edgepress 2026.9.6 → 2026.9.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edgepress",
-  "version": "2026.9.6",
+  "version": "2026.9.8",
   "description": "A static website builder for Cloudflare Workers with editable pages, Markdown posts, local search, themes, and consent-gated integrations.",
   "type": "module",
   "bin": {
@@ -17,8 +17,7 @@
     "edgepress.config.mjs",
     "project-compatibility.json",
     "wrangler.jsonc",
-    "README.md",
-    "CHANGELOG.txt"
+    "README.md"
   ],
   "repository": {
     "type": "git",

package/plugins/consent/index.js

@@ -21,7 +21,9 @@ export default function consentManager(api) {
     const ui = Object.fromEntries([
       'privacySettings', 'privacyNotice', 'privacyIntro', 'acceptOptional', 'rejectOptional',
       'savePreferences', 'optionalServices', 'noIntegrations', 'privacyPolicy', 'privacyController',
-      'servicePurpose', 'serviceRetention', 'consentReload', 'closePrivacy'
+      'servicePurpose', 'serviceDataCategories', 'serviceRecipient', 'serviceRetention', 'consentReload',
+      'closePrivacy', 'reviewDetails', 'managePrivacy', 'essentialStorage', 'pluginTracking',
+      'pluginStatistics', 'pluginAdvertising', 'pluginCaptcha'
     ].map((key) => [key, translate(config, locale, key)]));
     const services = ['tracking', 'statistics', 'advertising', 'captcha'].flatMap((group) =>
       config.browserPlugins[group].enabled ? config.browserPlugins[group].services.map((service) => ({ ...service, category: group })) : []
@@ -32,7 +34,7 @@ export default function consentManager(api) {
       integrations: services
     };
     if (privacy.policyUrl.startsWith('/')) privacy.policyUrl = localizedUrl(config, locale, privacy.policyUrl);
-    const payload = safeJson({ privacy, ui, siteLanguage: locale });
+    const payload = safeJson({ privacy, ui, siteLanguage: locale, defaultLocale: config.i18n.defaultLocale });
     const integration = '<script type="application/json" id="edgepress-privacy-config">' + payload + '</script>' +
       '<script src="/edgepress/plugins/consent/manager.js" defer></script>';
     return html.replace(/<\/body\s*>/i, integration + '</body>');

package/project-compatibility.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "frameworkVersion": "2026.9.6",
+  "frameworkVersion": "2026.9.8",
   "requirements": {
     "nodeMajor": 22,
     "nodeMinimumVersion": "22.12.0",
@@ -27,7 +27,11 @@
     { "name": "PDF-only audit output and temporary screenshot capture", "stage": "experimental", "since": "2026.9.4" },
     { "name": "Cloudflare one-click deployment guidance for existing and new projects", "stage": "stable", "since": "2026.9.5" },
     { "name": "Localized Posts navigation and responsive code copy controls", "stage": "experimental", "since": "2026.9.6" },
-    { "name": "Linked tables of contents on Markdown post pages", "stage": "experimental", "since": "2026.9.6" }
+    { "name": "Linked tables of contents on Markdown post pages", "stage": "experimental", "since": "2026.9.6" },
+    { "name": "Consent-nested browser services and generated privacy disclosures", "stage": "experimental", "since": "2026.9.7" },
+    { "name": "Responsive homepage imagery and chronological all-post archives", "stage": "experimental", "since": "2026.9.7" },
+    { "name": "Date-versioned localized consent disclosures with isolated responsive checks", "stage": "experimental", "since": "2026.9.8" },
+    { "name": "Markdown video syntax and locale-deduplicated chronological post lists", "stage": "experimental", "since": "2026.9.8" }
   ],
   "releaseHistory": [
     {
@@ -64,7 +68,19 @@
       "version": "2026.9.6",
       "date": "2026-09-25",
       "request": 6,
-      "notes": "Add a localized Posts link, accessible code-copy controls, responsive command wrapping, and linked post contents; refresh the bundled theme palettes and set the canonical site URL and author metadata."
+      "notes": "Add a localized Posts link, accessible code-copy controls, responsive command wrapping, linked post contents, and refreshed bundled theme palettes."
+    },
+    {
+      "version": "2026.9.7",
+      "date": "2026-09-26",
+      "request": 7,
+      "notes": "Add consent-gated Cloudflare Web Analytics and configuration-generated privacy disclosures; optimize responsive homepage imagery and all-post archive ordering; improve Markdown excerpts and mobile consent controls; remove obsolete report cleanup code."
+    },
+    {
+      "version": "2026.9.8",
+      "date": "2026-09-26",
+      "request": 8,
+      "notes": "Replace consent version counters with proposed and effective dates; localize service data disclosures; audit the consent component independently from page layout; add Markdown video rendering; fix unique localized archive ordering and Markdown excerpts."
     }
   ]
 }

package/src/build.js

@@ -4,14 +4,15 @@ import { dirname, relative, resolve, sep } from 'node:path';
 import { hostname } from 'node:os';
 import { mapLimit } from './concurrency.js';
 import { loadConfig } from './config.js';
-import { readDocuments } from './content.js';
+import { readDocuments, sortPostsNewest } from './content.js';
+import { plainText } from './markdown.js';
 import { createExtensions } from './plugin-api.js';
 import { collectAssets, rewriteAssetLinks, writeAssets } from './assets.js';
 import { loadLanguagePacks } from './i18n.js';
 import { generateBuiltinRoutes } from './generators.js';
 
 const RENDER_CACHE_VERSION = 3;
-const MARKDOWN_SECURITY_POLICY_VERSION = 3;
+const MARKDOWN_SECURITY_POLICY_VERSION = 4;
 
 async function readCache(file) {
   try {
@@ -222,7 +223,7 @@ export async function buildSite(root = process.cwd(), options = {}) {
       if (typeof html !== 'string') throw new Error('Markdown renderers must return HTML strings for ' + document.file);
       if (renderer.cacheable) nextCache[signature] = html;
       const rendered = { ...document, html };
-      rendered.description = rendered.description || rendered.markdown.replace(/\s+/g, ' ').slice(0, 180);
+      rendered.description = rendered.description || plainText(rendered.markdown).slice(0, 180);
       return rendered;
     });
 
@@ -230,7 +231,7 @@ export async function buildSite(root = process.cwd(), options = {}) {
     const visible = documents.filter((document) => !document.draft && publishedByLocalDate(document, now));
     let site = {
       config,
-      posts: visible.filter((document) => document.kind === 'posts').sort((a, b) => b.date - a.date),
+      posts: sortPostsNewest(visible.filter((document) => document.kind === 'posts')),
       pages: visible.filter((document) => document.kind === 'pages')
     };
     site = await extensions.filter('content:rendered', site, { config });

package/src/cli.js

@@ -292,17 +292,7 @@ async function clean(config) {
     try {
       const info = await lstat(toolsDirectory);
       if (info.isSymbolicLink() || !info.isDirectory()) throw new Error('Refusing to clean reports through an unsafe tools path: ' + toolsDirectory);
-      for (const name of ['page-check.json', 'page-check.md', 'page-check.pdf', 'page-check-visual.html']) {
-        await rm(resolve(toolsDirectory, name), { force: true });
-      }
-      const screenshots = resolve(toolsDirectory, 'page-check-screenshots');
-      try {
-        const screenshotsInfo = await lstat(screenshots);
-        if (screenshotsInfo.isSymbolicLink() || !screenshotsInfo.isDirectory()) throw new Error('Refusing to clean an unsafe screenshot path: ' + screenshots);
-        await rm(screenshots, { recursive: true, force: true });
-      } catch (error) {
-        if (error.code !== 'ENOENT') throw error;
-      }
+      await rm(resolve(toolsDirectory, 'page-check.pdf'), { force: true });
     } catch (error) {
       if (error.code !== 'ENOENT') throw error;
     }

package/src/config.js

@@ -20,7 +20,7 @@ const defaults = {
     policyUrl: '/privacy-policy/'
   },
   browserPlugins: {
-    consent: { enabled: true, version: '1', expiresDays: 180 },
+    consent: { enabled: true, proposedDate: '', effectiveDate: '', expiresDays: 180 },
     tracking: { enabled: true, services: [] },
     statistics: { enabled: true, services: [] },
     advertising: { enabled: true, services: [] },
@@ -51,6 +51,31 @@ function assertString(value, label) {
   if (typeof value !== 'string' || !value.trim()) throw new Error(label + ' must be a non-empty string');
 }
 
+function isDateOnly(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const date = new Date(value + 'T00:00:00.000Z');
+  return !Number.isNaN(date.valueOf()) && date.toISOString().slice(0, 10) === value;
+}
+
+function validateLocalizedServiceText(value, label, maxLength, locales) {
+  if (typeof value === 'string') {
+    if (!value.trim() || value.length > maxLength) throw new Error(label + ' must be a non-empty string of at most ' + maxLength + ' characters');
+    return;
+  }
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(label + ' must be a string or a locale-to-string map');
+  }
+  for (const [locale, text] of Object.entries(value)) {
+    if (!locales.includes(locale)) throw new Error(label + ' uses unsupported locale ' + locale);
+    if (typeof text !== 'string' || !text.trim() || text.length > maxLength) {
+      throw new Error(label + '.' + locale + ' must be a non-empty string of at most ' + maxLength + ' characters');
+    }
+  }
+  for (const locale of locales) if (!Object.prototype.hasOwnProperty.call(value, locale)) {
+    throw new Error(label + ' needs a translation for every configured locale, including ' + locale);
+  }
+}
+
 const integrationProviders = {
   'google-tag-manager': { group: 'tracking', credential: 'containerId', pattern: /^GTM-[A-Z0-9]{4,20}$/i },
   'meta-pixel': { group: 'tracking', credential: 'pixelId', pattern: /^[0-9]{6,20}$/ },
@@ -169,6 +194,29 @@ function validatePrivacyConfig(config) {
   if (!validPolicyUrl || /[\x00-\x20]/.test(policyUrl)) throw new Error('privacy.policyUrl must be a safe site path or HTTP URL');
 }
 
+function normalizeBrowserPlugins(value) {
+  if (value === undefined) return {};
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('config.yml plugins must be an object');
+  for (const key of Object.keys(value)) {
+    if (key !== 'consent') {
+      throw new Error('Unsupported plugin configuration group: ' + key + '; place browser services under plugins.consent.' + key);
+    }
+  }
+  if (value.consent === undefined) return {};
+  const input = value.consent;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('plugins.consent must be an object');
+  const consent = {};
+  const normalized = {};
+  const groups = ['tracking', 'statistics', 'advertising', 'captcha'];
+  for (const [key, section] of Object.entries(input)) {
+    if (groups.includes(key)) normalized[key] = section;
+    else if (['enabled', 'proposedDate', 'effectiveDate', 'expiresDays'].includes(key)) consent[key] = section;
+    else throw new Error('Unsupported plugins.consent option: ' + key);
+  }
+  normalized.consent = consent;
+  return normalized;
+}
+
 function validateBrowserPlugins(config) {
   const plugins = config.browserPlugins;
   const allowedGroups = ['consent', 'tracking', 'statistics', 'advertising', 'captcha'];
@@ -176,33 +224,43 @@ function validateBrowserPlugins(config) {
   for (const key of Object.keys(plugins)) if (!allowedGroups.includes(key)) throw new Error('Unsupported plugin configuration group: ' + key);
   const consent = plugins.consent;
   if (!consent || typeof consent !== 'object' || Array.isArray(consent) || typeof consent.enabled !== 'boolean' ||
-      typeof consent.version !== 'string' || !consent.version.trim() || !Number.isInteger(consent.expiresDays) ||
+      !isDateOnly(consent.proposedDate) ||
+      (consent.effectiveDate !== '' && consent.effectiveDate !== undefined && !isDateOnly(consent.effectiveDate)) ||
+      !Number.isInteger(consent.expiresDays) ||
       consent.expiresDays < 1 || consent.expiresDays > 730) {
-    throw new Error('plugins.consent needs enabled, version, and expiresDays from 1 to 730');
+    throw new Error('plugins.consent needs enabled, a YYYY-MM-DD proposedDate, an optional YYYY-MM-DD effectiveDate, and expiresDays from 1 to 730');
   }
-  for (const key of Object.keys(consent)) if (!['enabled', 'version', 'expiresDays'].includes(key)) {
+  if (consent.effectiveDate && consent.effectiveDate < consent.proposedDate) {
+    throw new Error('plugins.consent.effectiveDate cannot be earlier than proposedDate');
+  }
+  for (const key of Object.keys(consent)) if (!['enabled', 'proposedDate', 'effectiveDate', 'expiresDays'].includes(key)) {
     throw new Error('Unsupported plugins.consent option: ' + key);
   }
   const ids = new Set();
   let servicesCount = 0;
   for (const group of ['tracking', 'statistics', 'advertising', 'captcha']) {
+    const groupPath = 'plugins.consent.' + group;
     const section = plugins[group];
     if (!section || typeof section !== 'object' || Array.isArray(section) || typeof section.enabled !== 'boolean' || !Array.isArray(section.services)) {
-      throw new Error('plugins.' + group + ' needs enabled and a services array');
+      throw new Error(groupPath + ' needs enabled and a services array');
     }
-    for (const key of Object.keys(section)) if (!['enabled', 'services'].includes(key)) throw new Error('Unsupported plugins.' + group + ' option: ' + key);
-    if (!section.enabled && section.services.length) throw new Error('Clear plugins.' + group + '.services or enable the plugin group');
+    for (const key of Object.keys(section)) if (!['enabled', 'services'].includes(key)) throw new Error('Unsupported ' + groupPath + ' option: ' + key);
+    if (!section.enabled && section.services.length) throw new Error('Clear ' + groupPath + '.services or enable the plugin group');
     servicesCount += section.services.length;
     for (const service of section.services) {
-      if (!service || typeof service !== 'object' || Array.isArray(service)) throw new Error('Each plugins.' + group + '.services item must be an object');
+      if (!service || typeof service !== 'object' || Array.isArray(service)) throw new Error('Each ' + groupPath + '.services item must be an object');
       const { id, provider, purpose } = service;
       if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{1,63}$/.test(id) || ids.has(id)) throw new Error('Each configured service needs a unique lowercase id');
       ids.add(id);
       const definition = integrationProviders[provider];
-      if (!definition || definition.group !== group) throw new Error('Unsupported provider for plugins.' + group + ': ' + provider);
-      if (typeof purpose !== 'string' || !purpose.trim() || purpose.length > 500) throw new Error('Service ' + id + ' needs a short purpose description');
-      if (typeof service.retention !== 'string' || !service.retention.trim() || service.retention.length > 300) throw new Error('Service ' + id + ' needs a retention description');
-      const allowedKeys = new Set(['id', 'provider', 'purpose', 'retention', definition.credential]);
+      if (!definition || definition.group !== group) throw new Error('Unsupported provider for ' + groupPath + ': ' + provider);
+      const locales = config.i18n.locales;
+      validateLocalizedServiceText(service.name || provider, 'Service ' + id + '.name', 120, locales);
+      validateLocalizedServiceText(purpose, 'Service ' + id + '.purpose', 500, locales);
+      validateLocalizedServiceText(service.dataCategories, 'Service ' + id + '.dataCategories', 600, locales);
+      validateLocalizedServiceText(service.recipient, 'Service ' + id + '.recipient', 200, locales);
+      validateLocalizedServiceText(service.retention, 'Service ' + id + '.retention', 300, locales);
+      const allowedKeys = new Set(['id', 'provider', 'name', 'purpose', 'dataCategories', 'recipient', 'retention', definition.credential]);
       for (const key of Object.keys(service)) if (!allowedKeys.has(key)) throw new Error('Unsupported option for service ' + id + ': ' + key);
       const credential = service[definition.credential];
       if (typeof credential !== 'string' || !definition.pattern.test(credential)) throw new Error('Service ' + id + ' needs a valid public ' + definition.credential);
@@ -287,14 +345,13 @@ export async function loadConfig(root = process.cwd()) {
   }
   config.site = merge(config.site, siteYaml.site);
   config.privacy = merge(config.privacy, siteYaml.privacy);
-  config.browserPlugins = merge(config.browserPlugins, siteYaml.plugins);
+  config.browserPlugins = merge(config.browserPlugins, normalizeBrowserPlugins(siteYaml.plugins));
   assertString(config.site.title, 'site.title');
   assertString(config.site.language, 'site.language');
   if (!isCanonicalLocale(config.site.language)) throw new Error('site.language must be a valid canonical language tag');
   if (typeof config.site.description !== 'string') throw new Error('site.description must be a string');
   validateSiteConfig(config);
   validatePrivacyConfig(config);
-  validateBrowserPlugins(config);
   if (typeof config.markdown.gfm !== 'boolean' || typeof config.markdown.breaks !== 'boolean') {
     throw new Error('markdown.gfm and markdown.breaks must be booleans');
   }
@@ -329,6 +386,7 @@ export async function loadConfig(root = process.cwd()) {
     throw new Error('i18n.languagePacks must not contain duplicates');
   }
   config.i18n.locales = [config.i18n.defaultLocale, ...config.i18n.languagePacks];
+  validateBrowserPlugins(config);
 
   const siteUrl = String(config.site.url ?? '').trim();
   if (siteUrl) {

package/src/content.js

@@ -3,6 +3,27 @@ import { basename, dirname, extname, relative, resolve, sep } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { mapLimit } from './concurrency.js';
 
+export function sortPostsNewest(posts) {
+  return [...posts].sort((left, right) => {
+    const dateOrder = right.date - left.date;
+    if (dateOrder) return dateOrder;
+    const leftPath = String(left.path);
+    const rightPath = String(right.path);
+    return rightPath.localeCompare(leftPath, undefined, { numeric: true, sensitivity: 'base' });
+  });
+}
+
+export function postsForLocale(posts, locale, defaultLocale) {
+  const byBundle = new Map();
+  for (const post of posts) {
+    const current = byBundle.get(post.bundlePath);
+    if (!current || post.locale === locale || (current.locale !== locale && post.locale === defaultLocale)) {
+      byBundle.set(post.bundlePath, post);
+    }
+  }
+  return sortPostsNewest([...byBundle.values()]);
+}
+
 async function walkMarkdown(directory) {
   let entries;
   try {
@@ -174,7 +195,7 @@ export async function readDocuments(config) {
     }
     if (locale !== config.i18n.defaultLocale && metadata.homepage !== true) path = locale + '/' + path;
     return {
-      kind, file, relativePath, title, slug, date, locale,
+      kind, file, relativePath, bundlePath, title, slug, date, locale,
       author: kind === 'posts' ? normalizeAuthor(metadata.author, file) : '',
       videoId: (kind === 'posts' ? 'post-' : 'page-') + slugify(bundlePath + '-' + locale.toLowerCase()),
       video: kind === 'posts' ? normalizeVideo(metadata.video, file) : null,

package/src/generators.js

@@ -1,8 +1,8 @@
-import { plainText } from './markdown.js';
+import { plainText, renderMarkdownExcerpt } from './markdown.js';
 import { renderBlocks } from './page-blocks.js';
 import { renderLayout } from './theme.js';
 import { localizedUrl, translate } from './i18n.js';
-import { slugify } from './content.js';
+import { postsForLocale, slugify, sortPostsNewest } from './content.js';
 import { mapLimit } from './concurrency.js';
 
 function escapeHtml(value) {
@@ -120,12 +120,13 @@ function renderPostAuthor(post, locale, config) {
   return '<span class="post-author">' + escapeHtml(translate(config, locale, 'postAuthor').replace('{author}', post.author)) + '</span>';
 }
 
-function renderPostCard(post, locale, config) {
-  const summary = post.description || plainText(post.markdown).slice(0, 220);
-  return '<article class="post-card"><h2><a href="' + escapeHtml(urlFor(post.path)) + '">' + escapeHtml(post.title) + '</a></h2>' +
-    '<p class="meta"><time datetime="' + post.date.toISOString() + '">' + escapeHtml(dateLabel(post.date, locale)) + '</time>' +
-    (post.author ? ' · ' + renderPostAuthor(post, locale, config) : '') + '</p><p>' +
-    escapeHtml(summary) + '</p></article>';
+async function renderPostCard(post, locale, config, showLanguage = false) {
+  const summary = await renderMarkdownExcerpt(post.description || post.markdown, config.markdown);
+  return '<article class="post-card" lang="' + escapeHtml(post.locale) + '"><h2><a href="' + escapeHtml(urlFor(post.path)) + '">' + escapeHtml(post.title) + '</a></h2>' +
+    '<p class="meta"><time datetime="' + post.date.toISOString() + '">' + escapeHtml(dateLabel(post.date, post.locale)) + '</time>' +
+    (showLanguage ? ' · <span class="post-language" lang="' + escapeHtml(post.locale) + '">' + escapeHtml(post.locale) + '</span>' : '') +
+    (post.author ? ' · ' + renderPostAuthor(post, locale, config) : '') + '</p><div class="post-excerpt" lang="' + escapeHtml(post.locale) + '">' +
+    summary + '</div></article>';
 }
 
 async function pageBodyForDocument(page, site, config, locale, isHomepage = false, renderContext = {}) {
@@ -168,16 +169,17 @@ export async function generateBuiltinRoutes(site, config, extensions) {
     homepageLocales.add(page.locale);
   }
 
+  const allPosts = sortPostsNewest(site.posts);
   for (const locale of config.i18n.locales) {
-    const posts = site.posts.filter((post) => post.locale === locale).sort((a, b) => b.date - a.date);
+    const posts = allPosts.filter((post) => post.locale === locale);
+    const archivePosts = postsForLocale(allPosts, locale, defaultLocale);
     const pages = site.pages.filter((page) => page.locale === locale && !page.homepage);
     const homePage = homepageDocument(site.pages, locale, defaultLocale);
     const latestPostsPageSize = paginatedLatestPostsSize(homePage);
     if (latestPostsPageSize !== null && (!Number.isInteger(latestPostsPageSize) || latestPostsPageSize < 1 || latestPostsPageSize > 12)) {
       throw new Error('A paginated latest-posts block must use a count from 1 to 12');
     }
-    const homepagePosts = posts.length ? posts : site.posts.filter((post) => post.locale === defaultLocale).sort((a, b) => b.date - a.date);
-    const homepageArchivePages = latestPostsPageSize ? Math.ceil(homepagePosts.length / latestPostsPageSize) : 0;
+    const homepageArchivePages = latestPostsPageSize ? Math.ceil(archivePosts.length / latestPostsPageSize) : 0;
     const prefix = locale === defaultLocale ? '' : locale + '/';
     const label = (key) => translate(config, locale, key);
     const localeHomeUrl = localizedUrl(config, locale, '');
@@ -205,12 +207,13 @@ export async function generateBuiltinRoutes(site, config, extensions) {
           }
         }));
     } else {
-      const totalPages = Math.max(1, Math.ceil(posts.length / config.pagination.perPage));
+      const totalPages = Math.max(1, Math.ceil(archivePosts.length / config.pagination.perPage));
       for (let pageNumber = 1; pageNumber <= totalPages; pageNumber += 1) {
-        const subset = posts.slice((pageNumber - 1) * config.pagination.perPage, pageNumber * config.pagination.perPage);
+        const subset = archivePosts.slice((pageNumber - 1) * config.pagination.perPage, pageNumber * config.pagination.perPage);
+        const cards = await Promise.all(subset.map((post) => renderPostCard(post, locale, config, true)));
         const body = '<section class="intro"><h1>' + escapeHtml(config.site.title) + '</h1><p>' + escapeHtml(config.site.description) +
           '</p></section><section class="post-list" aria-label="' + escapeHtml(label('latestPosts')) + '">' +
-          (subset.length ? subset.map((post) => renderPostCard(post, locale, config)).join('') : '<p>' + escapeHtml(label('noPosts')) + '</p>') +
+          (cards.length ? cards.join('') : '<p>' + escapeHtml(label('noPosts')) + '</p>') +
           '</section>' + (pageNumber === 1 && pages.length ? '<section class="page-links"><h2>' + escapeHtml(label('pages')) + '</h2><ul>' +
             pages.map((page) => '<li><a href="' + escapeHtml(urlFor(page.path)) + '">' + escapeHtml(page.title) + '</a></li>').join('') + '</ul></section>' : '') +
           (totalPages > 1 ? '<nav class="pagination" aria-label="' + escapeHtml(label('pagination')) + '">' +
@@ -258,9 +261,10 @@ export async function generateBuiltinRoutes(site, config, extensions) {
 
     if (!homePage) allPagePaths.add(localizedUrl(config, locale, ''));
     const archivePageSize = latestPostsPageSize || config.pagination.perPage;
-    const archivePageCount = Math.max(1, Math.ceil(posts.length / archivePageSize));
+    const archivePageCount = Math.max(1, Math.ceil(archivePosts.length / archivePageSize));
     for (let pageNumber = 1; pageNumber <= archivePageCount; pageNumber += 1) {
-      const subset = posts.slice((pageNumber - 1) * archivePageSize, pageNumber * archivePageSize);
+      const subset = archivePosts.slice((pageNumber - 1) * archivePageSize, pageNumber * archivePageSize);
+      const cards = await Promise.all(subset.map((post) => renderPostCard(post, locale, config, true)));
       const archiveUrl = pageNumber === 1 ? 'archives/' : 'archives/page/' + pageNumber + '/';
       const pagination = archivePageCount > 1
         ? '<nav class="pagination" aria-label="' + escapeHtml(label('pagination')) + '">' +
@@ -269,7 +273,7 @@ export async function generateBuiltinRoutes(site, config, extensions) {
           (pageNumber < archivePageCount ? '<a rel="next" href="' + escapeHtml(localizedUrl(config, locale, 'archives/page/' + (pageNumber + 1) + '/')) + '">' +
             escapeHtml(label('older')) + '</a>' : '') + '</nav>' : '';
       const archiveBody = '<section><h1>' + escapeHtml(label('archives')) + '</h1>' +
-        (subset.length ? subset.map((post) => renderPostCard(post, locale, config)).join('') : '<p>' + escapeHtml(label('noPosts')) + '</p>') + pagination + '</section>';
+        (cards.length ? cards.join('') : '<p>' + escapeHtml(label('noPosts')) + '</p>') + pagination + '</section>';
       routes.push(await pageRoute(prefix + (pageNumber === 1 ? 'archives/index.html' : 'archives/page/' + pageNumber + '/index.html'),
         pageNumber === 1 ? label('archives') : label('archives') + ' · ' + pageNumber, label('allPosts'), archiveBody, locale, config, extensions,
         { urlPath: localizedUrl(config, locale, archiveUrl) }));
@@ -283,15 +287,16 @@ export async function generateBuiltinRoutes(site, config, extensions) {
       tags.get(slug).posts.push(post);
     }
     const tagRoutes = await mapLimit([...tags.entries()], config.concurrency, async ([slug, value]) => {
+      const cards = await Promise.all(value.posts.map((post) => renderPostCard(post, locale, config)));
       const body = '<section><h1>' + escapeHtml(label('tag')) + ': ' + escapeHtml(value.label) + '</h1>' +
-        value.posts.map((post) => renderPostCard(post, locale, config)).join('') + '</section>';
+        cards.join('') + '</section>';
       return pageRoute(prefix + 'tags/' + slug + '/index.html', label('tag') + ': ' + value.label,
         label('tag') + ' ' + value.label, body, locale, config, extensions);
     });
     routes.push(...tagRoutes);
 
     const searchable = [
-      ...posts.map((post) => ({ title: post.title, author: post.author, date: post.date.toISOString(), url: urlFor(post.path), summary: post.description || plainText(post.markdown).slice(0, 220), content: plainText(post.markdown), type: 'post' })),
+      ...posts.map((post) => ({ title: post.title, author: post.author, date: post.date.toISOString(), url: urlFor(post.path), summary: plainText(post.description || post.markdown).slice(0, 220), content: plainText(post.markdown), type: 'post' })),
       ...pages.map((page) => ({ title: page.title, url: urlFor(page.path), summary: page.description || plainText(page.markdown).slice(0, 220), type: 'page' }))
     ];
     routes.push(fileRoute(prefix + 'search.json', JSON.stringify(searchable), 'application/json; charset=utf-8'));
@@ -312,7 +317,7 @@ export async function generateBuiltinRoutes(site, config, extensions) {
     const entries = posts.slice(0, 20).map((post) => '<entry><title>' + escapeXml(post.title) + '</title>' +
       (post.author ? '<author><name>' + escapeXml(post.author) + '</name></author>' : '') + '<link href="' +
       escapeXml(base + urlFor(post.path)) + '"/><id>' + escapeXml(base + urlFor(post.path)) + '</id><updated>' + post.date.toISOString() +
-      '</updated><summary>' + escapeXml(post.description || plainText(post.markdown).slice(0, 220)) + '</summary></entry>').join('');
+      '</updated><summary>' + escapeXml(plainText(post.description || post.markdown).slice(0, 220)) + '</summary></entry>').join('');
     routes.push(fileRoute(prefix + 'feed.xml', '<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom"><title>' +
       escapeXml(config.site.title) + '</title><id>' + escapeXml(base || 'urn:edgepress:site') + '</id><updated>' +
       (posts[0]?.date.toISOString() || new Date(0).toISOString()) + '</updated>' + entries + '</feed>', 'application/atom+xml; charset=utf-8'));

package/src/i18n.js

@@ -53,6 +53,12 @@ export function translate(config, locale, key) {
   return selected?.[key] ?? base?.[key] ?? key;
 }
 
+export function translateValue(config, locale, value) {
+  if (typeof value === 'string') return value;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return '';
+  return value[locale] ?? value[config.i18n.defaultLocale] ?? Object.values(value).find((text) => typeof text === 'string') ?? '';
+}
+
 export function localePrefix(config, locale) {
   return locale === config.i18n.defaultLocale ? '' : '/' + locale;
 }

package/src/markdown.js

@@ -7,9 +7,9 @@ const allowedTags = [
   'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2',
   'h3', 'h4', 'h5', 'h6', 'header', 'hr', 'i', 'img', 'kbd', 'li', 'main',
   'mark', 'nav', 'ol', 'p', 'pre', 'q', 'rp', 'rt', 'rtc', 'ruby', 's',
-  'samp', 'section', 'small', 'span', 'strong', 'sub', 'summary', 'sup',
-  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'u', 'ul',
-  'var', 'wbr'
+  'samp', 'section', 'small', 'source', 'span', 'strong', 'sub', 'summary', 'sup',
+  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'track', 'tr', 'u', 'ul',
+  'var', 'video', 'wbr'
 ];
 
 const sanitizeOptions = {
@@ -20,9 +20,12 @@ const sanitizeOptions = {
     img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
     li: ['value'],
     ol: ['start'],
+    source: ['src', 'type'],
     span: ['class', 'role', 'aria-label'],
     td: ['align', 'colspan', 'rowspan'],
-    th: ['align', 'colspan', 'rowspan']
+    th: ['align', 'colspan', 'rowspan'],
+    track: ['kind', 'src', 'srclang', 'label', 'default'],
+    video: ['aria-label', 'controls', 'playsinline', 'poster', 'preload', 'width', 'height']
   },
   allowedSchemes: ['http', 'https', 'mailto', 'tel'],
   allowProtocolRelative: false,
@@ -35,10 +38,59 @@ const sanitizeOptions = {
   }
 };
 
+function videoMimeType(href) {
+  const path = String(href ?? '').split(/[?#]/, 1)[0].toLowerCase();
+  const extension = path.match(/\.(mp4|webm|ogv|ogg)$/)?.[1];
+  return ({ mp4: 'video/mp4', webm: 'video/webm', ogv: 'video/ogg', ogg: 'video/ogg' })[extension] || '';
+}
+
+function safeVideoHref(value) {
+  const href = String(value ?? '').trim();
+  if (!href || /[\x00-\x20\\]/.test(href) || href.startsWith('//')) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  if (href.startsWith('/')) return href;
+  let url;
+  try { url = new URL(href, 'https://edgepress.invalid'); }
+  catch { throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs'); }
+  if (url.username || url.password || !['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  return href;
+}
+
+function escapeHtml(value) {
+  return String(value ?? '').replace(/[&<>"']/g, (char) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+  })[char]);
+}
+
+function markdownRenderer(options) {
+  const renderer = new marked.Renderer();
+  const renderImage = renderer.image.bind(renderer);
+  renderer.image = (token) => {
+    const mimeType = videoMimeType(token.href);
+    if (mimeType) {
+      const description = String(token.text ?? '').trim();
+      if (!description) throw new Error('Markdown videos need descriptive alternative text');
+      const href = escapeHtml(safeVideoHref(token.href));
+      if (options.allowVideo === false) return '<span>' + escapeHtml(description) + '</span>';
+      const caption = token.title ? '<figcaption>' + escapeHtml(token.title) + '</figcaption>' : '';
+      return '<figure class="markdown-video"><video controls playsinline preload="none" aria-label="' +
+        escapeHtml(description) + '"><source src="' + href + '" type="' + mimeType + '"><a href="' + href + '">' +
+        escapeHtml(description) + '</a></video>' + caption + '</figure>';
+    }
+    if (options.allowImages === false) return '<span>' + escapeHtml(token.text || '') + '</span>';
+    return renderImage(token);
+  };
+  return renderer;
+}
+
 export async function renderMarkdown(source, options = {}) {
   let html = await marked.parse(source, {
     gfm: options.gfm !== false,
-    breaks: options.breaks === true
+    breaks: options.breaks === true,
+    renderer: markdownRenderer(options)
   });
   // GFM task markers become named static status icons. They remain readable to
   // assistive technology without exposing disabled, unlabeled form controls.
@@ -55,11 +107,38 @@ export async function renderMarkdown(source, options = {}) {
   return sanitizeHtml(html, sanitizeOptions);
 }
 
+export async function renderMarkdownExcerpt(source, options = {}) {
+  const markdown = String(source ?? '');
+  const tokens = marked.lexer(markdown, { gfm: options.gfm !== false });
+  const paragraph = tokens.find((token) => token.type === 'paragraph');
+  if (!paragraph) return '<p>' + escapeHtml(plainText(markdown).slice(0, 220)) + '</p>';
+  return renderMarkdown(paragraph.raw, { ...options, allowImages: false, allowVideo: false });
+}
+
 export function plainText(source) {
-  return String(source)
-    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
-    .replace(/[#>*_~|-]/g, ' ')
+  const html = marked.parse(String(source ?? ''), { gfm: true });
+  const namedEntities = {
+    amp: '&', apos: "'", copy: '©', gt: '>', hellip: '…', ldquo: '“', lsquo: '‘',
+    lt: '<', mdash: '—', nbsp: ' ', ndash: '–', quot: '"', rdquo: '”', rsquo: '’'
+  };
+  return String(html)
+    .replace(/<!--[\s\S]*?-->/g, ' ')
+    .replace(/<(script|style|textarea|option|xmp)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ')
+    .replace(/<img\b([^>]*)>/gi, (_match, attributes) => {
+      const alt = attributes.match(/\balt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i);
+      return alt ? ' ' + (alt[1] ?? alt[2] ?? alt[3]) + ' ' : ' ';
+    })
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&(#x[\da-f]+|#\d+|[a-z][a-z\d]+);/gi, (match, entity) => {
+      if (entity[0] === '#') {
+        const hex = entity[1]?.toLowerCase() === 'x';
+        const point = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
+        return Number.isInteger(point) && point > 0 && point <= 0x10ffff && !(point >= 0xd800 && point <= 0xdfff)
+          ? String.fromCodePoint(point)
+          : match;
+      }
+      return namedEntities[entity.toLowerCase()] ?? match;
+    })
     .replace(/\s+/g, ' ')
     .trim();
 }