Keep shared offline defaults and download optional fonts into a validated cache with reliable export fallbacks. Prune stale Android DOM assets and refresh the smaller iOS editor bundles.
Preserve lazy startup boundaries through direct shared exports and dependency-aware splitting. Add ESM graph and Chrome startup checks to prevent eager editor and font loading.
Use the native Play consent flow, track background downloads, and request confirmation before installation. Preserve manual Play and GitHub destinations when the native flow is unavailable, including older binaries without the SDK.
Validation: 20 update tests, root and mobile typechecks, Web build, Android Kotlin compilation, and signed release APK build passed. Real Play old-to-new installation verification remains incomplete and is deferred at the maintainer's request.
Docker instances reported most deployment fields as unknown. Report how
and when the container image was built, separately from how the
instance was deployed:
- Dockerfile: optional EDGE_EVER_BUILD_CREATED_AT, EDGE_EVER_BUILD_TRIGGER
and EDGE_EVER_BUILD_METHOD build args, empty by default.
- /api/health (self-hosted-bun only): optional buildCreatedAt and
buildProvenance. deploymentVersionCreatedAt and deployment keep their
meaning and stay runtime-supplied; Cloudflare responses are unchanged.
- docker-image.yml: official images record the build time and their
provenance. Draft-release builds dispatched with release_tag are
github_release, main pushes main_push, other dispatches manual.
The container test checks the health response for a metadata build
with runtime overrides and for a default self-build; the post-publish
audit checks the published image.
- Add an explicit `docker` deployment method. It is never inferred from
the runtime, and the registry source still comes only from
EDGE_EVER_CONTAINER_IMAGE.
- Web/desktop show "Image built at" and "Image build source" for Docker;
Android shows "Image built at". Older clients ignore the new fields.
- Document the build args and runtime variables in both Docker guides.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Opening a shared note on a phone meant copying the link to another
device. Add a collapsible "QR code" section to the note and notebook
share dialogs that renders the public link as a scannable code.
- Rendered with qrcode.react 4.2.0 (SVG, no dependencies), loaded with
the share dialogs only.
- Dark modules on a white panel in every theme so phone cameras can
read it; labelled for screen readers, no native title tooltip.
- Hidden for password-protected links, so the code never replaces the
password the recipient still has to receive separately.
- Copy in all four catalogs.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
* fix(web): show the localized label for untitled notes everywhere
Untitled notes are stored with the zh-CN default title, and several views
only replaced an empty title, so they showed 无标题笔记 in every locale.
The visible cases were the public share page (heading and browser tab),
the public notebook site, AI companion cards and mentions, the note link
picker, link text inserted for a note, and the title of a duplicated
note.
Add getMemoDisplayTitle() next to DEFAULT_MEMO_TITLE and use it in those
views, matching what MemoCard already does with isDefaultMemoTitle.
* fix(web): localize diagrams and content label on the public share page
The public share page passed zh-CN to read-only diagrams for every
language other than English, so Japanese and Polish visitors saw Chinese
diagram labels. Resolve the locale with resolveSupportedLocale(), which
the diagram renderer already supports for all four languages.
Also translate the note content aria-label, which was hard-coded in
English.
---------
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Public share and form pages only added a robots meta tag from JavaScript,
so the HTML for /share/* and /form/* was served without any indexing or
caching directive, and the form page had none at all. Error responses
from /api/public/* also lacked X-Robots-Tag.
Send one policy everywhere a token-bearing link is served:
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex
Cache-Control: private, no-store
Referrer-Policy: no-referrer
- /api/public/*: shared middleware in the application, so it applies on
Cloudflare and Docker, including 404/403 responses. Routes that already
set Cache-Control keep it.
- /share/* and /form/* HTML: _headers rules for Cloudflare static assets
and the self-hosted static server.
- Referrer-Policy keeps the share token out of Referer headers sent to
linked sites.
robots.txt is deliberately not used to block these paths: a disallowed
URL can still be indexed from external links, because crawlers never see
the noindex header.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
The README rewrite in d635c45f changed the "Build & Verify" step but left
the product site's manual deployment copy unchanged, so the
"product site deployment prompts mirror the root READMEs" regression test
fails on main and on every open PR.
tianma-if