Getting-Started: document GH Packages mirror + provenance attestation The v4.0.0 release added a GitHub Packages mirror at @d0n9x1n/hexo-blog-encrypt and switched npmjs publish to OIDC trusted publishing with --provenance. This page now mentions both: - A note that every release since v4.0.0 ships with a signed npm provenance statement that 'npm audit signatures' will verify. - An optional 'Install from GitHub Packages' subsection covering the scoped name + the .npmrc snippet for read:packages auth, with a clear note that npmjs.com is still the canonical install path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot committed May 4, 2026

Build comprehensive v4 wiki 11 pages: Home, Getting-Started, Configuration-Reference, Themes, Callbacks-and-MathJax, Tag-Based-Encryption, Migration-v3-to-v4, Security-Model, Browser-Support, FAQ, Troubleshooting. Plus _Sidebar for navigation. All internal cross-links resolve. All external links to the live demo + repo + npm verified. Source-of-truth for defaults/config is src/server/config.js#DEFAULTS. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot committed May 3, 2026