orangeCMS 1.1.0 — OAuth and static publication fixes

CMS source release. Agent plugin remains at 1.3.0.

Changes since plugin-v1.3.0 (2026-10-17).

Fixed

• OAuth consent submission: keep the consent page's referrer policy at
  same-origin, preventing browsers from sending an opaque origin that SvelteKit
  rejects as a cross-site POST when the administrator clicks Connect.
  (#6)
• OAuth callback redirects: allow the validated client's callback origin (or
  native application scheme) in the consent page's CSP form-action. Connect and
  Cancel can now redirect to the client; a first click no longer silently consumes
  consent and leaves a second click failing as already used.
  (#8)
• OAuth failure explanations: show the library's escaped rejection reason to
  the signed-in administrator and log rejected or failed consent requests, making
  expired, reused, browser-unbound, or otherwise invalid requests diagnosable.
  (#7)
• Static publication: capture anonymous SvelteKit navigation data even when
  the framework marks it private, no-store. HTML validation remains strict;
  navigation responses with load errors are rejected and a failed export preserves
  the previous approved snapshot. Added unit and compiled Worker smoke coverage.
  (47c381b)

Runtime and dependencies

• Upgrade prerequisite: Node.js 26.12.1 or newer within the 26.x line is
  now required, replacing the previous Node.js 22.17+ requirement. The repository
  pins 26.12.1 and enforces the supported range through package engines, strict
  engine checks, and a preinstall check. This change addresses CVE-2026-111497.
  Upgrade local and CI Node runtimes before installing dependencies; use pnpm
  12 or newer (the repository pins 12.4.1).
  (#3)
• Updated Vite from 8.3.2 to 8.3.3 and refreshed the dependency lockfile.
  (#4)

Upgrade and validation

• Update the CMS source in each installation and build/deploy through that
  installation's existing deployment flow. Publishing this release does not
  deploy consumer sites. Static snapshots still require explicit publication.
• This release adds no database migrations. Preserve existing data, migration
  history, site configuration, and secrets when adopting the source changes.
• Agent plugin manifests and skills remain at 1.3.0; no new plugin ZIP is
  needed for these runtime fixes.
• The complete source CI suite passed on e5bc8155bc2b0b6efe9cf15cc2ba22e6c504b23d:
  public-source audit, unit tests, Svelte typechecking, production Worker smoke
  tests with local D1/KV, configurable-route fixtures, and plugin packaging.
  CI run.

Full source comparison

orangeCMS agent plugin 1.3.0

Adds setup and usage guidance for verified static publication, backend outage behavior, and Cloudflare cost controls. The package contains only the MIT license, plugin manifests, and agent skills; site configuration and credentials are connected separately.

KV-only file storage and agent plugin 1.2.0

Uploads now use optional FILES_KV with no R2 fallback. The source removes default R2 bindings while preserving /files URLs, upload validation and browser uploads. Workers Free KV quotas reject excess operations rather than charge overages; the actual account plan must be verified before activation.

An offline preparer validates backup sizes and SHA-256 hashes, rejects unsafe paths/overwrites, and limits encoded bulk payloads to80MiB. Existing live R2 objects, public endpoints and storage charges are NOT retired by this source change. Full live inventory, verified export and destination readback must precede explicit deletion approval.

Includes updated setup/content skills and MIT-licensed portable/Claude plugin package.
Installation: https://github.com/maxffarrell/orangeCMS/blob/main/docs/PLUGINS.md
Cost and retirement policy: https://github.com/maxffarrell/orangeCMS/blob/main/docs/COSTS.md

Validation:54unit tests, typecheck, compiled Worker upload/OAuth/D1/KV smoke tests and both configurable-route fixtures. All tests use isolated local provider emulators. No remote storage, billing or plans were changed.

orangeCMS plugin 1.1.1 — zero-cost setup policy

Agent setup guidance now requires verifying the deployment account uses Workers Free before enabling remote OAuth. Never upgrade plans or enable paid services during setup. If billing cannot be verified, leave OAuth unconfigured.

Cloudflare KV Free limits reject excess operations rather than charge overages. Existing R2 and other account products have separate pricing; this release does not claim an unverified Cloudflare account has no charges. No cloud resources were created, deployed, or enabled for this release.

Includes OAuth-aware setup/content skills, portable and Claude manifests, and the MIT license. Installation: https://github.com/maxffarrell/orangeCMS/blob/main/docs/PLUGINS.md
Cost policy: https://github.com/maxffarrell/orangeCMS/blob/main/docs/COSTS.md

Runtime OAuth implementation is unchanged from 1.1.0 and passed 45 unit tests, typecheck, compiled Worker/D1/KV smoke, both route fixtures, and remote CI. Plugin packaging tests and skill validation also pass.

orangeCMS OAuth and agent plugin 1.1.0

orangeCMS now supports per-installation OAuth 2.1 for remote MCP clients. Connect to /mcp/authorized, sign in through the site admin login, select read/edit and stay-connected permissions, and revoke access under Connected apps. Existing anonymous MCP and API tokens remain available.

Uses Cloudflare workers-oauth-provider with S256 PKCE, discovery, dynamic registration/CIMD, audience checks, short-lived access tokens, consent-controlled refresh and revocation. Each site needs its own OAUTH_KV binding and configured Cloudflare Access. Apply the additive audit migration before adopting this revision. No central orangeCMS account or service is required.

The plugin ZIP includes setup/content skills, portable and Claude manifests, and the MIT license. Installation: https://github.com/maxffarrell/orangeCMS/blob/main/docs/PLUGINS.md

Validation: 45 unit tests, typecheck, compiled Worker OAuth/D1/KV smoke tests, remapped/no-public-form route fixtures, and strict Claude manifest validation. Hosted client sign-in is not claimed as tested.

orangeCMS agent plugin 1.0.0

Installable orangeCMS agent skills for project setup and content management. Includes Claude Code and portable ChatGPT/Codex manifests, repository marketplaces, and an MIT-licensed minimal ZIP.

Installation: https://github.com/maxffarrell/orangeCMS/blob/main/docs/PLUGINS.md

Fresh installations now apply an empty initial schema; neutral starter content is an explicit optional seed. Tested with 40 unit tests, typechecking, compiled Worker smoke tests, configurable-route fixtures, and an isolated Claude plugin installation.

Installing the plugin adds skills; connect each site separately. Authenticated ChatGPT remote MCP requires an OAuth integration, which is not included in this release.