Bump package manifests, README badges, and logger/monitoring defaults
to 1.5.0 covering this cycle's user-facing changes:
- New POST /api/logout with CSRF guards (X-Requested-With + Origin +
Sec-Fetch-Site) and the sensitive rate-limit preset; frontend
logout() always clears local state (cache, OTP timers, secrets,
search) so users can sign out even when the server is unreachable
- Bulk import is now chunked into 100-item batches with a
pending_backup_hash trail so large imports stay within rate limits
and never lose backup coverage on partial failures
- Restore flow now accepts directly uploaded backup files
- P1 responsive refactor: mobile bottom-sheet modals, sort moved into
a search-row popover, FAB consolidated to bottom-right; theme and
PWA install entries relocated under Settings > Preferences
- Native confirm() replaced with a themed showConfirmDialog (focus
trap, ARIA, danger variant, re-entrancy guard); body-scroll lock
is reference-counted so stacked modals stop leaking the lock
Docs:
- API_REFERENCE.md gains the /api/logout endpoint in the public list,
endpoint table, dedicated section, and the rate-limiting matrix
- README.md / README_EN.md mention the Sign Out entry under Settings
Authorizing a cloud drive target now automatically enables it and starts
syncing, removing the extra manual toggle step. Rewrite the setup guide
with bilingual (CN/EN) labels and add screenshots walking through the
Google Drive, OneDrive, and Cloudflare configuration flows.
Add a dedicated /api/secrets/export route (api/secrets/export.js)
that streams the unified backup format (JSON/CSV/HTML/TXT) with size
and auth guards. Settings persist the preferred export format per
user; backup runs pick it up so generated files match the chosen
schema. The UI settings label/toast reads "导出偏好格式" to clarify
the preference applies to batch export and backup export. The
Service Worker passes through offline responses, utils/backup-format.js
is slimmed down after route consolidation, and unused createdAt is
dropped from the unified format and validation.
Add OAuth2 flows and REST clients (utils/oauth.js, utils/onedrive.js,
utils/gdrive.js) plus UI tools so backups mirror to personal cloud
drives. New /api/onedrive/* and /api/gdrive/* routes handle auth,
token refresh and push; triggerBackup() fans out to configured
providers alongside S3/WebDAV. Adds CLOUD_DRIVE_SETUP.md, validation
for the new secrets, and coverage across api/utils layers.
Use CSS Grid auto-fill + minmax to dynamically determine column count
based on screen width, replacing fixed 2-column layout. Widen desktop
container from 900px to 1400px. Update desktop screenshot to reflect
the new 4-column layout.
Explicitly declare SECRETS_KV in wrangler.toml so Git auto-build
deployments can auto-create or reuse the linked KV resource. Update
README and DEPLOYMENT to reflect that Sync Upstream now auto-merges
wrangler.toml instead of requiring manual review.
