为静态博客添加评论功能

direction: down

classes: {
  secure: {
    style: {
      fill: "#e8f5ee"
      stroke: "#238636"
      font-color: "#173b25"
    }
  }
  storage: {
    style: {
      fill: "#eaf2ff"
      stroke: "#3975c6"
      font-color: "#183b65"
    }
  }
  sensitive: {
    style: {
      fill: "#fff4df"
      stroke: "#b7791f"
      font-color: "#654510"
    }
  }
  external: {
    style: {
      fill: "#f4edff"
      stroke: "#8250df"
      font-color: "#45257a"
    }
  }
}

serverless: {
  label: "无状态 Serverless 平台适配层"
  direction: right
  vercel: "Vercel Functions"
  netlify: "Netlify Functions"
  workers: "Cloudflare Workers + Static Assets"
  shared: {
    label: "任选一种入口注入 env、deployment、pages()，共用 server/submissions.js"
    class: secure
  }
  vercel -> shared
  netlify -> shared
  workers -> shared
}

submission: {
  label: "1 · 提交链路 · 统一 POST /api/submissions"
  direction: right
  form: "读者填写评论或回复：选填邮箱、parentId"
  challenge: {
    label: "Serverless action: challenge：校验同源、生产环境、内容及 comment-pages 白名单"
    class: secure
  }
  managed: {
    label: "浏览器按需加载 Cloudflare Turnstile Managed 组件并取得 token"
    class: external
  }
  submit: {
    label: "Serverless action: submit：复验内容、文章与父评论"
    class: secure
  }
  siteverify: {
    label: "Turnstile Siteverify：校验单次 token、hostname、action 与内容摘要 cData"
    class: external
  }
  moderationMail: {
    label: "从 COMMENTS_SECRET 派生审批密钥；Resend 发送带 7 天 HMAC 凭据的审核邮件"
    class: sensitive
  }
  form -> challenge: "同源 action: challenge"
  challenge -> managed: "返回 Site Key、action、cData"
  managed -> submit: "浏览器携 turnstileToken 自动提交"
  submit -> siteverify
  siteverify -> moderationMail: "验证通过；邮件使用固定幂等键"
}

review: {
  label: "2 · 邮件审核与批准 · 同一共享 API"
  direction: right
  inbox: {
    label: "博主收到私有邮件；待审数据不落数据库"
    class: sensitive
  }
  preview: {
    label: "审核页从 URL fragment 取出并清除凭据；action: preview 只展示"
    class: sensitive
  }
  approve: {
    label: "手动确认 action: approve：复验签名、期限、当前白名单与父评论"
    class: secure
  }
  seal: {
    label: "派生邮箱密钥：AES-256-GCM 加密选填邮箱，附带密钥摘要"
    class: secure
  }
  dispatch: {
    label: "派生发布密钥签名信封；GitHub API 接受 workflow_dispatch"
    class: external
  }
  inbox -> preview -> approve -> seal -> dispatch
}

publishing: {
  label: "3A · Git 持久化与 SSG 发布"
  direction: right
  action: {
    label: "publish-comment.yml：用同一 COMMENTS_SECRET 派生密钥并再次验签"
    class: secure
  }
  git: {
    label: "检查仓库、目录、父评论及循环；写入独立评论 JSON"
    class: storage
  }
  push: "Git commit + push：并发时 fetch / rebase / 重试，不强推"
  build: "托管平台 Git 集成运行 npm run deploy；Hugo SSG"
  html: {
    label: "静态 HTML：嵌套评论转义渲染；阅读不请求评论 API"
    class: storage
  }
  index: {
    label: "新 comment-pages.json：下次部署供 Node 函数包或 Workers ASSETS 读取"
    class: storage
  }
  action -> git: "拒绝明文邮箱；同 ID 同内容幂等，不覆盖冲突"
  git -> push -> build
  build -> html
  build -> index
}

notification: {
  label: "3B · 审批后的邮件通知"
  direction: right
  lookup: {
    label: "GitHub 接受任务后，从审批数据及当前 comment-pages 索引取得收件信息"
    class: sensitive
  }
  notify: {
    label: "仅服务端解密；Resend 分别发送审核通过和直接回复通知"
    class: sensitive
  }
  retry: {
    label: "部分失败时返回短期签名 notificationToken；action: notify 只重试失败邮件"
    class: secure
  }
  recipients: "评论者与直接被回复者收到邮件；同邮箱或未留邮箱时跳过"
  lookup -> notify: "每位收件人独立发送，使用固定幂等键"
  notify -> recipients
  notify -> retry: "仅部分通知失败时"
}

serverless.shared -> submission.challenge: "处理 challenge、submit 等 action"
submission.moderationMail -> review.inbox
review.dispatch -> publishing.action: "GitHub 接受任务后异步执行"
review.dispatch -> notification.lookup: "不等待 Action、构建或部署完成"