@bendyline/squisq 1.4.1 → 1.5.0

package/src/__tests__/getLayers.test.ts

@@ -108,7 +108,7 @@ describe('getLayers', () => {
     }
   });
 
-  it('returns empty array for unknown template', () => {
+  it('renders a visible fallback card for unknown templates (never blank)', () => {
     const block = {
       template: 'totally_nonexistent',
       id: 'unknown-1',
@@ -117,7 +117,11 @@ describe('getLayers', () => {
     } as unknown as TemplateBlock;
     const layers = getLayers(block, defaultContext);
 
-    expect(layers).toEqual([]);
+    expect(layers.length).toBeGreaterThan(0);
+    const noticeText = layers
+      .map((l) => (l.type === 'text' ? ((l.content as { text?: string }).text ?? '') : ''))
+      .join('\n');
+    expect(noticeText).toContain('Unknown template "totally_nonexistent"');
   });
 
   it('returns empty array for block with no template and no layers', () => {

package/src/__tests__/getLayersFallback.test.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { parseMarkdown } from '../markdown/parse.js';
+import { markdownToDoc } from '../doc/markdownToDoc.js';
+import { getLayers } from '../doc/getLayers.js';
+import { templateRegistry } from '../doc/templates/index.js';
+import type { Block, Layer } from '../schemas/Doc.js';
+
+function textOf(layers: Layer[]): string {
+  return layers
+    .map((l) => (l.type === 'text' ? ((l.content as { text?: string }).text ?? '') : ''))
+    .join('\n');
+}
+
+function firstBlock(md: string): Block {
+  return markdownToDoc(parseMarkdown(md)).blocks[0];
+}
+
+describe('getLayers — graceful degradation', () => {
+  it('renders an unknown template as a plain card with title, body, and notice', () => {
+    const block = firstBlock('## My Section {[photGrid]}\n\nSome body prose here.');
+    const layers = getLayers(block);
+    expect(layers.length).toBeGreaterThan(0);
+    const text = textOf(layers);
+    expect(text).toContain('My Section');
+    expect(text).toContain('Some body prose here.');
+    expect(text).toContain('Unknown template "photGrid"');
+  });
+
+  it('renders a fallback card when a template function throws', () => {
+    (templateRegistry as Record<string, unknown>)['__boom'] = () => {
+      throw new Error('kaboom');
+    };
+    try {
+      const block: Block = {
+        id: 'b1',
+        startTime: 0,
+        duration: 5,
+        audioSegment: 0,
+        template: '__boom',
+        title: 'Exploding block',
+      };
+      const layers = getLayers(block);
+      expect(layers.length).toBeGreaterThan(0);
+      expect(textOf(layers)).toContain('Template "__boom" failed');
+      expect(textOf(layers)).toContain('Exploding block');
+    } finally {
+      delete (templateRegistry as Record<string, unknown>)['__boom'];
+    }
+  });
+
+  it('blocks with no template at all still return empty layers', () => {
+    const block: Block = { id: 'raw', startTime: 0, duration: 5, audioSegment: 0 };
+    expect(getLayers(block)).toEqual([]);
+  });
+});
+
+describe('getLayers — structured data feeds templates', () => {
+  afterEach(() => {
+    delete (templateRegistry as Record<string, unknown>)['__capture'];
+  });
+
+  it('merges templateData and templateOverrides into the template input', () => {
+    let received: Record<string, unknown> | null = null;
+    (templateRegistry as Record<string, unknown>)['__capture'] = (
+      input: Record<string, unknown>,
+    ) => {
+      received = input;
+      return [];
+    };
+    const block: Block = {
+      id: 'b1',
+      startTime: 0,
+      duration: 5,
+      audioSegment: 0,
+      template: '__capture',
+      templateData: { rows: [['a', 'b']], zoom: 12 },
+      templateOverrides: { zoom: '14' },
+    };
+    getLayers(block);
+    expect(received).not.toBeNull();
+    expect(received!['rows']).toEqual([['a', 'b']]);
+    // String overrides from {[…]} params win last.
+    expect(received!['zoom']).toBe('14');
+  });
+
+  it('renders a dataTable from a GFM table in the markdown body', () => {
+    const md = [
+      '## People {[dataTable]}',
+      '',
+      '| Name | Age |',
+      '| --- | --- |',
+      '| Alice | 30 |',
+    ].join('\n');
+    const block = firstBlock(md);
+    const layers = getLayers(block);
+    expect(layers.length).toBeGreaterThan(0);
+    const tableLayer = layers.find((l) => l.type === 'table');
+    expect(tableLayer).toBeDefined();
+    const content = tableLayer!.content as { headers?: string[]; rows?: string[][] };
+    expect(content.headers).toEqual(['Name', 'Age']);
+    expect(content.rows).toEqual([['Alice', '30']]);
+  });
+});

package/src/__tests__/imageEditExportSvg.test.ts

@@ -0,0 +1,70 @@
+import { describe, it, expect } from 'vitest';
+import { buildSvgString } from '../imageEdit/export';
+import { createEmptyImageEditDoc, addLayer } from '../imageEdit/state';
+import { MemoryContentContainer } from '../storage/ContentContainer';
+import type { ImageEditLayer } from '../schemas/ImageEditDoc';
+
+const container = new MemoryContentContainer();
+
+describe('buildSvgString — path (drawing shape) layers', () => {
+  it('renders a named shape (shapeKind) as a <path>, deriving d from the box', async () => {
+    let doc = createEmptyImageEditDoc(200, 200);
+    const diamond: ImageEditLayer = {
+      id: 'p1',
+      type: 'path',
+      position: { x: 10, y: 20, width: 100, height: 80 },
+      content: {
+        d: 'M 0 0',
+        shapeKind: 'diamond',
+        fill: '#3399ff',
+        stroke: '#1a4d80',
+        strokeWidth: 2,
+      },
+    };
+    doc = addLayer(doc, diamond);
+
+    const svg = await buildSvgString(doc, container);
+    expect(svg).toContain('<path');
+    expect(svg).toContain('fill="#3399ff"');
+    expect(svg).toContain('stroke="#1a4d80"');
+    // A diamond inscribed in [10,20,100,80] starts at the top-center (60,20).
+    expect(svg).toContain('d="M 60 20');
+    // The seed `d="M 0 0"` must NOT survive — geometry is re-derived.
+    expect(svg).not.toContain('d="M 0 0"');
+  });
+
+  it('renders an arrow path with an end marker def', async () => {
+    let doc = createEmptyImageEditDoc(200, 200);
+    const arrow: ImageEditLayer = {
+      id: 'a1',
+      type: 'path',
+      position: { x: 0, y: 0, width: 100, height: 100 },
+      content: {
+        d: 'M 0 0 L 100 100',
+        stroke: '#000000',
+        strokeWidth: 2,
+        fill: 'none',
+        endMarker: 'arrow',
+      },
+    };
+    doc = addLayer(doc, arrow);
+
+    const svg = await buildSvgString(doc, container);
+    expect(svg).toContain('<marker id="marker-end-a1"');
+    expect(svg).toContain('marker-end="url(#marker-end-a1)"');
+    expect(svg).toContain('fill="none"');
+  });
+
+  it('still renders native rect/circle/line shape layers', async () => {
+    let doc = createEmptyImageEditDoc(100, 100);
+    doc = addLayer(doc, {
+      id: 's1',
+      type: 'shape',
+      position: { x: 5, y: 5, width: 40, height: 30 },
+      content: { shape: 'rect', fill: '#fff', borderRadius: 4 },
+    });
+    const svg = await buildSvgString(doc, container);
+    expect(svg).toContain('<rect x="5" y="5" width="40" height="30"');
+    expect(svg).toContain('rx="4"');
+  });
+});

package/src/__tests__/imageEditVersions.test.ts

@@ -46,6 +46,78 @@ describe('imageEdit/persistence', () => {
     );
     await expect(readImageEditDoc(sidecar)).rejects.toThrow(/unsupported schema version/);
   });
+
+  async function writeRaw(sidecar: ReturnType<typeof scopeContainer>, payload: unknown) {
+    await sidecar.writeFile('state.json', new TextEncoder().encode(JSON.stringify(payload)));
+  }
+
+  it('rejects layer that is not an object', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, { version: 1, canvas: { width: 1, height: 1 }, layers: [null] });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/layers\[0\] must be an object/);
+  });
+
+  it('rejects layer with missing id', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ type: 'text', position: { x: 0, y: 0 }, content: { text: 'hi', style: {} } }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/must have a string id/);
+  });
+
+  it('rejects layer with invalid type', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ id: 'x', type: 'video', position: { x: 0, y: 0 }, content: {} }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(
+      /type must be one of image\|text\|shape/,
+    );
+  });
+
+  it('rejects image layer with missing content.src', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ id: 'x', type: 'image', position: { x: 0, y: 0 }, content: { alt: 'test' } }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/content\.src must be a string/);
+  });
+
+  it('rejects text layer with missing content.text', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ id: 'x', type: 'text', position: { x: 0, y: 0 }, content: { style: {} } }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/content\.text must be a string/);
+  });
+
+  it('rejects shape layer with missing content.shape', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ id: 'x', type: 'shape', position: { x: 0, y: 0 }, content: {} }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/content\.shape must be a string/);
+  });
+
+  it('rejects layer with missing position', async () => {
+    const sidecar = scopeContainer(new MemoryContentContainer(), 'sc');
+    await writeRaw(sidecar, {
+      version: 1,
+      canvas: { width: 1, height: 1 },
+      layers: [{ id: 'x', type: 'shape', content: { shape: 'rect' } }],
+    });
+    await expect(readImageEditDoc(sidecar)).rejects.toThrow(/position must have/);
+  });
 });
 
 describe('imageEdit/versions', () => {

package/src/__tests__/inlineIconMarker.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest';
+import {
+  hasIconMarker,
+  iconClass,
+  iconMarker,
+  splitIconMarkers,
+  stripIconMarkers,
+} from '../icons/inlineIconMarker';
+
+describe('inline icon markers', () => {
+  it('encodes icons with a private-use sentinel', () => {
+    expect(iconMarker('solid', 'rocket')).toBe('\uE000solid:rocket\uE000');
+  });
+
+  it('detects and strips encoded markers from plain-text projections', () => {
+    const text = `Launch ${iconMarker('solid', 'rocket')} now`;
+
+    expect(hasIconMarker(text)).toBe(true);
+    expect(stripIconMarkers(text)).toBe('Launch  now');
+  });
+
+  it('splits marker-bearing text into text and icon runs', () => {
+    const text = `A ${iconMarker('regular', 'star')} and ${iconMarker('brands', 'github')}`;
+
+    expect(splitIconMarkers(text)).toEqual([
+      { type: 'text', text: 'A ' },
+      { type: 'icon', family: 'regular', name: 'star' },
+      { type: 'text', text: ' and ' },
+      { type: 'icon', family: 'brands', name: 'github' },
+    ]);
+  });
+
+  it('builds FontAwesome class names', () => {
+    expect(iconClass('solid', 'rocket')).toBe('fa-solid fa-rocket');
+  });
+});

package/src/__tests__/layoutBlock.test.ts

@@ -0,0 +1,83 @@
+import { describe, it, expect } from 'vitest';
+import { layoutBlock } from '../doc/templates/layoutBlock.js';
+import { createTemplateContext } from '../schemas/BlockTemplates.js';
+import { DEFAULT_THEME } from '../schemas/themeLibrary.js';
+import { VIEWPORT_PRESETS } from '../schemas/Viewport.js';
+import { isContainerTemplate } from '../doc/templates/index.js';
+import { parseMarkdown } from '../markdown/parse.js';
+import type { Block, Layer, TextLayer } from '../schemas/Doc.js';
+import type { RawLayersInput } from '../schemas/BlockTemplates.js';
+
+function child(
+  id: string,
+  template: string,
+  overrides: Record<string, string> = {},
+  bodyMd = '',
+): Block {
+  return {
+    id,
+    startTime: 0,
+    duration: 0,
+    audioSegment: 0,
+    template,
+    templateOverrides: overrides,
+    ...(bodyMd ? { contents: parseMarkdown(bodyMd).children } : {}),
+  } as Block;
+}
+
+function ctxWith(children: Block[]) {
+  const ctx = createTemplateContext(DEFAULT_THEME, 0, 1, VIEWPORT_PRESETS.landscape);
+  ctx.children = children;
+  return ctx;
+}
+
+const INPUT: RawLayersInput = { template: 'layout', id: 'lay', duration: 0, audioSegment: 0 };
+
+describe('layoutBlock template', () => {
+  it('returns a single hint layer for an empty layout', () => {
+    const layers = layoutBlock(INPUT, ctxWith([]));
+    expect(layers).toHaveLength(1);
+    expect(layers[0].type).toBe('text');
+    expect((layers[0] as TextLayer).content.text).toBe('Empty layout');
+  });
+
+  it('emits one layer per child, in document order, at absolute positions', () => {
+    const layers = layoutBlock(
+      INPUT,
+      ctxWith([
+        child('box-1', 'rectangle', { x: '760', y: '390', width: '400', height: '300' }),
+        child('text-1', 'text', { x: '360', y: '380', width: '1200', height: '320' }, 'Welcome'),
+      ]),
+    );
+    expect(layers.map((l) => l.id)).toEqual(['box-1', 'text-1']);
+    expect(layers[0].type).toBe('shape');
+    expect(layers[1].type).toBe('text');
+    expect((layers[1] as TextLayer).content.text).toBe('Welcome');
+    expect(layers[0].position).toMatchObject({ x: 760, y: 390 });
+  });
+});
+
+describe('layout container behavior', () => {
+  it('marks layout as a children-consuming container template', () => {
+    expect(isContainerTemplate('layout')).toBe(true);
+  });
+
+  it('renders a layout block through the template registry (getLayers)', async () => {
+    const { getLayers } = await import('../doc/getLayers.js');
+    const parent: Block = {
+      id: 'lay',
+      startTime: 0,
+      duration: 0,
+      audioSegment: 0,
+      template: 'layout',
+      children: [
+        child('text-1', 'text', { x: '360', y: '380', width: '1200', height: '320' }, 'Title'),
+        child('box-1', 'rectangle', { x: '760', y: '390', width: '400', height: '300' }),
+      ],
+    };
+    const layers = getLayers(parent, {});
+    const types = new Set(layers.map((l: Layer) => l.type));
+    expect(types.has('text')).toBe(true);
+    expect(types.has('shape')).toBe(true);
+  });
+});

package/src/__tests__/layoutLayout.test.ts

@@ -0,0 +1,169 @@
+import { describe, it, expect } from 'vitest';
+import { computeLayoutLayers } from '../doc/templates/layoutLayout.js';
+import { parseMarkdown } from '../markdown/parse.js';
+import type { ShapeLayer, TextLayer, ImageLayer, PathLayer } from '../schemas/Doc.js';
+
+const VP = { width: 1920, height: 1080 };
+
+function child(id: string, template: string, params: Record<string, string> = {}, bodyMd = '') {
+  return {
+    id,
+    template,
+    templateOverrides: params,
+    ...(bodyMd ? { contents: parseMarkdown(bodyMd).children } : {}),
+  };
+}
+
+describe('computeLayoutLayers', () => {
+  it('maps a text child to an absolutely-positioned TextLayer (body text + style)', () => {
+    const { layers } = computeLayoutLayers(
+      [
+        child(
+          'text-1',
+          'text',
+          {
+            x: '100',
+            y: '200',
+            width: '600',
+            height: '120',
+            fontSize: '48',
+            align: 'center',
+            valign: 'middle',
+            color: '#1e293b',
+          },
+          'Hello **world**',
+        ),
+      ],
+      VP,
+    );
+    expect(layers).toHaveLength(1);
+    const t = layers[0] as TextLayer;
+    expect(t.type).toBe('text');
+    expect(t.id).toBe('text-1');
+    expect(t.position).toMatchObject({ x: 100, y: 200, width: 600, height: 120 });
+    expect(t.content.text).toBe('Hello world'); // plain projection of the body
+    expect(t.content.style.fontSize).toBe(48);
+    expect(t.content.style.textAlign).toBe('center');
+    expect(t.content.style.verticalAlign).toBe('middle');
+    expect(t.content.style.color).toBe('#1e293b');
+  });
+
+  it('maps rectangle/circle children to ShapeLayers', () => {
+    const { layers } = computeLayoutLayers(
+      [
+        child('box-1', 'rectangle', {
+          x: '10',
+          y: '10',
+          width: '200',
+          height: '100',
+          fill: '#e0e7ff',
+          stroke: '#6366f1',
+          strokeWidth: '2',
+          borderRadius: '8',
+        }),
+        child('c-1', 'circle', { x: '300', y: '10', width: '120', height: '120' }),
+      ],
+      VP,
+    );
+    const shapes = layers.filter((l): l is ShapeLayer => l.type === 'shape');
+    expect(shapes.map((s) => s.content.shape)).toEqual(['rect', 'circle']);
+    expect(shapes[0].content.fill).toBe('#e0e7ff');
+    expect(shapes[0].content.borderRadius).toBe(8);
+    expect(shapes[0].position).toMatchObject({ x: 10, y: 10, width: 200, height: 100 });
+  });
+
+  it('maps an image child to an ImageLayer and skips one missing src', () => {
+    const { layers, warnings } = computeLayoutLayers(
+      [
+        child('img-1', 'image', {
+          x: '0',
+          y: '0',
+          width: '320',
+          height: '240',
+          src: 'pic.png',
+          alt: 'A pic',
+          fit: 'cover',
+        }),
+        child('img-2', 'image', { x: '0', y: '0' }),
+      ],
+      VP,
+    );
+    const imgs = layers.filter((l): l is ImageLayer => l.type === 'image');
+    expect(imgs).toHaveLength(1);
+    expect(imgs[0].content.src).toBe('pic.png');
+    expect(imgs[0].content.alt).toBe('A pic');
+    expect(imgs[0].content.fit).toBe('cover');
+    expect(warnings.some((w) => w.includes('img-2'))).toBe(true);
+  });
+
+  it('maps a named polygon to a PathLayer via shapePath', () => {
+    const { layers } = computeLayoutLayers(
+      [child('star-1', 'star', { x: '0', y: '0', width: '100', height: '100' })],
+      VP,
+    );
+    const p = layers[0] as PathLayer;
+    expect(p.type).toBe('path');
+    expect(p.content.d.startsWith('M')).toBe(true);
+  });
+
+  it('uses absolute positions (no fit-scaling) regardless of viewport', () => {
+    const children = [
+      child('text-1', 'text', { x: '100', y: '100', width: '200', height: '50' }, 'x'),
+    ];
+    const small = computeLayoutLayers(children, { width: 200, height: 200 }).layers[0];
+    const large = computeLayoutLayers(children, { width: 4000, height: 4000 }).layers[0];
+    expect(small.position.x).toBe(100);
+    expect(large.position.x).toBe(100);
+  });
+
+  it('preserves child document order as z-order', () => {
+    const { layers } = computeLayoutLayers(
+      [child('a', 'rectangle', { x: '0', y: '0' }), child('b', 'text', {}, 'top')],
+      VP,
+    );
+    expect(layers.map((l) => l.id)).toEqual(['a', 'b']);
+  });
+
+  it('warns and skips a child whose annotation is not a layer kind', () => {
+    const { layers, warnings } = computeLayoutLayers(
+      [child('weird', 'banana', { x: '0', y: '0' })],
+      VP,
+    );
+    expect(layers).toHaveLength(0);
+    expect(warnings.some((w) => w.includes('weird'))).toBe(true);
+  });
+
+  it('uses the supplied ink default for un-styled text and strokes', () => {
+    const { layers } = computeLayoutLayers(
+      [
+        child('t', 'text', { x: '0', y: '0' }, 'plain'),
+        child('l', 'line', { x: '0', y: '0', width: '100', height: '0' }),
+      ],
+      VP,
+      { ink: '#e0e0e0' },
+    );
+    const t = layers[0] as TextLayer;
+    const l = layers[1] as PathLayer;
+    expect(t.content.style.color).toBe('#e0e0e0');
+    expect(l.content.stroke).toBe('#e0e0e0');
+  });
+
+  it('keeps the dark-slate ink default when no defaults are supplied (editor scene canvas)', () => {
+    const { layers } = computeLayoutLayers([child('t', 'text', { x: '0', y: '0' }, 'plain')], VP);
+    const t = layers[0] as TextLayer;
+    expect(t.content.style.color).toBe('#1e293b');
+  });
+
+  it('never overrides author-specified color/stroke with the ink default', () => {
+    const { layers } = computeLayoutLayers(
+      [
+        child('t', 'text', { x: '0', y: '0', color: '#112233' }, 'styled'),
+        child('l', 'line', { x: '0', y: '0', width: '100', height: '0', stroke: '#445566' }),
+      ],
+      VP,
+      { ink: '#e0e0e0' },
+    );
+    expect((layers[0] as TextLayer).content.style.color).toBe('#112233');
+    expect((layers[1] as PathLayer).content.stroke).toBe('#445566');
+  });
+});

package/src/__tests__/markdown.test.ts

@@ -11,6 +11,7 @@ import {
   countNodes,
   createDocument,
   parseFrontmatter,
+  plainTextFromInlineHtml,
 } from '../markdown/index';
 import type {
   MarkdownDocument,
@@ -870,3 +871,25 @@ describe('frontmatter in parseMarkdown', () => {
     expect(doc.frontmatter).toBeUndefined();
   });
 });
+
+describe('plainTextFromInlineHtml', () => {
+  it('strips inline tags, keeping text', () => {
+    expect(plainTextFromInlineHtml('<strong>bold</strong> and <em>italic</em>')).toBe(
+      'bold and italic',
+    );
+  });
+
+  it('decodes entities', () => {
+    expect(plainTextFromInlineHtml('a &amp; b &lt;c&gt;')).toBe('a & b <c>');
+  });
+
+  it('turns <br> and block tags into line breaks', () => {
+    expect(plainTextFromInlineHtml('one<br>two')).toBe('one\ntwo');
+    expect(plainTextFromInlineHtml('<p>one</p><p>two</p>')).toBe('one\ntwo');
+    expect(plainTextFromInlineHtml('<h2>Title</h2><p>body</p>')).toBe('Title\nbody');
+  });
+
+  it('returns empty string for empty input', () => {
+    expect(plainTextFromInlineHtml('')).toBe('');
+  });
+});

package/src/__tests__/markdownSanitize.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest';
+import { parseHtmlToNodes, sanitizeHtmlNodes, sanitizeUrl } from '../markdown/index';
+import type { HtmlElement, HtmlNode } from '../markdown/index';
+
+function elements(nodes: HtmlNode[]): HtmlElement[] {
+  return nodes.filter((node): node is HtmlElement => node.type === 'htmlElement');
+}
+
+describe('markdown HTML sanitization', () => {
+  it('allows safe link URLs and rejects executable schemes', () => {
+    expect(sanitizeUrl('https://example.com', 'link')).toBe('https://example.com');
+    expect(sanitizeUrl('/docs/page.html#intro', 'link')).toBe('/docs/page.html#intro');
+    expect(sanitizeUrl('mailto:me@example.com', 'link')).toBe('mailto:me@example.com');
+    expect(sanitizeUrl('tel:+15551234567', 'link')).toBe('tel:+15551234567');
+    expect(sanitizeUrl('javascript:alert(1)', 'link')).toBeNull();
+    expect(sanitizeUrl('java\nscript:alert(1)', 'link')).toBeNull();
+    expect(sanitizeUrl('data:text/html,<script>alert(1)</script>', 'link')).toBeNull();
+  });
+
+  it('allows Squisq media URLs without allowing SVG or HTML data payloads', () => {
+    expect(sanitizeUrl('blob:http://localhost/abc', 'media')).toBe('blob:http://localhost/abc');
+    expect(sanitizeUrl('data:image/png;base64,AAA', 'media')).toBe('data:image/png;base64,AAA');
+    expect(sanitizeUrl('data:audio/webm;base64,AAA', 'media')).toBe('data:audio/webm;base64,AAA');
+    expect(sanitizeUrl('data:image/svg+xml;base64,AAA', 'media')).toBeNull();
+    expect(sanitizeUrl('data:text/html,<script>alert(1)</script>', 'media')).toBeNull();
+  });
+
+  it('removes dangerous tags and event handler attributes', () => {
+    const safe = sanitizeHtmlNodes(
+      parseHtmlToNodes('<div onclick="alert(1)">ok<script>alert(1)</script></div>'),
+    );
+    const [div] = elements(safe);
+
+    expect(div.tagName).toBe('div');
+    expect(div.attributes.onclick).toBeUndefined();
+    expect(div.children).toEqual([{ type: 'htmlText', value: 'ok' }]);
+  });
+
+  it('sanitizes link and image attributes inside raw HTML', () => {
+    const safe = sanitizeHtmlNodes(
+      parseHtmlToNodes(
+        '<a href="javascript:alert(1)" target="_blank">bad</a><img src="x.jpg" onerror="alert(1)" width="300">',
+      ),
+    );
+    const [link, image] = elements(safe);
+
+    expect(link.tagName).toBe('a');
+    expect(link.attributes.href).toBeUndefined();
+    expect(link.attributes.target).toBe('_blank');
+    expect(link.attributes.rel).toBe('noopener noreferrer');
+    expect(image.tagName).toBe('img');
+    expect(image.attributes.src).toBe('x.jpg');
+    expect(image.attributes.onerror).toBeUndefined();
+    expect(image.attributes.width).toBe('300');
+  });
+
+  it('unwraps unknown harmless containers while keeping their safe children', () => {
+    const safe = sanitizeHtmlNodes(parseHtmlToNodes('<custom><strong>kept</strong></custom>'));
+    const [strong] = elements(safe);
+
+    expect(strong.tagName).toBe('strong');
+    expect(strong.children).toEqual([{ type: 'htmlText', value: 'kept' }]);
+  });
+});