@robotical/martyblocksjr 4.2.7 → 4.2.9

package/editions/free/src/localizations/fr.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Exemples de projets",
   "ABOUT_SCRATCHJR": "À propos de Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/it.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Progetti di Esempio",
   "ABOUT_SCRATCHJR": "Info su Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/ja.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "ぷろじぇくとのれい",
   "ABOUT_SCRATCHJR": "Blocks Jrについて",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/ko.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "예시 프로젝트",
   "ABOUT_SCRATCHJR": "Blocks Jr 소개",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/nl.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Voorbeeldprojecten",
   "ABOUT_SCRATCHJR": "Over Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/no.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Prosjekt Prøver",
   "ABOUT_SCRATCHJR": "Om Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/pl.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Przykładowe Projekty",
   "ABOUT_SCRATCHJR": "O Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/pt-br.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Projetos de Exemplo",
   "ABOUT_SCRATCHJR": "Sobre o Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/pt.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Projetos de Exemplo",
   "ABOUT_SCRATCHJR": "Sobre o Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/sv.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Exempelprojekt",
   "ABOUT_SCRATCHJR": "Om Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/th.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "โครงงานตัวอย่าง",
   "ABOUT_SCRATCHJR": "เกี่ยวกับ Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/tr.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Örnek Projeler",
   "ABOUT_SCRATCHJR": "Blocks Jr Hakkında",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/uk.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "Зразки проєктів",
   "ABOUT_SCRATCHJR": "Про Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/zh-cn.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "项目示例",
   "ABOUT_SCRATCHJR": "关于 Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/localizations/zh-tw.json

@@ -4,7 +4,7 @@
   "SAMPLE_PROJECTS": "專案樣本",
   "ABOUT_SCRATCHJR": "關於 Blocks Jr",
   "ABOUT_BLOCKS_JR_EYEBROW": "Made for curious creators",
-  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring robots to life.",
+  "ABOUT_BLOCKS_JR_TAGLINE": "Create stories. Code characters. Bring learning to life.",
   "ABOUT_BLOCKS_JR_INTRODUCTION_TITLE": "A first step into creative coding",
   "ABOUT_BLOCKS_JR_INTRODUCTION_DESCRIPTION": "Blocks Jr is Robotical's beginner-friendly block coding environment. Young learners snap together colourful blocks to make characters move, tell interactive stories, and control real robots—building confidence through play and experimentation.",
   "ABOUT_BLOCKS_JR_FEATURES_TITLE": "What can you make?",

package/editions/free/src/settings.json

@@ -17,6 +17,9 @@
     "categoryStopColor": "#D62222",
     "paletteBlockShadowOpacity": 0.8,
     "autoSaveInterval": 30000,
+    "curriculumArtifactAllowedOrigins": [
+        "https://cdn.sanity.io"
+    ],
     "defaultLocale": "en",
     "defaultLocaleShort": "en",
     "supportedLocales": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robotical/martyblocksjr",
-  "version": "4.2.7",
+  "version": "4.2.9",
   "description": "ScratchJr",
   "repository": {
     "type": "git",

package/tests/CurriculumArtifact.test.js

@@ -0,0 +1,272 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { importPackageMock } = vi.hoisted(() => ({
+  importPackageMock: vi.fn(),
+}));
+
+vi.mock("@/editor/ProjectCloud", () => ({
+  default: {
+    importPackage: importPackageMock,
+  },
+}));
+
+import {
+  CURRICULUM_ARTIFACT_KIND,
+  CURRICULUM_ARTIFACT_PLATFORM,
+  importCurriculumArtifactFromSearch,
+  parseCurriculumArtifactRequest,
+  sha256Hex,
+  validateCurriculumArtifact,
+} from "@/editor/CurriculumArtifact";
+
+function validArtifact() {
+  return {
+    kind: CURRICULUM_ARTIFACT_KIND,
+    formatVersion: 1,
+    platform: CURRICULUM_ARTIFACT_PLATFORM,
+    projectPackage: {
+      formatVersion: 1,
+      project: {
+        id: "source-project-id-must-not-be-reused",
+        name: "Walking starter",
+        version: "iOSv01",
+        gallery: "samples",
+        isgift: "1",
+        thumbnail: {
+          pagecount: 1,
+          md5: "thumbnail.png",
+        },
+        json: {
+          pages: ["page 1"],
+          currentPage: "page 1",
+          "page 1": {
+            sprites: ["Marty 1"],
+            layers: ["Marty 1"],
+            md5: "Farm.svg",
+            "Marty 1": {
+              id: "Marty 1",
+              type: "sprite",
+              md5: "marty.svg",
+              animationFrames: ["marty.svg", "marty-2.svg"],
+              sounds: ["hello.wav"],
+              scripts: [],
+            },
+          },
+        },
+      },
+      assets: {
+        "thumbnail.png": "dGh1bWI=",
+        "marty.svg": "PHN2Zy8+",
+        "marty-2.svg": "PHN2Zy8+",
+        "hello.wav": "UklGRg==",
+      },
+    },
+  };
+}
+
+function responseFor(value, url = "https://cdn.sanity.io/files/project/dataset/walking.json") {
+  var bytes = new TextEncoder().encode(JSON.stringify(value));
+  return {
+    ok: true,
+    url: url,
+    headers: {
+      get(name) {
+        if (name.toLowerCase() === "content-type") {
+          return "application/vnd.robotical.curriculum-code-artifact+json; charset=utf-8";
+        }
+        if (name.toLowerCase() === "content-length") {
+          return String(bytes.byteLength);
+        }
+        return null;
+      },
+    },
+    arrayBuffer: async function () {
+      return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+    },
+  };
+}
+
+describe("curriculum artifact import", () => {
+  beforeEach(() => {
+    importPackageMock.mockReset();
+    importPackageMock.mockResolvedValue({ projectId: "42" });
+  });
+
+  it("normalizes a valid artifact into a fresh editable project package", () => {
+    var result = validateCurriculumArtifact(validArtifact());
+
+    expect(result.formatVersion).toBe(1);
+    expect(result.project).toMatchObject({
+      name: "Walking starter",
+      version: "iOSv01",
+      deleted: "NO",
+      isgift: "0",
+    });
+    expect(result.project.id).toBeUndefined();
+    expect(result.project.gallery).toBeUndefined();
+    expect(Object.keys(result.assets).sort()).toEqual([
+      "hello.wav",
+      "marty-2.svg",
+      "marty.svg",
+      "thumbnail.png",
+    ]);
+  });
+
+  it("rejects unsupported envelopes and packages", () => {
+    var artifact = validArtifact();
+    artifact.platform = "martyblocks";
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/platform/);
+
+    artifact = validArtifact();
+    artifact.formatVersion = 2;
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/formatVersion/);
+
+    artifact = validArtifact();
+    artifact.projectPackage.formatVersion = 2;
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/projectPackage formatVersion/);
+  });
+
+  it("rejects remote, traversal and unreferenced project assets", () => {
+    var artifact = validArtifact();
+    artifact.projectPackage.project.json["page 1"].md5 = "https://evil.example/background.svg";
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/safe relative asset identifier/);
+
+    artifact = validArtifact();
+    artifact.projectPackage.project.json["page 1"]["Marty 1"].md5 = "../marty.svg";
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/safe relative asset identifier/);
+
+    artifact = validArtifact();
+    artifact.projectPackage.assets["unused.svg"] = "PHN2Zy8+";
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/unreferenced asset/);
+
+    artifact = validArtifact();
+    artifact.projectPackage.project.json["page 1"]["Marty 1"].md5 = "sprites/%2e%2e/marty.svg";
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/safe relative asset identifier/);
+  });
+
+  it("rejects project structures that the editor cannot safely recreate", () => {
+    var artifact = validArtifact();
+    delete artifact.projectPackage.project.json["page 1"].layers;
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/layers/);
+
+    artifact = validArtifact();
+    artifact.projectPackage.project.json["page 1"].layers = [];
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/every sprite/);
+
+    artifact = validArtifact();
+    delete artifact.projectPackage.project.json["page 1"]["Marty 1"].scripts;
+    expect(() => validateCurriculumArtifact(artifact)).toThrow(/scripts/);
+  });
+
+  it("accepts only configured HTTPS URLs and loopback development URLs", () => {
+    expect(parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcdn.sanity.io%2Fartifact.json" +
+        "&curriculumArtifactSha256=" + "a".repeat(64),
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://cdn.sanity.io"],
+      }
+    ).url).toBe("https://cdn.sanity.io/artifact.json");
+
+    expect(parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=http%3A%2F%2Flocalhost%3A3011%2Fartifact.json",
+      { baseUrl: "http://localhost:3011/blocks-jr" }
+    ).url).toBe("http://localhost:3011/artifact.json");
+
+    expect(() => parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=https%3A%2F%2Fevil.example%2Fartifact.json" +
+        "&curriculumArtifactSha256=" + "a".repeat(64),
+      { baseUrl: "https://app.example/blocks-jr" }
+    )).toThrow(/origin is not allowed/);
+
+    expect(() => parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=https%3A%2F%2Fapp.example%2Fartifact.json" +
+        "&curriculumArtifactSha256=" + "a".repeat(64),
+      { baseUrl: "https://app.example/blocks-jr" }
+    )).toThrow(/origin is not allowed/);
+
+    expect(() => parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=%2Fartifact.json&curriculumArtifactSha256=" + "a".repeat(64),
+      { baseUrl: "https://app.example/blocks-jr" }
+    )).toThrow(/absolute URL/);
+  });
+
+  it("allows explicitly configured artifact origins", () => {
+    var request = parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcontent.robotical.io%2Fartifact.json" +
+        "&curriculumArtifactSha256=" + "a".repeat(64),
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://content.robotical.io"],
+      }
+    );
+    expect(request.url).toBe("https://content.robotical.io/artifact.json");
+  });
+
+  it("requires payload integrity outside loopback development", () => {
+    expect(() => parseCurriculumArtifactRequest(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcdn.sanity.io%2Fartifact.json",
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://cdn.sanity.io"],
+      }
+    )).toThrow(/required outside local development/);
+  });
+
+  it("fetches, verifies and imports a package as a new local project", async () => {
+    var response = responseFor(validArtifact());
+    var body = await response.arrayBuffer();
+    var digest = sha256Hex(body);
+    var fetchMock = vi.fn().mockResolvedValue(response);
+    var result = await importCurriculumArtifactFromSearch(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcdn.sanity.io%2Ffiles%2Fproject%2Fdataset%2Fwalking.json" +
+        "&curriculumArtifactSha256=" + digest,
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://cdn.sanity.io"],
+        fetchImplementation: fetchMock,
+        projectVersion: "iOSv01",
+      }
+    );
+
+    expect(result).toEqual({ projectId: "42" });
+    expect(fetchMock).toHaveBeenCalledWith(
+      "https://cdn.sanity.io/files/project/dataset/walking.json",
+      expect.objectContaining({
+        credentials: "omit",
+        cache: "no-store",
+        referrerPolicy: "no-referrer",
+      })
+    );
+    expect(importPackageMock).toHaveBeenCalledTimes(1);
+    expect(importPackageMock.mock.calls[0][0].project.id).toBeUndefined();
+  });
+
+  it("does not write anything when the checksum is wrong", async () => {
+    var fetchMock = vi.fn().mockResolvedValue(responseFor(validArtifact()));
+    await expect(importCurriculumArtifactFromSearch(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcdn.sanity.io%2Ffiles%2Fproject%2Fdataset%2Fwalking.json" +
+        "&curriculumArtifactSha256=" + "0".repeat(64),
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://cdn.sanity.io"],
+        fetchImplementation: fetchMock,
+      }
+    )).rejects.toThrow(/checksum/);
+    expect(importPackageMock).not.toHaveBeenCalled();
+  });
+
+  it("does not write anything when a redirect crosses an allowed-origin boundary", async () => {
+    var fetchMock = vi.fn().mockResolvedValue(responseFor(validArtifact(), "https://evil.example/artifact.json"));
+    await expect(importCurriculumArtifactFromSearch(
+      "?curriculumArtifactUrl=https%3A%2F%2Fcdn.sanity.io%2Ffiles%2Fproject%2Fdataset%2Fwalking.json" +
+        "&curriculumArtifactSha256=" + "b".repeat(64),
+      {
+        baseUrl: "https://app.example/blocks-jr",
+        allowedOrigins: ["https://cdn.sanity.io"],
+        fetchImplementation: fetchMock,
+      }
+    )).rejects.toThrow(/redirect origin/);
+    expect(importPackageMock).not.toHaveBeenCalled();
+  });
+});