edgepress 2026.10.1 → 2026.10.13

package/tests/consent-browser.test.mjs

@@ -0,0 +1,132 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import {resolve} from 'node:path';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import consentManager from '../plugins/consent/index.js';
+import {choiceSnapshot,readChoice} from '../static/edgepress/plugins/consent/choices.js';
+const root=fileURLToPath(new URL('../',import.meta.url));
+
+test('text view resumes the requested widget after consent, retries failure and never loads other allowed widgets', async () => {
+ const config = await loadConfig(root);
+ const origin = new URL(config.site.url).origin;
+ const service = {id:'discussion',provider:'external-widget',moduleUrl:'https://comments.example.com/widget.js',placement:'posts',backendUrl:'https://comments.example.com',name:'Discussion',purpose:'Read discussions.',dataCategories:'Comments.',recipient:'Publisher',retention:'Until removed.',privacyUrl:'https://comments.example.com/privacy'};
+ config.browserPlugins.services = [service, {...service, id:'other', moduleUrl:'https://comments.example.com/other.js'}];
+ let filter;
+ consentManager({registerFilter:(_name, callback) => {filter = callback;}});
+ const body = '<main>文章 Article 繁體</main><section data-edgepress-service="discussion"><button data-service-load="discussion">Load discussion</button></section><section data-edgepress-service="other"><button data-service-load="other">Load other</button></section>';
+ const html = filter('<!doctype html><html data-edgepress-data-mode="text"><body>' + body + '</body></html>', {config,page:{locale:'en'}});
+ const browser = await chromium.launch({headless:true,args:['--disable-extensions']});
+ try {
+  for (const blocked of [false, true]) {
+   const context = await browser.newContext();
+   if (blocked) await context.addInitScript(() => Object.defineProperty(window,'localStorage',{get(){throw new Error('Denied');}}));
+   const vendors = [];
+   await context.route('**/*', async route => {
+    const address = new URL(route.request().url());
+    if (address.origin !== origin) {
+     vendors.push(address.pathname);
+     return route.fulfill({contentType:'text/javascript',body:'export function mount(root){globalThis.attempts=(globalThis.attempts||0)+1;if(globalThis.attempts===1)throw new Error("Retry fixture");root.textContent="Mounted discussion";}'});
+    }
+    if (address.pathname.startsWith('/edgepress/')) {
+     try { return route.fulfill({contentType:address.pathname.endsWith('.js')?'text/javascript':'image/svg+xml',body:await readFile(resolve(root,'static',address.pathname.slice(1)))}); }
+     catch { return route.fulfill({status:404}); }
+    }
+    return route.fulfill({contentType:'text/html',body:html});
+   });
+   const page = await context.newPage();
+   const errors = [];
+   page.on('pageerror', error => errors.push(error.message));
+   await page.goto(origin + '/article/');
+   await page.locator('.privacy-accept').click();
+   await page.waitForTimeout(150);
+   assert.deepEqual(vendors, []);
+   await page.getByRole('button',{name:'Load discussion',exact:true}).click();
+   await page.waitForFunction(() => globalThis.attempts === 1);
+   await page.waitForFunction(() => !document.querySelector('[data-service-load=discussion]').disabled);
+   await page.getByRole('button',{name:'Load discussion',exact:true}).click();
+   await page.getByText('Mounted discussion',{exact:true}).waitFor();
+   assert.deepEqual(vendors, ['/widget.js']);
+   await page.reload();
+   await page.locator('.privacy-settings-button').waitFor();
+   assert.equal(await page.locator('.privacy-panel').isVisible(), false);
+   await page.waitForTimeout(150);
+   assert.deepEqual(vendors, ['/widget.js']);
+   await page.getByRole('button',{name:'Load discussion',exact:true}).click();
+   await page.waitForFunction(() => globalThis.attempts === 1);
+   assert.deepEqual(vendors, ['/widget.js','/widget.js']);
+   assert.deepEqual(errors, []);
+   await context.close();
+  }
+  const context = await browser.newContext();
+  await context.route('**/*', async route => {
+   const address = new URL(route.request().url());
+   if (address.origin !== origin) return route.fulfill({contentType:'text/javascript',body:'export function mount(root){root.textContent="Consented discussion";}'});
+   if (address.pathname.startsWith('/edgepress/')) {
+    try { return route.fulfill({contentType:address.pathname.endsWith('.js')?'text/javascript':'image/svg+xml',body:await readFile(resolve(root,'static',address.pathname.slice(1)))}); }
+    catch { return route.fulfill({status:404}); }
+   }
+   return route.fulfill({contentType:'text/html',body:html});
+  });
+  const page = await context.newPage();
+  await page.goto(origin + '/article/');
+  await page.locator('.privacy-close').click();
+  await page.getByRole('button',{name:'Load discussion',exact:true}).click();
+  await page.locator('.privacy-panel').waitFor({state:'visible'});
+  await page.locator('.privacy-accept').click();
+  await page.getByText('Consented discussion',{exact:true}).waitFor();
+  assert.equal(await page.getByRole('button',{name:'Load other',exact:true}).isVisible(),true);
+  await context.close();
+ } finally { await browser.close(); }
+});
+
+test('saved formal choices survive the provider rename, while an actual endpoint change requires consent',()=>{
+ const original=Object.fromEntries(['localStorage','sessionStorage','document','location'].map(name=>[name,Object.getOwnPropertyDescriptor(globalThis,name)]));
+ const values=new Map();const store={getItem:key=>values.get(key)||null,setItem:(key,value)=>values.set(key,value)};
+ const privacy={controller:{name:'Publisher',contact:'mail@example.com'},policyUrl:'/privacy/',consent:{enabled:true,proposedDate:'2026-10-03',effectiveDate:'2026-10-03',expiresDays:180},integrations:[{id:'github-comments',provider:'external-widget',moduleUrl:'https://comments.example.com/widget.js',placement:'posts',backendUrl:'https://website.example',name:'CommentNest',purpose:'Read comments'}]};
+ const previous=structuredClone(privacy);previous.integrations[0].provider='github-comments';previous.integrations[0].name='GitHub comments';delete previous.integrations[0].backendUrl;
+ const saved={proposedDate:'2026-10-03',effectiveDate:'2026-10-03',expiresAt:Date.now()+86400000,allowed:['github-comments'],fingerprint:JSON.stringify(previous)};
+ const config={privacy,siteOrigin:'https://website.example/',choiceFingerprint:'current-fingerprint',choiceSnapshot:choiceSnapshot(privacy)};
+ try {
+  Object.assign(globalThis,{localStorage:store,sessionStorage:store,document:{cookie:''},location:{protocol:'https:'}});values.set('edgepress-privacy-selection',JSON.stringify(saved));
+  assert.equal(readChoice(config),null,'A legacy same-origin service must not grant consent to an independent backend');
+  values.set('edgepress-privacy-selection',JSON.stringify(saved));const changed=structuredClone(config);changed.privacy.integrations[0].backendUrl='https://new-service.example';changed.choiceSnapshot=choiceSnapshot(changed.privacy);changed.choiceFingerprint='different-fingerprint';assert.equal(readChoice(changed),null);
+ }finally{for(const [name,descriptor] of Object.entries(original)){if(descriptor)Object.defineProperty(globalThis,name,descriptor);else delete globalThis[name];}}
+});
+test('privacy choices survive refresh, pages, locales, cosmetic rebuilds and blocked localStorage; withdrawal stays off',async()=>{
+ const config=await loadConfig(root),origin=new URL(config.site.url).origin;
+ const integration={id:'discussion',provider:'external-widget',moduleUrl:'https://comments.example.com/widget.js',placement:'posts',backendUrl:'https://comments.example.com',category:'backend',name:'Discussion',purpose:'Read discussions.',dataCategories:'Identity and comments.',recipient:'GitHub',retention:'Until removed.',privacyUrl:'https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement'};
+ config.browserPlugins.services=[integration];
+ let filter;consentManager({registerFilter:(_name,fn)=>{filter=fn;}});
+ const browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{})});
+ try {for(const blocked of [false,true]) {
+ const context=await browser.newContext();
+ if(blocked)await context.addInitScript(()=>{Object.defineProperty(window,'localStorage',{get(){throw new Error('Storage denied');}});});
+ let loads=0,cosmetic=false,policyChanged=false;
+ await context.route('**/*',async route=>{
+  const url=new URL(route.request().url());
+  if(url.origin!==origin)return route.fulfill({status:404,body:''});
+  if(url.pathname.endsWith('/external-widget.js'))return route.fulfill({contentType:'text/javascript',body:'export function load(){fetch("/integration-probe");}'});
+  if(url.pathname==='/integration-probe'){loads++;return route.fulfill({body:'ok'});}
+  if(url.pathname.startsWith('/edgepress/')) {
+   try{return route.fulfill({contentType:url.pathname.endsWith('.js')?'text/javascript':'image/svg+xml',body:await readFile(resolve(root,'static',url.pathname.slice(1)))});}catch{return route.fulfill({status:404,body:''});}
+  }
+  const current=structuredClone(config);
+  if(cosmetic)current.browserPlugins.services[0].name='Localized new presentation';
+  if(policyChanged)current.browserPlugins.consent.effectiveDate=new Date(Date.parse(current.browserPlugins.consent.effectiveDate+'T00:00:00Z')+86400000).toISOString().slice(0,10);
+  const html=filter('<!doctype html><html><body><main>Article</main></body></html>',{config:current,page:{locale:url.pathname.includes('translated')?'zh-CN':'en'}});
+  return route.fulfill({contentType:'text/html',body:html});
+ });
+ const page=await context.newPage();await page.goto(origin+'/article/');await page.locator('.privacy-panel').waitFor({state:'visible'});assert.equal(loads,0);assert.equal(await page.locator('.privacy-category').count(),0);assert.equal(await page.locator('.privacy-service-toggle strong').textContent(),'Discussion');
+ await page.locator('input[value=discussion]').check();await page.locator('.privacy-save').click();await page.waitForFunction(()=>document.querySelector('.privacy-panel').hidden);await page.waitForTimeout(50);assert.equal(loads,1);
+ for(const path of ['/article/','/translated/article/','/another/']) {await page.goto(origin+path);await page.locator('.privacy-settings-button').waitFor();await page.waitForTimeout(50);assert.ok(await page.locator('.privacy-panel').isHidden());assert.ok(await page.locator('input[value=discussion]').isChecked());}
+ assert.equal(loads,4);
+ cosmetic=true;await page.reload();await page.locator('.privacy-settings-button').waitFor();await page.waitForTimeout(50);assert.ok(await page.locator('.privacy-panel').isHidden());assert.equal(loads,5);
+ await page.locator('.privacy-settings-button').click();await page.locator('input[value=discussion]').uncheck();await Promise.all([page.waitForEvent('load'),page.locator('.privacy-save').click()]);await page.locator('.privacy-settings-button').waitFor();await page.waitForTimeout(50);assert.equal(loads,5);assert.ok(await page.locator('.privacy-panel').isHidden());
+ await page.reload();await page.locator('.privacy-settings-button').waitFor();assert.ok(await page.locator('.privacy-panel').isHidden());assert.ok(!await page.locator('input[value=discussion]').isChecked());
+ policyChanged=true;await page.reload();await page.locator('.privacy-panel').waitFor({state:'visible'});assert.ok(!await page.locator('input[value=discussion]').isChecked());assert.equal(loads,5);
+ await context.close();
+ }}finally{await browser.close();}
+});

package/tests/consent-config.test.mjs

@@ -0,0 +1,85 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,writeFile,readFile,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {resolve} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {parse,stringify} from 'yaml';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import consentManager from '../plugins/consent/index.js';
+import {generateBuiltinRoutes} from '../src/generators.js';
+import {renderBlocks} from '../src/page-blocks.js';
+
+const root=fileURLToPath(new URL('../',import.meta.url));
+const source=parse(await readFile(resolve(root,'config.yml'),'utf8'));
+source.plugins.consent.services.push({id:'github-comments',provider:'external-widget',moduleUrl:'https://comments.example.com/commentnest/widget.js',placement:'posts',backendUrl:'https://comments.example.com',name:'GitHub comments',purpose:'Read discussions.',dataCategories:'Identity and comments.',recipient:'GitHub',retention:'Until removed.',privacyUrl:'https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement'});
+
+test('consent payload follows YAML names, dates, expiry and enabled services; no old fingerprints survive',async()=>{
+  const folder=await mkdtemp(resolve(tmpdir(),'reporelay-consent-'));
+  try {
+    const settings=structuredClone(source);
+    settings.plugins.consent.expiresDays=37;
+    settings.plugins.consent.proposedDate='2026-10-03';
+    settings.plugins.consent.effectiveDate='2026-10-04';
+    for (const service of settings.plugins.consent.services) service.enabled = service.provider === 'external-widget';
+    settings.plugins.consent.services.find(service => service.provider === 'external-widget').name='Configured discussion name';
+    await writeFile(resolve(folder,'config.yml'),stringify(settings));
+    await writeFile(resolve(folder,'edgepress.config.mjs'),"export default {i18n:{defaultLocale:'en',languagePacks:['zh-CN']}};");
+    const config=await loadConfig(folder);
+    config.i18n.translationsByLocale={en:{}};
+    let filter;
+    consentManager({registerFilter:(_key,value)=>{filter=value;}});
+    const html=filter('<html><body></body></html>',{config,page:{locale:'en'}});
+    const payload=JSON.parse(html.match(/id="edgepress-privacy-config">([\s\S]*?)<\/script>/)[1]);
+    assert.equal(payload.privacy.consent.expiresDays,37);
+    assert.equal(payload.privacy.consent.effectiveDate,'2026-10-04');
+    assert.deepEqual(payload.privacy.integrations.map(item=>item.id),['github-comments']);
+    assert.equal(payload.privacy.integrations[0].name,'Configured discussion name');
+    assert.equal(payload.legacyChoiceFingerprints,undefined);
+    assert.equal(config.browserPlugins.services.filter(service => service.enabled === false).length,settings.plugins.consent.services.filter(service=>service.enabled===false).length,'Disabled services are retained without loading them');
+    assert.ok(!Object.hasOwn(payload.privacy.integrations[0], 'category'));
+    assert.ok(!Object.hasOwn(payload.ui, 'pluginBackend'));
+  } finally {await rm(folder,{recursive:true,force:true});}
+});
+
+test('disabling external services removes slots and publishes no service context',async()=>{
+  const config=await loadConfig(root);await loadLanguagePacks(config);
+  config.browserPlugins.services.forEach(service => service.enabled = false);
+  const post={kind:'posts',bundlePath:'fixture',title:'Article',locale:'en',path:'fixture/',date:new Date('2026-10-03'),
+    tags:[],category:'blog',description:'Article',markdown:'Text',html:'<p>Text</p>'};
+  const routes=await generateBuiltinRoutes({posts:[post],pages:[]},config,{filter:async(_key,value)=>value});
+  const article=routes.find(route=>route.path==='fixture/index.html');
+  assert.doesNotMatch(article.body,/data-edgepress-service|services-consent\.js/);
+  assert.equal(routes.find(route=>route.path==='edgepress/service-contexts.json').body,'[]');
+  const html=await renderBlocks([{columns:1,cells:[[{type:'service',integration:'github-comments'}]]}],{config,locale:'en',site:{posts:[]}});
+  assert.doesNotMatch(html,/data-edgepress-service/);
+});
+
+test('explicit service slots publish stable context across translations and reject duplicate blocks',async()=>{
+  const config=await loadConfig(root);await loadLanguagePacks(config);
+  config.browserPlugins.services=structuredClone(source.plugins.consent.services);
+  const blocks=[{columns:1,cells:[[{type:'service',integration:'github-comments'}]]}];
+  const pages=['en','zh-SG'].map(locale=>({kind:'pages',bundlePath:'home',title:'Home',locale,path:locale==='en'?'':locale+'/',homepage:true,blocks}));
+  const routes=await generateBuiltinRoutes({posts:[],pages},config,{filter:async(_key,value)=>value});
+  assert.match(routes.find(route=>route.path==='index.html').body,/data-service-thread="page:home"/);
+  assert.deepEqual(JSON.parse(routes.find(route=>route.path==='edgepress/service-contexts.json').body),[{thread:'page:home',title:'Home'}]);
+  const duplicate=[{columns:1,cells:[[{type:'service',integration:'github-comments'},{type:'service',integration:'github-comments'}]]}];
+  await assert.rejects(renderBlocks(duplicate,{config,locale:'en',document:pages[0],site:{posts:[]}}),/only one/);
+});
+
+
+test('flat consent configuration rejects category presets and validates per-service enablement',async()=>{
+ const folder=await mkdtemp(resolve(tmpdir(),'edgepress-services-'));
+ try {
+  await writeFile(resolve(folder,'edgepress.config.mjs'),"export default {i18n:{defaultLocale:'en',languagePacks:[]}};");
+  const settings=structuredClone(source);settings.plugins.consent.services=[];
+  settings.plugins.consent.statistics={enabled:true,services:[]};
+  await writeFile(resolve(folder,'config.yml'),stringify(settings));
+  await assert.rejects(loadConfig(folder),/plugins.consent.services/);
+  delete settings.plugins.consent.statistics;
+  settings.plugins.consent.services=[{...source.plugins.consent.services.find(service=>service.provider==='external-widget'),enabled:'yes'}];
+  await writeFile(resolve(folder,'config.yml'),stringify(settings));
+  await assert.rejects(loadConfig(folder),/enabled must be a boolean/);
+ }finally{await rm(folder,{recursive:true});}
+});

package/tests/consent-csp.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {chromium} from 'playwright';
+import {extendConsentPolicy,injectConsentPolicy,contentPermissions,validateServiceCsp,serializeConsentHeaders} from '../src/consent-csp.js';
+import { dataSaverInlineAssets } from '../src/data-saver.js';
+
+test('critical waiting assets receive exact CSP hashes without granting arbitrary inline scripts',async()=>{
+  const config={site:{dataSaver:{enabled:true}},browserPlugins:{services:[]}};
+  const inline=dataSaverInlineAssets(config);
+  const headers=extendConsentPolicy("/*\n  Content-Security-Policy: default-src 'self'; script-src 'self'; script-src-elem 'self'; style-src 'self'; style-src-elem 'self'",config);
+  assert(headers.includes(inline.scriptHash));
+  assert(headers.includes(inline.styleHash));
+  assert.doesNotMatch(headers,/unsafe-inline|unsafe-eval/);
+  assert.match(extendConsentPolicy('',config),/style-src 'self' 'unsafe-inline';/);
+  const browser=await chromium.launch({headless:true,args:['--disable-extensions']});
+  try {
+    const page=await browser.newPage();
+    await page.route('**/*',route=>route.fulfill({contentType:'text/html',body:injectConsentPolicy('<html><head><script id="edgepress-data-saver-config" type="application/json">{"enabled":true,"labels":{},"mode":"full"}</script><style>'+inline.style+'</style><script>'+inline.script+'</script><script>window.untrustedInline=true</script></head><body><main>Reading</main></body></html>',headers)}));
+    await page.goto('https://example.test/');
+    await page.waitForFunction(()=>document.documentElement.dataset.edgepressDataReady === 'true');
+    assert.equal(await page.evaluate(()=>window.untrustedInline),undefined);
+    assert.equal(await page.getAttribute('html','data-edgepress-data-mode'),'full');
+    assert.equal(await page.locator('body').evaluate(element=>getComputedStyle(element).visibility),'visible');
+  }finally{await browser.close();}
+});
+
+test('CSP is generated without source headers and removes disabled service permissions',()=>{
+  const services=[{provider:'external-widget',backendUrl:'https://comments.example',moduleUrl:'https://comments.example/widget.js'},{provider:'cloudflare-web-analytics'},{enabled:false,provider:'oembed',backendUrl:'https://disabled.example',embedOrigins:['https://disabled-media.example']}];
+  const config={browserPlugins:{services,consent:{enabled:true}}};
+  const headers=extendConsentPolicy('',config);
+  assert.match(headers,/Content-Security-Policy: default-src 'self'/);
+  assert.match(headers,/script-src 'self' https:\/\/comments.example https:\/\/static.cloudflareinsights.com/);
+  assert.match(headers,/connect-src 'self' https:\/\/comments.example https:\/\/cloudflareinsights.com/);
+  assert.doesNotMatch(headers,/disabled/);
+  assert.doesNotMatch(headers,/unsafe-eval/);
+  services[0].enabled=false;services[1].enabled=false;
+  assert.doesNotMatch(extendConsentPolicy('',config),/comments.example|cloudflareinsights/);
+  const custom={csp:{'connect-src':['https://api.example','https://*.media.example']}};
+  assert.doesNotThrow(()=>validateServiceCsp(custom));
+  for(const csp of [{'script-src':["'unsafe-inline'"]},{'connect-src':['https://user:pass@example.com']},{'default-src':['https://example.com']},{'connect-src':['https://example.com; script-src *']}])assert.throws(()=>validateServiceCsp({csp}));
+});
+
+test('global source policy and content media survive generation without granting inert embeds permission',()=>{
+  const config={browserPlugins:{services:[]},contentCsp:contentPermissions([{body:'<img src="https://pictures.example/image.webp"><video src="https://video.example/movie.mp4"></video><template><img src="https://disabled.example/a"></template>'}])};
+  const headers=extendConsentPolicy("/*\n  Content-Security-Policy: default-src 'self'; connect-src 'self' https://uploads.example; frame-ancestors 'none'",config);
+  const html=injectConsentPolicy('<html><head><title>Site</title></head><body></body></html>',headers);
+  assert.match(html,/http-equiv="Content-Security-Policy"/);assert.match(html,/https:\/\/uploads.example/);assert.match(html,/https:\/\/pictures.example/);assert.match(html,/https:\/\/video.example/);
+  assert.doesNotMatch(html,/frame-ancestors|disabled.example/);assert.match(headers,/frame-ancestors 'none'/);
+  const large=injectConsentPolicy('<html><head data-theme="test"><meta charset="utf-8"><title>繁體中文</title></head><body>简体中文</body></html>',extendConsentPolicy('',{browserPlugins:{services:[]},contentCsp:{'img-src':Array.from({length:24},(_,index)=>'https://image-'+index+'.example')}}));
+  assert(Buffer.byteLength(large.slice(0,large.indexOf('<meta charset="utf-8">')+22)) < 1024);
+  assert.equal((large.match(/<meta charset=/g)||[]).length,1);
+  assert(large.indexOf('<meta charset=') < large.indexOf('http-equiv="Content-Security-Policy"'));
+  for (const head of ['', '<meta charset="windows-1252">', '<title>'+'測試'.repeat(500)+'</title><meta charset="utf-8">']) {
+    const normalized = injectConsentPolicy('<!doctype html><html><head>'+head+'</head><body>中文</body></html>','');
+    assert(Buffer.byteLength(normalized.slice(0,normalized.indexOf('<meta charset="utf-8">')+22)) < 1024);
+    assert.equal((normalized.match(/<meta charset=/g)||[]).length,1);
+    assert.doesNotMatch(normalized,/windows-1252/);
+  }
+  const json=JSON.stringify({example:'<html><head></head><body><img src="https://metadata.example/a"></body></html>'});
+  assert.equal(injectConsentPolicy(json,headers),json);assert.deepEqual(contentPermissions([{body:json,contentType:'application/json'}]),{});
+});
+
+test('HTML CSP enforces configured origins on static platforms without custom response headers',async()=>{
+  const headers=extendConsentPolicy('',{browserPlugins:{services:[{provider:'external-api',backendUrl:'https://allowed.example'}]}});
+  const browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{})});
+  try{const context=await browser.newContext();let allowed=0,blocked=0;
+    await context.route('**/*',route=>{const url=new URL(route.request().url());if(url.origin==='https://allowed.example'){allowed++;return route.fulfill({body:'OK',headers:{'Access-Control-Allow-Origin':'*'}});}if(url.origin==='https://blocked.example'){blocked++;return route.fulfill({body:'BAD'});}return route.fulfill({contentType:'text/html',body:injectConsentPolicy('<html><head></head><body></body></html>',headers)});});
+    const page=await context.newPage();await page.goto('https://site.example/');
+    const result=await page.evaluate(async()=>{let rejected=false;await fetch('https://allowed.example/api');try{await fetch('https://blocked.example/api');}catch{rejected=true;}return rejected;});
+    assert.equal(result,true);assert.equal(allowed,1);assert.equal(blocked,0);await context.close();
+  }finally{await browser.close();}
+});
+
+test('large CSP policies obey the 2000-character header limit without intersecting allowed origin lists',async()=>{
+  const origins=Array.from({length:24},(_,i)=>'https://media-'+i+'.provider.example');
+  const source=extendConsentPolicy('',{browserPlugins:{services:[{provider:'oembed',backendUrl:'https://allowed.example',embedOrigins:origins}]}});
+  assert.ok(source.split('\n').some(line=>line.length>2000));
+  const serialized=serializeConsentHeaders(source),policies=serialized.split('\n').filter(line=>/^\s*Content-Security-Policy:/.test(line)).map(line=>line.replace(/^\s*Content-Security-Policy:\s*/,''));
+  assert.ok(policies.length>1);assert.ok(serialized.split('\n').every(line=>line.length<=2000));
+  const browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{})});
+  try{const context=await browser.newContext();let blocked=0,frames=0;
+    await context.route('**/*',route=>{const url=new URL(route.request().url());if(url.origin==='https://site.example')return route.fulfill({contentType:'text/html',headers:{'Content-Security-Policy':policies.join(', ')},body:'<html><head></head><body></body></html>'});if(url.origin==='https://blocked.example')blocked++;if(url.pathname==='/embed')frames++;return route.fulfill({contentType:url.pathname==='/embed'?'text/html':'text/plain',body:'OK',headers:{'Access-Control-Allow-Origin':'*'}});});
+    const page=await context.newPage();await page.goto('https://site.example/');
+    const result=await page.evaluate(async origins=>{for(const origin of origins)await fetch(origin+'/api');let rejected=false;try{await fetch('https://blocked.example/api');}catch{rejected=true;}return rejected;},['https://allowed.example',...origins]);
+    assert.equal(result,true);assert.equal(blocked,0);
+    await page.evaluate(origin=>{const frame=document.createElement('iframe');frame.src=origin+'/embed';document.body.append(frame);},origins[0]);await page.frameLocator('iframe').locator('body').waitFor();assert.equal(frames,1);
+    assert.equal(await page.evaluate(()=>new Promise((resolve,reject)=>{const worker=new Worker(URL.createObjectURL(new Blob(['postMessage(42)'],{type:'text/javascript'})));worker.onmessage=event=>{worker.terminate();resolve(event.data);};worker.onerror=()=>reject(new Error('Configured blob Worker was blocked'));})),42);
+    await context.close();
+  }finally{await browser.close();}
+});

package/tests/data-saver-loading.test.mjs

@@ -0,0 +1,158 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { chromium, firefox } from 'playwright';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { configureDataSaver, dataSaverHtml } from '../src/data-saver.js';
+
+test('full view discovers critical assets early and never waits for font styles', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = {enabled:true,mode:'full',debug:false,detectSlowConnection:false,respectBrowserPreference:false};
+  await configureDataSaver(config);
+  const html = dataSaverHtml('<!doctype html><html><head><meta charset="utf-8"><link rel="stylesheet" href="/full.css"><link rel="stylesheet" href="/edgepress/fonts.css"><script defer src="/control.js"></script></head><body><header>Navigation</header><main><h1>Readable 中文</h1></main><footer>Footer</footer></body></html>',config);
+  const settings = JSON.parse(html.match(/id="edgepress-data-saver-config"[^>]*>([\s\S]*?)<\/script>/)[1]);
+  assert(settings.fullPreloads.some(hint=>hint.href === '/full.css'));
+  assert(settings.fullPreloads.some(hint=>hint.href === '/control.js'));
+  assert(!settings.fullPreloads.some(hint=>/fonts/.test(hint.href)));
+  const browser = await chromium.launch({headless:true,args:['--disable-extensions']});
+  try {
+    const context = await browser.newContext();
+    let releaseFont;
+    const font = new Promise(resolve=>{releaseFont=resolve;});
+    let fontStarted;
+    const requested = new Promise(resolve=>{fontStarted=resolve;});
+    await context.route('**/*',async route=>{
+      const path = new URL(route.request().url()).pathname;
+      if (path === '/edgepress/fonts.css') { fontStarted(); await font; }
+      if (path.endsWith('.css')) return route.fulfill({contentType:'text/css',body:'body{font-family:system-ui}main{padding:1rem}'});
+      if (path.endsWith('.js')) return route.fulfill({contentType:'text/javascript',body:'document.documentElement.dataset.controlBound="true";'});
+      return route.fulfill({contentType:'text/html; charset=utf-8',body:html});
+    });
+    const page = await context.newPage();
+    await page.goto('https://loading.test/',{waitUntil:'domcontentloaded'});
+    await page.waitForFunction(()=>document.documentElement.dataset.edgepressDataReady === 'true');
+    assert.equal(await page.locator('main').isVisible(),true);
+    assert.equal(await page.getAttribute('html','data-control-bound'),'true');
+    await requested;
+    assert.equal(await page.locator('[data-data-wait]').isVisible(),false);
+    releaseFont();
+    await context.close();
+  } finally { await browser.close(); }
+});
+
+test('unfinished or failed CSS never exposes an unstyled page and retry restores reading', {timeout:30000}, async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = {enabled:true,mode:'full',debug:false,detectSlowConnection:true,respectBrowserPreference:false,promptAfterMs:150};
+  await configureDataSaver(config);
+  const html = dataSaverHtml('<html lang="en"><head><meta charset="utf-8"><link rel="stylesheet" href="/full.css"></head><body><header>Navigation</header><main><h1>Readable page</h1></main><footer>Footer</footer></body></html>',config);
+  const browser = await chromium.launch({headless:true,args:['--disable-extensions']});
+  try {
+    const context = await browser.newContext();
+    let release;
+    const pending = new Promise(resolve=>{release=resolve;});
+    let failed = false;
+    await context.route('**/*',async route=>{
+      const path = new URL(route.request().url()).pathname;
+      if (path === '/full.css') {
+        await pending;
+        if (!failed) { failed = true; return route.abort(); }
+      }
+      if (path.endsWith('.css')) return route.fulfill({contentType:'text/css',body:'body{margin:0}main{padding:1rem}'});
+      return route.fulfill({contentType:'text/html',body:html});
+    });
+    const page = await context.newPage();
+    await page.goto('https://loading.test/',{waitUntil:'domcontentloaded'});
+    await page.waitForTimeout(4500);
+    assert(await page.evaluate(()=>performance.getEntriesByName('first-contentful-paint').length>0),'The waiting UI must paint before the pending stylesheet completes');
+    assert.equal(await page.locator('main').isVisible(),false);
+    await page.locator('[data-data-dismiss]').click();
+    assert.equal(await page.locator('main').isVisible(),false);
+    assert.equal(await page.locator('[data-data-mode=text]').isVisible(),true);
+    release();
+    await page.locator('[data-data-retry]').waitFor({state:'visible'});
+    assert.equal(await page.locator('main').isVisible(),false);
+    assert.match(await page.locator('[data-data-progress-label]').innerText(),/could not load/);
+    await Promise.all([page.waitForNavigation({waitUntil:'domcontentloaded'}),page.locator('[data-data-retry]').click()]);
+    await page.waitForFunction(()=>document.documentElement.dataset.edgepressDataReady==='true');
+    assert.equal(await page.locator('main').isVisible(),true);
+    await context.close();
+  }finally{await browser.close();}
+});
+
+test('loading choices and measured progress remain stable after late completion and guard the debug entry', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled:true, debug:false, mode:'auto', detectSlowConnection:true, respectBrowserPreference:true, promptAfterMs:150 };
+  await configureDataSaver(config);
+  const runtime = await readFile('static/edgepress/data-saver.js');
+  const css = await readFile('static/edgepress/data-saver.css');
+  const image = await readFile('content/assets/edgepress/favicon/favicon-16.png');
+  const source = '<html lang="zh-CN"><head><meta charset="utf-8"><link rel="stylesheet" href="/full.css"></head><body><header><nav><a href="/second/">第二頁</a></nav></header><main><h1>繁體 简体 Article</h1><img src="/slow.png" loading="lazy" width="100" height="100" alt="有意义的图像"></main><footer>頁腳 Footer</footer></body></html>';
+  const html = dataSaverHtml(source, config);
+  for (const engine of [chromium,firefox]) {
+    const browser = await engine.launch({ headless:true, ...(engine === chromium ? {args:['--disable-extensions']} : {}) });
+    try {
+      for (const colorScheme of ['light','dark']) {
+        const context = await browser.newContext({viewport:{width:320,height:700},colorScheme,reducedMotion:'reduce'});
+        let current = html;
+        const requests = [];
+        let finishImage;
+        const released = new Promise(resolve => { finishImage = resolve; });
+        await context.route('**/*', async route => {
+          const path = new URL(route.request().url()).pathname;
+          requests.push(path);
+          if (path.endsWith('.js')) return route.fulfill({contentType:'text/javascript',body:runtime});
+          if (path === '/full.css') return route.fulfill({contentType:'text/css',body:'body{margin:0}main,header,footer{padding:1rem}'});
+          if (path.endsWith('.css')) return route.fulfill({contentType:'text/css',body:css});
+          if (path === '/slow.png') { await released; return route.fulfill({contentType:'image/png',body:image}); }
+          return route.fulfill({contentType:'text/html',body:path.endsWith('404.html') ? '<main><h1>404</h1></main>' : current});
+        });
+        const page = await context.newPage();
+        await page.goto('https://example.test/zh-CN/',{waitUntil:'domcontentloaded'});
+        await page.locator('[data-data-offer]').waitFor({state:'visible'});
+        assert.equal(await page.locator('main').isVisible(),false);
+        assert.match(await page.locator('[data-data-wait]').innerText(),/正在准备页面|首屏图片|页面样式/);
+        assert.equal(await page.locator('link[rel=preload][as=image]').count(),0);
+        assert.equal(await page.locator('[data-data-progress]').count(),1);
+        await page.locator('[data-data-mode=text]').focus();
+        finishImage();
+        await page.waitForTimeout(350);
+        assert.equal(await page.locator('[data-data-offer]').isVisible(),true);
+        assert.equal(await page.locator('main').isVisible(),false);
+        assert.equal(await page.evaluate(() => document.activeElement.dataset.dataMode),'text');
+        assert(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth));
+        const bounds = await page.locator('[data-data-offer]').boundingBox();
+        assert(bounds.x >= 0 && bounds.x + bounds.width <= 320);
+        if (process.env.DATA_SAVER_SCREENSHOTS && engine === chromium) await page.screenshot({path:process.env.DATA_SAVER_SCREENSHOTS + '/waiting-' + colorScheme + '.png'});
+        await Promise.all([page.waitForNavigation(),page.keyboard.press('Enter')]);
+        assert.equal(await page.getAttribute('html','data-edgepress-data-mode'),'text');
+        await page.waitForFunction(() => document.documentElement.dataset.edgepressDataReady === 'true');
+        await page.waitForFunction(() => document.activeElement.tagName === 'MAIN');
+        assert.equal(await page.locator('[data-data-wait]').isVisible(),false);
+        assert.match(await page.locator('main').innerText(),/繁體 简体 Article/);
+        assert.match(await page.locator('footer').innerText(),/頁腳 Footer/);
+        assert.match(await page.locator('body').evaluate(element => getComputedStyle(element).fontFamily),/Microsoft JhengHei/);
+        await page.goto('https://example.test/zh-CN/?data-save');
+        await page.waitForURL('**/zh-CN/404.html');
+        assert.equal(await page.locator('h1').innerText(),'404');
+        config.site.dataSaver.debug = true;
+        current = dataSaverHtml(source,config);
+        requests.length = 0;
+        await page.goto('https://example.test/zh-CN/?data-save');
+        assert.equal(await page.getAttribute('html','data-edgepress-data-mode'),'text');
+        assert(!requests.includes('/full.css'));
+        assert(!requests.includes('/slow.png'));
+        assert.equal(await page.locator('link[rel=preload]').count(),0);
+        await page.goto('https://example.test/zh-CN/?data-save=invalid');
+        await page.waitForURL('**/zh-CN/404.html');
+        await page.goto('https://example.test/zh-CN/?code=oauth&state=example');
+        assert.equal(new URL(page.url()).searchParams.get('code'),'oauth');
+        config.site.dataSaver.debug = false;
+        await context.close();
+      }
+    } finally { await browser.close(); }
+  }
+});

package/tests/data-saver-network.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { chromium } from 'playwright';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { configureDataSaver, dataSaverHtml } from '../src/data-saver.js';
+
+test('100 KB/s visitors can use the waiting-screen switch before parsing finishes without downloading media or engines', { timeout:30000 }, async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled:true, debug:false, mode:'auto', detectSlowConnection:true, respectBrowserPreference:false, promptAfterMs:5000 };
+  await configureDataSaver(config);
+  const runtime = await readFile('static/edgepress/data-saver.js');
+  const css = await readFile('static/edgepress/data-saver.css');
+  const html = dataSaverHtml('<html lang="zh-CN"><head><meta charset="utf-8"><link rel="stylesheet" href="/full.css"><script defer src="/controls.js"></script><script defer src="/engine.js" data-data-optional></script></head><body><header><nav><a href="/second/">下一頁</a></nav></header><main><h1>可閱讀的文章</h1><p>文字內容與網站導航。</p><button id="action">操作</button><img src="/large.png" alt="圖像描述"></main><footer>獨立頁腳</footer></body></html>',config);
+  const requests = [];
+  const timers = new Set();
+  const server = createServer((request,response) => {
+    const path = new URL(request.url,'http://localhost').pathname;
+    requests.push(path);
+    response.setHeader('Cache-Control','no-store');
+    if (path === '/controls.js') return response.writeHead(200,{'Content-Type':'text/javascript'}).end('window.controlsLoaded=true;document.querySelector("#action").addEventListener("click",()=>{window.controlUsed=true;});');
+    if (path.endsWith('.js')) return response.writeHead(200,{'Content-Type':'text/javascript'}).end(runtime);
+    if (path.endsWith('.css')) return response.writeHead(200,{'Content-Type':'text/css'}).end(path === '/full.css' ? 'body{margin:0}' + '/*' + 'x'.repeat(600000) + '*/' : css);
+    if (path.endsWith('.png')) return response.writeHead(200,{'Content-Type':'image/png'}).end(Buffer.alloc(1000000));
+    const split = html.indexOf('<header>');
+    response.writeHead(200,{'Content-Type':'text/html; charset=utf-8'});
+    response.write(html.slice(0,split));
+    const timer = setTimeout(() => { timers.delete(timer); response.end(html.slice(split)); },3000);
+    timers.add(timer);
+    response.on('close',() => { clearTimeout(timer); timers.delete(timer); });
+  });
+  await new Promise(resolve => server.listen(0,'127.0.0.1',resolve));
+  const browser = await chromium.launch({headless:true,args:['--disable-extensions']});
+  try {
+    const context = await browser.newContext({viewport:{width:390,height:844},colorScheme:'dark'});
+    await context.addInitScript(() => Object.defineProperty(navigator,'connection',{get:() => ({saveData:true,effectiveType:'2g'})}));
+    const page = await context.newPage();
+    const session = await context.newCDPSession(page);
+    await session.send('Network.enable');
+    await session.send('Network.emulateNetworkConditions',{offline:false,latency:150,downloadThroughput:100*1024,uploadThroughput:100*1024});
+    const started = performance.now();
+    await page.goto('http://127.0.0.1:' + server.address().port,{waitUntil:'commit'});
+    const button = page.locator('[data-data-mode=text]');
+    await button.waitFor({state:'visible'});
+    const offeredAfterMs = Math.round(performance.now()-started);
+    assert(offeredAfterMs < 2500,'Waiting entry must not wait for HTML completion: ' + offeredAfterMs);
+    assert.equal(await page.evaluate(() => document.readyState),'loading');
+    assert.equal(await page.getAttribute('html','data-edgepress-data-mode'),'full');
+    assert.equal(await page.locator('[data-data-progress]').isVisible(),true);
+    assert(requests.includes('/full.css'));
+    const textRequestStart = requests.length;
+    await button.focus();
+    await Promise.all([page.waitForNavigation({waitUntil:'domcontentloaded'}),page.keyboard.press('Enter')]);
+    await page.waitForFunction(() => document.documentElement.dataset.edgepressDataReady === 'true');
+    assert(!requests.slice(textRequestStart).includes('/full.css'));
+    const readableAfterMs = Math.round(performance.now()-started);
+    assert(readableAfterMs < 6000,'Text reading must not wait ten seconds: ' + readableAfterMs);
+    assert.equal(await page.locator('main').isVisible(),true);
+    assert.equal(await page.locator('header nav').isVisible(),true);
+    assert.equal(await page.locator('footer').innerText(),'獨立頁腳');
+    assert.match(await page.locator('main').innerText(),/圖像描述/);
+    assert(!requests.some(path => ['/large.png','/engine.js'].includes(path)),requests.join('\n'));
+    assert.equal(await page.evaluate(() => document.activeElement.tagName),'MAIN');
+    assert.equal(await page.evaluate(() => window.controlsLoaded),true);
+    await page.locator('#action').click();
+    assert.equal(await page.evaluate(() => window.controlUsed),true);
+    console.log(JSON.stringify({bandwidthKBs:100,latencyMs:150,offeredAfterMs,readableAfterMs,requests}));
+    await context.close();
+    requests.length = 0;
+    const pending = await browser.newContext({viewport:{width:390,height:844},colorScheme:'light'});
+    const loadingPage = await pending.newPage();
+    const loadingSession = await pending.newCDPSession(loadingPage);
+    await loadingSession.send('Network.enable');
+    await loadingSession.send('Network.emulateNetworkConditions',{offline:false,latency:150,downloadThroughput:100*1024,uploadThroughput:100*1024});
+    await loadingPage.goto('http://127.0.0.1:' + server.address().port,{waitUntil:'domcontentloaded'});
+    await loadingPage.waitForFunction(() => document.querySelector('[data-data-progress]').max >= 2);
+    assert(requests.includes('/full.css'));
+    assert.equal(await loadingPage.locator('[data-data-mode=text]').isVisible(),true);
+    assert.match(await loadingPage.locator('[data-data-progress-label]').innerText(),/页面样式/);
+    assert.equal(await loadingPage.getAttribute('html','data-edgepress-data-mode'),'full');
+    const switchStarted = performance.now();
+    await Promise.all([loadingPage.waitForNavigation({waitUntil:'domcontentloaded'}),loadingPage.locator('[data-data-mode=text]').click()]);
+    await loadingPage.locator('main').waitFor({state:'visible'});
+    const switchAfterMs = Math.round(performance.now()-switchStarted);
+    assert(switchAfterMs < 6000,'Pending full CSS must not delay the text switch: ' + switchAfterMs);
+    assert(!requests.includes('/large.png'));
+    assert(!requests.includes('/engine.js'));
+    console.log(JSON.stringify({pendingFullStyleSwitchAfterMs:switchAfterMs}));
+    await pending.close();
+  } finally {
+    await browser.close();
+    for (const timer of timers) clearTimeout(timer);
+    server.closeAllConnections();
+    await new Promise(resolve => server.close(resolve));
+  }
+});