edgepress 2026.10.1 → 2026.10.13

package/tests/data-saver.test.mjs

@@ -0,0 +1,294 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { createExtensions } from '../src/plugin-api.js';
+import { collectAssets, rewriteAssetLinks } from '../src/assets.js';
+import { renderLayout } from '../src/theme.js';
+import { configureDataSaver, dataSaverHtml, dataSaverLayout } from '../src/data-saver.js';
+import { chromium, firefox } from 'playwright';
+
+test('data-saving variants are opt-in and require safe theme-owned assets', async () => {
+  const config = await loadConfig(process.cwd());
+  assert.equal(config.site.dataSaver.enabled, false);
+  assert.match(dataSaverHtml('<html><head></head><body>Text</body></html>', config), /"enabled":false/);
+  config.site.dataSaver.enabled = true;
+  await configureDataSaver(config);
+  assert.equal(config.dataSaverTheme.stylesheet, 'data-saver-theme.css');
+  assert.deepEqual(config.dataSaverTheme.scripts, []);
+  const directory = await mkdtemp(resolve(tmpdir(), 'edgepress-data-'));
+  try {
+    await mkdir(resolve(directory, 'assets'));
+    config.resolvedPaths.theme = directory;
+    for (const variant of [undefined, { stylesheet: '../outside.css', scripts: [] }, { stylesheet: 'light.css', scripts: ['https://outside.test/app.js'] }, { stylesheet: 'light.css', scripts: [], unknown: true }]) {
+      await writeFile(resolve(directory, 'theme.json'), JSON.stringify({ dataSaver: variant }));
+      await assert.rejects(configureDataSaver(config));
+    }
+    for (const setting of ['enabled: yes', 'debug: yes', 'mode: invalid', 'detectSlowConnection: 1', 'respectBrowserPreference: null', 'promptAfterMs: 99', 'promptAfterMs: 60001', 'promptAfterMs: 500.5', 'unknown: true']) {
+      await writeFile(resolve(directory, 'config.yml'), 'site:\n  dataSaver:\n    ' + setting + '\n');
+      await assert.rejects(loadConfig(directory), /site.dataSaver/);
+    }
+  } finally { await rm(directory, { recursive: true, force: true }); }
+});
+
+test('text mode defers actual requests, preserves external prompts and loads only requested pictures', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled: true, mode: 'auto', detectSlowConnection: true, respectBrowserPreference: true };
+  config.site.externalLinks = { enabled: true, trustedOrigins: [] };
+  await configureDataSaver(config);
+  const extensions = await createExtensions(config);
+  const assets = await collectAssets(config, { documentViewer: true });
+  const files = new Map(assets.assets.map(item => ['/' + item.path, item.content]));
+  let html;
+  const image = await readFile('content/assets/edgepress/favicon/favicon-16.png');
+  const server = createServer((request, response) => {
+    const path = new URL(request.url, 'http://localhost').pathname;
+    const type = path.endsWith('.js') ? 'text/javascript' : path.endsWith('.css') ? 'text/css' : path.endsWith('.png') ? 'image/png' : 'text/html';
+    const content = path === '/' ? html : path.endsWith('.png') ? image : files.get(path);
+    response.writeHead(content ? 200 : 404, { 'Content-Type': type }).end(content || '');
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const origin = 'http://127.0.0.1:' + server.address().port;
+  config.site.url = origin;
+  const body = '<section class="post-content"><h1>Readable text</h1><p>Keep this paragraph.</p><a href="https://news.example.test/story">Outside</a><picture><source srcset="/one.png 1x"><img src="/one.png" alt="First image" width="1" height="1"></picture><img src="/two.png" alt="Second image"><video src="/large.mp4" poster="/poster.png" preload="auto"></video><section data-edgepress-document data-document-src="/large.pdf" data-document-title="Document"><div data-document-mount></div></section></section>';
+  const chart = '<figure><img src="/chart.png" alt="Sales grew from 10 to 15 units in September; the increase is 50%."><figcaption>Chart context and original source.</figcaption></figure>';
+  html = dataSaverHtml(rewriteAssetLinks(await renderLayout(config, extensions, { locale: 'en', title: 'Text', urlPath: '/' }, body + chart), assets.urlMap), config, assets.urlMap);
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    for (const hints of [{ saveData: true, effectiveType: '4g' }]) {
+      const context = await browser.newContext({ viewport: { width: 390, height: 844 }, colorScheme: 'dark', reducedMotion: 'reduce' });
+      await context.addInitScript(hints => Object.defineProperty(navigator, 'connection', { get: () => hints }), hints);
+      const page = await context.newPage();
+      const requests = [];
+      page.on('request', request => requests.push(request.url()));
+      await page.goto(origin);
+      assert.equal(await page.getAttribute('html', 'data-edgepress-data-mode'), 'text');
+      await page.waitForFunction(() => document.documentElement.dataset.edgepressDataReady === 'true');
+      await page.locator('main').waitFor({ state: 'visible' });
+      assert.match(await page.locator('main').innerText(), /Keep this paragraph/);
+      assert.match(await page.locator('main').innerText(), /First image/);
+      assert.equal(await page.locator('[data-data-description]').filter({ hasText: 'First image' }).isVisible(), true);
+      assert.match(await page.locator('main').innerText(), /Sales grew from 10 to 15 units/);
+      assert.equal(await page.locator('figcaption').innerText(), 'Chart context and original source.');
+      assert(!requests.some(url => /chart\.png/.test(url)));
+      assert.doesNotMatch(await page.locator('body').innerText(), /<img|<source|<video/);
+      assert.equal(await page.locator('.edgepress-data-controls').count(), 0);
+      assert.equal(await page.locator('header button[data-data-mode]').count(), 0);
+      assert(!requests.some(url => /one\.png|two\.png|poster\.png|large\.(?:pdf|mp4)|woff|\/style\.|document-viewer.*\.js|image-viewer.*\.js/.test(url)));
+      assert(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth));
+      if (await page.locator('.privacy-close').isVisible()) await page.locator('.privacy-close').click();
+      await page.getByText('Outside', { exact: true }).click();
+      assert.equal(await page.locator('.edgepress-external-url').textContent(), 'https://news.example.test/story');
+      await page.keyboard.press('Escape');
+      assert.equal(await page.evaluate(() => document.activeElement.textContent), 'Outside');
+      await page.getByRole('button', { name: 'Load this media: First image', exact: true }).click();
+      await page.locator('main img[src="/one.png"]').evaluate(element => element.decode());
+      assert(requests.some(url => url.endsWith('/one.png')));
+      assert(!requests.some(url => /two\.png|poster\.png|large\.(?:pdf|mp4)|woff|\/style\.|document-viewer.*\.js/.test(url)));
+      await page.getByRole('button', { name: 'Load this media: Second image', exact: true }).click();
+      await page.locator('main img[src="/two.png"]').evaluate(element => element.decode());
+      assert(!requests.some(url => /large\.(?:pdf|mp4)|woff|\/style\./.test(url)));
+      await Promise.all([page.waitForNavigation(), page.getByRole('button', { name: 'Show the full page', exact: true }).click()]);
+      assert.equal(await page.getAttribute('html', 'data-edgepress-data-mode'), 'full');
+      await page.waitForFunction(() => document.activeElement.tagName === 'MAIN');
+      assert.equal(await page.locator('[data-data-return]').isVisible(), false);
+      assert(requests.some(url => /\/style\./.test(url)));
+      await context.close();
+    }
+    const noScript = await browser.newContext({ javaScriptEnabled: false });
+    const page = await noScript.newPage();
+    await page.goto(origin);
+    assert.equal(await page.locator('main img').count(), 3);
+    assert.equal(await page.locator('main a').getAttribute('href'), 'https://news.example.test/story');
+    await noScript.close();
+    const initial = html;
+    for (const scenario of [
+      { browserPreference: false, slow: true, hints: { saveData: true, effectiveType: '4g' }, expected: 'full' },
+      { browserPreference: true, slow: false, hints: { saveData: false, effectiveType: '2g' }, expected: 'full' },
+      { browserPreference: false, slow: false, hints: { saveData: true, effectiveType: '2g' }, expected: 'full' },
+      { browserPreference: true, slow: true, hints: null, expected: 'full' },
+      { browserPreference: true, slow: true, hints: { saveData: true, effectiveType: '2g' }, stored: 'full', expected: 'full' },
+      { browserPreference: false, slow: false, hints: null, stored: 'text', expected: 'text' }
+    ]) {
+      html = initial.replace('"detectSlowConnection":true', '"detectSlowConnection":' + scenario.slow).replace('"respectBrowserPreference":true', '"respectBrowserPreference":' + scenario.browserPreference);
+      const context = await browser.newContext();
+      await context.addInitScript(scenario => {
+        Object.defineProperty(navigator, 'connection', { get: () => scenario.hints });
+        if (scenario.stored) localStorage.setItem('edgepress-data-mode', scenario.stored);
+      }, scenario);
+      const page = await context.newPage();
+      await page.goto(origin);
+      assert.equal(await page.getAttribute('html', 'data-edgepress-data-mode'), scenario.expected);
+      if (scenario.expected === 'full') await page.waitForFunction(() => document.documentElement.dataset.edgepressDataReady === 'true');
+      await context.close();
+    }
+    html = initial;
+    const blocked = await browser.newContext({ forcedColors: 'active' });
+    await blocked.addInitScript(() => {
+      for (const name of ['localStorage', 'sessionStorage']) Object.defineProperty(window, name, { get() { throw new DOMException('Blocked', 'SecurityError'); } });
+    });
+    const fallback = await blocked.newPage();
+    await fallback.goto(origin + '/?data-mode=text');
+    assert.equal(await fallback.getAttribute('html', 'data-edgepress-data-mode'), 'text');
+    await fallback.getByRole('button', { name: 'Show the full page', exact: true }).focus();
+    await Promise.all([fallback.waitForNavigation(), fallback.keyboard.press('Enter')]);
+    assert.equal(new URL(fallback.url()).searchParams.get('data-mode'), 'full');
+    await fallback.waitForFunction(() => document.activeElement.tagName === 'MAIN');
+    await blocked.close();
+    const alternate = await firefox.launch({ headless: true });
+    try {
+      const page = await alternate.newPage();
+      const requests = [];
+      page.on('request', request => requests.push(request.url()));
+      await page.goto(origin + '/?data-mode=text');
+      assert.equal(await page.getAttribute('html', 'data-edgepress-data-mode'), 'text');
+      assert(!requests.some(url => /one\.png|two\.png|poster\.png|large\.(?:pdf|mp4)|woff|\/style\./.test(url)), JSON.stringify(requests));
+      await page.getByRole('button', { name: 'Load this media: Second image', exact: true }).click();
+      await page.locator('main img[src="/two.png"]').evaluate(element => element.decode());
+    } finally { await alternate.close(); }
+  } finally {
+    await browser.close();
+    await new Promise(resolve => server.close(resolve));
+  }
+});
+
+test('full mode restores preloaded styles before revealing a stable keyboard-accessible page', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled: true, mode: 'full', detectSlowConnection: false, respectBrowserPreference: false };
+  await configureDataSaver(config);
+  const script = await readFile('static/edgepress/data-saver.js');
+  const stylesheet = await readFile('static/edgepress/data-saver.css');
+  const html = dataSaverHtml('<html lang="en"><head><link rel="preload" as="style" href="/full.css"><link rel="stylesheet" href="/full.css"></head><body><main><h1>Stable page</h1><p>Readable content</p></main></body></html>', config);
+  const server = createServer((request, response) => {
+    const path = new URL(request.url, 'http://localhost').pathname;
+    if (path === '/full.css') {
+      setTimeout(() => response.writeHead(200, { 'Content-Type': 'text/css' }).end('main{padding:100px 20px}'), 150);
+      return;
+    }
+    if (path.endsWith('.js')) response.writeHead(200, { 'Content-Type': 'text/javascript' }).end(script);
+    else if (path.endsWith('.css')) response.writeHead(200, { 'Content-Type': 'text/css' }).end(stylesheet);
+    else response.writeHead(200, { 'Content-Type': 'text/html' }).end(html);
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    const page = await browser.newPage();
+    await page.addInitScript(() => {
+      window.layoutShift = 0;
+      new PerformanceObserver(list => {
+        for (const entry of list.getEntries()) if (!entry.hadRecentInput) window.layoutShift += entry.value;
+      }).observe({ type: 'layout-shift', buffered: true });
+    });
+    await page.goto('http://127.0.0.1:' + server.address().port + '/?data-mode=full');
+    await page.waitForFunction(() => document.documentElement.dataset.edgepressDataReady === 'true');
+    assert.equal(await page.locator('main').evaluate(element => getComputedStyle(element).paddingTop), '100px');
+    assert.equal(await page.locator('link[rel="stylesheet"][href="/full.css"]').count(), 1);
+    await page.waitForTimeout(100);
+    assert(await page.evaluate(() => window.layoutShift <= 0.01));
+  } finally {
+    await browser.close();
+    await new Promise(resolve => server.close(resolve));
+  }
+});
+
+test('theme variants stay small and translated text is escaped without activating inline media', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver.enabled = true;
+  await configureDataSaver(config);
+  const result = dataSaverHtml('<html lang="zh-CN"><head></head><body><p>正文</p><img src="/picture.png" alt="&lt;script&gt;"></body></html>', config);
+  assert.match(result, /文字省流版/);
+  assert.match(result, /&lt;script&gt;/);
+  assert.match(result, /<template data-edgepress-data-html>&lt;img/);
+  const unlabelled = dataSaverHtml('<html lang="en"><head></head><body><img src="/chart.png"><img src="/decoration.png" alt=""></body></html>', config);
+  assert.equal((unlabelled.match(/<span[^>]*data-data-decorative/g) || []).length, 1, 'Missing alt is not permission to discard information');
+  for (const theme of ['default', 'folio']) {
+    const stylesheet = await readFile('themes/' + theme + '/assets/data-saver-theme.css', 'utf8');
+    assert(Buffer.byteLength(stylesheet) < 2048);
+    assert.doesNotMatch(stylesheet, /@import|@font-face|url\(/);
+  }
+});
+test('shared text layout retains themed landmarks and resolves local imports without font or media requests', async () => {
+  const config = { site: { dataSaver: { enabled: true } }, dataSaverTheme: { layoutStyles: ['style.css'] } };
+  const items = [
+    { path: 'style.css', content: Buffer.from('@import "/edgepress/fonts.css";@import "parts/cards.css";@import "https://external.test/full.css";body{display:flex;flex-direction:column;color:var(--ink)}main{flex:1}nav{display:flex}footer{border-top:1px solid var(--line)}.hero{background:u\\72l("/hero.png");padding:2rem}') },
+    { path: 'parts/cards.css', content: Buffer.from('@font-face{font-family:Heavy;src:url("/heavy.woff2")}.post-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr))}.card{--cover:url("/cover.png");color:CanvasText}') }
+  ];
+  const result = await dataSaverLayout(config, items);
+  assert.equal(result.path, 'edgepress/data-saver-layout.css');
+  const css = result.content.toString();
+  assert.match(css, /nav\{display:flex\}/);
+  assert.match(css, /footer\{border-top/);
+  assert.match(css, /grid-template-columns/);
+  assert.doesNotMatch(css, /@import|@font-face|url\(|hero\.png|heavy\.woff2|external\.test/);
+  await assert.rejects(dataSaverLayout(config, [{ path: 'style.css', content: Buffer.from('@import "style.css";') }]), /Circular/);
+  await assert.rejects(dataSaverLayout(config, [{ path: 'style.css', content: Buffer.from('@import "missing.css";') }]), /Missing/);
+  config.site.dataSaver.enabled = false;
+  assert.equal(await dataSaverLayout(config, items), null);
+});
+
+test('only a delayed first screen offers text view, without an automatic switch or permanent selector', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled: true, mode: 'auto', detectSlowConnection: true, respectBrowserPreference: true, promptAfterMs: 1500 };
+  await configureDataSaver(config);
+  const script = await readFile('static/edgepress/data-saver.js');
+  const stylesheet = await readFile('static/edgepress/data-saver.css');
+  const image = await readFile('content/assets/edgepress/favicon/favicon-16.png');
+  let delay = 0;
+  const html = dataSaverHtml('<html lang="en"><head><link rel="stylesheet" href="/full.css"></head><body><header><nav><a href="/second/">Second page</a></nav></header><main><h1>Separate page</h1><img src="/slow.png" width="200" height="100" alt="Delayed image"><a href="/third/">Third page</a></main><footer>Original footer</footer></body></html>', config);
+  const server = createServer((request, response) => {
+    const path = new URL(request.url, 'http://localhost').pathname;
+    if (path === '/slow.png') { setTimeout(() => response.writeHead(200, { 'Content-Type': 'image/png' }).end(image), delay); return; }
+    const content = path.endsWith('.js') ? script : path === '/full.css' ? 'body{margin:0}header,footer{padding:1rem}main{padding:2rem}' : path.endsWith('.css') ? stylesheet : html;
+    response.writeHead(200, { 'Content-Type': path.endsWith('.js') ? 'text/javascript' : path.endsWith('.css') ? 'text/css' : 'text/html' }).end(content);
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const origin = 'http://127.0.0.1:' + server.address().port;
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    const fast = await browser.newPage();
+    await fast.addInitScript(() => Object.defineProperty(navigator, 'connection', { get: () => ({ effectiveType: '2g', saveData: false }) }));
+    await fast.goto(origin);
+    await fast.waitForTimeout(650);
+    assert.equal(await fast.getAttribute('html', 'data-edgepress-data-mode'), 'full');
+    assert.equal(await fast.locator('[data-data-offer]').isVisible(), false);
+    assert.equal(await fast.locator('[data-data-return]').isVisible(), false);
+    delay = 2500;
+    const slow = await browser.newPage();
+    await slow.goto(origin, { waitUntil: 'domcontentloaded' });
+    const offer = slow.locator('[data-data-offer]');
+    await offer.waitFor({ state: 'visible' });
+    assert.equal(await slow.getAttribute('html', 'data-edgepress-data-mode'), 'full');
+    assert.equal(await slow.locator('header').count(), 1);
+    assert.equal(await slow.locator('footer').count(), 1);
+    await offer.getByRole('button', { name: 'Keep waiting' }).focus();
+    await slow.keyboard.press('Escape');
+    assert.equal(await offer.isVisible(), true);
+    assert.equal(await slow.locator('main').isVisible(), false);
+    assert.equal(await slow.locator('[data-data-wait]').isVisible(), true);
+    assert.equal(await slow.evaluate(() => document.activeElement.hasAttribute('data-data-progress-label')), true);
+    const choose = await browser.newPage();
+    await choose.goto(origin, { waitUntil: 'domcontentloaded' });
+    await choose.getByRole('button', { name: 'Use text view', exact: true }).waitFor();
+    await choose.getByRole('button', { name: 'Use text view', exact: true }).focus();
+    await Promise.all([choose.waitForNavigation(), choose.keyboard.press('Enter')]);
+    assert.equal(await choose.getAttribute('html', 'data-edgepress-data-mode'), 'text');
+    await choose.waitForFunction(() => document.activeElement.tagName === 'MAIN');
+    assert.equal(await choose.locator('header nav a').textContent(), 'Second page');
+    assert.equal(await choose.locator('footer').textContent(), 'Original footer');
+    assert.doesNotMatch(await choose.locator('body').innerText(), /<img/);
+    const disabled = await browser.newPage();
+    await disabled.route('**/edgepress/data-saver.js', route => route.fulfill({ contentType: 'text/javascript', body: script }));
+    await disabled.route(origin + '/', route => route.fulfill({ contentType: 'text/html', body: html.replace('"detectSlowConnection":true', '"detectSlowConnection":false') }));
+    await disabled.goto(origin, { waitUntil: 'domcontentloaded' });
+    await disabled.waitForTimeout(500);
+    assert.equal(await disabled.locator('[data-data-offer]').isVisible(), false);
+  } finally { await browser.close(); await new Promise(resolve => server.close(resolve)); }
+});

package/tests/document-package.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, resolve } from 'node:path';
+
+test('cloud dependency is pinned to a published source commit and excludes the removed PPT engine', async () => {
+  const manifest = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+  const lock = JSON.parse(await readFile(new URL('../package-lock.json', import.meta.url), 'utf8'));
+  const source = manifest.dependencies['@jsw-teams/document-viewer'];
+  assert.match(source, /^https:\/\/codeload\.github\.com\/jsw-teams\/document-viewer\/tar\.gz\/[a-f0-9]{40}$/);
+  assert.equal(lock.packages['node_modules/@jsw-teams/document-viewer'].resolved, source);
+  assert.ok(!manifest.files.includes('vendor'));
+  assert.ok(!lock.packages['node_modules/@file-viewer/ppt']);
+  assert.equal(manifest.overrides['@file-viewer/doc'].dompurify, '3.4.17');
+  const sanitizerVersions = Object.entries(lock.packages).filter(([path]) => path.endsWith('node_modules/dompurify')).map(([, dependency]) => dependency.version);
+  assert.deepEqual(sanitizerVersions, ['3.4.17']);
+  const require = createRequire(import.meta.url);
+  const root = resolve(dirname(require.resolve('@jsw-teams/document-viewer')), '..');
+  const component = JSON.parse(await readFile(resolve(root, 'package.json'), 'utf8'));
+  assert.ok(!component.dependencies['@file-viewer/ppt']);
+  assert.equal(component.dependencies.cfb, '1.2.2');
+  for (const path of ['src/ppt/parser.js', 'src/ppt/worker.js', 'src/renderers/ppt.js', 'src/icons.js', 'src/sheets/columns.js', 'src/sheets/column-controls.js', 'src/lucide-license.txt', 'tools/assets.mjs', 'NOTICE.md']) {
+    const content = await readFile(resolve(root, path), 'utf8');
+    assert.ok(content.length);
+    if (/\.(?:js|mjs)$/.test(path)) assert.doesNotMatch(content, /@file-viewer\/ppt|__DOCUMENT_PPT_ASSETS__|Flyfish Viewer|vendor-ppt|soffice/);
+  }
+});

package/tests/document-viewer.test.mjs

@@ -0,0 +1,152 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { createExtensions } from '../src/plugin-api.js';
+import { renderBlocks } from '../src/page-blocks.js';
+import { renderMarkdown, plainText } from '../src/markdown.js';
+import { parseDocument, renderDocument } from '../src/document.js';
+import { collectAssets, rewriteAssetLinks } from '../src/assets.js';
+import { renderLayout } from '../src/theme.js';
+import { contentPermissions } from '../src/consent-csp.js';
+import { createRequire } from 'node:module';
+import { extname } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { chromium } from 'playwright';
+
+async function configuration() {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  return config;
+}
+
+test('articles and Pages share inline document previews, escaping, no download links and inert code examples', async () => {
+  const config = await configuration();
+  const renderer = (await createExtensions(config)).renderer('.md');
+  const context = { config, locale: 'en' };
+  const source = '!document[Annual report](/documents/report.docx)';
+  const post = await renderer.render('Before\n' + source + '\nAfter', { config, document: { locale: 'en' } });
+  const text = await renderBlocks([{ columns: 1, cells: [[{ type: 'text', text: source }]] }], context);
+  const block = await renderBlocks([{ columns: 1, cells: [[{ type: 'document', title: 'Annual report', src: '/documents/report.docx' }]] }], context);
+  for (const html of [post, text, block]) {
+    assert.match(html, /data-edgepress-document/);
+    assert.match(html, /data-document-format="docx"/);
+    assert.doesNotMatch(html, /Download original|<a\b/);
+    assert.match(html, /data-document-mount/);
+    assert.doesNotMatch(html, /<figcaption>/);
+    assert.doesNotMatch(html, /<iframe|<p>\s*<figure/);
+  }
+  for (const example of ['`' + source + '`', '```md\n' + source + '\n```', '\\' + source]) {
+    assert.doesNotMatch(await renderer.render(example, { config, document: { locale: 'en' } }), /data-edgepress-document/);
+  }
+  assert.match(plainText(source), /Annual report/);
+  assert.doesNotMatch(plainText(source), /!document|report\.docx/);
+  assert.match(renderDocument({ title: '<script>title</script>', src: '/report.pdf' }, context), /&lt;script&gt;/);
+  assert.throws(() => renderDocument({ title: 'Unsafe', src: 'javascript:alert(1)', format: 'pdf' }, context));
+  assert.throws(() => renderDocument({ title: 'Invalid format', src: '/report.exe' }, context), /Unsupported/);
+  assert.throws(() => renderDocument({ title: 'Unknown field', src: '/report.pdf', scripts: true }, context), /Unsupported document field/);
+  assert.equal(parseDocument('!document[Shared](https://files.example/download/123){format=pdf service=documents}').format, 'pdf');
+  assert.throws(() => parseDocument('!document[Title](/a.pdf){script=evil}'));
+  assert.doesNotMatch(await renderMarkdown(source), /data-edgepress-document/);
+});
+
+test('remote direct-file URLs require a registered enabled consent service and cannot expand origin permissions', async () => {
+  const config = await configuration();
+  const context = { config, locale: 'en' };
+  const block = { title: 'Shared', src: 'https://files.example/download/123', format: 'xlsx', service: 'documents' };
+  assert.throws(() => renderDocument(block, context), /registered external-api/);
+  config.browserPlugins.services = [{ id: 'documents', enabled: true, provider: 'external-api', backendUrl: 'https://files.example', purpose: 'Read shared documents' }];
+  assert.match(renderDocument(block, context), /data-document-service="documents"/);
+  assert.throws(() => renderDocument({ ...block, src: 'https://unapproved.example/report.xlsx' }, context), /registered service origin/);
+  assert.throws(() => renderDocument({ ...block, previewSrc: 'https://unapproved.example/report.xlsx' }, context), /registered service origin/);
+  config.browserPlugins.services[0].enabled = false;
+  assert.doesNotMatch(renderDocument(block, context), /data-edgepress-document/);
+  assert.deepEqual(contentPermissions([{ body: '<template><figure data-edgepress-document></figure></template>' }]), {});
+  assert.deepEqual(contentPermissions([{ body: '<figure data-edgepress-document></figure>' }]), { 'script-src': ["'wasm-unsafe-eval'"], 'font-src': ['blob:'] });
+});
+
+test('document modules and Worker references are fingerprinted together, with no proprietary runtime', { timeout: 60000 }, async () => {
+  const config = await configuration();
+  const bundle = await collectAssets(config, { documentViewer: true });
+  const paths = new Set(bundle.assets.map(asset => '/' + asset.path));
+  for (const source of ['/edgepress/document-viewer/index.js', '/edgepress/document-viewer/pdf.worker.js', '/edgepress/document-viewer/ppt.worker.js', '/edgepress/document-viewer/styles.css']) {
+    assert.match(bundle.urlMap[source], /\.[a-f0-9]{16}\.(?:js|css)$/);
+    assert.ok(paths.has(bundle.urlMap[source]));
+  }
+  const scripts = bundle.assets.filter(asset => asset.content && asset.path.startsWith('edgepress/document-viewer/') && asset.path.endsWith('.js')).map(asset => asset.content.toString()).join('\n');
+  assert.match(scripts, /new URL\(["']\.\.\/pdf\.worker\.[a-f0-9]{16}\.js/);
+  assert.match(scripts, /new Worker\(new URL\(["']\.\.\/ppt\.worker\.[a-f0-9]{16}\.js/);
+  assert.doesNotMatch(scripts, /vendor-ppt|ppt-native\.wasm|Flyfish Viewer/);
+  const content = renderDocument({ title: 'PDF', src: '/report.pdf' }, { config, locale: 'en' });
+  const html = rewriteAssetLinks(await renderLayout(config, { filter: async (_name, value) => value }, { title: 'PDF', locale: 'en', urlPath: '/documents/' }, content), bundle.urlMap);
+  assert.match(html, /document-viewer\.[a-f0-9]{16}\.js/);
+  assert.match(html, /styles\.[a-f0-9]{16}\.css/);
+  assert.match(html, /edgepress-document-viewer-config/);
+});
+
+test('hashed EdgePress viewer previews shared URLs inline only after current consent', { timeout: 60000 }, async () => {
+  const config = await configuration();
+  config.site.url = 'https://site.example/';
+  config.browserPlugins.services = [{ id: 'documents', enabled: true, provider: 'external-api', backendUrl: 'https://files.example',
+    name: 'Shared documents', purpose: 'Read a selected shared document.', dataCategories: 'IP address and selected URL.',
+    recipient: 'File owner', retention: 'No viewer storage', privacyUrl: 'https://files.example/privacy/' }];
+  const bundle = await collectAssets(config, { documentViewer: true });
+  const extensions = await createExtensions(config);
+  const content = renderDocument({ title: 'Shared worksheet', src: 'https://files.example/download/123', format: 'xlsx', service: 'documents' }, { config, locale: 'en' });
+  const html = rewriteAssetLinks(await renderLayout(config, extensions, { title: 'Shared document', locale: 'en', urlPath: '/documents/' }, content), bundle.urlMap);
+  const assets = new Map(bundle.assets.map(asset => ['/' + asset.path, asset]));
+  const require = createRequire(import.meta.url);
+  const { utils, write } = createRequire(require.resolve('@jsw-teams/document-viewer'))('xlsx');
+  const workbook = utils.book_new();
+  utils.book_append_sheet(workbook, utils.aoa_to_sheet([['Shared preview is inline']]), 'Shared');
+  const bytes = write(workbook, { type: 'buffer', bookType: 'xlsx' });
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    const context = await browser.newContext({ viewport: { width: 320, height: 850 } });
+    const page = await context.newPage();
+    await page.addInitScript(() => {
+      window.documentTools = {};
+      Object.defineProperty(document, 'modelContext', { value: { registerTool(tool) { window.documentTools[tool.name] = tool; } } });
+    });
+    const errors = [];
+    let loads = 0;
+    page.on('pageerror', error => errors.push(error.message));
+    page.on('download', () => errors.push('Unexpected browser download'));
+    await context.route('**/*', async route => {
+      const url = new URL(route.request().url());
+      if (url.origin === 'https://files.example') {
+        assert.equal(url.pathname, '/download/123');
+        loads++;
+        return route.fulfill({ contentType: 'application/octet-stream', headers: { 'Access-Control-Allow-Origin': 'https://site.example', 'Content-Disposition': 'inline' }, body: bytes });
+      }
+      if (url.pathname === '/documents/') return route.fulfill({ contentType: 'text/html', body: html });
+      const asset = assets.get(url.pathname);
+      if (!asset) return route.fulfill({ status: 404, body: '' });
+      const types = { '.js': 'text/javascript', '.mjs': 'text/javascript', '.css': 'text/css', '.svg': 'image/svg+xml', '.woff2': 'font/woff2' };
+      return route.fulfill({ contentType: types[extname(url.pathname)] || 'application/octet-stream', body: asset.content || await readFile(asset.source) });
+    });
+    await page.goto('https://site.example/documents/');
+    await page.getByRole('button', { name: 'Preview document', exact: true }).waitFor();
+    assert.equal(loads, 0);
+    await page.evaluate(() => document.querySelector('.document-viewer button').click());
+    assert.equal(loads, 0);
+    assert.equal(await page.locator('iframe').count(), 0);
+    await page.waitForFunction(() => window.documentTools.edgepress_control_document);
+    await page.evaluate(() => window.documentTools.edgepress_control_document.execute({ document: '1', action: 'open' }));
+    assert.equal(loads, 0);
+    assert.equal(await page.locator('iframe').count(), 0);
+    await page.evaluate(async choiceUrl => {
+      const { makeChoice } = await import(choiceUrl);
+      const settings = JSON.parse(document.getElementById('edgepress-privacy-config').textContent);
+      localStorage.setItem('edgepress-privacy-selection', JSON.stringify(makeChoice(settings, ['documents'])));
+      document.querySelector('[data-consent-ui]')?.remove();
+      document.querySelector('.document-viewer button').click();
+    }, bundle.urlMap['/edgepress/plugins/consent/choices.js']);
+    await page.frameLocator('iframe').getByText('Shared preview is inline', { exact: true }).waitFor();
+    assert.equal(loads, 1);
+    await page.evaluate(() => { localStorage.removeItem('edgepress-privacy-selection'); dispatchEvent(new Event('storage')); });
+    assert.equal(await page.locator('iframe').count(), 0);
+    assert.deepEqual(errors, []);
+    await context.close();
+  } finally { await browser.close(); }
+});

package/tests/edge-issues.test.mjs

@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {resolve,extname} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {createExtensions} from '../src/plugin-api.js';
+import {renderLayout} from '../src/theme.js';
+import {renderBlocks} from '../src/page-blocks.js';
+import {reserveImageDimensions} from '../src/image-dimensions.js';
+
+test('Edge reports no unnamed form fields or unsized lazy images in responsive pages',async()=>{
+  const root=fileURLToPath(new URL('../',import.meta.url));
+  const config=await loadConfig(root);await loadLanguagePacks(config);
+  config.site.url='https://edge-issues.invalid';
+  config.resolvedPaths.theme=config.realPaths.theme=resolve(root,'themes/default');
+  config.site.navigation=[{key:'projects',url:'/projects/',labels:{en:'Projects'},children:[{key:'demo',url:'/demo/',labels:{en:'Demo'}}]}];
+  config.site.footerNavigation=[{key:'more',url:'/more/',labels:{en:'More'},children:[{key:'help',url:'/help/',labels:{en:'Help'}}]}];
+  const blocks=await renderBlocks([{columns:2,cells:Array.from({length:2},()=>[{type:'media-text',mediaType:'image',src:'/preview.svg',alt:'Demo',title:'Demo',text:'A responsive local preview.',animationSrc:'/demo.mp4'}])}],{config,locale:'en',site:{posts:[],pages:[]}});
+  const html=reserveImageDimensions(await renderLayout(config,await createExtensions(config),{locale:'en',title:'Demo',urlPath:'/'},'<h1>Demo</h1><article class="page-builder">'+blocks+'</article>'),new Map([['/preview.svg',{width:1200,height:750}]]),'index.html',config.site.url);
+  const browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{})});
+  try{
+    for(const width of [390,1440]){
+      const context=await browser.newContext({viewport:{width,height:900}});
+      await context.route('**/*',async route=>{
+        const url=new URL(route.request().url());assert.equal(url.origin,config.site.url);
+        if(url.pathname==='/')return route.fulfill({contentType:'text/html',body:html,headers:{'Content-Security-Policy':"default-src 'self'; style-src 'self'; script-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; worker-src 'self' blob:"}});
+        // Delay decoding: layout and the browser audit must succeed before bytes arrive.
+        if(url.pathname==='/preview.svg')return;
+        const path=url.pathname==='/style.css'?resolve(root,'themes/default/assets/style.css'):resolve(root,'static','.'+url.pathname);
+        const types={'.css':'text/css','.js':'text/javascript','.woff2':'font/woff2','.svg':'image/svg+xml'};
+        try{return route.fulfill({body:await readFile(path),contentType:types[extname(path)]||'application/octet-stream'});}
+        catch{return route.fulfill({status:404,body:''});}
+      });
+      const page=await context.newPage(),cdp=await context.newCDPSession(page),issues=[];
+      cdp.on('Audits.issueAdded',({issue})=>{
+        if(issue.code==='ContentSecurityPolicyIssue'||issue.code==='LazyLoadImageIssue'||issue.details.genericIssueDetails?.errorType==='FormEmptyIdAndNameAttributesForInputError')issues.push(issue);
+      });
+      await cdp.send('Audits.enable');await page.goto(config.site.url,{waitUntil:'domcontentloaded'});
+      await page.locator('.privacy-panel').waitFor({state:'visible'});
+      await page.locator('[data-navigation-select]').first().waitFor({state:'visible'});
+      const fields=await page.locator('input,select,textarea').evaluateAll(nodes=>nodes.map(node=>node.id||node.name));
+      assert.ok(fields.length>=5);assert.ok(fields.every(Boolean));assert.equal(new Set(fields).size,fields.length);
+      for(const image of await page.locator('img[loading=lazy]').all()){
+        const box=await image.boundingBox();assert.ok(box.width>0&&box.height>0);
+        assert.ok(Math.abs(box.width/box.height-1200/750)<.01);
+        assert.equal(await image.evaluate(node=>node.naturalWidth),0);
+      }
+      // Exercise both runtime photo paths without contacting a provider.
+      const photos=await page.evaluate(async()=>{
+        const {trustedEmbed,trustedProviderEmbed}=await import('/edgepress/oembed.js');
+        const data={version:'1.0',type:'photo',url:location.origin+'/preview.svg',width:1200,height:750,title:'Photo'};
+        const images=[trustedEmbed(data,location.origin,document),trustedProviderEmbed(data,{backendUrl:location.origin},document),trustedEmbed({...data,width:undefined,height:undefined},location.origin,document)];
+        document.querySelector('main').append(...images);
+        return images.map(image=>({width:Number(image.getAttribute('width')),height:Number(image.getAttribute('height')),ratio:image.style.aspectRatio}));
+      });
+      assert.equal(photos[0].width,1200);assert.equal(photos[1].height,750);assert.match(photos[2].ratio,/4\s*\/\s*3/);
+      await page.evaluate(()=>new Promise(resolve=>requestAnimationFrame(()=>requestAnimationFrame(resolve))));
+      assert.deepEqual(issues,[],`${width}px Edge Issues`);
+      await context.close();
+    }
+  }finally{await browser.close();}
+});

package/tests/embed-syntax.test.mjs

@@ -0,0 +1,68 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {createExtensions} from '../src/plugin-api.js';
+import {renderBlocks} from '../src/page-blocks.js';
+
+test('posts and Pages share validated embed lines, with inert code examples and disabled services', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  const service = {id:'youtube', provider:'oembed', backendUrl:'https://www.youtube.com', sourceOrigins:['https://www.youtube.com'], embedOrigins:['https://www.youtube.com'], name:'YouTube', embedPathPattern:'^/watch$', embedTemplate:'https://www.youtube.com/embed/example'};
+  // The fixture uses a local template and never contacts a real provider.
+  delete service.embedPathPattern;
+  config.browserPlugins.services = [service];
+  const renderer = (await createExtensions(config)).renderer('.md');
+  const source = '!embed[youtube](https://www.youtube.com/watch?v=example)';
+  const article = await renderer.render('Before\n' + source + '\nAfter', {config, document:{locale:'en'}});
+  const page = await renderBlocks([{columns:1, cells:[[{type:'text', text:'Before\n' + source + '\nAfter\n<script>unsafe</script>'}]]}], {config, locale:'en'});
+  for (const html of [article, page]) {
+    assert.match(html, /data-edgepress-oembed="youtube"/);
+    assert.match(html, /data-oembed-data/);
+    assert.doesNotMatch(html, /<iframe|<script|<p>\s*<figure/);
+    assert.match(html, /Before/); assert.match(html, /After/);
+  }
+  assert.match(page, /&lt;script&gt;unsafe/);
+  for (const example of ['`' + source + '`', '```md\n' + source + '\n```', '\\' + source]) {
+    assert.doesNotMatch(await renderer.render(example, {config, document:{locale:'en'}}), /data-edgepress-oembed/);
+  }
+  for (const unsafe of ['https://evil.example/video', 'https://user:password@www.youtube.com/watch', 'http://www.youtube.com/watch']) {
+    await assert.rejects(renderer.render('!embed[youtube](' + unsafe + ')', {config, document:{locale:'en'}}), /registered HTTPS/);
+  }
+  await assert.rejects(renderer.render('!embed[unknown](https://www.youtube.com/watch)', {config, document:{locale:'en'}}), /registered oembed service/);
+  service.enabled = false;
+  const disabled = await renderer.render(source, {config, document:{locale:'en'}});
+  assert.match(disabled, /data-oembed-disabled/);
+  assert.doesNotMatch(disabled, /data-edgepress-oembed|data-oembed-data|<iframe/);
+});
+
+
+test('article summaries and search text omit embeds while retaining prose and code examples',async()=>{
+ const {renderMarkdownExcerpt,plainText}=await import('../src/markdown.js');
+ const source='!embed[youtube](https://www.youtube.com/watch?v=example)\n\nA quiet afternoon.';
+ assert.equal((await renderMarkdownExcerpt(source)).trim(),'<p>A quiet afternoon.</p>');
+ assert.equal(plainText(source),'A quiet afternoon.');
+ assert.match(plainText('`!embed[youtube](https://www.youtube.com/watch?v=example)`'),/!embed\[youtube\]/);
+});
+
+
+test('Markdown article links and excerpts resolve raw and encoded locale placeholders without rewriting other URLs',async()=>{
+ const {localizedContentUrl}=await import('../src/i18n.js');const {renderMarkdown,renderMarkdownExcerpt}=await import('../src/markdown.js');
+ const config={i18n:{defaultLocale:'en'}};
+ for(const locale of ['en','zh-CN']){
+  const resolve=value=>localizedContentUrl(config,locale,value),prefix=locale==='en'?'':'/'+locale;
+  for(const token of ['[launge]','%5Blaunge%5D']){
+   const source='[Guide](/'+token+'/edgepress/guide/)';
+   for(const render of [renderMarkdown,renderMarkdownExcerpt])assert.match(await render(source,{linkResolver:resolve}),new RegExp('href="'+prefix+'/edgepress/guide/"'));
+  }
+  assert.equal(resolve('https://example.com/[launge]/'),'https://example.com/[launge]/');assert.equal(resolve('/explicit/'),'/explicit/');
+  assert.throws(()=>resolve('/other/[launge]/'),/first site-path segment/);
+ }
+});
+
+
+test('revision comparisons keep localized links valid without loading historical embeds',async()=>{
+ const {renderRevisionCards}=await import('../src/revision-cards.js');const {localizedContentUrl}=await import('../src/i18n.js');
+ const html=await renderRevisionCards('-[Old guide](/[launge]/guide/)\n+[Current guide](/[launge]/edgepress/)',key=>key,null,{linkResolver:value=>localizedContentUrl({i18n:{defaultLocale:'en'}},'zh-CN',value)});
+ assert.match(html,/href="\/zh-CN\/guide\/"/);assert.match(html,/href="\/zh-CN\/edgepress\/"/);assert.doesNotMatch(html,/%5Blaunge|data-edgepress-oembed/);
+});