edgepress 2026.10.1 → 2026.10.13

package/tests/external-links.test.mjs

@@ -0,0 +1,198 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { extname } from 'node:path';
+import { chromium, firefox } from 'playwright';
+import { classifyLink, linkOrigin } from '../static/edgepress/external-links-policy.js';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { collectAssets, rewriteAssetLinks } from '../src/assets.js';
+import { createExtensions } from '../src/plugin-api.js';
+import { renderLayout } from '../src/theme.js';
+
+const settings = { enabled: true, siteUrl: 'https://site.test', trustedOrigins: ['https://trusted.test'] };
+
+test('external links use exact origins and reject executable URLs, credentials and invalid trust settings', () => {
+  for (const href of ['/article/', '#section', 'https://site.test/article/', 'https://trusted.test/path', 'mailto:hello@example.test', 'tel:+1234567']) assert.equal(classifyLink(href, settings, 'https://site.test/page/').kind, 'native');
+  for (const href of ['https://trusted.test.attacker.test', 'https://child.trusted.test', 'http://trusted.test', 'https://trusted.test:8443', '//other.test/path']) assert.equal(classifyLink(href, settings, 'https://site.test/page/').kind, 'external');
+  for (const href of ['javascript:alert(1)', 'java\nscript:alert(1)', 'data:text/html,hello', 'https://trusted.test@other.test/', 'file:///tmp/private']) assert.equal(classifyLink(href, settings, 'https://site.test/').kind, 'blocked');
+  // A cross-origin <base> or an absolute GitHub file URL must not silently become trusted.
+  const outsideBase = 'https://untrusted.test/embedded/';
+  assert.equal(classifyLink('https://untrusted.test/file.mp4', settings, outsideBase).kind, 'external');
+  assert.equal(classifyLink('/file.mp4', settings, outsideBase).kind, 'external');
+  const githubFilm = 'https://github.com/jsw-teams/ai-video-production-workflow/blob/main/projects/guoqing/final.mp4';
+  const githubTarget = classifyLink(githubFilm, settings, 'https://site.test/article/');
+  assert.equal(githubTarget.kind, 'external');
+  assert.equal(githubTarget.url, githubFilm);
+  assert.equal(linkOrigin('https://trusted.test/'), 'https://trusted.test');
+  for (const origin of ['https://*.test', 'https://trusted.test/path', 'https://user@trusted.test', 'javascript:alert(1)', 'https://trusted.test?next=other', 'https://trusted.test#hash']) assert.throws(() => linkOrigin(origin));
+});
+
+test('prompts are opt-in, localized and fingerprint their complete dependency graph', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  const extensions = await createExtensions(config);
+  const page = { title: 'External links', locale: 'en', urlPath: '/links/' };
+  assert.ok(!(await renderLayout(config, extensions, page, '<main>Links</main>')).includes('edgepress-external-links-config'));
+  config.site.externalLinks = settings;
+  const html = await renderLayout(config, extensions, page, '<main>Links</main>');
+  assert.ok(html.includes('edgepress-external-links-config'));
+  const bundle = await collectAssets(config);
+  assert.match(bundle.urlMap['/edgepress/external-links.js'], /\.[a-f0-9]{16}\.js$/);
+  const runtime = bundle.assets.find(asset => '/' + asset.path === bundle.urlMap['/edgepress/external-links.js']).content.toString();
+  assert.match(runtime, /function classifyLink\(/);
+  assert.doesNotMatch(runtime, /from["']\.\/external-links-policy/);
+  assert.match(rewriteAssetLinks(html, bundle.urlMap), /external-links\.[a-f0-9]{16}\.css/);
+});
+
+test('site settings normalize exact origins and reject invalid prompt configuration', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-link-settings-'));
+  try {
+    await writeFile(resolve(root, 'edgepress.config.mjs'), 'export default { i18n: { defaultLocale: "en", languagePacks: [] } };');
+    const consent = 'plugins:\n  consent:\n    enabled: false\n    proposedDate: 2026-10-09\n';
+    await writeFile(resolve(root, 'config.yml'), consent + 'site:\n  url: https://site.test\n  externalLinks:\n    enabled: true\n    trustedOrigins: [https://trusted.test/, https://trusted.test]\n');
+    assert.deepEqual((await loadConfig(root)).site.externalLinks.trustedOrigins, ['https://trusted.test']);
+    for (const configuration of ['enabled: yes', 'trustedOrigins: [https://trusted.test/path]', 'trustedOrigins: [https://*.test]', 'trustedOrigins: [12]', 'enabled: true\n    redirect: https://other.test']) {
+      await writeFile(resolve(root, 'config.yml'), consent + 'site:\n  url: https://site.test\n  externalLinks:\n    ' + configuration + '\n');
+      await assert.rejects(loadConfig(root), /externalLinks|Trusted sites/);
+    }
+    await writeFile(resolve(root, 'config.yml'), consent + 'site:\n  externalLinks:\n    enabled: true\n');
+    await assert.rejects(loadConfig(root), /site.url/);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+for (const [name, engine] of [['Chromium', chromium], ['Firefox', firefox]]) {
+  test(name + ' preserves native links with localized keyboard-accessible theme-adaptive prompts', { timeout: 90000 }, async () => {
+    const config = await loadConfig(process.cwd());
+    config.site.url = settings.siteUrl;
+    config.site.externalLinks = { enabled: true, trustedOrigins: settings.trustedOrigins };
+    await loadLanguagePacks(config);
+    const extensions = await createExtensions(config);
+    const bundle = await collectAssets(config);
+    const assets = new Map(bundle.assets.map(asset => ['/' + asset.path, asset]));
+    const browser = await engine.launch({ headless: true, args: name === 'Chromium' ? ['--disable-extensions'] : [] });
+    try {
+      for (const [locale,title,back,proceed] of [['en', "You're leaving this site", 'Return', 'Continue to website'], ['zh-CN', '即将离开本站', '返回', '继续前往']]) {
+        const context = await browser.newContext({ viewport: { width: 320, height: 720 }, colorScheme: 'dark', reducedMotion: 'reduce' });
+        const page = await context.newPage();
+        const requests = [];
+        const errors = [];
+        page.on('pageerror', error => errors.push(error.message));
+        const content = '<main><a id="external" href="https://other.test/read?q=%3Cscript%3E#chapter">Other site</a><a id="github-film" href="https://github.com/jsw-teams/ai-video-production-workflow/blob/main/projects/guoqing/final.mp4">GitHub film</a><a id="long-url" href="https://other.test/path/' + 'a'.repeat(180) + '?x=1#part">Long URL</a><a id="root-url" href="https://other.test/">Site root</a><a id="trusted" href="https://trusted.test/path">Trusted site</a><a id="internal" href="#section">Inside</a><a id="new-tab" href="https://other.test/new" target="_blank">New tab</a><a id="download" href="https://other.test/file" download>Download</a><a id="auth" href="https://other.test/auth" data-external-link-skip>Sign in</a><section id="section">Section</section></main>';
+        const html = rewriteAssetLinks(await renderLayout(config, extensions, { title: 'Links', locale, urlPath: '/links/' }, content.replace('<main>', '<div>').replace('</main>', '</div>')), bundle.urlMap);
+        await context.route('**/*', async route => {
+          const url = new URL(route.request().url());
+          if (url.origin !== settings.siteUrl) { requests.push(url.href); return route.fulfill({ contentType: 'text/html', body: '<title>Destination</title><p>Arrived</p>' }); }
+          if (url.pathname === '/links/') return route.fulfill({ contentType: 'text/html', body: html });
+          const asset = assets.get(url.pathname);
+          if (!asset) return route.fulfill({ status: 404, body: '' });
+          return route.fulfill({ contentType: ({ '.js': 'text/javascript', '.css': 'text/css', '.woff2': 'font/woff2' })[extname(url.pathname)] || 'application/octet-stream', body: asset.content || await readFile(asset.source) });
+        });
+        await page.goto(settings.siteUrl + '/links/');
+        await page.locator('.privacy-reject').click();
+        await page.addStyleTag({ content: 'body{background:#18252f;color:#e2e8f0} :root{--surface:#18252f;--paper:#18252f;--ink:#e2e8f0;--accent:#8fc7ff}' });
+        const anchor = page.locator('#external');
+        await anchor.focus(); await anchor.press('Enter');
+        const dialog = page.getByRole('dialog');
+        await dialog.waitFor();
+        assert.equal(await dialog.getByRole('heading').textContent(), title);
+        assert.equal(await dialog.locator('.edgepress-external-url').textContent(), 'https://other.test/read?q=%3Cscript%3E#chapter');
+        assert.equal(await dialog.locator('.edgepress-external-url').count(), 1);
+        assert.equal(await dialog.locator('.edgepress-external-domain, .edgepress-external-origin').count(), 0);
+        assert.equal(await dialog.locator('.edgepress-external-url').evaluate(element => element.scrollWidth <= element.clientWidth), true);
+        assert.equal(await dialog.getByRole('button', { name: back, exact: true }).evaluate(element => element === document.activeElement), true);
+        assert.deepEqual(requests, []);
+        assert.equal(await dialog.evaluate(element => getComputedStyle(element).backgroundColor), 'rgb(24, 37, 47)');
+        assert.equal(await dialog.evaluate(element => element.getBoundingClientRect().right <= innerWidth), true);
+        assert.equal(await dialog.locator('script').count(), 0);
+        assert.equal(await anchor.getAttribute('href'), 'https://other.test/read?q=%3Cscript%3E#chapter');
+        await page.keyboard.press('Tab');
+        assert.equal(await dialog.getByRole('button', { name: proceed, exact: true }).evaluate(element => element === document.activeElement), true);
+        await page.keyboard.press('Tab'); await page.keyboard.press('Shift+Tab');
+        assert.equal(await dialog.getByRole('button', { name: proceed, exact: true }).evaluate(element => element === document.activeElement), true);
+        await page.keyboard.press('Escape');
+        assert.equal(await anchor.evaluate(element => element === document.activeElement), true);
+        assert.equal(await page.locator('main').evaluate(element => element.inert), false);
+        await page.evaluate(() => window.dispatchEvent(new PageTransitionEvent('pagehide', { persisted: true })));
+        await anchor.click();
+        await dialog.waitFor();
+        await page.evaluate(() => document.body.append(document.createElement('aside')));
+        assert.equal(await page.locator('body > aside').evaluate(element => element.inert), true);
+        await page.keyboard.press('Escape');
+        assert.equal(await page.locator('body > aside').evaluate(element => element.inert), false);
+        await page.locator('#github-film').click();
+        await dialog.waitFor();
+        assert.equal(await dialog.locator('.edgepress-external-url').textContent(), 'https://github.com/jsw-teams/ai-video-production-workflow/blob/main/projects/guoqing/final.mp4');
+        assert.deepEqual(requests, [], 'The video host must not be contacted before visitor confirmation');
+        await page.keyboard.press('Escape');
+        await page.locator('#long-url').click();
+        await dialog.waitFor();
+        assert.equal(await dialog.locator('.edgepress-external-url').textContent(), 'https://other.test/path/' + 'a'.repeat(180) + '?x=1#part');
+        assert.equal(await dialog.locator('.edgepress-external-url').evaluate(element => element.scrollWidth <= element.clientWidth), true);
+        await page.keyboard.press('Escape');
+        await page.locator('#root-url').click();
+        await dialog.waitFor();
+        assert.equal(await dialog.locator('.edgepress-external-url').textContent(), 'https://other.test/');
+        assert.equal(await dialog.locator('.edgepress-external-url').count(), 1);
+        await page.keyboard.press('Escape');
+        await page.locator('#internal').click();
+        assert.ok(page.url().endsWith('#section'));
+        await anchor.click();
+        await anchor.evaluate(element => element.href = 'https://changed.test/');
+        await dialog.getByRole('button', { name: proceed, exact: true }).click();
+        assert.deepEqual(requests, []);
+        await anchor.evaluate(element => element.href = 'https://other.test/read');
+        await anchor.click();
+        await dialog.getByRole('button', { name: proceed, exact: true }).click();
+        await page.getByText('Arrived', { exact: true }).waitFor();
+        assert.deepEqual(requests, ['https://other.test/read']);
+        await page.goto(settings.siteUrl + '/links/');
+        await page.locator('#new-tab').click();
+        const popupPromise = page.waitForEvent('popup');
+        await page.getByRole('dialog').getByRole('button', { name: proceed, exact: true }).click();
+        const popup = await popupPromise;
+        await popup.waitForLoadState();
+        assert.equal(await popup.evaluate(() => window.opener), null);
+        await popup.close();
+        for (const [selector, properties] of [['#external', { ctrlKey: true }], ['#external', { metaKey: true }], ['#external', { shiftKey: true }], ['#external', { button: 1 }], ['#download', {}], ['#auth', {}]]) {
+          const native = await page.locator(selector).evaluate((element, properties) => {
+            let intercepted = false;
+            window.addEventListener('click', event => { intercepted = event.defaultPrevented; event.preventDefault(); }, { once: true });
+            element.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, ...properties }));
+            return !intercepted && document.querySelector('.edgepress-external-overlay').hidden;
+          }, properties);
+          assert.equal(native, true);
+        }
+        for (const properties of [{}, { ctrlKey: true }, { metaKey: true }, { button: 1 }]) {
+          assert.equal(await page.evaluate(properties => {
+            const unsafe = document.createElement('a');
+            unsafe.href = 'javascript:window.unsafeNavigation=true';
+            document.body.append(unsafe);
+            let intercepted = false;
+            window.addEventListener('click', event => { intercepted = event.defaultPrevented; event.preventDefault(); }, { once: true });
+            unsafe.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, ...properties }));
+            unsafe.remove();
+            return intercepted;
+          }, properties), true);
+        }
+        await page.emulateMedia({ colorScheme: 'light', forcedColors: 'active' });
+        await page.locator('#external').click();
+        assert.equal(await page.getByRole('dialog').getByRole('button', { name: back, exact: true }).evaluate(element => getComputedStyle(element).appearance), 'none');
+        await page.keyboard.press('Escape');
+        await page.locator('#trusted').click();
+        await page.getByText('Arrived', { exact: true }).waitFor();
+        const noScript = await browser.newContext({ javaScriptEnabled: false });
+        await noScript.route('**/*', route => route.fulfill({ contentType: 'text/html', body: new URL(route.request().url()).hostname === 'other.test' ? '<p>Without scripts</p>' : html }));
+        const plain = await noScript.newPage();
+        await plain.goto(settings.siteUrl + '/links/');
+        await plain.locator('#external').click();
+        await plain.getByText('Without scripts', { exact: true }).waitFor();
+        await noScript.close();
+        assert.deepEqual(errors, []);
+        await context.close();
+      }
+    } finally { await browser.close(); }
+  });
+}

package/tests/fonts.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile, mkdtemp, rm} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import {tmpdir} from 'node:os';
+import {resolve, extname} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {collectAssets, writeAssets, rewriteAssetLinks} from '../src/assets.js';
+import {renderLayout} from '../src/theme.js';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+test('mutable fonts and font metadata never receive a directory-wide immutable policy', async () => {
+  const temporary = await mkdtemp(resolve(tmpdir(), 'edgepress-font-cache-'));
+  try {
+    await writeAssets({existingHeaders: '', assets: ['fonts/regular.0123456789abcdef.woff2', 'fonts/bold.abcdef0123456789.woff2', 'fonts/custom.woff2', 'fonts/provenance.json'].map(path => ({path, content: Buffer.from('fixture')}))}, temporary);
+    const headers = await readFile(resolve(temporary, '_headers'), 'utf8');
+    assert.doesNotMatch(headers, /\/fonts\/\*/);
+    assert.doesNotMatch(headers, /\/(?:fonts\/custom\.woff2|fonts\/provenance\.json)\n\s+Cache-Control:/);
+    assert.match(headers, /\/fonts\/regular\.0123456789abcdef\.woff2\n\s+Cache-Control: public, max-age=31536000, immutable/);
+  } finally { await rm(temporary, {recursive: true, force: true}); }
+});
+test('bundled fonts retain provenance, integrity and immutable CSS dependency graphs', async () => {
+  const config = await loadConfig(root), bundle = await collectAssets(config);
+  const faces = bundle.assets.find(asset => '/' + asset.path === bundle.urlMap['/edgepress/fonts/faces.css']);
+  const css = bundle.assets.find(asset => '/' + asset.path === bundle.urlMap['/edgepress/fonts.css']).content.toString();
+  assert.match(css, /fonts\/faces\.[a-f0-9]{16}\.css/);
+  assert.match(faces.content.toString(), /unicode-range:/);
+  assert.doesNotMatch(css + faces.content.toString(), /https?:|local\(/);
+  const provenance = JSON.parse(await readFile(resolve(root, 'static/edgepress/fonts/provenance.json')));
+  for (const family of provenance) {
+    assert.equal(family.metadata.license.type, 'OFL-1.1');
+    assert.match(await readFile(resolve(root, 'static/edgepress/fonts', family.license), 'utf8'), /SIL Open Font License/);
+    for (const asset of family.files) {
+      const bytes = await readFile(resolve(root, 'static/edgepress/fonts', asset.file));
+      assert.equal(createHash('sha256').update(bytes).digest('hex'), asset.sha256);
+      assert.ok(asset.file.includes('.' + asset.sha256.slice(0, 16) + '.woff2'));
+      assert.equal(bytes.subarray(0, 4).toString(), 'wOF2');
+    }
+  }
+  const temporary = await mkdtemp(resolve(tmpdir(), 'edgepress-font-headers-'));
+  try {
+    await writeAssets(bundle, temporary);
+    const headers = await readFile(resolve(temporary, '_headers'), 'utf8');
+    assert.ok(headers.includes('/edgepress/fonts/*.woff2\n  Cache-Control: public, max-age=31536000, immutable'));
+    assert.ok(headers.split('\n').filter(line => line && !/^\s/.test(line)).length <= 100);
+  } finally { await rm(temporary, {recursive: true, force: true}); }
+});
+
+test('English, simplified and traditional text use downloaded fonts without OS glyphs', async () => {
+  const config = await loadConfig(root); await loadLanguagePacks(config);
+  config.i18n.locales = ['en']; // Isolate Latin loading from the Chinese language menu label.
+  config.site.title = config.site.header.brandLabel = 'Font fixture';
+  config.site.footer = 'Local fonts';
+  config.site.navigation = []; config.site.footerNavigation = [];
+  const bundle = await collectAssets(config), assets = new Map(bundle.assets.map(asset => ['/' + asset.path, asset]));
+  const body = '<div class="post-content"><p id="sample">EdgePress café Ελληνικά Привет</p><p id="serif" style="font-family:var(--edgepress-font-serif)">Readable stories</p><p id="notice" class="image-lightbox-status">Unavailable</p></div>';
+  const html = rewriteAssetLinks(await renderLayout(config, {filter: async (_name, value) => value}, {title: 'Font coverage', locale: 'en'}, body), bundle.urlMap);
+  const browser = await chromium.launch({headless: true, ...(process.platform === 'win32' ? {channel: 'msedge'} : {})});
+  try {
+    const context = await browser.newContext(), page = await context.newPage(), requested = [], errors = [];
+    page.on('pageerror', error => errors.push(error.message));
+    await context.route('**/*', async route => {
+      const url = new URL(route.request().url()); assert.equal(url.origin, 'https://fonts.example');
+      if (url.pathname === '/') return route.fulfill({contentType: 'text/html', body: html});
+      const asset = assets.get(url.pathname);
+      if (!asset) return route.fulfill({status: 404, body: ''});
+      if (url.pathname.endsWith('.woff2')) requested.push(url.pathname);
+      return route.fulfill({contentType: {'.css': 'text/css', '.js': 'text/javascript', '.woff2': 'font/woff2', '.svg': 'image/svg+xml'}[extname(url.pathname)] || 'application/octet-stream', body: asset.content || await readFile(asset.source)});
+    });
+    await page.goto('https://fonts.example/');
+    await page.evaluate(() => document.fonts.ready);
+    const client = await context.newCDPSession(page); await client.send('DOM.enable'); await client.send('CSS.enable');
+    async function renderedFonts(selector) {
+      const {root: document} = await client.send('DOM.getDocument');
+      const {nodeId} = await client.send('DOM.querySelector', {nodeId: document.nodeId, selector});
+      const {fonts} = await client.send('CSS.getPlatformFontsForNode', {nodeId});
+      assert.ok(fonts.length, 'No rendered glyphs: ' + selector);
+      assert.ok(fonts.every(font => font.isCustomFont), 'Used OS font: ' + JSON.stringify(fonts));
+      return fonts;
+    }
+    await renderedFonts('#sample'); await renderedFonts('#serif'); await renderedFonts('#notice');
+    assert.ok(!requested.some(path => /noto-sans-(?:sc|tc)-/.test(path)), 'English page downloaded CJK fonts');
+    for (const [lang, text, family] of [['zh-CN', '写文建站海边的下午你好世界龘', 'Noto Sans SC'], ['zh-TW', '寫文建站多媒體檢視器讓分享更簡單臺灣', 'Noto Sans TC']]) {
+      await page.evaluate(({lang, text}) => {
+        document.documentElement.lang = lang;
+        document.querySelector('#sample').textContent = text;
+        document.querySelector('#serif').textContent = text;
+        document.querySelector('#notice').textContent = text;
+        document.querySelector('#sample').style.fontFamily = 'var(--edgepress-font-sans)';
+      }, {lang, text});
+      await page.evaluate(() => document.fonts.ready);
+      for (const selector of ['#sample', '#serif', '#notice']) assert.ok((await renderedFonts(selector)).some(font => font.familyName.startsWith(family)));
+    }
+    assert.deepEqual(errors, []);
+  } finally { await browser.close(); }
+});

package/tests/image-dimensions.test.mjs

@@ -0,0 +1,15 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,writeFile,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {collectImageDimensions,reserveImageDimensions} from '../src/image-dimensions.js';
+test('local content images reserve their real aspect ratio without fetching other origins or replacing explicit dimensions',async()=>{
+ const root=await mkdtemp(join(tmpdir(),'image-dimensions-'));try{const source=join(root,'portrait.svg');await writeFile(source,'<svg xmlns="http://www.w3.org/2000/svg" width="120" height="240"></svg>');const dimensions=await collectImageDimensions([{path:'images/p.svg',source}]);
+ const rewrite=html=>reserveImageDimensions(html,dimensions,'chapter/index.html','https://site.example');assert.match(rewrite('<img src="../images/p.svg" alt="Portrait">'),/width="120" height="240"/);assert.match(rewrite('<img src="/images/p.svg" width="60">'),/height="120"/);assert.match(rewrite('<img src="/images/p.svg" height="80">'),/width="40"/);const explicit='<img src="/images/p.svg" width="60" height="60">';assert.equal(rewrite(explicit),explicit);assert.equal(rewrite('<img src="https://other.example/images/p.svg">'),'<img src="https://other.example/images/p.svg">');assert.equal(rewrite('<img src="/%ZZ.svg">'),'<img src="/%ZZ.svg">');
+ assert.match(rewrite('<img src="/images/p.svg" loading="lazy">'),/width="120" height="240"/);
+ const styled=rewrite('<img src="/images/p.svg" loading="lazy" style="border:0">');assert.match(styled,/style="border:0"/);assert.equal(rewrite(styled),styled);
+ const authored='<img src="/images/p.svg" loading="lazy" width="60" height="60" style="aspect-ratio:1 / 1">';assert.equal(rewrite(authored),authored);
+ const inert='<img data-src="/images/p.svg">';assert.equal(rewrite(inert),inert);assert.match(rewrite('<img data-width="60" src="/images/p.svg">'),/width="120" height="240"/);
+ }finally{await rm(root,{recursive:true,force:true});}
+});

package/tests/image-viewer.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import {extname} from 'node:path';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {collectAssets,rewriteAssetLinks} from '../src/assets.js';
+import {renderLayout} from '../src/theme.js';
+import {renderBlocks} from '../src/page-blocks.js';
+import {renderMarkdown} from '../src/markdown.js';
+import {contentPermissions} from '../src/consent-csp.js';
+
+test('content originals are validated and participate in CSP without permitting inert embeds',async()=>{
+ const config=await loadConfig(fileURLToPath(new URL('../',import.meta.url))),context={config,locale:'en'};
+ const html=await renderBlocks([{columns:1,cells:[[{type:'image',src:'https://preview.example/p.png',originalSrc:'https://original.example/p.png',alt:'Picture'}]]}],context);assert.match(html,/data-original="https:\/\/original.example\/p.png"/);
+ await assert.rejects(renderBlocks([{columns:1,cells:[[{type:'image',src:'/image.png',originalSrc:'javascript:alert(1)',alt:'Picture'}]]}],context));
+ const markdown=await renderMarkdown('<img src="/p.png" data-original="javascript:alert(1)" alt="Picture">');assert.doesNotMatch(markdown,/javascript|data-original/);
+ const permissions=contentPermissions([{body:html+'<template><img data-original="https://blocked.example/p.png"></template>'}]);assert.deepEqual(permissions['img-src'],['https://preview.example','https://original.example']);
+});
+
+test('article and Pages images open the shared viewer; originals wait for clicks and blocked services remain untouched',async()=>{
+ const config=await loadConfig(fileURLToPath(new URL('../',import.meta.url)));await loadLanguagePacks(config);const bundle=await collectAssets(config),assets=new Map(bundle.assets.map(item=>['/'+item.path,item]));
+ assert.match(bundle.urlMap['/edgepress/image-viewer-lib.js'],/\.[a-f0-9]{16}\.js$/);assert.doesNotMatch(assets.get(bundle.urlMap['/edgepress/image-viewer-lib.js']).content.toString(),/hls\.js|cdn\.plyr|cloudflarestream/);
+ const body='<article><div class="post-content"><p>Keep the article visible.</p><img src="/preview.svg" data-original="https://pictures.example/original.svg" alt="Article picture"><a href="/other-page/"><img src="/preview.svg" alt="Navigation picture"></a><div data-edgepress-oembed="blocked"><img src="/preview.svg" data-original="https://pictures.example/blocked.svg" alt="Blocked picture"></div></div><figure class="image-block"><img src="/preview.svg" alt="Pages picture"></figure><article class="media-text-block"><figure><img src="/preview.svg" alt="Text and picture"></figure></article></article>';
+ const html=rewriteAssetLinks(await renderLayout(config,{filter:async(_name,value)=>value},{title:'Images',locale:'zh-CN',urlPath:'/images/'},body),bundle.urlMap),svg='<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="700"><rect width="1000" height="700" fill="#388b65"/></svg>';
+ const browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{})});
+ try{for(const width of [320,1280]){const context=await browser.newContext({viewport:{width,height:844}}),page=await context.newPage(),errors=[];let originals=0;
+  page.on('pageerror',error=>errors.push(error.message));await context.route('**/*',async route=>{const url=new URL(route.request().url());if(url.hostname==='pictures.example'){assert.notEqual(url.pathname,'/blocked.svg');originals++;return route.fulfill({contentType:'image/svg+xml',body:svg});}
+   if(url.pathname==='/images/')return route.fulfill({contentType:'text/html',body:html});if(url.pathname==='/preview.svg')return route.fulfill({contentType:'image/svg+xml',body:svg});const asset=assets.get(url.pathname);if(!asset)return route.fulfill({status:404,body:''});const types={'.js':'text/javascript','.css':'text/css','.svg':'image/svg+xml','.png':'image/png','.webp':'image/webp'};return route.fulfill({contentType:types[extname(url.pathname)]||'text/plain',body:asset.content||await readFile(asset.source)});
+  });await page.goto('https://site.example/images/');await page.getByRole('button',{name:'放大图片: Article picture'}).waitFor();assert.equal(originals,0);assert.equal(await page.locator('[alt="Navigation picture"]').getAttribute('role'),null);assert.equal(await page.locator('[alt="Blocked picture"]').getAttribute('role'),null);
+  await page.getByRole('button',{name:'放大图片: Article picture'}).click();await page.locator('.image-lightbox[open]').waitFor();await page.waitForFunction(()=>document.querySelector('.image-lightbox-photo').naturalWidth>0);assert.equal(originals,1);await page.getByRole('button',{name:'关闭图片',exact:true}).click();await page.locator('.image-lightbox').waitFor({state:'detached'});assert.equal(await page.locator('[alt="Article picture"]').evaluate(image=>image===document.activeElement),true);
+  await page.getByRole('button',{name:'放大图片: Text and picture'}).click();await page.locator('.image-lightbox[open]').waitFor();await page.keyboard.press('Escape');await page.locator('.image-lightbox').waitFor({state:'detached'});await page.getByRole('button',{name:'放大图片: Pages picture'}).click();await page.locator('.image-lightbox[open]').waitFor();await page.keyboard.press('Escape');await page.locator('.image-lightbox').waitFor({state:'detached'});assert.equal(originals,1);assert.deepEqual(errors,[]);assert.equal(await page.evaluate(()=>document.documentElement.scrollWidth<=innerWidth),true);await context.close();
+ }}finally{await browser.close();}
+});

package/tests/json-pages.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, mkdir, readFile, writeFile, rm, readdir} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {resolve} from 'node:path';
+import {pathToFileURL} from 'node:url';
+import {getLanguageService, TextDocument} from 'vscode-json-languageservice';
+import {loadConfig} from '../src/config.js';
+import {parseDocumentSource, readDocuments} from '../src/content.js';
+
+const page = {title:'JSON page', lang:'en', homepage:true, blocks:[{columns:2,cells:[[{type:'heading',level:2,text:'Left'},{type:'text',text:'Text with "quotes"\nand 中文'}],[{type:'text',text:'Right'}]]}]};
+
+test('shipped Pages resolve their local schema and validate through the VS Code service', async () => {
+  const service=getLanguageService({schemaRequestService:uri=>{
+    const url=new URL(uri);assert.equal(url.protocol,'file:');return readFile(url,'utf8');
+  },workspaceContext:{resolveRelativePath:(relative,resource)=>new URL(relative,resource).href}});
+  const files=await readdir('content/pages',{recursive:true});
+  assert.ok(files.filter(file=>file.endsWith('.json')).length);
+  for(const file of files.filter(file=>file.endsWith('.json'))){
+    const absolute=resolve('content/pages',file),text=await readFile(absolute,'utf8');
+    assert.ok(JSON.parse(text).$schema,file+' must link its schema');
+    const document=TextDocument.create(pathToFileURL(absolute).href,'json',1,text);
+    assert.deepEqual(await service.doValidation(document,service.parseJSONDocument(document)),[],file);
+  }
+});
+
+test('JSON and legacy YAML Pages use the same locale, routes, blocks and validation', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-json-content-'));
+  try {
+    const config = await loadConfig(process.cwd());
+    config.resolvedPaths.content = root;
+    await mkdir(resolve(root, 'pages/home'), {recursive: true});
+    const file = resolve(root, 'pages/home/en.json');
+    await writeFile(file, JSON.stringify(page));
+    const [document] = await readDocuments(config);
+    assert.equal(document.path, '');assert.equal(document.locale, 'en');
+    assert.deepEqual(document.blocks, page.blocks);assert.equal(document.markdown, '');
+    await writeFile(resolve(root, 'pages/home/en.md'), '---\nblocks: []\n---\n');
+    await assert.rejects(readDocuments(config), /Duplicate language/);
+    await rm(resolve(root, 'pages/home/en.md'));
+    await writeFile(file, JSON.stringify({...page, lang:'zh-CN'}));
+    await assert.rejects(readDocuments(config), /lang must match/);
+    await writeFile(file, '{broken');
+    await assert.rejects(readDocuments(config), /Invalid page JSON.*en\.json/);
+    assert.throws(() => parseDocumentSource('[]', file), /must be an object/);
+  } finally {await rm(root,{recursive:true,force:true});}
+});
+
+test('VS Code JSON service validates rows, cells and elements and provides their nested outline and folding', async () => {
+  const schema = JSON.parse(await readFile('schemas/pages.schema.json', 'utf8'));
+  const service = getLanguageService({});
+  const text = JSON.stringify(page, null, 2);
+  const document = TextDocument.create('file:///page.json', 'json', 1, text);
+  const parsed = service.parseJSONDocument(document);
+  assert.deepEqual(await service.doValidation(document, parsed, undefined, schema), []);
+  const outline = service.findDocumentSymbols2(document, parsed);
+  const blocks = outline.find(symbol => symbol.name === 'blocks');
+  const cells = blocks.children[0].children.find(symbol => symbol.name === 'cells');
+  assert.equal(cells.children.length, 2);
+  assert.equal(cells.children[0].children.length, 2);
+  const folds = service.getFoldingRanges(document);
+  for (const symbol of [blocks, cells, cells.children[0], cells.children[0].children[0]]) assert.ok(folds.some(range => range.startLine === symbol.range.start.line && range.endLine >= symbol.range.end.line - 1), symbol.name+' folds independently');
+  const broken = structuredClone(page);broken.blocks[0].cells.pop();
+  const invalid = TextDocument.create('file:///invalid.json', 'json', 1, JSON.stringify(broken, null, 2));
+  assert.ok((await service.doValidation(invalid, service.parseJSONDocument(invalid), undefined, schema)).length);
+});

package/tests/link-directory.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { renderBlocks } from '../src/page-blocks.js';
+import { renderLayout } from '../src/theme.js';
+import { collectAssets } from '../src/assets.js';
+
+const configForTests = async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  return config;
+};
+const rowsFor = items => [{ columns: 1, cells: [[{ type: 'link-directory', title: 'Independent sites', items }]] }];
+const contextFor = config => ({ config, locale: 'en', isHomepage: false, site: { posts: [], pages: [] } });
+
+test('link-directory renders data-driven rows and safely escapes URLs and descriptions', async () => {
+  const config = await configForTests();
+  const items = [
+    { title: 'Journal & notes', text: 'Stories with <code> examples', url: 'https://notes.example.org/posts/?ref=a&b=c' },
+    { title: 'Local guide', text: 'How to submit', url: '/contact/' }
+  ];
+  const html = await renderBlocks(rowsFor(items), contextFor(config));
+  assert.match(html, /class="link-directory-section"/);
+  assert.match(html, /<ul class="link-directory-items" role="list">/);
+  assert.doesNotMatch(html, /link-directory-number|<ol/);
+  assert.equal((html.match(/class="link-directory-entry"/g) || []).length, items.length);
+  assert.match(html, /notes\.example\.org/);
+  assert.match(html, /Journal &amp; notes/);
+  assert.match(html, /&lt;code&gt;/);
+  assert.match(html, /ref=a&amp;b=c/);
+  assert.match(html, /href="\/contact\/"/);
+  assert.doesNotMatch(html, /<img|feature-card|<script/i);
+  for (const bad of ['javascript:alert(1)', '//host.example/evil', 'https://name:password@host.example']) {
+    await assert.rejects(renderBlocks(rowsFor([{ title: 'Bad', url: bad }]), contextFor(config)), /safe site path|HTTP/);
+  }
+});
+
+test('link-directory uses the shared conditional stylesheet, including hash rewriting', async () => {
+  const config = await configForTests();
+  const rows = rowsFor([{ title: 'Example', url: 'https://example.org/' }]);
+  const content = await renderBlocks(rows, contextFor(config));
+  const extensions = { filter: async (_name, html) => html };
+  const html = await renderLayout(config, extensions, { title: 'Links', locale: 'en', urlPath: '/links/' }, '<main>' + content + '</main>');
+  assert.match(html, /href="\/edgepress\/link-directory\.css"/);
+  const empty = await renderLayout(config, extensions, { title: 'Empty', locale: 'en', urlPath: '/empty/' }, '<main><p>No directory</p></main>');
+  assert.doesNotMatch(empty, /link-directory\.css/);
+  const bundle = await collectAssets(config);
+  const stylesheet = bundle.urlMap['/edgepress/link-directory.css'];
+  assert.match(stylesheet, /\/edgepress\/link-directory\.[a-f0-9]{16}\.css/);
+});

package/tests/local-tool.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {renderLocalTool} from '../src/local-tool.js';
+import {renderBlocks} from '../src/page-blocks.js';
+import {rewriteAssetLinks} from '../src/assets.js';
+const manifest = {'/study.js':'/study.1111111111111111.js', '/study.css':'/study.2222222222222222.css', '/data/bank.json':'/data/bank.json'};
+const context = {config:{assetManifest:manifest}};
+const block = {type:'local-tool',id:'study',title:'Local search',script:'/study.js',stylesheet:'/study.css',data:'/data/bank.json',fallback:'Enable JavaScript to search.'};
+
+test('JSON Pages render trusted local tools and fingerprint their executable assets', async () => {
+  const body = await renderBlocks([{columns:1,cells:[[block]]}], context);
+  const output = rewriteAssetLinks(body, manifest);
+  assert.match(output, /data-edgepress-local-tool/);
+  assert.match(output, /data-tool-data="\/data\/bank.json"/);
+  assert.match(output, /study\.1111111111111111\.js/);
+  assert.match(output, /study\.2222222222222222\.css/);
+  assert.match(output, /<noscript><p>Enable JavaScript/);
+});
+
+test('local tools reject remote, traversal, encoded, executable-data and missing assets', () => {
+  for (const script of ['https://vendor.example/study.js','//vendor.example/study.js','/../study.js','/x/./study.js','/x/%2e%2e/study.js','javascript:alert(1)','/missing.js','/study.js?x=1']) {
+    assert.throws(() => renderLocalTool({...block,script},context), /local-tool.script/);
+  }
+  assert.throws(() => renderLocalTool({...block,data:'https://vendor.example/bank.json'}, context), /local-tool.data/);
+  assert.throws(() => renderLocalTool({...block,stylesheet:'/study.js'}, context), /local-tool.stylesheet/);
+});
+
+test('local tool titles and fallback text remain escaped and unsupported configuration fails', () => {
+  const html = renderLocalTool({...block,title:'<img onerror=x>',text:'<script>evil</script>',fallback:'<script>evil</script>'},context);
+  assert.ok(!html.includes('<img onerror'));
+  assert.match(html,/&lt;script&gt;evil/);
+  assert.throws(() => renderLocalTool({...block,id:'bad"id'},context),/local-tool.id/);
+  assert.throws(() => renderLocalTool({...block,endpoint:'/api'},context),/Unsupported local-tool/);
+});