edgepress 2026.10.1 → 2026.10.13

package/tests/markdown-media.test.mjs

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { chromium } from 'playwright';
+import { renderMarkdown, renderMarkdownExcerpt, plainText, hasMarkdownVideo } from '../src/markdown.js';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { collectAssets, rewriteAssetLinks } from '../src/assets.js';
+import { renderLayout } from '../src/theme.js';
+import { configureDataSaver, dataSaverHtml } from '../src/data-saver.js';
+import {reserveVideoMetadata} from '../src/video-metadata.js';
+
+test('CJK bold with closing punctuation renders beside following prose without rewriting code or URLs', async () => {
+  for (const source of ['前文**结果（XXX）**后文', '**（XXX）**后文', '前文**（XXX）** 后文', '前文**result (XXX)**后文', '前文**说明。**后文']) {
+    assert.match(await renderMarkdown(source), /<strong>/);
+    assert.doesNotMatch(plainText(source), /\*\*/);
+    assert.match(await renderMarkdownExcerpt(source), /<strong>/);
+  }
+  assert.match(await renderMarkdown('**外层 *内部*（测试）**后文'), /<strong>外层 <em>内部<\/em>（测试）<\/strong>后文/);
+  assert.match(await renderMarkdown('`**（XXX）**`'), /<code>\*\*（XXX）\*\*<\/code>/);
+  assert.doesNotMatch(await renderMarkdown('\\**（XXX）**'), /<strong>/);
+  assert.match(await renderMarkdown('a**punctuation!**b'), /a\*\*punctuation!\*\*b/);
+  assert.doesNotMatch(await renderMarkdown('**（XXX） **后文'), /<strong>/);
+  assert.match(decodeURIComponent(await renderMarkdown('[link](https://example.com/**（XXX）**)')), /href="https:\/\/example.com\/\*\*（XXX）\*\*"/);
+});
+
+test('Markdown videos request the shared engine, including reference links, while code examples remain inert', async () => {
+  assert.equal(hasMarkdownVideo('![Recording](/recording.mp4)'), true);
+  assert.equal(hasMarkdownVideo('![Recording][clip]\n\n[clip]: /recording.mp4'), true);
+  assert.equal(hasMarkdownVideo('`![Recording](/recording.mp4)`'), false);
+  assert.equal(hasMarkdownVideo('```md\n![Recording](/recording.mp4)\n```'), false);
+  const html = await renderMarkdown('![Recording](/recording.mp4 "A caption")');
+  assert.match(html, /data-edgepress-video/);
+  assert.match(html, /preload="none"/);
+  await assert.rejects(renderMarkdown('![Unsafe](javascript:bad.mp4)'), /safe relative/);
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  const layout = await renderLayout(config, { filter: async (_key, value) => value }, { title: 'Recording', locale: 'en', urlPath: '/recording/' }, '<main>' + html + '</main>');
+  assert.match(layout, /src="\/edgepress\/media-viewer.js"/);
+  const bundle = await collectAssets(config, { mediaViewer: hasMarkdownVideo('![Recording](/recording.mp4)') });
+  assert.match(bundle.urlMap['/edgepress/media-player-lib.js'], /\.[a-f0-9]{16}\.js$/);
+  config.site.dataSaver.enabled = true;
+  await configureDataSaver(config);
+  const gated = dataSaverHtml(rewriteAssetLinks(layout, bundle.urlMap), config, bundle.urlMap);
+  assert.match(gated, /data-edgepress-data-media data-data-feature="gallery"/);
+  assert.match(gated, /data-data-feature="gallery"[^>]*>.*?media-viewer\.[a-f0-9]{16}\.js/s);
+  assert.match(gated, /data-data-description>Recording/);
+  assert.match(gated, /<\/div><figcaption>A caption<\/figcaption>/);
+});
+
+test('inline local files use the shared player, wait for Play, seek, pause out of view and mount after text-view demand', { timeout: 60000 }, async () => {
+  const config = await loadConfig(process.cwd());
+  config.site.url = 'https://site.example';
+  await loadLanguagePacks(config);
+  const bundle = await collectAssets(config, { mediaViewer: true });
+  const assets = new Map(bundle.assets.map(asset => ['/' + asset.path, asset]));
+  const bytes = await readFile(new URL('./fixtures/recording.mp4', import.meta.url));
+  const body = reserveVideoMetadata(await renderMarkdown('前文**结果（XXX）**后文\n\n![Silent recording](/recording.mp4 "Recording")'),new Map([['/recording.mp4',{duration:12,width:320,height:180,poster:'/poster.svg'}]]),'index.html','https://site.example');
+  const script = '<script type="module" src="/edgepress/media-viewer.js"></script>';
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    for (const width of [320, 1280]) {
+      const context = await browser.newContext({ viewport: { width, height: 850 } });
+      const page = await context.newPage();
+      const requests = [], errors = [];
+      page.on('pageerror', error => errors.push(error.message));
+      const html = rewriteAssetLinks('<!doctype html><html lang="en"><head><style>body{margin:0}figure{margin:0}video{width:100%}</style><link rel="stylesheet" href="/edgepress/media-viewer.css"></head><body><main>' + body + '<div style="height:1600px"></div></main>' + script + '</body></html>', bundle.urlMap);
+      await page.route('https://site.example/**', async route => {
+        const request = route.request(), path = new URL(request.url()).pathname;
+        requests.push(path);
+        if (path === '/') return route.fulfill({ contentType: 'text/html', body: html });
+        if (path === '/poster.svg') return route.fulfill({contentType:'image/svg+xml',body:'<svg xmlns="http://www.w3.org/2000/svg" width="320" height="180"><rect width="320" height="180" fill="green"/></svg>'});
+        if (path === '/recording.mp4') {
+          const range = request.headers().range?.match(/bytes=(\d+)-(\d*)/);
+          const start = range ? Number(range[1]) : 0;
+          const end = range?.[2] ? Math.min(Number(range[2]), bytes.length - 1) : bytes.length - 1;
+          return route.fulfill({ status: range ? 206 : 200, contentType: 'video/mp4', headers: { 'Accept-Ranges': 'bytes', ...(range ? { 'Content-Range': `bytes ${start}-${end}/${bytes.length}` } : {}) }, body: bytes.subarray(start, end + 1) });
+        }
+        const asset = assets.get(path);
+        return asset ? route.fulfill({ contentType: ({ '.js': 'text/javascript', '.css': 'text/css' })[extname(path)] || 'application/octet-stream', body: asset.content || await readFile(asset.source) }) : route.fulfill({ status: 404, body: '' });
+      });
+      await page.goto('https://site.example/');
+      const player = page.locator('.markdown-video .media-player');
+      await player.waitFor();
+      assert.equal(requests.includes('/recording.mp4'), false);
+      assert.equal(await player.locator('.plyr__time--duration').textContent(),'00:12');
+      await page.waitForFunction(()=>document.querySelector('.media-player').classList.contains('plyr__poster-enabled'));
+      await player.locator('video').evaluate(video => { video.muted = true; });
+      await player.locator('.plyr__control--overlaid').click();
+      await page.waitForFunction(() => document.querySelector('video').currentTime > 0.2);
+      const video = player.locator('video');
+      const duration = await video.evaluate(video => video.duration);
+      await video.evaluate(video => { video.pause(); });
+      await player.locator('input[data-plyr="seek"]').evaluate(input => { input.value = '50'; input.dispatchEvent(new Event('input', { bubbles: true })); input.dispatchEvent(new Event('change', { bubbles: true })); });
+      await page.waitForFunction(duration => Math.abs(document.querySelector('video').currentTime - duration / 2) < 0.3, duration);
+      await player.locator('[data-plyr="play"]').last().click();
+      await page.evaluate(() => scrollTo(0, document.documentElement.scrollHeight));
+      await page.waitForFunction(() => document.querySelector('video').paused);
+      assert.ok(await video.evaluate(video => video.currentTime > 0));
+      assert.equal(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth), true);
+      assert.deepEqual(errors, []);
+      await context.close();
+    }
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    await page.route('https://site.example/**', async route => {
+      const path = new URL(route.request().url()).pathname;
+      if (path === '/') return route.fulfill({ contentType: 'text/html', body: rewriteAssetLinks('<html><head></head><body><main><div id="target"></div></main>' + script + '</body></html>', bundle.urlMap) });
+      const asset = assets.get(path);
+      return asset ? route.fulfill({ contentType: extname(path) === '.css' ? 'text/css' : 'text/javascript', body: asset.content || await readFile(asset.source) }) : route.fulfill({ status: 404, body: '' });
+    });
+    await page.goto('https://site.example/');
+    assert.equal(await page.locator('.media-player').count(), 0);
+    await page.evaluate(body => { document.getElementById('target').innerHTML = body; document.dispatchEvent(new Event('edgepress:data-media')); }, body);
+    await page.locator('.media-player').waitFor();
+    await context.close();
+  } finally { await browser.close(); }
+});

package/tests/media-block.test.mjs

@@ -0,0 +1,102 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readFile } from 'node:fs/promises';
+import { extname } from 'node:path';
+import { chromium } from 'playwright';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { collectAssets, rewriteAssetLinks } from '../src/assets.js';
+import { renderBlocks } from '../src/page-blocks.js';
+import { renderMediaViewer } from '../src/media-viewer.js';
+import { choiceSnapshot } from '../static/edgepress/plugins/consent/choices.js';
+
+const block = { type: 'media-viewer', title: 'Local attachments', items: [
+  { type: 'image', src: '/first.svg', originalSrc: '/original.svg', alt: 'First attachment' },
+  { type: 'image', src: '/second.svg', alt: 'Second attachment' },
+  { type: 'video', src: '/recording.mp4', label: 'Silent test recording', poster: '/poster.svg', silent: true, duration: 5 }
+] };
+
+async function configuration() {
+  const config = await loadConfig(process.cwd());
+  config.site.url = 'https://site.example';
+  await loadLanguagePacks(config);
+  return config;
+}
+
+test('Pages media blocks validate content, escape labels and keep every resource inert', async () => {
+  const config = await configuration();
+  const context = { config, locale: 'en' };
+  const html = await renderBlocks([{ columns: 1, cells: [[block]] }], context);
+  assert.match(html, /data-edgepress-media-viewer/);
+  assert.equal((html.match(/<template>/g) || []).length, 3);
+  assert.doesNotMatch(html, /<video[^>]*(?:\scontrols|\sautoplay|\ssrc=)/);
+  assert.match(renderMediaViewer({ ...block, title: '<script>bad</script>' }, context), /&lt;script&gt;/);
+  for (const item of [{ type: 'image', src: 'javascript:alert(1)', alt: 'Unsafe' }, { type: 'image', src: '/first.svg', alt: '' }, { type: 'video', src: '/recording.mp4', label: 'No captions' }]) assert.throws(() => renderMediaViewer({ ...block, items: [item] }, context));
+  const remote = { ...block, service: 'media', items: [{ type: 'image', src: 'https://files.example/first.svg', alt: 'Consented image' }] };
+  assert.throws(() => renderMediaViewer(remote, context), /registered external-api/);
+  config.browserPlugins.services = [{ id: 'media', provider: 'external-api', backendUrl: 'https://files.example', enabled: true, purpose: 'Preview selected media', csp: { 'img-src': ['https://files.example'] } }];
+  assert.match(renderMediaViewer(remote, context), /data-media-service="media"/);
+  assert.throws(() => renderMediaViewer({ ...remote, items: [{ ...remote.items[0], originalSrc: 'https://unapproved.example/original.svg' }] }, context), /CSP origin/);
+  config.browserPlugins.services[0].enabled = false;
+  assert.doesNotMatch(renderMediaViewer(remote, context), /data-edgepress-media-viewer|<template>/);
+});
+
+test('media blocks reuse hashed local components, select only one attachment and wait for play and consent', { timeout: 60000 }, async () => {
+  const config = await configuration();
+  const bundle = await collectAssets(config, { mediaViewer: true });
+  const assets = new Map(bundle.assets.map(asset => ['/' + asset.path, asset]));
+  for (const name of ['media-viewer.js', 'media-gallery-lib.js', 'media-player-lib.js', 'media-player.css']) assert.match(bundle.urlMap['/edgepress/' + name], /\.[a-f0-9]{16}\.(?:js|css)$/);
+  const remote = renderMediaViewer({ ...block, service: 'media', items: [{ type: 'image', src: 'https://files.example/remote.svg', alt: 'Consented image' }] }, { config: { ...config, browserPlugins: { services: [{ id: 'media', provider: 'external-api', backendUrl: 'https://files.example', purpose: 'Preview', csp: { 'img-src': ['https://files.example'] } }] } }, locale: 'en' });
+  const settings = { privacy: { consent: { expiresDays: 30 }, integrations: [{ id: 'media', provider: 'external-api', backendUrl: 'https://files.example', enabled: true }] } };
+  settings.choiceFingerprint = settings.choiceSnapshot = choiceSnapshot(settings.privacy);
+  const html = rewriteAssetLinks('<!doctype html><html lang="en"><head><title>Media block</title><link rel="stylesheet" href="/edgepress/media-viewer.css"><link rel="stylesheet" href="/edgepress/image-viewer.css"></head><body><main>' + renderMediaViewer(block, { config, locale: 'en' }) + remote + '</main><script id="edgepress-privacy-config" type="application/json">' + JSON.stringify(settings) + '</script><script type="module" src="/edgepress/media-viewer.js"></script></body></html>', bundle.urlMap);
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    for (const width of [320, 1280]) {
+      const page = await browser.newPage({ viewport: { width, height: 900 } });
+      const requests = [];
+      const errors = [];
+      page.on('pageerror', error => errors.push(error.message));
+      await page.route('**/*', async route => {
+        const url = new URL(route.request().url());
+        requests.push(url.pathname);
+        if (url.pathname === '/') return route.fulfill({ contentType: 'text/html', body: html });
+        if (url.pathname.endsWith('.svg')) return route.fulfill({ contentType: 'image/svg+xml', body: '<svg xmlns="http://www.w3.org/2000/svg" width="600" height="400"><rect width="600" height="400" fill="teal"/></svg>' });
+        if (url.pathname === '/recording.mp4') return route.fulfill({ contentType: 'video/mp4', body: await readFile(new URL('./fixtures/recording.mp4', import.meta.url)) });
+        const asset = assets.get(url.pathname);
+        const types = { '.js': 'text/javascript', '.css': 'text/css' };
+        return asset ? route.fulfill({ contentType: types[extname(url.pathname)] || 'application/octet-stream', body: asset.content || await readFile(asset.source) }) : route.fulfill({ status: 404, body: '' });
+      });
+      await page.goto('https://site.example/');
+      const local = page.locator('[data-edgepress-media-viewer]').first();
+      await local.locator('.gallery-stage').getByRole('button').waitFor();
+      assert.ok(requests.includes('/first.svg'));
+      assert.ok(!requests.includes('/second.svg') && !requests.includes('/original.svg') && !requests.includes('/remote.svg'));
+      assert.ok(!requests.some(path => /media-player-lib|recording\.mp4/.test(path)));
+      await local.locator('.gallery-stage').getByRole('button').click();
+      await page.locator('.image-lightbox img').waitFor();
+      assert.ok(requests.includes('/original.svg'));
+      await page.keyboard.press('Escape');
+      await local.locator('[data-next]').click();
+      await local.locator('.gallery-stage img').waitFor();
+      await local.locator('[data-next]').click();
+      await local.locator('.plyr').waitFor();
+      assert.ok(!requests.includes('/recording.mp4'));
+      await local.locator('.plyr__control--overlaid').click();
+      await page.waitForFunction(() => !!document.querySelector('video[src]'));
+      assert.equal(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth), true);
+      await page.evaluate(async choiceUrl => {
+        const { makeChoice, persistChoice } = await import(choiceUrl);
+        const settings = JSON.parse(document.getElementById('edgepress-privacy-config').textContent);
+        persistChoice(makeChoice(settings, ['media']));
+        document.dispatchEvent(new CustomEvent('edgepress:service-ready', { detail: { id: 'media' } }));
+      }, bundle.urlMap['/edgepress/plugins/consent/choices.js']);
+      await page.locator('[data-media-service] .gallery-stage img').waitFor();
+      assert.ok(requests.includes('/remote.svg'));
+      await page.evaluate(() => { localStorage.clear(); sessionStorage.clear(); dispatchEvent(new Event('storage')); });
+      assert.equal(await page.locator('[data-media-service] .gallery-stage img').count(), 0);
+      assert.deepEqual(errors, []);
+      await page.close();
+    }
+  } finally { await browser.close(); }
+});

package/tests/navigation.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile,readdir} from 'node:fs/promises';
+import {resolve} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {renderLayout} from '../src/theme.js';
+
+const root=fileURLToPath(new URL('../',import.meta.url));
+const extensions={filter:async(_key,value)=>value};
+test('navigation and footer keep external URLs and new-tab targets, including dropdown choices',async()=>{
+ const config=await fixture('default');
+ config.site.navigation[0].children.push({key:'share',url:'https://share.js.gripe',target:'_blank',labels:{en:'ishare'}});
+ config.site.footerNavigation=[{key:'share',url:'https://share.js.gripe',target:'_blank',labels:{en:'ishare'}}];
+ const html=await renderLayout(config,extensions,{locale:'zh-CN',urlPath:'/zh-CN/'},'<h1>Fixture</h1>');
+ assert.match(html,/<option value="https:\/\/share.js.gripe" data-target="_blank">ishare/);
+ assert.match(html,/<a href="https:\/\/share.js.gripe" target="_blank" rel="noopener noreferrer">ishare<\/a>/);
+ assert.doesNotMatch(html,/\/zh-CN\/https:/);
+});
+async function fixture(theme){
+ const config=await loadConfig(root);
+ await loadLanguagePacks(config);
+ config.site.url='https://navigation.invalid';
+ config.site.navigation=[{key:'projects',url:'/projects/',labels:{en:'Projects'},children:[{key:'edgepress',url:'/edgepress/',labels:{en:'EdgePress'}}]}];
+ config.resolvedPaths.theme=config.realPaths.theme=resolve(root,'themes',theme);
+ return config;
+}
+test('navigation uses a disabled display placeholder and preserves actual parent/child links',async()=>{
+ const config=await fixture('default');
+ const html=await renderLayout(config,extensions,{locale:'en',title:'Fixture',urlPath:'/edgepress/guide/'},'<h1>Fixture</h1>');
+ assert.match(html,/<option value="" selected disabled hidden>Projects<\/option>/);
+ assert.match(html,/<option value="\/projects\/">Projects<\/option>/);
+ assert.match(html,/<option value="\/edgepress\/">EdgePress<\/option>/);
+ assert.match(html,/<noscript><a href="\/projects\/">Projects<\/a><a href="\/edgepress\/">EdgePress<\/a><\/noscript>/);
+});
+test('keyboard parent selection, child selection, return navigation and no-JS links across themes/locales',async t=>{
+ let browser;
+ try{browser=await chromium.launch({headless:true,...(process.platform==='win32'?{channel:'msedge'}:{}),args:['--mute-audio','--disable-notifications']});}
+ catch(error){t.skip('Headless browser unavailable: '+error.message.split('\n')[0]);return;}
+ try{
+  let cases=0;
+  const themes=(await readdir(resolve(root,'themes'),{withFileTypes:true})).filter(item=>item.isDirectory()).map(item=>item.name);
+  for(const theme of themes){
+   const config=await fixture(theme);
+   for(const locale of config.i18n.locales) for(const width of [390,1440]) for(const colorScheme of ['light','dark']){
+    const context=await browser.newContext({viewport:{width,height:900},colorScheme});
+    const prefix=locale===config.i18n.defaultLocale?'/':'/'+locale+'/';
+    await context.route('**/*',async route=>{
+     const url=new URL(route.request().url());
+     if(url.origin!==config.site.url)return route.abort();
+     if(url.pathname==='/style.css')return route.fulfill({contentType:'text/css',body:await readFile(resolve(root,'themes',theme,'assets/style.css'),'utf8')});
+     if(/^\/edgepress\/[a-z0-9./-]+\.(js|png)$/i.test(url.pathname)&&!url.pathname.includes('..')){
+      try{return route.fulfill({body:await readFile(resolve(root,'static',url.pathname.slice(1))),contentType:url.pathname.endsWith('.js')?'text/javascript':'image/png'});}catch{return route.fulfill({status:404,body:''});}
+     }
+     return route.fulfill({contentType:'text/html',body:await renderLayout(config,extensions,{locale,title:'Fixture',urlPath:url.pathname},'<h1>Fixture</h1>')});
+    });
+    const page=await context.newPage();
+    await page.goto(config.site.url+prefix+'archives/');
+    const selector=page.locator('[data-navigation-select]').first();
+    await selector.waitFor({state:'visible'});
+    assert.equal(await selector.inputValue(),'');
+    await selector.focus();
+    assert.ok(await selector.evaluate(node=>parseFloat(getComputedStyle(node).outlineWidth)>=2));
+    await Promise.all([page.waitForURL(config.site.url+prefix+'projects/'),page.keyboard.press('ArrowDown')]);
+    await Promise.all([page.waitForURL(config.site.url+prefix+'edgepress/'),selector.selectOption(prefix+'edgepress/')]);
+    assert.equal(await selector.inputValue(),'');
+    await Promise.all([page.waitForURL(config.site.url+prefix+'projects/'),selector.selectOption(prefix+'projects/')]);
+    await page.goBack();
+    assert.equal(await selector.inputValue(),'');
+    assert.ok(await page.evaluate(()=>document.documentElement.scrollWidth<=innerWidth+1));
+    await context.close();cases++;
+   }
+   const context=await browser.newContext({javaScriptEnabled:false});
+   await context.route('**/*',async route=>{
+    if(route.request().resourceType()!=='document')return route.abort();
+    return route.fulfill({contentType:'text/html',body:await renderLayout(config,extensions,{locale:'en',title:'Fixture',urlPath:'/'},'<h1>Fixture</h1>')});
+   });
+   const page=await context.newPage();await page.goto(config.site.url);
+   assert.ok(await page.locator('noscript a[href="/projects/"]').isVisible());
+   assert.ok(await page.locator('noscript a[href="/edgepress/"]').isVisible());
+   await context.close();
+  }
+  assert.ok(cases>=themes.length*8);
+ }finally{await browser.close();}
+});

package/tests/oembed-layout.test.mjs

@@ -0,0 +1,98 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { chromium } from 'playwright';
+import { loadConfig } from '../src/config.js';
+import { loadLanguagePacks } from '../src/i18n.js';
+import { renderEmbed } from '../src/embed.js';
+import { configureDataSaver, dataSaverHtml, dataSaverLayout } from '../src/data-saver.js';
+
+test('embed entry stays compact until requested, retries failures and keeps keyboard focus without preconsent requests', async () => {
+  const config = await loadConfig(process.cwd());
+  await loadLanguagePacks(config);
+  config.site.dataSaver = { enabled:true, mode:'text', debug:false, detectSlowConnection:false, respectBrowserPreference:true };
+  await configureDataSaver(config);
+  const origin = 'https://embed-layout.test';
+  const service = { id: 'shared-media', provider: 'oembed', enabled: true, name: 'Shared media', backendUrl: 'https://media.example.test' };
+  config.browserPlugins.services = [service];
+  const block = await renderEmbed({ integration: service.id, url: service.backendUrl + '/s/example', title: 'A meaningful shared story' }, { config, locale: 'en' });
+  const browser = await chromium.launch({ headless: true, args: ['--disable-extensions'] });
+  try {
+    for (const theme of ['default', 'folio', 'signal']) for (const colorScheme of ['light', 'dark']) for (const mode of ['full','text']) {
+      const context = await browser.newContext({ viewport: { width: 320, height: 900 }, colorScheme, reducedMotion: 'reduce' });
+      let calls = 0, requests = 0;
+      const themeStyle = await readFile(resolve('themes',theme,'assets/style.css'));
+      const textVariant = await readFile(resolve(config.resolvedPaths.theme,'assets',config.dataSaverTheme.stylesheet));
+      const textLayout = await dataSaverLayout(config,[{path:'style.css',content:themeStyle},{path:config.dataSaverTheme.stylesheet,content:textVariant}]);
+      await context.route('**/*', async route => {
+        const url = new URL(route.request().url());
+        if (url.origin === service.backendUrl) {
+          requests++;
+          if (url.pathname === '/api') {
+            calls++;
+            await new Promise(resolve => setTimeout(resolve, 250));
+            if (calls === 1) return route.fulfill({ status: 503, contentType: 'application/json', body: '{}' });
+            return route.fulfill({ contentType: 'application/json', body: JSON.stringify({ version: '1.0', type: 'rich', width: 640, height: 360, title: 'Shared story', html: '<iframe src="' + service.backendUrl + '/embed/example"></iframe>' }) });
+          }
+          return route.fulfill({ contentType: 'text/html', body: '<p>Shared story content</p>' });
+        }
+        assert.equal(url.origin, origin);
+        if (url.pathname.endsWith('/choices.js')) return route.fulfill({ contentType: 'text/javascript', body: 'export function readChoice(){return {allowed:window.testAllowed?["shared-media"]:[]}}' });
+        if (url.pathname === '/style.css') return route.fulfill({ contentType: 'text/css', body: await readFile(resolve('themes', theme, 'assets/style.css')) });
+        if (url.pathname === '/edgepress/data-saver-layout.css') return route.fulfill({contentType:'text/css',body:textLayout.content});
+        if (url.pathname === '/data-saver-theme.css') return route.fulfill({contentType:'text/css',body:await readFile(resolve('themes',theme === 'signal' ? 'folio' : theme,'assets/data-saver-theme.css'))});
+        if (url.pathname.startsWith('/edgepress/')) return route.fulfill({ contentType: url.pathname.endsWith('.js') ? 'text/javascript' : 'text/css', body: await readFile(resolve('static', '.' + url.pathname.replace('.aaaaaaaaaaaaaaaa',''))) });
+        const html = '<!doctype html><html><head><link rel="stylesheet" href="/style.css"></head><body><main>' + block + '</main><script id="edgepress-privacy-config" type="application/json">' + JSON.stringify({ privacy: { integrations: [service] }, ui: { embedNeedsConsent: 'Allow {service} to load media.', embedLoading: 'Loading {service}…', embedUnavailable: 'Media unavailable. Try again.', embedLoaded: 'Loaded {service}.' } }) + '</script><script type="module" src="/edgepress/oembed.aaaaaaaaaaaaaaaa.js"></script></body></html>';
+        return route.fulfill({ contentType:'text/html', body:mode === 'text' ? dataSaverHtml(html,config) : html });
+      });
+      const page = await context.newPage();
+      const errors = [];
+      page.on('pageerror', error => errors.push(error.message));
+      await page.goto(origin);
+      if (mode === 'text') await page.waitForFunction(()=>document.documentElement.dataset.edgepressDataReady === 'true');
+      // Full mode loads optional scripts after the first animation frame; do not
+      // click until the oEmbed module has finished attaching its handlers.
+      if (mode === 'full') await page.waitForFunction(() => Boolean(document.querySelector('[data-edgepress-oembed]')?.style.getPropertyValue('--oembed-ratio')));
+      await page.evaluate(() => document.addEventListener('edgepress:privacy-open', () => window.testOpened = (window.testOpened || 0) + 1));
+      const entry = page.locator('[data-edgepress-oembed]');
+      const button = entry.locator('[data-oembed-load]');
+      assert.equal(await entry.locator('[data-oembed-status]').evaluate(element => element.getBoundingClientRect().height), 0);
+      assert((await entry.boundingBox()).height < 300);
+      assert.equal(requests, 0);
+      await button.focus(); await page.keyboard.press('Enter');
+      // This is an event counter, so deferred text-view styles must not make
+      // the assertion depend on the browser scheduling animation frames.
+      await page.waitForFunction(() => window.testOpened > 0, null, { polling: 50 });
+      assert.equal(await page.evaluate(()=>window.testOpened),1);
+      assert.equal(requests, 0);
+      assert.equal(await button.isEnabled(), true);
+      await page.evaluate(() => { window.testAllowed = true; });
+      await button.focus(); await page.keyboard.press('Enter');
+      await page.waitForFunction(() => document.querySelector('[data-edgepress-oembed]').getAttribute('aria-busy') === 'true');
+      assert.equal(await button.isEnabled(), false);
+      const pendingBounds = await entry.locator('[data-oembed-placeholder]').boundingBox();
+      assert(mode === 'text' ? pendingBounds === null : pendingBounds.height <= 60);
+      await entry.locator('[data-oembed-notice]').getByText('Media unavailable. Try again.', { exact: true }).waitFor();
+      await page.waitForFunction(() => !document.querySelector('[data-oembed-load]').disabled);
+      assert.equal(await button.isEnabled(), true);
+      assert.equal(await entry.locator('[data-oembed-status]').evaluate(element => element.getBoundingClientRect().height), 0);
+      await page.evaluate(()=>document.dispatchEvent(new CustomEvent('edgepress:service-ready',{detail:{id:'shared-media'}})));
+      await page.waitForTimeout(300);
+      assert.equal(calls,1);
+      assert.equal(await entry.getAttribute('data-oembed-unavailable'),'true');
+      await button.focus(); await page.keyboard.press('Enter');
+      await page.waitForFunction(() => document.querySelector('[data-edgepress-oembed]').dataset.loaded === 'true');
+      await page.frameLocator('iframe').getByText('Shared story content').waitFor();
+      assert.equal(calls, 2);
+      assert.equal(requests, 3);
+      assert.equal(await page.evaluate(() => document.activeElement.textContent), 'A meaningful shared story');
+      assert.equal(await entry.getAttribute('aria-busy'), 'false');
+      assert.equal(await button.count(), 0);
+      assert.equal(await entry.locator('[data-oembed-notice]').isVisible(), false);
+      assert(await page.evaluate(() => document.documentElement.scrollWidth <= innerWidth));
+      assert.deepEqual(errors, []);
+      await context.close();
+    }
+  } finally { await browser.close(); }
+});

package/tests/oembed.test.mjs

@@ -0,0 +1,96 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import {resolve} from 'node:path';
+import {chromium} from 'playwright';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+import {renderBlocks} from '../src/page-blocks.js';
+import consentManager from '../plugins/consent/index.js';
+import {extendConsentPolicy} from '../src/consent-csp.js';
+import {resolveEmbed,sanitizeEmbed} from '../src/oembed.js';
+import {readDocuments} from '../src/content.js';
+import {generateBuiltinRoutes} from '../src/generators.js';
+import {createExtensions} from '../src/plugin-api.js';
+import {mkdtemp,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+const root=fileURLToPath(new URL('../',import.meta.url));
+test('posts use the same consent-controlled oEmbed blocks as Pages',async()=>{
+ const config=await loadConfig(root);await loadLanguagePacks(config);const service='https://ishare.example';config.browserPlugins.services=[{id:'ishare',provider:'oembed',backendUrl:service,enabled:true,name:'ishare',purpose:'Load the shared post.',dataCategories:'Requested media and IP address.',recipient:'ishare',retention:'Until deletion.',privacyUrl:service+'/privacy/'}];
+ const document=(await readDocuments(config)).find(item=>item.kind==='posts'&&item.locale==='en');assert.ok(document);const extensions=await createExtensions(config);const post={...document,html:await extensions.renderer('.md').render('A seaside field note.\n\n!embed[ishare]('+service+'/s/'+'a'.repeat(32)+')',{config,document})};
+ const routes=await generateBuiltinRoutes({posts:[post],pages:[]},config,await createExtensions(config));const page=routes.find(route=>route.path===post.path+'index.html');assert.ok(page);assert.match(page.body,/A seaside field note/);assert.match(page.body,/data-edgepress-oembed="ishare"/);assert.doesNotMatch(page.body,/<iframe/);
+});
+test('Markdown embed syntax keeps the post body as the source of truth',async()=>{
+ const config=await loadConfig(root);await loadLanguagePacks(config);config.browserPlugins.services=[{id:'ishare',provider:'oembed',backendUrl:'https://ishare.example',sourceOrigins:['https://ishare.example'],enabled:true,name:'ishare'}];
+ const extensions=await createExtensions(config),renderer=extensions.renderer('.md');
+ const html=await renderer.render('Before\n\n!embed[ishare](https://ishare.example/s/'+'a'.repeat(32)+')\n\nAfter',{config,document:{locale:'en'}});
+ assert.match(html,/data-edgepress-oembed="ishare"/);assert.match(html,/data-oembed-placeholder/);assert.doesNotMatch(html,/<iframe/);
+ const ordinary=await renderer.render('![A photo](https://ishare.example/photo.jpg)',{config,document:{locale:'en'}});assert.match(ordinary,/<img/);assert.doesNotMatch(ordinary,/data-edgepress-oembed/);
+});
+test('oEmbed automatically loads visible content after consent and on return, and strips unsafe vendor HTML',async()=>{
+  const config=await loadConfig(root),origin=new URL(config.site.url).origin,service='https://share.js.gripe';
+  config.browserPlugins.services=[{id:'ishare',provider:'oembed',backendUrl:service,enabled:true,name:'ishare',purpose:'Load shared images and videos.',dataCategories:'IP address and requested media.',recipient:'ishare',retention:'Until publisher deletion.',privacyUrl:service+'/privacy.html'}];
+  const rows=[{columns:1,cells:[[{type:'oembed',integration:'ishare',url:service+'/s/'+'a'.repeat(32),title:'Shared image'}]]}];
+  const blocks=await renderBlocks(rows,{config,locale:'en'});assert.match(blocks,/data-edgepress-oembed/);assert.doesNotMatch(blocks,/<iframe/);
+  await assert.rejects(renderBlocks([{columns:1,cells:[[{type:'oembed',integration:'ishare',url:'https://evil.example/a'}]]}],{config,locale:'en'}),/origin/);
+  const policy=extendConsentPolicy('/*\n  Content-Security-Policy: default-src \'self\'; connect-src \'none\'',config);assert.match(policy,/frame-src 'self' https:\/\/share.js.gripe/);assert.match(policy,/img-src 'self' https:\/\/share.js.gripe/);
+  let filter;consentManager({registerFilter:(_name,fn)=>{filter=fn;}});
+  const browser=await chromium.launch({headless:true,args:['--disable-extensions']});
+  try{
+    const context=await browser.newContext();let calls=0,frames=0;
+    await context.route('**/*',async route=>{const url=new URL(route.request().url());
+      if(url.origin===service){if(url.pathname==='/api'){calls++;assert.equal(route.request().headers()['x-service-action'],'oembed');assert.equal(decodeURIComponent(route.request().headers()['x-service-resource']),service+'/s/'+'a'.repeat(32));return route.fulfill({contentType:'application/json',body:JSON.stringify({version:'1.0',type:'rich',title:'Image',width:640,height:480,html:'<iframe src="'+service+'/embed/'+'a'.repeat(32)+'" onload="window.bad=true" style="position:fixed"></iframe>'})});}frames++;return route.fulfill({contentType:'text/html',body:'Author / source<script>window.addEventListener("message",event=>{if(event.origin==="'+origin+'"&&event.data.type==="edgepress:embed-theme")window.hostTheme=event.data.colors;});window.parent.postMessage({type:"edgepress:embed-ready"},"'+origin+'");window.parent.postMessage({type:"edgepress:embed-size",height:555},"'+origin+'");</script>'});}
+      if(url.origin!==origin)throw Error('Unexpected external request '+url.href);
+      if(url.pathname.startsWith('/edgepress/')){try{return route.fulfill({contentType:url.pathname.endsWith('.js')?'text/javascript':'image/svg+xml',body:await readFile(resolve(root,'static',url.pathname.slice(1)))});}catch{return route.fulfill({status:404,body:''});}}
+      return route.fulfill({contentType:'text/html',body:filter('<!doctype html><html style="--accent:#7242b4"><body><main>'+blocks+'</main><script type="module" src="/edgepress/oembed.js"></script></body></html>',{config,page:{locale:'en'}})});
+    });
+    const page=await context.newPage();await page.goto(origin+'/embedding/');await page.locator('.privacy-panel').waitFor({state:'visible'});assert.equal(calls,0);
+    await page.locator('input[value=ishare]').check();assert.equal(calls,0);await page.locator('.privacy-save').click();
+    await page.locator('[data-oembed-status] iframe').waitFor();assert.equal(calls,1);assert.equal(await page.locator('.edgepress-oembed a').count(),1);assert.equal(await page.locator('.edgepress-oembed figcaption').innerText(),'Shared image');assert.equal(await page.locator('[data-oembed-notice]').isVisible(),false);assert.equal(await page.locator('[data-oembed-load]').count(),0);assert.equal(await page.locator('iframe').getAttribute('onload'),null);assert.equal(await page.locator('iframe').getAttribute('sandbox'),'allow-scripts allow-same-origin allow-presentation');
+    await page.reload();await page.locator('[data-oembed-status] iframe').waitFor();assert.equal(calls,2);
+    await page.waitForFunction(()=>document.querySelector('iframe').style.height==='555px');const child=page.frames().find(frame=>frame.url().startsWith(service));await child.waitForFunction(()=>window.hostTheme?.['--accent']==='#7242b4');
+    await page.evaluate(service=>window.dispatchEvent(new MessageEvent('message',{origin:service,source:window,data:{type:'edgepress:embed-size',height:3000}})),service);assert.equal(await page.locator('iframe').evaluate(frame=>frame.style.height),'555px');
+    const sanitized=await page.evaluate(async()=>{const {trustedEmbed}=await import('/edgepress/oembed.js');for(const html of ['<iframe src="https://evil.example/a"></iframe>','<script>alert(1)</script>','<iframe src="https://share.js.gripe/embed/a"></iframe><img src="https://evil.example/a">']){try{trustedEmbed({version:'1.0',type:'rich',width:640,height:480,html},'https://share.js.gripe',document);return false;}catch{}}return true;});assert.equal(sanitized,true);
+    if(!await page.locator('.privacy-panel').isVisible()){await page.locator('.privacy-settings-button').focus();await page.keyboard.press('Enter');}await page.locator('.privacy-panel').waitFor({state:'visible'});await page.locator('input[value=ishare]').uncheck();await Promise.all([page.waitForEvent('load'),page.locator('.privacy-save').click()]);await page.locator('[data-oembed-load]').waitFor();assert.equal(await page.locator('[data-oembed-notice]').isVisible(),true);assert.equal(calls,2);assert.equal(await page.locator('iframe').count(),0);
+    await context.close();
+  }finally{await browser.close();}
+});
+
+test('third-party metadata is cached, mixed Pages cells wait for consent, and YouTube/X/TikTok render repeatedly on demand',async()=>{
+  const directory=await mkdtemp(resolve(tmpdir(),'edgepress-oembed-'));
+  const config=await loadConfig(root),origin=new URL(config.site.url).origin;
+  const youtube=config.browserPlugins.services.find(s=>s.id==='youtube'),x=config.browserPlugins.services.find(s=>s.id==='x-posts'),tiktok={...structuredClone(youtube),id:'custom-video-fixture',name:'Custom video fixture',backendUrl:'https://www.tiktok.com',oembedEndpoint:'https://www.tiktok.com/oembed',sourceOrigins:['https://www.tiktok.com'],embedOrigins:['https://www.tiktok.com'],embedScripts:['https://www.tiktok.com/embed.js']};
+  await loadLanguagePacks(config);config.browserPlugins.services=[youtube,x,tiktok];config.resolvedPaths.cache=directory;
+  const data={version:'1.0',type:'video',width:640,height:360,title:'Video',html:'<iframe src="https://www.youtube.com/embed/jNQXAC9IVRw" onload="window.bad=true"></iframe><script>window.bad=true</script>'};
+  let lookups=0;const fetcher=async()=>{lookups++;return new Response(JSON.stringify(data));};
+  let browser;
+  try{
+    await resolveEmbed(youtube,'https://www.youtube.com/watch?v=jNQXAC9IVRw',config,fetcher);
+    assert.equal((await resolveEmbed(youtube,'https://www.youtube.com/watch?v=jNQXAC9IVRw',config,fetcher)).type,'video');assert.equal(lookups,1);
+    const tweet={version:'1.0',type:'rich',width:550,height:null,html:'<blockquote class="twitter-tweet"><p>Shared text</p><a href="https://x.com/user/status/123">Original</a></blockquote><script src="https://evil.example/a.js"></script>'};
+    const oldFetch=globalThis.fetch;globalThis.fetch=async address=>new Response(JSON.stringify(String(address).includes('tiktok')?{version:'1.0',type:'rich',width:325,height:700,html:'<blockquote class="tiktok-embed" data-video-id="123"><section>Video</section></blockquote>'}:tweet));
+    let blocks;try{blocks=await renderBlocks([{columns:2,cells:[[{type:'text',heading:'Context',text:'Text beside media'},{type:'oembed',integration:'x-posts',url:'https://x.com/user/status/123'},{type:'oembed',integration:'custom-video-fixture',url:'https://www.tiktok.com/@user/video/123'},{type:'oembed',integration:'custom-video-fixture',url:'https://www.tiktok.com/@user/video/124'}],[{type:'oembed',integration:'youtube',url:'https://www.youtube.com/watch?v=jNQXAC9IVRw',caption:'Video description'}]]}],{config,locale:'en'});}finally{globalThis.fetch=oldFetch;}
+    assert.match(blocks,/data-oembed-data/);assert.doesNotMatch(blocks,/<iframe|<script/);assert.match(blocks,/Video description/);
+    assert.doesNotMatch(sanitizeEmbed(data,youtube).html,/onload|script/);
+    let filter;consentManager({registerFilter:(_n,fn)=>filter=fn});
+    browser=await chromium.launch({headless:true,args:['--disable-extensions']});const context=await browser.newContext({viewport:{width:390,height:844}});let vendor=0;
+    await context.route('**/*',async route=>{
+      const url=new URL(route.request().url());
+      if(url.origin==='https://www.youtube.com'){assert.equal(route.request().headers().referer,origin+'/');vendor++;return route.fulfill({contentType:'text/html',body:'Player'});}
+      if(url.origin==='https://www.tiktok.com'){vendor++;return route.fulfill({contentType:'text/javascript',body:'globalThis.tiktokRuns=(globalThis.tiktokRuns||0)+1;document.querySelectorAll("blockquote.tiktok-embed").forEach(block=>block.dataset.tiktokRendered="true");'});}
+      if(url.origin==='https://platform.x.com'){vendor++;return route.fulfill({contentType:'text/javascript',body:'globalThis.twttr={widgets:{load(root){const block=root.querySelector(".twitter-tweet");if(block)block.dataset.rendered="true"}}};'});}
+      assert.equal(url.origin,origin,'No unconfigured origin is contacted');
+      if(url.pathname.startsWith('/edgepress/')){try{return route.fulfill({body:await readFile(resolve(root,'static',url.pathname.slice(1))),contentType:url.pathname.endsWith('.js')?'text/javascript':'image/svg+xml'});}catch{return route.fulfill({status:404,body:''});}}
+      return route.fulfill({contentType:'text/html',body:filter('<!doctype html><html><head><style>*{box-sizing:border-box}.page-row{display:grid;grid-template-columns:1fr}.page-cell{min-width:0}body{margin:8px}</style></head><body><main>'+blocks+'</main><script type="module" src="/edgepress/oembed.js"></script></body></html>',{config,page:{locale:'en'}})});
+    });
+    const page=await context.newPage();await page.goto(origin+'/mixed/');await page.locator('.privacy-panel').waitFor({state:'visible'});assert.equal(vendor,0);assert.match(await page.locator('[data-edgepress-oembed=youtube] [data-oembed-notice]').innerText(),/YouTube.*unloaded/i);
+    await page.locator('input[value=youtube]').check();await page.locator('input[value=x-posts]').check();await page.locator('input[value=custom-video-fixture]').check();assert.equal(vendor,0);await page.locator('.privacy-save').click();
+    for(const root of await page.locator('[data-edgepress-oembed]').all()){await root.scrollIntoViewIfNeeded();await page.waitForFunction(node=>node.dataset.loaded==='true',await root.elementHandle());}
+    await page.locator('iframe').scrollIntoViewIfNeeded();await page.frameLocator('iframe').getByText('Player',{exact:true}).waitFor();await page.locator('.twitter-tweet[data-rendered=true]').waitFor();await page.locator('blockquote[data-tiktok-rendered=true]').nth(1).waitFor();assert.ok(vendor>=3&&vendor<=4);assert.equal(await page.evaluate(()=>window.tiktokRuns),2);assert.equal(await page.evaluate(()=>!!window.bad),false);assert.ok(await page.evaluate(()=>document.documentElement.scrollWidth<=innerWidth));
+    await page.reload();for(const root of await page.locator('[data-edgepress-oembed]').all()){await root.scrollIntoViewIfNeeded();await page.waitForFunction(node=>node.dataset.loaded==='true',await root.elementHandle());}await page.locator('blockquote[data-tiktok-rendered=true]').nth(1).waitFor();await page.locator('iframe').scrollIntoViewIfNeeded();await page.frameLocator('iframe').getByText('Player',{exact:true}).waitFor();assert.ok(vendor>=6&&vendor<=8);assert.equal(await page.evaluate(()=>window.tiktokRuns),2);await context.close();
+    youtube.enabled=false;x.enabled=false;assert.equal(await renderBlocks([{columns:1,cells:[[{type:'oembed',integration:'youtube',url:'https://www.youtube.com/watch?v=jNQXAC9IVRw'}]]}],{config,locale:'en'}).then(html=>html.includes('data-edgepress-oembed')),false);
+    assert.match(await renderBlocks([{columns:1,cells:[[{type:'oembed',integration:'youtube',url:'https://www.youtube.com/watch?v=jNQXAC9IVRw'}]]}],{config,locale:'en'}),/disabled|turned off/i);
+    assert.equal(extendConsentPolicy('/*\n  Content-Security-Policy: default-src \'self\'',config).includes('youtube'),false);
+  }finally{if(browser)await browser.close();await rm(directory,{recursive:true,force:true});}
+});

package/tests/page-authoring.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {renderBlocks} from '../src/page-blocks.js';
+import {loadConfig} from '../src/config.js';
+import {loadLanguagePacks} from '../src/i18n.js';
+
+async function context(){const config=await loadConfig(process.cwd());await loadLanguagePacks(config);return {config,locale:'en',site:{posts:[],pages:[]}};}
+
+test('the published JSON example parses and renders with the same ordered containment',async()=>{
+  const guide=JSON.parse(await readFile('content/pages/page-authoring/en.json','utf8'));
+  const example=guide.blocks.flatMap(row=>row.cells.flat()).find(block=>block.type==='code'&&block.language==='json').code;
+  const page=JSON.parse(example);
+  const equivalent=[{columns:2,cells:[[{type:'heading',level:2,text:'About this project'},{type:'text',text:'A small tool for everyday writing.'}],[{type:'link-list',title:'Read more',items:[{label:'Project',url:'/[launge]/project-introduction/'}]}]]}];
+  assert.deepEqual(page.blocks,equivalent);
+  assert.equal(await renderBlocks(page.blocks,await context()),await renderBlocks(equivalent,await context()));
+});
+
+test('a missing cell identifies the row and actual column/cell counts',async()=>{
+  await assert.rejects(renderBlocks([{columns:1,cells:[[{type:'text',text:'First'}]]},{columns:2,cells:[[{type:'text',text:'Second'}]]}],await context()),/blocks\[1\] \(row 2\).*columns: 2; cells: 1/);
+});
+
+test('nested invalid content identifies its row, cell and element without weakening validation',async()=>{
+  const rows=[{columns:2,cells:[[{type:'text',text:'Safe'}],[{type:'section',title:'Links',blocks:[{type:'link-list',title:'Unsafe',items:[{label:'Bad',url:'javascript:alert(1)'}]}]}]]}];
+  await assert.rejects(renderBlocks(rows,await context()),/blocks\[0\].*cells\[1\].*elements\[0\].*elements\[0\].*safe site path/);
+  assert.match(await renderBlocks([{columns:1,cells:[[{type:'text',text:'<script>alert(1)</script>'}]]}],await context()),/&lt;script&gt;/);
+});

package/tests/page-formatting.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, mkdir, readFile, writeFile, rm, access} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {resolve} from 'node:path';
+import {parseDocumentSource} from '../src/content.js';
+import {formatPageSource, formatPages} from '../tools/assets/format-pages.mjs';
+
+test('JSON conversion preserves nested elements, metadata, multiline text and punctuation', () => {
+  const source = '---\ntitle: "A: page"\nblocks:\n  - columns: 2\n    cells:\n      - - type: section\n          blocks:\n            - type: text\n              text: |\n                Quote: "Hello"\n                # literal text 中文 []{}\n      - - type: text\n          text: Second cell\ndraft: false\n---\n\n';
+  const result = formatPageSource(source);
+  assert.deepEqual(JSON.parse(result), parseDocumentSource(source, 'page.md').metadata);
+  assert.equal(formatPageSource(result, {file: 'page.json'}), result);
+  assert.throws(() => formatPageSource(source + 'Do not discard this body'), /body content/);
+});
+
+test('migration preflights duplicate locale files and only deletes Markdown after writing its equivalent JSON', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-page-json-'));
+  try {
+    const folder = resolve(root, 'content/pages/home');
+    await mkdir(folder, {recursive: true});
+    const source = '---\nlang: en\nhomepage: true\nblocks: [{columns: 1, cells: [[{type: text, text: Hello}]]}]\n---\n';
+    await writeFile(resolve(folder, 'en.md'), source);
+    assert.equal((await formatPages(root)).length, 1);
+    assert.equal(await readFile(resolve(folder, 'en.md'), 'utf8'), source);
+    await writeFile(resolve(folder, 'en.json'), '{}');
+    await assert.rejects(formatPages(root, {write: true}), /Duplicate/);
+    assert.equal(await readFile(resolve(folder, 'en.md'), 'utf8'), source);
+    await rm(resolve(folder, 'en.json'));
+    await formatPages(root, {write: true});
+    await assert.rejects(access(resolve(folder, 'en.md')));
+    const {$schema, ...page} = JSON.parse(await readFile(resolve(folder, 'en.json'), 'utf8'));
+    assert.match($schema, /schemas\/pages\.schema\.json$/);
+    assert.deepEqual(page, parseDocumentSource(source, 'en.md').metadata);
+    assert.deepEqual(await formatPages(root), []);
+  } finally { await rm(root, {recursive: true, force: true}); }
+});