edgepress 2026.10.12 → 2026.10.13

package/src/i18n.js

@@ -1,86 +1,86 @@
-import { readFile, realpath, stat } from 'node:fs/promises';
-import {fileURLToPath} from 'node:url';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
-
-const MAX_LANGUAGE_FILE_BYTES = 64 * 1024;
-
-function isInside(root, target) {
-  const path = relative(root, target);
-  return path !== '..' && !path.startsWith('..' + sep) && !isAbsolute(path);
-}
-
-async function loadDictionary(root, directory, locale, label) {
-  const directoryPath = resolve(root, directory);
-  const file = resolve(directoryPath, locale + '.json');
-  const realRoot = await realpath(root);
-  const realDirectory = await realpath(directoryPath);
-  if (!isInside(realRoot, realDirectory)) throw new Error(label + ' language directory resolves outside the project root: ' + directoryPath);
-  const realFile = await realpath(file).catch((error) => {
-    if (error.code === 'ENOENT') throw new Error('Missing ' + label + ' language file: ' + file);
-    throw error;
-  });
-  if (!isInside(realDirectory, realFile)) throw new Error(label + ' language file resolves outside its language directory: ' + file);
-  const source = await readFile(realFile);
-  if (source.byteLength > MAX_LANGUAGE_FILE_BYTES) throw new Error(label + ' language file exceeds 64 KB: ' + file);
-  let parsed;
-  try { parsed = JSON.parse(source.toString('utf8')); }
-  catch (error) { throw new Error('Invalid JSON in ' + label + ' language file: ' + file, { cause: error }); }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    throw new Error(label + ' language file must contain an object of string translations: ' + file);
-  }
-  const dictionary = Object.create(null);
-  for (const [id, value] of Object.entries(parsed)) {
-    if (!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(id)) throw new Error('Invalid translation id in ' + file + ': ' + id);
-    if (typeof value !== 'string') throw new Error('Translation values must be strings in ' + file + ': ' + id);
-    dictionary[id] = value;
-  }
-  return dictionary;
-}
-
-export async function loadLanguagePacks(config) {
-  const baseLocale = config.i18n.defaultLocale;
-  const translationsByLocale = Object.create(null);
-  const builtinRoot=fileURLToPath(new URL('../',import.meta.url)),english=await loadDictionary(builtinRoot,'languages/base','en','Built-in');
-  async function defaults(locale){
-    if(locale==='en')return english;
-    const file=resolve(builtinRoot,'languages/packs',locale+'.json');
-    const exists=await stat(file).then(()=>true,error=>{if(error.code==='ENOENT')return false;throw error;});
-    return exists?{...english,...await loadDictionary(builtinRoot,'languages/packs',locale,'Built-in')}:english;
-  }
-  translationsByLocale[baseLocale] = {...await defaults(baseLocale),...await loadDictionary(config.root, 'languages/base', baseLocale, 'Base')};
-  for (const locale of config.i18n.languagePacks) {
-    translationsByLocale[locale] = {...await defaults(locale),...await loadDictionary(config.root, 'languages/packs', locale, 'Language pack')};
-  }
-  config.i18n.translationsByLocale = translationsByLocale;
-  return translationsByLocale;
-}
-
-export function translate(config, locale, key) {
-  const base = config.i18n.translationsByLocale?.[config.i18n.defaultLocale];
-  const selected = config.i18n.translationsByLocale?.[locale];
-  return selected?.[key] ?? base?.[key] ?? key;
-}
-
-export function translateValue(config, locale, value) {
-  if (typeof value === 'string') return value;
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return '';
-  return value[locale] ?? value[config.i18n.defaultLocale] ?? Object.values(value).find((text) => typeof text === 'string') ?? '';
-}
-
-export function localePrefix(config, locale) {
-  return locale === config.i18n.defaultLocale ? '' : '/' + locale;
-}
-
-export function localizedUrl(config, locale, path) {
-  const prefix = localePrefix(config, locale);
-  const suffix = String(path ?? '').replace(/^\/+/, '');
-  return prefix + '/' + suffix;
-}
-
-
-export function localizedContentUrl(config, locale, value, label = 'Content URL') {
-  const url=String(value),token=/^\/(?:\[launge\]|%5blaunge%5d)(?=\/|$)/i;
-  if(!url.startsWith('/'))return url;
-  if(/\[launge\]|%5blaunge%5d/i.test(url)&&!token.test(url))throw new Error(label+' may use [launge] only as the first site-path segment');
-  return token.test(url)?localePrefix(config,locale)+(url.replace(token,'')||'/'):url;
-}
+import { readFile, realpath, stat } from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+
+const MAX_LANGUAGE_FILE_BYTES = 64 * 1024;
+
+function isInside(root, target) {
+  const path = relative(root, target);
+  return path !== '..' && !path.startsWith('..' + sep) && !isAbsolute(path);
+}
+
+async function loadDictionary(root, directory, locale, label) {
+  const directoryPath = resolve(root, directory);
+  const file = resolve(directoryPath, locale + '.json');
+  const realRoot = await realpath(root);
+  const realDirectory = await realpath(directoryPath);
+  if (!isInside(realRoot, realDirectory)) throw new Error(label + ' language directory resolves outside the project root: ' + directoryPath);
+  const realFile = await realpath(file).catch((error) => {
+    if (error.code === 'ENOENT') throw new Error('Missing ' + label + ' language file: ' + file);
+    throw error;
+  });
+  if (!isInside(realDirectory, realFile)) throw new Error(label + ' language file resolves outside its language directory: ' + file);
+  const source = await readFile(realFile);
+  if (source.byteLength > MAX_LANGUAGE_FILE_BYTES) throw new Error(label + ' language file exceeds 64 KB: ' + file);
+  let parsed;
+  try { parsed = JSON.parse(source.toString('utf8')); }
+  catch (error) { throw new Error('Invalid JSON in ' + label + ' language file: ' + file, { cause: error }); }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(label + ' language file must contain an object of string translations: ' + file);
+  }
+  const dictionary = Object.create(null);
+  for (const [id, value] of Object.entries(parsed)) {
+    if (!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(id)) throw new Error('Invalid translation id in ' + file + ': ' + id);
+    if (typeof value !== 'string') throw new Error('Translation values must be strings in ' + file + ': ' + id);
+    dictionary[id] = value;
+  }
+  return dictionary;
+}
+
+export async function loadLanguagePacks(config) {
+  const baseLocale = config.i18n.defaultLocale;
+  const translationsByLocale = Object.create(null);
+  const builtinRoot=fileURLToPath(new URL('../',import.meta.url)),english=await loadDictionary(builtinRoot,'languages/base','en','Built-in');
+  async function defaults(locale){
+    if(locale==='en')return english;
+    const file=resolve(builtinRoot,'languages/packs',locale+'.json');
+    const exists=await stat(file).then(()=>true,error=>{if(error.code==='ENOENT')return false;throw error;});
+    return exists?{...english,...await loadDictionary(builtinRoot,'languages/packs',locale,'Built-in')}:english;
+  }
+  translationsByLocale[baseLocale] = {...await defaults(baseLocale),...await loadDictionary(config.root, 'languages/base', baseLocale, 'Base')};
+  for (const locale of config.i18n.languagePacks) {
+    translationsByLocale[locale] = {...await defaults(locale),...await loadDictionary(config.root, 'languages/packs', locale, 'Language pack')};
+  }
+  config.i18n.translationsByLocale = translationsByLocale;
+  return translationsByLocale;
+}
+
+export function translate(config, locale, key) {
+  const base = config.i18n.translationsByLocale?.[config.i18n.defaultLocale];
+  const selected = config.i18n.translationsByLocale?.[locale];
+  return selected?.[key] ?? base?.[key] ?? key;
+}
+
+export function translateValue(config, locale, value) {
+  if (typeof value === 'string') return value;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return '';
+  return value[locale] ?? value[config.i18n.defaultLocale] ?? Object.values(value).find((text) => typeof text === 'string') ?? '';
+}
+
+export function localePrefix(config, locale) {
+  return locale === config.i18n.defaultLocale ? '' : '/' + locale;
+}
+
+export function localizedUrl(config, locale, path) {
+  const prefix = localePrefix(config, locale);
+  const suffix = String(path ?? '').replace(/^\/+/, '');
+  return prefix + '/' + suffix;
+}
+
+
+export function localizedContentUrl(config, locale, value, label = 'Content URL') {
+  const url=String(value),token=/^\/(?:\[launge\]|%5blaunge%5d)(?=\/|$)/i;
+  if(!url.startsWith('/'))return url;
+  if(/\[launge\]|%5blaunge%5d/i.test(url)&&!token.test(url))throw new Error(label+' may use [launge] only as the first site-path segment');
+  return token.test(url)?localePrefix(config,locale)+(url.replace(token,'')||'/'):url;
+}

package/src/markdown.js

@@ -1,106 +1,106 @@
-import { marked, Marked } from 'marked';
+import { marked, Marked } from 'marked';
 import {parseEmbed} from './embed.js';
 import {parseDocument} from './document.js';
-import sanitizeHtml from 'sanitize-html';
-
-const allowedTags = [
-  'a', 'abbr', 'address', 'article', 'aside', 'b', 'bdi', 'bdo', 'blockquote',
-  'br', 'caption', 'cite', 'code', 'data', 'dd', 'del', 'details', 'dfn',
-  'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2',
-  'h3', 'h4', 'h5', 'h6', 'header', 'hr', 'i', 'img', 'kbd', 'li', 'main',
-  'mark', 'nav', 'ol', 'p', 'pre', 'q', 'rp', 'rt', 'rtc', 'ruby', 's',
-  'samp', 'section', 'small', 'source', 'span', 'strong', 'sub', 'summary', 'sup', 'button',
-  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'track', 'tr', 'u', 'ul',
-  'template', 'var', 'video', 'wbr'
-];
-
-const sanitizeOptions = {
-  allowedTags,
-  allowedAttributes: {
-    a: ['href', 'target', 'rel'],
+import sanitizeHtml from 'sanitize-html';
+
+const allowedTags = [
+  'a', 'abbr', 'address', 'article', 'aside', 'b', 'bdi', 'bdo', 'blockquote',
+  'br', 'caption', 'cite', 'code', 'data', 'dd', 'del', 'details', 'dfn',
+  'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2',
+  'h3', 'h4', 'h5', 'h6', 'header', 'hr', 'i', 'img', 'kbd', 'li', 'main',
+  'mark', 'nav', 'ol', 'p', 'pre', 'q', 'rp', 'rt', 'rtc', 'ruby', 's',
+  'samp', 'section', 'small', 'source', 'span', 'strong', 'sub', 'summary', 'sup', 'button',
+  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'track', 'tr', 'u', 'ul',
+  'template', 'var', 'video', 'wbr'
+];
+
+const sanitizeOptions = {
+  allowedTags,
+  allowedAttributes: {
+    a: ['href', 'target', 'rel'],
     button: ['type', 'data-oembed-load', 'data-service-consent-settings'],
-    code: ['class'],
-    img: ['src', 'alt', 'title', 'width', 'height', 'loading', 'data-original'],
+    code: ['class'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'loading', 'data-original'],
     figure: ['class', 'data-edgepress-oembed', 'data-oembed-url', 'data-oembed-width', 'data-oembed-height', 'data-oembed-disabled', 'data-oembed-unavailable', 'data-edgepress-document', 'data-document-src', 'data-document-title', 'data-document-format', 'data-document-preview', 'data-document-service'],
     div: ['class', 'data-oembed-status', 'data-oembed-placeholder', 'aria-hidden', 'data-document-mount'],
-    p: ['data-oembed-notice', 'class', 'role'],
-    template: ['data-oembed-data'],
-    li: ['value'],
-    ol: ['start'],
-    source: ['src', 'type'],
-    span: ['class', 'role', 'aria-label'],
-    td: ['align', 'colspan', 'rowspan'],
-    th: ['align', 'colspan', 'rowspan'],
-    track: ['kind', 'src', 'srclang', 'label', 'default'],
-    video: ['aria-label', 'controls', 'playsinline', 'poster', 'preload', 'width', 'height']
-  },
-  allowedSchemes: ['http', 'https', 'mailto', 'tel'],
-  allowProtocolRelative: false,
-  nonTextTags: ['script', 'style', 'textarea', 'option', 'xmp'],
-  transformTags: {
-    img: (_tagName,attributes)=>{if(attributes['data-original']){try{attributes['data-original']=safeVideoHref(attributes['data-original']);}catch{delete attributes['data-original'];}}return {tagName:'img',attribs:attributes};},
-    a: (_tagName, attributes) => ({
-      tagName: 'a',
-      attribs: { ...attributes, rel: 'noopener noreferrer' }
-    })
-  }
-};
-
-function videoMimeType(href) {
-  const path = String(href ?? '').split(/[?#]/, 1)[0].toLowerCase();
-  const extension = path.match(/\.(mp4|webm|ogv|ogg)$/)?.[1];
-  return ({ mp4: 'video/mp4', webm: 'video/webm', ogv: 'video/ogg', ogg: 'video/ogg' })[extension] || '';
-}
-
-function safeVideoHref(value) {
-  const href = String(value ?? '').trim();
-  if (!href || /[\x00-\x20\\]/.test(href) || href.startsWith('//')) {
-    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
-  }
-  if (href.startsWith('/')) return href;
-  let url;
-  try { url = new URL(href, 'https://edgepress.invalid'); }
-  catch { throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs'); }
-  if (url.username || url.password || !['http:', 'https:'].includes(url.protocol)) {
-    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
-  }
-  return href;
-}
-
-function escapeHtml(value) {
-  return String(value ?? '').replace(/[&<>"']/g, (char) => ({
-    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
-  })[char]);
-}
-
-function markdownRenderer(options) {
-  const renderer = new marked.Renderer();
-  const renderLink=renderer.link;
-  renderer.link=function(token){return renderLink.call(this,{...token,href:options.linkResolver?options.linkResolver(token.href):token.href});};
-  const renderImage = renderer.image;
-  renderer.image = function(token) {
-    const mimeType = videoMimeType(token.href);
-    if (mimeType) {
-      const description = String(token.text ?? '').trim();
-      if (!description) throw new Error('Markdown videos need descriptive alternative text');
-      const href = escapeHtml(safeVideoHref(token.href));
-      if (options.allowVideo === false) return '<span>' + escapeHtml(description) + '</span>';
-      const caption = token.title ? '<figcaption>' + escapeHtml(token.title) + '</figcaption>' : '';
-      return '<figure class="markdown-video"><video controls playsinline preload="none" aria-label="' +
-        escapeHtml(description) + '"><source src="' + href + '" type="' + mimeType + '"><a href="' + href + '">' +
-        escapeHtml(description) + '</a></video>' + caption + '</figure>';
-    }
-    if (options.allowImages === false) return '<span>' + escapeHtml(token.text || '') + '</span>';
-    if(options.imageResolver){const href=options.imageResolver(token.href);if(!href)return '<span>'+escapeHtml(token.text||'')+'</span>';return renderImage.call(this,{...token,href});}
-    return renderImage.call(this,token);
-  };
-  return renderer;
-}
-
+    p: ['data-oembed-notice', 'class', 'role'],
+    template: ['data-oembed-data'],
+    li: ['value'],
+    ol: ['start'],
+    source: ['src', 'type'],
+    span: ['class', 'role', 'aria-label'],
+    td: ['align', 'colspan', 'rowspan'],
+    th: ['align', 'colspan', 'rowspan'],
+    track: ['kind', 'src', 'srclang', 'label', 'default'],
+    video: ['data-edgepress-video', 'aria-label', 'controls', 'playsinline', 'poster', 'preload', 'width', 'height']
+  },
+  allowedSchemes: ['http', 'https', 'mailto', 'tel'],
+  allowProtocolRelative: false,
+  nonTextTags: ['script', 'style', 'textarea', 'option', 'xmp'],
+  transformTags: {
+    img: (_tagName,attributes)=>{if(attributes['data-original']){try{attributes['data-original']=safeVideoHref(attributes['data-original']);}catch{delete attributes['data-original'];}}return {tagName:'img',attribs:attributes};},
+    a: (_tagName, attributes) => ({
+      tagName: 'a',
+      attribs: { ...attributes, rel: 'noopener noreferrer' }
+    })
+  }
+};
+
+function videoMimeType(href) {
+  const path = String(href ?? '').split(/[?#]/, 1)[0].toLowerCase();
+  const extension = path.match(/\.(mp4|webm|ogv|ogg)$/)?.[1];
+  return ({ mp4: 'video/mp4', webm: 'video/webm', ogv: 'video/ogg', ogg: 'video/ogg' })[extension] || '';
+}
+
+function safeVideoHref(value) {
+  const href = String(value ?? '').trim();
+  if (!href || /[\x00-\x20\\]/.test(href) || href.startsWith('//')) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  if (href.startsWith('/')) return href;
+  let url;
+  try { url = new URL(href, 'https://edgepress.invalid'); }
+  catch { throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs'); }
+  if (url.username || url.password || !['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  return href;
+}
+
+function escapeHtml(value) {
+  return String(value ?? '').replace(/[&<>"']/g, (char) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+  })[char]);
+}
+
+function markdownRenderer(options) {
+  const renderer = new marked.Renderer();
+  const renderLink=renderer.link;
+  renderer.link=function(token){return renderLink.call(this,{...token,href:options.linkResolver?options.linkResolver(token.href):token.href});};
+  const renderImage = renderer.image;
+  renderer.image = function(token) {
+    const mimeType = videoMimeType(token.href);
+    if (mimeType) {
+      const description = String(token.text ?? '').trim();
+      if (!description) throw new Error('Markdown videos need descriptive alternative text');
+      const href = escapeHtml(safeVideoHref(token.href));
+      if (options.allowVideo === false) return '<span>' + escapeHtml(description) + '</span>';
+      const caption = token.title ? '<figcaption>' + escapeHtml(token.title) + '</figcaption>' : '';
+      return '<figure class="markdown-video"><video data-edgepress-video controls playsinline preload="none" aria-label="' +
+        escapeHtml(description) + '"><source src="' + href + '" type="' + mimeType + '"><a href="' + href + '">' +
+        escapeHtml(description) + '</a></video>' + caption + '</figure>';
+    }
+    if (options.allowImages === false) return '<span>' + escapeHtml(token.text || '') + '</span>';
+    if(options.imageResolver){const href=options.imageResolver(token.href);if(!href)return '<span>'+escapeHtml(token.text||'')+'</span>';return renderImage.call(this,{...token,href});}
+    return renderImage.call(this,token);
+  };
+  return renderer;
+}
+
 const embedSyntax = {name:'embed',level:'block',
-  start:source=>{const offset=source.search(/\n {0,3}!embed\[/);return offset<0?undefined:offset+1;},
-  tokenizer:source=>{const embed=parseEmbed(source);return embed?{type:'embed',...embed}:undefined;},
-  renderer:()=>''
+  start:source=>{const offset=source.search(/\n {0,3}!embed\[/);return offset<0?undefined:offset+1;},
+  tokenizer:source=>{const embed=parseEmbed(source);return embed?{type:'embed',...embed}:undefined;},
+  renderer:()=>''
 };
 
 const documentSyntax = { name: 'document', level: 'block',
@@ -108,66 +108,101 @@ const documentSyntax = { name: 'document', level: 'block',
   tokenizer: source => { const parsed = parseDocument(source); return parsed ? { type: 'document', ...parsed } : undefined; },
   renderer: token => '<p>' + escapeHtml(token.title) + '</p>'
 };
-
-export async function renderMarkdown(source, options = {}) {
-  const parser = new Marked({gfm: options.gfm !== false, breaks: options.breaks === true, renderer: markdownRenderer(options)});
-  parser.use({ extensions: [{ ...documentSyntax, renderer: token => options.documentRenderer ? options.documentRenderer(token) : documentSyntax.renderer(token) }] });
-  if (options.embedRenderer) parser.use({
-    async: true,
-    extensions: [{...embedSyntax, renderer: token => token.html}],
-    walkTokens: async token => { if (token.type === 'embed') token.html = await options.embedRenderer(token); }
-  });
-  let html = await parser.parse(source);
-  // GFM task markers become named static status icons. They remain readable to
-  // assistive technology without exposing disabled, unlabeled form controls.
-  html = html.replace(/<input\b([^>]*)>/gi, (_match, attributes) => {
-    const checked = /\bchecked(?:\s|=|$)/i.test(attributes);
-    const label = checked ? (options.taskLabels?.complete || 'Task complete') :
-      (options.taskLabels?.incomplete || 'Task incomplete');
-    const safeLabel = String(label).replace(/[&<>"']/g, (char) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
-    })[char]);
-    return '<span class="markdown-task-status" role="img" aria-label="' +
-      safeLabel + '">' + (checked ? '✓' : '□') + '</span>';
-  });
-  return sanitizeHtml(html, options.imageResolver?{...sanitizeOptions,transformTags:{...sanitizeOptions.transformTags,img:(_tag,attributes)=>{
-    const src=options.imageResolver(attributes.src);
-    return src?{tagName:'img',attribs:{src,alt:attributes.alt||'',loading:'lazy'}}:{tagName:'span',attribs:{},text:attributes.alt||''};
-  }}}:sanitizeOptions);
-}
-
-export async function renderMarkdownExcerpt(source, options = {}) {
-  const markdown = String(source ?? '');
-  const tokens = new Marked({gfm:options.gfm!==false}).use({extensions:[{...embedSyntax}, {...documentSyntax}]}).lexer(markdown);
-  const paragraph = tokens.find((token) => token.type === 'paragraph');
-  if (!paragraph) return '<p>' + escapeHtml(plainText(markdown).slice(0, 220)) + '</p>';
-  return renderMarkdown(paragraph.raw, { ...options, allowImages: false, allowVideo: false });
-}
-
-export function plainText(source) {
-  const html = new Marked({gfm:true}).use({extensions:[{...embedSyntax}, {...documentSyntax}]}).parse(String(source ?? ''));
-  const namedEntities = {
-    amp: '&', apos: "'", copy: '©', gt: '>', hellip: '…', ldquo: '“', lsquo: '‘',
-    lt: '<', mdash: '—', nbsp: ' ', ndash: '–', quot: '"', rdquo: '”', rsquo: '’'
-  };
-  return String(html)
-    .replace(/<!--[\s\S]*?-->/g, ' ')
-    .replace(/<(script|style|textarea|option|xmp)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ')
-    .replace(/<img\b([^>]*)>/gi, (_match, attributes) => {
-      const alt = attributes.match(/\balt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i);
-      return alt ? ' ' + (alt[1] ?? alt[2] ?? alt[3]) + ' ' : ' ';
-    })
-    .replace(/<[^>]*>/g, ' ')
-    .replace(/&(#x[\da-f]+|#\d+|[a-z][a-z\d]+);/gi, (match, entity) => {
-      if (entity[0] === '#') {
-        const hex = entity[1]?.toLowerCase() === 'x';
-        const point = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
-        return Number.isInteger(point) && point > 0 && point <= 0x10ffff && !(point >= 0xd800 && point <= 0xdfff)
-          ? String.fromCodePoint(point)
-          : match;
-      }
-      return namedEntities[entity.toLowerCase()] ?? match;
-    })
-    .replace(/\s+/g, ' ')
-    .trim();
-}
+
+// CommonMark treats punctuation beside a CJK letter as an intraword delimiter.
+// Accept the bracket/punctuation forms authors use in CJK prose, while letting
+// the ordinary lexer handle escapes, code, links and non-CJK emphasis.
+const cjkStrong = {
+  name: 'cjkStrong', level: 'inline', childTokens: ['tokens'],
+  start: source => { const index = source.indexOf('**'); return index < 0 ? undefined : index; },
+  tokenizer(source) {
+    if (!source.startsWith('**') || source.startsWith('***') || /^\*\*\s/.test(source)) return;
+    for (let end = source.indexOf('**', 2); end >= 0; end = source.indexOf('**', end + 2)) {
+      const text = source.slice(2, end);
+      if (source[end + 2] === '*' || /\s$/.test(text) || !text) continue;
+      const escapes = text.match(/\\+$/)?.[0].length || 0;
+      if (escapes % 2) continue;
+      const cjk = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u;
+      const bracketed = /^[（《「『【]/u.test(text) || /[）》」』】]$/u.test(text);
+      const cjkBoundary = /\p{P}$/u.test(text) && cjk.test(source[end + 2] || '');
+      if (!bracketed && !cjkBoundary) return;
+      return { type: 'cjkStrong', raw: source.slice(0, end + 2), text, tokens: this.lexer.inlineTokens(text) };
+    }
+  },
+  renderer(token) { return '<strong>' + this.parser.parseInline(token.tokens) + '</strong>'; }
+};
+
+function markdownParser(options = {}) {
+  const parser = new Marked({ gfm: options.gfm !== false, breaks: options.breaks === true, renderer: markdownRenderer(options) });
+  parser.use({ extensions: [cjkStrong, { ...documentSyntax, renderer: token => options.documentRenderer ? options.documentRenderer(token) : documentSyntax.renderer(token) }] });
+  return parser;
+}
+
+export function hasMarkdownVideo(source) {
+  const parser = markdownParser();
+  let found = false;
+  parser.walkTokens(parser.lexer(String(source || '')), token => { if (token.type === 'image' && videoMimeType(token.href)) found = true; });
+  return found;
+}
+
+export async function renderMarkdown(source, options = {}) {
+  const parser = markdownParser(options);
+  if (options.embedRenderer) parser.use({
+    async: true,
+    extensions: [{...embedSyntax, renderer: token => token.html}],
+    walkTokens: async token => { if (token.type === 'embed') token.html = await options.embedRenderer(token); }
+  });
+  let html = await parser.parse(source);
+  // GFM task markers become named static status icons. They remain readable to
+  // assistive technology without exposing disabled, unlabeled form controls.
+  html = html.replace(/<input\b([^>]*)>/gi, (_match, attributes) => {
+    const checked = /\bchecked(?:\s|=|$)/i.test(attributes);
+    const label = checked ? (options.taskLabels?.complete || 'Task complete') :
+      (options.taskLabels?.incomplete || 'Task incomplete');
+    const safeLabel = String(label).replace(/[&<>"']/g, (char) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+    })[char]);
+    return '<span class="markdown-task-status" role="img" aria-label="' +
+      safeLabel + '">' + (checked ? '✓' : '□') + '</span>';
+  });
+  return sanitizeHtml(html, options.imageResolver?{...sanitizeOptions,transformTags:{...sanitizeOptions.transformTags,img:(_tag,attributes)=>{
+    const src=options.imageResolver(attributes.src);
+    return src?{tagName:'img',attribs:{src,alt:attributes.alt||'',loading:'lazy'}}:{tagName:'span',attribs:{},text:attributes.alt||''};
+  }}}:sanitizeOptions);
+}
+
+export async function renderMarkdownExcerpt(source, options = {}) {
+  const markdown = String(source ?? '');
+  const tokens = markdownParser(options).use({extensions:[{...embedSyntax}]}).lexer(markdown);
+  const paragraph = tokens.find((token) => token.type === 'paragraph');
+  if (!paragraph) return '<p>' + escapeHtml(plainText(markdown).slice(0, 220)) + '</p>';
+  return renderMarkdown(paragraph.raw, { ...options, allowImages: false, allowVideo: false });
+}
+
+export function plainText(source) {
+  const html = markdownParser().use({extensions:[{...embedSyntax}]}).parse(String(source ?? ''));
+  const namedEntities = {
+    amp: '&', apos: "'", copy: '©', gt: '>', hellip: '…', ldquo: '“', lsquo: '‘',
+    lt: '<', mdash: '—', nbsp: ' ', ndash: '–', quot: '"', rdquo: '”', rsquo: '’'
+  };
+  return String(html)
+    .replace(/<!--[\s\S]*?-->/g, ' ')
+    .replace(/<(script|style|textarea|option|xmp)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ')
+    .replace(/<img\b([^>]*)>/gi, (_match, attributes) => {
+      const alt = attributes.match(/\balt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i);
+      return alt ? ' ' + (alt[1] ?? alt[2] ?? alt[3]) + ' ' : ' ';
+    })
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&(#x[\da-f]+|#\d+|[a-z][a-z\d]+);/gi, (match, entity) => {
+      if (entity[0] === '#') {
+        const hex = entity[1]?.toLowerCase() === 'x';
+        const point = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
+        return Number.isInteger(point) && point > 0 && point <= 0x10ffff && !(point >= 0xd800 && point <= 0xdfff)
+          ? String.fromCodePoint(point)
+          : match;
+      }
+      return namedEntities[entity.toLowerCase()] ?? match;
+    })
+    .replace(/\s+/g, ' ')
+    .trim();
+}

package/src/page-check.js

@@ -96,7 +96,7 @@ export async function markdownFeatureCoverage() {
   catch { unsafeVideoRejected = true; }
   const videoChecks = [
     ['image-shaped video syntax renders an accessible native player with deferred media',
-      /<video controls playsinline preload="none" aria-label="A kite crossing a field"><source src="https:\/\/media\.example\.org\/field-recording\.mp4" type="video\/mp4"/i.test(videoHtml)],
+      /<video\b(?=[^>]*\bcontrols\b)(?=[^>]*\bplaysinline\b)(?=[^>]*\bpreload="none")(?=[^>]*\baria-label="A kite crossing a field")[^>]*><source src="https:\/\/media\.example\.org\/field-recording\.mp4" type="video\/mp4"/i.test(videoHtml)],
     ['video title renders as a caption', /<figcaption>Wind test<\/figcaption>/i.test(videoHtml)],
     ['unsafe video URL is rejected', unsafeVideoRejected],
     ['post-list excerpt preserves inline Markdown formatting', /<strong>formatted<\/strong>[\s\S]*?<em>emphasis<\/em>[\s\S]*?<code>code<\/code>/i.test(excerptHtml)]