edgepress 2026.10.12 → 2026.10.13

package/src/revision-cards.js

@@ -1,30 +1,30 @@
-import {renderMarkdown} from './markdown.js';
-const escape=value=>String(value).replace(/[&<>"']/g,char=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[char]));
-
-// Git is a build-time source of history. Readers see changed passages, not patches.
-export function changedPassages(diff){
- const groups=[];let before=[],after=[];
- const finish=()=>{if(before.length||after.length)groups.push({before:before.join('\n'),after:after.join('\n')});before=[];after=[];};
- for(const line of String(diff).split(/\r?\n/)){
-  if(/^(?:diff --git|index |--- |\+\+\+ |\\)/.test(line))continue;
-  if(line.startsWith('-'))before.push(line.slice(1));
-  else if(line.startsWith('+'))after.push(line.slice(1));
-  else finish();
- }
- finish();return groups.filter(group=>group.before.trim()||group.after.trim());
-}
-export async function renderRevisionCards(diff,label,images,options={}){
- const groups=changedPassages(diff);if(!groups.length)return '';
- const cards=[];
- for(const group of groups){
-  const sides=[];
-  for(const side of ['before','after'])if(group[side].trim()){
-   const key=side==='before'?(group.after.trim()?'postChangeBefore':'postChangeRemoved'):(group.before.trim()?'postChangeAfter':'postChangeAdded');
-   const known=new Set(Object.values(images?.[side]||{}));
-   const content=(await renderMarkdown(group[side],{allowImages:!!images,allowVideo:false,...(options.linkResolver?{linkResolver:options.linkResolver}:{}),...(images?{imageResolver:href=>images[side]?.[href]||(known.has(href)?href:null)}:{})})).replace(/<h[1-6]\b[^>]*>/g,'<p class="post-change-heading">').replace(/<\/h[1-6]>/g,'</p>');
-   sides.push('<div class="post-change-side post-change-'+side+'"><p class="post-change-label">'+escape(label(key))+'</p><div class="post-change-content">'+content+'</div></div>');
-  }
-  cards.push('<div class="post-change-passage">'+sides.join('')+'</div>');
- }
- return '<details class="post-changes"><summary>'+escape(label('postChanges'))+'</summary><div class="post-changes-list">'+cards.join('')+'</div></details>';
-}
+import {renderMarkdown} from './markdown.js';
+const escape=value=>String(value).replace(/[&<>"']/g,char=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[char]));
+
+// Git is a build-time source of history. Readers see changed passages, not patches.
+export function changedPassages(diff){
+ const groups=[];let before=[],after=[];
+ const finish=()=>{if(before.length||after.length)groups.push({before:before.join('\n'),after:after.join('\n')});before=[];after=[];};
+ for(const line of String(diff).split(/\r?\n/)){
+  if(/^(?:diff --git|index |--- |\+\+\+ |\\)/.test(line))continue;
+  if(line.startsWith('-'))before.push(line.slice(1));
+  else if(line.startsWith('+'))after.push(line.slice(1));
+  else finish();
+ }
+ finish();return groups.filter(group=>group.before.trim()||group.after.trim());
+}
+export async function renderRevisionCards(diff,label,images,options={}){
+ const groups=changedPassages(diff);if(!groups.length)return '';
+ const cards=[];
+ for(const group of groups){
+  const sides=[];
+  for(const side of ['before','after'])if(group[side].trim()){
+   const key=side==='before'?(group.after.trim()?'postChangeBefore':'postChangeRemoved'):(group.before.trim()?'postChangeAfter':'postChangeAdded');
+   const known=new Set(Object.values(images?.[side]||{}));
+   const content=(await renderMarkdown(group[side],{allowImages:!!images,allowVideo:false,...(options.linkResolver?{linkResolver:options.linkResolver}:{}),...(images?{imageResolver:href=>images[side]?.[href]||(known.has(href)?href:null)}:{})})).replace(/<h[1-6]\b[^>]*>/g,'<p class="post-change-heading">').replace(/<\/h[1-6]>/g,'</p>');
+   sides.push('<div class="post-change-side post-change-'+side+'"><p class="post-change-label">'+escape(label(key))+'</p><div class="post-change-content">'+content+'</div></div>');
+  }
+  cards.push('<div class="post-change-passage">'+sides.join('')+'</div>');
+ }
+ return '<details class="post-changes"><summary>'+escape(label('postChanges'))+'</summary><div class="post-changes-list">'+cards.join('')+'</div></details>';
+}

package/src/rss.js

@@ -0,0 +1,100 @@
+import { renderMarkdown, plainText } from './markdown.js';
+import { localizedContentUrl, localizedUrl } from './i18n.js';
+import { authorForPost, normalizeCategory } from './post-details.js';
+
+function xml(value) {
+  return String(value ?? '')
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\ufffe\uffff]|[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, '')
+    .replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;' })[char]);
+}
+
+function decodeAttribute(value) {
+  return String(value).replace(/&(?:amp|quot|apos|lt|gt);/gi, entity => ({
+    '&amp;': '&', '&quot;': '"', '&apos;': "'", '&lt;': '<', '&gt;': '>'
+  })[entity.toLowerCase()]);
+}
+
+// Feed HTML has no reliable base URL. Its images and internal links must work
+// independently of the original article page, without adding active embeds.
+export function absoluteContentUrls(html, articleUrl) {
+  return String(html).replace(/\b(href|src)="([^"]*)"/g, (attribute, name, encoded) => {
+    const value = decodeAttribute(encoded);
+    if (/^(?:[a-z][a-z\d+.-]*:|\/\/)/i.test(value)) return attribute;
+    try {
+      const url = new URL(value, articleUrl);
+      if (url.protocol !== 'https:' && url.protocol !== 'http:') return attribute;
+      return name + '="' + url.href.replace(/&/g, '&amp;').replace(/"/g, '&quot;') + '"';
+    } catch {
+      return attribute;
+    }
+  });
+}
+
+function canonicalUrl(post, config) {
+  return config.site.url + '/' + String(post.path).split('/').filter(Boolean).map(encodeURIComponent).join('/') + '/';
+}
+
+function lastChanged(post) {
+  return post.updated instanceof Date && post.updated > post.date ? post.updated : post.date;
+}
+
+function categories(post) {
+  const category = normalizeCategory(post.category);
+  return [...new Set([...(category === 'uncategorized' ? [] : [category]), ...(post.tags || [])])];
+}
+
+function isSiteImage(href, config) {
+  const value = String(href ?? '');
+  if (value.startsWith('/') && !value.startsWith('//')) return value;
+  try {
+    const url = new URL(value);
+    return url.protocol === 'https:' && url.origin === new URL(config.site.url).origin ? value : '';
+  } catch { return ''; }
+}
+
+// Returns a single standard RSS 2.0 document; no hand-maintained XML assets.
+export async function generateRssRoute(posts, config, locale) {
+  const prefix = locale === config.i18n.defaultLocale ? '' : locale + '/';
+  const homeUrl = config.site.url + localizedUrl(config, locale, '');
+  const rssUrl = config.site.url + localizedUrl(config, locale, 'rss.xml');
+  const items = await Promise.all(posts.slice(0, 20).map(async post => {
+    const url = canonicalUrl(post, config);
+    // Re-render static Markdown with the normal sanitizer. Omit interactive
+    // embed/player markup and remote images that may bypass reader consent.
+    const rendered = await renderMarkdown(post.markdown || '', {
+      ...config.markdown,
+      linkResolver: href => localizedContentUrl(config, post.locale, href),
+      imageResolver: href => isSiteImage(href, config),
+      allowVideo: false
+    });
+    return {
+      url, title: post.title,
+      author: authorForPost(post, config).name || config.site.title,
+      locale: post.locale, published: post.date, updated: lastChanged(post),
+      summary: plainText(post.description || post.markdown).slice(0, 220),
+      content: absoluteContentUrls(rendered, url), categories: categories(post)
+    };
+  }));
+  const lastBuild = items.reduce((latest, item) => item.updated > latest ? item.updated : latest, new Date(0));
+  const rssItems = items.map(item =>
+    '<item><title>' + xml(item.title) + '</title><link>' + xml(item.url) + '</link>' +
+    '<guid isPermaLink="true">' + xml(item.url) + '</guid>' +
+    '<pubDate>' + item.published.toUTCString() + '</pubDate>' +
+    '<dc:date>' + item.updated.toISOString() + '</dc:date>' +
+    '<dc:creator>' + xml(item.author) + '</dc:creator>' +
+    '<dc:language>' + xml(item.locale) + '</dc:language>' +
+    '<description>' + xml(item.summary) + '</description>' +
+    item.categories.map(category => '<category>' + xml(category) + '</category>').join('') +
+    '<content:encoded>' + xml(item.content) + '</content:encoded></item>'
+  ).join('');
+  const rss = '<?xml version="1.0" encoding="utf-8"?>' +
+    '<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" ' +
+    'xmlns:content="http://purl.org/rss/1.0/modules/content/" ' +
+    'xmlns:dc="http://purl.org/dc/elements/1.1/"><channel>' +
+    '<title>' + xml(config.site.title) + '</title><link>' + xml(homeUrl) + '</link>' +
+    '<description>' + xml(config.site.description) + '</description><language>' + xml(locale) + '</language>' +
+    '<lastBuildDate>' + lastBuild.toUTCString() + '</lastBuildDate>' +
+    '<atom:link href="' + xml(rssUrl) + '" rel="self" type="application/rss+xml"/>' +
+    rssItems + '</channel></rss>';
+  return { path: prefix + 'rss.xml', body: rss, contentType: 'application/rss+xml; charset=utf-8' };
+}

package/src/theme.js

@@ -28,7 +28,7 @@ function navigationItems(config, locale, items, currentPath = '', scope = 'prima
   return values.map((item, index) => {
     const path = item.url === '@home' ? localizedUrl(config, locale, '') :
       item.url === '@archives' ? localizedUrl(config, locale, 'archives/') :
-        item.url === '@feed' ? localizedUrl(config, locale, 'feed.xml') :
+        item.url === '@feed' ? localizedUrl(config, locale, 'rss.xml') :
           item.url === '@search' ? localizedUrl(config, locale, 'search/') :
           item.url.startsWith('/') ? localizedUrl(config, locale, item.url) : item.url;
     const label = item.labels?.[locale] ?? item.labels?.[config.i18n.defaultLocale] ?? translate(config, locale, item.key);
@@ -38,7 +38,7 @@ function navigationItems(config, locale, items, currentPath = '', scope = 'prima
     if (item.children?.length) {
       const choices = [{ path, label, target:item.target }, ...item.children.map(child => ({
         path: child.url === '@home' ? localizedUrl(config, locale, '') : child.url === '@archives' ? localizedUrl(config, locale, 'archives/') :
-          child.url === '@feed' ? localizedUrl(config, locale, 'feed.xml') : child.url === '@search' ? localizedUrl(config, locale, 'search/') :
+          child.url === '@feed' ? localizedUrl(config, locale, 'rss.xml') : child.url === '@search' ? localizedUrl(config, locale, 'search/') :
           child.url.startsWith('/') ? localizedUrl(config, locale, child.url) : child.url,
         label: child.labels?.[locale] ?? child.labels?.[config.i18n.defaultLocale] ?? translate(config, locale, child.key), target:child.target
       }))];
@@ -150,7 +150,7 @@ export async function renderLayout(config, extensions, page, body) {
       stylesheet,
       homePath: localizedUrl(config, locale, ''),
       archivesPath: localizedUrl(config, locale, 'archives/'),
-      feedPath: localizedUrl(config, locale, 'feed.xml'),
+      feedPath: localizedUrl(config, locale, 'rss.xml'),
       homeLabel: translate(config, locale, 'home'),
       archivesLabel: translate(config, locale, 'archives'),
       feedLabel: translate(config, locale, 'feed'),
@@ -194,7 +194,7 @@ export async function renderLayout(config, extensions, page, body) {
     scripts.push('<script id="edgepress-external-links-config" type="application/json">' + JSON.stringify(settings).replace(/</g, '\\u003c') + '</script><script type="module" src="/edgepress/external-links.js"></script>');
   }
   if (/<main\b/i.test(filtered)) scripts.push('<script type="module" src="/edgepress/webmcp.js"></script>');
-  if (/data-edgepress-media-viewer(?:\s|=|>)/i.test(filtered)) {
+  if (/data-edgepress-(?:media-viewer|video)(?:\s|=|>)/i.test(filtered)) {
     filtered = filtered.replace(/<\/head\s*>/i, '<link rel="stylesheet" href="/edgepress/media-viewer.css"><link rel="stylesheet" href="/edgepress/image-viewer.css"></head>');
     scripts.push('<script type="module" src="/edgepress/media-viewer.js"></script>');
     if (filtered.includes('data-media-service')) scripts.push('<script defer src="/edgepress/services-consent.js"></script>');

package/src/video-metadata.js

@@ -0,0 +1,36 @@
+import {readFile} from 'node:fs/promises';
+import {posix} from 'node:path';
+
+// Offline-generated sidecars keep duration and posters available without requesting media.
+export async function collectVideoMetadata(assets) {
+  const known = new Map(assets.map(item => [item.path, item])), result = new Map();
+  for (const video of assets.filter(item => /\.(?:mp4|webm|ogv|ogg)$/i.test(item.path))) {
+    const sidecar = known.get(video.path + '.json');
+    if (!sidecar) continue;
+    const data = JSON.parse((sidecar.content ?? await readFile(sidecar.source)).toString());
+    const duration = Number(data.duration), width = Number(data.width), height = Number(data.height);
+    if (![duration, width, height].every(value => Number.isFinite(value) && value > 0)) throw new Error('Invalid video metadata: ' + sidecar.path);
+    if (typeof data.poster !== 'string' || /[\\?#\x00-\x1f]|^[a-z]+:|^\/\//i.test(data.poster)) throw new Error('Invalid video poster: ' + sidecar.path);
+    const poster = posix.normalize(posix.join(posix.dirname(video.path), data.poster));
+    if (!known.has(poster) || !/\.(?:jpe?g|png|webp|avif)$/i.test(poster)) throw new Error('Missing local video poster: ' + sidecar.path);
+    result.set('/' + video.path, {duration, width, height, poster: '/' + poster});
+  }
+  return result;
+}
+
+export function reserveVideoMetadata(html, metadata, path, origin) {
+  return html.replace(/<video\b([^>]*)>([\s\S]*?)<\/video>/gi, (tag, attributes, content) => {
+    const src = attributes.match(/\ssrc=["']([^"']+)["']/i)?.[1] ?? content.match(/<source\b[^>]*\ssrc=["']([^"']+)["']/i)?.[1];
+    if (!src) return tag;
+    let url;
+    try { url = new URL(src.replaceAll('&amp;', '&'), new URL('/' + path, origin)); } catch { return tag; }
+    if (url.origin !== new URL(origin).origin) return tag;
+    const data = metadata.get(decodeURI(url.pathname));
+    if (!data) return tag;
+    const escape = value => String(value).replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;');
+    for (const [name, value] of Object.entries({'data-duration': data.duration, poster: data.poster, width: data.width, height: data.height})) {
+      if (!new RegExp('\\s' + name + '\\s*=', 'i').test(attributes)) attributes += ' ' + name + '="' + escape(value) + '"';
+    }
+    return '<video' + attributes + '>' + content + '</video>';
+  });
+}