edgepress 2026.10.12 → 2026.10.13

package/tests/rss.test.mjs

@@ -0,0 +1,54 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { generateRssRoute, absoluteContentUrls } from '../src/rss.js';
+
+const config = {
+  site: { url: 'https://example.test', title: 'A & B', description: 'News <analysis>', author: { name: 'Editor' } },
+  i18n: { defaultLocale: 'en', locales: ['en', 'zh-CN'] },
+  markdown: { gfm: true, breaks: false }
+};
+
+function post(overrides = {}) {
+  return {
+    title: 'Title & <tag>', author: 'Writer', locale: 'en', path: '2026/10/scene/',
+    date: new Date('2026-10-15T09:00:00Z'), updated: new Date('2026-10-17T10:00:00Z'),
+    category: 'science', tags: ['AI', 'science'],
+    description: 'Summary & details',
+    markdown: '## Introduction\n\nLong **article** text with [local link](/notes/?a=1&b=2), a ![figure](/images/scene.webp) and <script>unsafe()</script>.\n\nA second paragraph.',
+    ...overrides
+  };
+}
+
+test('RSS 2.0 gives AI readers a stable canonical item, full safe HTML, and correct update metadata', async () => {
+  const route = await generateRssRoute([post()], config, 'en');
+  assert.equal(route.path, 'rss.xml');
+  assert.equal(route.contentType, 'application/rss+xml; charset=utf-8');
+  assert.match(route.body, /<rss version="2\.0" /);
+  assert.match(route.body, /<atom:link href="https:\/\/example\.test\/rss\.xml" rel="self" type="application\/rss\+xml"\/>/);
+  assert.match(route.body, /<title>Title &amp; &lt;tag&gt;<\/title>/);
+  assert.match(route.body, /<guid isPermaLink="true">https:\/\/example\.test\/2026\/10\/scene\/<\/guid>/);
+  assert.match(route.body, /<dc:creator>Writer<\/dc:creator>/);
+  assert.match(route.body, /<dc:date>2026-10-17T10:00:00\.000Z<\/dc:date>/);
+  assert.match(route.body, /<pubDate>Thu, 15 Oct 2026 09:00:00 GMT<\/pubDate>/);
+  assert.match(route.body, /<lastBuildDate>Sat, 17 Oct 2026 10:00:00 GMT<\/lastBuildDate>/);
+  assert.match(route.body, /<content:encoded>[\s\S]*Introduction[\s\S]*second paragraph[\s\S]*<\/content:encoded>/i);
+  assert.match(route.body, /https:\/\/example\.test\/images\/scene\.webp/);
+  assert.match(route.body, /https:\/\/example\.test\/notes\/\?a=1&amp;amp;b=2/);
+  assert.doesNotMatch(route.body, /unsafe\(\)|<script|<iframe/);
+  assert.equal((route.body.match(/<category>/g) || []).length, 2);
+});
+
+test('RSS locale paths, item limit, empty feeds and special characters', async () => {
+  const localized = await generateRssRoute([post({ title: '中文 & 新闻', locale: 'zh-CN', path: 'zh-CN/中文/' })], config, 'zh-CN');
+  assert.equal(localized.path, 'zh-CN/rss.xml');
+  assert.match(localized.body, /<language>zh-CN<\/language>/);
+  assert.match(localized.body, /<dc:language>zh-CN<\/dc:language>/);
+  assert.match(localized.body, /%E4%B8%AD%E6%96%87/);
+  assert.match(localized.body, /中文 &amp; 新闻/);
+  const empty = await generateRssRoute([], config, 'en');
+  assert.doesNotMatch(empty.body, /<item>/);
+  const limited = await generateRssRoute(Array.from({ length: 22 }, (_, i) => post({ title: String(i) })), config, 'en');
+  assert.equal((limited.body.match(/<item>/g) || []).length, 20);
+  assert.match(absoluteContentUrls('<a href="../x?a=1&amp;b=2">X</a>', 'https://example.test/section/article/'),
+    /href="https:\/\/example\.test\/section\/x\?a=1&amp;b=2"/);
+});

package/tests/video-metadata.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {collectVideoMetadata, reserveVideoMetadata} from '../src/video-metadata.js';
+import {dataSaverHtml, configureDataSaver} from '../src/data-saver.js';
+import {loadConfig} from '../src/config.js';
+
+test('local video sidecars reserve measured previews without downloading media and survive text-view gating', async () => {
+  const assets = [
+    {path:'media/clip.mp4'}, {path:'media/clip.mp4.poster.jpg'},
+    {path:'media/clip.mp4.json', content:Buffer.from(JSON.stringify({duration:150.001,width:960,height:540,poster:'clip.mp4.poster.jpg'}))}
+  ];
+  const metadata = await collectVideoMetadata(assets);
+  const source = '<figure><video data-edgepress-video preload="none" aria-label="Clip"><source src="/media/clip.mp4" type="video/mp4"></video><figcaption>Caption</figcaption></figure>';
+  const html = reserveVideoMetadata(source, metadata, '2026/10/report/index.html', 'https://site.example');
+  assert.match(html, /data-duration="150\.001" poster="\/media\/clip\.mp4\.poster\.jpg" width="960" height="540"/);
+  assert.equal(reserveVideoMetadata(html, metadata, 'index.html', 'https://site.example'),html);
+  assert.equal(reserveVideoMetadata(source.replace('/media/clip.mp4','https://other.example/media/clip.mp4'),metadata,'index.html','https://site.example'),source.replace('/media/clip.mp4','https://other.example/media/clip.mp4'));
+  assert.match(reserveVideoMetadata(source.replace('preload="none"','preload="none" poster="/chosen.jpg"'),metadata,'index.html','https://site.example'),/poster="\/chosen.jpg"/);
+  const config = await loadConfig(process.cwd()); config.site.dataSaver.enabled=true; await configureDataSaver(config);
+  const gated = dataSaverHtml('<html><head></head><body>'+html+'</body></html>',config,{});
+  assert.match(gated,/<template data-edgepress-data-html>.*data-duration=&quot;150\.001&quot;.*poster=&quot;\/media\/clip\.mp4\.poster\.jpg&quot;/s);
+  assert.match(gated,/<\/div><figcaption>Caption<\/figcaption>/);
+  assert.deepEqual(await collectVideoMetadata([{path:'media/clip.mp4'}]),new Map());
+  for (const change of [{duration:0},{poster:'https://external.example/image.jpg'},{poster:'missing.jpg'}]) {
+    const bad=assets.map(item=>item.path.endsWith('.json')?{...item,content:Buffer.from(JSON.stringify({duration:150,width:960,height:540,poster:'clip.mp4.poster.jpg',...change}))}:item);
+    await assert.rejects(collectVideoMetadata(bad));
+  }
+});

package/tests/writing.test.mjs

@@ -1,79 +1,79 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { postTemplate } from '../src/post-template.js';
-import { readDocuments } from '../src/content.js';
-import { renderMarkdown } from '../src/markdown.js';
-import { renderIcon } from '../src/icons.js';
-import { parse, stringify } from 'yaml';
-
-test('new post metadata round-trips quotes and Markdown titles, with one page title', async () => {
-  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-writing-'));
-  try {
-    const content = resolve(root, 'content');
-    await mkdir(resolve(content, 'posts/2026-10-02-writing'), { recursive: true });
-    const title = '中文 "title": **Markdown** <script>';
-    const source = postTemplate(title, '2026-10-02', 'zh-CN', '在这里写正文。');
-    await writeFile(resolve(content, 'posts/2026-10-02-writing/zh-cn.md'), source);
-    const config = { resolvedPaths: { content }, i18n: { defaultLocale: 'zh-CN', locales: ['zh-CN'] }, concurrency: 1, permalink: '/:year/:month/:slug/' };
-    const [post] = await readDocuments(config, 'posts');
-    assert.equal(post.title, title);
-    assert.equal(post.locale, 'zh-CN');
-    assert.equal(post.date.toISOString().slice(0, 10), '2026-10-02');
-    assert.equal(post.markdown, '在这里写正文。');
-    assert.equal(post.category, 'uncategorized');
-    assert.doesNotMatch(await renderMarkdown(post.markdown), /<h1/);
-  } finally { await rm(root, { recursive: true, force: true }); }
-});
-
-test('article authors accept a profile object and unsafe avatar URLs fail at content loading', async () => {
-  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-profile-'));
-  try {
-    const content = resolve(root, 'content');
-    const file = resolve(content, 'posts/profile/en.md');
-    await mkdir(resolve(content, 'posts/profile'), { recursive: true });
-    const config = { resolvedPaths: { content }, i18n: { locales: ['en'], defaultLocale: 'en' }, concurrency: 1, permalink: '/:slug/' };
-    const metadata = { title: 'Profile', date: '2026-10-02', author: { name: 'Guest', avatar: '/images/guest.png' }, category: '博客', tags: ['notes'] };
-    await writeFile(file, '---\n' + stringify(metadata) + '---\nText');
-    const [post] = await readDocuments(config);
-    assert.equal(post.author, 'Guest');
-    assert.equal(post.authorAvatar, '/images/guest.png');
-    assert.equal(post.category, 'blog');
-    metadata.author.avatar = 'javascript:alert(1)';
-    await writeFile(file, '---\n' + stringify(metadata) + '---\nText');
-    await assert.rejects(readDocuments(config), /author avatar/);
-  } finally { await rm(root, { recursive: true, force: true }); }
-});
-
-test('CLI creates a localized post and refuses to overwrite it', async () => {
-  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-cli-writing-'));
-  try {
-    await writeFile(resolve(root, 'edgepress.config.mjs'), 'export default {i18n:{defaultLocale:"zh-CN",languagePacks:[]}};');
-    const settings = parse(await readFile(resolve('config.yml'), 'utf8'));
-    settings.plugins.consent.services = [];
-    await writeFile(resolve(root, 'config.yml'), stringify(settings));
-    await mkdir(resolve(root, 'languages/base'), { recursive: true });
-    await writeFile(resolve(root, 'languages/base/zh-CN.json'), JSON.stringify({ postStarter: '在这里写正文。', postCreated: '已创建 {file}', postNextSteps: '用 Markdown 写正文。', postPreview: 'npm run dev' }));
-    const cli = resolve('src/cli.js');
-    const first = spawnSync(process.execPath, [cli, 'new', 'post', '我的第一篇文章'], { cwd: root, encoding: 'utf8' });
-    assert.equal(first.status, 0, first.stderr);
-    assert.match(first.stdout, /已创建/);
-    const match = first.stdout.match(/content[^\r\n]+\.md/);
-    const file = resolve(root, match[0]);
-    const before = await readFile(file, 'utf8');
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { postTemplate } from '../src/post-template.js';
+import { readDocuments } from '../src/content.js';
+import { renderMarkdown } from '../src/markdown.js';
+import { renderIcon } from '../src/icons.js';
+import { parse, stringify } from 'yaml';
+
+test('new post metadata round-trips quotes and Markdown titles, with one page title', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-writing-'));
+  try {
+    const content = resolve(root, 'content');
+    await mkdir(resolve(content, 'posts/2026-10-02-writing'), { recursive: true });
+    const title = '中文 "title": **Markdown** <script>';
+    const source = postTemplate(title, '2026-10-02', 'zh-CN', '在这里写正文。');
+    await writeFile(resolve(content, 'posts/2026-10-02-writing/zh-cn.md'), source);
+    const config = { resolvedPaths: { content }, i18n: { defaultLocale: 'zh-CN', locales: ['zh-CN'] }, concurrency: 1, permalink: '/:year/:month/:slug/' };
+    const [post] = await readDocuments(config, 'posts');
+    assert.equal(post.title, title);
+    assert.equal(post.locale, 'zh-CN');
+    assert.equal(post.date.toISOString().slice(0, 10), '2026-10-02');
+    assert.equal(post.markdown, '在这里写正文。');
+    assert.equal(post.category, 'uncategorized');
+    assert.doesNotMatch(await renderMarkdown(post.markdown), /<h1/);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test('article authors accept a profile object and unsafe avatar URLs fail at content loading', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-profile-'));
+  try {
+    const content = resolve(root, 'content');
+    const file = resolve(content, 'posts/profile/en.md');
+    await mkdir(resolve(content, 'posts/profile'), { recursive: true });
+    const config = { resolvedPaths: { content }, i18n: { locales: ['en'], defaultLocale: 'en' }, concurrency: 1, permalink: '/:slug/' };
+    const metadata = { title: 'Profile', date: '2026-10-02', author: { name: 'Guest', avatar: '/images/guest.png' }, category: '博客', tags: ['notes'] };
+    await writeFile(file, '---\n' + stringify(metadata) + '---\nText');
+    const [post] = await readDocuments(config);
+    assert.equal(post.author, 'Guest');
+    assert.equal(post.authorAvatar, '/images/guest.png');
+    assert.equal(post.category, 'blog');
+    metadata.author.avatar = 'javascript:alert(1)';
+    await writeFile(file, '---\n' + stringify(metadata) + '---\nText');
+    await assert.rejects(readDocuments(config), /author avatar/);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test('CLI creates a localized post and refuses to overwrite it', async () => {
+  const root = await mkdtemp(resolve(tmpdir(), 'edgepress-cli-writing-'));
+  try {
+    await writeFile(resolve(root, 'edgepress.config.mjs'), 'export default {i18n:{defaultLocale:"zh-CN",languagePacks:[]}};');
+    const settings = parse(await readFile(resolve('config.yml'), 'utf8'));
+    settings.plugins.consent.services = [];
+    await writeFile(resolve(root, 'config.yml'), stringify(settings));
+    await mkdir(resolve(root, 'languages/base'), { recursive: true });
+    await writeFile(resolve(root, 'languages/base/zh-CN.json'), JSON.stringify({ postStarter: '在这里写正文。', postCreated: '已创建 {file}', postNextSteps: '用 Markdown 写正文。', postPreview: 'npm run dev' }));
+    const cli = resolve('src/cli.js');
+    const first = spawnSync(process.execPath, [cli, 'new', 'post', '我的第一篇文章'], { cwd: root, encoding: 'utf8' });
+    assert.equal(first.status, 0, first.stderr);
+    assert.match(first.stdout, /已创建/);
+    const match = first.stdout.match(/content[^\r\n]+\.md/);
+    const file = resolve(root, match[0]);
+    const before = await readFile(file, 'utf8');
     assert.match(before, /在这里写正文。/);
-    assert.equal(parse(before.split('---')[1]).title, '我的第一篇文章');
-    assert.doesNotMatch(before, /# 我的第一篇文章/);
-    const second = spawnSync(process.execPath, [cli, 'new', 'post', '我的第一篇文章'], { cwd: root, encoding: 'utf8' });
-    assert.equal(second.status, 1);
-    assert.match(second.stderr, /already exists/);
-    assert.equal(await readFile(file, 'utf8'), before);
-  } finally { await rm(root, { recursive: true, force: true }); }
-});
-
+    assert.equal(parse(before.split('---')[1]).title, '我的第一篇文章');
+    assert.doesNotMatch(before, /# 我的第一篇文章/);
+    const second = spawnSync(process.execPath, [cli, 'new', 'post', '我的第一篇文章'], { cwd: root, encoding: 'utf8' });
+    assert.equal(second.status, 1);
+    assert.match(second.stderr, /already exists/);
+    assert.equal(await readFile(file, 'utf8'), before);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
 test('CLI initialization carries root security overrides without discarding operator choices', async () => {
   const root = await mkdtemp(resolve(tmpdir(), 'edgepress-cli-init-'));
   try {
@@ -87,15 +87,15 @@ test('CLI initialization carries root security overrides without discarding oper
     assert.equal(manifest.dependencies.wrangler, framework.devDependencies.wrangler);
     assert.equal(manifest.scripts.verify, 'node verify.mjs');
     assert.equal(manifest.name, 'operator-site');
-    const home = JSON.parse(await readFile(resolve(root, 'content/pages/home/en.json'), 'utf8'));
-    assert.equal(home.$schema, '../../../node_modules/edgepress/schemas/pages.schema.json');
-    assert.ok(home.blocks.length);
+    const home = JSON.parse(await readFile(resolve(root, 'content/pages/home/en.json'), 'utf8'));
+    assert.equal(home.$schema, '../../../node_modules/edgepress/schemas/pages.schema.json');
+    assert.ok(home.blocks.length);
   } finally { await rm(root, { recursive: true, force: true }); }
 });
 
 test('bitmap icon paths reject traversal and preserve safe caller classes', () => {
-  assert.match(renderIcon('book-open', 'icon nav_icon'), /class="icon nav_icon icon-library"/);
-  assert.match(renderIcon('book-open'), /alt="" aria-hidden="true"/);
-  for (const name of ['../home', 'home.png', '__proto__', 'HOME', '" onerror="x']) assert.throws(() => renderIcon(name));
-  for (const value of ['icon" onerror="x', 'icon<svg', '', undefined + '"']) assert.throws(() => renderIcon('home', value));
-});
+  assert.match(renderIcon('book-open', 'icon nav_icon'), /class="icon nav_icon icon-library"/);
+  assert.match(renderIcon('book-open'), /alt="" aria-hidden="true"/);
+  for (const name of ['../home', 'home.png', '__proto__', 'HOME', '" onerror="x']) assert.throws(() => renderIcon(name));
+  for (const value of ['icon" onerror="x', 'icon<svg', '', undefined + '"']) assert.throws(() => renderIcon('home', value));
+});