edgepress 2026.9.5 → 2026.9.8

package/src/markdown.js

@@ -7,9 +7,9 @@ const allowedTags = [
   'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2',
   'h3', 'h4', 'h5', 'h6', 'header', 'hr', 'i', 'img', 'kbd', 'li', 'main',
   'mark', 'nav', 'ol', 'p', 'pre', 'q', 'rp', 'rt', 'rtc', 'ruby', 's',
-  'samp', 'section', 'small', 'span', 'strong', 'sub', 'summary', 'sup',
-  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'u', 'ul',
-  'var', 'wbr'
+  'samp', 'section', 'small', 'source', 'span', 'strong', 'sub', 'summary', 'sup',
+  'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'track', 'tr', 'u', 'ul',
+  'var', 'video', 'wbr'
 ];
 
 const sanitizeOptions = {
@@ -20,9 +20,12 @@ const sanitizeOptions = {
     img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
     li: ['value'],
     ol: ['start'],
+    source: ['src', 'type'],
     span: ['class', 'role', 'aria-label'],
     td: ['align', 'colspan', 'rowspan'],
-    th: ['align', 'colspan', 'rowspan']
+    th: ['align', 'colspan', 'rowspan'],
+    track: ['kind', 'src', 'srclang', 'label', 'default'],
+    video: ['aria-label', 'controls', 'playsinline', 'poster', 'preload', 'width', 'height']
   },
   allowedSchemes: ['http', 'https', 'mailto', 'tel'],
   allowProtocolRelative: false,
@@ -35,10 +38,59 @@ const sanitizeOptions = {
   }
 };
 
+function videoMimeType(href) {
+  const path = String(href ?? '').split(/[?#]/, 1)[0].toLowerCase();
+  const extension = path.match(/\.(mp4|webm|ogv|ogg)$/)?.[1];
+  return ({ mp4: 'video/mp4', webm: 'video/webm', ogv: 'video/ogg', ogg: 'video/ogg' })[extension] || '';
+}
+
+function safeVideoHref(value) {
+  const href = String(value ?? '').trim();
+  if (!href || /[\x00-\x20\\]/.test(href) || href.startsWith('//')) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  if (href.startsWith('/')) return href;
+  let url;
+  try { url = new URL(href, 'https://edgepress.invalid'); }
+  catch { throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs'); }
+  if (url.username || url.password || !['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('Markdown video sources must be safe relative paths or HTTP(S) URLs');
+  }
+  return href;
+}
+
+function escapeHtml(value) {
+  return String(value ?? '').replace(/[&<>"']/g, (char) => ({
+    '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'
+  })[char]);
+}
+
+function markdownRenderer(options) {
+  const renderer = new marked.Renderer();
+  const renderImage = renderer.image.bind(renderer);
+  renderer.image = (token) => {
+    const mimeType = videoMimeType(token.href);
+    if (mimeType) {
+      const description = String(token.text ?? '').trim();
+      if (!description) throw new Error('Markdown videos need descriptive alternative text');
+      const href = escapeHtml(safeVideoHref(token.href));
+      if (options.allowVideo === false) return '<span>' + escapeHtml(description) + '</span>';
+      const caption = token.title ? '<figcaption>' + escapeHtml(token.title) + '</figcaption>' : '';
+      return '<figure class="markdown-video"><video controls playsinline preload="none" aria-label="' +
+        escapeHtml(description) + '"><source src="' + href + '" type="' + mimeType + '"><a href="' + href + '">' +
+        escapeHtml(description) + '</a></video>' + caption + '</figure>';
+    }
+    if (options.allowImages === false) return '<span>' + escapeHtml(token.text || '') + '</span>';
+    return renderImage(token);
+  };
+  return renderer;
+}
+
 export async function renderMarkdown(source, options = {}) {
   let html = await marked.parse(source, {
     gfm: options.gfm !== false,
-    breaks: options.breaks === true
+    breaks: options.breaks === true,
+    renderer: markdownRenderer(options)
   });
   // GFM task markers become named static status icons. They remain readable to
   // assistive technology without exposing disabled, unlabeled form controls.
@@ -55,11 +107,38 @@ export async function renderMarkdown(source, options = {}) {
   return sanitizeHtml(html, sanitizeOptions);
 }
 
+export async function renderMarkdownExcerpt(source, options = {}) {
+  const markdown = String(source ?? '');
+  const tokens = marked.lexer(markdown, { gfm: options.gfm !== false });
+  const paragraph = tokens.find((token) => token.type === 'paragraph');
+  if (!paragraph) return '<p>' + escapeHtml(plainText(markdown).slice(0, 220)) + '</p>';
+  return renderMarkdown(paragraph.raw, { ...options, allowImages: false, allowVideo: false });
+}
+
 export function plainText(source) {
-  return String(source)
-    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
-    .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
-    .replace(/[#>*_~|-]/g, ' ')
+  const html = marked.parse(String(source ?? ''), { gfm: true });
+  const namedEntities = {
+    amp: '&', apos: "'", copy: '©', gt: '>', hellip: '…', ldquo: '“', lsquo: '‘',
+    lt: '<', mdash: '—', nbsp: ' ', ndash: '–', quot: '"', rdquo: '”', rsquo: '’'
+  };
+  return String(html)
+    .replace(/<!--[\s\S]*?-->/g, ' ')
+    .replace(/<(script|style|textarea|option|xmp)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, ' ')
+    .replace(/<img\b([^>]*)>/gi, (_match, attributes) => {
+      const alt = attributes.match(/\balt\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i);
+      return alt ? ' ' + (alt[1] ?? alt[2] ?? alt[3]) + ' ' : ' ';
+    })
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&(#x[\da-f]+|#\d+|[a-z][a-z\d]+);/gi, (match, entity) => {
+      if (entity[0] === '#') {
+        const hex = entity[1]?.toLowerCase() === 'x';
+        const point = Number.parseInt(entity.slice(hex ? 2 : 1), hex ? 16 : 10);
+        return Number.isInteger(point) && point > 0 && point <= 0x10ffff && !(point >= 0xd800 && point <= 0xdfff)
+          ? String.fromCodePoint(point)
+          : match;
+      }
+      return namedEntities[entity.toLowerCase()] ?? match;
+    })
     .replace(/\s+/g, ' ')
     .trim();
 }

package/src/page-blocks.js

@@ -1,5 +1,7 @@
-import { plainText } from './markdown.js';
-import { translate } from './i18n.js';
+import { renderMarkdownExcerpt } from './markdown.js';
+import { translate, translateValue } from './i18n.js';
+import { isIconName, renderIcon } from './icons.js';
+import { postsForLocale } from './content.js';
 
 const captchaProviders = new Set(['cloudflare-turnstile', 'google-recaptcha', 'hcaptcha']);
 
@@ -32,6 +34,20 @@ function list(value, label, min = 1, max = 50) {
   return value;
 }
 
+function imageCandidates(value, label) {
+  let previousWidth = 0;
+  return list(value, label, 1, 4).map((candidate, index) => {
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) throw new Error(label + '[' + index + '] must be an object');
+    const src = escapeHtml(safeUrl(candidate.src, label + '[' + index + '].src'));
+    const width = candidate.width;
+    if (!Number.isInteger(width) || width < 1 || width > 10000 || width <= previousWidth) {
+      throw new Error(label + ' widths must be increasing integers from 1 to 10000');
+    }
+    previousWidth = width;
+    return src + ' ' + width + 'w';
+  }).join(', ');
+}
+
 function enabledIntegration(config, id, category) {
   const section = config.browserPlugins[category];
   const match = section?.enabled && section.services.find((item) => item.id === id);
@@ -43,6 +59,10 @@ function dateLabel(date, locale) {
   return new Intl.DateTimeFormat(locale, { dateStyle: 'long', timeZone: 'UTC' }).format(date);
 }
 
+function dateOnlyLabel(value, locale) {
+  return new Intl.DateTimeFormat(locale, { dateStyle: 'long', timeZone: 'UTC' }).format(new Date(value + 'T00:00:00.000Z'));
+}
+
 function renderPrivacyServices(context) {
   const groups = [
     ['tracking', translate(context.config, context.locale, 'pluginTracking')],
@@ -57,22 +77,40 @@ function renderPrivacyServices(context) {
   if (!configured.length) {
     return '<p class="privacy-empty">' + escapeHtml(text(context.emptyText, 'privacy-services.emptyText', 2000)) + '</p>';
   }
-  return '<ul class="privacy-service-list">' + configured.map((service) => '<li><h3>' + escapeHtml(service.category + ' · ' + service.provider) +
-    '</h3><p><strong>' + escapeHtml(translate(context.config, context.locale, 'servicePurpose')) + ':</strong> ' + escapeHtml(service.purpose) +
-    '</p><p><strong>' + escapeHtml(translate(context.config, context.locale, 'serviceRetention')) + ':</strong> ' + escapeHtml(service.retention) + '</p></li>').join('') + '</ul>';
+  return '<ul class="privacy-service-list">' + configured.map((service) => '<li><h3>' + escapeHtml(service.category + ' · ' +
+    translateValue(context.config, context.locale, service.name || service.provider)) + '</h3><p><strong>' +
+    escapeHtml(translate(context.config, context.locale, 'servicePurpose')) + ':</strong> ' +
+    escapeHtml(translateValue(context.config, context.locale, service.purpose)) + '</p><p><strong>' +
+    escapeHtml(translate(context.config, context.locale, 'serviceDataCategories')) + ':</strong> ' +
+    escapeHtml(translateValue(context.config, context.locale, service.dataCategories)) + '</p><p><strong>' +
+    escapeHtml(translate(context.config, context.locale, 'serviceRecipient')) + ':</strong> ' +
+    escapeHtml(translateValue(context.config, context.locale, service.recipient)) + '</p><p><strong>' +
+    escapeHtml(translate(context.config, context.locale, 'serviceRetention')) + ':</strong> ' +
+    escapeHtml(translateValue(context.config, context.locale, service.retention)) + '</p></li>').join('') + '</ul>';
 }
 
-function renderLatestPosts(block, context) {
+async function renderLatestPosts(block, context) {
   const count = block.count ?? 3;
   if (!Number.isInteger(count) || count < 1 || count > 12) throw new Error('latest-posts.count must be an integer from 1 to 12');
-  const posts = context.site.posts.filter((post) => post.locale === context.locale ||
-    (!context.site.posts.some((item) => item.locale === context.locale) && post.locale === context.config.i18n.defaultLocale)).slice(0, count);
+  const paginate = block.paginate ?? false;
+  if (typeof paginate !== 'boolean') throw new Error('latest-posts.paginate must be a boolean');
+  const posts = postsForLocale(context.site.posts, context.locale, context.config.i18n.defaultLocale);
   const title = escapeHtml(text(block.title, 'latest-posts.title', 200));
-  const cards = posts.map((post) => '<article class="post-card"><h3><a href="' + escapeHtml('/' + post.path.split('/').filter(Boolean).join('/') + (post.path.endsWith('/') ? '/' : '')) + '">' +
-    escapeHtml(post.title) + '</a></h3><p class="meta"><time datetime="' + post.date.toISOString() + '">' + escapeHtml(dateLabel(post.date, context.locale)) +
-    '</time></p><p>' + escapeHtml(post.description || plainText(post.markdown).slice(0, 220)) + '</p></article>').join('');
+  const authorLabel = (post) => post.author ? '<span class="post-author">' + escapeHtml(translate(context.config, context.locale, 'postAuthor')
+    .replace('{author}', post.author)) + '</span>' : '';
+  const cards = (await Promise.all(posts.slice(0, count).map(async (post) => {
+    const excerpt = await renderMarkdownExcerpt(post.description || post.markdown, context.config.markdown);
+    return '<article class="post-card" lang="' + escapeHtml(post.locale) + '"><h3><a href="' + escapeHtml('/' + post.path.split('/').filter(Boolean).join('/') + (post.path.endsWith('/') ? '/' : '')) + '">' +
+      escapeHtml(post.title) + '</a></h3><p class="meta"><time datetime="' + post.date.toISOString() + '">' + escapeHtml(dateLabel(post.date, context.locale)) +
+      '</time>' + (post.author ? ' · ' + authorLabel(post) : '') + '</p><div class="post-excerpt" lang="' + escapeHtml(post.locale) + '">' + excerpt + '</div></article>';
+  }))).join('');
+  const pagination = paginate && context.latestPostsPagination?.totalPages > 1
+    ? '<nav class="pagination latest-posts-pagination" aria-label="' + escapeHtml(translate(context.config, context.locale, 'pagination')) + '">' +
+      '<a rel="next" href="' + escapeHtml(context.latestPostsPagination.olderUrl) + '">' + escapeHtml(translate(context.config, context.locale, 'older')) + '</a>' +
+      '<a href="' + escapeHtml(context.latestPostsPagination.archiveUrl) + '">' + escapeHtml(translate(context.config, context.locale, 'allPosts')) + '</a></nav>'
+    : '';
   return '<section class="latest-posts"><h2>' + title + '</h2>' +
-    (cards ? '<div class="post-list">' + cards + '</div>' : '<p>' + escapeHtml(translate(context.config, context.locale, 'noPosts')) + '</p>') + '</section>';
+    (cards ? '<div class="post-list">' + cards + '</div>' : '<p>' + escapeHtml(translate(context.config, context.locale, 'noPosts')) + '</p>') + pagination + '</section>';
 }
 
 function renderMediaText(block) {
@@ -88,12 +126,13 @@ function renderMediaText(block) {
     media = '<img src="' + src + '" alt="' + alt + '" loading="lazy" decoding="async">';
   } else {
     if (!alt.trim()) throw new Error('media-text.alt must describe the video');
+    const videoSrc = escapeHtml(safeUrl(block.src, 'media-text.src'));
     const captions = escapeHtml(safeUrl(block.captions, 'media-text.captions'));
     const language = escapeHtml(text(block.captionLanguage, 'media-text.captionLanguage', 24));
     if (!/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/.test(language)) throw new Error('media-text.captionLanguage must be a language tag');
     const trackLabel = escapeHtml(text(block.captionLabel, 'media-text.captionLabel', 120));
     const poster = block.poster ? ' poster="' + escapeHtml(safeUrl(block.poster, 'media-text.poster')) + '"' : '';
-    media = '<video controls preload="none" aria-label="' + alt + '"' + poster + '><source src="' + src + '"><track kind="captions" src="' + captions + '" srclang="' + language + '" label="' + trackLabel + '" default></video>';
+    media = '<video controls playsinline preload="metadata" aria-label="' + alt + '"' + poster + '><source src="' + videoSrc + '" type="video/mp4"><track kind="captions" src="' + captions + '" srclang="' + language + '" label="' + trackLabel + '" default></video>';
   }
   const title = text(block.title, 'media-text.title', 240, true);
   const content = text(block.text, 'media-text.text', 2000);
@@ -117,6 +156,22 @@ async function renderBlock(block, context, depth, index) {
       const level = context.isHomepage && index === 0 ? 'h1' : 'h2';
       const eyebrow = text(block.eyebrow, 'hero.eyebrow', 120, true);
       const description = text(block.text, 'hero.text', 1000, true);
+      const mascotSrc = block.mascotSrc === undefined ? '' : safeUrl(block.mascotSrc, 'hero.mascotSrc');
+      const mascotAlt = block.mascotAlt === undefined ? '' : text(block.mascotAlt, 'hero.mascotAlt', 500);
+      if (Boolean(mascotSrc) !== Boolean(mascotAlt)) throw new Error('hero.mascotSrc and hero.mascotAlt must be provided together');
+      const mascotWebpSrcset = block.mascotWebpSrcset === undefined ? '' : imageCandidates(block.mascotWebpSrcset, 'hero.mascotWebpSrcset');
+      if (mascotWebpSrcset && !mascotSrc) throw new Error('hero.mascotWebpSrcset requires hero.mascotSrc');
+      if (block.mascotSizes !== undefined && !mascotWebpSrcset) throw new Error('hero.mascotSizes requires hero.mascotWebpSrcset');
+      const hasMascotWidth = block.mascotWidth !== undefined;
+      const hasMascotHeight = block.mascotHeight !== undefined;
+      if (hasMascotWidth !== hasMascotHeight) throw new Error('hero.mascotWidth and hero.mascotHeight must be provided together');
+      const mascotWidth = hasMascotWidth ? block.mascotWidth : 1222;
+      const mascotHeight = hasMascotHeight ? block.mascotHeight : 1287;
+      if (!Number.isInteger(mascotWidth) || mascotWidth < 1 || mascotWidth > 10000 ||
+          !Number.isInteger(mascotHeight) || mascotHeight < 1 || mascotHeight > 10000) {
+        throw new Error('hero.mascotWidth and hero.mascotHeight must be integers from 1 to 10000');
+      }
+      const mascotSizes = mascotWebpSrcset ? escapeHtml(text(block.mascotSizes ?? '230px', 'hero.mascotSizes', 200)) : '';
       let action = '';
       if (block.cta) {
         const label = escapeHtml(text(block.cta.label, 'hero.cta.label', 120));
@@ -126,9 +181,15 @@ async function renderBlock(block, context, depth, index) {
       const highlights = block.highlights === undefined ? [] : list(block.highlights, 'hero.highlights', 1, 4);
       const highlightPanel = highlights.length ? '<ul class="hero-highlights">' + highlights.map((item) => '<li>' +
         escapeHtml(text(item, 'hero highlight', 180)) + '</li>').join('') + '</ul>' : '';
-      return '<section class="hero-block' + (highlightPanel ? ' hero-block--split' : '') + '"><div class="hero-main">' +
+      const mascotImage = mascotSrc ? '<img class="hero-mascot" src="' + escapeHtml(mascotSrc) + '" alt="' +
+        escapeHtml(mascotAlt) + '" width="' + mascotWidth + '" height="' + mascotHeight + '" decoding="async">' : '';
+      const mascot = mascotWebpSrcset
+        ? '<picture class="hero-mascot-picture"><source type="image/webp" srcset="' + mascotWebpSrcset + '" sizes="' + mascotSizes + '">' + mascotImage + '</picture>'
+        : mascotImage;
+      const aside = mascot || highlightPanel ? '<div class="hero-aside">' + mascot + highlightPanel + '</div>' : '';
+      return '<section class="hero-block' + (aside ? ' hero-block--split' : '') + '"><div class="hero-main">' +
         (eyebrow ? '<p class="eyebrow">' + escapeHtml(eyebrow) + '</p>' : '') + '<' + level + '>' + escapeHtml(heading) + '</' + level + '>' +
-        (description ? '<p class="hero-copy">' + escapeHtml(description) + '</p>' : '') + action + '</div>' + highlightPanel + '</section>';
+        (description ? '<p class="hero-copy">' + escapeHtml(description) + '</p>' : '') + action + '</div>' + aside + '</section>';
     }
     case 'section': {
       const heading = text(block.title, 'section.title', 200, true);
@@ -240,13 +301,15 @@ async function renderBlock(block, context, depth, index) {
     case 'privacy-consent': {
       const storageLabel = escapeHtml(text(block.storageLabel, 'privacy-consent.storageLabel', 120));
       const expiryLabel = escapeHtml(text(block.expiryLabel, 'privacy-consent.expiryLabel', 120));
-      const versionLabel = escapeHtml(text(block.versionLabel, 'privacy-consent.versionLabel', 120));
+      const proposedDateLabel = escapeHtml(text(block.proposedDateLabel, 'privacy-consent.proposedDateLabel', 120));
+      const effectiveDateLabel = escapeHtml(text(block.effectiveDateLabel, 'privacy-consent.effectiveDateLabel', 120));
       const expiryText = text(block.expiryText, 'privacy-consent.expiryText', 120);
       if (!expiryText.includes('{days}')) throw new Error('privacy-consent.expiryText must include a {days} placeholder');
       const consent = context.config.browserPlugins.consent;
       return '<dl class="privacy-controller-details"><div><dt>' + storageLabel + '</dt><dd>edgepress-privacy-choice</dd></div>' +
         '<div><dt>' + expiryLabel + '</dt><dd>' + escapeHtml(expiryText.replace('{days}', String(consent.expiresDays))) + '</dd></div>' +
-        '<div><dt>' + versionLabel + '</dt><dd>' + escapeHtml(consent.version) + '</dd></div></dl>';
+        '<div><dt>' + proposedDateLabel + '</dt><dd>' + escapeHtml(dateOnlyLabel(consent.proposedDate, context.locale)) + '</dd></div>' +
+        (consent.effectiveDate ? '<div><dt>' + effectiveDateLabel + '</dt><dd>' + escapeHtml(dateOnlyLabel(consent.effectiveDate, context.locale)) + '</dd></div>' : '') + '</dl>';
     }
     case 'privacy-controller': {
       const controller = context.config.privacy.controller;
@@ -269,7 +332,10 @@ async function renderBlock(block, context, depth, index) {
         const title = escapeHtml(text(item?.title, 'feature title', 200));
         const description = escapeHtml(text(item?.text, 'feature text', 1000, true));
         const href = item?.url ? safeUrl(item.url, 'feature.url') : '';
-        return '<article class="feature-card"><h3>' + (href ? '<a href="' + escapeHtml(href) + '">' + title + '</a>' : title) + '</h3>' +
+        const iconName = item?.icon === undefined ? '' : text(item.icon, 'feature icon', 40);
+        if (iconName && !isIconName(iconName)) throw new Error('Unsupported feature icon: ' + iconName);
+        const icon = iconName ? renderIcon(iconName, 'feature-icon') : '';
+        return '<article class="feature-card">' + icon + '<h3>' + (href ? '<a href="' + escapeHtml(href) + '">' + title + '</a>' : title) + '</h3>' +
           (description ? '<p>' + description + '</p>' : '') + '</article>';
       }).join('');
       return '<section class="feature-section"><h2>' + escapeHtml(heading) + '</h2><div class="feature-grid">' + cells + '</div></section>';

package/src/page-check.js

@@ -1,6 +1,7 @@
-import { access, lstat, mkdir, readFile, readdir, realpath, rm } from 'node:fs/promises';
+import { access, lstat, mkdir, readFile, readdir, realpath } from 'node:fs/promises';
 import { extname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { addVisualEvidence } from './report-visuals.js';
+import { renderMarkdown, renderMarkdownExcerpt } from './markdown.js';
 
 async function htmlFiles(directory) {
   let entries;
@@ -60,7 +61,7 @@ async function contentDocuments(output, config) {
   return documents;
 }
 
-function markdownFeatureCoverage(root, files, sourceByFile) {
+async function markdownFeatureCoverage(root, files, sourceByFile) {
   const expected = [
     ['headings 2 through 6', /<h2\b[\s\S]*?<h3\b[\s\S]*?<h4\b[\s\S]*?<h5\b[\s\S]*?<h6\b/i],
     ['Setext heading syntax', /<h2\b[^>]*>Setext (?:heading level two|二级标题示例)<\/h2>/i],
@@ -76,6 +77,7 @@ function markdownFeatureCoverage(root, files, sourceByFile) {
     ['GFM automatic links', /href="https:\/\/www\.markdownguide\.org\//i],
     ['angle-bracket, www, and email automatic links', /href="https:\/\/commonmark\.org"[\s\S]*?href="http:\/\/www\.example\.com"[\s\S]*?href="mailto:team@example\.com"/i],
     ['images with alternative text', /<img\b[^>]*src="\/edgepress-markdown-guide\.svg"[^>]*alt="[^"]+"/i],
+    ['image-shaped video Markdown syntax documented', (html) => html.includes('field-recording.mp4')],
     ['nested lists with inline formatting', /<li>[\s\S]*?<strong\b[\s\S]*?<ol\b[\s\S]*?<li>/i],
     ['task lists with accessible status names', /markdown-task-status" role="img" aria-label="[^"]+"/i],
     ['lists nested inside block quotes', /<blockquote>[\s\S]*?<ul\b[\s\S]*?<\/blockquote>/i],
@@ -84,16 +86,32 @@ function markdownFeatureCoverage(root, files, sourceByFile) {
     ['safe semantic inline HTML', /<kbd>Ctrl<\/kbd>/i],
     ['sanitization of active script markup', (html) => !/<script\b[^>]*>alert\(/i.test(html)]
   ];
+  const videoMarkdown = '![A kite crossing a field](https://media.example.org/field-recording.mp4 "Wind test")';
+  const videoHtml = await renderMarkdown(videoMarkdown);
+  const excerptHtml = await renderMarkdownExcerpt('A **formatted** excerpt with _emphasis_ and `code`.');
+  let unsafeVideoRejected = false;
+  try { await renderMarkdown('![Unsafe video](javascript:alert(1).mp4)'); }
+  catch { unsafeVideoRejected = true; }
+  const videoChecks = [
+    ['image-shaped video syntax renders an accessible native player with deferred media',
+      /<video controls playsinline preload="none" aria-label="A kite crossing a field"><source src="https:\/\/media\.example\.org\/field-recording\.mp4" type="video\/mp4"/i.test(videoHtml)],
+    ['video title renders as a caption', /<figcaption>Wind test<\/figcaption>/i.test(videoHtml)],
+    ['unsafe video URL is rejected', unsafeVideoRejected],
+    ['post-list excerpt preserves inline Markdown formatting', /<strong>formatted<\/strong>[\s\S]*?<em>emphasis<\/em>[\s\S]*?<code>code<\/code>/i.test(excerptHtml)]
+  ];
   const guides = files.filter((file) => /markdown-syntax-guide\/index\.html$/i.test(file.replace(/\\/g, '/')));
   const documents = guides.map((file) => {
     const html = sourceByFile.get(file) || '';
     const content = html.match(/<div class="post-content">([\s\S]*?)<\/div>/i)?.[1] || '';
-    const checks = expected.map(([feature, matcher]) => ({ feature, passed: typeof matcher === 'function' ? matcher(content) : matcher.test(content) }));
+    const checks = [
+      ...expected.map(([feature, matcher]) => ({ feature, passed: typeof matcher === 'function' ? matcher(content) : matcher.test(content) })),
+      ...videoChecks.map(([feature, passed]) => ({ feature, passed }))
+    ];
     return { path: relative(root, file).replace(/\\/g, '/'), checks, passed: checks.filter((item) => item.passed).length };
   });
   return {
     status: guides.length && documents.every((document) => document.checks.every((item) => item.passed)) ? 'pass' : 'fail',
-    checks: expected.length * Math.max(1, guides.length),
+    checks: (expected.length + videoChecks.length) * Math.max(1, guides.length),
     passed: documents.reduce((total, document) => total + document.passed, 0),
     documents
   };
@@ -119,7 +137,12 @@ async function resolveLocalLink(output, pageFile, href) {
   else candidates.push(resolve(output, clean + '.html'), resolve(output, clean, 'index.html'));
   for (const candidate of candidates) {
     if (!candidate.startsWith(output + sep)) continue;
-    if (await exists(candidate)) return { file: candidate, fragment: url.hash.slice(1) };
+    if (await exists(candidate)) {
+      let fragment = url.hash.slice(1);
+      try { fragment = decodeURIComponent(fragment); }
+      catch { return { broken: true, target: href }; }
+      return { file: candidate, fragment };
+    }
   }
   return { broken: true, target: href };
 }
@@ -161,7 +184,7 @@ export async function checkPages(config) {
     pageIds.set(file, new Set([...html.matchAll(/\bid\s*=\s*["']([^"']+)["']/gi)].map((match) => match[1])));
     metrics.htmlBytes += Buffer.byteLength(html);
   }
-  const markdownRendering = markdownFeatureCoverage(output, files, sourceByFile);
+  const markdownRendering = await markdownFeatureCoverage(output, files, sourceByFile);
   if (!markdownRendering.documents.length) {
     addFinding('error', 'markdown-rendering', 'content/posts', 'The Markdown syntax guide post was not generated.');
   }
@@ -254,13 +277,60 @@ export async function checkPages(config) {
   const hashedAssets = all.filter((file) => /\.[a-f0-9]{16}\.(?:css|js)$/i.test(file))
     .map((file) => relative(output, file).split(sep).join('/'));
   const styleFiles = all.filter((file) => extname(file).toLowerCase() === '.css');
+  let styles = '';
   if (styleFiles.length) {
-    const styles = (await Promise.all(styleFiles.map((file) => readFile(file, 'utf8')))).join('\n');
+    styles = (await Promise.all(styleFiles.map((file) => readFile(file, 'utf8')))).join('\n');
     inspect('accessibility', !/:focus(?:-visible)?\s*\{[^}]*outline/i.test(styles), 'warning', 'theme', 'No visible keyboard focus outline was found in the generated CSS.');
   } else {
     inspect('accessibility', true, 'warning', 'theme', 'No stylesheet was found to inspect for keyboard focus styles.');
   }
 
+  const consentConfig = config.browserPlugins.consent;
+  const consentUiChecks = [];
+  if (consentConfig.enabled) {
+    const consentCheck = (name, passed) => consentUiChecks.push({ name, passed });
+    let managerScript = '';
+    const managerAsset = all.find((file) => {
+      const path = relative(output, file).split(sep).join('/');
+      return /^edgepress\/plugins\/consent\/manager\.[a-f0-9]{16}\.js$/i.test(path);
+    });
+    if (managerAsset) {
+      try { managerScript = await readFile(managerAsset, 'utf8'); }
+      catch { /* The missing manager is reported below. */ }
+    }
+    const htmlWithConsent = files.filter((file) => {
+      const html = sourceByFile.get(file) || '';
+      return html.includes('edgepress-privacy-config') && /\/edgepress\/plugins\/consent\/manager\.[a-f0-9]{16}\.js/i.test(html);
+    });
+    consentCheck('privacy controls are injected on every generated page', files.length > 0 && htmlWithConsent.length === files.length);
+    consentCheck('consent manager script was generated', Boolean(managerScript));
+    consentCheck('service disclosure supports data categories, recipient, and retention',
+      managerScript.includes('serviceDataCategories') && managerScript.includes('serviceRecipient') && managerScript.includes('serviceRetention'));
+    consentCheck('stored choices are tied to proposed and effective dates',
+      managerScript.includes('proposedDate: consent.proposedDate') && managerScript.includes('effectiveDate: consent.effectiveDate'));
+    consentCheck('new visitors start with every optional service off', managerScript.includes('checkbox.checked = false'));
+    consentCheck('accept and reject controls share the same component styling',
+      /\.privacy-panel \.privacy-accept,\.privacy-manager \.privacy-panel \.privacy-reject\s*\{[^}]*background:[^}]*\}/.test(styles));
+    const componentClass = /(?:^|[\s>+~])\.privacy-(?:manager|panel|settings-button|close|intro|essential|details|service-preview|preview-item|category|service-settings|service-setting|service-toggle|service-toggle-text|service-disclosures|actions|accept|reject|manage|save|empty|policy-link|controller)(?=$|[^\w-])/;
+    let scoped = true;
+    for (const match of styles.matchAll(/([^{}]+)\{[^{}]*\}/g)) {
+      const selector = match[1].trim();
+      if (componentClass.test(selector) && !selector.includes('.privacy-manager')) scoped = false;
+    }
+    consentCheck('consent component CSS selectors stay within the manager', scoped);
+  }
+  const consentUi = consentConfig.enabled
+    ? {
+        status: consentUiChecks.every((item) => item.passed) ? 'pass' : 'fail',
+        checks: consentUiChecks.length,
+        passed: consentUiChecks.filter((item) => item.passed).length,
+        results: consentUiChecks
+      }
+    : { status: 'not enabled', checks: 0, passed: 0, results: [] };
+  for (const check of consentUiChecks.filter((item) => !item.passed)) {
+    issues.push({ severity: 'error', category: 'consent-ui', page: 'privacy manager', message: 'Consent UI requirement failed: ' + check.name + '.' });
+  }
+
   let robots = '';
   let sitemap = '';
   let llms = '';
@@ -314,6 +384,7 @@ export async function checkPages(config) {
     contentSummary,
     documents,
     markdownRendering,
+    consentUi,
     errors,
     warnings,
     accessibility,
@@ -323,6 +394,7 @@ export async function checkPages(config) {
     issues,
     scope: [
       'Accessibility checks inspect generated HTML and CSS. They do not measure color contrast, screen-reader behavior, keyboard interactions in a browser, or dynamic vendor widgets.',
+      'Page layout is measured with the consent manager hidden. The consent manager has separate component checks and screenshots, so its size does not change the page-content overflow result.',
       'Agent-friendliness checks inspect metadata, structured data, internal links, robots.txt, sitemap.xml, and llms.txt. They do not guarantee crawler indexing or answer quality.',
       'This automated report is not a legal-compliance assessment or a substitute for manual review.',
       'Screenshots capture generated local pages at desktop and mobile viewports. They do not replace manual keyboard, zoom, contrast, or assistive-technology review.'
@@ -337,24 +409,6 @@ export async function checkPages(config) {
   const root = await realpath(config.root);
   const directory = await realpath(requestedDirectory);
   if (!isInside(root, directory)) throw new Error('Page-check report directory must stay inside the project root');
-  for (const name of ['page-check.json', 'page-check.md', 'page-check-visual.html']) {
-    const file = resolve(directory, name);
-    try {
-      const info = await lstat(file);
-      if (info.isSymbolicLink() || !info.isFile()) throw new Error('Refusing an unsafe legacy report path: ' + file);
-      await rm(file);
-    } catch (error) {
-      if (error.code !== 'ENOENT') throw error;
-    }
-  }
-  const screenshotsDirectory = resolve(directory, 'page-check-screenshots');
-  try {
-    const info = await lstat(screenshotsDirectory);
-    if (info.isSymbolicLink() || !info.isDirectory()) throw new Error('Refusing an unsafe legacy screenshots path: ' + screenshotsDirectory);
-    await rm(screenshotsDirectory, { recursive: true });
-  } catch (error) {
-    if (error.code !== 'ENOENT') throw error;
-  }
   const pdfPath = resolve(directory, 'page-check.pdf');
   try {
     const info = await lstat(pdfPath);