import test from 'node:test'; import assert from 'node:assert/strict'; import { attributesFromShortcode, booleanValue, canTransformShortcode, finiteNumber, normalizeControls, normalizePlayerOptions, normalizeSource, normalizeWidth, previewHeight, secondsValue } from '../../src/options.js'; test( 'source validation permits explicit web URLs and site-relative cast paths', () => { for ( const value of [ 'https://example.com/recording.cast', 'http://localhost:8888/a.cast?x=1&y=2', '/uploads/hello.cast', "https://example.com/it's.cast" ] ) assert.equal( normalizeSource( ` ${ value } ` ), value ); } ); test( 'source validation rejects executable, credentialed, ambiguous and malformed URLs', () => { for ( const value of [ '', '//evil.test/cast', '/\\evil.test/cast', 'javascript:alert(1)', 'data:text/plain,cast', 'blob:https://example.com/a', 'file:///tmp/a.cast', 'https://user:secret@example.com/a.cast', 'https://example.com/\na.cast', 'https://example.com/