# Markdown tests

JS tests for the `stm-markdown` renderer in `js/statum-markdown.js` (loaded
after `js/statum-core.js`, which it requires). These are the
repository's first JavaScript tests; they run under
[QuickJS](https://bellard.org/quickjs/) so **no Node.js is required**.

## Running

```sh
tests/markdown/run.sh          # regressions + spec suite, gates on 95%
tests/markdown/run.sh -v       # also list every failing spec example
```

`run.sh` builds the vendored QuickJS interpreter on first use
(`tools/qjs/build.sh`, ~20s with gcc; the binary is gitignored) and reuses a
system `qjs` when one is on `PATH`.

## Suites

- `regressions.js` — hand-written cases: the three reported bugs
  (emphasis spanning a line break, single newlines must not start
  paragraphs, wrapped lines must stay inside list items), the security
  posture (raw HTML neutralised, `javascript:`/`data:`/`vbscript:` URL
  filtering, entity smuggling), and edge cases (CRLF, empty input,
  tight vs loose lists, setext headings).
- `spec-test.js` — the official CommonMark 0.31.2 example suite (655
  examples, extracted from the spec with `spec_tests.py --dump-tests` into
  `spec-tests.json`), compared after cmark-style whitespace normalisation.

## Scope and expected diffs

The renderer keeps Statum's escape-first security posture, so two spec
sections are **out of scope** and excluded from the denominator:

- *HTML blocks* (46 examples) and *Raw HTML* (21): raw HTML in the source
  renders as escaped text, never markup.

A handful of in-scope examples also differ by design:

- autolinks with schemes outside http/https/mailto/ftp keep their text but
  the `href` is replaced with `#` (`<irc://…>`, `<made-up-scheme:…>`).

Current score: **96.4%** of the 588 in-scope examples.

## Regenerating the spec data

```sh
git clone https://github.com/commonmark/commonmark-spec /tmp/cmspec
python3 /tmp/cmspec/test/spec_tests.py -s /tmp/cmspec/spec.txt --dump-tests \
  > tests/markdown/spec-tests.json
```