Add page data delivery and publication guards

mindspace-content-scan.test.mjs

@@ -51,6 +51,22 @@ test('scanContent can allow active html as acknowledgeable publication warnings'
   );
 });
 
+test('scanContent can allow interactive html forms as acknowledgeable warnings', () => {
+  const result = scanContent(
+    '<form id="survey"><input name="q1"></form><script src="/assets/page-data-client.js"></script>',
+    { format: 'html', allowHtmlActiveContent: true },
+  );
+  assert.equal(result.status, 'warned');
+  assert.equal(result.allowed, true);
+  assert.deepEqual(
+    result.findings.map((finding) => [finding.type, finding.blocking]),
+    [
+      ['html_script', false],
+      ['html_form_action', false],
+    ],
+  );
+});
+
 test('redactContent masks secrets and strips unsafe html', () => {
   const result = redactContent(
     '手机号 13800138000\n邮箱 john@example.com\n<script>alert(1)</script>\nkey=sk_test_1234567890abcdef',