build(site): [SITE-07] restore Monaco Markdown component notices

test/browser/README.md

@@ -1,5 +1,10 @@
 # Browser regression entry
 
+`editor-markdown.spec.js` runs the bundled DOMPurify/marked renderer, verifies
+formatting, selected filtering and temporary-hook cleanup. `site-vendor.spec.js`
+also checks all 85 notice files and the core-origin attribution links over HTTP.
+These checks do not constitute exhaustive sanitizer or physical-device validation.
+
 `editor-modes.spec.js` exercises Monaco's actual automatic mode/provider registration
 through a real editor. It switches CSS/JSON/TypeScript/HTML models, checks diagnostic
 arrival/removal and document formatting, verifies all four mode bundle responses,

test/browser/editor-markdown.spec.js

@@ -0,0 +1,46 @@
+import { expect, test } from './fixtures.js'
+
+test('docs Monaco renders Markdown with its bundled parser and sanitizer', async ({ page }, testInfo) => {
+  await page.goto('/test/player.html?core=candidate&chapter=published')
+  await page.addScriptTag({ url: '/assets/js/vs/loader.js' })
+  const result = await page.evaluate(async () => {
+    window.require.config({ paths: { vs: '/assets/js/vs' } })
+    const load = ids => new Promise((resolve, reject) => window.require(ids, (...modules) => resolve(modules), reject))
+    await load(['vs/editor/editor.main'])
+    const [renderer, purify] = await load(['vs/base/browser/markdownRenderer', 'vs/base/browser/dompurify/dompurify'])
+    const rendered = renderer.renderMarkdown({
+      value: '**Player** and `art.play()`\n\n| API | Result |\n| --- | --- |\n| play | Promise |\n\n[Docs](https://artplayer.org/document/)\n\n<span onclick="window.markdownExecuted=true">safe text</span><script>window.markdownExecuted=true</script>',
+      supportHtml: true,
+      isTrusted: false,
+    })
+    document.body.appendChild(rendered.element)
+    const element = rendered.element
+    const output = {
+      version: purify.version,
+      strong: element.querySelector('strong')?.textContent,
+      code: element.querySelector('code')?.textContent,
+      cells: [...element.querySelectorAll('td')].map(cell => cell.textContent),
+      link: element.querySelector('a')?.getAttribute('data-href'),
+      text: element.textContent,
+      scripts: element.querySelectorAll('script').length,
+      handlers: element.querySelectorAll('[onclick]').length,
+      executed: window.markdownExecuted === true,
+    }
+    rendered.dispose()
+    element.remove()
+    // Renderer hooks must not leak into a later consumer of the same singleton.
+    output.afterDispose = purify.sanitize('<div style="color:red">next</div>')
+    return output
+  })
+  await testInfo.attach('monaco-markdown-result', { contentType: 'application/json', body: JSON.stringify(result, null, 2) })
+  expect(result.version).toBe('2.3.1')
+  expect(result.strong).toBe('Player')
+  expect(result.code).toBe('art.play()')
+  expect(result.cells).toEqual(['play', 'Promise'])
+  expect(result.link).toBe('https://artplayer.org/document/')
+  expect(result.text).toContain('safe text')
+  expect(result.scripts).toBe(0)
+  expect(result.handlers).toBe(0)
+  expect(result.executed).toBe(false)
+  expect(result.afterDispose).toBe('<div style="color:red">next</div>')
+})

test/browser/site-vendor.spec.js

@@ -24,6 +24,7 @@ test('mobile vConsole shows logs and upstream site notice texts are served uncha
   for (const { path, count } of [
     { path: '/licenses/console/react-pure-render/ATTRIBUTION.md', count: 2 },
     { path: '/licenses/monaco-editor/language-services/ATTRIBUTION.md', count: 12 },
+    { path: '/licenses/monaco-editor/core-origins/ATTRIBUTION.md', count: 3 },
   ]) {
     const attribution = await request.get(path)
     expect(attribution.status()).toBe(200)
@@ -41,6 +42,8 @@ test('mobile vConsole shows logs and upstream site notice texts are served uncha
   expect(index.status()).toBe(200)
   expect(await index.text()).toContain('Included component: @vscode/codicons 0.0.26')
   expect(await index.text()).toContain('Included component: typescript (Monaco worker) 4.4.4')
+  expect(await index.text()).toContain('Included component: dompurify (Monaco core) 2.3.1')
+  expect(await index.text()).toContain('Included component: marked (Monaco core) 3.0.2')
   expect(await index.text()).toContain('Included component: vscode-html-languageservice 4.1.1')
   expect(await index.text()).toContain('Included component: vscode-json-languageservice 4.1.9')
   expect(await index.text()).toContain('Included component: js-beautify (Monaco HTML embedded)')

test/monaco-provenance.test.js

@@ -4,9 +4,17 @@ import test from 'node:test'
 import ts from 'typescript'
 import { extractBasicFixtures } from '../scripts/site-vendor/monaco/basic-fixtures.ts'
 import { emitAmd } from '../scripts/site-vendor/monaco/compiler.ts'
+import { adaptCoreOrigin } from '../scripts/site-vendor/monaco/core-origins.ts'
 import { aliasModule, moduleIds, nameModule, verifyWorkerSources } from '../scripts/site-vendor/monaco/languages.ts'
 import { browserTypeScript, verifyTypeScriptSource } from '../scripts/site-vendor/monaco/typescript.ts'
 
+test('Core origin adaptation rejects duplicate boundaries and preserves replacement bytes', () => {
+  const edits = [{ before: 'export default purify;', after: 'define(factory); // $&' }]
+  assert.equal(adaptCoreOrigin('export default purify;', edits), 'define(factory); // $&')
+  assert.throws(() => adaptCoreOrigin('missing', edits), /boundary/)
+  assert.throws(() => adaptCoreOrigin('export default purify;export default purify;', edits), /boundary/)
+})
+
 test('Monaco fixture extraction retains generated cases and preprocessing but rejects extra imports', () => {
   const file = 'monaco-languages/src/scss/scss.test.ts'
   const source = `import { testTokenization } from '../test/testRunner';

test/site-notices.test.js

@@ -8,10 +8,28 @@ import process from 'node:process'
 // eslint-disable-next-line test/no-import-node-test -- Verify real notice bytes and failure-before-write behavior.
 import test from 'node:test'
 import { verifyConsoleNoticeSources } from '../scripts/site-vendor/console/notices.ts'
+import { verifyMonacoCoreNotices } from '../scripts/site-vendor/monaco/core-origins.ts'
 import { verifyMonacoLanguageNoticeArchives, verifyMonacoLanguageNotices } from '../scripts/site-vendor/monaco/notices.ts'
 import { generateNotices, writeOrCheckNotices } from '../scripts/site-vendor/notices.ts'
 
 const hash = bytes => createHash('sha256').update(bytes).digest('hex')
+
+test('Monaco core notices cannot replace DOMPurify terms with the Markdown parser license', () => {
+  const original = JSON.parse(fs.readFileSync('scripts/site-vendor/manifest.json', 'utf8'))
+  assert.doesNotThrow(() => verifyMonacoCoreNotices(process.cwd(), original))
+  const manifest = structuredClone(original)
+  const group = manifest.groups.find(group => group.name === 'monaco-editor')
+  group.components.find(item => item.name === 'dompurify (Monaco core)').notices = group.components.find(item => item.name === 'marked (Monaco core)').notices
+  assert.doesNotThrow(() => generateNotices(process.cwd(), manifest))
+  assert.throws(() => verifyMonacoCoreNotices(process.cwd(), manifest), /core notice binding/)
+  const record = JSON.parse(fs.readFileSync('refactor/baselines/monaco-core-origins-provenance.json', 'utf8'))
+  for (const notice of record.notices) {
+    const missing = structuredClone(original)
+    const group = missing.groups.find(group => group.name === 'monaco-editor')
+    group.notices = group.notices.filter(item => item.target !== notice.target)
+    assert.throws(() => verifyMonacoCoreNotices(process.cwd(), missing), /Monaco core notice/)
+  }
+})
 test('Monaco language notices bind full original terms to their actual worker sources', () => {
   const original = JSON.parse(fs.readFileSync('scripts/site-vendor/manifest.json', 'utf8'))
   assert.equal(verifyMonacoLanguageNotices(process.cwd(), original), 12)