@caelo-cms/shared 0.10.61 → 0.10.62

package/dist/static-security-headers.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Security response headers for uploaded media and the published static
+ * site — the one definition the admin's media routes, the staging preview,
+ * every static publisher and every provider stack's edge config derive
+ * from (#863, #891).
+ *
+ * An SVG opened directly (`https://<site>/_assets/logo.<hash>.svg`) is a
+ * document, not an image: it runs script in the origin it is served from.
+ * On the public site that origin also serves `/api/*` (the gateway behind
+ * the same load balancer, CLAUDE.md §11.B), on the admin it holds the
+ * operator's session. `sanitizeSvg` strips script at upload; this CSP is
+ * the line behind it should a construct ever get past the sanitizer: no
+ * script, no plugins, no network, and `sandbox` gives the document an
+ * opaque origin. Inline styles and `data:` rasters / fonts stay allowed so
+ * an SVG renders exactly as before — as a document and as an `<img>`.
+ * Browsers apply a CSP only to documents (and workers), so the header
+ * changes nothing for an SVG loaded through `<img>` or CSS.
+ *
+ * Only SVG gets the CSP: raster images, video and fonts cannot run script,
+ * and `sandbox` would stop Chrome's built-in viewer from opening a PDF.
+ * `nosniff` goes on everything so a browser never reinterprets bytes as a
+ * scriptable type the content-type did not declare.
+ */
+/** The CSP an SVG document is served with (see the file comment). */
+export declare const SVG_DOCUMENT_CSP = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:; sandbox";
+/** `X-Content-Type-Options` value every media / static response carries. */
+export declare const NOSNIFF = "nosniff";
+/** The MIME type the CSP is keyed on. */
+export declare const SVG_CONTENT_TYPE = "image/svg+xml";
+/**
+ * Regex (source string, unanchored at the start) matching a URL path that
+ * ends in `.svg`, any case. Only syntax shared by ECMAScript and RE2 (no
+ * inline flags), so the same string serves Firebase Hosting's `regex`
+ * header matcher and `RegExp` here. The static generator names every file
+ * by extension (`contentTypeFor` in admin-core), so the extension is what
+ * decides the served `image/svg+xml`.
+ */
+export declare const SVG_PATH_PATTERN = "\\.[sS][vV][gG]$";
+/** True when `contentType` is SVG (case and parameters such as `; charset=` ignored). */
+export declare function isSvgContentType(contentType: string): boolean;
+/**
+ * Security headers for one media / static-file response.
+ *
+ * @param contentType - the `content-type` the response is served with.
+ * @returns lower-case header entries to spread into the response's headers.
+ * @example
+ *   new Response(body, { headers: { "Content-Type": ct, ...mediaSecurityHeaders(ct) } });
+ */
+export declare function mediaSecurityHeaders(contentType: string): Record<string, string>;
+//# sourceMappingURL=static-security-headers.d.ts.map

package/dist/static-security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-security-headers.d.ts","sourceRoot":"","sources":["../src/static-security-headers.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,0FAC4D,CAAC;AAE1F,4EAA4E;AAC5E,eAAO,MAAM,OAAO,YAAY,CAAC;AAEjC,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIhF"}

package/dist/static-security-headers.js

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Security response headers for uploaded media and the published static
+ * site — the one definition the admin's media routes, the staging preview,
+ * every static publisher and every provider stack's edge config derive
+ * from (#863, #891).
+ *
+ * An SVG opened directly (`https://<site>/_assets/logo.<hash>.svg`) is a
+ * document, not an image: it runs script in the origin it is served from.
+ * On the public site that origin also serves `/api/*` (the gateway behind
+ * the same load balancer, CLAUDE.md §11.B), on the admin it holds the
+ * operator's session. `sanitizeSvg` strips script at upload; this CSP is
+ * the line behind it should a construct ever get past the sanitizer: no
+ * script, no plugins, no network, and `sandbox` gives the document an
+ * opaque origin. Inline styles and `data:` rasters / fonts stay allowed so
+ * an SVG renders exactly as before — as a document and as an `<img>`.
+ * Browsers apply a CSP only to documents (and workers), so the header
+ * changes nothing for an SVG loaded through `<img>` or CSS.
+ *
+ * Only SVG gets the CSP: raster images, video and fonts cannot run script,
+ * and `sandbox` would stop Chrome's built-in viewer from opening a PDF.
+ * `nosniff` goes on everything so a browser never reinterprets bytes as a
+ * scriptable type the content-type did not declare.
+ */
+/** The CSP an SVG document is served with (see the file comment). */
+export const SVG_DOCUMENT_CSP = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:; sandbox";
+/** `X-Content-Type-Options` value every media / static response carries. */
+export const NOSNIFF = "nosniff";
+/** The MIME type the CSP is keyed on. */
+export const SVG_CONTENT_TYPE = "image/svg+xml";
+/**
+ * Regex (source string, unanchored at the start) matching a URL path that
+ * ends in `.svg`, any case. Only syntax shared by ECMAScript and RE2 (no
+ * inline flags), so the same string serves Firebase Hosting's `regex`
+ * header matcher and `RegExp` here. The static generator names every file
+ * by extension (`contentTypeFor` in admin-core), so the extension is what
+ * decides the served `image/svg+xml`.
+ */
+export const SVG_PATH_PATTERN = "\\.[sS][vV][gG]$";
+/** True when `contentType` is SVG (case and parameters such as `; charset=` ignored). */
+export function isSvgContentType(contentType) {
+    return (contentType.split(";")[0] ?? "").trim().toLowerCase() === SVG_CONTENT_TYPE;
+}
+/**
+ * Security headers for one media / static-file response.
+ *
+ * @param contentType - the `content-type` the response is served with.
+ * @returns lower-case header entries to spread into the response's headers.
+ * @example
+ *   new Response(body, { headers: { "Content-Type": ct, ...mediaSecurityHeaders(ct) } });
+ */
+export function mediaSecurityHeaders(contentType) {
+    const headers = { "x-content-type-options": NOSNIFF };
+    if (isSvgContentType(contentType))
+        headers["content-security-policy"] = SVG_DOCUMENT_CSP;
+    return headers;
+}
+//# sourceMappingURL=static-security-headers.js.map

package/dist/static-security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-security-headers.js","sourceRoot":"","sources":["../src/static-security-headers.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAC3B,uFAAuF,CAAC;AAE1F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC;AAEjC,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,OAAO,GAA2B,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC;IAC9E,IAAI,gBAAgB,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,gBAAgB,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/version.d.ts

@@ -19,7 +19,7 @@
  * Format: SemVer 2.0.0. Pre-1.0 minor bumps are breaking; post-1.0
  * follow standard SemVer.
  */
-export declare const CAELO_VERSION = "0.10.61";
+export declare const CAELO_VERSION = "0.10.62";
 /**
  * Deprecated alias for back-compat — early P17 work spelled this
  * `CALEO_VERSION` (typo of "Caelo"). New code should import
@@ -31,7 +31,7 @@ export declare const CAELO_VERSION = "0.10.61";
  *
  * @deprecated use CAELO_VERSION
  */
-export declare const CALEO_VERSION = "0.10.61";
+export declare const CALEO_VERSION = "0.10.62";
 /**
  * Parsed shape — major/minor/patch + optional pre-release tag.
  * Stable interface for callers that need to feature-gate (rare —

package/dist/version.js

@@ -20,7 +20,7 @@
  * Format: SemVer 2.0.0. Pre-1.0 minor bumps are breaking; post-1.0
  * follow standard SemVer.
  */
-export const CAELO_VERSION = "0.10.61";
+export const CAELO_VERSION = "0.10.62";
 /**
  * Deprecated alias for back-compat — early P17 work spelled this
  * `CALEO_VERSION` (typo of "Caelo"). New code should import

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/shared",
-  "version": "0.10.61",
+  "version": "0.10.62",
   "private": false,
   "license": "MPL-2.0",
   "description": "Shared Zod schemas + types + the two-pass HTML composer used by every Caelo CMS workspace package. Stable enough for plugin authors and embedders to depend on directly.",

package/src/auto-update.test.ts

@@ -58,6 +58,7 @@ function input(over: Partial<AutoUpdateInput> & { version?: string; publishedHou
     facts: FACTS,
     upgraderAvailable: true,
     convergeAvailable: true,
+    skippedVersion: null,
     now: NOW,
     ...rest,
   } satisfies AutoUpdateInput;
@@ -376,6 +377,30 @@ describe("decideAutoUpdate — modes and versions", () => {
   });
 });
 
+describe("decideAutoUpdate — the Owner skipped a scheduled install (#868)", () => {
+  it("does not install or schedule the skipped release, but still offers it", () => {
+    for (const publishedHoursAgo of [48, 2]) {
+      const d = decideAutoUpdate(input({ publishedHoursAgo, skippedVersion: VERSIONS.patch }));
+      expect(d.action).toBe("notify");
+      if (d.action !== "notify") continue;
+      expect(d.version).toBe(VERSIONS.patch);
+      expect(d.reason).toContain("skipped the automatic install of v0.10.48");
+    }
+  });
+
+  it("installs a newer release than the skipped one automatically again", () => {
+    const d = decideAutoUpdate(input({ version: "0.10.49", skippedVersion: VERSIONS.patch }));
+    expect(d.action).toBe("install");
+  });
+
+  it("leaves every other decision about the skipped release as it was", () => {
+    const d = decideAutoUpdate(
+      input({ skippedVersion: VERSIONS.patch, facts: { ...FACTS, contractMigrations: true } }),
+    );
+    expect(d.action).toBe("manual");
+  });
+});
+
 describe("nextWindowOpening", () => {
   it("returns the start of the next window in the window's time zone", () => {
     const p = { windowStart: "02:00", windowEnd: "05:00", windowTimezone: "America/New_York" };

package/src/auto-update.ts

@@ -37,6 +37,11 @@
  *  10. soak period not over (security releases: their own, shorter one) → wait;
  *  11. outside the maintenance window → wait until it opens;
  *  12. otherwise → install.
+ *
+ * On top of the rules: a release the Owner skipped ("Skip this time" in
+ * Settings → Updates, #868) that the rules would install or schedule is
+ * offered instead (notify). Only that version: a newer release installs
+ * automatically again, and the skipped one stays installable by hand.
  */
 
 import {
@@ -119,6 +124,11 @@ export interface AutoUpdateInput {
   readonly convergeAvailable: boolean;
   /** Why it has none right now, in plain words (null: none set up at all). */
   readonly upgraderProblem?: string | null;
+  /**
+   * The release whose automatic install the Owner skipped
+   * (`platform_update_scheduler.skipped_version`, #868); null when none.
+   */
+  readonly skippedVersion: string | null;
   readonly now: Date;
 }
 
@@ -199,8 +209,34 @@ function isStable(version: string): boolean {
 
 const hours = (n: number) => `${n} hour${n === 1 ? "" : "s"}`;
 
+/**
+ * The scheduler's sentence for a release whose automatic install the Owner
+ * skipped (#868); the skip op writes the same one right away.
+ */
+export function skippedInstallReason(version: string): string {
+  return `The Owner skipped the automatic install of v${version}. It stays available in Settings → Updates; the next newer release installs automatically again.`;
+}
+
 /** Decide what the scheduler does now. See the file comment for the rules. */
 export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
+  const decision = decideByRules(input);
+  if (
+    (decision.action === "install" || decision.action === "wait") &&
+    input.skippedVersion !== null &&
+    decision.version === input.skippedVersion
+  ) {
+    return {
+      action: "notify",
+      version: decision.version,
+      kind: decision.kind,
+      reason: skippedInstallReason(decision.version),
+    };
+  }
+  return decision;
+}
+
+/** The numbered rules of the file comment, without the Owner's skip. */
+function decideByRules(input: AutoUpdateInput): AutoUpdateDecision {
   const { policy, release, now } = input;
   if (!release) {
     return { action: "none", reason: "The release check has not found a Caelo release yet." };

package/src/cloud-shell-install.test.ts

@@ -1,7 +1,12 @@
 // SPDX-License-Identifier: MPL-2.0
 
 import { describe, expect, it } from "bun:test";
-import { cloudShellInstallUrl } from "./cloud-shell-install.js";
+import {
+  CLOUD_SHELL_UPGRADE_FIRST_VERSION,
+  cloudShellInstallUrl,
+  cloudShellUpgradeCommand,
+  cloudShellUpgradeUrl,
+} from "./cloud-shell-install.js";
 
 describe("cloudShellInstallUrl", () => {
   it("pins the release branch of the install repo and the provider's tutorial", () => {
@@ -18,3 +23,33 @@ describe("cloudShellInstallUrl", () => {
     expect(() => cloudShellInstallUrl("latest", "gcp")).toThrow();
   });
 });
+
+describe("cloudShellUpgradeUrl (#816)", () => {
+  it("opens the release's upgrade walkthrough, never the install one", () => {
+    const url = cloudShellUpgradeUrl(CLOUD_SHELL_UPGRADE_FIRST_VERSION, "gcp-firebase");
+    expect(url).toBe(
+      `https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https://github.com/caelo-cms/install&cloudshell_git_branch=release-v${CLOUD_SHELL_UPGRADE_FIRST_VERSION}&cloudshell_tutorial=upgrade-gcp-firebase.md`,
+    );
+    expect(cloudShellUpgradeUrl("v9.0.0", "gcp")).toContain(
+      "cloudshell_git_branch=release-v9.0.0&cloudshell_tutorial=upgrade-gcp.md",
+    );
+    expect(url).not.toContain("tutorial=gcp-firebase.md");
+  });
+
+  it("no link for a release whose branch has no upgrade tutorial, or a pre-release", () => {
+    expect(cloudShellUpgradeUrl("0.10.59", "gcp")).toBeNull();
+    expect(cloudShellUpgradeUrl("0.11.0-rc.1", "gcp")).toBeNull();
+    expect(cloudShellUpgradeUrl("latest", "gcp")).toBeNull();
+  });
+});
+
+describe("cloudShellUpgradeCommand", () => {
+  it("names the install, and its project when known", () => {
+    expect(cloudShellUpgradeCommand({ project: "acme-site", install: "acme.com" })).toBe(
+      "./run.sh upgrade --project acme-site --install acme.com",
+    );
+    expect(cloudShellUpgradeCommand({ project: null, install: "acme.com" })).toBe(
+      "./run.sh upgrade --install acme.com",
+    );
+  });
+});

package/src/cloud-shell-install.ts

@@ -11,6 +11,8 @@
  * admin's "run this release in Cloud Shell" hint — so they can't drift.
  */
 
+import { isNewerVersion } from "./version.js";
+
 /** The repository the Cloud Shell button clones. */
 export const CLOUD_SHELL_INSTALL_REPO = "https://github.com/caelo-cms/install";
 
@@ -45,3 +47,65 @@ export function cloudShellInstallUrl(version: string, provider: CloudShellProvid
     `&cloudshell_tutorial=${provider}.md`,
   ].join("");
 }
+
+/**
+ * The first release whose `release-v<version>` branch in the install
+ * repository ships the break-glass upgrade (#816): `upgrade-gcp.md`,
+ * `upgrade-gcp-firebase.md` and `./run.sh upgrade`. Release branches are
+ * cut from the install repository's main when the release is tracked and
+ * never move, so older branches lack the tutorial; for them the admin shows
+ * the CLI command instead of a link that would open nothing.
+ *
+ * Set to the release that follows caelo-cms/install#3 (the upgrade
+ * tutorials) merging; if that merge slips past a release, raise it.
+ */
+export const CLOUD_SHELL_UPGRADE_FIRST_VERSION = "0.10.60";
+
+/**
+ * The Cloud Shell link that opens the break-glass UPGRADE walkthrough of a
+ * stable release (#816), never the install wizard.
+ *
+ * Cloud Shell links cannot carry the project or the install: Google
+ * documents no parameter for either, and a tutorial cannot read the URL.
+ * `./run.sh upgrade` finds the Owner's install itself (the projects whose
+ * ops bucket holds `install/install.json`); the admin shows the explicit
+ * `--project … --install …` line ({@link cloudShellUpgradeCommand}) next to
+ * the button for an Owner with several installs.
+ *
+ * @returns null for a pre-release (no pinned branch) or a release before
+ *   {@link CLOUD_SHELL_UPGRADE_FIRST_VERSION} (its branch has no tutorial)
+ *
+ * @example cloudShellUpgradeUrl("0.10.60", "gcp-firebase")
+ *   // → "https://shell.cloud.google.com/cloudshell/editor?cloudshell_git_repo=https://github.com/caelo-cms/install&cloudshell_git_branch=release-v0.10.60&cloudshell_tutorial=upgrade-gcp-firebase.md"
+ */
+export function cloudShellUpgradeUrl(version: string, provider: CloudShellProvider): string | null {
+  const m = STABLE.exec(version);
+  if (!m?.[1]) return null;
+  if (isNewerVersion(CLOUD_SHELL_UPGRADE_FIRST_VERSION, m[1])) return null;
+  return [
+    "https://shell.cloud.google.com/cloudshell/editor",
+    `?cloudshell_git_repo=${CLOUD_SHELL_INSTALL_REPO}`,
+    `&cloudshell_git_branch=release-v${m[1]}`,
+    `&cloudshell_tutorial=upgrade-${provider}.md`,
+  ].join("");
+}
+
+/**
+ * The one line the break-glass walkthrough runs, from the clone of the
+ * install repository: `./run.sh upgrade` with the install named when the
+ * admin knows it (`--project` from its upgrader job, `--install` = domain).
+ *
+ * @example cloudShellUpgradeCommand({ project: "acme-site", install: "acme.com" })
+ *   // → "./run.sh upgrade --project acme-site --install acme.com"
+ */
+export function cloudShellUpgradeCommand(target: {
+  readonly project: string | null;
+  readonly install: string;
+}): string {
+  return [
+    "./run.sh upgrade",
+    ...(target.project ? ["--project", target.project] : []),
+    "--install",
+    target.install,
+  ].join(" ");
+}

package/src/css-scope-scan.test.ts

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { formatCssScopeFindings, moduleRootTokens, scanModuleCssScope } from "./css-scope-scan.js";
+
+describe("scanModuleCssScope (issue #158)", () => {
+  it("flags element-only selectors as global, at top level and inside @media", () => {
+    const f = scanModuleCssScope({
+      css: "h1 { color: red } .hero p, body { margin: 0 } @media (max-width: 600px) { a:hover { color: blue } }",
+    });
+    expect(f.global).toEqual(["h1", "body", "a:hover"]);
+    // Without the html there is no root to anchor against.
+    expect(f.unanchored).toEqual([]);
+  });
+
+  it("does not count a class inside a pseudo argument as scoping", () => {
+    expect(scanModuleCssScope({ css: "h1:not(.x) { color: red }" }).global).toEqual(["h1:not(.x)"]);
+  });
+
+  it("checks selectors against the module root class when the html is known", () => {
+    const f = scanModuleCssScope({
+      html: '<section class="hero is-dark"><div class="card"></div></section>',
+      css: ".hero h1{} .hero__title{} .hero-cta{} html.dark .hero{} .card{} .is-darkish{}",
+    });
+    expect(f.global).toEqual([]);
+    expect(f.unanchored).toEqual([".card", ".is-darkish"]);
+    expect(f.rootClasses).toEqual(["hero", "is-dark"]);
+  });
+
+  it("accepts the root id as an anchor", () => {
+    const f = scanModuleCssScope({
+      html: '<div id="pricing"></div>',
+      css: "#pricing .row{} .row{}",
+    });
+    expect(f.unanchored).toEqual([".row"]);
+    expect(f.rootHasNoClass).toBe(false);
+  });
+
+  it("skips blocks that hold no selectors, comments and strings", () => {
+    const f = scanModuleCssScope({
+      html: '<div class="m"></div>',
+      css: '/* h1 {} */ @keyframes spin { from { opacity: 0 } to { opacity: 1 } } @font-face { font-family: X } @import url("x.css"); .m::after { content: "}{ h1 {" } .m { & h2 { color: red } }',
+    });
+    expect(f.global).toEqual([]);
+    expect(f.unanchored).toEqual([]);
+  });
+
+  it("reports a root element with nothing to scope under", () => {
+    const f = scanModuleCssScope({ html: "<section><h2>x</h2></section>", css: ".title{}" });
+    expect(f.rootHasNoClass).toBe(true);
+    expect(formatCssScopeFindings(f)).toContain("root element has no class");
+  });
+
+  it("formats nothing for scoped CSS", () => {
+    expect(
+      formatCssScopeFindings(
+        scanModuleCssScope({ html: '<div class="faq"></div>', css: ".faq summary{}" }),
+      ),
+    ).toBeNull();
+  });
+
+  it("names the root class in the fix and truncates long lists", () => {
+    const text = formatCssScopeFindings(
+      scanModuleCssScope({
+        html: '<nav class="site-nav"></nav>',
+        css: "a{} b{} i{} p{} ul{} li{} em{}",
+      }),
+    );
+    expect(text).toContain("`.site-nav h2`");
+    expect(text).toContain("(+2 more)");
+  });
+});
+
+describe("moduleRootTokens", () => {
+  it("reads the first element past comments and ignores templated values", () => {
+    expect(
+      moduleRootTokens('<!-- hero --> <section class="hero {{variant}}" id="{{anchor}}">'),
+    ).toEqual({ classes: ["hero"], id: null });
+    expect(moduleRootTokens("just text")).toBeNull();
+    expect(moduleRootTokens('<!-- a --><!----> \n<div class="card">')).toEqual({
+      classes: ["card"],
+      id: null,
+    });
+    expect(moduleRootTokens('<!-- never closed <div class="card">')).toBeNull();
+  });
+
+  it("stays linear on comment-heavy input (CodeQL js/redos)", () => {
+    const started = performance.now();
+    expect(moduleRootTokens(`<!--${"--><!--".repeat(50_000)}`)).toBeNull();
+    expect(moduleRootTokens(`${"<!---->".repeat(50_000)}<p class="x">`)?.classes).toEqual(["x"]);
+    expect(moduleRootTokens("<A\t".repeat(50_000))).toBeNull();
+    expect(performance.now() - started).toBeLessThan(1000);
+  });
+
+  it("reads bare and attribute-carrying start tags, and rejects a malformed one", () => {
+    expect(moduleRootTokens("<section>")).toEqual({ classes: [], id: null });
+    expect(moduleRootTokens('<div\n  class="a b"\n  id="main">')).toEqual({
+      classes: ["a", "b"],
+      id: "main",
+    });
+    expect(moduleRootTokens('<div/class="a">')).toBeNull();
+    expect(moduleRootTokens('<div class="a"')).toBeNull();
+  });
+});
+
+describe("scanModuleCssScope comment stripping", () => {
+  it("drops closed comments and treats an unterminated one as running to the end", () => {
+    expect(scanModuleCssScope({ css: "/* h1 { x: 1 } */ p { color: red }" }).global).toEqual(["p"]);
+    expect(scanModuleCssScope({ css: "p { color: red } /* h1 { x: 1 }" }).global).toEqual(["p"]);
+  });
+
+  it("stays linear on many unterminated comment openers (CodeQL js/polynomial-redos)", () => {
+    const started = performance.now();
+    scanModuleCssScope({ css: `/*${"a/*".repeat(100_000)}` });
+    expect(performance.now() - started).toBeLessThan(1000);
+  });
+});