@cyberskill/design 1.5.0 → 1.6.0

package/templates/app-shell/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/app-shell/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/article/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/article/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/auth/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/auth/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/bod-deck/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/bod-deck/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/bod-investor-update/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/bod-investor-update/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/bod-memo/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/bod-memo/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/bod-minutes/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');

package/templates/bod-minutes/support.js

@@ -769,15 +769,32 @@
       return {};
     }
   };
+  /**
+   * Evaluate DC class source without Function-constructor / eval call sites
+   * (site CSP forbids unsafe-eval; 'unsafe-inline' still allows a synchronous
+   * classic script).
+   */
   function evalDcLogic(src) {
-    //! nosemgrep: eval-and-function-constructor
-    const fn = new Function(
-      "DCLogic",
-      "StreamableLogic",
-      "React",
-      src + '\n;return (typeof Component!=="undefined"&&Component)||undefined;'
-    );
-    return fn(StreamableLogic, StreamableLogic, getReact());
+    const key = "__dcEvalResult_" + Math.random().toString(36).slice(2);
+    window.__DCLogic = StreamableLogic;
+    window.__DCReactForEval = getReact();
+    const safeSrc = String(src).replace(/<\/(script)/gi, "<\\/$1");
+    const el = document.createElement("script");
+    el.text =
+      "var DCLogic=window.__DCLogic,StreamableLogic=window.__DCLogic,React=window.__DCReactForEval;\n" +
+      safeSrc +
+      "\n;window[" +
+      JSON.stringify(key) +
+      ']=(typeof Component!=="undefined"&&Component)||undefined;';
+    (document.documentElement || document.head).appendChild(el);
+    el.remove();
+    const result = window[key];
+    try {
+      delete window[key];
+    } catch (_) {
+      window[key] = void 0;
+    }
+    return result;
   }
 
   // src/component.ts
@@ -1139,13 +1156,22 @@
         }).code : src;
         const module = { exports: {} };
         const before = new Set(Object.keys(window));
-        //! nosemgrep: eval-and-function-constructor
-        new Function("React", "module", "exports", "require", code)(
-          getReact(),
-          module,
-          module.exports,
-          () => ({})
-        );
+        // CSP-safe: run Babel output via inline classic script (no Function ctor).
+        window.__DCReactForEval = getReact();
+        window.__DCModuleTmp = module;
+        const safeCode = String(code).replace(/<\/(script)/gi, "<\\/$1");
+        const el = document.createElement("script");
+        el.text =
+          "(function(React,module,exports,require){\n" +
+          safeCode +
+          "\n})(window.__DCReactForEval,window.__DCModuleTmp,window.__DCModuleTmp.exports,function(){return{};});";
+        (document.documentElement || document.head).appendChild(el);
+        el.remove();
+        try {
+          delete window.__DCModuleTmp;
+        } catch (_) {
+          window.__DCModuleTmp = void 0;
+        }
         const globals = {};
         for (const k of Object.keys(window)) {
           if (!before.has(k) && typeof window[k] === "function") {

package/templates/bod-report/ds-base.js

@@ -22,6 +22,14 @@
   s.onerror = () => console.error('ds-base.js: failed to load ' + s.src + ' — if this is a consuming project, point the base line in ds-base.js at the bound _ds/<folder> tree relative to this page (e.g. _ds/<folder> at the project root, ../_ds/<folder> one level down); in a fresh design system this can just mean the bundle is not compiled yet');
   document.head.appendChild(s);
 
+  // Print documents: PDF (window.print) + editable DOCX toolbar (TASK-IMP-022).
+  // Path is relative to this template folder → templates/_vendor/doc-export.js
+  if (document.querySelector('meta[name="omelette-owns-print"]')) {
+    const ex = document.createElement('script');
+    ex.src = '../_vendor/doc-export.js';
+    document.head.appendChild(ex);
+  }
+
   const syncLang = () => {
     try {
       const a = document.querySelector('[lang]');