eyeling 1.24.19 → 1.24.20

package/HANDBOOK.md

@@ -3760,7 +3760,7 @@ When a user does want a portable link, the **Copy share link** button creates on
 - edited programs are shared with a compact compressed `?state=...` payload,
 - default option values are omitted from that payload to keep links small.
 
-If a generated compact share link is still very long, the playground reveals a **Create TinyURL** option. The threshold is intentionally conservative, and the shortener handoff is explicit rather than automatic: after the user chooses that option, the browser uses a TinyURL API token stored locally in that browser to create the short link and copy it to the clipboard. If no token is provided, or if the API request fails, the playground falls back to opening TinyURL and copying the long compact share link so it can be pasted manually. This avoids silently sending encoded editor content to a third-party service while still making the account-backed TinyURL workflow one click after setup.
+If a generated compact share link is still very long, the playground reveals a **Create TinyURL** option. The threshold is intentionally conservative, and the shortener handoff is explicit rather than automatic: after the user chooses that option, the browser uses a TinyURL API token stored locally in that browser to create the short link and copy it to the clipboard. The API request is sent as a POST with `referrerPolicy: "no-referrer"`, so an already-long playground URL is not leaked again as a large `Referer` header. If no token is provided, or if the API request fails, the playground falls back to opening TinyURL without putting the long URL in TinyURL's address bar, and it copies the compact share link so it can be pasted manually. This avoids silently sending encoded editor content to a third-party service while still making the account-backed TinyURL workflow one click after setup.
 
 This keeps everyday use pleasant while preserving the important tutorial and issue-reporting workflow: a link can still capture the imported resource, the local editable overlay, background-knowledge mode, proof-comments mode, and HTTPS-dereferencing mode.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eyeling",
-  "version": "1.24.19",
+  "version": "1.24.20",
   "description": "A minimal Notation3 (N3) reasoner in JavaScript.",
   "main": "./index.js",
   "keywords": [

package/test/playground.test.js

@@ -797,7 +797,18 @@ async function main() {
         const originalFetch = window.fetch;
         let seen = null;
         window.fetch = async (url, options) => {
-          seen = { url: String(url || ''), options: options || null };
+          options = options || {};
+          seen = {
+            url: String(url || ''),
+            options: {
+              method: options.method,
+              headers: options.headers,
+              body: options.body,
+              cache: options.cache,
+              referrerPolicy: options.referrerPolicy,
+              hasSignal: !!options.signal,
+            },
+          };
           return {
             ok: true,
             status: 200,
@@ -973,8 +984,8 @@ ${JSON.stringify(last, null, 2)}`);
     const longShare = await makeShareUrlDiagnosticsInPage();
     assert.ok(longShare.length > longShare.threshold, `Expected test share URL to exceed threshold (${longShare.length} <= ${longShare.threshold})`);
     assert.equal(longShare.needsShortener, true, 'Expected oversized share URL to request a shortener option');
-    assert.match(longShare.shortenerUrl, /^https:\/\/tinyurl\.com\/app\?url=/, 'Expected TinyURL app fallback handoff');
-    assert.ok(longShare.shortenerUrl.includes(encodeURIComponent(longShare.url).slice(0, 40)), 'Expected shortener URL to carry the generated share URL');
+    assert.equal(longShare.shortenerUrl, 'https://tinyurl.com/app', 'Expected TinyURL app fallback handoff to avoid embedding the huge URL');
+    assert.equal(longShare.shortenerUrl.includes(encodeURIComponent(longShare.url).slice(0, 40)), false, 'Expected shortener fallback URL not to carry the generated share URL');
     const tinyUrlCreated = await createTinyUrlWithStubInPage(longShare.url, 'test-token-123', {
       data: { tiny_url: 'https://tinyurl.com/eyeling-test' },
     });
@@ -982,6 +993,7 @@ ${JSON.stringify(last, null, 2)}`);
     assert.equal(tinyUrlCreated.seen.url, 'https://api.tinyurl.com/create', 'Expected TinyURL API create endpoint');
     assert.equal(tinyUrlCreated.seen.options.method, 'POST', 'Expected TinyURL API POST request');
     assert.equal(tinyUrlCreated.seen.options.headers.Authorization, 'Bearer test-token-123', 'Expected bearer token authorization');
+    assert.equal(tinyUrlCreated.seen.options.referrerPolicy, 'no-referrer', 'Expected TinyURL API request not to send a long Referer');
     assert.match(String(tinyUrlCreated.seen.options.body || ''), /"url":/, 'Expected TinyURL API body to include the long URL');
     endTest();