Section 45.12 Dynamic Exercise Options
A fill-in-the-blank exercise may import a Javascript library to generate its content, described for authors in Subsection 4.12.7. In HTML that library runs in the reader’s browser. A static conversion has no browser, so the same library instead runs once at build time, under Node, with the privileges of whoever is building the book. The option here is what makes that static build willing to run a library it did not ship with the project.
Subsection 45.12.1 Approved Remote Libraries
A dynamic exercise may name a Javascript library kept with the project (
@source) or fetched from elsewhere (@url). A library kept with the project needs no approval, since it is already the author’s own code. A library named by @url is different: a static build would otherwise run unvetted, unpinned code as whoever is building the book, so it refuses to do so unless the publisher lists that exact URL as approved,/publication/dynamics/remote-libraries/library/@url
repeated once per library. Approval is per-URL rather than a blanket switch, so approving one library never extends to a different one an exercise starts importing later, and only a secure URL (
https://) may ever be approved. HTML output is not gated this way, since the library then runs in the reader’s browser under the usual protections rather than as the person building the book. See Subsection 4.12.7 for the author-facing side of this feature.
