feat: add ephemeral webcam faces and adaptive screens

src/test/mediaPrivacyPolicy.test.ts

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, it } from "node:test";
+
+const staticRunbook = readFileSync(
+  fileURLToPath(new URL("../../deploy/STATIC.md", import.meta.url)),
+  "utf8",
+);
+
+describe("production media permissions policy", () => {
+  const policy = staticRunbook.match(/Permissions-Policy\s+"([^"]+)"/)?.[1] ?? "";
+
+  it("allows only same-origin contextual camera and display prompts", () => {
+    assert.match(policy, /(?:^|,\s*)display-capture=\(self\)(?:,|$)/);
+    assert.match(policy, /(?:^|,\s*)camera=\(self\)(?:,|$)/);
+    assert.doesNotMatch(policy, /camera=\(\*\)/);
+    assert.doesNotMatch(policy, /display-capture=\(\*\)/);
+  });
+
+  it("keeps audio and unrelated high-risk capabilities denied", () => {
+    for (const capability of ["microphone", "geolocation", "payment", "usb"]) {
+      assert.match(policy, new RegExp(`(?:^|,\\s*)${capability}=\\(\\)(?:,|$)`));
+    }
+  });
+
+  it("documents denial, indicator, stop, and page lifecycle acceptance", () => {
+    assert.match(staticRunbook, /denying the browser prompt/i);
+    assert.match(staticRunbook, /active indicator/i);
+    assert.match(staticRunbook, /stop on the in-product control or `pagehide`/i);
+    assert.match(staticRunbook, /neither webcam faces nor office screens request audio/i);
+  });
+});