v0.42.1

A parametric variable's description says what the engine does (engine#277)

The description of ExerciseVariable in schema/lesson.schema.json ended
"The engine validates the contract and never samples or evaluates". That has
not been true since engine#220: resolveExerciseVariables samples and
evaluates a parametric exercise and evaluateExpression is exported. The
description now names both helpers and that the random source is a parameter.
Consumers that render the schema's descriptions carried the false sentence:
adaptive-learner's generated lesson-format reference publishes it in eight
languages and follows on its next re-pin. No type, field or rule changes;
x-schema-version stays 1.19.

The self-hosted Mermaid bundle ships the notices of everything it contains (engine#274)

The docs site serves Mermaid's standalone bundle since engine#272, and next to
it shipped only Mermaid's own licence. The bundle also contains the code of 73
other packages: d3, dagre, cytoscape, KaTeX, DOMPurify and, bundled a level
deeper into Mermaid's parser, langium, chevrotain (Apache-2.0, which asks for a
copy of the licence itself) and the vscode-languageserver packages.
Redistributing the bundle means shipping each of their notices.

• docs-site/assets/mermaid.min.js.LICENSE.txt now carries the licence and
  NOTICE files of all 74 packages. What the bundle contains is read from its
  source maps (scripts/third-party-notices.mjs,
  scripts/mermaid-notices.mjs), following @mermaid-js/parser's own maps,
  not from the dependency tree: the bundle was built from Mermaid's lockfile,
  so versions differ from what npm installs here, and langium and chevrotain
  are not installed at all.
• Each text comes from the package installed at that exact version, or from
  third-party/licenses/, which scripts/vendor-licence-texts.mjs fills with
  npm pack (25 packages today). The build fails on a source map entry it
  cannot attribute and on a package without a licence text, naming the
  command that fetches it.
• scripts/write-mermaid-notices.mjs writes the same file for a Mermaid
  bundle vendored elsewhere, from a scratch install of that version, and
  fetches missing texts on request (adaptive-learner#3813). A package that
  ships its licence only as a README section, as fastdom 1.0.12 does, gets
  that section as LICENSE.from-README with a line naming its origin.
• Nothing in the npm package changes; third-party/ is not published.

The Pages site loads nothing from a third-party host (engine#272)

The docs site and the API reference on
https://astrapi69.github.io/learn-content-engine/ sent requests to other
hosts on page load (measured on 2026-10-20 over 40 pages of the live site):
every docs page with a diagram loaded Mermaid from cdn.jsdelivr.net, an
unpinned mermaid@11, and /api/ loaded the README's npm and CI badges
from img.shields.io and github.com. Each request handed the visitor's
IP address to that host before the visitor had done anything. After the
fix, a browser capture of all 133 pages of the assembled site recorded no
request to another host (2026-10-20).

• The docs site serves Mermaid itself: npm run docs:site copies the
  bundle of the mermaid devDependency, the version package-lock.json
  pins, to docs-site/assets/mermaid.min.js (/docs/assets/ on the site),
  and the pages load it by a relative path. The notices of what the bundle
  contains ship next to it as mermaid.min.js.LICENSE.txt (see engine#274
  below; the first version of this fix shipped Mermaid's licence only).
• The API reference shows the badges as text links: a local TypeDoc plugin
  (scripts/typedoc-plugin-remote-images.mjs) replaces a remote image in
  rendered Markdown with its alt text in brackets, so /api/ reads
  "[npm version] [CI]", two links. The README keeps its badges for GitHub
  and npm, where they load through the platform's image proxy.
• A gate guards the forms it can read: npm run docs:pages assembles the
  site as the Pages workflow deploys it, and npm run docs:pages:check
  (scripts/check-external-hosts.mjs) fails on a third-party reference in
  the site's HTML, CSS files, web manifests and service workers. In HTML it
  reads the elements and attributes that fetch, CSS in <style> and in
  style attributes, the loads an inline script names (import,
  import(), importScripts(), new Worker(), an import map) and an
  <iframe srcdoc>, and it resolves references against a <base href>;
  scripts/external-hosts-lib.mjs lists every form. It reads files and
  runs no JavaScript, so a request a script makes at runtime is outside
  it. The rules are a copy of bibliogon's check_external_hosts.py until
  astrapi69/bibliogon#1124 makes it one shared tool, and they cover the
  nine fetch forms that issue found the original passes. CI runs both on
  every pull request, the Pages workflow before each deploy;
  make pages-check runs them locally.

No change to the library code, the schema or the types.