open_blog 0.1.0

data/lib/open_blog/surface_report/record_checks.rb

@@ -0,0 +1,248 @@
+require "digest"
+require "time"
+require_relative "expected_content"
+
+module OpenBlog
+  class SurfaceReport
+    class RecordChecks
+      GENERATED = ".ob-notice, .ob-highlights, .ob-date, .ob-toc, .ob-correction, .ob-disclosure, [data-open-blog-preview]".freeze
+
+      def initialize(context)
+        @context = context
+      end
+
+      def call
+        posts = @context.respond_to?(:scope) && @context.scope == :site ? [] : @context.posts
+        posts.each do |post|
+          modified_date(post)
+          corrections(post)
+          approval(post)
+          revision(post)
+          notice(post)
+          connections(post)
+        end
+        redirects
+      end
+
+      private
+
+      def record(predicate, status, reason, post: nil, **options)
+        @context.record(predicate, status, reason, post: post, **options)
+      end
+
+      def readable(page)
+        page && page.status == 200 && page.body
+      end
+
+      def modified_date(post)
+        latest = post.publications.where(entry_type: %w[substantive correction]).where("occurred_at <= ?", @context.now).maximum(:occurred_at)
+        baseline = post.baseline
+        expected = latest || baseline&.last_modified_at || (!baseline && post.publications.find_by(entry_type: "first")&.occurred_at)
+        return record("E6", :not_verified, "The release history has no supported modification date.", post: post) unless expected
+        page = @context.post_page(post)
+        sitemap = @context.page(@context.absolute("#{OpenBlog.mount_path.chomp('/')}/sitemap.xml"))
+        return record("E6", :not_verified, "The article or sitemap could not be inspected.", post: post) unless readable(page) && readable(sitemap)
+        xml = Nokogiri::XML(sitemap.body) { |options| options.strict.nonet }
+        entry = xml.xpath("//*[local-name()='url']").find { |node| node.at_xpath("./*[local-name()='loc']")&.text == @context.absolute(post.path) }
+        values = [ page.article&.fetch("dateModified", nil) ]
+        sitemap_date = entry&.at_xpath("./*[local-name()='lastmod']")&.text
+        values << sitemap_date if sitemap_date.present?
+        values.concat(page.document.css(".ob-date--updated time").map { |node| node["datetime"] })
+        valid = values.all? { |value| same_time?(value, expected) }
+        record("E6", valid ? :pass : :fail, valid ? "Displayed modification dates agree with release history." : "A modification date differs from release history.", post: post)
+      rescue Nokogiri::XML::SyntaxError
+        record("E6", :fail, "The sitemap date evidence is not valid XML.", post: post)
+      end
+
+      def corrections(post)
+        entries = post.publications.where(entry_type: "correction").where("occurred_at <= ?", @context.now).to_a
+        return record("E7", :not_applicable, "No correction release is recorded.", post: post) if entries.empty?
+        page = @context.post_page(post)
+        return record("E7", :not_verified, "The article could not be inspected.", post: post) unless readable(page)
+        blocks = page.document.css(".ob-correction")
+        label = I18n.t("open_blog.notices.correction", locale: @context.config.locale)
+        valid = entries.all? { |entry| blocks.any? { |block| visible_text(block).include?(label) && block.css("time").any? { |node| same_time?(node["datetime"], entry.occurred_at) } } }
+        record("E7", valid ? :pass : :fail, valid ? "Recorded corrections have dated notices." : "A recorded correction lacks a dated notice.", post: post)
+      end
+
+      def approved(post)
+        post.approvals.where(revision_id: post.public_revision_id, facts_checked: true).order(:approved_at, :id).first
+      end
+
+      def approval(post)
+        return record("E18", :not_applicable, "The article is recorded as written by a person.", post: post) if post.provenance_human_written?
+        review = approved(post)
+        unless review
+          return record("E18", post.provenance_unknown? ? :not_verified : :fail, "No fact-checked review covers the public revision.", post: post)
+        end
+        baseline = post.baseline
+        released = if baseline && baseline.adopted_revision_id == post.public_revision_id
+          baseline.first_published_at || baseline.declared_first_published_at
+        else
+          post.publications.where(revision_id: post.public_revision_id).minimum(:occurred_at)
+        end
+        marks = []
+        marks << "publisher declaration" if review.kind == "declared"
+        marks << "review after release" if released && review.approved_at > released
+        record("E18", :pass, "A fact-checked review covers the public revision.", post: post, marks: marks,
+          details: { approved_at: review.approved_at.iso8601, released_at: released&.iso8601 })
+      end
+
+      def revision(post)
+        return record("E19", :not_applicable, "The article is recorded as written by a person.", post: post) if post.provenance_human_written?
+        stored = post.public_revision
+        page = @context.post_page(post)
+        unless stored && readable(page) && (!post.provenance_unknown? || approved(post))
+          return record("E19", :not_verified, "The revision, review, or fetched article is unavailable.", post: post)
+        end
+        payload = JSON.parse(stored.payload)
+        expected = ExpectedContent.call(post, payload, base_url: @context.config.public_base_url)
+        actual = page.document.at_css("[data-open-blog-content]")
+        return record("E19", :not_verified, "The stored revision content could not be rendered.", post: post) unless expected
+        return record("E19", :fail, "The fetched page has no declared article content region.", post: post) unless actual
+        parts = {}
+        linked = post.publications.exists?(revision_id: stored.id) && approved(post)
+        parts["A"] = mark(Digest::SHA256.hexdigest(stored.payload) == stored.identifier && linked && RevisionPayload.new(post).identifier == stored.identifier)
+        parts["B"] = mark(text(project(expected)) == text(project(actual)))
+        parts["C"] = mark(links(project(expected)) == links(project(actual)))
+        images = payload.fetch("images").select { |image| %w[cover body].include?(image["role"]) }
+        parts["D"] = mark(actual.css("img").map { |node| [ node["src"], node["alt"].to_s ] } == images.map { |image| image.values_at("url", "alt") })
+        parts["E"] = image_files(images)
+        parts["F"] = head(page, payload)
+        faq = actual.css("[data-open-blog-faq-entry]").map do |entry|
+          question = entry.at_css("h3")
+          [ text(question), entry.css("p").map { |node| text(node) }.join(" ") ]
+        end
+        expected_faq = payload.fetch("faq").map { |entry| [ normalize(entry["question"]), normalize(entry["answer"]) ] }
+        parts["G"] = mark(faq == expected_faq && (expected_faq.any? || actual.css("[data-open-blog-faq]").empty?))
+        status = parts.value?("fail") ? :fail : parts.value?("not verified") ? :not_verified : :pass
+        record("E19", status, status == :pass ? "Fetched content agrees with the stored public revision." : "Some revision comparisons differ or lack evidence.", post: post, details: parts)
+      rescue JSON::ParserError, KeyError, ActionView::Template::Error => error
+        record("E19", :not_verified, "Stored content could not be compared (#{error.class.name}).", post: post)
+      end
+
+      def image_files(images)
+        results = images.map do |image|
+          next "not verified" if image["sha256"].blank?
+          page = image_page(image["url"])
+          next "not verified" unless readable(page)
+          mark(Digest::SHA256.hexdigest(page.body) == image["sha256"])
+        end
+        results.include?("fail") ? "fail" : results.include?("not verified") ? "not verified" : "pass"
+      end
+
+      def image_page(path)
+        url = @context.absolute(path)
+        seen = []
+        6.times do
+          return if url.nil? || seen.include?(url)
+          seen << url
+          page = @context.page(url)
+          return page unless page && [ 301, 302, 303, 307, 308 ].include?(page.status)
+          location = page.headers["location"] || page.headers["Location"]
+          return if location.blank?
+          url = URI.join(url, location).to_s
+        end
+        nil
+      rescue URI::InvalidURIError, URI::BadURIError
+        nil
+      end
+
+      def head(page, payload)
+        document = page.document
+        title = payload["search_title"].presence || payload["title"]
+        description = payload["search_description"].presence || payload["description"]
+        return "fail" unless document.at_css("title")&.text&.start_with?(title) && document.at_css('meta[name="description"]')&.[]("content") == description
+        social = payload.fetch("images").select { |image| image["role"] == "social" }
+        return "pass" if social.empty?
+        url = document.at_css('meta[property="og:image"]')&.[]("content")
+        return "fail" unless url && URI.parse(url).path == social.first["url"]
+        image_files([ social.first.merge("url" => url) ])
+      rescue URI::InvalidURIError
+        "fail"
+      end
+
+      def notice(post)
+        dependencies = [ @context.row("E4", post: post), @context.row("E18", post: post), @context.row("E19", post: post) ]
+        needed = !post.provenance_human_written? && dependencies.any? { |row| !row || %w[fail].include?(row[:result].to_s) || row[:result].to_s.tr("_", " ") == "not verified" }
+        return record("E20", :not_applicable, "The inspected evidence does not require an AI notice.", post: post) unless needed
+        page = @context.post_page(post)
+        return record("E20", :not_verified, "The article could not be inspected for a notice.", post: post) unless readable(page)
+        key = post.provenance_ai_assisted? ? "ai_assisted" : "ai_unknown"
+        label = I18n.t("open_blog.notices.#{key}", locale: @context.config.locale)
+        valid = page.document.css(".ob-notice--ai").any? { |node| visible_text(node).include?(label) }
+        record("E20", valid ? :pass : :fail, valid ? "The fetched article includes the relevant AI notice." : "The fetched article lacks the relevant AI notice.", post: post)
+      end
+
+      def connections(post)
+        declaration = post.connection_declarations.order(:id).last
+        page = @context.post_page(post)
+        { "E21" => declaration && declaration.connections.any?, "E22" => declaration&.third_party_paid? }.each do |predicate, needed|
+          if !declaration
+            record(predicate, :not_verified, "No connection declaration was supplied.", post: post)
+          elsif !needed
+            record(predicate, :not_applicable, "The publisher declared no matching connection.", post: post)
+          elsif !readable(page)
+            record(predicate, :not_verified, "The article could not be inspected.", post: post)
+          else
+            selector = predicate == "E21" ? "[data-open-blog-content] .ob-disclosure" : "[data-open-blog-content] .ob-notice--paid"
+            document = page.document
+            valid = document.css(selector).any? do |node|
+              next false if visible_text(node).blank?
+              body = document.at_css("[data-open-blog-body]")
+              predicate == "E21" || (body && (node <=> body) == -1)
+            end
+            record(predicate, valid ? :pass : :fail, valid ? "A disclosure is present in the article markup." : "A declared connection has no disclosure markup.", post: post)
+          end
+        end
+      end
+
+      def redirects
+        entries = Redirect.all.to_a
+        if entries.empty?
+          began = Baseline.minimum(:adopted_at)
+          reason = "No URL changes are recorded; earlier moves require imported history."
+          reason += " Imported coverage begins #{began.iso8601}." if began
+          return record("T4", :not_applicable, reason)
+        end
+        entries.each do |entry|
+          page = @context.page(@context.absolute(entry.old_path))
+          unless page && page.status.to_i.positive?
+            record("T4", :not_verified, "The recorded old URL could not be fetched.", details: { path: entry.old_path })
+            next
+          end
+          valid = if entry.new_path
+            [ 301, 308 ].include?(page.status) && @context.absolute(page.headers["location"] || page.headers["Location"]) == @context.absolute(entry.new_path)
+          else
+            [ 404, 410 ].include?(page.status)
+          end
+          record("T4", valid ? :pass : :fail, valid ? "The old URL has the recorded response." : "The old URL differs from its recorded destination or removal.", details: { path: entry.old_path })
+        end
+      end
+
+      def project(node)
+        node = node.dup
+        node.css(GENERATED).remove
+        node
+      end
+
+      def visible_text(node)
+        return "" unless node && ![ node, *node.ancestors ].any? { |parent| parent.key?("hidden") || parent["aria-hidden"] == "true" }
+        text(node)
+      end
+
+      def text(node) = normalize(node&.text)
+      def normalize(value) = value.to_s.gsub(/\s+/, " ").strip
+      def links(node) = node.css("a[href]").map { |link| [ text(link), link["href"] ] }
+      def mark(value) = value ? "pass" : "fail"
+
+      def same_time?(value, expected)
+        return false if value.blank?
+        value = value.to_s
+        value.length == 10 ? Date.iso8601(value) == expected.to_date : Time.iso8601(value).to_i == expected.to_i
+      rescue ArgumentError
+        false
+      end
+    end
+  end
+end

data/lib/open_blog/surface_report/robots.rb

@@ -0,0 +1,49 @@
+module OpenBlog
+  class SurfaceReport
+    module Robots
+      module_function
+
+      def allowed?(body, path, agent)
+        return true if path == "/robots.txt"
+        groups = []
+        group = nil
+        body.to_s.dup.force_encoding("UTF-8").scrub.delete_prefix("\uFEFF").split(/\r\n|\n|\r/).each do |line|
+          key, value = line.sub(/#.*/, "").strip.split(":", 2).map(&:strip)
+          next unless value
+          if key.downcase == "user-agent"
+            next unless value.match?(/\A(?:[a-z_-]+|\*)\z/i)
+            if !group || group[:started]
+              group = { agents: [], rules: [], started: false }
+              groups << group
+            end
+            group[:agents] << value.downcase
+          elsif %w[allow disallow].include?(key.downcase) && group
+            group[:started] = true
+            group[:rules] << [ key.downcase, normalize(value) ] if value.start_with?("/")
+          end
+        end
+        selected = groups.select { |entry| entry[:agents].include?(agent.downcase) }
+        selected = groups.select { |entry| entry[:agents].include?("*") } if selected.empty?
+        target = normalize(path)
+        matches = selected.flat_map { |entry| entry[:rules] }.select do |_kind, pattern|
+          ending = pattern.end_with?("$")
+          value = ending ? pattern[0...-1] : pattern
+          expression = value.split("*", -1).map { |part| Regexp.escape(part) }.join(".*")
+          target.match?(Regexp.new("\\A#{expression}#{'\\z' if ending}"))
+        end
+        winner = matches.max_by { |kind, pattern| [ pattern.delete("*").delete_suffix("$").bytesize, kind == "allow" ? 1 : 0 ] }
+        winner.nil? || winner.first == "allow"
+      end
+
+      def normalize(value)
+        escaped = value.to_s.b.bytes.map { |byte| byte > 127 ? "%%%02X" % byte : byte.chr }.join
+        escaped.gsub(/%([0-9a-f]{2})/i) do
+          byte = Regexp.last_match(1).to_i(16)
+          character = byte.chr
+          character.match?(/[a-z0-9._~-]/i) ? character : "%%%02X" % byte
+        end
+      end
+      private_class_method :normalize
+    end
+  end
+end

data/lib/open_blog/surface_report.rb

@@ -0,0 +1,223 @@
+require "uri"
+require "json"
+require "nokogiri"
+
+module OpenBlog
+  class SurfaceReport
+    autoload :Http, "open_blog/surface_report/http"
+    autoload :Robots, "open_blog/surface_report/robots"
+    autoload :PageChecks, "open_blog/surface_report/page_checks"
+    autoload :ExpectedContent, "open_blog/surface_report/expected_content"
+    autoload :RecordChecks, "open_blog/surface_report/record_checks"
+    autoload :ReachChecks, "open_blog/surface_report/reach_checks"
+
+    STATUSES = [ "pass", "fail", "not applicable", "not verified" ].freeze
+    LIMIT = 50
+    NOTICE = "Automated observations do not establish editorial quality or replace manual review, browser testing, and field measurements.".freeze
+    NOT_ASSESSED = %w[E2 E9 E10 E11 E12 E13 E14 E15 E23 E24 E25].freeze
+    NOT_RUN = [
+      { predicate: "T12_render", reason: "Small-screen layout requires a browser session." },
+      { predicate: "T18", reason: "Hidden content and navigation behavior need manual inspection." },
+      { predicate: "T19", reason: "Accessibility requires browser tooling and human testing." },
+      { predicate: "T20", reason: "Performance assessment needs real-user field measurements." }
+    ].freeze
+
+    def self.run(scope: :site, post: nil, page: 1, reach: false, http: nil)
+      context = Context.new(scope: scope, post: post, page: page, reach: reach, http: http)
+      PageChecks.new(context).call
+      RecordChecks.new(context).call
+      ReachChecks.new(context).call unless context.scope == :site
+      Result.new(context)
+    end
+
+    def self.declarations
+      {
+        field_map: { title: "posts.title", description: "posts.description", search_title: "posts.search_title",
+          search_description: "posts.search_description", body: "posts.body_markdown or rich_body", author: "posts.author_name",
+          images: "cover_image, body image manifest, social_image", faq: "faqs.question and faqs.answer ordered by position" },
+        content_selector: "[data-open-blog-content]", faq_selectors: OpenBlog::FAQ_SELECTORS.values,
+        primary_list_type: OpenBlog.config.primary_list_type, sign_in_destinations: OpenBlog.config.sign_in_destinations
+      }
+    end
+
+    class Page
+      attr_reader :url, :status, :headers, :body, :error
+
+      def initialize(url:, status: 0, headers: {}, body: "", error: nil)
+        @url, @status, @body, @error = url, status.to_i, body, error
+        @headers = headers.to_h.transform_keys { |key| key.to_s.downcase }
+      end
+
+      def document
+        @document ||= Nokogiri::HTML5.parse(body.to_s.dup.force_encoding(Encoding::UTF_8).scrub)
+      end
+
+      def articles
+        @articles ||= document.css('script[type="application/ld+json"]').flat_map do |script|
+          json_nodes(JSON.parse(script.text))
+        rescue JSON::ParserError
+          []
+        end.select { |node| (Array(node["@type"]) & %w[Article BlogPosting]).any? }
+      end
+
+      def article
+        articles.first
+      end
+
+      private
+
+      def json_nodes(value)
+        case value
+        when Array then value.flat_map { |item| json_nodes(item) }
+        when Hash then [ value, *json_nodes(value["@graph"]) ]
+        else []
+        end
+      end
+    end
+
+    class Context
+      attr_reader :scope, :posts, :config, :now, :reach, :results, :pagination, :limitations
+
+      def initialize(scope:, post:, page:, reach:, http:)
+        @config, @now, @results, @pages = OpenBlog.config, Time.current, [], {}
+        @deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 60
+        @response_bytes = 0
+        @limitations = []
+        @scope = scope.to_s.to_sym
+        invalid!(:scope) unless %i[site post all].include?(@scope)
+        page = page.to_i if page.is_a?(String) && page.match?(/\A[1-9]\d*\z/)
+        invalid!(:page) unless page.is_a?(Integer) && page.between?(1, 1_000_000)
+        @reach = case reach
+        when true, "true" then true
+        when false, "false" then false
+        else invalid!(:reach)
+        end
+        invalid!(:post) if @scope == :post ? post.blank? : post.present?
+        @http = http || Http.new(trusted_origin: config.public_base_url)
+        select_posts(post, page)
+      end
+
+      def record(predicate, status, reason, post: nil, marks: [], details: nil)
+        status = status.to_s.tr("_", " ")
+        raise ArgumentError, "Unknown report status" unless STATUSES.include?(status)
+        value = { predicate: predicate.to_s, result: status, reason: reason.to_s, marks: marks }
+        value[:post_id] = post.respond_to?(:id) ? post.id : post if post
+        value[:details] = details if details
+        results << value
+        value
+      end
+
+      def row(predicate, post: nil)
+        id = post.respond_to?(:id) ? post.id : post
+        results.find { |value| value[:predicate] == predicate.to_s && value[:post_id] == id }
+      end
+
+      def absolute(path)
+        return if path.blank? || config.public_base_url.blank?
+        URI.join("#{config.public_base_url.chomp('/')}/", path.to_s).to_s
+      rescue URI::InvalidURIError, URI::BadURIError
+        nil
+      end
+
+      def post_page(post)
+        page(absolute(post.path))
+      end
+
+      def page(url)
+        return Page.new(url: nil, error: "Set public_base_url to inspect reader pages.") if url.blank?
+        return @pages[url] if @pages.key?(url)
+        if @byte_budget_exhausted || @pages.length >= 500 || Process.clock_gettime(Process::CLOCK_MONOTONIC) >= @deadline
+          return limited_page(url, "Report request budget exhausted; narrow the scope and retry.")
+        end
+        @pages[url] ||= begin
+          response = @http.get(url)
+          @response_bytes += response.body.to_s.bytesize
+          if @response_bytes > 32 * 1024 * 1024
+            @byte_budget_exhausted = true
+            limited_page(url, "Report response-byte budget exhausted; narrow the scope and retry.")
+          else
+            Page.new(url: url, status: response.status, headers: response.headers, body: response.body)
+          end
+        rescue Http::FetchError => error
+          Page.new(url: url, error: error.message)
+        end
+      end
+
+      def robots_allowed?(url, agent)
+        return if url.blank?
+        uri = URI.parse(url)
+        target = URI.join(url, "/robots.txt").to_s
+        6.times do |attempt|
+          response = page(target)
+          return if response.status.zero? || response.status >= 500
+          return true if response.status.between?(400, 499)
+          return Robots.allowed?(response.body, uri.request_uri, agent) if response.status == 200
+          return unless [ 301, 302, 303, 307, 308 ].include?(response.status)
+          return if response.headers["location"].blank? || attempt == 5
+          target = URI.join(target, response.headers["location"]).to_s
+        end
+      rescue URI::InvalidURIError, URI::BadURIError
+        nil
+      end
+
+      private
+
+      def limited_page(url, reason)
+        @limitations << reason unless @limitations.include?(reason)
+        Page.new(url: url, error: reason)
+      end
+
+      def select_posts(identity, number)
+        scope = Post.listed.order(:id)
+        if @scope == :post
+          identity = identity.id if identity.is_a?(Post)
+          selected = scope.find_by(id: identity) if identity.to_s.match?(/\A\d+\z/)
+          selected ||= scope.find_by(slug: identity.to_s)
+          raise Error::NotFound unless selected
+          @posts = [ selected ]
+          @pagination = { page: 1, per_page: 1, total: 1, pages: 1 }
+        else
+          total = scope.count
+          @posts = scope.offset((number - 1) * LIMIT).limit(LIMIT).to_a
+          @pagination = { page: number, per_page: LIMIT, total: total, pages: (total.to_f / LIMIT).ceil }
+        end
+      end
+
+      def invalid!(field)
+        raise Error::ValidationFailed.new(details: [ field.to_s ])
+      end
+    end
+
+    class Result
+      def initialize(context)
+        @data = { gem_version: OpenBlog::VERSION, report_version: "1", date: context.now.iso8601,
+          scope: context.scope.to_s, post_ids: context.posts.map(&:id), pagination: context.pagination,
+          declarations: SurfaceReport.declarations, results: context.results, limitations: context.limitations,
+          counts: STATUSES.to_h { |status| [ status, context.results.count { |row| row[:result] == status } ] },
+          not_run: NOT_RUN, not_assessed: NOT_ASSESSED, sentence: NOTICE }
+      end
+
+      def to_h
+        @data.deep_dup
+      end
+
+      def to_text
+        lines = [ "OpenBlog page and record report", "#{@data[:date]} | scope: #{@data[:scope]}",
+          "Articles: #{@data[:post_ids].join(', ')} | page #{@data[:pagination][:page]} of #{@data[:pagination][:pages]}" ]
+        lines << "Declarations: #{JSON.generate(@data[:declarations])}"
+        @data[:results].each do |row|
+          identity = row[:post_id] ? " article #{row[:post_id]}" : ""
+          lines << "#{row[:predicate]}#{identity}: #{row[:result]} — #{row[:reason]}"
+          lines << "  #{row[:marks].join('; ')}" if row[:marks].any?
+          lines << "  Evidence: #{JSON.generate(row[:details])}" if row[:details]
+        end
+        lines << @data[:counts].map { |status, count| "#{status}: #{count}" }.join(" | ")
+        lines << "Not run: #{@data[:not_run].map { |item| item[:predicate] }.join(', ')}"
+        lines << "Not assessed: #{@data[:not_assessed].join(', ')}"
+        @data[:limitations].each { |reason| lines << "Limit: #{reason}" }
+        lines << NOTICE
+        lines.join("\n") + "\n"
+      end
+    end
+  end
+end

data/lib/open_blog/syntax_css.rb

@@ -0,0 +1,55 @@
+require "rouge"
+require "fileutils"
+require "pathname"
+
+module OpenBlog
+  class SyntaxCss
+    LIGHT_SCOPE = ".ob-highlight"
+    DARK_SCOPE = '[data-theme="dark"] .ob-highlight'
+    SYSTEM_SCOPE = 'html:not([data-theme="light"]) .ob-highlight'
+
+    def self.render(theme: OpenBlog.config.syntax_theme)
+      selected = Rouge::Theme.find(theme)
+      unless selected && selected.respond_to?(:mode) && selected.respond_to?(:make_light!) && selected.respond_to?(:make_dark!)
+        raise ConfigurationError, "Syntax theme #{theme.inspect} must provide light and dark modes; try github, base16, or gruvbox."
+      end
+      light = selected.mode(:light).render(scope: LIGHT_SCOPE)
+      dark = selected.mode(:dark).render(scope: DARK_SCOPE)
+      system = selected.mode(:dark).render(scope: SYSTEM_SCOPE)
+      css = "#{light}\n\n#{dark}\n\n@media (prefers-color-scheme: dark) {\n#{system}\n}\n"
+      css += github_contrast if selected == Rouge::Themes::Github
+      css
+    end
+
+    def self.github_contrast
+      comments = %w[c ch cd cm cp cpf c1 cs gl gt].map { |name| "#{LIGHT_SCOPE} .#{name}" }.join(", ")
+      <<~CSS
+        #{LIGHT_SCOPE} .gr { color: #cf222e; }
+        #{comments} { color: #57606a; }
+        #{DARK_SCOPE} .gh, #{DARK_SCOPE} .gu { color: #79c0ff; }
+        @media (prefers-color-scheme: dark) {
+          #{SYSTEM_SCOPE} .gh, #{SYSTEM_SCOPE} .gu { color: #79c0ff; }
+        }
+      CSS
+    end
+    private_class_method :github_contrast
+
+    def self.write(root: Rails.root, path: nil, theme: OpenBlog.config.syntax_theme)
+      root = Pathname(root)
+      destination = path ? root.join(path) : default_path(root)
+      css = render(theme: theme)
+      FileUtils.mkdir_p(destination.dirname)
+      destination.write(css)
+      destination
+    end
+
+    def self.default_path(root)
+      tailwind = root.join("app/assets/tailwind/open_blog/syntax.css")
+      stylesheets = root.join("app/assets/stylesheets/open_blog/syntax.css")
+      return tailwind if tailwind.file?
+      return stylesheets if stylesheets.file?
+      root.join("app/assets/tailwind/application.css").file? ? tailwind : stylesheets
+    end
+    private_class_method :default_path
+  end
+end

data/lib/open_blog/unpublish.rb

@@ -0,0 +1,13 @@
+module OpenBlog
+  class Unpublish
+    def self.call(post, actor:, now: Time.current)
+      Operation.run(post: post, actor: actor, now: now) do |current, _created|
+        raise Error::NotFound unless current.persisted?
+        was_public = current.published?
+        current.update!(status: "draft", publish_at: nil)
+        Remove.write_redirect(current, target: nil, source: "unpublish", now: now) if was_public
+        { revision: nil, publication: nil, approval: nil }
+      end
+    end
+  end
+end

data/lib/open_blog/version.rb

@@ -0,0 +1,3 @@
+module OpenBlog
+  VERSION = "0.1.0"
+end