unaltraweb 0.7.1 → 0.7.3

data/scripts/export_practice_runtime_archives.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Export two prepared images for the hub's existing Docker-save loader.
+
+No build, pull, load, retag, installation or resource manager is implemented here.
+The existing bounded exporter is reused; PDF provenance comes from its own BOM
+record rather than the controller's source commit.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import sys
+import tarfile
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT))
+sys.path.insert(0, str(ROOT / "src"))
+from scripts.prepare_practice_candidate import export_image, image, sha256
+from unaltraweb_mcp.distribution import distribution_contract
+from unaltraweb_mcp.runtime_lifecycle import IMAGE_ID, immutable_reference
+
+
+def verify_archive(path, expected_id, expected_source):
+    """Inspect only Docker-save metadata/config; never extract or load layers."""
+    with tarfile.open(path, "r:gz") as archive:
+        records = archive.getmembers()
+        by_name = {entry.name: entry for entry in records}
+        if len(records) != len(by_name) or len(records) > 10000:
+            raise ValueError("Docker-save archive inventory is ambiguous or excessive")
+        def small_json(name):
+            entry = by_name.get(name)
+            if entry is None or not entry.isfile() or entry.size > 2*1024*1024:
+                raise ValueError("Docker-save metadata is missing or invalid")
+            with archive.extractfile(entry) as stream:
+                raw = stream.read()
+            return json.loads(raw), raw
+        manifest, _ = small_json("manifest.json")
+        if not isinstance(manifest, list) or len(manifest) != 1:
+            raise ValueError("Expected one immutable image per Docker-save archive")
+        item = manifest[0]
+        if item.get("RepoTags"):
+            raise ValueError("Export by configuration ID only; archive must not reassign tag aliases")
+        config, raw = small_json(item.get("Config"))
+        if "sha256:" + hashlib.sha256(raw).hexdigest() != expected_id:
+            raise ValueError("Docker-save config bytes differ from the expected image ID")
+        if config.get("config", {}).get("Labels", {}).get("org.opencontainers.image.revision") != expected_source:
+            raise ValueError("Docker-save image producer differs from its own expected source")
+        if (config.get("os"), config.get("architecture")) != ("linux", "amd64"):
+            raise ValueError("Archive must retain the selected Linux/amd64 platform")
+        for name in item.get("Layers", []):
+            if name not in by_name or not by_name[name].isfile():
+                raise ValueError("Docker-save layer is missing")
+    return {"config_id": expected_id, "source_revision": expected_source, "repo_tags": []}
+
+
+def write_new(path, value):
+    with path.open("x") as stream:
+        stream.write(json.dumps(value, indent=2, sort_keys=True) + "\n")
+        stream.flush()
+        os.fsync(stream.fileno())
+
+
+def prepare(output, controller_reference, controller_id, controller_source, pdf_id, *, controller_archive=None, controller_archive_sha256=None):
+    output = Path(output).absolute()
+    if (output.resolve() != output or not any(output.is_relative_to(root) for root in (ROOT / "tmp", Path("/tmp/opencode")))
+            or not output.parent.is_dir()):
+        raise ValueError("Select a new non-symlink export directory under factory tmp/ or /tmp/opencode/")
+    if os.path.lexists(output):
+        raise FileExistsError("Runtime archive delivery already exists")
+    if not immutable_reference(controller_reference) or not IMAGE_ID.fullmatch(controller_id) or not IMAGE_ID.fullmatch(pdf_id):
+        raise ValueError("Select immutable image references and full expected configuration IDs")
+    if not re.fullmatch(r"(?:[0-9a-f]{40}|sha256:[0-9a-f]{64})", controller_source):
+        raise ValueError("Controller source must be its exact Git or sealed snapshot identity")
+    if bool(controller_archive) != bool(controller_archive_sha256):
+        raise ValueError("Reusing a controller archive requires its exact SHA-256")
+    contract = distribution_contract()
+    pdf_reference = contract["consumer_integration"]["manual_pdf_image"]
+    producers = [row["producer_sha"] for row in contract["deployment_contract"]["manual_pdf_workers"] if row["reference"] == pdf_reference]
+    if len(producers) != 1:
+        raise ValueError("Selected PDF needs one provider-owned producer record")
+    selected = {"controller": image(controller_reference, controller_id), "manual_pdf": image(pdf_reference, pdf_id)}
+    if selected["controller"]["source_revision"] != controller_source or selected["manual_pdf"]["source_revision"] != producers[0]:
+        raise ValueError("Prepared controller/PDF does not match its own producer")
+    if controller_archive:
+        controller_archive = Path(controller_archive)
+        if controller_archive.is_symlink() or sha256(controller_archive) != controller_archive_sha256:
+            raise ValueError("Retained controller archive hash differs")
+        verify_archive(controller_archive, controller_id, controller_source)
+    if shutil.disk_usage(output.parent).free < sum(item["size"] for item in selected.values()) + 256*1024*1024:
+        raise RuntimeError("Insufficient space for the bounded archive export")
+    output.mkdir(mode=0o755)
+    exported = {}
+    for role, observed in selected.items():
+        destination = output / ("controller.docker.tar.gz" if role == "controller" else "manual-pdf.docker.tar.gz")
+        if role == "controller" and controller_archive:
+            with controller_archive.open("rb") as source, destination.open("xb") as target:
+                shutil.copyfileobj(source, target, 1024*1024)
+                target.flush()
+                os.fsync(target.fileno())
+            if sha256(destination) != controller_archive_sha256:
+                raise ValueError("Copied controller archive differs")
+            record = {"path": destination.name, "sha256": controller_archive_sha256, "bytes": destination.stat().st_size,
+                      "format": "docker-save-gzip", "reused_exact_bytes": True}
+        else:
+            record = export_image(observed["image_id"], destination)
+        archive_identity = verify_archive(destination, observed["image_id"], observed["source_revision"])
+        exported[role] = {"archive": record, "image": observed, "archive_identity": archive_identity,
+                          "offline_selection": {"reference": observed["image_id"], "expected_image_id": observed["image_id"]}}
+    manifest = {"schema_version": 1, "kind": "unaltraweb-practice-runtime-archives", "published": False, "images": exported,
+                "loading": "Existing hub H2 Docker-save loader; no Web loader or alias mutation",
+                "digest_note": "Registry digests are pre-export observations, not a claim that docker load restores RepoDigests."}
+    write_new(output / "runtime-archives.json", manifest)
+    files = [{"path": path.name, "sha256": sha256(path), "bytes": path.stat().st_size} for path in sorted(output.iterdir())]
+    write_new(output / "ready.json", {"schema_version": 1, "kind": "unaltraweb-runtime-archives-ready", "ready": True,
+                                      "manifest": "runtime-archives.json", "files": files, "published": False})
+    for row in files:
+        if sha256(output / row["path"]) != row["sha256"]:
+            raise ValueError("Runtime archive delivery changed before handoff")
+    return {"ok": True, "ready": str(output / "ready.json"), "sha256": sha256(output / "ready.json"), "images": exported}
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--controller-image", required=True)
+    parser.add_argument("--controller-id", required=True)
+    parser.add_argument("--controller-source", required=True)
+    parser.add_argument("--pdf-id", required=True)
+    parser.add_argument("--controller-archive", type=Path)
+    parser.add_argument("--controller-archive-sha256")
+    args = parser.parse_args()
+    print(json.dumps(prepare(args.output, args.controller_image, args.controller_id, args.controller_source, args.pdf_id,
+                             controller_archive=args.controller_archive, controller_archive_sha256=args.controller_archive_sha256), indent=2))

data/scripts/manual/filters/practice-finish.lua

@@ -0,0 +1,36 @@
+-- Consume the core caption filter's output, preserving its short captions/credits.
+local continuation = "continued"
+local function metadata(meta)
+  continuation = pandoc.utils.stringify(meta["continuation-label"] or "continued")
+end
+
+local function figures(blocks)
+  local result, figure = pandoc.List(), nil
+  for _, block in ipairs(blocks) do
+    if block.t == "RawBlock" and block.text == "\\begin{figure}[H]\n\\centering" then
+      assert(not figure, "Nested practice figure")
+      figure = pandoc.List()
+    elseif figure and block.t == "RawBlock" and block.text == "\\end{figure}" then
+      assert(#figure == 2, "Practice figures require one caption and one image")
+      local caption = pandoc.write(pandoc.Pandoc({figure[1]}), "latex"):gsub("%s+$", "")
+      local image = pandoc.write(pandoc.Pandoc({figure[2]}), "latex"):gsub("%s+$", "")
+      result:insert(pandoc.RawBlock("latex", "\\PracticeFigure{" .. caption .. "}{" .. image .. "}"))
+      figure = nil
+    elseif figure then figure:insert(block)
+    else result:insert(block) end
+  end
+  assert(not figure, "Unclosed practice figure")
+  return result
+end
+
+local function table_caption(element)
+  assert(#element.caption.long > 0, "Practice tables require a Table: caption")
+  local rendered = pandoc.write(pandoc.Pandoc({element}), "latex")
+  local caption = pandoc.write(pandoc.Pandoc(element.caption.long), "latex"):gsub("%s+$", "")
+  rendered = rendered:gsub("\\endfirsthead", function()
+    return "\\endfirsthead\n\\caption[]{" .. caption .. " (" .. continuation .. ")}\\tabularnewline"
+  end, 1)
+  return pandoc.RawBlock("latex", rendered)
+end
+
+return {{Meta = metadata}, {Blocks = figures, Table = table_caption}}

data/scripts/manual/filters/practice-layout.lua

@@ -0,0 +1,84 @@
+-- Private practice PDFs use their own counters, pagination and image policy.
+local assets = {}
+
+local function metadata(meta)
+  for original, target in pairs(meta["practice-assets"] or {}) do
+    assets[original] = pandoc.utils.stringify(target)
+  end
+end
+
+local function image(element)
+  local target = assets[element.src]
+  assert(target, "Undeclared practice image: " .. element.src)
+  element.src = target
+  return element
+end
+
+local function figure(element)
+  assert(#element.content == 1 and element.content[1].content
+    and #element.content[1].content == 1 and element.content[1].content[1].t == "Image",
+    "Practice figures require one standalone image")
+  local picture = element.content[1].content[1]
+  picture.attributes.width = nil
+  picture.attributes.height = nil
+  if picture.title ~= "" then
+    element.caption.long = pandoc.read(picture.title, "markdown").blocks
+  end
+  assert(#element.caption.long > 0, "Practice figures require a caption")
+  return element
+end
+
+local function line_count(text)
+  local _, count = text:gsub("\n", "")
+  return count + 1
+end
+
+local function blocks(values)
+  local result = pandoc.List()
+  for index, element in ipairs(values) do
+    local needed = nil
+    if element.t == "Header" then
+      needed = 6
+      local following = values[index + 1]
+      if following and following.t == "Table" then needed = 9 end
+      if following and following.t == "CodeBlock" and line_count(following.text) <= 12 then
+        needed = line_count(following.text) + 7
+      end
+    elseif element.t == "CodeBlock" and line_count(element.text) <= 12 then
+      needed = line_count(element.text) + 4
+    end
+    if needed then
+      result:insert(pandoc.RawBlock("latex", "\\Needspace{" .. needed .. "\\baselineskip}"))
+    end
+    result:insert(element)
+  end
+  return result
+end
+
+local function table_widths(element)
+  if #element.colspecs < 3 then return nil end
+  for _, column in ipairs(element.colspecs) do
+    if column[2] and column[2] ~= 0 then return nil end
+  end
+  local weights, counts, longest = {}, {}, {}
+  for index in ipairs(element.colspecs) do weights[index], counts[index], longest[index] = 0, 0, 0 end
+  for _, body in ipairs(element.bodies) do
+    for _, row in ipairs(body.body) do
+      for index, cell in ipairs(row.cells) do
+        local text = pandoc.utils.stringify(cell.contents)
+        weights[index] = weights[index] + utf8.len(text)
+        counts[index] = counts[index] + 1
+        for word in text:gmatch("%S+") do longest[index] = math.max(longest[index], utf8.len(word)) end
+      end
+    end
+  end
+  local total = 0
+  for index in ipairs(weights) do
+    weights[index] = math.max(12, longest[index] * 0.9, math.min(90, weights[index] / math.max(1, counts[index]) * 0.65))
+    total = total + weights[index]
+  end
+  for index, weight in ipairs(weights) do element.colspecs[index] = {element.colspecs[index][1], weight / total} end
+  return element
+end
+
+return {{Meta = metadata}, {Image = image}, {Figure = figure, Table = table_widths}, {Blocks = blocks}}

data/scripts/manual/practice_pdf.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+"""Consumer-bound entry point used by the factory Make contract."""
+import argparse
+import json
+import os
+from pathlib import Path
+import sys
+
+FACTORY = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(FACTORY / "src"))
+from unaltraweb_mcp.distribution import consumer_integration
+from unaltraweb_mcp.practice_pdf import build
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--project", required=True)
+    args = parser.parse_args()
+    try:
+        result = build(Path(args.project), FACTORY, os.environ.get("PRACTICE_SOURCE", ""),
+                       os.environ.get("PRACTICE_VERSION", ""), run=os.environ.get("PRACTICE_RUN", ""),
+                       image=os.environ.get("MANUAL_PDF_IMAGE") or consumer_integration()["manual_pdf_image"],
+                       dry_run=os.environ.get("PRACTICE_DRY_RUN", "0") == "1")
+    except (OSError, ValueError, RuntimeError) as exc:
+        result = {"ok": False, "publishes": False, "error": str(exc)}
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0 if result["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

data/scripts/manual/render_practice.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+"""Run only inside the bounded PDF toolchain with /source readonly and /out writable."""
+import json
+from pathlib import Path
+import re
+import subprocess
+from urllib.parse import unquote, urlsplit
+
+SOURCE = Path("/source")
+OUTPUT = Path("/out")
+MARKDOWN = "markdown+fenced_divs+pipe_tables+link_attributes-raw_tex-raw_html"
+
+
+def run(command, log):
+    subprocess.run(command, cwd=OUTPUT, check=True, stdout=log, stderr=subprocess.STDOUT)
+
+
+def effective_source(request, log):
+    """Apply the controller's authorised links to the actual Pandoc AST.
+
+    This is a lookup/fail-closed rendering pass, not another filesystem resolver.
+    The exact effective AST/Markdown are retained with the render artifacts.
+    """
+    assert request.get("portable_links") == "portable-links.json"
+    raw = (SOURCE / "portable-links.json").read_bytes()
+    if len(raw) > 1024*1024:
+        raise ValueError("Portable link context exceeds its bound")
+    links = json.loads(raw)
+    assert links["kind"] == "unaltraweb-practice-reading-links" and links["schema_version"] == 1
+    mapping = {entry["href"]: entry["target"] for entry in links["links"]}
+    run(["pandoc", str(SOURCE / "source.md"), "--from="+MARKDOWN, "--to=json", "--output=source.parsed.json"], log)
+    parsed = OUTPUT / "source.parsed.json"
+    if parsed.stat().st_size > 16*1024*1024:
+        raise ValueError("Practice AST exceeds its bound")
+    document = json.loads(parsed.read_bytes())
+    pending, count, applied = [(document, 0)], 0, []
+    while pending:
+        value, depth = pending.pop()
+        count += 1
+        if count > 200000 or depth > 128:
+            raise ValueError("Practice AST exceeds its structural bound")
+        if isinstance(value, dict):
+            if value.get("t") == "Link":
+                target = value["c"][-1]
+                href = target[0]
+                uri = urlsplit(href)
+                if href in mapping:
+                    target[0] = mapping[href]
+                    applied.append({"source_href": href, "target_href": target[0]})
+                elif not href.startswith("#") and uri.scheme.lower() not in {"https", "http", "mailto"}:
+                    raise ValueError("Pandoc found a local/unsupported reading link without an authorised portable mapping: " + href)
+            pending.extend((child, depth+1) for child in value.values())
+        elif isinstance(value, list):
+            pending.extend((child, depth+1) for child in value)
+    effective = OUTPUT / "source.effective.json"
+    effective.write_text(json.dumps(document, ensure_ascii=False, sort_keys=True)+"\n")
+    run(["pandoc", str(effective), "--from=json", "--to=markdown", "--wrap=none", "--output=source.effective.md"], log)
+    return links, applied
+
+
+def check_pdf_links(pdf, context):
+    allowed = {row["destination"] for row in context["targets"].values()}
+    observed = []
+    for page_number, page in enumerate(pdf.pages, 1):
+        for reference in page.get("/Annots", []):
+            annotation = reference.get_object()
+            if annotation.get("/Subtype") != "/Link" or annotation.get("/A") is None:
+                continue
+            action = annotation["/A"].get_object()
+            kind = str(action.get("/S"))
+            if kind == "/GoTo":
+                continue
+            if kind not in {"/URI", "/GoToR", "/Launch"}:
+                raise ValueError("Unsupported action in a reading link")
+            value = action.get("/URI") if kind == "/URI" else action.get("/F")
+            if hasattr(value, "get_object"):
+                value = value.get_object()
+            if isinstance(value, dict):
+                value = value.get("/UF") or value.get("/F")
+            if not isinstance(value, str):
+                raise ValueError("Reading link has no bounded file/URI target")
+            uri = urlsplit(value)
+            if uri.scheme.lower() in {"https", "http", "mailto"} or value.startswith("#"):
+                continue
+            if uri.scheme or uri.netloc or uri.query or unquote(uri.path, errors="strict") not in allowed:
+                raise ValueError("Final PDF contains a local target outside its portable recipient selection: " + value)
+            observed.append({"page": page_number, "kind": kind, "target": value})
+    return observed
+
+
+def main():
+    request = json.loads((SOURCE / "request.json").read_text())
+    basename = request["basename"]
+    assert basename in {"LLEGIU-ME", "LEEME", "README"}
+    filters = request["filters"]
+    assert filters == ["practice-layout.lua", "code-blocks.lua", "figure-captions.lua", "practice-finish.lua"]
+    with (OUTPUT / "render.log").open("x") as log:
+        context, applied = effective_source(request, log)
+        command = ["pandoc", str(OUTPUT / "source.effective.json"), "--standalone", "--from=json",
+                   "--number-sections", "--top-level-division=section", "--metadata-file=/source/metadata.yml",
+                   "--template=/source/practice.tex", "--resource-path=/source", "-t", "latex", "-o", "practice.tex"]
+        for name in filters:
+            command.append("--lua-filter=/source/" + name)
+        run(command, log)
+        for _ in range(3):
+            run(["xelatex", "-no-shell-escape", "-interaction=nonstopmode", "-halt-on-error", "practice.tex"], log)
+        run(["qpdf", "--deterministic-id", "--object-streams=generate", "--recompress-flate",
+             "--compression-level=9", "practice.pdf", basename + ".pdf"], log)
+        run(["pdftoppm", "-f", "1", "-singlefile", "-png", "-r", "110", basename + ".pdf", "preview"], log)
+    latex_log = (OUTPUT / "practice.log").read_text(errors="replace")
+    diagnostics = [line for line in latex_log.splitlines() if re.search(r"Overfull|Underfull|Warning:|Missing character", line)]
+    from pypdf import PdfReader
+    pdf = PdfReader(OUTPUT / (basename + ".pdf"))
+    if not pdf.pages or any(float(page.mediabox.width) < float(page.mediabox.height) for page in pdf.pages):
+        raise ValueError("Practice PDF must contain landscape pages")
+    local_links = check_pdf_links(pdf, context)
+    report = {"pages": len(pdf.pages), "diagnostics": diagnostics,
+               "portable_link_context": context["context"], "applied_links": applied, "local_pdf_links": local_links,
+              "review_required": True, "publishes": False}
+    (OUTPUT / "render-report.json").write_text(json.dumps(report, ensure_ascii=False, indent=2) + "\n")
+    print(json.dumps(report, ensure_ascii=False))
+
+
+if __name__ == "__main__":
+    main()

data/scripts/manual/templates/practice.tex

@@ -0,0 +1,95 @@
+% Article wrapper appended to the factory-owned manual typographic preamble.
+\usepackage{fancyhdr}
+\usepackage{lastpage}
+\pagestyle{fancy}
+\fancyhf{}
+\fancyhead[L]{\small\sffamily\color{ManualMuted}$course-short-title$}
+\fancyhead[R]{\small\sffamily\color{ManualMuted}$short-title$}
+\fancyfoot[L]{\footnotesize\sffamily\color{ManualMuted}v$practice-version$ · $lang$}
+\fancyfoot[C]{\footnotesize\sffamily\color{ManualMuted}$if(draft)$$draft-label$$endif$}
+\fancyfoot[R]{\footnotesize\sffamily\color{ManualMuted}\thepage/\pageref*{LastPage}}
+\renewcommand{\headrulewidth}{0.2pt}
+\renewcommand{\footrulewidth}{0pt}
+\fancypagestyle{practicefirst}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}
+\titleformat{\section}{\normalfont\sffamily\Large\bfseries\color{ManualSecondary}}{\thesection}{0.55em}{}
+\titleformat{\subsection}{\normalfont\large\bfseries\color{ManualSecondary}}{\thesubsection}{0.6em}{}
+\titlespacing*{\section}{0pt}{1.1em}{0.45em}
+\titlespacing*{\subsection}{0pt}{0.9em}{0.35em}
+\setcounter{secnumdepth}{2}
+\setlength{\emergencystretch}{3em}
+\setlist[enumerate]{before=\raggedright}
+\setlength{\LTleft}{\fill}
+\setlength{\LTright}{\fill}
+\setlength{\LTcapwidth}{\textwidth}
+\captionsetup[figure]{format=plain,justification=centering,singlelinecheck=false,margin=0pt,aboveskip=0pt,belowskip=0pt}
+\captionsetup[table]{format=plain,justification=centering,singlelinecheck=false,margin=0pt,skip=14pt}
+
+% Measure the caption once, then fit the image to the remaining text rectangle.
+% The complete unit moves to the next page instead of shrinking into a page tail.
+\newsavebox{\PracticeCaptionBox}
+\newsavebox{\PracticeImageBox}
+\newsavebox{\PracticeFigureBox}
+\newlength{\PracticeImageHeight}
+\newlength{\PracticeFigureHeight}
+\newlength{\PracticeCaptionGap}
+\setlength{\PracticeCaptionGap}{14pt}
+\newcommand{\PracticeFigure}[2]{%
+  \par\begingroup
+  \setlength{\parskip}{0pt}%
+  \setbox\PracticeCaptionBox=\vbox{\hsize=\linewidth\captionsetup{type=figure}#1\par}%
+  \setlength{\PracticeImageHeight}{\dimexpr\textheight-\ht\PracticeCaptionBox-\dp\PracticeCaptionBox-\PracticeCaptionGap-2pt\relax}%
+  \ifdim\PracticeImageHeight<\baselineskip
+    \PackageError{unaltraweb-practice}{Figure caption exceeds the usable page height}{Shorten the caption or split the figure.}%
+  \fi
+  \setkeys{Gin}{width=\linewidth,height=\PracticeImageHeight,keepaspectratio}%
+  \sbox{\PracticeImageBox}{#2}%
+  \setbox\PracticeFigureBox=\vbox{%
+    \hsize=\linewidth\offinterlineskip
+    \hbox to\linewidth{\hfil\usebox{\PracticeCaptionBox}\hfil}%
+    \vskip\PracticeCaptionGap
+    \hbox to\linewidth{\hfil\usebox{\PracticeImageBox}\hfil}%
+  }%
+  \setlength{\PracticeFigureHeight}{\dimexpr\ht\PracticeFigureBox+\dp\PracticeFigureBox+2pt\relax}%
+  \Needspace{\PracticeFigureHeight}%
+  \nointerlineskip\usebox{\PracticeFigureBox}\par
+  \endgroup\addvspace{1em}%
+}
+
+\begin{document}
+\thispagestyle{practicefirst}
+{\setlength{\parskip}{0pt}%
+\noindent
+\begin{minipage}[c]{0.65\linewidth}
+  $if(series-logo)$
+  \begin{minipage}[c]{17mm}
+    \setlength{\fboxsep}{2mm}%
+    \colorbox{ManualBand}{\includegraphics[width=13mm,height=10.4mm,keepaspectratio]{$series-logo$}}%
+  \end{minipage}%
+  \hspace{3mm}%
+  $endif$
+  \begin{minipage}[c]{0.76\linewidth}
+    {\sffamily\bfseries\color{ManualPrimary}$series$}\par
+    {\small\sffamily\color{ManualMuted}$audience-label$}\par
+  \end{minipage}
+\end{minipage}%
+\hfill
+\begin{minipage}[c]{0.32\linewidth}
+  $if(cover-logo)$\raggedleft\includegraphics[width=58mm,height=26mm,keepaspectratio]{$cover-logo$}$endif$
+\end{minipage}\par
+\vspace{4mm}
+{\small\sffamily\bfseries\color{ManualSecondary}$subject$$if(subject-codes)$ ($subject-codes$)$endif$}\par
+\vspace{1mm}
+{\sffamily\fontsize{9.2}{11.6}\selectfont\color{ManualMuted}%
+$for(teaching-guides)$
+$teaching-guides.degree$\par
+$endfor$
+$if(institution-line)$$institution-line$\par$endif$
+$if(author)$$author$ · $endif$$practice-version-label$ $practice-version$\par
+}
+\vspace{2mm}{\color{ManualSecondary!40}\hrule}
+}
+\vspace{4mm}
+{\LARGE\sffamily\bfseries\color{ManualSecondary}$title$}\par
+\vspace{1mm}
+$body$
+\end{document}