@rathnasgala/theme 0.0.1

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@rathnasgala/theme",
+  "version": "0.0.1",
+  "description": "Managed Gala static-site theme payload",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rathnasgala/site-template.git"
+  },
+  "files": [
+    "payload"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

package/payload/.gala/artifact-files/gitignore

@@ -0,0 +1,5 @@
+_site/
+node_modules/
+.gala/build/
+scrap/
+.DS_Store

package/payload/.gala/managed-files.json

@@ -0,0 +1,51 @@
+{
+  "schemaVersion": 1,
+  "themePackage": {
+    "name": "@rathnasgala/theme",
+    "version": "0.0.1",
+    "availableDesignThemes": [
+      "editorial"
+    ],
+    "securityAdvisories": []
+  },
+  "files": {
+    ".gitignore": "b5fa24e10155097a0d372926fd2e59e6072e7cc2cb6399bbfb4beb8b33ea315b",
+    ".gala/publish.yml.template": "73080241d89bd09964b797a8bcc8e18471412e11bc873efad76305b60f497d08",
+    "eleventy.config.js": "0b8c753a28afecdf733ea650cab5fd0691a87f996bc186820c5f949003891cc9",
+    "package.json": "86e1e9922fda15122fe4eb5325d30d145cbdb2877e24307914702d0b64cf1ce9",
+    "package-lock.json": "92372b1bfbdeedf53a8942b3a4e774da3f708ebbf177d92f2b6280e83981df67",
+    "lib/build-manifest.js": "88949f0112d683ca809bb67ca969e15634792423559a67bc79a534cd807e5535",
+    "lib/site-config.js": "9eebf302e1ee5e7fa7b41e50cd0540cf71f917fda25c511fe1db3b035359b091",
+    "lib/engagement-snapshot.js": "298c11b1ab135a3a98a4e31b6320ab60dfd7fda6a9d9053df37d86282a5a6687",
+    "lib/publication-state.js": "1b59c29a18bbb1193bddea898dac3a4fb832c7bc4751263be086f3d64392dea0",
+    "lib/render-markdown.js": "3c493e50264711ee537bf34db826ee39780a6caad5c82174919f48e18fc76ae8",
+    "lib/seo.js": "609ae1c3a1b484dd7c37592d672d13c9aad8005471e2223caaabd2a8e800d194",
+    "src/404.njk": "be0d44370ac5402156aaf3d32ea581057bc61ec94c1a5f92bb809733af7a8a20",
+    "src/_includes/layouts/base.njk": "4def165838c1314c5d7b3759830d268ad48ee6a966dafe492ae7b0bb5018a7c7",
+    "src/_includes/layouts/post.njk": "ced9783eae1b4ca51b950edf19224cd4022294775c9dcc78964b65e504e9d497",
+    "src/_includes/components/ui.njk": "774a82eade4fa21b9203f6455995de4a274eb0b2a452a54288f5fc4b5c16f233",
+    "src/_data/buildManifest.js": "628163305984e0d3537e27b0d4050f5ba5ead12a834878266d2ce8004ffe1b1e",
+    "src/_data/engagementSnapshot.js": "9217dacebfaf008f7a0ad67ff4e8d1fa8fba609a9dc7e3430c78c5b32024da0e",
+    "src/_data/feedLinks.js": "06c93352ebd888acb431a1c9a8be6ecff757895468e9f2d336761038751c2d5e",
+    "src/_data/languages.js": "1358748f7fa2f74406d3295a030827d6229a53e94da72cf712e719d7a356aeac",
+    "src/_data/site.js": "d9c001f4cc12a34027dd92303530b11b5402d47613459bb997e22c4bcbea326d",
+    "src/assets/theme-mode.js": "67cfd8f950ee002d9b6364b7c90db0ad30341d78ac331b649d884ac00a3d6089",
+    "src/assets/interactions.js": "1f68c7e80208c43a40390356009d6101f76f56200f23c654e19ddd253b10b677",
+    "src/assets/preferences.js": "789127bee013ed6a1bbf8cefd7b9109291c16220e7a6e09314e3c93c54731d1d",
+    "src/assets/search.js": "5571697e2a5377c465e5446f77f2225948a5c0bdc58d0be44b579341e756909f",
+    "src/assets/theme.css": "c1ea914cd4a4a23afce8265548feafcb730254c993fe55853779915491356a5c",
+    "src/index.njk": "5c313f0fcdad3ddbfb79376bc9671b3f37539ef70c14bdbbd26d6e2e6de250e8",
+    "src/feed.11ty.js": "009bd2384e08e02a9405683bab1653bab3aeaec16accb0fd01ba69b24c777da9",
+    "src/languages.11ty.js": "399559199c65570d7d5efd88e20254838e316f81c06d7b28ec34990e963db915",
+    "src/posts.11ty.js": "2967f9e17fa7fcec5bf44387ab5bdee7bf8b8c85cfdc589f2105829995fc1d0e",
+    "src/redirects.11ty.js": "3c163246a59f5364861db6a6f05ae88afc938a5379d86cf42776d8d49b0031f3",
+    "src/search-index.11ty.js": "700dc2a2be0ef20de3a828a4612fcf7a082691eade29c6e1d75f09c24b6c6024",
+    "src/search.njk": "63f2e8aeebb63c90da2e375eece639ce096cad1eff7f28628cafc46faf7ceee6",
+    "src/settings.njk": "9e6babf4d2774687558618c4fbd109ddfc0f479f52ec2e5d00c373c44ad16676",
+    "src/sitemap.11ty.js": "4f233e94fb4a913ad5659116518432ed264984a7b622eba3558c77b4ec6435dc",
+    "static/robots.txt": "16ceb5ee3e0dc13aa9adf31a3ebbe45a1d965b8c2b9f72eaf84e5911e140ed95"
+  },
+  "artifactSources": {
+    ".gitignore": ".gala/artifact-files/gitignore"
+  }
+}

package/payload/.gala/publish.yml.template

@@ -0,0 +1,35 @@
+name: Publish
+
+on:
+  push:
+    branches:
+      - __DEFAULT_BRANCH__
+  schedule:
+    - cron: '__CRON__'
+      timezone: '__TIMEZONE__'
+  workflow_dispatch:
+
+concurrency:
+  group: gala-publish-${{ github.repository }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    uses: __ACTION_REF__
+    with:
+      operation: build
+      mode: __BUILD_MODE__
+      site-id: __SITE_ID__
+      api-base-url: ${{ vars.GALA_API_BASE_URL }}
+      output-directory: _site
+      timezone: __TIMEZONE__
+      config-path: site.config.yml
+      floor-guard-percent: ${{ vars.GALA_FLOOR_GUARD_PERCENT || '20' }}
+      floor-guard-pages: ${{ vars.GALA_FLOOR_GUARD_PAGES || '25' }}
+      keepalive-threshold-days: ${{ vars.GALA_KEEPALIVE_THRESHOLD_DAYS || '50' }}
+      floor-guard-override-commit-sha: ${{ contains(github.event.head_commit.message || '', 'Gala-Floor-Override:') && github.sha || '' }}
+    secrets:
+      site-secret: ${{ secrets.GALA_SITE_SECRET }}

package/payload/eleventy.config.js

@@ -0,0 +1,47 @@
+import { markdownLibrary } from './lib/render-markdown.js';
+import { readBuildManifest } from './lib/build-manifest.js';
+import { lstat, realpath } from 'node:fs/promises';
+import path from 'node:path';
+
+async function verifiedMediaSource(postSource, mediaSource) {
+  const metadata = await lstat(mediaSource);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(`Validated media source is no longer a regular file: ${mediaSource}`);
+  }
+  const [postDirectory, source] = await Promise.all([
+    realpath(path.dirname(postSource)),
+    realpath(mediaSource)
+  ]);
+  const relative = path.relative(postDirectory, source);
+  if (relative === '' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error(`Validated media source escaped its post folder: ${mediaSource}`);
+  }
+  return source;
+}
+
+export default async function (eleventyConfig) {
+  const manifest = await readBuildManifest();
+  eleventyConfig.setLibrary('md', markdownLibrary);
+  eleventyConfig.addPassthroughCopy({ static: '/' });
+  eleventyConfig.addPassthroughCopy({ 'src/assets': 'assets' });
+  eleventyConfig.addPassthroughCopy('custom.css');
+  for (const post of manifest.posts) {
+    for (const copy of post.media ?? []) {
+      const source = await verifiedMediaSource(post.source, copy.source);
+      eleventyConfig.addPassthroughCopy({ [source]: copy.output });
+    }
+  }
+  eleventyConfig.addCollection('posts', (collectionApi) =>
+    collectionApi.getAll().filter((item) => item.data.post?.publicationState === 'published')
+  );
+
+  return {
+    dir: {
+      input: 'src',
+      output: '_site',
+      includes: '_includes',
+      data: '_data'
+    },
+    pathPrefix: process.env.GALA_PATH_PREFIX ?? '/'
+  };
+}

package/payload/lib/build-manifest.js

@@ -0,0 +1,189 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+const LANGUAGE = /^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/;
+const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const STATES = new Set(['published', 'tombstoned']);
+const ASSIGNED_SOURCE = /^content\/posts\/[a-z0-9]+(?:-[a-z0-9]+)*\/index\.[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*\.md$/;
+
+function absoluteHttps(value, field) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new TypeError(`${field} must be an absolute URL`);
+  }
+  if (parsed.protocol !== 'https:' || parsed.username !== '' || parsed.password !== '') {
+    throw new TypeError(`${field} must use HTTPS without credentials`);
+  }
+}
+
+function validatedPost(post, index, seen) {
+  if (post == null || Array.isArray(post) || typeof post !== 'object') {
+    throw new TypeError(`build manifest posts[${index}] must be a mapping`);
+  }
+  if (typeof post.source !== 'string' || !post.source.startsWith('content/posts/')
+      || post.source.split('/').some((part) => part === '.' || part === '..')) {
+    throw new TypeError(`build manifest posts[${index}].source is invalid`);
+  }
+  if (!ULID.test(post.id)) {
+    throw new TypeError(`build manifest posts[${index}].id is invalid`);
+  }
+  if (!SLUG.test(post.slug) || !LANGUAGE.test(post.language)) {
+    throw new TypeError(`build manifest posts[${index}] effective slug or language is invalid`);
+  }
+  if (typeof post.relativeUrl !== 'string' || !post.relativeUrl.startsWith('/')
+      || !post.relativeUrl.endsWith('/') || post.relativeUrl.includes('?')
+      || post.relativeUrl.includes('#') || post.relativeUrl.split('/').includes('..')) {
+    throw new TypeError(`build manifest posts[${index}].relativeUrl is invalid`);
+  }
+  absoluteHttps(post.canonicalUrl, `build manifest posts[${index}].canonicalUrl`);
+  absoluteHttps(post.pageUrl, `build manifest posts[${index}].pageUrl`);
+  if (!STATES.has(post.publicationState)) {
+    throw new TypeError(`build manifest posts[${index}].publicationState is invalid`);
+  }
+  if (post.frontmatter == null || Array.isArray(post.frontmatter)
+      || typeof post.frontmatter !== 'object') {
+    throw new TypeError(`build manifest posts[${index}].frontmatter must be a mapping`);
+  }
+  if (post.rawFrontmatter == null || Array.isArray(post.rawFrontmatter)
+      || typeof post.rawFrontmatter !== 'object') {
+    throw new TypeError(`build manifest posts[${index}].rawFrontmatter must be a mapping`);
+  }
+  if (typeof post.contentBody !== 'string') {
+    throw new TypeError(`build manifest posts[${index}].contentBody must be a string`);
+  }
+  if (post.publicationState === 'published' && typeof post.body !== 'string') {
+    throw new TypeError(`build manifest posts[${index}].body is required when published`);
+  }
+  if (post.publicationState === 'tombstoned' && post.body !== null) {
+    throw new TypeError(`build manifest posts[${index}].body must be null when tombstoned`);
+  }
+  let media;
+  if (post.media != null) {
+    if (!Array.isArray(post.media)) {
+      throw new TypeError(`build manifest posts[${index}].media must be a list`);
+    }
+    const sourcePrefix = `${path.posix.dirname(post.source)}/`;
+    const outputPrefix = post.relativeUrl.slice(1);
+    const outputs = new Set();
+    media = post.media.map((copy, mediaIndex) => {
+      const source = copy?.source;
+      const output = copy?.output;
+      if (typeof source !== 'string' || typeof output !== 'string'
+          || !source.startsWith(sourcePrefix) || !output.startsWith(outputPrefix)
+          || source.includes('\\') || output.includes('\\')
+          || source.split('/').some((part) => part === '.' || part === '..')
+          || output.split('/').some((part) => part === '.' || part === '..')
+          || outputs.has(output)) {
+        throw new TypeError(`build manifest posts[${index}].media[${mediaIndex}] is invalid`);
+      }
+      outputs.add(output);
+      return Object.freeze({ source, output });
+    });
+  }
+  const identityVariant = `${post.id}\u0000${post.language.toLowerCase()}`;
+  for (const [type, value] of [
+    ['source', post.source],
+    ['relativeUrl', post.relativeUrl],
+    ['pageUrl', post.pageUrl],
+    ['identity-language', identityVariant]
+  ]) {
+    const values = seen[type];
+    if (values.has(value)) throw new TypeError(`build manifest duplicate ${type}: ${value}`);
+    values.add(value);
+  }
+  return Object.freeze({
+    ...post,
+    ...(media == null ? {} : { media: Object.freeze(media) }),
+    rawFrontmatter: Object.freeze({ ...post.rawFrontmatter }),
+    frontmatter: Object.freeze({ ...post.frontmatter })
+  });
+}
+
+function validatedRedirect(redirect, index, seen) {
+  if (redirect == null || Array.isArray(redirect) || typeof redirect !== 'object') {
+    throw new TypeError(`build manifest redirects[${index}] must be a mapping`);
+  }
+  if (!ULID.test(redirect.id) || !LANGUAGE.test(redirect.language)) {
+    throw new TypeError(`build manifest redirects[${index}] identity is invalid`);
+  }
+  if (typeof redirect.relativeUrl !== 'string' || !redirect.relativeUrl.startsWith('/')
+      || !redirect.relativeUrl.endsWith('/') || redirect.relativeUrl.includes('?')
+      || redirect.relativeUrl.includes('#') || redirect.relativeUrl.split('/').includes('..')) {
+    throw new TypeError(`build manifest redirects[${index}].relativeUrl is invalid`);
+  }
+  absoluteHttps(redirect.pageUrl, `build manifest redirects[${index}].pageUrl`);
+  absoluteHttps(redirect.targetUrl, `build manifest redirects[${index}].targetUrl`);
+  if (redirect.pageUrl === redirect.targetUrl) {
+    throw new TypeError(`build manifest redirects[${index}] must change URL`);
+  }
+  for (const [type, value] of [['relativeUrl', redirect.relativeUrl], ['pageUrl', redirect.pageUrl]]) {
+    if (seen[type].has(value)) throw new TypeError(`build manifest duplicate ${type}: ${value}`);
+    seen[type].add(value);
+  }
+  return Object.freeze({ ...redirect });
+}
+
+export function validateBuildManifest(value) {
+  if (value == null || Array.isArray(value) || typeof value !== 'object'
+      || value.schemaVersion !== 1 || !DATE.test(value.evaluationDate)
+      || !Array.isArray(value.posts) || !Array.isArray(value.redirects)) {
+    throw new TypeError('Unsupported build manifest schema');
+  }
+  const seen = {
+    source: new Set(),
+    relativeUrl: new Set(),
+    pageUrl: new Set(),
+    'identity-language': new Set()
+  };
+  const posts = value.posts.map((post, index) => validatedPost(post, index, seen));
+  const redirects = value.redirects.map((redirect, index) =>
+    validatedRedirect(redirect, index, seen)
+  );
+  let assignedContentIds;
+  if (value.assignedContentIds != null) {
+    if (!Array.isArray(value.assignedContentIds)) {
+      throw new TypeError('build manifest assignedContentIds must be a list');
+    }
+    const sources = new Set();
+    assignedContentIds = value.assignedContentIds.map((assigned, index) => {
+      if (!ASSIGNED_SOURCE.test(assigned?.source) || !ULID.test(assigned?.id)
+          || typeof assigned?.fileHash !== 'string' || !/^[a-f0-9]{64}$/.test(assigned.fileHash)
+          || sources.has(assigned.source)) {
+        throw new TypeError(`build manifest assignedContentIds[${index}] is invalid`);
+      }
+      sources.add(assigned.source);
+      return Object.freeze({ ...assigned });
+    });
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    evaluationDate: value.evaluationDate,
+    ...(assignedContentIds == null
+      ? {}
+      : { assignedContentIds: Object.freeze(assignedContentIds) }),
+    posts: Object.freeze(posts),
+    redirects: Object.freeze(redirects)
+  });
+}
+
+export async function readBuildManifest(root = process.cwd()) {
+  const manifestPath = path.resolve(root, '.gala', 'build', 'validated-posts.json');
+  let source;
+  try {
+    source = await readFile(manifestPath, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      throw new Error('Validated build manifest is missing; run Gala validation before Eleventy');
+    }
+    throw error;
+  }
+  try {
+    return validateBuildManifest(JSON.parse(source));
+  } catch (error) {
+    throw new TypeError(`Invalid validated build manifest: ${error.message}`);
+  }
+}

package/payload/lib/engagement-snapshot.js

@@ -0,0 +1,43 @@
+import { readFile } from 'node:fs/promises';
+
+export const EMPTY_ENGAGEMENT = Object.freeze({
+  available: false,
+  reactions: null,
+  comments: null,
+  views: null
+});
+
+export async function readEngagementSnapshot(file) {
+  let source;
+  try {
+    source = await readFile(file, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return { schemaVersion: 1, refreshedAt: null, articles: {} };
+    throw error;
+  }
+
+  let snapshot;
+  try {
+    snapshot = JSON.parse(source);
+  } catch (error) {
+    throw new TypeError(`Invalid engagement snapshot JSON: ${error.message}`);
+  }
+
+  if (snapshot?.schemaVersion !== 1 || snapshot.articles == null || Array.isArray(snapshot.articles)) {
+    throw new TypeError('Unsupported engagement snapshot schema');
+  }
+  return snapshot;
+}
+
+export function engagementFor(snapshot, articleId) {
+  const entry = snapshot.articles[articleId];
+  if (entry == null) return EMPTY_ENGAGEMENT;
+
+  for (const field of ['reactions', 'comments', 'views']) {
+    if (!Number.isSafeInteger(entry[field]) || entry[field] < 0) {
+      throw new TypeError(`Invalid ${field} count for article ${articleId}`);
+    }
+  }
+
+  return Object.freeze({ available: true, ...entry });
+}

package/payload/lib/publication-state.js

@@ -0,0 +1,61 @@
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+
+export const PublicationState = Object.freeze({
+  PUBLISHED: 'published',
+  TOMBSTONED: 'tombstoned',
+  NOT_EMITTED: 'not-emitted'
+});
+
+function requireCalendarDate(value, fieldName) {
+  if (typeof value !== 'string' || !DATE_PATTERN.test(value)) {
+    throw new TypeError(`${fieldName} must use YYYY-MM-DD`);
+  }
+
+  const [year, month, day] = value.split('-').map(Number);
+  const parsed = new Date(Date.UTC(year, month - 1, day));
+  if (
+    parsed.getUTCFullYear() !== year ||
+    parsed.getUTCMonth() !== month - 1 ||
+    parsed.getUTCDate() !== day
+  ) {
+    throw new TypeError(`${fieldName} must be a valid calendar date`);
+  }
+
+  return value;
+}
+
+export function localDateAt(instant, timezone) {
+  if (!(instant instanceof Date) || Number.isNaN(instant.valueOf())) {
+    throw new TypeError('instant must be a valid Date');
+  }
+
+  const parts = new Intl.DateTimeFormat('en-CA', {
+    timeZone: timezone,
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit'
+  }).formatToParts(instant);
+
+  const values = Object.fromEntries(parts.map(({ type, value }) => [type, value]));
+  return `${values.year}-${values.month}-${values.day}`;
+}
+
+export function evaluatePublicationState(post, today) {
+  const publishAfterDate = requireCalendarDate(post.publishAfterDate, 'publishAfterDate');
+  const evaluationDate = requireCalendarDate(today, 'today');
+
+  // FR-501 and FR-504 take precedence over deletion: never-published content
+  // must leave no public artifact, even when its deletion date has passed.
+  if (publishAfterDate > evaluationDate) {
+    return PublicationState.NOT_EMITTED;
+  }
+
+  if (post.deleteDate != null) {
+    const deleteDate = requireCalendarDate(post.deleteDate, 'deleteDate');
+    if (deleteDate <= evaluationDate) {
+      return PublicationState.TOMBSTONED;
+    }
+  }
+
+  return PublicationState.PUBLISHED;
+}

package/payload/lib/render-markdown.js

@@ -0,0 +1,96 @@
+import MarkdownIt from 'markdown-it';
+import footnote from 'markdown-it-footnote';
+import sanitizeHtml from 'sanitize-html';
+
+const ADMONITION_TYPES = new Set(['NOTE', 'TIP', 'IMPORTANT', 'WARNING', 'CAUTION']);
+
+function admonitions(markdown) {
+  markdown.core.ruler.after('block', 'gala_admonitions', (state) => {
+    for (let index = 0; index < state.tokens.length - 2; index += 1) {
+      const open = state.tokens[index];
+      const inline = state.tokens[index + 2];
+      if (open.type !== 'blockquote_open' || inline?.type !== 'inline') continue;
+
+      const match = inline.content.match(/^\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)](?:\n|$)/);
+      if (!match || !ADMONITION_TYPES.has(match[1])) continue;
+
+      open.tag = 'aside';
+      open.attrSet('class', `admonition admonition-${match[1].toLowerCase()}`);
+      open.attrSet('role', 'note');
+      inline.content = inline.content.slice(match[0].length);
+      if (inline.children?.[0]?.type === 'text') {
+        inline.children[0].content = inline.children[0].content.replace(
+          /^\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)](?:\n|$)/,
+          ''
+        );
+      }
+
+      let depth = 1;
+      for (let cursor = index + 1; cursor < state.tokens.length; cursor += 1) {
+        if (state.tokens[cursor].type === 'blockquote_open') depth += 1;
+        if (state.tokens[cursor].type === 'blockquote_close') depth -= 1;
+        if (depth === 0) {
+          state.tokens[cursor].tag = 'aside';
+          break;
+        }
+      }
+    }
+  });
+}
+
+const markdown = new MarkdownIt({ html: true, linkify: true, typographer: false })
+  .use(footnote)
+  .use(admonitions);
+
+const sanitizeOptions = {
+  allowedTags: [
+    'a', 'abbr', 'aside', 'blockquote', 'br', 'code', 'del', 'div', 'em',
+    'figcaption', 'figure', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'img',
+    'li', 'mark', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table',
+    'tbody', 'td', 'th', 'thead', 'tr', 'ul'
+  ],
+  allowedAttributes: {
+    a: ['href', 'title', 'rel'],
+    aside: ['class', 'role'],
+    code: ['class'],
+    div: ['class', 'id'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'loading', 'decoding'],
+    li: ['id'],
+    ol: ['class'],
+    span: ['class'],
+    sup: ['class'],
+    td: ['colspan', 'rowspan'],
+    th: ['colspan', 'rowspan', 'scope']
+  },
+  allowedClasses: {
+    aside: [
+      'admonition', 'admonition-note', 'admonition-tip', 'admonition-important',
+      'admonition-warning', 'admonition-caution'
+    ],
+    code: [/^language-[a-z0-9_-]+$/],
+    ol: ['footnotes-list'],
+    span: ['footnote-backref'],
+    sup: ['footnote-ref']
+  },
+  allowedSchemes: ['https', 'mailto'],
+  allowedSchemesByTag: {
+    a: ['https', 'mailto'],
+    img: ['https']
+  },
+  allowProtocolRelative: false,
+  enforceHtmlBoundary: true
+};
+
+export function renderMarkdown(source) {
+  if (typeof source !== 'string') throw new TypeError('Markdown source must be a string');
+  return sanitizeHtml(markdown.render(source), sanitizeOptions);
+}
+
+export const markdownLibrary = Object.assign(Object.create(markdown), {
+  render(source, environment) {
+    return sanitizeHtml(markdown.render(source, environment), sanitizeOptions);
+  },
+  renderInline(source, environment) {
+    return sanitizeHtml(markdown.renderInline(source, environment), sanitizeOptions);
+  }
+});