@rathnasgala2/template 2.0.0 → 2.1.0

package/src/core/internal/feeds.js

@@ -1,24 +1,21 @@
 /**
- * RSS 2.0 and Atom 1.0 feed generation (task packet S2-T08; brief S2
- * section 3 "Required generated outputs": "RSS and Atom feeds").
+ * RSS 2.0 and Atom 1.0 feed generation.
  *
  * Both feeds are built from the exact same {@link selectPublishedArticles}
  * selection and ordering `internal/page-kinds.js`'s `index` page kind
  * paginates (most recently published first, `publishedAt` descending, tied
  * broken by ascending `id`), so a feed's item order can never drift from the
  * site's own index listing. Every URL is an absolute `https://` URL resolved
- * against `buildInput.baseUrl` (brief S2 section 3: "absolute URLs from the
- * build input's public origin"), never a relative path — a feed reader has
- * no notion of the publication's own base path to resolve a relative URL
- * against.
+ * against `buildInput.baseUrl` — always the build input's public origin,
+ * never a relative path — since a feed reader has no notion of the
+ * publication's own base path to resolve a relative URL against.
  *
- * Item count (documented scoped decision, not fixed by the brief or
- * DEC-097): neither source specifies a maximum feed item count. This module
- * bounds it at {@link FEED_ITEM_LIMIT} — a conservative, deterministic
- * default with no author-facing configuration surface in S2, matching this
- * renderer's own established style for an unspecified numeric bound (see
- * `internal/page-kinds.js`'s `LISTING_PAGE_SIZE` and the media pipeline
- * scope decisions in the package README).
+ * Item count: this renderer's build input carries no maximum feed item
+ * count. This module bounds it at {@link FEED_ITEM_LIMIT} — a conservative,
+ * deterministic default with no author-facing configuration surface,
+ * matching this renderer's own established style for an unspecified
+ * numeric bound (see `internal/page-kinds.js`'s `LISTING_PAGE_SIZE` and the
+ * media pipeline scope decisions in the package README).
  */
 
 import { escapeHtml } from './skeleton.js';

package/src/core/internal/fs-walk.js

@@ -3,8 +3,8 @@
  *
  * Filesystem readdir order is not portable, so every caller that needs a
  * reproducible route/asset ordering must sort explicitly; this module never
- * returns raw enumeration order (brief S2 section 3: "no
- * filesystem-enumeration-order dependence").
+ * returns raw enumeration order, so this renderer has no
+ * filesystem-enumeration-order dependence.
  */
 
 import { readdir } from 'node:fs/promises';

package/src/core/internal/media/avif-probe.js

@@ -7,17 +7,17 @@
  * enough to confirm an `ftyp` box with major brand `avif`, locate the
  * `meta` box, and read the primary item's `ispe` (image spatial extents)
  * property for declared width/height, but it does not run a full AV1
- * bitstream decode. DEC-097's closed `gala-theme-binary-assets-v2` profile
+ * bitstream decode. This renderer's closed passive-theme-asset decoder
  * requires a complete single-frame AV1 decode for *passive theme assets*;
  * an equivalent from-scratch AV1 decoder for *author media* is out of
- * proportion to this task's scope, flagged to the orchestrator as a
+ * proportion to this module's scope, flagged to the orchestrator as a
  * follow-up. AVIF is therefore admitted as a *source* reference
  * (recorded, digest-verified, dimension-bounded) with no generated
  * responsive derivative; its original bytes pass through as the sole asset
  * entry, exactly like WebP.
  *
- * The box walk is bounded: at most 4,096 boxes are visited (matching
- * DEC-097's own "4,096 container structures" isolation bound for the binary
+ * The box walk is bounded: at most 4,096 boxes are visited (matching this
+ * renderer's own container-structure isolation bound for the binary
  * decoder family) and every box's declared size is checked against the
  * remaining buffer length before it is used to slice, so a malformed or
  * adversarial box table cannot cause an out-of-bounds read or an unbounded

package/src/core/internal/media/font-policy.js

@@ -1,7 +1,7 @@
 /**
- * Font policy for `appearance.fontAssets` (brief S2 section 3: "Custom fonts
+ * Font policy for `appearance.fontAssets`: custom fonts
  * require licensing, glyph and language coverage plus fallback evidence, and
- * no remote font is ever retrieved").
+ * no remote font is ever retrieved.
  *
  * `build-input:2.0.0`'s `resolvedFile` shape (the only shape
  * `appearance.fontAssets` entries use) is `{path, sourceDigest}` — a

package/src/core/internal/media/limits.js

@@ -1,37 +1,34 @@
 import { MediaPipelineError } from '../../errors.js';
 
 /**
- * Media pipeline resource ceilings (brief S2 section 3, S2-T05: "bounded
- * decoding worker", "decompression and resource limits").
+ * Media pipeline resource ceilings: a bounded decoding worker with fixed
+ * decompression and resource limits, so a hostile or malformed image/font
+ * can never trigger unbounded allocation or a decode bomb.
  *
- * The raster-specific numbers below are DEC-097's own closed
- * `gala-theme-binary-assets-v2` bounds (decision document section titled
- * "Binary theme assets"): non-animated raster, width/height each `1..8192`,
- * at most 16,777,216 pixels, at most 67,108,864 decoded RGBA8 buffer bytes,
- * source raster at most 16,777,216 bytes, source font at most 4,194,304
- * bytes. DEC-097 states those bounds for the closed theme *passive-asset*
- * decoder profile; the brief's author-media pipeline (S2-T05) gives no
- * separate numeric profile of its own, so this renderer reuses the same
- * numbers for the author-media decode-bound worker rather than inventing an
- * unrelated set — the physical decode-bomb risk (integer overflow, unbounded
- * allocation) is identical for both call sites. This is an explicit,
- * documented implementer decision, not a value taken from author-media text.
+ * The raster-specific numbers below are this renderer's closed binary-asset
+ * bounds, shared between the theme passive-asset decoder profile and the
+ * author-media pipeline (which has no separate numeric profile of its own):
+ * non-animated raster, width/height each `1..8192`, at most 16,777,216
+ * pixels, at most 67,108,864 decoded RGBA8 buffer bytes, source raster at
+ * most 16,777,216 bytes, source font at most 4,194,304 bytes. Reusing the
+ * same numbers for both call sites, rather than inventing an unrelated set,
+ * is a deliberate choice: the physical decode-bomb risk (integer overflow,
+ * unbounded allocation) is identical for both.
  *
- * DEC-097's separate "document-22 operational release" MVP launch gate also
- * fixes a smaller general per-source-file ceiling (10,485,760 bytes) that
- * applies to *every* repository source file regardless of kind, with "the
- * smaller declared per-file/package budget still wins." Applied here: the
+ * A separate, smaller general per-source-file ceiling (10,485,760 bytes)
+ * applies to *every* repository source file regardless of kind, and the
+ * smaller declared per-file/package budget always wins. Applied here: the
  * effective per-image source-byte ceiling is `min(16,777,216, 10,485,760)`.
  * The font ceiling (4,194,304) is already smaller than the general cap, so
  * it is unaffected.
  *
  * `MAX_IMAGES_PER_PUBLICATION` and `MAX_TOTAL_MEDIA_BYTES_PER_PUBLICATION`
- * are not fixed anywhere in the brief or DEC-097; there is no cited
- * per-publication *media-specific* aggregate. These two values are this
- * renderer's own conservative, documented ceilings (well under DEC-097's
- * unrelated 50,000-file / 1,073,741,824-byte whole-artifact ceiling), so a
- * publication cannot exhaust the media pipeline's bounded decode budget by
- * sheer reference count even though each individual file is itself bounded.
+ * have no externally fixed per-publication *media-specific* aggregate to
+ * conform to. These two values are this renderer's own conservative,
+ * documented ceilings (well under this renderer's separate, unrelated
+ * 50,000-file / 1,073,741,824-byte whole-artifact ceiling), so a publication
+ * cannot exhaust the media pipeline's bounded decode budget by sheer
+ * reference count even though each individual file is itself bounded.
  */
 
 /** Maximum admitted raster width or height, in pixels, inclusive. */
@@ -44,15 +41,15 @@ export const MAX_IMAGE_PIXELS = 16_777_216;
 export const MAX_DECODED_RGBA_BYTES = 67_108_864;
 
 /**
- * Maximum admitted raster source byte length: the smaller of DEC-097's
- * raster-specific cap (16,777,216) and its general per-source-file cap
- * (10,485,760).
+ * Maximum admitted raster source byte length: the smaller of this
+ * renderer's raster-specific cap (16,777,216) and its general
+ * per-source-file cap (10,485,760).
  */
 export const MAX_IMAGE_SOURCE_BYTES = 10_485_760;
 
 /**
- * Maximum admitted font source byte length (DEC-097's binary font cap,
- * already smaller than the general per-source-file cap).
+ * Maximum admitted font source byte length (this renderer's binary font
+ * cap, already smaller than the general per-source-file cap).
  */
 export const MAX_FONT_SOURCE_BYTES = 4_194_304;
 
@@ -74,8 +71,9 @@ export const MAX_FONTS_PER_PUBLICATION = 8;
 /**
  * Maximum aggregate decoded-plus-derivative byte budget the media pipeline
  * will spend for one publication (implementer-chosen; see module
- * documentation). Comfortably under DEC-097's unrelated 1,073,741,824-byte
- * whole-artifact ceiling, which this constant does not replace or relax.
+ * documentation). Comfortably under this renderer's separate, unrelated
+ * 1,073,741,824-byte whole-artifact ceiling, which this constant does not
+ * replace or relax.
  */
 export const MAX_TOTAL_MEDIA_BYTES_PER_PUBLICATION = 268_435_456;
 
@@ -116,9 +114,9 @@ export function assertDimensionsWithinCeiling(
 
 /**
  * Non-resetting wall-clock budget for one file's bounded decode, in
- * milliseconds. DEC-097's own closed binary-asset decoder uses a ten-second
- * non-resetting deadline; this renderer reuses that figure for the same
- * documented reason as the size/pixel ceilings above.
+ * milliseconds. This renderer's closed binary-asset decoder uses a
+ * ten-second non-resetting deadline, for the same documented reason as the
+ * size/pixel ceilings above.
  */
 export const DECODE_DEADLINE_MS = 10_000;
 

package/src/core/internal/media/pipeline.js

@@ -1,10 +1,10 @@
 /**
- * Media pipeline orchestration (brief S2 section 3, S2-T05).
+ * Media pipeline orchestration.
  *
  * `build-input:2.0.0` never carries raw asset bytes for a `resolvedFile`
- * reference — only its repository-relative `path` and a `sourceDigest`
- * (DEC-097 section 6: "`build` exposes this decoded set as a read-only
- * source mount"). This pipeline therefore reads actual bytes from
+ * reference — only its repository-relative `path` and a `sourceDigest`:
+ * `build` exposes this decoded set as a read-only source mount. This
+ * pipeline therefore reads actual bytes from
  * `options.sourceDirectory`, the caller-mounted read-only source tree, and
  * fails closed (`MEDIA_SOURCE_DIGEST_MISMATCH`) if what it reads there does
  * not hash to the digest `build-input` declared — the same fail-closed

package/src/core/internal/media/png-codec.js

@@ -6,11 +6,11 @@
  * (grayscale+alpha) and 6 (truecolor+alpha), bit depth 8 only, no
  * interlacing. Any other bit depth, interlace method, or PNG structure this
  * module does not recognize is a `MEDIA_FORMAT_INVALID` rejection — never a
- * best-effort guess — matching the fail-closed posture the brief and
- * DEC-097 both require of this pipeline. This is a deliberately smaller
- * surface than DEC-097's own closed `gala-theme-binary-assets-v2` PNG
- * grammar (which the theme packages use for passive presentation assets);
- * author media only needs a decode path sufficient to bound, re-derive
+ * best-effort guess — matching the fail-closed posture required throughout
+ * this pipeline. This is a deliberately smaller surface than this
+ * renderer's own closed passive-theme-asset PNG grammar (which the theme
+ * packages use for passive presentation assets); author media only needs a
+ * decode path sufficient to bound, re-derive
  * orientation-free pixels from, and re-encode ordinary photographic/graphic
  * uploads.
  *
@@ -371,8 +371,8 @@ function crc32(buffer) {
  * Deterministically encode an RGBA8 raster as a minimal truecolor+alpha PNG:
  * one `IHDR`, one "filter type 0 (none)" `IDAT` stream at a fixed zlib
  * level/strategy, one `IEND`. No ancillary chunk (no metadata) is ever
- * emitted, matching the brief's "strip nonessential metadata" requirement
- * for every output this renderer produces.
+ * emitted, stripping nonessential metadata
+ * from every output this renderer produces.
  *
  * @param {{width: number, height: number, rgba: Buffer}} raster the raster
  *   to encode

package/src/core/internal/media/resize.js

@@ -4,8 +4,8 @@
  *
  * IEEE 754 double-precision arithmetic is fully deterministic — the same
  * inputs always produce the same bit pattern on any conforming engine — so
- * this box filter (unlike a lossy codec's own pixel decode, which DEC-097
- * notes is implementation-dependent) is safe to use directly for the
+ * this box filter (unlike a lossy codec's own pixel decode, which is
+ * implementation-dependent) is safe to use directly for the
  * two-clean-build byte-equality requirement: the same source raster and the
  * same target width always produce the same resized raster, and therefore,
  * fed through this pipeline's own deterministic encoders, the same

package/src/core/internal/media/sniff.js

@@ -1,10 +1,10 @@
 /**
  * Media-type sniffing from decoded bytes, never from a file extension or a
- * caller-declared media type (brief S2 section 3: "Establish media type from
- * decoded bytes, not extension").
+ * caller-declared media type: media type is established from
+ * decoded bytes, not extension.
  *
- * SVG is deliberately excluded from this sniffer's admitted output set: "SVG
- * is never processed as author media" (brief S2 section 3). Any byte
+ * SVG is deliberately excluded from this sniffer's admitted output set: SVG
+ * is never processed as author media. Any byte
  * sequence recognizable as SVG/XML is classified `'svg'` here specifically
  * so the caller can reject it with a distinct, explicit
  * `MEDIA_SVG_REJECTED` reason rather than falling through to a generic

package/src/core/internal/media/theme-svg-sanitizer.js

@@ -0,0 +1,278 @@
+/**
+ * The closed admission grammar a theme-declared passive SVG asset must pass
+ * before it is copied into a published artifact (TPL-C2, prerequisite for
+ * TPL-H6's iconography decision).
+ *
+ * Author-supplied SVG is unconditionally rejected by the media pipeline
+ * (`internal/media/sniff.js`'s `'svg'` classification, `MEDIA_SVG_REJECTED`
+ * in `internal/media/pipeline.js`) — SVG is active content (it admits
+ * `<script>`, event-handler attributes and external references) and the
+ * render-policy's own residual-active-content scan explicitly forbids it in
+ * markdown-derived HTML. A theme package is a lower-trust supply-chain input
+ * than the repository owner's own authored content, so it cannot be held to
+ * a looser standard: this module is the one path an SVG byte sequence may
+ * take to reach a published artifact, and it applies its own closed
+ * tag/attribute/scheme allowlist — independent of, and strictly narrower
+ * than, `sanitize-html`'s author-content configuration in
+ * `internal/content-security.js` — followed by the same class of fail-closed
+ * residual-scan backstop that pipeline uses.
+ *
+ * Scope: this grammar targets exactly one use case — a small, static,
+ * decorative icon or mark referenced from theme CSS (`::before`/`::after`
+ * `content: url(...)`, `background-image`, or an `<img>`/`<use>` a future
+ * theme ships). It is deliberately conservative: no `<script>`, no `<style>`
+ * (inline CSS can itself carry `url()` external references), no
+ * `<foreignObject>` (arbitrary embedded HTML), no `<image>` (a raster/SVG
+ * reference of its own, which would need this same admission recursively),
+ * no event-handler attribute of any kind, and no attribute whose value is a
+ * URL reference other than a same-document `#fragment` (so `<use href="#id">`
+ * referencing a `<symbol>` defined earlier in the same file works; anything
+ * that could reach off-document content does not).
+ */
+
+import sanitizeHtml from 'sanitize-html';
+
+import { ThemeAssetError } from '../../errors.js';
+
+/** @type {string} the reason code every rejection in this module carries. */
+export const THEME_SVG_REJECTED_CODE = 'THEME_ASSET_SVG_REJECTED';
+
+/**
+ * The closed SVG element allowlist: structural/grouping and shape elements,
+ * gradients/clipping used for flat icon artwork, and `<title>`/`<desc>` for
+ * accessible names. No scripting, styling, foreign-content or
+ * external-media element is admitted.
+ *
+ * @type {readonly string[]}
+ */
+const ALLOWED_SVG_TAGS = Object.freeze([
+  'svg',
+  'g',
+  'defs',
+  'symbol',
+  'use',
+  'title',
+  'desc',
+  'path',
+  'rect',
+  'circle',
+  'ellipse',
+  'line',
+  'polyline',
+  'polygon',
+  'clipPath',
+  'mask',
+  'linearGradient',
+  'radialGradient',
+  'stop',
+]);
+
+/** @type {readonly string[]} presentation/geometry attributes admitted on
+ * every allowed tag (a closed union, not per-tag — {@link assertNoResidualActiveSvgContent}
+ * is the fail-closed backstop for anything this allowlist under-restricts). */
+const COMMON_SVG_ATTRIBUTES = Object.freeze([
+  'id',
+  'class',
+  'role',
+  'aria-hidden',
+  'aria-label',
+  'focusable',
+  'viewBox',
+  'width',
+  'height',
+  'x',
+  'y',
+  'x1',
+  'y1',
+  'x2',
+  'y2',
+  'cx',
+  'cy',
+  'r',
+  'rx',
+  'ry',
+  'd',
+  'points',
+  'transform',
+  'fill',
+  'fill-rule',
+  'fill-opacity',
+  'stroke',
+  'stroke-width',
+  'stroke-linecap',
+  'stroke-linejoin',
+  'stroke-dasharray',
+  'stroke-opacity',
+  'opacity',
+  'clip-path',
+  'clip-rule',
+  'mask',
+  'offset',
+  'stop-color',
+  'stop-opacity',
+  'gradientUnits',
+  'gradientTransform',
+  'preserveAspectRatio',
+  'xmlns',
+]);
+
+/** @type {import('sanitize-html').IOptions} */
+const SVG_SANITIZE_OPTIONS = {
+  allowedTags: [...ALLOWED_SVG_TAGS],
+  allowedAttributes: Object.fromEntries(
+    ALLOWED_SVG_TAGS.map((tag) => [
+      tag,
+      tag === 'use'
+        ? [...COMMON_SVG_ATTRIBUTES, 'href', 'xlink:href']
+        : [...COMMON_SVG_ATTRIBUTES],
+    ]),
+  ),
+  // `href`/`xlink:href` are only ever admitted on `use` above, and only a
+  // same-document fragment reference is a legal value (enforced below by
+  // {@link assertNoResidualActiveSvgContent}, since sanitize-html's own
+  // scheme allowlist does not distinguish "no scheme" from "fragment-only").
+  allowedSchemesByTag: { use: [] },
+  allowProtocolRelative: false,
+  nonTextTags: [
+    'script',
+    'style',
+    'foreignObject',
+    'image',
+    'animate',
+    'animateTransform',
+    'animateMotion',
+    'set',
+    'iframe',
+  ],
+  disallowedTagsMode: 'discard',
+  parser: { xmlMode: true, decodeEntities: true },
+};
+
+/** @type {readonly RegExp[]} fail-closed backstop patterns; a hit here is
+ * this module's own configuration defect, never expected of admitted
+ * content — mirrors `content-security.js`'s
+ * `RESIDUAL_ACTIVE_CONTENT_PATTERNS` backstop pattern. */
+const RESIDUAL_ACTIVE_SVG_PATTERNS = Object.freeze([
+  /<script[\s>/]/i,
+  /<style[\s>/]/i,
+  /<foreignobject[\s>/]/i,
+  /<image[\s>/]/i,
+  /<iframe[\s>/]/i,
+  /\son[a-z]+\s*=/i,
+  /url\(\s*['"]?(?:https?:)?\/\//i,
+  /url\(\s*['"]?data:/i,
+]);
+
+/**
+ * @param {string} sanitized the sanitize-html output
+ * @returns {void}
+ */
+function assertNoResidualActiveSvgContent(sanitized) {
+  for (const pattern of RESIDUAL_ACTIVE_SVG_PATTERNS) {
+    if (pattern.test(sanitized)) {
+      throw new ThemeAssetError(
+        THEME_SVG_REJECTED_CODE,
+        `sanitized theme SVG still matches a forbidden pattern (${pattern})`,
+      );
+    }
+  }
+  // Every href/xlink:href that survived sanitization must be a same-document
+  // fragment reference; sanitize-html's own scheme allowlist admits a
+  // schemeless value (including a bare fragment) without distinguishing it
+  // from, say, a schemeless relative path, so this is checked explicitly.
+  for (const match of sanitized.matchAll(
+    /(?:href|xlink:href)\s*=\s*"([^"]*)"/gi,
+  )) {
+    if (!match[1].startsWith('#')) {
+      throw new ThemeAssetError(
+        THEME_SVG_REJECTED_CODE,
+        `theme SVG href must be a same-document fragment reference, got ${JSON.stringify(match[1])}`,
+      );
+    }
+  }
+}
+
+/**
+ * Reject, rather than silently strip, any of the specific constructs the
+ * fix requires an SVG sanitizer to police (no script, no event handlers, no
+ * external references): a theme package is untrusted supply-chain input, so
+ * a file that *contains* one of these is treated as a rejected asset, not
+ * quietly laundered into a smaller, safe file the theme author never
+ * reviewed. The allowlist pass below is defense-in-depth on top of this,
+ * narrowing an already-clean file to the admitted tag/attribute vocabulary.
+ *
+ * @param {string} source the raw SVG text
+ * @returns {void}
+ */
+function assertNoForbiddenSvgConstructs(source) {
+  if (/<!doctype/i.test(source) || /<!entity/i.test(source)) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG must not declare a DOCTYPE or an XML entity',
+    );
+  }
+  if (
+    /<\s*(script|style|foreignobject|image|iframe|animate\w*|set)[\s>/]/i.test(
+      source,
+    )
+  ) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG must not contain a <script>, <style>, <foreignObject>, ' +
+        '<image>, <iframe>, animation or <set> element',
+    );
+  }
+  if (/\son[a-z]+\s*=/i.test(source)) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG must not carry an event-handler attribute',
+    );
+  }
+  for (const match of source.matchAll(
+    /(?:href|xlink:href)\s*=\s*(['"])(.*?)\1/gis,
+  )) {
+    if (!match[2].startsWith('#')) {
+      throw new ThemeAssetError(
+        THEME_SVG_REJECTED_CODE,
+        `theme SVG href must be a same-document fragment reference, got ${JSON.stringify(match[2])}`,
+      );
+    }
+  }
+  if (/url\(\s*['"]?(?:https?:)?\/\//i.test(source)) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG must not reference an external url()',
+    );
+  }
+  if (/url\(\s*['"]?data:/i.test(source)) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG must not embed a data: url()',
+    );
+  }
+}
+
+/**
+ * Sanitize one theme-declared SVG passive asset's exact bytes against the
+ * closed grammar above, failing closed on anything it does not admit.
+ *
+ * @param {Buffer} bytes the file's raw bytes (already sniffed as `'svg'` by
+ *   {@link ../media/sniff.js})
+ * @returns {Buffer} the sanitized UTF-8 SVG bytes, safe to publish
+ */
+export function sanitizeThemeSvg(bytes) {
+  const source = bytes.toString('utf8');
+  assertNoForbiddenSvgConstructs(source);
+  const sanitized = sanitizeHtml(source, SVG_SANITIZE_OPTIONS);
+  if (sanitized.trim().length === 0 || !/<svg[\s>]/i.test(sanitized)) {
+    throw new ThemeAssetError(
+      THEME_SVG_REJECTED_CODE,
+      'theme SVG did not survive sanitization as a root <svg> element',
+    );
+  }
+  // Fail-closed backstop over the allowlist pass above — a hit here is this
+  // module's own configuration defect, never expected of admitted content
+  // (the explicit rejection checks above should already have caught it).
+  assertNoResidualActiveSvgContent(sanitized);
+  return Buffer.from(sanitized, 'utf8');
+}

package/src/core/internal/media/webp-probe.js

@@ -5,11 +5,11 @@
  * the `RIFF`/`WEBP` container framing and the `VP8 `/`VP8L` chunk header
  * closely enough to reject a malformed or oversized file and to read the
  * format's own declared width/height, but it does not run a full VP8/VP8L
- * entropy decoder — DEC-097's own closed `gala-theme-binary-assets-v2`
- * profile requires a complete bounded VP8/VP8L bitstream decode for
+ * entropy decoder — this renderer's closed passive-theme-asset decoder
+ * requires a complete bounded VP8/VP8L bitstream decode for
  * *passive theme assets*; hand-authoring an equivalent, independently
  * verifiable decoder for *author media* was judged out of proportion to
- * this task's scope and is flagged to the orchestrator as a follow-up
+ * this module's scope and is flagged to the orchestrator as a follow-up
  * rather than attempted partially. What this module still enforces, fully:
  * exact container framing, a single recognized image chunk (any `VP8X`,
  * animation, or a second image chunk rejects), and the shared

package/src/core/internal/messages.js

@@ -1,17 +1,17 @@
 /**
- * Core-owned chrome message catalog (brief S2 section 3: the semantic
- * skeleton and navigation renderer; task packet S2-T06: "all user-visible
- * chrome strings coming from a message catalog (not inline literals) so
- * localization can find them").
+ * Core-owned chrome message catalog: every user-visible chrome string comes
+ * from a message catalog, not an inline literal, so localization can find
+ * them.
  *
  * Every user-visible string this package's own generated chrome (skip link,
  * navigation labels, breadcrumb labels, pagination controls, generated
- * listing-page headings, the error page kind, the S2-T07 Light/Dark/System
+ * listing-page headings, the error page kind, the Light/Dark/System
  * appearance control's label and its three option labels) emits is looked
  * up here by key
- * rather than written inline at its call site. S2 authors exactly one
- * catalog, `en` (the only language the golden fixture's own core chrome is
- * required to exercise); per-content localization of *authored* content is
+ * rather than written inline at its call site. This renderer authors
+ * exactly one catalog, `en` (the only language the golden fixture's own
+ * core chrome is required to exercise); per-content localization of
+ * *authored* content is
  * `publication`/`content` data, not core chrome, and full chrome
  * localization (additional catalogs, a locale-selection policy) is future
  * work this module is shaped to admit without changing any call site: every