@rathnasgala2/template 2.0.0 → 2.2.0

package/contracts/theme-styling-contract.jcs

@@ -1 +1 @@
-{"attributes":[{"match":"exact-value","name":"data-gala-page-kind","role":"semantic","values":["archive","article","author","error","index","page","profile","series","tag"]},{"match":"exact-value","name":"data-gala-resolved-color-mode","role":"state","values":["dark","light"]},{"match":"exact-value","name":"data-gala-slot","role":"semantic","values":["account-intent","article-end","article-footer-ad","article-preamble","conversation","edition-selector","footer-auxiliary","footer-profile","header-actions","newsletter"]},{"match":"presence","name":"data-gala-publication-root","role":"root","values":[]}],"catalogDigest":"sha256:46b43a6d1775f88bf2ded331512bd0cf27d232e256e40a89bda773e50897877f","classSelectors":["language-bash","language-css","language-diff","language-java","language-javascript","language-json","language-jsx","language-markdown","language-markup","language-python","language-sql","language-tsx","language-typescript","language-yaml","token"],"combinators":[" "," > "," + "," ~ "],"composition":{"compoundOrder":["type","id","class","attribute","pseudo-class","pseudo-element"],"functionalSelectorArguments":"compound-only","maximumFunctionalDepth":1,"nthExpressionProfile":"gala-positive-an-plus-b-v2","rootScope":"first-compound-required"},"contractVersion":"2.0.0","functionalPseudos":["is","where","not","nth-child","nth-last-child"],"idSelectors":["gala-appearance-color-mode","main-content"],"orderedLayers":["gala-tokens","gala-components","gala-utilities","gala-print"],"profile":"gala-template-styling-contract-v2","pseudoClasses":[],"pseudoElements":["after","before","marker","selection"],"publicThemeSlotHooks":[{"hookId":"code-block","selectorAtom":"pre"},{"hookId":"code-inline","selectorAtom":"code"},{"hookId":"code-language-bash","selectorAtom":".language-bash"},{"hookId":"code-language-css","selectorAtom":".language-css"},{"hookId":"code-language-diff","selectorAtom":".language-diff"},{"hookId":"code-language-java","selectorAtom":".language-java"},{"hookId":"code-language-javascript","selectorAtom":".language-javascript"},{"hookId":"code-language-json","selectorAtom":".language-json"},{"hookId":"code-language-jsx","selectorAtom":".language-jsx"},{"hookId":"code-language-markdown","selectorAtom":".language-markdown"},{"hookId":"code-language-markup","selectorAtom":".language-markup"},{"hookId":"code-language-python","selectorAtom":".language-python"},{"hookId":"code-language-sql","selectorAtom":".language-sql"},{"hookId":"code-language-tsx","selectorAtom":".language-tsx"},{"hookId":"code-language-typescript","selectorAtom":".language-typescript"},{"hookId":"code-language-yaml","selectorAtom":".language-yaml"},{"hookId":"code-token","selectorAtom":".token"},{"hookId":"content-article","selectorAtom":"article"},{"hookId":"control-appearance-select","selectorAtom":"#gala-appearance-color-mode"},{"hookId":"control-label","selectorAtom":"label"},{"hookId":"control-option","selectorAtom":"option"},{"hookId":"control-select","selectorAtom":"select"},{"hookId":"heading-1","selectorAtom":"h1"},{"hookId":"heading-2","selectorAtom":"h2"},{"hookId":"heading-3","selectorAtom":"h3"},{"hookId":"heading-4","selectorAtom":"h4"},{"hookId":"heading-5","selectorAtom":"h5"},{"hookId":"heading-6","selectorAtom":"h6"},{"hookId":"landmark-footer","selectorAtom":"footer"},{"hookId":"landmark-header","selectorAtom":"header"},{"hookId":"landmark-main","selectorAtom":"main"},{"hookId":"landmark-main-content","selectorAtom":"#main-content"},{"hookId":"landmark-navigation","selectorAtom":"nav"},{"hookId":"media-image","selectorAtom":"img"},{"hookId":"page-archive","selectorAtom":"[data-gala-page-kind=\"archive\"]"},{"hookId":"page-article","selectorAtom":"[data-gala-page-kind=\"article\"]"},{"hookId":"page-author","selectorAtom":"[data-gala-page-kind=\"author\"]"},{"hookId":"page-error","selectorAtom":"[data-gala-page-kind=\"error\"]"},{"hookId":"page-index","selectorAtom":"[data-gala-page-kind=\"index\"]"},{"hookId":"page-page","selectorAtom":"[data-gala-page-kind=\"page\"]"},{"hookId":"page-profile","selectorAtom":"[data-gala-page-kind=\"profile\"]"},{"hookId":"page-series","selectorAtom":"[data-gala-page-kind=\"series\"]"},{"hookId":"page-tag","selectorAtom":"[data-gala-page-kind=\"tag\"]"},{"hookId":"prose-blockquote","selectorAtom":"blockquote"},{"hookId":"prose-divider","selectorAtom":"hr"},{"hookId":"prose-emphasis","selectorAtom":"em"},{"hookId":"prose-link","selectorAtom":"a"},{"hookId":"prose-list-item","selectorAtom":"li"},{"hookId":"prose-list-ordered","selectorAtom":"ol"},{"hookId":"prose-list-unordered","selectorAtom":"ul"},{"hookId":"prose-paragraph","selectorAtom":"p"},{"hookId":"prose-span","selectorAtom":"span"},{"hookId":"prose-strong","selectorAtom":"strong"},{"hookId":"prose-time","selectorAtom":"time"},{"hookId":"slot-account-intent","selectorAtom":"[data-gala-slot=\"account-intent\"]"},{"hookId":"slot-article-end","selectorAtom":"[data-gala-slot=\"article-end\"]"},{"hookId":"slot-article-footer-ad","selectorAtom":"[data-gala-slot=\"article-footer-ad\"]"},{"hookId":"slot-article-preamble","selectorAtom":"[data-gala-slot=\"article-preamble\"]"},{"hookId":"slot-conversation","selectorAtom":"[data-gala-slot=\"conversation\"]"},{"hookId":"slot-edition-selector","selectorAtom":"[data-gala-slot=\"edition-selector\"]"},{"hookId":"slot-footer-auxiliary","selectorAtom":"[data-gala-slot=\"footer-auxiliary\"]"},{"hookId":"slot-footer-profile","selectorAtom":"[data-gala-slot=\"footer-profile\"]"},{"hookId":"slot-header-actions","selectorAtom":"[data-gala-slot=\"header-actions\"]"},{"hookId":"slot-newsletter","selectorAtom":"[data-gala-slot=\"newsletter\"]"}],"publicationRootSelector":"[data-gala-publication-root]","resolvedPaletteSelectors":{"dark":"[data-gala-publication-root][data-gala-resolved-color-mode=\"dark\"]","light":"[data-gala-publication-root][data-gala-resolved-color-mode=\"light\"]"},"stylesheetLayers":{"components":"gala-components","print":"gala-print","tokens":"gala-tokens","utilities":"gala-utilities"},"templatePackage":"@rathnasgala2/template","templateVersion":"2.0.0","typeSelectors":["a","article","blockquote","code","em","footer","h1","h2","h3","h4","h5","h6","header","hr","img","label","li","main","nav","ol","option","p","pre","select","span","strong","time","ul"]}
+{"attributes":[{"match":"exact-value","name":"data-gala-page-kind","role":"semantic","values":["archive","article","author","error","index","page","profile","series","tag"]},{"match":"exact-value","name":"data-gala-resolved-color-mode","role":"state","values":["dark","light"]},{"match":"exact-value","name":"data-gala-slot","role":"semantic","values":["account-intent","article-end","article-footer-ad","article-preamble","conversation","edition-selector","footer-auxiliary","footer-profile","header-actions","newsletter"]},{"match":"presence","name":"data-gala-publication-root","role":"root","values":[]}],"catalogDigest":"sha256:4aca7e9794bddfb2c3afd22f4efd078e7dcf69dde9d62ce52d28cec19aef8b91","classSelectors":["language-bash","language-css","language-diff","language-java","language-javascript","language-json","language-jsx","language-markdown","language-markup","language-python","language-sql","language-tsx","language-typescript","language-yaml","token"],"combinators":[" "," > "," + "," ~ "],"composition":{"compoundOrder":["type","id","class","attribute","pseudo-class","pseudo-element"],"functionalPseudoKeywordArguments":["even","odd"],"functionalSelectorArguments":"compound-only","maximumFunctionalDepth":1,"nthExpressionProfile":"gala-positive-an-plus-b-v2","rootScope":"first-compound-required"},"contractVersion":"2.1.0","functionalPseudos":["is","where","not","nth-child","nth-last-child"],"idSelectors":["gala-appearance-color-mode","main-content"],"orderedLayers":["gala-base","gala-tokens","gala-components","gala-utilities","gala-print"],"profile":"gala-template-styling-contract-v2","pseudoClasses":["active","disabled","focus-visible","hover","visited"],"pseudoElements":["after","before","marker","selection"],"publicThemeSlotHooks":[{"hookId":"code-block","selectorAtom":"pre"},{"hookId":"code-inline","selectorAtom":"code"},{"hookId":"code-language-bash","selectorAtom":".language-bash"},{"hookId":"code-language-css","selectorAtom":".language-css"},{"hookId":"code-language-diff","selectorAtom":".language-diff"},{"hookId":"code-language-java","selectorAtom":".language-java"},{"hookId":"code-language-javascript","selectorAtom":".language-javascript"},{"hookId":"code-language-json","selectorAtom":".language-json"},{"hookId":"code-language-jsx","selectorAtom":".language-jsx"},{"hookId":"code-language-markdown","selectorAtom":".language-markdown"},{"hookId":"code-language-markup","selectorAtom":".language-markup"},{"hookId":"code-language-python","selectorAtom":".language-python"},{"hookId":"code-language-sql","selectorAtom":".language-sql"},{"hookId":"code-language-tsx","selectorAtom":".language-tsx"},{"hookId":"code-language-typescript","selectorAtom":".language-typescript"},{"hookId":"code-language-yaml","selectorAtom":".language-yaml"},{"hookId":"code-token","selectorAtom":".token"},{"hookId":"content-article","selectorAtom":"article"},{"hookId":"control-appearance-select","selectorAtom":"#gala-appearance-color-mode"},{"hookId":"control-label","selectorAtom":"label"},{"hookId":"control-option","selectorAtom":"option"},{"hookId":"control-select","selectorAtom":"select"},{"hookId":"heading-1","selectorAtom":"h1"},{"hookId":"heading-2","selectorAtom":"h2"},{"hookId":"heading-3","selectorAtom":"h3"},{"hookId":"heading-4","selectorAtom":"h4"},{"hookId":"heading-5","selectorAtom":"h5"},{"hookId":"heading-6","selectorAtom":"h6"},{"hookId":"landmark-footer","selectorAtom":"footer"},{"hookId":"landmark-header","selectorAtom":"header"},{"hookId":"landmark-main","selectorAtom":"main"},{"hookId":"landmark-main-content","selectorAtom":"#main-content"},{"hookId":"landmark-navigation","selectorAtom":"nav"},{"hookId":"media-image","selectorAtom":"img"},{"hookId":"page-archive","selectorAtom":"[data-gala-page-kind=\"archive\"]"},{"hookId":"page-article","selectorAtom":"[data-gala-page-kind=\"article\"]"},{"hookId":"page-author","selectorAtom":"[data-gala-page-kind=\"author\"]"},{"hookId":"page-error","selectorAtom":"[data-gala-page-kind=\"error\"]"},{"hookId":"page-index","selectorAtom":"[data-gala-page-kind=\"index\"]"},{"hookId":"page-page","selectorAtom":"[data-gala-page-kind=\"page\"]"},{"hookId":"page-profile","selectorAtom":"[data-gala-page-kind=\"profile\"]"},{"hookId":"page-series","selectorAtom":"[data-gala-page-kind=\"series\"]"},{"hookId":"page-tag","selectorAtom":"[data-gala-page-kind=\"tag\"]"},{"hookId":"prose-blockquote","selectorAtom":"blockquote"},{"hookId":"prose-divider","selectorAtom":"hr"},{"hookId":"prose-emphasis","selectorAtom":"em"},{"hookId":"prose-link","selectorAtom":"a"},{"hookId":"prose-list-item","selectorAtom":"li"},{"hookId":"prose-list-ordered","selectorAtom":"ol"},{"hookId":"prose-list-unordered","selectorAtom":"ul"},{"hookId":"prose-paragraph","selectorAtom":"p"},{"hookId":"prose-span","selectorAtom":"span"},{"hookId":"prose-strong","selectorAtom":"strong"},{"hookId":"prose-time","selectorAtom":"time"},{"hookId":"slot-account-intent","selectorAtom":"[data-gala-slot=\"account-intent\"]"},{"hookId":"slot-article-end","selectorAtom":"[data-gala-slot=\"article-end\"]"},{"hookId":"slot-article-footer-ad","selectorAtom":"[data-gala-slot=\"article-footer-ad\"]"},{"hookId":"slot-article-preamble","selectorAtom":"[data-gala-slot=\"article-preamble\"]"},{"hookId":"slot-conversation","selectorAtom":"[data-gala-slot=\"conversation\"]"},{"hookId":"slot-edition-selector","selectorAtom":"[data-gala-slot=\"edition-selector\"]"},{"hookId":"slot-footer-auxiliary","selectorAtom":"[data-gala-slot=\"footer-auxiliary\"]"},{"hookId":"slot-footer-profile","selectorAtom":"[data-gala-slot=\"footer-profile\"]"},{"hookId":"slot-header-actions","selectorAtom":"[data-gala-slot=\"header-actions\"]"},{"hookId":"slot-newsletter","selectorAtom":"[data-gala-slot=\"newsletter\"]"}],"publicationRootSelector":"[data-gala-publication-root]","resolvedPaletteSelectors":{"dark":"[data-gala-publication-root][data-gala-resolved-color-mode=\"dark\"]","light":"[data-gala-publication-root][data-gala-resolved-color-mode=\"light\"]"},"stylesheetLayers":{"components":"gala-components","print":"gala-print","tokens":"gala-tokens","utilities":"gala-utilities"},"templatePackage":"@rathnasgala2/template","templateVersion":"2.1.0","typeSelectors":["a","article","blockquote","code","em","footer","h1","h2","h3","h4","h5","h6","header","hr","img","label","li","main","nav","ol","option","p","pre","select","span","strong","time","ul"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rathnasgala2/template",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Deterministic Eleventy-backed static publication renderer for Galascribe portable repositories.",
   "type": "module",
   "license": "Apache-2.0",
@@ -25,12 +25,11 @@
     "contracts/",
     "types/",
     "LICENSE",
-    "NOTICE",
     "README.md"
   ],
   "engines": {
-    "node": "24.18.0",
-    "npm": "11.16.0"
+    "node": ">=24.0.0",
+    "npm": ">=11.0.0"
   },
   "devEngines": {
     "runtime": {
@@ -61,12 +60,12 @@
     "test": "node --test",
     "licenses:generate": "node scripts/generate-license-inventory.mjs",
     "licenses:check": "node scripts/generate-license-inventory.mjs --check",
-    "sbom:generate": "cyclonedx-npm --output-file sbom.cdx.json --output-format JSON --spec-version 1.6 && node scripts/apply-sbom-normalization.mjs",
+    "sbom:generate": "cyclonedx-npm --package-lock-only --output-file sbom.cdx.json --output-format JSON --spec-version 1.6 && node scripts/apply-sbom-normalization.mjs",
     "sbom:check": "node scripts/check-sbom-current.mjs",
     "workflows:check": "node scripts/check-workflow-pins.mjs",
     "workflows:drift": "node scripts/check-workflow-drift.mjs",
     "schema-pin:check": "node scripts/check-no-local-schema-pin.mjs",
-    "audit": "npm audit --audit-level=high",
+    "audit": "node scripts/npm-audit.mjs",
     "verify": "npm run format:check && npm run lint && npm run typecheck && npm run architecture && npm run duplication && npm run contracts:check && npm run schema-pin:check && npm test && npm run licenses:check && npm run sbom:check && npm run workflows:check && npm run audit"
   },
   "dependencies": {

package/src/core/errors.js

@@ -4,7 +4,7 @@
  * bare `Error`, so a caller (eventually `publish-kernel`) can distinguish
  * "the supplied build input is not schema-valid" from "the caller's own
  * adapter options are incomplete or unsafe" without string-matching a
- * message (brief S2 section 3: "fails closed on invalid input").
+ * message: this renderer fails closed on invalid input.
  */
 
 /**
@@ -43,14 +43,14 @@ export class RenderOptionsError extends Error {
 }
 
 /**
- * The media pipeline (S2-T05) rejected an image or font reference: an
- * unrecognized or malformed format, a decompression or resource ceiling
- * crossing, an unconditionally-rejected SVG image input, a font that is not
- * bounded WOFF2, or a source file whose bytes do not match its declared
+ * The media pipeline rejected an image or font reference: an unrecognized or
+ * malformed format, a decompression or resource ceiling crossing, an
+ * unconditionally-rejected SVG image input, a font that is not bounded
+ * WOFF2, or a source file whose bytes do not match its declared
  * `build-input` digest. Every one of these fails closed — before any
  * derivative is written and before rendering completes — never as a warning
- * or silent fallback (brief S2 section 3: "Reject decompression or resource
- * excess"; "SVG is never processed as author media").
+ * or silent fallback: decompression or resource excess is always rejected,
+ * and SVG is never processed as author media.
  */
 export class MediaPipelineError extends Error {
   /**
@@ -78,8 +78,8 @@ export class MediaPipelineError extends Error {
  * byte-equal the published render-policy identity, a non-empty module or
  * placement value, or sanitized output that still matched a forbidden
  * pattern (an adapter defect, never expected of admitted content). Rendering
- * never completes for the affected build (brief S2 section 3: "fail-closed
- * behaviour on any content the policy rejects").
+ * never completes for the affected build: this renderer has fail-closed
+ * behaviour on any content the policy rejects.
  */
 export class RenderPolicyViolationError extends Error {
   /**
@@ -95,14 +95,14 @@ export class RenderPolicyViolationError extends Error {
  * The selected theme package's `theme.json` (or its declared file set) did
  * not conform to the closed shape `internal/theme-assets.js` needs to copy
  * its stylesheets/passive assets and render its `<link>` elements: an
- * invalid `stylesheets` list shape, a `cssLayers` projection that does not
- * byte-equal the corresponding ordered layer names, or a missing declared
- * file (task packet S2-T12).
+ * invalid `stylesheets` list shape, a schema/contract-integrity violation
+ * (which also covers an inadmissible `cssLayers` projection — see
+ * `urn:gala:schema:theme-contract:2.0.0`), or a missing declared file.
  */
 export class ThemeAssetError extends Error {
   /**
    * @param {string} reasonCode a stable, machine-checkable reason code (for
-   *   example `THEME_STYLESHEETS_INVALID`, `THEME_CSS_LAYERS_INVALID`)
+   *   example `THEME_STYLESHEETS_INVALID`, `THEME_CONTRACT_SCHEMA_INVALID`)
    * @param {string} message a human-readable description
    */
   constructor(reasonCode, message) {

package/src/core/index.js

@@ -1,11 +1,9 @@
 /**
  * `@rathnasgala2/template` public entry point.
  *
- * This is S2-T03's Eleventy-confined renderer adapter, extended by S2-T05's
- * media pipeline: it consumes one validated
+ * This is the Eleventy-confined renderer adapter: it consumes one validated
  * `urn:gala:schema:build-input:2.0.0` instance and emits a candidate output
- * directory plus one `urn:gala:schema:artifact-manifest:2.0.0` instance
- * (brief S2 section 3).
+ * directory plus one `urn:gala:schema:artifact-manifest:2.0.0` instance.
  *
  * `renderPublication` is the only documented *rendering* entry point. It
  * fails closed: an invalid `build-input` is rejected with
@@ -14,7 +12,7 @@
  * Eleventy ever runs, and a rejected image or font is rejected with
  * {@link MediaPipelineError} before the manifest is assembled.
  *
- * `normalizeAuthoredMarkdown` (re-exported here from S2-T04's
+ * `normalizeAuthoredMarkdown` (re-exported here from
  * `internal/content-security.js`) is this package's second public entry
  * point: the upstream normalization step a `build-input:2.0.0` producer
  * (`publish-kernel`/`publish-action`) calls once per authored Markdown
@@ -25,38 +23,36 @@
  * reaches this renderer, and how `renderPublication` verifies that instead
  * of re-deriving it.
  *
- * S2-T05 adds `options.sourceDirectory` (the caller-mounted, read-only
- * repository source tree `build-input`'s `resolvedFile` references point
- * into) and runs `processMedia` after the Eleventy route listing is already
- * computed, so generated derivative files under `assets/media/` are never
- * mistaken for an HTML route.
+ * `options.sourceDirectory` is the caller-mounted, read-only repository
+ * source tree `build-input`'s `resolvedFile` references point into.
+ * `processMedia` runs after the Eleventy route listing is already computed,
+ * so generated derivative files under `assets/media/` are never mistaken for
+ * an HTML route.
  *
- * Output-security (markdown/sanitizer/highlighter/CSP; S2-T04) and the media
- * pipeline (S2-T05) are layered on the same adapter. S2-T06 adds the core
- * semantic skeleton and navigation renderer (`internal/skeleton.js`) and
- * every generated page kind (`internal/page-kinds.js`): publication profile,
+ * Output-security (markdown/sanitizer/highlighter/CSP) and the media
+ * pipeline are layered on the same adapter, alongside the core semantic
+ * skeleton and navigation renderer (`internal/skeleton.js`) and every
+ * generated page kind (`internal/page-kinds.js`): publication profile,
  * author, article/page, index, tag, series and archive pages, each composed
- * with one shared header/primary-navigation/footer chrome and, where the
- * brief requires it, a breadcrumb trail. Feeds/search/sitemap remain
- * S2-T08. This adapter also emits every authored static redirect, shaped so
- * that later task extends the page-body pipeline without touching the
- * confinement, route-projection or manifest-assembly mechanics here.
+ * with one shared header/primary-navigation/footer chrome and, where
+ * required, a breadcrumb trail. This adapter also emits every authored
+ * static redirect and the feeds/search/sitemap outputs, shaped so that later
+ * work can extend the page-body pipeline without touching the confinement,
+ * route-projection or manifest-assembly mechanics here.
  *
- * S2-T07 adds the Light/Dark/System appearance controller
- * (`internal/appearance/`): the server-rendered control in the header's
- * `header-actions` slot (`controller-markup.js`), the one deterministic
- * pre-paint bootstrap script this renderer ever emits, written into the
- * candidate output directory and entered into the manifest as an ordinary
- * `manifestAsset` row exactly like an S2-T05 media derivative
- * (`bootstrap-script.js`), and the fixed `data-` attribute names, mode
- * values and storage key every one of those pieces shares
- * (`contract.js`) — the contract S2-T12's published theme styling catalog
+ * The Light/Dark/System appearance controller (`internal/appearance/`) adds:
+ * the server-rendered control in the header's `header-actions` slot
+ * (`controller-markup.js`), the one deterministic pre-paint bootstrap script
+ * this renderer ever emits, written into the candidate output directory and
+ * entered into the manifest as an ordinary `manifestAsset` row exactly like a
+ * media derivative (`bootstrap-script.js`), and the fixed `data-` attribute
+ * names, mode values and storage key every one of those pieces shares
+ * (`contract.js`) — the same contract the published theme styling catalog
  * targets.
  *
  * `src/core/` is the only admitted source root in this repository. No
  * `src/modules/` tree, module import edge, registration stub, module
  * configuration, module output or module runtime is ever added beside it
- * (brief S2 section 3; DEC-097 sections 2 and 5).
  */
 
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
@@ -70,6 +66,11 @@ import {
   appearanceBootstrapScriptHref,
 } from './internal/appearance/contract.js';
 import { APPEARANCE_BOOTSTRAP_SCRIPT_SOURCE } from './internal/appearance/bootstrap-script.js';
+import {
+  GALA_BASE_STYLESHEET_MEDIA_TYPE,
+  GALA_BASE_STYLESHEET_PATH,
+  GALA_BASE_STYLESHEET_SOURCE,
+} from './internal/appearance/base-layer.js';
 import { renderAppearanceControl } from './internal/appearance/controller-markup.js';
 import {
   ArtifactManifestValidationError,
@@ -99,7 +100,9 @@ import {
 } from './internal/page-kinds.js';
 import { assertProvenance } from './internal/provenance.js';
 import {
+  derivePublicBasePath,
   errorDocumentPath,
+  joinPublicRoute,
   joinBasePathAndRoute,
   projectFixedAssetPath,
   projectRouteToFilePath,
@@ -151,7 +154,7 @@ export const TEMPLATE_PACKAGE_NAME = '@rathnasgala2/template';
  *
  * @type {string}
  */
-export const TEMPLATE_PACKAGE_VERSION = '2.0.0';
+export const TEMPLATE_PACKAGE_VERSION = '2.1.0';
 
 /**
  * Validate the caller-supplied render options, independent of build-input
@@ -180,10 +183,9 @@ function assertOptions(options) {
       throw new RenderOptionsError(`options.${key} must be an absolute path`);
     }
   }
-  // S2-T12: an optional caller-mounted, read-only extracted theme package
-  // directory (`internal/theme-assets.js`). Absent entirely by default
-  // (every pre-S2-T12 caller, including this repository's own test suite)
-  // so this addition is purely additive.
+  // An optional caller-mounted, read-only extracted theme package directory
+  // (`internal/theme-assets.js`). Absent entirely by default, so this
+  // addition is purely additive.
   if (options.themeDirectory !== undefined) {
     if (
       typeof options.themeDirectory !== 'string' ||
@@ -228,9 +230,9 @@ function assertOptions(options) {
  * render-policy identity, and that no module or placement value leaked
  * through (belt-and-suspenders on top of the `build-input:2.0.0` schema's
  * own `modules: {}` / `placements: []` closure). Fails closed before any
- * directory is created or Eleventy ever runs (DEC-097 section 5: "An absent
- * policy file, wrong path/name/version/digest, mixed identity between
- * records or body produced under a different policy rejects before build").
+ * directory is created or Eleventy ever runs: an absent policy file, wrong
+ * path/name/version/digest, mixed identity between records, or body
+ * produced under a different policy rejects before build.
  *
  * @param {import('../../types/index.d.ts').NormalizedBuildInput} validatedInput
  *   the schema-validated build input
@@ -320,9 +322,16 @@ export async function renderPublication(buildInput, options) {
   // `page.language` below); only the *chrome strings surrounding it* are
   // rendered in one consistent language, matching a reader's expectation
   // that navigation/footer text does not flip language from page to page
-  // (task packet S2-T06 scoped decision; see `internal/messages.js`).
+  // (see `internal/messages.js`).
   const siteMessages = getMessages(validatedInput.publication.defaultLanguage);
-  const homeRoute = joinBasePathAndRoute(validatedInput.basePath, '/');
+  // Every emitted URL carries the `baseUrl` path (for example `/g9/` on a
+  // GitHub project site); output file paths keep using `basePath` alone.
+  const publicBasePath = derivePublicBasePath(
+    validatedInput.baseUrl,
+    validatedInput.basePath,
+  );
+  const urlPrefix = derivePublicBasePath(validatedInput.baseUrl, '/');
+  const homeRoute = joinPublicRoute(publicBasePath, '/');
 
   const appearanceControlHtml = renderAppearanceControl({
     messages: siteMessages,
@@ -336,6 +345,7 @@ export async function renderPublication(buildInput, options) {
   const footerNavHtml = renderFooterNavigation({
     items: validatedInput.navigation.footerItems,
     messages: siteMessages,
+    urlPrefix,
   });
   const footerCard = validatedInput.publication.footerCard;
   // Already verified render-policy-conformant HTML by
@@ -350,31 +360,37 @@ export async function renderPublication(buildInput, options) {
     messages: siteMessages,
   });
 
-  // Run before page assembly, not after (task packet S2-T08): resolving
-  // each page's own `og:image`/`twitter:image` needs the S2-T05 media
-  // pipeline's own finished `assets` list (only it knows which derivative
-  // file extension a given source image's `sourceDigest` produced — see
-  // `internal/seo.js`). This only moves the in-memory computation earlier;
-  // `mediaFiles`' actual bytes are still written to `outputDirectory` only
-  // after the route listing below (unchanged from S2-T05), so
-  // `outputDirectory/assets/media/` still can never be mistaken for an
-  // Eleventy-rendered HTML route.
+  // Run before page assembly, not after: resolving each page's own
+  // `og:image`/`twitter:image` needs the media pipeline's own finished
+  // `assets` list (only it knows which derivative file extension a given
+  // source image's `sourceDigest` produced — see `internal/seo.js`). This
+  // only moves the in-memory computation earlier; `mediaFiles`' actual
+  // bytes are still written to `outputDirectory` only after the route
+  // listing below, so `outputDirectory/assets/media/` still can never be
+  // mistaken for an Eleventy-rendered HTML route.
   const { assets: mediaAssets, files: mediaFiles } = await processMedia(
     validatedInput,
     { sourceDirectory: path.resolve(options.sourceDirectory) },
   );
 
-  // S2-T08: the site-wide feeds, resolved once so every page's feed-
-  // discovery `<link>` tags and the feed documents themselves agree on the
-  // exact same self URLs.
+  // The site-wide feeds, resolved once so every page's feed-discovery
+  // `<link>` tags and the feed documents themselves agree on the exact same
+  // self URLs.
   const feeds = buildFeeds(validatedInput);
   const siteName = validatedInput.publication.title;
-  const appearanceScriptHrefValue = appearanceBootstrapScriptHref(
-    validatedInput.basePath,
+  const appearanceScriptHrefValue =
+    appearanceBootstrapScriptHref(publicBasePath);
+  // TPL-H3/TPL-M7: the template-owned gala-base stylesheet's own basePath-
+  // joined href, computed the same way as the appearance script href above
+  // so it can never drift from the physical file/manifest path written
+  // below.
+  const baseStylesheetHrefValue = joinBasePathAndRoute(
+    publicBasePath,
+    `/${GALA_BASE_STYLESHEET_PATH}`,
   );
 
-  // S2-T12: the selected theme package's copied stylesheets/passive assets
-  // and the ordered `<link>` markup every generated page's `<head>` inserts.
+  // The selected theme package's copied stylesheets/passive assets and the
+  // ordered `<link>` markup every generated page's `<head>` inserts.
   // Run before page assembly (same reasoning as the media pipeline above):
   // every page's `data.themeStylesheetLinksHtml` needs the same one
   // already-rendered fragment.
@@ -382,15 +398,16 @@ export async function renderPublication(buildInput, options) {
     ? await loadThemeAssets({
         themeDirectory: path.resolve(options.themeDirectory),
         basePath: validatedInput.basePath,
+        publicBasePath,
       })
     : undefined;
   const themeStylesheetLinksHtml = themeAssetsResult
     ? themeAssetsResult.linkTagsHtml
-    : defaultThemeStylesheetLinksHtml(validatedInput.basePath);
+    : defaultThemeStylesheetLinksHtml(publicBasePath);
 
   /** @type {{virtualPath: string, content: string, permalink: string, layout?: string, data?: Record<string, unknown>}[]} */
   const contentPages = [];
-  /** @type {{joinedSource: string, joinedTarget: string, filePath: string}[]} */
+  /** @type {{joinedSource: string, joinedTarget: string, publicTarget: string, filePath: string}[]} */
   const redirectProjections = [];
 
   const generatedPages = buildGeneratedPages(validatedInput);
@@ -403,6 +420,7 @@ export async function renderPublication(buildInput, options) {
       items: validatedInput.navigation.items,
       currentRoute: joinedRoute,
       messages: siteMessages,
+      urlPrefix,
     });
     const bodyHtml = renderPageBody({
       messages: siteMessages,
@@ -416,7 +434,7 @@ export async function renderPublication(buildInput, options) {
       mediaAssets,
       reference: page.socialImageRef,
       baseUrl: validatedInput.baseUrl,
-      basePath: validatedInput.basePath,
+      basePath: publicBasePath,
     });
     contentPages.push({
       virtualPath: `pages/${page.kind}-${index}.html`,
@@ -430,7 +448,10 @@ export async function renderPublication(buildInput, options) {
         pageKind: page.kind,
         description: page.description,
         robotsContent: page.robotsContent,
-        canonicalUrl: new URL(joinedRoute, validatedInput.baseUrl).toString(),
+        canonicalUrl: new URL(
+          joinPublicRoute(publicBasePath, page.route),
+          validatedInput.baseUrl,
+        ).toString(),
         siteName,
         ogType: page.ogType ?? 'website',
         ogImage,
@@ -438,6 +459,7 @@ export async function renderPublication(buildInput, options) {
         atomFeedUrl: feeds.atomSelfUrl,
         rssFeedUrl: feeds.rssSelfUrl,
         appearanceScriptHref: appearanceScriptHrefValue,
+        baseStylesheetHref: baseStylesheetHrefValue,
         themeStylesheetLinksHtml,
       },
     });
@@ -456,6 +478,10 @@ export async function renderPublication(buildInput, options) {
       redirectProjections.push({
         joinedSource,
         joinedTarget: joined,
+        publicTarget: joinPublicRoute(
+          publicBasePath,
+          contentRoute(record.frontmatter),
+        ),
         filePath: projectRouteToFilePath(joinedSource, routeProfile),
       });
     }
@@ -463,7 +489,7 @@ export async function renderPublication(buildInput, options) {
 
   const redirectPages = redirectProjections.map((projection, index) => ({
     virtualPath: `redirects/${index}.html`,
-    content: renderRedirectDocument(projection.joinedTarget),
+    content: renderRedirectDocument(projection.publicTarget),
     permalink: projection.filePath,
   }));
 
@@ -473,14 +499,15 @@ export async function renderPublication(buildInput, options) {
     );
   }
 
-  // S2-T08: the one ordinary generated `404.html` error page, using the
-  // S2-T06 `error` page kind's own pure body function. Pushed after the
-  // guard above so the guard's own "is there anything authored to render"
-  // check is unaffected by this always-present synthetic page.
+  // The one ordinary generated `404.html` error page, using the `error`
+  // page kind's own pure body function. Pushed after the guard above so the
+  // guard's own "is there anything authored to render" check is unaffected
+  // by this always-present synthetic page.
   const errorNavHtml = renderPrimaryNavigation({
     items: validatedInput.navigation.items,
     currentRoute: undefined,
     messages: siteMessages,
+    urlPrefix,
   });
   const errorBodyHtml = renderPageBody({
     messages: siteMessages,
@@ -509,11 +536,12 @@ export async function renderPublication(buildInput, options) {
       atomFeedUrl: feeds.atomSelfUrl,
       rssFeedUrl: feeds.rssSelfUrl,
       appearanceScriptHref: appearanceScriptHrefValue,
+      baseStylesheetHref: baseStylesheetHrefValue,
       themeStylesheetLinksHtml,
     },
   });
 
-  // S2-T08: feeds, sitemap and the static search index. Each is a fixed,
+  // Feeds, sitemap and the static search index. Each is a fixed,
   // literal-extension file — never route-normalized like an ordinary
   // content route (`internal/route.js#projectFixedAssetPath`) — and each
   // bypasses the shared HTML skeleton layout entirely (no `layout` field,
@@ -537,7 +565,7 @@ export async function renderPublication(buildInput, options) {
   );
   const sitemapXml = buildSitemap({
     generatedPages,
-    basePath: validatedInput.basePath,
+    basePath: publicBasePath,
     baseUrl: validatedInput.baseUrl,
   });
   const searchIndexJson = buildSearchIndex(validatedInput);
@@ -570,10 +598,9 @@ export async function renderPublication(buildInput, options) {
     outputDirectory,
   });
 
-  // S2-T08: the exact `routeClass`/`mediaType` this renderer's own generated
+  // The exact `routeClass`/`mediaType` this renderer's own generated
   // non-HTML routes carry, keyed by their fixed output path. Every other
-  // route defaults to `'html'`/`text/html; charset=utf-8`, unchanged from
-  // S2-T03.
+  // route defaults to `'html'`/`text/html; charset=utf-8`.
   /** @type {Map<string, {routeClass: import('../../types/index.d.ts').ManifestRouteEntry['routeClass'], mediaType: string}>} */
   const specialRoutes = new Map([
     [
@@ -663,8 +690,8 @@ export async function renderPublication(buildInput, options) {
     await writeFile(destination, file.bytes);
   }
 
-  // S2-T12: the selected theme package's stylesheet/passive-asset bytes,
-  // written for the same reason and at the same point as the media pipeline
+  // The selected theme package's stylesheet/passive-asset bytes, written
+  // for the same reason and at the same point as the media pipeline
   // output immediately above (`themeAssetsResult` is `undefined` when no
   // `options.themeDirectory` was supplied, in which case there is nothing to
   // write — the fallback `defaultThemeStylesheetLinksHtml` link above points
@@ -677,10 +704,10 @@ export async function renderPublication(buildInput, options) {
     }
   }
 
-  // S2-T07's one deterministic pre-paint appearance-controller bootstrap
-  // script (brief S2 section 3: "the appearance controller is the only
-  // browser bootstrap"). Written after the routes listing above for the same
-  // reason as the media pipeline output immediately above: it must never be
+  // The one deterministic pre-paint appearance-controller bootstrap script:
+  // the appearance controller is the only browser bootstrap this renderer
+  // ever emits. Written after the routes listing above for the same reason
+  // as the media pipeline output immediately above: it must never be
   // mistaken for an Eleventy-rendered HTML route. Its bytes are a pure
   // function of `internal/appearance/contract.js`'s own fixed constants, so
   // this asset row is identical on every build regardless of build input.
@@ -714,9 +741,36 @@ export async function renderPublication(buildInput, options) {
     immutable: false,
   };
 
+  // TPL-H3/TPL-M7: the template-owned gala-base stylesheet, written and
+  // manifested for the same reason and at the same point as the appearance
+  // bootstrap script immediately above. Always emitted, independent of
+  // whether a theme was selected (`baseStylesheetHrefValue` above is
+  // likewise unconditional), because it is what makes contract-mandated
+  // chrome presentable even with no theme at all.
+  const baseStylesheetBytes = Buffer.from(GALA_BASE_STYLESHEET_SOURCE, 'utf8');
+  const joinedBaseStylesheetPath = projectFixedAssetPath(
+    validatedInput.basePath,
+    `/${GALA_BASE_STYLESHEET_PATH}`,
+  );
+  const baseStylesheetDestination = path.join(
+    outputDirectory,
+    joinedBaseStylesheetPath,
+  );
+  await mkdir(path.dirname(baseStylesheetDestination), { recursive: true });
+  await writeFile(baseStylesheetDestination, baseStylesheetBytes);
+  /** @type {import('../../types/index.d.ts').ManifestAssetEntry} */
+  const baseStylesheetAsset = {
+    path: joinedBaseStylesheetPath,
+    mediaType: GALA_BASE_STYLESHEET_MEDIA_TYPE,
+    byteLength: String(baseStylesheetBytes.byteLength),
+    sha256: digestBytes(baseStylesheetBytes),
+    immutable: false,
+  };
+
   const assets = [
     ...joinedMediaAssets,
     appearanceScriptAsset,
+    baseStylesheetAsset,
     ...(themeAssetsResult ? themeAssetsResult.assets : []),
   ].sort((a, b) => compareUtf8Bytes(a.path, b.path));
 
@@ -754,5 +808,6 @@ export {
 
 export {
   computeBodyDigest,
+  computeRenderPolicyIdentity,
   normalizeAuthoredMarkdown,
 } from './internal/content-security.js';