@rathnasgala2/template 2.0.0

package/src/core/internal/eleventy-render.js

@@ -0,0 +1,220 @@
+/**
+ * The one module in this repository permitted to import `@11ty/eleventy`.
+ * Every other module reaches rendered output only through
+ * {@link renderPagesWithEleventy}'s plain-data return value: no Eleventy
+ * instance, plug-in API, config object or Nunjucks environment crosses back
+ * out of this module (brief S2 section 3: "No Eleventy object, plug-in API,
+ * config object or Nunjucks environment may cross the adapter boundary in
+ * either direction").
+ *
+ * Confinement enforced here:
+ * - `configPath: false` on the `Eleventy` constructor disables discovery of
+ *   any `.eleventy.js`/`eleventy.config.*` file entirely (`TemplateConfig`
+ *   treats an explicit falsy `configPath` as "skip config files" rather
+ *   than searching `process.cwd()`), so nothing from an author repository
+ *   or an ambient host directory is ever read as configuration.
+ * - The only filesystem paths this module touches are the caller-supplied
+ *   `inputDirectory` and `outputDirectory`, both required to be absolute
+ *   paths under the caller's declared work/output roots.
+ * - `eleventyConfig.setUseGitIgnore(false)` stops Eleventy from walking
+ *   parent directories looking for a `.gitignore` to exclude files by.
+ * - Every page is supplied as an in-memory virtual template
+ *   (`eleventyConfig.addTemplate`) with `templateEngineOverride: false`, so
+ *   author-authority body content is written verbatim and is never
+ *   interpreted as Nunjucks/Liquid template syntax.
+ * - `elev.write()` runs exactly one full build; this module never calls
+ *   `.watch()` or constructs an incremental build, and never sets
+ *   `runMode: "watch"` (brief S2 section 3: "Incremental and watch mode
+ *   ... cannot produce a releasable artifact").
+ * - No plugin that performs network access is registered, and Eleventy's
+ *   own default plugins (`HtmlBasePlugin`, `BundlePlugin`) perform no
+ *   network access.
+ */
+
+import Eleventy from '@11ty/eleventy';
+
+import {
+  APPEARANCE_ROOT_ATTRIBUTE,
+  COLOR_SCHEME_META_CONTENT,
+} from './appearance/contract.js';
+import { contentSecurityPolicyMetaTag } from './content-security.js';
+import { PAGE_KIND_ATTRIBUTE } from './page-kinds.js';
+
+/**
+ * @typedef {object} EleventyPage
+ * @property {string} virtualPath a unique virtual input path (arbitrary,
+ *   never read from any real filesystem location)
+ * @property {string} content the exact output bytes for this page (raw
+ *   HTML, or a fragment inserted into `layout` when one is supplied)
+ * @property {string} permalink the output-directory-relative file path,
+ *   already normalized (no leading slash)
+ * @property {string} [layout] a layout file name relative to the layouts
+ *   directory this module writes; omitted pages are written byte-for-byte
+ *   with no wrapping
+ * @property {Record<string, unknown>} [data] extra front-matter data made
+ *   available to the layout (e.g. `title`, `lang`)
+ */
+
+/**
+ * The one skeleton layout this repository ships. It is core-owned static
+ * markup, not discovered from or influenced by the author repository. As of
+ * S2-T06, `{{ content | safe }}` is the page's *complete* body content
+ * (skip link, header, primary navigation, main, footer — see
+ * `internal/skeleton.js`'s `renderPageBody`), so this layout only supplies
+ * the outer document shell, the per-page `lang`/`dir` attributes, the CSP
+ * baseline, the S2-T07 appearance-controller wiring and the S2-T08
+ * SEO/localization `<head>` metadata below; it does not itself wrap
+ * anything in `<main>`.
+ *
+ * The one S2-T04 addition on top of S2-T03's minimal layout is the
+ * byte-exact per-artifact CSP `<meta>` baseline (brief S2 section 3): S2
+ * materializes no module package, configuration, output or runtime, so the
+ * same constant tag is correct on every route.
+ *
+ * S2-T07 additions, all fixed literals from `internal/appearance/contract.js`
+ * (never re-typed here), each byte-identical on every route exactly like the
+ * CSP tag above:
+ *
+ * - the `data-gala-publication-root` presence attribute on `<html>`, always
+ *   rendered independent of JavaScript, so a theme's own no-JS
+ *   `prefers-color-scheme` fallback CSS has a stable root scope to key off;
+ * - `<meta name="color-scheme" content="light dark">`, so user-agent styling
+ *   (form controls, scrollbars) and the initial paint already follow
+ *   `prefers-color-scheme` before any script runs;
+ * - the one `<script src>` this renderer ever emits (brief S2 section 3:
+ *   "the appearance controller is the only browser bootstrap"): a plain,
+ *   same-origin, non-`defer`/non-`async`/non-`module` classic script, placed
+ *   after the CSP `<meta>` so it is governed by the policy it declares.
+ *   Being a blocking `<script src>` in `<head>`, it always finishes running
+ *   — synchronously resolving and applying the appearance state — before
+ *   `<body>` (and so any themed paint) is even parsed, satisfying the
+ *   pre-paint requirement with no visibility-hiding trick of any kind (see
+ *   `internal/appearance/bootstrap-script.js`'s own module documentation).
+ *   Its `href` (S2-T12 basePath fix) is supplied per-page as
+ *   `data.appearanceScriptHref`, already `basePath`-joined by the caller
+ *   (`internal/appearance/contract.js`'s `appearanceBootstrapScriptHref`),
+ *   never a literal embedded in this fixed layout source.
+ *
+ * S2-T08 adds every other `<head>` element: a viewport meta, an optional
+ * plain-text description, an optional `robots` directive
+ * (`internal/page-kinds.js`'s per-page-kind `robotsContent`), an optional
+ * canonical link, Open Graph and Twitter Card meta tags and the Atom/RSS
+ * feed discovery links (present on every page, unconditionally — the feeds
+ * themselves are site-wide, not per-page). S2-T12 adds the theme stylesheet
+ * `<link>` elements (`internal/theme-assets.js`, in `cssLayers` order,
+ * including the print stylesheet hookup that used to be a fixed literal
+ * line here) as one already-rendered `data.themeStylesheetLinksHtml`
+ * fragment, and the `data-gala-page-kind` attribute on `<body>`
+ * (`internal/page-kinds.js`'s `PAGE_KIND_ATTRIBUTE`). Every interpolated
+ * `{{ variable }}`
+ * below relies on Nunjucks' own default `autoescape: true` (verified: no
+ * `nunjucksEnvironmentOptions.autoescape` override exists anywhere in this
+ * repository or in `@11ty/eleventy`'s own source, so Nunjucks' own
+ * documented default stands) for HTML-entity escaping — the same implicit
+ * contract `{{ title }}` already relied on before S2-T08; only
+ * `{{ content | safe }}` is deliberately exempted, because that value is
+ * already sanitized HTML markup, not plain text.
+ *
+ * @type {string}
+ */
+const SKELETON_LAYOUT_SOURCE = [
+  '<!doctype html>',
+  `<html lang="{{ lang }}" dir="{{ dir }}" ${APPEARANCE_ROOT_ATTRIBUTE}>`,
+  '<head>',
+  '<meta charset="utf-8">',
+  '<meta name="viewport" content="width=device-width, initial-scale=1">',
+  contentSecurityPolicyMetaTag(),
+  `<meta name="color-scheme" content="${COLOR_SCHEME_META_CONTENT}">`,
+  '<script src="{{ appearanceScriptHref }}"></script>',
+  '<title>{{ title }}</title>',
+  '{% if description %}<meta name="description" content="{{ description }}">{% endif %}',
+  '{% if robotsContent %}<meta name="robots" content="{{ robotsContent }}">{% endif %}',
+  '{% if canonicalUrl %}<link rel="canonical" href="{{ canonicalUrl }}">{% endif %}',
+  '<meta property="og:site_name" content="{{ siteName }}">',
+  '{% if canonicalUrl %}<meta property="og:url" content="{{ canonicalUrl }}">{% endif %}',
+  '<meta property="og:type" content="{{ ogType }}">',
+  '<meta property="og:title" content="{{ title }}">',
+  '{% if description %}<meta property="og:description" content="{{ description }}">{% endif %}',
+  '{% if ogImage %}<meta property="og:image" content="{{ ogImage }}">{% endif %}',
+  '<meta name="twitter:card" content="{{ twitterCard }}">',
+  '<meta name="twitter:title" content="{{ title }}">',
+  '{% if description %}<meta name="twitter:description" content="{{ description }}">{% endif %}',
+  '{% if ogImage %}<meta name="twitter:image" content="{{ ogImage }}">{% endif %}',
+  '<link rel="alternate" type="application/atom+xml" href="{{ atomFeedUrl }}" title="{{ siteName }}">',
+  '<link rel="alternate" type="application/rss+xml" href="{{ rssFeedUrl }}" title="{{ siteName }}">',
+  '{{ themeStylesheetLinksHtml | safe }}',
+  '</head>',
+  `<body ${PAGE_KIND_ATTRIBUTE}="{{ pageKind }}">`,
+  '{{ content | safe }}',
+  '</body>',
+  '</html>',
+  '',
+].join('\n');
+
+const LAYOUT_FILE_NAME = 'skeleton.njk';
+
+/**
+ * Render every supplied page through a fully confined, single-pass,
+ * programmatic Eleventy 3.1.6 build.
+ *
+ * @param {object} options render options
+ * @param {readonly EleventyPage[]} options.pages pages to emit, already
+ *   carrying their final output-relative permalink
+ * @param {string} options.inputDirectory an absolute, empty-or-caller-owned
+ *   directory Eleventy may treat as its input root (only
+ *   `${inputDirectory}/_includes/skeleton.njk` is written into it)
+ * @param {string} options.outputDirectory an absolute directory Eleventy
+ *   writes the candidate publication into
+ * @returns {Promise<void>} resolves once the single build pass completes
+ */
+export async function renderPagesWithEleventy({
+  pages,
+  inputDirectory,
+  outputDirectory,
+}) {
+  const { mkdir, writeFile } = await import('node:fs/promises');
+  const path = await import('node:path');
+
+  const includesDirectory = path.join(inputDirectory, '_includes');
+  await mkdir(includesDirectory, { recursive: true });
+  await writeFile(
+    path.join(includesDirectory, LAYOUT_FILE_NAME),
+    SKELETON_LAYOUT_SOURCE,
+    'utf8',
+  );
+
+  const eleventy = new Eleventy(inputDirectory, outputDirectory, {
+    source: 'script',
+    runMode: 'build',
+    dryRun: false,
+    quietMode: true,
+    // Explicit falsy configPath: skip .eleventy.js/eleventy.config.*
+    // discovery entirely rather than searching process.cwd().
+    configPath: false,
+    config(eleventyConfig) {
+      eleventyConfig.setUseGitIgnore(false);
+      eleventyConfig.setLayoutsDirectory('_includes');
+      eleventyConfig.setQuietMode(true);
+      eleventyConfig.setDataDeepMerge(false);
+
+      for (const page of pages) {
+        eleventyConfig.addTemplate(page.virtualPath, page.content, {
+          permalink: page.permalink,
+          layout: page.layout,
+          templateEngineOverride: false,
+          ...page.data,
+        });
+      }
+    },
+  });
+
+  // Eleventy's "Wrote N files" summary is logged with `force: true`
+  // regardless of quiet mode (its own `logFinished()` caller intentionally
+  // bypasses verbosity). `disableLogger()` is Eleventy's own documented
+  // escape hatch for that: it marks the console logger disabled so this
+  // library call produces no stdout/stderr output of its own; the caller
+  // decides what, if anything, to report.
+  eleventy.disableLogger();
+
+  await eleventy.write();
+}

package/src/core/internal/feeds.js

@@ -0,0 +1,161 @@
+/**
+ * RSS 2.0 and Atom 1.0 feed generation (task packet S2-T08; brief S2
+ * section 3 "Required generated outputs": "RSS and Atom feeds").
+ *
+ * Both feeds are built from the exact same {@link selectPublishedArticles}
+ * selection and ordering `internal/page-kinds.js`'s `index` page kind
+ * paginates (most recently published first, `publishedAt` descending, tied
+ * broken by ascending `id`), so a feed's item order can never drift from the
+ * site's own index listing. Every URL is an absolute `https://` URL resolved
+ * against `buildInput.baseUrl` (brief S2 section 3: "absolute URLs from the
+ * build input's public origin"), never a relative path — a feed reader has
+ * no notion of the publication's own base path to resolve a relative URL
+ * against.
+ *
+ * Item count (documented scoped decision, not fixed by the brief or
+ * DEC-097): neither source specifies a maximum feed item count. This module
+ * bounds it at {@link FEED_ITEM_LIMIT} — a conservative, deterministic
+ * default with no author-facing configuration surface in S2, matching this
+ * renderer's own established style for an unspecified numeric bound (see
+ * `internal/page-kinds.js`'s `LISTING_PAGE_SIZE` and the media pipeline
+ * scope decisions in the package README).
+ */
+
+import { escapeHtml } from './skeleton.js';
+import { joinBasePathAndRoute } from './route.js';
+import {
+  contentLastModified,
+  contentRoute,
+  selectPublishedArticles,
+} from './page-kinds.js';
+
+/** @type {number} */
+export const FEED_ITEM_LIMIT = 50;
+
+/** @type {string} the un-joined route the Atom feed is published at. */
+export const ATOM_FEED_ROUTE = '/feed/atom.xml';
+/** @type {string} the un-joined route the RSS feed is published at. */
+export const RSS_FEED_ROUTE = '/feed/rss.xml';
+
+/**
+ * Format an `rfc3339` (`YYYY-MM-DDTHH:mm:ss.000Z`) timestamp as RFC 822/1123
+ * text, the pubDate grammar RSS 2.0 requires. `Date#toUTCString()` always
+ * emits the fixed-width, zero-padded, `GMT`-suffixed form this needs,
+ * deterministically, from a deterministic input.
+ *
+ * @param {string} rfc3339 a validated `rfc3339` timestamp
+ * @returns {string} an RFC 822/1123 date-time string
+ */
+function toRfc822(rfc3339) {
+  return new Date(rfc3339).toUTCString();
+}
+
+/**
+ * Build the deterministic Atom 1.0 and RSS 2.0 feed documents for one
+ * validated `build-input:2.0.0` instance.
+ *
+ * @param {import('../../../types/index.d.ts').NormalizedBuildInput} validatedInput
+ * @returns {{atomXml: string, rssXml: string, atomSelfUrl: string, rssSelfUrl: string}}
+ *   both feed documents' exact UTF-8 text, plus each feed's own absolute
+ *   self URL (for the shared layout's feed-discovery `<link>` tags)
+ */
+export function buildFeeds(validatedInput) {
+  const { publication, authors, content, basePath, baseUrl } = validatedInput;
+  const authorsById = new Map(authors.map((author) => [author.id, author]));
+  const articles = selectPublishedArticles(content).slice(0, FEED_ITEM_LIMIT);
+
+  /**
+   * @param {string} route an un-joined route
+   * @returns {string} the absolute `https://` URL
+   */
+  const absoluteUrl = (route) =>
+    new URL(joinBasePathAndRoute(basePath, route), baseUrl).toString();
+
+  const siteUrl = absoluteUrl('/');
+  const atomSelfUrl = absoluteUrl(ATOM_FEED_ROUTE);
+  const rssSelfUrl = absoluteUrl(RSS_FEED_ROUTE);
+
+  const feedUpdated =
+    articles.length > 0
+      ? contentLastModified(articles[0].frontmatter)
+      : validatedInput.buildEpoch;
+
+  const atomEntries = articles
+    .map((record) => {
+      const { frontmatter } = record;
+      const entryUrl = absoluteUrl(contentRoute(frontmatter));
+      const authorNames = frontmatter.authorIds.map(
+        (id) => authorsById.get(id)?.displayName ?? '',
+      );
+      const authorsXml = authorNames
+        .map((name) => `<author><name>${escapeHtml(name)}</name></author>`)
+        .join('');
+      const summaryXml = frontmatter.description
+        ? `<summary>${escapeHtml(frontmatter.description)}</summary>`
+        : '';
+      return (
+        `<entry>` +
+        `<id>${escapeHtml(entryUrl)}</id>` +
+        `<title>${escapeHtml(frontmatter.title)}</title>` +
+        `<updated>${escapeHtml(contentLastModified(frontmatter))}</updated>` +
+        `<published>${escapeHtml(frontmatter.publishedAt)}</published>` +
+        `<link href="${escapeHtml(entryUrl)}" rel="alternate"/>` +
+        authorsXml +
+        summaryXml +
+        `</entry>`
+      );
+    })
+    .join('');
+
+  const atomXml =
+    '<?xml version="1.0" encoding="UTF-8"?>\n' +
+    '<feed xmlns="http://www.w3.org/2005/Atom">' +
+    `<id>${escapeHtml(siteUrl)}</id>` +
+    `<title>${escapeHtml(publication.title)}</title>` +
+    `<subtitle>${escapeHtml(publication.description)}</subtitle>` +
+    `<updated>${escapeHtml(feedUpdated)}</updated>` +
+    `<link href="${escapeHtml(atomSelfUrl)}" rel="self"/>` +
+    `<link href="${escapeHtml(siteUrl)}" rel="alternate"/>` +
+    atomEntries +
+    '</feed>\n';
+
+  const rssItems = articles
+    .map((record) => {
+      const { frontmatter } = record;
+      const itemUrl = absoluteUrl(contentRoute(frontmatter));
+      const descriptionXml = frontmatter.description
+        ? `<description>${escapeHtml(frontmatter.description)}</description>`
+        : '';
+      return (
+        `<item>` +
+        `<title>${escapeHtml(frontmatter.title)}</title>` +
+        `<link>${escapeHtml(itemUrl)}</link>` +
+        `<guid isPermaLink="true">${escapeHtml(itemUrl)}</guid>` +
+        `<pubDate>${escapeHtml(toRfc822(frontmatter.publishedAt))}</pubDate>` +
+        descriptionXml +
+        `</item>`
+      );
+    })
+    .join('');
+
+  // `atom:link rel="self"` is RSS 2.0's own de-facto self-discovery
+  // convention (no equivalent element exists in the bare RSS 2.0
+  // vocabulary itself), requiring the `atom` namespace declaration on the
+  // root `<rss>` element — the same self-discovery guarantee the Atom feed
+  // above already gets from its native `<link rel="self">` (independent
+  // review request).
+  const rssXml =
+    '<?xml version="1.0" encoding="UTF-8"?>\n' +
+    '<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">' +
+    '<channel>' +
+    `<title>${escapeHtml(publication.title)}</title>` +
+    `<link>${escapeHtml(siteUrl)}</link>` +
+    `<description>${escapeHtml(publication.description)}</description>` +
+    `<lastBuildDate>${escapeHtml(toRfc822(feedUpdated))}</lastBuildDate>` +
+    `<atom:link href="${escapeHtml(rssSelfUrl)}" rel="self" type="application/rss+xml"/>` +
+    rssItems +
+    '</channel>' +
+    '</rss>\n';
+
+  return { atomXml, rssXml, rssSelfUrl, atomSelfUrl };
+}

package/src/core/internal/fs-walk.js

@@ -0,0 +1,38 @@
+/**
+ * Deterministic recursive directory listing.
+ *
+ * Filesystem readdir order is not portable, so every caller that needs a
+ * reproducible route/asset ordering must sort explicitly; this module never
+ * returns raw enumeration order (brief S2 section 3: "no
+ * filesystem-enumeration-order dependence").
+ */
+
+import { readdir } from 'node:fs/promises';
+import path from 'node:path';
+
+/**
+ * List every regular file under `root`, recursively, as POSIX-style
+ * (forward-slash) paths relative to `root`, sorted by UTF-8 byte sequence.
+ *
+ * @param {string} root an absolute directory path
+ * @returns {Promise<string[]>} sorted, root-relative, forward-slash paths
+ */
+export async function listFilesSortedByUtf8Bytes(root) {
+  const entries = await readdir(root, { withFileTypes: true });
+  /** @type {string[]} */
+  const files = [];
+  for (const entry of entries) {
+    const absolute = path.join(root, entry.name);
+    if (entry.isDirectory()) {
+      const nested = await listFilesSortedByUtf8Bytes(absolute);
+      for (const relative of nested) {
+        files.push(`${entry.name}/${relative}`);
+      }
+    } else if (entry.isFile()) {
+      files.push(entry.name);
+    }
+  }
+  return files.sort((a, b) =>
+    Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8')),
+  );
+}

package/src/core/internal/media/avif-probe.js

@@ -0,0 +1,169 @@
+/**
+ * Bounded AVIF (ISOBMFF) container validation and declared-dimension
+ * extraction.
+ *
+ * Scope decision (documented, not silently assumed, and identical in spirit
+ * to `webp-probe.js`): this module walks the ISOBMFF box structure closely
+ * enough to confirm an `ftyp` box with major brand `avif`, locate the
+ * `meta` box, and read the primary item's `ispe` (image spatial extents)
+ * property for declared width/height, but it does not run a full AV1
+ * bitstream decode. DEC-097's closed `gala-theme-binary-assets-v2` profile
+ * requires a complete single-frame AV1 decode for *passive theme assets*;
+ * an equivalent from-scratch AV1 decoder for *author media* is out of
+ * proportion to this task's scope, flagged to the orchestrator as a
+ * follow-up. AVIF is therefore admitted as a *source* reference
+ * (recorded, digest-verified, dimension-bounded) with no generated
+ * responsive derivative; its original bytes pass through as the sole asset
+ * entry, exactly like WebP.
+ *
+ * The box walk is bounded: at most 4,096 boxes are visited (matching
+ * DEC-097's own "4,096 container structures" isolation bound for the binary
+ * decoder family) and every box's declared size is checked against the
+ * remaining buffer length before it is used to slice, so a malformed or
+ * adversarial box table cannot cause an out-of-bounds read or an unbounded
+ * walk.
+ */
+
+import { MediaPipelineError } from '../../errors.js';
+import { assertDimensionsWithinCeiling } from './limits.js';
+
+const MAX_BOXES_VISITED = 4096;
+
+/**
+ * Walk one ISOBMFF box list, bounded, yielding `{type, start, end}` for each
+ * top-level box.
+ *
+ * @param {Buffer} bytes the buffer to walk
+ * @param {number} start the offset to begin walking at
+ * @param {number} end the exclusive offset to stop walking at
+ * @param {{count: number}} budget a shared box-count budget, mutated
+ * @param {string} referencePath the source path, for error messages
+ * @returns {{type: string, start: number, end: number}[]} the boxes found
+ */
+function walkBoxes(bytes, start, end, budget, referencePath) {
+  /** @type {{type: string, start: number, end: number}[]} */
+  const boxes = [];
+  let offset = start;
+  while (offset < end) {
+    if (offset + 8 > end) {
+      throw new MediaPipelineError(
+        'MEDIA_FORMAT_INVALID',
+        'truncated ISOBMFF box header',
+        referencePath,
+      );
+    }
+    budget.count += 1;
+    if (budget.count > MAX_BOXES_VISITED) {
+      throw new MediaPipelineError(
+        'MEDIA_RESOURCE_EXCEEDED',
+        'AVIF container exceeds the admitted box-count ceiling',
+        referencePath,
+      );
+    }
+    const size = bytes.readUInt32BE(offset);
+    const type = bytes.subarray(offset + 4, offset + 8).toString('ascii');
+    if (size < 8 || offset + size > end) {
+      throw new MediaPipelineError(
+        'MEDIA_FORMAT_INVALID',
+        `ISOBMFF box "${type}" has an invalid or overflowing size`,
+        referencePath,
+      );
+    }
+    boxes.push({ type, start: offset, end: offset + size });
+    offset += size;
+  }
+  return boxes;
+}
+
+/**
+ * Validate an AVIF container and return its declared primary-item
+ * dimensions.
+ *
+ * @param {Buffer} bytes complete AVIF file bytes
+ * @param {string} referencePath the source path, for error messages
+ * @returns {{width: number, height: number}} the declared dimensions
+ */
+export function probeAvif(bytes, referencePath) {
+  const budget = { count: 0 };
+  const topLevel = walkBoxes(bytes, 0, bytes.length, budget, referencePath);
+  const ftyp = topLevel.find((box) => box.type === 'ftyp');
+  if (!ftyp) {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      'missing ftyp box',
+      referencePath,
+    );
+  }
+  const majorBrand = bytes
+    .subarray(ftyp.start + 8, ftyp.start + 12)
+    .toString('ascii');
+  if (majorBrand !== 'avif') {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      `unsupported ftyp major brand "${majorBrand}"; only "avif" is admitted`,
+      referencePath,
+    );
+  }
+
+  const meta = topLevel.find((box) => box.type === 'meta');
+  if (!meta) {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      'missing meta box',
+      referencePath,
+    );
+  }
+  // `meta` is a full box: 4 bytes of version/flags precede its child boxes.
+  const metaChildren = walkBoxes(
+    bytes,
+    meta.start + 12,
+    meta.end,
+    budget,
+    referencePath,
+  );
+  const iprp = metaChildren.find((box) => box.type === 'iprp');
+  if (!iprp) {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      'missing iprp box',
+      referencePath,
+    );
+  }
+  const iprpChildren = walkBoxes(
+    bytes,
+    iprp.start + 8,
+    iprp.end,
+    budget,
+    referencePath,
+  );
+  const ipco = iprpChildren.find((box) => box.type === 'ipco');
+  if (!ipco) {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      'missing ipco box',
+      referencePath,
+    );
+  }
+  const ipcoChildren = walkBoxes(
+    bytes,
+    ipco.start + 8,
+    ipco.end,
+    budget,
+    referencePath,
+  );
+  const ispe = ipcoChildren.find((box) => box.type === 'ispe');
+  if (!ispe || ispe.end - ispe.start < 20) {
+    throw new MediaPipelineError(
+      'MEDIA_FORMAT_INVALID',
+      'missing or malformed ispe property',
+      referencePath,
+    );
+  }
+  // ispe is a full box: 4 bytes header + 4 bytes version/flags, then two
+  // 32-bit big-endian dimensions.
+  const width = bytes.readUInt32BE(ispe.start + 12);
+  const height = bytes.readUInt32BE(ispe.start + 16);
+
+  assertDimensionsWithinCeiling(width, height, referencePath, 'AVIF');
+  return { width, height };
+}

package/src/core/internal/media/font-policy.js

@@ -0,0 +1,56 @@
+/**
+ * Font policy for `appearance.fontAssets` (brief S2 section 3: "Custom fonts
+ * require licensing, glyph and language coverage plus fallback evidence, and
+ * no remote font is ever retrieved").
+ *
+ * `build-input:2.0.0`'s `resolvedFile` shape (the only shape
+ * `appearance.fontAssets` entries use) is `{path, sourceDigest}` — a
+ * repository-relative path plus a digest, nothing else. There is no
+ * schema-carried field anywhere in `build-input` for a font's license text,
+ * glyph set, or language-coverage claim (`grep`-verified against the
+ * published `@rathnasgala2/schemas` package); a custom font's licensing,
+ * glyph-coverage and fallback *evidence* is therefore necessarily an
+ * authoring-process and documentation concern outside this schema's data
+ * model, not a field this renderer can validate — this repository's README
+ * states that requirement in those terms rather than fabricating a
+ * validation step against a field that does not exist. What this module
+ * *does* enforce, structurally, for every font this pipeline processes:
+ *
+ * - the file is bounded WOFF2 (exact `wOF2` signature, size at most
+ *   `MAX_FONT_SOURCE_BYTES`) — anything else is `MEDIA_FONT_FORMAT_INVALID`;
+ * - `resolvedFile.path` is always a `repoRelativePath` (schema-enforced
+ *   before this renderer ever runs: no scheme, no host, no `://`), so a
+ *   remote font reference cannot enter `build-input` in the first place, and
+ *   this pipeline never performs a network fetch to resolve one — "no
+ *   remote font is ever retrieved" holds by construction, not by a runtime
+ *   check with something to catch.
+ */
+
+import { MediaPipelineError } from '../../errors.js';
+import { MAX_FONT_SOURCE_BYTES } from './limits.js';
+
+const WOFF2_SIGNATURE = Buffer.from([0x77, 0x4f, 0x46, 0x32]); // "wOF2"
+
+/**
+ * Validate one font asset's bytes are bounded WOFF2.
+ *
+ * @param {Buffer} bytes complete font file bytes
+ * @param {string} referencePath the source path, for error messages
+ * @returns {void}
+ */
+export function assertFontPolicy(bytes, referencePath) {
+  if (bytes.length > MAX_FONT_SOURCE_BYTES) {
+    throw new MediaPipelineError(
+      'MEDIA_RESOURCE_EXCEEDED',
+      `font source is ${bytes.length} bytes, exceeding the ${MAX_FONT_SOURCE_BYTES}-byte ceiling`,
+      referencePath,
+    );
+  }
+  if (bytes.length < 4 || !bytes.subarray(0, 4).equals(WOFF2_SIGNATURE)) {
+    throw new MediaPipelineError(
+      'MEDIA_FONT_FORMAT_INVALID',
+      'font is not a WOFF2 file (missing "wOF2" signature); no other font format is admitted as author media',
+      referencePath,
+    );
+  }
+}