@rathnasgala2/template 3.0.1 → 3.2.0

package/README.md

@@ -35,10 +35,11 @@ mistaken for an HTML route:
 
 - **Bounded decode.** JPEG (via the pinned pure-JS `jpeg-js` decoder, no native
   addon or WebAssembly) and PNG (hand-written, using Node's built-in `zlib` with
-  a decompression-bomb-bounded inflate) are fully decoded to RGBA8; WebP and
-  AVIF get bounded container/declared-dimension validation without a full
-  entropy decode (a documented scope decision — see
-  `webp-probe.js`/`avif-probe.js`). Every format shares one set of resource
+  a decompression-bomb-bounded inflate) are fully decoded to RGBA8; WebP, AVIF
+  and GIF get bounded container/declared-dimension validation without a full
+  entropy decode, and their original bytes pass through unmodified (a documented
+  scope decision — see `webp-probe.js`/`avif-probe.js`/ `gif-probe.js`; an
+  animated GIF keeps its animation). Every format shares one set of resource
   ceilings in `limits.js` (raster dimension, pixel count, decoded-buffer and
   source-byte caps reused from the theme package's own closed binary-asset
   decoder bounds, plus this renderer's own documented per-publication ceilings).
@@ -61,13 +62,86 @@ mistaken for an HTML route:
   structurally.
 - **Fail-closed errors.** Every rejection — oversize, decompression bomb, digest
   mismatch, SVG, unrecognized format, invalid font — is a `MediaPipelineError`
-  with a stable `reasonCode`, thrown before the manifest is assembled.
+  with a stable `reasonCode`, thrown before anything is written.
 
 `options.sourceDirectory` is the caller-mounted, read-only repository source
 tree `build-input`'s `resolvedFile` references point into; every referenced
 file's bytes are read from there and verified against `build-input`'s declared
 `sourceDigest` before being decoded.
 
+### Content images
+
+Every `<img>` in a rendered body must name an image file `build-input`
+inventories for that document in `content[].media[]` (an entry whose `mediaType`
+is `image/png`, `image/jpeg`, `image/webp`, `image/avif` or `image/gif`). The
+`src` is resolved by one rule (`src/core/internal/media/content-images.js`): it
+is entity-decoded; a scheme, a protocol-relative `//`, a query or a fragment
+never resolves; one leading `/` or `./` is dropped (paths are
+repository-root-relative); the rest is percent-decoded and NFC-normalized; an
+empty, `.` or `..` segment never resolves; the result must equal an inventoried
+`path`. The publication profile and the footer card (checked only when enabled,
+since only then is it rendered) have no inventory, so an image there never
+resolves.
+
+An image that resolves to nothing (a remote image included: the render policy
+already strips its `src`) fails the build with `BuildInputValidationError`, one
+`MEDIA_REFERENCE_UNRESOLVED` diagnostic per image (`instancePointer` names the
+body, `reference` the `src`), before anything is written. An inventoried file
+the media pipeline rejects fails with that `MediaPipelineError` reason code,
+also before anything is written.
+
+A resolved image runs through the media pipeline and renders as
+`<img src srcset sizes="(max-width: 960px) 100vw, 960px" alt width height loading="lazy" decoding="async">`:
+`srcset` names every output file in ascending width (PNG/JPEG: each fixed
+derivative width below the source plus the re-encoded original; GIF, WebP and
+AVIF: the original only), and `src` is the widest of them no wider than 960
+pixels, or the original when none is. `alt` is the authored text. The feeds
+carry the same `src` as an absolute URL, without `srcset`. Only pipeline output
+is written: the source file is never copied, and identical bytes under two paths
+are processed and written once. Images use the base layer's existing `img`
+rules; no class is added. The front-matter `hero` renders as the article's cover
+`<figure>` above the body (`role: "decorative"` renders `alt=""`).
+
+### Editions
+
+A document of `kind: "edition"` restates one article at another depth. Its front
+matter's `edition` object names the article (`of`, the article's slug) and the
+depth (`kind`: `QUICK_READ`, `STANDARD` or `DEEP_DIVE`), and `build-input`
+carries it as an ordinary `content[]` record. Whether an edition is current is
+decided before the build input exists, so an edition that arrives is rendered as
+given. An edition is a content kind, not a module: the renderer runs no
+generation and has no Prism runtime.
+
+- **Routes.** `/<slug>/quick-read`, `/<slug>/standard` and `/<slug>/deep-dive`,
+  where `<slug>` is `edition.of` (written as `…/index.html` like every route).
+  The page's `data-gala-page-kind` is `article`, so the published page-kind
+  hooks do not change. Reactions and comments stay on the article; an edition
+  page carries none.
+- **The article stays the reference.** `<link rel="canonical">` and `og:url`
+  name the article, the robots directive is `noindex, follow`, and the
+  structured data is a `WebPage` with a breadcrumb back to the article.
+- **Never listed.** An edition is in no index, tag, series, archive or author
+  listing, feed, `sitemap.xml`, `search-index.json`, `llms.txt` or
+  `llms-full.txt`, and it does not move the footer's copyright year.
+- **Selector.** The article and each of its editions carry one
+  `<nav aria-label="Editions">` of links, in the `edition-selector` slot at the
+  end of the article head: Original, Quick read, Standard, Deep dive in that
+  order, only the kinds that exist, the page being read marked
+  `aria-current="page"`. An `unlisted` edition is not listed, except on its own
+  page. An edition page adds the line "Generated edition, reviewed by the
+  author; the original is the reference". The links are plain anchors; nothing
+  needs JavaScript. The strings come from the message catalog, and the markup
+  reuses the base layer's `g-pills`, `g-pill` and `g-label` hooks, so the
+  published theme styling contract does not change.
+- **Cover.** An edition with no `hero` or social image of its own uses its
+  article's.
+- **Fails closed.** Before anything is written, `BuildInputValidationError`
+  carries one diagnostic per edition that cannot be placed:
+  `EDITION_ORIGINAL_UNRESOLVED` (`edition.of` names no article of the build),
+  `EDITION_DUPLICATE` (two editions of one article at one depth) and
+  `EDITION_ROUTE_CONFLICT` (the route is already another document's route or
+  redirect).
+
 The complete output-security pipeline (`src/core/internal/content-security.js`)
 sits on top of that adapter. **Division of labour** (normalization replaces an
 authored body path with a `renderableBody` carrying "the deterministic policy
@@ -153,23 +227,29 @@ output-security pipeline every generated page still passes through:
   `header-actions` slot), one primary `<nav>` from `navigationNormalized.items`,
   one `<main id="main-content">` (an optional breadcrumb `<nav>` before the
   page's own single `<h1>`), and one `<footer>` (publication name, footer
-  navigation, the `footer-profile` slot, the remaining core slots, and the
-  template attribution line). Core owns nine versioned semantic slots
-  (`header-actions`, `article-preamble`, `article-end`, `footer-profile`,
-  `footer-auxiliary`, `account-intent`, `conversation`, `newsletter`,
-  `edition-selector`) plus the collapsed `article-footer-ad` slot: every slot is
-  one `data-gala-slot="<name>"` attribute on an otherwise empty, non-landmark
-  `<div>`, and the collapsed slot additionally carries `hidden`. This renderer
-  has no module system, so every slot except `footer-profile` (which always
-  wraps the publication's own footer card) and `header-actions` (the appearance
-  control, core content rather than a module) renders empty. This module also
-  renders breadcrumbs and deterministic pagination controls
-  (`rel="prev"`/`rel="next"`, an `aria-current="page"` status).
+  navigation, the `footer-profile` slot, the remaining footer slots
+  (`footer-auxiliary`, `account-intent`, `conversation`, `newsletter`), and the
+  "Made with Galascribe" attribution line, which
+  `appearance.attribution.showMadeWith: false` omits). Core owns nine versioned
+  semantic slots (`header-actions`, `article-preamble`, `article-end`,
+  `footer-profile`, `footer-auxiliary`, `account-intent`, `conversation`,
+  `newsletter`, `edition-selector`) plus the collapsed `article-footer-ad` slot:
+  every slot is one `data-gala-slot="<name>"` attribute on an otherwise empty,
+  non-landmark `<div>`, and the collapsed slot additionally carries `hidden`.
+  This renderer has no module system, so every slot except `footer-profile`
+  (which always wraps the publication's own footer card), `header-actions` (the
+  appearance control, core content rather than a module) and `edition-selector`
+  (see Editions) renders empty. `edition-selector` is rendered by the article
+  page kind at the end of the article head, only where there is an edition to
+  offer, not in the footer. This module also renders breadcrumbs and
+  deterministic pagination controls (`rel="prev"`/`rel="next"`, an
+  `aria-current="page"` status).
 - **`src/core/internal/page-kinds.js`** builds every generated page kind from a
   validated `build-input:2.0.0`: `profile` (the optional publication profile),
   `author` (one page per `build-input.authors` entry, at `/authors/<id>`),
-  `article`/`page` (one page per `content[]` record, at its own route), `index`
-  (a paginated reverse-chronological listing of every `status: "published"`,
+  `article`/`page` (one page per `content[]` record, at its own route; a
+  `kind: "edition"` record renders beside its article, see Editions), `index` (a
+  paginated reverse-chronological listing of every `status: "published"`,
   `kind: "article"` record — an `unlisted` record is reachable only by its own
   direct route, never through a generated listing), `tag`/`series` (one listing
   page per distinct authored value, plus a `/tags`/`/series` root page linking
@@ -424,6 +504,10 @@ numbers:
 - decode/resource ceilings reuse the theme binary-asset profile's numbers
   (dimension, pixel-count, decoded-buffer, source-byte caps), since the
   decode-bomb risk they defend against is identical regardless of asset class;
+  the JPEG decoder's own memory knob counts its whole working set (coefficient
+  and line buffers as well as the RGBA output), so it is sized for an image at
+  the pixel ceiling at 32 bytes per pixel (512 MiB) rather than to the RGBA
+  output alone, which rejected every JPEG above about three to five megapixels;
 - responsive derivative widths (`320/640/960/1280/1920`), JPEG derivative
   quality (`82`), and the per-publication image/font count and aggregate byte
   ceilings are this renderer's own conservative choices;
@@ -431,7 +515,12 @@ numbers:
   VP8/VP8L/AV1 entropy decode or derivative generation — hand-authoring an
   independently verifiable decoder for either format was judged out of
   proportion to this task, and is flagged as a follow-up rather than attempted
-  partially.
+  partially;
+- GIF gets a bounded block-structure walk (signature, logical screen and every
+  frame within the dimension ceilings, every sub-block chain inside the file, at
+  least one image, the trailer as the last byte) and passes through unmodified:
+  this renderer carries no GIF encoder, so an animation is never resized, and
+  any comment or application extension is served as authored.
 
 Every remaining "Required generated output" from this renderer's own governing
 brief sits on top of the page kinds above:
@@ -440,15 +529,15 @@ brief sits on top of the page kinds above:
   (`/feed/atom.xml`) and RSS 2.0 (`/feed/rss.xml`) documents over the exact
   reverse-chronological `status: "published"`, `kind: "article"` selection
   `internal/page-kinds.js`'s `index` page kind paginates (the shared
-  `selectPublishedArticles` export), every item URL absolute against
-  `buildInput.baseUrl`, bounded to the most recent 50 entries (documented scoped
-  decision — neither the brief nor this renderer's own styling decision fixes a
-  feed item count).
+  `selectPublishedArticles` export; editions are never in it), every item URL
+  absolute against `buildInput.baseUrl`, bounded to the most recent 50 entries
+  (documented scoped decision — neither the brief nor this renderer's own
+  styling decision fixes a feed item count).
 - **Sitemap** (`src/core/internal/sitemap.js`): `/sitemap.xml` over every page
   `internal/page-kinds.js` generated that this renderer did not itself mark
-  `noindex` (unlisted content), deterministically sorted by each entry's own
-  absolute URL, with `<lastmod>` sourced from each page's own authored
-  `publishedAt`/`updatedAt` — never build time.
+  `noindex` (unlisted content and editions), deterministically sorted by each
+  entry's own absolute URL, with `<lastmod>` sourced from each page's own
+  authored `publishedAt`/`updatedAt` — never build time.
 - **Static search index** (`src/core/internal/search-index.js`):
   `/search-index.json`, a deterministic JSON document indexing every published
   `article`/`page` record's title, description, a bounded plain-text excerpt,
@@ -459,13 +548,14 @@ brief sits on top of the page kinds above:
   C).
 - **SEO/Open-Graph/Twitter/localization metadata**: every generated page's
   `<head>` now carries a viewport meta, an optional description, an optional
-  `robots` directive (`noindex, follow` for `status: "unlisted"` content and for
-  the generated `404.html`), a canonical link, `og:*`/ `twitter:*` meta tags
-  (image resolved to an absolute content-addressed media derivative URL via
-  `internal/seo.js`, never the raw source path) and the Atom/RSS feed-discovery
-  `<link>`s. **hreflang** is a documented scope decision, not a silent omission:
-  `build-input:2.0.0` has no translation/locale-variant linkage between distinct
-  `content[]` records (see `internal/seo.js`'s module documentation), so no
+  `robots` directive (`noindex, follow` for `status: "unlisted"` content, for
+  editions and for the generated `404.html`), a canonical link, `og:*`/
+  `twitter:*` meta tags (image resolved to an absolute content-addressed media
+  derivative URL via `internal/seo.js`, never the raw source path) and the
+  Atom/RSS feed-discovery `<link>`s. **hreflang** is a documented scope
+  decision, not a silent omission: `build-input:2.0.0` has no
+  translation/locale-variant linkage between distinct `content[]` records (see
+  `internal/seo.js`'s module documentation), so no
   `<link rel="alternate" hreflang="...">` is ever emitted by this renderer.
 - **Search and assistant discovery** (3.0.0, unpublished). Every page carries
   one `<script type="application/ld+json">` data block
@@ -481,9 +571,9 @@ brief sits on top of the page kinds above:
   `width` and `height` from the media pipeline; the article cover and the home
   hero are `fetchpriority="high"`, all other images
   `loading="lazy" decoding="async"`. Feeds carry the full sanitized body
-  (`content:encoded` in RSS, `<content type="html">` in Atom), authors and
-  categories. Author pages live at `/authors/<name-slug>` (the id when two names
-  collide).
+  (`content:encoded` in RSS, `<content type="html">` in Atom; each image as its
+  absolute media-derivative URL), authors and categories. Author pages live at
+  `/authors/<name-slug>` (the id when two names collide).
 - **`robots.txt`, `llms.txt`, `llms-full.txt`** (`internal/robots.js`,
   `internal/llms.js`). `robots.txt` allows all crawlers and names the absolute
   sitemap; `publication.crawlers.ai: "block"` (validated by the build-input
@@ -493,7 +583,7 @@ brief sits on top of the page kinds above:
   a GitHub project site) must have the same file at its host root. `llms.txt`
   follows llmstxt.org (`# title`, `> description`, `## Articles`, `## Series`,
   `## Optional`); `llms-full.txt` is every published article as plain text.
-  Unlisted content is excluded from both.
+  Unlisted content and editions are excluded from both.
 - **`404.html`**: the `error` page kind's pure `renderErrorPageBody`, now
   actually wired into `renderPublication` at the fixed `errorDocumentKey`
   (`internal/route.js#errorDocumentPath`) — `404.html` at the root, or
@@ -551,7 +641,7 @@ npm run format          # apply Prettier
 npm run format:check    # CI check
 npm run lint            # ESLint flat config
 npm run typecheck       # tsc --checkJs --noEmit against types/index.d.ts
-npm run architecture    # dependency-cruiser: no src/modules/, no circular deps
+npm run architecture    # dependency-cruiser: core never imports src/modules, no circular deps
 npm run duplication     # jscpd, 3% / 50 tokens
 npm run contracts:generate  # (re)write contracts/*.jcs from their reviewed source modules
 npm run contracts:check     # fail if committed contracts drifted
@@ -569,23 +659,28 @@ npm run audit               # npm audit --audit-level=high
 ## Package layout
 
 ```text
-src/core/                                # the only source root
+src/core/                                # the renderer
+src/modules/interactions/browser/        # the reader-interactions browser script (emitted as data)
 contracts/render-policy.jcs              # normalized-body policy identity (real content)
 contracts/theme-styling-contract.jcs     # published styling catalog (real and closed)
 ```
 
-No `src/modules/` tree, module import edge, registration stub, module
-configuration, module output or module runtime is ever admitted beside
-`src/core/`. `test/module-tree-absence.test.js` and `.dependency-cruiser.cjs`'s
-`only-src-core-is-a-source-root` rule both enforce this; `interactions`,
-`whitelabel`, `newsletter` and `prism` have no module directory, package,
-configuration schema, stub, output, runtime code, network target or
-compatibility promise in this MVP.
+`src/core/` and `src/modules/interactions/` are the only source roots, and
+`src/core` never imports from `src/modules`: the interactions browser script is
+read from disk and emitted as `assets/gala-interactions-v1.js` when
+`build-input.modules.interactions` is present.
+`test/module-tree-absence.test.js`, `.dependency-cruiser.cjs` and the ESLint
+`no-restricted-imports` rule enforce this. `newsletter` and `prism` have no
+module directory, package, configuration schema, stub, output or runtime code in
+this MVP. Whitelabel is not a module either: the footer's "Made with Galascribe"
+line is a core appearance switch, `build-input.appearance.attribution`
+(`showMadeWith: false` omits the line; absent or `true` shows it). Nor are
+editions: they are a rendered content kind (see Editions).
 
 ## Consuming `@rathnasgala2/schemas`
 
-This repository consumes `@rathnasgala2/schemas@3.0.0` from the public npm
-registry, declared as `"@rathnasgala2/schemas": "3.0.0"` (exact pin, no range)
+This repository consumes `@rathnasgala2/schemas@3.3.0` from the public npm
+registry, declared as `"@rathnasgala2/schemas": "3.3.0"` (exact pin, no range)
 so `package-lock.json` records the resolved version and integrity hash. The
 LOCAL-1/LOCAL-39 local-tarball convention
 (`file:../../local-packages/rathnasgala2-schemas-*.tgz`) is retired for this

package/contracts/render-policy.jcs

@@ -1 +1 @@
-{"contentSecurityPolicy":"default-src 'none'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; manifest-src 'self'; worker-src 'none'","contentSecurityPolicyHeaderOnlyDirectives":["frame-ancestors 'none'"],"contentSecurityPolicyMeta":"default-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; media-src 'self'; manifest-src 'self'; worker-src 'none'","highlighter":{"grammars":["bash","css","diff","java","javascript","json","jsx","markdown","markup","python","sql","tsx","typescript","yaml"],"package":"@11ty/eleventy-plugin-syntaxhighlight","tokenClasses":["atrule","attr-equals","attr-name","attr-value","bold","boolean","builtin","cdata","char","class-name","comment","constant","content","coord","deleted","deleted-sign","doctype","entity","for-or-select","function","function-variable","important","inserted","inserted-sign","interpolation","interpolation-punctuation","italic","key","keyword","namespace","null","number","operator","prefix","prolog","property","punctuation","regex","rule","selector","shebang","string","symbol","tag","template-punctuation","template-string","title","token","url","variable"],"version":"5.0.2"},"markdownIt":{"options":{"html":false,"linkify":false,"typographer":false},"package":"markdown-it","version":"14.3.1"},"name":"gala-render-policy","sanitizer":{"allowedAttributes":{"a":["href","rel"],"code":["class"],"h1":["id"],"h2":["id"],"h3":["id"],"h4":["id"],"h5":["id"],"h6":["id"],"img":["src","alt"],"ol":["start"],"pre":["class"],"span":["class"]},"allowedTags":["p","br","hr","h1","h2","h3","h4","h5","h6","ul","ol","li","blockquote","pre","code","strong","em","b","i","u","s","del","ins","sub","sup","mark","small","wbr","a","img","table","thead","tbody","tr","th","td","dl","dt","dd","figure","figcaption","span"],"allowedUrlSchemes":["https","http","mailto"],"package":"sanitize-html","version":"2.17.7"},"version":"2.0.0"}
+{"contentSecurityPolicy":"default-src 'none'; base-uri 'none'; object-src 'none'; frame-ancestors 'none'; form-action 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self' https://api.galascribe.com; media-src 'self'; manifest-src 'self'; worker-src 'none'","contentSecurityPolicyHeaderOnlyDirectives":["frame-ancestors 'none'"],"contentSecurityPolicyMeta":"default-src 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self' https://api.galascribe.com; media-src 'self'; manifest-src 'self'; worker-src 'none'","highlighter":{"grammars":["bash","css","diff","java","javascript","json","jsx","markdown","markup","python","sql","tsx","typescript","yaml"],"package":"@11ty/eleventy-plugin-syntaxhighlight","tokenClasses":["atrule","attr-equals","attr-name","attr-value","bold","boolean","builtin","cdata","char","class-name","comment","constant","content","coord","deleted","deleted-sign","doctype","entity","for-or-select","function","function-variable","important","inserted","inserted-sign","interpolation","interpolation-punctuation","italic","key","keyword","namespace","null","number","operator","prefix","prolog","property","punctuation","regex","rule","selector","shebang","string","symbol","tag","template-punctuation","template-string","title","token","url","variable"],"version":"5.0.2"},"markdownIt":{"options":{"html":false,"linkify":false,"typographer":false},"package":"markdown-it","version":"14.3.1"},"name":"gala-render-policy","sanitizer":{"allowedAttributes":{"a":["href","rel"],"code":["class"],"h1":["id"],"h2":["id"],"h3":["id"],"h4":["id"],"h5":["id"],"h6":["id"],"img":["src","alt"],"ol":["start"],"pre":["class"],"span":["class"]},"allowedTags":["p","br","hr","h1","h2","h3","h4","h5","h6","ul","ol","li","blockquote","pre","code","strong","em","b","i","u","s","del","ins","sub","sup","mark","small","wbr","a","img","table","thead","tbody","tr","th","td","dl","dt","dd","figure","figcaption","span"],"allowedUrlSchemes":["https","http","mailto"],"package":"sanitize-html","version":"2.17.7"},"version":"2.0.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rathnasgala2/template",
-  "version": "3.0.1",
+  "version": "3.2.0",
   "description": "Deterministic Eleventy-backed static publication renderer for Galascribe portable repositories.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,6 +22,7 @@
   "types": "./types/index.d.ts",
   "files": [
     "src/core/",
+    "src/modules/",
     "contracts/",
     "types/",
     "LICENSE",
@@ -52,7 +53,7 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "lint": "eslint .",
-    "typecheck": "tsc --project tsconfig.json",
+    "typecheck": "tsc --project tsconfig.json && tsc --project tsconfig.modules.json",
     "architecture": "depcruise --validate .dependency-cruiser.cjs src contracts eslint.config.js",
     "duplication": "jscpd src scripts test eslint.config.js",
     "contracts:generate": "node scripts/generate-contracts.mjs",
@@ -71,7 +72,7 @@
   "dependencies": {
     "@11ty/eleventy": "3.1.6",
     "@11ty/eleventy-plugin-syntaxhighlight": "5.0.2",
-    "@rathnasgala2/schemas": "3.0.0",
+    "@rathnasgala2/schemas": "3.3.0",
     "jpeg-js": "0.4.4",
     "markdown-it": "14.3.1",
     "sanitize-html": "2.17.7"

package/src/core/index.js

@@ -9,8 +9,13 @@
  * fails closed: an invalid `build-input` is rejected with
  * {@link BuildInputValidationError} before anything is written, malformed
  * adapter options are rejected with {@link RenderOptionsError} before
- * Eleventy ever runs, and a rejected image or font is rejected with
- * {@link MediaPipelineError} before the manifest is assembled.
+ * Eleventy ever runs, a body image that names no inventoried image asset is
+ * rejected with {@link BuildInputValidationError}
+ * (`MEDIA_REFERENCE_UNRESOLVED`) before anything is written, an edition that
+ * names no article in the build, repeats another edition or takes another
+ * document's route is rejected the same way (`EDITION_ORIGINAL_UNRESOLVED`,
+ * `EDITION_DUPLICATE`, `EDITION_ROUTE_CONFLICT`), and a rejected image or font
+ * is rejected with {@link MediaPipelineError} before anything is written.
  *
  * `normalizeAuthoredMarkdown` (re-exported here from
  * `internal/content-security.js`) is this package's second public entry
@@ -83,8 +88,17 @@ import {
   assertPolicyConformantHtml,
   assertRenderPolicyIdentity,
   computeRenderPolicyIdentity,
+  contentSecurityPolicyMetaTag,
 } from './internal/content-security.js';
+import { resolveEditions } from './internal/editions.js';
 import { renderPagesWithEleventy } from './internal/eleventy-render.js';
+import {
+  INTERACTIONS_SCRIPT_MEDIA_TYPE,
+  INTERACTIONS_SCRIPT_PATH,
+  interactionsActive,
+  loadInteractionsScript,
+  validateInteractionsModule,
+} from './internal/interactions.js';
 import {
   ATOM_FEED_ROUTE,
   RSS_FEED_ROUTE,
@@ -92,6 +106,10 @@ import {
 } from './internal/feeds.js';
 import { listFilesSortedByUtf8Bytes } from './internal/fs-walk.js';
 import { getMessages } from './internal/messages.js';
+import {
+  resolveContentImages,
+  rewriteBodyImages,
+} from './internal/media/content-images.js';
 import { processMedia } from './internal/media/pipeline.js';
 import {
   buildGeneratedPages,
@@ -128,7 +146,11 @@ import {
   renderPrimaryNavigation,
 } from './internal/skeleton.js';
 import { renderFooter, renderHeader } from './internal/chrome.js';
-import { createComponents, createMediaImage } from './internal/components.js';
+import {
+  createComponents,
+  createContentImage,
+  createMediaImage,
+} from './internal/components.js';
 import {
   collectIncludedSources,
   compareUtf8Bytes,
@@ -241,8 +263,9 @@ function assertOptions(options) {
  * Verify every `renderableBody.renderPolicy` in the publication profile,
  * footer card and every content record byte-equals the currently published
  * render-policy identity, and that no module or placement value leaked
- * through (belt-and-suspenders on top of the `build-input:2.0.0` schema's
- * own `modules: {}` / `placements: []` closure). Fails closed before any
+ * through (belt-and-suspenders on top of the `build-input` schema's module
+ * closure: only a valid `interactions` module is admitted, `placements` stays
+ * empty). Fails closed before any
  * directory is created or Eleventy ever runs: an absent policy file, wrong
  * path/name/version/digest, mixed identity between records, or body
  * produced under a different policy rejects before build.
@@ -252,14 +275,20 @@ function assertOptions(options) {
  * @returns {Promise<void>} resolves once every reference is verified
  */
 async function assertRenderPolicyCompliance(validatedInput) {
-  if (
-    Object.keys(validatedInput.modules).length !== 0 ||
-    validatedInput.placements.length !== 0
-  ) {
+  const moduleKeys = Object.keys(validatedInput.modules);
+  if (moduleKeys.some((key) => key !== 'interactions')) {
+    throw new RenderPolicyViolationError(
+      'build-input.modules may only carry interactions',
+    );
+  }
+  if (validatedInput.placements.length !== 0) {
     throw new RenderPolicyViolationError(
-      'build-input.modules and build-input.placements must both be empty in S2',
+      'build-input.placements must be empty',
     );
   }
+  if (validatedInput.modules.interactions !== undefined) {
+    validateInteractionsModule(validatedInput.modules.interactions);
+  }
 
   const identity = await computeRenderPolicyIdentity();
 
@@ -321,13 +350,18 @@ export async function renderPublication(buildInput, options) {
     );
 
   await assertRenderPolicyCompliance(validatedInput);
+  // Every body image must name an image asset the build input inventories
+  // for its document; resolved here, from the verified bodies alone, so an
+  // unresolved one fails closed before anything is written.
+  const contentImages = resolveContentImages(validatedInput);
+  // Every edition must sit beside an article of this build; placed here for the
+  // same reason.
+  const editions = resolveEditions(validatedInput.content, contentRoute);
   assertOptions(options);
   const routeProfile = options.routeNormalizationProfile ?? 'directory-index';
 
   const outputDirectory = path.resolve(options.outputDirectory);
   const workDirectory = path.resolve(options.workDirectory);
-  await mkdir(outputDirectory, { recursive: true });
-  await mkdir(workDirectory, { recursive: true });
 
   // The site-wide message catalog for core chrome (skip link, navigation,
   // breadcrumb, pagination and footer labels). Every page's own <html lang>
@@ -343,6 +377,17 @@ export async function renderPublication(buildInput, options) {
     validatedInput.baseUrl,
     validatedInput.basePath,
   );
+  const interactionsModule = validatedInput.modules.interactions;
+  const interactionsOn = interactionsActive(interactionsModule);
+  // One CSP per build: the production policy, plus (local stack only) the
+  // interactions module's differing API origin in `connect-src`.
+  const cspMetaTag = contentSecurityPolicyMetaTag(
+    interactionsModule?.apiOrigin,
+  );
+  const interactionsScriptHref = joinBasePathAndRoute(
+    publicBasePath,
+    `/${INTERACTIONS_SCRIPT_PATH}`,
+  );
   const urlPrefix = derivePublicBasePath(validatedInput.baseUrl, '/');
   const homeRoute = joinPublicRoute(publicBasePath, '/');
 
@@ -362,9 +407,22 @@ export async function renderPublication(buildInput, options) {
     assets: mediaAssets,
     files: mediaFiles,
     dimensions: mediaDimensions,
+    variants: mediaVariants,
   } = await processMedia(validatedInput, {
     sourceDirectory: path.resolve(options.sourceDirectory),
+    contentImages: [...contentImages.values()],
   });
+  // Created only now, after every input and media check has passed, so a
+  // rejected build input or media reference leaves nothing behind.
+  await mkdir(outputDirectory, { recursive: true });
+  await mkdir(workDirectory, { recursive: true });
+  const contentImage = createContentImage({ mediaVariants, publicBasePath });
+  /** @type {(body: string) => string} a body's page form */
+  const pageBody = (body) =>
+    rewriteBodyImages(body, contentImages, contentImage.page);
+  /** @type {(body: string) => string} a body's feed form */
+  const feedBody = (body) =>
+    rewriteBodyImages(body, contentImages, contentImage.feed);
   const mediaImage = createMediaImage({
     mediaAssets,
     publicBasePath,
@@ -381,7 +439,9 @@ export async function renderPublication(buildInput, options) {
   // Already verified render-policy-conformant HTML by
   // assertRenderPolicyCompliance's assertPolicyConformantHtml call above —
   // inserted as-is, never re-parsed as Markdown.
-  const footerProfileHtml = footerCard?.enabled ? footerCard.body.body : '';
+  const footerProfileHtml = footerCard?.enabled
+    ? pageBody(footerCard.body.body)
+    : '';
   const authorsById = new Map(
     validatedInput.authors.map((author) => [author.id, author]),
   );
@@ -414,6 +474,7 @@ export async function renderPublication(buildInput, options) {
       `</div></div>`
     : '';
   const latestYear = validatedInput.content
+    .filter((record) => record.frontmatter.kind !== 'edition')
     .map((record) => record.frontmatter.publishedAt.slice(0, 4))
     .sort()
     .at(-1);
@@ -430,6 +491,9 @@ export async function renderPublication(buildInput, options) {
     authorHtml: footerAuthorHtml,
     footerProfileHtml,
     copyrightText: `${siteMessages.footerCopyrightPrefix} ${latestYear ? `${latestYear} ` : ''}${publication.title}`,
+    // The whitelabel switch: a core appearance setting, not a module.
+    showAttribution:
+      validatedInput.appearance.attribution?.showMadeWith !== false,
     messages: siteMessages,
   });
 
@@ -463,7 +527,7 @@ export async function renderPublication(buildInput, options) {
   // The site-wide feeds, resolved once so every page's feed-discovery
   // `<link>` tags and the feed documents themselves agree on the exact same
   // self URLs.
-  const feeds = buildFeeds(validatedInput);
+  const feeds = buildFeeds(validatedInput, { feedBody });
   const siteName = validatedInput.publication.title;
   const appearanceScriptHrefValue =
     appearanceBootstrapScriptHref(publicBasePath);
@@ -498,9 +562,14 @@ export async function renderPublication(buildInput, options) {
   const redirectProjections = [];
 
   const generatedPages = buildGeneratedPages(validatedInput, {
+    pageBody,
+    editions,
     mediaAssets,
     mediaDimensions,
+    interactions: interactionsOn ? interactionsModule : undefined,
   });
+  /** @type {Set<string>} output paths of the interaction-bearing routes */
+  const interactionBearingPaths = new Set();
   generatedPages.forEach((page, index) => {
     const joinedRoute = joinBasePathAndRoute(
       validatedInput.basePath,
@@ -520,10 +589,12 @@ export async function renderPublication(buildInput, options) {
       basePath: publicBasePath,
     });
     const ogImage = ogImageInfo?.url;
+    const pagePermalink = projectRouteToFilePath(joinedRoute, routeProfile);
+    if (page.interactionBearing) interactionBearingPaths.add(pagePermalink);
     contentPages.push({
       virtualPath: `pages/${page.kind}-${index}.html`,
       content: bodyHtml,
-      permalink: projectRouteToFilePath(joinedRoute, routeProfile),
+      permalink: pagePermalink,
       layout: 'skeleton.njk',
       data: {
         title: page.documentTitle ?? page.title,
@@ -534,7 +605,7 @@ export async function renderPublication(buildInput, options) {
         description: page.description,
         robotsContent: page.robotsContent,
         canonicalUrl: new URL(
-          joinPublicRoute(publicBasePath, page.route),
+          joinPublicRoute(publicBasePath, page.canonicalRoute ?? page.route),
           validatedInput.baseUrl,
         ).toString(),
         siteName,
@@ -552,6 +623,10 @@ export async function renderPublication(buildInput, options) {
         atomFeedUrl: feeds.atomSelfUrl,
         rssFeedUrl: feeds.rssSelfUrl,
         appearanceScriptHref: appearanceScriptHrefValue,
+        interactionsScriptHref: page.interactionBearing
+          ? interactionsScriptHref
+          : undefined,
+        cspMetaTag,
         baseStylesheetHref: baseStylesheetHrefValue,
         themeStylesheetLinksHtml,
       },
@@ -623,6 +698,7 @@ export async function renderPublication(buildInput, options) {
       atomFeedUrl: feeds.atomSelfUrl,
       rssFeedUrl: feeds.rssSelfUrl,
       appearanceScriptHref: appearanceScriptHrefValue,
+      cspMetaTag,
       baseStylesheetHref: baseStylesheetHrefValue,
       themeStylesheetLinksHtml,
     },
@@ -767,7 +843,7 @@ export async function renderPublication(buildInput, options) {
       byteLength: String(bytes.byteLength),
       sha256: digestBytes(bytes),
       routeClass: special?.routeClass ?? 'html',
-      interactionBearing: false,
+      interactionBearing: interactionBearingPaths.has(filePath),
     });
   }
   routes.sort((a, b) => compareUtf8Bytes(a.path, b.path));
@@ -897,10 +973,39 @@ export async function renderPublication(buildInput, options) {
     immutable: false,
   };
 
+  // The reader-interactions browser script, only when the module is on. Its
+  // bytes are the template package's own file, so the asset row is a pure
+  // function of the template version.
+  /** @type {import('../../types/index.d.ts').ManifestAssetEntry[]} */
+  const interactionsAssets = [];
+  if (interactionsOn) {
+    const interactionsScriptBytes = await loadInteractionsScript();
+    const joinedInteractionsScriptPath = projectFixedAssetPath(
+      validatedInput.basePath,
+      `/${INTERACTIONS_SCRIPT_PATH}`,
+    );
+    const interactionsScriptDestination = path.join(
+      outputDirectory,
+      joinedInteractionsScriptPath,
+    );
+    await mkdir(path.dirname(interactionsScriptDestination), {
+      recursive: true,
+    });
+    await writeFile(interactionsScriptDestination, interactionsScriptBytes);
+    interactionsAssets.push({
+      path: joinedInteractionsScriptPath,
+      mediaType: INTERACTIONS_SCRIPT_MEDIA_TYPE,
+      byteLength: String(interactionsScriptBytes.byteLength),
+      sha256: digestBytes(interactionsScriptBytes),
+      immutable: false,
+    });
+  }
+
   const assets = [
     ...joinedMediaAssets,
     appearanceScriptAsset,
     baseStylesheetAsset,
+    ...interactionsAssets,
     ...(themeAssetsResult ? themeAssetsResult.assets : []),
   ].sort((a, b) => compareUtf8Bytes(a.path, b.path));