@rathnasgala2/template 3.1.0 → 3.2.1

package/README.md

@@ -35,10 +35,11 @@ mistaken for an HTML route:
 
 - **Bounded decode.** JPEG (via the pinned pure-JS `jpeg-js` decoder, no native
   addon or WebAssembly) and PNG (hand-written, using Node's built-in `zlib` with
-  a decompression-bomb-bounded inflate) are fully decoded to RGBA8; WebP and
-  AVIF get bounded container/declared-dimension validation without a full
-  entropy decode (a documented scope decision — see
-  `webp-probe.js`/`avif-probe.js`). Every format shares one set of resource
+  a decompression-bomb-bounded inflate) are fully decoded to RGBA8; WebP, AVIF
+  and GIF get bounded container/declared-dimension validation without a full
+  entropy decode, and their original bytes pass through unmodified (a documented
+  scope decision — see `webp-probe.js`/`avif-probe.js`/ `gif-probe.js`; an
+  animated GIF keeps its animation). Every format shares one set of resource
   ceilings in `limits.js` (raster dimension, pixel count, decoded-buffer and
   source-byte caps reused from the theme package's own closed binary-asset
   decoder bounds, plus this renderer's own documented per-publication ceilings).
@@ -61,13 +62,86 @@ mistaken for an HTML route:
   structurally.
 - **Fail-closed errors.** Every rejection — oversize, decompression bomb, digest
   mismatch, SVG, unrecognized format, invalid font — is a `MediaPipelineError`
-  with a stable `reasonCode`, thrown before the manifest is assembled.
+  with a stable `reasonCode`, thrown before anything is written.
 
 `options.sourceDirectory` is the caller-mounted, read-only repository source
 tree `build-input`'s `resolvedFile` references point into; every referenced
 file's bytes are read from there and verified against `build-input`'s declared
 `sourceDigest` before being decoded.
 
+### Content images
+
+Every `<img>` in a rendered body must name an image file `build-input`
+inventories for that document in `content[].media[]` (an entry whose `mediaType`
+is `image/png`, `image/jpeg`, `image/webp`, `image/avif` or `image/gif`). The
+`src` is resolved by one rule (`src/core/internal/media/content-images.js`): it
+is entity-decoded; a scheme, a protocol-relative `//`, a query or a fragment
+never resolves; one leading `/` or `./` is dropped (paths are
+repository-root-relative); the rest is percent-decoded and NFC-normalized; an
+empty, `.` or `..` segment never resolves; the result must equal an inventoried
+`path`. The publication profile and the footer card (checked only when enabled,
+since only then is it rendered) have no inventory, so an image there never
+resolves.
+
+An image that resolves to nothing (a remote image included: the render policy
+already strips its `src`) fails the build with `BuildInputValidationError`, one
+`MEDIA_REFERENCE_UNRESOLVED` diagnostic per image (`instancePointer` names the
+body, `reference` the `src`), before anything is written. An inventoried file
+the media pipeline rejects fails with that `MediaPipelineError` reason code,
+also before anything is written.
+
+A resolved image runs through the media pipeline and renders as
+`<img src srcset sizes="(max-width: 960px) 100vw, 960px" alt width height loading="lazy" decoding="async">`:
+`srcset` names every output file in ascending width (PNG/JPEG: each fixed
+derivative width below the source plus the re-encoded original; GIF, WebP and
+AVIF: the original only), and `src` is the widest of them no wider than 960
+pixels, or the original when none is. `alt` is the authored text. The feeds
+carry the same `src` as an absolute URL, without `srcset`. Only pipeline output
+is written: the source file is never copied, and identical bytes under two paths
+are processed and written once. Images use the base layer's existing `img`
+rules; no class is added. The front-matter `hero` renders as the article's cover
+`<figure>` above the body (`role: "decorative"` renders `alt=""`).
+
+### Editions
+
+A document of `kind: "edition"` restates one article at another depth. Its front
+matter's `edition` object names the article (`of`, the article's slug) and the
+depth (`kind`: `QUICK_READ`, `STANDARD` or `DEEP_DIVE`), and `build-input`
+carries it as an ordinary `content[]` record. Whether an edition is current is
+decided before the build input exists, so an edition that arrives is rendered as
+given. An edition is a content kind, not a module: the renderer runs no
+generation and has no Prism runtime.
+
+- **Routes.** `/<slug>/quick-read`, `/<slug>/standard` and `/<slug>/deep-dive`,
+  where `<slug>` is `edition.of` (written as `…/index.html` like every route).
+  The page's `data-gala-page-kind` is `article`, so the published page-kind
+  hooks do not change. Reactions and comments stay on the article; an edition
+  page carries none.
+- **The article stays the reference.** `<link rel="canonical">` and `og:url`
+  name the article, the robots directive is `noindex, follow`, and the
+  structured data is a `WebPage` with a breadcrumb back to the article.
+- **Never listed.** An edition is in no index, tag, series, archive or author
+  listing, feed, `sitemap.xml`, `search-index.json`, `llms.txt` or
+  `llms-full.txt`, and it does not move the footer's copyright year.
+- **Selector.** The article and each of its editions carry one
+  `<nav aria-label="Editions">` of links, in the `edition-selector` slot at the
+  end of the article head: Original, Quick read, Standard, Deep dive in that
+  order, only the kinds that exist, the page being read marked
+  `aria-current="page"`. An `unlisted` edition is not listed, except on its own
+  page. An edition page adds the line "Generated edition, reviewed by the
+  author; the original is the reference". The links are plain anchors; nothing
+  needs JavaScript. The strings come from the message catalog, and the markup
+  reuses the base layer's `g-pills`, `g-pill` and `g-label` hooks, so the
+  published theme styling contract does not change.
+- **Cover.** An edition with no `hero` or social image of its own uses its
+  article's.
+- **Fails closed.** Before anything is written, `BuildInputValidationError`
+  carries one diagnostic per edition that cannot be placed:
+  `EDITION_ORIGINAL_UNRESOLVED` (`edition.of` names no article of the build),
+  `EDITION_DUPLICATE` (two editions of one article at one depth) and
+  `EDITION_ROUTE_CONFLICT` (the route is already another document's route or
+  redirect).
+
 The complete output-security pipeline (`src/core/internal/content-security.js`)
 sits on top of that adapter. **Division of labour** (normalization replaces an
 authored body path with a `renderableBody` carrying "the deterministic policy
@@ -153,23 +227,29 @@ output-security pipeline every generated page still passes through:
   `header-actions` slot), one primary `<nav>` from `navigationNormalized.items`,
   one `<main id="main-content">` (an optional breadcrumb `<nav>` before the
   page's own single `<h1>`), and one `<footer>` (publication name, footer
-  navigation, the `footer-profile` slot, the remaining core slots, and the
-  template attribution line). Core owns nine versioned semantic slots
-  (`header-actions`, `article-preamble`, `article-end`, `footer-profile`,
-  `footer-auxiliary`, `account-intent`, `conversation`, `newsletter`,
-  `edition-selector`) plus the collapsed `article-footer-ad` slot: every slot is
-  one `data-gala-slot="<name>"` attribute on an otherwise empty, non-landmark
-  `<div>`, and the collapsed slot additionally carries `hidden`. This renderer
-  has no module system, so every slot except `footer-profile` (which always
-  wraps the publication's own footer card) and `header-actions` (the appearance
-  control, core content rather than a module) renders empty. This module also
-  renders breadcrumbs and deterministic pagination controls
-  (`rel="prev"`/`rel="next"`, an `aria-current="page"` status).
+  navigation, the `footer-profile` slot, the remaining footer slots
+  (`footer-auxiliary`, `account-intent`, `conversation`, `newsletter`), and the
+  "Made with Galascribe" attribution line, which
+  `appearance.attribution.showMadeWith: false` omits). Core owns nine versioned
+  semantic slots (`header-actions`, `article-preamble`, `article-end`,
+  `footer-profile`, `footer-auxiliary`, `account-intent`, `conversation`,
+  `newsletter`, `edition-selector`) plus the collapsed `article-footer-ad` slot:
+  every slot is one `data-gala-slot="<name>"` attribute on an otherwise empty,
+  non-landmark `<div>`, and the collapsed slot additionally carries `hidden`.
+  This renderer has no module system, so every slot except `footer-profile`
+  (which always wraps the publication's own footer card), `header-actions` (the
+  appearance control, core content rather than a module) and `edition-selector`
+  (see Editions) renders empty. `edition-selector` is rendered by the article
+  page kind at the end of the article head, only where there is an edition to
+  offer, not in the footer. This module also renders breadcrumbs and
+  deterministic pagination controls (`rel="prev"`/`rel="next"`, an
+  `aria-current="page"` status).
 - **`src/core/internal/page-kinds.js`** builds every generated page kind from a
   validated `build-input:2.0.0`: `profile` (the optional publication profile),
   `author` (one page per `build-input.authors` entry, at `/authors/<id>`),
-  `article`/`page` (one page per `content[]` record, at its own route), `index`
-  (a paginated reverse-chronological listing of every `status: "published"`,
+  `article`/`page` (one page per `content[]` record, at its own route; a
+  `kind: "edition"` record renders beside its article, see Editions), `index` (a
+  paginated reverse-chronological listing of every `status: "published"`,
   `kind: "article"` record — an `unlisted` record is reachable only by its own
   direct route, never through a generated listing), `tag`/`series` (one listing
   page per distinct authored value, plus a `/tags`/`/series` root page linking
@@ -424,6 +504,10 @@ numbers:
 - decode/resource ceilings reuse the theme binary-asset profile's numbers
   (dimension, pixel-count, decoded-buffer, source-byte caps), since the
   decode-bomb risk they defend against is identical regardless of asset class;
+  the JPEG decoder's own memory knob counts its whole working set (coefficient
+  and line buffers as well as the RGBA output), so it is sized for an image at
+  the pixel ceiling at 32 bytes per pixel (512 MiB) rather than to the RGBA
+  output alone, which rejected every JPEG above about three to five megapixels;
 - responsive derivative widths (`320/640/960/1280/1920`), JPEG derivative
   quality (`82`), and the per-publication image/font count and aggregate byte
   ceilings are this renderer's own conservative choices;
@@ -431,7 +515,12 @@ numbers:
   VP8/VP8L/AV1 entropy decode or derivative generation — hand-authoring an
   independently verifiable decoder for either format was judged out of
   proportion to this task, and is flagged as a follow-up rather than attempted
-  partially.
+  partially;
+- GIF gets a bounded block-structure walk (signature, logical screen and every
+  frame within the dimension ceilings, every sub-block chain inside the file, at
+  least one image, the trailer as the last byte) and passes through unmodified:
+  this renderer carries no GIF encoder, so an animation is never resized, and
+  any comment or application extension is served as authored.
 
 Every remaining "Required generated output" from this renderer's own governing
 brief sits on top of the page kinds above:
@@ -440,15 +529,15 @@ brief sits on top of the page kinds above:
   (`/feed/atom.xml`) and RSS 2.0 (`/feed/rss.xml`) documents over the exact
   reverse-chronological `status: "published"`, `kind: "article"` selection
   `internal/page-kinds.js`'s `index` page kind paginates (the shared
-  `selectPublishedArticles` export), every item URL absolute against
-  `buildInput.baseUrl`, bounded to the most recent 50 entries (documented scoped
-  decision — neither the brief nor this renderer's own styling decision fixes a
-  feed item count).
+  `selectPublishedArticles` export; editions are never in it), every item URL
+  absolute against `buildInput.baseUrl`, bounded to the most recent 50 entries
+  (documented scoped decision — neither the brief nor this renderer's own
+  styling decision fixes a feed item count).
 - **Sitemap** (`src/core/internal/sitemap.js`): `/sitemap.xml` over every page
   `internal/page-kinds.js` generated that this renderer did not itself mark
-  `noindex` (unlisted content), deterministically sorted by each entry's own
-  absolute URL, with `<lastmod>` sourced from each page's own authored
-  `publishedAt`/`updatedAt` — never build time.
+  `noindex` (unlisted content and editions), deterministically sorted by each
+  entry's own absolute URL, with `<lastmod>` sourced from each page's own
+  authored `publishedAt`/`updatedAt` — never build time.
 - **Static search index** (`src/core/internal/search-index.js`):
   `/search-index.json`, a deterministic JSON document indexing every published
   `article`/`page` record's title, description, a bounded plain-text excerpt,
@@ -459,13 +548,14 @@ brief sits on top of the page kinds above:
   C).
 - **SEO/Open-Graph/Twitter/localization metadata**: every generated page's
   `<head>` now carries a viewport meta, an optional description, an optional
-  `robots` directive (`noindex, follow` for `status: "unlisted"` content and for
-  the generated `404.html`), a canonical link, `og:*`/ `twitter:*` meta tags
-  (image resolved to an absolute content-addressed media derivative URL via
-  `internal/seo.js`, never the raw source path) and the Atom/RSS feed-discovery
-  `<link>`s. **hreflang** is a documented scope decision, not a silent omission:
-  `build-input:2.0.0` has no translation/locale-variant linkage between distinct
-  `content[]` records (see `internal/seo.js`'s module documentation), so no
+  `robots` directive (`noindex, follow` for `status: "unlisted"` content, for
+  editions and for the generated `404.html`), a canonical link, `og:*`/
+  `twitter:*` meta tags (image resolved to an absolute content-addressed media
+  derivative URL via `internal/seo.js`, never the raw source path) and the
+  Atom/RSS feed-discovery `<link>`s. **hreflang** is a documented scope
+  decision, not a silent omission: `build-input:2.0.0` has no
+  translation/locale-variant linkage between distinct `content[]` records (see
+  `internal/seo.js`'s module documentation), so no
   `<link rel="alternate" hreflang="...">` is ever emitted by this renderer.
 - **Search and assistant discovery** (3.0.0, unpublished). Every page carries
   one `<script type="application/ld+json">` data block
@@ -481,9 +571,9 @@ brief sits on top of the page kinds above:
   `width` and `height` from the media pipeline; the article cover and the home
   hero are `fetchpriority="high"`, all other images
   `loading="lazy" decoding="async"`. Feeds carry the full sanitized body
-  (`content:encoded` in RSS, `<content type="html">` in Atom), authors and
-  categories. Author pages live at `/authors/<name-slug>` (the id when two names
-  collide).
+  (`content:encoded` in RSS, `<content type="html">` in Atom; each image as its
+  absolute media-derivative URL), authors and categories. Author pages live at
+  `/authors/<name-slug>` (the id when two names collide).
 - **`robots.txt`, `llms.txt`, `llms-full.txt`** (`internal/robots.js`,
   `internal/llms.js`). `robots.txt` allows all crawlers and names the absolute
   sitemap; `publication.crawlers.ai: "block"` (validated by the build-input
@@ -493,7 +583,7 @@ brief sits on top of the page kinds above:
   a GitHub project site) must have the same file at its host root. `llms.txt`
   follows llmstxt.org (`# title`, `> description`, `## Articles`, `## Series`,
   `## Optional`); `llms-full.txt` is every published article as plain text.
-  Unlisted content is excluded from both.
+  Unlisted content and editions are excluded from both.
 - **`404.html`**: the `error` page kind's pure `renderErrorPageBody`, now
   actually wired into `renderPublication` at the fixed `errorDocumentKey`
   (`internal/route.js#errorDocumentPath`) — `404.html` at the root, or
@@ -580,14 +670,17 @@ contracts/theme-styling-contract.jcs     # published styling catalog (real and c
 read from disk and emitted as `assets/gala-interactions-v1.js` when
 `build-input.modules.interactions` is present.
 `test/module-tree-absence.test.js`, `.dependency-cruiser.cjs` and the ESLint
-`no-restricted-imports` rule enforce this. `whitelabel`, `newsletter` and
-`prism` have no module directory, package, configuration schema, stub, output or
-runtime code in this MVP.
+`no-restricted-imports` rule enforce this. `newsletter` and `prism` have no
+module directory, package, configuration schema, stub, output or runtime code in
+this MVP. Whitelabel is not a module either: the footer's "Made with Galascribe"
+line is a core appearance switch, `build-input.appearance.attribution`
+(`showMadeWith: false` omits the line; absent or `true` shows it). Nor are
+editions: they are a rendered content kind (see Editions).
 
 ## Consuming `@rathnasgala2/schemas`
 
-This repository consumes `@rathnasgala2/schemas@3.1.0` from the public npm
-registry, declared as `"@rathnasgala2/schemas": "3.1.0"` (exact pin, no range)
+This repository consumes `@rathnasgala2/schemas@3.3.0` from the public npm
+registry, declared as `"@rathnasgala2/schemas": "3.3.0"` (exact pin, no range)
 so `package-lock.json` records the resolved version and integrity hash. The
 LOCAL-1/LOCAL-39 local-tarball convention
 (`file:../../local-packages/rathnasgala2-schemas-*.tgz`) is retired for this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rathnasgala2/template",
-  "version": "3.1.0",
+  "version": "3.2.1",
   "description": "Deterministic Eleventy-backed static publication renderer for Galascribe portable repositories.",
   "type": "module",
   "license": "Apache-2.0",
@@ -72,7 +72,7 @@
   "dependencies": {
     "@11ty/eleventy": "3.1.6",
     "@11ty/eleventy-plugin-syntaxhighlight": "5.0.2",
-    "@rathnasgala2/schemas": "3.1.0",
+    "@rathnasgala2/schemas": "3.3.0",
     "jpeg-js": "0.4.4",
     "markdown-it": "14.3.1",
     "sanitize-html": "2.17.7"

package/src/core/index.js

@@ -9,8 +9,13 @@
  * fails closed: an invalid `build-input` is rejected with
  * {@link BuildInputValidationError} before anything is written, malformed
  * adapter options are rejected with {@link RenderOptionsError} before
- * Eleventy ever runs, and a rejected image or font is rejected with
- * {@link MediaPipelineError} before the manifest is assembled.
+ * Eleventy ever runs, a body image that names no inventoried image asset is
+ * rejected with {@link BuildInputValidationError}
+ * (`MEDIA_REFERENCE_UNRESOLVED`) before anything is written, an edition that
+ * names no article in the build, repeats another edition or takes another
+ * document's route is rejected the same way (`EDITION_ORIGINAL_UNRESOLVED`,
+ * `EDITION_DUPLICATE`, `EDITION_ROUTE_CONFLICT`), and a rejected image or font
+ * is rejected with {@link MediaPipelineError} before anything is written.
  *
  * `normalizeAuthoredMarkdown` (re-exported here from
  * `internal/content-security.js`) is this package's second public entry
@@ -85,6 +90,7 @@ import {
   computeRenderPolicyIdentity,
   contentSecurityPolicyMetaTag,
 } from './internal/content-security.js';
+import { resolveEditions } from './internal/editions.js';
 import { renderPagesWithEleventy } from './internal/eleventy-render.js';
 import {
   INTERACTIONS_SCRIPT_MEDIA_TYPE,
@@ -100,6 +106,10 @@ import {
 } from './internal/feeds.js';
 import { listFilesSortedByUtf8Bytes } from './internal/fs-walk.js';
 import { getMessages } from './internal/messages.js';
+import {
+  resolveContentImages,
+  rewriteBodyImages,
+} from './internal/media/content-images.js';
 import { processMedia } from './internal/media/pipeline.js';
 import {
   buildGeneratedPages,
@@ -136,7 +146,11 @@ import {
   renderPrimaryNavigation,
 } from './internal/skeleton.js';
 import { renderFooter, renderHeader } from './internal/chrome.js';
-import { createComponents, createMediaImage } from './internal/components.js';
+import {
+  createComponents,
+  createContentImage,
+  createMediaImage,
+} from './internal/components.js';
 import {
   collectIncludedSources,
   compareUtf8Bytes,
@@ -336,13 +350,18 @@ export async function renderPublication(buildInput, options) {
     );
 
   await assertRenderPolicyCompliance(validatedInput);
+  // Every body image must name an image asset the build input inventories
+  // for its document; resolved here, from the verified bodies alone, so an
+  // unresolved one fails closed before anything is written.
+  const contentImages = resolveContentImages(validatedInput);
+  // Every edition must sit beside an article of this build; placed here for the
+  // same reason.
+  const editions = resolveEditions(validatedInput.content, contentRoute);
   assertOptions(options);
   const routeProfile = options.routeNormalizationProfile ?? 'directory-index';
 
   const outputDirectory = path.resolve(options.outputDirectory);
   const workDirectory = path.resolve(options.workDirectory);
-  await mkdir(outputDirectory, { recursive: true });
-  await mkdir(workDirectory, { recursive: true });
 
   // The site-wide message catalog for core chrome (skip link, navigation,
   // breadcrumb, pagination and footer labels). Every page's own <html lang>
@@ -388,9 +407,22 @@ export async function renderPublication(buildInput, options) {
     assets: mediaAssets,
     files: mediaFiles,
     dimensions: mediaDimensions,
+    variants: mediaVariants,
   } = await processMedia(validatedInput, {
     sourceDirectory: path.resolve(options.sourceDirectory),
+    contentImages: [...contentImages.values()],
   });
+  // Created only now, after every input and media check has passed, so a
+  // rejected build input or media reference leaves nothing behind.
+  await mkdir(outputDirectory, { recursive: true });
+  await mkdir(workDirectory, { recursive: true });
+  const contentImage = createContentImage({ mediaVariants, publicBasePath });
+  /** @type {(body: string) => string} a body's page form */
+  const pageBody = (body) =>
+    rewriteBodyImages(body, contentImages, contentImage.page);
+  /** @type {(body: string) => string} a body's feed form */
+  const feedBody = (body) =>
+    rewriteBodyImages(body, contentImages, contentImage.feed);
   const mediaImage = createMediaImage({
     mediaAssets,
     publicBasePath,
@@ -407,7 +439,9 @@ export async function renderPublication(buildInput, options) {
   // Already verified render-policy-conformant HTML by
   // assertRenderPolicyCompliance's assertPolicyConformantHtml call above —
   // inserted as-is, never re-parsed as Markdown.
-  const footerProfileHtml = footerCard?.enabled ? footerCard.body.body : '';
+  const footerProfileHtml = footerCard?.enabled
+    ? pageBody(footerCard.body.body)
+    : '';
   const authorsById = new Map(
     validatedInput.authors.map((author) => [author.id, author]),
   );
@@ -440,6 +474,7 @@ export async function renderPublication(buildInput, options) {
       `</div></div>`
     : '';
   const latestYear = validatedInput.content
+    .filter((record) => record.frontmatter.kind !== 'edition')
     .map((record) => record.frontmatter.publishedAt.slice(0, 4))
     .sort()
     .at(-1);
@@ -456,6 +491,9 @@ export async function renderPublication(buildInput, options) {
     authorHtml: footerAuthorHtml,
     footerProfileHtml,
     copyrightText: `${siteMessages.footerCopyrightPrefix} ${latestYear ? `${latestYear} ` : ''}${publication.title}`,
+    // The whitelabel switch: a core appearance setting, not a module.
+    showAttribution:
+      validatedInput.appearance.attribution?.showMadeWith !== false,
     messages: siteMessages,
   });
 
@@ -489,7 +527,7 @@ export async function renderPublication(buildInput, options) {
   // The site-wide feeds, resolved once so every page's feed-discovery
   // `<link>` tags and the feed documents themselves agree on the exact same
   // self URLs.
-  const feeds = buildFeeds(validatedInput);
+  const feeds = buildFeeds(validatedInput, { feedBody });
   const siteName = validatedInput.publication.title;
   const appearanceScriptHrefValue =
     appearanceBootstrapScriptHref(publicBasePath);
@@ -524,6 +562,8 @@ export async function renderPublication(buildInput, options) {
   const redirectProjections = [];
 
   const generatedPages = buildGeneratedPages(validatedInput, {
+    pageBody,
+    editions,
     mediaAssets,
     mediaDimensions,
     interactions: interactionsOn ? interactionsModule : undefined,
@@ -565,7 +605,7 @@ export async function renderPublication(buildInput, options) {
         description: page.description,
         robotsContent: page.robotsContent,
         canonicalUrl: new URL(
-          joinPublicRoute(publicBasePath, page.route),
+          joinPublicRoute(publicBasePath, page.canonicalRoute ?? page.route),
           validatedInput.baseUrl,
         ).toString(),
         siteName,

package/src/core/internal/appearance/base-layer.js

@@ -524,6 +524,7 @@ export const GALA_BASE_COMPONENT_CSS = `
   .g-article-head h1 { font-size: clamp(2.25rem, 1.2rem + 3.8vw, var(--gala-display-max)); }
   .g-article-meta { display: flex; align-items: center; justify-content: space-between; gap: var(--gala-space-4); width: 100%; padding-top: 1.1rem; border-top: var(--gala-border-width) solid var(--gala-color-border); flex-wrap: wrap; }
   .g-share { display: flex; gap: var(--gala-space-1); }
+  [data-gala-slot="edition-selector"] { display: grid; grid-template-columns: minmax(0, 1fr); gap: var(--gala-space-2); min-width: 0; max-width: 100%; }
   .g-article-cover { margin-block: 0; }
   .g-article-cover img { width: 100%; height: auto; aspect-ratio: 21 / 9; object-fit: cover; border-radius: var(--gala-radius-large); border: var(--gala-border-card); box-shadow: var(--gala-shadow-card); filter: var(--gala-media-filter); }
   .g-article-grid { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, var(--gala-content-measure)) minmax(0, 1fr); gap: clamp(1.5rem, 4vw, 3.5rem); padding-block: clamp(2rem, 5vw, 3.5rem) var(--gala-space-4); }
@@ -670,7 +671,6 @@ export const GALA_BASE_COMPONENT_CSS = `
   }
   .g-reaction:hover:not(:disabled) { border-color: var(--gala-color-text); color: var(--gala-color-text); }
   .g-reaction:active:not(:disabled) { transform: scale(.96); }
-  .g-reaction:disabled { opacity: .55; cursor: default; }
   .g-reaction__icon { display: inline-grid; place-items: center; font-size: 1.1rem; line-height: 1; }
   .g-reaction__icon .g-icon { width: 1.15rem; height: 1.15rem; }
   .g-reaction__label { overflow-wrap: anywhere; }
@@ -705,12 +705,41 @@ export const GALA_BASE_COMPONENT_CSS = `
   }
   .g-composer__submit:hover:not(:disabled), .g-composer__signin:hover, .g-report button[type="submit"]:hover { filter: brightness(1.07) saturate(1.05); }
   .g-composer__submit:active:not(:disabled), .g-composer__signin:active { transform: scale(.97); }
-  .g-composer__submit:disabled { opacity: .55; cursor: default; box-shadow: none; }
   .g-composer__cancel, .g-report button[type="button"] {
     min-height: 2.75rem; padding: .6rem 1rem; border-radius: var(--gala-radius-pill); border: var(--gala-border-width) solid var(--gala-color-border); background: transparent; color: var(--gala-color-text);
     font-family: var(--gala-font-ui); font-weight: var(--gala-weight-ui); font-size: .9rem; cursor: pointer;
   }
   .g-composer__cancel:hover, .g-report button[type="button"]:hover { border-color: var(--gala-color-text); }
+  /* Interaction-button states. Enabled: full-strength tokens and a pointer.
+     Disabled (native or aria-disabled): muted surface and border tokens,
+     faint text, reduced opacity, a dashed border and not-allowed. Working
+     (aria-busy): enabled colours, a progress cursor and a spinner, never the
+     muted look. Themes may tint these tokens, never remove the rule. */
+  .g-reaction:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-comments__more:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-composer__cancel:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-report button[type="button"]:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-comment__action:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-composer__submit:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-composer__signin:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]),
+  .g-report button[type="submit"]:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]) {
+    background: var(--gala-color-surface-raised); background-image: none; color: var(--gala-color-text-faint);
+    border: var(--gala-border-width) dashed var(--gala-color-border); box-shadow: none; filter: none; transform: none;
+    opacity: .6; cursor: not-allowed;
+  }
+  .g-interactions__signout:is(:disabled, [aria-disabled="true"]):not([aria-busy="true"]) { color: var(--gala-color-text-faint); text-decoration-style: dashed; opacity: .6; cursor: not-allowed; }
+  .g-reaction[aria-busy="true"], .g-comments__more[aria-busy="true"], .g-composer__cancel[aria-busy="true"], .g-comment__action[aria-busy="true"],
+  .g-composer__submit[aria-busy="true"], .g-composer__signin[aria-busy="true"], .g-report button[aria-busy="true"] { cursor: progress; }
+  .g-reaction[aria-busy="true"]::after, .g-comments__more[aria-busy="true"]::after, .g-comment__action[aria-busy="true"]::after,
+  .g-composer__submit[aria-busy="true"]::after, .g-report button[aria-busy="true"]::after {
+    content: ""; display: inline-block; flex: none; width: .9em; height: .9em; margin-left: .5em; border-radius: 50%;
+    border: 2px solid currentColor; border-right-color: transparent; vertical-align: -.1em; animation: g-busy-spin .8s linear infinite;
+  }
+  @keyframes g-busy-spin { to { transform: rotate(360deg); } }
+  @media (prefers-reduced-motion: reduce) {
+    .g-reaction[aria-busy="true"]::after, .g-comments__more[aria-busy="true"]::after, .g-comment__action[aria-busy="true"]::after,
+    .g-composer__submit[aria-busy="true"]::after, .g-report button[aria-busy="true"]::after { animation: none; border-right-color: currentColor; border-style: dotted; }
+  }
   .g-comment-list { display: grid; gap: var(--gala-space-4); min-width: 0; }
   .g-comment { display: grid; gap: var(--gala-space-2); min-width: 0; }
   .g-comment__head { display: flex; align-items: center; gap: var(--gala-space-3); min-width: 0; }

package/src/core/internal/chrome.js

@@ -142,6 +142,9 @@ function renderSocialLinks(socialLinks, rssHref, messages) {
  * @param {string} options.footerProfileHtml the already-rendered footer card
  *   body (may be empty)
  * @param {string | undefined} options.copyrightText the copyright line
+ * @param {boolean} options.showAttribution whether the Galascribe
+ *   attribution line renders: the build input's
+ *   `appearance.attribution.showMadeWith`, shown when absent
  * @param {Readonly<Record<string, string | ((...args: string[]) => string)>>} options.messages
  * @returns {string} the rendered footer
  */
@@ -158,6 +161,7 @@ export function renderFooter({
   authorHtml,
   footerProfileHtml,
   copyrightText,
+  showAttribution,
   messages,
 }) {
   const label = (/** @type {string} */ key) =>
@@ -190,10 +194,9 @@ export function renderFooter({
     renderSlot('account-intent') +
     renderSlot('conversation') +
     renderSlot('newsletter') +
-    renderSlot('edition-selector') +
     `<div class="g-wrap g-footer-base">` +
     (copyrightText ? `<span>${escapeHtml(copyrightText)}</span>` : '') +
-    `<span>${label('footerAttributionLabel')}</span>` +
+    (showAttribution ? `<span>${label('footerAttributionLabel')}</span>` : '') +
     `</div></footer>`
   );
 }

package/src/core/internal/components.js

@@ -14,6 +14,7 @@
  * published one is never rendered.
  */
 
+import { RenderPolicyViolationError } from '../errors.js';
 import { escapeHtml } from './skeleton.js';
 import { icon } from './icons.js';
 import { joinBasePathAndRoute } from './route.js';
@@ -197,18 +198,76 @@ export function renderImage({
 }
 
 /**
- * Add `loading="lazy" decoding="async"` to every `<img>` in an
- * already-sanitized body. Applied at render time only: the body's own
- * digest is over the stored bytes and is never recomputed.
+ * The widest slot a content image fills, in CSS pixels: the prose column
+ * never exceeds it, so a content image's `src` is its largest output file
+ * no wider than this.
+ */
+export const CONTENT_IMAGE_SLOT_WIDTH = 960;
+
+/** The `sizes` value every content image carries (the slot above). */
+export const CONTENT_IMAGE_SIZES = `(max-width: ${CONTENT_IMAGE_SLOT_WIDTH}px) 100vw, ${CONTENT_IMAGE_SLOT_WIDTH}px`;
+
+/**
+ * Build the two renderers for a content image (an image a body references,
+ * already resolved by `media/content-images.js` and processed by the media
+ * pipeline). The page form names every output file of the image in
+ * `srcset`; its `src` is the largest output file no wider than
+ * {@link CONTENT_IMAGE_SLOT_WIDTH}, or the original when the image has no
+ * narrower file (a GIF, WebP or AVIF passes through as its original only).
+ * Applied at render time only: the body's own digest is over the stored
+ * bytes and is never recomputed.
  *
- * @param {string} bodyHtml sanitized body HTML
- * @returns {string} the body with loading hints on its images
+ * @param {object} options
+ * @param {Readonly<Record<string, readonly {path: string, width: number, height: number}[]>>} options.mediaVariants
+ *   the media pipeline's output files per source digest, ascending width
+ * @param {string} options.publicBasePath the public base path
+ * @returns {{page: (reference: {path: string, sourceDigest: string}, altAttribute: string) => string, feed: (reference: {path: string, sourceDigest: string}, altAttribute: string) => string}}
+ *   the page form (responsive, lazy) and the feed form (one `src`, no
+ *   loading hints); `altAttribute` is the body's own entity-encoded `alt`
  */
-export function lazyBodyImages(bodyHtml) {
-  return bodyHtml.replace(
-    /<img\b(?![^>]*\bloading=)/g,
-    '<img loading="lazy" decoding="async"',
-  );
+export function createContentImage({ mediaVariants, publicBasePath }) {
+  /**
+   * @param {{path: string, sourceDigest: string}} reference
+   * @returns {{url: string, width: number, height: number}[]} every output
+   *   file of the image, ascending width
+   */
+  const filesOf = (reference) => {
+    const variants = mediaVariants[reference.sourceDigest] ?? [];
+    if (variants.length === 0) {
+      throw new RenderPolicyViolationError(
+        `content image ${reference.path} has no media pipeline output; this is a renderer defect`,
+      );
+    }
+    return variants.map((variant) => ({
+      url: joinBasePathAndRoute(publicBasePath, `/${variant.path}`),
+      width: variant.width,
+      height: variant.height,
+    }));
+  };
+  /**
+   * @param {{url: string, width: number, height: number}[]} files
+   * @returns {{url: string, width: number, height: number}} the `src` file
+   */
+  const fitting = (files) =>
+    files.filter((file) => file.width <= CONTENT_IMAGE_SLOT_WIDTH).at(-1) ??
+    files[0];
+  return {
+    page(reference, altAttribute) {
+      const files = filesOf(reference);
+      const source = fitting(files);
+      const srcset = files
+        .map((file) => `${file.url} ${file.width}w`)
+        .join(', ');
+      return (
+        `<img src="${escapeHtml(source.url)}" srcset="${escapeHtml(srcset)}" sizes="${CONTENT_IMAGE_SIZES}"` +
+        ` alt="${altAttribute}" width="${source.width}" height="${source.height}" loading="lazy" decoding="async">`
+      );
+    },
+    feed(reference, altAttribute) {
+      const source = fitting(filesOf(reference));
+      return `<img src="${escapeHtml(source.url)}" alt="${altAttribute}" width="${source.width}" height="${source.height}">`;
+    },
+  };
 }
 
 /**