<x-site-layout :title="$page->title.' — MITH Studios'">
    <div class="mx-auto max-w-3xl px-4 sm:px-6 py-12">
        <h1 class="text-4xl uppercase tracking-wide text-stone-50">{{ $page->title }}</h1>

        @if ($page->summary)
            <p class="mt-3 text-stone-400">{{ $page->summary }}</p>
        @endif

        {{--
            Both options are load-bearing; do not drop them.

            Str::markdown() does NOT sanitise by default — league/commonmark
            ships html_input=allow and allow_unsafe_links=true. GitHub-flavoured
            mode happens to escape a bare <script>, which makes it look safe,
            but <img src=x onerror=…>, inline event handlers and
            [x](javascript:…) all pass through verbatim. This is admin-authored
            text on a public page, so that is a stored XSS.

            'strip' removes raw HTML entirely; allow_unsafe_links=false drops
            javascript:/data: hrefs. Ordinary Markdown is unaffected.
        --}}
        <div class="prose prose-invert mt-8 max-w-none
                    prose-headings:uppercase prose-headings:tracking-tight
                    prose-a:text-amber-400 prose-strong:text-stone-100">
            {!! Str::markdown((string) $page->body, [
                'html_input' => 'strip',
                'allow_unsafe_links' => false,
            ]) !!}
        </div>

        <p class="mt-12 font-mono text-xs uppercase tracking-widest text-stone-600">
            Last updated {{ $page->updated_at->setTimezone(config('studio.timezone'))->format('j F Y') }}
        </p>
    </div>
</x-site-layout>
