unaltraweb 0.3.0

data/_plugins/reproducible_build_time.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Unaltraweb
+  module ReproducibleBuildTime
+    EPOCH = /\A[0-9]+\z/
+    module_function
+
+    def build_time
+      raw = ENV["SOURCE_DATE_EPOCH"]
+      return if raw.nil?
+
+      unless EPOCH.match?(raw)
+        raise Jekyll::Errors::FatalException,
+              "SOURCE_DATE_EPOCH must be a non-negative base-10 integer"
+      end
+
+      time = Time.at(Integer(raw, 10)).utc
+      time
+    rescue ArgumentError, RangeError => error
+      raise Jekyll::Errors::FatalException,
+            "Invalid SOURCE_DATE_EPOCH: #{error.message}"
+    end
+
+    def apply(site)
+      time = build_time
+      return unless time
+
+      site.config["time"] = time.iso8601
+      site.time = time
+    end
+
+    def normalize_static_files(site)
+      time = build_time
+      return unless time
+
+      site.static_files.each do |file|
+        file.instance_variable_set(:@modified_time, time)
+      end
+    end
+  end
+end
+
+Jekyll::Hooks.register :site, :after_init do |site|
+  Unaltraweb::ReproducibleBuildTime.apply(site)
+end
+
+Jekyll::Hooks.register :site, :after_reset do |site|
+  Unaltraweb::ReproducibleBuildTime.apply(site)
+end
+
+Jekyll::Hooks.register :site, :post_read do |site|
+  Unaltraweb::ReproducibleBuildTime.normalize_static_files(site)
+end

data/_plugins/search-data.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module Jekyll
+  module UnaltrawebSearchData
+    module_function
+
+    def write(site)
+      return unless site.config["search_enabled"]
+
+      target = site.in_dest_dir("assets/js/search-data.js")
+      FileUtils.mkdir_p(File.dirname(target))
+      File.write(target, script(entries(site)))
+    end
+
+    def entries(site)
+      pages = site.pages.select { |page| page.data["nav"] && !page.data["autogen"] }
+      collections = site.collections.respond_to?(:values) ? site.collections.values : site.collections
+      docs = collections.reject { |collection| collection.label == "posts" }.flat_map(&:docs)
+
+      (pages + site.posts.docs + docs).filter_map do |item|
+        title = item.data["title"].to_s.strip
+        next if title.empty?
+
+        {
+          id: "search-#{Jekyll::Utils.slugify(title)}",
+          title: title,
+          description: item.data["description"].to_s.gsub(/\s+/, " ").strip,
+          section: search_section(item),
+          url: relative_url(site, item.url),
+        }
+      end
+    end
+
+    def search_section(item)
+      return "Navigation" unless item.respond_to?(:collection) && item.collection
+
+      collection = item.collection
+      label = collection.respond_to?(:label) ? collection.label : collection.to_s
+      return "Posts" if label == "posts"
+      return label.capitalize unless label.empty?
+
+      "Navigation"
+    end
+
+    def relative_url(site, url)
+      return url if url.start_with?("http://", "https://")
+
+      baseurl = site.config["baseurl"].to_s.chomp("/")
+      path = url.start_with?("/") ? url : "/#{url}"
+      "#{baseurl}#{path}"
+    end
+
+    def script(entries)
+      rows = entries.map do |entry|
+        <<~JS
+          {
+            id: #{JSON.generate(entry[:id])},
+            title: #{JSON.generate(entry[:title])},
+            description: #{JSON.generate(entry[:description])},
+            section: #{JSON.generate(entry[:section])},
+            handler: () => { window.location.href = #{JSON.generate(entry[:url])}; },
+          }
+        JS
+      end.join(",\n")
+
+      <<~JS
+        const ninja = document.querySelector("ninja-keys");
+        if (ninja) {
+          ninja.data = [
+        #{rows}
+          ];
+        }
+      JS
+    end
+  end
+
+  Hooks.register :site, :post_write do |site|
+    UnaltrawebSearchData.write(site)
+  end
+end

data/_plugins/theme-cache-bust.rb

@@ -0,0 +1,56 @@
+# Make jekyll-cache-bust work when assets live in the unaltraweb gem theme
+# instead of the child site repository.
+require "jekyll-cache-bust"
+
+module Jekyll
+  module CacheBust
+    class CacheDigester
+      UNALTRAWEB_ROOT = File.expand_path("..", __dir__)
+
+      private
+
+      def directory_files_content
+        return main_css_source_content if directory == "assets/_sass"
+
+        target_directory = existing_path(directory)
+        return "" unless target_directory
+
+        Dir[File.join(target_directory, "**", "*")].map do |file|
+          File.read(file) unless File.directory?(file)
+        end.join
+      end
+
+      def file_content
+        local_file_name = file_name.slice((file_name.index("assets/")..-1))
+        return main_css_source_content if local_file_name == "assets/css/main.css"
+
+        target_file = existing_path(local_file_name)
+        return "" unless target_file
+
+        File.read(target_file)
+      end
+
+      def main_css_source_content
+        files = existing_paths("assets/css/main.scss")
+        existing_paths("_sass").each do |sass_dir|
+          files.concat(Dir[File.join(sass_dir, "**", "*")].reject { |file| File.directory?(file) })
+        end
+        files.uniq.sort.map { |file| File.read(file) }.join
+      end
+
+      def existing_path(relative_path)
+        return nil if relative_path.nil? || relative_path.empty?
+
+        existing_paths(relative_path).first
+      end
+
+      def existing_paths(relative_path)
+        [
+          relative_path,
+          File.join("docs", relative_path),
+          File.join(UNALTRAWEB_ROOT, relative_path),
+        ].select { |path| File.exist?(path) }
+      end
+    end
+  end
+end

data/_plugins/vega_visual_images.rb

@@ -0,0 +1,290 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "psych"
+require "yaml"
+
+# Rewrites Vega-Lite and Vega specification image references to the single
+# generated output declared for the source in .vegavisuals.yml.
+module Unaltraweb
+  module VegaVisualImages
+    module_function
+
+    BASEURL_PREFIX = /\A\{\{\s*site\.baseurl\s*\}\}/.freeze
+    REMOTE_PATH_PREFIX = %r{\A(?:[a-z][a-z0-9+.-]*:)?//}i.freeze
+    FENCED_CODE_BLOCK = /^[ \t]*(`{3,}|~{3,})[^\n]*\n.*?^[ \t]*\1[ \t]*$/m.freeze
+    INLINE_CODE_SPAN = /(`+)[^\n]*?\1/.freeze
+    VEGA_PATH_SUFFIX = /\.(?:vl|vg)\.json\z/i.freeze
+    VEGA_DESTINATION = /(?:\{\{\s*site\.baseurl\s*\}\})?[^\s)"']*?\.(?:vl|vg)\.json(?:[?#][^\s)"']*)?/i.freeze
+    OUTPUT_SUFFIXES = %w[.svg .png .pdf].freeze
+    SAFE_NAME = /\A[A-Za-z0-9][A-Za-z0-9_.-]*\z/.freeze
+    MANIFEST_NAME = ".vegavisuals.yml"
+
+    def rewrite(content, site_source:)
+      return content if content.nil? || content.empty?
+
+      rewrite_outside_code_fences(content) { |chunk| rewrite_chunk(chunk, site_source: site_source) }
+    end
+
+    def rewrite_chunk(content, site_source:)
+      out = content.dup
+      out.gsub!(/!\[([^\]]*)\]\((#{VEGA_DESTINATION})(\s+(?:"[^"]*"|'[^']*'))?\)/i) do
+        alt = Regexp.last_match(1)
+        path = published_path_for(Regexp.last_match(2), site_source)
+        title = Regexp.last_match(3).to_s
+        "![#{alt}](#{path}#{title})"
+      end
+      out.gsub!(/(<img\b[^>]*\bsrc=)(["'])([^"']+)\2/i) do
+        prefix = Regexp.last_match(1)
+        quote = Regexp.last_match(2)
+        source_ref = Regexp.last_match(3)
+        next Regexp.last_match(0) unless vega_reference?(source_ref)
+
+        "#{prefix}#{quote}#{published_path_for(source_ref, site_source)}#{quote}"
+      end
+      out
+    end
+
+    def rewrite_outside_code_fences(content)
+      fences = []
+      protected_source = content.to_s.gsub(FENCED_CODE_BLOCK) do
+        token = "UNALTRAWEBVEGAVISUALCODE#{fences.length}"
+        fences << Regexp.last_match(0)
+        token
+      end
+      protected_source.gsub!(INLINE_CODE_SPAN) do
+        token = "UNALTRAWEBVEGAVISUALCODE#{fences.length}"
+        fences << Regexp.last_match(0)
+        token
+      end
+      transformed = yield(protected_source)
+      fences.each_index.reverse_each do |index|
+        transformed.gsub!("UNALTRAWEBVEGAVISUALCODE#{index}", fences[index])
+      end
+      transformed
+    end
+
+    def published_path_for(source_ref, site_source)
+      source_path, decoration = reference_parts(source_ref)
+      source_relative, = resolve_project_path(
+        source_path,
+        site_source,
+        label: "Vega visualization source",
+        must_exist: true
+      )
+      fatal("Vega visualization source must end in .vl.json or .vg.json: #{source_ref}") unless source_relative.match?(VEGA_PATH_SUFFIX)
+
+      entries = manifest_entries(site_source)
+      matches = entries.select { |entry| entry.fetch("source") == source_relative }
+      if matches.empty?
+        fatal("Vega visualization source is not declared in #{MANIFEST_NAME}: #{source_relative}")
+      end
+      if matches.length > 1
+        fatal("Vega visualization source is ambiguous in #{MANIFEST_NAME}: #{source_relative}")
+      end
+
+      output_relative = matches.first.fetch("output")
+      if File.extname(output_relative).downcase == ".pdf"
+        fatal("Vega visualization output cannot be embedded as a web image: #{output_relative}; use SVG or PNG")
+      end
+      _, output_local = resolve_project_path(
+        output_relative,
+        site_source,
+        label: "Vega visualization output",
+        must_exist: true
+      )
+      fatal("Missing rendered Vega visualization output: #{output_relative}") unless File.file?(output_local)
+      source_root = site_root(site_source)
+      unless inside_project?(output_local, source_root)
+        fatal("Vega visualization output is outside the Jekyll source directory: #{output_relative}")
+      end
+      published_relative = Pathname.new(output_local).relative_path_from(Pathname.new(source_root)).to_s
+
+      reference_for(source_ref, published_relative, decoration)
+    end
+
+    def manifest_entries(site_source)
+      root = project_root(site_source)
+      manifest_path = File.join(root, MANIFEST_NAME)
+      fatal("Missing required Vega visualization manifest: #{MANIFEST_NAME}") unless File.file?(manifest_path)
+      fatal("Vega visualization manifest exceeds 1048576 bytes: #{MANIFEST_NAME}") if File.size(manifest_path) > 1024 * 1024
+
+      text = File.binread(manifest_path).force_encoding(Encoding::UTF_8)
+      fatal("Invalid UTF-8 in Vega visualization manifest: #{MANIFEST_NAME}") unless text.valid_encoding?
+      reject_unsafe_yaml!(text)
+      value = YAML.safe_load(text, permitted_classes: [], permitted_symbols: [], aliases: false)
+      fatal("Vega visualization manifest must be a mapping: #{MANIFEST_NAME}") unless value.is_a?(Hash)
+      fatal("Vega visualization manifest version must be 1") unless value["version"] == 1
+      %w[profile family].each do |field|
+        fatal("Vega visualization manifest requires a #{field}") unless value[field].is_a?(String) && !value[field].empty?
+      end
+
+      visualizations = value["visualizations"]
+      fatal("Vega visualization manifest visualizations must be a list") unless visualizations.is_a?(Array)
+
+      names = {}
+      sources = {}
+      outputs = {}
+      visualizations.each_with_index.map do |item, index|
+        fatal("Vega visualization at index #{index} must be a mapping") unless item.is_a?(Hash)
+        name = item["name"]
+        fatal("Vega visualization at index #{index} has an invalid name") unless name.is_a?(String) && name.match?(SAFE_NAME)
+        fatal("Duplicate Vega visualization name: #{name}") if names[name]
+
+        source_relative, source_local = resolve_project_path(
+          item["source"],
+          root,
+          label: "source for Vega visualization #{name}",
+          must_exist: true
+        )
+        output_relative, output_local = resolve_project_path(
+          item["output"],
+          root,
+          label: "output for Vega visualization #{name}",
+          must_exist: false
+        )
+        fatal("Vega visualization #{name} output cannot replace its source") if source_local == output_local
+        fatal("Duplicate Vega visualization source: #{source_relative}") if sources[source_relative]
+        fatal("Duplicate Vega visualization output: #{output_relative}") if outputs[output_relative]
+
+        output_suffix = File.extname(output_relative).downcase
+        fatal("Vega visualization #{name} output must use .svg, .png, or .pdf") unless OUTPUT_SUFFIXES.include?(output_suffix)
+        format = item["format"]
+        fatal("Vega visualization #{name} format must be a string") unless format.nil? || format.is_a?(String)
+        if format && !format.empty? && ".#{format.strip.downcase}" != output_suffix
+          fatal("Vega visualization #{name} output suffix does not match format #{format}")
+        end
+        engine = item.fetch("engine", "auto")
+        fatal("Vega visualization #{name} engine must be a string") unless engine.is_a?(String)
+        inputs = item.fetch("inputs", [])
+        unless inputs.is_a?(Array) && inputs.all? { |entry| entry.is_a?(String) && !entry.empty? }
+          fatal("Vega visualization #{name} inputs must be a list of paths")
+        end
+
+        names[name] = true
+        sources[source_relative] = true
+        outputs[output_relative] = true
+        { "name" => name, "source" => source_relative, "output" => output_relative }
+      end
+    rescue Psych::Exception, SystemCallError => e
+      fatal("Invalid Vega visualization manifest #{MANIFEST_NAME}: #{e.message}")
+    end
+
+    def reject_unsafe_yaml!(text)
+      stream = Psych.parse_stream(text)
+      fatal("#{MANIFEST_NAME} must contain exactly one YAML document") unless stream.children.length == 1
+      inspect_yaml_node!(stream)
+    end
+
+    def inspect_yaml_node!(node)
+      fatal("YAML aliases are not allowed in #{MANIFEST_NAME}") if node.is_a?(Psych::Nodes::Alias)
+      if node.is_a?(Psych::Nodes::Mapping)
+        keys = {}
+        node.children.each_slice(2) do |key, value|
+          fatal("YAML mapping keys must be scalars in #{MANIFEST_NAME}") unless key.is_a?(Psych::Nodes::Scalar)
+          fatal("Duplicate YAML key in #{MANIFEST_NAME}: #{key.value}") if keys[key.value]
+
+          keys[key.value] = true
+          inspect_yaml_node!(value)
+        end
+      elsif node.respond_to?(:children)
+        Array(node.children).each { |child| inspect_yaml_node!(child) }
+      end
+    end
+
+    def vega_reference?(source_ref)
+      local = source_ref.to_s.sub(BASEURL_PREFIX, "")
+      path = local.split(/[?#]/, 2).first.to_s
+      path.match?(VEGA_PATH_SUFFIX)
+    end
+
+    def reference_parts(source_ref, strict: true)
+      local = source_ref.to_s.sub(BASEURL_PREFIX, "")
+      match = /\A([^?#]*)([?#].*)?\z/m.match(local)
+      return [nil, ""] unless match
+
+      path = match[1]
+      decoration = match[2].to_s
+      if path.empty? || path.match?(REMOTE_PATH_PREFIX)
+        fatal("Vega visualization source must be a local project path: #{source_ref}") if strict
+        return [nil, decoration]
+      end
+      [path.sub(%r{\A/+}, ""), decoration]
+    end
+
+    def reference_for(source_ref, relative_path, decoration)
+      baseurl = source_ref[BASEURL_PREFIX]
+      return "#{baseurl}/#{relative_path}#{decoration}" if baseurl
+      return "/#{relative_path}#{decoration}" if source_ref.start_with?("/")
+
+      "{{ site.baseurl }}/#{relative_path}#{decoration}"
+    end
+
+    def resolve_project_path(raw, site_source, label:, must_exist:)
+      fatal("#{label} must be a non-empty project-relative path") unless raw.is_a?(String) && !raw.strip.empty?
+      fatal("#{label} contains a null byte") if raw.include?("\0")
+      relative = Pathname.new(raw)
+      if relative.absolute? || relative.each_filename.include?("..") || raw.match?(REMOTE_PATH_PREFIX)
+        fatal("#{label} must be a safe project-relative path: #{raw}")
+      end
+
+      cleaned = relative.cleanpath.to_s
+      fatal("#{label} must be a safe project-relative path: #{raw}") if cleaned.empty? || cleaned == "."
+      root = project_root(site_source)
+      resolved = resolve_location(File.expand_path(cleaned, root))
+      fatal("#{label} escapes the project: #{raw}") unless inside_project?(resolved, root)
+      fatal("#{label} is not a file: #{raw}") if must_exist && !File.file?(resolved)
+
+      canonical = Pathname.new(resolved).relative_path_from(Pathname.new(root)).to_s
+      [canonical, resolved]
+    rescue ArgumentError, SystemCallError => e
+      fatal("Cannot resolve #{label}: #{raw} (#{e.message})")
+    end
+
+    def resolve_location(path)
+      return File.realpath(path) if File.exist?(path) || File.symlink?(path)
+
+      missing = []
+      cursor = path
+      until File.exist?(cursor) || File.symlink?(cursor)
+        parent = File.dirname(cursor)
+        raise Errno::ENOENT, path if parent == cursor
+
+        missing.unshift(File.basename(cursor))
+        cursor = parent
+      end
+      File.expand_path(File.join(File.realpath(cursor), *missing))
+    end
+
+    def project_root(site_source)
+      source = site_root(site_source)
+      working = File.realpath(Dir.pwd)
+      root = inside_project?(source, working) ? working : source
+      root
+    rescue SystemCallError => e
+      fatal("Cannot resolve Vega visualization project root #{site_source}: #{e.message}")
+    end
+
+    def site_root(site_source)
+      root = File.realpath(site_source)
+      fatal("Vega visualization project root is not a directory: #{site_source}") unless File.directory?(root)
+      root
+    rescue SystemCallError => e
+      fatal("Cannot resolve Jekyll source directory #{site_source}: #{e.message}")
+    end
+
+    def inside_project?(path, root)
+      path == root || path.start_with?("#{root}#{File::SEPARATOR}")
+    end
+
+    def fatal(message)
+      raise Jekyll::Errors::FatalException, message
+    end
+  end
+end
+
+Jekyll::Hooks.register [:documents, :pages], :pre_render do |doc|
+  next unless doc.respond_to?(:content) && doc.content
+
+  doc.content = Unaltraweb::VegaVisualImages.rewrite(doc.content, site_source: doc.site.source)
+end if defined?(Jekyll::Hooks)

data/_plugins/web_capture_images.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require "rexml/document"
+
+module Unaltraweb
+  module WebCaptureImages
+    module_function
+
+    BASEURL_PREFIX = /\A\{\{\s*site\.baseurl\s*\}\}/.freeze
+    REMOTE_PATH_PREFIX = %r{\A(?:[a-z]+:)?//}i.freeze
+    FENCED_CODE_BLOCK = /^[ \t]*(`{3,}|~{3,})[^\n]*\n.*?^[ \t]*\1[ \t]*$/m.freeze
+    CAPTURE_SOURCE = /\.capture\.ya?ml/i.freeze
+    ALLOWED_ELEMENTS = %w[svg g defs metadata title desc image rect path text tspan marker polygon polyline line circle ellipse clippath mask lineargradient radialgradient stop pattern use namedview grid page].freeze
+    ALLOWED_ATTRIBUTES = %w[id class version baseprofile xmlns xlink inkscape x y x1 y1 x2 y2 cx cy r rx ry width height viewbox preserveaspectratio d points transform fill stroke stroke-width stroke-linecap stroke-linejoin stroke-miterlimit stroke-dasharray stroke-dashoffset opacity fill-opacity stroke-opacity fill-rule clip-rule clip-path mask font-family font-size font-style font-weight text-anchor dominant-baseline marker-start marker-mid marker-end markerwidth markerheight refx refy orient offset stop-color stop-opacity patternunits patterncontentunits gradientunits gradienttransform spreadmethod href style data-selector groupmode label space role aria-label pagecolor bordercolor borderopacity objecttolerance gridtolerance guidetolerance showgrid showguides zoom current-layer document-units pagecheckerboard deskcolor units originx originy spacingx spacingy].freeze
+    ALLOWED_STYLE_PROPERTIES = %w[fill stroke stroke-width stroke-linecap stroke-linejoin stroke-miterlimit stroke-dasharray stroke-dashoffset opacity fill-opacity stroke-opacity fill-rule clip-rule clip-path mask font-family font-size font-style font-weight text-anchor dominant-baseline marker-start marker-mid marker-end stop-color stop-opacity display visibility].freeze
+
+    def rewrite(content, site_source:)
+      return content if content.nil? || content.empty?
+
+      rewrite_outside_code_fences(content) { |chunk| rewrite_chunk(chunk, site_source: site_source) }
+    end
+
+    def rewrite_chunk(content, site_source:)
+      out = content.dup
+      out.gsub!(/!\[([^\]]*)\]\(([^)]*?#{CAPTURE_SOURCE})(\s+"[^"]*")?\)/i) do
+        alt = Regexp.last_match(1)
+        path = svg_path_for(Regexp.last_match(2), site_source)
+        title = Regexp.last_match(3).to_s
+        "![#{alt}](#{path}#{title})"
+      end
+      out.gsub!(/(<img\b[^>]*\bsrc=)(["'])([^"']+?#{CAPTURE_SOURCE})\2/i) do
+        prefix = Regexp.last_match(1)
+        quote = Regexp.last_match(2)
+        path = svg_path_for(Regexp.last_match(3), site_source)
+        "#{prefix}#{quote}#{path}#{quote}"
+      end
+      out
+    end
+
+    def rewrite_outside_code_fences(content)
+      source = content.to_s
+      fences = []
+      protected_source = source.gsub(FENCED_CODE_BLOCK) do
+        token = "UNALTRAWEBWEBFENCEDCODEBLOCK#{fences.length}"
+        fences << Regexp.last_match(0)
+        token
+      end
+      transformed = yield(protected_source)
+      fences.each_index.reverse_each do |index|
+        transformed.gsub!("UNALTRAWEBWEBFENCEDCODEBLOCK#{index}", fences[index])
+      end
+      transformed
+    end
+
+    def svg_path_for(capture_path, site_source)
+      edited = capture_path.sub(/\.capture\.ya?ml/i, ".capture.edited.svg")
+      if local_asset_exists?(edited, site_source)
+        validate_svg!(local_asset_path(edited, site_source))
+        return edited
+      end
+
+      generated = capture_path.sub(/\.capture\.ya?ml/i, ".capture.svg")
+      local = local_asset_path(generated, site_source)
+      unless local && File.file?(local)
+        raise Jekyll::Errors::FatalException, "Missing rendered web capture SVG for #{capture_path}. Run make web-capture-render."
+      end
+      validate_svg!(local)
+      generated
+    end
+
+    def validate_svg!(path)
+      text = File.read(path, encoding: "UTF-8")
+      lowered = text.downcase
+      raise "unsafe XML declaration" if lowered.include?("<!doctype") || lowered.include?("<!entity")
+
+      document = REXML::Document.new(text)
+      document.elements.each("//*") do |element|
+        tag = element.name.to_s.downcase
+        raise "unsupported element #{tag}" unless ALLOWED_ELEMENTS.include?(tag)
+
+        element.attributes.each_attribute do |attribute|
+          name = attribute.expanded_name.to_s.split(":").last.downcase
+          value = attribute.value.to_s.strip
+          lowered_value = value.downcase
+          raise "unsupported attribute #{name}" unless ALLOWED_ATTRIBUTES.include?(name)
+          raise "unsafe attribute #{name}" if lowered_value.include?("@import") || lowered_value.include?("javascript:") || lowered_value.include?("expression(")
+          if name == "href" && !value.start_with?("data:image/png;base64,", "#")
+            raise "external SVG reference"
+          end
+          without_local_urls = lowered_value.gsub(/url\(\s*["']?#[A-Za-z_][-:.A-Za-z0-9_]*["']?\s*\)/, "")
+          if without_local_urls.include?("url(")
+            raise "external CSS reference"
+          end
+          if name == "style"
+            value.split(";").map(&:strip).reject(&:empty?).each do |declaration|
+              property, separator, = declaration.partition(":")
+              raise "unsupported style #{property.strip}" if separator.empty? || !ALLOWED_STYLE_PROPERTIES.include?(property.strip.downcase)
+            end
+          end
+        end
+      end
+    rescue REXML::ParseException, RuntimeError => e
+      raise Jekyll::Errors::FatalException, "Unsafe web capture SVG #{path}: #{e.message}"
+    end
+
+    def local_asset_exists?(asset_path, site_source)
+      local = local_asset_path(asset_path, site_source)
+      local && File.file?(local)
+    end
+
+    def local_asset_path(asset_path, site_source)
+      local_path = asset_path
+        .sub(BASEURL_PREFIX, "")
+        .split(/[?#]/, 2)
+        .first.to_s
+        .sub(%r{\A/+}, "")
+      return nil if local_path.empty? || local_path.match?(REMOTE_PATH_PREFIX)
+
+      root = File.expand_path(site_source)
+      path = File.expand_path(local_path, root)
+      return nil unless path == root || path.start_with?("#{root}/")
+
+      path
+    end
+
+    Jekyll::Hooks.register :site, :post_read do |site|
+      site.static_files.reject! do |file|
+        relative = file.relative_path.to_s.downcase
+        if relative.end_with?(".capture.svg")
+          source = file.path.sub(/\.capture\.svg\z/i, ".capture.yml")
+          source_yaml = file.path.sub(/\.capture\.svg\z/i, ".capture.yaml")
+          edited = file.path.sub(/\.capture\.svg\z/i, ".capture.edited.svg")
+          remove = (!File.file?(source) && !File.file?(source_yaml)) || File.file?(edited)
+          validate_svg!(file.path) unless remove
+          remove
+        elsif relative.end_with?(".capture.edited.svg")
+          source = file.path.sub(/\.capture\.edited\.svg\z/i, ".capture.yml")
+          source_yaml = file.path.sub(/\.capture\.edited\.svg\z/i, ".capture.yaml")
+          remove = !File.file?(source) && !File.file?(source_yaml)
+          validate_svg!(file.path) unless remove
+          remove
+        else
+          relative.end_with?(".capture.yml", ".capture.yaml", ".capture.png")
+        end
+      end
+    end
+  end
+end
+
+Jekyll::Hooks.register [:documents, :pages], :pre_render do |doc|
+  next unless doc.respond_to?(:content) && doc.content
+
+  doc.content = Unaltraweb::WebCaptureImages.rewrite(doc.content, site_source: doc.site.source)
+end if defined?(Jekyll::Hooks)