@geekity/cms 0.3.0 → 0.4.0

package/dist/webmention/receive.d.ts

@@ -0,0 +1,141 @@
+import type { PostComment } from '../admin/store.ts';
+import type { CommentNotices, CommentRecords } from '../comments/records.ts';
+import type { CommentChecker } from '../comments/submission.ts';
+import type { Document } from '../content/document.ts';
+/**
+ * Taking a webmention somebody sent this site.
+ *
+ * Two steps, and the split is the whole design. The endpoint decides in one
+ * request whether the thing it was handed could possibly be a webmention —
+ * two http URLs, not the same one, the target a page here — and answers 202 or
+ * 400 without touching the network. Everything that needs somebody else's
+ * server is done afterwards, out of the request: fetching the source, checking
+ * that it really links here, reading its microformats, and putting the result
+ * in the moderation queue.
+ *
+ * That is why a source that turns out to say nothing about this site still
+ * gets a 202. The spec allows exactly this, and the alternative — holding the
+ * connection open while a stranger's server is fetched — is a way of being
+ * held open by a stranger's server.
+ *
+ * What lands is a comment like any other (doc-6), and it lands the same way:
+ * this module reads what the source says and hands `intakeComment` a proposed
+ * comment, so the file, the index, the {@link CommentChecker} seam, the
+ * verdict-to-status rule and the notice are the very ones a form submission
+ * gets. That is how TASK-52 sends it to Akismet as a `webmention` without this
+ * module knowing Akismet exists, and how a moderator's decision on a mention
+ * survives the page that sent it being edited and re-sent.
+ *
+ * What it is not held by is the closing rules: a post that stopped taking
+ * comments a year ago still hears about a page that links to it, exactly as it
+ * still hears a fediverse reply, because neither is something this site can
+ * stop happening.
+ */
+/** How long the source is given to answer before it is abandoned. */
+export declare const VERIFY_TIMEOUT_MS = 15000;
+/** One webmention as it arrived, before anything has been fetched. */
+export interface IncomingWebmention {
+    /** The page claiming to link here. */
+    readonly source: string;
+    /** The page on this site it claims to link to. */
+    readonly target: string;
+    /** The post that target names. */
+    readonly document: Document;
+    /** Where the request came from, **unhashed**, for the checker. */
+    readonly address?: string | undefined;
+    /** The `User-Agent` the sender sent. */
+    readonly userAgent?: string | undefined;
+    /** The `Referer` the sender sent. */
+    readonly referrer?: string | undefined;
+}
+/** What one submitted pair turned out to be. */
+export type WebmentionRequest = 
+/** Worth checking: the target is a page here and the source might link to it. */
+{
+    readonly ok: true;
+    readonly source: string;
+    readonly target: string;
+    readonly document: Document;
+}
+/** Not a webmention at all, with the reason a sender is told. */
+ | {
+    readonly ok: false;
+    readonly message: string;
+};
+/** What {@link checkWebmentionRequest} needs to answer. */
+export interface CheckWebmentionOptions {
+    /** The site's public origin. */
+    readonly baseUrl: string;
+    /** The public document one of this site's paths names, or `undefined`. */
+    readonly documentAt: (pathname: string) => Document | undefined;
+}
+/**
+ * Whether a submitted `source` and `target` are worth going and looking at.
+ *
+ * Everything here is decided from the two strings and this site's own index —
+ * nothing is fetched — because this is what a 400 has to be decided from: the
+ * spec wants a synchronous answer, and a synchronous answer must not depend on
+ * a stranger's server.
+ */
+export declare function checkWebmentionRequest(source: string, target: string, options: CheckWebmentionOptions): WebmentionRequest;
+/** What {@link verifyWebmention} needs around it. */
+export interface VerifyWebmentionOptions {
+    /** The webmention to check. */
+    readonly incoming: IncomingWebmention;
+    /** The comment files and the index over them. */
+    readonly records: CommentRecords;
+    /** Where the address salt lives. */
+    readonly dataDir: string;
+    /** The site's public origin. */
+    readonly baseUrl: string;
+    /** The checker, when the site named one. */
+    readonly checker?: CommentChecker | undefined;
+    /** Who to tell when one lands in the queue, handed to the intake (TASK-55). */
+    readonly notices?: CommentNotices | undefined;
+    /** The clock. */
+    readonly now: Date;
+    /** Where failures are reported. */
+    readonly logger: {
+        warn(message: string): void;
+    };
+}
+/** What became of one verification. */
+export type WebmentionOutcome = 
+/**
+ * The source links here and the comment was written or rewritten.
+ *
+ * `created` says which. A page that sends its webmention again every time it
+ * is edited would otherwise put the moderators through a notification each
+ * time (TASK-55), for an entry that has been in the queue all along.
+ */
+{
+    readonly kind: 'stored';
+    readonly comment: PostComment;
+    readonly created: boolean;
+}
+/** The source does not link here any more, and what it left is gone. */
+ | {
+    readonly kind: 'deleted';
+}
+/** The source does not link here, and there was nothing to remove. */
+ | {
+    readonly kind: 'ignored';
+}
+/** The source could not be read this time; whatever is stored stands. */
+ | {
+    readonly kind: 'unreachable';
+    readonly reason: string;
+};
+/**
+ * Go and look at the source, and put what it says in the queue.
+ *
+ * The three endings are the three things a source can be. A page that links
+ * here is stored, or rewritten where this site already has one from it — the
+ * source URL is the identity, so a blog post edited and re-sent updates its
+ * comment instead of adding a second. A page that has stopped linking here, or
+ * that has gone, takes its comment with it, which is the only way a webmention
+ * can be withdrawn. A page that could not be read at all changes nothing: a
+ * server having a bad afternoon must not delete what it said last week.
+ */
+export declare function verifyWebmention(options: VerifyWebmentionOptions): Promise<WebmentionOutcome>;
+//# sourceMappingURL=receive.d.ts.map

package/dist/webmention/receive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.d.ts","sourceRoot":"","sources":["../../src/webmention/receive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAmB,MAAM,wBAAwB,CAAC;AAC9F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAKvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAS,CAAC;AAExC,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,wCAAwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,gDAAgD;AAChD,MAAM,MAAM,iBAAiB;AAC3B,iFAAiF;AAC/E;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AACH,iEAAiE;GAC/D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,sBAAsB,GAC9B,iBAAiB,CA2BnB;AAED,qDAAqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC9C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC9C,iBAAiB;IACjB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAClD;AAED,uCAAuC;AACvC,MAAM,MAAM,iBAAiB;AAC3B;;;;;;GAMG;AACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACvF,wEAAwE;GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,sEAAsE;GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwF5B"}

package/dist/webmention/receive.js

@@ -0,0 +1,264 @@
+import { deleteComment, heldWebmention, intakeComment } from '../comments/records.js';
+import { sanitizeCommentHtml } from '../web/sanitize.js';
+import { readCapped, WEBMENTION_USER_AGENT } from './discovery.js';
+import { linksTo, sourceEntry } from './microformats.js';
+/**
+ * Taking a webmention somebody sent this site.
+ *
+ * Two steps, and the split is the whole design. The endpoint decides in one
+ * request whether the thing it was handed could possibly be a webmention —
+ * two http URLs, not the same one, the target a page here — and answers 202 or
+ * 400 without touching the network. Everything that needs somebody else's
+ * server is done afterwards, out of the request: fetching the source, checking
+ * that it really links here, reading its microformats, and putting the result
+ * in the moderation queue.
+ *
+ * That is why a source that turns out to say nothing about this site still
+ * gets a 202. The spec allows exactly this, and the alternative — holding the
+ * connection open while a stranger's server is fetched — is a way of being
+ * held open by a stranger's server.
+ *
+ * What lands is a comment like any other (doc-6), and it lands the same way:
+ * this module reads what the source says and hands `intakeComment` a proposed
+ * comment, so the file, the index, the {@link CommentChecker} seam, the
+ * verdict-to-status rule and the notice are the very ones a form submission
+ * gets. That is how TASK-52 sends it to Akismet as a `webmention` without this
+ * module knowing Akismet exists, and how a moderator's decision on a mention
+ * survives the page that sent it being edited and re-sent.
+ *
+ * What it is not held by is the closing rules: a post that stopped taking
+ * comments a year ago still hears about a page that links to it, exactly as it
+ * still hears a fediverse reply, because neither is something this site can
+ * stop happening.
+ */
+/** How long the source is given to answer before it is abandoned. */
+export const VERIFY_TIMEOUT_MS = 15_000;
+/**
+ * Whether a submitted `source` and `target` are worth going and looking at.
+ *
+ * Everything here is decided from the two strings and this site's own index —
+ * nothing is fetched — because this is what a 400 has to be decided from: the
+ * spec wants a synchronous answer, and a synchronous answer must not depend on
+ * a stranger's server.
+ */
+export function checkWebmentionRequest(source, target, options) {
+    if (source.trim() === '' || target.trim() === '') {
+        return refuse('A webmention needs both a source and a target.');
+    }
+    const from = webUrl(source);
+    const to = webUrl(target);
+    if (from === undefined)
+        return refuse('The source is not an http or https URL.');
+    if (to === undefined)
+        return refuse('The target is not an http or https URL.');
+    if (from.href === to.href)
+        return refuse('The source and the target are the same page.');
+    // A source on a loopback or private address is not somebody else's page: it
+    // is this network, and fetching it would make the site a way of reaching
+    // machines nobody outside can reach. This stops the obvious spelling of that
+    // and not a name that resolves to one — a receiver that has to be sure needs
+    // to check the address it actually connects to.
+    if (isPrivateHost(from.hostname))
+        return refuse('The source is not a public URL.');
+    const site = webUrl(options.baseUrl);
+    if (site === undefined || to.origin !== site.origin) {
+        return refuse('The target is not a page on this site.');
+    }
+    const document = options.documentAt(to.pathname);
+    if (document === undefined)
+        return refuse('There is no page here at that address.');
+    return { ok: true, source: from.href, target: to.href, document };
+}
+/**
+ * Go and look at the source, and put what it says in the queue.
+ *
+ * The three endings are the three things a source can be. A page that links
+ * here is stored, or rewritten where this site already has one from it — the
+ * source URL is the identity, so a blog post edited and re-sent updates its
+ * comment instead of adding a second. A page that has stopped linking here, or
+ * that has gone, takes its comment with it, which is the only way a webmention
+ * can be withdrawn. A page that could not be read at all changes nothing: a
+ * server having a bad afternoon must not delete what it said last week.
+ */
+export async function verifyWebmention(options) {
+    const { incoming, records, now } = options;
+    const held = heldWebmention(records, incoming.document.slug, incoming.source);
+    const fetched = await readSource(incoming.source);
+    if (fetched.kind === 'unreachable') {
+        options.logger.warn(`Could not read ${incoming.source} to verify a webmention: ${fetched.reason}`);
+        return { kind: 'unreachable', reason: fetched.reason };
+    }
+    if (fetched.kind === 'gone' || !mentions(fetched, incoming)) {
+        if (held === undefined)
+            return { kind: 'ignored' };
+        await deleteComment(records, held.id);
+        return { kind: 'deleted' };
+    }
+    const entry = fetched.html
+        ? sourceEntry(fetched.body, fetched.url, incoming.target)
+        : // A source that is not HTML — plain text, JSON, anything — has no
+            // microformats to read, so all that can be said about it is that it
+            // links here.
+            undefined;
+    const kind = entry?.kind ?? 'mention';
+    const author = {
+        name: entry?.author.name !== undefined && entry.author.name !== ''
+            ? entry.author.name
+            : hostOf(incoming.source),
+        url: entry?.author.url ?? null,
+        email: null,
+        avatar: entry?.author.photo ?? null,
+    };
+    // A like and a repost say nothing: the page's title is a title, not a
+    // comment, and printing it under a post as though somebody wrote it would be
+    // putting words in their mouth.
+    const wordless = kind === 'like' || kind === 'repost';
+    const text = wordless ? '' : (entry?.content.text ?? '');
+    const html = wordless
+        ? ''
+        : entry !== undefined && entry.content.html !== ''
+            ? sanitizeCommentHtml(entry.content.html)
+            : paragraph(text);
+    const proposed = {
+        slug: incoming.document.slug,
+        permalink: incoming.document.permalink,
+        source: 'webmention',
+        kind,
+        author,
+        content: { markdown: text, html },
+        submitted: entry?.published ?? now.toISOString(),
+        inReplyTo: null,
+        // The URL it was sent from rather than the entry's own `u-url`: this is
+        // the identity a later webmention is matched against, and the sender is
+        // the one who chose it.
+        url: incoming.source,
+        // A page has nobody to ask, and no address to ask them at.
+        notify: false,
+    };
+    const outcome = await intakeComment({
+        records,
+        origin: 'webmention',
+        comment: proposed,
+        // The target as its sender named it, rather than this site's own idea of
+        // the permalink: that is the URL the conversation is about.
+        post: { title: incoming.document.title, url: incoming.target },
+        dataDir: options.dataDir,
+        baseUrl: options.baseUrl,
+        checker: options.checker,
+        notices: options.notices,
+        address: incoming.address,
+        userAgent: incoming.userAgent,
+        referrer: incoming.referrer,
+        logger: options.logger,
+    });
+    if (outcome.kind === 'stored') {
+        return { kind: 'stored', comment: outcome.comment, created: outcome.created };
+    }
+    // A source nobody was holding anything from leaves nothing behind, and one
+    // whose entry went while this was deciding has already been dealt with.
+    return outcome.kind === 'discarded' && outcome.removed
+        ? { kind: 'deleted' }
+        : { kind: 'ignored' };
+}
+/** Fetch a source page, following redirects and reading no more than a page. */
+async function readSource(source) {
+    let response;
+    try {
+        response = await fetch(source, {
+            headers: { accept: 'text/html, */*;q=0.8', 'user-agent': WEBMENTION_USER_AGENT },
+            redirect: 'follow',
+            signal: AbortSignal.timeout(VERIFY_TIMEOUT_MS),
+        });
+    }
+    catch (thrown) {
+        return { kind: 'unreachable', reason: messageOf(thrown) };
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        // A page the server says is not there is a page that is not linking here.
+        // A server that is broken is a different thing and takes nothing with it.
+        if (response.status >= 400 && response.status < 500)
+            return { kind: 'gone' };
+        return { kind: 'unreachable', reason: `answered ${String(response.status)}` };
+    }
+    const type = response.headers.get('content-type') ?? '';
+    return {
+        kind: 'read',
+        body: await readCapped(response),
+        url: response.url === '' ? source : response.url,
+        html: /^\s*(text\/html|application\/xhtml\+xml)/i.test(type),
+    };
+}
+/**
+ * Whether what was read really links to the target.
+ *
+ * HTML is parsed, because a link is a link and the target written out in the
+ * prose is not one. Anything else — plain text, JSON, whatever somebody chose
+ * to publish — is searched for the target as it stands, which is all a format
+ * with no links can offer and what the spec asks for.
+ */
+function mentions(fetched, incoming) {
+    return fetched.html
+        ? linksTo(fetched.body, fetched.url, incoming.target)
+        : fetched.body.includes(incoming.target);
+}
+/** A URL, when it is an http or https one, and `undefined` otherwise. */
+function webUrl(value) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        return undefined;
+    if (url.hostname === '')
+        return undefined;
+    return url;
+}
+/** Whether a hostname is one only this network can see. */
+function isPrivateHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local'))
+        return true;
+    if (host === '::1' || host === '0.0.0.0')
+        return true;
+    if (host.startsWith('fc') || host.startsWith('fd') || host.startsWith('fe80:'))
+        return true;
+    const parts = host.split('.');
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part)))
+        return false;
+    const [a = 0, b = 0] = parts.map(Number);
+    if (a === 127 || a === 10 || a === 0)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    return false;
+}
+/** The host a source is on, for a page that never says who wrote it. */
+function hostOf(source) {
+    try {
+        return new URL(source).host;
+    }
+    catch {
+        return source;
+    }
+}
+/** A line of text as the one paragraph of HTML it is. */
+function paragraph(text) {
+    if (text === '')
+        return '';
+    return `<p>${text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;')}</p>`;
+}
+function refuse(message) {
+    return { ok: false, message };
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=receive.js.map

package/dist/webmention/receive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.js","sourceRoot":"","sources":["../../src/webmention/receive.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAItF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAsCxC;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAc,EACd,OAA+B;IAE/B,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,gDAAgD,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,yCAAyC,CAAC,CAAC;IACjF,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;IAEzF,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAEnF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,wCAAwC,CAAC,CAAC;IAEpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAuCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,kBAAkB,QAAQ,CAAC,MAAM,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAC9E,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnD,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI;QACxB,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;QACzD,CAAC,CAAC,kEAAkE;YAClE,oEAAoE;YACpE,cAAc;YACd,SAAS,CAAC;IAEd,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG;QACb,IAAI,EACF,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE;YAC1D,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI;YACnB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI;QAC9B,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;KACpC,CAAC;IACF,sEAAsE;IACtE,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,QAAQ,GAAG,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE;YAChD,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;QAC5B,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS;QACtC,MAAM,EAAE,YAAY;QACpB,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;QACjC,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE;QAChD,SAAS,EAAE,IAAI;QACf,wEAAwE;QACxE,wEAAwE;QACxE,wBAAwB;QACxB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,2DAA2D;QAC3D,MAAM,EAAE,KAAK;KACd,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,OAAO;QACP,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,QAAQ;QACjB,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO;QACpD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;QACrB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1B,CAAC;AAUD,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,qBAAqB,EAAE;YAChF,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG;QAChD,IAAI,EAAE,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,OAAqD,EACrD,QAA4B;IAE5B,OAAO,OAAO,CAAC,IAAI;QACjB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;AACnG,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/webmention/routes.d.ts

@@ -0,0 +1,37 @@
+import type { Hono } from 'hono';
+import type { GeekityEnv } from '../env.ts';
+/**
+ * The one public endpoint webmentions add.
+ *
+ * A single path under `/_geekity/`, like the comment form's, so it is out of
+ * the way of every permalink a site might ever mint and the route table does
+ * not grow with the site. It is what the `Link` header and the `<link>` in
+ * every post's head point at, and it takes nothing but a form with a `source`
+ * and a `target` in it.
+ */
+/** Where a webmention is sent. */
+export declare const WEBMENTION_PATH = "/_geekity/webmention";
+/** The fields a webmention carries, which the spec fixes. */
+export declare const WEBMENTION_FIELDS: {
+    readonly source: 'source';
+    readonly target: 'target';
+};
+/**
+ * The endpoint a page should advertise, or `undefined` when the site is not
+ * taking webmentions.
+ *
+ * Read off the site data the renderer already has rather than the settings, so
+ * a template asks one question and gets the same answer the endpoint gives.
+ * A file that does not mention the setting is a site that takes them: that is
+ * the default, and an older `site.json` should not quietly stop.
+ */
+export declare function webmentionEndpointFor(site: Record<string, unknown>): string | undefined;
+/**
+ * Register the webmention endpoint. Mounted by the public site.
+ *
+ * The answer is a 202 for anything worth going and looking at and a 400 for
+ * anything that is not, and the looking happens afterwards — see
+ * `receive.ts` for why that split is the whole design.
+ */
+export declare function mountWebmentions(app: Hono<GeekityEnv>): void;
+//# sourceMappingURL=routes.d.ts.map

package/dist/webmention/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/webmention/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAI5C;;;;;;;;GAQG;AAEH,kCAAkC;AAClC,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,MAAM,EAAE,QAAQ;CAAW,CAAC;AAEjF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CA0C5D"}

package/dist/webmention/routes.js

@@ -0,0 +1,75 @@
+import { readSiteSettings } from '../admin/settings.js';
+import { clientAddress } from '../admin/throttle.js';
+import { publicDocumentAt } from '../web/documents.js';
+import { checkWebmentionRequest } from './receive.js';
+/**
+ * The one public endpoint webmentions add.
+ *
+ * A single path under `/_geekity/`, like the comment form's, so it is out of
+ * the way of every permalink a site might ever mint and the route table does
+ * not grow with the site. It is what the `Link` header and the `<link>` in
+ * every post's head point at, and it takes nothing but a form with a `source`
+ * and a `target` in it.
+ */
+/** Where a webmention is sent. */
+export const WEBMENTION_PATH = '/_geekity/webmention';
+/** The fields a webmention carries, which the spec fixes. */
+export const WEBMENTION_FIELDS = { source: 'source', target: 'target' };
+/**
+ * The endpoint a page should advertise, or `undefined` when the site is not
+ * taking webmentions.
+ *
+ * Read off the site data the renderer already has rather than the settings, so
+ * a template asks one question and gets the same answer the endpoint gives.
+ * A file that does not mention the setting is a site that takes them: that is
+ * the default, and an older `site.json` should not quietly stop.
+ */
+export function webmentionEndpointFor(site) {
+    return site['webmentionsReceive'] === false ? undefined : WEBMENTION_PATH;
+}
+/**
+ * Register the webmention endpoint. Mounted by the public site.
+ *
+ * The answer is a 202 for anything worth going and looking at and a 400 for
+ * anything that is not, and the looking happens afterwards — see
+ * `receive.ts` for why that split is the whole design.
+ */
+export function mountWebmentions(app) {
+    app.post(WEBMENTION_PATH, async (c) => {
+        const { store, config, webmentions } = c.var;
+        if (!readSiteSettings(config.contentDir).webmentionsReceive) {
+            // A 404 rather than a 403: a site that does not take webmentions has no
+            // endpoint, and that is what having no endpoint looks like.
+            return c.text('This site does not take webmentions.', 404);
+        }
+        const body = await c.req.parseBody();
+        const checked = checkWebmentionRequest(text(body[WEBMENTION_FIELDS.source]), text(body[WEBMENTION_FIELDS.target]), {
+            baseUrl: config.baseUrl,
+            documentAt: (pathname) => publicDocumentAt(store, pathname),
+        });
+        if (!checked.ok)
+            return c.text(checked.message, 400);
+        // Nothing waits for the check: the sender is answered now and the source
+        // is fetched afterwards, and `receive` never rejects.
+        void webmentions.receive({
+            source: checked.source,
+            target: checked.target,
+            document: checked.document,
+            address: clientAddress(c, config),
+            userAgent: c.req.header('user-agent'),
+            referrer: c.req.header('referer'),
+        });
+        return c.text('Accepted. The source will be checked shortly.', 202);
+    });
+    // A GET on the endpoint is somebody looking rather than sending, and saying
+    // so is friendlier than a 404 on a URL that is really there.
+    app.get(WEBMENTION_PATH, (c) => {
+        c.header('allow', 'POST');
+        return c.text('Send a webmention here with a POST carrying source and target.', 405);
+    });
+}
+/** A form field as a string. A file upload, or a missing field, is the empty one. */
+function text(value) {
+    return typeof value === 'string' ? value : '';
+}
+//# sourceMappingURL=routes.js.map

package/dist/webmention/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/webmention/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;;GAQG;AAEH,kCAAkC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IACjE,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAqB;IACpD,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAE7C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAC5D,wEAAwE;YACxE,4DAA4D;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,sBAAsB,CACpC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EACpC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EACpC;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC5D,CACF,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAErD,yEAAyE;QACzE,sDAAsD;QACtD,KAAK,WAAW,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;YACrC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,gEAAgE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/webmention/service.d.ts

@@ -0,0 +1,94 @@
+import type { AdminStore, SentWebmention } from '../admin/store.ts';
+import type { CommentNotices } from '../comments/records.ts';
+import type { ResolvedConfig } from '../config.ts';
+import type { ContentStore } from '../content/store.ts';
+import type { DocumentChange } from '../content/sync.ts';
+import type { IncomingWebmention, WebmentionOutcome } from './receive.ts';
+/**
+ * Telling the pages a post links to that it links to them.
+ *
+ * The other half of the same conversation the fediverse carries: a post is
+ * published, and everything it points at is asked whether it takes webmentions
+ * and told if it does. It is driven by the same index changes delivery is —
+ * a post saved in the editor and a post edited on disk are one thing here —
+ * and, like delivery, it ignores a full scan: the boot scan reports a cold
+ * index as a directory full of creations, and notifying every page the archive
+ * has ever linked to every time somebody deleted the database would be a
+ * denial of service with this site's name on it.
+ *
+ * What is recorded is a cache of outcomes, one row per (post, target), exactly
+ * as `ap_deliveries` is (decision-9): the links themselves are in the post's
+ * file, so a database thrown away costs the record of how it went and nothing
+ * else — and {@link WebmentionSender.send} reads the file again rather than
+ * replaying anything.
+ */
+/** How long one webmention POST is given before it is abandoned. */
+export declare const SEND_TIMEOUT_MS = 10000;
+/** What one post's links came to. */
+export interface WebmentionReport {
+    /** The post they were in. */
+    readonly slug: string;
+    /** Its absolute URL, which is the `source` that was sent. */
+    readonly source: string;
+    /** One row per external link, in the order the post links to them. */
+    readonly sent: readonly SentWebmention[];
+}
+/** Where a service reports what it could not do. `console` will do. */
+export interface WebmentionLogger {
+    warn(message: string): void;
+}
+/** What {@link createWebmentionService} needs. */
+export interface CreateWebmentionServiceOptions {
+    /** Where the outcomes are recorded, and where the comment index lives. */
+    admin: AdminStore;
+    /** The content index, which a resend reads the post out of. */
+    store: ContentStore;
+    /**
+     * Config after defaults: the base URL, the content and data directories, the
+     * clock, and the checker an incoming webmention is put through.
+     */
+    config: Pick<ResolvedConfig, 'baseUrl' | 'contentDir' | 'dataDir' | 'now' | 'commentChecker'>;
+    /** Where failures are reported. Defaults to `console`. */
+    logger?: WebmentionLogger | undefined;
+    /**
+     * Who to tell when an incoming webmention lands in the queue (TASK-55).
+     *
+     * Handed straight to the intake, which decides whether this one is worth a
+     * message. Optional, because a service built for a test of sending has
+     * nobody to tell; the CMS always hands one in.
+     */
+    notifications?: CommentNotices | undefined;
+}
+/** Sends a site's webmentions, takes the ones sent to it, and remembers both. */
+export interface WebmentionService {
+    /**
+     * Consider one index change and tell whatever pages it moved. Returns as
+     * soon as the sends are queued rather than when they are answered — a save
+     * is not something a stranger's server should be able to hold up.
+     */
+    handle(change: DocumentChange): void;
+    /**
+     * Send one post's webmentions again, from the file as it now reads.
+     *
+     * Not "send those again": the links are read out of the post at the moment
+     * this is called (decision-9), so a link added since the last publish goes
+     * out and one taken out is told, which is what somebody pressing Resend is
+     * asking for. `undefined` when no post answers to that slug.
+     */
+    send(slug: string): Promise<WebmentionReport | undefined>;
+    /**
+     * Take one webmention the endpoint has accepted and check it, out of the
+     * request that brought it.
+     *
+     * Returns as soon as it is queued — the sender has already had its 202, and
+     * fetching a stranger's page is not something a stranger's connection should
+     * be held open for. The promise it hands back is for a test, or for a caller
+     * that wants to know what became of one; nothing has to look at it.
+     */
+    receive(incoming: IncomingWebmention): Promise<WebmentionOutcome>;
+    /** Resolve once every queued send and check has finished, however it finished. */
+    settled(): Promise<void>;
+}
+/** Build the webmention service for one site. */
+export declare function createWebmentionService(options: CreateWebmentionServiceOptions): WebmentionService;
+//# sourceMappingURL=service.d.ts.map

package/dist/webmention/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/webmention/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAC1F,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE1E;;;;;;;;;;;;;;;;;GAiBG;AAEH,oEAAoE;AACpE,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,8BAA8B;IAC7C,0EAA0E;IAC1E,KAAK,EAAE,UAAU,CAAC;IAClB,+DAA+D;IAC/D,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,KAAK,GAAG,gBAAgB,CAAC,CAAC;IAC9F,0DAA0D;IAC1D,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACtC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC5C;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACrC;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,kFAAkF;IAClF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,iDAAiD;AACjD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,iBAAiB,CAsKnB"}