@riebeckite/plugin-webmention 0.0.6

package/dist/index.js

@@ -0,0 +1,1159 @@
+// index.ts
+import {
+  createStyleAsset,
+  definePlugin
+} from "@riebeckite/core";
+
+// src/provider.ts
+var WEBMENTION_CAPABILITIES = ["store", "query"];
+function supportsWebmentionCapability(provider, capability) {
+  return provider.capabilities.has(capability);
+}
+var UnsupportedWebmentionQueryError = class extends Error {
+  constructor(query, requiredCapability) {
+    super(
+      `Webmention provider does not support ${requiredCapability} operations.`
+    );
+    this.query = query;
+    this.requiredCapability = requiredCapability;
+  }
+  query;
+  requiredCapability;
+  name = "UnsupportedWebmentionQueryError";
+};
+function requiredCapabilityForQuery(_query) {
+  return "query";
+}
+function assertWebmentionQuerySupported(provider, query) {
+  const capability = requiredCapabilityForQuery(query);
+  if (!supportsWebmentionCapability(provider, capability)) {
+    throw new UnsupportedWebmentionQueryError(query, capability);
+  }
+}
+
+// src/diagnostics.ts
+var WEBMENTION_PLUGIN_NAME = "webmention";
+function buildWebmentionDiagnostics(provider, options) {
+  const diagnostics = [];
+  if (options.render && !supportsWebmentionCapability(provider, "query")) {
+    diagnostics.push({
+      code: "webmention-render-requires-query",
+      severity: "warning",
+      pluginName: WEBMENTION_PLUGIN_NAME,
+      message: "The webmention provider cannot query, so stored mentions will not render near articles.",
+      suggestion: 'Use a provider that advertises the "query" capability or set render: false.'
+    });
+  }
+  if (!supportsWebmentionCapability(provider, "store")) {
+    diagnostics.push({
+      code: "webmention-receive-requires-store",
+      severity: "warning",
+      pluginName: WEBMENTION_PLUGIN_NAME,
+      message: "The webmention provider cannot store, so the receive endpoint rejects deliveries with 503.",
+      suggestion: 'Use a provider that advertises the "store" capability or disable the plugin.'
+    });
+  }
+  return diagnostics;
+}
+
+// src/http.ts
+function jsonResponse(status, value) {
+  return {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8" },
+    json: value
+  };
+}
+function errorResponse(status, error) {
+  return jsonResponse(status, { error });
+}
+
+// src/url.ts
+function normalizeWebmentionUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (url.username !== "" || url.password !== "") return null;
+  url.hash = "";
+  url.hostname = url.hostname.toLowerCase();
+  return url.toString();
+}
+function urlComparisonKey(value) {
+  const normalized = normalizeWebmentionUrl(value);
+  if (normalized === null) return value;
+  const url = new URL(normalized);
+  url.hash = "";
+  if (url.pathname.length > 1 && url.pathname.endsWith("/")) {
+    url.pathname = url.pathname.slice(0, -1);
+  }
+  return url.toString();
+}
+function resolvePublicUrl(permalink, baseUrl) {
+  try {
+    return new URL(permalink, baseUrl ?? "https://example.invalid").toString();
+  } catch {
+    return null;
+  }
+}
+
+// src/targets.ts
+function entryPublicUrl(entry, config) {
+  if (config?.site.baseUrl) {
+    return resolvePublicUrl(entry.permalink, config.site.baseUrl);
+  }
+  return normalizeWebmentionUrl(entry.permalink);
+}
+function findTargetEntry(manifest, config, target) {
+  const key = urlComparisonKey(target);
+  for (const entry of manifest.entries) {
+    const publicUrl = entryPublicUrl(entry, config);
+    if (publicUrl !== null && urlComparisonKey(publicUrl) === key) return entry;
+  }
+  return void 0;
+}
+function isAllowedTarget(target, allowedTargets, config) {
+  const key = urlComparisonKey(target);
+  for (const candidate of allowedTargets) {
+    const resolved = config?.site.baseUrl ? resolvePublicUrl(candidate, config.site.baseUrl) : normalizeWebmentionUrl(candidate);
+    if (resolved !== null && urlComparisonKey(resolved) === key) return true;
+  }
+  return false;
+}
+
+// src/feed.ts
+function createWebmentionFeedHandler(options, provider) {
+  return async (context) => {
+    if (!supportsWebmentionCapability(provider, "query")) {
+      return errorResponse(501, "unsupported_query");
+    }
+    const target = context.request.query.target;
+    const limit = parsePositiveInteger(context.request.query.limit) ?? options.limit;
+    const since = context.request.query.since;
+    let mentions;
+    try {
+      if (target !== void 0 && target !== "") {
+        const result = await provider.query({
+          type: "mentions_for_target",
+          target,
+          limit
+        });
+        mentions = result.mentions;
+      } else {
+        const result = await provider.query({
+          type: "all_mentions",
+          limit,
+          since
+        });
+        mentions = result.mentions;
+      }
+    } catch (error) {
+      if (error instanceof UnsupportedWebmentionQueryError) {
+        return errorResponse(501, "unsupported_query");
+      }
+      return errorResponse(503, "storage_unavailable");
+    }
+    return {
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "public, max-age=60"
+      },
+      json: buildFeed(context.manifest, context.config, mentions)
+    };
+  };
+}
+function buildFeed(manifest, config, mentions) {
+  return {
+    version: "1",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    count: mentions.length,
+    mentions: mentions.map((mention) => ({
+      ...mention,
+      entry: summarizeEntry(manifest, config, mention.target)
+    }))
+  };
+}
+function summarizeEntry(manifest, config, target) {
+  const entry = findTargetEntry(manifest, config, target);
+  if (!entry) return null;
+  return {
+    slug: entry.slug,
+    permalink: entry.permalink,
+    title: entry.title
+  };
+}
+function parsePositiveInteger(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 1e3)
+    return void 0;
+  return parsed;
+}
+
+// src/parse.ts
+var ANCHOR_PATTERN = /<a\b([^>]*)>([\s\S]*?)<\/a>/gi;
+var ATTRIBUTE_PATTERN = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+))/g;
+var META_PATTERN = /<meta\b([^>]*?)\/?>/gi;
+var TITLE_PATTERN = /<title\b[^>]*>([\s\S]*?)<\/title>/i;
+var TIME_PATTERN = /<time\b([^>]*)>([\s\S]*?)<\/time>/gi;
+var PARAGRAPH_PATTERN = /<p\b[^>]*>([\s\S]*?)<\/p>/i;
+var H_CARD_PATTERN = /<[a-z][a-z0-9-]*\b([^>]*)>([\s\S]*?)<\/[a-z][a-z0-9-]*>/gi;
+var MAX_TEXT_LENGTH = 280;
+function parseWebmentionSource(html, sourceUrl) {
+  const meta = extractMeta(html);
+  const title = firstText(
+    extractTagText(html, TITLE_PATTERN),
+    meta.get("og:title"),
+    meta.get("twitter:title")
+  );
+  const description = firstText(
+    meta.get("description"),
+    meta.get("og:description"),
+    extractTagText(html, PARAGRAPH_PATTERN)
+  );
+  const publishedAt = firstText(
+    meta.get("article:published_time"),
+    meta.get("og:updated_time"),
+    extractFirstTime(html)
+  );
+  const author = extractAuthor(html, sourceUrl, meta);
+  return {
+    ...title === void 0 ? {} : { title: truncate(title) },
+    ...description === void 0 ? {} : { excerpt: truncate(description) },
+    ...author === void 0 ? {} : { author },
+    ...publishedAt === void 0 ? {} : { publishedAt },
+    links: extractLinks(html, sourceUrl)
+  };
+}
+function findTargetLink(source, target) {
+  const targetKey = normalizeWebmentionUrl(target) ?? target;
+  const targetWithoutSlash = targetKey.replace(/\/$/, "");
+  for (const link of source.links) {
+    if (link.normalized === null) continue;
+    const linkWithoutSlash = link.normalized.replace(/\/$/, "");
+    if (linkWithoutSlash === targetWithoutSlash) return link;
+  }
+  return null;
+}
+function webmentionTypeForRels(rels) {
+  const values = rels.map((rel) => rel.toLowerCase());
+  if (values.includes("in-reply-to") || values.includes("reply")) {
+    return "reply";
+  }
+  if (values.includes("repost") || values.includes("reblog")) return "repost";
+  if (values.includes("like")) return "like";
+  if (values.includes("bookmark")) return "bookmark";
+  return "mention";
+}
+function extractLinks(html, sourceUrl) {
+  const links = [];
+  for (const match of html.matchAll(ANCHOR_PATTERN)) {
+    const attributes = parseAttributes(match[1] ?? "");
+    const href = attributes.get("href");
+    if (!href) continue;
+    links.push({
+      href,
+      normalized: resolve(href, sourceUrl),
+      rels: (attributes.get("rel") ?? "").split(/\s+/).filter((rel) => rel !== ""),
+      text: truncate(stripTags(decodeEntities(match[2] ?? "")))
+    });
+  }
+  return links;
+}
+function extractAuthor(html, sourceUrl, meta) {
+  const hCard = extractHCard(html, sourceUrl);
+  if (hCard) return hCard;
+  const name = firstText(meta.get("author"), meta.get("article:author"));
+  const url = firstText(meta.get("author:url"), extractAuthorLink(html));
+  if (!name && !url) return void 0;
+  return {
+    ...name === void 0 ? {} : { name: truncate(name) },
+    ...url === void 0 || resolve(url, sourceUrl) === null ? {} : { url: resolve(url, sourceUrl) }
+  };
+}
+function extractHCard(html, sourceUrl) {
+  for (const match of html.matchAll(H_CARD_PATTERN)) {
+    const classes = parseAttributes(match[1] ?? "").get("class") ?? "";
+    if (!/\bh-card\b/.test(classes)) continue;
+    const body = match[2] ?? "";
+    const name = extractElementText(body, "p-name");
+    const url = extractElementAttribute(body, "u-url", "href");
+    if (!name && !url) continue;
+    return {
+      ...name === void 0 ? {} : { name: truncate(name) },
+      ...url === void 0 || resolve(url, sourceUrl) === null ? {} : { url: resolve(url, sourceUrl) }
+    };
+  }
+  return void 0;
+}
+function extractElementText(html, classToken) {
+  const pattern = new RegExp(
+    `<[a-z][a-z0-9-]*\\b[^>]*\\bclass\\s*=\\s*(?:"[^"]*\\b${classToken}\\b[^"]*"|'[^']*\\b${classToken}\\b[^']*')[^>]*>([\\s\\S]*?)</[a-z][a-z0-9-]*>`,
+    "i"
+  );
+  const match = html.match(pattern);
+  return match ? stripTags(decodeEntities(match[1] ?? "")) : void 0;
+}
+function extractElementAttribute(html, classToken, attribute) {
+  const pattern = new RegExp(
+    `<[a-z][a-z0-9-]*\\b([^>]*\\bclass\\s*=\\s*(?:"[^"]*\\b${classToken}\\b[^"]*"|'[^']*\\b${classToken}\\b[^']*')[^>]*)>`,
+    "i"
+  );
+  const match = html.match(pattern);
+  if (!match) return void 0;
+  return parseAttributes(match[1] ?? "").get(attribute);
+}
+function extractAuthorLink(html) {
+  for (const match of html.matchAll(ANCHOR_PATTERN)) {
+    const attributes = parseAttributes(match[1] ?? "");
+    const rels = (attributes.get("rel") ?? "").toLowerCase().split(/\s+/);
+    if (rels.includes("author")) return attributes.get("href");
+  }
+  return void 0;
+}
+function extractMeta(html) {
+  const meta = /* @__PURE__ */ new Map();
+  for (const match of html.matchAll(META_PATTERN)) {
+    const attributes = parseAttributes(match[1] ?? "");
+    const key = (attributes.get("property") ?? attributes.get("name") ?? attributes.get("itemprop") ?? "").toLowerCase();
+    const content = attributes.get("content");
+    if (key && content !== void 0 && !meta.has(key)) {
+      meta.set(key, content);
+    }
+  }
+  return meta;
+}
+function extractFirstTime(html) {
+  for (const match of html.matchAll(TIME_PATTERN)) {
+    const datetime = parseAttributes(match[1] ?? "").get("datetime");
+    const value = datetime ?? stripTags(decodeEntities(match[2] ?? ""));
+    if (value) return value;
+  }
+  return void 0;
+}
+function extractTagText(html, pattern) {
+  const match = html.match(pattern);
+  if (!match) return void 0;
+  const text = stripTags(decodeEntities(match[1] ?? ""));
+  return text === "" ? void 0 : text;
+}
+function parseAttributes(input) {
+  const attributes = /* @__PURE__ */ new Map();
+  for (const match of input.matchAll(ATTRIBUTE_PATTERN)) {
+    const name = (match[1] ?? "").toLowerCase();
+    const value = match[2] ?? match[3] ?? match[4] ?? "";
+    if (name !== "") attributes.set(name, value);
+  }
+  return attributes;
+}
+function resolve(value, base) {
+  const decoded = decodeEntities(value.trim());
+  if (decoded === "") return null;
+  try {
+    return normalizeWebmentionUrl(new URL(decoded, base).toString());
+  } catch {
+    return null;
+  }
+}
+function stripTags(value) {
+  return collapseWhitespace(value.replace(/<[^>]*>/g, " "));
+}
+function collapseWhitespace(value) {
+  return value.replace(/\s+/g, " ").trim();
+}
+function truncate(value) {
+  const text = collapseWhitespace(value);
+  return text.length <= MAX_TEXT_LENGTH ? text : `${text.slice(0, MAX_TEXT_LENGTH - 1).trimEnd()}…`;
+}
+function firstText(...values) {
+  for (const value of values) {
+    if (value !== void 0 && value.trim() !== "") return value;
+  }
+  return void 0;
+}
+var NAMED_ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " "
+};
+function decodeEntities(value) {
+  return value.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (entity, body) => {
+    if (body.startsWith("#")) {
+      const isHex = body[1] === "x" || body[1] === "X";
+      const code = Number.parseInt(body.slice(isHex ? 2 : 1), isHex ? 16 : 10);
+      if (Number.isFinite(code) && code > 0 && code <= 1114111) {
+        return String.fromCodePoint(code);
+      }
+      return entity;
+    }
+    return NAMED_ENTITIES[body.toLowerCase()] ?? entity;
+  });
+}
+
+// src/verify.ts
+var DEFAULT_WEBMENTION_TIMEOUT_MS = 1e4;
+var DEFAULT_WEBMENTION_MAX_BYTES = 1e6;
+var DEFAULT_WEBMENTION_USER_AGENT = "Riebeckite-Webmention/1.0 (+https://github.com/Rerurate514/riebeckite)";
+var MAX_REDIRECTS = 10;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function createWebmentionSourceFetcher(options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_WEBMENTION_TIMEOUT_MS;
+  const maxBytes = options.maxBytes ?? DEFAULT_WEBMENTION_MAX_BYTES;
+  const userAgent = options.userAgent ?? DEFAULT_WEBMENTION_USER_AGENT;
+  const allowPrivateHosts = options.allowPrivateHosts ?? false;
+  const resolveHostname = options.resolveHostname ?? defaultResolveHostname;
+  return async (rawUrl) => {
+    const url = normalizeWebmentionUrl(rawUrl);
+    if (url === null) return null;
+    if (typeof globalThis.fetch !== "function") return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      let currentUrl = url;
+      for (let redirects = 0; ; redirects += 1) {
+        if (!allowPrivateHosts && await isBlockedSourceUrl(currentUrl, resolveHostname)) {
+          return null;
+        }
+        const response = await globalThis.fetch(currentUrl, {
+          redirect: "manual",
+          signal: controller.signal,
+          headers: {
+            accept: "text/html,application/xhtml+xml",
+            "user-agent": userAgent
+          }
+        });
+        if (REDIRECT_STATUSES.has(response.status)) {
+          const location = response.headers.get("location");
+          await cancelBody(response);
+          if (location === null || redirects >= MAX_REDIRECTS) return null;
+          const next = resolveRedirectUrl(location, currentUrl);
+          if (next === null) return null;
+          currentUrl = next;
+          continue;
+        }
+        if (!response.ok) return null;
+        const contentType = response.headers.get("content-type") ?? "";
+        if (contentType !== "" && !isHtmlContentType(contentType)) return null;
+        const html = await readBodyWithinLimit(response, maxBytes);
+        if (html === null) return null;
+        return { url: response.url || currentUrl, html };
+      }
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+async function verifyWebmention(input) {
+  const source = normalizeWebmentionUrl(input.source);
+  const target = normalizeWebmentionUrl(input.target);
+  if (source === null) return { ok: false, reason: "invalid_source" };
+  if (target === null) return { ok: false, reason: "invalid_target" };
+  const document = await input.fetchSource(source);
+  if (document === null) return { ok: false, reason: "source_unreachable" };
+  const parsed = parseWebmentionSource(document.html, source);
+  const link = findTargetLink(parsed, target);
+  if (link === null) return { ok: false, reason: "no_link_found" };
+  return {
+    ok: true,
+    mention: {
+      source,
+      target,
+      type: webmentionTypeForRels(link.rels),
+      verifiedAt: input.verifiedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      ...parsed.publishedAt === void 0 ? {} : { publishedAt: parsed.publishedAt },
+      ...parsed.title === void 0 ? {} : { title: parsed.title },
+      ...parsed.excerpt === void 0 ? {} : { excerpt: parsed.excerpt },
+      ...parsed.author === void 0 ? {} : { author: parsed.author }
+    }
+  };
+}
+var defaultResolveHostname = async (hostname) => {
+  const { lookup } = await import("node:dns/promises");
+  const records = await lookup(hostname, { all: true });
+  return records.map((record) => record.address);
+};
+async function isBlockedSourceUrl(url, resolveHostname) {
+  const hostname = new URL(url).hostname;
+  if (isDisallowedHostname(hostname)) return true;
+  const host = normalizeHostname(hostname);
+  if (isIpAddressLiteral(host)) return false;
+  let addresses;
+  try {
+    addresses = await resolveHostname(host);
+  } catch {
+    return false;
+  }
+  return addresses.some((address) => isDisallowedIpAddress(address));
+}
+function isDisallowedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (host === "" || host === "localhost" || host.endsWith(".localhost")) {
+    return true;
+  }
+  return isIpAddressLiteral(host) && isDisallowedIpAddress(host);
+}
+function isDisallowedIpAddress(address) {
+  const host = normalizeHostname(address);
+  return host.includes(":") ? isDisallowedIpv6(host) : isDisallowedIpv4(host);
+}
+function normalizeHostname(hostname) {
+  return hostname.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function isIpAddressLiteral(host) {
+  return host.includes(":") || /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
+}
+function isDisallowedIpv4(host) {
+  const octets = parseIpv4(host);
+  if (octets === null) return true;
+  const [a, b, c] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 192 && b === 0 && c === 2) return true;
+  if (a === 192 && b === 88 && c === 99) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 198 && b === 51 && c === 100) return true;
+  if (a === 203 && b === 0 && c === 113) return true;
+  return a >= 224;
+}
+function isDisallowedIpv6(host) {
+  const bytes = parseIpv6(host);
+  if (bytes === null) return true;
+  if (bytes.every((byte) => byte === 0)) return true;
+  if (bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1) {
+    return true;
+  }
+  if (bytes.slice(0, 10).every((byte) => byte === 0)) {
+    return isDisallowedIpv4Bytes(bytes, 12);
+  }
+  if ((bytes[0] & 254) === 252) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 192) return true;
+  if (bytes[0] === 255) return true;
+  if (bytes[0] === 32 && bytes[1] === 2) return true;
+  if (bytes[0] === 32 && bytes[1] === 1 && bytes[2] === 13 && bytes[3] === 184) {
+    return true;
+  }
+  if (bytes[0] === 1 && bytes[1] === 0) return true;
+  if (bytes[0] === 0 && bytes[1] === 100 && bytes[2] === 255 && bytes[3] === 155) {
+    return true;
+  }
+  return false;
+}
+function isDisallowedIpv4Bytes(bytes, offset) {
+  const a = bytes[offset];
+  const b = bytes[offset + 1];
+  const c = bytes[offset + 2];
+  const d = bytes[offset + 3];
+  return isDisallowedIpv4(`${a}.${b}.${c}.${d}`);
+}
+function parseIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const value = Number(part);
+    if (value > 255) return null;
+    octets.push(value);
+  }
+  const [a, b, c, d] = octets;
+  if (a === void 0 || b === void 0 || c === void 0 || d === void 0) {
+    return null;
+  }
+  return [a, b, c, d];
+}
+function parseIpv6(host) {
+  const withoutZone = host.split("%", 1)[0] ?? host;
+  if (!withoutZone.includes(":")) return null;
+  const sections = withoutZone.split("::");
+  if (sections.length > 2) return null;
+  const head = parseHextets(sections[0] ?? "");
+  const tail = sections.length === 2 ? parseHextets(sections[1] ?? "") : [];
+  if (head === null || tail === null) return null;
+  let hextets;
+  if (sections.length === 2) {
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0) return null;
+    hextets = [...head, ...new Array(missing).fill(0), ...tail];
+  } else {
+    hextets = head;
+  }
+  if (hextets.length !== 8) return null;
+  const bytes = new Uint8Array(16);
+  for (let index = 0; index < 8; index += 1) {
+    const value = hextets[index];
+    bytes[index * 2] = value >> 8 & 255;
+    bytes[index * 2 + 1] = value & 255;
+  }
+  return bytes;
+}
+function parseHextets(segment) {
+  if (segment === "") return [];
+  const pieces = segment.split(":");
+  const hextets = [];
+  for (let index = 0; index < pieces.length; index += 1) {
+    const piece = pieces[index];
+    if (piece === void 0) return null;
+    if (piece.includes(".")) {
+      if (index !== pieces.length - 1) return null;
+      const octets = parseIpv4(piece);
+      if (octets === null) return null;
+      const [first, second, third, fourth] = octets;
+      hextets.push((first << 8 | second) >>> 0);
+      hextets.push((third << 8 | fourth) >>> 0);
+      continue;
+    }
+    if (!/^[0-9a-f]{1,4}$/.test(piece)) return null;
+    hextets.push(Number.parseInt(piece, 16));
+  }
+  return hextets;
+}
+function resolveRedirectUrl(location, baseUrl) {
+  try {
+    return normalizeWebmentionUrl(new URL(location, baseUrl).toString());
+  } catch {
+    return null;
+  }
+}
+async function readBodyWithinLimit(response, maxBytes) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null) {
+    const length = Number(declared);
+    if (Number.isFinite(length) && length > maxBytes) return null;
+  }
+  const body = response.body;
+  if (body === null) {
+    const text = await response.text();
+    return new TextEncoder().encode(text).byteLength > maxBytes ? null : text;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value === void 0) continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+async function cancelBody(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+  }
+}
+function isHtmlContentType(contentType) {
+  return /(?:text\/html|application\/xhtml\+xml)/i.test(contentType);
+}
+
+// src/receive.ts
+var MAX_REQUEST_BODY_BYTES = 64 * 1024;
+function createWebmentionReceiveHandler(options, provider) {
+  return async (context) => {
+    if (!supportsWebmentionCapability(provider, "store")) {
+      return errorResponse(503, "storage_unavailable");
+    }
+    const { body, headers } = context.request;
+    if (new TextEncoder().encode(body).byteLength > MAX_REQUEST_BODY_BYTES) {
+      return errorResponse(413, "payload_too_large");
+    }
+    const params = parseWebmentionRequestBody(body, headers);
+    if (params === null) return errorResponse(400, "invalid_request");
+    const { source, target } = params;
+    if (!source || !target) {
+      return errorResponse(400, "missing_source_or_target");
+    }
+    const entry = findTargetEntry(context.manifest, context.config, target);
+    const allowed = entry !== void 0 || isAllowedTarget(target, options.allowedTargets, context.config);
+    if (!allowed) return errorResponse(400, "target_not_found");
+    const verification = await verifyWebmention({
+      source,
+      target,
+      fetchSource: options.fetchSource
+    });
+    if ("reason" in verification) {
+      return errorResponse(400, verification.reason);
+    }
+    try {
+      await provider.store(verification.mention);
+    } catch {
+      return errorResponse(503, "storage_unavailable");
+    }
+    return jsonResponse(202, { status: "accepted" });
+  };
+}
+function parseWebmentionRequestBody(body, headers) {
+  const contentType = headers["content-type"]?.toLowerCase() ?? "";
+  if (contentType.includes("application/json")) {
+    let value;
+    try {
+      value = JSON.parse(body);
+    } catch {
+      return null;
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      return null;
+    }
+    const record = value;
+    return {
+      ...typeof record.source === "string" ? { source: record.source } : {},
+      ...typeof record.target === "string" ? { target: record.target } : {}
+    };
+  }
+  if (contentType !== "" && !contentType.includes("urlencoded")) {
+    return null;
+  }
+  const search = new URLSearchParams(body);
+  const source = search.get("source");
+  const target = search.get("target");
+  return {
+    ...source === null ? {} : { source },
+    ...target === null ? {} : { target }
+  };
+}
+
+// src/endpoints.ts
+function createWebmentionEndpoints(options) {
+  return [
+    {
+      path: options.endpoint,
+      method: "POST",
+      handler: createWebmentionReceiveHandler(options, options.provider)
+    },
+    {
+      path: options.endpoint,
+      method: "GET",
+      handler: createWebmentionFeedHandler(options, options.provider)
+    }
+  ];
+}
+
+// src/mention.ts
+var WEBMENTION_TYPES = [
+  "mention",
+  "reply",
+  "like",
+  "repost",
+  "bookmark"
+];
+function webmentionKey(mention) {
+  return `${mention.source}
+${mention.target}`;
+}
+
+// src/memory_provider.ts
+var MemoryWebmentionProvider = class {
+  capabilities = new Set(WEBMENTION_CAPABILITIES);
+  #mentions = /* @__PURE__ */ new Map();
+  constructor(initialMentions = []) {
+    for (const mention of initialMentions) {
+      this.#mentions.set(webmentionKey(mention), mention);
+    }
+  }
+  async store(mention) {
+    this.#mentions.set(webmentionKey(mention), mention);
+  }
+  async query(query) {
+    assertWebmentionQuerySupported(this, query);
+    const since = query.type === "all_mentions" ? query.since : void 0;
+    const mentions = [...this.#mentions.values()].filter(
+      (mention) => withinSince(mention, since)
+    );
+    if (query.type === "mentions_for_target") {
+      const key = urlComparisonKey(query.target);
+      return {
+        type: query.type,
+        target: query.target,
+        mentions: applyLimit(
+          mentions.filter((mention) => urlComparisonKey(mention.target) === key).sort(compareMentions),
+          query.limit
+        )
+      };
+    }
+    return {
+      type: query.type,
+      mentions: applyLimit(mentions.sort(compareMentions), query.limit)
+    };
+  }
+};
+function withinSince(mention, since) {
+  return since === void 0 || mention.verifiedAt >= since;
+}
+function applyLimit(mentions, limit) {
+  if (limit === void 0) return mentions;
+  return mentions.slice(0, Math.max(0, limit));
+}
+function compareMentions(left, right) {
+  return (right.publishedAt ?? right.verifiedAt).localeCompare(
+    left.publishedAt ?? left.verifiedAt
+  ) || left.source.localeCompare(right.source);
+}
+
+// src/options.ts
+var DEFAULT_WEBMENTION_ENDPOINT = "/webmentions";
+var DEFAULT_WEBMENTION_HEADING_TEXT = "Mentions";
+var DEFAULT_WEBMENTION_LIMIT = 20;
+var DEFAULT_WEBMENTION_CLASS_NAME = "rr-webmention";
+function resolveWebmentionOptions(options = {}) {
+  return {
+    provider: options.provider ?? new MemoryWebmentionProvider(),
+    endpoint: normalizeEndpoint(options.endpoint),
+    render: options.render ?? true,
+    headingText: normalizeText(
+      options.headingText,
+      DEFAULT_WEBMENTION_HEADING_TEXT
+    ),
+    limit: normalizeLimit(options.limit),
+    className: normalizeText(options.className, DEFAULT_WEBMENTION_CLASS_NAME),
+    allowedTargets: options.allowedTargets ?? [],
+    fetchSource: options.fetchSource ?? createWebmentionSourceFetcher({
+      timeoutMs: options.timeoutMs,
+      maxBytes: options.maxBytes,
+      userAgent: options.userAgent,
+      allowPrivateHosts: options.allowPrivateHosts
+    }),
+    nofollow: options.nofollow ?? true
+  };
+}
+function validateWebmentionOptions(options) {
+  if (!options) return [];
+  const issues = [];
+  if (options.provider !== void 0 && !isWebmentionProvider(options.provider)) {
+    issues.push({
+      path: "provider",
+      message: "Expected a webmention provider with capabilities, store, and query."
+    });
+  }
+  if (options.endpoint !== void 0 && !isEndpointPath(options.endpoint)) {
+    issues.push({
+      path: "endpoint",
+      message: 'Expected a site-relative path starting with "/" without query, hash, or whitespace.'
+    });
+  }
+  for (const key of ["headingText", "className", "userAgent"]) {
+    const value = options[key];
+    if (value !== void 0 && (typeof value !== "string" || value.trim() === "")) {
+      issues.push({ path: key, message: "Expected a non-empty string." });
+    }
+  }
+  if (options.limit !== void 0 && !isNonNegativeInteger(options.limit)) {
+    issues.push({
+      path: "limit",
+      message: "Expected a non-negative integer."
+    });
+  }
+  if (options.timeoutMs !== void 0 && !isPositiveInteger(options.timeoutMs)) {
+    issues.push({
+      path: "timeoutMs",
+      message: "Expected a positive integer."
+    });
+  }
+  if (options.maxBytes !== void 0 && !isPositiveInteger(options.maxBytes)) {
+    issues.push({
+      path: "maxBytes",
+      message: "Expected a positive integer."
+    });
+  }
+  for (const key of ["render", "nofollow", "allowPrivateHosts"]) {
+    const value = options[key];
+    if (value !== void 0 && typeof value !== "boolean") {
+      issues.push({ path: key, message: "Expected a boolean." });
+    }
+  }
+  if (options.fetchSource !== void 0 && typeof options.fetchSource !== "function") {
+    issues.push({
+      path: "fetchSource",
+      message: "Expected a source fetcher function."
+    });
+  }
+  if (options.allowedTargets !== void 0) {
+    if (!Array.isArray(options.allowedTargets)) {
+      issues.push({
+        path: "allowedTargets",
+        message: "Expected an array of absolute http(s) URLs."
+      });
+    } else {
+      options.allowedTargets.forEach((target, index) => {
+        if (!isAbsoluteHttpUrl(target)) {
+          issues.push({
+            path: `allowedTargets.${index}`,
+            message: "Expected an absolute http(s) URL."
+          });
+        }
+      });
+    }
+  }
+  return issues;
+}
+function isWebmentionProvider(value) {
+  return typeof value === "object" && value !== null && "capabilities" in value && "store" in value && typeof value.store === "function" && "query" in value && typeof value.query === "function";
+}
+function normalizeEndpoint(value) {
+  if (value === void 0) return DEFAULT_WEBMENTION_ENDPOINT;
+  const trimmed = value.trim();
+  if (!isEndpointPath(trimmed)) return DEFAULT_WEBMENTION_ENDPOINT;
+  return trimmed === "/" ? DEFAULT_WEBMENTION_ENDPOINT : trimmed.replace(/\/$/, "");
+}
+function isEndpointPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/")) return false;
+  if (value.length < 2) return false;
+  if (value.includes("?") || value.includes("#")) return false;
+  if (/\s/.test(value) || value.includes("//")) return false;
+  if (value === "/assets" || value.startsWith("/assets/")) return false;
+  return true;
+}
+function normalizeText(value, fallback) {
+  if (typeof value !== "string" || value.trim() === "") return fallback;
+  return value.trim();
+}
+function normalizeLimit(value) {
+  if (value === void 0 || !isNonNegativeInteger(value)) {
+    return DEFAULT_WEBMENTION_LIMIT;
+  }
+  return value;
+}
+function isNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function isAbsoluteHttpUrl(value) {
+  if (typeof value !== "string" || value.trim() === "") return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// src/render.ts
+import { escapeHtml, escapeHtmlAttribute } from "@riebeckite/core";
+var WEBMENTION_ATTRIBUTE = "data-webmention";
+function renderWebmentionSection(mentions, options) {
+  if (mentions.length === 0) return "";
+  const className = escapeHtmlAttribute(options.className);
+  const items = mentions.map((mention) => renderWebmentionItem(mention, options)).join("");
+  return `<section class="${className}" ${WEBMENTION_ATTRIBUTE} data-webmention-count="${mentions.length}"><h2 class="${className}__heading">${escapeHtml(options.headingText)}</h2><ul class="${className}__list">${items}</ul></section>`;
+}
+function renderWebmentionItem(mention, options) {
+  const className = escapeHtmlAttribute(options.className);
+  const rel = options.nofollow ? ' rel="nofollow ugc"' : "";
+  const label = firstNonEmpty(mention.title, mention.author?.name) ?? mention.source;
+  const author = mention.author?.name !== void 0 && mention.title !== void 0 ? `<span class="${className}__author">${escapeHtml(mention.author.name)}</span>` : "";
+  const date = mention.publishedAt === void 0 ? "" : `<time class="${className}__date" datetime="${escapeHtmlAttribute(
+    mention.publishedAt
+  )}">${escapeHtml(formatDate(mention.publishedAt))}</time>`;
+  const excerpt = mention.excerpt === void 0 ? "" : `<p class="${className}__excerpt">${escapeHtml(mention.excerpt)}</p>`;
+  return `<li class="${className}__item ${className}__item--${mention.type}" data-webmention-type="${mention.type}"><a class="${className}__source" href="${escapeHtmlAttribute(
+    mention.source
+  )}"${rel}>${escapeHtml(label)}</a>${author}${date}${excerpt}</li>`;
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (value !== void 0 && value.trim() !== "") return value;
+  }
+  return void 0;
+}
+function formatDate(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  return date.toISOString().slice(0, 10);
+}
+
+// src/server.ts
+async function getWebmentionsForEntry(input) {
+  const entry = input.manifest.bySlug.get(input.slug);
+  if (!entry) return [];
+  const target = entryPublicUrl(entry, input.config);
+  if (target === null) return [];
+  const result = await input.provider.query({
+    type: "mentions_for_target",
+    target,
+    limit: input.limit
+  });
+  return [...result.mentions].sort(compareMentions2);
+}
+function groupMentionsBySlug(manifest, config, mentions) {
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const mention of mentions) {
+    const key = urlComparisonKey(mention.target);
+    const list = byTarget.get(key);
+    if (list) list.push(mention);
+    else byTarget.set(key, [mention]);
+  }
+  const grouped = /* @__PURE__ */ new Map();
+  for (const entry of manifest.entries) {
+    const target = entryPublicUrl(entry, config);
+    if (target === null) continue;
+    const list = byTarget.get(urlComparisonKey(target));
+    if (list && list.length > 0) {
+      grouped.set(entry.slug, [...list].sort(compareMentions2));
+    }
+  }
+  return grouped;
+}
+function countUnmatchedMentions(manifest, config, mentions) {
+  let unmatched = 0;
+  for (const mention of mentions) {
+    if (findTargetEntry(manifest, config, mention.target) === void 0) {
+      unmatched += 1;
+    }
+  }
+  return unmatched;
+}
+function compareMentions2(left, right) {
+  return (right.publishedAt ?? right.verifiedAt).localeCompare(
+    left.publishedAt ?? left.verifiedAt
+  ) || left.source.localeCompare(right.source);
+}
+
+// index.ts
+var webmentionPlugin = webmention;
+function webmention(options = {}) {
+  const resolved = resolveWebmentionOptions(options);
+  const provider = resolved.provider;
+  const processed = /* @__PURE__ */ new Map();
+  return definePlugin({
+    name: WEBMENTION_PLUGIN_NAME,
+    options,
+    validateOptions: validateWebmentionOptions,
+    onPostProcessed: ({ slug, content }) => {
+      processed.set(slug, content);
+    },
+    onManifestCreated: async (context) => {
+      if (!resolved.render || !supportsWebmentionCapability(provider, "query")) {
+        processed.clear();
+        return;
+      }
+      let mentions;
+      try {
+        const result = await provider.query({ type: "all_mentions" });
+        mentions = result.mentions;
+      } catch (error) {
+        context.diagnostics.push({
+          code: "webmention-query-failed",
+          severity: "warning",
+          pluginName: WEBMENTION_PLUGIN_NAME,
+          message: "The webmention provider could not be queried, so mentions were not rendered.",
+          meta: {
+            cause: error instanceof Error ? error.message : String(error)
+          }
+        });
+        processed.clear();
+        return;
+      }
+      const grouped = groupMentionsBySlug(
+        context.manifest,
+        context.config,
+        mentions
+      );
+      for (const [slug, list] of grouped) {
+        const entry = context.manifest.bySlug.get(slug);
+        if (!entry || entry.html.includes(WEBMENTION_ATTRIBUTE)) continue;
+        const section = renderWebmentionSection(
+          list.slice(0, resolved.limit),
+          resolved
+        );
+        if (section === "") continue;
+        entry.html = `${entry.html}${section}`;
+        const content = processed.get(slug);
+        if (content) content.html = entry.html;
+      }
+      const unmatched = countUnmatchedMentions(
+        context.manifest,
+        context.config,
+        mentions
+      );
+      if (unmatched > 0) {
+        context.diagnostics.push({
+          code: "webmention-unmatched-target",
+          severity: "info",
+          pluginName: WEBMENTION_PLUGIN_NAME,
+          message: `${unmatched} verified webmention(s) target a URL that is not a published entry and were not rendered.`
+        });
+      }
+      processed.clear();
+    },
+    endpoints: createWebmentionEndpoints(resolved),
+    assets: [createStyleAsset(WEBMENTION_PLUGIN_NAME)],
+    addDiagnostics: () => buildWebmentionDiagnostics(provider, resolved)
+  });
+}
+export {
+  DEFAULT_WEBMENTION_CLASS_NAME,
+  DEFAULT_WEBMENTION_ENDPOINT,
+  DEFAULT_WEBMENTION_HEADING_TEXT,
+  DEFAULT_WEBMENTION_LIMIT,
+  DEFAULT_WEBMENTION_MAX_BYTES,
+  DEFAULT_WEBMENTION_TIMEOUT_MS,
+  DEFAULT_WEBMENTION_USER_AGENT,
+  MemoryWebmentionProvider,
+  UnsupportedWebmentionQueryError,
+  WEBMENTION_ATTRIBUTE,
+  WEBMENTION_CAPABILITIES,
+  WEBMENTION_TYPES,
+  assertWebmentionQuerySupported,
+  buildFeed,
+  buildWebmentionDiagnostics,
+  compareMentions2 as compareMentions,
+  countUnmatchedMentions,
+  createWebmentionEndpoints,
+  createWebmentionFeedHandler,
+  createWebmentionReceiveHandler,
+  createWebmentionSourceFetcher,
+  entryPublicUrl,
+  findTargetEntry,
+  findTargetLink,
+  getWebmentionsForEntry,
+  groupMentionsBySlug,
+  isAllowedTarget,
+  normalizeWebmentionUrl,
+  parseWebmentionRequestBody,
+  parseWebmentionSource,
+  renderWebmentionItem,
+  renderWebmentionSection,
+  requiredCapabilityForQuery,
+  resolvePublicUrl,
+  resolveWebmentionOptions,
+  summarizeEntry,
+  supportsWebmentionCapability,
+  urlComparisonKey,
+  validateWebmentionOptions,
+  verifyWebmention,
+  webmention,
+  webmentionKey,
+  webmentionPlugin,
+  webmentionTypeForRels
+};