[Edit: Note the iframe has changed to a CORS request per comments below from @cramforce]

There are several use cases where rewriting the href tags on AMP pages would be useful. These include AMP to AMP linking and affiliate link automation.

This is a tentative proposal for a way to handle this via new amp-rewrite-links component.

The basic model would be similar to amp-ad and amp-analytics a framework to which vendors could add their own code.

<amp-rewrite-links
   type="vendorname"
   data-vendor-specifc-id="1234"
   data-additional-vendor-data="stuff"
></amp-rewrite-links>

Vendors would provide a target url that is loaded in an iframe by the AMP runtime.

Upon load the vendor frame would send a requestLinks message.

The amp-rewrite-links component will respond with links message containing an array of href values from the page (fragment links and amp-bind actions would be ignored). amp-rewrite-links will also begin monitoring for mutations that add or change href values and will send additional links messages with the changed or added values as needed.

When the vendor iframe receives a links message it will respond with a linksDestination message containing an object defining link behavior.

{
  "http://www.example.com/somelink" : {
    "verb": "GET",
    "url": "http://www.someothersite.com/path",
    "target" : "_blank" /* or _top */
  }, 
  "http://www.example.com/anotherlink" : {
    "verb": "POST",
    "url": "http://www.someothersite.com/path"
    "postBody":  "opaque value to send as post body",
    "postHeaders": { /* 
      headers to send with post from whitelist - 
      may include encoding and content-type
    */ }
  }
}

Allowed verbs GET, POST

On a click action the runtime will lookup the href in the responses it's received from the rewrite frame and GET/POST to the new destination as appropriate. Any href not found in the responses is handled as normal.

Any clicks that occur before the frame has responded behave as normal (that is the runtime does not defer clicks for a response)

Questions:

1. Does this cover all the use cases?
2. Are there security implications (beyond having to trust your rewrite vendor)?
3. Allow passing CID and other AMP variables to vendor frame?
4. Allow publishers to provide their own rewrite frame url or restrict to approved vendors?