@farcaster/frame-core 0.0.0-canary-20250611151843 → 0.0.0-canary-20250627213014

package/src/schemas/manifest.ts

@@ -3,6 +3,7 @@ import { miniAppHostCapabilityList } from '../types.ts'
 import {
   buttonTitleSchema,
   createSimpleStringSchema,
+  domainSchema,
   encodedJsonFarcasterSignatureSchema,
   frameNameSchema,
   hexColorSchema,
@@ -98,6 +99,8 @@ export const domainFrameConfigSchema = z
     /** see https://github.com/farcasterxyz/miniapps/discussions/158 */
     /** Documentation will be added once this feature is finalized. */
     castShareUrl: secureUrlSchema.optional(),
+    /** Canonical domain for the frame application */
+    canonicalDomain: domainSchema.optional(),
   })
   .refine(
     (data) => {

package/src/schemas/shared.ts

@@ -40,6 +40,9 @@ export const secureUrlSchema = z
   .url()
   .startsWith('https://', { message: 'Must be an https url' })
   .max(1024)
+  .refine((url) => !url.includes(' '), {
+    message: 'URL must not contain spaces',
+  })
 
 export const frameNameSchema = z.string().max(32)
 export const buttonTitleSchema = z.string().max(32)
@@ -58,6 +61,34 @@ export const hexColorSchema = z
       'Invalid hex color code. It should be in the format #RRGGBB or #RGB.',
   })
 
+// Domain validation regex:
+// - Each label (part between dots) must start and end with alphanumeric
+// - Labels can contain hyphens in the middle
+// - Cannot have consecutive dots
+// - Must have at least one dot (TLD required)
+// - TLD must be at least 2 characters and only letters
+const DOMAIN_REGEX =
+  /^(?!.*\.\.)([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/
+
+export const domainSchema = z
+  .string()
+  .max(1024)
+  .regex(DOMAIN_REGEX, {
+    message: 'Must be a valid domain name (e.g., example.com, sub.example.com)',
+  })
+  .refine((value) => !value.includes('://'), {
+    message: 'Domain must not include protocol (http://, https://, etc.)',
+  })
+  .refine((value) => !value.includes('/'), {
+    message: 'Domain must not include path separators',
+  })
+  .refine((value) => !value.includes('@'), {
+    message: 'Domain must not include @ symbol',
+  })
+  .refine((value) => !value.includes(':'), {
+    message: 'Domain must not include port numbers',
+  })
+
 export const aspectRatioSchema = z.union([z.literal('1:1'), z.literal('3:2')])
 
 export const encodedJsonFarcasterSignatureSchema = z.object({