@karibsen/eponyme 0.5.0 → 0.7.0

package/dist/runtime/types/index.js

@@ -1,5 +1,4 @@
 export * from "./auth.js";
 export * from "./eponyme.js";
 export * from "./field.js";
-export * from "./captcha.js";
 export * from "./variables.js";

package/dist/runtime/utils/cache-tags.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Single source of truth for Eponyme cache tags, shared by the API responses that carry
+ * them, the module that tags the host's page routes at build time, and any purge the host
+ * runs on publication. Kept free of server imports so `module.ts` can use it too: a page
+ * and its API response must be tagged by the same code, or a purge would drop one and
+ * leave the other.
+ *
+ * A CDN cannot usually be purged by URL — Vercel and Cloudflare both purge by tag — and one
+ * entry appears in more than one cached response: its own, its collection's listing, and the
+ * page that renders it. Tagging all of them is what lets publishing an article drop the
+ * article, the index that lists it, and the HTML a visitor would otherwise keep receiving.
+ *
+ * A comma is the delimiter every CDN uses for this header, so it is stripped rather than
+ * escaped: a tag containing one would silently become two.
+ */
+export declare function getEponymeCacheTags(name: string, collection?: {
+    name: string;
+} | string): string[];
+/** The shape of `nuxt.options.routeRules` this needs, declared so this file stays build-safe. */
+type TaggableRouteRules = Record<string, {
+    headers?: Record<string, string>;
+}>;
+/**
+ * Tags the host's public routes with the same tags their API responses carry.
+ *
+ * A published entry ends up in two caches: the JSON the browser reads, and — as soon as the
+ * host puts a route under `swr`, `isr` or `prerender` — the HTML itself. Only the first was
+ * tagged, so a purge on publication dropped the JSON and left visitors on the old page.
+ * `previewPaths` already declares which route renders which entry, which is exactly the
+ * mapping needed to tag the other one, once, at build time.
+ *
+ * A collection pattern cannot name a slug in a route rule, so its pages carry the
+ * collection-level tag: publishing one article purges every article page and the index that
+ * lists them. Broader than strictly needed, and never wrong — tagging per entry would mean
+ * tracking every entry read during a render, and nitro's request context is not shared
+ * across the internal fetch that reads them.
+ *
+ * A header the host wrote wins: this only fills in what nobody set. Returns what it did, so
+ * the module can say it out loud: writing into someone else's `routeRules` is invisible to
+ * whoever reads their own config, and an effect nobody can see is one nobody can debug.
+ */
+export declare function tagPreviewPathRoutes(previewPaths: Record<string, string>, routeRules: TaggableRouteRules): {
+    route: string;
+    tag: string;
+}[];
+export {};

package/dist/runtime/utils/cache-tags.js

@@ -0,0 +1,28 @@
+export function getEponymeCacheTags(name, collection) {
+  const collectionName = typeof collection === "string" ? collection : collection?.name;
+  const tags = ["eponyme", `eponyme:${name}`];
+  if (collectionName) tags.push(`eponyme:${collectionName}`);
+  return [...new Set(tags)].map((tag) => tag.replace(/,/g, "").slice(0, 256));
+}
+export function tagPreviewPathRoutes(previewPaths, routeRules) {
+  const tagged = [];
+  for (const [name, path] of Object.entries(previewPaths)) {
+    if (!path.startsWith("/")) continue;
+    const isCollection = path.includes(":slug");
+    const route = isCollection ? path.replace(/:slug\b.*$/, "**") : path;
+    const tags = getEponymeCacheTags(name, isCollection ? name : void 0);
+    const value = tags.join(",");
+    const existing = routeRules[route] ?? {};
+    routeRules[route] = {
+      ...existing,
+      headers: {
+        // Vercel reads its own header; `Cache-Tag` is what Cloudflare and Fastly-style CDNs read.
+        "Vercel-Cache-Tag": value,
+        "Cache-Tag": value,
+        ...existing.headers
+      }
+    };
+    tagged.push({ route, tag: tags[tags.length - 1] });
+  }
+  return tagged;
+}

package/dist/runtime/utils/hydration-cache.d.ts

@@ -9,3 +9,13 @@ import type { NuxtApp } from '#app';
  * first paint faithful and still refetches on every later navigation.
  */
 export declare function cacheDuringHydrationOnly<T>(key: string, nuxtApp: NuxtApp): T | undefined;
+/**
+ * `getCachedData` for one read, or `undefined` to keep Nuxt's own policy.
+ *
+ * Published content is the same for every visitor and already answers with a public
+ * `Cache-Control`, so Nuxt's default is exactly right: the SSR payload while hydrating,
+ * then `nuxtApp.static.data`, which prerendered and prefetched payloads fill. A client
+ * navigation to a prerendered route then costs no request at all. Unreleased material
+ * keeps refetching after hydration.
+ */
+export declare function cacheForPublicRead(isPublic: boolean): typeof cacheDuringHydrationOnly | undefined;

package/dist/runtime/utils/hydration-cache.js

@@ -1,3 +1,6 @@
 export function cacheDuringHydrationOnly(key, nuxtApp) {
   return nuxtApp.isHydrating ? nuxtApp.payload.data[key] : void 0;
 }
+export function cacheForPublicRead(isPublic) {
+  return isPublic ? void 0 : cacheDuringHydrationOnly;
+}

package/dist/runtime/utils/middle-ellipsis.d.ts

@@ -0,0 +1 @@
+export declare function middleEllipsis(value: string, maxLength?: number): string;

package/dist/runtime/utils/middle-ellipsis.js

@@ -0,0 +1,8 @@
+export function middleEllipsis(value, maxLength = 28) {
+  const characters = [...value];
+  if (characters.length <= maxLength) return value;
+  const available = maxLength - 1;
+  const startLength = Math.ceil(available / 2);
+  const endLength = Math.floor(available / 2);
+  return `${characters.slice(0, startLength).join("")}\u2026${characters.slice(-endLength).join("")}`;
+}

package/dist/runtime/utils/normalize-eponyme-phones.d.ts

@@ -0,0 +1,9 @@
+import type { EponymeSchema } from '../types/index.js';
+/**
+ * Rewrites every phone value in a payload to E.164, wherever it sits in the schema.
+ *
+ * Applied on the server before a write, which is what makes the stored format a guarantee
+ * rather than a convention: the API accepts any JSON, so a client normalising on its own could
+ * always be bypassed. Values that cannot be parsed are left as typed for validation to reject.
+ */
+export declare function normalizeEponymePhones(schema: EponymeSchema, data: Record<string, unknown>): Record<string, unknown>;

package/dist/runtime/utils/normalize-eponyme-phones.js

@@ -0,0 +1,38 @@
+import { isArrayItemFieldDefinition } from "./get-field-default-value.js";
+import { toEponymePhoneValue } from "./normalize-phone.js";
+export function normalizeEponymePhones(schema, data) {
+  const result = { ...data };
+  for (const [name, definition] of Object.entries(schema)) {
+    if (!(name in result)) continue;
+    result[name] = normalizeField(definition, result[name]);
+  }
+  return result;
+}
+function normalizeField(definition, value) {
+  if (definition.type === "phone") return toEponymePhoneValue(value, definition.options);
+  if (definition.type === "section")
+    return normalizeNested(definition.options.fields, value);
+  if (definition.type === "tabs") {
+    if (!isRecord(value)) return value;
+    const tabs = { ...value };
+    for (const [tabName, tab] of Object.entries(definition.options.tabs))
+      if (tabName in tabs) tabs[tabName] = normalizeNested(tab.fields, tabs[tabName]);
+    return tabs;
+  }
+  if (definition.type === "array") {
+    if (!Array.isArray(value)) return value;
+    return value.map((item) => normalizeArrayItem(definition.options.of, item));
+  }
+  return value;
+}
+function normalizeArrayItem(of, item) {
+  if (isArrayItemFieldDefinition(of)) return normalizeField(of, item);
+  return normalizeNested(of, item);
+}
+function normalizeNested(schema, value) {
+  if (!isRecord(value)) return value;
+  return normalizeEponymePhones(schema, value);
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/runtime/utils/normalize-phone.d.ts

@@ -0,0 +1,26 @@
+import type { PhoneFieldOptions } from '../types/field.js';
+export interface NormalizedPhone {
+    /** The number in E.164, present only when it parsed and validated. */
+    e164?: string;
+    /** Country the number resolved to, present as soon as it parsed. */
+    country?: string;
+    valid: boolean;
+    /** Set when the number is valid but its country is not in `countries`. */
+    countryNotAllowed?: boolean;
+}
+/**
+ * Single source of truth for what a phone field accepts, shared by the validation the server
+ * enforces, the editor field, and the write path that stores the value.
+ *
+ * The `min` metadata bundle is deliberate: it is a fraction of the size of the full one and
+ * parses and formats every country. The trade is precision — it accepts a few numbers the full
+ * metadata would reject as impossible for their region.
+ *
+ * @see https://gitlab.com/catamphetamine/libphonenumber-js#min-vs-max-vs-mobile-vs-core
+ */
+export declare function normalizeEponymePhone(value: unknown, options?: PhoneFieldOptions): NormalizedPhone;
+/**
+ * The value to store: E.164 whenever the number is understood, and the input untouched when it
+ * is not, so validation can report it and the editor can still see what was typed.
+ */
+export declare function toEponymePhoneValue(value: unknown, options?: PhoneFieldOptions): unknown;

package/dist/runtime/utils/normalize-phone.js

@@ -0,0 +1,17 @@
+import { parsePhoneNumberFromString } from "libphonenumber-js/min";
+export function normalizeEponymePhone(value, options = {}) {
+  const raw = typeof value === "string" ? value.trim() : "";
+  if (!raw) return { valid: true };
+  const international = raw.startsWith("+");
+  if (options.detectCountry === false && !international) return { valid: false };
+  const parsed = parsePhoneNumberFromString(raw, international ? void 0 : options.defaultCountry);
+  if (!parsed || !parsed.isValid()) return { valid: false, country: parsed?.country };
+  const allowed = options.countries?.length ? options.countries : void 0;
+  if (allowed && (!parsed.country || !allowed.includes(parsed.country)))
+    return { valid: false, country: parsed.country, countryNotAllowed: true };
+  return { valid: true, e164: parsed.number, country: parsed.country };
+}
+export function toEponymePhoneValue(value, options = {}) {
+  if (typeof value !== "string") return value;
+  return normalizeEponymePhone(value, options).e164 ?? value;
+}

package/dist/runtime/utils/preview.d.ts

@@ -20,6 +20,16 @@ export declare function splitCollectionEntry(collectionNames: string[], name: st
  * returns `previewPaths[collection]` with `:slug` filled in.
  */
 export declare function resolvePreviewPath(previewPaths: Record<string, string>, collectionNames: string[], name: string): string | undefined;
+/**
+ * The query parameters that turn a public route into a preview.
+ *
+ * Named here because three places have to agree on them: the panel that builds the URL,
+ * the composables that read it, and the middleware that keeps such a response out of
+ * every cache. A typo in any one of them fails silently, in the direction of leaking.
+ */
+export declare const EPONYME_PREVIEW_QUERY = "__eponyme_preview";
+export declare const EPONYME_PREVIEW_VERSION_QUERY = "__eponyme_preview_version";
+export declare const EPONYME_PREVIEW_TOKEN_QUERY = "__eponyme_preview_token";
 /** Reads `?__eponyme_preview_version=` — `draft` by default, or a numeric history id. */
 export declare function readPreviewVersion(raw: unknown): PreviewVersion;
 /** Reads the preview query params, unwrapping the repeated-param array form. */

package/dist/runtime/utils/preview.js

@@ -18,13 +18,18 @@ export function resolvePreviewPath(previewPaths, collectionNames, name) {
   if (!pattern || !pattern.includes(":slug")) return void 0;
   return applyPreviewSlug(pattern, entry.slug);
 }
+export const EPONYME_PREVIEW_QUERY = "__eponyme_preview";
+export const EPONYME_PREVIEW_VERSION_QUERY = "__eponyme_preview_version";
+export const EPONYME_PREVIEW_TOKEN_QUERY = "__eponyme_preview_token";
 export function readPreviewVersion(raw) {
   if (raw === "published") return "published";
   const id = Number(raw);
   return Number.isSafeInteger(id) && id > 0 ? id : "draft";
 }
 export function readPreviewQuery(query) {
-  const entry = Array.isArray(query.__eponyme_preview) ? query.__eponyme_preview[0] : query.__eponyme_preview;
-  const version = Array.isArray(query.__eponyme_preview_version) ? query.__eponyme_preview_version[0] : query.__eponyme_preview_version;
+  const rawEntry = query[EPONYME_PREVIEW_QUERY];
+  const rawVersion = query[EPONYME_PREVIEW_VERSION_QUERY];
+  const entry = Array.isArray(rawEntry) ? rawEntry[0] : rawEntry;
+  const version = Array.isArray(rawVersion) ? rawVersion[0] : rawVersion;
   return { entry: entry === void 0 || entry === null ? void 0 : String(entry), version };
 }

package/dist/runtime/utils/validate-eponyme-data.js

@@ -1,5 +1,6 @@
 import { isArrayItemFieldDefinition } from "./get-field-default-value.js";
 import { isFieldVisible } from "./is-field-visible.js";
+import { normalizeEponymePhone } from "./normalize-phone.js";
 const urlPattern = /^https?:\/\//i;
 const datePattern = /^\d{4}-\d{2}-\d{2}$/;
 const colorPattern = /^#(?:[\da-f]{3}|[\da-f]{6}|[\da-f]{8})$/i;
@@ -134,7 +135,10 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
     const href = link.href.trim();
     if (mode === "publish" && options.required && !href) addError(errors, name, "This field is required.");
     if (!href) return;
-    if (link.type === "external" && !urlPattern.test(href)) addError(errors, name, "External links must be HTTP(S) URLs.");
+    if (link.type === "external" && !isAllowedProtocol(href, definition.options.protocols)) {
+      const allowed = normalizeProtocols(definition.options.protocols);
+      addError(errors, name, isDefaultProtocols(definition.options.protocols) ? "External links must be HTTP(S) URLs." : `External links must start with ${allowed.map((protocol) => `${protocol}:`).join(" or ")}.`);
+    }
     if (link.type === "internal" && !href.startsWith("/") && !href.startsWith("#")) addError(errors, name, "Internal links must start with / or #.");
     return;
   }
@@ -160,6 +164,16 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
     if (definition.options.max && normalized > definition.options.max) addError(errors, name, `Must be on or before ${definition.options.max}.`);
     return;
   }
+  if (definition.type === "phone") {
+    const phone = normalizeEponymePhone(normalized, definition.options);
+    if (normalized && phone.countryNotAllowed) {
+      const accepted = definition.options.countries?.join(", ");
+      addError(errors, name, phone.country ? `Numbers from ${phone.country} are not accepted. Use a number from: ${accepted}.` : `Must be a number from: ${accepted}.`);
+    } else if (normalized && !phone.valid) {
+      addError(errors, name, definition.options.detectCountry === false ? "Must be a valid phone number in international format, starting with the country code." : "Must be a valid phone number.");
+    }
+    return;
+  }
   if (definition.type === "color") {
     if (normalized && !colorPattern.test(normalized)) addError(errors, name, "Must be a valid hex color.");
     return;
@@ -179,8 +193,20 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
   if (definition.options.maxLength !== void 0 && value.length > definition.options.maxLength) addError(errors, name, `Must contain at most ${definition.options.maxLength} characters.`);
   if (definition.options.regex && !definition.options.regex.test(value)) addError(errors, name, "Has an invalid format.");
   const [localPart, domain, ...extraParts] = normalized.split("@");
-  if ((definition.type === "email" || definition.options.email) && normalized && (!localPart || !domain?.includes(".") || extraParts.length)) addError(errors, name, "Must be a valid email address.");
-  if (definition.options.url && normalized && !urlPattern.test(normalized)) addError(errors, name, "Must be an HTTP(S) URL.");
+  if (definition.type === "email" && normalized && (!localPart || !domain?.includes(".") || extraParts.length)) addError(errors, name, "Must be a valid email address.");
+}
+const DEFAULT_URL_PROTOCOLS = ["http", "https"];
+const schemePattern = /^([a-z][a-z0-9+.-]*):/i;
+function normalizeProtocols(protocols) {
+  const declared = protocols?.length ? protocols : DEFAULT_URL_PROTOCOLS;
+  return declared.map((protocol) => protocol.trim().toLowerCase().replace(/:.*$/, ""));
+}
+function isDefaultProtocols(protocols) {
+  return !protocols?.length;
+}
+function isAllowedProtocol(href, protocols) {
+  const scheme = schemePattern.exec(href)?.[1]?.toLowerCase();
+  return Boolean(scheme) && normalizeProtocols(protocols).includes(scheme);
 }
 function getRichTextContent(value) {
   return value.replace(/<br\s*\/?>/gi, " ").replace(/<\/p>|<\/h[1-6]>|<\/li>|<\/blockquote>/gi, " ").replace(/<[^>]+>/g, "").replace(/&nbsp;|&#160;/gi, " ").replace(/&amp;/gi, "&").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/\s+/g, " ").trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karibsen/eponyme",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "A lightweight, type-safe content manager for Nuxt.",
   "license": "MIT",
   "type": "module",
@@ -60,9 +60,9 @@
   },
   "dependencies": {
     "@iconify-json/mingcute": "^1.2.7",
+    "@karibsen/ui": "latest",
     "@nuxt/icon": "^2.3.1",
     "@nuxt/kit": "^4.4.8",
-    "@karibsen/ui": "latest",
     "@tailwindcss/vite": "^4.1.12",
     "@tanstack/vue-table": "^8.21.3",
     "@tiptap/extension-image": "^3.29.2",
@@ -72,6 +72,7 @@
     "@vueuse/core": "^14.3.0",
     "@vueuse/integrations": "^14.3.0",
     "fuse.js": "^7.5.0",
+    "libphonenumber-js": "^1.13.9",
     "picocolors": "^1.1.1",
     "reka-ui": "^2.10.1",
     "slugify": "^1.6.9",

package/dist/runtime/server/utils/eponyme-captcha.d.ts

@@ -1,6 +0,0 @@
-import type { H3Event } from 'h3';
-import type { EponymeCaptchaResult, EponymeCaptchaVerifier } from '../../types/captcha.js';
-export declare const CAPTCHA_TOKEN_KEY = "_eponyme_captcha";
-export declare function eponymeCaptchaVerifier(): EponymeCaptchaVerifier;
-export declare function isEponymeCaptchaConfigured(): boolean;
-export declare function verifyEponymeCaptcha(event: H3Event, token: unknown): Promise<EponymeCaptchaResult>;

package/dist/runtime/server/utils/eponyme-captcha.js

@@ -1,14 +0,0 @@
-import { getRequestIP } from "h3";
-import captchaVerifier from "#eponyme/captcha";
-export const CAPTCHA_TOKEN_KEY = "_eponyme_captcha";
-export function eponymeCaptchaVerifier() {
-  return captchaVerifier;
-}
-export function isEponymeCaptchaConfigured() {
-  return eponymeCaptchaVerifier().name !== "none";
-}
-export async function verifyEponymeCaptcha(event, token) {
-  if (typeof token !== "string" || !token.trim())
-    return { success: false, reason: "Missing captcha token." };
-  return eponymeCaptchaVerifier().verify(token, { ip: getRequestIP(event, { xForwardedFor: true }) });
-}

package/dist/runtime/types/captcha.d.ts

@@ -1,16 +0,0 @@
-export interface EponymeCaptchaResult {
-    success: boolean;
-    /** Provider-specific reason, surfaced in server logs rather than to the visitor. */
-    reason?: string;
-}
-/**
- * Verifies the token a visitor's captcha widget produced. Implemented by an adapter
- * package such as `@karibsen/eponyme-captcha`; the core ships none, so a project
- * without an adapter simply has no captcha.
- */
-export interface EponymeCaptchaVerifier {
-    name: string;
-    verify: (token: string, context: {
-        ip?: string;
-    }) => Promise<EponymeCaptchaResult>;
-}

package/dist/runtime/utils/no-captcha.d.ts

@@ -1,7 +0,0 @@
-import type { EponymeCaptchaVerifier } from '../types/captcha.js';
-/**
- * Stands in when no adapter is installed. It never claims success, so a form that
- * requires a captcha refuses submissions rather than silently accepting them all.
- */
-declare const verifier: EponymeCaptchaVerifier;
-export default verifier;

package/dist/runtime/utils/no-captcha.js

@@ -1,5 +0,0 @@
-const verifier = {
-  name: "none",
-  verify: async () => ({ success: false, reason: "No captcha adapter is installed." })
-};
-export default verifier;