@karibsen/eponyme 0.6.0 → 0.7.0

package/dist/runtime/middleware/eponyme-owner.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("nuxt/app").RouteMiddleware;
+declare const _default: import("#app").RouteMiddleware;
 export default _default;

package/dist/runtime/server/api/eponyme-forms/[path].post.js

@@ -1,7 +1,6 @@
 import { createError, defineEventHandler, getRequestHeader, readRawBody, setResponseHeader, setResponseStatus } from "h3";
 import { useEponymeFormService } from "../../services/eponyme-form-service.js";
 import { readEponymeFormRoute } from "../../utils/form-route.js";
-import { CAPTCHA_TOKEN_KEY, isEponymeCaptchaConfigured, verifyEponymeCaptcha } from "../../utils/eponyme-captcha.js";
 import { callEponymeBlockingHook, callEponymeHook } from "../../utils/eponyme-hooks.js";
 export default defineEventHandler(async (event) => {
   const route = readEponymeFormRoute(event);
@@ -27,20 +26,6 @@ export default defineEventHandler(async (event) => {
     setResponseStatus(event, 201);
     return { submitted: true };
   }
-  if (definition.captcha) {
-    if (!isEponymeCaptchaConfigured()) {
-      throw createError({
-        statusCode: 500,
-        statusMessage: `Form "${route.name}" requires a captcha but no adapter is installed. Add one, such as @karibsen/eponyme-captcha.`
-      });
-    }
-    const token = payload && typeof payload === "object" ? payload[CAPTCHA_TOKEN_KEY] : void 0;
-    const result2 = await verifyEponymeCaptcha(event, token);
-    if (!result2.success) {
-      setResponseStatus(event, 422);
-      return { errors: { _form: ["Captcha verification failed. Please try again."] } };
-    }
-  }
   const validated = service.validate(route.name, payload);
   if (validated && "errors" in validated) {
     setResponseStatus(event, 422);

package/dist/runtime/server/services/eponyme-form-store.d.ts

@@ -1,5 +1,6 @@
 import type { EponymeConfig, EponymeFormDefinitionBase } from '../../types/index.js';
 import { type ValidationErrors } from '../../utils/validate-eponyme-data.js';
+/** Kept here rather than imported, so the store stays free of H3 imports. */
 type DateValue = Date | string;
 export interface EponymeFormSubmission {
     id: string;

package/dist/runtime/server/services/eponyme-form-store.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
+import { normalizeEponymePhones } from "../../utils/normalize-eponyme-phones.js";
 import { getEponymeForms } from "../../utils/get-eponyme-schemas.js";
 import { validateEponymeData } from "../../utils/validate-eponyme-data.js";
-const CAPTCHA_TOKEN_KEY = "_eponyme_captcha";
 const DEFAULT_PER_PAGE = 25;
 const MAX_PER_PAGE = 100;
 export class EponymeFormService {
@@ -37,10 +37,11 @@ export class EponymeFormService {
     if (!payload || typeof payload !== "object" || Array.isArray(payload))
       return { errors: { _form: ["Body must be an object."] } };
     const input = payload;
-    const { [definition.honeypot || ""]: _honeypot, [CAPTCHA_TOKEN_KEY]: _captcha, ...rest } = input;
-    const unknownKeys = Object.keys(rest).filter((key) => !(key in definition.fields));
+    const { [definition.honeypot || ""]: _honeypot, ...submitted } = input;
+    const unknownKeys = Object.keys(submitted).filter((key) => !(key in definition.fields));
     if (unknownKeys.length)
       return { errors: Object.fromEntries(unknownKeys.map((key) => [key, ["Unknown field."]])) };
+    const rest = normalizeEponymePhones(definition.fields, submitted);
     const errors = validateEponymeData(definition.fields, rest, "publish");
     if (Object.keys(errors).length) return { errors };
     return { data: rest };

package/dist/runtime/server/services/eponyme-store.d.ts

@@ -233,7 +233,18 @@ export declare class EponymeService {
     private getCollectionEntry;
     /** Reconcile every configured eponyme at application startup. This is the one place that heals. */
     syncAll(): Promise<void>;
+    /**
+     * Brings a stored document back in line with the schema: keys the schema no longer declares
+     * are dropped, and a key it declares but the document lacks takes its default.
+     *
+     * Recursive, because a field added inside a section, a tab or an array item is otherwise
+     * never filled in: the container it lives in already exists and is still valid, so a
+     * top-level pass keeps it untouched and the new field reads as missing forever. That was
+     * silent — `defaultValue` simply did nothing for anything but a root field.
+     */
     private reconcile;
+    /** Descends into the containers; a leaf is returned untouched for `reconcile` to judge. */
+    private reconcileField;
     private createState;
     private normalizeState;
     /**

package/dist/runtime/server/services/eponyme-store.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { createDefaultEponymeData } from "../../utils/create-default-eponyme-data.js";
+import { isArrayItemFieldDefinition } from "../../utils/get-field-default-value.js";
 import { getEponymeCollections, getEponymeSchemas } from "../../utils/get-eponyme-schemas.js";
 import { normalizeSlug } from "../../utils/normalize-slug.js";
 import { applyPreviewSlug } from "../../utils/preview.js";
 import { validateEponymeData, validateEponymePatch } from "../../utils/validate-eponyme-data.js";
+import { normalizeEponymePhones } from "../../utils/normalize-eponyme-phones.js";
 export const COLLECTION_METADATA_KEYS = ["updatedAt", "publishedAt", "title", "slug"];
 export class EponymeService {
   constructor(config, client, options = {}) {
@@ -63,15 +65,43 @@ export class EponymeService {
   async syncAll() {
     await Promise.all(Object.keys(this.schemas).map((name) => this.loadState(name, { heal: true })));
   }
+  /**
+   * Brings a stored document back in line with the schema: keys the schema no longer declares
+   * are dropped, and a key it declares but the document lacks takes its default.
+   *
+   * Recursive, because a field added inside a section, a tab or an array item is otherwise
+   * never filled in: the container it lives in already exists and is still valid, so a
+   * top-level pass keeps it untouched and the new field reads as missing forever. That was
+   * silent — `defaultValue` simply did nothing for anything but a root field.
+   */
   reconcile(schema, value, mode) {
-    const persisted = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+    const persisted = isPlainObject(value) ? value : {};
     const defaults = createDefaultEponymeData(schema);
     return Object.fromEntries(Object.keys(schema).map((key) => {
-      const candidate = key in persisted ? persisted[key] : defaults[key];
-      const errors = validateEponymeData({ [key]: schema[key] }, { [key]: candidate }, mode);
+      const definition = schema[key];
+      const candidate = key in persisted ? this.reconcileField(definition, persisted[key], mode) : defaults[key];
+      const errors = validateEponymeData({ [key]: definition }, { [key]: candidate }, mode);
       return [key, Object.keys(errors).length ? defaults[key] : candidate];
     }));
   }
+  /** Descends into the containers; a leaf is returned untouched for `reconcile` to judge. */
+  reconcileField(definition, value, mode) {
+    if (definition.type === "section")
+      return isPlainObject(value) ? this.reconcile(definition.options.fields, value, mode) : value;
+    if (definition.type === "tabs") {
+      if (!isPlainObject(value)) return value;
+      return Object.fromEntries(Object.entries(definition.options.tabs).map(([tabName, tab]) => [
+        tabName,
+        this.reconcile(tab.fields, value[tabName], mode)
+      ]));
+    }
+    if (definition.type === "array") {
+      const of = definition.options.of;
+      if (!Array.isArray(value) || isArrayItemFieldDefinition(of)) return value;
+      return value.map((item) => isPlainObject(item) ? this.reconcile(of, item, mode) : item);
+    }
+    return value;
+  }
   createState(schema, value) {
     const data = this.reconcile(schema, value ?? createDefaultEponymeData(schema), "publish");
     return {
@@ -386,7 +416,7 @@ export class EponymeService {
     const taken = await this.slugTakenError(definition, entryName);
     if (taken) return taken;
     const defaults = createDefaultEponymeData(definition.fields);
-    const data = { ...defaults, ...input, [definition.slugField]: slug };
+    const data = normalizeEponymePhones(definition.fields, { ...defaults, ...input, [definition.slugField]: slug });
     const errors = validateEponymePatch(definition.fields, data, data, "draft");
     if (Object.keys(errors).length) return { errors };
     const state = {
@@ -494,8 +524,8 @@ export class EponymeService {
       if (submittedSlug !== collectionEntry.slug)
         return { errors: { [collectionEntry.definition.slugField]: ["The slug cannot be changed after creation."] } };
     }
-    const data = { ...state.__eponyme.draft, ...payload };
-    const patchErrors = validateEponymePatch(schema, payload, data, action);
+    const data = normalizeEponymePhones(schema, { ...state.__eponyme.draft, ...payload });
+    const patchErrors = validateEponymePatch(schema, normalizeEponymePhones(schema, payload), data, action);
     const errors = action === "publish" ? mergeErrors(patchErrors, validateEponymeData(schema, data, "publish")) : patchErrors;
     if (Object.keys(errors).length) return { errors };
     const publishedAt = action === "publish" ? (/* @__PURE__ */ new Date()).toISOString() : state.__eponyme.publishedAt;

package/dist/runtime/types/eponyme-config.d.ts

@@ -16,10 +16,3 @@ declare module '#eponyme/variables' {
   const variables: EponymeVariables
   export default variables
 }
-
-declare module '#eponyme/captcha' {
-  import type { EponymeCaptchaVerifier } from './captcha'
-
-  const verifier: EponymeCaptchaVerifier
-  export default verifier
-}

package/dist/runtime/types/eponyme.d.ts

@@ -1,4 +1,4 @@
-import type { ArrayFieldDefinition, ArrayItemValue, BooleanFieldDefinition, CheckboxGroupFieldDefinition, EmailFieldDefinition, FieldDefinition, NumberFieldDefinition, RadioFieldDefinition, SectionFieldDefinition, SectionValue, SelectFieldDefinition, SlugFieldDefinition, StringFieldDefinition, TabFieldDefinition, TabsValue, TextareaFieldDefinition, UrlFieldDefinition, UrlValue } from './field.js';
+import type { ArrayFieldDefinition, ArrayItemValue, BooleanFieldDefinition, CheckboxGroupFieldDefinition, EmailFieldDefinition, FieldDefinition, NumberFieldDefinition, PhoneFieldDefinition, RadioFieldDefinition, SectionFieldDefinition, SectionValue, SelectFieldDefinition, SlugFieldDefinition, StringFieldDefinition, TabFieldDefinition, TabsValue, TextareaFieldDefinition, UrlFieldDefinition, UrlValue } from './field.js';
 export type EponymeSchema = Record<string, FieldDefinition>;
 export interface EponymeCollectionDefinitionBase {
     __eponymeCollection: true;
@@ -26,7 +26,7 @@ export interface EponymeCollectionDefinition<T extends EponymeSchema = EponymeSc
  * `slug`, `richText`, `image`, `date`, `color`, `array`, `section` and `tabs` are
  * authoring concerns and are rejected by `form()`.
  */
-export type EponymeFormFieldDefinition = StringFieldDefinition | TextareaFieldDefinition | EmailFieldDefinition | UrlFieldDefinition | NumberFieldDefinition | BooleanFieldDefinition | SelectFieldDefinition | RadioFieldDefinition | CheckboxGroupFieldDefinition;
+export type EponymeFormFieldDefinition = StringFieldDefinition | TextareaFieldDefinition | EmailFieldDefinition | PhoneFieldDefinition | UrlFieldDefinition | NumberFieldDefinition | BooleanFieldDefinition | SelectFieldDefinition | RadioFieldDefinition | CheckboxGroupFieldDefinition;
 export type EponymeFormSchema = Record<string, EponymeFormFieldDefinition>;
 /** `custom` leaves delivery to the host application; `managed` stores the submission. */
 export type EponymeFormMode = 'custom' | 'managed';
@@ -42,8 +42,6 @@ export interface EponymeFormOptions<T extends EponymeFormSchema = EponymeFormSch
     honeypot?: string | false;
     /** In bytes. */
     maxBodyBytes?: number;
-    /** Requires a valid captcha token. Needs an adapter such as `@karibsen/eponyme-captcha`. */
-    captcha?: boolean;
 }
 export interface EponymeFormDefinitionBase {
     __eponymeForm: true;
@@ -53,7 +51,6 @@ export interface EponymeFormDefinitionBase {
     submission: Required<EponymeFormSubmissionOptions>;
     honeypot: string | false;
     maxBodyBytes: number;
-    captcha: boolean;
 }
 export interface EponymeFormDefinition<T extends EponymeFormSchema = EponymeFormSchema> extends EponymeFormDefinitionBase {
     fields: T;

package/dist/runtime/types/field.d.ts

@@ -1,4 +1,5 @@
-export type EponymeFieldType = 'string' | 'slug' | 'email' | 'url' | 'textarea' | 'richText' | 'number' | 'boolean' | 'image' | 'select' | 'radio' | 'checkboxGroup' | 'date' | 'color' | 'array' | 'section' | 'tabs';
+import type { CountryCode } from 'libphonenumber-js/min';
+export type EponymeFieldType = 'string' | 'slug' | 'email' | 'phone' | 'url' | 'textarea' | 'richText' | 'number' | 'boolean' | 'image' | 'select' | 'radio' | 'checkboxGroup' | 'date' | 'color' | 'array' | 'section' | 'tabs';
 export type FieldVisibilityCondition = {
     field: string;
     equals: unknown;
@@ -27,8 +28,6 @@ export interface TextFieldOptions extends DefaultFieldOptions<string> {
     placeholder?: string;
     trim?: boolean;
     regex?: RegExp;
-    email?: boolean;
-    url?: boolean;
 }
 export type StringFieldOptions = TextFieldOptions;
 export type TextareaFieldOptions = TextFieldOptions;
@@ -65,6 +64,37 @@ export interface EmailFieldDefinition {
     type: 'email';
     options: EmailFieldOptions;
 }
+/**
+ * Countries a phone field accepts, as ISO 3166-1 alpha-2 codes. Re-exported so declaring a
+ * field autocompletes them without importing from `libphonenumber-js` in application code.
+ */
+export type PhoneCountry = CountryCode;
+export interface PhoneFieldOptions extends DefaultFieldOptions<string> {
+    placeholder?: string;
+    /**
+     * Countries whose numbers are accepted. A number resolving to any other country is refused.
+     * Omitted, every country is accepted.
+     */
+    countries?: PhoneCountry[];
+    /**
+     * Country a number typed without an international prefix belongs to. Without it, only
+     * `+…` numbers can be understood.
+     */
+    defaultCountry?: PhoneCountry;
+    /**
+     * Whether a number may be written in national form and resolved against `defaultCountry`.
+     * `false` requires the international `+…` form, so the country is never guessed.
+     *
+     * @default true
+     */
+    detectCountry?: boolean;
+    /** Value of the input's `autocomplete` attribute. */
+    autocomplete?: 'tel' | 'tel-national' | 'tel-country-code';
+}
+export interface PhoneFieldDefinition {
+    type: 'phone';
+    options: PhoneFieldOptions;
+}
 export type UrlType = 'internal' | 'external';
 export interface UrlValue {
     href: string;
@@ -72,8 +102,23 @@ export interface UrlValue {
     openInNewTab: boolean;
     download?: boolean;
 }
+/**
+ * Scheme of an external link, without the trailing colon. The common ones are suggested, and
+ * any other scheme is still accepted — `bitcoin`, `matrix` or an application scheme are valid
+ * choices this list has no business refusing.
+ */
+export type UrlProtocol = 'http' | 'https' | 'mailto' | 'tel' | 'sms' | 'ftp' | (string & {});
 export interface UrlFieldOptions extends DefaultFieldOptions<UrlValue> {
     placeholder?: string;
+    /**
+     * Schemes an external link may use. `['https']` refuses plain `http`, and adding `mailto`
+     * or `tel` is what makes a contact link possible.
+     *
+     * Internal links are unaffected: they still have to start with `/` or `#`.
+     *
+     * @default ['http', 'https']
+     */
+    protocols?: UrlProtocol[];
 }
 export interface UrlFieldDefinition {
     type: 'url';
@@ -155,7 +200,7 @@ export interface ColorFieldDefinition {
     type: 'color';
     options: ColorFieldOptions;
 }
-export type ArrayItemFieldDefinition = StringFieldDefinition | SlugFieldDefinition | EmailFieldDefinition | UrlFieldDefinition | TextareaFieldDefinition | RichTextFieldDefinition | NumberFieldDefinition | BooleanFieldDefinition | ImageFieldDefinition | SelectFieldDefinition | RadioFieldDefinition | CheckboxGroupFieldDefinition | DateFieldDefinition | ColorFieldDefinition;
+export type ArrayItemFieldDefinition = StringFieldDefinition | SlugFieldDefinition | EmailFieldDefinition | PhoneFieldDefinition | UrlFieldDefinition | TextareaFieldDefinition | RichTextFieldDefinition | NumberFieldDefinition | BooleanFieldDefinition | ImageFieldDefinition | SelectFieldDefinition | RadioFieldDefinition | CheckboxGroupFieldDefinition | DateFieldDefinition | ColorFieldDefinition;
 export type ArrayItemSchema = Record<string, ArrayItemFieldDefinition>;
 export type ArrayItemDefinition = ArrayItemFieldDefinition | ArrayItemSchema;
 export type ArrayItemValue<T extends ArrayItemDefinition> = T extends NumberFieldDefinition ? number : T extends BooleanFieldDefinition ? boolean : T extends UrlFieldDefinition ? UrlValue : T extends CheckboxGroupFieldDefinition<infer Value> ? Value[] : T extends ArrayItemFieldDefinition ? string : T extends ArrayItemSchema ? {

package/dist/runtime/types/index.d.ts

@@ -1,5 +1,4 @@
 export * from './auth.js';
 export * from './eponyme.js';
 export * from './field.js';
-export * from './captcha.js';
 export * from './variables.js';

package/dist/runtime/types/index.js

@@ -1,5 +1,4 @@
 export * from "./auth.js";
 export * from "./eponyme.js";
 export * from "./field.js";
-export * from "./captcha.js";
 export * from "./variables.js";

package/dist/runtime/utils/middle-ellipsis.d.ts

@@ -0,0 +1 @@
+export declare function middleEllipsis(value: string, maxLength?: number): string;

package/dist/runtime/utils/middle-ellipsis.js

@@ -0,0 +1,8 @@
+export function middleEllipsis(value, maxLength = 28) {
+  const characters = [...value];
+  if (characters.length <= maxLength) return value;
+  const available = maxLength - 1;
+  const startLength = Math.ceil(available / 2);
+  const endLength = Math.floor(available / 2);
+  return `${characters.slice(0, startLength).join("")}\u2026${characters.slice(-endLength).join("")}`;
+}

package/dist/runtime/utils/normalize-eponyme-phones.d.ts

@@ -0,0 +1,9 @@
+import type { EponymeSchema } from '../types/index.js';
+/**
+ * Rewrites every phone value in a payload to E.164, wherever it sits in the schema.
+ *
+ * Applied on the server before a write, which is what makes the stored format a guarantee
+ * rather than a convention: the API accepts any JSON, so a client normalising on its own could
+ * always be bypassed. Values that cannot be parsed are left as typed for validation to reject.
+ */
+export declare function normalizeEponymePhones(schema: EponymeSchema, data: Record<string, unknown>): Record<string, unknown>;

package/dist/runtime/utils/normalize-eponyme-phones.js

@@ -0,0 +1,38 @@
+import { isArrayItemFieldDefinition } from "./get-field-default-value.js";
+import { toEponymePhoneValue } from "./normalize-phone.js";
+export function normalizeEponymePhones(schema, data) {
+  const result = { ...data };
+  for (const [name, definition] of Object.entries(schema)) {
+    if (!(name in result)) continue;
+    result[name] = normalizeField(definition, result[name]);
+  }
+  return result;
+}
+function normalizeField(definition, value) {
+  if (definition.type === "phone") return toEponymePhoneValue(value, definition.options);
+  if (definition.type === "section")
+    return normalizeNested(definition.options.fields, value);
+  if (definition.type === "tabs") {
+    if (!isRecord(value)) return value;
+    const tabs = { ...value };
+    for (const [tabName, tab] of Object.entries(definition.options.tabs))
+      if (tabName in tabs) tabs[tabName] = normalizeNested(tab.fields, tabs[tabName]);
+    return tabs;
+  }
+  if (definition.type === "array") {
+    if (!Array.isArray(value)) return value;
+    return value.map((item) => normalizeArrayItem(definition.options.of, item));
+  }
+  return value;
+}
+function normalizeArrayItem(of, item) {
+  if (isArrayItemFieldDefinition(of)) return normalizeField(of, item);
+  return normalizeNested(of, item);
+}
+function normalizeNested(schema, value) {
+  if (!isRecord(value)) return value;
+  return normalizeEponymePhones(schema, value);
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/runtime/utils/normalize-phone.d.ts

@@ -0,0 +1,26 @@
+import type { PhoneFieldOptions } from '../types/field.js';
+export interface NormalizedPhone {
+    /** The number in E.164, present only when it parsed and validated. */
+    e164?: string;
+    /** Country the number resolved to, present as soon as it parsed. */
+    country?: string;
+    valid: boolean;
+    /** Set when the number is valid but its country is not in `countries`. */
+    countryNotAllowed?: boolean;
+}
+/**
+ * Single source of truth for what a phone field accepts, shared by the validation the server
+ * enforces, the editor field, and the write path that stores the value.
+ *
+ * The `min` metadata bundle is deliberate: it is a fraction of the size of the full one and
+ * parses and formats every country. The trade is precision — it accepts a few numbers the full
+ * metadata would reject as impossible for their region.
+ *
+ * @see https://gitlab.com/catamphetamine/libphonenumber-js#min-vs-max-vs-mobile-vs-core
+ */
+export declare function normalizeEponymePhone(value: unknown, options?: PhoneFieldOptions): NormalizedPhone;
+/**
+ * The value to store: E.164 whenever the number is understood, and the input untouched when it
+ * is not, so validation can report it and the editor can still see what was typed.
+ */
+export declare function toEponymePhoneValue(value: unknown, options?: PhoneFieldOptions): unknown;

package/dist/runtime/utils/normalize-phone.js

@@ -0,0 +1,17 @@
+import { parsePhoneNumberFromString } from "libphonenumber-js/min";
+export function normalizeEponymePhone(value, options = {}) {
+  const raw = typeof value === "string" ? value.trim() : "";
+  if (!raw) return { valid: true };
+  const international = raw.startsWith("+");
+  if (options.detectCountry === false && !international) return { valid: false };
+  const parsed = parsePhoneNumberFromString(raw, international ? void 0 : options.defaultCountry);
+  if (!parsed || !parsed.isValid()) return { valid: false, country: parsed?.country };
+  const allowed = options.countries?.length ? options.countries : void 0;
+  if (allowed && (!parsed.country || !allowed.includes(parsed.country)))
+    return { valid: false, country: parsed.country, countryNotAllowed: true };
+  return { valid: true, e164: parsed.number, country: parsed.country };
+}
+export function toEponymePhoneValue(value, options = {}) {
+  if (typeof value !== "string") return value;
+  return normalizeEponymePhone(value, options).e164 ?? value;
+}

package/dist/runtime/utils/validate-eponyme-data.js

@@ -1,5 +1,6 @@
 import { isArrayItemFieldDefinition } from "./get-field-default-value.js";
 import { isFieldVisible } from "./is-field-visible.js";
+import { normalizeEponymePhone } from "./normalize-phone.js";
 const urlPattern = /^https?:\/\//i;
 const datePattern = /^\d{4}-\d{2}-\d{2}$/;
 const colorPattern = /^#(?:[\da-f]{3}|[\da-f]{6}|[\da-f]{8})$/i;
@@ -134,7 +135,10 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
     const href = link.href.trim();
     if (mode === "publish" && options.required && !href) addError(errors, name, "This field is required.");
     if (!href) return;
-    if (link.type === "external" && !urlPattern.test(href)) addError(errors, name, "External links must be HTTP(S) URLs.");
+    if (link.type === "external" && !isAllowedProtocol(href, definition.options.protocols)) {
+      const allowed = normalizeProtocols(definition.options.protocols);
+      addError(errors, name, isDefaultProtocols(definition.options.protocols) ? "External links must be HTTP(S) URLs." : `External links must start with ${allowed.map((protocol) => `${protocol}:`).join(" or ")}.`);
+    }
     if (link.type === "internal" && !href.startsWith("/") && !href.startsWith("#")) addError(errors, name, "Internal links must start with / or #.");
     return;
   }
@@ -160,6 +164,16 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
     if (definition.options.max && normalized > definition.options.max) addError(errors, name, `Must be on or before ${definition.options.max}.`);
     return;
   }
+  if (definition.type === "phone") {
+    const phone = normalizeEponymePhone(normalized, definition.options);
+    if (normalized && phone.countryNotAllowed) {
+      const accepted = definition.options.countries?.join(", ");
+      addError(errors, name, phone.country ? `Numbers from ${phone.country} are not accepted. Use a number from: ${accepted}.` : `Must be a number from: ${accepted}.`);
+    } else if (normalized && !phone.valid) {
+      addError(errors, name, definition.options.detectCountry === false ? "Must be a valid phone number in international format, starting with the country code." : "Must be a valid phone number.");
+    }
+    return;
+  }
   if (definition.type === "color") {
     if (normalized && !colorPattern.test(normalized)) addError(errors, name, "Must be a valid hex color.");
     return;
@@ -179,8 +193,20 @@ function validateFieldRules(name, definition, value, errors, mode, _context) {
   if (definition.options.maxLength !== void 0 && value.length > definition.options.maxLength) addError(errors, name, `Must contain at most ${definition.options.maxLength} characters.`);
   if (definition.options.regex && !definition.options.regex.test(value)) addError(errors, name, "Has an invalid format.");
   const [localPart, domain, ...extraParts] = normalized.split("@");
-  if ((definition.type === "email" || definition.options.email) && normalized && (!localPart || !domain?.includes(".") || extraParts.length)) addError(errors, name, "Must be a valid email address.");
-  if (definition.options.url && normalized && !urlPattern.test(normalized)) addError(errors, name, "Must be an HTTP(S) URL.");
+  if (definition.type === "email" && normalized && (!localPart || !domain?.includes(".") || extraParts.length)) addError(errors, name, "Must be a valid email address.");
+}
+const DEFAULT_URL_PROTOCOLS = ["http", "https"];
+const schemePattern = /^([a-z][a-z0-9+.-]*):/i;
+function normalizeProtocols(protocols) {
+  const declared = protocols?.length ? protocols : DEFAULT_URL_PROTOCOLS;
+  return declared.map((protocol) => protocol.trim().toLowerCase().replace(/:.*$/, ""));
+}
+function isDefaultProtocols(protocols) {
+  return !protocols?.length;
+}
+function isAllowedProtocol(href, protocols) {
+  const scheme = schemePattern.exec(href)?.[1]?.toLowerCase();
+  return Boolean(scheme) && normalizeProtocols(protocols).includes(scheme);
 }
 function getRichTextContent(value) {
   return value.replace(/<br\s*\/?>/gi, " ").replace(/<\/p>|<\/h[1-6]>|<\/li>|<\/blockquote>/gi, " ").replace(/<[^>]+>/g, "").replace(/&nbsp;|&#160;/gi, " ").replace(/&amp;/gi, "&").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/\s+/g, " ").trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@karibsen/eponyme",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "A lightweight, type-safe content manager for Nuxt.",
   "license": "MIT",
   "type": "module",
@@ -60,9 +60,9 @@
   },
   "dependencies": {
     "@iconify-json/mingcute": "^1.2.7",
+    "@karibsen/ui": "latest",
     "@nuxt/icon": "^2.3.1",
     "@nuxt/kit": "^4.4.8",
-    "@karibsen/ui": "latest",
     "@tailwindcss/vite": "^4.1.12",
     "@tanstack/vue-table": "^8.21.3",
     "@tiptap/extension-image": "^3.29.2",
@@ -72,6 +72,7 @@
     "@vueuse/core": "^14.3.0",
     "@vueuse/integrations": "^14.3.0",
     "fuse.js": "^7.5.0",
+    "libphonenumber-js": "^1.13.9",
     "picocolors": "^1.1.1",
     "reka-ui": "^2.10.1",
     "slugify": "^1.6.9",

package/dist/runtime/server/utils/eponyme-captcha.d.ts

@@ -1,6 +0,0 @@
-import type { H3Event } from 'h3';
-import type { EponymeCaptchaResult, EponymeCaptchaVerifier } from '../../types/captcha.js';
-export declare const CAPTCHA_TOKEN_KEY = "_eponyme_captcha";
-export declare function eponymeCaptchaVerifier(): EponymeCaptchaVerifier;
-export declare function isEponymeCaptchaConfigured(): boolean;
-export declare function verifyEponymeCaptcha(event: H3Event, token: unknown): Promise<EponymeCaptchaResult>;

package/dist/runtime/server/utils/eponyme-captcha.js

@@ -1,14 +0,0 @@
-import { getRequestIP } from "h3";
-import captchaVerifier from "#eponyme/captcha";
-export const CAPTCHA_TOKEN_KEY = "_eponyme_captcha";
-export function eponymeCaptchaVerifier() {
-  return captchaVerifier;
-}
-export function isEponymeCaptchaConfigured() {
-  return eponymeCaptchaVerifier().name !== "none";
-}
-export async function verifyEponymeCaptcha(event, token) {
-  if (typeof token !== "string" || !token.trim())
-    return { success: false, reason: "Missing captcha token." };
-  return eponymeCaptchaVerifier().verify(token, { ip: getRequestIP(event, { xForwardedFor: true }) });
-}

package/dist/runtime/types/captcha.d.ts

@@ -1,16 +0,0 @@
-export interface EponymeCaptchaResult {
-    success: boolean;
-    /** Provider-specific reason, surfaced in server logs rather than to the visitor. */
-    reason?: string;
-}
-/**
- * Verifies the token a visitor's captcha widget produced. Implemented by an adapter
- * package such as `@karibsen/eponyme-captcha`; the core ships none, so a project
- * without an adapter simply has no captcha.
- */
-export interface EponymeCaptchaVerifier {
-    name: string;
-    verify: (token: string, context: {
-        ip?: string;
-    }) => Promise<EponymeCaptchaResult>;
-}

package/dist/runtime/utils/no-captcha.d.ts

@@ -1,7 +0,0 @@
-import type { EponymeCaptchaVerifier } from '../types/captcha.js';
-/**
- * Stands in when no adapter is installed. It never claims success, so a form that
- * requires a captcha refuses submissions rather than silently accepting them all.
- */
-declare const verifier: EponymeCaptchaVerifier;
-export default verifier;

package/dist/runtime/utils/no-captcha.js

@@ -1,5 +0,0 @@
-const verifier = {
-  name: "none",
-  verify: async () => ({ success: false, reason: "No captcha adapter is installed." })
-};
-export default verifier;