@optique/core 1.3.0-dev.2583 → 1.3.0-dev.2587

package/dist/valueparser.cjs

@@ -2756,6 +2756,18 @@ function url(options = {}) {
 */
 const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
 /**
+* Whether a URL scheme can yield a tuple origin.  Opaque schemes such as
+* `file:`, `blob:`, `mailto:`, and `data:` cannot, and an origin parser can
+* never accept them, so they are rejected when listed in `allowedProtocols`.
+*/
+function canProduceOrigin(protocol) {
+	try {
+		return new URL(`${protocol}//0.invalid`).origin !== "null";
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a {@link ValueParser} for web origins.
 *
 * An origin is a scheme, a host, and an optional port, and nothing else.  The
@@ -2804,6 +2816,7 @@ function origin(options = {}) {
 				const rendered = typeof protocol === "string" ? JSON.stringify(protocol) : String(protocol);
 				throw new TypeError(`Each allowed protocol must be a valid protocol ending with a colon (e.g., "https:"), got: ${rendered}.`);
 			}
+			if (!canProduceOrigin(protocol)) throw new TypeError(`Each allowed protocol must name a scheme that can produce an origin, but ${JSON.stringify(protocol)} cannot.`);
 			const normalized = protocol.toLowerCase();
 			if (seen.has(normalized)) continue;
 			seen.add(normalized);
@@ -2817,7 +2830,7 @@ function origin(options = {}) {
 	const invalidOrigin = options.errors?.invalidOrigin;
 	const disallowedProtocol = options.errors?.disallowedProtocol;
 	function invalidOriginError(input) {
-		return invalidOrigin ? typeof invalidOrigin === "function" ? invalidOrigin(input) : invalidOrigin : require_message.message`Invalid origin: ${input}.`;
+		return invalidOrigin ? typeof invalidOrigin === "function" ? invalidOrigin(input) : invalidOrigin : require_message.message`Invalid origin.`;
 	}
 	function disallowedProtocolError(protocol) {
 		return disallowedProtocol ? typeof disallowedProtocol === "function" ? disallowedProtocol(protocol, originalProtocols) : disallowedProtocol : [
@@ -2853,26 +2866,26 @@ function origin(options = {}) {
 		} else if (!hostname$1.endsWith(".")) url$1.hostname = `${hostname$1}.`;
 		return url$1;
 	}
-	function resolve(url$1, label) {
+	function resolve(url$1) {
 		if (allowedProtocols != null && !allowedProtocols.includes(url$1.protocol)) return {
 			success: false,
 			error: disallowedProtocolError(url$1.protocol)
 		};
 		if (url$1.protocol === "blob:") return {
 			success: false,
-			error: require_message.message`The URL ${label} wraps another origin. Pass that origin instead.`
+			error: require_message.message`The ${url$1.protocol} URL wraps another origin. Pass that origin instead.`
 		};
 		if (url$1.origin === "null") return {
 			success: false,
-			error: require_message.message`The URL ${label} has no origin.`
+			error: require_message.message`The ${url$1.protocol} URL has no origin.`
 		};
 		if (url$1.username !== "" || url$1.password !== "") return {
 			success: false,
 			error: require_message.message`An origin must not contain credentials: ${url$1.origin}`
 		};
-		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "")) return {
+		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "" || url$1.href !== new URL(url$1.origin).href)) return {
 			success: false,
-			error: require_message.message`Expected only an origin, but got: ${label}`
+			error: require_message.message`Expected only an origin, but got extra components on ${url$1.origin}.`
 		};
 		return {
 			success: true,
@@ -2890,21 +2903,21 @@ function origin(options = {}) {
 				success: false,
 				error: invalidOriginError(input)
 			};
-			return resolve(new URL(input), input);
+			return resolve(new URL(input));
 		},
 		validate(value) {
 			if (!(value instanceof URL)) return {
 				success: false,
 				error: invalidOriginError(String(value))
 			};
-			return resolve(value, value.href);
+			return resolve(value);
 		},
 		format(value) {
 			return value.origin;
 		},
 		normalize(value) {
 			if (!(value instanceof URL)) return value;
-			const result = resolve(value, value.href);
+			const result = resolve(value);
 			return result.success ? result.value : value;
 		},
 		*suggest(prefix) {

package/dist/valueparser.d.cts

@@ -1191,6 +1191,8 @@ interface UrlOptions {
 declare function url(options?: UrlOptions): ValueParser<"sync", URL>;
 /**
  * Options for creating an {@link origin} parser.
+ *
+ * @since 1.3.0
  */
 interface OriginOptions {
   /**
@@ -1203,7 +1205,9 @@ interface OriginOptions {
   /**
    * List of allowed URL protocols (e.g., `["http:", "https:"]`).
    * If specified, the parsed URL must use one of these protocols.
-   * Protocol names should include the trailing colon (e.g., `"https:"`).
+   * Protocol names should include the trailing colon (e.g., `"https:"`), and
+   * each must name a scheme that can produce an origin; opaque schemes such as
+   * `file:` and `blob:` are rejected at construction.
    * If not specified, any protocol with a tuple origin is allowed.
    */
   readonly allowedProtocols?: readonly string[];
@@ -1212,8 +1216,8 @@ interface OriginOptions {
    *
    * - `"strip"`: return just the origin, discarding any path, query, or
    *   fragment.
-   * - `"reject"`: fail when the input has a path other than `/`, a query, or
-   *   a fragment.
+   * - `"reject"`: fail when the input has a path other than `/`, or a query
+   *   or fragment delimiter (including an empty `?` or `#`).
    *
    * Credentials are always rejected, under either setting.
    * @default `"strip"`

package/dist/valueparser.d.ts

@@ -1191,6 +1191,8 @@ interface UrlOptions {
 declare function url(options?: UrlOptions): ValueParser<"sync", URL>;
 /**
  * Options for creating an {@link origin} parser.
+ *
+ * @since 1.3.0
  */
 interface OriginOptions {
   /**
@@ -1203,7 +1205,9 @@ interface OriginOptions {
   /**
    * List of allowed URL protocols (e.g., `["http:", "https:"]`).
    * If specified, the parsed URL must use one of these protocols.
-   * Protocol names should include the trailing colon (e.g., `"https:"`).
+   * Protocol names should include the trailing colon (e.g., `"https:"`), and
+   * each must name a scheme that can produce an origin; opaque schemes such as
+   * `file:` and `blob:` are rejected at construction.
    * If not specified, any protocol with a tuple origin is allowed.
    */
   readonly allowedProtocols?: readonly string[];
@@ -1212,8 +1216,8 @@ interface OriginOptions {
    *
    * - `"strip"`: return just the origin, discarding any path, query, or
    *   fragment.
-   * - `"reject"`: fail when the input has a path other than `/`, a query, or
-   *   a fragment.
+   * - `"reject"`: fail when the input has a path other than `/`, or a query
+   *   or fragment delimiter (including an empty `?` or `#`).
    *
    * Credentials are always rejected, under either setting.
    * @default `"strip"`

package/dist/valueparser.js

@@ -2756,6 +2756,18 @@ function url(options = {}) {
 */
 const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
 /**
+* Whether a URL scheme can yield a tuple origin.  Opaque schemes such as
+* `file:`, `blob:`, `mailto:`, and `data:` cannot, and an origin parser can
+* never accept them, so they are rejected when listed in `allowedProtocols`.
+*/
+function canProduceOrigin(protocol) {
+	try {
+		return new URL(`${protocol}//0.invalid`).origin !== "null";
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a {@link ValueParser} for web origins.
 *
 * An origin is a scheme, a host, and an optional port, and nothing else.  The
@@ -2804,6 +2816,7 @@ function origin(options = {}) {
 				const rendered = typeof protocol === "string" ? JSON.stringify(protocol) : String(protocol);
 				throw new TypeError(`Each allowed protocol must be a valid protocol ending with a colon (e.g., "https:"), got: ${rendered}.`);
 			}
+			if (!canProduceOrigin(protocol)) throw new TypeError(`Each allowed protocol must name a scheme that can produce an origin, but ${JSON.stringify(protocol)} cannot.`);
 			const normalized = protocol.toLowerCase();
 			if (seen.has(normalized)) continue;
 			seen.add(normalized);
@@ -2817,7 +2830,7 @@ function origin(options = {}) {
 	const invalidOrigin = options.errors?.invalidOrigin;
 	const disallowedProtocol = options.errors?.disallowedProtocol;
 	function invalidOriginError(input) {
-		return invalidOrigin ? typeof invalidOrigin === "function" ? invalidOrigin(input) : invalidOrigin : message`Invalid origin: ${input}.`;
+		return invalidOrigin ? typeof invalidOrigin === "function" ? invalidOrigin(input) : invalidOrigin : message`Invalid origin.`;
 	}
 	function disallowedProtocolError(protocol) {
 		return disallowedProtocol ? typeof disallowedProtocol === "function" ? disallowedProtocol(protocol, originalProtocols) : disallowedProtocol : [
@@ -2853,26 +2866,26 @@ function origin(options = {}) {
 		} else if (!hostname$1.endsWith(".")) url$1.hostname = `${hostname$1}.`;
 		return url$1;
 	}
-	function resolve(url$1, label) {
+	function resolve(url$1) {
 		if (allowedProtocols != null && !allowedProtocols.includes(url$1.protocol)) return {
 			success: false,
 			error: disallowedProtocolError(url$1.protocol)
 		};
 		if (url$1.protocol === "blob:") return {
 			success: false,
-			error: message`The URL ${label} wraps another origin. Pass that origin instead.`
+			error: message`The ${url$1.protocol} URL wraps another origin. Pass that origin instead.`
 		};
 		if (url$1.origin === "null") return {
 			success: false,
-			error: message`The URL ${label} has no origin.`
+			error: message`The ${url$1.protocol} URL has no origin.`
 		};
 		if (url$1.username !== "" || url$1.password !== "") return {
 			success: false,
 			error: message`An origin must not contain credentials: ${url$1.origin}`
 		};
-		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "")) return {
+		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "" || url$1.href !== new URL(url$1.origin).href)) return {
 			success: false,
-			error: message`Expected only an origin, but got: ${label}`
+			error: message`Expected only an origin, but got extra components on ${url$1.origin}.`
 		};
 		return {
 			success: true,
@@ -2890,21 +2903,21 @@ function origin(options = {}) {
 				success: false,
 				error: invalidOriginError(input)
 			};
-			return resolve(new URL(input), input);
+			return resolve(new URL(input));
 		},
 		validate(value) {
 			if (!(value instanceof URL)) return {
 				success: false,
 				error: invalidOriginError(String(value))
 			};
-			return resolve(value, value.href);
+			return resolve(value);
 		},
 		format(value) {
 			return value.origin;
 		},
 		normalize(value) {
 			if (!(value instanceof URL)) return value;
-			const result = resolve(value, value.href);
+			const result = resolve(value);
 			return result.success ? result.value : value;
 		},
 		*suggest(prefix) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optique/core",
-  "version": "1.3.0-dev.2583",
+  "version": "1.3.0-dev.2587",
   "description": "Type-safe combinatorial command-line interface parser",
   "keywords": [
     "CLI",
@@ -237,7 +237,7 @@
   },
   "sideEffects": false,
   "devDependencies": {
-    "@optique/env": "1.3.0-dev.2583+d30dbb53",
+    "@optique/env": "1.3.0-dev.2587+ab6dc7e5",
     "@types/node": "^24.0.0",
     "fast-check": "^4.7.0",
     "tsdown": "^0.13.0",