@optique/core 1.3.0-dev.2585 → 1.3.0-dev.2589

package/dist/valueparser.cjs

@@ -2756,6 +2756,18 @@ function url(options = {}) {
 */
 const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
 /**
+* Whether a URL scheme can yield a tuple origin.  Opaque schemes such as
+* `file:`, `blob:`, `mailto:`, and `data:` cannot, and an origin parser can
+* never accept them, so they are rejected when listed in `allowedProtocols`.
+*/
+function canProduceOrigin(protocol) {
+	try {
+		return new URL(`${protocol}//0.invalid`).origin !== "null";
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a {@link ValueParser} for web origins.
 *
 * An origin is a scheme, a host, and an optional port, and nothing else.  The
@@ -2804,6 +2816,7 @@ function origin(options = {}) {
 				const rendered = typeof protocol === "string" ? JSON.stringify(protocol) : String(protocol);
 				throw new TypeError(`Each allowed protocol must be a valid protocol ending with a colon (e.g., "https:"), got: ${rendered}.`);
 			}
+			if (!canProduceOrigin(protocol)) throw new TypeError(`Each allowed protocol must name a scheme that can produce an origin, but ${JSON.stringify(protocol)} cannot.`);
 			const normalized = protocol.toLowerCase();
 			if (seen.has(normalized)) continue;
 			seen.add(normalized);
@@ -2870,7 +2883,7 @@ function origin(options = {}) {
 			success: false,
 			error: require_message.message`An origin must not contain credentials: ${url$1.origin}`
 		};
-		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "")) return {
+		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "" || url$1.href !== new URL(url$1.origin).href)) return {
 			success: false,
 			error: require_message.message`Expected only an origin, but got extra components on ${url$1.origin}.`
 		};

package/dist/valueparser.d.cts

@@ -1191,6 +1191,8 @@ interface UrlOptions {
 declare function url(options?: UrlOptions): ValueParser<"sync", URL>;
 /**
  * Options for creating an {@link origin} parser.
+ *
+ * @since 1.3.0
  */
 interface OriginOptions {
   /**
@@ -1203,7 +1205,9 @@ interface OriginOptions {
   /**
    * List of allowed URL protocols (e.g., `["http:", "https:"]`).
    * If specified, the parsed URL must use one of these protocols.
-   * Protocol names should include the trailing colon (e.g., `"https:"`).
+   * Protocol names should include the trailing colon (e.g., `"https:"`), and
+   * each must name a scheme that can produce an origin; opaque schemes such as
+   * `file:` and `blob:` are rejected at construction.
    * If not specified, any protocol with a tuple origin is allowed.
    */
   readonly allowedProtocols?: readonly string[];
@@ -1212,8 +1216,8 @@ interface OriginOptions {
    *
    * - `"strip"`: return just the origin, discarding any path, query, or
    *   fragment.
-   * - `"reject"`: fail when the input has a path other than `/`, a query, or
-   *   a fragment.
+   * - `"reject"`: fail when the input has a path other than `/`, or a query
+   *   or fragment delimiter (including an empty `?` or `#`).
    *
    * Credentials are always rejected, under either setting.
    * @default `"strip"`

package/dist/valueparser.d.ts

@@ -1191,6 +1191,8 @@ interface UrlOptions {
 declare function url(options?: UrlOptions): ValueParser<"sync", URL>;
 /**
  * Options for creating an {@link origin} parser.
+ *
+ * @since 1.3.0
  */
 interface OriginOptions {
   /**
@@ -1203,7 +1205,9 @@ interface OriginOptions {
   /**
    * List of allowed URL protocols (e.g., `["http:", "https:"]`).
    * If specified, the parsed URL must use one of these protocols.
-   * Protocol names should include the trailing colon (e.g., `"https:"`).
+   * Protocol names should include the trailing colon (e.g., `"https:"`), and
+   * each must name a scheme that can produce an origin; opaque schemes such as
+   * `file:` and `blob:` are rejected at construction.
    * If not specified, any protocol with a tuple origin is allowed.
    */
   readonly allowedProtocols?: readonly string[];
@@ -1212,8 +1216,8 @@ interface OriginOptions {
    *
    * - `"strip"`: return just the origin, discarding any path, query, or
    *   fragment.
-   * - `"reject"`: fail when the input has a path other than `/`, a query, or
-   *   a fragment.
+   * - `"reject"`: fail when the input has a path other than `/`, or a query
+   *   or fragment delimiter (including an empty `?` or `#`).
    *
    * Credentials are always rejected, under either setting.
    * @default `"strip"`

package/dist/valueparser.js

@@ -2756,6 +2756,18 @@ function url(options = {}) {
 */
 const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/u;
 /**
+* Whether a URL scheme can yield a tuple origin.  Opaque schemes such as
+* `file:`, `blob:`, `mailto:`, and `data:` cannot, and an origin parser can
+* never accept them, so they are rejected when listed in `allowedProtocols`.
+*/
+function canProduceOrigin(protocol) {
+	try {
+		return new URL(`${protocol}//0.invalid`).origin !== "null";
+	} catch {
+		return false;
+	}
+}
+/**
 * Creates a {@link ValueParser} for web origins.
 *
 * An origin is a scheme, a host, and an optional port, and nothing else.  The
@@ -2804,6 +2816,7 @@ function origin(options = {}) {
 				const rendered = typeof protocol === "string" ? JSON.stringify(protocol) : String(protocol);
 				throw new TypeError(`Each allowed protocol must be a valid protocol ending with a colon (e.g., "https:"), got: ${rendered}.`);
 			}
+			if (!canProduceOrigin(protocol)) throw new TypeError(`Each allowed protocol must name a scheme that can produce an origin, but ${JSON.stringify(protocol)} cannot.`);
 			const normalized = protocol.toLowerCase();
 			if (seen.has(normalized)) continue;
 			seen.add(normalized);
@@ -2870,7 +2883,7 @@ function origin(options = {}) {
 			success: false,
 			error: message`An origin must not contain credentials: ${url$1.origin}`
 		};
-		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "")) return {
+		if (extraComponents === "reject" && (url$1.pathname !== "/" || url$1.search !== "" || url$1.hash !== "" || url$1.href !== new URL(url$1.origin).href)) return {
 			success: false,
 			error: message`Expected only an origin, but got extra components on ${url$1.origin}.`
 		};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optique/core",
-  "version": "1.3.0-dev.2585",
+  "version": "1.3.0-dev.2589",
   "description": "Type-safe combinatorial command-line interface parser",
   "keywords": [
     "CLI",
@@ -237,7 +237,7 @@
   },
   "sideEffects": false,
   "devDependencies": {
-    "@optique/env": "1.3.0-dev.2585+77a42c40",
+    "@optique/env": "1.3.0-dev.2589+3608b288",
     "@types/node": "^24.0.0",
     "fast-check": "^4.7.0",
     "tsdown": "^0.13.0",