@valbuild/core 0.136.1 → 0.137.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @valbuild/core
 
+## 0.137.0
+
+### Patch Changes
+
+- [#676](https://github.com/valbuild/val/pull/676) [`43b58f2`](https://github.com/valbuild/val/commit/43b58f2962840883badf91950da2c51b89d1c7cb) Thanks [@freekh](https://github.com/freekh)! - External page keys are now validated, and `mailto:` and `tel:` are allowed.
+
+  `externalPageRouter` documented a rule — a key must start with `https://` or
+  `http://` — and never enforced it: the validator collected the errors and then
+  returned an empty list, so a key like `discord.gg/val` or `/about` was accepted
+  in silence and behaved as a relative link on the site.
+
+  Fixing that made the rule itself worth looking at, because it was a rule about
+  the protocol standing in for a rule about links. A contact page's email address
+  and phone number are external pages to whoever maintains the list, and they
+  were refused. So the rule that is now enforced is a deny list rather than an
+  allow list: a key must have a scheme, and the scheme must not be one of
+  `javascript:`, `data:`, `vbscript:`, `file:` or `blob:` — which are not links
+  at all. An external page key ends up in an `href` in your site's own markup, so
+  those stay refused however the router is configured.
+
+  A project that wants to be stricter says so:
+
+  ```ts
+  s.record(item).router(externalPageRouter({ schemes: ["https", "mailto"] }));
+  ```
+
+  `initVal()` from `@valbuild/next` and `@valbuild/tanstack` hands you the
+  callable form, so the narrowed version typechecks in an app.
+
+  Val Studio applies the same rule while you type — it calls the same function —
+  and shows a narrowed project's own list in the message.
+
+  If your project has a key with no scheme at all, it will start showing a
+  validation error on that entry. Give it one, or move it out of the external
+  router.
+
+## 0.136.8
+
+### Patch Changes
+
+- [#737](https://github.com/valbuild/val/pull/737) [`35577be`](https://github.com/valbuild/val/commit/35577be50981fec35fc27ee9435a092a26909395) Thanks [@freekh](https://github.com/freekh)! - After a publish, the Studio no longer loses edits or applies a list reorder twice while the new build is rolling out.
+
+  The Studio shows the content built into the page it loaded, with the unpublished changes on top. Which changes those are comes from the server, and the server lists them relative to its own build. For a while after a publish the two can be different builds: a tab opened before the publish keeps its page, and a managed project's new build reaches each location up to a minute apart. The Studio then applied one build's list of changes to another build's content. Published edits went missing, or were applied a second time, which is invisible for a text replacement but reorders a list again, or removes the wrong item.
+
+  The server already says which build answered (`sourcesSha`), and the Studio now computes the same fingerprint for the content it holds. When the two differ, it fetches the answering build's content and puts it in place together with that build's list of changes, in one step, so nothing on screen shows a half-updated state. Going back to its own build needs no fetch. When they match, which is almost always, nothing extra is requested.
+
 ## 0.136.1
 
 ### Patch Changes

package/dist/declarations/src/externalUrlSchemes.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+export declare const UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
+export type ExternalUrlSchemePolicy = {
+    /**
+     * The only schemes allowed, without the colon: `["https", "mailto"]`.
+     *
+     * Absent means the wide default — anything but {@link UNSAFE_URL_SCHEMES}.
+     */
+    schemes?: readonly string[];
+};
+/** The scheme of a URL, lowercased and without the colon, or null. */
+export declare function schemeOf(url: string): string | null;
+export type SchemeRejection = {
+    reason: "no-scheme";
+} | {
+    reason: "unsafe";
+    scheme: string;
+} | {
+    reason: "not-allowed";
+    scheme: string;
+    allowed: readonly string[];
+};
+/** `null` when the URL's scheme is acceptable under `policy`. */
+export declare function rejectScheme(url: string, policy?: ExternalUrlSchemePolicy): SchemeRejection | null;
+/** What to tell whoever wrote the key. */
+export declare function describeSchemeRejection(rejection: SchemeRejection): string;
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+export declare function isCheckableScheme(url: string): boolean;

package/dist/declarations/src/extractValModules.d.ts

@@ -70,6 +70,21 @@ export type ValModuleShas = {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+export declare function computeSourcesSha(entries: readonly {
+    path: string;
+    source: unknown;
+}[]): string;
 export declare function computeValModuleShas(config: ValModules["config"], entries: readonly ValModuleShaEntry[], moduleErrors: readonly ExtractedModuleError[]): ValModuleShas;
 /**
  * Extracts schemas and sources from a ValModules registry and computes the

package/dist/declarations/src/index.d.ts

@@ -1,6 +1,6 @@
 export { initVal, type ConfigDirectory } from "./initVal.js";
 export { modules, type ValModules } from "./modules.js";
-export { extractValModules, computeValModuleShas, type ExtractedValModules, type ValModuleShaEntry, type ValModuleShas, type ExtractedModuleError, } from "./extractValModules.js";
+export { extractValModules, computeValModuleShas, computeSourcesSha, type ExtractedValModules, type ValModuleShaEntry, type ValModuleShas, type ExtractedModuleError, } from "./extractValModules.js";
 export type { InitVal, ValConfig, ValConstructor, ContentConstructor, } from "./initVal.js";
 export { Schema, type SerializedSchema, type SelectorOfSchema } from "./schema/index.js";
 export { hasRemoteFileSchema, hasMediaSchema, } from "./schema/hasRemoteFileSchema.js";
@@ -79,9 +79,19 @@ export { type SerializedLiteralSchema, LiteralSchema } from "./schema/literal.js
 export { deserializeSchema } from "./schema/deserialize.js";
 export { type PreviewItem, type ItemPreviewInput, type RecordPreview, type ArrayPreview, type ReifiedPreview, type PreviewScope, previewScope, } from "./preview.js";
 export { type InlineRender, type FieldRender, isInlineRender } from "./render.js";
-export type { ValRouter, RouteValidationError } from "./router.js";
+export type { ValRouter, ExternalPageRouter, RouteValidationError, } from "./router.js";
 export { parseNextJsRoutePattern, parseTanStackRoutePattern, tanStackSegmentsOfRoutePath, validateUrlAgainstPattern, } from "./router.js";
 export { getSourcePathFromRoute, isPageRouter } from "./getSourcePathFromRoute.js";
+/**
+ * Which URL schemes an external page key may carry.
+ *
+ * Exported from the package root rather than only through `Internal` because
+ * the Studio has to apply the same rule the router does, while the key is
+ * being typed - one implementation, two callers, no second copy to drift.
+ */
+export { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf, UNSAFE_URL_SCHEMES, } from "./externalUrlSchemes.js";
+export type { ExternalUrlSchemePolicy, SchemeRejection, } from "./externalUrlSchemes.js";
+import { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf } from "./externalUrlSchemes.js";
 export declare const FATAL_ERROR_TYPES: readonly ["no-schema", "no-source", "invalid-id", "no-module", "invalid-patch"];
 export type FatalErrorType = (typeof FATAL_ERROR_TYPES)[number];
 export declare const DEFAULT_CONTENT_HOST = "https://content.val.build";
@@ -138,7 +148,12 @@ declare const Internal: {
     joinModuleFilePathAndModulePath: typeof joinModuleFilePathAndModulePath;
     nextAppRouter: import("./router.js").ValRouter;
     tanstackRouter: import("./router.js").ValRouter;
-    externalPageRouter: import("./router.js").ValRouter;
+    externalPageRouter: import("./router.js").ExternalPageRouter;
+    describeSchemeRejection: typeof describeSchemeRejection;
+    isCheckableScheme: typeof isCheckableScheme;
+    rejectScheme: typeof rejectScheme;
+    schemeOf: typeof schemeOf;
+    UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
     color: {
         parseColor: typeof parseColor;
         formatColor: typeof formatColor;

package/dist/declarations/src/router.d.ts

@@ -1,5 +1,31 @@
 import { ModuleFilePath } from "./val/index.js";
-export declare const externalPageRouter: ValRouter;
+import { ExternalUrlSchemePolicy } from "./externalUrlSchemes.js";
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+export declare const externalPageRouter: ExternalPageRouter;
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+export type ExternalPageRouter = ValRouter & ((policy: ExternalUrlSchemePolicy) => ValRouter);
 export type RouteValidationError = {
     error: {
         message: string;
@@ -70,5 +96,14 @@ export declare function tanStackSegmentsOfRoutePath(routePath: string): string[]
 export declare const tanstackRouter: ValRouter;
 export interface ValRouter {
     getRouterId(): string;
+    /**
+     * Which URL schemes this router's keys may use, where it restricts them.
+     *
+     * Serialized alongside the router id so the Studio can apply the SAME rule
+     * while someone types, rather than accepting a key and reporting it as a
+     * validation error afterwards. Absent on routers whose keys are paths rather
+     * than URLs, which is every other one.
+     */
+    getUrlSchemePolicy?(): ExternalUrlSchemePolicy;
     validate(moduleFilePath: ModuleFilePath, urlPaths: string[]): RouteValidationError[];
 }

package/dist/declarations/src/schema/record.d.ts

@@ -31,6 +31,15 @@ export type SerializedRecordSchema = {
     /** Static layout config, carried whole in the serialized schema — see `render.ts`. */
     render?: FieldRender;
     router?: string;
+    /**
+     * The URL schemes this router's keys may use, where it restricts them.
+     *
+     * Carried so the Studio can apply the router's OWN rule while someone types
+     * rather than accepting a key and reporting it afterwards. Absent both when
+     * the router has no scheme rule (every path router) and when it allows the
+     * wide default, which the Studio knows on its own.
+     */
+    routerSchemes?: string[];
     customValidate?: boolean;
     mediaType?: "files" | "images";
     accept?: string;

package/dist/{index-3b96790c.esm.js → index-42ab6700.esm.js}

@@ -5630,6 +5630,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6446,21 +6461,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -12609,9 +12625,41 @@ function collectObjectRecursive(item, collector) {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+function computeSourcesSha(entries) {
+  var sourcesSha = "";
+  var _iterator = _createForOfIteratorHelper(entries),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _step.value,
+        path = _step$value.path,
+        source = _step$value.source;
+      sourcesSha = hash(sourcesSha + JSON.stringify({
+        path: path,
+        source: source
+      }));
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return sourcesSha;
+}
 function computeValModuleShas(config, entries, moduleErrors) {
   var configSha = hash(JSON.stringify(config));
-  var sourcesSha = "";
+  var sourcesSha = computeSourcesSha(entries);
   var baseSha = configSha;
   // NOTE: schemaSha is deliberately NOT seeded with configSha. It is compared
   // across bundles (the server extracts from the Node bundle, the editor SPA
@@ -12622,18 +12670,14 @@ function computeValModuleShas(config, entries, moduleErrors) {
   // server-only env vars and therefore `undefined` in the browser. Seeding with
   // them made the two sides disagree on every production load.
   var schemaSha = "";
-  var _iterator = _createForOfIteratorHelper(entries),
-    _step;
+  var _iterator2 = _createForOfIteratorHelper(entries),
+    _step2;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var entry = _step.value;
+    for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+      var entry = _step2.value;
       var path = entry.path,
         source = entry.source,
         serializedSchema = entry.serializedSchema;
-      sourcesSha = hash(sourcesSha + JSON.stringify({
-        path: path,
-        source: source
-      }));
       baseSha = hash(baseSha + JSON.stringify({
         path: path,
         schema: serializedSchema,
@@ -12651,9 +12695,9 @@ function computeValModuleShas(config, entries, moduleErrors) {
       }));
     }
   } catch (err) {
-    _iterator.e(err);
+    _iterator2.e(err);
   } finally {
-    _iterator.f();
+    _iterator2.f();
   }
   return {
     baseSha: baseSha,
@@ -12675,7 +12719,7 @@ function extractValModules(_x) {
 }
 function _extractValModules() {
   _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
-    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator2, _step2, error, _iterator3, _step3, _error, _t, _t2;
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator3, _step3, error, _iterator4, _step4, _error, _t, _t2;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
@@ -12822,10 +12866,10 @@ function _extractValModules() {
           // Appended AFTER the loop on purpose: each entry's `moduleErrorsAt` is the
           // error count at the time it was folded in, so the SHAs stay a function of
           // the modules themselves.
-          _iterator2 = _createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
+          _iterator3 = _createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
           try {
-            for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-              error = _step2.value;
+            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+              error = _step3.value;
               moduleErrors.push(error);
             }
             // Same kind of rule, same reason it is here: a view cycle is a property of the
@@ -12833,20 +12877,20 @@ function _extractValModules() {
             // catches it either — a view stores a pointer, not content, so there is no
             // data cycle for a source walk to trip over.
           } catch (err) {
-            _iterator2.e(err);
+            _iterator3.e(err);
           } finally {
-            _iterator2.f();
+            _iterator3.f();
           }
-          _iterator3 = _createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
+          _iterator4 = _createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
           try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              _error = _step3.value;
+            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+              _error = _step4.value;
               moduleErrors.push(_error);
             }
           } catch (err) {
-            _iterator3.e(err);
+            _iterator4.e(err);
           } finally {
-            _iterator3.f();
+            _iterator4.f();
           }
           return _context.a(2, _objectSpread2(_objectSpread2({
             sources: sources,
@@ -13737,35 +13781,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = _createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = _createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14165,7 +14339,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.1",
+	version: "0.137.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14279,6 +14453,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14371,4 +14550,4 @@ function tryJsonParse(str) {
   }
 }
 
-export { DateTimeSchema as $, ArraySchema as A, BooleanSchema as B, resolveSettingsModule as C, DEFAULT_CONTENT_HOST as D, localeTagError as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeOfValue as H, Internal as I, declaredKeySetOf as J, missingDeclaredKeys as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, discriminatedUnionBranchOf as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, ColorSchema as U, VAL_EXTENSION as V, CodeSchema as W, CODE_LANGUAGES as X, COLOR_FORMATS as Y, DEFAULT_COLOR_FORMAT as Z, _typeof as _, _slicedToArray as a, KeyOfSchema as a0, ValViewSchema as a1, isValViewSource as a2, RouteSchema as a3, RichTextSchema as a4, DiscriminatedUnionSchema as a5, EnumSchema as a6, LiteralSchema as a7, deserializeSchema as a8, previewScope as a9, isInlineRender as aa, parseNextJsRoutePattern as ab, parseTanStackRoutePattern as ac, tanStackSegmentsOfRoutePath as ad, validateUrlAgainstPattern as ae, getSourcePathFromRoute as af, isPageRouter as ag, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, hasRemoteFileSchema as j, hasMediaSchema as k, DEFAULT_VAL_REMOTE_HOST as l, modules as m, derefPatch as n, StringSchema as o, ImageSchema as p, FileSchema as q, DateSchema as r, splitModuleFilePathAndModulePath as s, SettingsSchema as t, ASSISTANT_SETTINGS_MAX_LENGTH as u, THEME_RADIUS_STEPS as v, THEME_RADIUS_LENGTHS as w, assistantAvailability as x, SETTINGS_MODULE_CONVENTION as y, isRootModuleFilePath as z };
+export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, describeSchemeRejection as ai, isCheckableScheme as aj, rejectScheme as ak, schemeOf as al, UNSAFE_URL_SCHEMES as am, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };