@valbuild/core 0.136.1 → 0.137.0

package/dist/{index-ab3e94a0.cjs.prod.js → index-481a7dcd.cjs.prod.js}

@@ -5632,6 +5632,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6448,21 +6463,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -12611,9 +12627,41 @@ function collectObjectRecursive(item, collector) {
  * exactly. That is the property the promotion relies on: only the modules whose
  * source actually moved change anything.
  */
+/**
+ * The `sourcesSha` fold on its own: path and source, in `val.modules` order.
+ *
+ * Separate from {@link computeValModuleShas} because the Studio needs it and
+ * has nothing else that fold takes. It is how a client tells whether the base
+ * it is showing is the base a server's `/stat` answer is relative to: the chain
+ * a server announces is the patches ITS build does not contain, so applying it
+ * to another build's source loses edits or applies them twice. Both sides call
+ * this one implementation, so the comparison is only ever between two runs of
+ * the same code.
+ */
+function computeSourcesSha(entries) {
+  var sourcesSha = "";
+  var _iterator = result._createForOfIteratorHelper(entries),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _step$value = _step.value,
+        path = _step$value.path,
+        source = _step$value.source;
+      sourcesSha = hash(sourcesSha + JSON.stringify({
+        path: path,
+        source: source
+      }));
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return sourcesSha;
+}
 function computeValModuleShas(config, entries, moduleErrors) {
   var configSha = hash(JSON.stringify(config));
-  var sourcesSha = "";
+  var sourcesSha = computeSourcesSha(entries);
   var baseSha = configSha;
   // NOTE: schemaSha is deliberately NOT seeded with configSha. It is compared
   // across bundles (the server extracts from the Node bundle, the editor SPA
@@ -12624,18 +12672,14 @@ function computeValModuleShas(config, entries, moduleErrors) {
   // server-only env vars and therefore `undefined` in the browser. Seeding with
   // them made the two sides disagree on every production load.
   var schemaSha = "";
-  var _iterator = result._createForOfIteratorHelper(entries),
-    _step;
+  var _iterator2 = result._createForOfIteratorHelper(entries),
+    _step2;
   try {
-    for (_iterator.s(); !(_step = _iterator.n()).done;) {
-      var entry = _step.value;
+    for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+      var entry = _step2.value;
       var path = entry.path,
         source = entry.source,
         serializedSchema = entry.serializedSchema;
-      sourcesSha = hash(sourcesSha + JSON.stringify({
-        path: path,
-        source: source
-      }));
       baseSha = hash(baseSha + JSON.stringify({
         path: path,
         schema: serializedSchema,
@@ -12653,9 +12697,9 @@ function computeValModuleShas(config, entries, moduleErrors) {
       }));
     }
   } catch (err) {
-    _iterator.e(err);
+    _iterator2.e(err);
   } finally {
-    _iterator.f();
+    _iterator2.f();
   }
   return {
     baseSha: baseSha,
@@ -12677,7 +12721,7 @@ function extractValModules(_x) {
 }
 function _extractValModules() {
   _extractValModules = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(valModules) {
-    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator2, _step2, error, _iterator3, _step3, _error, _t, _t2;
+    var moduleErrors, addModuleError, sources, schemas, serializedSchemas, shaEntries, moduleIdx, module, at, value, path, schema, source, serializedSchema, pathM, _iterator3, _step3, error, _iterator4, _step4, _error, _t, _t2;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
@@ -12824,10 +12868,10 @@ function _extractValModules() {
           // Appended AFTER the loop on purpose: each entry's `moduleErrorsAt` is the
           // error count at the time it was folded in, so the SHAs stay a function of
           // the modules themselves.
-          _iterator2 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
+          _iterator3 = result._createForOfIteratorHelper(resolveSettingsModule(serializedSchemas).errors);
           try {
-            for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-              error = _step2.value;
+            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+              error = _step3.value;
               moduleErrors.push(error);
             }
             // Same kind of rule, same reason it is here: a view cycle is a property of the
@@ -12835,20 +12879,20 @@ function _extractValModules() {
             // catches it either — a view stores a pointer, not content, so there is no
             // data cycle for a source walk to trip over.
           } catch (err) {
-            _iterator2.e(err);
+            _iterator3.e(err);
           } finally {
-            _iterator2.f();
+            _iterator3.f();
           }
-          _iterator3 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
+          _iterator4 = result._createForOfIteratorHelper(viewCycleErrors(serializedSchemas));
           try {
-            for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
-              _error = _step3.value;
+            for (_iterator4.s(); !(_step4 = _iterator4.n()).done;) {
+              _error = _step4.value;
               moduleErrors.push(_error);
             }
           } catch (err) {
-            _iterator3.e(err);
+            _iterator4.e(err);
           } finally {
-            _iterator3.f();
+            _iterator4.f();
           }
           return _context.a(2, _objectSpread2(_objectSpread2({
             sources: sources,
@@ -13739,35 +13783,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = result._createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = result._createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14167,7 +14341,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.1",
+	version: "0.137.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14281,6 +14455,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14411,6 +14590,7 @@ exports.StringSchema = StringSchema;
 exports.THEME_LOGO_DIRECTORY = THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = VAL_EXTENSION;
 exports.ValViewSchema = ValViewSchema;
 exports._classCallCheck = _classCallCheck;
@@ -14419,9 +14599,11 @@ exports._slicedToArray = _slicedToArray;
 exports._toConsumableArray = _toConsumableArray;
 exports._typeof = _typeof;
 exports.assistantAvailability = assistantAvailability;
+exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;
+exports.describeSchemeRejection = describeSchemeRejection;
 exports.deserializeSchema = deserializeSchema;
 exports.discriminatedUnionBranchOf = discriminatedUnionBranchOf;
 exports.extractValModules = extractValModules;
@@ -14429,6 +14611,7 @@ exports.getSourcePathFromRoute = getSourcePathFromRoute;
 exports.hasMediaSchema = hasMediaSchema;
 exports.hasRemoteFileSchema = hasRemoteFileSchema;
 exports.initVal = initVal;
+exports.isCheckableScheme = isCheckableScheme;
 exports.isInlineRender = isInlineRender;
 exports.isPageRouter = isPageRouter;
 exports.isRootModuleFilePath = isRootModuleFilePath;
@@ -14440,7 +14623,9 @@ exports.modules = modules;
 exports.parseNextJsRoutePattern = parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = parseTanStackRoutePattern;
 exports.previewScope = previewScope;
+exports.rejectScheme = rejectScheme;
 exports.resolveSettingsModule = resolveSettingsModule;
+exports.schemeOf = schemeOf;
 exports.splitModuleFilePathAndModulePath = splitModuleFilePathAndModulePath;
 exports.tanStackSegmentsOfRoutePath = tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = validateUrlAgainstPattern;