@valbuild/core 0.136.8 → 0.137.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @valbuild/core
 
+## 0.137.0
+
+### Patch Changes
+
+- [#676](https://github.com/valbuild/val/pull/676) [`43b58f2`](https://github.com/valbuild/val/commit/43b58f2962840883badf91950da2c51b89d1c7cb) Thanks [@freekh](https://github.com/freekh)! - External page keys are now validated, and `mailto:` and `tel:` are allowed.
+
+  `externalPageRouter` documented a rule — a key must start with `https://` or
+  `http://` — and never enforced it: the validator collected the errors and then
+  returned an empty list, so a key like `discord.gg/val` or `/about` was accepted
+  in silence and behaved as a relative link on the site.
+
+  Fixing that made the rule itself worth looking at, because it was a rule about
+  the protocol standing in for a rule about links. A contact page's email address
+  and phone number are external pages to whoever maintains the list, and they
+  were refused. So the rule that is now enforced is a deny list rather than an
+  allow list: a key must have a scheme, and the scheme must not be one of
+  `javascript:`, `data:`, `vbscript:`, `file:` or `blob:` — which are not links
+  at all. An external page key ends up in an `href` in your site's own markup, so
+  those stay refused however the router is configured.
+
+  A project that wants to be stricter says so:
+
+  ```ts
+  s.record(item).router(externalPageRouter({ schemes: ["https", "mailto"] }));
+  ```
+
+  `initVal()` from `@valbuild/next` and `@valbuild/tanstack` hands you the
+  callable form, so the narrowed version typechecks in an app.
+
+  Val Studio applies the same rule while you type — it calls the same function —
+  and shows a narrowed project's own list in the message.
+
+  If your project has a key with no scheme at all, it will start showing a
+  validation error on that entry. Give it one, or move it out of the external
+  router.
+
 ## 0.136.8
 
 ### Patch Changes

package/dist/declarations/src/externalUrlSchemes.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+export declare const UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
+export type ExternalUrlSchemePolicy = {
+    /**
+     * The only schemes allowed, without the colon: `["https", "mailto"]`.
+     *
+     * Absent means the wide default — anything but {@link UNSAFE_URL_SCHEMES}.
+     */
+    schemes?: readonly string[];
+};
+/** The scheme of a URL, lowercased and without the colon, or null. */
+export declare function schemeOf(url: string): string | null;
+export type SchemeRejection = {
+    reason: "no-scheme";
+} | {
+    reason: "unsafe";
+    scheme: string;
+} | {
+    reason: "not-allowed";
+    scheme: string;
+    allowed: readonly string[];
+};
+/** `null` when the URL's scheme is acceptable under `policy`. */
+export declare function rejectScheme(url: string, policy?: ExternalUrlSchemePolicy): SchemeRejection | null;
+/** What to tell whoever wrote the key. */
+export declare function describeSchemeRejection(rejection: SchemeRejection): string;
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+export declare function isCheckableScheme(url: string): boolean;

package/dist/declarations/src/index.d.ts

@@ -79,9 +79,19 @@ export { type SerializedLiteralSchema, LiteralSchema } from "./schema/literal.js
 export { deserializeSchema } from "./schema/deserialize.js";
 export { type PreviewItem, type ItemPreviewInput, type RecordPreview, type ArrayPreview, type ReifiedPreview, type PreviewScope, previewScope, } from "./preview.js";
 export { type InlineRender, type FieldRender, isInlineRender } from "./render.js";
-export type { ValRouter, RouteValidationError } from "./router.js";
+export type { ValRouter, ExternalPageRouter, RouteValidationError, } from "./router.js";
 export { parseNextJsRoutePattern, parseTanStackRoutePattern, tanStackSegmentsOfRoutePath, validateUrlAgainstPattern, } from "./router.js";
 export { getSourcePathFromRoute, isPageRouter } from "./getSourcePathFromRoute.js";
+/**
+ * Which URL schemes an external page key may carry.
+ *
+ * Exported from the package root rather than only through `Internal` because
+ * the Studio has to apply the same rule the router does, while the key is
+ * being typed - one implementation, two callers, no second copy to drift.
+ */
+export { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf, UNSAFE_URL_SCHEMES, } from "./externalUrlSchemes.js";
+export type { ExternalUrlSchemePolicy, SchemeRejection, } from "./externalUrlSchemes.js";
+import { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf } from "./externalUrlSchemes.js";
 export declare const FATAL_ERROR_TYPES: readonly ["no-schema", "no-source", "invalid-id", "no-module", "invalid-patch"];
 export type FatalErrorType = (typeof FATAL_ERROR_TYPES)[number];
 export declare const DEFAULT_CONTENT_HOST = "https://content.val.build";
@@ -138,7 +148,12 @@ declare const Internal: {
     joinModuleFilePathAndModulePath: typeof joinModuleFilePathAndModulePath;
     nextAppRouter: import("./router.js").ValRouter;
     tanstackRouter: import("./router.js").ValRouter;
-    externalPageRouter: import("./router.js").ValRouter;
+    externalPageRouter: import("./router.js").ExternalPageRouter;
+    describeSchemeRejection: typeof describeSchemeRejection;
+    isCheckableScheme: typeof isCheckableScheme;
+    rejectScheme: typeof rejectScheme;
+    schemeOf: typeof schemeOf;
+    UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
     color: {
         parseColor: typeof parseColor;
         formatColor: typeof formatColor;

package/dist/declarations/src/router.d.ts

@@ -1,5 +1,31 @@
 import { ModuleFilePath } from "./val/index.js";
-export declare const externalPageRouter: ValRouter;
+import { ExternalUrlSchemePolicy } from "./externalUrlSchemes.js";
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+export declare const externalPageRouter: ExternalPageRouter;
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+export type ExternalPageRouter = ValRouter & ((policy: ExternalUrlSchemePolicy) => ValRouter);
 export type RouteValidationError = {
     error: {
         message: string;
@@ -70,5 +96,14 @@ export declare function tanStackSegmentsOfRoutePath(routePath: string): string[]
 export declare const tanstackRouter: ValRouter;
 export interface ValRouter {
     getRouterId(): string;
+    /**
+     * Which URL schemes this router's keys may use, where it restricts them.
+     *
+     * Serialized alongside the router id so the Studio can apply the SAME rule
+     * while someone types, rather than accepting a key and reporting it as a
+     * validation error afterwards. Absent on routers whose keys are paths rather
+     * than URLs, which is every other one.
+     */
+    getUrlSchemePolicy?(): ExternalUrlSchemePolicy;
     validate(moduleFilePath: ModuleFilePath, urlPaths: string[]): RouteValidationError[];
 }

package/dist/declarations/src/schema/record.d.ts

@@ -31,6 +31,15 @@ export type SerializedRecordSchema = {
     /** Static layout config, carried whole in the serialized schema — see `render.ts`. */
     render?: FieldRender;
     router?: string;
+    /**
+     * The URL schemes this router's keys may use, where it restricts them.
+     *
+     * Carried so the Studio can apply the router's OWN rule while someone types
+     * rather than accepting a key and reporting it afterwards. Absent both when
+     * the router has no scheme rule (every path router) and when it allows the
+     * wide default, which the Studio knows on its own.
+     */
+    routerSchemes?: string[];
     customValidate?: boolean;
     mediaType?: "files" | "images";
     accept?: string;

package/dist/{index-962a8ac3.esm.js → index-42ab6700.esm.js}

@@ -5630,6 +5630,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6446,21 +6461,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -13765,35 +13781,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = _createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = _createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14193,7 +14339,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.8",
+	version: "0.137.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14307,6 +14453,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14399,4 +14550,4 @@ function tryJsonParse(str) {
   }
 }
 
-export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };
+export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, describeSchemeRejection as ai, isCheckableScheme as aj, rejectScheme as ak, schemeOf as al, UNSAFE_URL_SCHEMES as am, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };

package/dist/{index-2545d3b4.cjs.prod.js → index-481a7dcd.cjs.prod.js}

@@ -5632,6 +5632,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6448,21 +6463,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -13767,35 +13783,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = result._createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = result._createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14195,7 +14341,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.8",
+	version: "0.137.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14309,6 +14455,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14439,6 +14590,7 @@ exports.StringSchema = StringSchema;
 exports.THEME_LOGO_DIRECTORY = THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = VAL_EXTENSION;
 exports.ValViewSchema = ValViewSchema;
 exports._classCallCheck = _classCallCheck;
@@ -14451,6 +14603,7 @@ exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;
+exports.describeSchemeRejection = describeSchemeRejection;
 exports.deserializeSchema = deserializeSchema;
 exports.discriminatedUnionBranchOf = discriminatedUnionBranchOf;
 exports.extractValModules = extractValModules;
@@ -14458,6 +14611,7 @@ exports.getSourcePathFromRoute = getSourcePathFromRoute;
 exports.hasMediaSchema = hasMediaSchema;
 exports.hasRemoteFileSchema = hasRemoteFileSchema;
 exports.initVal = initVal;
+exports.isCheckableScheme = isCheckableScheme;
 exports.isInlineRender = isInlineRender;
 exports.isPageRouter = isPageRouter;
 exports.isRootModuleFilePath = isRootModuleFilePath;
@@ -14469,7 +14623,9 @@ exports.modules = modules;
 exports.parseNextJsRoutePattern = parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = parseTanStackRoutePattern;
 exports.previewScope = previewScope;
+exports.rejectScheme = rejectScheme;
 exports.resolveSettingsModule = resolveSettingsModule;
+exports.schemeOf = schemeOf;
 exports.splitModuleFilePathAndModulePath = splitModuleFilePathAndModulePath;
 exports.tanStackSegmentsOfRoutePath = tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = validateUrlAgainstPattern;

package/dist/{index-afbcf0ca.cjs.dev.js → index-fed897a2.cjs.dev.js}

@@ -5632,6 +5632,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6448,21 +6463,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -13767,35 +13783,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = result._createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = result._createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14195,7 +14341,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.8",
+	version: "0.137.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14309,6 +14455,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14439,6 +14590,7 @@ exports.StringSchema = StringSchema;
 exports.THEME_LOGO_DIRECTORY = THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = VAL_EXTENSION;
 exports.ValViewSchema = ValViewSchema;
 exports._classCallCheck = _classCallCheck;
@@ -14451,6 +14603,7 @@ exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;
+exports.describeSchemeRejection = describeSchemeRejection;
 exports.deserializeSchema = deserializeSchema;
 exports.discriminatedUnionBranchOf = discriminatedUnionBranchOf;
 exports.extractValModules = extractValModules;
@@ -14458,6 +14611,7 @@ exports.getSourcePathFromRoute = getSourcePathFromRoute;
 exports.hasMediaSchema = hasMediaSchema;
 exports.hasRemoteFileSchema = hasRemoteFileSchema;
 exports.initVal = initVal;
+exports.isCheckableScheme = isCheckableScheme;
 exports.isInlineRender = isInlineRender;
 exports.isPageRouter = isPageRouter;
 exports.isRootModuleFilePath = isRootModuleFilePath;
@@ -14469,7 +14623,9 @@ exports.modules = modules;
 exports.parseNextJsRoutePattern = parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = parseTanStackRoutePattern;
 exports.previewScope = previewScope;
+exports.rejectScheme = rejectScheme;
 exports.resolveSettingsModule = resolveSettingsModule;
+exports.schemeOf = schemeOf;
 exports.splitModuleFilePathAndModulePath = splitModuleFilePathAndModulePath;
 exports.tanStackSegmentsOfRoutePath = tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = validateUrlAgainstPattern;

package/dist/valbuild-core.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-afbcf0ca.cjs.dev.js');
+var dist_valbuildCore = require('./index-fed897a2.cjs.dev.js');
 require('./result-bb1f436e.cjs.dev.js');
 
 
@@ -44,6 +44,7 @@ exports.StringSchema = dist_valbuildCore.StringSchema;
 exports.THEME_LOGO_DIRECTORY = dist_valbuildCore.THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = dist_valbuildCore.THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = dist_valbuildCore.THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = dist_valbuildCore.UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = dist_valbuildCore.VAL_EXTENSION;
 exports.ValViewSchema = dist_valbuildCore.ValViewSchema;
 exports.assistantAvailability = dist_valbuildCore.assistantAvailability;
@@ -51,6 +52,7 @@ exports.computeSourcesSha = dist_valbuildCore.computeSourcesSha;
 exports.computeValModuleShas = dist_valbuildCore.computeValModuleShas;
 exports.declaredKeySetOf = dist_valbuildCore.declaredKeySetOf;
 exports.derefPatch = dist_valbuildCore.derefPatch;
+exports.describeSchemeRejection = dist_valbuildCore.describeSchemeRejection;
 exports.deserializeSchema = dist_valbuildCore.deserializeSchema;
 exports.discriminatedUnionBranchOf = dist_valbuildCore.discriminatedUnionBranchOf;
 exports.extractValModules = dist_valbuildCore.extractValModules;
@@ -58,6 +60,7 @@ exports.getSourcePathFromRoute = dist_valbuildCore.getSourcePathFromRoute;
 exports.hasMediaSchema = dist_valbuildCore.hasMediaSchema;
 exports.hasRemoteFileSchema = dist_valbuildCore.hasRemoteFileSchema;
 exports.initVal = dist_valbuildCore.initVal;
+exports.isCheckableScheme = dist_valbuildCore.isCheckableScheme;
 exports.isInlineRender = dist_valbuildCore.isInlineRender;
 exports.isPageRouter = dist_valbuildCore.isPageRouter;
 exports.isRootModuleFilePath = dist_valbuildCore.isRootModuleFilePath;
@@ -69,6 +72,8 @@ exports.modules = dist_valbuildCore.modules;
 exports.parseNextJsRoutePattern = dist_valbuildCore.parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = dist_valbuildCore.parseTanStackRoutePattern;
 exports.previewScope = dist_valbuildCore.previewScope;
+exports.rejectScheme = dist_valbuildCore.rejectScheme;
 exports.resolveSettingsModule = dist_valbuildCore.resolveSettingsModule;
+exports.schemeOf = dist_valbuildCore.schemeOf;
 exports.tanStackSegmentsOfRoutePath = dist_valbuildCore.tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = dist_valbuildCore.validateUrlAgainstPattern;

package/dist/valbuild-core.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-2545d3b4.cjs.prod.js');
+var dist_valbuildCore = require('./index-481a7dcd.cjs.prod.js');
 require('./result-787e35f6.cjs.prod.js');
 
 
@@ -44,6 +44,7 @@ exports.StringSchema = dist_valbuildCore.StringSchema;
 exports.THEME_LOGO_DIRECTORY = dist_valbuildCore.THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = dist_valbuildCore.THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = dist_valbuildCore.THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = dist_valbuildCore.UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = dist_valbuildCore.VAL_EXTENSION;
 exports.ValViewSchema = dist_valbuildCore.ValViewSchema;
 exports.assistantAvailability = dist_valbuildCore.assistantAvailability;
@@ -51,6 +52,7 @@ exports.computeSourcesSha = dist_valbuildCore.computeSourcesSha;
 exports.computeValModuleShas = dist_valbuildCore.computeValModuleShas;
 exports.declaredKeySetOf = dist_valbuildCore.declaredKeySetOf;
 exports.derefPatch = dist_valbuildCore.derefPatch;
+exports.describeSchemeRejection = dist_valbuildCore.describeSchemeRejection;
 exports.deserializeSchema = dist_valbuildCore.deserializeSchema;
 exports.discriminatedUnionBranchOf = dist_valbuildCore.discriminatedUnionBranchOf;
 exports.extractValModules = dist_valbuildCore.extractValModules;
@@ -58,6 +60,7 @@ exports.getSourcePathFromRoute = dist_valbuildCore.getSourcePathFromRoute;
 exports.hasMediaSchema = dist_valbuildCore.hasMediaSchema;
 exports.hasRemoteFileSchema = dist_valbuildCore.hasRemoteFileSchema;
 exports.initVal = dist_valbuildCore.initVal;
+exports.isCheckableScheme = dist_valbuildCore.isCheckableScheme;
 exports.isInlineRender = dist_valbuildCore.isInlineRender;
 exports.isPageRouter = dist_valbuildCore.isPageRouter;
 exports.isRootModuleFilePath = dist_valbuildCore.isRootModuleFilePath;
@@ -69,6 +72,8 @@ exports.modules = dist_valbuildCore.modules;
 exports.parseNextJsRoutePattern = dist_valbuildCore.parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = dist_valbuildCore.parseTanStackRoutePattern;
 exports.previewScope = dist_valbuildCore.previewScope;
+exports.rejectScheme = dist_valbuildCore.rejectScheme;
 exports.resolveSettingsModule = dist_valbuildCore.resolveSettingsModule;
+exports.schemeOf = dist_valbuildCore.schemeOf;
 exports.tanStackSegmentsOfRoutePath = dist_valbuildCore.tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = dist_valbuildCore.validateUrlAgainstPattern;

package/dist/valbuild-core.esm.js

@@ -1,2 +1,2 @@
-export { v as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, Y as CODE_LANGUAGES, Z as COLOR_FORMATS, X as CodeSchema, W as ColorSchema, e as DEFAULT_APP_HOST, $ as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, n as DEFAULT_VAL_REMOTE_HOST, t as DateSchema, a0 as DateTimeSchema, a6 as DiscriminatedUnionSchema, a7 as EnumSchema, F as FATAL_ERROR_TYPES, r as FileSchema, G as GenericSelector, q as ImageSchema, I as Internal, a1 as KeyOfSchema, a8 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a5 as RichTextSchema, a4 as RouteSchema, z as SETTINGS_MODULE_CONVENTION, S as Schema, u as SettingsSchema, p as StringSchema, T as THEME_LOGO_DIRECTORY, x as THEME_RADIUS_LENGTHS, w as THEME_RADIUS_STEPS, V as VAL_EXTENSION, a2 as ValViewSchema, y as assistantAvailability, j as computeSourcesSha, h as computeValModuleShas, K as declaredKeySetOf, o as derefPatch, a9 as deserializeSchema, U as discriminatedUnionBranchOf, g as extractValModules, ag as getSourcePathFromRoute, l as hasMediaSchema, k as hasRemoteFileSchema, i as initVal, ab as isInlineRender, ah as isPageRouter, C as isRootModuleFilePath, a3 as isValViewSource, J as localeOfValue, H as localeTagError, Q as missingDeclaredKeys, m as modules, ac as parseNextJsRoutePattern, ad as parseTanStackRoutePattern, aa as previewScope, E as resolveSettingsModule, ae as tanStackSegmentsOfRoutePath, af as validateUrlAgainstPattern } from './index-962a8ac3.esm.js';
+export { v as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, Y as CODE_LANGUAGES, Z as COLOR_FORMATS, X as CodeSchema, W as ColorSchema, e as DEFAULT_APP_HOST, $ as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, n as DEFAULT_VAL_REMOTE_HOST, t as DateSchema, a0 as DateTimeSchema, a6 as DiscriminatedUnionSchema, a7 as EnumSchema, F as FATAL_ERROR_TYPES, r as FileSchema, G as GenericSelector, q as ImageSchema, I as Internal, a1 as KeyOfSchema, a8 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a5 as RichTextSchema, a4 as RouteSchema, z as SETTINGS_MODULE_CONVENTION, S as Schema, u as SettingsSchema, p as StringSchema, T as THEME_LOGO_DIRECTORY, x as THEME_RADIUS_LENGTHS, w as THEME_RADIUS_STEPS, am as UNSAFE_URL_SCHEMES, V as VAL_EXTENSION, a2 as ValViewSchema, y as assistantAvailability, j as computeSourcesSha, h as computeValModuleShas, K as declaredKeySetOf, o as derefPatch, ai as describeSchemeRejection, a9 as deserializeSchema, U as discriminatedUnionBranchOf, g as extractValModules, ag as getSourcePathFromRoute, l as hasMediaSchema, k as hasRemoteFileSchema, i as initVal, aj as isCheckableScheme, ab as isInlineRender, ah as isPageRouter, C as isRootModuleFilePath, a3 as isValViewSource, J as localeOfValue, H as localeTagError, Q as missingDeclaredKeys, m as modules, ac as parseNextJsRoutePattern, ad as parseTanStackRoutePattern, aa as previewScope, ak as rejectScheme, E as resolveSettingsModule, al as schemeOf, ae as tanStackSegmentsOfRoutePath, af as validateUrlAgainstPattern } from './index-42ab6700.esm.js';
 import './result-daff1cae.esm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/core",
-  "version": "0.136.8",
+  "version": "0.137.0",
   "private": false,
   "description": "Val - supercharged hard-coded content",
   "repository": {

package/patch/dist/valbuild-core-patch.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-afbcf0ca.cjs.dev.js');
+var dist_valbuildCore = require('../../dist/index-fed897a2.cjs.dev.js');
 var result = require('../../dist/result-bb1f436e.cjs.dev.js');
 var util = require('../../dist/util-b213092b.cjs.dev.js');
 

package/patch/dist/valbuild-core-patch.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-2545d3b4.cjs.prod.js');
+var dist_valbuildCore = require('../../dist/index-481a7dcd.cjs.prod.js');
 var result = require('../../dist/result-787e35f6.cjs.prod.js');
 var util = require('../../dist/util-030d8a1f.cjs.prod.js');
 

package/patch/dist/valbuild-core-patch.esm.js

@@ -1,5 +1,5 @@
-import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-962a8ac3.esm.js';
-export { P as PatchError } from '../../dist/index-962a8ac3.esm.js';
+import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-42ab6700.esm.js';
+export { P as PatchError } from '../../dist/index-42ab6700.esm.js';
 import { f as isNonEmpty, e as err, o as ok, m as map, g as flatMap, i as isErr, h as flatMapReduce, j as filterOrElse, k as mapErr, l as map$1, n as all, p as flatten, q as allT } from '../../dist/result-daff1cae.esm.js';
 import { p as pipe } from '../../dist/util-18613e99.esm.js';