@valbuild/core 0.136.8 → 0.138.0

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @valbuild/core
 
+## 0.138.0
+
+### Minor Changes
+
+- [#751](https://github.com/valbuild/val/pull/751) [`5876fe0`](https://github.com/valbuild/val/commit/5876fe075fdee1f76f1cdaa2488ac52c58c894a8) Thanks [@freekh](https://github.com/freekh)! - Publishing no longer asks for a commit message by default.
+
+  - **Publish publishes.** In HTTP mode, pressing Publish goes straight to publishing, just as Save already did in local development. Where an AI model is available it writes the commit message (the button reads "Preparing" meanwhile, for up to 15 seconds). Otherwise the message is built from what changed, and names the exact path when a single field changed, e.g. `Update hero.title in /content/home.val.ts`. When several things changed, the message body lists the changed modules and their fields: up to six modules and five fields each, then how many more.
+  - **`studio.commitMessage: "required"`** in `s.settings()` brings the box back, redesigned. Editors can turn it on from the Studio too: Settings → Studio → "Ask for a commit message". It opens empty rather than pre-filled, so a message cannot be published unread. The AI fills it in when it can, and Publish stays disabled until there is a message. Nothing publishes on its own: the countdown that published while the AI was still writing is gone.
+  - **The overlay menu stays open** while the commit message popover is open, or a publish is under way. Before, moving onto the popover collapsed the menu and the popover moved with it.
+
+### Patch Changes
+
+- [#752](https://github.com/valbuild/val/pull/752) [`57af895`](https://github.com/valbuild/val/commit/57af8959cc46519a405b1ed7441623f8bf2e6d27) Thanks [@freekh](https://github.com/freekh)! - `s.date()` now reports a value that is not a real `YYYY-MM-DD` day as a validation error. It used to check only `from` / `to`, and compared those as plain strings, so a typo like `"19f81-12-30"` passed a `.from("1900-01-01").to("2024-01-01")` range without a word. Impossible days such as `"2023-02-29"` are rejected too, and a `from` / `to` bound that is not a valid date is reported as a schema error.
+
+  The Studio's date field no longer shows a year below 100 (`"0050-01-01"`) as empty: it was read as 1950 and discarded.
+
+## 0.137.0
+
+### Patch Changes
+
+- [#676](https://github.com/valbuild/val/pull/676) [`43b58f2`](https://github.com/valbuild/val/commit/43b58f2962840883badf91950da2c51b89d1c7cb) Thanks [@freekh](https://github.com/freekh)! - External page keys are now validated, and `mailto:` and `tel:` are allowed.
+
+  `externalPageRouter` documented a rule — a key must start with `https://` or
+  `http://` — and never enforced it: the validator collected the errors and then
+  returned an empty list, so a key like `discord.gg/val` or `/about` was accepted
+  in silence and behaved as a relative link on the site.
+
+  Fixing that made the rule itself worth looking at, because it was a rule about
+  the protocol standing in for a rule about links. A contact page's email address
+  and phone number are external pages to whoever maintains the list, and they
+  were refused. So the rule that is now enforced is a deny list rather than an
+  allow list: a key must have a scheme, and the scheme must not be one of
+  `javascript:`, `data:`, `vbscript:`, `file:` or `blob:` — which are not links
+  at all. An external page key ends up in an `href` in your site's own markup, so
+  those stay refused however the router is configured.
+
+  A project that wants to be stricter says so:
+
+  ```ts
+  s.record(item).router(externalPageRouter({ schemes: ["https", "mailto"] }));
+  ```
+
+  `initVal()` from `@valbuild/next` and `@valbuild/tanstack` hands you the
+  callable form, so the narrowed version typechecks in an app.
+
+  Val Studio applies the same rule while you type — it calls the same function —
+  and shows a narrowed project's own list in the message.
+
+  If your project has a key with no scheme at all, it will start showing a
+  validation error on that entry. Give it one, or move it out of the external
+  router.
+
 ## 0.136.8
 
 ### Patch Changes

package/dist/declarations/src/externalUrlSchemes.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+export declare const UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
+export type ExternalUrlSchemePolicy = {
+    /**
+     * The only schemes allowed, without the colon: `["https", "mailto"]`.
+     *
+     * Absent means the wide default — anything but {@link UNSAFE_URL_SCHEMES}.
+     */
+    schemes?: readonly string[];
+};
+/** The scheme of a URL, lowercased and without the colon, or null. */
+export declare function schemeOf(url: string): string | null;
+export type SchemeRejection = {
+    reason: "no-scheme";
+} | {
+    reason: "unsafe";
+    scheme: string;
+} | {
+    reason: "not-allowed";
+    scheme: string;
+    allowed: readonly string[];
+};
+/** `null` when the URL's scheme is acceptable under `policy`. */
+export declare function rejectScheme(url: string, policy?: ExternalUrlSchemePolicy): SchemeRejection | null;
+/** What to tell whoever wrote the key. */
+export declare function describeSchemeRejection(rejection: SchemeRejection): string;
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+export declare function isCheckableScheme(url: string): boolean;

package/dist/declarations/src/index.d.ts

@@ -54,7 +54,7 @@ export { type SerializedImageSchema, ImageSchema } from "./schema/image.js";
 export { type SerializedFileSchema, FileSchema } from "./schema/file.js";
 export { type SerializedDateSchema, DateSchema } from "./schema/date.js";
 export { type SerializedSettingsSchema, SettingsSchema, } from "./schema/settings.js";
-export { type SettingsSource, type AssistantSettingsSource, type LocalesSettingsSource, type AssistantAvailability, type ThemeSettingsSource, type StudioSettingsSource, type ThemeRadius, ASSISTANT_SETTINGS_MAX_LENGTH, THEME_LOGO_DIRECTORY, THEME_RADIUS_STEPS, THEME_RADIUS_LENGTHS, assistantAvailability, } from "./source/settings.js";
+export { type SettingsSource, type AssistantSettingsSource, type LocalesSettingsSource, type AssistantAvailability, type ThemeSettingsSource, type StudioSettingsSource, type StudioCommitMessageMode, type ThemeRadius, ASSISTANT_SETTINGS_MAX_LENGTH, THEME_LOGO_DIRECTORY, THEME_RADIUS_STEPS, THEME_RADIUS_LENGTHS, assistantAvailability, } from "./source/settings.js";
 export { type ResolvedSettingsModule, SETTINGS_MODULE_CONVENTION, isRootModuleFilePath, resolveSettingsModule, } from "./settingsModule.js";
 export { type Locale, localeTagError, localeOfValue } from "./locale.js";
 export { type SerializedLocaleSchema, LocaleSchema } from "./schema/locale.js";
@@ -79,9 +79,19 @@ export { type SerializedLiteralSchema, LiteralSchema } from "./schema/literal.js
 export { deserializeSchema } from "./schema/deserialize.js";
 export { type PreviewItem, type ItemPreviewInput, type RecordPreview, type ArrayPreview, type ReifiedPreview, type PreviewScope, previewScope, } from "./preview.js";
 export { type InlineRender, type FieldRender, isInlineRender } from "./render.js";
-export type { ValRouter, RouteValidationError } from "./router.js";
+export type { ValRouter, ExternalPageRouter, RouteValidationError, } from "./router.js";
 export { parseNextJsRoutePattern, parseTanStackRoutePattern, tanStackSegmentsOfRoutePath, validateUrlAgainstPattern, } from "./router.js";
 export { getSourcePathFromRoute, isPageRouter } from "./getSourcePathFromRoute.js";
+/**
+ * Which URL schemes an external page key may carry.
+ *
+ * Exported from the package root rather than only through `Internal` because
+ * the Studio has to apply the same rule the router does, while the key is
+ * being typed - one implementation, two callers, no second copy to drift.
+ */
+export { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf, UNSAFE_URL_SCHEMES, } from "./externalUrlSchemes.js";
+export type { ExternalUrlSchemePolicy, SchemeRejection, } from "./externalUrlSchemes.js";
+import { describeSchemeRejection, isCheckableScheme, rejectScheme, schemeOf } from "./externalUrlSchemes.js";
 export declare const FATAL_ERROR_TYPES: readonly ["no-schema", "no-source", "invalid-id", "no-module", "invalid-patch"];
 export type FatalErrorType = (typeof FATAL_ERROR_TYPES)[number];
 export declare const DEFAULT_CONTENT_HOST = "https://content.val.build";
@@ -138,7 +148,12 @@ declare const Internal: {
     joinModuleFilePathAndModulePath: typeof joinModuleFilePathAndModulePath;
     nextAppRouter: import("./router.js").ValRouter;
     tanstackRouter: import("./router.js").ValRouter;
-    externalPageRouter: import("./router.js").ValRouter;
+    externalPageRouter: import("./router.js").ExternalPageRouter;
+    describeSchemeRejection: typeof describeSchemeRejection;
+    isCheckableScheme: typeof isCheckableScheme;
+    rejectScheme: typeof rejectScheme;
+    schemeOf: typeof schemeOf;
+    UNSAFE_URL_SCHEMES: readonly ["javascript", "data", "vbscript", "file", "blob"];
     color: {
         parseColor: typeof parseColor;
         formatColor: typeof formatColor;

package/dist/declarations/src/router.d.ts

@@ -1,5 +1,31 @@
 import { ModuleFilePath } from "./val/index.js";
-export declare const externalPageRouter: ValRouter;
+import { ExternalUrlSchemePolicy } from "./externalUrlSchemes.js";
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+export declare const externalPageRouter: ExternalPageRouter;
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+export type ExternalPageRouter = ValRouter & ((policy: ExternalUrlSchemePolicy) => ValRouter);
 export type RouteValidationError = {
     error: {
         message: string;
@@ -70,5 +96,14 @@ export declare function tanStackSegmentsOfRoutePath(routePath: string): string[]
 export declare const tanstackRouter: ValRouter;
 export interface ValRouter {
     getRouterId(): string;
+    /**
+     * Which URL schemes this router's keys may use, where it restricts them.
+     *
+     * Serialized alongside the router id so the Studio can apply the SAME rule
+     * while someone types, rather than accepting a key and reporting it as a
+     * validation error afterwards. Absent on routers whose keys are paths rather
+     * than URLs, which is every other one.
+     */
+    getUrlSchemePolicy?(): ExternalUrlSchemePolicy;
     validate(moduleFilePath: ModuleFilePath, urlPaths: string[]): RouteValidationError[];
 }

package/dist/declarations/src/schema/record.d.ts

@@ -31,6 +31,15 @@ export type SerializedRecordSchema = {
     /** Static layout config, carried whole in the serialized schema — see `render.ts`. */
     render?: FieldRender;
     router?: string;
+    /**
+     * The URL schemes this router's keys may use, where it restricts them.
+     *
+     * Carried so the Studio can apply the router's OWN rule while someone types
+     * rather than accepting a key and reporting it afterwards. Absent both when
+     * the router has no scheme rule (every path router) and when it allows the
+     * wide default, which the Studio knows on its own.
+     */
+    routerSchemes?: string[];
     customValidate?: boolean;
     mediaType?: "files" | "images";
     accept?: string;

package/dist/declarations/src/source/settings.d.ts

@@ -52,7 +52,21 @@ export type StudioSettingsSource = {
      * that browser and is not here.
      */
     tour?: boolean | null;
+    /**
+     * Whether publishing asks for a commit message.
+     *
+     * Unset means `"automatic"`: pressing Publish publishes, with a summary the
+     * AI writes where one is available and one assembled from what changed where
+     * it is not. Nobody is shown a box. `"required"` opens the box on every
+     * publish and will not publish it empty — the AI still fills it in, where
+     * there is one, but a person has to read it and press Publish.
+     *
+     * Only the HTTP (remote) mode commits, so this changes nothing in local
+     * development, where Save writes to disk.
+     */
+    commitMessage?: StudioCommitMessageMode | null;
 };
+export type StudioCommitMessageMode = "automatic" | "required";
 /**
  * How the Studio looks in this project.
  *

package/dist/{index-2545d3b4.cjs.prod.js → index-3296fc4f.cjs.prod.js}

@@ -5632,6 +5632,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6448,21 +6463,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -8742,7 +8758,8 @@ function settings() {
       }).nullable().describe("The project's own mark, shown where Val's is in the Studio. A square-ish mark rather than a wordmark: the slot is 32px wide.")
     }),
     studio: new SettingsSchema({
-      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it.")
+      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it."),
+      commitMessage: enumSchema("automatic", "required").nullable().describe("Whether publishing asks for a commit message. Unset is the same as 'automatic': Publish publishes straight away, with a message the AI writes (or one listing what changed). 'required' asks every time, and will not publish an empty one.")
     }),
     locales: new SettingsSchema({
       // Nullable because the source type is, and because the Studio writes
@@ -10914,7 +10931,7 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
   }, {
     key: "executeValidate",
     value: function executeValidate(path, src) {
-      var _this$options, _this$options2, _this$options3, _this$options4;
+      var _this$options, _this$options2, _this$options3, _this$options4, _this$options5, _this$options6;
       var errors = this.executeCustomValidateFunctions(src, this.customValidateFunctions, {
         path: path
       });
@@ -10928,7 +10945,31 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
         });
         return _defineProperty({}, path, errors);
       }
-      if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.from && (_this$options2 = this.options) !== null && _this$options2 !== void 0 && _this$options2.to) {
+      // The bounds below are compared as strings, which only orders days when
+      // every side is a real `YYYY-MM-DD`: "19f81-12-30" sorts between
+      // "1900-01-01" and "2024-01-01" and would pass them.
+      if (!isCalendarDay(src)) {
+        errors.push({
+          message: "Value '".concat(src, "' is not a valid date (expected YYYY-MM-DD)"),
+          value: src
+        });
+        return _defineProperty({}, path, errors);
+      }
+      var bounds = [["From", (_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.from], ["To", (_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.to]];
+      for (var _i = 0, _bounds = bounds; _i < _bounds.length; _i++) {
+        var _bounds$_i = _slicedToArray(_bounds[_i], 2),
+          name = _bounds$_i[0],
+          bound = _bounds$_i[1];
+        if (bound !== undefined && !isCalendarDay(bound)) {
+          errors.push({
+            message: "".concat(name, " date '").concat(bound, "' is not a valid date (expected YYYY-MM-DD)"),
+            value: src,
+            typeError: true
+          });
+          return _defineProperty({}, path, errors);
+        }
+      }
+      if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from && (_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
         if (this.options.from > this.options.to) {
           errors.push({
             message: "From date ".concat(this.options.from, " is after to date ").concat(this.options.to),
@@ -10941,14 +10982,14 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
             value: src
           });
         }
-      } else if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from) {
+      } else if ((_this$options5 = this.options) !== null && _this$options5 !== void 0 && _this$options5.from) {
         if (src < this.options.from) {
           errors.push({
             message: "Date is before the minimum date ".concat(this.options.from),
             value: src
           });
         }
-      } else if ((_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
+      } else if ((_this$options6 = this.options) !== null && _this$options6 !== void 0 && _this$options6.to) {
         if (src > this.options.to) {
           errors.push({
             message: "Date is after the maximum date ".concat(this.options.to),
@@ -11118,6 +11159,27 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
     }
   }]);
 }(Schema);
+var CALENDAR_DAY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Whether `value` is a `YYYY-MM-DD` day that exists on the calendar — so
+ * "2023-02-29" and "2024-13-01" are not, even though they have the shape.
+ */
+function isCalendarDay(value) {
+  var match = CALENDAR_DAY.exec(value);
+  if (!match) {
+    return false;
+  }
+  var year = Number(match[1]);
+  var month = Number(match[2]);
+  var day = Number(match[3]);
+  // Out-of-range fields roll over (Feb 30 -> Mar 2) instead of failing, so a
+  // day is real only if it survives the round trip. setUTCFullYear, not
+  // Date.UTC: the latter maps years 0-99 to 1900-1999.
+  var date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
 var date = function date(options) {
   return new DateSchema(options);
 };
@@ -13767,35 +13829,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = result._createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = result._createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14195,7 +14387,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.8",
+	version: "0.138.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14309,6 +14501,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14439,6 +14636,7 @@ exports.StringSchema = StringSchema;
 exports.THEME_LOGO_DIRECTORY = THEME_LOGO_DIRECTORY;
 exports.THEME_RADIUS_LENGTHS = THEME_RADIUS_LENGTHS;
 exports.THEME_RADIUS_STEPS = THEME_RADIUS_STEPS;
+exports.UNSAFE_URL_SCHEMES = UNSAFE_URL_SCHEMES;
 exports.VAL_EXTENSION = VAL_EXTENSION;
 exports.ValViewSchema = ValViewSchema;
 exports._classCallCheck = _classCallCheck;
@@ -14451,6 +14649,7 @@ exports.computeSourcesSha = computeSourcesSha;
 exports.computeValModuleShas = computeValModuleShas;
 exports.declaredKeySetOf = declaredKeySetOf;
 exports.derefPatch = derefPatch;
+exports.describeSchemeRejection = describeSchemeRejection;
 exports.deserializeSchema = deserializeSchema;
 exports.discriminatedUnionBranchOf = discriminatedUnionBranchOf;
 exports.extractValModules = extractValModules;
@@ -14458,6 +14657,7 @@ exports.getSourcePathFromRoute = getSourcePathFromRoute;
 exports.hasMediaSchema = hasMediaSchema;
 exports.hasRemoteFileSchema = hasRemoteFileSchema;
 exports.initVal = initVal;
+exports.isCheckableScheme = isCheckableScheme;
 exports.isInlineRender = isInlineRender;
 exports.isPageRouter = isPageRouter;
 exports.isRootModuleFilePath = isRootModuleFilePath;
@@ -14469,7 +14669,9 @@ exports.modules = modules;
 exports.parseNextJsRoutePattern = parseNextJsRoutePattern;
 exports.parseTanStackRoutePattern = parseTanStackRoutePattern;
 exports.previewScope = previewScope;
+exports.rejectScheme = rejectScheme;
 exports.resolveSettingsModule = resolveSettingsModule;
+exports.schemeOf = schemeOf;
 exports.splitModuleFilePathAndModulePath = splitModuleFilePathAndModulePath;
 exports.tanStackSegmentsOfRoutePath = tanStackSegmentsOfRoutePath;
 exports.validateUrlAgainstPattern = validateUrlAgainstPattern;