@valbuild/core 0.136.8 → 0.138.0

package/dist/{index-962a8ac3.esm.js → index-a25822a3.esm.js}

@@ -5630,6 +5630,21 @@ function missingDeclaredKeys(declared, present) {
   });
 }
 
+/**
+ * A router's scheme restriction, as a spreadable fragment.
+ *
+ * Spread rather than assigned so an unrestricted router adds no key at all:
+ * `routerSchemes: undefined` would serialize as an explicit `undefined` and
+ * show up in every schema diff for no reason.
+ */
+function routerSchemes(router) {
+  var _router$getUrlSchemeP;
+  var schemes = router === null || router === void 0 || (_router$getUrlSchemeP = router.getUrlSchemePolicy) === null || _router$getUrlSchemeP === void 0 ? void 0 : _router$getUrlSchemeP.call(router).schemes;
+  return schemes === undefined ? {} : {
+    routerSchemes: _toConsumableArray(schemes)
+  };
+}
+
 /**
  * The source type of a `.jsonValues()` record: every entry value is EITHER a
  * lazily loaded {@link JsonSource} whose resolved content is the (loosened, see
@@ -6446,21 +6461,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     key: "executeSerialize",
     value: function executeSerialize() {
       var _this$renderInput, _this$keySchema, _this$currentRouter, _this$customValidateF, _this$externalLabel;
-      var result = {
+      var result = _objectSpread2(_objectSpread2({
         type: "record",
         render: (_this$renderInput = this.renderInput) !== null && _this$renderInput !== void 0 ? _this$renderInput : undefined,
         item: this.item["executeSerialize"](),
         key: (_this$keySchema = this.keySchema) === null || _this$keySchema === void 0 ? void 0 : _this$keySchema["executeSerialize"](),
         opt: this.opt,
         preview: this.previewInput ? true : undefined,
-        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId(),
+        router: (_this$currentRouter = this.currentRouter) === null || _this$currentRouter === void 0 ? void 0 : _this$currentRouter.getRouterId()
+      }, routerSchemes(this.currentRouter)), {}, {
         customValidate: this.customValidateFunctions && ((_this$customValidateF = this.customValidateFunctions) === null || _this$customValidateF === void 0 ? void 0 : _this$customValidateF.length) > 0,
         jsonValues: this.isJsonValues ? true : undefined,
         external: (_this$externalLabel = this.externalLabel) !== null && _this$externalLabel !== void 0 ? _this$externalLabel : undefined,
         readonly: this.isReadonly,
         hidden: this.isHidden,
         description: this.description
-      };
+      });
       if (this.mediaOptions) {
         result.mediaType = this.mediaOptions.type;
         result.accept = this.mediaOptions.accept;
@@ -8740,7 +8756,8 @@ function settings() {
       }).nullable().describe("The project's own mark, shown where Val's is in the Studio. A square-ish mark rather than a wordmark: the slot is 32px wide.")
     }),
     studio: new SettingsSchema({
-      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it.")
+      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it."),
+      commitMessage: enumSchema("automatic", "required").nullable().describe("Whether publishing asks for a commit message. Unset is the same as 'automatic': Publish publishes straight away, with a message the AI writes (or one listing what changed). 'required' asks every time, and will not publish an empty one.")
     }),
     locales: new SettingsSchema({
       // Nullable because the source type is, and because the Studio writes
@@ -10912,7 +10929,7 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
   }, {
     key: "executeValidate",
     value: function executeValidate(path, src) {
-      var _this$options, _this$options2, _this$options3, _this$options4;
+      var _this$options, _this$options2, _this$options3, _this$options4, _this$options5, _this$options6;
       var errors = this.executeCustomValidateFunctions(src, this.customValidateFunctions, {
         path: path
       });
@@ -10926,7 +10943,31 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
         });
         return _defineProperty({}, path, errors);
       }
-      if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.from && (_this$options2 = this.options) !== null && _this$options2 !== void 0 && _this$options2.to) {
+      // The bounds below are compared as strings, which only orders days when
+      // every side is a real `YYYY-MM-DD`: "19f81-12-30" sorts between
+      // "1900-01-01" and "2024-01-01" and would pass them.
+      if (!isCalendarDay(src)) {
+        errors.push({
+          message: "Value '".concat(src, "' is not a valid date (expected YYYY-MM-DD)"),
+          value: src
+        });
+        return _defineProperty({}, path, errors);
+      }
+      var bounds = [["From", (_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.from], ["To", (_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.to]];
+      for (var _i = 0, _bounds = bounds; _i < _bounds.length; _i++) {
+        var _bounds$_i = _slicedToArray(_bounds[_i], 2),
+          name = _bounds$_i[0],
+          bound = _bounds$_i[1];
+        if (bound !== undefined && !isCalendarDay(bound)) {
+          errors.push({
+            message: "".concat(name, " date '").concat(bound, "' is not a valid date (expected YYYY-MM-DD)"),
+            value: src,
+            typeError: true
+          });
+          return _defineProperty({}, path, errors);
+        }
+      }
+      if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from && (_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
         if (this.options.from > this.options.to) {
           errors.push({
             message: "From date ".concat(this.options.from, " is after to date ").concat(this.options.to),
@@ -10939,14 +10980,14 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
             value: src
           });
         }
-      } else if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from) {
+      } else if ((_this$options5 = this.options) !== null && _this$options5 !== void 0 && _this$options5.from) {
         if (src < this.options.from) {
           errors.push({
             message: "Date is before the minimum date ".concat(this.options.from),
             value: src
           });
         }
-      } else if ((_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
+      } else if ((_this$options6 = this.options) !== null && _this$options6 !== void 0 && _this$options6.to) {
         if (src > this.options.to) {
           errors.push({
             message: "Date is after the maximum date ".concat(this.options.to),
@@ -11116,6 +11157,27 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
     }
   }]);
 }(Schema);
+var CALENDAR_DAY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Whether `value` is a `YYYY-MM-DD` day that exists on the calendar — so
+ * "2023-02-29" and "2024-13-01" are not, even though they have the shape.
+ */
+function isCalendarDay(value) {
+  var match = CALENDAR_DAY.exec(value);
+  if (!match) {
+    return false;
+  }
+  var year = Number(match[1]);
+  var month = Number(match[2]);
+  var day = Number(match[3]);
+  // Out-of-range fields roll over (Feb 30 -> Mar 2) instead of failing, so a
+  // day is real only if it survives the round trip. setUTCFullYear, not
+  // Date.UTC: the latter maps years 0-99 to 1900-1999.
+  var date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
 var date = function date(options) {
   return new DateSchema(options);
 };
@@ -13765,35 +13827,165 @@ function isInlineRender(schema) {
   return false;
 }
 
-var externalPageRouter = {
-  getRouterId: function getRouterId() {
-    return "external-url-router";
-  },
-  validate: function validate(_moduleFilePath, urlPaths) {
-    var errors = [];
-    var _iterator = _createForOfIteratorHelper(urlPaths),
-      _step;
-    try {
-      for (_iterator.s(); !(_step = _iterator.n()).done;) {
-        var urlPath = _step.value;
-        if (!(urlPath.startsWith("https://") || urlPath.startsWith("http://"))) {
-          errors.push({
-            error: {
-              message: "URL path \"".concat(urlPath, "\" does not start with \"https://\" or \"http://\""),
-              expectedPath: null,
-              urlPath: urlPath
-            }
-          });
+/**
+ * Which URL schemes an external page key may use.
+ *
+ * External pages are the URLs a site links OUT to, and a link is not only a web
+ * page: `mailto:` on a contact page and `tel:` on a phone number are the same
+ * kind of thing to whoever maintains the list, and were refused outright.
+ *
+ * So the default is a deny list rather than an allow list — anything with a
+ * scheme, except the handful that are not links at all. Listing every scheme
+ * worth linking to is a list that is wrong the moment someone wants
+ * `whatsapp:` or `msteams:`, and being wrong that way means an editor cannot
+ * store a URL their site genuinely uses.
+ *
+ * A project that wants to be stricter says so:
+ *
+ * ```ts
+ * s.router(externalPageRouter({ schemes: ["https", "mailto"] }), item)
+ * ```
+ */
+
+/**
+ * The schemes that are refused however wide the policy is.
+ *
+ * Not a style preference. An external page key ends up in an `href` in the
+ * consuming site's own markup, so `javascript:` there is stored XSS on that
+ * site, and `data:` is the same trick wearing a document. `vbscript:` is the
+ * historical spelling of the first. `file:` and `blob:` address the visitor's
+ * own machine rather than anywhere on the internet.
+ *
+ * These stay refused even when a project lists them in `schemes`: a config
+ * option is not a good enough reason to let content inject script into the
+ * page that renders it.
+ */
+var UNSAFE_URL_SCHEMES = ["javascript", "data", "vbscript", "file", "blob"];
+/** The scheme of a URL, lowercased and without the colon, or null. */
+function schemeOf(url) {
+  var match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(url.trim());
+  return match === null ? null : match[1].toLowerCase();
+}
+/** `null` when the URL's scheme is acceptable under `policy`. */
+function rejectScheme(url) {
+  var policy = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var scheme = schemeOf(url);
+  if (scheme === null) {
+    return {
+      reason: "no-scheme"
+    };
+  }
+  if (UNSAFE_URL_SCHEMES.includes(scheme)) {
+    return {
+      reason: "unsafe",
+      scheme: scheme
+    };
+  }
+  if (policy.schemes !== undefined) {
+    var allowed = policy.schemes.map(function (s) {
+      return s.toLowerCase();
+    });
+    if (!allowed.includes(scheme)) {
+      return {
+        reason: "not-allowed",
+        scheme: scheme,
+        allowed: policy.schemes
+      };
+    }
+  }
+  return null;
+}
+
+/** What to tell whoever wrote the key. */
+function describeSchemeRejection(rejection) {
+  switch (rejection.reason) {
+    case "no-scheme":
+      return "Must start with a scheme, like https:// or mailto:.";
+    case "unsafe":
+      return "\"".concat(rejection.scheme, ":\" cannot be used in a link: it runs code or reads the visitor's own machine rather than pointing at somewhere on the internet.");
+    case "not-allowed":
+      return "\"".concat(rejection.scheme, ":\" is not one of the schemes this router allows (").concat(rejection.allowed.join(", "), ").");
+  }
+}
+
+/**
+ * Whether a link check can open this URL.
+ *
+ * Separate from whether it is ALLOWED, and the two are not the same question:
+ * `mailto:` is a perfectly good external page and there is no request to make
+ * of it. A URL that cannot be opened is reported as not checked, never as
+ * broken.
+ */
+function isCheckableScheme(url) {
+  var scheme = schemeOf(url);
+  return scheme === "http" || scheme === "https";
+}
+
+/**
+ * The router whose keys are URLs to somewhere else.
+ *
+ * Used directly for the wide default, or called to narrow it:
+ *
+ * ```ts
+ * s.router(externalPageRouter, item)                          // anything safe
+ * s.router(externalPageRouter({ schemes: ["https"] }), item)  // https only
+ * ```
+ *
+ * Its one rule is that a key has a scheme, and that the scheme is not one of
+ * the handful that are not links at all - see `externalUrlSchemes.ts`. That
+ * rule was WRITTEN here from the start and never enforced: the errors were
+ * collected into a list and then `return []` threw them away, so every key was
+ * accepted however it was spelled.
+ *
+ * `expectedPath` is null because there is nothing to suggest: a key that is
+ * not a URL could have been meant as any URL, and guessing `https://` in front
+ * of it would propose a different site as often as the right one.
+ */
+var externalPageRouter = Object.assign(function (policy) {
+  return createExternalPageRouter(policy);
+}, createExternalPageRouter());
+
+/**
+ * Callable AND a router, so `externalPageRouter` keeps working unchanged
+ * where nobody needs to configure it - which is almost everywhere.
+ */
+
+function createExternalPageRouter() {
+  var policy = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  return {
+    getRouterId: function getRouterId() {
+      return "external-url-router";
+    },
+    getUrlSchemePolicy: function getUrlSchemePolicy() {
+      return policy;
+    },
+    validate: function validate(_moduleFilePath, urlPaths) {
+      var errors = [];
+      var _iterator = _createForOfIteratorHelper(urlPaths),
+        _step;
+      try {
+        for (_iterator.s(); !(_step = _iterator.n()).done;) {
+          var urlPath = _step.value;
+          var rejection = rejectScheme(urlPath, policy);
+          if (rejection !== null) {
+            errors.push({
+              error: {
+                message: "URL \"".concat(urlPath, "\" cannot be used here. ").concat(describeSchemeRejection(rejection)),
+                expectedPath: null,
+                urlPath: urlPath
+              }
+            });
+          }
         }
+      } catch (err) {
+        _iterator.e(err);
+      } finally {
+        _iterator.f();
       }
-    } catch (err) {
-      _iterator.e(err);
-    } finally {
-      _iterator.f();
+      return errors;
     }
-    return [];
-  }
-};
+  };
+}
 // Helper function to validate a URL path against a route pattern
 function validateUrlAgainstPattern(urlPath, routePattern) {
   // Remove leading slash and split URL path
@@ -14193,7 +14385,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.136.8",
+	version: "0.138.0",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14307,6 +14499,11 @@ var Internal = {
   nextAppRouter: nextAppRouter,
   tanstackRouter: tanstackRouter,
   externalPageRouter: externalPageRouter,
+  describeSchemeRejection: describeSchemeRejection,
+  isCheckableScheme: isCheckableScheme,
+  rejectScheme: rejectScheme,
+  schemeOf: schemeOf,
+  UNSAFE_URL_SCHEMES: UNSAFE_URL_SCHEMES,
   color: {
     parseColor: parseColor,
     formatColor: formatColor,
@@ -14399,4 +14596,4 @@ function tryJsonParse(str) {
   }
 }
 
-export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };
+export { DEFAULT_COLOR_FORMAT as $, ArraySchema as A, BooleanSchema as B, isRootModuleFilePath as C, DEFAULT_CONTENT_HOST as D, resolveSettingsModule as E, FATAL_ERROR_TYPES as F, GenericSelector as G, localeTagError as H, Internal as I, localeOfValue as J, declaredKeySetOf as K, LocaleSchema as L, ModuleFilePathSep as M, NumberSchema as N, ObjectSchema as O, PatchError as P, missingDeclaredKeys as Q, RecordSchema as R, Schema as S, THEME_LOGO_DIRECTORY as T, discriminatedUnionBranchOf as U, VAL_EXTENSION as V, ColorSchema as W, CodeSchema as X, CODE_LANGUAGES as Y, COLOR_FORMATS as Z, _typeof as _, _slicedToArray as a, DateTimeSchema as a0, KeyOfSchema as a1, ValViewSchema as a2, isValViewSource as a3, RouteSchema as a4, RichTextSchema as a5, DiscriminatedUnionSchema as a6, EnumSchema as a7, LiteralSchema as a8, deserializeSchema as a9, previewScope as aa, isInlineRender as ab, parseNextJsRoutePattern as ac, parseTanStackRoutePattern as ad, tanStackSegmentsOfRoutePath as ae, validateUrlAgainstPattern as af, getSourcePathFromRoute as ag, isPageRouter as ah, describeSchemeRejection as ai, isCheckableScheme as aj, rejectScheme as ak, schemeOf as al, UNSAFE_URL_SCHEMES as am, _createClass as b, _classCallCheck as c, _toConsumableArray as d, DEFAULT_APP_HOST as e, DEFAULT_STATIC_HOST as f, extractValModules as g, computeValModuleShas as h, initVal as i, computeSourcesSha as j, hasRemoteFileSchema as k, hasMediaSchema as l, modules as m, DEFAULT_VAL_REMOTE_HOST as n, derefPatch as o, StringSchema as p, ImageSchema as q, FileSchema as r, splitModuleFilePathAndModulePath as s, DateSchema as t, SettingsSchema as u, ASSISTANT_SETTINGS_MAX_LENGTH as v, THEME_RADIUS_STEPS as w, THEME_RADIUS_LENGTHS as x, assistantAvailability as y, SETTINGS_MODULE_CONVENTION as z };