@valbuild/core 0.137.0 → 0.138.2

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @valbuild/core
 
+## 0.138.2
+
+### Patch Changes
+
+- [#760](https://github.com/valbuild/val/pull/760) [`cf3bbc8`](https://github.com/valbuild/val/commit/cf3bbc8fc89ff349aac5ab101d0b4f28164583e6) Thanks [@freekh](https://github.com/freekh)! - Files and images can now be renamed in the Studio, for local files and remote ones.
+
+  - **Rename a file in a gallery** from its properties: click the pencil next to the file name. Every field that uses the file is updated to the new name in the same step, including images inside rich text, and the dialog says how many places will change before you save.
+  - **Rename the file of an image or file field** with the new **Rename** button. A field that picks its file from a gallery sends you to the gallery instead, because other fields may use the same file.
+  - **You choose the name, Val keeps the rest.** The short hash at the end of the name (`_a1b2c`) and the file extension stay as they are, so two different files can never end up with the same name. The name is cleaned up the same way an upload's is: lower case, and characters that do not belong in a URL are dropped.
+  - **Renaming a local file moves it.** The file is saved under the new name and the old file is deleted when you publish, so nothing is left behind to clean up. If another field uses the same file without going through a gallery, pick the file again in that field.
+  - **Renaming a remote file is instant.** Remote files are stored by their content, so a published remote file only gets a new address and nothing is uploaded again.
+  - **Gallery images used in rich text now count as references.** A gallery file used only inside rich text could be deleted, which left the text pointing at nothing. It is now listed under the file's references and blocks the delete like any other use.
+
+## 0.138.0
+
+### Minor Changes
+
+- [#751](https://github.com/valbuild/val/pull/751) [`5876fe0`](https://github.com/valbuild/val/commit/5876fe075fdee1f76f1cdaa2488ac52c58c894a8) Thanks [@freekh](https://github.com/freekh)! - Publishing no longer asks for a commit message by default.
+
+  - **Publish publishes.** In HTTP mode, pressing Publish goes straight to publishing, just as Save already did in local development. Where an AI model is available it writes the commit message (the button reads "Preparing" meanwhile, for up to 15 seconds). Otherwise the message is built from what changed, and names the exact path when a single field changed, e.g. `Update hero.title in /content/home.val.ts`. When several things changed, the message body lists the changed modules and their fields: up to six modules and five fields each, then how many more.
+  - **`studio.commitMessage: "required"`** in `s.settings()` brings the box back, redesigned. Editors can turn it on from the Studio too: Settings → Studio → "Ask for a commit message". It opens empty rather than pre-filled, so a message cannot be published unread. The AI fills it in when it can, and Publish stays disabled until there is a message. Nothing publishes on its own: the countdown that published while the AI was still writing is gone.
+  - **The overlay menu stays open** while the commit message popover is open, or a publish is under way. Before, moving onto the popover collapsed the menu and the popover moved with it.
+
+### Patch Changes
+
+- [#752](https://github.com/valbuild/val/pull/752) [`57af895`](https://github.com/valbuild/val/commit/57af8959cc46519a405b1ed7441623f8bf2e6d27) Thanks [@freekh](https://github.com/freekh)! - `s.date()` now reports a value that is not a real `YYYY-MM-DD` day as a validation error. It used to check only `from` / `to`, and compared those as plain strings, so a typo like `"19f81-12-30"` passed a `.from("1900-01-01").to("2024-01-01")` range without a word. Impossible days such as `"2023-02-29"` are rejected too, and a `from` / `to` bound that is not a valid date is reported as a schema error.
+
+  The Studio's date field no longer shows a year below 100 (`"0050-01-01"`) as empty: it was read as 1950 and discarded.
+
 ## 0.137.0
 
 ### Patch Changes

package/dist/declarations/src/index.d.ts

@@ -39,6 +39,7 @@ import { isJson, getJsonImport, resolveJsonValues } from "./source/json.js";
 import { isExternal, hasInlineExternalEntries } from "./source/external.js";
 import { createExternalFileRef, splitExternalFileRef, isExternalFileRef } from "./source/externalRef.js";
 import { createRemoteRef } from "./source/remote.js";
+import { createRenamedFilename } from "./source/filename.js";
 import { getValidationBasis, getValidationHash } from "./remote/validationBasis.js";
 import { getFileHash, hashToRemoteFileHash } from "./remote/fileHash.js";
 import { splitRemoteRef } from "./remote/splitRemoteRef.js";
@@ -54,7 +55,7 @@ export { type SerializedImageSchema, ImageSchema } from "./schema/image.js";
 export { type SerializedFileSchema, FileSchema } from "./schema/file.js";
 export { type SerializedDateSchema, DateSchema } from "./schema/date.js";
 export { type SerializedSettingsSchema, SettingsSchema, } from "./schema/settings.js";
-export { type SettingsSource, type AssistantSettingsSource, type LocalesSettingsSource, type AssistantAvailability, type ThemeSettingsSource, type StudioSettingsSource, type ThemeRadius, ASSISTANT_SETTINGS_MAX_LENGTH, THEME_LOGO_DIRECTORY, THEME_RADIUS_STEPS, THEME_RADIUS_LENGTHS, assistantAvailability, } from "./source/settings.js";
+export { type SettingsSource, type AssistantSettingsSource, type LocalesSettingsSource, type AssistantAvailability, type ThemeSettingsSource, type StudioSettingsSource, type StudioCommitMessageMode, type ThemeRadius, ASSISTANT_SETTINGS_MAX_LENGTH, THEME_LOGO_DIRECTORY, THEME_RADIUS_STEPS, THEME_RADIUS_LENGTHS, assistantAvailability, } from "./source/settings.js";
 export { type ResolvedSettingsModule, SETTINGS_MODULE_CONVENTION, isRootModuleFilePath, resolveSettingsModule, } from "./settingsModule.js";
 export { type Locale, localeTagError, localeOfValue } from "./locale.js";
 export { type SerializedLocaleSchema, LocaleSchema } from "./schema/locale.js";
@@ -233,5 +234,6 @@ declare const Internal: {
     VAL_STATE_COOKIE: "val_state";
     VAL_SESSION_COOKIE: "val_session";
     createFilename: (data: string | null, filename: string | null, metadata: FileMetadata | ImageMetadata | undefined, sha256: string) => string | null;
+    createRenamedFilename: typeof createRenamedFilename;
 };
 export { Internal };

package/dist/declarations/src/source/filename.d.ts

@@ -0,0 +1,37 @@
+/**
+ * How Val names a media file: a cleaned-up base name, the first five hex of the
+ * content's SHA-256, and the extension — `hero-mountains_a1b2c.jpg`.
+ *
+ * Two producers need this and must agree: an upload (`createFilename`, which
+ * has the bytes) and a rename (`createRenamedFilename`, which keeps the bytes
+ * and only changes what is in front of the hash). If they disagreed, renaming a
+ * file to the name it was uploaded with would give it a different name.
+ */
+/** The `_a1b2c` a Val filename ends in, before the extension. */
+export declare const FILENAME_HASH_SUFFIX_LENGTH = 5;
+/**
+ * The part of a filename a person chose, made safe for a URL path.
+ *
+ * Lower case, with everything `encodeURIComponent` would escape dropped rather
+ * than escaped — a path segment that needs decoding is a path segment that gets
+ * decoded twice somewhere. Can return the empty string, for a name made only of
+ * such characters; a caller that needs a name has to refuse that.
+ */
+export declare function sanitizeFilenameBase(base: string): string;
+/**
+ * `base` with a trailing `_<hashPrefix>` removed, so a name that already carries
+ * the hash does not get it twice (`photo_a1b2c` + `a1b2c` → `photo_a1b2c`, not
+ * `photo_a1b2c_a1b2c`).
+ */
+export declare function stripHashSuffix(base: string, hashPrefix: string): string;
+/**
+ * The name a file gets when it is renamed to `newBase`.
+ *
+ * The hash and the extension are not the editor's to change: the hash keeps two
+ * different files from ever sharing a name, and the extension is part of a
+ * remote file's validation hash and of how its bytes are served. So they are
+ * passed in, and only the base comes from the person.
+ *
+ * Returns `null` when nothing usable is left of `newBase` after cleaning it.
+ */
+export declare function createRenamedFilename(newBase: string, sha256: string, ext: string): string | null;

package/dist/declarations/src/source/settings.d.ts

@@ -52,7 +52,21 @@ export type StudioSettingsSource = {
      * that browser and is not here.
      */
     tour?: boolean | null;
+    /**
+     * Whether publishing asks for a commit message.
+     *
+     * Unset means `"automatic"`: pressing Publish publishes, with a summary the
+     * AI writes where one is available and one assembled from what changed where
+     * it is not. Nobody is shown a box. `"required"` opens the box on every
+     * publish and will not publish it empty — the AI still fills it in, where
+     * there is one, but a person has to read it and press Publish.
+     *
+     * Only the HTTP (remote) mode commits, so this changes nothing in local
+     * development, where Save writes to disk.
+     */
+    commitMessage?: StudioCommitMessageMode | null;
 };
+export type StudioCommitMessageMode = "automatic" | "required";
 /**
  * How the Studio looks in this project.
  *

package/dist/{index-42ab6700.esm.js → index-36b5e0cb.esm.js}

@@ -8756,7 +8756,8 @@ function settings() {
       }).nullable().describe("The project's own mark, shown where Val's is in the Studio. A square-ish mark rather than a wordmark: the slot is 32px wide.")
     }),
     studio: new SettingsSchema({
-      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it.")
+      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it."),
+      commitMessage: enumSchema("automatic", "required").nullable().describe("Whether publishing asks for a commit message. Unset is the same as 'automatic': Publish publishes straight away, with a message the AI writes (or one listing what changed). 'required' asks every time, and will not publish an empty one.")
     }),
     locales: new SettingsSchema({
       // Nullable because the source type is, and because the Studio writes
@@ -10928,7 +10929,7 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
   }, {
     key: "executeValidate",
     value: function executeValidate(path, src) {
-      var _this$options, _this$options2, _this$options3, _this$options4;
+      var _this$options, _this$options2, _this$options3, _this$options4, _this$options5, _this$options6;
       var errors = this.executeCustomValidateFunctions(src, this.customValidateFunctions, {
         path: path
       });
@@ -10942,7 +10943,31 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
         });
         return _defineProperty({}, path, errors);
       }
-      if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.from && (_this$options2 = this.options) !== null && _this$options2 !== void 0 && _this$options2.to) {
+      // The bounds below are compared as strings, which only orders days when
+      // every side is a real `YYYY-MM-DD`: "19f81-12-30" sorts between
+      // "1900-01-01" and "2024-01-01" and would pass them.
+      if (!isCalendarDay(src)) {
+        errors.push({
+          message: "Value '".concat(src, "' is not a valid date (expected YYYY-MM-DD)"),
+          value: src
+        });
+        return _defineProperty({}, path, errors);
+      }
+      var bounds = [["From", (_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.from], ["To", (_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.to]];
+      for (var _i = 0, _bounds = bounds; _i < _bounds.length; _i++) {
+        var _bounds$_i = _slicedToArray(_bounds[_i], 2),
+          name = _bounds$_i[0],
+          bound = _bounds$_i[1];
+        if (bound !== undefined && !isCalendarDay(bound)) {
+          errors.push({
+            message: "".concat(name, " date '").concat(bound, "' is not a valid date (expected YYYY-MM-DD)"),
+            value: src,
+            typeError: true
+          });
+          return _defineProperty({}, path, errors);
+        }
+      }
+      if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from && (_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
         if (this.options.from > this.options.to) {
           errors.push({
             message: "From date ".concat(this.options.from, " is after to date ").concat(this.options.to),
@@ -10955,14 +10980,14 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
             value: src
           });
         }
-      } else if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from) {
+      } else if ((_this$options5 = this.options) !== null && _this$options5 !== void 0 && _this$options5.from) {
         if (src < this.options.from) {
           errors.push({
             message: "Date is before the minimum date ".concat(this.options.from),
             value: src
           });
         }
-      } else if ((_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
+      } else if ((_this$options6 = this.options) !== null && _this$options6 !== void 0 && _this$options6.to) {
         if (src > this.options.to) {
           errors.push({
             message: "Date is after the maximum date ".concat(this.options.to),
@@ -11132,6 +11157,27 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
     }
   }]);
 }(Schema);
+var CALENDAR_DAY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Whether `value` is a `YYYY-MM-DD` day that exists on the calendar — so
+ * "2023-02-29" and "2024-13-01" are not, even though they have the shape.
+ */
+function isCalendarDay(value) {
+  var match = CALENDAR_DAY.exec(value);
+  if (!match) {
+    return false;
+  }
+  var year = Number(match[1]);
+  var month = Number(match[2]);
+  var day = Number(match[3]);
+  // Out-of-range fields roll over (Feb 30 -> Mar 2) instead of failing, so a
+  // day is real only if it survives the round trip. setUTCFullYear, not
+  // Date.UTC: the latter maps years 0-99 to 1900-1999.
+  var date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
 var date = function date(options) {
   return new DateSchema(options);
 };
@@ -13311,6 +13357,63 @@ function createRemoteRef(remoteHost, _ref) {
   return "".concat(remoteHost, "/file/p/").concat(publicProjectId, "/b/").concat(bucket, "/v/").concat(coreVersion, "/h/").concat(validationHash, "/f/").concat(fileHash, "/p/").concat(filePath);
 }
 
+/**
+ * How Val names a media file: a cleaned-up base name, the first five hex of the
+ * content's SHA-256, and the extension — `hero-mountains_a1b2c.jpg`.
+ *
+ * Two producers need this and must agree: an upload (`createFilename`, which
+ * has the bytes) and a rename (`createRenamedFilename`, which keeps the bytes
+ * and only changes what is in front of the hash). If they disagreed, renaming a
+ * file to the name it was uploaded with would give it a different name.
+ */
+
+/** The `_a1b2c` a Val filename ends in, before the extension. */
+var FILENAME_HASH_SUFFIX_LENGTH = 5;
+
+/**
+ * The part of a filename a person chose, made safe for a URL path.
+ *
+ * Lower case, with everything `encodeURIComponent` would escape dropped rather
+ * than escaped — a path segment that needs decoding is a path segment that gets
+ * decoded twice somewhere. Can return the empty string, for a name made only of
+ * such characters; a caller that needs a name has to refuse that.
+ */
+function sanitizeFilenameBase(base) {
+  return encodeURIComponent(base).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+}
+
+/**
+ * `base` with a trailing `_<hashPrefix>` removed, so a name that already carries
+ * the hash does not get it twice (`photo_a1b2c` + `a1b2c` → `photo_a1b2c`, not
+ * `photo_a1b2c_a1b2c`).
+ */
+function stripHashSuffix(base, hashPrefix) {
+  var pos = base.lastIndexOf("_");
+  if (pos !== -1 && base.slice(pos + 1) === hashPrefix) {
+    return base.slice(0, pos);
+  }
+  return base;
+}
+
+/**
+ * The name a file gets when it is renamed to `newBase`.
+ *
+ * The hash and the extension are not the editor's to change: the hash keeps two
+ * different files from ever sharing a name, and the extension is part of a
+ * remote file's validation hash and of how its bytes are served. So they are
+ * passed in, and only the base comes from the person.
+ *
+ * Returns `null` when nothing usable is left of `newBase` after cleaning it.
+ */
+function createRenamedFilename(newBase, sha256, ext) {
+  var hashPrefix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
+  var cleaned = sanitizeFilenameBase(stripHashSuffix(newBase.trim(), hashPrefix));
+  if (cleaned === "") {
+    return null;
+  }
+  return ext === "" ? "".concat(cleaned, "_").concat(hashPrefix) : "".concat(cleaned, "_").concat(hashPrefix, ".").concat(ext);
+}
+
 /**
  * The validation basis is used in remote refs to determine if the remote content needs to be re-validated.
  *
@@ -14339,7 +14442,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.137.0",
+	version: "0.138.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14526,21 +14629,17 @@ var Internal = {
     if (!data) {
       return filename;
     }
-    var shaSuffix = sha256.slice(0, 5);
+    var shaSuffix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
     var mimeType = (_Internal$getMimeType = Internal.getMimeType(data)) !== null && _Internal$getMimeType !== void 0 ? _Internal$getMimeType : "unknown";
     var newExt = (_Internal$mimeTypeToF = Internal.mimeTypeToFileExt(mimeType)) !== null && _Internal$mimeTypeToF !== void 0 ? _Internal$mimeTypeToF : "unknown"; // Don't trust the file extension
     if (filename) {
       var cleanFilename = filename.split(".").slice(0, -1).join(".") || filename; // remove extension if it exists
-      var maybeShaSuffixPos = cleanFilename.lastIndexOf("_");
-      var currentShaSuffix = cleanFilename.slice(maybeShaSuffixPos + 1, cleanFilename.length);
-      if (currentShaSuffix === shaSuffix) {
-        cleanFilename = cleanFilename.slice(0, maybeShaSuffixPos);
-      }
-      var escapedFilename = encodeURIComponent(cleanFilename).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+      var escapedFilename = sanitizeFilenameBase(stripHashSuffix(cleanFilename, shaSuffix));
       return "".concat(escapedFilename, "_").concat(shaSuffix, ".").concat(newExt);
     }
     return "".concat(sha256, ".").concat(newExt);
-  }
+  },
+  createRenamedFilename: createRenamedFilename
 };
 function tryJsonParse(str) {
   try {

package/dist/{index-481a7dcd.cjs.prod.js → index-87b5aa27.cjs.prod.js}

@@ -8758,7 +8758,8 @@ function settings() {
       }).nullable().describe("The project's own mark, shown where Val's is in the Studio. A square-ish mark rather than a wordmark: the slot is 32px wide.")
     }),
     studio: new SettingsSchema({
-      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it.")
+      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it."),
+      commitMessage: enumSchema("automatic", "required").nullable().describe("Whether publishing asks for a commit message. Unset is the same as 'automatic': Publish publishes straight away, with a message the AI writes (or one listing what changed). 'required' asks every time, and will not publish an empty one.")
     }),
     locales: new SettingsSchema({
       // Nullable because the source type is, and because the Studio writes
@@ -10930,7 +10931,7 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
   }, {
     key: "executeValidate",
     value: function executeValidate(path, src) {
-      var _this$options, _this$options2, _this$options3, _this$options4;
+      var _this$options, _this$options2, _this$options3, _this$options4, _this$options5, _this$options6;
       var errors = this.executeCustomValidateFunctions(src, this.customValidateFunctions, {
         path: path
       });
@@ -10944,7 +10945,31 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
         });
         return _defineProperty({}, path, errors);
       }
-      if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.from && (_this$options2 = this.options) !== null && _this$options2 !== void 0 && _this$options2.to) {
+      // The bounds below are compared as strings, which only orders days when
+      // every side is a real `YYYY-MM-DD`: "19f81-12-30" sorts between
+      // "1900-01-01" and "2024-01-01" and would pass them.
+      if (!isCalendarDay(src)) {
+        errors.push({
+          message: "Value '".concat(src, "' is not a valid date (expected YYYY-MM-DD)"),
+          value: src
+        });
+        return _defineProperty({}, path, errors);
+      }
+      var bounds = [["From", (_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.from], ["To", (_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.to]];
+      for (var _i = 0, _bounds = bounds; _i < _bounds.length; _i++) {
+        var _bounds$_i = _slicedToArray(_bounds[_i], 2),
+          name = _bounds$_i[0],
+          bound = _bounds$_i[1];
+        if (bound !== undefined && !isCalendarDay(bound)) {
+          errors.push({
+            message: "".concat(name, " date '").concat(bound, "' is not a valid date (expected YYYY-MM-DD)"),
+            value: src,
+            typeError: true
+          });
+          return _defineProperty({}, path, errors);
+        }
+      }
+      if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from && (_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
         if (this.options.from > this.options.to) {
           errors.push({
             message: "From date ".concat(this.options.from, " is after to date ").concat(this.options.to),
@@ -10957,14 +10982,14 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
             value: src
           });
         }
-      } else if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from) {
+      } else if ((_this$options5 = this.options) !== null && _this$options5 !== void 0 && _this$options5.from) {
         if (src < this.options.from) {
           errors.push({
             message: "Date is before the minimum date ".concat(this.options.from),
             value: src
           });
         }
-      } else if ((_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
+      } else if ((_this$options6 = this.options) !== null && _this$options6 !== void 0 && _this$options6.to) {
         if (src > this.options.to) {
           errors.push({
             message: "Date is after the maximum date ".concat(this.options.to),
@@ -11134,6 +11159,27 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
     }
   }]);
 }(Schema);
+var CALENDAR_DAY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Whether `value` is a `YYYY-MM-DD` day that exists on the calendar — so
+ * "2023-02-29" and "2024-13-01" are not, even though they have the shape.
+ */
+function isCalendarDay(value) {
+  var match = CALENDAR_DAY.exec(value);
+  if (!match) {
+    return false;
+  }
+  var year = Number(match[1]);
+  var month = Number(match[2]);
+  var day = Number(match[3]);
+  // Out-of-range fields roll over (Feb 30 -> Mar 2) instead of failing, so a
+  // day is real only if it survives the round trip. setUTCFullYear, not
+  // Date.UTC: the latter maps years 0-99 to 1900-1999.
+  var date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
 var date = function date(options) {
   return new DateSchema(options);
 };
@@ -13313,6 +13359,63 @@ function createRemoteRef(remoteHost, _ref) {
   return "".concat(remoteHost, "/file/p/").concat(publicProjectId, "/b/").concat(bucket, "/v/").concat(coreVersion, "/h/").concat(validationHash, "/f/").concat(fileHash, "/p/").concat(filePath);
 }
 
+/**
+ * How Val names a media file: a cleaned-up base name, the first five hex of the
+ * content's SHA-256, and the extension — `hero-mountains_a1b2c.jpg`.
+ *
+ * Two producers need this and must agree: an upload (`createFilename`, which
+ * has the bytes) and a rename (`createRenamedFilename`, which keeps the bytes
+ * and only changes what is in front of the hash). If they disagreed, renaming a
+ * file to the name it was uploaded with would give it a different name.
+ */
+
+/** The `_a1b2c` a Val filename ends in, before the extension. */
+var FILENAME_HASH_SUFFIX_LENGTH = 5;
+
+/**
+ * The part of a filename a person chose, made safe for a URL path.
+ *
+ * Lower case, with everything `encodeURIComponent` would escape dropped rather
+ * than escaped — a path segment that needs decoding is a path segment that gets
+ * decoded twice somewhere. Can return the empty string, for a name made only of
+ * such characters; a caller that needs a name has to refuse that.
+ */
+function sanitizeFilenameBase(base) {
+  return encodeURIComponent(base).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+}
+
+/**
+ * `base` with a trailing `_<hashPrefix>` removed, so a name that already carries
+ * the hash does not get it twice (`photo_a1b2c` + `a1b2c` → `photo_a1b2c`, not
+ * `photo_a1b2c_a1b2c`).
+ */
+function stripHashSuffix(base, hashPrefix) {
+  var pos = base.lastIndexOf("_");
+  if (pos !== -1 && base.slice(pos + 1) === hashPrefix) {
+    return base.slice(0, pos);
+  }
+  return base;
+}
+
+/**
+ * The name a file gets when it is renamed to `newBase`.
+ *
+ * The hash and the extension are not the editor's to change: the hash keeps two
+ * different files from ever sharing a name, and the extension is part of a
+ * remote file's validation hash and of how its bytes are served. So they are
+ * passed in, and only the base comes from the person.
+ *
+ * Returns `null` when nothing usable is left of `newBase` after cleaning it.
+ */
+function createRenamedFilename(newBase, sha256, ext) {
+  var hashPrefix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
+  var cleaned = sanitizeFilenameBase(stripHashSuffix(newBase.trim(), hashPrefix));
+  if (cleaned === "") {
+    return null;
+  }
+  return ext === "" ? "".concat(cleaned, "_").concat(hashPrefix) : "".concat(cleaned, "_").concat(hashPrefix, ".").concat(ext);
+}
+
 /**
  * The validation basis is used in remote refs to determine if the remote content needs to be re-validated.
  *
@@ -14341,7 +14444,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.137.0",
+	version: "0.138.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14528,21 +14631,17 @@ var Internal = {
     if (!data) {
       return filename;
     }
-    var shaSuffix = sha256.slice(0, 5);
+    var shaSuffix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
     var mimeType = (_Internal$getMimeType = Internal.getMimeType(data)) !== null && _Internal$getMimeType !== void 0 ? _Internal$getMimeType : "unknown";
     var newExt = (_Internal$mimeTypeToF = Internal.mimeTypeToFileExt(mimeType)) !== null && _Internal$mimeTypeToF !== void 0 ? _Internal$mimeTypeToF : "unknown"; // Don't trust the file extension
     if (filename) {
       var cleanFilename = filename.split(".").slice(0, -1).join(".") || filename; // remove extension if it exists
-      var maybeShaSuffixPos = cleanFilename.lastIndexOf("_");
-      var currentShaSuffix = cleanFilename.slice(maybeShaSuffixPos + 1, cleanFilename.length);
-      if (currentShaSuffix === shaSuffix) {
-        cleanFilename = cleanFilename.slice(0, maybeShaSuffixPos);
-      }
-      var escapedFilename = encodeURIComponent(cleanFilename).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+      var escapedFilename = sanitizeFilenameBase(stripHashSuffix(cleanFilename, shaSuffix));
       return "".concat(escapedFilename, "_").concat(shaSuffix, ".").concat(newExt);
     }
     return "".concat(sha256, ".").concat(newExt);
-  }
+  },
+  createRenamedFilename: createRenamedFilename
 };
 function tryJsonParse(str) {
   try {

package/dist/{index-fed897a2.cjs.dev.js → index-8e33ef62.cjs.dev.js}

@@ -8758,7 +8758,8 @@ function settings() {
       }).nullable().describe("The project's own mark, shown where Val's is in the Studio. A square-ish mark rather than a wordmark: the slot is 32px wide.")
     }),
     studio: new SettingsSchema({
-      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it.")
+      tour: _boolean().nullable().describe("Whether editors are offered the guided tour of the Studio. Unset means yes. Off hides the offer for everyone on this project — the tour stays in Quick actions for anyone who wants it."),
+      commitMessage: enumSchema("automatic", "required").nullable().describe("Whether publishing asks for a commit message. Unset is the same as 'automatic': Publish publishes straight away, with a message the AI writes (or one listing what changed). 'required' asks every time, and will not publish an empty one.")
     }),
     locales: new SettingsSchema({
       // Nullable because the source type is, and because the Studio writes
@@ -10930,7 +10931,7 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
   }, {
     key: "executeValidate",
     value: function executeValidate(path, src) {
-      var _this$options, _this$options2, _this$options3, _this$options4;
+      var _this$options, _this$options2, _this$options3, _this$options4, _this$options5, _this$options6;
       var errors = this.executeCustomValidateFunctions(src, this.customValidateFunctions, {
         path: path
       });
@@ -10944,7 +10945,31 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
         });
         return _defineProperty({}, path, errors);
       }
-      if ((_this$options = this.options) !== null && _this$options !== void 0 && _this$options.from && (_this$options2 = this.options) !== null && _this$options2 !== void 0 && _this$options2.to) {
+      // The bounds below are compared as strings, which only orders days when
+      // every side is a real `YYYY-MM-DD`: "19f81-12-30" sorts between
+      // "1900-01-01" and "2024-01-01" and would pass them.
+      if (!isCalendarDay(src)) {
+        errors.push({
+          message: "Value '".concat(src, "' is not a valid date (expected YYYY-MM-DD)"),
+          value: src
+        });
+        return _defineProperty({}, path, errors);
+      }
+      var bounds = [["From", (_this$options = this.options) === null || _this$options === void 0 ? void 0 : _this$options.from], ["To", (_this$options2 = this.options) === null || _this$options2 === void 0 ? void 0 : _this$options2.to]];
+      for (var _i = 0, _bounds = bounds; _i < _bounds.length; _i++) {
+        var _bounds$_i = _slicedToArray(_bounds[_i], 2),
+          name = _bounds$_i[0],
+          bound = _bounds$_i[1];
+        if (bound !== undefined && !isCalendarDay(bound)) {
+          errors.push({
+            message: "".concat(name, " date '").concat(bound, "' is not a valid date (expected YYYY-MM-DD)"),
+            value: src,
+            typeError: true
+          });
+          return _defineProperty({}, path, errors);
+        }
+      }
+      if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from && (_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
         if (this.options.from > this.options.to) {
           errors.push({
             message: "From date ".concat(this.options.from, " is after to date ").concat(this.options.to),
@@ -10957,14 +10982,14 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
             value: src
           });
         }
-      } else if ((_this$options3 = this.options) !== null && _this$options3 !== void 0 && _this$options3.from) {
+      } else if ((_this$options5 = this.options) !== null && _this$options5 !== void 0 && _this$options5.from) {
         if (src < this.options.from) {
           errors.push({
             message: "Date is before the minimum date ".concat(this.options.from),
             value: src
           });
         }
-      } else if ((_this$options4 = this.options) !== null && _this$options4 !== void 0 && _this$options4.to) {
+      } else if ((_this$options6 = this.options) !== null && _this$options6 !== void 0 && _this$options6.to) {
         if (src > this.options.to) {
           errors.push({
             message: "Date is after the maximum date ".concat(this.options.to),
@@ -11134,6 +11159,27 @@ var DateSchema = /*#__PURE__*/function (_Schema) {
     }
   }]);
 }(Schema);
+var CALENDAR_DAY = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Whether `value` is a `YYYY-MM-DD` day that exists on the calendar — so
+ * "2023-02-29" and "2024-13-01" are not, even though they have the shape.
+ */
+function isCalendarDay(value) {
+  var match = CALENDAR_DAY.exec(value);
+  if (!match) {
+    return false;
+  }
+  var year = Number(match[1]);
+  var month = Number(match[2]);
+  var day = Number(match[3]);
+  // Out-of-range fields roll over (Feb 30 -> Mar 2) instead of failing, so a
+  // day is real only if it survives the round trip. setUTCFullYear, not
+  // Date.UTC: the latter maps years 0-99 to 1900-1999.
+  var date = new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  return date.getUTCFullYear() === year && date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
 var date = function date(options) {
   return new DateSchema(options);
 };
@@ -13313,6 +13359,63 @@ function createRemoteRef(remoteHost, _ref) {
   return "".concat(remoteHost, "/file/p/").concat(publicProjectId, "/b/").concat(bucket, "/v/").concat(coreVersion, "/h/").concat(validationHash, "/f/").concat(fileHash, "/p/").concat(filePath);
 }
 
+/**
+ * How Val names a media file: a cleaned-up base name, the first five hex of the
+ * content's SHA-256, and the extension — `hero-mountains_a1b2c.jpg`.
+ *
+ * Two producers need this and must agree: an upload (`createFilename`, which
+ * has the bytes) and a rename (`createRenamedFilename`, which keeps the bytes
+ * and only changes what is in front of the hash). If they disagreed, renaming a
+ * file to the name it was uploaded with would give it a different name.
+ */
+
+/** The `_a1b2c` a Val filename ends in, before the extension. */
+var FILENAME_HASH_SUFFIX_LENGTH = 5;
+
+/**
+ * The part of a filename a person chose, made safe for a URL path.
+ *
+ * Lower case, with everything `encodeURIComponent` would escape dropped rather
+ * than escaped — a path segment that needs decoding is a path segment that gets
+ * decoded twice somewhere. Can return the empty string, for a name made only of
+ * such characters; a caller that needs a name has to refuse that.
+ */
+function sanitizeFilenameBase(base) {
+  return encodeURIComponent(base).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+}
+
+/**
+ * `base` with a trailing `_<hashPrefix>` removed, so a name that already carries
+ * the hash does not get it twice (`photo_a1b2c` + `a1b2c` → `photo_a1b2c`, not
+ * `photo_a1b2c_a1b2c`).
+ */
+function stripHashSuffix(base, hashPrefix) {
+  var pos = base.lastIndexOf("_");
+  if (pos !== -1 && base.slice(pos + 1) === hashPrefix) {
+    return base.slice(0, pos);
+  }
+  return base;
+}
+
+/**
+ * The name a file gets when it is renamed to `newBase`.
+ *
+ * The hash and the extension are not the editor's to change: the hash keeps two
+ * different files from ever sharing a name, and the extension is part of a
+ * remote file's validation hash and of how its bytes are served. So they are
+ * passed in, and only the base comes from the person.
+ *
+ * Returns `null` when nothing usable is left of `newBase` after cleaning it.
+ */
+function createRenamedFilename(newBase, sha256, ext) {
+  var hashPrefix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
+  var cleaned = sanitizeFilenameBase(stripHashSuffix(newBase.trim(), hashPrefix));
+  if (cleaned === "") {
+    return null;
+  }
+  return ext === "" ? "".concat(cleaned, "_").concat(hashPrefix) : "".concat(cleaned, "_").concat(hashPrefix, ".").concat(ext);
+}
+
 /**
  * The validation basis is used in remote refs to determine if the remote content needs to be re-validated.
  *
@@ -14341,7 +14444,7 @@ function isPageRouter(routerId) {
 
 var corePackageJson = {
 	name: "@valbuild/core",
-	version: "0.137.0",
+	version: "0.138.2",
 	"private": false,
 	description: "Val - supercharged hard-coded content",
 	repository: {
@@ -14528,21 +14631,17 @@ var Internal = {
     if (!data) {
       return filename;
     }
-    var shaSuffix = sha256.slice(0, 5);
+    var shaSuffix = sha256.slice(0, FILENAME_HASH_SUFFIX_LENGTH);
     var mimeType = (_Internal$getMimeType = Internal.getMimeType(data)) !== null && _Internal$getMimeType !== void 0 ? _Internal$getMimeType : "unknown";
     var newExt = (_Internal$mimeTypeToF = Internal.mimeTypeToFileExt(mimeType)) !== null && _Internal$mimeTypeToF !== void 0 ? _Internal$mimeTypeToF : "unknown"; // Don't trust the file extension
     if (filename) {
       var cleanFilename = filename.split(".").slice(0, -1).join(".") || filename; // remove extension if it exists
-      var maybeShaSuffixPos = cleanFilename.lastIndexOf("_");
-      var currentShaSuffix = cleanFilename.slice(maybeShaSuffixPos + 1, cleanFilename.length);
-      if (currentShaSuffix === shaSuffix) {
-        cleanFilename = cleanFilename.slice(0, maybeShaSuffixPos);
-      }
-      var escapedFilename = encodeURIComponent(cleanFilename).replace(/%[0-9A-Fa-f]{2}/g, "").toLowerCase();
+      var escapedFilename = sanitizeFilenameBase(stripHashSuffix(cleanFilename, shaSuffix));
       return "".concat(escapedFilename, "_").concat(shaSuffix, ".").concat(newExt);
     }
     return "".concat(sha256, ".").concat(newExt);
-  }
+  },
+  createRenamedFilename: createRenamedFilename
 };
 function tryJsonParse(str) {
   try {

package/dist/valbuild-core.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-fed897a2.cjs.dev.js');
+var dist_valbuildCore = require('./index-8e33ef62.cjs.dev.js');
 require('./result-bb1f436e.cjs.dev.js');
 
 

package/dist/valbuild-core.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-481a7dcd.cjs.prod.js');
+var dist_valbuildCore = require('./index-87b5aa27.cjs.prod.js');
 require('./result-787e35f6.cjs.prod.js');
 
 

package/dist/valbuild-core.esm.js

@@ -1,2 +1,2 @@
-export { v as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, Y as CODE_LANGUAGES, Z as COLOR_FORMATS, X as CodeSchema, W as ColorSchema, e as DEFAULT_APP_HOST, $ as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, n as DEFAULT_VAL_REMOTE_HOST, t as DateSchema, a0 as DateTimeSchema, a6 as DiscriminatedUnionSchema, a7 as EnumSchema, F as FATAL_ERROR_TYPES, r as FileSchema, G as GenericSelector, q as ImageSchema, I as Internal, a1 as KeyOfSchema, a8 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a5 as RichTextSchema, a4 as RouteSchema, z as SETTINGS_MODULE_CONVENTION, S as Schema, u as SettingsSchema, p as StringSchema, T as THEME_LOGO_DIRECTORY, x as THEME_RADIUS_LENGTHS, w as THEME_RADIUS_STEPS, am as UNSAFE_URL_SCHEMES, V as VAL_EXTENSION, a2 as ValViewSchema, y as assistantAvailability, j as computeSourcesSha, h as computeValModuleShas, K as declaredKeySetOf, o as derefPatch, ai as describeSchemeRejection, a9 as deserializeSchema, U as discriminatedUnionBranchOf, g as extractValModules, ag as getSourcePathFromRoute, l as hasMediaSchema, k as hasRemoteFileSchema, i as initVal, aj as isCheckableScheme, ab as isInlineRender, ah as isPageRouter, C as isRootModuleFilePath, a3 as isValViewSource, J as localeOfValue, H as localeTagError, Q as missingDeclaredKeys, m as modules, ac as parseNextJsRoutePattern, ad as parseTanStackRoutePattern, aa as previewScope, ak as rejectScheme, E as resolveSettingsModule, al as schemeOf, ae as tanStackSegmentsOfRoutePath, af as validateUrlAgainstPattern } from './index-42ab6700.esm.js';
+export { v as ASSISTANT_SETTINGS_MAX_LENGTH, A as ArraySchema, B as BooleanSchema, Y as CODE_LANGUAGES, Z as COLOR_FORMATS, X as CodeSchema, W as ColorSchema, e as DEFAULT_APP_HOST, $ as DEFAULT_COLOR_FORMAT, D as DEFAULT_CONTENT_HOST, f as DEFAULT_STATIC_HOST, n as DEFAULT_VAL_REMOTE_HOST, t as DateSchema, a0 as DateTimeSchema, a6 as DiscriminatedUnionSchema, a7 as EnumSchema, F as FATAL_ERROR_TYPES, r as FileSchema, G as GenericSelector, q as ImageSchema, I as Internal, a1 as KeyOfSchema, a8 as LiteralSchema, L as LocaleSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, a5 as RichTextSchema, a4 as RouteSchema, z as SETTINGS_MODULE_CONVENTION, S as Schema, u as SettingsSchema, p as StringSchema, T as THEME_LOGO_DIRECTORY, x as THEME_RADIUS_LENGTHS, w as THEME_RADIUS_STEPS, am as UNSAFE_URL_SCHEMES, V as VAL_EXTENSION, a2 as ValViewSchema, y as assistantAvailability, j as computeSourcesSha, h as computeValModuleShas, K as declaredKeySetOf, o as derefPatch, ai as describeSchemeRejection, a9 as deserializeSchema, U as discriminatedUnionBranchOf, g as extractValModules, ag as getSourcePathFromRoute, l as hasMediaSchema, k as hasRemoteFileSchema, i as initVal, aj as isCheckableScheme, ab as isInlineRender, ah as isPageRouter, C as isRootModuleFilePath, a3 as isValViewSource, J as localeOfValue, H as localeTagError, Q as missingDeclaredKeys, m as modules, ac as parseNextJsRoutePattern, ad as parseTanStackRoutePattern, aa as previewScope, ak as rejectScheme, E as resolveSettingsModule, al as schemeOf, ae as tanStackSegmentsOfRoutePath, af as validateUrlAgainstPattern } from './index-36b5e0cb.esm.js';
 import './result-daff1cae.esm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/core",
-  "version": "0.137.0",
+  "version": "0.138.2",
   "private": false,
   "description": "Val - supercharged hard-coded content",
   "repository": {

package/patch/dist/valbuild-core-patch.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-fed897a2.cjs.dev.js');
+var dist_valbuildCore = require('../../dist/index-8e33ef62.cjs.dev.js');
 var result = require('../../dist/result-bb1f436e.cjs.dev.js');
 var util = require('../../dist/util-b213092b.cjs.dev.js');
 

package/patch/dist/valbuild-core-patch.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-481a7dcd.cjs.prod.js');
+var dist_valbuildCore = require('../../dist/index-87b5aa27.cjs.prod.js');
 var result = require('../../dist/result-787e35f6.cjs.prod.js');
 var util = require('../../dist/util-030d8a1f.cjs.prod.js');
 

package/patch/dist/valbuild-core-patch.esm.js

@@ -1,5 +1,5 @@
-import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-42ab6700.esm.js';
-export { P as PatchError } from '../../dist/index-42ab6700.esm.js';
+import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-36b5e0cb.esm.js';
+export { P as PatchError } from '../../dist/index-36b5e0cb.esm.js';
 import { f as isNonEmpty, e as err, o as ok, m as map, g as flatMap, i as isErr, h as flatMapReduce, j as filterOrElse, k as mapErr, l as map$1, n as all, p as flatten, q as allT } from '../../dist/result-daff1cae.esm.js';
 import { p as pipe } from '../../dist/util-18613e99.esm.js';