@valbuild/core 0.97.1 → 0.97.7

package/dist/declarations/src/initSchema.d.ts

@@ -285,7 +285,7 @@ export declare function initSchema(): {
     datetime: (options?: Record<string, never>) => import("./schema/datetime.js").DateTimeSchema<import("./schema/string.js").RawString>;
     route: <T extends string>(options?: Record<string, never>) => import("./schema/route.js").RouteSchema<T>;
     router: typeof router;
-    images: <Accept extends `image/${string}`>(options: import("./schema/images.js").ImagesOptions<Accept>) => import("./schema/record.js").RecordSchema<import("./schema/object.js").ObjectSchema<{
+    images: <Accept extends `image/${string}`>(options?: import("./schema/images.js").ImagesOptions<Accept>) => import("./schema/record.js").RecordSchema<import("./schema/object.js").ObjectSchema<{
         width: import("./schema/number.js").NumberSchema<number>;
         height: import("./schema/number.js").NumberSchema<number>;
         mimeType: import("./schema/string.js").StringSchema<string>;

package/dist/declarations/src/initVal.d.ts

@@ -13,7 +13,7 @@ export type ContentConstructor = {
 export type ValConstructor = {
     unstable_getPath: typeof getPath;
 };
-export type ConfigDirectory = `/public/val`;
+export type ConfigDirectory = `/public` | `/public/${string}`;
 export type ValConfig = {
     project?: string;
     root?: string;

package/dist/declarations/src/remote/splitRemoteRef.d.ts

@@ -6,7 +6,7 @@ export declare function splitRemoteRef(ref: string): {
     version: string;
     validationHash: string;
     fileHash: string;
-    filePath: `public/val/${string}`;
+    filePath: `public/${string}`;
 } | {
     status: "error";
     error: string;

package/dist/declarations/src/schema/images.d.ts

@@ -14,8 +14,9 @@ export type AltSchema = StringSchema<string> | StringSchema<string | null> | Rec
 export type ImagesOptions<Accept extends `image/${string}`> = {
     /**
      * The accepted mime type pattern. Must be an image type (e.g., "image/png", "image/webp", "image/*")
+     * @default "image/*"
      */
-    accept: Accept;
+    accept?: Accept;
     /**
      * The directory where images should be stored.
      * Must start with "/public" (e.g., "/public/val/images")
@@ -64,6 +65,9 @@ type ImagesItemSrc = {
 /**
  * Define a collection of images.
  *
+ * All options are optional: `s.images()` accepts any image type (`"image/*"`) in
+ * the default `/public/val` directory, with nullable alt text and remote disabled.
+ *
  * @example
  * ```typescript
  * const schema = s.images({
@@ -81,5 +85,5 @@ type ImagesItemSrc = {
  * });
  * ```
  */
-export declare const images: <Accept extends `image/${string}`>(options: ImagesOptions<Accept>) => RecordSchema<ObjectSchema<ImagesItemProps, ImagesItemSrc>, Schema<string>, Record<string, ImagesEntryMetadata>>;
+export declare const images: <Accept extends `image/${string}`>(options?: ImagesOptions<Accept>) => RecordSchema<ObjectSchema<ImagesItemProps, ImagesItemSrc>, Schema<string>, Record<string, ImagesEntryMetadata>>;
 export {};

package/dist/declarations/src/schema/index.d.ts

@@ -86,6 +86,15 @@ export declare abstract class Schema<Src extends SelectorSource> {
     protected abstract executeRender(sourcePath: SourcePath | ModuleFilePath, src: Src): ReifiedRender;
     /** MUTATES! since internal and perf sensitive */
     protected appendValidationError(current: ValidationErrors, path: SourcePath, message: string, value: unknown, schemaError?: boolean): ValidationErrors;
+    /**
+     * Merges two sets of validation errors path-wise: errors on the same path are
+     * concatenated, not overwritten. Object spread cannot be used for this, since
+     * it replaces the array of the colliding path. A record, for example, validates
+     * the key and the item on the same path, so both sets must survive.
+     *
+     * MUTATES! since internal and perf sensitive
+     */
+    protected mergeValidationErrors(current: ValidationErrors, incoming: ValidationErrors): ValidationErrors;
 }
 export type SelectorOfSchema<T extends Schema<SelectorSource>> = T extends Schema<infer Src> ? Src : never;
 export {};

package/dist/declarations/src/schema/record.d.ts

@@ -45,6 +45,8 @@ export declare class RecordSchema<T extends Schema<SelectorSource>, K extends Sc
     validate(validationFunction: (src: Src) => false | string): RecordSchema<T, K, Src>;
     protected executeValidate(path: SourcePath, src: Src): ValidationErrors;
     private isRemoteUrl;
+    /** Marks the validation errors reported at `path` as key errors (in place). */
+    private markKeyErrorsAtPath;
     private validateMediaKey;
     private validateMediaEntry;
     private validateMediaMimeType;

package/dist/declarations/src/schema/router.d.ts

@@ -2,4 +2,5 @@ import { Schema, SelectorOfSchema } from "./index.js";
 import { ValRouter } from "../router.js";
 import { SelectorSource } from "../selector/index.js";
 import { RecordSchema } from "./record.js";
-export declare function router<T extends Schema<SelectorSource>, Src extends Record<string, SelectorOfSchema<T>>>(router: ValRouter, item: T): RecordSchema<T, Schema<string>, Src>;
+export declare function router<K extends Schema<string>, T extends Schema<SelectorSource>>(router: ValRouter, key: K, item: T): RecordSchema<T, K, Record<SelectorOfSchema<K>, SelectorOfSchema<T>>>;
+export declare function router<T extends Schema<SelectorSource>>(router: ValRouter, item: T): RecordSchema<T, Schema<string>, Record<string, SelectorOfSchema<T>>>;

package/dist/declarations/src/selector/file.d.ts

@@ -5,6 +5,6 @@ export type FileSelector<Metadata extends FileMetadata | undefined> = GenericSel
     url: string;
 }> & {
     readonly url: UnknownSelector<string>;
-} & Metadata extends undefined ? {} : Metadata extends Source ? {
+} & (Metadata extends undefined ? {} : Metadata extends Source ? {
     readonly metadata: UnknownSelector<Metadata>;
-} : {};
+} : {});

package/dist/declarations/src/source/file.d.ts

@@ -22,7 +22,7 @@ export type FileSource<Metadata extends FileMetadata | undefined = FileMetadata
 export declare const initFile: (config?: ValConfig) => {
     <Metadata extends {
         readonly [key: string]: Json;
-    }>(ref: `${"/public/val"}/${string}`, metadata: Metadata): FileSource<Metadata>;
-    (ref: `${"/public/val"}/${string}`, metadata?: undefined): FileSource<undefined>;
+    }>(ref: `${import("../initVal.js").ConfigDirectory}/${string}`, metadata: Metadata): FileSource<Metadata>;
+    (ref: `${import("../initVal.js").ConfigDirectory}/${string}`, metadata?: undefined): FileSource<undefined>;
 };
 export declare function isFile(obj: unknown): obj is FileSource;

package/dist/declarations/src/source/image.d.ts

@@ -14,6 +14,6 @@ export type ImageSource<Metadata extends ImageMetadata | undefined = ImageMetada
     readonly patch_id?: string;
 };
 export declare const initImage: (config?: ValConfig) => {
-    (ref: `${"/public/val"}/${string}`, metadata: ImageMetadata): ImageSource<ImageMetadata>;
-    (ref: `${"/public/val"}/${string}`, metadata?: undefined): ImageSource<undefined>;
+    (ref: `${import("../initVal.js").ConfigDirectory}/${string}`, metadata: ImageMetadata): ImageSource<ImageMetadata>;
+    (ref: `${import("../initVal.js").ConfigDirectory}/${string}`, metadata?: undefined): ImageSource<undefined>;
 };

package/dist/declarations/src/source/remote.d.ts

@@ -12,12 +12,12 @@ export type RemoteSource<Metadata extends FileMetadata | undefined = FileMetadat
     readonly patch_id?: string;
 };
 export declare const initRemote: (config?: ValConfig) => <Metadata extends FileMetadata | ImageMetadata>(ref: RemoteRef, metadata?: Metadata) => RemoteSource<Metadata>;
-export type RemoteRef = `${string}/file/p/${string}/v/${string}/h/${string}/f/${string}/p/public/val/${string}`;
+export type RemoteRef = `${string}/file/p/${string}/b/${string}/v/${string}/h/${string}/f/${string}/p/public/${string}`;
 export declare function createRemoteRef(remoteHost: string, { publicProjectId, coreVersion, validationHash, fileHash, filePath, bucket, }: {
     publicProjectId: string;
     coreVersion: string;
     validationHash: string;
     fileHash: string;
-    filePath: `public/val/${string}`;
+    filePath: `public/${string}`;
     bucket: string;
 }): RemoteRef;

package/dist/{index-4da4ac5a.cjs.prod.js → index-139e0a7d.cjs.prod.js}

@@ -222,6 +222,34 @@ var Schema = /*#__PURE__*/function () {
         }]);
       }
     }
+
+    /**
+     * Merges two sets of validation errors path-wise: errors on the same path are
+     * concatenated, not overwritten. Object spread cannot be used for this, since
+     * it replaces the array of the colliding path. A record, for example, validates
+     * the key and the item on the same path, so both sets must survive.
+     *
+     * MUTATES! since internal and perf sensitive
+     */
+  }, {
+    key: "mergeValidationErrors",
+    value: function mergeValidationErrors(current, incoming) {
+      if (!incoming) {
+        return current;
+      }
+      if (!current) {
+        return incoming;
+      }
+      for (var pathS in incoming) {
+        var _path = pathS;
+        if (current[_path]) {
+          current[_path] = current[_path].concat(incoming[_path]);
+        } else {
+          current[_path] = incoming[_path];
+        }
+      }
+      return current;
+    }
   }]);
 }();
 
@@ -1007,11 +1035,7 @@ var ObjectSchema = /*#__PURE__*/function (_Schema) {
           src);
         } else {
           var subError = schema["executeValidate"](subPath, src[_key]);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = this.mergeValidationErrors(error, subError);
         }
       }
       return error;
@@ -1185,7 +1209,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
       if (assertRes.data === null) {
         return false;
       }
-      var error = {};
+      var error = false;
       for (var _i = 0, _Object$entries = Object.entries(assertRes.data); _i < _Object$entries.length; _i++) {
         var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
           idx = _Object$entries$_i[0],
@@ -1193,12 +1217,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
         var subPath = unsafeCreateSourcePath(path, Number(idx));
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         var subError = this.item["executeValidate"](subPath, i);
-        if (subError) {
-          error = _objectSpread2(_objectSpread2({}, subError), error);
-        }
-      }
-      if (Object.keys(error).length === 0) {
-        return false;
+        error = this.mergeValidationErrors(error, subError);
       }
       return error;
     }
@@ -2892,7 +2911,15 @@ function splitRemoteRef(ref) {
       error: "Invalid remote ref: " + ref
     };
   }
-  if (match[7].indexOf("public/val/") !== 0) {
+  if (match[7].indexOf("public/") !== 0) {
+    return {
+      status: "error",
+      error: "Invalid remote ref: " + ref
+    };
+  }
+  if (match[7].split("/").some(function (segment) {
+    return segment === "." || segment === "..";
+  })) {
     return {
       status: "error",
       error: "Invalid remote ref: " + ref
@@ -2973,9 +3000,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
         }]));
       }
       var routerValidations = this.getRouterValidations(path, src);
-      if (routerValidations) {
-        return routerValidations;
-      }
+      error = this.mergeValidationErrors(error, routerValidations);
       var _iterator = result._createForOfIteratorHelper(customValidationErrors),
         _step;
       try {
@@ -3039,15 +3064,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
                 keyError: true
               });
             });
-            if (error) {
-              if (error[keyPath]) {
-                error[keyPath] = [].concat(_toConsumableArray(error[keyPath]), _toConsumableArray(keyError[keyPath]));
-              } else {
-                error[keyPath] = keyError[keyPath];
-              }
-            } else {
-              error = keyError;
-            }
+            error = _this2.mergeValidationErrors(error, keyError);
           }
         }
         var subPath = createValPathOfItem(path, key);
@@ -3056,22 +3073,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
           // Should! never happen
           src);
         } else if (_this2.mediaOptions) {
-          // Media collection: validate key (path/URL) and entry (metadata)
+          // Media collection: validate key (path/URL) and entry (metadata).
+          // Gallery entries are keyed by their file path and the metadata is
+          // derived, so surface entry errors on the key rather than the value.
           var keyErr = _this2.validateMediaKey(subPath, key);
           if (keyErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), keyErr) : keyErr;
+            _this2.markKeyErrorsAtPath(keyErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, keyErr);
           var entryErr = _this2.validateMediaEntry(subPath, elem);
           if (entryErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), entryErr) : entryErr;
+            _this2.markKeyErrorsAtPath(entryErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, entryErr);
         } else {
           var subError = _this2.item["executeValidate"](subPath, elem);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = _this2.mergeValidationErrors(error, subError);
         }
       });
       return error;
@@ -3081,6 +3098,19 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     value: function isRemoteUrl(url) {
       return url.startsWith("https://") || url.startsWith("http://");
     }
+
+    /** Marks the validation errors reported at `path` as key errors (in place). */
+  }, {
+    key: "markKeyErrorsAtPath",
+    value: function markKeyErrorsAtPath(errors, path) {
+      if (errors && errors[path]) {
+        errors[path] = errors[path].map(function (err) {
+          return _objectSpread2(_objectSpread2({}, err), {}, {
+            keyError: true
+          });
+        });
+      }
+    }
   }, {
     key: "validateMediaKey",
     value: function validateMediaKey(path, key) {
@@ -4882,10 +4912,11 @@ var datetime = function datetime(options) {
   return new DateTimeSchema(options);
 };
 
-function router(router, item) {
-  var keySchema = string();
-  var recordSchema = new RecordSchema(item, false, [], router, keySchema);
-  return recordSchema;
+function router(router, keyOrItem, maybeItem) {
+  if (maybeItem) {
+    return new RecordSchema(maybeItem, false, [], router, keyOrItem);
+  }
+  return new RecordSchema(keyOrItem, false, [], router, string());
 }
 
 /**
@@ -4905,6 +4936,9 @@ function router(router, item) {
 /**
  * Define a collection of images.
  *
+ * All options are optional: `s.images()` accepts any image type (`"image/*"`) in
+ * the default `/public/val` directory, with nullable alt text and remote disabled.
+ *
  * @example
  * ```typescript
  * const schema = s.images({
@@ -4923,9 +4957,9 @@ function router(router, item) {
  * ```
  */
 var images = function images(options) {
-  var _options$directory, _options$alt, _options$remote;
-  var directory = (_options$directory = options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
-  var altSchema = (_options$alt = options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
+  var _options$directory, _options$alt, _options$accept, _options$remote;
+  var directory = (_options$directory = options === null || options === void 0 ? void 0 : options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
+  var altSchema = (_options$alt = options === null || options === void 0 ? void 0 : options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
   var itemSchema = new ObjectSchema({
     width: new NumberSchema(undefined, false),
     height: new NumberSchema(undefined, false),
@@ -4934,9 +4968,9 @@ var images = function images(options) {
   }, false);
   return new RecordSchema(itemSchema, false, [], null, null, {
     type: "images",
-    accept: options.accept,
+    accept: (_options$accept = options === null || options === void 0 ? void 0 : options.accept) !== null && _options$accept !== void 0 ? _options$accept : "image/*",
     directory: directory,
-    remote: (_options$remote = options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
+    remote: (_options$remote = options === null || options === void 0 ? void 0 : options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
     altSchema: altSchema
   });
 };
@@ -5042,6 +5076,9 @@ var initRemote = function initRemote(config) {
   }
   return remote;
 };
+
+// NOTE: the segments must match the ref built by createRemoteRef below and the RegEx in splitRemoteRef.
+
 function createRemoteRef(remoteHost, _ref2) {
   var publicProjectId = _ref2.publicProjectId,
     coreVersion = _ref2.coreVersion,

package/dist/{index-039896b7.cjs.dev.js → index-24fcc47f.cjs.dev.js}

@@ -222,6 +222,34 @@ var Schema = /*#__PURE__*/function () {
         }]);
       }
     }
+
+    /**
+     * Merges two sets of validation errors path-wise: errors on the same path are
+     * concatenated, not overwritten. Object spread cannot be used for this, since
+     * it replaces the array of the colliding path. A record, for example, validates
+     * the key and the item on the same path, so both sets must survive.
+     *
+     * MUTATES! since internal and perf sensitive
+     */
+  }, {
+    key: "mergeValidationErrors",
+    value: function mergeValidationErrors(current, incoming) {
+      if (!incoming) {
+        return current;
+      }
+      if (!current) {
+        return incoming;
+      }
+      for (var pathS in incoming) {
+        var _path = pathS;
+        if (current[_path]) {
+          current[_path] = current[_path].concat(incoming[_path]);
+        } else {
+          current[_path] = incoming[_path];
+        }
+      }
+      return current;
+    }
   }]);
 }();
 
@@ -1007,11 +1035,7 @@ var ObjectSchema = /*#__PURE__*/function (_Schema) {
           src);
         } else {
           var subError = schema["executeValidate"](subPath, src[_key]);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = this.mergeValidationErrors(error, subError);
         }
       }
       return error;
@@ -1185,7 +1209,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
       if (assertRes.data === null) {
         return false;
       }
-      var error = {};
+      var error = false;
       for (var _i = 0, _Object$entries = Object.entries(assertRes.data); _i < _Object$entries.length; _i++) {
         var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
           idx = _Object$entries$_i[0],
@@ -1193,12 +1217,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
         var subPath = unsafeCreateSourcePath(path, Number(idx));
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         var subError = this.item["executeValidate"](subPath, i);
-        if (subError) {
-          error = _objectSpread2(_objectSpread2({}, subError), error);
-        }
-      }
-      if (Object.keys(error).length === 0) {
-        return false;
+        error = this.mergeValidationErrors(error, subError);
       }
       return error;
     }
@@ -2892,7 +2911,15 @@ function splitRemoteRef(ref) {
       error: "Invalid remote ref: " + ref
     };
   }
-  if (match[7].indexOf("public/val/") !== 0) {
+  if (match[7].indexOf("public/") !== 0) {
+    return {
+      status: "error",
+      error: "Invalid remote ref: " + ref
+    };
+  }
+  if (match[7].split("/").some(function (segment) {
+    return segment === "." || segment === "..";
+  })) {
     return {
       status: "error",
       error: "Invalid remote ref: " + ref
@@ -2973,9 +3000,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
         }]));
       }
       var routerValidations = this.getRouterValidations(path, src);
-      if (routerValidations) {
-        return routerValidations;
-      }
+      error = this.mergeValidationErrors(error, routerValidations);
       var _iterator = result._createForOfIteratorHelper(customValidationErrors),
         _step;
       try {
@@ -3039,15 +3064,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
                 keyError: true
               });
             });
-            if (error) {
-              if (error[keyPath]) {
-                error[keyPath] = [].concat(_toConsumableArray(error[keyPath]), _toConsumableArray(keyError[keyPath]));
-              } else {
-                error[keyPath] = keyError[keyPath];
-              }
-            } else {
-              error = keyError;
-            }
+            error = _this2.mergeValidationErrors(error, keyError);
           }
         }
         var subPath = createValPathOfItem(path, key);
@@ -3056,22 +3073,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
           // Should! never happen
           src);
         } else if (_this2.mediaOptions) {
-          // Media collection: validate key (path/URL) and entry (metadata)
+          // Media collection: validate key (path/URL) and entry (metadata).
+          // Gallery entries are keyed by their file path and the metadata is
+          // derived, so surface entry errors on the key rather than the value.
           var keyErr = _this2.validateMediaKey(subPath, key);
           if (keyErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), keyErr) : keyErr;
+            _this2.markKeyErrorsAtPath(keyErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, keyErr);
           var entryErr = _this2.validateMediaEntry(subPath, elem);
           if (entryErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), entryErr) : entryErr;
+            _this2.markKeyErrorsAtPath(entryErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, entryErr);
         } else {
           var subError = _this2.item["executeValidate"](subPath, elem);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = _this2.mergeValidationErrors(error, subError);
         }
       });
       return error;
@@ -3081,6 +3098,19 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     value: function isRemoteUrl(url) {
       return url.startsWith("https://") || url.startsWith("http://");
     }
+
+    /** Marks the validation errors reported at `path` as key errors (in place). */
+  }, {
+    key: "markKeyErrorsAtPath",
+    value: function markKeyErrorsAtPath(errors, path) {
+      if (errors && errors[path]) {
+        errors[path] = errors[path].map(function (err) {
+          return _objectSpread2(_objectSpread2({}, err), {}, {
+            keyError: true
+          });
+        });
+      }
+    }
   }, {
     key: "validateMediaKey",
     value: function validateMediaKey(path, key) {
@@ -4882,10 +4912,11 @@ var datetime = function datetime(options) {
   return new DateTimeSchema(options);
 };
 
-function router(router, item) {
-  var keySchema = string();
-  var recordSchema = new RecordSchema(item, false, [], router, keySchema);
-  return recordSchema;
+function router(router, keyOrItem, maybeItem) {
+  if (maybeItem) {
+    return new RecordSchema(maybeItem, false, [], router, keyOrItem);
+  }
+  return new RecordSchema(keyOrItem, false, [], router, string());
 }
 
 /**
@@ -4905,6 +4936,9 @@ function router(router, item) {
 /**
  * Define a collection of images.
  *
+ * All options are optional: `s.images()` accepts any image type (`"image/*"`) in
+ * the default `/public/val` directory, with nullable alt text and remote disabled.
+ *
  * @example
  * ```typescript
  * const schema = s.images({
@@ -4923,9 +4957,9 @@ function router(router, item) {
  * ```
  */
 var images = function images(options) {
-  var _options$directory, _options$alt, _options$remote;
-  var directory = (_options$directory = options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
-  var altSchema = (_options$alt = options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
+  var _options$directory, _options$alt, _options$accept, _options$remote;
+  var directory = (_options$directory = options === null || options === void 0 ? void 0 : options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
+  var altSchema = (_options$alt = options === null || options === void 0 ? void 0 : options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
   var itemSchema = new ObjectSchema({
     width: new NumberSchema(undefined, false),
     height: new NumberSchema(undefined, false),
@@ -4934,9 +4968,9 @@ var images = function images(options) {
   }, false);
   return new RecordSchema(itemSchema, false, [], null, null, {
     type: "images",
-    accept: options.accept,
+    accept: (_options$accept = options === null || options === void 0 ? void 0 : options.accept) !== null && _options$accept !== void 0 ? _options$accept : "image/*",
     directory: directory,
-    remote: (_options$remote = options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
+    remote: (_options$remote = options === null || options === void 0 ? void 0 : options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
     altSchema: altSchema
   });
 };
@@ -5042,6 +5076,9 @@ var initRemote = function initRemote(config) {
   }
   return remote;
 };
+
+// NOTE: the segments must match the ref built by createRemoteRef below and the RegEx in splitRemoteRef.
+
 function createRemoteRef(remoteHost, _ref2) {
   var publicProjectId = _ref2.publicProjectId,
     coreVersion = _ref2.coreVersion,

package/dist/{index-8c26d8f4.esm.js → index-802570f7.esm.js}

@@ -220,6 +220,34 @@ var Schema = /*#__PURE__*/function () {
         }]);
       }
     }
+
+    /**
+     * Merges two sets of validation errors path-wise: errors on the same path are
+     * concatenated, not overwritten. Object spread cannot be used for this, since
+     * it replaces the array of the colliding path. A record, for example, validates
+     * the key and the item on the same path, so both sets must survive.
+     *
+     * MUTATES! since internal and perf sensitive
+     */
+  }, {
+    key: "mergeValidationErrors",
+    value: function mergeValidationErrors(current, incoming) {
+      if (!incoming) {
+        return current;
+      }
+      if (!current) {
+        return incoming;
+      }
+      for (var pathS in incoming) {
+        var _path = pathS;
+        if (current[_path]) {
+          current[_path] = current[_path].concat(incoming[_path]);
+        } else {
+          current[_path] = incoming[_path];
+        }
+      }
+      return current;
+    }
   }]);
 }();
 
@@ -1005,11 +1033,7 @@ var ObjectSchema = /*#__PURE__*/function (_Schema) {
           src);
         } else {
           var subError = schema["executeValidate"](subPath, src[_key]);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = this.mergeValidationErrors(error, subError);
         }
       }
       return error;
@@ -1183,7 +1207,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
       if (assertRes.data === null) {
         return false;
       }
-      var error = {};
+      var error = false;
       for (var _i = 0, _Object$entries = Object.entries(assertRes.data); _i < _Object$entries.length; _i++) {
         var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
           idx = _Object$entries$_i[0],
@@ -1191,12 +1215,7 @@ var ArraySchema = /*#__PURE__*/function (_Schema) {
         var subPath = unsafeCreateSourcePath(path, Number(idx));
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         var subError = this.item["executeValidate"](subPath, i);
-        if (subError) {
-          error = _objectSpread2(_objectSpread2({}, subError), error);
-        }
-      }
-      if (Object.keys(error).length === 0) {
-        return false;
+        error = this.mergeValidationErrors(error, subError);
       }
       return error;
     }
@@ -2890,7 +2909,15 @@ function splitRemoteRef(ref) {
       error: "Invalid remote ref: " + ref
     };
   }
-  if (match[7].indexOf("public/val/") !== 0) {
+  if (match[7].indexOf("public/") !== 0) {
+    return {
+      status: "error",
+      error: "Invalid remote ref: " + ref
+    };
+  }
+  if (match[7].split("/").some(function (segment) {
+    return segment === "." || segment === "..";
+  })) {
     return {
       status: "error",
       error: "Invalid remote ref: " + ref
@@ -2971,9 +2998,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
         }]));
       }
       var routerValidations = this.getRouterValidations(path, src);
-      if (routerValidations) {
-        return routerValidations;
-      }
+      error = this.mergeValidationErrors(error, routerValidations);
       var _iterator = _createForOfIteratorHelper(customValidationErrors),
         _step;
       try {
@@ -3037,15 +3062,7 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
                 keyError: true
               });
             });
-            if (error) {
-              if (error[keyPath]) {
-                error[keyPath] = [].concat(_toConsumableArray(error[keyPath]), _toConsumableArray(keyError[keyPath]));
-              } else {
-                error[keyPath] = keyError[keyPath];
-              }
-            } else {
-              error = keyError;
-            }
+            error = _this2.mergeValidationErrors(error, keyError);
           }
         }
         var subPath = createValPathOfItem(path, key);
@@ -3054,22 +3071,22 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
           // Should! never happen
           src);
         } else if (_this2.mediaOptions) {
-          // Media collection: validate key (path/URL) and entry (metadata)
+          // Media collection: validate key (path/URL) and entry (metadata).
+          // Gallery entries are keyed by their file path and the metadata is
+          // derived, so surface entry errors on the key rather than the value.
           var keyErr = _this2.validateMediaKey(subPath, key);
           if (keyErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), keyErr) : keyErr;
+            _this2.markKeyErrorsAtPath(keyErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, keyErr);
           var entryErr = _this2.validateMediaEntry(subPath, elem);
           if (entryErr) {
-            error = error ? _objectSpread2(_objectSpread2({}, error), entryErr) : entryErr;
+            _this2.markKeyErrorsAtPath(entryErr, subPath);
           }
+          error = _this2.mergeValidationErrors(error, entryErr);
         } else {
           var subError = _this2.item["executeValidate"](subPath, elem);
-          if (subError && error) {
-            error = _objectSpread2(_objectSpread2({}, subError), error);
-          } else if (subError) {
-            error = subError;
-          }
+          error = _this2.mergeValidationErrors(error, subError);
         }
       });
       return error;
@@ -3079,6 +3096,19 @@ var RecordSchema = /*#__PURE__*/function (_Schema) {
     value: function isRemoteUrl(url) {
       return url.startsWith("https://") || url.startsWith("http://");
     }
+
+    /** Marks the validation errors reported at `path` as key errors (in place). */
+  }, {
+    key: "markKeyErrorsAtPath",
+    value: function markKeyErrorsAtPath(errors, path) {
+      if (errors && errors[path]) {
+        errors[path] = errors[path].map(function (err) {
+          return _objectSpread2(_objectSpread2({}, err), {}, {
+            keyError: true
+          });
+        });
+      }
+    }
   }, {
     key: "validateMediaKey",
     value: function validateMediaKey(path, key) {
@@ -4880,10 +4910,11 @@ var datetime = function datetime(options) {
   return new DateTimeSchema(options);
 };
 
-function router(router, item) {
-  var keySchema = string();
-  var recordSchema = new RecordSchema(item, false, [], router, keySchema);
-  return recordSchema;
+function router(router, keyOrItem, maybeItem) {
+  if (maybeItem) {
+    return new RecordSchema(maybeItem, false, [], router, keyOrItem);
+  }
+  return new RecordSchema(keyOrItem, false, [], router, string());
 }
 
 /**
@@ -4903,6 +4934,9 @@ function router(router, item) {
 /**
  * Define a collection of images.
  *
+ * All options are optional: `s.images()` accepts any image type (`"image/*"`) in
+ * the default `/public/val` directory, with nullable alt text and remote disabled.
+ *
  * @example
  * ```typescript
  * const schema = s.images({
@@ -4921,9 +4955,9 @@ function router(router, item) {
  * ```
  */
 var images = function images(options) {
-  var _options$directory, _options$alt, _options$remote;
-  var directory = (_options$directory = options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
-  var altSchema = (_options$alt = options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
+  var _options$directory, _options$alt, _options$accept, _options$remote;
+  var directory = (_options$directory = options === null || options === void 0 ? void 0 : options.directory) !== null && _options$directory !== void 0 ? _options$directory : "/public/val";
+  var altSchema = (_options$alt = options === null || options === void 0 ? void 0 : options.alt) !== null && _options$alt !== void 0 ? _options$alt : string().nullable();
   var itemSchema = new ObjectSchema({
     width: new NumberSchema(undefined, false),
     height: new NumberSchema(undefined, false),
@@ -4932,9 +4966,9 @@ var images = function images(options) {
   }, false);
   return new RecordSchema(itemSchema, false, [], null, null, {
     type: "images",
-    accept: options.accept,
+    accept: (_options$accept = options === null || options === void 0 ? void 0 : options.accept) !== null && _options$accept !== void 0 ? _options$accept : "image/*",
     directory: directory,
-    remote: (_options$remote = options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
+    remote: (_options$remote = options === null || options === void 0 ? void 0 : options.remote) !== null && _options$remote !== void 0 ? _options$remote : false,
     altSchema: altSchema
   });
 };
@@ -5040,6 +5074,9 @@ var initRemote = function initRemote(config) {
   }
   return remote;
 };
+
+// NOTE: the segments must match the ref built by createRemoteRef below and the RegEx in splitRemoteRef.
+
 function createRemoteRef(remoteHost, _ref2) {
   var publicProjectId = _ref2.publicProjectId,
     coreVersion = _ref2.coreVersion,

package/dist/valbuild-core.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-039896b7.cjs.dev.js');
+var dist_valbuildCore = require('./index-24fcc47f.cjs.dev.js');
 require('./result-bb1f436e.cjs.dev.js');
 
 

package/dist/valbuild-core.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('./index-4da4ac5a.cjs.prod.js');
+var dist_valbuildCore = require('./index-139e0a7d.cjs.prod.js');
 require('./result-787e35f6.cjs.prod.js');
 
 

package/dist/valbuild-core.esm.js

@@ -1,2 +1,2 @@
-export { A as ArraySchema, B as BooleanSchema, e as DEFAULT_APP_HOST, D as DEFAULT_CONTENT_HOST, g as DEFAULT_VAL_REMOTE_HOST, p as DateSchema, q as DateTimeSchema, F as FATAL_ERROR_TYPES, h as FILE_REF_PROP, j as FILE_REF_SUBTYPE_TAG, o as FileSchema, G as GenericSelector, n as ImageSchema, I as Internal, K as KeyOfSchema, L as LiteralSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, t as RichTextSchema, r as RouteSchema, S as Schema, l as StringSchema, U as UnionSchema, V as VAL_EXTENSION, k as derefPatch, u as deserializeSchema, f as extractValModules, v as getSourcePathFromRoute, i as initVal, m as modules } from './index-8c26d8f4.esm.js';
+export { A as ArraySchema, B as BooleanSchema, e as DEFAULT_APP_HOST, D as DEFAULT_CONTENT_HOST, g as DEFAULT_VAL_REMOTE_HOST, p as DateSchema, q as DateTimeSchema, F as FATAL_ERROR_TYPES, h as FILE_REF_PROP, j as FILE_REF_SUBTYPE_TAG, o as FileSchema, G as GenericSelector, n as ImageSchema, I as Internal, K as KeyOfSchema, L as LiteralSchema, M as ModuleFilePathSep, N as NumberSchema, O as ObjectSchema, R as RecordSchema, t as RichTextSchema, r as RouteSchema, S as Schema, l as StringSchema, U as UnionSchema, V as VAL_EXTENSION, k as derefPatch, u as deserializeSchema, f as extractValModules, v as getSourcePathFromRoute, i as initVal, m as modules } from './index-802570f7.esm.js';
 import './result-4bd63123.esm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/core",
-  "version": "0.97.1",
+  "version": "0.97.7",
   "private": false,
   "description": "Val - supercharged hard-coded content",
   "repository": {

package/patch/dist/valbuild-core-patch.cjs.dev.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-039896b7.cjs.dev.js');
+var dist_valbuildCore = require('../../dist/index-24fcc47f.cjs.dev.js');
 var result = require('../../dist/result-bb1f436e.cjs.dev.js');
 var util = require('../../dist/util-b213092b.cjs.dev.js');
 

package/patch/dist/valbuild-core-patch.cjs.prod.js

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var dist_valbuildCore = require('../../dist/index-4da4ac5a.cjs.prod.js');
+var dist_valbuildCore = require('../../dist/index-139e0a7d.cjs.prod.js');
 var result = require('../../dist/result-787e35f6.cjs.prod.js');
 var util = require('../../dist/util-030d8a1f.cjs.prod.js');
 

package/patch/dist/valbuild-core-patch.esm.js

@@ -1,5 +1,5 @@
-import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-8c26d8f4.esm.js';
-export { P as PatchError } from '../../dist/index-8c26d8f4.esm.js';
+import { _ as _typeof, a as _slicedToArray, P as PatchError, s as splitModuleFilePathAndModulePath, b as _createClass, c as _classCallCheck, d as _toConsumableArray } from '../../dist/index-802570f7.esm.js';
+export { P as PatchError } from '../../dist/index-802570f7.esm.js';
 import { f as isNonEmpty, e as err, o as ok, m as map, g as flatMap, i as isErr, h as flatMapReduce, j as filterOrElse, k as mapErr, l as map$1, n as all, p as flatten, q as allT } from '../../dist/result-4bd63123.esm.js';
 import { p as pipe } from '../../dist/util-18613e99.esm.js';