@vit-foundation/ui 0.16.0 → 0.18.0

package/dist/components/timeline/TimelineMilestone.svelte

@@ -30,6 +30,7 @@
 	import EditPanel from '../../edit/chrome/EditPanel.svelte';
 	import Editable from '../../edit/Editable.svelte';
 	import { MILESTONE_CATEGORY_COLOR, milestoneCategoryLabel } from '../../utils/milestones.js';
+	import { isExternalUrl } from '../../utils/paths.js';
 	import CardMedia from '../ui/CardMedia.svelte';
 	import DraftBadge from '../../edit/chrome/DraftBadge.svelte';
 	import DateText from '../ui/DateText.svelte';
@@ -96,7 +97,13 @@
 	 * predicate — they never route the value through Link, so nothing splices a
 	 * locale into it.
 	 */
-	const isExternal = $derived(/^(?:[a-z][a-z0-9+.-]*:)?\/\//i.test(milestone.linkUrl ?? ''));
+	// An ALLOW-LIST, not "does it look absolute". The predicate here used to be
+	// /^(?:[a-z][a-z0-9+.-]*:)?\/\//i — it asks for '//', so any scheme
+	// without one ('javascript:alert(1)') read as INTERNAL and went to Link,
+	// which handed it to the locale resolver and got it back unchanged. A
+	// destination that is neither a path nor an http(s) URL now renders no
+	// link at all rather than choosing between two wrong branches.
+	const isExternal = $derived(isExternalUrl(milestone.linkUrl ?? ''));
 </script>
 
 <article style={`--milestone-color: ${color}`}>

package/dist/components/ui/Link.svelte

@@ -3,6 +3,7 @@
 	import type { HTMLAnchorAttributes } from 'svelte/elements';
 	import type { Locale } from '../../config/types.js';
 	import { getUiConfig } from '../../config/context.js';
+	import { isInternalPath } from '../../utils/paths.js';
 
 	interface Props extends HTMLAnchorAttributes {
 		/**
@@ -13,6 +14,13 @@
 		 * path can come back mangled, and no `rel` is emitted. A content column that may hold
 		 * either (a milestone's `link_url`) branches at the call site and
 		 * renders a bare anchor for the external case.
+		 *
+		 * This is ENFORCED, not assumed. The sentence above was here while the
+		 * component handed anything at all to `config.href` — and a resolver
+		 * that localizes paths returns 'javascript:alert(1)' unchanged, so an
+		 * editor-written destination reached an <a href> intact. Anything that
+		 * is not a root-relative path renders as plain text now: dropping a
+		 * link is a visible bug someone reports, emitting a hostile one is not.
 		 */
 		href: string;
 		/** Target locale; defaults to the current request/page locale. */
@@ -24,7 +32,11 @@
 
 	const config = getUiConfig();
 
-	const resolvedHref = $derived(config.href(href, { locale }));
+	const internal = $derived(isInternalPath(href));
+	const resolvedHref = $derived(internal ? config.href(href, { locale }) : undefined);
 </script>
 
+<!-- No href rather than no element: an anchor without one is not a link and
+     navigates nowhere, while the surrounding CSS (which selects `a`) keeps
+     applying, so a refused destination costs the layout nothing. -->
 <a href={resolvedHref} {...rest}>{@render children()}</a>

package/dist/components/ui/Link.svelte.d.ts

@@ -10,6 +10,13 @@ interface Props extends HTMLAnchorAttributes {
      * path can come back mangled, and no `rel` is emitted. A content column that may hold
      * either (a milestone's `link_url`) branches at the call site and
      * renders a bare anchor for the external case.
+     *
+     * This is ENFORCED, not assumed. The sentence above was here while the
+     * component handed anything at all to `config.href` — and a resolver
+     * that localizes paths returns 'javascript:alert(1)' unchanged, so an
+     * editor-written destination reached an <a href> intact. Anything that
+     * is not a root-relative path renders as plain text now: dropping a
+     * link is a visible bug someone reports, emitting a hostile one is not.
      */
     href: string;
     /** Target locale; defaults to the current request/page locale. */

package/dist/content-components.d.ts

@@ -11,6 +11,7 @@ export type { ProjectEditMap } from './components/projects/ProjectCard.svelte';
 export { default as SortSelect } from './components/weeklies/SortSelect.svelte';
 export { default as TeamMemberCard } from './components/team/TeamMemberCard.svelte';
 export type { TeamMemberEditMap } from './components/team/TeamMemberCard.svelte';
+export type { CollaboratorEditMap } from './components/team/CollaboratorList.svelte';
 export { default as Timeline } from './components/timeline/Timeline.svelte';
 export { default as TimelineMilestone } from './components/timeline/TimelineMilestone.svelte';
 export type { MilestoneEditMap } from './components/timeline/TimelineMilestone.svelte';

package/dist/edit/Editable.svelte

@@ -2,6 +2,7 @@
 	import type { Snippet } from 'svelte';
 	import { getUiConfig } from '../config/context.js';
 	import { getEditAdapter } from './context.js';
+	import { commitState } from './commit.svelte.js';
 	import type { EditDescriptor } from './types.js';
 
 	/**
@@ -58,30 +59,22 @@
 	const adapter = getEditAdapter();
 	const config = getUiConfig();
 
-	let status = $state<'idle' | 'dirty' | 'saving' | 'error'>('idle');
-	/** Last persisted value: what Escape restores and blur diffs against. */
+	/**
+	 * The commit lifecycle — the four states, the announcements, the last
+	 * persisted value and the follow-the-prop rule — is shared with
+	 * `PropertyRow` (see `./commit.svelte.js`). What stays here is where the
+	 * DRAFT lives: in the DOM, because this is a contenteditable.
+	 */
 	// svelte-ignore state_referenced_locally
-	let savedValue = $state(value);
+	const commit_ = commitState(value, config.editMessages);
 	/** What the child snippet renders. Only rewritten while the DOM is not
 	 * being typed in — Svelte and the reader must not fight over the node. */
 	// svelte-ignore state_referenced_locally
 	let renderText = $state(value);
-	let announcement = $state('');
 
-	// Follow the prop when the app reloads content underneath us — and only
-	// then. Diffing against savedValue instead would fire after every save,
-	// where savedValue has legitimately advanced past the prop, and repaint
-	// the committed draft with stale copy. Never over a draft being held.
-	// svelte-ignore state_referenced_locally
-	let lastPropValue = $state(value);
 	$effect(() => {
-		if (value !== lastPropValue) {
-			lastPropValue = value;
-			if (status === 'idle') {
-				savedValue = value;
-				renderText = value;
-			}
-		}
+		const adopted = commit_.follow(value);
+		if (adopted !== null) renderText = adopted;
 	});
 
 	const active = $derived(edit !== undefined && (adapter?.isEditing ?? false));
@@ -108,35 +101,27 @@
 		range.deleteContents();
 		range.insertNode(document.createTextNode(multiline ? text : text.replace(/\s*\n\s*/g, ' ')));
 		selection.collapseToEnd();
-		status = 'dirty';
+		commit_.markDirty();
 	}
 
 	function handleInput(): void {
-		if (status !== 'saving') status = 'dirty';
+		commit_.markDirty();
 	}
 
 	async function commit(element: HTMLElement): Promise<void> {
 		if (!edit || !adapter) return;
 		const draft = textOf(element).trim();
-		if (draft === savedValue) {
-			status = 'idle';
+		if (draft === commit_.saved) {
+			commit_.settle();
 			return;
 		}
-		status = 'saving';
-		announcement = config.editMessages.edit_saving();
-		try {
-			await adapter.save(edit, draft);
-			savedValue = draft;
-			status = 'idle';
-			announcement = config.editMessages.edit_saved();
-		} catch {
-			// Draft stays in the DOM; the reader decides whether to retry.
-			status = 'error';
-			announcement = config.editMessages.edit_saveError();
-		}
+		// A failed save leaves the draft in the DOM; the reader decides whether
+		// to retry.
+		await commit_.commit(draft, () => adapter.save(edit, draft));
 	}
 
 	function handleBlur(event: FocusEvent): void {
+		const status = commit_.status;
 		if (status === 'dirty' || status === 'error') void commit(event.currentTarget as HTMLElement);
 	}
 
@@ -146,9 +131,8 @@
 			// Svelte's cached text still equals renderText, so a state write
 			// alone cannot repaint a node the reader has mutated: restore the
 			// DOM directly, then settle.
-			element.textContent = savedValue;
-			status = 'idle';
-			announcement = '';
+			element.textContent = commit_.saved;
+			commit_.revert();
 			element.blur();
 			return;
 		}
@@ -168,7 +152,7 @@
 					role: 'textbox',
 					'aria-label': edit?.label,
 					'aria-multiline': multiline ? 'true' : undefined,
-					'data-vit-editing': status,
+					'data-vit-editing': commit_.status,
 					onbeforeinput: handleBeforeInput,
 					oninput: handleInput,
 					onblur: handleBlur,
@@ -181,7 +165,7 @@
 
 {@render children(renderText, attrs)}
 {#if active}
-	<span class="status" role="status">{announcement}</span>
+	<span class="status" role="status">{commit_.announcement}</span>
 {/if}
 
 <style>

package/dist/edit/chrome/LinkEdit.svelte

@@ -4,7 +4,9 @@
 	import Icon from '../../components/ui/Icon.svelte';
 	import Modal from '../../components/ui/Modal.svelte';
 	import { getUiConfig } from '../../config/context.js';
+	import type { ParameterlessKey } from '../../config/types.js';
 	import { getEditAdapter } from '../context.js';
+	import { propertyValue } from '../commit.svelte.js';
 	import type { EditDescriptor, EntityOp, PropertyDescriptor } from '../types.js';
 	import ConfirmDialog from './ConfirmDialog.svelte';
 
@@ -31,7 +33,11 @@
 		href: { descriptor: PropertyDescriptor | undefined; value: string };
 		/**
 		 * Extra property rows under Adreça — a menu link's Ordre. Labelled from
-		 * their descriptors, committed on Desa only when changed.
+		 * their descriptors, committed on Desa only when changed, and rendered
+		 * BY TYPE: this used to be a bare text input whatever the descriptor
+		 * said, which made it a second renderer that would silently miss any
+		 * property type the package grew. An `image` row has no place in a link
+		 * modal and is the one type refused here.
 		 */
 		extras?: { descriptor: PropertyDescriptor; value: string | null }[];
 		/** With `adapter.applyOp`, the modal gains a confirmed Elimina action. */
@@ -57,7 +63,14 @@
 	const editing = $derived(text.edit !== undefined && (adapter?.isEditing ?? false));
 	// Every field beyond the text needs both a place and a verb to save with.
 	const editsHref = $derived(href.descriptor !== undefined && adapter?.saveProperty !== undefined);
-	const editableExtras = $derived(adapter?.saveProperty !== undefined ? (extras ?? []) : []);
+	const editableExtras = $derived(
+		adapter?.saveProperty !== undefined
+			? (extras ?? []).filter((extra) => extra.descriptor.type !== 'image')
+			: []
+	);
+
+	/** A flag state's wording, from the same catalog the site renders. */
+	const wording = (key: ParameterlessKey): string => config.messages[key]?.() ?? key;
 	const removable = $derived(removeOp !== undefined && adapter?.applyOp !== undefined);
 
 	let open = $state(false);
@@ -104,7 +117,8 @@
 			for (const [index, extra] of editableExtras.entries()) {
 				const next = draftExtras[index].trim();
 				if (next === (extra.value ?? '')) continue;
-				await adapter.saveProperty!(extra.descriptor, next);
+				// A flag extra hands the adapter a BOOLEAN, like a panel row does.
+				await adapter.saveProperty!(extra.descriptor, propertyValue(extra.descriptor, next));
 				draftExtras[index] = next;
 			}
 			open = false;
@@ -167,7 +181,25 @@
 			{#each editableExtras as extra, index (index)}
 				<label>
 					<span>{extra.descriptor.label}</span>
-					<input type="text" bind:value={draftExtras[index]} disabled={saving} />
+					{#if extra.descriptor.type === 'select'}
+						<select bind:value={draftExtras[index]} disabled={saving}>
+							{#each extra.descriptor.options ?? [] as option (option.value)}
+								<option value={option.value}>{option.label}</option>
+							{/each}
+						</select>
+					{:else if extra.descriptor.type === 'flag'}
+						<select bind:value={draftExtras[index]} disabled={saving}>
+							<option value="true">{wording(extra.descriptor.on ?? 'status_published')}</option>
+							<option value="false">{wording(extra.descriptor.off ?? 'status_draft')}</option>
+						</select>
+					{:else}
+						<input
+							type={extra.descriptor.type === 'date' ? 'date' : 'text'}
+							placeholder={extra.descriptor.placeholder}
+							bind:value={draftExtras[index]}
+							disabled={saving}
+						/>
+					{/if}
 				</label>
 			{/each}
 		</div>

package/dist/edit/chrome/LinkEdit.svelte.d.ts

@@ -29,7 +29,11 @@ interface Props {
     };
     /**
      * Extra property rows under Adreça — a menu link's Ordre. Labelled from
-     * their descriptors, committed on Desa only when changed.
+     * their descriptors, committed on Desa only when changed, and rendered
+     * BY TYPE: this used to be a bare text input whatever the descriptor
+     * said, which made it a second renderer that would silently miss any
+     * property type the package grew. An `image` row has no place in a link
+     * modal and is the one type refused here.
      */
     extras?: {
         descriptor: PropertyDescriptor;

package/dist/edit/chrome/PropertyRow.svelte

@@ -2,13 +2,16 @@
 	import { getUiConfig } from '../../config/context.js';
 	import type { ParameterlessKey } from '../../config/types.js';
 	import { getEditAdapter } from '../context.js';
+	import { commitState, propertyValue } from '../commit.svelte.js';
 	import type { PropertyDescriptor, PropertyValue } from '../types.js';
 
 	/**
 	 * One property of an EditPanel: label, a control by `descriptor.type`, and
-	 * its own commit lifecycle — Editable's state machine, panel-shaped. Each
-	 * row commits on change/blur independently; a failed save keeps the draft
-	 * in the control so nothing typed is lost.
+	 * its own commit lifecycle — literally Editable's now, through
+	 * `../commit.svelte.js`, where it used to be a second copy of the same
+	 * four states, the same follow-the-prop effect and the same three
+	 * announcements. Each row commits on change/blur independently; a failed
+	 * save keeps the draft in the control so nothing typed is lost.
 	 *
 	 * The row assumes an adapter with `saveProperty` exists — EditPanel only
 	 * renders when the frame's triple gate already established both.
@@ -34,61 +37,40 @@
 	/** A flag state's wording, from the same catalog the site renders. */
 	const wording = (key: ParameterlessKey): string => config.messages[key]?.() ?? key;
 
-	let status = $state<'idle' | 'dirty' | 'saving' | 'error'>('idle');
-	let announcement = $state('');
-	/** Last persisted value, what a failed draft is measured against. */
 	// svelte-ignore state_referenced_locally
-	let savedValue = $state(asText(value));
+	const commit_ = commitState(asText(value), config.editMessages);
 	// svelte-ignore state_referenced_locally
 	let draft = $state(asText(value));
 	let fileInput: HTMLInputElement | undefined = $state();
 
-	// Follow the prop only while idle — never repaint a held draft (the
-	// Editable rule).
-	// svelte-ignore state_referenced_locally
-	let lastPropValue = $state(asText(value));
 	$effect(() => {
-		const next = asText(value);
-		if (next !== lastPropValue) {
-			lastPropValue = next;
-			if (status === 'idle') {
-				savedValue = next;
-				draft = next;
-			}
-		}
+		const adopted = commit_.follow(asText(value));
+		if (adopted !== null) draft = adopted;
 	});
 
 	async function persist(next: PropertyValue): Promise<void> {
 		if (!adapter?.saveProperty) return;
-		status = 'saving';
-		announcement = config.editMessages.edit_saving();
-		try {
-			await adapter.saveProperty(descriptor, next);
-			savedValue = asText(next);
-			draft = asText(next);
-			status = 'idle';
-			announcement = config.editMessages.edit_saved();
-		} catch {
-			// Draft stays in the control; the editor decides whether to retry.
-			status = 'error';
-			announcement = config.editMessages.edit_saveError();
-		}
+		const landed = await commit_.commit(asText(next), () =>
+			adapter.saveProperty!(descriptor, next)
+		);
+		// Draft stays in the control on failure; the editor decides whether to
+		// retry. On success it takes the value the adapter actually stored.
+		if (landed) draft = asText(next);
 	}
 
 	function commit(): void {
 		const trimmed = draft.trim();
-		if (trimmed === savedValue) {
-			status = 'idle';
+		if (trimmed === commit_.saved) {
+			commit_.settle();
 			return;
 		}
 		if (descriptor.type === 'flag') {
-			void persist(trimmed === 'true');
+			void persist(propertyValue(descriptor, trimmed));
 			return;
 		}
 		if (trimmed === '') {
 			if (!descriptor.nullable) {
-				status = 'error';
-				announcement = config.editMessages.edit_emptyRequired();
+				commit_.refuse(config.editMessages.edit_emptyRequired());
 				return;
 			}
 			void persist(null);
@@ -98,20 +80,21 @@
 	}
 
 	function markDirty(): void {
-		if (status !== 'saving') status = 'dirty';
+		commit_.markDirty();
 	}
 
 	async function upload(event: Event): Promise<void> {
 		const file = (event.currentTarget as HTMLInputElement).files?.[0];
 		if (!file || !adapter?.uploadImage) return;
-		status = 'saving';
-		announcement = config.editMessages.edit_saving();
 		try {
-			const path = await adapter.uploadImage(descriptor, file);
-			await persist(path);
-		} catch {
-			status = 'error';
-			announcement = config.editMessages.edit_saveError();
+			// The upload and the write are ONE gesture to the editor, so the
+			// upload runs inside the same commit: a failed upload reports as a
+			// failed save, which is what it is from the panel's side.
+			await commit_.commit(asText(value), async () => {
+				const path = await adapter.uploadImage!(descriptor, file);
+				await adapter.saveProperty!(descriptor, path);
+				draft = asText(path);
+			});
 		} finally {
 			if (fileInput) fileInput.value = '';
 		}
@@ -127,7 +110,7 @@
 	{#if descriptor.type === 'select'}
 		<select
 			{id}
-			data-vit-editing={status}
+			data-vit-editing={commit_.status}
 			value={draft}
 			onchange={(event) => {
 				draft = event.currentTarget.value;
@@ -143,7 +126,7 @@
 		     (published/draft, open/closed), the adapter receives a boolean. -->
 		<select
 			{id}
-			data-vit-editing={status}
+			data-vit-editing={commit_.status}
 			value={draft}
 			onchange={(event) => {
 				draft = event.currentTarget.value;
@@ -154,13 +137,13 @@
 			<option value="false">{wording(descriptor.off ?? 'status_draft')}</option>
 		</select>
 	{:else if descriptor.type === 'image'}
-		{#if savedValue}
-			<img class="thumb" src={savedValue} alt="" />
+		{#if commit_.saved}
+			<img class="thumb" src={commit_.saved} alt="" />
 		{/if}
 		<input
 			{id}
 			type="text"
-			data-vit-editing={status}
+			data-vit-editing={commit_.status}
 			placeholder={descriptor.placeholder}
 			bind:value={draft}
 			oninput={markDirty}
@@ -183,7 +166,7 @@
 		<input
 			{id}
 			type={descriptor.type === 'date' ? 'date' : descriptor.type === 'url' ? 'url' : 'text'}
-			data-vit-editing={status}
+			data-vit-editing={commit_.status}
 			placeholder={descriptor.placeholder}
 			bind:value={draft}
 			oninput={markDirty}
@@ -191,7 +174,7 @@
 		/>
 	{/if}
 
-	{#if descriptor.nullable && savedValue !== ''}
+	{#if descriptor.nullable && commit_.saved !== ''}
 		<button
 			type="button"
 			class="aux"
@@ -204,7 +187,7 @@
 		</button>
 	{/if}
 
-	<span class="status" role="status">{announcement}</span>
+	<span class="status" role="status">{commit_.announcement}</span>
 </div>
 
 <style>

package/dist/edit/chrome/PropertyRow.svelte.d.ts

@@ -1,9 +1,11 @@
 import type { PropertyDescriptor, PropertyValue } from '../types.js';
 /**
  * One property of an EditPanel: label, a control by `descriptor.type`, and
- * its own commit lifecycle — Editable's state machine, panel-shaped. Each
- * row commits on change/blur independently; a failed save keeps the draft
- * in the control so nothing typed is lost.
+ * its own commit lifecycle — literally Editable's now, through
+ * `../commit.svelte.js`, where it used to be a second copy of the same
+ * four states, the same follow-the-prop effect and the same three
+ * announcements. Each row commits on change/blur independently; a failed
+ * save keeps the draft in the control so nothing typed is lost.
  *
  * The row assumes an adapter with `saveProperty` exists — EditPanel only
  * renders when the frame's triple gate already established both.

package/dist/edit/commit.svelte.d.ts

@@ -0,0 +1,58 @@
+import type { EditMessages } from '../config/edit-messages.js';
+import type { PropertyDescriptor, PropertyValue } from './types.js';
+/**
+ * The commit lifecycle of ONE editable value — the state machine
+ * `Editable` and `PropertyRow` both ran, in one place.
+ *
+ * They implemented it twice: the same four states, the same "follow the prop
+ * only while idle" effect with the same `lastPropValue` trick, and the same
+ * three announcements read from the same three message keys. The inline
+ * editor's suite covered one of them, so a bug in commit-or-rollback
+ * semantics had two homes and one test surface. `LinkEdit` is deliberately
+ * NOT a caller: a modal that batch-commits several halves and reports a
+ * partial failure is a different shape, not a simpler version of this one.
+ *
+ * Where the draft LIVES stays the caller's business — the DOM owns it for a
+ * `contenteditable`, a `$state` string owns it for a panel control — which is
+ * why this holds `saved` and the status but never the draft.
+ */
+export type CommitStatus = 'idle' | 'dirty' | 'saving' | 'error';
+export interface CommitState<T> {
+    /** What the affordance paints (`data-vit-editing`). */
+    readonly status: CommitStatus;
+    /** The visually hidden `role="status"` line. */
+    readonly announcement: string;
+    /** The last persisted value: what a revert restores and a commit diffs against. */
+    readonly saved: T;
+    /** Typing began. Never overrides an in-flight save. */
+    markDirty(): void;
+    /** Back to rest without a write — an unchanged draft. */
+    settle(): void;
+    /** Escape: back to rest AND silent, the announcement withdrawn with the draft. */
+    revert(): void;
+    /** Refuse before any write, with its own reason (an emptied required field). */
+    refuse(announcement: string): void;
+    /**
+     * Runs one write. Announces each phase, advances `saved` on success, and
+     * leaves the state at `'error'` on rejection so the caller's draft can stay
+     * on screen. Answers whether it landed.
+     */
+    commit(next: T, write: () => Promise<void>): Promise<boolean>;
+    /**
+     * Adopt a value the app reloaded underneath us — and only while idle.
+     * Diffing against `saved` instead would fire after every save, where
+     * `saved` has legitimately advanced past the prop, and repaint the
+     * committed draft with stale copy. Never over a draft being held.
+     *
+     * Answers the value the caller should render, or `null` for "leave it".
+     */
+    follow(next: T): T | null;
+}
+export declare function commitState<T>(initial: T, messages: EditMessages): CommitState<T>;
+/**
+ * A control's string draft as the value the ADAPTER takes. Every control's
+ * state is text — a flag's boolean rides as `'true'`/`'false'` in its
+ * `<select>` — and this is the one place it becomes a boolean again, so the
+ * panel row and the link modal cannot disagree about the boundary.
+ */
+export declare function propertyValue(descriptor: PropertyDescriptor, draft: string): PropertyValue;

package/dist/edit/commit.svelte.js

@@ -0,0 +1,70 @@
+export function commitState(initial, messages) {
+    let status = $state('idle');
+    let announcement = $state('');
+    let saved = $state(initial);
+    let lastProp = $state(initial);
+    return {
+        get status() {
+            return status;
+        },
+        get announcement() {
+            return announcement;
+        },
+        get saved() {
+            return saved;
+        },
+        markDirty() {
+            if (status !== 'saving')
+                status = 'dirty';
+        },
+        settle() {
+            status = 'idle';
+        },
+        revert() {
+            status = 'idle';
+            announcement = '';
+        },
+        refuse(next) {
+            status = 'error';
+            announcement = next;
+        },
+        async commit(next, write) {
+            status = 'saving';
+            announcement = messages.edit_saving();
+            try {
+                await write();
+                saved = next;
+                // `lastProp` is NOT advanced here: it tracks the last PROP value
+                // seen, and a save does not change the prop. Advancing it made an
+                // unchanged prop look like a reload on the next effect run, which
+                // then restored the pre-save value over the committed one.
+                status = 'idle';
+                announcement = messages.edit_saved();
+                return true;
+            }
+            catch {
+                status = 'error';
+                announcement = messages.edit_saveError();
+                return false;
+            }
+        },
+        follow(next) {
+            if (next === lastProp)
+                return null;
+            lastProp = next;
+            if (status !== 'idle')
+                return null;
+            saved = next;
+            return next;
+        }
+    };
+}
+/**
+ * A control's string draft as the value the ADAPTER takes. Every control's
+ * state is text — a flag's boolean rides as `'true'`/`'false'` in its
+ * `<select>` — and this is the one place it becomes a boolean again, so the
+ * panel row and the link modal cannot disagree about the boundary.
+ */
+export function propertyValue(descriptor, draft) {
+    return descriptor.type === 'flag' ? draft === 'true' : draft;
+}

package/dist/index.d.ts

@@ -6,4 +6,4 @@ export * from './admin.js';
 export * from './forms/index.js';
 export * from './config/index.js';
 export * from './edit/index.js';
-export { buildQueryString, isPathUnder } from './utils/paths.js';
+export { buildQueryString, isExternalUrl, isInternalPath, isPathUnder } from './utils/paths.js';

package/dist/index.js

@@ -13,4 +13,4 @@ export * from './forms/index.js';
 export * from './config/index.js';
 export * from './edit/index.js';
 // Path utilities shared with host apps.
-export { buildQueryString, isPathUnder } from './utils/paths.js';
+export { buildQueryString, isExternalUrl, isInternalPath, isPathUnder } from './utils/paths.js';

package/dist/utils/paths.d.ts

@@ -6,3 +6,27 @@ export declare function isPathUnder(pathname: string, prefix: string): boolean;
  * mirrors and the hrefs it renders are spelled by the same function.
  */
 export declare function buildQueryString(params: Record<string, string | null | undefined>): string;
+/**
+ * Whether a destination is a ROOT-RELATIVE path — the only shape `Link` will
+ * resolve, and what "internal" means everywhere in this package.
+ *
+ * One leading slash, and the second character must not be another slash:
+ * '//evil.example' is protocol-relative and leaves the site. A bare scheme is
+ * not a path either, so 'javascript:alert(1)' fails here — which is the point.
+ */
+export declare function isInternalPath(href: string): boolean;
+/**
+ * Whether a destination is an EXTERNAL URL this package is willing to emit.
+ *
+ * An allow-list, not a deny-list, and it is the reason this function exists
+ * rather than a `!isInternalPath` at each call site: the classifier it
+ * replaced accepted ANY scheme followed by '//', so a scheme WITHOUT one —
+ * 'javascript:alert(1)' — fell through to the internal branch and reached the
+ * locale resolver, which returns it verbatim into an <a href>.
+ *
+ * Protocol-relative ('//host/path') stays external on purpose: it is another
+ * origin, so localizing it would splice a locale segment into someone else's
+ * URL, and it carries the page's own scheme rather than a new one. What is
+ * excluded is every scheme that is not http(s) — which is where the harm was.
+ */
+export declare function isExternalUrl(href: string): boolean;

package/dist/utils/paths.js

@@ -16,3 +16,31 @@ export function buildQueryString(params) {
     const encoded = search.toString();
     return encoded ? `?${encoded}` : '';
 }
+/**
+ * Whether a destination is a ROOT-RELATIVE path — the only shape `Link` will
+ * resolve, and what "internal" means everywhere in this package.
+ *
+ * One leading slash, and the second character must not be another slash:
+ * '//evil.example' is protocol-relative and leaves the site. A bare scheme is
+ * not a path either, so 'javascript:alert(1)' fails here — which is the point.
+ */
+export function isInternalPath(href) {
+    return /^\/([^/]|$)/.test(href);
+}
+/**
+ * Whether a destination is an EXTERNAL URL this package is willing to emit.
+ *
+ * An allow-list, not a deny-list, and it is the reason this function exists
+ * rather than a `!isInternalPath` at each call site: the classifier it
+ * replaced accepted ANY scheme followed by '//', so a scheme WITHOUT one —
+ * 'javascript:alert(1)' — fell through to the internal branch and reached the
+ * locale resolver, which returns it verbatim into an <a href>.
+ *
+ * Protocol-relative ('//host/path') stays external on purpose: it is another
+ * origin, so localizing it would splice a locale segment into someone else's
+ * URL, and it carries the page's own scheme rather than a new one. What is
+ * excluded is every scheme that is not http(s) — which is where the harm was.
+ */
+export function isExternalUrl(href) {
+    return /^(?:https?:)?\/\/[^/]/i.test(href);
+}

package/package.json

@@ -1,12 +1,14 @@
 {
 	"name": "@vit-foundation/ui",
-	"version": "0.16.0",
+	"version": "0.18.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build && npm run prepack",
 		"preview": "vite preview",
 		"prepare": "svelte-kit sync || echo ''",
 		"prepack": "svelte-kit sync && svelte-package && publint",
+		"_comment:prepublishOnly": "Publishing is MANUAL (the release workflow has no NPM_TOKEN and fails on every tag), so the gate belongs on the command that actually publishes. npm runs this before prepack.",
+		"prepublishOnly": "npm run lint && npm run check && npm run test:unit -- --run",
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
 		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
 		"format": "prettier --write .",