Fix some zod-transform-socials parsing issues

Author: essential-randomness

.changeset/social-bsky-handles.md

@@ -0,0 +1,10 @@
+---
+"@fujocoded/zod-transform-socials": patch
+---
+
+Tighten and extend Bluesky profile URL matching. The `bsky.app`/`bsky.social`
+profile form now validates the handle as a real domain and additionally
+recognizes DID handles such as `did:plc:…` and `did:web:…`.
+
+Also escapes the literal dots in every platform's match pattern so lookalike
+hosts no longer match by accident.

.changeset/social-npm-unscoped.md

@@ -0,0 +1,7 @@
+---
+"@fujocoded/zod-transform-socials": patch
+---
+
+Recognize unscoped npm packages. The npm match previously required a scope, so
+URLs like `npmjs.com/package/social-links` fell through to `custom`; they now
+resolve to the `npm` platform. Underscores are also accepted in package names.

package-lock.json

@@ -48,6 +48,7 @@
   },
   "scripts": {
     "build": "tsup src/index.ts src/zod4.ts --format cjs,esm --dts --clean",
+    "test": "vitest",
     "test:compat": "npm run build && node --experimental-strip-types scripts/check-compat.ts",
     "typecheck": "tsc --noEmit",
     "validate": " npx publint"
@@ -59,6 +60,7 @@
     "@types/node": "^22.0.0",
     "tsup": "^8.1.0",
     "typescript": "^5.5.2",
+    "vitest": "^3.0.5",
     "zod": "^3.25.76"
   },
   "peerDependencies": {

zod-transform-socials/package.json

@@ -20,6 +20,12 @@ export type DomainShortcuts = {
 const escapeForRegex = (input: string) =>
   input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
+const DOMAIN_LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+const HANDLE = `${DOMAIN_LABEL}(?:\\.${DOMAIN_LABEL})+`;
+// Bluesky profile URLs accept a DID in place of a handle, e.g.
+// `bsky.app/profile/did:plc:abc123` or `did:web:example.com`.
+const DID = "did:[a-z]+:[a-zA-Z0-9._:%-]*[a-zA-Z0-9._-]";
+
 export type CreateSocialLinksConfig = {
   /**
    * Register extra domains against a platform with a known URL shape
@@ -33,81 +39,81 @@ export const createSocialLinks = (config: CreateSocialLinksConfig = {}) => {
 
   const tumblrMatches: ProfileMatch[] = [
     {
-      match: "https?://www.tumblr.com/([a-z0-9-]+)/?.*",
+      match: "https?://www\\.tumblr\\.com/([a-z0-9-]+)/?.*",
       // TODO: more may be necessary for things like extracting usernames
       group: 1,
     },
     // Must be last because it's a more general match, or www will be as a username
     {
-      match: "https?://([a-z0-9-]+).tumblr.com/?.*",
+      match: "https?://([a-z0-9-]+)\\.tumblr\\.com/?.*",
       // TODO: more may be necessary for things like extracting usernames
       group: 1,
     },
   ];
   socialLinks.addProfile("tumblr", tumblrMatches);
   const kofiMatches: ProfileMatch[] = [
     {
-      match: "https?://ko-fi.com/([a-z0-9-_]+)",
+      match: "https?://ko-fi\\.com/([a-z0-9-_]+)",
       group: 1,
     },
   ];
   socialLinks.addProfile("ko-fi", kofiMatches);
 
   const inprntMatches: ProfileMatch[] = [
     {
-      match: "https?://(?:www.)?inprnt.com/gallery/([a-z0-9-]+)/?",
+      match: "https?://(?:www\\.)?inprnt\\.com/gallery/([a-z0-9-]+)/?",
       group: 1,
     },
   ];
   socialLinks.addProfile("inprnt", inprntMatches);
 
   const neocitiesMatches: ProfileMatch[] = [
     {
-      match: "https?://([a-z0-9-]+).neocities.org",
+      match: "https?://([a-z0-9-]+)\\.neocities\\.org",
       group: 1,
     },
   ];
   socialLinks.addProfile("neocities", neocitiesMatches);
 
   const blueSkyMatches: ProfileMatch[] = [
     {
-      match: "https?://([a-z0-9-]+).bsky.(?:app|social)/?.*",
+      match: "https?://([a-z0-9-]+)\\.bsky\\.(?:app|social)/?.*",
       group: 1,
     },
     {
-      match: "https?://bsky.(?:app|social)/profile/([a-z0-9-.]+)/?.*",
+      match: `https?://bsky\\.(?:app|social)/profile/(${HANDLE}|${DID})/?.*`,
       group: 1,
     },
   ];
-  socialLinks.addProfile("bsky", blueSkyMatches);
+  replaceMatches(socialLinks, "bsky", blueSkyMatches);
 
   const ao3Matches: ProfileMatch[] = [
     {
-      match: "https?://archiveofourown.org/users/([a-z0-9-]+)",
+      match: "https?://archiveofourown\\.org/users/([a-z0-9-]+)",
       group: 1,
     },
   ];
   socialLinks.addProfile("archiveofourown", ao3Matches);
 
   const dreamwidthMatches: ProfileMatch[] = [
     {
-      match: "https?://([a-z0-9-]+).dreamwidth.org",
+      match: "https?://([a-z0-9-]+)\\.dreamwidth\\.org",
       group: 1,
     },
   ];
   socialLinks.addProfile("dreamwidth", dreamwidthMatches);
 
   const furaffinityMatches: ProfileMatch[] = [
     {
-      match: "https?://www.furaffinity.net/user/([a-z0-9-]+)",
+      match: "https?://www\\.furaffinity\\.net/user/([a-z0-9-]+)",
       group: 1,
     },
   ];
   socialLinks.addProfile("furaffinity", furaffinityMatches);
 
   const carrdMatches: ProfileMatch[] = [
     {
-      match: "https?://([a-z0-9-]+).carrd.co/?",
+      match: "https?://([a-z0-9-]+)\\.carrd\\.co/?",
       group: 1,
     },
   ];
@@ -116,16 +122,19 @@ export const createSocialLinks = (config: CreateSocialLinksConfig = {}) => {
   const kickstarterMatches: ProfileMatch[] = [
     {
       // https://www.kickstarter.com/projects/essential-randomness/the-fujoshi-guide-to-web-development
-      match: "https?://www.kickstarter.com/projects/[a-z0-9-]+/([a-z0-9-]+)/?",
+      match:
+        "https?://www\\.kickstarter\\.com/projects/[a-z0-9-]+/([a-z0-9-]+)/?",
       group: 1,
     },
   ];
   socialLinks.addProfile("kickstarter", kickstarterMatches);
 
   const npmMatches: ProfileMatch[] = [
     {
-      // https://www.npmjs.com/package/@bobaboard/ao3.js
-      match: "https?://www.npmjs.com/package/([a-z0-9-@]+/[a-z0-9-\\.]+)/?",
+      // Scoped and unscoped packages, e.g.
+      // `npmjs.com/package/@bobaboard/ao3.js` or `npmjs.com/package/social-links`.
+      match:
+        "https?://www\\.npmjs\\.com/package/((?:@[a-z0-9-._]+/)?[a-z0-9-._]+)/?",
       group: 1,
     },
   ];
@@ -137,20 +146,20 @@ export const createSocialLinks = (config: CreateSocialLinksConfig = {}) => {
   const gitHubMatches: ProfileMatch[] = [
     {
       // https://github.com/FujoWebDev/AO3.js
-      match: "https?://github.com/([a-z0-9-]+/[a-z0-9-\\.]+)/?",
+      match: "https?://github\\.com/([a-z0-9-]+/[a-z0-9-\\.]+)/?",
       group: 1,
     },
     {
       // https://github.com/orgs/FujoWebDev/
-      match: "https?://github.com/orgs/([a-z0-9-]+)/?",
+      match: "https?://github\\.com/orgs/([a-z0-9-]+)/?",
       group: 1,
     },
   ];
   appendMatches(socialLinks, "github", gitHubMatches);
 
   const xMatches: ProfileMatch[] = [
     {
-      match: "(?:https?://)?(?:www.)?x.com/@?([a-z0-9-\\.]+)/?.*",
+      match: "(?:https?://)?(?:www\\.)?x\\.com/@?([a-z0-9-\\.]+)/?.*",
       group: 1,
     },
   ];
@@ -178,6 +187,15 @@ const appendMatches = (
   socialLinks.profiles.set(platform, [...existing, ...matches]);
 };
 
+const replaceMatches = (
+  socialLinks: SocialLinksLib,
+  platform: string,
+  matches: ProfileMatch[],
+) => {
+  // @ts-expect-error profiles is private on SocialLinks
+  socialLinks.profiles.set(platform, matches);
+};
+
 // This top-level call is safe even under `"sideEffects": false` in package.json
 // because the logic in `createSocialLinks` only mutates the returned
 //  object, and doesn't touch anything observable from outside the package.

zod-transform-socials/src/social-links.ts

@@ -0,0 +1,129 @@
+import { describe, expect, test } from "vitest";
+import { transformSocial, createTransformSocial } from "../src/transform.ts";
+import { socialLinks } from "../src/social-links.ts";
+
+describe("Bluesky: bsky.app/social profile URLs", () => {
+  test("extracts a domain handle and tags the platform + icon", () => {
+    expect(
+      transformSocial("https://bsky.app/profile/fujoweb.dev/post/3abc"),
+    ).toEqual({
+      url: "https://bsky.app/profile/fujoweb.dev/post/3abc",
+      platform: "bsky",
+      username: "fujoweb.dev",
+      icon: "simple-icons:bluesky",
+    });
+  });
+
+  test("matches bsky.social as well as bsky.app", () => {
+    const result = transformSocial("https://bsky.social/profile/fujoweb.dev");
+    expect(result.platform).toBe("bsky");
+    expect(result.username).toBe("fujoweb.dev");
+  });
+
+  test("normalizes uppercase URLs before matching", () => {
+    const result = transformSocial("https://BSKY.APP/profile/FujoWeb.Dev");
+    expect(result.platform).toBe("bsky");
+    expect(result.username).toBe("fujoweb.dev");
+  });
+
+  test("accepts multi-label handles", () => {
+    expect(
+      transformSocial("https://bsky.app/profile/boba-tan.staging.bsky.dev")
+        .username,
+    ).toBe("boba-tan.staging.bsky.dev");
+  });
+});
+
+describe("Bluesky: subdomain profile URLs", () => {
+  test("extracts the subdomain as the username", () => {
+    const result = transformSocial("https://fujoweb.bsky.app");
+    expect(result.platform).toBe("bsky");
+    expect(result.username).toBe("fujoweb");
+  });
+
+  test("works for the bsky.social subdomain form too", () => {
+    const result = transformSocial("https://fujoweb.bsky.social/some/path");
+    expect(result.platform).toBe("bsky");
+    expect(result.username).toBe("fujoweb");
+  });
+});
+
+describe("Bluesky: invalid handles fall through to `custom`", () => {
+  test("rejects handles with consecutive dots", () => {
+    expect(
+      transformSocial("https://bsky.app/profile/bad..handle").platform,
+    ).toBe("custom");
+  });
+
+  test("rejects single-label handles (HANDLE requires a dot)", () => {
+    expect(transformSocial("https://bsky.app/profile/fujoweb").platform).toBe(
+      "custom",
+    );
+  });
+
+  test("rejects handles with a leading hyphen in a label", () => {
+    expect(transformSocial("https://bsky.app/profile/-bad.dev").platform).toBe(
+      "custom",
+    );
+  });
+
+  test("does not match an unescaped-dot lookalike host", () => {
+    expect(
+      transformSocial("https://bskyyapp/profile/fujoweb.dev").platform,
+    ).toBe("custom");
+  });
+});
+
+describe("Bluesky: DID profile URLs", () => {
+  test("recognizes a did:plc handle", () => {
+    expect(transformSocial("https://bsky.app/profile/did:plc:b0b474n")).toEqual(
+      {
+        url: "https://bsky.app/profile/did:plc:b0b474n",
+        platform: "bsky",
+        username: "did:plc:b0b474n",
+        icon: "simple-icons:bluesky",
+      },
+    );
+  });
+
+  test("recognizes a did:web handle", () => {
+    const result = transformSocial(
+      "https://bsky.app/profile/did:web:example.com",
+    );
+    expect(result.platform).toBe("bsky");
+    expect(result.username).toBe("did:web:example.com");
+  });
+
+  // The DID pattern mirrors `@atproto/syntax`'s `ensureValidDidRegex`, which
+  // allows upper-case ASCII in the method-specific identifier (for `did:web`
+  // hosts and percent-encoding). Since this library lowercases profiles by
+  //default, however, going directly through the common entry point would
+  // make it impossible to test this case.
+  // This is here to future proof and make sure that the uppercase remains
+  // valid, even if we stop lowercasing.
+  test("matches a mixed-case did:web via the raw case-sensitive matcher", () => {
+    const url = "https://bsky.app/profile/did:web:FujoWeb.dev";
+    expect(socialLinks.detectProfile(url)).toBe("bsky");
+    expect(socialLinks.getProfileId("bsky", url)).toBe("did:web:FujoWeb.dev");
+  });
+
+  // The trailing-character anchor (`[a-zA-Z0-9._-]$`) forbids a DID ending in
+  // `:` or `%`, so the matcher trims a stray trailing colon off the username.
+  test("does not capture a trailing colon as part of the DID", () => {
+    expect(
+      transformSocial("https://bsky.app/profile/did:plc:abc123:").username,
+    ).toBe("did:plc:abc123");
+  });
+});
+
+describe("Bluesky via createTransformSocial", () => {
+  test("a freshly created transformer matches Bluesky identically", () => {
+    const { transformSocial: scoped } = createTransformSocial();
+    expect(scoped("https://bsky.app/profile/fujoweb.dev")).toEqual({
+      url: "https://bsky.app/profile/fujoweb.dev",
+      platform: "bsky",
+      username: "fujoweb.dev",
+      icon: "simple-icons:bluesky",
+    });
+  });
+});