perf: keep valibot out of production client bundles (#869)

Author: harlan-zw

packages/script/src/runtime/registry/_gcm-consent.ts

@@ -1,14 +1,48 @@
 importtype{ConsentState,GcmConsentApi,UseScriptContext}from'../types'
-import{safeParse,strictObject}from'valibot'
 import{logger}from'../logger'
-import{gcmConsentState}from'./schemas'
 
 exporttype{GcmConsentApi}
 
-// Strict variant rebuilt from the lenient schema's entries — same shape, but
-// unknown keys produce issues so we can warn on typos without breaking the
-// lenient `defaultConsent` schema parse used at build time.
-constgcmConsentStateStrict=strictObject(gcmConsentState.entries)
+// GCMv2 consent categories. Every entry takes `granted` or `denied`.
+constCONSENT_CATEGORIES=[
+'ad_storage',
+'ad_user_data',
+'ad_personalization',
+'analytics_storage',
+'functionality_storage',
+'personalization_storage',
+'security_storage',
+]asconstsatisfiesreadonly(keyofConsentState)[]
+
+constCONSENT_CATEGORY_KEYS: ReadonlySet<string>=newSet(CONSENT_CATEGORIES)
+
+// Fails to compile if `ConsentState` grows a key this validator does not know about.
+typeAssertNever<Textendsnever>=T
+type_ConsentKeysChecked=AssertNever<Exclude<keyofConsentState,typeofCONSENT_CATEGORIES[number]|'wait_for_update'|'region'>>
+
+/**
+ * Describe what is wrong with one consent entry, or return `null` when it is valid.
+ * The canonical schema stays lenient so unknown keys pass a schema parse; here we
+ * reject them, because an unknown key is almost always a typo the user wants to see.
+ */
+functiondescribeConsentIssue(key: string,value: unknown): string|null{
+if(CONSENT_CATEGORY_KEYS.has(key)){
+returnvalue==='granted'||value==='denied'
+ ? null
+ : `"${key}" must be "granted" or "denied", received ${JSON.stringify(value)}`
+}
+if(key==='wait_for_update'){
+returntypeofvalue==='number'&&Number.isFinite(value)
+ ? null
+ : `"wait_for_update" must be a number, received ${JSON.stringify(value)}`
+}
+if(key==='region'){
+returnArray.isArray(value)&&value.every(entry=>typeofentry==='string')
+ ? null
+ : `"region" must be an array of strings, received ${JSON.stringify(value)}`
+}
+return`unknown key "${key}"`
+}
 
 /**
  * GCMv2 consent contract returned by registry scripts (GA, GTM, future Google Ads, …).
@@ -21,11 +55,15 @@ export interface GcmConsentContract {
 
 /** Validate a partial GCMv2 consent state. Logs each issue via the registry-scoped logger. */
 exportfunctionvalidateConsentState(log: typeoflogger,state: ConsentState,source: string){
-constresult=safeParse(gcmConsentStateStrict,state)
-if(result.success)
+if(state===null||typeofstate!=='object'){
+log.warn(`${source}: consent state must be an object, received ${JSON.stringify(state)}`)
 return
-for(constissueofresult.issues)
-log.warn(`${source}: ${issue.message} (path: ${issue.path?.map(p=>p.key).join('.')||'<root>'})`)
+}
+for(constkeyinstate){
+constissue=describeConsentIssue(key,(stateasRecord<string,unknown>)[key])
+if(issue)
+log.warn(`${source}: ${issue}`)
+}
 }
 
 exportfunctionattachGcmConsent(

packages/script/src/runtime/registry/speedcurve.ts

@@ -1,4 +1,5 @@
 importtype{LuxGlobal,UserConfig}from'@speedcurve/lux'
+importtype{InferInput}from'valibot'
 importtype{RouteLocationNormalized}from'vue-router'
 importtype{RegistryScriptInput,UseScriptContext}from'#nuxt-scripts/types'
 import{useHead,useNuxtApp,useRouter}from'nuxt/app'
@@ -25,10 +26,28 @@ export type SpeedCurveInput = Omit<RegistryScriptInput<typeof SpeedCurveOptions>
 label?: string|((to: RouteLocationNormalized)=>string|false)|false
 }
 
-// Derived from the schema: all schema keys except the composable-only ones.
-constLUX_USER_CONFIG_KEYS=Object.keys(SpeedCurveOptions.entries).filter(
-k=>k!=='id'&&k!=='autoTrackSpaNavigations'&&k!=='spaMode',
-)as(keyofUserConfig)[]
+/** Schema keys consumed by `useScriptSpeedCurve` itself, never forwarded to LUX. */
+typeComposableOnlyKey='id'|'spaMode'|'autoTrackSpaNavigations'
+typeForwardedKey=Exclude<keyofInferInput<typeofSpeedCurveOptions>,ComposableOnlyKey>
+
+// Listed rather than derived from `SpeedCurveOptions.entries`, so a production build
+// drops the schema and valibot with it. The type guards below fail to compile if this
+// list and the schema drift apart.
+constLUX_USER_CONFIG_KEYS=[
+'label',
+'samplerate',
+'sendBeaconOnPageHidden',
+'trackErrors',
+'maxErrors',
+'minMeasureTime',
+'maxMeasureTime',
+'newBeaconOnPageShow',
+'trackHiddenPages',
+'cookieDomain',
+]asconstsatisfiesreadonly(ForwardedKey&keyofUserConfig)[]
+
+typeAssertNever<Textendsnever>=T
+type_AllForwardedKeysListed=AssertNever<Exclude<ForwardedKey,typeofLUX_USER_CONFIG_KEYS[number]>>
 
 letluxWired=false
 letteardownAutoTracker=()=>{}

test/unit/gcm-consent.test.ts

@@ -0,0 +1,53 @@
+importtype{ConsentState}from'../../packages/script/src/runtime/types'
+import{describe,expect,it,vi}from'vitest'
+import{validateConsentState}from'../../packages/script/src/runtime/registry/_gcm-consent'
+
+functioncollectWarnings(state: unknown): string[]{
+constwarn=vi.fn()
+validateConsentState({ warn }asany,stateasConsentState,'consent.update()')
+returnwarn.mock.calls.map(([message])=>messageasstring)
+}
+
+describe('validateConsentState',()=>{
+it('accepts a valid partial GCMv2 state',()=>{
+expect(collectWarnings({
+ad_storage: 'granted',
+analytics_storage: 'denied',
+wait_for_update: 500,
+region: ['AU','NZ'],
+})).toEqual([])
+})
+
+it('warns once per unknown key',()=>{
+constwarnings=collectWarnings({analytics_storages: 'granted',ad_storag: 'denied'})
+expect(warnings).toHaveLength(2)
+expect(warnings[0]).toContain('analytics_storages')
+expect(warnings[1]).toContain('ad_storag')
+})
+
+it('warns on a consent value outside granted/denied',()=>{
+constwarnings=collectWarnings({ad_storage: 'allow'})
+expect(warnings).toHaveLength(1)
+expect(warnings[0]).toContain('ad_storage')
+expect(warnings[0]).toContain('"allow"')
+})
+
+it('warns when wait_for_update is not a number',()=>{
+expect(collectWarnings({wait_for_update: '500'})[0]).toContain('wait_for_update')
+expect(collectWarnings({wait_for_update: Number.NaN})[0]).toContain('wait_for_update')
+})
+
+it('warns when region is not an array of strings',()=>{
+expect(collectWarnings({region: 'AU'})[0]).toContain('region')
+expect(collectWarnings({region: ['AU',2]})[0]).toContain('region')
+})
+
+it('warns when the state is not an object',()=>{
+expect(collectWarnings(null)[0]).toContain('must be an object')
+expect(collectWarnings('granted')[0]).toContain('must be an object')
+})
+
+it('reports the calling source in each warning',()=>{
+expect(collectWarnings({nope: 'granted'})[0]).toContain('consent.update()')
+})
+})