Refactor validation logic to lazily initialize TypeBox compiler, improving performance in CSP-restricted environments.

.changeset/worker-safe-validator.md

@@ -0,0 +1,5 @@
+---
+"@opral/zettel-ast": minor
+---
+
+Use a lazy, Cloudflare-safe validator fallback (TypeBox Value.Check) to avoid eval in restricted environments. See https://github.com/sinclairzx81/typebox/issues/1095.

packages/zettel-ast/src/validate.test.ts

@@ -0,0 +1,51 @@
+import { expect, test, vi } from "vitest";
+
+const exampleDoc = {
+	type: "zettel_doc",
+	content: [
+		{
+			type: "zettel_text_block",
+			zettel_key: "4ee4134378b1",
+			style: "zettel_normal",
+			children: [
+				{
+					type: "zettel_span",
+					zettel_key: "e60571e00344",
+					text: "Hello world",
+					marks: [],
+				},
+			],
+		},
+	],
+};
+
+test("compiles lazily on first validate call", async () => {
+	vi.resetModules();
+	const { TypeCompiler } = await import("@sinclair/typebox/compiler");
+	const compileSpy = vi.spyOn(TypeCompiler, "Compile");
+	const { validate } = await import("./validate.js");
+
+	expect(compileSpy).not.toHaveBeenCalled();
+	validate(exampleDoc);
+	expect(compileSpy).toHaveBeenCalledTimes(1);
+
+	compileSpy.mockRestore();
+});
+
+test("falls back to dynamic checks when compile is blocked", async () => {
+	vi.resetModules();
+	const { TypeCompiler } = await import("@sinclair/typebox/compiler");
+	const compileSpy = vi
+		.spyOn(TypeCompiler, "Compile")
+		.mockImplementation(() => {
+			throw new Error("Eval disabled");
+		});
+	const { validate } = await import("./validate.js");
+
+	const result = validate(exampleDoc);
+
+	expect(compileSpy).toHaveBeenCalledTimes(1);
+	expect(result.errors).toBeUndefined();
+
+	compileSpy.mockRestore();
+});

packages/zettel-ast/src/validate.ts

@@ -1,7 +1,31 @@
-import { TypeCompiler } from "@sinclair/typebox/compiler";
+import { TypeCompiler, TypeCheck } from "@sinclair/typebox/compiler";
+import { Value } from "@sinclair/typebox/value";
 import { ZettelDocJsonSchema, type ZettelDoc } from "./schema.js";
 
-const Z = TypeCompiler.Compile(ZettelDocJsonSchema);
+// Lazily initialize to avoid evaluating TypeBox's compiler at module load in
+// CSP-restricted runtimes (e.g. Cloudflare Workers).
+let cachedValidator: TypeCheck<typeof ZettelDocJsonSchema> | undefined;
+
+function getValidator() {
+	if (cachedValidator) {
+		return cachedValidator;
+	}
+
+	try {
+		// Prefer compiled validator for speed when eval is permitted.
+		cachedValidator = TypeCompiler.Compile(ZettelDocJsonSchema);
+	} catch {
+		// Fall back to dynamic checking when code generation is blocked.
+		cachedValidator = new TypeCheck(
+			ZettelDocJsonSchema,
+			[],
+			(value) => Value.Check(ZettelDocJsonSchema, value),
+			""
+		);
+	}
+
+	return cachedValidator;
+}
 
 export type SerializableError = { message: string };
 
@@ -29,9 +53,10 @@ export type ValidationResult<T> =
  *   }
  */
 export function validate(zettel: unknown): ValidationResult<ZettelDoc> {
-	const result = Z.Check(zettel);
+	const validator = getValidator();
+	const result = validator.Check(zettel);
 	if (!result) {
-		const errors = [...Z.Errors(zettel)];
+		const errors = [...validator.Errors(zettel)];
 		return {
 			success: false,
 			data: undefined,