@farm.js/federation 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/config.js

@@ -127,7 +127,7 @@ function normalizeRemoteAlias(value) {
 function normalizeRemoteEntry(value, alias) {
     const entry = nonEmptyString(value, `Federation remote ${alias} entry`);
     if (entry.startsWith("/")) {
-        if (entry.startsWith("//") || entry.includes("\\")) {
+        if (entry.startsWith("//") || entry.includes("\\") || !hasBrowserStablePathname(entry)) {
             throw new TypeError(`Federation remote ${alias} entry must be a root-relative URL, not a network-path URL`);
         }
         return entry;
@@ -177,7 +177,7 @@ function normalizeOutputFile(value) {
     if (value.includes("\\") ||
         value.includes("?") ||
         value.includes("#") ||
-        segments.some((segment) => !segment || segment === "." || segment === "..") ||
+        segments.some((segment) => !isBrowserStablePathSegment(segment)) ||
         !/\.m?js$/i.test(filename)) {
         throw new TypeError("Federation filename must be a safe relative .js or .mjs path");
     }
@@ -190,7 +190,9 @@ function optionalPublicPath(value) {
     if (publicPath === "auto")
         return publicPath;
     if (publicPath.startsWith("/")) {
-        if (publicPath.startsWith("//") || publicPath.includes("\\")) {
+        if (publicPath.startsWith("//") ||
+            publicPath.includes("\\") ||
+            !hasBrowserStablePathname(publicPath)) {
             throw new TypeError("Federation publicPath must be a root-relative URL, not a network-path URL");
         }
         return publicPath;
@@ -212,6 +214,26 @@ function optionalPublicPath(value) {
     }
     return parsed.href;
 }
+function hasBrowserStablePathname(value) {
+    const pathname = value.split(/[?#]/, 1)[0] || "/";
+    return pathname.split("/").every((segment) => !segment || isBrowserStablePathSegment(segment));
+}
+function isBrowserStablePathSegment(segment) {
+    if (!segment)
+        return false;
+    let decoded = segment;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        // Malformed escapes remain literal in browser pathnames.
+    }
+    return (decoded !== "." &&
+        decoded !== ".." &&
+        !decoded.includes("/") &&
+        !decoded.includes("\\") &&
+        !hasControlCharacter(decoded));
+}
 function booleanOption(value, label) {
     if (value !== undefined && typeof value !== "boolean") {
         throw new TypeError(`Federation ${label} must be a boolean`);

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { type FederationOptions, type FederationRemote, type FederationSharedOptions, type FederationSharedPackage, type FederationSharedPackages } from "./config.js";
 export type { FederationOptions, FederationRemote, FederationSharedOptions, FederationSharedPackage, FederationSharedPackages, };
 /** Publish and consume independently deployed browser modules from a Farm application. */
-export declare function federation(options: FederationOptions): import("@farm.js/core/plugin").FarmPlugin<undefined, Record<string, never>, unknown, undefined, unknown, false>;
+export declare function federation(options: FederationOptions): import("@farm.js/core/plugin").FarmPlugin<undefined, Record<string, never>, unknown, undefined, unknown, false, import("@farm.js/core/plugin").PluginRoutes>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,mHAyBpD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,GACzB,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,gKAyBpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/federation",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.2",
   "description": "Client-side Module Federation for Farm.js applications",
   "keywords": [
     "farm.js",
@@ -37,7 +37,7 @@
   "dependencies": {
     "@module-federation/runtime": "^2.9.0",
     "@module-federation/vite": "^1.21.6",
-    "@farm.js/core": "0.1.0-beta.92"
+    "@farm.js/core": "0.1.1"
   },
   "devDependencies": {
     "@types/node": "^20.10.5",