@farm.js/scripts 0.1.0-beta.0 → 0.1.0-beta.1

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EAId,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAyBpB,qBAAa,sBAAuB,SAAQ,KAAK;IACtC,IAAI,SAA4B;CAC1C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,SAA8B;CAC5C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAGjD,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAHlB,IAAI,SAAgC;gBAElC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAM5B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM;IAHb,IAAI,SAAqB;gBAEvB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM;CAIvB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAHnB,IAAI,SAAwB;gBAE1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM;CAI7B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAG/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAHpB,IAAI,SAA8B;gBAEhC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM;CAM9B;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,CA0CpF;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CA6BlF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAKrE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,wBAAwB,EAAE,EAChD,aAAa,GAAE,MAAM,GAAG,OAAO,UAAmB,EAClD,QAAQ,SAAM,GACb,aAAa,CA8Lf"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EAId,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAgCpB,qBAAa,sBAAuB,SAAQ,KAAK;IACtC,IAAI,SAA4B;CAC1C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,SAA8B;CAC5C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAGjD,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAHlB,IAAI,SAAgC;gBAElC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAM5B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAGtC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM;IAHb,IAAI,SAAqB;gBAEvB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM;CAIvB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAHnB,IAAI,SAAwB;gBAE1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM;CAI7B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAG/C,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAHpB,IAAI,SAA8B;gBAEhC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM;CAM9B;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC,CA0CpF;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CA6BlF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAKrE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,wBAAwB,EAAE,EAChD,aAAa,GAAE,MAAM,GAAG,OAAO,UAAmB,EAClD,QAAQ,SAAM,GACb,aAAa,CAkMf"}

package/dist/client.js

@@ -80,7 +80,7 @@ export function defineScript(definition) {
             const store = currentStore();
             if (!store)
                 return () => { };
-            const entry = ensureEntry(store, resolved, false);
+            const entry = ensureEntry(store, resolved, null);
             entry.listeners.add(listener);
             callListener(store, listener, snapshot(entry));
             return () => entry.listeners.delete(listener);
@@ -141,7 +141,10 @@ export function getScriptConsent(category) {
 /** @internal Start the browser lifecycle for definitions serialized by the Farm plugin. */
 export function startScriptRuntime(definitions, runtimeWindow = window, basePath = "/") {
     const store = getStore(runtimeWindow, basePath);
-    const entries = definitions.map((definition) => ensureEntry(store, cloneScriptDefinition(definition), true));
+    // This runtime's claim on its configured scripts. Released on close so a
+    // successor (an HMR re-evaluation) can re-register changed definitions.
+    const owner = Symbol("farm-scripts-runtime");
+    const entries = definitions.map((definition) => ensureEntry(store, cloneScriptDefinition(definition), owner));
     let closed = false;
     let idleHandle;
     let interactionHandler;
@@ -303,6 +306,8 @@ export function startScriptRuntime(definitions, runtimeWindow = window, basePath
             if (closed)
                 return;
             closed = true;
+            for (const entry of entries)
+                entry.owners.delete(owner);
             if (idleHandle !== undefined) {
                 if (typeof runtimeWindow.cancelIdleCallback === "function") {
                     runtimeWindow.cancelIdleCallback(idleHandle);
@@ -361,21 +366,35 @@ function getStore(runtimeWindow, basePath) {
 function registerLocalDefinition(definition) {
     const store = currentStore();
     if (store)
-        ensureEntry(store, definition, false);
+        ensureEntry(store, definition, null);
 }
-function ensureEntry(store, definition, configured) {
+function ensureEntry(store, definition, owner) {
     const existing = store.entries.get(definition.name);
     if (existing) {
         if (!sameScriptDefinition(existing.definition, definition)) {
-            throw new TypeError(`Script ${JSON.stringify(definition.name)} was defined with conflicting options`);
+            if (existing.owners.size > 0) {
+                // Two live registrations disagreeing about the same script is a real
+                // application error and keeps failing loudly.
+                throw new TypeError(`Script ${JSON.stringify(definition.name)} was defined with conflicting options`);
+            }
+            // No live runtime owns the old definition — its runtime has closed, as
+            // happens on every HMR configuration change. Adopt the new definition
+            // and reset load state so it loads fresh; a previously injected element
+            // cannot be un-executed, but the replacement no longer throws. Status
+            // subscribers survive the swap and are told about the reset.
+            existing.definition = definition;
+            existing.triggered = false;
+            existing.attempt = 0;
+            existing.promise = undefined;
+            setEntryState(store, existing, "idle");
         }
-        if (configured)
-            existing.configured = true;
+        if (owner)
+            existing.owners.add(owner);
         return existing;
     }
     const entry = {
         definition,
-        configured,
+        owners: new Set(owner ? [owner] : []),
         status: "idle",
         attempt: 0,
         triggered: false,
@@ -387,7 +406,7 @@ function ensureEntry(store, definition, configured) {
 }
 async function loadRegisteredScript(store, name, stack = []) {
     const entry = store.entries.get(name);
-    if (!entry?.configured) {
+    if (!entry || entry.owners.size === 0) {
         throw new ScriptNotRegisteredError(`Script ${JSON.stringify(name)} is not registered. Pass its defineScript() handle to scripts({ scripts: [...] })`);
     }
     entry.triggered = true;
@@ -403,10 +422,7 @@ async function loadRegisteredScript(store, name, stack = []) {
     }
     if (entry.promise)
         return entry.promise;
-    if (entry.definition.consent && getConsent(store, entry.definition.consent) !== "granted") {
-        setEntryState(store, entry, "blocked");
-        throw new ScriptConsentRequiredError(name, entry.definition.consent);
-    }
+    assertScriptConsent(store, entry);
     if (entry.definition.preconnect)
         addPreconnect(store, entry.definition);
     if (stack.includes(name)) {
@@ -414,6 +430,7 @@ async function loadRegisteredScript(store, name, stack = []) {
     }
     const promise = (async () => {
         for (const dependency of entry.definition.dependsOn) {
+            assertScriptConsent(store, entry);
             try {
                 await loadRegisteredScript(store, dependency, [...stack, name]);
             }
@@ -431,6 +448,9 @@ async function loadRegisteredScript(store, name, stack = []) {
         for (let attempt = 1; attempt <= maximumAttempts; attempt += 1) {
             entry.attempt = attempt;
             notify(store, entry);
+            // Dependencies, retry delays, and status listeners can change consent.
+            // A blocked load must not be treated as a retryable network failure.
+            assertScriptConsent(store, entry);
             try {
                 const value = await loadElement(store, entry.definition);
                 setEntryState(store, entry, "ready");
@@ -455,6 +475,13 @@ async function loadRegisteredScript(store, name, stack = []) {
             entry.promise = undefined;
     }
 }
+function assertScriptConsent(store, entry) {
+    const category = entry.definition.consent;
+    if (category && getConsent(store, category) !== "granted") {
+        setEntryState(store, entry, "blocked");
+        throw new ScriptConsentRequiredError(entry.definition.name, category);
+    }
+}
 async function loadElement(store, definition) {
     const existingValue = findLoadedValue(store, definition);
     if (existingValue.found)

package/dist/index.d.ts

@@ -2,5 +2,5 @@ import { type FarmPlugin } from "@farm.js/core/plugin";
 import type { ResolvedScriptsOptions, ScriptRuntime, ScriptsOptions } from "./types.js";
 export type { AnyScriptHandle, ResolvedScriptDefinition, ResolvedScriptLoadStrategy, ScriptConsentState, ScriptDefinition, ScriptDuration, ScriptHandle, ScriptLoadStrategy, ScriptPlacement, ScriptSnapshot, ScriptStatus, ScriptStatusListener, ScriptType, ScriptsOptions, } from "./types.js";
 /** Manage explicitly registered third-party browser scripts across Farm's client lifecycle. */
-export declare function scripts(options: ScriptsOptions): FarmPlugin<unknown, Record<string, unknown>, ScriptRuntime, ResolvedScriptsOptions>;
+export declare function scripts(options: ScriptsOptions): FarmPlugin<unknown, Record<string, unknown>, ScriptRuntime, ResolvedScriptsOptions, unknown, false, import("@farm.js/core/plugin").PluginRoutes>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,+FAA+F;AAC/F,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,uFA0C9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAExF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,+FAA+F;AAC/F,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,oJA0C9C"}

package/dist/shared.js

@@ -204,6 +204,10 @@ function normalizeScriptSource(value) {
         if (src.includes("\\") || hasControlCharacter) {
             throw new TypeError("script root-relative src cannot contain backslashes or control characters");
         }
+        const pathname = src.split(/[?#]/, 1)[0] || "/";
+        if (pathname.split("/").some((segment) => !isStableRootRelativeSegment(segment))) {
+            throw new TypeError("script root-relative src contains a browser-unstable path segment");
+        }
         return src;
     }
     if (!/^https?:\/\//i.test(src)) {
@@ -224,6 +228,25 @@ function normalizeScriptSource(value) {
     }
     return src;
 }
+function isStableRootRelativeSegment(segment) {
+    if (!segment)
+        return true;
+    let decoded = segment;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        // Malformed escapes remain literal in browser pathnames.
+    }
+    return (decoded !== "." &&
+        decoded !== ".." &&
+        !decoded.includes("/") &&
+        !decoded.includes("\\") &&
+        !Array.from(decoded).some((character) => {
+            const code = character.charCodeAt(0);
+            return code <= 31 || (code >= 127 && code <= 159);
+        }));
+}
 function normalizeDataAttributes(value) {
     if (value === undefined)
         return {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farm.js/scripts",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.1",
   "description": "Typed, lifecycle-aware third-party browser scripts for Farm.js",
   "keywords": [
     "consent",
@@ -36,7 +36,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@farm.js/core": "0.1.0-beta.92"
+    "@farm.js/core": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.5",