@uniformdev/next-app-router-shared 20.54.1-alpha.1 → 20.55.1

package/dist/index.d.mts

@@ -79,10 +79,8 @@ declare const resolveRuleFromPageState: ({ pageState, rule, }: {
     pageState: PageState;
     rule: VisibilityParameterValue;
 }) => boolean | undefined;
-declare const serializeEvaluationResult: ({ payload, }: {
+declare const serializeEvaluationResult: ({ payload }: {
     payload: PageState;
-    /** @deprecated No longer needed — v2 format is URL-safe by default. */
-    encode?: boolean;
 }) => string;
 declare const deserializeEvaluationResult: ({ input: providedInput, decode, }: {
     input: string;

package/dist/index.d.ts

@@ -79,10 +79,8 @@ declare const resolveRuleFromPageState: ({ pageState, rule, }: {
     pageState: PageState;
     rule: VisibilityParameterValue;
 }) => boolean | undefined;
-declare const serializeEvaluationResult: ({ payload, }: {
+declare const serializeEvaluationResult: ({ payload }: {
     payload: PageState;
-    /** @deprecated No longer needed — v2 format is URL-safe by default. */
-    encode?: boolean;
 }) => string;
 declare const deserializeEvaluationResult: ({ input: providedInput, decode, }: {
     input: string;

package/dist/index.esm.js

@@ -253,11 +253,12 @@ var serializeV2 = (payload) => {
     ...payload.components[key]
   }));
   const compressedComponentIds = compressIds(sortedComponents.map((c) => c._id));
+  const componentById = new Map(sortedComponents.map((c) => [c._id, c]));
   const componentEntries = [];
   Object.keys(compressedComponentIds).forEach((compressedId) => {
     var _a;
     const originalId = compressedComponentIds[compressedId];
-    const component = sortedComponents.find((c) => c._id === originalId);
+    const component = componentById.get(originalId);
     if (!component) {
       throw new Error(`Component ${originalId} not found`);
     }
@@ -286,9 +287,7 @@ var serializeV2 = (payload) => {
   parts.push(rulesStr);
   let keysStr = "";
   if (payload.keys) {
-    const keyEntries = Object.entries(payload.keys).map(
-      ([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`
-    );
+    const keyEntries = Object.entries(payload.keys).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`);
     keysStr = keyEntries.join(V2_ENTRY_SEP);
   }
   parts.push(keysStr);
@@ -297,20 +296,38 @@ var serializeV2 = (payload) => {
   parts.push(payload.locale ? toBase64Url(payload.locale) : "");
   return parts.join(V2_FIELD_SEP);
 };
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var isUnsafeKey = (key) => UNSAFE_KEYS.has(key);
 var deserializeV2 = (input) => {
   var _a, _b, _c, _d;
   const fields = input.split(V2_FIELD_SEP);
-  const compositionState = parseInt(fields[1], 10);
+  if (fields.length < 3) {
+    throw new Error(`Invalid serialized PageState: expected at least 3 fields but got ${fields.length}`);
+  }
+  const compositionStateRaw = fields[1];
+  const compositionState = Number.parseInt(compositionStateRaw, 10);
+  if (Number.isNaN(compositionState)) {
+    throw new Error(
+      `Invalid serialized PageState: compositionState '${compositionStateRaw}' is not a valid number`
+    );
+  }
   const routePath = fromBase64Url(fields[2]);
-  const components = {};
+  const components = /* @__PURE__ */ Object.create(null);
   const componentsStr = (_a = fields[3]) != null ? _a : "";
   if (componentsStr) {
     componentsStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx === -1) {
-        components[entry] = {};
+        const id = entry;
+        if (isUnsafeKey(id)) {
+          return;
+        }
+        components[id] = {};
       } else {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         const indexes = entry.slice(sepIdx + 1).split(V2_INDEX_SEP).map(Number);
         components[id] = { indexes };
       }
@@ -319,22 +336,28 @@ var deserializeV2 = (input) => {
   const rulesStr = (_b = fields[4]) != null ? _b : "";
   let rules;
   if (rulesStr) {
-    rules = {};
+    rules = /* @__PURE__ */ Object.create(null);
     rulesStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         rules[id] = entry.slice(sepIdx + 1) === "1";
       }
     });
   }
   const keysStr = (_c = fields[5]) != null ? _c : "";
-  const keys = {};
+  const keys = /* @__PURE__ */ Object.create(null);
   if (keysStr) {
     keysStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const k = fromBase64Url(entry.slice(0, sepIdx));
+        if (isUnsafeKey(k)) {
+          return;
+        }
         const v = fromBase64Url(entry.slice(sepIdx + 1));
         keys[k] = v;
       }
@@ -356,9 +379,7 @@ var deserializeV2 = (input) => {
     isPrefetch
   };
 };
-var serializeEvaluationResult = ({
-  payload
-}) => {
+var serializeEvaluationResult = ({ payload }) => {
   return serializeV2(payload);
 };
 var deserializeEvaluationResult = ({

package/dist/index.js

@@ -288,11 +288,12 @@ var serializeV2 = (payload) => {
     ...payload.components[key]
   }));
   const compressedComponentIds = compressIds(sortedComponents.map((c) => c._id));
+  const componentById = new Map(sortedComponents.map((c) => [c._id, c]));
   const componentEntries = [];
   Object.keys(compressedComponentIds).forEach((compressedId) => {
     var _a;
     const originalId = compressedComponentIds[compressedId];
-    const component = sortedComponents.find((c) => c._id === originalId);
+    const component = componentById.get(originalId);
     if (!component) {
       throw new Error(`Component ${originalId} not found`);
     }
@@ -321,9 +322,7 @@ var serializeV2 = (payload) => {
   parts.push(rulesStr);
   let keysStr = "";
   if (payload.keys) {
-    const keyEntries = Object.entries(payload.keys).map(
-      ([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`
-    );
+    const keyEntries = Object.entries(payload.keys).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`);
     keysStr = keyEntries.join(V2_ENTRY_SEP);
   }
   parts.push(keysStr);
@@ -332,20 +331,38 @@ var serializeV2 = (payload) => {
   parts.push(payload.locale ? toBase64Url(payload.locale) : "");
   return parts.join(V2_FIELD_SEP);
 };
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var isUnsafeKey = (key) => UNSAFE_KEYS.has(key);
 var deserializeV2 = (input) => {
   var _a, _b, _c, _d;
   const fields = input.split(V2_FIELD_SEP);
-  const compositionState = parseInt(fields[1], 10);
+  if (fields.length < 3) {
+    throw new Error(`Invalid serialized PageState: expected at least 3 fields but got ${fields.length}`);
+  }
+  const compositionStateRaw = fields[1];
+  const compositionState = Number.parseInt(compositionStateRaw, 10);
+  if (Number.isNaN(compositionState)) {
+    throw new Error(
+      `Invalid serialized PageState: compositionState '${compositionStateRaw}' is not a valid number`
+    );
+  }
   const routePath = fromBase64Url(fields[2]);
-  const components = {};
+  const components = /* @__PURE__ */ Object.create(null);
   const componentsStr = (_a = fields[3]) != null ? _a : "";
   if (componentsStr) {
     componentsStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx === -1) {
-        components[entry] = {};
+        const id = entry;
+        if (isUnsafeKey(id)) {
+          return;
+        }
+        components[id] = {};
       } else {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         const indexes = entry.slice(sepIdx + 1).split(V2_INDEX_SEP).map(Number);
         components[id] = { indexes };
       }
@@ -354,22 +371,28 @@ var deserializeV2 = (input) => {
   const rulesStr = (_b = fields[4]) != null ? _b : "";
   let rules;
   if (rulesStr) {
-    rules = {};
+    rules = /* @__PURE__ */ Object.create(null);
     rulesStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         rules[id] = entry.slice(sepIdx + 1) === "1";
       }
     });
   }
   const keysStr = (_c = fields[5]) != null ? _c : "";
-  const keys = {};
+  const keys = /* @__PURE__ */ Object.create(null);
   if (keysStr) {
     keysStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const k = fromBase64Url(entry.slice(0, sepIdx));
+        if (isUnsafeKey(k)) {
+          return;
+        }
         const v = fromBase64Url(entry.slice(sepIdx + 1));
         keys[k] = v;
       }
@@ -391,9 +414,7 @@ var deserializeV2 = (input) => {
     isPrefetch
   };
 };
-var serializeEvaluationResult = ({
-  payload
-}) => {
+var serializeEvaluationResult = ({ payload }) => {
   return serializeV2(payload);
 };
 var deserializeEvaluationResult = ({

package/dist/index.mjs

@@ -253,11 +253,12 @@ var serializeV2 = (payload) => {
     ...payload.components[key]
   }));
   const compressedComponentIds = compressIds(sortedComponents.map((c) => c._id));
+  const componentById = new Map(sortedComponents.map((c) => [c._id, c]));
   const componentEntries = [];
   Object.keys(compressedComponentIds).forEach((compressedId) => {
     var _a;
     const originalId = compressedComponentIds[compressedId];
-    const component = sortedComponents.find((c) => c._id === originalId);
+    const component = componentById.get(originalId);
     if (!component) {
       throw new Error(`Component ${originalId} not found`);
     }
@@ -286,9 +287,7 @@ var serializeV2 = (payload) => {
   parts.push(rulesStr);
   let keysStr = "";
   if (payload.keys) {
-    const keyEntries = Object.entries(payload.keys).map(
-      ([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`
-    );
+    const keyEntries = Object.entries(payload.keys).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${toBase64Url(k)}${V2_KV_SEP}${toBase64Url(v)}`);
     keysStr = keyEntries.join(V2_ENTRY_SEP);
   }
   parts.push(keysStr);
@@ -297,20 +296,38 @@ var serializeV2 = (payload) => {
   parts.push(payload.locale ? toBase64Url(payload.locale) : "");
   return parts.join(V2_FIELD_SEP);
 };
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var isUnsafeKey = (key) => UNSAFE_KEYS.has(key);
 var deserializeV2 = (input) => {
   var _a, _b, _c, _d;
   const fields = input.split(V2_FIELD_SEP);
-  const compositionState = parseInt(fields[1], 10);
+  if (fields.length < 3) {
+    throw new Error(`Invalid serialized PageState: expected at least 3 fields but got ${fields.length}`);
+  }
+  const compositionStateRaw = fields[1];
+  const compositionState = Number.parseInt(compositionStateRaw, 10);
+  if (Number.isNaN(compositionState)) {
+    throw new Error(
+      `Invalid serialized PageState: compositionState '${compositionStateRaw}' is not a valid number`
+    );
+  }
   const routePath = fromBase64Url(fields[2]);
-  const components = {};
+  const components = /* @__PURE__ */ Object.create(null);
   const componentsStr = (_a = fields[3]) != null ? _a : "";
   if (componentsStr) {
     componentsStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx === -1) {
-        components[entry] = {};
+        const id = entry;
+        if (isUnsafeKey(id)) {
+          return;
+        }
+        components[id] = {};
       } else {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         const indexes = entry.slice(sepIdx + 1).split(V2_INDEX_SEP).map(Number);
         components[id] = { indexes };
       }
@@ -319,22 +336,28 @@ var deserializeV2 = (input) => {
   const rulesStr = (_b = fields[4]) != null ? _b : "";
   let rules;
   if (rulesStr) {
-    rules = {};
+    rules = /* @__PURE__ */ Object.create(null);
     rulesStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const id = entry.slice(0, sepIdx);
+        if (isUnsafeKey(id)) {
+          return;
+        }
         rules[id] = entry.slice(sepIdx + 1) === "1";
       }
     });
   }
   const keysStr = (_c = fields[5]) != null ? _c : "";
-  const keys = {};
+  const keys = /* @__PURE__ */ Object.create(null);
   if (keysStr) {
     keysStr.split(V2_ENTRY_SEP).forEach((entry) => {
       const sepIdx = entry.indexOf(V2_KV_SEP);
       if (sepIdx !== -1) {
         const k = fromBase64Url(entry.slice(0, sepIdx));
+        if (isUnsafeKey(k)) {
+          return;
+        }
         const v = fromBase64Url(entry.slice(sepIdx + 1));
         keys[k] = v;
       }
@@ -356,9 +379,7 @@ var deserializeV2 = (input) => {
     isPrefetch
   };
 };
-var serializeEvaluationResult = ({
-  payload
-}) => {
+var serializeEvaluationResult = ({ payload }) => {
   return serializeV2(payload);
 };
 var deserializeEvaluationResult = ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniformdev/next-app-router-shared",
-  "version": "20.54.1-alpha.1+028680cba4",
+  "version": "20.55.1",
   "license": "SEE LICENSE IN LICENSE.txt",
   "scripts": {
     "build": "tsup",
@@ -36,8 +36,8 @@
     "vitest": "3.2.4"
   },
   "dependencies": {
-    "@uniformdev/canvas": "20.54.1-alpha.1+028680cba4",
-    "@uniformdev/context": "20.54.1-alpha.1+028680cba4",
+    "@uniformdev/canvas": "20.55.1",
+    "@uniformdev/context": "20.55.1",
     "uuid": "9.0.1"
   },
   "engines": {
@@ -51,5 +51,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "028680cba478a17da934cdb2ddebb777e2553455"
+  "gitHead": "44d778abd699dafbabda982cb3295be043ba3cb0"
 }