@mfeflow/contracts 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,1417 @@
+import { ENTRY_TYPES, GLOBAL_NAME, pickRegistryFields } from "./entry.js";
+function isObj(value) {
+    return 'object' == typeof value && null !== value && !Array.isArray(value);
+}
+class Checker {
+    issues = [];
+    add(path, message) {
+        this.issues.push({
+            path,
+            message
+        });
+    }
+    string(obj, key, path, opts = {}) {
+        const value = obj[key];
+        const at = path ? `${path}.${key}` : key;
+        if (void 0 === value) {
+            if (opts.required ?? true) this.add(at, 'is required');
+            return;
+        }
+        if ('string' != typeof value) return void this.add(at, 'must be a string');
+        if (opts.pattern && !opts.pattern.test(value)) return void this.add(at, opts.hint ?? `must match ${String(opts.pattern)}`);
+        return value;
+    }
+    stringArray(obj, key, path, opts = {}) {
+        const value = obj[key];
+        const at = path ? `${path}.${key}` : key;
+        if (void 0 === value) {
+            if (opts.required ?? true) this.add(at, 'is required');
+            return [];
+        }
+        if (!Array.isArray(value)) {
+            this.add(at, 'must be an array of strings');
+            return [];
+        }
+        const out = [];
+        value.forEach((item, i)=>{
+            if ('string' != typeof item) this.add(`${at}[${String(i)}]`, 'must be a string');
+            else if (opts.pattern && !opts.pattern.test(item)) this.add(`${at}[${String(i)}]`, opts.hint ?? `must match ${String(opts.pattern)}`);
+            else out.push(item);
+        });
+        return out;
+    }
+    number(obj, key, path, opts = {}) {
+        const value = obj[key];
+        const at = path ? `${path}.${key}` : key;
+        if (void 0 === value) {
+            if (opts.required ?? true) this.add(at, 'is required');
+            return;
+        }
+        if ('number' != typeof value || Number.isNaN(value)) return void this.add(at, 'must be a number');
+        if (void 0 !== opts.min && value < opts.min) this.add(at, `must be ≥ ${String(opts.min)}`);
+        if (void 0 !== opts.max && value > opts.max) this.add(at, `must be ≤ ${String(opts.max)}`);
+        return value;
+    }
+    object(obj, key, path, required = true) {
+        const value = obj[key];
+        const at = path ? `${path}.${key}` : key;
+        if (void 0 === value) {
+            if (required) this.add(at, 'is required');
+            return;
+        }
+        if (!isObj(value)) return void this.add(at, 'must be an object');
+        return value;
+    }
+}
+function isUrl(value) {
+    try {
+        const u = new URL(value);
+        return 'https:' === u.protocol || 'http:' === u.protocol;
+    } catch  {
+        return false;
+    }
+}
+const SEGMENT = String.raw`(?!\.\.?(?:/|$))[^/\\\u0000]+`;
+const SAFE_RELATIVE_PATH = new RegExp(`^(?![A-Za-z]:)${SEGMENT}(?:/${SEGMENT})*$`);
+function isSafeRelativePath(value) {
+    if ('' === value || value.includes('\\') || value.includes('\0')) return false;
+    if (value.startsWith('/') || /^[A-Za-z]:/.test(value)) return false;
+    return value.split('/').every((part)=>'' !== part && '.' !== part && '..' !== part);
+}
+const MFE_NAME = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*)*$/;
+const ROUTE = /^\/[A-Za-z0-9/_:*.-]*$/;
+const EXPOSE = /^\.\/[A-Za-z0-9_/-]+$/;
+const EVENT_NAME = /^[a-z][a-z0-9-]*\.[a-z][a-z0-9_]*@[0-9]+$/;
+const ANALYTICS_EVENT = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
+function validateMfeManifest(value) {
+    const c = new Checker();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    c.string(value, 'name', '', {
+        pattern: MFE_NAME,
+        hint: 'use lowercase words of letters and digits joined by single _ (a Module Federation name)'
+    });
+    c.string(value, 'owner', '');
+    c.string(value, 'contact', '', {
+        required: false
+    });
+    c.stringArray(value, 'shells', '', {
+        pattern: MFE_NAME,
+        hint: 'must be a shell name'
+    });
+    const routes = c.stringArray(value, 'routes', '', {
+        pattern: ROUTE,
+        hint: 'must start with "/"'
+    });
+    if (new Set(routes).size !== routes.length) c.add('routes', 'has duplicates');
+    c.stringArray(value, 'exposes', '', {
+        pattern: EXPOSE,
+        hint: 'must look like "./App"'
+    });
+    const events = c.object(value, 'events', '', false);
+    if (events) {
+        c.stringArray(events, 'publishes', 'events', {
+            pattern: EVENT_NAME,
+            hint: 'must look like "cart.item_added@1"'
+        });
+        c.stringArray(events, 'consumes', 'events', {
+            pattern: EVENT_NAME,
+            hint: 'must look like "cart.item_added@1"'
+        });
+    }
+    c.stringArray(value, 'analyticsEvents', '', {
+        required: false,
+        pattern: ANALYTICS_EVENT,
+        hint: 'must look like "checkout_order_completed"'
+    });
+    const budgets = c.object(value, 'budgets', '', false);
+    if (budgets) {
+        c.number(budgets, 'initialJsKb', 'budgets', {
+            required: false,
+            min: 1
+        });
+        c.number(budgets, 'lcpMs', 'budgets', {
+            required: false,
+            min: 1
+        });
+    }
+    const platform = c.object(value, 'platform', '', false);
+    if (platform) {
+        for (const [pkg, range] of Object.entries(platform))if ('string' != typeof range) c.add(`platform.${pkg}`, 'must be a semver range string');
+    }
+    return c.issues;
+}
+function isMfeManifest(value) {
+    return 0 === validateMfeManifest(value).length;
+}
+function fail(why) {
+    throw new Error(`mf-manifest.json: ${why}`);
+}
+function strings(value) {
+    return Array.isArray(value) ? value.filter((v)=>'string' == typeof v) : [];
+}
+function manifest_assets_list(value) {
+    return Array.isArray(value) ? value : [];
+}
+function joinEntry(dir, name) {
+    if ('' === dir) return name;
+    let path = dir;
+    if ('.' === path) path = '';
+    else if (path.startsWith('./')) path = path.slice(2);
+    else if (path.startsWith('/')) {
+        path = path.slice(1);
+        if (path.endsWith('/')) path = path.slice(0, -1);
+    }
+    if ('' === path) return name;
+    return path.endsWith('/') ? `${path}${name}` : `${path}/${name}`;
+}
+const RELATIVE_WITHOUT_PAGE = 'metaData.publicPath is relative, so the file URLs resolve against the shell page; pass pageUrl to compute them';
+function isAbsolute(publicPath) {
+    return /^[a-z][a-z\d+.-]*:/i.test(publicPath) || publicPath.startsWith('//');
+}
+function resolveFile(publicPath, manifestUrl, pageUrl, file) {
+    if ('' === publicPath || 'auto' === publicPath) return new URL(file, manifestUrl).href;
+    return new URL(`${publicPath}${file}`, pageUrl).href;
+}
+function sync(assets, kind) {
+    const group = isObj(assets) ? assets[kind] : void 0;
+    return isObj(group) ? strings(group.sync) : [];
+}
+function assetsFromManifest(manifest, manifestUrl, options = {}) {
+    if (!isUrl(manifestUrl)) fail(`manifest URL "${manifestUrl}" is not an http(s) URL`);
+    if (!isObj(manifest)) fail('must be an object');
+    const meta = manifest.metaData;
+    if (!isObj(meta)) fail('has no metaData');
+    const entry = meta.remoteEntry;
+    if (!isObj(entry) || 'string' != typeof entry.name || '' === entry.name) fail('metaData.remoteEntry has no name');
+    if ('string' == typeof meta.getPublicPath && '' !== meta.getPublicPath) return {
+        exposes: {},
+        manifestOnly: 'metaData.getPublicPath computes the file URLs in the browser, so they cannot be known at publish time'
+    };
+    const publicPath = 'string' == typeof meta.publicPath ? meta.publicPath : '';
+    const { pageUrl } = options;
+    if (void 0 !== pageUrl && !isUrl(pageUrl)) fail(`page URL "${pageUrl}" is not an http(s) URL`);
+    const relative = '' !== publicPath && 'auto' !== publicPath && !isAbsolute(publicPath);
+    if (relative && void 0 === pageUrl) return {
+        exposes: {},
+        manifestOnly: RELATIVE_WITHOUT_PAGE
+    };
+    const at = (file)=>resolveFile(publicPath, manifestUrl, pageUrl ?? manifestUrl, file);
+    const exposes = {};
+    for (const expose of manifest_assets_list(manifest.exposes)){
+        if (!isObj(expose) || 'string' != typeof expose.path) continue;
+        const files = [
+            ...sync(expose.assets, 'css'),
+            ...sync(expose.assets, 'js')
+        ];
+        exposes[expose.path] = [
+            ...new Set(files)
+        ].map(at);
+    }
+    const entryPath = 'string' == typeof entry.path ? entry.path : '';
+    const type = 'string' == typeof entry.type && '' !== entry.type ? entry.type : void 0;
+    if (void 0 !== type && !ENTRY_TYPES.includes(type)) fail(`metaData.remoteEntry.type "${type}" is not a Module Federation entry type`);
+    const globalName = 'string' == typeof meta.globalName && '' !== meta.globalName ? meta.globalName : void 0;
+    if (void 0 !== globalName && !GLOBAL_NAME.test(globalName)) fail(`metaData.globalName "${globalName}" is not a valid global name`);
+    return {
+        remoteEntry: at(joinEntry(entryPath, entry.name)),
+        exposes,
+        ...void 0 === type ? {} : {
+            type
+        },
+        ...void 0 === globalName ? {} : {
+            entryGlobalName: globalName
+        }
+    };
+}
+const SCRIPT_UNSAFE = new RegExp('[<\\u2028\\u2029]', 'g');
+function jsonForScript(value) {
+    return JSON.stringify(value).replace(SCRIPT_UNSAFE, (c)=>`\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+function attribute(value) {
+    return value.replace(/[&"<>]/g, (c)=>`&#${String(c.charCodeAt(0))};`);
+}
+const ESM_TYPES = new Set([
+    'module',
+    'esm'
+]);
+function registryInjection(index, needs, options = {}) {
+    const inline = {
+        remotes: index.remotes.map((remote)=>pickRegistryFields(remote))
+    };
+    let html = `<script>window.__MFE_REGISTRY__=${jsonForScript(inline)}</script>`;
+    const seen = new Set();
+    const hint = (attrs, href)=>{
+        const tag = `<link ${attrs} href="${attribute(href)}">`;
+        if (seen.has(tag)) return;
+        seen.add(tag);
+        html += tag;
+    };
+    for (const need of needs){
+        const remote = index.remotes.find((r)=>r.name === need.remote);
+        if (void 0 === remote) continue;
+        if (void 0 === remote.remoteEntry) {
+            if (true === options.snapshot) hint('rel="preload" as="fetch" crossorigin', remote.entry);
+            continue;
+        }
+        const esm = void 0 !== remote.type && ESM_TYPES.has(remote.type);
+        const script = (href)=>hint(esm ? 'rel="modulepreload"' : 'rel="preload" as="script"', href);
+        script(remote.remoteEntry);
+        for (const file of remote.exposes?.[need.expose] ?? [])if (/\.css(\?|$)/.test(file)) hint('rel="preload" as="style"', file);
+        else script(file);
+    }
+    return html;
+}
+function tagEnd(html, from) {
+    const close = html.indexOf('>', from);
+    return -1 === close ? -1 : close + 1;
+}
+function sameChar(code, lower) {
+    return code === lower || lower >= 97 && lower <= 122 && code === lower - 32;
+}
+function indexOfCI(html, needle, from, to = html.length) {
+    const last = to - needle.length;
+    for(let at = from; at <= last; at++){
+        let i = 0;
+        while(i < needle.length && sameChar(html.charCodeAt(at + i), needle.charCodeAt(i)))i++;
+        if (i === needle.length) return at;
+    }
+    return -1;
+}
+function headEnd(html) {
+    let at = indexOfCI(html, '<head', 0);
+    while(-1 !== at){
+        const next = html.charAt(at + 5);
+        if ('>' === next || /\s/.test(next)) return tagEnd(html, at);
+        at = indexOfCI(html, '<head', at + 5);
+    }
+    return -1;
+}
+function charsetEnd(html, from) {
+    const stop = indexOfCI(html, '</head', from);
+    for(let at = indexOfCI(html, '<meta', from); -1 !== at;){
+        if (-1 !== stop && at > stop) break;
+        const end = tagEnd(html, at);
+        if (-1 === end) break;
+        if (-1 !== indexOfCI(html, 'charset', at, end)) return end;
+        at = indexOfCI(html, '<meta', end);
+    }
+    return -1;
+}
+function injectIntoHead(html, snippet) {
+    const open = headEnd(html);
+    if (-1 === open) throw new Error('@mfeflow/contracts: the HTML has no <head> to inject into');
+    const charset = charsetEnd(html, open);
+    const end = -1 === charset ? open : charset;
+    return html.slice(0, end) + snippet + html.slice(end);
+}
+const ENTRY_TYPE = new RegExp(`^(?:${ENTRY_TYPES.join('|')})$`);
+const VERSION = /^[0-9A-Za-z.+-]+$/;
+function checkRemoteFiles(c, obj, at) {
+    const entry = c.string(obj, 'remoteEntry', at, {
+        required: false
+    });
+    if (void 0 !== entry && !isUrl(entry)) c.add(at ? `${at}.remoteEntry` : 'remoteEntry', 'must be an http(s) URL');
+    c.string(obj, 'type', at, {
+        required: false,
+        pattern: ENTRY_TYPE,
+        hint: `must be a Module Federation entry type: ${ENTRY_TYPES.join(', ')}`
+    });
+    c.string(obj, 'entryGlobalName', at, {
+        required: false,
+        pattern: GLOBAL_NAME,
+        hint: 'must be a JavaScript global name (letters, digits, _, $, -; not starting with a digit)'
+    });
+    const exposes = c.object(obj, 'exposes', at, false);
+    if (!exposes) return;
+    const base = at ? `${at}.exposes` : 'exposes';
+    for (const [expose, files] of Object.entries(exposes)){
+        if (!EXPOSE.test(expose)) c.add(`${base}.${expose}`, 'must look like "./App"');
+        if (!Array.isArray(files)) {
+            c.add(`${base}.${expose}`, 'must be an array of URLs');
+            continue;
+        }
+        files.forEach((file, i)=>{
+            if ('string' != typeof file || !isUrl(file)) c.add(`${base}.${expose}[${String(i)}]`, 'must be an http(s) URL');
+        });
+    }
+}
+function validateRegistryEntry(value) {
+    const c = new Checker();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    c.string(value, 'version', '', {
+        pattern: VERSION,
+        hint: 'must be a version like 1.4.2+a1b2c3d'
+    });
+    const url = c.string(value, 'manifestUrl', '');
+    if (void 0 !== url && !isUrl(url)) c.add('manifestUrl', 'must be an http(s) URL');
+    checkRemoteFiles(c, value, '');
+    c.string(value, 'previous', '', {
+        required: false,
+        pattern: VERSION,
+        hint: 'must be a version'
+    });
+    c.string(value, 'owner', '', {
+        required: false
+    });
+    const rollout = c.object(value, 'rollout', '', false);
+    if (rollout) {
+        c.string(rollout, 'candidate', 'rollout', {
+            pattern: VERSION,
+            hint: 'must be a version'
+        });
+        c.string(rollout, 'stable', 'rollout', {
+            pattern: VERSION,
+            hint: 'must be a version'
+        });
+        c.number(rollout, 'percent', 'rollout', {
+            min: 0,
+            max: 100
+        });
+    }
+    return c.issues;
+}
+function validateRegistryIndex(value) {
+    const c = new Checker();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    for (const key of [
+        'shell',
+        'env',
+        'generatedAt'
+    ])c.string(value, key, '', {
+        required: false
+    });
+    const remotes = value.remotes;
+    if (!Array.isArray(remotes)) {
+        c.add('remotes', 'must be an array');
+        return c.issues;
+    }
+    const names = new Set();
+    const claimed = new Map();
+    remotes.forEach((remote, i)=>{
+        const at = `remotes[${String(i)}]`;
+        if (!isObj(remote)) return void c.add(at, 'must be an object');
+        const name = c.string(remote, 'name', at, {
+            pattern: MFE_NAME,
+            hint: 'must be a Module Federation name'
+        });
+        const entry = c.string(remote, 'entry', at);
+        if (void 0 !== entry && !isUrl(entry)) c.add(`${at}.entry`, 'must be an http(s) URL');
+        checkRemoteFiles(c, remote, at);
+        c.string(remote, 'version', at, {
+            required: false
+        });
+        c.string(remote, 'owner', at, {
+            required: false
+        });
+        const routes = c.stringArray(remote, 'routes', at, {
+            required: false,
+            pattern: ROUTE,
+            hint: 'must start with "/"'
+        });
+        if (void 0 !== name) {
+            if (names.has(name)) c.add(`${at}.name`, `duplicate remote "${name}"`);
+            names.add(name);
+            for (const route of routes){
+                const owner = claimed.get(route);
+                if (void 0 !== owner && owner !== name) c.add(`${at}.routes`, `route "${route}" is already claimed by "${owner}"`);
+                claimed.set(route, name);
+            }
+        }
+    });
+    return c.issues;
+}
+function isRegistryEntry(value) {
+    return 0 === validateRegistryEntry(value).length;
+}
+function isRegistryIndex(value) {
+    return 0 === validateRegistryIndex(value).length;
+}
+const project_SEGMENT = String.raw`(?!\.\.?(?:/|$))[^/\\\u0000]+`;
+const CHECKOUT_PATH = new RegExp(`^(?:(?![A-Za-z]:)(?:\\.\\.(?:/\\.\\.)*(?:/${project_SEGMENT})*|${project_SEGMENT}(?:/${project_SEGMENT})*)|(?:/|[A-Za-z]:/)${project_SEGMENT}(?:/${project_SEGMENT})*)$`);
+const FILE_HASH = /^sha256-[0-9a-f]{64}$/;
+const REGISTRY_NAMESPACE = /^@[a-z0-9][a-z0-9-]*$/;
+function isCheckoutPath(value) {
+    if ('' === value || value.includes('\\') || value.includes('\0')) return false;
+    const absolute = /^(?:\/|[A-Za-z]:\/)/.exec(value);
+    if (absolute) {
+        const parts = value.slice(absolute[0].length).split('/');
+        return parts.every((part)=>'' !== part && '.' !== part && '..' !== part);
+    }
+    if (/^[A-Za-z]:/.test(value)) return false;
+    const parts = value.split('/');
+    const climbing = parts.findIndex((part)=>'..' !== part);
+    const rest = -1 === climbing ? [] : parts.slice(climbing);
+    return rest.every((part)=>'' !== part && '.' !== part && '..' !== part);
+}
+const SCOPE = /^@[a-z0-9][a-z0-9-._]*$/;
+const FEATURE = /^(@[a-z0-9-]+\/)?[a-z][a-z0-9-]*$/;
+function validateMfeflowProject(value) {
+    const c = new Checker();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    if (1 !== value.version) c.add('version', 'must be 1');
+    const topology = c.string(value, 'topology', '');
+    if (void 0 !== topology && ![
+        'monorepo',
+        'polyrepo',
+        'hybrid'
+    ].includes(topology)) c.add('topology', 'must be monorepo, polyrepo or hybrid');
+    const pm = c.string(value, 'packageManager', '');
+    if (void 0 !== pm && ![
+        'pnpm',
+        'npm'
+    ].includes(pm)) c.add('packageManager', 'must be pnpm or npm');
+    c.string(value, 'scope', '', {
+        pattern: SCOPE,
+        hint: 'must be an npm scope like "@shopco"'
+    });
+    const apps = c.object(value, 'apps', '');
+    let shells = 0;
+    if (apps) {
+        for (const [name, app] of Object.entries(apps)){
+            const at = `apps.${name}`;
+            if (!MFE_NAME.test(name)) c.add(at, 'app names must be Module Federation names');
+            if (!isObj(app)) {
+                c.add(at, 'must be an object');
+                continue;
+            }
+            const kind = c.string(app, 'kind', at);
+            if ('shell' === kind) shells++;
+            else if (void 0 !== kind && 'remote' !== kind) c.add(`${at}.kind`, 'must be shell or remote');
+            c.string(app, 'path', at);
+            const port = c.number(app, 'port', at, {
+                required: false,
+                min: 1,
+                max: 65535
+            });
+            if (void 0 !== port && !Number.isInteger(port)) c.add(`${at}.port`, 'must be a whole number');
+        }
+        if (0 === shells) c.add('apps', 'needs at least one shell');
+    }
+    const features = c.object(value, 'features', '');
+    if (features) for (const [name, feature] of Object.entries(features)){
+        const at = `features.${name}`;
+        if (!FEATURE.test(name)) c.add(at, 'feature names look like "analytics-gtm" or "@someone/feature"');
+        if (isObj(feature)) {
+            c.string(feature, 'version', at);
+            c.object(feature, 'options', at, false);
+        } else c.add(at, 'must be an object');
+    }
+    const files = c.object(value, 'files', '', false);
+    if (files) for (const [file, hash] of Object.entries(files)){
+        const at = `files.${file}`;
+        if (!isSafeRelativePath(file)) c.add(at, 'must be a relative path with forward slashes');
+        if ('string' != typeof hash || !FILE_HASH.test(hash)) c.add(at, 'must be a hash like "sha256-<64 hex characters>"');
+    }
+    const registries = c.object(value, 'registries', '', false);
+    if (registries) for (const [ns, url] of Object.entries(registries)){
+        const at = `registries.${ns}`;
+        if ('@mfeflow' === ns) c.add(at, '@mfeflow is reserved for first-party features');
+        else if (!REGISTRY_NAMESPACE.test(ns)) c.add(at, 'namespaces look like "@someone"');
+        if ('string' != typeof url || !url.startsWith('https://') || !url.includes('{name}')) c.add(at, 'must be an https URL containing {name}');
+    }
+    if ('local' in value) {
+        const local = c.string(value, 'local', '');
+        if (void 0 !== local && !isCheckoutPath(local)) c.add('local', 'must be a path with forward slashes: relative like "../mfeflow", or absolute when no relative path exists');
+    }
+    const budget = c.object(value, 'budget', '', false);
+    if (budget) for (const key of [
+        'shellKb',
+        'remoteKb',
+        'lcpDeltaMs',
+        'baselineKb'
+    ])c.number(budget, key, 'budget', {
+        required: false,
+        min: 1
+    });
+    return c.issues;
+}
+function isMfeflowProject(value) {
+    return 0 === validateMfeflowProject(value).length;
+}
+const COST_MODEL = {
+    lcpDeltaMs: 300,
+    shellKb: 32,
+    remoteKb: 10
+};
+const KB = 1024;
+const round1 = (value)=>Math.round(10 * value) / 10;
+const line = (actual, budget)=>({
+        budget,
+        actual,
+        pass: actual <= budget
+    });
+function judgeCost(sample, model = COST_MODEL) {
+    const lcp = line(Math.round(sample.lcpDeltaMs), model.lcpDeltaMs);
+    const shell = line(round1((sample.shellBytes - sample.monolithBytes) / KB), model.shellKb);
+    const remotes = Object.entries(sample.remoteBytes).toSorted(([a], [b])=>a < b ? -1 : a > b ? 1 : 0).map(([name, bytes])=>Object.assign(line(round1(bytes / KB), model.remoteKb), {
+            name
+        }));
+    return {
+        pass: lcp.pass && shell.pass && remotes.every((r)=>r.pass),
+        lcp,
+        shell,
+        remotes
+    };
+}
+const REMOTE_PATH = /^\/mfe\/([^/]+)\//;
+function splitScripts(requests) {
+    let shellBytes = 0;
+    const remoteBytes = {};
+    for (const request of requests){
+        if ('Script' !== request.type) continue;
+        const remote = REMOTE_PATH.exec(request.path)?.[1];
+        if (void 0 === remote) shellBytes += request.bytes;
+        else remoteBytes[remote] = (remoteBytes[remote] ?? 0) + request.bytes;
+    }
+    return {
+        shellBytes,
+        remoteBytes
+    };
+}
+const TRANSFORM_OPS = [
+    'add-import',
+    'wrap-provider',
+    'add-shared',
+    'add-boot-step',
+    'add-env-key',
+    'add-route',
+    'add-workflow-step'
+];
+const FEATURE_CONDITION = 'feature:';
+const FEATURE_NAME = /^(@[a-z0-9-]+\/)?[a-z][a-z0-9-]*$/;
+const IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const TARGET = /^(root|shell|remotes|(app:)?[a-z][a-z0-9_]*)$/;
+const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const JOB_ID = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+const SCRIPT_NAME = /^[A-Za-z0-9:_.-]+$/;
+const PACKAGE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+function isTransformOp(op) {
+    return TRANSFORM_OPS.some((name)=>name === op);
+}
+function isLiteral(value) {
+    return null === value || [
+        'string',
+        'number',
+        'boolean'
+    ].includes(typeof value);
+}
+function checkTarget(c, obj, at) {
+    c.string(obj, 'target', at, {
+        required: false,
+        pattern: TARGET,
+        hint: 'must be root, shell, remotes, an app name or app:<name>'
+    });
+}
+function checkLiteralMap(c, value, at) {
+    if (void 0 === value) return;
+    if (!isObj(value)) return c.add(at, 'must be an object');
+    for (const [k, v] of Object.entries(value))if (!isLiteral(v)) c.add(`${at}.${k}`, 'must be a string, number, boolean or null');
+}
+function checkWhen(c, obj, at) {
+    const when = obj.when;
+    if (void 0 === when) return;
+    if (!isObj(when) || 0 === Object.keys(when).length) return c.add(`${at}.when`, 'must be an object of option names and values');
+    for (const [name, value] of Object.entries(when)){
+        const feature = name.startsWith(FEATURE_CONDITION) ? name.slice(FEATURE_CONDITION.length) : '';
+        if ('' !== feature) {
+            if (!FEATURE_NAME.test(feature)) c.add(`${at}.when`, `"${name}" must name a feature, like feature:env-t3`);
+            if ('boolean' != typeof value) c.add(`${at}.when.${name}`, 'must be true or false');
+            continue;
+        }
+        if (!IDENT.test(name)) c.add(`${at}.when`, `"${name}" must be a JavaScript identifier`);
+        if ('string' != typeof value && 'boolean' != typeof value) c.add(`${at}.when.${name}`, 'must be a string or boolean');
+    }
+}
+function checkPath(c, obj, key, at) {
+    const value = c.string(obj, key, at);
+    if (void 0 !== value && !isSafeRelativePath(value)) c.add(`${at}.${key}`, 'must be a relative path with forward slashes and no ".."');
+}
+const VALIDATORS = [
+    'zod',
+    'valibot',
+    'arktype'
+];
+function checkSchema(c, t, at) {
+    if (!isObj(t.schema)) return void c.string(t, 'schema', at);
+    const entries = Object.entries(t.schema);
+    if (0 === entries.length) c.add(`${at}.schema`, 'needs at least one validator');
+    for (const [validator, text] of entries)if (VALIDATORS.some((v)=>v === validator)) {
+        if ('string' != typeof text) c.add(`${at}.schema.${validator}`, 'must be text');
+    } else c.add(`${at}.schema`, `"${validator}" must be one of ${VALIDATORS.join(', ')}`);
+}
+function checkTransform(c, t, at) {
+    if (!isObj(t)) return c.add(at, 'must be an object');
+    const op = c.string(t, 'op', at);
+    if (void 0 === op) return;
+    if (!isTransformOp(op)) return void c.add(`${at}.op`, `unknown op "${op}"; built-in ops: ${TRANSFORM_OPS.join(', ')}`);
+    checkPath(c, t, 'file', at);
+    checkTarget(c, t, at);
+    checkWhen(c, t, at);
+    if (void 0 !== t.defaultImport && 'boolean' != typeof t.defaultImport) c.add(`${at}.defaultImport`, 'must be true or false');
+    if (void 0 !== t.typeOnly && 'boolean' != typeof t.typeOnly) c.add(`${at}.typeOnly`, 'must be true or false');
+    if (void 0 !== t.await && 'boolean' != typeof t.await) c.add(`${at}.await`, 'must be true or false');
+    const ident = (key, required = true)=>c.string(t, key, at, {
+            required,
+            pattern: IDENT,
+            hint: 'must be a JavaScript identifier'
+        });
+    switch(op){
+        case 'add-import':
+            c.string(t, 'from', at);
+            c.stringArray(t, 'named', at, {
+                required: false,
+                pattern: IDENT
+            });
+            ident('default', false);
+            ident('namespace', false);
+            if (!t.named && !t.default && !t.namespace && void 0 !== t.typeOnly) c.add(at, 'typeOnly needs named, default or namespace');
+            break;
+        case 'wrap-provider':
+            ident('component');
+            c.string(t, 'from', at);
+            ident('function', false);
+            checkLiteralMap(c, t.props, `${at}.props`);
+            break;
+        case 'add-shared':
+            c.string(t, 'name', at, {
+                pattern: PACKAGE,
+                hint: 'must be an npm package name'
+            });
+            ident('list', false);
+            break;
+        case 'add-boot-step':
+            ident('call');
+            c.string(t, 'from', at);
+            ident('function', false);
+            c.string(t, 'before', at, {
+                required: false,
+                pattern: IDENT
+            });
+            c.string(t, 'after', at, {
+                required: false,
+                pattern: IDENT
+            });
+            if (void 0 !== t.before && void 0 !== t.after) c.add(at, 'use before or after, not both');
+            if (void 0 !== t.args) if (Array.isArray(t.args)) t.args.forEach((a, i)=>{
+                if (!isLiteral(a)) c.add(`${at}.args[${String(i)}]`, 'must be a string, number, boolean or null');
+            });
+            else c.add(`${at}.args`, 'must be an array');
+            break;
+        case 'add-env-key':
+            {
+                c.string(t, 'key', at, {
+                    pattern: ENV_KEY,
+                    hint: 'must be a plain key'
+                });
+                const scope = c.string(t, 'scope', at);
+                if (void 0 !== scope && 'server' !== scope && 'runtime' !== scope) c.add(`${at}.scope`, 'must be server or runtime');
+                checkSchema(c, t, at);
+                ident('object', false);
+                if (void 0 !== t.example) checkPath(c, t, 'example', at);
+                if (void 0 !== t.configFiles) {
+                    for (const f of c.stringArray(t, 'configFiles', at))if (!isSafeRelativePath(f)) c.add(`${at}.configFiles`, `"${f}" must be a relative path with no ".."`);
+                }
+                if (void 0 !== t.value && !isLiteral(t.value) && !(Array.isArray(t.value) && t.value.every((v)=>'string' == typeof v))) c.add(`${at}.value`, 'must be a string, number, boolean, null or a list of strings');
+                break;
+            }
+        case 'add-route':
+            c.string(t, 'path', at, {
+                pattern: ROUTE,
+                hint: 'must be a route path'
+            });
+            ident('component');
+            c.string(t, 'from', at);
+            ident('routes', false);
+            break;
+        case 'add-workflow-step':
+            {
+                c.string(t, 'job', at, {
+                    pattern: JOB_ID,
+                    hint: 'must be a job id'
+                });
+                c.string(t, 'after', at, {
+                    required: false
+                });
+                const step = c.object(t, 'step', at);
+                if (step) {
+                    c.string(step, 'name', `${at}.step`);
+                    for (const key of [
+                        'id',
+                        'uses',
+                        'run',
+                        'if'
+                    ])c.string(step, key, `${at}.step`, {
+                        required: false
+                    });
+                    checkLiteralMap(c, step.with, `${at}.step.with`);
+                    checkLiteralMap(c, step.env, `${at}.step.env`);
+                    if (!step.uses && !step.run) c.add(`${at}.step`, 'needs uses or run');
+                }
+                break;
+            }
+    }
+}
+function eachObject(c, value, key, check) {
+    const list = value[key];
+    if (void 0 === list) return;
+    if (!Array.isArray(list)) return c.add(key, 'must be an array');
+    list.forEach((item, i)=>{
+        const at = `${key}[${String(i)}]`;
+        if (isObj(item)) check(item, at);
+        else c.add(at, 'must be an object');
+    });
+}
+function validateFeatureManifest(value) {
+    const c = new Checker();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    c.string(value, 'name', '', {
+        pattern: FEATURE_NAME,
+        hint: 'feature names look like "analytics-gtm" or "@someone/feature"'
+    });
+    c.string(value, 'version', '');
+    c.string(value, "description", '', {
+        required: false
+    });
+    c.stringArray(value, 'requires', '', {
+        required: false,
+        pattern: FEATURE_NAME
+    });
+    c.stringArray(value, 'conflicts', '', {
+        required: false,
+        pattern: FEATURE_NAME
+    });
+    eachObject(c, value, 'prompts', (p, at)=>{
+        c.string(p, 'name', at, {
+            pattern: IDENT,
+            hint: 'must be a JavaScript identifier'
+        });
+        const type = c.string(p, 'type', at);
+        if (void 0 !== type && ![
+            'boolean',
+            'string',
+            'select'
+        ].includes(type)) c.add(`${at}.type`, 'must be boolean, string or select');
+        c.string(p, 'message', at, {
+            required: false
+        });
+        if (void 0 !== p.default && 'string' != typeof p.default && 'boolean' != typeof p.default) c.add(`${at}.default`, 'must be a string or boolean');
+        const choices = c.stringArray(p, 'choices', at, {
+            required: 'select' === type
+        });
+        if ('select' === type && 'string' == typeof p.default && !choices.includes(p.default)) c.add(`${at}.default`, 'must be one of the choices');
+    });
+    eachObject(c, value, 'files', (f, at)=>{
+        checkPath(c, f, 'to', at);
+        checkTarget(c, f, at);
+        checkWhen(c, f, at);
+        c.string(f, 'from', at, {
+            required: false
+        });
+        c.string(f, 'content', at, {
+            required: false
+        });
+        if ('string' == typeof f.from && !isSafeRelativePath(f.from)) c.add(`${at}.from`, 'must be a relative path with forward slashes and no ".."');
+        if (void 0 === f.from === (void 0 === f.content)) c.add(at, 'needs exactly one of from or content');
+    });
+    eachObject(c, value, 'dependencies', (d, at)=>{
+        c.string(d, 'name', at, {
+            pattern: PACKAGE,
+            hint: 'must be an npm package name'
+        });
+        c.string(d, 'range', at);
+        checkTarget(c, d, at);
+        checkWhen(c, d, at);
+    });
+    eachObject(c, value, "scripts", (s, at)=>{
+        c.string(s, 'name', at, {
+            pattern: SCRIPT_NAME,
+            hint: "must be a script name"
+        });
+        c.string(s, 'command', at);
+        checkTarget(c, s, at);
+        checkWhen(c, s, at);
+    });
+    eachObject(c, value, 'transforms', (t, at)=>{
+        checkTransform(c, t, at);
+    });
+    eachObject(c, value, 'migrations', (m, at)=>{
+        c.string(m, 'from', at);
+        c.string(m, 'to', at);
+        checkPath(c, m, 'module', at);
+    });
+    return c.issues;
+}
+function isFeatureManifest(value) {
+    return 0 === validateFeatureManifest(value).length;
+}
+const DOCS_URL = 'https://mfeflow.github.io/mfeflow';
+const SCHEMA_URLS = {
+    mfe: `${DOCS_URL}/schema/mfe.json`,
+    project: `${DOCS_URL}/schema/mfeflow.json`,
+    feature: `${DOCS_URL}/schema/feature.json`,
+    registryEntry: `${DOCS_URL}/schema/registry-entry.json`,
+    registryIndex: `${DOCS_URL}/schema/registry-index.json`
+};
+function errorDocsUrl(code) {
+    return `${DOCS_URL}/errors/${code}`;
+}
+const DRAFT = 'https://json-schema.org/draft/2020-12/schema';
+const str = (pattern)=>pattern ? {
+        type: 'string',
+        pattern: pattern.source
+    } : {
+        type: 'string'
+    };
+const json_schema_strings = (pattern)=>({
+        type: 'array',
+        items: str(pattern)
+    });
+const literal = {
+    type: [
+        'string',
+        'number',
+        'boolean',
+        'null'
+    ]
+};
+const literalMap = {
+    type: 'object',
+    additionalProperties: literal
+};
+const json_schema_url = {
+    type: 'string',
+    format: 'uri',
+    pattern: '^https?://'
+};
+const relativePath = {
+    type: 'string',
+    pattern: SAFE_RELATIVE_PATH.source
+};
+const exposeFiles = {
+    type: 'object',
+    propertyNames: str(EXPOSE),
+    additionalProperties: {
+        type: 'array',
+        items: json_schema_url
+    }
+};
+function root(name, title, body) {
+    return {
+        $schema: DRAFT,
+        $id: SCHEMA_URLS[name],
+        title,
+        type: 'object',
+        properties: {
+            $schema: {
+                type: 'string'
+            },
+            ...body.properties
+        },
+        required: body.required
+    };
+}
+const remoteFiles = {
+    remoteEntry: json_schema_url,
+    type: {
+        type: 'string',
+        enum: [
+            ...ENTRY_TYPES
+        ]
+    },
+    entryGlobalName: str(GLOBAL_NAME),
+    exposes: exposeFiles
+};
+const json_schema_when = {
+    type: 'object',
+    minProperties: 1,
+    propertyNames: str(IDENT),
+    additionalProperties: {
+        type: [
+            'string',
+            'boolean'
+        ]
+    }
+};
+const target = str(TARGET);
+const transformBase = {
+    file: relativePath,
+    target: target,
+    when: json_schema_when
+};
+function json_schema_op(name, required, properties) {
+    return {
+        type: 'object',
+        properties: {
+            op: {
+                const: name
+            },
+            ...transformBase,
+            ...properties
+        },
+        required: [
+            'op',
+            'file',
+            ...required
+        ]
+    };
+}
+const defaultImport = {
+    type: 'boolean'
+};
+const transform = {
+    type: 'object',
+    properties: {
+        op: {
+            enum: [
+                ...TRANSFORM_OPS
+            ]
+        }
+    },
+    required: [
+        'op'
+    ],
+    oneOf: [
+        json_schema_op('add-import', [
+            'from'
+        ], {
+            from: str(),
+            named: json_schema_strings(IDENT),
+            default: str(IDENT),
+            namespace: str(IDENT),
+            typeOnly: {
+                type: 'boolean'
+            }
+        }),
+        json_schema_op('wrap-provider', [
+            'component',
+            'from'
+        ], {
+            component: str(IDENT),
+            from: str(),
+            props: literalMap,
+            defaultImport: defaultImport,
+            function: str(IDENT)
+        }),
+        json_schema_op('add-shared', [
+            'name'
+        ], {
+            name: str(PACKAGE),
+            list: str(IDENT)
+        }),
+        json_schema_op('add-boot-step', [
+            'call',
+            'from'
+        ], {
+            call: str(IDENT),
+            from: str(),
+            args: {
+                type: 'array',
+                items: literal
+            },
+            await: {
+                type: 'boolean'
+            },
+            defaultImport: defaultImport,
+            before: str(IDENT),
+            after: str(IDENT),
+            function: str(IDENT)
+        }),
+        json_schema_op('add-env-key', [
+            'key',
+            'scope',
+            'schema'
+        ], {
+            key: str(ENV_KEY),
+            scope: {
+                enum: [
+                    'server',
+                    'runtime'
+                ]
+            },
+            schema: str(),
+            value: literal,
+            object: str(IDENT),
+            example: relativePath,
+            configFiles: {
+                type: 'array',
+                items: relativePath
+            }
+        }),
+        json_schema_op('add-route', [
+            'path',
+            'component',
+            'from'
+        ], {
+            path: str(ROUTE),
+            component: str(IDENT),
+            from: str(),
+            defaultImport: defaultImport,
+            routes: str(IDENT)
+        }),
+        json_schema_op('add-workflow-step', [
+            'job',
+            'step'
+        ], {
+            job: str(JOB_ID),
+            after: str(),
+            step: {
+                type: 'object',
+                properties: {
+                    name: str(),
+                    id: str(),
+                    uses: str(),
+                    run: str(),
+                    with: literalMap,
+                    env: literalMap,
+                    if: str()
+                },
+                required: [
+                    'name'
+                ],
+                anyOf: [
+                    {
+                        required: [
+                            'uses'
+                        ]
+                    },
+                    {
+                        required: [
+                            'run'
+                        ]
+                    }
+                ]
+            }
+        })
+    ]
+};
+const json_schema_item = (properties, required)=>({
+        type: 'object',
+        properties,
+        required
+    });
+const JSON_SCHEMAS = {
+    mfe: root('mfe', 'mfe.json', {
+        properties: {
+            name: str(MFE_NAME),
+            owner: str(),
+            contact: str(),
+            shells: json_schema_strings(MFE_NAME),
+            routes: {
+                ...json_schema_strings(ROUTE),
+                uniqueItems: true
+            },
+            exposes: json_schema_strings(EXPOSE),
+            events: {
+                type: 'object',
+                properties: {
+                    publishes: json_schema_strings(EVENT_NAME),
+                    consumes: json_schema_strings(EVENT_NAME)
+                },
+                required: [
+                    'publishes',
+                    'consumes'
+                ]
+            },
+            analyticsEvents: json_schema_strings(ANALYTICS_EVENT),
+            budgets: {
+                type: 'object',
+                properties: {
+                    initialJsKb: {
+                        type: 'number',
+                        minimum: 1
+                    },
+                    lcpMs: {
+                        type: 'number',
+                        minimum: 1
+                    }
+                }
+            },
+            platform: {
+                type: 'object',
+                additionalProperties: {
+                    type: 'string'
+                }
+            }
+        },
+        required: [
+            'name',
+            'owner',
+            'shells',
+            'routes',
+            'exposes'
+        ]
+    }),
+    project: root('project', 'mfeflow.json', {
+        properties: {
+            version: {
+                const: 1
+            },
+            topology: {
+                enum: [
+                    'monorepo',
+                    'polyrepo',
+                    'hybrid'
+                ]
+            },
+            packageManager: {
+                enum: [
+                    'pnpm',
+                    'npm'
+                ]
+            },
+            scope: str(SCOPE),
+            apps: {
+                type: 'object',
+                propertyNames: str(MFE_NAME),
+                minProperties: 1,
+                additionalProperties: json_schema_item({
+                    kind: {
+                        enum: [
+                            'shell',
+                            'remote'
+                        ]
+                    },
+                    path: str(),
+                    port: {
+                        type: 'integer',
+                        minimum: 1,
+                        maximum: 65535
+                    }
+                }, [
+                    'kind',
+                    'path'
+                ])
+            },
+            features: {
+                type: 'object',
+                propertyNames: str(FEATURE_NAME),
+                additionalProperties: json_schema_item({
+                    version: str(),
+                    options: {
+                        type: 'object'
+                    }
+                }, [
+                    'version'
+                ])
+            },
+            files: {
+                type: 'object',
+                propertyNames: relativePath,
+                additionalProperties: str(FILE_HASH)
+            },
+            registries: {
+                type: 'object',
+                propertyNames: {
+                    type: 'string',
+                    pattern: REGISTRY_NAMESPACE.source,
+                    not: {
+                        const: '@mfeflow'
+                    }
+                },
+                additionalProperties: {
+                    type: 'string',
+                    pattern: '^https://.*\\{name\\}'
+                }
+            },
+            local: str(CHECKOUT_PATH),
+            budget: {
+                type: 'object',
+                properties: Object.fromEntries([
+                    'shellKb',
+                    'remoteKb',
+                    'lcpDeltaMs',
+                    'baselineKb'
+                ].map((key)=>[
+                        key,
+                        {
+                            type: 'number',
+                            minimum: 1
+                        }
+                    ]))
+            }
+        },
+        required: [
+            'version',
+            'topology',
+            'packageManager',
+            'scope',
+            'apps',
+            'features'
+        ]
+    }),
+    feature: root('feature', 'feature.json', {
+        properties: {
+            name: str(FEATURE_NAME),
+            version: str(),
+            description: str(),
+            prompts: {
+                type: 'array',
+                items: json_schema_item({
+                    name: str(IDENT),
+                    type: {
+                        enum: [
+                            'boolean',
+                            'string',
+                            'select'
+                        ]
+                    },
+                    message: str(),
+                    default: {
+                        type: [
+                            'string',
+                            'boolean'
+                        ]
+                    },
+                    choices: json_schema_strings()
+                }, [
+                    'name',
+                    'type'
+                ])
+            },
+            requires: json_schema_strings(FEATURE_NAME),
+            conflicts: json_schema_strings(FEATURE_NAME),
+            files: {
+                type: 'array',
+                items: {
+                    ...json_schema_item({
+                        to: relativePath,
+                        target: target,
+                        when: json_schema_when,
+                        from: relativePath,
+                        content: str(),
+                        template: {
+                            type: 'boolean'
+                        }
+                    }, [
+                        'to'
+                    ]),
+                    oneOf: [
+                        {
+                            required: [
+                                'from'
+                            ]
+                        },
+                        {
+                            required: [
+                                'content'
+                            ]
+                        }
+                    ]
+                }
+            },
+            dependencies: {
+                type: 'array',
+                items: json_schema_item({
+                    name: str(PACKAGE),
+                    range: str(),
+                    dev: {
+                        type: 'boolean'
+                    },
+                    target: target,
+                    when: json_schema_when
+                }, [
+                    'name',
+                    'range'
+                ])
+            },
+            scripts: {
+                type: 'array',
+                items: json_schema_item({
+                    name: str(SCRIPT_NAME),
+                    command: str(),
+                    target: target,
+                    when: json_schema_when
+                }, [
+                    'name',
+                    'command'
+                ])
+            },
+            transforms: {
+                type: 'array',
+                items: transform
+            },
+            migrations: {
+                type: 'array',
+                items: json_schema_item({
+                    from: str(),
+                    to: str(),
+                    module: relativePath
+                }, [
+                    'from',
+                    'to',
+                    'module'
+                ])
+            }
+        },
+        required: [
+            'name',
+            'version'
+        ]
+    }),
+    registryEntry: root('registryEntry', 'registry entry', {
+        properties: {
+            version: str(VERSION),
+            manifestUrl: json_schema_url,
+            ...remoteFiles,
+            previous: str(VERSION),
+            owner: str(),
+            rollout: json_schema_item({
+                candidate: str(VERSION),
+                stable: str(VERSION),
+                percent: {
+                    type: 'number',
+                    minimum: 0,
+                    maximum: 100
+                }
+            }, [
+                'candidate',
+                'stable',
+                'percent'
+            ])
+        },
+        required: [
+            'version',
+            'manifestUrl'
+        ]
+    }),
+    registryIndex: root('registryIndex', 'registry index', {
+        properties: {
+            shell: str(),
+            env: str(),
+            generatedAt: str(),
+            remotes: {
+                type: 'array',
+                items: json_schema_item({
+                    name: str(MFE_NAME),
+                    entry: json_schema_url,
+                    ...remoteFiles,
+                    version: str(),
+                    routes: json_schema_strings(ROUTE),
+                    owner: str()
+                }, [
+                    'name',
+                    'entry'
+                ])
+            }
+        },
+        required: [
+            'remotes'
+        ]
+    })
+};
+export { ANALYTICS_EVENT, COST_MODEL, DOCS_URL, EVENT_NAME, EXPOSE, FEATURE_CONDITION, FEATURE_NAME, FILE_HASH, JSON_SCHEMAS, MFE_NAME, ROUTE, SCHEMA_URLS, TRANSFORM_OPS, assetsFromManifest, errorDocsUrl, injectIntoHead, isFeatureManifest, isMfeManifest, isMfeflowProject, isRegistryEntry, isRegistryIndex, isSafeRelativePath, judgeCost, registryInjection, round1, splitScripts, validateFeatureManifest, validateMfeManifest, validateMfeflowProject, validateRegistryEntry, validateRegistryIndex };