@mfeflow/runtime 0.4.0 → 0.5.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { composeProviders, withProps, type ProviderComponent } from './providers.js';
 export { REMOTE_ERROR_EVENT, reportRemoteError, type RemoteErrorReport } from './report.js';
-export { DEFAULT_REGISTRY_URL, isRegistryIndex, loadRegistryIndex, REGISTRY_GLOBAL, registeredRemotes, registerRemotesFromIndex, type LoadRegistryOptions, type RegisterOptions, type RegistryIndex, type RegistryRemote, } from './registry.js';
+export { DEFAULT_REGISTRY_URL, isRegistryIndex, loadRegistryIndex, REGISTRY_GLOBAL, REGISTRY_FALLBACK, registeredRemotes, registrySources, registrySourcesFromConfig, type RegistrySources, registerRemotesFromIndex, type LoadRegistryOptions, type RegisterOptions, type RegistryIndex, type RegistryRemote, } from './registry.js';
 export { DefaultRemoteFallback, RemoteBoundary, remoteComponent, type FallbackProps, type RemoteBoundaryProps, type RemoteOptions, } from './remote.js';
 export { ASSERT_PARAM, assertRequested, checkSingletons, type SingletonCheck } from './singletons.js';
 export { applyDevOverrides, OVERRIDE_PARAM, OVERRIDE_STORAGE_KEY, type DevOverrideOptions, } from './overrides.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 export { composeProviders, withProps } from "./providers.js";
 export { REMOTE_ERROR_EVENT, reportRemoteError } from "./report.js";
-export { DEFAULT_REGISTRY_URL, REGISTRY_GLOBAL, isRegistryIndex, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes } from "./registry.js";
+export { DEFAULT_REGISTRY_URL, REGISTRY_FALLBACK, REGISTRY_GLOBAL, isRegistryIndex, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes, registrySources, registrySourcesFromConfig } from "./registry.js";
 export { DefaultRemoteFallback, RemoteBoundary, remoteComponent } from "./remote.js";
 export { ASSERT_PARAM, assertRequested, checkSingletons } from "./singletons.js";
 export { OVERRIDE_PARAM, OVERRIDE_STORAGE_KEY, applyDevOverrides } from "./overrides.js";

package/dist/plugins/entry-retry.js

@@ -15,16 +15,19 @@ function createEntryRetryPlugin(options = {}) {
                 }
                 await sleep(delayMs * attempt);
                 if (globalLoading[uniqueKey] === failed) delete globalLoading[uniqueKey];
+                const before = globalLoading[uniqueKey];
                 try {
-                    const exports = await getRemoteEntry({
+                    const attemptLoad = getRemoteEntry({
                         origin,
                         remoteInfo,
                         remoteEntryExports,
                         getEntryUrl: (url)=>`${url}${url.includes('?') ? '&' : '?'}retry=${String(attempt)}`
                     });
+                    const started = globalLoading[uniqueKey];
+                    failed = started === before ? void 0 : started;
+                    const exports = await attemptLoad;
                     if (exports) return exports;
                 } catch  {}
-                failed = globalLoading[uniqueKey];
             }
             return;
         } finally{

package/dist/plugins/report.d.ts

@@ -5,6 +5,7 @@ declare global {
         where: string;
         message: string;
         time: number;
+        version?: string;
     }[] | undefined;
 }
 /** Reports every Module Federation load failure with the remote's name. */

package/dist/plugins/report.js

@@ -1,14 +1,21 @@
 const EVENT = 'mfeflow:remote-error';
+const VERSIONS = Symbol.for('mfeflow.remote-versions');
 function mfeflowReportPlugin() {
     return {
         name: 'mfeflow-report',
         errorLoadRemote (args) {
             const mfe = args.id.split('/')[0] ?? args.id;
+            const versions = Reflect.get(globalThis, VERSIONS);
+            const known = versions instanceof Map ? versions.get(mfe) : void 0;
+            const version = 'string' == typeof known ? known : void 0;
             const report = {
                 mfe,
                 where: `errorLoadRemote:${args.lifecycle}`,
                 message: args.error instanceof Error ? args.error.message : String(args.error),
-                time: Date.now()
+                time: Date.now(),
+                ...void 0 === version ? {} : {
+                    version
+                }
             };
             (globalThis.mfeflowReports ??= []).push(report);
             if ("u" > typeof window && 'function' == typeof CustomEvent) window.dispatchEvent(new CustomEvent(EVENT, {

package/dist/registry.d.ts

@@ -1,31 +1,11 @@
-export interface RegistryRemote {
-    /** Module Federation name, e.g. `cart`. */
-    name: string;
-    /** `mf-manifest.json` URL of the version to load. Used when `remoteEntry` is absent. */
-    entry: string;
-    /**
-     * The remote's entry script. Registered in place of the manifest in
-     * production, so the shell fetches no manifest and ships no snapshot code.
-     */
-    remoteEntry?: string;
-    /** How `remoteEntry` loads (`module` for ESM). Passed to Module Federation with it. */
-    type?: string;
-    /** The global `remoteEntry` defines when it differs from `name`. */
-    entryGlobalName?: string;
-    version?: string;
-    routes?: string[];
-    owner?: string;
-}
-export interface RegistryIndex {
-    shell?: string;
-    env?: string;
-    generatedAt?: string;
-    remotes: RegistryRemote[];
-}
+import { isRegistryIndexRemote, type RegistryIndex, type RegistryIndexRemote } from '@mfeflow/contracts/entry';
+import { type RuntimeConfigValues } from './runtime-config.js';
+export type RegistryRemote = RegistryIndexRemote;
+export type { RegistryIndex };
 /** Reported for a registry entry that has only a manifest URL in a shell built without the manifest loader. */
 export declare const NO_REMOTE_ENTRY = "MFE_NO_REMOTE_ENTRY";
 /** True for a valid registry remote. */
-export declare function isRegistryRemote(value: unknown): value is RegistryRemote;
+export declare const isRegistryRemote: typeof isRegistryIndexRemote;
 /**
  * True for a registry index envelope (what the shell fetches at boot). Remotes
  * are checked one by one in `loadRegistryIndex`, so one bad remote does not
@@ -35,11 +15,16 @@ export declare function isRegistryIndex(value: unknown): value is RegistryIndex;
 /** Reported for a registry remote that is skipped because a field is invalid. */
 export declare const INVALID_REMOTE = "MFE_INVALID_REMOTE";
 export interface LoadRegistryOptions {
+    /** The whole time budget for all URLs together, in ms. Default 5000. */
     timeoutMs?: number;
+    /** How long each URL except the last gets, in ms. The last one gets what is left. Default 1500. */
+    primaryTimeoutMs?: number;
     fetch?: typeof fetch;
     /** Use an index the server or edge inlined as `window.__MFE_REGISTRY__`. Default true. */
     inline?: boolean;
-    /** Allow the fallback fetch to leave the page's origin. Default false. */
+    /** Origins other than the page's that an index URL may be on. */
+    allowedOrigins?: readonly string[];
+    /** Allow any origin for the index URLs. Default false; prefer `allowedOrigins`. */
     allowCrossOrigin?: boolean;
 }
 /**
@@ -49,13 +34,36 @@ export interface LoadRegistryOptions {
  */
 export declare const REGISTRY_GLOBAL = "__MFE_REGISTRY__";
 export declare const DEFAULT_REGISTRY_URL = "/registry/index.json";
+/** Reported once when the primary index failed and a later URL served the shell. */
+export declare const REGISTRY_FALLBACK = "MFE_REGISTRY_FALLBACK";
 /**
  * Reads the registry index: `window.__MFE_REGISTRY__` when the edge inlined it,
- * otherwise a same-origin fetch. Throws on HTTP errors, timeouts, invalid JSON
- * and cross-origin URLs. A remote with an invalid field is skipped and reported
- * (`MFE_INVALID_REMOTE`); the valid ones stay.
+ * otherwise the first of `source` (one URL or an ordered list, primary first)
+ * that answers. A 5xx, network error, timeout, non-JSON body, invalid envelope
+ * or disallowed origin moves on to the next URL; each URL except the last gets
+ * `primaryTimeoutMs`, the last gets the rest of `timeoutMs`. Each URL must be on
+ * the page's origin or in `allowedOrigins`. Falling back is reported once
+ * (`MFE_REGISTRY_FALLBACK`). Throws when every URL fails. A remote with an
+ * invalid field is skipped and reported (`MFE_INVALID_REMOTE`); the valid ones stay.
+ */
+export declare function loadRegistryIndex(source?: string | readonly string[], options?: LoadRegistryOptions): Promise<RegistryIndex>;
+/**
+ * The index URLs and extra allowed origins from the shell's runtime config:
+ * `registryUrls` (primary first) and `registryOrigins`. Without them it is the
+ * default same-origin URL and no extra origins.
+ */
+export declare function registrySourcesFromConfig(config: RuntimeConfigValues): RegistrySources;
+export interface RegistrySources {
+    urls: string[];
+    allowedOrigins: string[];
+}
+/**
+ * Where the shell loads the registry from, without holding up boot. An inlined runtime config is
+ * used as is. When the index is inlined nothing is fetched (inline the runtime config too if its
+ * remotes live on another origin). Otherwise the config file is used if it answers within
+ * `waitMs`; past that, or when it fails, the same-origin default.
  */
-export declare function loadRegistryIndex(url?: string, options?: LoadRegistryOptions): Promise<RegistryIndex>;
+export declare function registrySources(waitMs?: number): Promise<RegistrySources>;
 /** Remotes registered by the last `registerRemotesFromIndex` call (for the dev overlay). */
 export declare function registeredRemotes(): readonly RegistryRemote[];
 export interface RegisterOptions {

package/dist/registry.js

@@ -1,27 +1,17 @@
-import { ENTRY_TYPES, GLOBAL_NAME, pickRegistryFields } from "@mfeflow/contracts/entry";
+import { isRegistryIndexRemote, pickRegistryFields, registryRemoteIssues } from "@mfeflow/contracts/entry";
 import { registerRemotes } from "@module-federation/enhanced/runtime";
-import { reportRemoteError } from "./report.js";
+import { rememberRemoteVersions, reportRemoteError } from "./report.js";
+import { RUNTIME_CONFIG_KEY, fetchRuntimeConfig } from "./runtime-config.js";
 const NO_REMOTE_ENTRY = 'MFE_NO_REMOTE_ENTRY';
 function builtWithSnapshot() {
     return 'boolean' == typeof __MFEFLOW_SNAPSHOT__ ? __MFEFLOW_SNAPSHOT__ : true;
 }
-function isStringArray(value) {
-    return Array.isArray(value) && value.every((v)=>'string' == typeof v);
-}
 function remoteProblem(value) {
-    if ('object' != typeof value || null === value) return 'not an object';
-    if (!('name' in value) || 'string' != typeof value.name || !GLOBAL_NAME.test(value.name)) return 'name';
-    if (!('entry' in value) || 'string' != typeof value.entry) return 'entry';
-    if ('remoteEntry' in value && 'string' != typeof value.remoteEntry) return 'remoteEntry';
-    if ('type' in value && ('string' != typeof value.type || !ENTRY_TYPES.includes(value.type))) return 'type';
-    if ('entryGlobalName' in value && ('string' != typeof value.entryGlobalName || !GLOBAL_NAME.test(value.entryGlobalName))) return 'entryGlobalName';
-    if ('version' in value && 'string' != typeof value.version) return 'version';
-    if ('owner' in value && 'string' != typeof value.owner) return 'owner';
-    if ('routes' in value && !isStringArray(value.routes)) return 'routes';
-}
-function isRegistryRemote(value) {
-    return void 0 === remoteProblem(value);
+    const first = registryRemoteIssues(value).find((issue)=>!issue.path.startsWith('exposes'));
+    if (void 0 === first) return;
+    return '' === first.path ? 'not an object' : first.path.split(/[.[]/)[0] ?? first.path;
 }
+const isRegistryRemote = isRegistryIndexRemote;
 function isRegistryIndex(value) {
     return 'object' == typeof value && null !== value && 'remotes' in value && Array.isArray(value.remotes);
 }
@@ -41,22 +31,107 @@ function withoutInvalidRemotes(index) {
 }
 const REGISTRY_GLOBAL = '__MFE_REGISTRY__';
 const DEFAULT_REGISTRY_URL = '/registry/index.json';
-function sameOrigin(url) {
-    if ("u" < typeof location) return true;
-    return new URL(url, location.href).origin === location.origin;
+const REGISTRY_FALLBACK = 'MFE_REGISTRY_FALLBACK';
+function originOf(url) {
+    try {
+        return new URL(url, "u" < typeof location ? void 0 : location.href).origin;
+    } catch  {
+        return;
+    }
 }
-async function loadRegistryIndex(url = DEFAULT_REGISTRY_URL, options = {}) {
-    const inlined = Reflect.get(globalThis, REGISTRY_GLOBAL);
-    if (false !== options.inline && isRegistryIndex(inlined)) return withoutInvalidRemotes(inlined);
-    if (true !== options.allowCrossOrigin && !sameOrigin(url)) throw new Error(`registry index ${url}: must be same-origin`);
+function originAllowed(url, options) {
+    if (true === options.allowCrossOrigin) return true;
+    const origin = originOf(url);
+    if (void 0 === origin) return false;
+    if ("u" < typeof location || origin === location.origin) return true;
+    return (options.allowedOrigins ?? []).some((allowed)=>originOf(allowed) === origin);
+}
+async function fetchIndex(url, timeoutMs, options) {
+    if (!originAllowed(url, options)) throw new Error(`registry index ${url}: must be same-origin or in allowedOrigins`);
     const doFetch = options.fetch ?? fetch;
-    const res = await doFetch(url, {
-        signal: AbortSignal.timeout(options.timeoutMs ?? 5000)
-    });
+    const signal = AbortSignal.timeout(timeoutMs);
+    let res;
+    try {
+        res = await doFetch(url, {
+            signal
+        });
+    } catch (error) {
+        if (signal.aborted) throw new Error(`registry index ${url}: timed out after ${String(timeoutMs)} ms`, {
+            cause: error
+        });
+        throw new Error(`registry index ${url}: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error
+        });
+    }
+    if (res.redirected && !originAllowed(res.url, options)) throw new Error(`registry index ${url}: redirected to ${res.url}, which is not allowed`);
     if (!res.ok) throw new Error(`registry index ${url}: HTTP ${String(res.status)}`);
-    const body = await res.json();
+    let body;
+    try {
+        body = await res.json();
+    } catch  {
+        throw new Error(`registry index ${url}: not valid JSON`);
+    }
     if (!isRegistryIndex(body)) throw new Error(`registry index ${url}: not a valid index`);
-    return withoutInvalidRemotes(body);
+    return body;
+}
+async function loadRegistryIndex(source = DEFAULT_REGISTRY_URL, options = {}) {
+    const inlined = Reflect.get(globalThis, REGISTRY_GLOBAL);
+    if (false !== options.inline && isRegistryIndex(inlined)) return withoutInvalidRemotes(inlined);
+    const urls = 'string' == typeof source ? [
+        source
+    ] : source;
+    if (0 === urls.length) throw new Error('registry index: no URL given');
+    const budget = options.timeoutMs ?? 5000;
+    const primaryMs = options.primaryTimeoutMs ?? 1500;
+    const started = Date.now();
+    const failures = [];
+    for (const [position, url] of urls.entries()){
+        const remaining = budget - (Date.now() - started);
+        if (remaining <= 0) {
+            failures.push(new Error(`registry index ${url}: no time left`));
+            continue;
+        }
+        const timeoutMs = position === urls.length - 1 ? remaining : Math.min(primaryMs, remaining);
+        try {
+            const index = await fetchIndex(url, timeoutMs, options);
+            const [first] = failures;
+            if (void 0 !== first) reportRemoteError('registry', 'registry', new Error(`${REGISTRY_FALLBACK}: ${first.message}; using ${url}`));
+            return withoutInvalidRemotes(index);
+        } catch (error) {
+            failures.push(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    const [only] = failures;
+    if (1 === failures.length && void 0 !== only) throw only;
+    throw new Error(`registry index: every source failed (${failures.map((e)=>e.message).join('; ')})`);
+}
+const strings = (value)=>Array.isArray(value) ? value.filter((v)=>'string' == typeof v && '' !== v) : [];
+function registrySourcesFromConfig(config) {
+    const urls = strings(config.registryUrls);
+    const allowedOrigins = strings(config.registryOrigins).flatMap((o)=>{
+        const url = URL.canParse(o) ? new URL(o) : void 0;
+        return url?.protocol === 'https:' || url?.protocol === 'http:' ? url.origin : [];
+    });
+    return {
+        urls: urls.length > 0 ? urls : [
+            DEFAULT_REGISTRY_URL
+        ],
+        allowedOrigins
+    };
+}
+async function registrySources(waitMs = 1500) {
+    const configInlined = Reflect.has(globalThis, RUNTIME_CONFIG_KEY);
+    if (!configInlined && isRegistryIndex(Reflect.get(globalThis, REGISTRY_GLOBAL))) return registrySourcesFromConfig({});
+    let timer;
+    const late = new Promise((resolve)=>{
+        timer = setTimeout(()=>resolve({}), waitMs);
+    });
+    const config = await Promise.race([
+        fetchRuntimeConfig().catch(()=>({})),
+        late
+    ]);
+    clearTimeout(timer);
+    return registrySourcesFromConfig(config);
 }
 function toMfRemote(r) {
     if (void 0 === r.remoteEntry) return {
@@ -102,7 +177,8 @@ function registerRemotesFromIndex(index, options = {}) {
         ok.push(remote);
     }
     registerRemotes(ok.map(toMfRemote));
+    rememberRemoteVersions(ok);
     registered = ok.map((r)=>pickRegistryFields(r));
     return ok.map((r)=>r.name);
 }
-export { DEFAULT_REGISTRY_URL, INVALID_REMOTE, NO_REMOTE_ENTRY, REGISTRY_GLOBAL, isRegistryIndex, isRegistryRemote, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes };
+export { DEFAULT_REGISTRY_URL, INVALID_REMOTE, NO_REMOTE_ENTRY, REGISTRY_FALLBACK, REGISTRY_GLOBAL, isRegistryIndex, isRegistryRemote, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes, registrySources, registrySourcesFromConfig };

package/dist/report.d.ts

@@ -5,7 +5,14 @@ export interface RemoteErrorReport {
     where: string;
     message: string;
     time: number;
+    /** The registered version of the remote, when the registry gave one. */
+    version?: string;
 }
+/** Remembers each remote's version so its reports say `cart@1.2.3`. Replaces what was remembered before. */
+export declare function rememberRemoteVersions(remotes: readonly {
+    name: string;
+    version?: string;
+}[]): void;
 /** Fired on `window` for every report; telemetry and the dev overlay listen to it. */
 export declare const REMOTE_ERROR_EVENT = "mfeflow:remote-error";
 declare global {

package/dist/report.js

@@ -1,16 +1,34 @@
+const VERSIONS = Symbol.for('mfeflow.remote-versions');
+const isVersionMap = (value)=>value instanceof Map;
+function versionMap() {
+    const existing = Reflect.get(globalThis, VERSIONS);
+    if (isVersionMap(existing)) return existing;
+    const created = new Map();
+    Reflect.set(globalThis, VERSIONS, created);
+    return created;
+}
+function rememberRemoteVersions(remotes) {
+    const versions = versionMap();
+    versions.clear();
+    for (const { name, version } of remotes)if (void 0 !== version) versions.set(name, version);
+}
 const REMOTE_ERROR_EVENT = 'mfeflow:remote-error';
 function reportRemoteError(mfe, where, error) {
+    const version = versionMap().get(mfe);
     const report = {
         mfe,
         where,
         message: error instanceof Error ? error.message : String(error),
-        time: Date.now()
+        time: Date.now(),
+        ...void 0 === version ? {} : {
+            version
+        }
     };
     (globalThis.mfeflowReports ??= []).push(report);
     if ("u" > typeof window && 'function' == typeof CustomEvent) window.dispatchEvent(new CustomEvent(REMOTE_ERROR_EVENT, {
         detail: report
     }));
-    console.error(`[mfeflow] ${mfe} ${where}: ${report.message}`);
+    console.error(`[mfeflow] ${void 0 === version ? mfe : `${mfe}@${version}`} ${where}: ${report.message}`);
     return report;
 }
-export { REMOTE_ERROR_EVENT, reportRemoteError };
+export { REMOTE_ERROR_EVENT, rememberRemoteVersions, reportRemoteError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mfeflow/runtime",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Runtime for mfeflow micro-frontends: remotes from a registry index, RemoteBoundary with timeout and fallback, error reporting, singleton checks, composeProviders.",
   "keywords": [
     "micro-frontend",
@@ -55,7 +55,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@mfeflow/contracts": "0.4.0"
+    "@mfeflow/contracts": "0.5.0"
   },
   "peerDependencies": {
     "@module-federation/enhanced": "^2.9.0",