@mfeflow/runtime 0.4.0 → 0.6.0

package/dist/beacon.d.ts

@@ -0,0 +1,45 @@
+import { type RegistrySources } from './registry.js';
+import { type RuntimeConfigValues } from './runtime-config.js';
+/** The registry server's endpoint for these index URLs, and the env they name. */
+export interface BeaconTarget {
+    url: string;
+    env: string;
+}
+export declare const CLIENT_ID_KEY = "mfeflow:client";
+/** The first index URL that is a registry server's `/v1/index/<env>`. A static host has no beacon. */
+export declare function beaconTarget(urls: readonly string[]): BeaconTarget | undefined;
+/** A stable id for this browser, so the server keeps giving it the same rollout side. Not tied to a person. */
+export declare function clientId(): string;
+/** The server index URLs get `?u=<client id>`; any other URL is returned as it came. */
+export declare function withClientId(url: string, id?: string): string;
+export type Send = (url: string, body: string) => boolean;
+export interface BeaconReporter {
+    load(remote: string, version: string): void;
+    error(remote: string, version: string): void;
+    /** Sends what has been counted since the last flush as one request. Nothing counted, nothing sent. */
+    flush(): void;
+    stop(): void;
+}
+/**
+ * Counts, per remote@version, whether this page loaded it and whether it failed, and sends the
+ * page's counts as one request: `{ env, u, entries }`. A page is one load and at most one error
+ * for a remote, so the error rate reads as "page views that hit an error". What was sent is
+ * remembered, so a flush on `visibilitychange` followed by more loads never reports the same load
+ * again. An error that comes after a clean report is sent once more.
+ */
+export declare function createBeaconReporter(target: BeaconTarget, send: Send, client?: string): BeaconReporter;
+/** Stops the running reporter so the next start is a fresh one. For tests. */
+export declare function resetRegistryBeaconForTests(): void;
+/**
+ * Starts the reporter when the runtime config has `registryBeacon: true` and one of the index URLs
+ * is a registry server's. Otherwise does nothing. Calling it again returns the reporter already
+ * running, so the Module Federation plugin is registered once.
+ */
+export declare function startRegistryBeacon(config: RuntimeConfigValues, urls: readonly string[], send?: Send): BeaconReporter | undefined;
+/**
+ * `registrySources()` for a shell that wants the beacon. With `registryBeacon: true` in the runtime
+ * config it adds this browser's id to the registry server's index URLs and starts the reporter;
+ * without it, the sources come back untouched. Import it on demand
+ * (`await import('@mfeflow/runtime/beacon')`) so a shell with the option off never downloads it.
+ */
+export declare function registrySourcesWithBeacon(waitMs?: number): Promise<RegistrySources>;

package/dist/beacon.js

@@ -0,0 +1,169 @@
+import { registerPlugins } from "@module-federation/enhanced/runtime";
+import { REMOTE_ERROR_EVENT, remoteVersion } from "./report.js";
+import { registrySources } from "./registry.js";
+import { RUNTIME_CONFIG_KEY } from "./runtime-config.js";
+const SERVER_INDEX = /\/v1\/index\/([a-z][a-z0-9-]*)$/;
+const PARSE_BASE = 'https://page.invalid';
+const MAX_ENTRIES = 20;
+const MAX_BYTES = 4096;
+const MAX_PENDING = 200;
+const CLIENT_ID_KEY = 'mfeflow:client';
+function beaconTarget(urls) {
+    for (const raw of urls){
+        if (!URL.canParse(raw, PARSE_BASE)) continue;
+        const url = new URL(raw, PARSE_BASE);
+        const env = SERVER_INDEX.exec(url.pathname)?.[1];
+        if (void 0 === env) continue;
+        const beacon = new URL(raw, "u" < typeof location ? PARSE_BASE : location.href);
+        beacon.pathname = beacon.pathname.replace(SERVER_INDEX, '/v1/beacon');
+        beacon.search = '';
+        beacon.hash = '';
+        return {
+            url: beacon.href,
+            env
+        };
+    }
+}
+const randomId = ()=>Array.from(crypto.getRandomValues(new Uint8Array(16)), (b)=>b.toString(16).padStart(2, '0')).join('');
+let memoryId;
+function clientId() {
+    try {
+        const stored = localStorage.getItem(CLIENT_ID_KEY);
+        if (null !== stored && /^[\w.:-]{1,128}$/.test(stored)) return stored;
+        const fresh = randomId();
+        localStorage.setItem(CLIENT_ID_KEY, fresh);
+        return fresh;
+    } catch  {
+        memoryId ??= randomId();
+        return memoryId;
+    }
+}
+function withClientId(url, id = clientId()) {
+    if (!URL.canParse(url, PARSE_BASE)) return url;
+    const parsed = new URL(url, PARSE_BASE);
+    if (!SERVER_INDEX.test(parsed.pathname)) return url;
+    const absolute = URL.canParse(url);
+    const target = absolute ? new URL(url) : parsed;
+    target.searchParams.set('u', id);
+    return absolute ? target.href : `${target.pathname}${target.search}${target.hash}`;
+}
+const byteLength = (text)=>new TextEncoder().encode(text).length;
+function createBeaconReporter(target, send, client = clientId()) {
+    const pending = new Map();
+    const sent = new Map();
+    const note = (remote, version, failed)=>{
+        const key = `${remote}@${version}`;
+        const before = sent.get(key);
+        if (void 0 !== before && (before || !failed)) return;
+        const known = pending.get(key);
+        if (void 0 !== known) known.failed ||= failed;
+        else if (pending.size < MAX_PENDING) pending.set(key, {
+            remote,
+            version,
+            failed
+        });
+    };
+    const flush = ()=>{
+        if (0 === pending.size) return;
+        const batch = [
+            ...pending.entries()
+        ];
+        pending.clear();
+        for (const [key, { failed }] of batch)sent.set(key, failed);
+        const head = JSON.stringify({
+            env: target.env,
+            u: client,
+            entries: []
+        });
+        let chunk = [];
+        let size = head.length;
+        const emit = ()=>{
+            if (chunk.length > 0) send(target.url, JSON.stringify({
+                env: target.env,
+                u: client,
+                entries: chunk
+            }));
+            chunk = [];
+            size = head.length;
+        };
+        for (const [, { remote, version, failed }] of batch){
+            const entry = {
+                remote,
+                version,
+                loads: 1,
+                errors: failed ? 1 : 0
+            };
+            const extra = byteLength(JSON.stringify(entry)) + 1;
+            if (chunk.length === MAX_ENTRIES || size + extra > MAX_BYTES) emit();
+            chunk.push(entry);
+            size += extra;
+        }
+        emit();
+    };
+    const onError = (event)=>{
+        const detail = event instanceof CustomEvent ? event.detail : void 0;
+        const mfe = 'object' == typeof detail && null !== detail ? Reflect.get(detail, 'mfe') : void 0;
+        const version = 'object' == typeof detail && null !== detail ? Reflect.get(detail, 'version') : void 0;
+        if ('string' == typeof mfe && 'string' == typeof version) note(mfe, version, true);
+    };
+    const onHide = ()=>{
+        if ("u" < typeof document || 'hidden' === document.visibilityState) flush();
+    };
+    window.addEventListener(REMOTE_ERROR_EVENT, onError);
+    window.addEventListener('pagehide', flush);
+    document.addEventListener('visibilitychange', onHide);
+    return {
+        load: (remote, version)=>note(remote, version, false),
+        error: (remote, version)=>note(remote, version, true),
+        flush,
+        stop () {
+            window.removeEventListener(REMOTE_ERROR_EVENT, onError);
+            window.removeEventListener('pagehide', flush);
+            document.removeEventListener('visibilitychange', onHide);
+            pending.clear();
+            sent.clear();
+        }
+    };
+}
+const sendWithBeacon = (url, body)=>"u" > typeof navigator && 'function' == typeof navigator.sendBeacon ? navigator.sendBeacon(url, body) : false;
+let active;
+function resetRegistryBeaconForTests() {
+    active?.stop();
+    active = void 0;
+}
+function startRegistryBeacon(config, urls, send = sendWithBeacon) {
+    if (true !== config.registryBeacon) return;
+    if (void 0 !== active) return active;
+    const target = beaconTarget(urls);
+    if (void 0 === target) return;
+    const reporter = createBeaconReporter(target, send);
+    active = reporter;
+    registerPlugins([
+        {
+            name: 'mfeflow-beacon',
+            onLoad (args) {
+                const remote = args.id.split('/')[0] ?? args.id;
+                const version = remoteVersion(remote);
+                if (void 0 !== version) reporter.load(remote, version);
+            }
+        }
+    ]);
+    return reporter;
+}
+const isConfig = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+async function registrySourcesWithBeacon(waitMs) {
+    const sources = await registrySources(waitMs);
+    const config = Reflect.get(globalThis, RUNTIME_CONFIG_KEY);
+    if (!isConfig(config) || true !== config.registryBeacon) return sources;
+    try {
+        const urls = sources.urls.map((url)=>withClientId(url));
+        startRegistryBeacon(config, urls);
+        return {
+            ...sources,
+            urls
+        };
+    } catch  {
+        return sources;
+    }
+}
+export { CLIENT_ID_KEY, beaconTarget, clientId, createBeaconReporter, registrySourcesWithBeacon, resetRegistryBeaconForTests, startRegistryBeacon, withClientId };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { composeProviders, withProps, type ProviderComponent } from './providers.js';
 export { REMOTE_ERROR_EVENT, reportRemoteError, type RemoteErrorReport } from './report.js';
-export { DEFAULT_REGISTRY_URL, isRegistryIndex, loadRegistryIndex, REGISTRY_GLOBAL, registeredRemotes, registerRemotesFromIndex, type LoadRegistryOptions, type RegisterOptions, type RegistryIndex, type RegistryRemote, } from './registry.js';
+export { DEFAULT_REGISTRY_URL, isRegistryIndex, loadRegistryIndex, REGISTRY_GLOBAL, REGISTRY_FALLBACK, registeredRemotes, registrySources, registrySourcesFromConfig, type RegistrySources, registerRemotesFromIndex, type LoadRegistryOptions, type RegisterOptions, type RegistryIndex, type RegistryRemote, } from './registry.js';
 export { DefaultRemoteFallback, RemoteBoundary, remoteComponent, type FallbackProps, type RemoteBoundaryProps, type RemoteOptions, } from './remote.js';
 export { ASSERT_PARAM, assertRequested, checkSingletons, type SingletonCheck } from './singletons.js';
 export { applyDevOverrides, OVERRIDE_PARAM, OVERRIDE_STORAGE_KEY, type DevOverrideOptions, } from './overrides.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 export { composeProviders, withProps } from "./providers.js";
 export { REMOTE_ERROR_EVENT, reportRemoteError } from "./report.js";
-export { DEFAULT_REGISTRY_URL, REGISTRY_GLOBAL, isRegistryIndex, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes } from "./registry.js";
+export { DEFAULT_REGISTRY_URL, REGISTRY_FALLBACK, REGISTRY_GLOBAL, isRegistryIndex, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes, registrySources, registrySourcesFromConfig } from "./registry.js";
 export { DefaultRemoteFallback, RemoteBoundary, remoteComponent } from "./remote.js";
 export { ASSERT_PARAM, assertRequested, checkSingletons } from "./singletons.js";
 export { OVERRIDE_PARAM, OVERRIDE_STORAGE_KEY, applyDevOverrides } from "./overrides.js";

package/dist/plugins/entry-retry.js

@@ -15,16 +15,19 @@ function createEntryRetryPlugin(options = {}) {
                 }
                 await sleep(delayMs * attempt);
                 if (globalLoading[uniqueKey] === failed) delete globalLoading[uniqueKey];
+                const before = globalLoading[uniqueKey];
                 try {
-                    const exports = await getRemoteEntry({
+                    const attemptLoad = getRemoteEntry({
                         origin,
                         remoteInfo,
                         remoteEntryExports,
                         getEntryUrl: (url)=>`${url}${url.includes('?') ? '&' : '?'}retry=${String(attempt)}`
                     });
+                    const started = globalLoading[uniqueKey];
+                    failed = started === before ? void 0 : started;
+                    const exports = await attemptLoad;
                     if (exports) return exports;
                 } catch  {}
-                failed = globalLoading[uniqueKey];
             }
             return;
         } finally{

package/dist/plugins/report.d.ts

@@ -5,6 +5,7 @@ declare global {
         where: string;
         message: string;
         time: number;
+        version?: string;
     }[] | undefined;
 }
 /** Reports every Module Federation load failure with the remote's name. */

package/dist/plugins/report.js

@@ -1,14 +1,21 @@
 const EVENT = 'mfeflow:remote-error';
+const VERSIONS = Symbol.for('mfeflow.remote-versions');
 function mfeflowReportPlugin() {
     return {
         name: 'mfeflow-report',
         errorLoadRemote (args) {
             const mfe = args.id.split('/')[0] ?? args.id;
+            const versions = Reflect.get(globalThis, VERSIONS);
+            const known = versions instanceof Map ? versions.get(mfe) : void 0;
+            const version = 'string' == typeof known ? known : void 0;
             const report = {
                 mfe,
                 where: `errorLoadRemote:${args.lifecycle}`,
                 message: args.error instanceof Error ? args.error.message : String(args.error),
-                time: Date.now()
+                time: Date.now(),
+                ...void 0 === version ? {} : {
+                    version
+                }
             };
             (globalThis.mfeflowReports ??= []).push(report);
             if ("u" > typeof window && 'function' == typeof CustomEvent) window.dispatchEvent(new CustomEvent(EVENT, {

package/dist/registry.d.ts

@@ -1,31 +1,11 @@
-export interface RegistryRemote {
-    /** Module Federation name, e.g. `cart`. */
-    name: string;
-    /** `mf-manifest.json` URL of the version to load. Used when `remoteEntry` is absent. */
-    entry: string;
-    /**
-     * The remote's entry script. Registered in place of the manifest in
-     * production, so the shell fetches no manifest and ships no snapshot code.
-     */
-    remoteEntry?: string;
-    /** How `remoteEntry` loads (`module` for ESM). Passed to Module Federation with it. */
-    type?: string;
-    /** The global `remoteEntry` defines when it differs from `name`. */
-    entryGlobalName?: string;
-    version?: string;
-    routes?: string[];
-    owner?: string;
-}
-export interface RegistryIndex {
-    shell?: string;
-    env?: string;
-    generatedAt?: string;
-    remotes: RegistryRemote[];
-}
+import { isRegistryIndexRemote, type RegistryIndex, type RegistryIndexRemote } from '@mfeflow/contracts/entry';
+import { type RuntimeConfigValues } from './runtime-config.js';
+export type RegistryRemote = RegistryIndexRemote;
+export type { RegistryIndex };
 /** Reported for a registry entry that has only a manifest URL in a shell built without the manifest loader. */
 export declare const NO_REMOTE_ENTRY = "MFE_NO_REMOTE_ENTRY";
 /** True for a valid registry remote. */
-export declare function isRegistryRemote(value: unknown): value is RegistryRemote;
+export declare const isRegistryRemote: typeof isRegistryIndexRemote;
 /**
  * True for a registry index envelope (what the shell fetches at boot). Remotes
  * are checked one by one in `loadRegistryIndex`, so one bad remote does not
@@ -35,11 +15,16 @@ export declare function isRegistryIndex(value: unknown): value is RegistryIndex;
 /** Reported for a registry remote that is skipped because a field is invalid. */
 export declare const INVALID_REMOTE = "MFE_INVALID_REMOTE";
 export interface LoadRegistryOptions {
+    /** The whole time budget for all URLs together, in ms. Default 5000. */
     timeoutMs?: number;
+    /** How long each URL except the last gets, in ms. The last one gets what is left. Default 1500. */
+    primaryTimeoutMs?: number;
     fetch?: typeof fetch;
     /** Use an index the server or edge inlined as `window.__MFE_REGISTRY__`. Default true. */
     inline?: boolean;
-    /** Allow the fallback fetch to leave the page's origin. Default false. */
+    /** Origins other than the page's that an index URL may be on. */
+    allowedOrigins?: readonly string[];
+    /** Allow any origin for the index URLs. Default false; prefer `allowedOrigins`. */
     allowCrossOrigin?: boolean;
 }
 /**
@@ -49,13 +34,36 @@ export interface LoadRegistryOptions {
  */
 export declare const REGISTRY_GLOBAL = "__MFE_REGISTRY__";
 export declare const DEFAULT_REGISTRY_URL = "/registry/index.json";
+/** Reported once when the primary index failed and a later URL served the shell. */
+export declare const REGISTRY_FALLBACK = "MFE_REGISTRY_FALLBACK";
 /**
  * Reads the registry index: `window.__MFE_REGISTRY__` when the edge inlined it,
- * otherwise a same-origin fetch. Throws on HTTP errors, timeouts, invalid JSON
- * and cross-origin URLs. A remote with an invalid field is skipped and reported
- * (`MFE_INVALID_REMOTE`); the valid ones stay.
+ * otherwise the first of `source` (one URL or an ordered list, primary first)
+ * that answers. A 5xx, network error, timeout, non-JSON body, invalid envelope
+ * or disallowed origin moves on to the next URL; each URL except the last gets
+ * `primaryTimeoutMs`, the last gets the rest of `timeoutMs`. Each URL must be on
+ * the page's origin or in `allowedOrigins`. Falling back is reported once
+ * (`MFE_REGISTRY_FALLBACK`). Throws when every URL fails. A remote with an
+ * invalid field is skipped and reported (`MFE_INVALID_REMOTE`); the valid ones stay.
+ */
+export declare function loadRegistryIndex(source?: string | readonly string[], options?: LoadRegistryOptions): Promise<RegistryIndex>;
+/**
+ * The index URLs and extra allowed origins from the shell's runtime config:
+ * `registryUrls` (primary first) and `registryOrigins`. Without them it is the
+ * default same-origin URL and no extra origins.
+ */
+export declare function registrySourcesFromConfig(config: RuntimeConfigValues): RegistrySources;
+export interface RegistrySources {
+    urls: string[];
+    allowedOrigins: string[];
+}
+/**
+ * Where the shell loads the registry from, without holding up boot. An inlined runtime config is
+ * used as is. When the index is inlined nothing is fetched (inline the runtime config too if its
+ * remotes live on another origin). Otherwise the config file is used if it answers within
+ * `waitMs`; past that, or when it fails, the same-origin default.
  */
-export declare function loadRegistryIndex(url?: string, options?: LoadRegistryOptions): Promise<RegistryIndex>;
+export declare function registrySources(waitMs?: number): Promise<RegistrySources>;
 /** Remotes registered by the last `registerRemotesFromIndex` call (for the dev overlay). */
 export declare function registeredRemotes(): readonly RegistryRemote[];
 export interface RegisterOptions {

package/dist/registry.js

@@ -1,27 +1,17 @@
-import { ENTRY_TYPES, GLOBAL_NAME, pickRegistryFields } from "@mfeflow/contracts/entry";
+import { isRegistryIndexRemote, pickRegistryFields, registryRemoteIssues } from "@mfeflow/contracts/entry";
 import { registerRemotes } from "@module-federation/enhanced/runtime";
-import { reportRemoteError } from "./report.js";
+import { rememberRemoteVersions, reportRemoteError } from "./report.js";
+import { RUNTIME_CONFIG_KEY, fetchRuntimeConfig } from "./runtime-config.js";
 const NO_REMOTE_ENTRY = 'MFE_NO_REMOTE_ENTRY';
 function builtWithSnapshot() {
     return 'boolean' == typeof __MFEFLOW_SNAPSHOT__ ? __MFEFLOW_SNAPSHOT__ : true;
 }
-function isStringArray(value) {
-    return Array.isArray(value) && value.every((v)=>'string' == typeof v);
-}
 function remoteProblem(value) {
-    if ('object' != typeof value || null === value) return 'not an object';
-    if (!('name' in value) || 'string' != typeof value.name || !GLOBAL_NAME.test(value.name)) return 'name';
-    if (!('entry' in value) || 'string' != typeof value.entry) return 'entry';
-    if ('remoteEntry' in value && 'string' != typeof value.remoteEntry) return 'remoteEntry';
-    if ('type' in value && ('string' != typeof value.type || !ENTRY_TYPES.includes(value.type))) return 'type';
-    if ('entryGlobalName' in value && ('string' != typeof value.entryGlobalName || !GLOBAL_NAME.test(value.entryGlobalName))) return 'entryGlobalName';
-    if ('version' in value && 'string' != typeof value.version) return 'version';
-    if ('owner' in value && 'string' != typeof value.owner) return 'owner';
-    if ('routes' in value && !isStringArray(value.routes)) return 'routes';
-}
-function isRegistryRemote(value) {
-    return void 0 === remoteProblem(value);
+    const first = registryRemoteIssues(value).find((issue)=>!issue.path.startsWith('exposes'));
+    if (void 0 === first) return;
+    return '' === first.path ? 'not an object' : first.path.split(/[.[]/)[0] ?? first.path;
 }
+const isRegistryRemote = isRegistryIndexRemote;
 function isRegistryIndex(value) {
     return 'object' == typeof value && null !== value && 'remotes' in value && Array.isArray(value.remotes);
 }
@@ -41,22 +31,107 @@ function withoutInvalidRemotes(index) {
 }
 const REGISTRY_GLOBAL = '__MFE_REGISTRY__';
 const DEFAULT_REGISTRY_URL = '/registry/index.json';
-function sameOrigin(url) {
-    if ("u" < typeof location) return true;
-    return new URL(url, location.href).origin === location.origin;
+const REGISTRY_FALLBACK = 'MFE_REGISTRY_FALLBACK';
+function originOf(url) {
+    try {
+        return new URL(url, "u" < typeof location ? void 0 : location.href).origin;
+    } catch  {
+        return;
+    }
 }
-async function loadRegistryIndex(url = DEFAULT_REGISTRY_URL, options = {}) {
-    const inlined = Reflect.get(globalThis, REGISTRY_GLOBAL);
-    if (false !== options.inline && isRegistryIndex(inlined)) return withoutInvalidRemotes(inlined);
-    if (true !== options.allowCrossOrigin && !sameOrigin(url)) throw new Error(`registry index ${url}: must be same-origin`);
+function originAllowed(url, options) {
+    if (true === options.allowCrossOrigin) return true;
+    const origin = originOf(url);
+    if (void 0 === origin) return false;
+    if ("u" < typeof location || origin === location.origin) return true;
+    return (options.allowedOrigins ?? []).some((allowed)=>originOf(allowed) === origin);
+}
+async function fetchIndex(url, timeoutMs, options) {
+    if (!originAllowed(url, options)) throw new Error(`registry index ${url}: must be same-origin or in allowedOrigins`);
     const doFetch = options.fetch ?? fetch;
-    const res = await doFetch(url, {
-        signal: AbortSignal.timeout(options.timeoutMs ?? 5000)
-    });
+    const signal = AbortSignal.timeout(timeoutMs);
+    let res;
+    try {
+        res = await doFetch(url, {
+            signal
+        });
+    } catch (error) {
+        if (signal.aborted) throw new Error(`registry index ${url}: timed out after ${String(timeoutMs)} ms`, {
+            cause: error
+        });
+        throw new Error(`registry index ${url}: ${error instanceof Error ? error.message : String(error)}`, {
+            cause: error
+        });
+    }
+    if (res.redirected && !originAllowed(res.url, options)) throw new Error(`registry index ${url}: redirected to ${res.url}, which is not allowed`);
     if (!res.ok) throw new Error(`registry index ${url}: HTTP ${String(res.status)}`);
-    const body = await res.json();
+    let body;
+    try {
+        body = await res.json();
+    } catch  {
+        throw new Error(`registry index ${url}: not valid JSON`);
+    }
     if (!isRegistryIndex(body)) throw new Error(`registry index ${url}: not a valid index`);
-    return withoutInvalidRemotes(body);
+    return body;
+}
+async function loadRegistryIndex(source = DEFAULT_REGISTRY_URL, options = {}) {
+    const inlined = Reflect.get(globalThis, REGISTRY_GLOBAL);
+    if (false !== options.inline && isRegistryIndex(inlined)) return withoutInvalidRemotes(inlined);
+    const urls = 'string' == typeof source ? [
+        source
+    ] : source;
+    if (0 === urls.length) throw new Error('registry index: no URL given');
+    const budget = options.timeoutMs ?? 5000;
+    const primaryMs = options.primaryTimeoutMs ?? 1500;
+    const started = Date.now();
+    const failures = [];
+    for (const [position, url] of urls.entries()){
+        const remaining = budget - (Date.now() - started);
+        if (remaining <= 0) {
+            failures.push(new Error(`registry index ${url}: no time left`));
+            continue;
+        }
+        const timeoutMs = position === urls.length - 1 ? remaining : Math.min(primaryMs, remaining);
+        try {
+            const index = await fetchIndex(url, timeoutMs, options);
+            const [first] = failures;
+            if (void 0 !== first) reportRemoteError('registry', 'registry', new Error(`${REGISTRY_FALLBACK}: ${first.message}; using ${url}`));
+            return withoutInvalidRemotes(index);
+        } catch (error) {
+            failures.push(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    const [only] = failures;
+    if (1 === failures.length && void 0 !== only) throw only;
+    throw new Error(`registry index: every source failed (${failures.map((e)=>e.message).join('; ')})`);
+}
+const strings = (value)=>Array.isArray(value) ? value.filter((v)=>'string' == typeof v && '' !== v) : [];
+function registrySourcesFromConfig(config) {
+    const urls = strings(config.registryUrls);
+    const allowedOrigins = strings(config.registryOrigins).flatMap((o)=>{
+        const url = URL.canParse(o) ? new URL(o) : void 0;
+        return url?.protocol === 'https:' || url?.protocol === 'http:' ? url.origin : [];
+    });
+    return {
+        urls: urls.length > 0 ? urls : [
+            DEFAULT_REGISTRY_URL
+        ],
+        allowedOrigins
+    };
+}
+async function registrySources(waitMs = 1500) {
+    const configInlined = Reflect.has(globalThis, RUNTIME_CONFIG_KEY);
+    if (!configInlined && isRegistryIndex(Reflect.get(globalThis, REGISTRY_GLOBAL))) return registrySourcesFromConfig({});
+    let timer;
+    const late = new Promise((resolve)=>{
+        timer = setTimeout(()=>resolve({}), waitMs);
+    });
+    const config = await Promise.race([
+        fetchRuntimeConfig().catch(()=>({})),
+        late
+    ]);
+    clearTimeout(timer);
+    return registrySourcesFromConfig(config);
 }
 function toMfRemote(r) {
     if (void 0 === r.remoteEntry) return {
@@ -102,7 +177,8 @@ function registerRemotesFromIndex(index, options = {}) {
         ok.push(remote);
     }
     registerRemotes(ok.map(toMfRemote));
+    rememberRemoteVersions(ok);
     registered = ok.map((r)=>pickRegistryFields(r));
     return ok.map((r)=>r.name);
 }
-export { DEFAULT_REGISTRY_URL, INVALID_REMOTE, NO_REMOTE_ENTRY, REGISTRY_GLOBAL, isRegistryIndex, isRegistryRemote, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes };
+export { DEFAULT_REGISTRY_URL, INVALID_REMOTE, NO_REMOTE_ENTRY, REGISTRY_FALLBACK, REGISTRY_GLOBAL, isRegistryIndex, isRegistryRemote, loadRegistryIndex, registerRemotesFromIndex, registeredRemotes, registrySources, registrySourcesFromConfig };

package/dist/report.d.ts

@@ -5,7 +5,16 @@ export interface RemoteErrorReport {
     where: string;
     message: string;
     time: number;
+    /** The registered version of the remote, when the registry gave one. */
+    version?: string;
 }
+/** The version the registry gave this remote on this page, if any. */
+export declare const remoteVersion: (mfe: string) => string | undefined;
+/** Remembers each remote's version so its reports say `cart@1.2.3`. Replaces what was remembered before. */
+export declare function rememberRemoteVersions(remotes: readonly {
+    name: string;
+    version?: string;
+}[]): void;
 /** Fired on `window` for every report; telemetry and the dev overlay listen to it. */
 export declare const REMOTE_ERROR_EVENT = "mfeflow:remote-error";
 declare global {

package/dist/report.js

@@ -1,16 +1,35 @@
+const VERSIONS = Symbol.for('mfeflow.remote-versions');
+const isVersionMap = (value)=>value instanceof Map;
+function versionMap() {
+    const existing = Reflect.get(globalThis, VERSIONS);
+    if (isVersionMap(existing)) return existing;
+    const created = new Map();
+    Reflect.set(globalThis, VERSIONS, created);
+    return created;
+}
+const remoteVersion = (mfe)=>versionMap().get(mfe);
+function rememberRemoteVersions(remotes) {
+    const versions = versionMap();
+    versions.clear();
+    for (const { name, version } of remotes)if (void 0 !== version) versions.set(name, version);
+}
 const REMOTE_ERROR_EVENT = 'mfeflow:remote-error';
 function reportRemoteError(mfe, where, error) {
+    const version = versionMap().get(mfe);
     const report = {
         mfe,
         where,
         message: error instanceof Error ? error.message : String(error),
-        time: Date.now()
+        time: Date.now(),
+        ...void 0 === version ? {} : {
+            version
+        }
     };
     (globalThis.mfeflowReports ??= []).push(report);
     if ("u" > typeof window && 'function' == typeof CustomEvent) window.dispatchEvent(new CustomEvent(REMOTE_ERROR_EVENT, {
         detail: report
     }));
-    console.error(`[mfeflow] ${mfe} ${where}: ${report.message}`);
+    console.error(`[mfeflow] ${void 0 === version ? mfe : `${mfe}@${version}`} ${where}: ${report.message}`);
     return report;
 }
-export { REMOTE_ERROR_EVENT, reportRemoteError };
+export { REMOTE_ERROR_EVENT, rememberRemoteVersions, remoteVersion, reportRemoteError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mfeflow/runtime",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Runtime for mfeflow micro-frontends: remotes from a registry index, RemoteBoundary with timeout and fallback, error reporting, singleton checks, composeProviders.",
   "keywords": [
     "micro-frontend",
@@ -33,6 +33,11 @@
       "import": "./dist/providers.js",
       "default": "./dist/providers.js"
     },
+    "./beacon": {
+      "types": "./dist/beacon.d.ts",
+      "import": "./dist/beacon.js",
+      "default": "./dist/beacon.js"
+    },
     "./plugins/report": {
       "types": "./dist/plugins/report.d.ts",
       "import": "./dist/plugins/report.js",
@@ -55,7 +60,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@mfeflow/contracts": "0.4.0"
+    "@mfeflow/contracts": "0.6.0"
   },
   "peerDependencies": {
     "@module-federation/enhanced": "^2.9.0",