@module-federation/vite 1.16.12 → 1.16.13

package/README.md

@@ -6,22 +6,15 @@
 
 [Read the announcement](https://www.linkedin.com/posts/voidzero_github-module-federationvite-vite-plugin-activity-7449452398202241024-JyAL).
 
-<div align="center">
-  <h2>Gold Sponsor</h2>
-  <a href="https://www.zephyr-cloud.io/">
-    <img src="./docs/sponsors/zephyr-logo.png" alt="Zephyr Cloud" width="360" />
-  </a>
-
-  <h3>Sponsors</h3>
-  <p>
-    <a href="https://github.com/thecoder93">
-      <img src="https://github.com/thecoder93.png?size=96" alt="thecoder93" width="64" height="64" />
-    </a>
-    <a href="https://github.com/stephanelgrg">
-      <img src="https://github.com/stephanelgrg.png?size=96" alt="stephanelgrg" width="64" height="64" />
-    </a>
-  </p>
-</div>
+<br />
+
+<a href="https://github.com/sponsors/gioboa">
+  <img src="./docs/sponsors.png" alt="Sponsors" />
+</a>
+
+## Become a sponsor
+
+[Support this project on GitHub Sponsors](https://github.com/sponsors/gioboa)
 
 ## Reason why 🤔
 

package/lib/index.js

@@ -650,7 +650,7 @@ function getExposesCssMapPlaceholder() {
 function getVirtualExposesId(options) {
 	return `virtual:mf-exposes:${`${options.internalName}__${options.filename}`.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
 }
-function generateExposes(options) {
+function generateExposes(options, remoteDependencyMap = {}, command = "build") {
 	return `
     const cssAssetMap = ${JSON.stringify(options.bundleAllCSS ? EXPOSES_CSS_MAP_PLACEHOLDER : {})};
     const injectedCssHrefs = new Set();
@@ -683,8 +683,12 @@ function generateExposes(options) {
           }
           injectedCssHrefs.add(href);
 
+          // Check for any existing stylesheet with the same href, not just
+          // MF-injected ones. This prevents duplicate <link> tags when Vite's
+          // own CSS module injection or MF runtime's createLink has already
+          // created a <link rel="stylesheet"> for the same URL.
           const existingLink = document.querySelector(
-            \`link[rel="stylesheet"][data-mf-href="\${href}"]\`
+            \`link[rel="stylesheet"][href="\${href}"]\`
           );
           if (existingLink) {
             return Promise.resolve();
@@ -694,7 +698,6 @@ function generateExposes(options) {
             const link = document.createElement("link");
             link.rel = "stylesheet";
             link.href = href;
-            link.setAttribute("data-mf-href", href);
             link.onload = () => resolve();
             link.onerror = () => reject(new Error(\`[Module Federation] Failed to load CSS asset: \${href}\`));
             document.head.appendChild(link);
@@ -705,12 +708,22 @@ function generateExposes(options) {
 
     export default {
     ${Object.keys(options.exposes).map((key) => {
+		const remoteDependencyPreloads = (remoteDependencyMap[key] ?? []).map((remoteId) => {
+			const virtualRemote = getRemoteVirtualModule(remoteId, command);
+			return `import(${JSON.stringify(virtualRemote.getImportId())})
+            .then((mod) => mod.__mf_remote_pending)`;
+		}).join(",");
 		return `
         ${JSON.stringify(key)}: async () => {
           await injectCssAssets(${JSON.stringify(key)})
+          await Promise.all([${remoteDependencyPreloads}])
           const importModule = await importExposedModule(
             () => import(${JSON.stringify(options.exposes[key].import)})
           )
+          const dependencyPending = importModule && importModule.__mf_remote_dependency_pending;
+          if (dependencyPending && typeof dependencyPending.then === "function") {
+            await dependencyPending;
+          }
           const exportModule = {}
           Object.assign(exportModule, importModule)
           Object.defineProperty(exportModule, "__esModule", {
@@ -1245,7 +1258,7 @@ function writePreBuildLibPath(pkg, shareItem) {
     const __mfPrebuildExports = __mfPrebuildNamespace;
     ${declarations}
     ${namedExportLine}
-    export default __mfPrebuildExports;
+    export default __mfPrebuildNamespace.default ?? __mfPrebuildNamespace;
   `, true);
 		return;
 	}
@@ -1334,13 +1347,13 @@ function generateLazyWorkspaceSingletonExports(namedExports, importSource, cache
       ${eagerLocalFallback ? applyLocalFallback : `if (import.meta.env.SSR) {
         ${applyLocalFallback}
       } else {
-        initPromise.then(() =>
+        (__mfModuleCache.pendingShareLoads ||= []).push(initPromise.then(() =>
           import(${escapeGeneratedStringLiteral(importSource)}).then((mod) => {
             exportModule = __mfNormalizeShareModule(mod);
             __mfWriteSharedCache(__mfModuleCache.share, ${cacheDescriptor}, exportModule);
             __mfApplyLazyShareExports(exportModule);
           })
-        );
+        ));
       }`}
     } else {
       __mfApplyLazyShareExports(exportModule);
@@ -1367,13 +1380,13 @@ function generateDeferredHostProvidedExports(namedExports, pkg, cacheDescriptor)
     };
     let exportModule = __mfReadSharedCache(__mfModuleCache.share, ${cacheDescriptor});
     if (exportModule === undefined) {
-      initPromise.then(() => {
+      (__mfModuleCache.pendingShareLoads ||= []).push(initPromise.then(() => {
         exportModule = __mfReadSharedCache(__mfModuleCache.share, ${cacheDescriptor});
         if (exportModule === undefined) {
           throw new Error("[Module Federation] Shared module ${pkg} was imported before federation bootstrap finished.");
         }
         __mfApplyHostProvidedExports(exportModule);
-      });
+      }));
     } else {
       __mfApplyHostProvidedExports(exportModule);
     }
@@ -1890,7 +1903,6 @@ function generateRemoteEntry(options, virtualExposesId = getVirtualExposesId(opt
     if (initScope.indexOf(initToken) >= 0) return;
     initScope.push(initToken);
     initRes.initShareScopeMap('${options.shareScope}', shared);
-    initResolve(initRes)
     try {
       await retrySharedInit(async () => {
         await Promise.all(await initRes.initializeSharing('${options.shareScope}', {
@@ -1914,6 +1926,7 @@ function generateRemoteEntry(options, virtualExposesId = getVirtualExposesId(opt
       const resolved = await Promise.resolve(mod);
       __mfWriteSharedCache(__mfModuleCache.share, cacheDescriptor, __mfNormalizeRuntimeShare(resolved));
     }
+    initResolve(initRes)
     return initRes
   }
 
@@ -2272,10 +2285,10 @@ function injectHostInitPreloads(html, bundle, resolvePath) {
 function getFirstHtmlEntryFile(entryFiles) {
 	return entryFiles.find((file) => file.endsWith(".html"));
 }
-function stripQueryAndHash(file) {
+function stripQueryAndHash$1(file) {
 	return file.split(/[?#]/)[0];
 }
-function resolveDevHashEntryFileName(fileName) {
+function resolveDevHashEntryFileName$1(fileName) {
 	if (!fileName.includes("[hash")) return fileName;
 	const normalized = fileName.replace(/(?:[._-]?\[hash(?::\d+)?\])/g, "");
 	const baseName = path$1.basename(normalized);
@@ -2419,6 +2432,9 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
   await __mfHostInit.__tla;
   const { initHost } = __mfHostInit;
   ${preloadBlock}
+  if (__mfModuleCache.pendingShareLoads) {
+    await Promise.all(__mfModuleCache.pendingShareLoads);
+  }
 })().then(() => ${importExpression(entrySrc)});
 `;
 		return [
@@ -2461,7 +2477,7 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
 		const scriptRegex = /<script\b(?=[^>]*\btype=["']module["'])(?=[^>]*\bsrc=["']([^"']+)["'])[^>]*>/gi;
 		let match;
 		while ((match = scriptRegex.exec(htmlContent)) !== null) {
-			const scriptSrc = stripQueryAndHash(match[1]);
+			const scriptSrc = stripQueryAndHash$1(match[1]);
 			if (/^(?:[a-z]+:)?\/\//i.test(scriptSrc)) continue;
 			addEntryFile(scriptSrc);
 			addEntryFile(scriptSrc.startsWith("/") ? path$1.resolve(viteConfig.root, scriptSrc.slice(1)) : path$1.resolve(path$1.dirname(htmlPath), scriptSrc));
@@ -2504,7 +2520,7 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
 					next();
 					return;
 				}
-				const devFileName = resolveDevHashEntryFileName(fileName);
+				const devFileName = resolveDevHashEntryFileName$1(fileName);
 				if (devFileName !== fileName && req.url?.startsWith((viteConfig.base + devFileName).replace(/^\/?/, "/"))) req.url = req.url.replace(devFileName, fileName);
 				if (req.url && req.url.startsWith((viteConfig.base + fileName).replace(/^\/?/, "/"))) req.url = devEntryPath;
 				next();
@@ -4088,8 +4104,39 @@ function pluginModuleParseEnd_default(excludeFn, options) {
 }
 //#endregion
 //#region src/plugins/pluginProxyRemoteEntry.ts
+function resolveDevHashEntryFileName(fileName) {
+	if (!fileName.includes("[hash")) return fileName;
+	const normalized = fileName.replace(/(?:[._-]?\[hash(?::\d+)?\])/g, "");
+	const baseName = path$1.basename(normalized);
+	return path$1.extname(baseName) ? normalized : `${normalized}.js`;
+}
 function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposesId }) {
 	let viteConfig, _command, root;
+	let exposeRemoteDependencies = {};
+	function isRemoteImport(source) {
+		return Object.keys(options.remotes).some((name) => source === name || source.startsWith(name + "/"));
+	}
+	function collectRemoteDependencies(code) {
+		const dependencies = /* @__PURE__ */ new Set();
+		for (const match of code.matchAll(/(?:^|[;\n\r])\s*import\s+(?:[\s\S]*?\s+from\s+)?["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g)) {
+			const source = match[1] || match[2];
+			if (source && isRemoteImport(source)) dependencies.add(source);
+		}
+		return Array.from(dependencies).sort();
+	}
+	async function refreshExposeRemoteDependencies(ctx) {
+		const next = {};
+		for (const [exposeKey, expose] of Object.entries(options.exposes)) {
+			const resolved = await ctx.resolve(expose.import);
+			if (!resolved?.id || resolved.id.includes("\0")) continue;
+			try {
+				next[exposeKey] = collectRemoteDependencies(readFileSync$1(resolved.id, "utf8"));
+			} catch {
+				next[exposeKey] = [];
+			}
+		}
+		exposeRemoteDependencies = next;
+	}
 	return {
 		name: "proxyRemoteEntry",
 		enforce: "post",
@@ -4101,6 +4148,7 @@ function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposes
 			_command = command;
 		},
 		async buildStart() {
+			await refreshExposeRemoteDependencies(this);
 			if (_command !== "build") return;
 			for (const expose of Object.values(options.exposes)) {
 				const resolved = await this.resolve(expose.import);
@@ -4122,19 +4170,19 @@ function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposes
 		},
 		load(id) {
 			if (id === remoteEntryId) return parsePromise.then((_) => generateRemoteEntry(options, virtualExposesId, _command));
-			if (id === virtualExposesId) return generateExposes(options);
+			if (id === virtualExposesId) return generateExposes(options, exposeRemoteDependencies, _command);
 			if (_command === "serve" && id.includes(getHostAutoInitPath())) return id;
 		},
 		transform(code, id) {
 			return mapCodeToCodeWithSourcemap((() => {
 				if (!filterId(id)) return;
 				if (id.includes(remoteEntryId)) return parsePromise.then((_) => generateRemoteEntry(options, virtualExposesId, _command));
-				if (id === virtualExposesId) return generateExposes(options);
+				if (id === virtualExposesId) return generateExposes(options, exposeRemoteDependencies, _command);
 				if (id.includes(getHostAutoInitPath())) {
 					if (_command === "serve") {
 						const host = typeof viteConfig.server?.host === "string" && viteConfig.server.host !== "0.0.0.0" ? viteConfig.server.host : "localhost";
 						const resolvedPublicPath = resolvePublicPath(options, viteConfig.base);
-						const publicPath = JSON.stringify((resolvedPublicPath === "auto" ? "/" : resolvedPublicPath) + options.filename);
+						const publicPath = JSON.stringify((resolvedPublicPath === "auto" ? "/" : resolvedPublicPath) + resolveDevHashEntryFileName(options.filename));
 						const fallbackOrigin = `//${host}:${viteConfig.server?.port}`;
 						const ssrRemoteEntry = "data:text/javascript," + encodeURIComponent("export async function init(){return {loadRemote:async()=>({}),loadShare:async()=>({})}}");
 						return `
@@ -4573,26 +4621,7 @@ function applyRewrites(code, imports, id) {
 	const ms = new CodeRewriter(code);
 	let changed = false;
 	let counter = 0;
-	let namedProxyHelperDeclared = false;
 	const dependencyPendingIds = [];
-	const namedProxyHelper = `function __mfCreateNamedRemoteProxy(ns, key) {
-  const target = function (...args) {
-    const value = ns[key];
-    return typeof value === "function" ? value.apply(this, args) : value;
-  };
-  return new Proxy(target, {
-    get(_target, prop) {
-      if (prop === "then") return undefined;
-      const value = ns[key];
-      if (prop === Symbol.toPrimitive) return () => value;
-      const item = value == null ? undefined : value[prop];
-      return typeof item === "function" ? item.bind(value) : item;
-    },
-    apply(target, thisArg, args) {
-      return target.apply(thisArg, args);
-    }
-  });
-}`;
 	for (const imp of imports) switch (imp.kind) {
 		case "static": {
 			const src = JSON.stringify(imp.source);
@@ -4610,20 +4639,8 @@ function applyRewrites(code, imports, id) {
 				importParts.push(`__mf_remote_pending as ${pendingId}`);
 				let rewrite = `import { ${importParts.join(", ")} } from ${src};`;
 				if (imp.named.length > 0) {
-					const isProxyId = `__mf_is_proxy_${counter++}`;
-					const tempNames = imp.named.map((_s) => `__mf_named_${counter++}`);
-					const destructParts = imp.named.map((s, index) => `${s.imported}: ${tempNames[index]}`);
-					const bindingLines = imp.named.map((s, index) => {
-						const temp = tempNames[index];
-						return `const ${s.local} = ${isProxyId} ? __mfCreateNamedRemoteProxy(${nsId}, ${JSON.stringify(s.imported)}) : ${temp};`;
-					});
-					if (!namedProxyHelperDeclared) {
-						rewrite += `\n${namedProxyHelper}`;
-						namedProxyHelperDeclared = true;
-					}
-					rewrite += `\nconst ${isProxyId} = ${nsId} && ${nsId}.__mf_is_remote_proxy;`;
-					rewrite += `\nconst { ${destructParts.join(", ")} } = ${isProxyId} ? {} : ${nsId};`;
-					rewrite += `\n${bindingLines.join("\n")}`;
+					const destructParts = imp.named.map((s) => `${s.imported}: ${s.local}`);
+					rewrite += `\nconst { ${destructParts.join(", ")} } = ${nsId};`;
 				}
 				ms.overwrite(imp.start, imp.end, rewrite);
 			}
@@ -4880,6 +4897,104 @@ function pluginRemoteNamedExports(options) {
 }
 //#endregion
 //#region src/plugins/pluginSSRRemoteEntry.ts
+const MAX_RUNNER_BODY_BYTES = 1024 * 1024;
+const ALLOWED_RUNNER_INVOKE_NAMES = new Set(["fetchModule", "getBuiltins"]);
+const VITE_FS_PREFIX = "/@fs/";
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function stripQueryAndHash(id) {
+	const queryIndex = id.indexOf("?");
+	const hashIndex = id.indexOf("#");
+	const endIndex = queryIndex === -1 ? hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+	return endIndex === -1 ? id : id.slice(0, endIndex);
+}
+function decodeRunnerFilePath(filePath) {
+	try {
+		return decodeURIComponent(filePath);
+	} catch {
+		return;
+	}
+}
+function hasRelativeTraversal(id) {
+	return id.split(/[\\/]+/).includes("..");
+}
+function getRealPathIfExists(filePath) {
+	try {
+		return fs$1.realpathSync.native(filePath);
+	} catch {
+		return;
+	}
+}
+function isPathWithinDirectory(filePath, directory) {
+	const realFilePath = getRealPathIfExists(filePath) ?? path$1.resolve(filePath);
+	const realDirectory = getRealPathIfExists(directory) ?? path$1.resolve(directory);
+	const relative = path$1.relative(realDirectory, realFilePath);
+	return relative === "" || !relative.startsWith("..") && !path$1.isAbsolute(relative);
+}
+function getRunnerAllowedDirectories(config) {
+	return [config.root, ...config.server?.fs?.allow ?? []].map((directory) => path$1.resolve(directory));
+}
+function isPathWithinAllowedDirectories(filePath, allowedDirectories) {
+	return allowedDirectories.some((directory) => isPathWithinDirectory(filePath, directory));
+}
+function isSafeRunnerFetchModuleId(id, config) {
+	if (typeof id !== "string" || !id || id.includes("\0")) return false;
+	const decoded = decodeViteId(id).replace(/^\0+/, "");
+	if (!decoded || decoded.startsWith("virtual:")) return !!decoded;
+	if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(decoded) || decoded.startsWith("//")) return false;
+	const cleanId = decodeRunnerFilePath(stripQueryAndHash(decoded));
+	if (!cleanId || hasRelativeTraversal(cleanId)) return false;
+	const allowedDirectories = getRunnerAllowedDirectories(config);
+	if (cleanId.startsWith(VITE_FS_PREFIX)) {
+		const fsPath = cleanId.slice(5);
+		return path$1.isAbsolute(fsPath) && isPathWithinAllowedDirectories(fsPath, allowedDirectories);
+	}
+	if (path$1.isAbsolute(cleanId)) {
+		if (isPathWithinAllowedDirectories(cleanId, allowedDirectories)) return true;
+		return !fs$1.existsSync(cleanId);
+	}
+	return true;
+}
+function isRunnerInvokePayload(payload, config) {
+	if (!payload || typeof payload !== "object") return false;
+	if (payload.type !== "custom" || payload.event !== "vite:invoke") return false;
+	const data = payload.data;
+	if (!data || typeof data !== "object") return false;
+	const name = data.name;
+	const args = data.data;
+	if (typeof name !== "string" || !ALLOWED_RUNNER_INVOKE_NAMES.has(name) || !Array.isArray(args)) return false;
+	if (name === "getBuiltins") return args.length === 0;
+	if (args.length < 1 || args.length > 3) return false;
+	const [id, importer, opts] = args;
+	return isSafeRunnerFetchModuleId(id, config) && (importer === void 0 || importer === null || isSafeRunnerFetchModuleId(importer, config)) && (opts === void 0 || isPlainObject(opts));
+}
+function readBoundedRunnerBody(req, res) {
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let done = false;
+		const fail = (statusCode, message) => {
+			if (done) return;
+			done = true;
+			res.statusCode = statusCode;
+			res.end(message);
+			resolve(void 0);
+		};
+		req.on("data", (chunk) => {
+			if (done) return;
+			size += chunk.length;
+			if (size > MAX_RUNNER_BODY_BYTES) return fail(413, "Payload too large");
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			if (done) return;
+			done = true;
+			resolve(Buffer.concat(chunks));
+		});
+		req.on("error", () => fail(400, "Bad request"));
+	});
+}
 /**
 * Emits a Node-compatible SSR remote entry alongside the browser entry.
 *
@@ -4966,7 +5081,8 @@ function pluginSSRRemoteEntry(options) {
 			});
 			const ssrEnv = server.environments?.ssr;
 			const clientEnv = server.environments?.client;
-			if (typeof (ssrEnv?.fetchModule ?? clientEnv?.fetchModule) === "function") server.middlewares.use("/__mf_runner__", async (req, res) => {
+			const runnerEnv = typeof ssrEnv?.hot?.handleInvoke === "function" ? ssrEnv : typeof clientEnv?.hot?.handleInvoke === "function" ? clientEnv : void 0;
+			if (typeof (ssrEnv?.fetchModule ?? clientEnv?.fetchModule) === "function" && runnerEnv) server.middlewares.use("/__mf_runner__", async (req, res) => {
 				res.setHeader("Access-Control-Allow-Origin", "*");
 				if (req.method === "OPTIONS") {
 					res.setHeader("Access-Control-Allow-Methods", "POST");
@@ -4981,46 +5097,37 @@ function pluginSSRRemoteEntry(options) {
 					return;
 				}
 				try {
-					const chunks = [];
-					await new Promise((resolve, reject) => {
-						req.on("data", (chunk) => chunks.push(chunk));
-						req.on("end", resolve);
-						req.on("error", reject);
-					});
-					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					if (body.name === "getBuiltins") {
-						const builtins = (clientEnv ?? ssrEnv)?.config?.resolve?.builtins ?? [];
-						res.setHeader("Content-Type", "application/json");
-						res.end(JSON.stringify({ result: builtins }));
+					const rawBody = await readBoundedRunnerBody(req, res);
+					if (!rawBody) return;
+					let body;
+					try {
+						body = JSON.parse(rawBody.toString("utf8"));
+					} catch {
+						res.statusCode = 400;
+						res.end(JSON.stringify({ error: { message: "Invalid JSON" } }));
 						return;
 					}
-					if (body.name !== "fetchModule") {
+					if (!isRunnerInvokePayload(body, server.config)) {
 						res.statusCode = 400;
-						res.end(JSON.stringify({ error: { message: `Unsupported invoke: ${body.name}` } }));
+						res.end(JSON.stringify({ error: { message: "Invalid runner invoke" } }));
 						return;
 					}
-					const [id, importer, opts] = body.data;
-					const fetchEnv = ssrEnv ?? clientEnv;
-					const fetchFn = fetchEnv.fetchModule.bind(fetchEnv);
-					let result;
-					try {
-						result = await fetchFn(id, importer, opts);
-					} catch (fetchErr) {
-						const bareId = decodeViteId(id);
-						try {
+					let result = await runnerEnv.hot.handleInvoke(body);
+					if ("error" in result && body.data.name === "fetchModule") {
+						const id = body.data.data[0];
+						const bareId = typeof id === "string" ? decodeViteId(id).replace(/^\0/, "") : "";
+						if (bareId && !bareId.startsWith(".") && !bareId.startsWith("/") && !bareId.startsWith("file:") && !/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(bareId)) try {
 							const { createRequire } = await import("module");
 							const path = await import("path");
 							const { pathToFileURL } = await import("url");
-							result = {
-								externalize: pathToFileURL(createRequire(pathToFileURL(path.join(server.config.root, "package.json"))).resolve(bareId.replace(/^\0/, ""))).href,
+							result = { result: {
+								externalize: pathToFileURL(createRequire(pathToFileURL(path.join(server.config.root, "package.json"))).resolve(bareId)).href,
 								type: "module"
-							};
-						} catch {
-							throw fetchErr;
-						}
+							} };
+						} catch {}
 					}
 					res.setHeader("Content-Type", "application/json");
-					res.end(JSON.stringify({ result }));
+					res.end(JSON.stringify(result));
 				} catch (e) {
 					res.setHeader("Content-Type", "application/json");
 					res.end(JSON.stringify({ error: { message: String(e instanceof Error ? e.message : e) } }));
@@ -5864,7 +5971,9 @@ function federation(mfUserOptions) {
 			},
 			load(id) {
 				if (id.includes("__loadShare__") || id.includes("__loadRemote__")) {
-					let code = VirtualModule.findById(id)?.code ?? readFileSync(id, "utf-8");
+					const virtualModule = VirtualModule.findById(id);
+					if (!virtualModule?.code) return null;
+					let code = virtualModule.code;
 					const environmentName = this.environment?.name;
 					if (environmentName && environmentName !== "client" || !environmentName && isSsrBuild) code = prependWorkspaceSingletonSsrImport(code);
 					code = code.replace(/import\s+["'][^"']*__prebuild__[^"']*["']\s*;?/g, "");
@@ -5948,7 +6057,15 @@ function federation(mfUserOptions) {
 				options.runtimePlugins.forEach((p) => {
 					const pluginPath = typeof p === "string" ? p : p[0];
 					if (SSR_ONLY_PLUGINS.has(pluginPath)) return;
-					if (pluginPath && !pluginPath.startsWith(".") && !pluginPath.startsWith("/") && !pluginPath.startsWith("\0") && !pluginPath.startsWith("virtual:")) config.optimizeDeps.include.push(pluginPath);
+					if (pluginPath && !pluginPath.startsWith(".") && !pluginPath.startsWith("/") && !pluginPath.startsWith("\0") && !pluginPath.startsWith("virtual:")) {
+						let optimizeDep = pluginPath;
+						if (pluginPath === "@module-federation/dts-plugin/dynamic-remote-type-hints-plugin") try {
+							optimizeDep = normalizePathForImport(resolveImportPath(pluginPath));
+						} catch {
+							optimizeDep = pluginPath;
+						}
+						config.optimizeDeps.include.push(optimizeDep);
+					}
 				});
 				if (isRolldown) {
 					config.build ??= {};

package/lib/ssrVmStrategy-DtpfkCw1.js

@@ -0,0 +1,152 @@
+import { SsrEntryHttpError, neutralizeBrowserPreloadHelpers } from "./utils/ssrEntryLoader.js";
+//#region src/utils/ssrVmStrategy.ts
+/**
+* vm.SourceTextModule strategy for loading remote SSR entries.
+*
+* Unlike the temp-file strategy (which rewrites bare shared imports to
+* host-resolved file:// paths at fetch time), this strategy evaluates the
+* remote's ESM graph with `vm.SourceTextModule` in the current context and
+* resolves bare imports through a linker, in order:
+*
+*  1. The host's federation share scope — `instance.loadShare(name)` on the
+*     global `__FEDERATION__` instances. This restores real share-scope
+*     semantics (version negotiation, loaded-first reuse) on the server.
+*  2. The build-time `resolvedShared` file map (same source as the temp-file
+*     strategy) as a fallback when no instance shares the package.
+*  3. Plain host `import(specifier)` for everything else (node builtins,
+*     packages the remote expects the host to provide).
+*
+* Requires Node with `--experimental-vm-modules`; callers must check
+* `isVmStrategyAvailable()` and fall back to the temp-file strategy when the
+* API is missing.
+*/
+let vmApiPromise;
+async function getVmApi() {
+	if (!vmApiPromise) vmApiPromise = (async () => {
+		try {
+			const vm = await import(
+				/* @vite-ignore */
+				"vm"
+);
+			if (typeof vm.SourceTextModule !== "function" || typeof vm.SyntheticModule !== "function") return null;
+			return vm;
+		} catch {
+			return null;
+		}
+	})();
+	return vmApiPromise;
+}
+async function isVmStrategyAvailable() {
+	return await getVmApi() !== null;
+}
+function getFederationInstances() {
+	return globalThis.__FEDERATION__?.__INSTANCES__ ?? [];
+}
+/**
+* Resolve a bare specifier to a module namespace: share scope first, then the
+* build-time resolvedShared file map, then plain host import.
+*/
+async function loadBareModule(specifier, options) {
+	for (const instance of getFederationInstances()) {
+		if (typeof instance?.loadShare !== "function") continue;
+		if (!instance.options?.shared || !(specifier in instance.options.shared)) continue;
+		try {
+			const factory = await instance.loadShare(specifier);
+			if (typeof factory === "function") {
+				const shared = factory();
+				if (shared) return shared;
+			}
+		} catch {}
+	}
+	const resolvedPath = options.resolvedShared[specifier];
+	if (resolvedPath) return import(
+		/* @vite-ignore */
+		`file://${resolvedPath}`
+);
+	return import(
+		/* @vite-ignore */
+		specifier
+);
+}
+function createSyntheticModule(vm, specifier, namespace) {
+	const source = namespace && typeof namespace === "object" ? namespace : { default: namespace };
+	const exportNames = new Set(Object.keys(source));
+	exportNames.add("default");
+	const syntheticModule = new vm.SyntheticModule([...exportNames], () => {
+		for (const exportName of exportNames) if (exportName === "default") syntheticModule.setExport("default", source.default !== void 0 ? source.default : namespace);
+		else syntheticModule.setExport(exportName, source[exportName]);
+	}, { identifier: `mf-shared:${specifier}` });
+	return syntheticModule;
+}
+const httpModuleCache = /* @__PURE__ */ new Map();
+const namespaceCache = /* @__PURE__ */ new Map();
+function getBodyPreview(body) {
+	return body.slice(0, 240).replace(/\s+/g, " ").trim();
+}
+async function fetchModuleSource(url) {
+	const res = await fetch(url);
+	const text = await res.text();
+	if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(text));
+	return neutralizeBrowserPreloadHelpers(text);
+}
+function isHttpUrl(value) {
+	return value.startsWith("http://") || value.startsWith("https://");
+}
+/** Resolve a specifier against the referencing module's URL; null for bare specifiers. */
+function resolveSpecifierUrl(specifier, referencerUrl) {
+	if (isHttpUrl(specifier)) return specifier;
+	if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/")) return new URL(specifier, referencerUrl).href;
+	return null;
+}
+function getHttpModule(vm, url, options) {
+	const cacheKey = `${options.versionKey}::${url}`;
+	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
+		const code = await fetchModuleSource(url);
+		return new vm.SourceTextModule(code, {
+			identifier: url,
+			initializeImportMeta(meta) {
+				meta.url = url;
+			},
+			importModuleDynamically: (specifier, referencingModule) => importDynamically(vm, specifier, referencingModule, options)
+		});
+	})().catch((error) => {
+		httpModuleCache.delete(cacheKey);
+		throw error;
+	}));
+	return httpModuleCache.get(cacheKey);
+}
+async function linkModule(vm, specifier, referencingModule, options) {
+	const url = resolveSpecifierUrl(specifier, referencingModule.identifier);
+	if (url) return getHttpModule(vm, url, options);
+	return createSyntheticModule(vm, specifier, await loadBareModule(specifier, options));
+}
+async function importDynamically(vm, specifier, referencingModule, options) {
+	const linker = (spec, referencer) => linkModule(vm, spec, referencer, options);
+	const module = await linker(specifier, referencingModule);
+	if (module.status === "unlinked") await module.link(linker);
+	if (module.status === "linked") await module.evaluate();
+	return module;
+}
+/**
+* Load and evaluate a remote SSR entry as a `vm.SourceTextModule` graph and
+* return its namespace (the federation container with `init`/`get`).
+* Returns null when the vm module APIs are unavailable.
+*/
+async function loadViaVmStrategy(entryUrl, options) {
+	const vm = await getVmApi();
+	if (!vm) return null;
+	const cacheKey = `${options.versionKey}::${entryUrl}`;
+	if (!namespaceCache.has(cacheKey)) namespaceCache.set(cacheKey, (async () => {
+		const entryModule = await getHttpModule(vm, entryUrl, options);
+		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, options);
+		if (entryModule.status === "unlinked") await entryModule.link(linker);
+		if (entryModule.status === "linked") await entryModule.evaluate();
+		return entryModule.namespace;
+	})().catch((error) => {
+		namespaceCache.delete(cacheKey);
+		throw error;
+	}));
+	return namespaceCache.get(cacheKey);
+}
+//#endregion
+export { isVmStrategyAvailable, loadViaVmStrategy };

package/lib/utils/ssrEntryLoader.d.ts

@@ -32,6 +32,29 @@ interface RemoteInfo {
   type?: string;
   entryGlobalName?: string;
 }
+declare class SsrEntryHttpError extends Error {
+  readonly url: string;
+  readonly status: number;
+  readonly statusText: string;
+  readonly bodyPreview: string;
+  constructor(url: string, status: number, statusText: string, bodyPreview: string);
+}
+/**
+ * Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
+ * remote SSR entries. Pass a remote entry URL to scope the invalidation to one
+ * remote; call with no arguments to invalidate everything.
+ *
+ * Note: the MF runtime keeps its own container/module caches per federation
+ * instance. This function best-effort clears the module caches of all global
+ * federation instances so re-renders load fresh remote modules, but hosts that
+ * hold direct references to previously loaded modules keep those references.
+ */
+declare function revalidate(remoteEntryUrl?: string): void;
+/**
+ * Neutralize browser-only preload machinery in Vite/Rolldown output so the
+ * code can evaluate in Node. Shared by the temp-file and vm strategies.
+ */
+declare function neutralizeBrowserPreloadHelpers(code: string): string;
 /**
  * MF runtime plugin factory.
  *
@@ -50,6 +73,33 @@ interface SsrEntryLoaderOptions {
    * in remote SSR entry temp files — no runtime createRequire walk-up needed.
    */
   resolvedShared?: Record<string, string>;
+  /**
+   * How to evaluate remote SSR entries on the server.
+   *
+   * - `'temp-file'` (default): fetch the ESM graph, rewrite specifiers, write
+   *   temp files and `import()` them. Works on stock Node; shared packages are
+   *   pinned to the host's copies via `resolvedShared` (no version negotiation).
+   * - `'vm'`: evaluate the graph with `vm.SourceTextModule` and link bare
+   *   shared imports through the host's federation share scope (`loadShare`),
+   *   restoring version negotiation. Requires `--experimental-vm-modules`;
+   *   falls back to `'temp-file'` when unavailable.
+   */
+  strategy?: 'temp-file' | 'vm';
+  /**
+   * Share scope consulted by the `'vm'` strategy when linking bare imports.
+   * Defaults to `'default'`.
+   */
+  shareScopeName?: string;
+  /**
+   * Re-check each remote's manifest when the cached SSR entry resolution is
+   * older than this many milliseconds. When the manifest's version changes
+   * (remote redeployed at the same URL), the loader drops its caches for that
+   * remote so subsequent loads use the new build. Omit to cache until process
+   * exit or an explicit `revalidate()` call. Only manifest-resolved entries
+   * can be revalidated this way — convention-resolved entries have no version
+   * source.
+   */
+  maxAgeMs?: number;
 }
 declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   name: string;
@@ -63,4 +113,4 @@ declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   } | undefined>;
 };
 //#endregion
-export { ssrEntryLoaderPlugin as default };
+export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/lib/utils/ssrEntryLoader.js

@@ -70,10 +70,7 @@ async function getOrCreateRunner(remoteOrigin) {
 					return await (await fetch(runnerEndpoint, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
-						body: JSON.stringify({
-							name: payload.data.name,
-							data: payload.data.data
-						})
+						body: JSON.stringify(payload)
 					})).json();
 				} }
 			}, new ESModulesEvaluator());
@@ -88,6 +85,27 @@ const _path = () => nodeImport("path");
 const _fs = () => nodeImport("fs");
 const _crypto = () => nodeImport("crypto");
 const _module = () => nodeImport("module");
+/**
+* Version key for a resolved SSR entry. Derived from the remote's manifest
+* content so a redeploy at the same URL produces a different key, which in
+* turn produces different temp-file names — busting both our caches and
+* Node's ESM module cache. Convention-resolved entries (no manifest) get a
+* stable placeholder key and cannot be revalidated automatically.
+*/
+const UNVERSIONED = "unversioned";
+function hashString(value) {
+	let hash = 2166136261;
+	for (let i = 0; i < value.length; i++) {
+		hash ^= value.charCodeAt(i);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function computeManifestVersionKey(manifest) {
+	const buildVersion = manifest.metaData?.buildInfo?.buildVersion;
+	const contentHash = hashString(JSON.stringify(manifest));
+	return buildVersion ? `${buildVersion}-${contentHash}` : contentHash;
+}
 const ssrEntryCache = /* @__PURE__ */ new Map();
 const manifestFetchCache = /* @__PURE__ */ new Map();
 var SsrEntryHttpError = class extends Error {
@@ -149,7 +167,8 @@ function resolveSSREntryUrl(manifest, manifestUrl) {
 	const entryPath = (meta.ssrRemoteEntry.path || "") + meta.ssrRemoteEntry.name;
 	return {
 		url: new URL(entryPath, base).href,
-		type: meta.ssrRemoteEntry.type || "module"
+		type: meta.ssrRemoteEntry.type || "module",
+		versionKey: computeManifestVersionKey(manifest)
 	};
 }
 /**
@@ -191,14 +210,17 @@ function buildSsrEntryCandidates(ctx, options = {}) {
 	const candidates = [];
 	if (!options.skipServerBuild) candidates.push({
 		url: `${remoteOrigin}/__mf_server__/${filename}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	});
 	candidates.push({
 		url: `${base}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	}, {
 		url: `${remoteOrigin}/__mf_ssr__/${filename}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	});
 	return candidates;
 }
@@ -212,13 +234,15 @@ async function resolveFirstReachableCandidate(candidates) {
 async function resolveSSREntryImpl(remoteEntryUrl) {
 	if (isSsrEntry(remoteEntryUrl)) return {
 		url: remoteEntryUrl,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	};
 	if (!isManifestEntry(remoteEntryUrl)) {
 		const filename = getEntryFilename(remoteEntryUrl);
 		const fromServerBuild = await headCheckSsrEntry({
 			url: `${remoteEntryUrl.replace(/\/[^/]+$/, "")}/__mf_server__/${filename}.ssr.js`,
-			type: "module"
+			type: "module",
+			versionKey: UNVERSIONED
 		});
 		if (fromServerBuild) return fromServerBuild;
 	}
@@ -229,9 +253,63 @@ async function resolveSSREntryImpl(remoteEntryUrl) {
 	}
 	return resolveFirstReachableCandidate(buildSsrEntryCandidates(ctx, { skipServerBuild: !isManifestEntry(remoteEntryUrl) }));
 }
-async function getSSREntry(remoteEntryUrl) {
-	if (!ssrEntryCache.has(remoteEntryUrl)) ssrEntryCache.set(remoteEntryUrl, resolveSSREntryImpl(remoteEntryUrl));
-	return ssrEntryCache.get(remoteEntryUrl);
+function setSsrEntryCache(remoteEntryUrl) {
+	const record = {
+		promise: resolveSSREntryImpl(remoteEntryUrl),
+		resolvedAt: Date.now()
+	};
+	ssrEntryCache.set(remoteEntryUrl, record);
+	return record;
+}
+async function getSSREntry(remoteEntryUrl, maxAgeMs) {
+	const cached = ssrEntryCache.get(remoteEntryUrl);
+	if (!cached) return setSsrEntryCache(remoteEntryUrl).promise;
+	if (!(typeof maxAgeMs === "number" && maxAgeMs >= 0 && Date.now() - cached.resolvedAt >= maxAgeMs)) return cached.promise;
+	const previous = await cached.promise.catch(() => null);
+	manifestFetchCache.delete(getManifestUrl(remoteEntryUrl));
+	const record = setSsrEntryCache(remoteEntryUrl);
+	const next = await record.promise.catch(() => null);
+	if (previous && next && previous.versionKey !== next.versionKey) dropRemoteCaches(remoteEntryUrl);
+	return record.promise;
+}
+/**
+* Drop per-remote caches after a version change so old artifacts stop being
+* reused. Temp-file cache keys hold SSR entry/chunk URLs (not the browser
+* entry URL), so scope the invalidation by origin.
+*/
+function dropRemoteCaches(remoteEntryUrl) {
+	let origin;
+	try {
+		origin = new URL(remoteEntryUrl).origin;
+	} catch {
+		return;
+	}
+	for (const key of tempFileCache.keys()) if (key.slice(key.indexOf("::") + 2).startsWith(origin)) tempFileCache.delete(key);
+}
+/**
+* Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
+* remote SSR entries. Pass a remote entry URL to scope the invalidation to one
+* remote; call with no arguments to invalidate everything.
+*
+* Note: the MF runtime keeps its own container/module caches per federation
+* instance. This function best-effort clears the module caches of all global
+* federation instances so re-renders load fresh remote modules, but hosts that
+* hold direct references to previously loaded modules keep those references.
+*/
+function revalidate(remoteEntryUrl) {
+	if (remoteEntryUrl) {
+		ssrEntryCache.delete(remoteEntryUrl);
+		manifestFetchCache.delete(getManifestUrl(remoteEntryUrl));
+		dropRemoteCaches(remoteEntryUrl);
+	} else {
+		ssrEntryCache.clear();
+		manifestFetchCache.clear();
+		tempFileCache.clear();
+	}
+	const federation = globalThis.__FEDERATION__;
+	for (const instance of federation?.__INSTANCES__ ?? []) try {
+		instance?.moduleCache?.clear?.();
+	} catch {}
 }
 const tempFileCache = /* @__PURE__ */ new Map();
 let ssrCacheDirPromise;
@@ -252,14 +330,11 @@ async function getSSRCacheDir() {
 	})();
 	return ssrCacheDirPromise;
 }
-function transformSsrCode(code, base, sharedPkgMap) {
-	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
-	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
-		const resolved = sharedPkgMap.get(specifier);
-		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
-	});
+/**
+* Neutralize browser-only preload machinery in Vite/Rolldown output so the
+* code can evaluate in Node. Shared by the temp-file and vm strategies.
+*/
+function neutralizeBrowserPreloadHelpers(code) {
 	code = code.replace(/import\s*\{([^}]*)\}\s*from\s*["'][^"']*preload-helper[^"']*["'];?/g, (_m, bindings) => {
 		return bindings.split(",").map((b) => {
 			const parts = b.trim().split(/\s+as\s+/);
@@ -270,6 +345,16 @@ function transformSsrCode(code, base, sharedPkgMap) {
 	code = code.replace(/\b([A-Za-z_$][\w$]*)\s*\(\s*\(\s*\)\s*=>\s*import\(([^)]*)\)\s*,\s*\[\]\s*\)/g, "import($2)");
 	return code;
 }
+function transformSsrCode(code, base, sharedPkgMap) {
+	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
+	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
+	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
+	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
+		const resolved = sharedPkgMap.get(specifier);
+		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
+	});
+	return neutralizeBrowserPreloadHelpers(code);
+}
 function isVitePreloadHelperSpecifier(specifier) {
 	return specifier.includes("preload-helper");
 }
@@ -277,10 +362,15 @@ function isVitePreloadHelperSpecifier(specifier) {
 * Fetch an HTTP ESM module, transform it, write it to a temp .js file and
 * return the file path. Recursively does the same for HTTP transitive imports
 * so that `import('file:///...temp.js')` can resolve them.
+*
+* `versionKey` participates in both the cache key and the temp file name, so
+* a remote redeploy (new manifest → new key) produces new files and bypasses
+* Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
+async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap, versionKey = UNVERSIONED) {
+	const cacheKey = `${versionKey}::${url}`;
 	if (visited.has(url)) return visited.get(url);
-	if (tempFileCache.has(url)) return tempFileCache.get(url);
+	if (tempFileCache.has(cacheKey)) return tempFileCache.get(cacheKey);
 	const promise = (async () => {
 		const res = await fetch(url);
 		let code = await res.text();
@@ -292,7 +382,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
 		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, sharedPkgMap);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, sharedPkgMap, versionKey);
 			subMap.set(u, `file://${tmpPath}`);
 		}));
 		code = transformSsrCode(code, base, sharedPkgMap);
@@ -300,22 +390,36 @@ async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
 		const { createHash } = await _crypto();
 		const { join } = await _path();
 		const { writeFileSync } = await _fs();
-		const tmpFile = join(tmpDir, `${createHash("sha1").update(url).digest("hex").slice(0, 12)}.js`);
+		const tmpFile = join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}.js`);
 		writeFileSync(tmpFile, code, "utf8");
 		visited.set(url, tmpFile);
 		return tmpFile;
 	})();
-	tempFileCache.set(url, promise);
+	tempFileCache.set(cacheKey, promise);
 	return promise;
 }
-async function importTempModule(filePath) {
-	return await import(
-		/* @vite-ignore */
-		filePath
-);
+async function importTempModule(filePath, versionKey) {
+	return await import(`${filePath}?v=${encodeURIComponent(versionKey)}`);
+}
+let warnedVmUnavailable = false;
+async function tryVmStrategy(ssrEntry, options) {
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("../ssrVmStrategy-DtpfkCw1.js");
+	if (!await isVmStrategyAvailable()) {
+		if (!warnedVmUnavailable) {
+			warnedVmUnavailable = true;
+			console.warn("[mf-vite:ssr-entry-loader] strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
+		}
+		return null;
+	}
+	return await loadViaVmStrategy(ssrEntry.url, {
+		resolvedShared: options.resolvedShared,
+		shareScopeName: options.shareScopeName,
+		versionKey: ssrEntry.versionKey
+	});
 }
-async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
-	const { url, type } = ssrEntry;
+async function loadSSRRemoteEntry(ssrEntry, options) {
+	const { url, type, versionKey } = ssrEntry;
+	const { resolvedShared } = options;
 	if (type === "commonjs-module" || type === "commonjs") {
 		const { createRequire } = await _module();
 		const req = createRequire(import.meta.url);
@@ -338,12 +442,18 @@ async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
 				if (process.env.NODE_ENV !== "production") return null;
 			}
 		}
+		if (options.strategy === "vm") try {
+			const fromVm = await tryVmStrategy(ssrEntry, options);
+			if (fromVm) return fromVm;
+		} catch (error) {
+			if (isSsrEntryHttpError(error)) throw error;
+		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
 		try {
-			return await importTempModule(await fetchEsmToTempFile(url, cacheDir, /* @__PURE__ */ new Map(), sharedPkgMap));
+			return await importTempModule(await fetchEsmToTempFile(url, cacheDir, /* @__PURE__ */ new Map(), sharedPkgMap, versionKey), versionKey);
 		} catch (error) {
 			if (isSsrEntryHttpError(error)) throw error;
 			return null;
@@ -359,18 +469,23 @@ async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
 	}
 }
 function ssrEntryLoaderPlugin(options = {}) {
-	const resolvedShared = options.resolvedShared ?? {};
+	const resolved = {
+		resolvedShared: options.resolvedShared ?? {},
+		strategy: options.strategy ?? "temp-file",
+		shareScopeName: options.shareScopeName ?? "default",
+		maxAgeMs: options.maxAgeMs
+	};
 	return {
 		name: "mf-vite:ssr-entry-loader",
 		async loadEntry({ remoteInfo }) {
 			if (!isNodeServer()) return;
-			const ssrEntry = await getSSREntry(remoteInfo.entry);
+			const ssrEntry = await getSSREntry(remoteInfo.entry, resolved.maxAgeMs);
 			if (!ssrEntry) return;
-			const mod = await loadSSRRemoteEntry(ssrEntry, resolvedShared);
+			const mod = await loadSSRRemoteEntry(ssrEntry, resolved);
 			if (!mod) return;
 			return mod;
 		}
 	};
 }
 //#endregion
-export { ssrEntryLoaderPlugin as default };
+export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.16.12",
+  "version": "1.16.13",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -86,4 +86,4 @@
     "vite": "8.1.0",
     "vitest": "4.0.18"
   }
-}
+}