@module-federation/vite 1.16.12 → 1.16.14

package/README.md

@@ -6,22 +6,15 @@
 
 [Read the announcement](https://www.linkedin.com/posts/voidzero_github-module-federationvite-vite-plugin-activity-7449452398202241024-JyAL).
 
-<div align="center">
-  <h2>Gold Sponsor</h2>
-  <a href="https://www.zephyr-cloud.io/">
-    <img src="./docs/sponsors/zephyr-logo.png" alt="Zephyr Cloud" width="360" />
-  </a>
-
-  <h3>Sponsors</h3>
-  <p>
-    <a href="https://github.com/thecoder93">
-      <img src="https://github.com/thecoder93.png?size=96" alt="thecoder93" width="64" height="64" />
-    </a>
-    <a href="https://github.com/stephanelgrg">
-      <img src="https://github.com/stephanelgrg.png?size=96" alt="stephanelgrg" width="64" height="64" />
-    </a>
-  </p>
-</div>
+<br />
+
+<a href="https://github.com/sponsors/gioboa">
+  <img src="./docs/sponsors.png" alt="Sponsors" />
+</a>
+
+## Become a sponsor
+
+[Support this project on GitHub Sponsors](https://github.com/sponsors/gioboa)
 
 ## Reason why 🤔
 

package/lib/index.js

@@ -380,7 +380,9 @@ function normalizeShared(shared) {
 	if (Array.isArray(shared)) shared.forEach((key) => {
 		if (isModuleFederationRuntimePackage(key)) return;
 		const normalizedKey = normalizeSharedKey(key);
+		const hadConfiguredPackageSubpath = (result[normalizedKey]?.shareConfig)?.__mfConfiguredPackageSubpath === true;
 		result[normalizedKey] = normalizeShareItem(normalizedKey, normalizedKey);
+		if (key.endsWith("/") || hadConfiguredPackageSubpath) result[normalizedKey].shareConfig.__mfConfiguredPackageSubpath = true;
 		explicitSharedKeys.add(normalizedKey);
 		sourceEntries.push([normalizedKey, normalizedKey]);
 	});
@@ -388,7 +390,9 @@ function normalizeShared(shared) {
 		if (isModuleFederationRuntimePackage(key)) return;
 		const normalizedKey = normalizeSharedKey(key);
 		const value = shared[key];
+		const hadConfiguredPackageSubpath = (result[normalizedKey]?.shareConfig)?.__mfConfiguredPackageSubpath === true;
 		result[normalizedKey] = normalizeShareItem(normalizedKey, value);
+		if (key.endsWith("/") || hadConfiguredPackageSubpath) result[normalizedKey].shareConfig.__mfConfiguredPackageSubpath = true;
 		explicitSharedKeys.add(normalizedKey);
 		sourceEntries.push([normalizedKey, value]);
 	});
@@ -650,7 +654,7 @@ function getExposesCssMapPlaceholder() {
 function getVirtualExposesId(options) {
 	return `virtual:mf-exposes:${`${options.internalName}__${options.filename}`.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
 }
-function generateExposes(options) {
+function generateExposes(options, remoteDependencyMap = {}, command = "build") {
 	return `
     const cssAssetMap = ${JSON.stringify(options.bundleAllCSS ? EXPOSES_CSS_MAP_PLACEHOLDER : {})};
     const injectedCssHrefs = new Set();
@@ -683,8 +687,12 @@ function generateExposes(options) {
           }
           injectedCssHrefs.add(href);
 
+          // Check for any existing stylesheet with the same href, not just
+          // MF-injected ones. This prevents duplicate <link> tags when Vite's
+          // own CSS module injection or MF runtime's createLink has already
+          // created a <link rel="stylesheet"> for the same URL.
           const existingLink = document.querySelector(
-            \`link[rel="stylesheet"][data-mf-href="\${href}"]\`
+            \`link[rel="stylesheet"][href="\${href}"]\`
           );
           if (existingLink) {
             return Promise.resolve();
@@ -694,7 +702,6 @@ function generateExposes(options) {
             const link = document.createElement("link");
             link.rel = "stylesheet";
             link.href = href;
-            link.setAttribute("data-mf-href", href);
             link.onload = () => resolve();
             link.onerror = () => reject(new Error(\`[Module Federation] Failed to load CSS asset: \${href}\`));
             document.head.appendChild(link);
@@ -705,12 +712,22 @@ function generateExposes(options) {
 
     export default {
     ${Object.keys(options.exposes).map((key) => {
+		const remoteDependencyPreloads = (remoteDependencyMap[key] ?? []).map((remoteId) => {
+			const virtualRemote = getRemoteVirtualModule(remoteId, command);
+			return `import(${JSON.stringify(virtualRemote.getImportId())})
+            .then((mod) => mod.__mf_remote_pending)`;
+		}).join(",");
 		return `
         ${JSON.stringify(key)}: async () => {
           await injectCssAssets(${JSON.stringify(key)})
+          await Promise.all([${remoteDependencyPreloads}])
           const importModule = await importExposedModule(
             () => import(${JSON.stringify(options.exposes[key].import)})
           )
+          const dependencyPending = importModule && importModule.__mf_remote_dependency_pending;
+          if (dependencyPending && typeof dependencyPending.then === "function") {
+            await dependencyPending;
+          }
           const exportModule = {}
           Object.assign(exportModule, importModule)
           Object.defineProperty(exportModule, "__esModule", {
@@ -1129,6 +1146,15 @@ function getWorkspacePackageJson(pkg) {
 		fromResolvedEntry: resolved
 	})?.packageJson;
 }
+function getSharedDependencyGraphPackageJson(pkg) {
+	const installedPackageJson = getInstalledPackageJson(pkg, { packageName: getPackageName(pkg) })?.packageJson;
+	if (installedPackageJson) return installedPackageJson;
+	try {
+		const packageJsonPath = createRequire$1(pathToFileURL(path$1.join(getPackageDetectionCwd(), "package.json"))).resolve(`${getPackageName(pkg)}/package.json`);
+		return JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+	} catch {}
+	return getWorkspacePackageJson(pkg);
+}
 function getDependencyNames(packageJson) {
 	if (!packageJson) return [];
 	const names = /* @__PURE__ */ new Set();
@@ -1143,7 +1169,7 @@ function getDependencyNames(packageJson) {
 	}
 	return Array.from(names);
 }
-function isWorkspaceSingletonConsumedByPeer(pkg) {
+function isSharedSingletonConsumedByPeer(pkg) {
 	const shared = getNormalizeModuleFederationOptions()?.shared || {};
 	const sharedKeyByPackageName = /* @__PURE__ */ new Map();
 	Object.entries(shared).filter(([, item]) => item.shareConfig.singleton === true).forEach(([key]) => {
@@ -1151,7 +1177,7 @@ function isWorkspaceSingletonConsumedByPeer(pkg) {
 		if (!sharedKeyByPackageName.get(packageName) || key === packageName) sharedKeyByPackageName.set(packageName, key);
 	});
 	const reachesPkg = (current, seen) => {
-		const packageJson = getWorkspacePackageJson(current);
+		const packageJson = getSharedDependencyGraphPackageJson(current);
 		for (const dependency of getDependencyNames(packageJson)) {
 			const sharedDependency = sharedKeyByPackageName.get(dependency);
 			if (!sharedDependency) continue;
@@ -1164,6 +1190,10 @@ function isWorkspaceSingletonConsumedByPeer(pkg) {
 	};
 	return Array.from(sharedKeyByPackageName.values()).some((sharedPkg) => sharedPkg !== pkg && reachesPkg(sharedPkg, new Set([sharedPkg])));
 }
+function isRemoteOnlyContainer() {
+	const options = getNormalizeModuleFederationOptions();
+	return Object.keys(options.exposes || {}).length > 0 && Object.keys(options.remotes || {}).length === 0;
+}
 function tryResolveImportFromPackageRoot(pkg, root) {
 	try {
 		return resolveWorkspaceEsmEntry(pkg, createRequire$1(pathToFileURL(path$1.join(root, "package.json"))).resolve(pkg), root);
@@ -1245,7 +1275,7 @@ function writePreBuildLibPath(pkg, shareItem) {
     const __mfPrebuildExports = __mfPrebuildNamespace;
     ${declarations}
     ${namedExportLine}
-    export default __mfPrebuildExports;
+    export default __mfPrebuildNamespace.default ?? __mfPrebuildNamespace;
   `, true);
 		return;
 	}
@@ -1317,37 +1347,34 @@ function generateEagerWorkspaceSingletonExports(namedExports, importSource, cach
     const __mf_default = exportModule.default ?? exportModule;${namedExportAssignments}
     export { __mf_default as default };${namedExportLine}`;
 }
-function generateLazyWorkspaceSingletonExports(namedExports, importSource, cacheDescriptor, eagerLocalFallback) {
+function generateLazyWorkspaceSingletonExports(namedExports, importSource, cacheDescriptor) {
 	const namedExportVars = namedExports.map((_name, i) => `__mf_${i}`);
 	const declarations = namedExports.length > 0 ? ["let __mf_default;", ...namedExportVars.map((name) => `let ${name};`)].join("\n    ") : "let __mf_default;";
 	const assignments = namedExports.length > 0 ? [...namedExports.map((name, i) => `${namedExportVars[i]} = mod[${escapeGeneratedStringLiteral(name)}];`), "__mf_default = mod.default ?? mod;"].join("\n      ") : "__mf_default = mod.default ?? mod;";
 	const namedExportLine = namedExports.length > 0 ? `\n    export { ${namedExports.map((name, i) => `${namedExportVars[i]} as ${name}`).join(", ")} };` : "";
-	const applyLocalFallback = `exportModule = __mfNormalizeShareModule(__mfLocalShare);
-      __mfWriteSharedCache(__mfModuleCache.share, ${cacheDescriptor}, exportModule);
-      __mfApplyLazyShareExports(exportModule);`;
-	const body = `${declarations}
+	return `${declarations}
     const __mfApplyLazyShareExports = (mod) => {
       ${assignments}
     };
     let exportModule = __mfReadSharedCache(__mfModuleCache.share, ${cacheDescriptor});
     if (exportModule === undefined) {
-      ${eagerLocalFallback ? applyLocalFallback : `if (import.meta.env.SSR) {
-        ${applyLocalFallback}
+      if (import.meta.env.SSR) {
+        ${`exportModule = __mfNormalizeShareModule(__mfLocalShare);
+      __mfWriteSharedCache(__mfModuleCache.share, ${cacheDescriptor}, exportModule);
+      __mfApplyLazyShareExports(exportModule);`}
       } else {
-        initPromise.then(() =>
+        (__mfModuleCache.pendingShareLoads ||= []).push(initPromise.then(() =>
           import(${escapeGeneratedStringLiteral(importSource)}).then((mod) => {
             exportModule = __mfNormalizeShareModule(mod);
             __mfWriteSharedCache(__mfModuleCache.share, ${cacheDescriptor}, exportModule);
             __mfApplyLazyShareExports(exportModule);
           })
-        );
-      }`}
+        ));
+      }
     } else {
       __mfApplyLazyShareExports(exportModule);
     }
     export { __mf_default as default };${namedExportLine}`;
-	return eagerLocalFallback ? `import * as __mfLocalShare from ${escapeGeneratedStringLiteral(importSource)};
-    ${body}` : body;
 }
 const WORKSPACE_SINGLETON_SSR_LOCAL_SHARE = "__mfNormalizeShareModule(__mfLocalShare)";
 function prependWorkspaceSingletonSsrImport(code) {
@@ -1367,13 +1394,13 @@ function generateDeferredHostProvidedExports(namedExports, pkg, cacheDescriptor)
     };
     let exportModule = __mfReadSharedCache(__mfModuleCache.share, ${cacheDescriptor});
     if (exportModule === undefined) {
-      initPromise.then(() => {
+      (__mfModuleCache.pendingShareLoads ||= []).push(initPromise.then(() => {
         exportModule = __mfReadSharedCache(__mfModuleCache.share, ${cacheDescriptor});
         if (exportModule === undefined) {
           throw new Error("[Module Federation] Shared module ${pkg} was imported before federation bootstrap finished.");
         }
         __mfApplyHostProvidedExports(exportModule);
-      });
+      }));
     } else {
       __mfApplyHostProvidedExports(exportModule);
     }
@@ -1421,17 +1448,21 @@ function writeLoadShareModule(pkg, shareItem, command, _isRolldown) {
 	const devImportSource = concreteSharedImportSource || pkg;
 	const localProviderPath = getLocalProviderImportPath(pkg);
 	const isWorkspacePackage = isWorkspacePackageEntry(pkg, localProviderPath) || isWorkspacePackageEntry(pkg, concreteSharedImportSource);
-	const lazyLocalFallbackSource = concreteSharedImportSource || localProviderPath || sharedImportSource;
+	const lazyLocalFallbackSource = command !== "build" ? concreteSharedImportSource || localProviderPath || devImportSource : concreteSharedImportSource || localProviderPath || sharedImportSource;
 	const skipServePrebuildWarmup = command !== "build" && (pkg === "lit" || pkg.startsWith("lit/"));
 	const isWorkspaceSingleton = isWorkspacePackage && shareItem.shareConfig.singleton === true;
-	const usesEagerWorkspaceFallback = isWorkspaceSingleton && isWorkspaceSingletonConsumedByPeer(pkg);
+	const isDefaultShareScope = shareItem.scope === void 0 || shareItem.scope === "default" || Array.isArray(shareItem.scope) && shareItem.scope[0] === "default";
+	const usesDeferredSingletonFallback = isWorkspaceSingleton || command !== "build" && isRemoteOnlyContainer() && shareItem.shareConfig.singleton === true || command === "build" && isRemoteOnlyContainer() && shareItem.shareConfig.singleton === true && !isDefaultShareScope;
+	const isConsumedByPeerSingleton = isSharedSingletonConsumedByPeer(pkg);
+	const usesEntryInjectedRemoteFallback = command !== "build" && !isWorkspaceSingleton && isRemoteOnlyContainer() && shareItem.shareConfig.singleton === true && getNormalizeModuleFederationOptions().hostInitInjectLocation === "entry" && isConsumedByPeerSingleton;
+	const usesEagerWorkspaceFallback = isWorkspaceSingleton && isConsumedByPeerSingleton;
 	const namedExports = getSharedNamedExports(pkg, shareItem);
 	let exportLine;
 	let initBlock = "";
-	if (usesEagerWorkspaceFallback) exportLine = generateEagerWorkspaceSingletonExports(namedExports, lazyLocalFallbackSource, cacheDescriptor);
-	else if (isWorkspaceSingleton) {
+	if (usesEagerWorkspaceFallback || usesEntryInjectedRemoteFallback) exportLine = generateEagerWorkspaceSingletonExports(namedExports, lazyLocalFallbackSource, cacheDescriptor);
+	else if (usesDeferredSingletonFallback) {
 		importLine = `${getRuntimeInitPromiseBootstrapCode()}\n    ${importLine}`;
-		exportLine = generateLazyWorkspaceSingletonExports(namedExports, lazyLocalFallbackSource, cacheDescriptor, command !== "build");
+		exportLine = generateLazyWorkspaceSingletonExports(namedExports, lazyLocalFallbackSource, cacheDescriptor);
 	} else if (namedExports.length > 0) {
 		const destructure = `const { ${namedExports.map((name, i) => `${name}: __mf_${i}`).join(", ")} } = exportModule;`;
 		const namedExportLine = `export { ${namedExports.map((name, i) => `__mf_${i} as ${name}`).join(", ")} };`;
@@ -1452,9 +1483,9 @@ function writeLoadShareModule(pkg, shareItem, command, _isRolldown) {
 		initBlock = `exportModule = __mfNormalizeShareModule(__mfLocalShare);
       __mfWriteSharedCache(__mfModuleCache.share, ${cacheDescriptor}, exportModule);`;
 	}
-	const prebuildImportLine = isWorkspaceSingleton || isWorkspacePackage && command !== "build" ? "" : `import * as __mfLocalShare from ${escapeGeneratedStringLiteral(skipServePrebuildWarmup ? devImportSource : sharedImportSource)};`;
-	const devDynamicImportLine = isWorkspacePackage ? "" : command !== "build" && !skipServePrebuildWarmup ? `;() => import(${escapeGeneratedStringLiteral(devImportSource)}).catch(() => {});` : "";
-	const moduleBody = isWorkspaceSingleton ? `
+	const prebuildImportLine = usesDeferredSingletonFallback || isWorkspacePackage && command !== "build" ? "" : `import * as __mfLocalShare from ${escapeGeneratedStringLiteral(skipServePrebuildWarmup ? devImportSource : sharedImportSource)};`;
+	const devDynamicImportLine = isWorkspacePackage ? "" : usesDeferredSingletonFallback ? "" : command !== "build" && !skipServePrebuildWarmup ? `;() => import(${escapeGeneratedStringLiteral(devImportSource)}).catch(() => {});` : "";
+	const moduleBody = usesDeferredSingletonFallback ? `
     ${prebuildImportLine}
     ${devDynamicImportLine}
     ${importLine}
@@ -1587,29 +1618,14 @@ function generateLocalSharedImportMap() {
       }
       `;
 }
-function generateUsedSharedPreloadConfig() {
-	return `{
-      ${getOrderedUsedShares().map((pkg) => {
-		const shareItem = getShareItemForPreload(pkg);
-		if (!shareItem) return null;
-		return `${JSON.stringify(pkg)}: {
-            version: ${JSON.stringify(shareItem.version)},
-            scope: ${JSON.stringify(shareItem.scope)},
-            shareConfig: {
-              singleton: ${shareItem.shareConfig.singleton},
-              requiredVersion: ${JSON.stringify(shareItem.shareConfig.requiredVersion)},
-              strictVersion: ${shareItem.shareConfig.strictVersion},
-              ${shareItem.shareConfig.import === false ? "import: false," : ""}
-            }
-          }`;
-	}).filter((item) => item !== null).join(",\n")}
-    }`;
-}
 function getOrderedUsedShares() {
 	const shares = new Set(getUsedShares());
 	try {
 		Object.keys(getNormalizeModuleFederationOptions().shared).forEach((pkg) => {
-			if (!pkg.endsWith("/")) shares.add(pkg);
+			if (!pkg.endsWith("/")) {
+				shares.add(pkg);
+				return;
+			}
 		});
 	} catch {}
 	return orderSharedDependenciesFirst(Array.from(shares).sort((a, b) => {
@@ -1712,12 +1728,31 @@ const sharedProviderSelectionHelperCode = `const __mfOriginalProviderKey = Symbo
 function hasImportFalseShared$1(options) {
 	return Object.values(options.shared ?? {}).some((share) => share?.shareConfig?.import === false);
 }
-function generateDirectSharedCacheSeedCode(command = "build") {
-	return getOrderedUsedShares().map((pkg) => {
-		const shareItem = getShareItemForPreload(pkg);
-		if (!shareItem || shareItem.shareConfig.import === false) return null;
-		return generateSharedCacheSeedItem(pkg, shareItem, command === "serve" ? getLocalSharedPackagePath(pkg, shareItem) : getDirectSharedCacheSeedImportPath(pkg, shareItem));
-	}).filter((item) => item !== null).join("\n");
+function generateRuntimeSharedCacheSeedCode() {
+	return `
+    for (const [pkg, share] of Object.entries(usedShared)) {
+      const cacheDescriptor = __mfGetSharedCacheDescriptor(pkg, share.shareConfig?.singleton, share.version, share.scope);
+      if (share.shareConfig?.import === false || __mfReadSharedCache(__mfModuleCache.share, cacheDescriptor) !== undefined) {
+        continue;
+      }
+      const singletonCacheDescriptor = __mfGetSharedCacheDescriptor(pkg, true, share.version, share.scope);
+      const singletonModule = __mfReadSharedCache(__mfModuleCache.share, singletonCacheDescriptor);
+      if (singletonModule !== undefined) {
+        __mfWriteSharedCache(__mfModuleCache.share, cacheDescriptor, singletonModule);
+        continue;
+      }
+      const factory = await share.get();
+      const mod = typeof factory === "function" ? factory() : factory;
+      const resolved = await Promise.resolve(mod);
+      ${normalizeRuntimeShareCode}
+      const normalizedModule = __mfNormalizeRuntimeShare(resolved);
+      const exportModule = normalizedModule === resolved ? {...resolved} : normalizedModule;
+      Object.defineProperty(exportModule, "__esModule", {
+        value: true,
+        enumerable: false
+      });
+      __mfWriteSharedCache(__mfModuleCache.share, cacheDescriptor, exportModule);
+    }`;
 }
 function getBrowserImportPath(importPath) {
 	if (/^(?:[a-zA-Z]:[\\/]|\/)/.test(importPath) && !importPath.startsWith("/@")) return `/@fs/${importPath}`;
@@ -1867,7 +1902,7 @@ function generateRemoteEntry(options, virtualExposesId = getVirtualExposesId(opt
         __mfWriteSharedCache(__mfModuleCache.share, cacheDescriptor, singletonModule);
       }
     }
-    ${generateDirectSharedCacheSeedCode(command)}
+    ${generateRuntimeSharedCacheSeedCode()}
     const __browserPlugins = [${pluginImportNames.filter((item) => !isSsrOnlyPlugin(item[1])).map((item) => `${item[0]}(${item[2]})`).join(", ")}];
     const __ssrPlugins = typeof globalThis.window === 'undefined'
       ? await Promise.all([${pluginImportNames.filter((item) => isSsrOnlyPlugin(item[1])).map((item) => {
@@ -1890,7 +1925,6 @@ function generateRemoteEntry(options, virtualExposesId = getVirtualExposesId(opt
     if (initScope.indexOf(initToken) >= 0) return;
     initScope.push(initToken);
     initRes.initShareScopeMap('${options.shareScope}', shared);
-    initResolve(initRes)
     try {
       await retrySharedInit(async () => {
         await Promise.all(await initRes.initializeSharing('${options.shareScope}', {
@@ -1914,6 +1948,7 @@ function generateRemoteEntry(options, virtualExposesId = getVirtualExposesId(opt
       const resolved = await Promise.resolve(mod);
       __mfWriteSharedCache(__mfModuleCache.share, cacheDescriptor, __mfNormalizeRuntimeShare(resolved));
     }
+    initResolve(initRes)
     return initRes
   }
 
@@ -1943,7 +1978,7 @@ function generateHostAutoInitCode(remoteEntryImport, _command = "build") {
           ${generateHostAutoInitSharedCacheSeedCode(_command)}
           const remoteEntry = await import(${remoteEntryImport});
           const runtime = await remoteEntry.init();
-          const usedShared = ${generateUsedSharedPreloadConfig()};
+          const {usedShared} = await import("${getLocalSharedImportMapPath()}");
           ${normalizeRuntimeShareCode}
           ${shouldPreloadShares ? `
           for (const [pkg, share] of Object.entries(usedShared)) {
@@ -2272,10 +2307,10 @@ function injectHostInitPreloads(html, bundle, resolvePath) {
 function getFirstHtmlEntryFile(entryFiles) {
 	return entryFiles.find((file) => file.endsWith(".html"));
 }
-function stripQueryAndHash(file) {
+function stripQueryAndHash$1(file) {
 	return file.split(/[?#]/)[0];
 }
-function resolveDevHashEntryFileName(fileName) {
+function resolveDevHashEntryFileName$1(fileName) {
 	if (!fileName.includes("[hash")) return fileName;
 	const normalized = fileName.replace(/(?:[._-]?\[hash(?::\d+)?\])/g, "");
 	const baseName = path$1.basename(normalized);
@@ -2419,6 +2454,9 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
   await __mfHostInit.__tla;
   const { initHost } = __mfHostInit;
   ${preloadBlock}
+  if (__mfModuleCache.pendingShareLoads) {
+    await Promise.all(__mfModuleCache.pendingShareLoads);
+  }
 })().then(() => ${importExpression(entrySrc)});
 `;
 		return [
@@ -2461,7 +2499,7 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
 		const scriptRegex = /<script\b(?=[^>]*\btype=["']module["'])(?=[^>]*\bsrc=["']([^"']+)["'])[^>]*>/gi;
 		let match;
 		while ((match = scriptRegex.exec(htmlContent)) !== null) {
-			const scriptSrc = stripQueryAndHash(match[1]);
+			const scriptSrc = stripQueryAndHash$1(match[1]);
 			if (/^(?:[a-z]+:)?\/\//i.test(scriptSrc)) continue;
 			addEntryFile(scriptSrc);
 			addEntryFile(scriptSrc.startsWith("/") ? path$1.resolve(viteConfig.root, scriptSrc.slice(1)) : path$1.resolve(path$1.dirname(htmlPath), scriptSrc));
@@ -2504,7 +2542,7 @@ const addEntry = ({ entryName, entryPath, fileName, inject = "entry", forceClien
 					next();
 					return;
 				}
-				const devFileName = resolveDevHashEntryFileName(fileName);
+				const devFileName = resolveDevHashEntryFileName$1(fileName);
 				if (devFileName !== fileName && req.url?.startsWith((viteConfig.base + devFileName).replace(/^\/?/, "/"))) req.url = req.url.replace(devFileName, fileName);
 				if (req.url && req.url.startsWith((viteConfig.base + fileName).replace(/^\/?/, "/"))) req.url = devEntryPath;
 				next();
@@ -4088,8 +4126,60 @@ function pluginModuleParseEnd_default(excludeFn, options) {
 }
 //#endregion
 //#region src/plugins/pluginProxyRemoteEntry.ts
+function resolveDevHashEntryFileName(fileName) {
+	if (!fileName.includes("[hash")) return fileName;
+	const normalized = fileName.replace(/(?:[._-]?\[hash(?::\d+)?\])/g, "");
+	const baseName = path$1.basename(normalized);
+	return path$1.extname(baseName) ? normalized : `${normalized}.js`;
+}
 function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposesId }) {
 	let viteConfig, _command, root;
+	let exposeRemoteDependencies = {};
+	function isRemoteImport(source) {
+		return Object.keys(options.remotes).some((name) => source === name || source.startsWith(name + "/"));
+	}
+	function collectImportSources(code) {
+		const sources = /* @__PURE__ */ new Set();
+		for (const match of code.matchAll(/(?:^|[;\n\r])\s*import\s+(?:[\s\S]*?\s+from\s+)?["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g)) {
+			const source = match[1] || match[2];
+			if (source) sources.add(source);
+		}
+		return Array.from(sources).sort();
+	}
+	function shouldScanResolvedImport(id) {
+		if (!id || id.includes("\0")) return false;
+		if (id.includes("/node_modules/") || id.includes("\\node_modules\\")) return false;
+		return /\.(?:[cm]?[jt]sx?|vue|svelte)(?:\?|$)/.test(id);
+	}
+	async function collectRemoteDependencies(ctx, id, seen = /* @__PURE__ */ new Set()) {
+		if (seen.has(id) || !shouldScanResolvedImport(id)) return [];
+		seen.add(id);
+		let code;
+		try {
+			code = readFileSync$1(id, "utf8");
+		} catch {
+			return [];
+		}
+		const dependencies = /* @__PURE__ */ new Set();
+		for (const source of collectImportSources(code)) {
+			if (isRemoteImport(source)) {
+				dependencies.add(source);
+				continue;
+			}
+			const resolved = await ctx.resolve(source, id);
+			if (!resolved?.id || !shouldScanResolvedImport(resolved.id)) continue;
+			for (const dependency of await collectRemoteDependencies(ctx, resolved.id, seen)) dependencies.add(dependency);
+		}
+		return Array.from(dependencies).sort();
+	}
+	async function refreshExposeRemoteDependencies(ctx) {
+		const next = {};
+		for (const [exposeKey, expose] of Object.entries(options.exposes)) {
+			const resolved = await ctx.resolve(expose.import);
+			next[exposeKey] = resolved?.id ? await collectRemoteDependencies(ctx, resolved.id) : [];
+		}
+		exposeRemoteDependencies = next;
+	}
 	return {
 		name: "proxyRemoteEntry",
 		enforce: "post",
@@ -4101,6 +4191,7 @@ function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposes
 			_command = command;
 		},
 		async buildStart() {
+			await refreshExposeRemoteDependencies(this);
 			if (_command !== "build") return;
 			for (const expose of Object.values(options.exposes)) {
 				const resolved = await this.resolve(expose.import);
@@ -4122,19 +4213,19 @@ function pluginProxyRemoteEntry_default({ options, remoteEntryId, virtualExposes
 		},
 		load(id) {
 			if (id === remoteEntryId) return parsePromise.then((_) => generateRemoteEntry(options, virtualExposesId, _command));
-			if (id === virtualExposesId) return generateExposes(options);
+			if (id === virtualExposesId) return generateExposes(options, exposeRemoteDependencies, _command);
 			if (_command === "serve" && id.includes(getHostAutoInitPath())) return id;
 		},
 		transform(code, id) {
 			return mapCodeToCodeWithSourcemap((() => {
 				if (!filterId(id)) return;
 				if (id.includes(remoteEntryId)) return parsePromise.then((_) => generateRemoteEntry(options, virtualExposesId, _command));
-				if (id === virtualExposesId) return generateExposes(options);
+				if (id === virtualExposesId) return generateExposes(options, exposeRemoteDependencies, _command);
 				if (id.includes(getHostAutoInitPath())) {
 					if (_command === "serve") {
 						const host = typeof viteConfig.server?.host === "string" && viteConfig.server.host !== "0.0.0.0" ? viteConfig.server.host : "localhost";
 						const resolvedPublicPath = resolvePublicPath(options, viteConfig.base);
-						const publicPath = JSON.stringify((resolvedPublicPath === "auto" ? "/" : resolvedPublicPath) + options.filename);
+						const publicPath = JSON.stringify((resolvedPublicPath === "auto" ? "/" : resolvedPublicPath) + resolveDevHashEntryFileName(options.filename));
 						const fallbackOrigin = `//${host}:${viteConfig.server?.port}`;
 						const ssrRemoteEntry = "data:text/javascript," + encodeURIComponent("export async function init(){return {loadRemote:async()=>({}),loadShare:async()=>({})}}");
 						return `
@@ -4573,26 +4664,7 @@ function applyRewrites(code, imports, id) {
 	const ms = new CodeRewriter(code);
 	let changed = false;
 	let counter = 0;
-	let namedProxyHelperDeclared = false;
 	const dependencyPendingIds = [];
-	const namedProxyHelper = `function __mfCreateNamedRemoteProxy(ns, key) {
-  const target = function (...args) {
-    const value = ns[key];
-    return typeof value === "function" ? value.apply(this, args) : value;
-  };
-  return new Proxy(target, {
-    get(_target, prop) {
-      if (prop === "then") return undefined;
-      const value = ns[key];
-      if (prop === Symbol.toPrimitive) return () => value;
-      const item = value == null ? undefined : value[prop];
-      return typeof item === "function" ? item.bind(value) : item;
-    },
-    apply(target, thisArg, args) {
-      return target.apply(thisArg, args);
-    }
-  });
-}`;
 	for (const imp of imports) switch (imp.kind) {
 		case "static": {
 			const src = JSON.stringify(imp.source);
@@ -4610,20 +4682,8 @@ function applyRewrites(code, imports, id) {
 				importParts.push(`__mf_remote_pending as ${pendingId}`);
 				let rewrite = `import { ${importParts.join(", ")} } from ${src};`;
 				if (imp.named.length > 0) {
-					const isProxyId = `__mf_is_proxy_${counter++}`;
-					const tempNames = imp.named.map((_s) => `__mf_named_${counter++}`);
-					const destructParts = imp.named.map((s, index) => `${s.imported}: ${tempNames[index]}`);
-					const bindingLines = imp.named.map((s, index) => {
-						const temp = tempNames[index];
-						return `const ${s.local} = ${isProxyId} ? __mfCreateNamedRemoteProxy(${nsId}, ${JSON.stringify(s.imported)}) : ${temp};`;
-					});
-					if (!namedProxyHelperDeclared) {
-						rewrite += `\n${namedProxyHelper}`;
-						namedProxyHelperDeclared = true;
-					}
-					rewrite += `\nconst ${isProxyId} = ${nsId} && ${nsId}.__mf_is_remote_proxy;`;
-					rewrite += `\nconst { ${destructParts.join(", ")} } = ${isProxyId} ? {} : ${nsId};`;
-					rewrite += `\n${bindingLines.join("\n")}`;
+					const destructParts = imp.named.map((s) => `${s.imported}: ${s.local}`);
+					rewrite += `\nconst { ${destructParts.join(", ")} } = ${nsId};`;
 				}
 				ms.overwrite(imp.start, imp.end, rewrite);
 			}
@@ -4880,6 +4940,104 @@ function pluginRemoteNamedExports(options) {
 }
 //#endregion
 //#region src/plugins/pluginSSRRemoteEntry.ts
+const MAX_RUNNER_BODY_BYTES = 1024 * 1024;
+const ALLOWED_RUNNER_INVOKE_NAMES = new Set(["fetchModule", "getBuiltins"]);
+const VITE_FS_PREFIX = "/@fs/";
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function stripQueryAndHash(id) {
+	const queryIndex = id.indexOf("?");
+	const hashIndex = id.indexOf("#");
+	const endIndex = queryIndex === -1 ? hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+	return endIndex === -1 ? id : id.slice(0, endIndex);
+}
+function decodeRunnerFilePath(filePath) {
+	try {
+		return decodeURIComponent(filePath);
+	} catch {
+		return;
+	}
+}
+function hasRelativeTraversal(id) {
+	return id.split(/[\\/]+/).includes("..");
+}
+function getRealPathIfExists(filePath) {
+	try {
+		return fs$1.realpathSync.native(filePath);
+	} catch {
+		return;
+	}
+}
+function isPathWithinDirectory(filePath, directory) {
+	const realFilePath = getRealPathIfExists(filePath) ?? path$1.resolve(filePath);
+	const realDirectory = getRealPathIfExists(directory) ?? path$1.resolve(directory);
+	const relative = path$1.relative(realDirectory, realFilePath);
+	return relative === "" || !relative.startsWith("..") && !path$1.isAbsolute(relative);
+}
+function getRunnerAllowedDirectories(config) {
+	return [config.root, ...config.server?.fs?.allow ?? []].map((directory) => path$1.resolve(directory));
+}
+function isPathWithinAllowedDirectories(filePath, allowedDirectories) {
+	return allowedDirectories.some((directory) => isPathWithinDirectory(filePath, directory));
+}
+function isSafeRunnerFetchModuleId(id, config) {
+	if (typeof id !== "string" || !id || id.includes("\0")) return false;
+	const decoded = decodeViteId(id).replace(/^\0+/, "");
+	if (!decoded || decoded.startsWith("virtual:")) return !!decoded;
+	if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(decoded) || decoded.startsWith("//")) return false;
+	const cleanId = decodeRunnerFilePath(stripQueryAndHash(decoded));
+	if (!cleanId || hasRelativeTraversal(cleanId)) return false;
+	const allowedDirectories = getRunnerAllowedDirectories(config);
+	if (cleanId.startsWith(VITE_FS_PREFIX)) {
+		const fsPath = cleanId.slice(5);
+		return path$1.isAbsolute(fsPath) && isPathWithinAllowedDirectories(fsPath, allowedDirectories);
+	}
+	if (path$1.isAbsolute(cleanId)) {
+		if (isPathWithinAllowedDirectories(cleanId, allowedDirectories)) return true;
+		return !fs$1.existsSync(cleanId);
+	}
+	return true;
+}
+function isRunnerInvokePayload(payload, config) {
+	if (!payload || typeof payload !== "object") return false;
+	if (payload.type !== "custom" || payload.event !== "vite:invoke") return false;
+	const data = payload.data;
+	if (!data || typeof data !== "object") return false;
+	const name = data.name;
+	const args = data.data;
+	if (typeof name !== "string" || !ALLOWED_RUNNER_INVOKE_NAMES.has(name) || !Array.isArray(args)) return false;
+	if (name === "getBuiltins") return args.length === 0;
+	if (args.length < 1 || args.length > 3) return false;
+	const [id, importer, opts] = args;
+	return isSafeRunnerFetchModuleId(id, config) && (importer === void 0 || importer === null || isSafeRunnerFetchModuleId(importer, config)) && (opts === void 0 || isPlainObject(opts));
+}
+function readBoundedRunnerBody(req, res) {
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let done = false;
+		const fail = (statusCode, message) => {
+			if (done) return;
+			done = true;
+			res.statusCode = statusCode;
+			res.end(message);
+			resolve(void 0);
+		};
+		req.on("data", (chunk) => {
+			if (done) return;
+			size += chunk.length;
+			if (size > MAX_RUNNER_BODY_BYTES) return fail(413, "Payload too large");
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			if (done) return;
+			done = true;
+			resolve(Buffer.concat(chunks));
+		});
+		req.on("error", () => fail(400, "Bad request"));
+	});
+}
 /**
 * Emits a Node-compatible SSR remote entry alongside the browser entry.
 *
@@ -4966,7 +5124,8 @@ function pluginSSRRemoteEntry(options) {
 			});
 			const ssrEnv = server.environments?.ssr;
 			const clientEnv = server.environments?.client;
-			if (typeof (ssrEnv?.fetchModule ?? clientEnv?.fetchModule) === "function") server.middlewares.use("/__mf_runner__", async (req, res) => {
+			const runnerEnv = typeof ssrEnv?.hot?.handleInvoke === "function" ? ssrEnv : typeof clientEnv?.hot?.handleInvoke === "function" ? clientEnv : void 0;
+			if (typeof (ssrEnv?.fetchModule ?? clientEnv?.fetchModule) === "function" && runnerEnv) server.middlewares.use("/__mf_runner__", async (req, res) => {
 				res.setHeader("Access-Control-Allow-Origin", "*");
 				if (req.method === "OPTIONS") {
 					res.setHeader("Access-Control-Allow-Methods", "POST");
@@ -4981,46 +5140,37 @@ function pluginSSRRemoteEntry(options) {
 					return;
 				}
 				try {
-					const chunks = [];
-					await new Promise((resolve, reject) => {
-						req.on("data", (chunk) => chunks.push(chunk));
-						req.on("end", resolve);
-						req.on("error", reject);
-					});
-					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					if (body.name === "getBuiltins") {
-						const builtins = (clientEnv ?? ssrEnv)?.config?.resolve?.builtins ?? [];
-						res.setHeader("Content-Type", "application/json");
-						res.end(JSON.stringify({ result: builtins }));
+					const rawBody = await readBoundedRunnerBody(req, res);
+					if (!rawBody) return;
+					let body;
+					try {
+						body = JSON.parse(rawBody.toString("utf8"));
+					} catch {
+						res.statusCode = 400;
+						res.end(JSON.stringify({ error: { message: "Invalid JSON" } }));
 						return;
 					}
-					if (body.name !== "fetchModule") {
+					if (!isRunnerInvokePayload(body, server.config)) {
 						res.statusCode = 400;
-						res.end(JSON.stringify({ error: { message: `Unsupported invoke: ${body.name}` } }));
+						res.end(JSON.stringify({ error: { message: "Invalid runner invoke" } }));
 						return;
 					}
-					const [id, importer, opts] = body.data;
-					const fetchEnv = ssrEnv ?? clientEnv;
-					const fetchFn = fetchEnv.fetchModule.bind(fetchEnv);
-					let result;
-					try {
-						result = await fetchFn(id, importer, opts);
-					} catch (fetchErr) {
-						const bareId = decodeViteId(id);
-						try {
+					let result = await runnerEnv.hot.handleInvoke(body);
+					if ("error" in result && body.data.name === "fetchModule") {
+						const id = body.data.data[0];
+						const bareId = typeof id === "string" ? decodeViteId(id).replace(/^\0/, "") : "";
+						if (bareId && !bareId.startsWith(".") && !bareId.startsWith("/") && !bareId.startsWith("file:") && !/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(bareId)) try {
 							const { createRequire } = await import("module");
 							const path = await import("path");
 							const { pathToFileURL } = await import("url");
-							result = {
-								externalize: pathToFileURL(createRequire(pathToFileURL(path.join(server.config.root, "package.json"))).resolve(bareId.replace(/^\0/, ""))).href,
+							result = { result: {
+								externalize: pathToFileURL(createRequire(pathToFileURL(path.join(server.config.root, "package.json"))).resolve(bareId)).href,
 								type: "module"
-							};
-						} catch {
-							throw fetchErr;
-						}
+							} };
+						} catch {}
 					}
 					res.setHeader("Content-Type", "application/json");
-					res.end(JSON.stringify({ result }));
+					res.end(JSON.stringify(result));
 				} catch (e) {
 					res.setHeader("Content-Type", "application/json");
 					res.end(JSON.stringify({ error: { message: String(e instanceof Error ? e.message : e) } }));
@@ -5864,7 +6014,9 @@ function federation(mfUserOptions) {
 			},
 			load(id) {
 				if (id.includes("__loadShare__") || id.includes("__loadRemote__")) {
-					let code = VirtualModule.findById(id)?.code ?? readFileSync(id, "utf-8");
+					const virtualModule = VirtualModule.findById(id);
+					if (!virtualModule?.code) return null;
+					let code = virtualModule.code;
 					const environmentName = this.environment?.name;
 					if (environmentName && environmentName !== "client" || !environmentName && isSsrBuild) code = prependWorkspaceSingletonSsrImport(code);
 					code = code.replace(/import\s+["'][^"']*__prebuild__[^"']*["']\s*;?/g, "");
@@ -5948,7 +6100,15 @@ function federation(mfUserOptions) {
 				options.runtimePlugins.forEach((p) => {
 					const pluginPath = typeof p === "string" ? p : p[0];
 					if (SSR_ONLY_PLUGINS.has(pluginPath)) return;
-					if (pluginPath && !pluginPath.startsWith(".") && !pluginPath.startsWith("/") && !pluginPath.startsWith("\0") && !pluginPath.startsWith("virtual:")) config.optimizeDeps.include.push(pluginPath);
+					if (pluginPath && !pluginPath.startsWith(".") && !pluginPath.startsWith("/") && !pluginPath.startsWith("\0") && !pluginPath.startsWith("virtual:")) {
+						let optimizeDep = pluginPath;
+						if (pluginPath === "@module-federation/dts-plugin/dynamic-remote-type-hints-plugin") try {
+							optimizeDep = normalizePathForImport(resolveImportPath(pluginPath));
+						} catch {
+							optimizeDep = pluginPath;
+						}
+						config.optimizeDeps.include.push(optimizeDep);
+					}
 				});
 				if (isRolldown) {
 					config.build ??= {};

package/lib/ssrVmStrategy-DtpfkCw1.js

@@ -0,0 +1,152 @@
+import { SsrEntryHttpError, neutralizeBrowserPreloadHelpers } from "./utils/ssrEntryLoader.js";
+//#region src/utils/ssrVmStrategy.ts
+/**
+* vm.SourceTextModule strategy for loading remote SSR entries.
+*
+* Unlike the temp-file strategy (which rewrites bare shared imports to
+* host-resolved file:// paths at fetch time), this strategy evaluates the
+* remote's ESM graph with `vm.SourceTextModule` in the current context and
+* resolves bare imports through a linker, in order:
+*
+*  1. The host's federation share scope — `instance.loadShare(name)` on the
+*     global `__FEDERATION__` instances. This restores real share-scope
+*     semantics (version negotiation, loaded-first reuse) on the server.
+*  2. The build-time `resolvedShared` file map (same source as the temp-file
+*     strategy) as a fallback when no instance shares the package.
+*  3. Plain host `import(specifier)` for everything else (node builtins,
+*     packages the remote expects the host to provide).
+*
+* Requires Node with `--experimental-vm-modules`; callers must check
+* `isVmStrategyAvailable()` and fall back to the temp-file strategy when the
+* API is missing.
+*/
+let vmApiPromise;
+async function getVmApi() {
+	if (!vmApiPromise) vmApiPromise = (async () => {
+		try {
+			const vm = await import(
+				/* @vite-ignore */
+				"vm"
+);
+			if (typeof vm.SourceTextModule !== "function" || typeof vm.SyntheticModule !== "function") return null;
+			return vm;
+		} catch {
+			return null;
+		}
+	})();
+	return vmApiPromise;
+}
+async function isVmStrategyAvailable() {
+	return await getVmApi() !== null;
+}
+function getFederationInstances() {
+	return globalThis.__FEDERATION__?.__INSTANCES__ ?? [];
+}
+/**
+* Resolve a bare specifier to a module namespace: share scope first, then the
+* build-time resolvedShared file map, then plain host import.
+*/
+async function loadBareModule(specifier, options) {
+	for (const instance of getFederationInstances()) {
+		if (typeof instance?.loadShare !== "function") continue;
+		if (!instance.options?.shared || !(specifier in instance.options.shared)) continue;
+		try {
+			const factory = await instance.loadShare(specifier);
+			if (typeof factory === "function") {
+				const shared = factory();
+				if (shared) return shared;
+			}
+		} catch {}
+	}
+	const resolvedPath = options.resolvedShared[specifier];
+	if (resolvedPath) return import(
+		/* @vite-ignore */
+		`file://${resolvedPath}`
+);
+	return import(
+		/* @vite-ignore */
+		specifier
+);
+}
+function createSyntheticModule(vm, specifier, namespace) {
+	const source = namespace && typeof namespace === "object" ? namespace : { default: namespace };
+	const exportNames = new Set(Object.keys(source));
+	exportNames.add("default");
+	const syntheticModule = new vm.SyntheticModule([...exportNames], () => {
+		for (const exportName of exportNames) if (exportName === "default") syntheticModule.setExport("default", source.default !== void 0 ? source.default : namespace);
+		else syntheticModule.setExport(exportName, source[exportName]);
+	}, { identifier: `mf-shared:${specifier}` });
+	return syntheticModule;
+}
+const httpModuleCache = /* @__PURE__ */ new Map();
+const namespaceCache = /* @__PURE__ */ new Map();
+function getBodyPreview(body) {
+	return body.slice(0, 240).replace(/\s+/g, " ").trim();
+}
+async function fetchModuleSource(url) {
+	const res = await fetch(url);
+	const text = await res.text();
+	if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(text));
+	return neutralizeBrowserPreloadHelpers(text);
+}
+function isHttpUrl(value) {
+	return value.startsWith("http://") || value.startsWith("https://");
+}
+/** Resolve a specifier against the referencing module's URL; null for bare specifiers. */
+function resolveSpecifierUrl(specifier, referencerUrl) {
+	if (isHttpUrl(specifier)) return specifier;
+	if (specifier.startsWith("./") || specifier.startsWith("../") || specifier.startsWith("/")) return new URL(specifier, referencerUrl).href;
+	return null;
+}
+function getHttpModule(vm, url, options) {
+	const cacheKey = `${options.versionKey}::${url}`;
+	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
+		const code = await fetchModuleSource(url);
+		return new vm.SourceTextModule(code, {
+			identifier: url,
+			initializeImportMeta(meta) {
+				meta.url = url;
+			},
+			importModuleDynamically: (specifier, referencingModule) => importDynamically(vm, specifier, referencingModule, options)
+		});
+	})().catch((error) => {
+		httpModuleCache.delete(cacheKey);
+		throw error;
+	}));
+	return httpModuleCache.get(cacheKey);
+}
+async function linkModule(vm, specifier, referencingModule, options) {
+	const url = resolveSpecifierUrl(specifier, referencingModule.identifier);
+	if (url) return getHttpModule(vm, url, options);
+	return createSyntheticModule(vm, specifier, await loadBareModule(specifier, options));
+}
+async function importDynamically(vm, specifier, referencingModule, options) {
+	const linker = (spec, referencer) => linkModule(vm, spec, referencer, options);
+	const module = await linker(specifier, referencingModule);
+	if (module.status === "unlinked") await module.link(linker);
+	if (module.status === "linked") await module.evaluate();
+	return module;
+}
+/**
+* Load and evaluate a remote SSR entry as a `vm.SourceTextModule` graph and
+* return its namespace (the federation container with `init`/`get`).
+* Returns null when the vm module APIs are unavailable.
+*/
+async function loadViaVmStrategy(entryUrl, options) {
+	const vm = await getVmApi();
+	if (!vm) return null;
+	const cacheKey = `${options.versionKey}::${entryUrl}`;
+	if (!namespaceCache.has(cacheKey)) namespaceCache.set(cacheKey, (async () => {
+		const entryModule = await getHttpModule(vm, entryUrl, options);
+		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, options);
+		if (entryModule.status === "unlinked") await entryModule.link(linker);
+		if (entryModule.status === "linked") await entryModule.evaluate();
+		return entryModule.namespace;
+	})().catch((error) => {
+		namespaceCache.delete(cacheKey);
+		throw error;
+	}));
+	return namespaceCache.get(cacheKey);
+}
+//#endregion
+export { isVmStrategyAvailable, loadViaVmStrategy };

package/lib/utils/ssrEntryLoader.d.ts

@@ -32,6 +32,29 @@ interface RemoteInfo {
   type?: string;
   entryGlobalName?: string;
 }
+declare class SsrEntryHttpError extends Error {
+  readonly url: string;
+  readonly status: number;
+  readonly statusText: string;
+  readonly bodyPreview: string;
+  constructor(url: string, status: number, statusText: string, bodyPreview: string);
+}
+/**
+ * Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
+ * remote SSR entries. Pass a remote entry URL to scope the invalidation to one
+ * remote; call with no arguments to invalidate everything.
+ *
+ * Note: the MF runtime keeps its own container/module caches per federation
+ * instance. This function best-effort clears the module caches of all global
+ * federation instances so re-renders load fresh remote modules, but hosts that
+ * hold direct references to previously loaded modules keep those references.
+ */
+declare function revalidate(remoteEntryUrl?: string): void;
+/**
+ * Neutralize browser-only preload machinery in Vite/Rolldown output so the
+ * code can evaluate in Node. Shared by the temp-file and vm strategies.
+ */
+declare function neutralizeBrowserPreloadHelpers(code: string): string;
 /**
  * MF runtime plugin factory.
  *
@@ -50,6 +73,33 @@ interface SsrEntryLoaderOptions {
    * in remote SSR entry temp files — no runtime createRequire walk-up needed.
    */
   resolvedShared?: Record<string, string>;
+  /**
+   * How to evaluate remote SSR entries on the server.
+   *
+   * - `'temp-file'` (default): fetch the ESM graph, rewrite specifiers, write
+   *   temp files and `import()` them. Works on stock Node; shared packages are
+   *   pinned to the host's copies via `resolvedShared` (no version negotiation).
+   * - `'vm'`: evaluate the graph with `vm.SourceTextModule` and link bare
+   *   shared imports through the host's federation share scope (`loadShare`),
+   *   restoring version negotiation. Requires `--experimental-vm-modules`;
+   *   falls back to `'temp-file'` when unavailable.
+   */
+  strategy?: 'temp-file' | 'vm';
+  /**
+   * Share scope consulted by the `'vm'` strategy when linking bare imports.
+   * Defaults to `'default'`.
+   */
+  shareScopeName?: string;
+  /**
+   * Re-check each remote's manifest when the cached SSR entry resolution is
+   * older than this many milliseconds. When the manifest's version changes
+   * (remote redeployed at the same URL), the loader drops its caches for that
+   * remote so subsequent loads use the new build. Omit to cache until process
+   * exit or an explicit `revalidate()` call. Only manifest-resolved entries
+   * can be revalidated this way — convention-resolved entries have no version
+   * source.
+   */
+  maxAgeMs?: number;
 }
 declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   name: string;
@@ -63,4 +113,4 @@ declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   } | undefined>;
 };
 //#endregion
-export { ssrEntryLoaderPlugin as default };
+export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/lib/utils/ssrEntryLoader.js

@@ -70,10 +70,7 @@ async function getOrCreateRunner(remoteOrigin) {
 					return await (await fetch(runnerEndpoint, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
-						body: JSON.stringify({
-							name: payload.data.name,
-							data: payload.data.data
-						})
+						body: JSON.stringify(payload)
 					})).json();
 				} }
 			}, new ESModulesEvaluator());
@@ -88,6 +85,27 @@ const _path = () => nodeImport("path");
 const _fs = () => nodeImport("fs");
 const _crypto = () => nodeImport("crypto");
 const _module = () => nodeImport("module");
+/**
+* Version key for a resolved SSR entry. Derived from the remote's manifest
+* content so a redeploy at the same URL produces a different key, which in
+* turn produces different temp-file names — busting both our caches and
+* Node's ESM module cache. Convention-resolved entries (no manifest) get a
+* stable placeholder key and cannot be revalidated automatically.
+*/
+const UNVERSIONED = "unversioned";
+function hashString(value) {
+	let hash = 2166136261;
+	for (let i = 0; i < value.length; i++) {
+		hash ^= value.charCodeAt(i);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function computeManifestVersionKey(manifest) {
+	const buildVersion = manifest.metaData?.buildInfo?.buildVersion;
+	const contentHash = hashString(JSON.stringify(manifest));
+	return buildVersion ? `${buildVersion}-${contentHash}` : contentHash;
+}
 const ssrEntryCache = /* @__PURE__ */ new Map();
 const manifestFetchCache = /* @__PURE__ */ new Map();
 var SsrEntryHttpError = class extends Error {
@@ -149,7 +167,8 @@ function resolveSSREntryUrl(manifest, manifestUrl) {
 	const entryPath = (meta.ssrRemoteEntry.path || "") + meta.ssrRemoteEntry.name;
 	return {
 		url: new URL(entryPath, base).href,
-		type: meta.ssrRemoteEntry.type || "module"
+		type: meta.ssrRemoteEntry.type || "module",
+		versionKey: computeManifestVersionKey(manifest)
 	};
 }
 /**
@@ -191,14 +210,17 @@ function buildSsrEntryCandidates(ctx, options = {}) {
 	const candidates = [];
 	if (!options.skipServerBuild) candidates.push({
 		url: `${remoteOrigin}/__mf_server__/${filename}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	});
 	candidates.push({
 		url: `${base}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	}, {
 		url: `${remoteOrigin}/__mf_ssr__/${filename}.ssr.js`,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	});
 	return candidates;
 }
@@ -212,13 +234,15 @@ async function resolveFirstReachableCandidate(candidates) {
 async function resolveSSREntryImpl(remoteEntryUrl) {
 	if (isSsrEntry(remoteEntryUrl)) return {
 		url: remoteEntryUrl,
-		type: "module"
+		type: "module",
+		versionKey: UNVERSIONED
 	};
 	if (!isManifestEntry(remoteEntryUrl)) {
 		const filename = getEntryFilename(remoteEntryUrl);
 		const fromServerBuild = await headCheckSsrEntry({
 			url: `${remoteEntryUrl.replace(/\/[^/]+$/, "")}/__mf_server__/${filename}.ssr.js`,
-			type: "module"
+			type: "module",
+			versionKey: UNVERSIONED
 		});
 		if (fromServerBuild) return fromServerBuild;
 	}
@@ -229,9 +253,63 @@ async function resolveSSREntryImpl(remoteEntryUrl) {
 	}
 	return resolveFirstReachableCandidate(buildSsrEntryCandidates(ctx, { skipServerBuild: !isManifestEntry(remoteEntryUrl) }));
 }
-async function getSSREntry(remoteEntryUrl) {
-	if (!ssrEntryCache.has(remoteEntryUrl)) ssrEntryCache.set(remoteEntryUrl, resolveSSREntryImpl(remoteEntryUrl));
-	return ssrEntryCache.get(remoteEntryUrl);
+function setSsrEntryCache(remoteEntryUrl) {
+	const record = {
+		promise: resolveSSREntryImpl(remoteEntryUrl),
+		resolvedAt: Date.now()
+	};
+	ssrEntryCache.set(remoteEntryUrl, record);
+	return record;
+}
+async function getSSREntry(remoteEntryUrl, maxAgeMs) {
+	const cached = ssrEntryCache.get(remoteEntryUrl);
+	if (!cached) return setSsrEntryCache(remoteEntryUrl).promise;
+	if (!(typeof maxAgeMs === "number" && maxAgeMs >= 0 && Date.now() - cached.resolvedAt >= maxAgeMs)) return cached.promise;
+	const previous = await cached.promise.catch(() => null);
+	manifestFetchCache.delete(getManifestUrl(remoteEntryUrl));
+	const record = setSsrEntryCache(remoteEntryUrl);
+	const next = await record.promise.catch(() => null);
+	if (previous && next && previous.versionKey !== next.versionKey) dropRemoteCaches(remoteEntryUrl);
+	return record.promise;
+}
+/**
+* Drop per-remote caches after a version change so old artifacts stop being
+* reused. Temp-file cache keys hold SSR entry/chunk URLs (not the browser
+* entry URL), so scope the invalidation by origin.
+*/
+function dropRemoteCaches(remoteEntryUrl) {
+	let origin;
+	try {
+		origin = new URL(remoteEntryUrl).origin;
+	} catch {
+		return;
+	}
+	for (const key of tempFileCache.keys()) if (key.slice(key.indexOf("::") + 2).startsWith(origin)) tempFileCache.delete(key);
+}
+/**
+* Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
+* remote SSR entries. Pass a remote entry URL to scope the invalidation to one
+* remote; call with no arguments to invalidate everything.
+*
+* Note: the MF runtime keeps its own container/module caches per federation
+* instance. This function best-effort clears the module caches of all global
+* federation instances so re-renders load fresh remote modules, but hosts that
+* hold direct references to previously loaded modules keep those references.
+*/
+function revalidate(remoteEntryUrl) {
+	if (remoteEntryUrl) {
+		ssrEntryCache.delete(remoteEntryUrl);
+		manifestFetchCache.delete(getManifestUrl(remoteEntryUrl));
+		dropRemoteCaches(remoteEntryUrl);
+	} else {
+		ssrEntryCache.clear();
+		manifestFetchCache.clear();
+		tempFileCache.clear();
+	}
+	const federation = globalThis.__FEDERATION__;
+	for (const instance of federation?.__INSTANCES__ ?? []) try {
+		instance?.moduleCache?.clear?.();
+	} catch {}
 }
 const tempFileCache = /* @__PURE__ */ new Map();
 let ssrCacheDirPromise;
@@ -252,14 +330,11 @@ async function getSSRCacheDir() {
 	})();
 	return ssrCacheDirPromise;
 }
-function transformSsrCode(code, base, sharedPkgMap) {
-	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
-	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
-		const resolved = sharedPkgMap.get(specifier);
-		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
-	});
+/**
+* Neutralize browser-only preload machinery in Vite/Rolldown output so the
+* code can evaluate in Node. Shared by the temp-file and vm strategies.
+*/
+function neutralizeBrowserPreloadHelpers(code) {
 	code = code.replace(/import\s*\{([^}]*)\}\s*from\s*["'][^"']*preload-helper[^"']*["'];?/g, (_m, bindings) => {
 		return bindings.split(",").map((b) => {
 			const parts = b.trim().split(/\s+as\s+/);
@@ -270,6 +345,16 @@ function transformSsrCode(code, base, sharedPkgMap) {
 	code = code.replace(/\b([A-Za-z_$][\w$]*)\s*\(\s*\(\s*\)\s*=>\s*import\(([^)]*)\)\s*,\s*\[\]\s*\)/g, "import($2)");
 	return code;
 }
+function transformSsrCode(code, base, sharedPkgMap) {
+	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
+	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
+	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
+	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
+		const resolved = sharedPkgMap.get(specifier);
+		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
+	});
+	return neutralizeBrowserPreloadHelpers(code);
+}
 function isVitePreloadHelperSpecifier(specifier) {
 	return specifier.includes("preload-helper");
 }
@@ -277,10 +362,15 @@ function isVitePreloadHelperSpecifier(specifier) {
 * Fetch an HTTP ESM module, transform it, write it to a temp .js file and
 * return the file path. Recursively does the same for HTTP transitive imports
 * so that `import('file:///...temp.js')` can resolve them.
+*
+* `versionKey` participates in both the cache key and the temp file name, so
+* a remote redeploy (new manifest → new key) produces new files and bypasses
+* Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
+async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap, versionKey = UNVERSIONED) {
+	const cacheKey = `${versionKey}::${url}`;
 	if (visited.has(url)) return visited.get(url);
-	if (tempFileCache.has(url)) return tempFileCache.get(url);
+	if (tempFileCache.has(cacheKey)) return tempFileCache.get(cacheKey);
 	const promise = (async () => {
 		const res = await fetch(url);
 		let code = await res.text();
@@ -292,7 +382,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
 		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, sharedPkgMap);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, sharedPkgMap, versionKey);
 			subMap.set(u, `file://${tmpPath}`);
 		}));
 		code = transformSsrCode(code, base, sharedPkgMap);
@@ -300,22 +390,36 @@ async function fetchEsmToTempFile(url, tmpDir, visited, sharedPkgMap) {
 		const { createHash } = await _crypto();
 		const { join } = await _path();
 		const { writeFileSync } = await _fs();
-		const tmpFile = join(tmpDir, `${createHash("sha1").update(url).digest("hex").slice(0, 12)}.js`);
+		const tmpFile = join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}.js`);
 		writeFileSync(tmpFile, code, "utf8");
 		visited.set(url, tmpFile);
 		return tmpFile;
 	})();
-	tempFileCache.set(url, promise);
+	tempFileCache.set(cacheKey, promise);
 	return promise;
 }
-async function importTempModule(filePath) {
-	return await import(
-		/* @vite-ignore */
-		filePath
-);
+async function importTempModule(filePath, versionKey) {
+	return await import(`${filePath}?v=${encodeURIComponent(versionKey)}`);
+}
+let warnedVmUnavailable = false;
+async function tryVmStrategy(ssrEntry, options) {
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("../ssrVmStrategy-DtpfkCw1.js");
+	if (!await isVmStrategyAvailable()) {
+		if (!warnedVmUnavailable) {
+			warnedVmUnavailable = true;
+			console.warn("[mf-vite:ssr-entry-loader] strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
+		}
+		return null;
+	}
+	return await loadViaVmStrategy(ssrEntry.url, {
+		resolvedShared: options.resolvedShared,
+		shareScopeName: options.shareScopeName,
+		versionKey: ssrEntry.versionKey
+	});
 }
-async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
-	const { url, type } = ssrEntry;
+async function loadSSRRemoteEntry(ssrEntry, options) {
+	const { url, type, versionKey } = ssrEntry;
+	const { resolvedShared } = options;
 	if (type === "commonjs-module" || type === "commonjs") {
 		const { createRequire } = await _module();
 		const req = createRequire(import.meta.url);
@@ -338,12 +442,18 @@ async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
 				if (process.env.NODE_ENV !== "production") return null;
 			}
 		}
+		if (options.strategy === "vm") try {
+			const fromVm = await tryVmStrategy(ssrEntry, options);
+			if (fromVm) return fromVm;
+		} catch (error) {
+			if (isSsrEntryHttpError(error)) throw error;
+		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
 		try {
-			return await importTempModule(await fetchEsmToTempFile(url, cacheDir, /* @__PURE__ */ new Map(), sharedPkgMap));
+			return await importTempModule(await fetchEsmToTempFile(url, cacheDir, /* @__PURE__ */ new Map(), sharedPkgMap, versionKey), versionKey);
 		} catch (error) {
 			if (isSsrEntryHttpError(error)) throw error;
 			return null;
@@ -359,18 +469,23 @@ async function loadSSRRemoteEntry(ssrEntry, resolvedShared = {}) {
 	}
 }
 function ssrEntryLoaderPlugin(options = {}) {
-	const resolvedShared = options.resolvedShared ?? {};
+	const resolved = {
+		resolvedShared: options.resolvedShared ?? {},
+		strategy: options.strategy ?? "temp-file",
+		shareScopeName: options.shareScopeName ?? "default",
+		maxAgeMs: options.maxAgeMs
+	};
 	return {
 		name: "mf-vite:ssr-entry-loader",
 		async loadEntry({ remoteInfo }) {
 			if (!isNodeServer()) return;
-			const ssrEntry = await getSSREntry(remoteInfo.entry);
+			const ssrEntry = await getSSREntry(remoteInfo.entry, resolved.maxAgeMs);
 			if (!ssrEntry) return;
-			const mod = await loadSSRRemoteEntry(ssrEntry, resolvedShared);
+			const mod = await loadSSRRemoteEntry(ssrEntry, resolved);
 			if (!mod) return;
 			return mod;
 		}
 	};
 }
 //#endregion
-export { ssrEntryLoaderPlugin as default };
+export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.16.12",
+  "version": "1.16.14",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -70,9 +70,9 @@
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
   },
   "dependencies": {
-    "@module-federation/dts-plugin": "2.6.0",
-    "@module-federation/runtime": "2.6.0",
-    "@module-federation/sdk": "2.6.0"
+    "@module-federation/dts-plugin": "2.7.0",
+    "@module-federation/runtime": "2.7.0",
+    "@module-federation/sdk": "2.7.0"
   },
   "devDependencies": {
     "@playwright/test": "1.58.2",
@@ -86,4 +86,4 @@
     "vite": "8.1.0",
     "vitest": "4.0.18"
   }
-}
+}