@module-federation/vite 1.18.2 → 1.19.0

package/README.md

@@ -221,6 +221,28 @@ You can specify the place the host initialization file is injected with the **ho
 The **moduleParseTimeout** option allows you to configure the maximum time to wait for module parsing during the build process.
 The **moduleParseIdleTimeout** option is an alternative that resets the timer on every parsed module. It only fires when there has been no module activity for the configured duration, making it suitable for large codebases where the total build time exceeds the fixed timeout.
 
+## Runtime capability optimization
+
+Runtime features that a build never uses can be removed at build time:
+
+```ts
+federation({
+  name: "remote",
+  exposes: {
+    "./remote-app": "./src/App.vue",
+  },
+  disableRemote: true,
+  disableShared: true,
+  disableSnapshot: true,
+});
+```
+
+- `disableRemote` removes remote-consumption support. Do not enable it when `remotes` are configured.
+- `disableShared` removes shared-dependency support. Do not enable it when `shared` dependencies are configured.
+- `disableSnapshot` removes snapshot support, including manifest-based remotes, preload, dynamic type hints, HMR, and devtools integration.
+
+All three options default to `false`, except `disableSnapshot`, which defaults to `true` for Node/SSR builds. An explicitly configured Vite `define` value takes precedence over the corresponding option.
+
 ## Load the Remote App
 
 In your host app, you can now import and use the remote app with **defineAsyncComponent**

package/lib/index.d.ts

@@ -96,6 +96,27 @@ type ModuleFederationOptions = {
    * @default 'web' (or 'node' if build.ssr is enabled)
    */
   target?: 'web' | 'node';
+  /**
+   * Removes remote-consumption support from the federation runtime.
+   * Only enable this for builds that never load remotes.
+   *
+   * @default false
+   */
+  disableRemote?: boolean;
+  /**
+   * Removes shared-dependency support from the federation runtime.
+   * Only enable this when the build has no shared dependencies.
+   *
+   * @default false
+   */
+  disableShared?: boolean;
+  /**
+   * Removes snapshot support, including manifest-based remotes, preload,
+   * dynamic type hints, HMR, and devtools integration.
+   *
+   * @default false (true for Node/SSR builds)
+   */
+  disableSnapshot?: boolean;
   /**
    * Additional packages to mark as external in the SSR remote entry build.
    * Shared packages and MF runtime packages are always external. Use this to

package/lib/index.js

@@ -1,4 +1,4 @@
-import { _ as createModuleFederationError, a as getIsRolldown, b as rebaseImport, c as getPackageNameFromNodeModulePath, d as isNuxtProjectRoot, f as packageNameDecode, g as sharedCacheHelperCode, h as setPackageDetectionCwd, i as getInstalledPackageJson, l as getSharedCacheDescriptor, m as resolveImportPath, o as getPackageDetectionCwd, p as packageNameEncode, r as getInstalledPackageEntry, s as getPackageName, u as hasPackageDependency, v as mfWarn, y as normalizePathForImport } from "./pluginDts-CGDIZCsD.js";
+import { _ as createModuleFederationError, a as getIsRolldown, b as rebaseImport, c as getPackageNameFromNodeModulePath, d as isNuxtProjectRoot, f as packageNameDecode, g as sharedCacheHelperCode, h as setPackageDetectionCwd, i as getInstalledPackageJson, l as getSharedCacheDescriptor, m as resolveImportPath, o as getPackageDetectionCwd, p as packageNameEncode, r as getInstalledPackageEntry, s as getPackageName, u as hasPackageDependency, v as mfWarn, y as normalizePathForImport } from "./pluginDts-Cd2opGcZ.js";
 import { createRequire } from "node:module";
 import * as fs$2 from "fs";
 import { existsSync, readFileSync, realpathSync, statSync, writeFileSync } from "fs";
@@ -237,6 +237,10 @@ const ASSET_LIKE_IMPORT_RE = new RegExp(`\\.(${[...[
 function isAssetLikeImport(source) {
 	return ASSET_LIKE_IMPORT_RE.test(source);
 }
+const VITE_OPTIMIZABLE_ENTRY_RE = /\.[cm]?[jt]s$/;
+function isViteOptimizableEntry(resolvedPath) {
+	return VITE_OPTIMIZABLE_ENTRY_RE.test(resolvedPath);
+}
 function removeTrailingSlash(value) {
 	return value.endsWith("/") ? value.slice(0, -1) : value;
 }
@@ -544,7 +548,10 @@ function normalizeModuleFederationOptions(options) {
 		moduleParseTimeout: options.moduleParseTimeout || 10,
 		moduleParseIdleTimeout: options.moduleParseIdleTimeout,
 		varFilename: options.varFilename,
-		target: options.target
+		target: options.target,
+		disableRemote: options.disableRemote,
+		disableShared: options.disableShared,
+		disableSnapshot: options.disableSnapshot
 	};
 	explicitSharedKeysByOptions.set(normalized, new Set(explicitSharedKeys));
 	return config = normalized;
@@ -4915,8 +4922,8 @@ function resolveReactRefreshRuntime(root) {
 * falls back to this remote's local runtime when the remote is opened directly.
 */
 const REACT_REFRESH_PROXY_MODULE = [
-	`const __remoteOrigin = new URL(import.meta.url).origin;`,
-	`const __target = window.location.origin === __remoteOrigin ? '${LOCAL_REACT_REFRESH_PATH}' : window.location.origin + '${REACT_REFRESH_PATH}';`,
+	`const __remoteUrl = new URL(import.meta.url);`,
+	`const __target = window.location.origin === __remoteUrl.origin ? new URL('.${LOCAL_REACT_REFRESH_PATH}', __remoteUrl).href : window.location.origin + '${REACT_REFRESH_PATH}';`,
 	`const __rt = await import(__target);`,
 	`export const injectIntoGlobalHook = __rt.injectIntoGlobalHook;`,
 	`export const register = __rt.register;`,
@@ -4933,14 +4940,14 @@ const reactAdapter = {
 		let reactRefreshRuntime;
 		server.middlewares.use((req, res, next) => {
 			const url = stripQuery(req.url);
-			if (url === LOCAL_REACT_REFRESH_PATH) {
+			if (url?.endsWith(LOCAL_REACT_REFRESH_PATH)) {
 				reactRefreshRuntime ??= resolveReactRefreshRuntime(server.config.root);
 				res.setHeader("Content-Type", "application/javascript; charset=utf-8");
 				res.setHeader("Access-Control-Allow-Origin", "*");
 				res.end(reactRefreshRuntime);
 				return;
 			}
-			if (url !== REACT_REFRESH_PATH) return next();
+			if (!url?.endsWith(REACT_REFRESH_PATH)) return next();
 			res.setHeader("Content-Type", "application/javascript; charset=utf-8");
 			res.setHeader("Access-Control-Allow-Origin", "*");
 			res.end(REACT_REFRESH_PROXY_MODULE);
@@ -5630,6 +5637,35 @@ const chunkContainsCssModules = (modules) => {
 	return false;
 };
 /**
+* Analyzes assets associated with a chunk without mutating the output map.
+* The static-import traversal is cycle-safe and ignores missing bundle entries.
+*/
+const analyzeChunkAssets = (bundle, fileName, chunk) => {
+	const dynamicAssets = [];
+	const visited = /* @__PURE__ */ new Set();
+	const queue = [fileName];
+	for (let queueIndex = 0; queueIndex < queue.length; queueIndex++) {
+		const currentFileName = queue[queueIndex];
+		if (visited.has(currentFileName)) continue;
+		visited.add(currentFileName);
+		const currentChunk = bundle[currentFileName];
+		if (!currentChunk || currentChunk.type !== "chunk") continue;
+		for (const dynamicImport of currentChunk.dynamicImports ?? []) {
+			if (!bundle[dynamicImport]) continue;
+			dynamicAssets.push({
+				fileName: dynamicImport,
+				type: isCSSFile(dynamicImport) ? "css" : "js"
+			});
+		}
+		for (const staticImport of currentChunk.imports ?? []) queue.push(staticImport);
+	}
+	return {
+		importedCss: Array.from(chunk.viteMetadata?.importedCss ?? []),
+		containsCssModules: chunkContainsCssModules(chunk.modules),
+		dynamicAssets
+	};
+};
+/**
 * Processes module assets and tracks them in the files map
 * @param bundle - The Rollup output bundle
 * @param filesMap - The preload map to populate
@@ -5637,6 +5673,7 @@ const chunkContainsCssModules = (modules) => {
 */
 const processModuleAssets = (bundle, filesMap, moduleMatcher, options = {}) => {
 	const bundleCssAssets = collectCssAssets(bundle);
+	const chunkAnalysisCache = /* @__PURE__ */ new Map();
 	for (const [fileName, fileData] of Object.entries(bundle)) {
 		if (fileData.type !== "chunk") continue;
 		if (!fileData.modules) continue;
@@ -5649,27 +5686,19 @@ const processModuleAssets = (bundle, filesMap, moduleMatcher, options = {}) => {
 			}
 			const matchKey = comparableModulePaths.map(moduleMatcher).find(Boolean);
 			if (!matchKey) continue;
+			let analysis = chunkAnalysisCache.get(fileName);
+			if (!analysis) {
+				analysis = analyzeChunkAssets(bundle, fileName, fileData);
+				chunkAnalysisCache.set(fileName, analysis);
+			}
 			trackAsset(filesMap, matchKey, fileName, false, "js");
 			let foundCssViaMetadata = false;
-			if (fileData.viteMetadata?.importedCss?.size) for (const cssFile of Array.from(fileData.viteMetadata.importedCss)) {
+			for (const cssFile of analysis.importedCss) {
 				trackAsset(filesMap, matchKey, cssFile, false, "css");
 				foundCssViaMetadata = true;
 			}
-			if (!foundCssViaMetadata && chunkContainsCssModules(fileData.modules)) for (const cssAsset of Array.from(bundleCssAssets)) trackAsset(filesMap, matchKey, cssAsset, false, "css");
-			const visited = /* @__PURE__ */ new Set();
-			const queue = [fileName];
-			for (let queueIndex = 0; queueIndex < queue.length; queueIndex++) {
-				const cur = queue[queueIndex];
-				if (visited.has(cur)) continue;
-				visited.add(cur);
-				const chunk = bundle[cur];
-				if (!chunk || chunk.type !== "chunk") continue;
-				if (chunk.dynamicImports) for (const dynamicImport of chunk.dynamicImports) {
-					if (!bundle[dynamicImport]) continue;
-					trackAsset(filesMap, matchKey, dynamicImport, true, isCSSFile(dynamicImport) ? "css" : "js");
-				}
-				if (chunk.imports) for (const imp of chunk.imports) queue.push(imp);
-			}
+			if (!foundCssViaMetadata && analysis.containsCssModules) for (const cssAsset of Array.from(bundleCssAssets)) trackAsset(filesMap, matchKey, cssAsset, false, "css");
+			for (const asset of analysis.dynamicAssets) trackAsset(filesMap, matchKey, asset.fileName, true, asset.type);
 		}
 	}
 };
@@ -7759,6 +7788,44 @@ var normalizeOptimizeDeps_default = {
 	}
 };
 //#endregion
+//#region src/utils/runtimeCapabilityOptimization.ts
+const RUNTIME_CAPABILITIES = [
+	{
+		option: "disableRemote",
+		define: "FEDERATION_OPTIMIZE_NO_REMOTE"
+	},
+	{
+		option: "disableShared",
+		define: "FEDERATION_OPTIMIZE_NO_SHARED"
+	},
+	{
+		option: "disableSnapshot",
+		define: "FEDERATION_OPTIMIZE_NO_SNAPSHOT_PLUGIN"
+	}
+];
+function isEquivalentBooleanDefine(value, expected) {
+	return String(value) === JSON.stringify(expected);
+}
+function applyRuntimeCapabilityDefines(define, options, { defaultDisableSnapshot, onConflict } = {}) {
+	for (const capability of RUNTIME_CAPABILITIES) {
+		const explicitValue = options[capability.option];
+		const desiredValue = capability.option === "disableSnapshot" ? explicitValue ?? defaultDisableSnapshot : explicitValue;
+		if (desiredValue === void 0) continue;
+		if (!(capability.define in define)) {
+			define[capability.define] = JSON.stringify(desiredValue);
+			continue;
+		}
+		if (explicitValue !== void 0 && !isEquivalentBooleanDefine(define[capability.define], explicitValue)) onConflict?.(`${capability.define} define (${define[capability.define]}) differs from ${capability.option} option (${explicitValue}). The existing define will not be overridden.`);
+	}
+	if (!("FEDERATION_HAS_EXPOSES" in define)) define["FEDERATION_HAS_EXPOSES"] = JSON.stringify(Object.keys(options.exposes).length > 0);
+}
+function getRuntimeCapabilityConfigurationWarnings(options) {
+	const warnings = [];
+	if (options.disableRemote && Object.keys(options.remotes).length > 0) warnings.push("disableRemote is true, but remotes are configured. Remote loading will be unavailable at runtime.");
+	if (options.disableShared && Object.keys(options.shared).length > 0) warnings.push("disableShared is true, but shared dependencies are configured. Shared dependency loading will be unavailable at runtime.");
+	return warnings;
+}
+//#endregion
 //#region src/index.ts
 const patchedManualChunks = /* @__PURE__ */ new WeakSet();
 const PRELOAD_HELPER_CHUNK = "vite-preload-helper";
@@ -7843,8 +7910,7 @@ function isFederationHtmlPreloadDependency(dep, includeSharedRuntime = false) {
 }
 function canResolveSharedSubpath(subpath, projectRoot) {
 	try {
-		createRequire$1(pathToFileURL(path$1.join(projectRoot, "package.json"))).resolve(subpath);
-		return true;
+		return isViteOptimizableEntry(createRequire$1(pathToFileURL(path$1.join(projectRoot, "package.json"))).resolve(subpath));
 	} catch {
 		return false;
 	}
@@ -8029,16 +8095,21 @@ export default __mfShared.default ?? __mfShared;`
 						const optimizeDeps = config.optimizeDeps ??= {};
 						optimizeDeps.include ??= [];
 						optimizeDeps.exclude ??= [];
-						const shouldBypassOptimizeDep = isLitShare(key);
+						const shouldBypassOptimizeDep = isLitShare(key) || !canResolveSharedSubpath(key, root);
 						if (optimizeDeps.include.includes(key)) optimizeDeps.exclude = optimizeDeps.exclude.filter((dep) => dep !== key);
 						else if (shouldBypassOptimizeDep) optimizeDeps.exclude.push(key);
 						else optimizeDeps.include.push(key);
 						for (const subpath of getCommonSharedSubpaths(key)) {
+							const canResolveSubpath = canResolveSharedSubpath(subpath, root);
+							if (subpath === "react/compiler-runtime" && !canResolveSubpath) {
+								optimizeDeps.exclude.push(subpath);
+								continue;
+							}
 							getLoadShareModulePath(subpath, isRolldown, options);
 							writeLoadShareModule(subpath, shareItem, _command, isRolldown, options);
 							writePreBuildLibPath(subpath, shareItem, options);
 							addUsedShares(subpath, options);
-							if (canResolveSharedSubpath(subpath, root)) optimizeDeps.include.push(subpath);
+							if (canResolveSubpath) optimizeDeps.include.push(subpath);
 							else optimizeDeps.exclude.push(subpath);
 						}
 					}
@@ -8086,9 +8157,18 @@ export default __mfShared.default ?? __mfShared;`
 	};
 }
 const SSR_ONLY_PLUGINS = new Set(["@module-federation/vite/ssrEntryLoader"]);
+function applyBuildTimeRuntimeDefines(define, options, { target, isAstro, defaultDisableSnapshot }) {
+	const envTargetDefineValue = !options.target && isAstro ? "undefined" : JSON.stringify(target);
+	if (!("ENV_TARGET" in define)) define.ENV_TARGET = envTargetDefineValue;
+	applyRuntimeCapabilityDefines(define, options, {
+		defaultDisableSnapshot,
+		onConflict: mfWarn
+	});
+	if (options.target && define.ENV_TARGET !== JSON.stringify(options.target)) mfWarn(`ENV_TARGET define (${define.ENV_TARGET}) differs from target option ("${options.target}"). ENV_TARGET will not be overridden.`);
+}
 function loadPluginDts(options) {
 	if (options.dts === false) return [];
-	return [import("./pluginDts-CGDIZCsD.js").then((n) => n.n).then(({ default: pluginDts }) => pluginDts(options))];
+	return [import("./pluginDts-Cd2opGcZ.js").then((n) => n.n).then(({ default: pluginDts }) => pluginDts(options))];
 }
 function federation(mfUserOptions) {
 	if (isTestEnv()) return [];
@@ -8102,6 +8182,7 @@ function federation(mfUserOptions) {
 	let command;
 	let desiredRolldownOutput;
 	let isSsrBuild = false;
+	const emittedRuntimeCapabilityWarnings = /* @__PURE__ */ new Set();
 	return [
 		{
 			name: "vite:module-federation-virtual-modules",
@@ -8444,11 +8525,17 @@ function federation(mfUserOptions) {
 				}
 				const isAstro = hasPackageDependency("astro");
 				const resolvedTarget = options.target ?? (config.build?.ssr ? "node" : "web");
-				const envTargetDefineValue = !options.target && isAstro ? "undefined" : JSON.stringify(resolvedTarget);
 				if (!config.define) config.define = {};
-				if (!("ENV_TARGET" in config.define)) config.define["ENV_TARGET"] = envTargetDefineValue;
-				if (resolvedTarget === "node" && !("FEDERATION_OPTIMIZE_NO_SNAPSHOT_PLUGIN" in config.define)) config.define["FEDERATION_OPTIMIZE_NO_SNAPSHOT_PLUGIN"] = "true";
-				if (options.target && "ENV_TARGET" in config.define && config.define["ENV_TARGET"] !== JSON.stringify(options.target)) mfWarn(`ENV_TARGET define (${config.define["ENV_TARGET"]}) differs from target option ("${options.target}"). ENV_TARGET will not be overridden.`);
+				applyBuildTimeRuntimeDefines(config.define, options, {
+					target: resolvedTarget,
+					isAstro,
+					defaultDisableSnapshot: resolvedTarget === "node" ? true : void 0
+				});
+				for (const warning of getRuntimeCapabilityConfigurationWarnings(options)) {
+					if (emittedRuntimeCapabilityWarnings.has(warning)) continue;
+					emittedRuntimeCapabilityWarnings.add(warning);
+					mfWarn(warning);
+				}
 			},
 			configResolved(config) {
 				if (!hasPackageDependency("nitro")) return;
@@ -8458,11 +8545,12 @@ function federation(mfUserOptions) {
 			configEnvironment(name, config) {
 				if (!(config.consumer === "server" || name === "ssr" || name === "server" || config.build?.ssr === true)) return;
 				const isAstro = hasPackageDependency("astro");
-				const envTargetDefineValue = !options.target && isAstro ? "undefined" : JSON.stringify(options.target ?? "node");
 				config.define = { ...config.define ?? {} };
-				if (!("ENV_TARGET" in config.define)) config.define["ENV_TARGET"] = envTargetDefineValue;
-				if (!("FEDERATION_OPTIMIZE_NO_SNAPSHOT_PLUGIN" in config.define)) config.define["FEDERATION_OPTIMIZE_NO_SNAPSHOT_PLUGIN"] = "true";
-				if (options.target && config.define["ENV_TARGET"] !== JSON.stringify(options.target)) mfWarn(`ENV_TARGET define (${config.define["ENV_TARGET"]}) differs from target option ("${options.target}"). ENV_TARGET will not be overridden.`);
+				applyBuildTimeRuntimeDefines(config.define, options, {
+					target: options.target ?? "node",
+					isAstro,
+					defaultDisableSnapshot: true
+				});
 			}
 		},
 		...Manifest(options),

package/lib/{pluginDts-CGDIZCsD.js → pluginDts-Cd2opGcZ.js}

@@ -102,6 +102,7 @@ let packageDetectionCwd;
 function getDependencyCacheKey(cwd, dependencyName) {
 	return `${cwd}:${dependencyName}`;
 }
+const installedPackageJsonCache = /* @__PURE__ */ new Map();
 function setPackageDetectionCwd(cwd) {
 	packageDetectionCwd = cwd;
 }
@@ -398,6 +399,13 @@ const sharedCacheHelperCode = `const __mfGetSharedCacheDescriptor = (pkg, single
 function getInstalledPackageJson(pkg, opts) {
 	const cwd = opts?.cwd || getPackageDetectionCwd();
 	const packageName = opts?.packageName || getPackageName(pkg);
+	const cacheKey = `${cwd}\0${pkg}\0${packageName}\0${opts?.fromResolvedEntry ?? ""}`;
+	if (installedPackageJsonCache.has(cacheKey)) return installedPackageJsonCache.get(cacheKey);
+	const result = resolveInstalledPackageJson(pkg, cwd, packageName, opts);
+	installedPackageJsonCache.set(cacheKey, result);
+	return result;
+}
+function resolveInstalledPackageJson(pkg, cwd, packageName, opts) {
 	const tryReadPackageJson = (packageJsonPath) => {
 		if (!existsSync(packageJsonPath)) return void 0;
 		try {

package/lib/{ssrEntryLoader-DgsCQOqq.js → ssrEntryLoader-CuZVKlRm.js}

@@ -1,5 +1,6 @@
 //#region src/utils/fetchWithTimeout.ts
 const DEFAULT_SSR_FETCH_TIMEOUT_MS = 1e4;
+const DEFAULT_SSR_FETCH_MAX_BYTES = 10 * 1024 * 1024;
 function getFetchUrl(input) {
 	const raw = typeof input === "string" || input instanceof URL ? String(input) : input.url;
 	return new URL(raw);
@@ -10,6 +11,11 @@ function getSecureFetchUrl(input) {
 	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) throw new TypeError(`Refusing to fetch SSR resource over an insecure connection: ${url}`);
 	return url;
 }
+function isAbortLikeError(error) {
+	if (!error || typeof error !== "object") return false;
+	const name = error.name;
+	return name === "AbortError" || name === "TimeoutError";
+}
 /** Fetch with a bounded wait. Set timeoutMs to 0 to disable the timeout. */
 async function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS) {
 	const inputUrl = getSecureFetchUrl(input);
@@ -29,11 +35,67 @@ async function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_SSR_FETCH_
 	try {
 		return await request(inputUrl);
 	} catch (error) {
-		if (inputUrl.hostname !== "localhost") throw error;
+		if (inputUrl.hostname !== "localhost" || isAbortLikeError(error)) throw error;
 		inputUrl.hostname = "[::1]";
 		return request(inputUrl);
 	}
 }
+var SsrFetchBodyTooLargeError = class extends Error {
+	url;
+	maxBytes;
+	declaredBytes;
+	constructor(url, maxBytes, declaredBytes) {
+		super(declaredBytes != null ? `SSR response from ${url} declared ${declaredBytes} bytes which exceeds the ${maxBytes}-byte limit` : `SSR response from ${url} exceeded the ${maxBytes}-byte limit`);
+		this.name = "SsrFetchBodyTooLargeError";
+		this.url = url;
+		this.maxBytes = maxBytes;
+		this.declaredBytes = declaredBytes;
+	}
+};
+function isSsrFetchBodyTooLargeError(error) {
+	return error instanceof SsrFetchBodyTooLargeError;
+}
+/**
+* Read a response body as text, rejecting when it exceeds `maxBytes`.
+* Set `maxBytes` to 0 (or a non-finite value) to disable the limit.
+*/
+async function readResponseTextBounded(res, maxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, url = res.url || "unknown") {
+	if (!Number.isFinite(maxBytes) || maxBytes <= 0) return res.text();
+	const contentLengthHeader = res.headers?.get?.("content-length") ?? null;
+	if (contentLengthHeader != null) {
+		const declaredBytes = Number(contentLengthHeader);
+		if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+			try {
+				await res.body?.cancel();
+			} catch {}
+			throw new SsrFetchBodyTooLargeError(url, maxBytes, declaredBytes);
+		}
+	}
+	if (!res.body) return res.text();
+	const reader = res.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			try {
+				await reader.cancel();
+			} catch {}
+			throw new SsrFetchBodyTooLargeError(url, maxBytes);
+		}
+		chunks.push(value);
+	}
+	const merged = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(merged);
+}
 //#endregion
 //#region src/utils/ssrEntryLoader.ts
 /**
@@ -93,8 +155,8 @@ async function getModuleRunnerModule() {
 * This is Vite 8+ only — older versions don't expose `vite/module-runner` or
 * the `/__mf_runner__` proxy endpoint.
 */
-async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs) {
-	const cacheKey = `${fetchTimeoutMs}::${remoteOrigin}`;
+async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = `${fetchTimeoutMs}::${fetchMaxBytes}::${remoteOrigin}`;
 	if (runnerCache.has(cacheKey)) return runnerCache.get(cacheKey);
 	const promise = (async () => {
 		const viteRunner = await getModuleRunnerModule();
@@ -105,11 +167,12 @@ async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs) {
 			return new ModuleRunner({
 				hmr: false,
 				transport: { async invoke(payload) {
-					return await (await fetchWithTimeout(runnerEndpoint, {
+					const text = await readResponseTextBounded(await fetchWithTimeout(runnerEndpoint, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
 						body: JSON.stringify(payload)
-					}, fetchTimeoutMs)).json();
+					}, fetchTimeoutMs), fetchMaxBytes, runnerEndpoint);
+					return JSON.parse(text);
 				} }
 			}, new ESModulesEvaluator());
 		} catch {
@@ -146,8 +209,8 @@ function computeManifestVersionKey(manifest) {
 }
 const ssrEntryCache = /* @__PURE__ */ new Map();
 const manifestFetchCache = /* @__PURE__ */ new Map();
-function makeUrlCacheKey(url, fetchTimeoutMs) {
-	return `${fetchTimeoutMs}::${url}`;
+function makeUrlCacheKey(url, fetchTimeoutMs, fetchMaxBytes) {
+	return `${fetchTimeoutMs}::${fetchMaxBytes}::${url}`;
 }
 var SsrEntryHttpError = class extends Error {
 	constructor(url, status, statusText, bodyPreview) {
@@ -165,22 +228,26 @@ function getBodyPreview(body) {
 function isSsrEntryHttpError(error) {
 	return error instanceof SsrEntryHttpError;
 }
-async function fetchManifest(manifestUrl, fetchTimeoutMs) {
+async function fetchManifest(manifestUrl, fetchTimeoutMs, fetchMaxBytes) {
 	try {
 		const res = await fetchWithTimeout(manifestUrl, {}, fetchTimeoutMs);
 		if (!res.ok) return null;
-		return await res.json();
-	} catch {
+		const text = await readResponseTextBounded(res, fetchMaxBytes, manifestUrl);
+		return JSON.parse(text);
+	} catch (error) {
+		if (isSsrFetchBodyTooLargeError(error)) throw error;
 		return null;
 	}
 }
-async function fetchManifestCached(manifestUrl, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(manifestUrl, fetchTimeoutMs);
+async function fetchManifestCached(manifestUrl, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 	if (!manifestFetchCache.has(cacheKey)) {
-		const promise = fetchManifest(manifestUrl, fetchTimeoutMs);
+		const promise = fetchManifest(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 		manifestFetchCache.set(cacheKey, promise);
 		promise.then((manifest) => {
 			if (!manifest && manifestFetchCache.get(cacheKey) === promise) manifestFetchCache.delete(cacheKey);
+		}, () => {
+			if (manifestFetchCache.get(cacheKey) === promise) manifestFetchCache.delete(cacheKey);
 		});
 	}
 	return manifestFetchCache.get(cacheKey);
@@ -239,9 +306,9 @@ function resolveAssetBaseUrl(entryUrl, manifest, manifestUrl) {
 	if (!isManifestEntry(entryUrl)) return entryUrl;
 	return new URL("remoteEntry.js", manifestUrl.replace(/\/[^/]+$/, "/")).href;
 }
-async function buildEntryContext(entryUrl, fetchTimeoutMs) {
+async function buildEntryContext(entryUrl, fetchTimeoutMs, fetchMaxBytes) {
 	const manifestUrl = getManifestUrl(entryUrl);
-	const manifest = await fetchManifestCached(manifestUrl, fetchTimeoutMs);
+	const manifest = await fetchManifestCached(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 	const assetBaseUrl = resolveAssetBaseUrl(entryUrl, manifest, manifestUrl);
 	return {
 		entryUrl,
@@ -279,7 +346,7 @@ async function resolveFirstReachableCandidate(candidates, fetchTimeoutMs) {
 	}
 	return null;
 }
-async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs) {
+async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes) {
 	if (isSsrEntry(remoteEntryUrl)) return {
 		url: remoteEntryUrl,
 		type: "module",
@@ -294,33 +361,35 @@ async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs) {
 		}, fetchTimeoutMs);
 		if (fromServerBuild) return fromServerBuild;
 	}
-	const ctx = await buildEntryContext(remoteEntryUrl, fetchTimeoutMs);
+	const ctx = await buildEntryContext(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	if (ctx.manifest) {
 		const fromManifest = resolveSSREntryUrl(ctx.manifest, ctx.manifestUrl);
 		if (fromManifest) return fromManifest;
 	}
 	return resolveFirstReachableCandidate(buildSsrEntryCandidates(ctx, { skipServerBuild: !isManifestEntry(remoteEntryUrl) }), fetchTimeoutMs);
 }
-function setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs);
+function setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const record = {
-		promise: resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs),
+		promise: resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes),
 		resolvedAt: Date.now()
 	};
 	ssrEntryCache.set(cacheKey, record);
 	record.promise.then((entry) => {
 		if (!entry && ssrEntryCache.get(cacheKey) === record) ssrEntryCache.delete(cacheKey);
+	}, () => {
+		if (ssrEntryCache.get(cacheKey) === record) ssrEntryCache.delete(cacheKey);
 	});
 	return record;
 }
-async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs);
+async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const cached = ssrEntryCache.get(cacheKey);
-	if (!cached) return setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs).promise;
+	if (!cached) return setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes).promise;
 	if (!(typeof maxAgeMs === "number" && maxAgeMs >= 0 && Date.now() - cached.resolvedAt >= maxAgeMs)) return cached.promise;
 	const previous = await cached.promise.catch(() => null);
-	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs));
-	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs);
+	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs, fetchMaxBytes));
+	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const next = await record.promise.catch(() => null);
 	if (previous && next && previous.versionKey !== next.versionKey) dropRemoteCaches(remoteEntryUrl);
 	return record.promise;
@@ -337,7 +406,7 @@ function dropRemoteCaches(remoteEntryUrl) {
 	} catch {
 		return;
 	}
-	for (const [key] of tempFileCache) if (JSON.parse(key)[2].startsWith(origin)) {
+	for (const [key] of tempFileCache) if (JSON.parse(key).find((part) => typeof part === "string" && /^https?:\/\//.test(part))?.startsWith(origin)) {
 		tempFileCache.delete(key);
 		tempFilePathCache.delete(key);
 	}
@@ -429,9 +498,10 @@ function isVitePreloadHelperSpecifier(specifier) {
 * a remote redeploy (new manifest → new key) produces new files and bypasses
 * Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default") {
+async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
 	const cacheKey = JSON.stringify([
 		fetchTimeoutMs,
+		fetchMaxBytes,
 		versionKey,
 		url,
 		contextKey
@@ -440,7 +510,8 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	const cached = tempFileCache.get(cacheKey);
 	if (cached) {
 		pending.add(cached);
-		const tmpFile = await tempFilePathCache.get(cacheKey);
+		const reserved = tempFilePathCache.get(cacheKey);
+		const tmpFile = reserved ? await reserved : await cached;
 		visited.set(url, tmpFile);
 		return tmpFile;
 	}
@@ -454,7 +525,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		const tmpFile = await tmpFilePromise;
 		visited.set(url, tmpFile);
 		const res = await fetchWithTimeout(url, {}, fetchTimeoutMs);
-		let code = await res.text();
+		let code = await readResponseTextBounded(res, fetchMaxBytes, url);
 		if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(code));
 		const base = url.replace(/\/[^/]*$/, "/");
 		const relImports = [];
@@ -463,7 +534,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
 			subMap.set(u, `file://${tmpPath}`);
 		}));
 		code = transformSsrCode(code, base, sharedPkgMap);
@@ -480,9 +551,9 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	});
 	return promise;
 }
-async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default") {
+async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
 	const pending = /* @__PURE__ */ new Set();
-	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey);
+	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
 	await Promise.all(pending);
 	return rootFile;
 }
@@ -494,7 +565,7 @@ async function importTempModule(filePath, versionKey) {
 }
 let warnedVmUnavailable = false;
 async function tryVmStrategy(ssrEntry, options) {
-	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-ChF8MB7l.js");
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-Dpw20xiw.js");
 	if (!await isVmStrategyAvailable()) {
 		if (!warnedVmUnavailable) {
 			warnedVmUnavailable = true;
@@ -507,6 +578,7 @@ async function tryVmStrategy(ssrEntry, options) {
 		shareScopeName: options.shareScopeName,
 		versionKey: ssrEntry.versionKey,
 		fetchTimeoutMs: options.fetchTimeoutMs,
+		fetchMaxBytes: options.fetchMaxBytes,
 		cacheContext: options.cacheContext,
 		federationInstance: options.federationInstance
 	});
@@ -525,14 +597,15 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 		const urlObj = new URL(url);
 		if (urlObj.pathname.includes("/__mf_ssr__/")) {
 			const remoteOrigin = urlObj.origin;
-			const runner = await getOrCreateRunner(remoteOrigin, options.fetchTimeoutMs);
+			const runner = await getOrCreateRunner(remoteOrigin, options.fetchTimeoutMs, options.fetchMaxBytes);
 			if (!runner) {
 				if (process.env.NODE_ENV !== "production") return null;
 			} else try {
 				const mod = await runner.import(urlObj.pathname);
 				if (mod && typeof mod === "object" && "init" in mod) return mod;
 				if (process.env.NODE_ENV !== "production") return null;
-			} catch {
+			} catch (error) {
+				if (isSsrFetchBodyTooLargeError(error)) throw error;
 				if (process.env.NODE_ENV !== "production") return null;
 			}
 		}
@@ -540,16 +613,16 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 			const fromVm = await tryVmStrategy(ssrEntry, options);
 			if (fromVm) return fromVm;
 		} catch (error) {
-			if (isSsrEntryHttpError(error)) throw error;
+			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
 		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
 		try {
-			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName)), versionKey);
+			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes), versionKey);
 		} catch (error) {
-			if (isSsrEntryHttpError(error)) throw error;
+			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
 			return null;
 		}
 	}
@@ -569,6 +642,7 @@ function ssrEntryLoaderPlugin(options = {}) {
 		shareScopeName: options.shareScopeName ?? "default",
 		maxAgeMs: options.maxAgeMs,
 		fetchTimeoutMs: options.fetchTimeoutMs ?? 1e4,
+		fetchMaxBytes: options.fetchMaxBytes ?? 10485760,
 		cacheContext: {}
 	};
 	return {
@@ -580,7 +654,7 @@ function ssrEntryLoaderPlugin(options = {}) {
 				cacheContext: origin,
 				federationInstance: origin
 			} : resolved;
-			const ssrEntry = await getSSREntry(remoteInfo.entry, loadOptions.maxAgeMs, loadOptions.fetchTimeoutMs);
+			const ssrEntry = await getSSREntry(remoteInfo.entry, loadOptions.maxAgeMs, loadOptions.fetchTimeoutMs, loadOptions.fetchMaxBytes);
 			if (!ssrEntry) return;
 			const mod = await loadSSRRemoteEntry(ssrEntry, loadOptions);
 			if (!mod) return;
@@ -589,4 +663,4 @@ function ssrEntryLoaderPlugin(options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_SSR_FETCH_TIMEOUT_MS as a, ssrEntryLoaderPlugin as i, neutralizeBrowserPreloadHelpers as n, fetchWithTimeout as o, revalidate as r, SsrEntryHttpError as t };
+export { DEFAULT_SSR_FETCH_MAX_BYTES as a, readResponseTextBounded as c, ssrEntryLoaderPlugin as i, neutralizeBrowserPreloadHelpers as n, DEFAULT_SSR_FETCH_TIMEOUT_MS as o, revalidate as r, fetchWithTimeout as s, SsrEntryHttpError as t };

package/lib/{ssrVmStrategy-ChF8MB7l.js → ssrVmStrategy-Dpw20xiw.js}

@@ -1,4 +1,4 @@
-import { n as neutralizeBrowserPreloadHelpers, o as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-DgsCQOqq.js";
+import { c as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, s as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-CuZVKlRm.js";
 //#region src/utils/ssrVmStrategy.ts
 /**
 * vm.SourceTextModule strategy for loading remote SSR entries.
@@ -104,9 +104,9 @@ function getVmCacheContextKey(options) {
 function getBodyPreview(body) {
 	return body.slice(0, 240).replace(/\s+/g, " ").trim();
 }
-async function fetchModuleSource(url, fetchTimeoutMs) {
+async function fetchModuleSource(url, fetchTimeoutMs, fetchMaxBytes) {
 	const res = await fetchWithTimeout(url, {}, fetchTimeoutMs);
-	const text = await res.text();
+	const text = await readResponseTextBounded(res, fetchMaxBytes ?? 10485760, url);
 	if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(text));
 	return neutralizeBrowserPreloadHelpers(text);
 }
@@ -123,11 +123,12 @@ function getHttpModule(vm, url, options) {
 	const cacheKey = JSON.stringify([
 		getVmCacheContextKey(options),
 		options.fetchTimeoutMs ?? 1e4,
+		options.fetchMaxBytes ?? 10485760,
 		options.versionKey,
 		url
 	]);
 	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
-		const code = await fetchModuleSource(url, options.fetchTimeoutMs);
+		const code = await fetchModuleSource(url, options.fetchTimeoutMs, options.fetchMaxBytes);
 		return new vm.SourceTextModule(code, {
 			identifier: url,
 			initializeImportMeta(meta) {

package/lib/utils/ssrEntryLoader.d.ts

@@ -105,6 +105,11 @@ interface SsrEntryLoaderOptions {
    * 10 seconds. Set to `0` to disable the timeout.
    */
   fetchTimeoutMs?: number;
+  /**
+   * Maximum response body size in bytes for each SSR network request. Defaults
+   * to 10 MiB. Set to `0` to disable the limit.
+   */
+  fetchMaxBytes?: number;
 }
 declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   name: string;

package/lib/utils/ssrEntryLoader.js

@@ -1,2 +1,2 @@
-import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-DgsCQOqq.js";
+import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-CuZVKlRm.js";
 export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.18.2",
+  "version": "1.19.0",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -86,4 +86,4 @@
     "vite": "8.1.0",
     "vitest": "4.0.18"
   }
-}
+}