@module-federation/vite 1.23.0 → 1.23.1

package/lib/{ssrEntryLoader-BvAkpCyi.js → ssrEntryLoader-DmqLXUmm.js}

@@ -1,4 +1,4 @@
-import { t as EXTERNAL_URL_RE } from "./buildPaths-BoaQTkxt.js";
+import { a as CodeRewriter, i as createCodePositionMap, r as mfWarn, s as EXTERNAL_URL_RE } from "./logger--uKHOVjR.js";
 //#region src/utils/fetchWithTimeout.ts
 const DEFAULT_SSR_FETCH_TIMEOUT_MS = 1e4;
 const DEFAULT_SSR_FETCH_MAX_BYTES = 10 * 1024 * 1024;
@@ -98,6 +98,15 @@ async function readResponseTextBounded(res, maxBytes = DEFAULT_SSR_FETCH_MAX_BYT
 	return new TextDecoder().decode(merged);
 }
 //#endregion
+//#region src/utils/url.ts
+function getUrlOrigin(value) {
+	try {
+		return new URL(value).origin;
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/utils/ssrEntryLoader.ts
 /**
 * MF runtime plugin that intercepts the `loadEntry` lifecycle hook on the
@@ -470,35 +479,44 @@ async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs, fetchMaxByt
 	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs, fetchMaxBytes));
 	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const next = await record.promise.catch(() => null);
-	if (previous && next && previous.versionKey !== next.versionKey) {
-		dropRemoteCaches(remoteEntryUrl);
-		await clearRunnerCaches(remoteEntryUrl);
-	}
+	if (previous && next && previous.versionKey !== next.versionKey) await invalidateRemoteCaches(remoteEntryUrl);
 	return record.promise;
 }
 /**
-* Drop per-remote caches after a version change so old artifacts stop being
-* reused. Temp-file cache keys hold SSR entry/chunk URLs (not the browser
-* entry URL), so scope the invalidation by origin.
+* Drop per-remote temp-file caches after a version change so old artifacts stop
+* being reused. Temp-file cache keys hold SSR entry/chunk URLs (not the
+* browser entry URL), so scope the invalidation by origin.
 */
-function dropRemoteCaches(remoteEntryUrl) {
-	let origin;
-	try {
-		origin = new URL(remoteEntryUrl).origin;
-	} catch {
-		return;
-	}
+function dropRemoteTempFileCaches(remoteEntryUrl) {
+	const origin = getUrlOrigin(remoteEntryUrl);
+	if (!origin) return;
+	const staleRecords = [...tempFileRecords.values()].filter((record) => record.remoteOrigin === origin);
 	for (const [key] of tempFileCache) if (JSON.parse(key).find((part) => typeof part === "string" && /^https?:\/\//.test(part))?.startsWith(origin)) {
 		tempFileCache.delete(key);
 		tempFilePathCache.delete(key);
 	}
+	scheduleTempFileCleanup(staleRecords);
+}
+/** Invalidate all SSR loader caches owned by a remote. */
+async function invalidateRemoteCaches(remoteEntryUrl) {
+	dropRemoteTempFileCaches(remoteEntryUrl);
+	scheduleVmCacheCleanup(remoteEntryUrl);
+	await clearRunnerCaches(remoteEntryUrl);
+}
+/**
+* The VM strategy owns separate in-memory module-graph caches. Keep their
+* invalidation aligned with the temp-file and ModuleRunner caches without a
+* static import cycle between the two SSR strategies.
+*/
+function scheduleVmCacheCleanup(remoteEntryUrl) {
+	if (!vmStrategyModulePromise) return;
+	vmStrategyModulePromise.then(({ clearVmStrategyCaches }) => clearVmStrategyCaches(remoteEntryUrl)).catch(() => {});
 }
 async function clearRunnerCaches(remoteEntryUrl) {
 	let remoteOrigin;
-	if (remoteEntryUrl) try {
-		remoteOrigin = new URL(remoteEntryUrl).origin;
-	} catch {
-		return;
+	if (remoteEntryUrl) {
+		remoteOrigin = getUrlOrigin(remoteEntryUrl);
+		if (!remoteOrigin) return;
 	}
 	await Promise.all([...runnerCache.values()].filter((cached) => !remoteOrigin || cached.remoteOrigin === remoteOrigin).map(async (cached) => {
 		try {
@@ -506,6 +524,15 @@ async function clearRunnerCaches(remoteEntryUrl) {
 		} catch {}
 	}));
 }
+/** Invalidate all SSR loader caches across every remote. */
+function invalidateAllRemoteCaches() {
+	const staleRecords = [...tempFileRecords.values()];
+	tempFileCache.clear();
+	tempFilePathCache.clear();
+	scheduleTempFileCleanup(staleRecords);
+	scheduleVmCacheCleanup();
+	clearRunnerCaches();
+}
 /**
 * Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
 * remote SSR entries. Pass a remote entry URL to scope the invalidation to one
@@ -522,15 +549,13 @@ function revalidate(remoteEntryUrl) {
 		for (const key of ssrEntryCache.keys()) if (key.endsWith(`::${remoteEntryUrl}`)) ssrEntryCache.delete(key);
 		const manifestUrl = getManifestUrl(remoteEntryUrl);
 		for (const key of manifestFetchCache.keys()) if (key.endsWith(`::${manifestUrl}`)) manifestFetchCache.delete(key);
-		dropRemoteCaches(remoteEntryUrl);
+		invalidateRemoteCaches(remoteEntryUrl);
 	} else {
 		unversionedGlobalGeneration += 1;
 		ssrEntryCache.clear();
 		manifestFetchCache.clear();
-		tempFileCache.clear();
-		tempFilePathCache.clear();
+		invalidateAllRemoteCaches();
 	}
-	clearRunnerCaches(remoteEntryUrl);
 	const federation = globalThis.__FEDERATION__;
 	for (const instance of federation?.__INSTANCES__ ?? []) try {
 		instance?.moduleCache?.clear?.();
@@ -538,6 +563,73 @@ function revalidate(remoteEntryUrl) {
 }
 const tempFileCache = /* @__PURE__ */ new Map();
 const tempFilePathCache = /* @__PURE__ */ new Map();
+const TEMP_FILE_CLEANUP_DELAY_MS = 3e4;
+const tempFileRecords = /* @__PURE__ */ new Map();
+const scheduledTempFileCleanup = /* @__PURE__ */ new Set();
+function scheduleTempFileCleanup(records) {
+	for (const record of records) {
+		if (scheduledTempFileCleanup.has(record.cacheKey)) continue;
+		scheduledTempFileCleanup.add(record.cacheKey);
+		const timer = setTimeout(() => {
+			cleanupTempFileRecord(record);
+		}, TEMP_FILE_CLEANUP_DELAY_MS);
+		if (typeof timer === "object" && timer && "unref" in timer) timer.unref?.();
+	}
+}
+async function cleanupTempFileRecord(record) {
+	try {
+		await record.promise.catch(() => void 0);
+		if (tempFileRecords.get(record.cacheKey) !== record) return;
+		const filePath = await record.filePathPromise;
+		const { rmSync } = await _fs();
+		rmSync(filePath, { force: true });
+	} catch {} finally {
+		if (tempFileRecords.get(record.cacheKey) === record) tempFileRecords.delete(record.cacheKey);
+		scheduledTempFileCleanup.delete(record.cacheKey);
+	}
+}
+const requireShimCache = /* @__PURE__ */ new Map();
+/**
+* `resolvedShared` rewrites import/export specifiers only. Bundled CommonJS in a
+* remote requires shared packages through `createRequire(import.meta.url)` —
+* Rolldown's `__require("react")` — and Node resolves those from the temp dir,
+* which can reach another copy than the pinned one. Remote modules importing
+* `node:module` get this shim instead: its `createRequire` resolves pinned
+* specifiers to the same files the rewritten imports load.
+*/
+function createRequireShimSource(sharedPkgMap) {
+	return [
+		"import * as nodeModule from 'node:module';",
+		"export * from 'node:module';",
+		"export default nodeModule.default;",
+		`const pinned = new Map(${JSON.stringify([...sharedPkgMap])});`,
+		"const pin = (id) => (typeof id === 'string' && pinned.get(id)) || id;",
+		"export function createRequire(filename) {",
+		"  const require = nodeModule.createRequire(filename);",
+		"  const resolve = (id, options) => require.resolve(pin(id), options);",
+		"  resolve.paths = require.resolve.paths;",
+		"  return Object.assign((id) => require(pin(id)), require, { resolve });",
+		"}",
+		""
+	].join("\n");
+}
+function getRequireShimUrl(tmpDir, sharedPkgMap, contextKey) {
+	const cacheKey = JSON.stringify([tmpDir, contextKey]);
+	const cached = requireShimCache.get(cacheKey);
+	if (cached) return cached;
+	const promise = (async () => {
+		const { join } = await _path();
+		const { writeFileSync } = await _fs();
+		const file = join(tmpDir, `node-module-${hashString(contextKey)}.mjs`);
+		writeFileSync(file, createRequireShimSource(sharedPkgMap), "utf8");
+		return `file://${file}`;
+	})();
+	requireShimCache.set(cacheKey, promise);
+	promise.catch(() => {
+		if (requireShimCache.get(cacheKey) === promise) requireShimCache.delete(cacheKey);
+	});
+	return promise;
+}
 function getSsrTransformContextKey(resolvedShared, shareScopeName) {
 	return JSON.stringify([shareScopeName, getSortedRecordEntries(resolvedShared)]);
 }
@@ -574,15 +666,57 @@ function neutralizeBrowserPreloadHelpers(code) {
 	code = code.replace(/\b([A-Za-z_$][\w$]*)\s*\(\s*\(\s*\)\s*=>\s*import\(([^)]*)\)\s*,\s*\[\]\s*\)/g, "import($2)");
 	return code;
 }
-function transformSsrCode(code, base, sharedPkgMap) {
-	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
-	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
-		const resolved = sharedPkgMap.get(specifier);
-		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
+const SSR_MODULE_SPECIFIER_RE = /(?:from|export\s*\*\s*from|import\s*\(?\s*)\s*(["'`])([^"'`\s]+)\1/g;
+function isRelativeSpecifier(specifier) {
+	return specifier.startsWith("./") || specifier.startsWith("../");
+}
+/**
+* Module specifiers used by the import/export syntax of `code`. Import-like
+* text inside comments and string literals (JSDoc such as
+* `@type {import('./x')}`, docs, error messages) is skipped, and a comment
+* between `import(` and the specifier (webpack-style magic comments) does not
+* hide a real dynamic import. Discovery and rewriting both read this list, so
+* they always agree on which specifiers exist.
+*/
+function findSsrModuleSpecifiers(code) {
+	let blanked = "";
+	let blankedUntil = 0;
+	const isCode = createCodePositionMap(code, (start, end) => {
+		blanked += code.slice(blankedUntil, start) + " ".repeat(end - start);
+		blankedUntil = end;
 	});
-	return neutralizeBrowserPreloadHelpers(code);
+	blanked += code.slice(blankedUntil);
+	const specifiers = [];
+	for (const match of blanked.matchAll(SSR_MODULE_SPECIFIER_RE)) {
+		if (!isCode[match.index]) continue;
+		const end = match.index + match[0].length;
+		const value = match[2];
+		specifiers.push({
+			start: end - value.length - 2,
+			end,
+			value
+		});
+	}
+	return specifiers;
+}
+function isNodeModuleSpecifier(specifier) {
+	return specifier === "node:module" || specifier === "module";
+}
+function transformSsrCode(code, base, specifiers, sharedPkgMap, requireShimUrl, tempFileUrlMap) {
+	const rewriter = new CodeRewriter(code);
+	for (const { start, end, value } of specifiers) {
+		if (requireShimUrl && isNodeModuleSpecifier(value)) {
+			rewriter.overwrite(start, end, `"${requireShimUrl}"`);
+			continue;
+		}
+		const resolvedShared = sharedPkgMap?.get(value);
+		const relativeUrl = isRelativeSpecifier(value) ? new URL(value, base).href : void 0;
+		const absoluteHttpUrl = value.startsWith("http://") || value.startsWith("https://") ? value : void 0;
+		const httpUrl = relativeUrl ?? absoluteHttpUrl;
+		const replacement = (httpUrl ? tempFileUrlMap?.get(httpUrl) : void 0) ?? relativeUrl ?? (resolvedShared && `file://${resolvedShared}`);
+		if (replacement) rewriter.overwrite(start, end, `"${replacement}"`);
+	}
+	return neutralizeBrowserPreloadHelpers(rewriter.toString());
 }
 function isVitePreloadHelperSpecifier(specifier) {
 	return specifier.includes("preload-helper");
@@ -591,21 +725,22 @@ function getTempFileImportUrl(filePath, versionKey) {
 	return `file://${filePath}?v=${encodeURIComponent(versionKey)}`;
 }
 /**
-* Fetch an HTTP ESM module, transform it, write it to a temp .js file and
+* Fetch an HTTP ESM module, transform it, write it to a temp file and
 * return the file path. Recursively does the same for HTTP transitive imports
-* so that `import('file:///...temp.js')` can resolve them.
+* so that `import('file:///...temp.mjs')` can resolve them.
 *
 * `versionKey` participates in both the cache key and the temp file name, so
 * a remote redeploy (new manifest → new key) produces new files and bypasses
 * Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
+async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, extension = ".mjs") {
 	const cacheKey = JSON.stringify([
 		fetchTimeoutMs,
 		fetchMaxBytes,
 		versionKey,
 		url,
-		contextKey
+		contextKey,
+		extension
 	]);
 	if (visited.has(url)) return visited.get(url);
 	const cached = tempFileCache.get(cacheKey);
@@ -619,7 +754,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	const tmpFilePromise = (async () => {
 		const { createHash } = await _crypto();
 		const { join } = await _path();
-		return join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}.js`);
+		return join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}${extension}`);
 	})();
 	tempFilePathCache.set(cacheKey, tmpFilePromise);
 	const promise = (async () => {
@@ -629,32 +764,38 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		let code = await readResponseTextBounded(res, fetchMaxBytes, url);
 		if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(code));
 		const base = url.replace(/\/[^/]*$/, "/");
-		const relImports = [];
-		const relRegex = /(?:from|export\s*\*\s*from|import\s*\(?\s*)\s*["'`]([^"'`\s]+)["'`]/g;
-		let m;
-		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
+		const specifiers = findSsrModuleSpecifiers(code);
+		const relImports = specifiers.map(({ value }) => value).filter((value) => isRelativeSpecifier(value) && !isVitePreloadHelperSpecifier(value)).map((value) => new URL(value, base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes, extension);
 			subMap.set(u, getTempFileImportUrl(tmpPath, versionKey));
 		}));
-		code = transformSsrCode(code, base, sharedPkgMap);
-		for (const [httpUrl, fileUrl] of subMap) code = code.split(httpUrl).join(fileUrl);
+		const requireShimUrl = sharedPkgMap?.size && specifiers.some(({ value }) => isNodeModuleSpecifier(value)) ? await getRequireShimUrl(tmpDir, sharedPkgMap, contextKey) : void 0;
+		code = transformSsrCode(code, base, specifiers, sharedPkgMap, requireShimUrl, subMap);
 		const { writeFileSync } = await _fs();
 		writeFileSync(tmpFile, code, "utf8");
 		return tmpFile;
 	})();
+	const record = {
+		cacheKey,
+		filePathPromise: tmpFilePromise,
+		promise,
+		remoteOrigin: getUrlOrigin(url)
+	};
+	tempFileRecords.set(cacheKey, record);
 	tempFileCache.set(cacheKey, promise);
 	pending.add(promise);
 	promise.catch(() => {
 		if (tempFileCache.get(cacheKey) === promise) tempFileCache.delete(cacheKey);
 		if (tempFilePathCache.get(cacheKey) === tmpFilePromise) tempFilePathCache.delete(cacheKey);
+		if (tempFileRecords.get(cacheKey) === record && !scheduledTempFileCleanup.has(cacheKey)) tempFileRecords.delete(cacheKey);
 	});
 	return promise;
 }
-async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
+async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, extension = ".mjs") {
 	const pending = /* @__PURE__ */ new Set();
-	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
+	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes, extension);
 	await Promise.all(pending);
 	return rootFile;
 }
@@ -665,12 +806,25 @@ async function importTempModule(filePath, versionKey) {
 );
 }
 let warnedVmUnavailable = false;
+let vmStrategyModulePromise;
+function getVmStrategyModule() {
+	if (!vmStrategyModulePromise) vmStrategyModulePromise = import("./ssrVmStrategy-B_e3yqa2.js");
+	return vmStrategyModulePromise;
+}
+/**
+* Non-HTTP failures keep falling back (to temp-file after vm, to the federation
+* runtime's own Node loader after temp-file), but whatever the fallback throws
+* then hides the real cause, so report it first.
+*/
+function warnStrategyFallback(strategy, url, fallback, error) {
+	mfWarn(`SSR entry loader: strategy "${strategy}" failed to load ${url}; falling back to ${fallback}.`, error);
+}
 async function tryVmStrategy(ssrEntry, options) {
-	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-CDbcwMnf.js");
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await getVmStrategyModule();
 	if (!await isVmStrategyAvailable()) {
 		if (!warnedVmUnavailable) {
 			warnedVmUnavailable = true;
-			console.warn("[mf-vite:ssr-entry-loader] strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
+			mfWarn("SSR entry loader: strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
 		}
 		return null;
 	}
@@ -715,15 +869,18 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 			if (fromVm) return fromVm;
 		} catch (error) {
 			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
+			warnStrategyFallback("vm", url, "the temp-file strategy", error);
 		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
+		const extension = type === "commonjs-module" || type === "commonjs" ? ".js" : ".mjs";
 		try {
-			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes), versionKey);
+			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes, extension), versionKey);
 		} catch (error) {
 			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
+			warnStrategyFallback("temp-file", url, "the federation runtime's loader", error);
 			return null;
 		}
 	}
@@ -764,4 +921,4 @@ function ssrEntryLoaderPlugin(options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_SSR_FETCH_MAX_BYTES as a, readResponseTextBounded as c, ssrEntryLoaderPlugin as i, neutralizeBrowserPreloadHelpers as n, DEFAULT_SSR_FETCH_TIMEOUT_MS as o, revalidate as r, fetchWithTimeout as s, SsrEntryHttpError as t };
+export { getUrlOrigin as a, fetchWithTimeout as c, ssrEntryLoaderPlugin as i, readResponseTextBounded as l, neutralizeBrowserPreloadHelpers as n, DEFAULT_SSR_FETCH_MAX_BYTES as o, revalidate as r, DEFAULT_SSR_FETCH_TIMEOUT_MS as s, SsrEntryHttpError as t };

package/lib/{ssrVmStrategy-CDbcwMnf.js → ssrVmStrategy-B_e3yqa2.js}

@@ -1,5 +1,5 @@
 import { t as findSharedKey } from "./sharedKeyMatcher-Od_nYxJA.js";
-import { c as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, s as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-BvAkpCyi.js";
+import { a as getUrlOrigin, c as fetchWithTimeout, l as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, t as SsrEntryHttpError } from "./ssrEntryLoader-DmqLXUmm.js";
 //#region src/utils/ssrVmStrategy.ts
 /**
 * vm.SourceTextModule strategy for loading remote SSR entries.
@@ -73,10 +73,38 @@ async function loadBareModule(specifier, options) {
 		/* @vite-ignore */
 		`file://${resolvedPath}`
 );
-	return import(
+	const namespace = await import(
 		/* @vite-ignore */
 		specifier
 );
+	return specifier === "module" || specifier === "node:module" ? withRemoteCreateRequire(namespace, options.resolvedShared) : namespace;
+}
+/**
+* Remote modules keep their http(s) URL as `import.meta.url`, which Node's
+* `createRequire` rejects. Rolldown's runtime for Node-targeted output calls
+* `createRequire(import.meta.url)` as soon as a bundled CommonJS module
+* requires an external, so hand remote modules a `createRequire` that resolves
+* those URLs from the app root — the base the temp-file strategy's temp files
+* resolve from. Its `require` also pins `resolvedShared` specifiers to the
+* same files the linker loads for the matching imports, so a bundled
+* `__require("react")` cannot reach a second copy of a shared package.
+*/
+async function withRemoteCreateRequire(nodeModule, resolvedShared) {
+	const { pathToFileURL } = await import(
+		/* @vite-ignore */
+		"url"
+);
+	const appRoot = pathToFileURL(`${process.cwd()}/`);
+	const pin = (id) => resolvedShared[id] ?? id;
+	return {
+		...nodeModule,
+		createRequire: (filename) => {
+			const require = nodeModule.createRequire(isHttpUrl(String(filename)) ? appRoot : filename);
+			const resolve = ((id, options) => require.resolve(pin(id), options));
+			resolve.paths = require.resolve.paths;
+			return Object.assign((id) => require(pin(id)), require, { resolve });
+		}
+	};
 }
 function createSyntheticModule(vm, specifier, namespace) {
 	const source = namespace && typeof namespace === "object" ? namespace : { default: namespace };
@@ -90,6 +118,8 @@ function createSyntheticModule(vm, specifier, namespace) {
 }
 const httpModuleCache = /* @__PURE__ */ new Map();
 const namespaceCache = /* @__PURE__ */ new Map();
+const httpModuleCacheOwners = /* @__PURE__ */ new Map();
+const namespaceCacheOwners = /* @__PURE__ */ new Map();
 const linkQueues = /* @__PURE__ */ new WeakMap();
 const contextIds = /* @__PURE__ */ new WeakMap();
 let nextContextId = 1;
@@ -108,6 +138,37 @@ function getVmCacheContextKey(options) {
 		Object.entries(options.resolvedShared).sort(([left], [right]) => left.localeCompare(right))
 	]);
 }
+function addVmCacheOwner(ownersByCacheKey, cacheKey, rootEntryUrl) {
+	if (!rootEntryUrl) return;
+	const owners = ownersByCacheKey.get(cacheKey) ?? /* @__PURE__ */ new Set();
+	owners.add(rootEntryUrl);
+	ownersByCacheKey.set(cacheKey, owners);
+}
+function clearOwnedVmCache(cache, ownersByCacheKey, remoteOrigin) {
+	for (const [cacheKey, owners] of ownersByCacheKey) {
+		if (!remoteOrigin) {
+			cache.delete(cacheKey);
+			ownersByCacheKey.delete(cacheKey);
+			continue;
+		}
+		for (const owner of owners) if (getUrlOrigin(owner) === remoteOrigin) owners.delete(owner);
+		if (owners.size === 0) {
+			cache.delete(cacheKey);
+			ownersByCacheKey.delete(cacheKey);
+		}
+	}
+}
+/**
+* Drop cached VM module graphs after a remote revalidation. A module graph can
+* contain URLs from another origin, so ownership is tracked by the root entry
+* rather than inferred from each module URL.
+*/
+function clearVmStrategyCaches(remoteEntryUrl) {
+	const remoteOrigin = remoteEntryUrl === void 0 ? void 0 : getUrlOrigin(remoteEntryUrl);
+	if (remoteEntryUrl !== void 0 && !remoteOrigin) return;
+	clearOwnedVmCache(httpModuleCache, httpModuleCacheOwners, remoteOrigin);
+	clearOwnedVmCache(namespaceCache, namespaceCacheOwners, remoteOrigin);
+}
 function getBodyPreview(body) {
 	return body.slice(0, 240).replace(/\s+/g, " ").trim();
 }
@@ -134,6 +195,7 @@ function getHttpModule(vm, url, options) {
 		options.versionKey,
 		url
 	]);
+	addVmCacheOwner(httpModuleCacheOwners, cacheKey, options.rootEntryUrl);
 	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
 		const code = await fetchModuleSource(url, options.fetchTimeoutMs, options.fetchMaxBytes);
 		return new vm.SourceTextModule(code, {
@@ -145,6 +207,7 @@ function getHttpModule(vm, url, options) {
 		});
 	})().catch((error) => {
 		httpModuleCache.delete(cacheKey);
+		httpModuleCacheOwners.delete(cacheKey);
 		throw error;
 	}));
 	return httpModuleCache.get(cacheKey);
@@ -180,18 +243,24 @@ async function importDynamically(vm, specifier, referencingModule, options) {
 async function loadViaVmStrategy(entryUrl, options) {
 	const vm = await getVmApi();
 	if (!vm) return null;
+	const graphOptions = {
+		...options,
+		rootEntryUrl: entryUrl
+	};
 	const cacheKey = `${getVmCacheContextKey(options)}::${options.versionKey}::${entryUrl}`;
+	addVmCacheOwner(namespaceCacheOwners, cacheKey, entryUrl);
 	if (!namespaceCache.has(cacheKey)) namespaceCache.set(cacheKey, (async () => {
-		const entryModule = await getHttpModule(vm, entryUrl, options);
-		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, options);
+		const entryModule = await getHttpModule(vm, entryUrl, graphOptions);
+		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, graphOptions);
 		await linkModuleGraph(entryModule, linker, options.cacheContext);
 		if (entryModule.status === "linked") await entryModule.evaluate();
 		return entryModule.namespace;
 	})().catch((error) => {
 		namespaceCache.delete(cacheKey);
+		namespaceCacheOwners.delete(cacheKey);
 		throw error;
 	}));
 	return namespaceCache.get(cacheKey);
 }
 //#endregion
-export { isVmStrategyAvailable, loadViaVmStrategy };
+export { clearVmStrategyCaches, findVmSharedKey, isVmStrategyAvailable, loadViaVmStrategy };

package/lib/utils/ssrEntryLoader.js

@@ -1,2 +1,2 @@
-import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-BvAkpCyi.js";
+import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-DmqLXUmm.js";
 export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.23.0",
+  "version": "1.23.1",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -77,9 +77,9 @@
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
   },
   "dependencies": {
-    "@module-federation/dts-plugin": "2.9.1",
-    "@module-federation/runtime": "2.9.1",
-    "@module-federation/sdk": "2.9.1"
+    "@module-federation/dts-plugin": "2.9.2",
+    "@module-federation/runtime": "2.9.2",
+    "@module-federation/sdk": "2.9.2"
   },
   "devDependencies": {
     "@playwright/test": "1.62.0",

package/lib/buildPaths-BoaQTkxt.js

@@ -1,66 +0,0 @@
-//#region src/utils/buildPaths.ts
-/**
-* Rebase an import path for a bootstrap file that moved from root into `dir`.
-*
-* When entryFileNames places entries in a subdirectory (e.g. `static/js/`),
-* the bootstrap file moves there too. Paths that resolved from the HTML root
-* must resolve from the new directory instead.
-*
-* Cases: `/static/js/hostInit.js` → `./hostInit.js` (strip dir prefix)
-*        `./src/main.tsx`          → `../../src/main.tsx` (climb back up for each dir level)
-*        `https://cdn.example.com` → unchanged         (absolute URL)
-*/
-function rebaseImport(importSrc, dir) {
-	if (!dir) return importSrc;
-	if (isAbsoluteUrl(importSrc)) return importSrc;
-	const normalizedDir = dir.replace(/^\/+|\/+$/g, "");
-	if (!normalizedDir) return importSrc;
-	const stripDirPrefix = (src, prefix) => {
-		if (src === prefix) return "";
-		if (src.startsWith(prefix + "/")) return src.slice(prefix.length);
-	};
-	const absoluteRemainder = stripDirPrefix(importSrc, "/" + normalizedDir);
-	if (absoluteRemainder !== void 0) {
-		const remainder = absoluteRemainder.replace(/^\/+/, "");
-		return remainder ? "./" + remainder : "./";
-	}
-	const relativeRemainder = stripDirPrefix(importSrc, normalizedDir);
-	if (relativeRemainder !== void 0) {
-		const remainder = relativeRemainder.replace(/^\/+/, "");
-		return remainder ? "./" + remainder : "./";
-	}
-	const upLevels = normalizedDir.split("/").filter(Boolean).length;
-	const prefix = upLevels > 0 ? "../".repeat(upLevels) : "./";
-	if (importSrc.startsWith("./")) return prefix + importSrc.slice(2);
-	if (importSrc.startsWith("/")) return prefix + importSrc.slice(1);
-	return prefix + importSrc;
-}
-function normalizePathForImport(path) {
-	return path.replace(/\\/g, "/");
-}
-const EXTERNAL_URL_RE = /^(?:[a-z]+:|\/\/)/i;
-function isAbsoluteUrl(src) {
-	if (/^[a-z]:[\\/]/i.test(src)) return false;
-	return EXTERNAL_URL_RE.test(src);
-}
-const HASH_PLACEHOLDER_RE = /(?:[._-]?\[hash(?::\d+)?\])/g;
-function hasFileExtension(fileName) {
-	return fileName.slice(Math.max(fileName.lastIndexOf("/"), fileName.lastIndexOf("\\")) + 1).lastIndexOf(".") > 0;
-}
-/**
-* Resolve a bundler `filename` template that still contains `[hash]` placeholders
-* into the concrete, stable file name Module Federation serves.
-*
-* The federation entries are emitted by us rather than hashed by the bundler, so
-* the placeholder is dropped instead of being substituted. When stripping it also
-* removes the extension (`mf-[hash:8]` → `mf`), `.js` is appended so the result
-* stays a loadable module. The extension check deliberately looks at the basename
-* only — a dotted directory (`assets/v1.2/entry`) must not be mistaken for one.
-*/
-function resolveHashPlaceholderFileName(fileName) {
-	if (!fileName.includes("[hash")) return fileName;
-	const normalized = fileName.replace(HASH_PLACEHOLDER_RE, "");
-	return hasFileExtension(normalized) ? normalized : `${normalized}.js`;
-}
-//#endregion
-export { resolveHashPlaceholderFileName as i, normalizePathForImport as n, rebaseImport as r, EXTERNAL_URL_RE as t };