@module-federation/vite 1.23.0 → 1.23.2

package/lib/{ssrEntryLoader-BvAkpCyi.js → ssrEntryLoader-DEH3eV1e.js}

@@ -1,4 +1,4 @@
-import { t as EXTERNAL_URL_RE } from "./buildPaths-BoaQTkxt.js";
+import { a as CodeRewriter, i as createCodePositionMap, r as mfWarn, s as EXTERNAL_URL_RE } from "./logger-DOwfTlw5.js";
 //#region src/utils/fetchWithTimeout.ts
 const DEFAULT_SSR_FETCH_TIMEOUT_MS = 1e4;
 const DEFAULT_SSR_FETCH_MAX_BYTES = 10 * 1024 * 1024;
@@ -98,6 +98,15 @@ async function readResponseTextBounded(res, maxBytes = DEFAULT_SSR_FETCH_MAX_BYT
 	return new TextDecoder().decode(merged);
 }
 //#endregion
+//#region src/utils/url.ts
+function getUrlOrigin(value) {
+	try {
+		return new URL(value).origin;
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region src/utils/ssrEntryLoader.ts
 /**
 * MF runtime plugin that intercepts the `loadEntry` lifecycle hook on the
@@ -470,35 +479,55 @@ async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs, fetchMaxByt
 	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs, fetchMaxBytes));
 	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const next = await record.promise.catch(() => null);
-	if (previous && next && previous.versionKey !== next.versionKey) {
-		dropRemoteCaches(remoteEntryUrl);
-		await clearRunnerCaches(remoteEntryUrl);
-	}
+	if (previous && next && previous.versionKey !== next.versionKey) await invalidateRemoteCaches(remoteEntryUrl);
 	return record.promise;
 }
 /**
-* Drop per-remote caches after a version change so old artifacts stop being
-* reused. Temp-file cache keys hold SSR entry/chunk URLs (not the browser
-* entry URL), so scope the invalidation by origin.
+* Drop a remote graph's temp-file caches after a version change so old
+* artifacts stop being reused. A generated module can be shared by multiple
+* remote graphs, so cleanup is scoped by graph owner rather than URL origin.
 */
-function dropRemoteCaches(remoteEntryUrl) {
-	let origin;
-	try {
-		origin = new URL(remoteEntryUrl).origin;
-	} catch {
-		return;
-	}
-	for (const [key] of tempFileCache) if (JSON.parse(key).find((part) => typeof part === "string" && /^https?:\/\//.test(part))?.startsWith(origin)) {
+function dropRemoteTempFileCaches(remoteEntryUrl) {
+	const staleRecords = [];
+	for (const [key, record] of tempFileRecords) {
+		if (!record.owners.delete(remoteEntryUrl) || record.owners.size > 0) continue;
 		tempFileCache.delete(key);
 		tempFilePathCache.delete(key);
+		staleRecords.push(record);
 	}
+	scheduleTempFileCleanup(staleRecords);
 }
+/**
+* Invalidate all SSR loader caches owned by a remote. The runtime loading map
+* is cleared synchronously so `revalidate()` can safely clear module caches
+* immediately after invoking this function.
+*/
+function invalidateRemoteCaches(remoteEntryUrl) {
+	invalidateRuntimeRemoteEntry(remoteEntryUrl);
+	dropRemoteTempFileCaches(remoteEntryUrl);
+	scheduleVmCacheCleanup(remoteEntryUrl);
+	return clearRunnerCaches(remoteEntryUrl);
+}
+/**
+* The VM strategy owns separate in-memory module-graph caches. Keep their
+* invalidation aligned with the temp-file and ModuleRunner caches without a
+* static import cycle between the two SSR strategies.
+*/
+function scheduleVmCacheCleanup(remoteEntryUrl) {
+	if (!vmStrategyModulePromise) return;
+	vmStrategyModulePromise.then(({ clearVmStrategyCaches }) => clearVmStrategyCaches(remoteEntryUrl)).catch(() => {});
+}
+/**
+* A dev-mode ModuleRunner is created per origin (one Vite dev server) and is
+* shared by every remote that server hosts, so its module cache can only be
+* cleared as a whole. Origin scoping is therefore the finest granularity here;
+* clearing only costs a re-evaluation, no generated files are removed.
+*/
 async function clearRunnerCaches(remoteEntryUrl) {
 	let remoteOrigin;
-	if (remoteEntryUrl) try {
-		remoteOrigin = new URL(remoteEntryUrl).origin;
-	} catch {
-		return;
+	if (remoteEntryUrl) {
+		remoteOrigin = getUrlOrigin(remoteEntryUrl);
+		if (!remoteOrigin) return;
 	}
 	await Promise.all([...runnerCache.values()].filter((cached) => !remoteOrigin || cached.remoteOrigin === remoteOrigin).map(async (cached) => {
 		try {
@@ -506,6 +535,28 @@ async function clearRunnerCaches(remoteEntryUrl) {
 		} catch {}
 	}));
 }
+/** Invalidate all SSR loader caches across every remote. */
+function invalidateAllRemoteCaches() {
+	invalidateRuntimeRemoteEntry();
+	const staleRecords = [...tempFileRecords.values()];
+	for (const record of staleRecords) record.owners.clear();
+	tempFileCache.clear();
+	tempFilePathCache.clear();
+	scheduleTempFileCleanup(staleRecords);
+	scheduleVmCacheCleanup();
+	clearRunnerCaches();
+}
+/**
+* runtime-core deduplicates remote entry loads in a process-global map. The
+* SSR loader's module cache invalidation must evict the matching runtime entry
+* too, otherwise the next loadRemote() returns the pre-revalidation container
+* without invoking this loader again.
+*/
+function invalidateRuntimeRemoteEntry(remoteEntryUrl) {
+	const globalLoading = globalThis.__GLOBAL_LOADING_REMOTE_ENTRY__;
+	if (!globalLoading) return;
+	for (const key of Object.keys(globalLoading)) if (remoteEntryUrl === void 0 || key === remoteEntryUrl || key.endsWith(`:${remoteEntryUrl}`)) delete globalLoading[key];
+}
 /**
 * Drop the loader's caches so the next `loadEntry` re-resolves and re-fetches
 * remote SSR entries. Pass a remote entry URL to scope the invalidation to one
@@ -522,15 +573,13 @@ function revalidate(remoteEntryUrl) {
 		for (const key of ssrEntryCache.keys()) if (key.endsWith(`::${remoteEntryUrl}`)) ssrEntryCache.delete(key);
 		const manifestUrl = getManifestUrl(remoteEntryUrl);
 		for (const key of manifestFetchCache.keys()) if (key.endsWith(`::${manifestUrl}`)) manifestFetchCache.delete(key);
-		dropRemoteCaches(remoteEntryUrl);
+		invalidateRemoteCaches(remoteEntryUrl);
 	} else {
 		unversionedGlobalGeneration += 1;
 		ssrEntryCache.clear();
 		manifestFetchCache.clear();
-		tempFileCache.clear();
-		tempFilePathCache.clear();
+		invalidateAllRemoteCaches();
 	}
-	clearRunnerCaches(remoteEntryUrl);
 	const federation = globalThis.__FEDERATION__;
 	for (const instance of federation?.__INSTANCES__ ?? []) try {
 		instance?.moduleCache?.clear?.();
@@ -538,6 +587,74 @@ function revalidate(remoteEntryUrl) {
 }
 const tempFileCache = /* @__PURE__ */ new Map();
 const tempFilePathCache = /* @__PURE__ */ new Map();
+const TEMP_FILE_CLEANUP_DELAY_MS = 3e4;
+const tempFileRecords = /* @__PURE__ */ new Map();
+const scheduledTempFileCleanup = /* @__PURE__ */ new Set();
+function scheduleTempFileCleanup(records) {
+	for (const record of records) {
+		if (scheduledTempFileCleanup.has(record.cacheKey)) continue;
+		scheduledTempFileCleanup.add(record.cacheKey);
+		const timer = setTimeout(() => {
+			cleanupTempFileRecord(record);
+		}, TEMP_FILE_CLEANUP_DELAY_MS);
+		if (typeof timer === "object" && timer && "unref" in timer) timer.unref?.();
+	}
+}
+async function cleanupTempFileRecord(record) {
+	try {
+		await record.promise.catch(() => void 0);
+		if (record.owners.size > 0) return;
+		if (tempFileRecords.get(record.cacheKey) !== record) return;
+		const filePath = await record.filePathPromise;
+		const { rmSync } = await _fs();
+		rmSync(filePath, { force: true });
+	} catch {} finally {
+		if (tempFileRecords.get(record.cacheKey) === record) tempFileRecords.delete(record.cacheKey);
+		scheduledTempFileCleanup.delete(record.cacheKey);
+	}
+}
+const requireShimCache = /* @__PURE__ */ new Map();
+/**
+* `resolvedShared` rewrites import/export specifiers only. Bundled CommonJS in a
+* remote requires shared packages through `createRequire(import.meta.url)` —
+* Rolldown's `__require("react")` — and Node resolves those from the temp dir,
+* which can reach another copy than the pinned one. Remote modules importing
+* `node:module` get this shim instead: its `createRequire` resolves pinned
+* specifiers to the same files the rewritten imports load.
+*/
+function createRequireShimSource(sharedPkgMap) {
+	return [
+		"import * as nodeModule from 'node:module';",
+		"export * from 'node:module';",
+		"export default nodeModule.default;",
+		`const pinned = new Map(${JSON.stringify([...sharedPkgMap])});`,
+		"const pin = (id) => (typeof id === 'string' && pinned.get(id)) || id;",
+		"export function createRequire(filename) {",
+		"  const require = nodeModule.createRequire(filename);",
+		"  const resolve = (id, options) => require.resolve(pin(id), options);",
+		"  resolve.paths = require.resolve.paths;",
+		"  return Object.assign((id) => require(pin(id)), require, { resolve });",
+		"}",
+		""
+	].join("\n");
+}
+function getRequireShimUrl(tmpDir, sharedPkgMap, contextKey) {
+	const cacheKey = JSON.stringify([tmpDir, contextKey]);
+	const cached = requireShimCache.get(cacheKey);
+	if (cached) return cached;
+	const promise = (async () => {
+		const { join } = await _path();
+		const { writeFileSync } = await _fs();
+		const file = join(tmpDir, `node-module-${hashString(contextKey)}.mjs`);
+		writeFileSync(file, createRequireShimSource(sharedPkgMap), "utf8");
+		return `file://${file}`;
+	})();
+	requireShimCache.set(cacheKey, promise);
+	promise.catch(() => {
+		if (requireShimCache.get(cacheKey) === promise) requireShimCache.delete(cacheKey);
+	});
+	return promise;
+}
 function getSsrTransformContextKey(resolvedShared, shareScopeName) {
 	return JSON.stringify([shareScopeName, getSortedRecordEntries(resolvedShared)]);
 }
@@ -574,15 +691,57 @@ function neutralizeBrowserPreloadHelpers(code) {
 	code = code.replace(/\b([A-Za-z_$][\w$]*)\s*\(\s*\(\s*\)\s*=>\s*import\(([^)]*)\)\s*,\s*\[\]\s*\)/g, "import($2)");
 	return code;
 }
-function transformSsrCode(code, base, sharedPkgMap) {
-	code = code.replace(/((?:from|export\s*\*\s*from)\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`]/g, (_m, prefix, _q, specifier) => `${prefix}"${new URL(specifier, base).href}"`);
-	code = code.replace(/(import\s*\(\s*)(["'`])(\.\.?\/[^"'`\s][^"'`]*)["'`](\s*\))/g, (_m, prefix, _q, specifier, suffix) => `${prefix}"${new URL(specifier, base).href}"${suffix}`);
-	if (sharedPkgMap && sharedPkgMap.size > 0) code = code.replace(/(?:from|import\s*\()\s*(["'`])([^"'`./][^"'`]*)["'`]/g, (m, _q, specifier) => {
-		const resolved = sharedPkgMap.get(specifier);
-		return resolved ? m.replace(specifier, `file://${resolved}`) : m;
+const SSR_MODULE_SPECIFIER_RE = /(?:from|export\s*\*\s*from|import\s*\(?\s*)\s*(["'`])([^"'`\s]+)\1/g;
+function isRelativeSpecifier(specifier) {
+	return specifier.startsWith("./") || specifier.startsWith("../");
+}
+/**
+* Module specifiers used by the import/export syntax of `code`. Import-like
+* text inside comments and string literals (JSDoc such as
+* `@type {import('./x')}`, docs, error messages) is skipped, and a comment
+* between `import(` and the specifier (webpack-style magic comments) does not
+* hide a real dynamic import. Discovery and rewriting both read this list, so
+* they always agree on which specifiers exist.
+*/
+function findSsrModuleSpecifiers(code) {
+	let blanked = "";
+	let blankedUntil = 0;
+	const isCode = createCodePositionMap(code, (start, end) => {
+		blanked += code.slice(blankedUntil, start) + " ".repeat(end - start);
+		blankedUntil = end;
 	});
-	return neutralizeBrowserPreloadHelpers(code);
+	blanked += code.slice(blankedUntil);
+	const specifiers = [];
+	for (const match of blanked.matchAll(SSR_MODULE_SPECIFIER_RE)) {
+		if (!isCode[match.index]) continue;
+		const end = match.index + match[0].length;
+		const value = match[2];
+		specifiers.push({
+			start: end - value.length - 2,
+			end,
+			value
+		});
+	}
+	return specifiers;
+}
+function isNodeModuleSpecifier(specifier) {
+	return specifier === "node:module" || specifier === "module";
+}
+function transformSsrCode(code, base, specifiers, sharedPkgMap, requireShimUrl, tempFileUrlMap) {
+	const rewriter = new CodeRewriter(code);
+	for (const { start, end, value } of specifiers) {
+		if (requireShimUrl && isNodeModuleSpecifier(value)) {
+			rewriter.overwrite(start, end, `"${requireShimUrl}"`);
+			continue;
+		}
+		const resolvedShared = sharedPkgMap?.get(value);
+		const relativeUrl = isRelativeSpecifier(value) ? new URL(value, base).href : void 0;
+		const absoluteHttpUrl = value.startsWith("http://") || value.startsWith("https://") ? value : void 0;
+		const httpUrl = relativeUrl ?? absoluteHttpUrl;
+		const replacement = (httpUrl ? tempFileUrlMap?.get(httpUrl) : void 0) ?? relativeUrl ?? (resolvedShared && `file://${resolvedShared}`);
+		if (replacement) rewriter.overwrite(start, end, `"${replacement}"`);
+	}
+	return neutralizeBrowserPreloadHelpers(rewriter.toString());
 }
 function isVitePreloadHelperSpecifier(specifier) {
 	return specifier.includes("preload-helper");
@@ -591,25 +750,27 @@ function getTempFileImportUrl(filePath, versionKey) {
 	return `file://${filePath}?v=${encodeURIComponent(versionKey)}`;
 }
 /**
-* Fetch an HTTP ESM module, transform it, write it to a temp .js file and
+* Fetch an HTTP ESM module, transform it, write it to a temp file and
 * return the file path. Recursively does the same for HTTP transitive imports
-* so that `import('file:///...temp.js')` can resolve them.
+* so that `import('file:///...temp.mjs')` can resolve them.
 *
 * `versionKey` participates in both the cache key and the temp file name, so
 * a remote redeploy (new manifest → new key) produces new files and bypasses
 * Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
+async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, extension = ".mjs", owner) {
 	const cacheKey = JSON.stringify([
 		fetchTimeoutMs,
 		fetchMaxBytes,
 		versionKey,
 		url,
-		contextKey
+		contextKey,
+		extension
 	]);
 	if (visited.has(url)) return visited.get(url);
 	const cached = tempFileCache.get(cacheKey);
 	if (cached) {
+		if (owner) tempFileRecords.get(cacheKey)?.owners.add(owner);
 		pending.add(cached);
 		const reserved = tempFilePathCache.get(cacheKey);
 		const tmpFile = reserved ? await reserved : await cached;
@@ -619,7 +780,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	const tmpFilePromise = (async () => {
 		const { createHash } = await _crypto();
 		const { join } = await _path();
-		return join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}.js`);
+		return join(tmpDir, `${createHash("sha1").update(cacheKey).digest("hex").slice(0, 12)}${extension}`);
 	})();
 	tempFilePathCache.set(cacheKey, tmpFilePromise);
 	const promise = (async () => {
@@ -629,32 +790,38 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		let code = await readResponseTextBounded(res, fetchMaxBytes, url);
 		if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(code));
 		const base = url.replace(/\/[^/]*$/, "/");
-		const relImports = [];
-		const relRegex = /(?:from|export\s*\*\s*from|import\s*\(?\s*)\s*["'`]([^"'`\s]+)["'`]/g;
-		let m;
-		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
+		const specifiers = findSsrModuleSpecifiers(code);
+		const relImports = specifiers.map(({ value }) => value).filter((value) => isRelativeSpecifier(value) && !isVitePreloadHelperSpecifier(value)).map((value) => new URL(value, base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes, extension, owner);
 			subMap.set(u, getTempFileImportUrl(tmpPath, versionKey));
 		}));
-		code = transformSsrCode(code, base, sharedPkgMap);
-		for (const [httpUrl, fileUrl] of subMap) code = code.split(httpUrl).join(fileUrl);
+		const requireShimUrl = sharedPkgMap?.size && specifiers.some(({ value }) => isNodeModuleSpecifier(value)) ? await getRequireShimUrl(tmpDir, sharedPkgMap, contextKey) : void 0;
+		code = transformSsrCode(code, base, specifiers, sharedPkgMap, requireShimUrl, subMap);
 		const { writeFileSync } = await _fs();
 		writeFileSync(tmpFile, code, "utf8");
 		return tmpFile;
 	})();
+	const record = {
+		cacheKey,
+		filePathPromise: tmpFilePromise,
+		promise,
+		owners: owner ? /* @__PURE__ */ new Set([owner]) : /* @__PURE__ */ new Set()
+	};
+	tempFileRecords.set(cacheKey, record);
 	tempFileCache.set(cacheKey, promise);
 	pending.add(promise);
 	promise.catch(() => {
 		if (tempFileCache.get(cacheKey) === promise) tempFileCache.delete(cacheKey);
 		if (tempFilePathCache.get(cacheKey) === tmpFilePromise) tempFilePathCache.delete(cacheKey);
+		if (tempFileRecords.get(cacheKey) === record && !scheduledTempFileCleanup.has(cacheKey)) tempFileRecords.delete(cacheKey);
 	});
 	return promise;
 }
-async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
+async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, extension = ".mjs", owner) {
 	const pending = /* @__PURE__ */ new Set();
-	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
+	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes, extension, owner);
 	await Promise.all(pending);
 	return rootFile;
 }
@@ -665,12 +832,25 @@ async function importTempModule(filePath, versionKey) {
 );
 }
 let warnedVmUnavailable = false;
-async function tryVmStrategy(ssrEntry, options) {
-	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-CDbcwMnf.js");
+let vmStrategyModulePromise;
+function getVmStrategyModule() {
+	if (!vmStrategyModulePromise) vmStrategyModulePromise = import("./ssrVmStrategy-COMHOCN2.js");
+	return vmStrategyModulePromise;
+}
+/**
+* Non-HTTP failures keep falling back (to temp-file after vm, to the federation
+* runtime's own Node loader after temp-file), but whatever the fallback throws
+* then hides the real cause, so report it first.
+*/
+function warnStrategyFallback(strategy, url, fallback, error) {
+	mfWarn(`SSR entry loader: strategy "${strategy}" failed to load ${url}; falling back to ${fallback}.`, error);
+}
+async function tryVmStrategy(ssrEntry, options, rootEntryUrl) {
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await getVmStrategyModule();
 	if (!await isVmStrategyAvailable()) {
 		if (!warnedVmUnavailable) {
 			warnedVmUnavailable = true;
-			console.warn("[mf-vite:ssr-entry-loader] strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
+			mfWarn("SSR entry loader: strategy \"vm\" requires vm.SourceTextModule (run Node with --experimental-vm-modules); falling back to the temp-file strategy.");
 		}
 		return null;
 	}
@@ -681,10 +861,11 @@ async function tryVmStrategy(ssrEntry, options) {
 		fetchTimeoutMs: options.fetchTimeoutMs,
 		fetchMaxBytes: options.fetchMaxBytes,
 		cacheContext: options.cacheContext,
-		federationInstance: options.federationInstance
+		federationInstance: options.federationInstance,
+		rootEntryUrl
 	});
 }
-async function loadSSRRemoteEntry(ssrEntry, options) {
+async function loadSSRRemoteEntry(ssrEntry, options, rootEntryUrl) {
 	const { url, type, versionKey } = ssrEntry;
 	const { resolvedShared } = options;
 	if (type === "commonjs-module" || type === "commonjs") {
@@ -711,19 +892,22 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 			}
 		}
 		if (options.strategy === "vm") try {
-			const fromVm = await tryVmStrategy(ssrEntry, options);
+			const fromVm = await tryVmStrategy(ssrEntry, options, rootEntryUrl);
 			if (fromVm) return fromVm;
 		} catch (error) {
 			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
+			warnStrategyFallback("vm", url, "the temp-file strategy", error);
 		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
+		const extension = type === "commonjs-module" || type === "commonjs" ? ".js" : ".mjs";
 		try {
-			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes), versionKey);
+			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes, extension, rootEntryUrl), versionKey);
 		} catch (error) {
 			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
+			warnStrategyFallback("temp-file", url, "the federation runtime's loader", error);
 			return null;
 		}
 	}
@@ -757,7 +941,7 @@ function ssrEntryLoaderPlugin(options = {}) {
 			} : resolved;
 			const ssrEntry = await getSSREntry(remoteInfo.entry, loadOptions.maxAgeMs, loadOptions.fetchTimeoutMs, loadOptions.fetchMaxBytes);
 			if (!ssrEntry) return;
-			const mod = await loadSSRRemoteEntry(ssrEntry, loadOptions);
+			const mod = await loadSSRRemoteEntry(ssrEntry, loadOptions, remoteInfo.entry);
 			if (!mod) return;
 			return mod;
 		}

package/lib/{ssrVmStrategy-CDbcwMnf.js → ssrVmStrategy-COMHOCN2.js}

@@ -1,5 +1,5 @@
 import { t as findSharedKey } from "./sharedKeyMatcher-Od_nYxJA.js";
-import { c as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, s as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-BvAkpCyi.js";
+import { c as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, s as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-DEH3eV1e.js";
 //#region src/utils/ssrVmStrategy.ts
 /**
 * vm.SourceTextModule strategy for loading remote SSR entries.
@@ -73,10 +73,38 @@ async function loadBareModule(specifier, options) {
 		/* @vite-ignore */
 		`file://${resolvedPath}`
 );
-	return import(
+	const namespace = await import(
 		/* @vite-ignore */
 		specifier
 );
+	return specifier === "module" || specifier === "node:module" ? withRemoteCreateRequire(namespace, options.resolvedShared) : namespace;
+}
+/**
+* Remote modules keep their http(s) URL as `import.meta.url`, which Node's
+* `createRequire` rejects. Rolldown's runtime for Node-targeted output calls
+* `createRequire(import.meta.url)` as soon as a bundled CommonJS module
+* requires an external, so hand remote modules a `createRequire` that resolves
+* those URLs from the app root — the base the temp-file strategy's temp files
+* resolve from. Its `require` also pins `resolvedShared` specifiers to the
+* same files the linker loads for the matching imports, so a bundled
+* `__require("react")` cannot reach a second copy of a shared package.
+*/
+async function withRemoteCreateRequire(nodeModule, resolvedShared) {
+	const { pathToFileURL } = await import(
+		/* @vite-ignore */
+		"url"
+);
+	const appRoot = pathToFileURL(`${process.cwd()}/`);
+	const pin = (id) => resolvedShared[id] ?? id;
+	return {
+		...nodeModule,
+		createRequire: (filename) => {
+			const require = nodeModule.createRequire(isHttpUrl(String(filename)) ? appRoot : filename);
+			const resolve = ((id, options) => require.resolve(pin(id), options));
+			resolve.paths = require.resolve.paths;
+			return Object.assign((id) => require(pin(id)), require, { resolve });
+		}
+	};
 }
 function createSyntheticModule(vm, specifier, namespace) {
 	const source = namespace && typeof namespace === "object" ? namespace : { default: namespace };
@@ -90,6 +118,8 @@ function createSyntheticModule(vm, specifier, namespace) {
 }
 const httpModuleCache = /* @__PURE__ */ new Map();
 const namespaceCache = /* @__PURE__ */ new Map();
+const httpModuleCacheOwners = /* @__PURE__ */ new Map();
+const namespaceCacheOwners = /* @__PURE__ */ new Map();
 const linkQueues = /* @__PURE__ */ new WeakMap();
 const contextIds = /* @__PURE__ */ new WeakMap();
 let nextContextId = 1;
@@ -108,6 +138,31 @@ function getVmCacheContextKey(options) {
 		Object.entries(options.resolvedShared).sort(([left], [right]) => left.localeCompare(right))
 	]);
 }
+function addVmCacheOwner(ownersByCacheKey, cacheKey, rootEntryUrl) {
+	if (!rootEntryUrl) return;
+	const owners = ownersByCacheKey.get(cacheKey) ?? /* @__PURE__ */ new Set();
+	owners.add(rootEntryUrl);
+	ownersByCacheKey.set(cacheKey, owners);
+}
+function clearOwnedVmCache(cache, ownersByCacheKey, remoteEntryUrl) {
+	for (const [cacheKey, owners] of ownersByCacheKey) {
+		if (remoteEntryUrl !== void 0 && !owners.delete(remoteEntryUrl)) continue;
+		if (remoteEntryUrl !== void 0 && owners.size > 0) continue;
+		cache.delete(cacheKey);
+		ownersByCacheKey.delete(cacheKey);
+	}
+}
+/**
+* Drop cached VM module graphs after a remote revalidation. A module graph can
+* contain URLs from another origin, and one origin can serve several remotes,
+* so ownership is tracked by the owning remote entry URL rather than inferred
+* from each module URL. A module shared by several graphs stays cached while
+* another remote still owns it.
+*/
+function clearVmStrategyCaches(remoteEntryUrl) {
+	clearOwnedVmCache(httpModuleCache, httpModuleCacheOwners, remoteEntryUrl);
+	clearOwnedVmCache(namespaceCache, namespaceCacheOwners, remoteEntryUrl);
+}
 function getBodyPreview(body) {
 	return body.slice(0, 240).replace(/\s+/g, " ").trim();
 }
@@ -134,6 +189,7 @@ function getHttpModule(vm, url, options) {
 		options.versionKey,
 		url
 	]);
+	addVmCacheOwner(httpModuleCacheOwners, cacheKey, options.rootEntryUrl);
 	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
 		const code = await fetchModuleSource(url, options.fetchTimeoutMs, options.fetchMaxBytes);
 		return new vm.SourceTextModule(code, {
@@ -145,6 +201,7 @@ function getHttpModule(vm, url, options) {
 		});
 	})().catch((error) => {
 		httpModuleCache.delete(cacheKey);
+		httpModuleCacheOwners.delete(cacheKey);
 		throw error;
 	}));
 	return httpModuleCache.get(cacheKey);
@@ -180,18 +237,25 @@ async function importDynamically(vm, specifier, referencingModule, options) {
 async function loadViaVmStrategy(entryUrl, options) {
 	const vm = await getVmApi();
 	if (!vm) return null;
+	const rootEntryUrl = options.rootEntryUrl ?? entryUrl;
+	const graphOptions = {
+		...options,
+		rootEntryUrl
+	};
 	const cacheKey = `${getVmCacheContextKey(options)}::${options.versionKey}::${entryUrl}`;
+	addVmCacheOwner(namespaceCacheOwners, cacheKey, rootEntryUrl);
 	if (!namespaceCache.has(cacheKey)) namespaceCache.set(cacheKey, (async () => {
-		const entryModule = await getHttpModule(vm, entryUrl, options);
-		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, options);
+		const entryModule = await getHttpModule(vm, entryUrl, graphOptions);
+		const linker = (specifier, referencingModule) => linkModule(vm, specifier, referencingModule, graphOptions);
 		await linkModuleGraph(entryModule, linker, options.cacheContext);
 		if (entryModule.status === "linked") await entryModule.evaluate();
 		return entryModule.namespace;
 	})().catch((error) => {
 		namespaceCache.delete(cacheKey);
+		namespaceCacheOwners.delete(cacheKey);
 		throw error;
 	}));
 	return namespaceCache.get(cacheKey);
 }
 //#endregion
-export { isVmStrategyAvailable, loadViaVmStrategy };
+export { clearVmStrategyCaches, findVmSharedKey, isVmStrategyAvailable, loadViaVmStrategy };

package/lib/utils/ssrEntryLoader.js

@@ -1,2 +1,2 @@
-import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-BvAkpCyi.js";
+import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-DEH3eV1e.js";
 export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.23.0",
+  "version": "1.23.2",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -77,9 +77,9 @@
     "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
   },
   "dependencies": {
-    "@module-federation/dts-plugin": "2.9.1",
-    "@module-federation/runtime": "2.9.1",
-    "@module-federation/sdk": "2.9.1"
+    "@module-federation/dts-plugin": "2.9.2",
+    "@module-federation/runtime": "2.9.2",
+    "@module-federation/sdk": "2.9.2"
   },
   "devDependencies": {
     "@playwright/test": "1.62.0",