npm - @softarc/native-federation-orchestrator - Versions diffs - 4.0.2 → 4.1.1 - Mend

@softarc/native-federation-orchestrator 4.0.2 → 4.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (25) hide show

package/README.md CHANGED Viewed

@@ -67,7 +67,7 @@ Get up and running in under 2 minutes:
     </script>
     <!-- Include the orchestrator runtime -->
-    <script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.0.2/quickstart.mjs"></script>
+    <script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.1.0/quickstart.mjs"></script>
   </head>
   <body>
     <!-- Use your loaded components -->
@@ -85,7 +85,7 @@ Your micro frontends are now loaded and ready to use. The runtime handles the wh
 ```html
 <!-- Development and quick testing -->
-<script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.0.2/quickstart.mjs"></script>
+<script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.1.0/quickstart.mjs"></script>
 ```
 ## Advanced Usage
@@ -120,12 +120,13 @@ const HeaderComponent = await loadRemoteModule('team/mfe2', './Header');
 ## Documentation
-| Guide                                                                                                         | Description                                |
-| ------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
-| [🚀 Getting Started](https://github.com/native-federation/orchestrator/blob/main/docs/getting-started.md)     | Detailed setup instructions and examples   |
-| [🏗️ Architecture](https://github.com/native-federation/orchestrator/blob/main/docs/architecture.md)           | Understanding the native federation domain |
-| [⚙️ Configuration](https://github.com/native-federation/orchestrator/blob/main/docs/config.md)                | Complete configuration reference           |
-| [🔄 Version Resolution](https://github.com/native-federation/orchestrator/blob/main/docs/version-resolver.md) | How dependency conflicts are resolved      |
+| Guide                                                                                                         | Description                                     |
+| ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
+| [🚀 Getting Started](https://github.com/native-federation/orchestrator/blob/main/docs/getting-started.md)     | Detailed setup instructions and examples        |
+| [🏗️ Architecture](https://github.com/native-federation/orchestrator/blob/main/docs/architecture.md)           | Understanding the native federation domain      |
+| [⚙️ Configuration](https://github.com/native-federation/orchestrator/blob/main/docs/config.md)                | Complete configuration reference                |
+| [🔄 Version Resolution](https://github.com/native-federation/orchestrator/blob/main/docs/version-resolver.md) | How dependency conflicts are resolved           |
+| [🔒 Security & Trusted Types](https://github.com/native-federation/orchestrator/blob/main/docs/security.md)   | CSP setup and the built-in Trusted Types policy |
 ## Example repositories

package/fesm2022/@softarc/native-federation-orchestrator.mjs CHANGED Viewed

@@ -1278,26 +1278,35 @@ function getScope(path) {
 // src/lib/2.app/flows/init/get-remote-entries.ts
 function createGetRemoteEntries(config, ports) {
-  return (remotesOrManifestUrl = {}) => ports.manifestProvider.provide(remotesOrManifestUrl).catch((e) => {
-    config.log.error(1, "Could not fetch manifest.", e);
-    return Promise.reject(new NFError("Failed to fetch manifest"));
-  }).then(addHostRemoteEntry).then(fetchRemoteEntries).then(removeSkippedRemotes).then(checkForSSE);
+  return (remotesOrManifestUrl = {}) => {
+    const manifestPromise = config.manifestIntegrity ? ports.manifestProvider.provide(remotesOrManifestUrl, {
+      integrity: config.manifestIntegrity
+    }) : ports.manifestProvider.provide(remotesOrManifestUrl);
+    return manifestPromise.catch((e) => {
+      config.log.error(1, "Could not fetch manifest.", e);
+      return Promise.reject(new NFError("Failed to fetch manifest"));
+    }).then(addHostRemoteEntry).then(fetchRemoteEntries).then(removeSkippedRemotes).then(checkForSSE);
+  };
   function addHostRemoteEntry(manifest) {
     if (!config.hostRemoteEntry) return manifest;
-    const { name, url, cacheTag } = config.hostRemoteEntry;
+    const { name, url, cacheTag, integrity } = config.hostRemoteEntry;
     const urlWithCache = cacheTag ? `${url}?cacheTag=${cacheTag}` : url;
     return {
       ...manifest,
-      [name]: urlWithCache
+      [name]: integrity ? { url: urlWithCache, integrity } : urlWithCache
     };
   }
+  function normalizeEntry(descriptor) {
+    return typeof descriptor === "string" ? { url: descriptor } : descriptor;
+  }
   async function fetchRemoteEntries(manifest) {
     const fetchPromises = Object.entries(manifest).map(
-      ([remoteName, remoteEntryUrl]) => fetchRemoteEntry(remoteName, remoteEntryUrl)
+      ([remoteName, descriptor]) => fetchRemoteEntry(remoteName, descriptor)
     );
     return Promise.all(fetchPromises);
   }
-  async function fetchRemoteEntry(remoteName, remoteEntryUrl) {
+  async function fetchRemoteEntry(remoteName, descriptor) {
+    const { url: remoteEntryUrl, integrity } = normalizeEntry(descriptor);
     let isOverride = false;
     let skip = false;
     ports.remoteInfoRepo.tryGet(remoteName).ifPresent((cachedRemoteInfo) => {
@@ -1311,7 +1320,7 @@ function createGetRemoteEntries(config, ports) {
     });
     if (skip) return false;
     try {
-      const remoteEntry = await ports.remoteEntryProvider.provide(remoteEntryUrl);
+      const remoteEntry = integrity ? await ports.remoteEntryProvider.provide(remoteEntryUrl, { integrity }) : await ports.remoteEntryProvider.provide(remoteEntryUrl);
       config.log.debug(
         1,
         `Fetched '${remoteEntry.name}' from '${remoteEntry.url}', exposing: ${JSON.stringify(remoteEntry.exposes)}`
@@ -1381,13 +1390,14 @@ function createProcessRemoteEntries(config, ports) {
     ports.scopedExternalsRepo.remove(remoteEntry.name);
     ports.sharedExternalsRepo.removeFromAllScopes(remoteEntry.name);
   }
-  function addRemoteInfoToStorage({ name, url, exposes }) {
+  function addRemoteInfoToStorage({ name, url, exposes, integrity }) {
     ports.remoteInfoRepo.addOrUpdate(name, {
       scopeUrl: getScope(url),
       exposes: Object.values(exposes ?? []).map((m) => ({
         moduleName: m.key,
         file: m.outFileName
-      }))
+      })),
+      ...integrity ? { integrity } : {}
     });
   }
   function addExternalsToStorage(remoteEntry) {
@@ -1552,7 +1562,7 @@ function createDetermineSharedExternals(config, ports) {
   }
 }
-// node_modules/.pnpm/@softarc+native-federation@4.0.0_typescript@5.9.3/node_modules/@softarc/native-federation/src/lib/domain/core/build-notification-options.contract.js
+// node_modules/.pnpm/@softarc+native-federation@4.1.0_typescript@5.9.3/node_modules/@softarc/native-federation/src/lib/domain/core/build-notification-options.contract.js
 var BuildNotificationType;
 (function(BuildNotificationType2) {
   BuildNotificationType2["COMPLETED"] = "federation-rebuild-complete";
@@ -1560,7 +1570,7 @@ var BuildNotificationType;
   BuildNotificationType2["CANCELLED"] = "federation-rebuild-cancelled";
 })(BuildNotificationType || (BuildNotificationType = {}));
-// node_modules/.pnpm/@softarc+native-federation@4.0.0_typescript@5.9.3/node_modules/@softarc/native-federation/src/lib/domain/core/chunk.js
+// node_modules/.pnpm/@softarc+native-federation@4.1.0_typescript@5.9.3/node_modules/@softarc/native-federation/src/lib/domain/core/chunk.js
 var CHUNK_PREFIX = "@nf-internal";
 function toChunkImport(fileName) {
   if (fileName.startsWith("./")) {
@@ -1594,6 +1604,9 @@ function createGenerateImportMap(config, ports) {
         return new NFError("Could not create ImportMap.");
       });
       addToScope(importMap, remote.scopeUrl, createScopeModules(externals, remote.scopeUrl));
+      for (const version of Object.values(externals)) {
+        addIntegrity(importMap, join(remote.scopeUrl, version.file), remoteName, version.file);
+      }
       Object.values(externals).filter((e) => !!e.bundle).forEach((e) => registerBundleChunks(chunkBundles, remoteName, e.bundle));
     }
     return importMap;
@@ -1621,9 +1634,11 @@ function createGenerateImportMap(config, ports) {
         if (version.action === "scope") {
           for (const remote of version.remotes) {
             const remoteScope = getScope2(shareScope, remote.name, externalName);
+            const url = join(remoteScope, remote.file);
             addToScope(importMap, remoteScope, {
-              [externalName]: join(remoteScope, remote.file)
+              [externalName]: url
             });
+            addIntegrity(importMap, url, remote.name, remote.file);
             registerBundleChunks(chunkBundles, remote.name, remote.bundle);
             remote.cached = true;
           }
@@ -1631,6 +1646,10 @@ function createGenerateImportMap(config, ports) {
         }
         const scope = getScope2(shareScope, version.remotes[0].name, externalName);
         let targetFileUrl = join(scope, version.remotes[0].file);
+        let targetFileSource = {
+          name: version.remotes[0].name,
+          file: version.remotes[0].file
+        };
         version.remotes[0].cached = true;
         if (version.action === "share") {
           registerBundleChunks(chunkBundles, version.remotes[0].name, version.remotes[0].bundle);
@@ -1643,6 +1662,10 @@ function createGenerateImportMap(config, ports) {
             if (!overrideScope)
               overrideScope = getScope2(shareScope, override.remotes[0].name, externalName);
             targetFileUrl = join(overrideScope, override.remotes[0].file);
+            targetFileSource = {
+              name: override.remotes[0].name,
+              file: override.remotes[0].file
+            };
             override.remotes[0].cached = true;
             version.remotes[0].cached = false;
           }
@@ -1651,6 +1674,7 @@ function createGenerateImportMap(config, ports) {
           const scope2 = getScope2(shareScope, r.name, externalName);
           addToScope(importMap, scope2, { [externalName]: targetFileUrl });
         });
+        addIntegrity(importMap, targetFileUrl, targetFileSource.name, targetFileSource.file);
       }
       ports.sharedExternalsRepo.addOrUpdate(externalName, external, shareScope);
     }
@@ -1691,9 +1715,11 @@ function createGenerateImportMap(config, ports) {
         if (version.action === "scope") {
           for (const remote of version.remotes) {
             const remoteScope = getScope2(GLOBAL_SCOPE, remote.name, externalName);
+            const url2 = join(remoteScope, remote.file);
             addToScope(importMap, remoteScope, {
-              [externalName]: join(remoteScope, remote.file)
+              [externalName]: url2
             });
+            addIntegrity(importMap, url2, remote.name, remote.file);
             remote.cached = true;
             registerBundleChunks(chunkBundles, remote.name, remote.bundle);
           }
@@ -1704,7 +1730,9 @@ function createGenerateImportMap(config, ports) {
           continue;
         }
         const scope = getScope2(GLOBAL_SCOPE, version.remotes[0].name, externalName);
-        addToGlobal(importMap, { [externalName]: join(scope, version.remotes[0].file) });
+        const url = join(scope, version.remotes[0].file);
+        addToGlobal(importMap, { [externalName]: url });
+        addIntegrity(importMap, url, version.remotes[0].name, version.remotes[0].file);
         registerBundleChunks(chunkBundles, version.remotes[0].name, version.remotes[0].bundle);
         version.remotes[0].cached = true;
       }
@@ -1739,6 +1767,7 @@ function createGenerateImportMap(config, ports) {
       const moduleName = join(remoteName, exposed.moduleName);
       const moduleUrl = join(remote.scopeUrl, exposed.file);
       importMap.imports[moduleName] = moduleUrl;
+      addIntegrity(importMap, moduleUrl, remoteName, exposed.file);
     }
   }
   function registerBundleChunks(chunkBundles, remoteName, bundleName) {
@@ -1753,7 +1782,9 @@ function createGenerateImportMap(config, ports) {
       const imports = Array.from(bundles).reduce((_imports, bundleName) => {
         ports.sharedChunksRepo.tryGet(remoteName, bundleName).ifPresent((files) => {
           files.forEach((file) => {
-            _imports[toChunkImport(file)] = join(baseUrl, file);
+            const url = join(baseUrl, file);
+            _imports[toChunkImport(file)] = url;
+            addIntegrity(importMap, url, remoteName, file);
           });
         });
         return _imports;
@@ -1762,6 +1793,12 @@ function createGenerateImportMap(config, ports) {
     });
     return importMap;
   }
+  function addIntegrity(importMap, url, remoteName, file) {
+    const hash = ports.remoteInfoRepo.tryGet(remoteName).get()?.integrity?.[file];
+    if (!hash) return;
+    if (!importMap.integrity) importMap.integrity = {};
+    importMap.integrity[url] = hash;
+  }
   function getScope2(ctx, remoteName, externalName) {
     return ports.remoteInfoRepo.tryGet(remoteName).map((remote) => remote.scopeUrl).orThrow(() => {
       if (externalName) {
@@ -1888,31 +1925,75 @@ var createVersionCheck = () => {
   };
 };
+// src/lib/utils/integrity.ts
+var SUPPORTED_ALGORITHMS = {
+  "sha256-": "SHA-256",
+  "sha384-": "SHA-384",
+  "sha512-": "SHA-512"
+};
+var parseIntegrity = (integrity) => {
+  for (const prefix of Object.keys(SUPPORTED_ALGORITHMS)) {
+    if (integrity.startsWith(prefix)) {
+      return { algorithm: SUPPORTED_ALGORITHMS[prefix], expected: integrity };
+    }
+  }
+  return null;
+};
+var toBase64 = (bytes) => {
+  const view = new Uint8Array(bytes);
+  let bin = "";
+  for (let i = 0; i < view.length; i++) bin += String.fromCharCode(view[i]);
+  return btoa(bin);
+};
+var verifyIntegrity = async (bytes, integrity) => {
+  const parsed = parseIntegrity(integrity);
+  if (!parsed) {
+    throw new TypeError(
+      `Unsupported integrity prefix in '${integrity}'. Expected sha256-, sha384-, or sha512-.`
+    );
+  }
+  const subtle = typeof crypto !== "undefined" && crypto.subtle ? crypto.subtle : void 0;
+  if (!subtle) {
+    throw new Error("SubtleCrypto is not available in this environment.");
+  }
+  const digest = await subtle.digest(parsed.algorithm, bytes);
+  const actual = integrity.substring(0, integrity.indexOf("-") + 1) + toBase64(digest);
+  if (actual !== parsed.expected) {
+    throw new Error(`Integrity mismatch: expected ${parsed.expected}, got ${actual}`);
+  }
+};
 // src/lib/3.adapters/http/manifest-provider.ts
 var createManifestProvider = () => {
-  const mapToJson = (response) => {
+  const ensureOk = (response) => {
     if (!response.ok)
       return Promise.reject(new NFError(`${response.status} - ${response.statusText}`));
-    return response.json();
+    return response;
   };
-  const formatError = (remoteEntryUrl) => (err) => {
+  const formatError = (manifestUrl) => (err) => {
     const msg = err instanceof Error ? err.message : String(err);
-    throw new NFError(`Fetch of '${remoteEntryUrl}' returned ${msg}`);
+    throw new NFError(`Fetch of '${manifestUrl}' returned ${msg}`);
   };
   return {
-    provide: async function(remotesOrManifestUrl) {
+    provide: async function(remotesOrManifestUrl, opts = {}) {
       if (typeof remotesOrManifestUrl !== "string") return Promise.resolve(remotesOrManifestUrl);
-      return fetch(remotesOrManifestUrl).then(mapToJson).catch(formatError(remotesOrManifestUrl));
+      const parse = async (response) => {
+        if (!opts.integrity) return response.json();
+        const bytes = await response.arrayBuffer();
+        await verifyIntegrity(bytes, opts.integrity);
+        return JSON.parse(new TextDecoder().decode(bytes));
+      };
+      return fetch(remotesOrManifestUrl).then(ensureOk).then(parse).catch(formatError(remotesOrManifestUrl));
     }
   };
 };
 // src/lib/3.adapters/http/remote-entry-provider.ts
 var createRemoteEntryProvider = () => {
-  const mapToJson = (response) => {
+  const ensureOk = (response) => {
     if (!response.ok)
       return Promise.reject(new Error(`${response.status} - ${response.statusText}`));
-    return response.json();
+    return response;
   };
   const fillEmptyFields = (remoteEntryUrl) => (remoteEntry) => {
     if (!remoteEntry.exposes) remoteEntry.exposes = [];
@@ -1925,8 +2006,14 @@ var createRemoteEntryProvider = () => {
     throw new NFError(`Fetch of '${remoteEntryUrl}' returned ${msg}`);
   };
   return {
-    provide: async function(remoteEntryUrl) {
-      return fetch(remoteEntryUrl).then(mapToJson).then(fillEmptyFields(remoteEntryUrl)).catch(formatError(remoteEntryUrl));
+    provide: async function(remoteEntryUrl, opts = {}) {
+      const parse = async (response) => {
+        if (!opts.integrity) return response.json();
+        const bytes = await response.arrayBuffer();
+        await verifyIntegrity(bytes, opts.integrity);
+        return JSON.parse(new TextDecoder().decode(bytes));
+      };
+      return fetch(remoteEntryUrl).then(ensureOk).then(parse).then(fillEmptyFields(remoteEntryUrl)).catch(formatError(remoteEntryUrl));
     }
   };
 };
@@ -2177,27 +2264,89 @@ var createDriving = (config) => {
   return { adapters, config };
 };
+// src/lib/4.config/import-map/trusted-types.ts
+var IMPORT_MAP_KEYS = /* @__PURE__ */ new Set(["imports", "scopes", "integrity"]);
+var validateImportMapJSON = (input) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(input);
+  } catch {
+    throw new TypeError("[nf-orchestrator] trusted-types: import map is not valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new TypeError("[nf-orchestrator] trusted-types: import map must be a plain object");
+  }
+  for (const key of Object.keys(parsed)) {
+    if (!IMPORT_MAP_KEYS.has(key)) {
+      throw new TypeError(`[nf-orchestrator] trusted-types: unexpected key "${key}" in import map`);
+    }
+  }
+  return input;
+};
+var validateScriptURL = (input) => {
+  const base = typeof location !== "undefined" ? location.href : "http://localhost/";
+  let url;
+  try {
+    url = new URL(input, base);
+  } catch {
+    throw new TypeError(`[nf-orchestrator] trusted-types: invalid script URL "${input}"`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new TypeError(
+      `[nf-orchestrator] trusted-types: disallowed protocol "${url.protocol}" for script URL`
+    );
+  }
+  return input;
+};
+var passThroughPolicy = {
+  createScript: (input) => input,
+  createScriptURL: (input) => input
+};
+var cachedPolicy = null;
+var getTrustedTypesPolicy = (name = "nfo") => {
+  if (name === false) return passThroughPolicy;
+  if (cachedPolicy) return cachedPolicy;
+  const factory = globalThis.trustedTypes;
+  if (!factory) {
+    cachedPolicy = passThroughPolicy;
+    return cachedPolicy;
+  }
+  const native = factory.createPolicy(name, {
+    createScript: validateImportMapJSON,
+    createScriptURL: validateScriptURL
+  });
+  cachedPolicy = {
+    createScript: (input) => native.createScript(input),
+    createScriptURL: (input) => native.createScriptURL(input)
+  };
+  return cachedPolicy;
+};
 // src/lib/4.config/import-map/replace-in-dom.ts
-var replaceInDOM = (mapType) => (importMap, opts = {}) => {
+var replaceInDOM = (mapType, trustedTypesPolicyName = "nfo") => (importMap, opts = {}) => {
   if (opts?.override) {
     document.head.querySelectorAll(`script[type="${mapType}"]`).forEach((importMap2) => importMap2.remove());
   }
+  const policy = getTrustedTypesPolicy(trustedTypesPolicyName);
   document.head.appendChild(
     Object.assign(document.createElement("script"), {
       type: mapType,
-      innerHTML: JSON.stringify(importMap)
+      text: policy.createScript(JSON.stringify(importMap))
     })
   );
   return Promise.resolve(importMap);
 };
 // src/lib/4.config/import-map/use-default.ts
-var useDefaultImportMap = () => ({
-  loadModuleFn: (url) => import(
-    /* @vite-ignore */
-    url
-  ),
-  setImportMapFn: replaceInDOM("importmap"),
+var useDefaultImportMap = (trustedTypesPolicyName = "nfo") => ({
+  loadModuleFn: (url) => {
+    const trusted = getTrustedTypesPolicy(trustedTypesPolicyName).createScriptURL(url);
+    return import(
+      /* @vite-ignore */
+      trusted
+    );
+  },
+  setImportMapFn: replaceInDOM("importmap", trustedTypesPolicyName),
   reloadBrowserFn: () => {
     window.location.reload();
   }
@@ -2205,7 +2354,7 @@ var useDefaultImportMap = () => ({
 // src/lib/4.config/import-map/import-map.config.ts
 var createImportMapConfig = (o) => {
-  const fallback = useDefaultImportMap();
+  const fallback = useDefaultImportMap(o.trustedTypesPolicyName);
   return {
     setImportMapFn: o.setImportMapFn ?? fallback.setImportMapFn,
     loadModuleFn: o.loadModuleFn ?? fallback.loadModuleFn,
@@ -2215,22 +2364,25 @@ var createImportMapConfig = (o) => {
 // src/lib/4.config/host/host.config.ts
 var createHostConfig = (override) => {
+  const extras = override?.manifestIntegrity ? { manifestIntegrity: override.manifestIntegrity } : {};
   if (!override?.hostRemoteEntry) {
-    return { hostRemoteEntry: false };
+    return { hostRemoteEntry: false, ...extras };
   }
   if (typeof override.hostRemoteEntry === "string") {
     return {
       hostRemoteEntry: {
         name: "__NF-HOST__",
         url: override.hostRemoteEntry
-      }
+      },
+      ...extras
     };
   }
   return {
     hostRemoteEntry: {
       name: "__NF-HOST__",
       ...override.hostRemoteEntry
-    }
+    },
+    ...extras
   };
 };
@@ -2355,15 +2507,13 @@ function createConvertToImportMap({ log }, ports) {
       return;
     }
     const remoteEntryScope = getScope(remoteEntry.url);
+    const integrityMap = remoteEntry.integrity;
     const chunkBundles = /* @__PURE__ */ new Set(["mapping-or-exposed"]);
     remoteEntry.shared.forEach((external) => {
       if (!external.singleton) {
-        addToScopes(
-          remoteEntryScope,
-          external.packageName,
-          join(remoteEntryScope, external.outFileName),
-          importMap
-        );
+        const url2 = join(remoteEntryScope, external.outFileName);
+        addToScopes(remoteEntryScope, external.packageName, url2, importMap);
+        addIntegrity(importMap, url2, integrityMap, external.outFileName);
         if (external?.bundle) chunkBundles.add(external?.bundle);
         return;
       }
@@ -2388,26 +2538,22 @@ function createConvertToImportMap({ log }, ports) {
       }
       if (external?.bundle) chunkBundles.add(external?.bundle);
       if (actions[external.packageName].action === "scope") {
-        addToScopes(
-          remoteEntryScope,
-          external.packageName,
-          join(remoteEntryScope, external.outFileName),
-          importMap
-        );
+        const url2 = join(remoteEntryScope, external.outFileName);
+        addToScopes(remoteEntryScope, external.packageName, url2, importMap);
+        addIntegrity(importMap, url2, integrityMap, external.outFileName);
         return;
       }
       if (external.shareScope) {
-        addToScopes(
-          remoteEntryScope,
-          external.packageName,
-          join(remoteEntryScope, external.outFileName),
-          importMap
-        );
+        const url2 = join(remoteEntryScope, external.outFileName);
+        addToScopes(remoteEntryScope, external.packageName, url2, importMap);
+        addIntegrity(importMap, url2, integrityMap, external.outFileName);
         return;
       }
-      importMap.imports[external.packageName] = join(remoteEntryScope, external.outFileName);
+      const url = join(remoteEntryScope, external.outFileName);
+      importMap.imports[external.packageName] = url;
+      addIntegrity(importMap, url, integrityMap, external.outFileName);
     });
-    addChunkImports(importMap, remoteEntry.name, remoteEntryScope, chunkBundles);
+    addChunkImports(importMap, remoteEntry, remoteEntryScope, chunkBundles);
   }
   function addToScopes(scope, packageName, url, importMap) {
     if (!importMap.scopes) importMap.scopes = {};
@@ -2421,34 +2567,44 @@ function createConvertToImportMap({ log }, ports) {
       const moduleName = join(remoteEntry.name, exposed.key);
       const moduleUrl = join(scope, exposed.outFileName);
       importMap.imports[moduleName] = moduleUrl;
+      addIntegrity(importMap, moduleUrl, remoteEntry.integrity, exposed.outFileName);
     });
   }
-  function addChunkImports(importMap, remoteName, remoteEntryScope, chunkBundles) {
+  function addChunkImports(importMap, remoteEntry, remoteEntryScope, chunkBundles) {
     Array.from(chunkBundles).forEach((bundleName) => {
-      ports.sharedChunksRepo.tryGet(remoteName, bundleName).ifPresent((files) => {
+      ports.sharedChunksRepo.tryGet(remoteEntry.name, bundleName).ifPresent((files) => {
         files.forEach((file) => {
-          addToScopes(
-            remoteEntryScope,
-            toChunkImport(file),
-            join(remoteEntryScope, file),
-            importMap
-          );
+          const url = join(remoteEntryScope, file);
+          addToScopes(remoteEntryScope, toChunkImport(file), url, importMap);
+          addIntegrity(importMap, url, remoteEntry.integrity, file);
         });
       });
     });
     return importMap;
   }
+  function addIntegrity(importMap, url, integrityMap, file) {
+    const hash = integrityMap?.[file];
+    if (!hash) return;
+    if (!importMap.integrity) importMap.integrity = {};
+    importMap.integrity[url] = hash;
+  }
 }
 // src/lib/2.app/flows/dynamic-init/get-remote-entry.ts
+var normalizeRemoteRef = (remote) => {
+  if (!remote) return {};
+  if (typeof remote === "string") return { name: remote };
+  return remote;
+};
 function createGetRemoteEntry(config, ports) {
-  return async (remoteEntryUrl, remoteName) => {
+  return async (remoteEntryUrl, remote) => {
+    const { name: remoteName, integrity } = normalizeRemoteRef(remote);
     if (!!remoteName && shouldSkipCachedRemote(remoteEntryUrl, remoteName)) {
       config.log.debug(7, `Found remote '${remoteName}' in storage, omitting fetch.`);
       return Optional.empty();
     }
     try {
-      const remoteEntry = await ports.remoteEntryProvider.provide(remoteEntryUrl);
+      const remoteEntry = integrity ? await ports.remoteEntryProvider.provide(remoteEntryUrl, { integrity }) : await ports.remoteEntryProvider.provide(remoteEntryUrl);
       config.log.debug(
         7,
         `[${remoteEntry.name}] Fetched from '${remoteEntry.url}', exposing: ${JSON.stringify(remoteEntry.exposes)}`
@@ -2657,7 +2813,7 @@ var createDynamicInitFlow = ({
   const processDynamicRemoteEntry = async (remoteEntry) => {
     return flow.updateCache(remoteEntry).then(flow.convertToImportMap).then(flow.commitChanges);
   };
-  const initRemoteEntry = (remoteEntryUrl, remoteName) => flow.getRemoteEntry(remoteEntryUrl, remoteName).then((entry) => entry.map(processDynamicRemoteEntry).orElse(Promise.resolve())).then(() => ({
+  const initRemoteEntry = (remoteEntryUrl, remote) => flow.getRemoteEntry(remoteEntryUrl, remote).then((entry) => entry.map(processDynamicRemoteEntry).orElse(Promise.resolve())).then(() => ({
     config,
     adapters,
     initRemoteEntry
@@ -2689,15 +2845,18 @@ var initFederation = (remotesOrManifestUrl, options = {}) => {
       }),
       load: loadRemoteModule
     };
-    const initRemoteEntry = async (remoteEntryUrl, remoteName) => dynamicInitFlow(remoteEntryUrl, remoteName).catch((e) => {
-      stateDump(`[dynamic-init][${remoteName ?? remoteEntryUrl}] STATE DUMP`);
-      if (config.strict.strictRemoteEntry) return Promise.reject(e);
-      else console.warn("Failed to initialize remote entry, continuing anyway.");
-      return Promise.resolve();
-    }).then(() => ({
-      ...output,
-      initRemoteEntry
-    }));
+    const initRemoteEntry = async (remoteEntryUrl, remote) => {
+      const remoteName = typeof remote === "string" ? remote : remote?.name;
+      return dynamicInitFlow(remoteEntryUrl, remote).catch((e) => {
+        stateDump(`[dynamic-init][${remoteName ?? remoteEntryUrl}] STATE DUMP`);
+        if (config.strict.strictRemoteEntry) return Promise.reject(e);
+        else console.warn("Failed to initialize remote entry, continuing anyway.");
+        return Promise.resolve();
+      }).then(() => ({
+        ...output,
+        initRemoteEntry
+      }));
+    };
     return {
       ...output,
       initRemoteEntry