@softarc/native-federation 4.4.1 → 4.5.0

package/README.md

@@ -363,7 +363,7 @@ shared: share({
 })
 ```
 
-Finally, it's also possible to break out of the `ignoreUnusedDeps` feature for specific externals if desired, for example when sharing a whole suite of interconnected external dependencies like @angular/core. This can be handy when you want to avoid the chance of cross-version secondary entrypoints being used by the different micro frontends. E.g. mfe1 uses @angular/core v20.1.0 and mfe2 uses @angular/core/rxjs-interop v20.0.8, then you might want consistent use of v20.1.0 so rxjs-interop should be exported by mfe1. The `keepAll` prop allows you to enforce this:
+Finally, it's also possible to exempt the secondary entry points of a specific external from the `ignoreUnusedDeps` feature, for example when sharing a whole suite of interconnected external dependencies like @angular/core. This can be handy when you want to avoid the chance of cross-version secondary entrypoints being used by the different micro frontends. E.g. mfe1 uses @angular/core v20.1.0 and mfe2 uses @angular/core/rxjs-interop v20.0.8, then you might want consistent use of v20.1.0 so rxjs-interop should be exported by mfe1. The `keepAll` prop allows you to enforce this:
 
 ```typescript
 shared: share({
@@ -377,6 +377,10 @@ shared: share({
 })
 ```
 
+`keepAll` is read per **package family**, not per entry point: every entry point of @angular/core is published as long as _something_ still reaches @angular/core, but a package nothing imports at all is pruned anyway. That is what keeps the feature meaningful when `keepAll` is applied to every package at once — it exempts the secondaries from reachability, not the package itself. For a package with no secondary entry points the family is the package itself, so the flag changes nothing there. Use `ignoreUnusedDeps: false` to publish everything unconditionally.
+
+Note that mapped paths read the same flag differently: there, `keepAll` opts the mapping out of reachability entirely (see [Keeping mappings that nothing imports](#keeping-mappings-that-nothing-imports)).
+
 The API for configuring and using Native Federation is very similar to the one provided by our Module Federation plugin [@angular-architects/module-federation](https://www.npmjs.com/package/@angular-architects/module-federation). Hence, most of the articles on it are also valid for Native Federation.
 
 ### Sharing
@@ -487,7 +491,7 @@ module.exports = withNativeFederation({
 });
 ```
 
-- `keepAll` keeps the mapping even when nothing imports it. This is read exactly as it is for a shared package, so a bare `includeSecondaries: true` opts out too.
+- `keepAll` keeps the mapping even when nothing imports it, and on a mapping a bare `includeSecondaries: true` means the same thing — a mapping has no secondary entry points, so the flag can only mean "exempt from reachability". A shared package reads it differently: `true` is the default there and only means "share the secondaries", so `{ keepAll: true }` is the only spelling that affects pruning — and even then the package itself still has to be reached.
 - `resolveGlob` is additionally required for **wildcard** mappings. A wildcard is a pattern rather than an entry point, and normally only the reachability scan turns it into concrete files; `resolveGlob` expands it against the filesystem instead. Without it, a wildcard mapping is dropped with a warning.
 
 An expanded wildcard is named by the same rule the reachability scan uses, so `libs/ui/*` matching `libs/ui/button/index.ts` is shared as `@my-org/ui/button`.
@@ -496,7 +500,7 @@ Expansion only accepts **entry points**. A glob cannot tell a library's public s
 
 That restriction is not cosmetic: **only barrel imports can be shared as a mapped path.** A mapped path is advertised under its import specifier and marked external, so the specifier has to be one a browser import map can resolve, and a dot in the last segment does not resolve (see [vitejs/vite#21036](https://github.com/vitejs/vite/issues/21036)).
 
-So the rule is simply *would this end up in `remoteEntry.json`?* If it would, a non-barrel specifier fails the build:
+So the rule is simply _would this end up in `remoteEntry.json`?_ If it would, a non-barrel specifier fails the build:
 
 ```
 Invalid 'shared mappings' config. Only barrel imports can be shared as a sharedMapping:
@@ -693,7 +697,7 @@ For a zero-build integration, declare your remotes in a manifest and include the
 </script>
 
 <!-- Include the orchestrator -->
-<script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.5.1/quickstart.mjs"></script>
+<script src="https://unpkg.com/@softarc/native-federation-orchestrator@4.6.0/quickstart.mjs"></script>
 ```
 
 The `mfe-loader-available` event signals that the orchestrator has fetched the

package/dist/internal.d.ts

@@ -15,5 +15,6 @@ export { isCjsCandidate, classifyByExtension, hasEsmSyntax, type ModuleFormat, }
 export { isIdentifierName, planCjsWrap, buildSyntheticCjsEntry, isEsmInteropError, } from './lib/utils/package/cjs-named-exports.js';
 export type { NfFileWatcher, NfFileWatcherOptions, } from './lib/domain/utils/file-watcher.contract.js';
 export { syncNfFileWatcher, createNfWatcher, type WatchSources } from './lib/utils/file-watcher.js';
+export type { WatchPort, WatchHandle } from './lib/domain/utils/io-port.contract.js';
 export { linkedSharedDirs, sharedMappingDirs } from './lib/core/build/resolve-shared-dirs.js';
 export { isUnderDir, isUnderAnyDir } from './lib/utils/path-patterns.js';

package/dist/lib/config/configuration-context.d.ts

@@ -1,7 +1,8 @@
+import type { FileReaderPort } from '../domain/utils/io-port.contract.js';
 export interface ConfigurationContext {
     workspaceRoot?: string;
     packageJson?: string;
 }
-export declare function useWorkspace(workspaceRoot: string): void;
+export declare function useWorkspace(workspaceRoot: string, io?: FileReaderPort): void;
 export declare function usePackageJson(packageJson?: string): void;
 export declare function getConfigContext(): ConfigurationContext;

package/dist/lib/config/configuration-context.js

@@ -1,6 +1,8 @@
+import { nodeIo } from "../utils/io/node-io-adapter.js";
+import { toDiskCase } from "../utils/disk-case.js";
 let _context = {};
-function useWorkspace(workspaceRoot) {
-  _context = { ..._context, workspaceRoot };
+function useWorkspace(workspaceRoot, io = nodeIo) {
+  _context = { ..._context, workspaceRoot: toDiskCase(io, workspaceRoot) };
 }
 function usePackageJson(packageJson) {
   _context = { ..._context, packageJson };

package/dist/lib/config/get-used-dependencies.js

@@ -4,6 +4,7 @@ import { sharedPackageJsonRepository, tryGetPackageInfo } from "../utils/package
 import { getExternalImportsCore } from "./get-external-imports.js";
 import { nodeIo } from "../utils/io/node-io-adapter.js";
 import { isSharedMapping, matchMapping } from "./match-mapping.js";
+import { logger } from "../utils/logger.js";
 import * as path from "path";
 const defaultDeps = {
   io: nodeIo,
@@ -71,6 +72,8 @@ function addTransientDeps(packages, workspaceRoot, deps) {
 }
 function resolveUsedMappings(fileInfos, workspaceRoot, sharedMappings) {
   const usedMappings = {};
+  const matchesIgnoringCase = createCaseInsensitiveMatcher(sharedMappings);
+  const caseOnlyMisses = /* @__PURE__ */ new Set();
   for (const fileName of Object.keys(fileInfos)) {
     const fullFileName = path.join(workspaceRoot, fileName);
     if (isSharedMapping(fullFileName, sharedMappings)) continue;
@@ -80,10 +83,27 @@ function resolveUsedMappings(fileInfos, workspaceRoot, sharedMappings) {
       const fullImport = path.join(workspaceRoot, imp);
       const match = matchMapping(fullImport, sharedMappings);
       if (match) usedMappings[fullImport] = match;
+      else if (matchesIgnoringCase(fullImport)) caseOnlyMisses.add(fullImport);
     }
   }
+  warnOnCaseOnlyMisses(caseOnlyMisses);
   return usedMappings;
 }
+function createCaseInsensitiveMatcher(sharedMappings) {
+  const lowerCased = Object.fromEntries(
+    Object.entries(sharedMappings).map(([sharedPath, sharedImport]) => [
+      sharedPath.toLowerCase(),
+      sharedImport
+    ])
+  );
+  return (filePath) => matchMapping(filePath.toLowerCase(), lowerCased) !== null;
+}
+function warnOnCaseOnlyMisses(misses) {
+  if (misses.size === 0) return;
+  logger.warn(
+    `${misses.size} import(s) match a shared mapping only when case is ignored, so those libraries were pruned from remoteEntry.json -- e.g. '${[...misses][0]}'.`
+  );
+}
 export {
   getUsedDependenciesFactory,
   getUsedDependenciesFactoryCore

package/dist/lib/config/project-paths.d.ts

@@ -2,4 +2,4 @@ import type { FileReaderPort } from '../domain/utils/io-port.contract.js';
 export declare function findRootTsConfigJson(): string;
 export declare function findRootTsConfigJsonCore(io: FileReaderPort): string;
 export declare function findPackageJson(io: FileReaderPort, folder: string): string;
-export declare function inferProjectPath(projectPath: string | undefined): string;
+export declare function inferProjectPath(projectPath: string | undefined, io?: FileReaderPort): string;

package/dist/lib/config/project-paths.js

@@ -2,11 +2,12 @@ import * as path from "path";
 import { cwd } from "process";
 import { getConfigContext } from "./configuration-context.js";
 import { nodeIo } from "../utils/io/node-io-adapter.js";
+import { toDiskCase } from "../utils/disk-case.js";
 function findRootTsConfigJson() {
   return findRootTsConfigJsonCore(nodeIo);
 }
 function findRootTsConfigJsonCore(io) {
-  const packageJson = findPackageJson(io, cwd());
+  const packageJson = findPackageJson(io, toDiskCase(io, cwd()));
   const projectRoot = path.dirname(packageJson);
   const tsConfigBaseJson = path.join(projectRoot, "tsconfig.base.json");
   const tsConfigJson = path.join(projectRoot, "tsconfig.json");
@@ -29,7 +30,7 @@ function findPackageJson(io, folder) {
     "no package.json found. Searched the following folder and all parents: " + folder
   );
 }
-function inferProjectPath(projectPath) {
+function inferProjectPath(projectPath, io = nodeIo) {
   if (!projectPath && getConfigContext().packageJson) {
     projectPath = path.dirname(getConfigContext().packageJson || "");
   }
@@ -37,7 +38,7 @@ function inferProjectPath(projectPath) {
     projectPath = getConfigContext().workspaceRoot || "";
   }
   if (!projectPath) {
-    projectPath = cwd();
+    projectPath = toDiskCase(io, cwd());
   }
   return projectPath;
 }

package/dist/lib/config/remove-unused-deps.js

@@ -3,17 +3,26 @@ import {
   expandWildcardMapping,
   isWildcardMapping
 } from "./expand-mappings.js";
+import { inferPackageFromSecondary } from "../utils/normalize.js";
 import { logger } from "../utils/logger.js";
 function removeUnusedDeps(usedDependencies, config, ctx) {
-  const filteredDependencies = Object.entries(config.shared).filter(([shared, meta]) => !!meta.includeSecondaries || usedDependencies.external.has(shared)).reduce((acc, [shared, meta]) => ({ ...acc, [shared]: meta }), {});
+  const usedPackages = new Set([...usedDependencies.external].map(inferPackageFromSecondary));
+  const filteredDependencies = Object.entries(config.shared).filter(
+    ([shared, meta]) => meta.includeSecondaries ? usedPackages.has(inferPackageFromSecondary(shared)) : usedDependencies.external.has(shared)
+  ).reduce((acc, [shared, meta]) => ({ ...acc, [shared]: meta }), {});
+  const sharedMappings = withoutSkippedMappings(
+    { ...keptMappings(config, ctx), ...usedDependencies.internal },
+    config.skip
+  );
+  if (Object.keys(config.sharedMappings).length > 0 && Object.keys(sharedMappings).length === 0) {
+    logger.warn(
+      "No shared mapping is reachable from the entry points, so remoteEntry.json will ship without this workspace's libraries. Disable 'ignoreUnusedDeps' to publish them anyway."
+    );
+  }
   return {
     ...config,
     shared: filteredDependencies,
-    // Both halves can contain wildcard-expanded imports, which the skip list has not seen yet.
-    sharedMappings: withoutSkippedMappings(
-      { ...keptMappings(config, ctx), ...usedDependencies.internal },
-      config.skip
-    )
+    sharedMappings
   };
 }
 function keptMappings(config, ctx) {

package/dist/lib/config/share-utils.js

@@ -8,7 +8,7 @@ import {
 import { logger } from "../utils/logger.js";
 import { nodeIo } from "../utils/io/node-io-adapter.js";
 import { findPackageJson, inferProjectPath } from "./project-paths.js";
-import { isInferVersion, lookupVersion } from "./version-lookup.js";
+import { isInferVersion, lookupVersion, applyAutoRequiredOptions } from "./version-lookup.js";
 import { addSecondaries, getSecondaries } from "./secondaries.js";
 const fromPackageJson = (baseCfg, projectPath) => {
   const skipList = [...DEFAULT_SKIP_LIST];
@@ -59,8 +59,19 @@ function shareAllCore(io, config, opts = {}, repo = sharedPackageJsonRepository)
       if (!!opts.overrides && Object.keys(opts.overrides).some((o) => key.startsWith(o))) {
         continue;
       }
-      const inferVersion = !config.requiredVersion || config.requiredVersion === "auto";
-      const requiredVersion = inferVersion ? versions[key] : config.requiredVersion;
+      const requiredVersionCfg = config.requiredVersion ?? void 0;
+      const isAutoObject = typeof requiredVersionCfg === "object";
+      const inferVersion = !requiredVersionCfg || requiredVersionCfg === "auto" || isAutoObject;
+      let requiredVersion;
+      if (inferVersion) {
+        const base = versions[key];
+        requiredVersion = isAutoObject ? applyAutoRequiredOptions(base, {
+          range: requiredVersionCfg.range,
+          version: requiredVersionCfg.version ?? config.version
+        }) : base;
+      } else {
+        requiredVersion = requiredVersionCfg;
+      }
       if (!sharedExternals[key]) {
         sharedExternals[key] = { ...config, requiredVersion };
       }
@@ -100,11 +111,20 @@ function shareCore(io, configuredShareObjects, projectPath = "", skipList = DEFA
   const result = {};
   for (const key in shareObjects) {
     let includeSecondaries = false;
-    const shareObject = shareObjects[key];
-    if (shareObject.requiredVersion === "auto" || isInferVersion() && typeof shareObject.requiredVersion === "undefined" || (shareObject.requiredVersion?.length ?? 1) < 1) {
-      const version = lookupVersion(key, projectPath, repo);
-      shareObject.requiredVersion = version;
-      shareObject.version = version.replace(/^\D*/, "");
+    const { requiredVersion: requiredVersionCfg, ...rest } = shareObjects[key];
+    const shareObject = {
+      ...rest,
+      ...typeof requiredVersionCfg === "string" && {
+        requiredVersion: requiredVersionCfg
+      }
+    };
+    if (requiredVersionCfg === "auto" || isInferVersion() && typeof requiredVersionCfg === "undefined" || typeof requiredVersionCfg === "object" || (requiredVersionCfg?.length ?? 1) < 1) {
+      const isAutoObject = typeof requiredVersionCfg === "object";
+      const explicitVersion = isAutoObject ? requiredVersionCfg.version ?? shareObject.version : void 0;
+      const resolvedVersion = explicitVersion && explicitVersion !== "auto" ? explicitVersion : void 0;
+      const raw = resolvedVersion ?? lookupVersion(key, projectPath, repo);
+      shareObject.requiredVersion = isAutoObject && requiredVersionCfg.range ? applyAutoRequiredOptions(raw, { range: requiredVersionCfg.range }) : raw;
+      shareObject.version = raw.replace(/^\D*/, "");
     }
     if (typeof shareObject.includeSecondaries === "undefined") {
       shareObject.includeSecondaries = true;

package/dist/lib/config/version-lookup.d.ts

@@ -2,3 +2,7 @@ import type { PackageJsonRepository } from '../domain/utils/package-json.contrac
 export declare function setInferVersion(infer: boolean): void;
 export declare function isInferVersion(): boolean;
 export declare function lookupVersion(key: string, workspaceRoot: string, repo: PackageJsonRepository): string;
+export declare function applyAutoRequiredOptions(baseVersion: string, opts?: {
+    range?: 'exact' | '^' | '~' | 'minor' | 'patch';
+    version?: string;
+}): string;

package/dist/lib/config/version-lookup.js

@@ -30,7 +30,34 @@ function lookupVersionInMap(key, versions) {
   }
   return versions[key];
 }
+function applyAutoRequiredOptions(baseVersion, opts) {
+  const explicit = opts?.version && opts.version !== "auto" ? opts.version : void 0;
+  const raw = (explicit ?? baseVersion ?? "").trim();
+  if (!opts || !opts.range) return raw;
+  const requested = opts.range;
+  const singleTokenMatch = raw.match(
+    /^(?:[~^<>=]*\s*)?v?(\d+)(?:\.(\d+))?(?:\.(\d+))?((?:[-+][\w.]+)?)$/
+  );
+  if (!singleTokenMatch) {
+    return raw;
+  }
+  const [, major, minor = "0", patch = "0", extra] = singleTokenMatch;
+  const bareVersion = `${major}.${minor}.${patch}${extra}`;
+  switch (requested) {
+    case "exact":
+      return bareVersion;
+    case "^":
+    case "minor":
+      return `^${bareVersion}`;
+    case "~":
+    case "patch":
+      return `~${bareVersion}`;
+    default:
+      return raw;
+  }
+}
 export {
+  applyAutoRequiredOptions,
   isInferVersion,
   lookupVersion,
   setInferVersion

package/dist/lib/core/build/build-for-federation.js

@@ -6,9 +6,11 @@ import { logger } from "../../utils/logger.js";
 import { AbortedError } from "../../utils/errors.js";
 import { addExternalsToCache } from "../cache/federation-cache.js";
 import { planSharedBundles } from "./shared-bundle-plan.js";
+import { hintUnwatchedLinkedDeps } from "./resolve-shared-dirs.js";
 async function buildForFederation(config, fedOptions, externals, signal) {
   logger.info("Building federation artifacts");
   logger.notice("Skip packages you don't want to share in your federation config");
+  hintUnwatchedLinkedDeps(config, fedOptions);
   await executeSharedBundlePlans(planSharedBundles(config, externals), config, fedOptions, signal);
   const start = process.hrtime();
   const artifactInfo = await bundleExposedAndMappings(

package/dist/lib/core/build/resolve-shared-dirs.d.ts

@@ -6,8 +6,11 @@ import type { PackageJsonRepository } from '../../domain/utils/package-json.cont
  *  file-mapping agree on one identity for symlinked (npm-linked) deps. */
 export declare function resolveSharedPackageDirs(config: NormalizedFederationConfig, fedOptions: NormalizedFederationOptions, io?: FileReaderPort, repo?: PackageJsonRepository): Map<string, string>;
 /** Realpath'd dirs of symlinked shared packages — the bounded watch set.
- *  Deduped, since secondaries share a package dir. */
+ *  Deduped, since secondaries share a package dir. Empty unless `watchLinkedDeps` is on. */
 export declare function linkedSharedDirs(config: NormalizedFederationConfig, fedOptions: NormalizedFederationOptions, io?: FileReaderPort, repo?: PackageJsonRepository): string[];
+/** Names the npm-linked shared packages a watching build leaves unwatched -- see
+ *  AGENTS.md "What to watch". Advisory only, so a resolution failure must not fail the build. */
+export declare function hintUnwatchedLinkedDeps(config: NormalizedFederationConfig, fedOptions: NormalizedFederationOptions, io?: FileReaderPort, repo?: PackageJsonRepository): void;
 /**
  * Source directories of the workspace libs in `config.sharedMappings` — the watch set
  * for mappings, derived from config alone rather than from a bundler cache.
@@ -24,9 +27,12 @@ export declare function linkedSharedDirs(config: NormalizedFederationConfig, fed
  * they are source trees, not the dist output `linkedSharedDirs` exists for.
  */
 export declare function sharedMappingDirs(config: NormalizedFederationConfig): string[];
-/** Per-key content signal (max mtime of the resolved dir) for symlinked deps only.
+/** Per-key content signal (max mtime of the resolved dir) for linked checkouts only.
  *  Registry deps get no signal, keeping their checksum version-only. (Every key is
- *  still resolved: detecting the symlink requires the realpath + lstat.) */
+ *  still resolved: detecting the symlink requires the realpath + lstat.)
+ *
+ *  Deliberately not gated on `watchLinkedDeps`: that option decides whether an edit is
+ *  noticed live, never whether the next build is correct. */
 export declare function linkedContentSignals(keys: string[], folder: string, io?: FileReaderPort, repo?: PackageJsonRepository): Record<string, string>;
 /** `config.shared` keys whose package directory contains at least one modified file. */
 export declare function affectedSharedKeys(modifiedFiles: readonly string[], dirs: Map<string, string>, io?: FileReaderPort): Set<string>;

package/dist/lib/core/build/resolve-shared-dirs.js

@@ -1,7 +1,11 @@
 import * as path from "path";
 import { nodeIo } from "../../utils/io/node-io-adapter.js";
-import { sharedPackageJsonRepository } from "../../utils/package/package-info.js";
-import { isUnderDir, toPosix } from "../../utils/path-patterns.js";
+import { logger } from "../../utils/logger.js";
+import {
+  getPkgFolder,
+  sharedPackageJsonRepository
+} from "../../utils/io/package-json-repository.js";
+import { isOutsideNodeModules, isUnderDir, toPosix } from "../../utils/path-patterns.js";
 const folderOf = (fedOptions) => fedOptions.packageJson ? path.dirname(fedOptions.packageJson) : fedOptions.workspaceRoot;
 function resolveEntries(keys, folder, io, repo) {
   const out = [];
@@ -9,10 +13,12 @@ function resolveEntries(keys, folder, io, repo) {
     const pkgJsonPath = repo.findDepPackageJson(key, folder);
     if (!pkgJsonPath) continue;
     const pkgDir = path.dirname(pkgJsonPath);
+    const realDir = toPosix(io.realpath(pkgDir));
     out.push({
       key,
-      realDir: toPosix(io.realpath(pkgDir)),
-      isSymlink: !!io.stat(pkgDir)?.isSymbolicLink
+      realDir,
+      // pnpm's default linker symlinks every dep, so the link alone proves nothing.
+      isLinkedCheckout: !!io.stat(pkgDir)?.isSymbolicLink && isOutsideNodeModules(realDir)
     });
   }
   return out;
@@ -22,24 +28,50 @@ function resolveSharedPackageDirs(config, fedOptions, io = nodeIo, repo = shared
   return new Map(entries.map((e) => [e.key, e.realDir]));
 }
 function linkedSharedDirs(config, fedOptions, io = nodeIo, repo = sharedPackageJsonRepository) {
+  if (!fedOptions.watchLinkedDeps) return [];
   const entries = resolveEntries(Object.keys(config.shared), folderOf(fedOptions), io, repo);
-  return [...new Set(entries.filter((e) => e.isSymlink).map((e) => e.realDir))];
+  return [...new Set(entries.filter((e) => e.isLinkedCheckout).map((e) => e.realDir))];
+}
+function hintUnwatchedLinkedDeps(config, fedOptions, io = nodeIo, repo = sharedPackageJsonRepository) {
+  if (!fedOptions.watch || fedOptions.watchLinkedDeps) return;
+  try {
+    const names = /* @__PURE__ */ new Map();
+    for (const entry of resolveEntries(
+      Object.keys(config.shared),
+      folderOf(fedOptions),
+      io,
+      repo
+    )) {
+      if (entry.isLinkedCheckout && !names.has(entry.realDir)) {
+        names.set(entry.realDir, getPkgFolder(entry.key));
+      }
+    }
+    if (names.size === 0) return;
+    logger.notice(
+      `Detected npm-linked shared packages: ${[...names.values()].join(", ")}. Set 'watchLinkedDeps' to true to rebuild when they change.`
+    );
+  } catch {
+  }
 }
 function sharedMappingDirs(config) {
-  const dirs = Object.keys(config.sharedMappings).map((entryPoint) => toPosix(path.dirname(entryPoint))).filter((dir) => !dir.includes("node_modules"));
+  const dirs = Object.keys(config.sharedMappings).map((entryPoint) => toPosix(path.dirname(entryPoint))).filter(isOutsideNodeModules);
   return [...new Set(dirs)];
 }
 function maxMtime(io, dir) {
   let max = 0;
+  const bump = (s) => {
+    if (s && s.mtimeMs > max) max = s.mtimeMs;
+  };
   const walk = (d) => {
     for (const name of io.readDir(d)) {
       const full = path.join(d, name);
-      if (io.isDirectory(full)) walk(full);
-      else {
-        let s = io.stat(full);
-        if (s?.isSymbolicLink) s = io.stat(io.realpath(full));
-        if (s && s.mtimeMs > max) max = s.mtimeMs;
+      const entry = io.stat(full);
+      if (entry?.isSymbolicLink) {
+        if (!io.isDirectory(full)) bump(io.stat(io.realpath(full)));
+        continue;
       }
+      if (io.isDirectory(full)) walk(full);
+      else bump(entry);
     }
   };
   walk(dir);
@@ -47,8 +79,15 @@ function maxMtime(io, dir) {
 }
 function linkedContentSignals(keys, folder, io = nodeIo, repo = sharedPackageJsonRepository) {
   const signals = {};
+  const byDir = /* @__PURE__ */ new Map();
   for (const entry of resolveEntries(keys, folder, io, repo)) {
-    if (entry.isSymlink) signals[entry.key] = String(maxMtime(io, entry.realDir));
+    if (!entry.isLinkedCheckout) continue;
+    let signal = byDir.get(entry.realDir);
+    if (signal === void 0) {
+      signal = String(maxMtime(io, entry.realDir));
+      byDir.set(entry.realDir, signal);
+    }
+    signals[entry.key] = signal;
   }
   return signals;
 }
@@ -63,6 +102,7 @@ function affectedSharedKeys(modifiedFiles, dirs, io = nodeIo) {
 }
 export {
   affectedSharedKeys,
+  hintUnwatchedLinkedDeps,
   linkedContentSignals,
   linkedSharedDirs,
   resolveSharedPackageDirs,

package/dist/lib/core/normalize-options.js

@@ -9,6 +9,7 @@ import { getDefaultCachePath } from "./cache/cache-persistence.js";
 import { getUsedDependenciesFactory } from "../config/get-used-dependencies.js";
 import { logger } from "../utils/logger.js";
 import { normalizePackageName } from "../utils/normalize.js";
+import { toDiskCase } from "../utils/disk-case.js";
 const defaultConfigLoader = async (fullConfigPath) => (await import(pathToFileURL(fullConfigPath).href))?.default;
 async function normalizeFederationOptions(options, cache) {
   return normalizeFederationOptionsCore(
@@ -18,14 +19,16 @@ async function normalizeFederationOptions(options, cache) {
   );
 }
 async function normalizeFederationOptionsCore(deps, options, cache) {
-  const fullConfigPath = path.join(options.workspaceRoot, options.federationConfig);
+  const workspaceRoot = toDiskCase(deps.io, options.workspaceRoot);
+  const packageJson = options.packageJson && toDiskCase(deps.io, options.packageJson);
+  const fullConfigPath = path.join(workspaceRoot, options.federationConfig);
   if (!deps.io.exists(fullConfigPath)) {
     throw new Error("Expected " + fullConfigPath);
   }
   let config = await deps.loadConfig(fullConfigPath);
   const projectName = resolveProjectName(options.projectName ?? config.name);
   const suppliedCache = cache ?? createFederationCache(
-    getDefaultCachePath(options.workspaceRoot)
+    getDefaultCachePath(workspaceRoot)
   );
   const federationCache = {
     ...suppliedCache,
@@ -34,9 +37,12 @@ async function normalizeFederationOptionsCore(deps, options, cache) {
   };
   const normalizedOptions = {
     ...options,
+    workspaceRoot,
+    ...packageJson && { packageJson },
     entryPoints: options.entryPoints ?? Object.values(config.exposes ?? {}).map((e) => e.file),
     projectName,
     cacheExternalArtifacts: options.cacheExternalArtifacts ?? true,
+    watchLinkedDeps: options.watchLinkedDeps ?? false,
     federationCache
   };
   const nothingShared = Object.keys(config.shared).length === 0 && Object.keys(config.sharedMappings).length === 0;
@@ -44,21 +50,21 @@ async function normalizeFederationOptionsCore(deps, options, cache) {
     logger.debug("Nothing is shared, skipping the used dependency scan.");
   } else if (config.features.ignoreUnusedDeps) {
     const getUsedDeps = (deps.usedDependenciesFactory ?? getUsedDependenciesFactory)(
-      options.workspaceRoot,
+      workspaceRoot,
       options.entryPoints
     );
     config = removeUnusedDeps(getUsedDeps(config), config, {
       io: deps.io,
-      workspaceRoot: options.workspaceRoot
+      workspaceRoot
     });
     logger.info("Removed unused dependencies.");
     logger.debug(
-      'This can be disabled per dependency/external using the "includeSecondaries: {keepAll: true}" property. Or in general by disabling the "ignoreUnusedDeps" feature. '
+      'Keep everything with "ignoreUnusedDeps: false", or one mapping with "includeSecondaries: {keepAll: true}". On a shared package that flag only keeps the secondaries of a package something still imports.'
     );
   } else {
     config.sharedMappings = expandOrDropWildcards(config, {
       io: deps.io,
-      workspaceRoot: options.workspaceRoot
+      workspaceRoot
     });
   }
   assertBarrelMappings(config.sharedMappings);

package/dist/lib/domain/config/external-config.contract.d.ts

@@ -3,6 +3,16 @@ export type IncludeSecondariesOptions = {
     resolveGlob?: boolean;
     keepAll?: boolean;
 } | boolean;
+export interface AutoRequiredOptions {
+    version?: 'auto' | string;
+    /** Controls how the resolved package.json version is emitted.
+     * - 'exact' => "1.2.3"
+     * - '^' | '~' => '^1.2.3' or '~1.2.3'
+     * - 'minor' => maps to '^' (allow minor bumps)
+     * - 'patch' => maps to '~' (allow patch bumps)
+     */
+    range?: 'exact' | '^' | '~' | 'minor' | 'patch';
+}
 export interface ExternalConfig {
     singleton?: boolean;
     strictVersion?: boolean;
@@ -39,8 +49,10 @@ export interface NormalizedExternalConfig {
 }
 export type SharedExternalsConfig = Record<string, ExternalConfig>;
 export type NormalizedSharedExternalsConfig = Record<string, NormalizedExternalConfig>;
-export type ShareAllExternalsOptions = ExternalConfig;
-export type ShareExternalsOptions = SharedExternalsConfig;
+export type ShareAllExternalsOptions = Omit<ExternalConfig, 'requiredVersion'> & {
+    requiredVersion?: string | AutoRequiredOptions;
+};
+export type ShareExternalsOptions = Record<string, ShareAllExternalsOptions>;
 export type ResolvedExternalConfig = Omit<ExternalConfig, 'includeSecondaries'> & {
     includeSecondaries?: boolean;
 };

package/dist/lib/domain/config/federation-config.contract.d.ts

@@ -14,9 +14,9 @@ export type SharedMappingConfigs = Record<string, ExternalConfig>;
  * have nothing to select. `requiredVersion` and `version` stay optional because their
  * defaults are read from the mapped lib's package.json at build time.
  *
- * `includeSecondaries` collapses to a boolean exactly as it does for a shared external:
- * it means "exempt from `ignoreUnusedDeps` pruning". `resolveGlob` is lifted out of it
- * because a mapping has no secondary entry points for it to apply to.
+ * `includeSecondaries` collapses to a boolean meaning "exempt from `ignoreUnusedDeps`
+ * pruning" — stronger than on a shared external, where it only exempts the secondaries.
+ * `resolveGlob` is lifted out of it because a mapping has no secondaries to apply it to.
  */
 export interface NormalizedMappingConfig {
     singleton: boolean;

package/dist/lib/domain/core/federation-options.contract.d.ts

@@ -10,6 +10,11 @@ export interface FederationOptions {
     verbose?: boolean;
     dev?: boolean;
     watch?: boolean;
+    /** Poll-watch npm-linked shared deps so rebuilding the linked lib live-reloads the host.
+     *  Off by default: a registry dep is bundled once and cached by checksum, so watching
+     *  node_modules cannot change an outcome. With this off a linked lib still re-bundles on
+     *  the next build, it just does not live-reload. */
+    watchLinkedDeps?: boolean;
     packageJson?: string;
     entryPoints?: string[];
     buildNotifications?: BuildNotificationOptions;
@@ -19,4 +24,5 @@ export interface NormalizedFederationOptions<TBundlerCache = unknown> extends Fe
     entryPoints: string[];
     projectName: string;
     cacheExternalArtifacts: boolean;
+    watchLinkedDeps: boolean;
 }

package/dist/lib/domain/utils/file-watcher.contract.d.ts

@@ -1,4 +1,11 @@
+import type { WatchPort } from './io-port.contract.js';
 export interface NfFileWatcherOptions {
+    /** Watch implementation, defaulting to Node's fs. The built-in poll is dependency-free
+     *  but sweeps the tree every `pollIntervalMs`; a host that already ships a real watcher
+     *  should pass it here. An event-driven implementation may ignore `opts.poll`, but must
+     *  then survive inode replacement on its own: a polled dir supersedes the native watches
+     *  beneath it, so a missed rename-replace is never re-covered. */
+    watch?: WatchPort['watch'];
     onChange?: (path: string) => void;
     pollIntervalMs?: number;
     debounceMs?: number;

package/dist/lib/domain/utils/io-port.contract.d.ts

@@ -20,6 +20,8 @@ export interface FileReaderPort {
     /** Immediate child entry names (not full paths). Empty array on ENOENT, never throws. */
     readDir(path: string): string[];
     realpath(path: string): string;
+    /** The path as disk spells it, including case on case-insensitive filesystems. */
+    realpathNative(path: string): string;
     stat(path: string): StatInfo | null;
 }
 export interface FileWriterPort {

package/dist/lib/utils/disk-case.d.ts

@@ -0,0 +1,7 @@
+import type { FileReaderPort } from '../domain/utils/io-port.contract.js';
+/**
+ * Every absolute path that gets string-compared later descends from a root supplied by the
+ * invoking tool, and on Windows two tools can report one root with different drive-letter case.
+ * Correcting it at the root keeps the comparison sites unchanged.
+ */
+export declare function toDiskCase(io: FileReaderPort, p: string): string;

package/dist/lib/utils/disk-case.js

@@ -0,0 +1,14 @@
+import * as path from "path";
+import { toPosix } from "./path-patterns.js";
+function toDiskCase(io, p) {
+  const real = io.realpathNative(p);
+  if (real === p || !differsOnlyByCase(real, p)) return p;
+  return path.normalize(real);
+}
+function differsOnlyByCase(a, b) {
+  const strip = (s) => toPosix(s).replace(/\/+$/, "").toLowerCase();
+  return strip(a) === strip(b);
+}
+export {
+  toDiskCase
+};

package/dist/lib/utils/file-watcher.js

@@ -1,12 +1,13 @@
 import { dirname, join } from "path";
 import { nodeIo } from "./io/node-io-adapter.js";
 import { logger } from "./logger.js";
-import { isUnderDir, toPosix } from "./path-patterns.js";
+import { isOutsideNodeModules, isUnderDir, toPosix } from "./path-patterns.js";
 function createNfWatcher(options = {}) {
   return createNfWatcherCore(nodeIo, options);
 }
 function createNfWatcherCore(io, options = {}, now = Date.now) {
   const { onChange } = options;
+  const watch = options.watch ?? ((p, o, cb) => io.watch(p, o, cb));
   const pollIntervalMs = options.pollIntervalMs ?? 300;
   const debounceMs = options.debounceMs ?? 0;
   const dedupeReplays = options.dedupeReplays ?? true;
@@ -21,18 +22,18 @@ function createNfWatcherCore(io, options = {}, now = Date.now) {
     return posix.length > 1 ? posix.replace(/\/+$/, "") : posix;
   };
   const covers = (path, poll) => {
-    for (const [dir, watch] of watchers) {
-      if ((watch.poll || !poll) && isUnderDir(path, dir)) return true;
+    for (const [dir, watch2] of watchers) {
+      if ((watch2.poll || !poll) && isUnderDir(path, dir)) return true;
     }
     return false;
   };
   const supersede = (dir, poll) => {
     for (const map of [watchers, fileDirWatchers]) {
-      for (const [key, watch] of map) {
-        if (watch.poll && !poll) continue;
+      for (const [key, watch2] of map) {
+        if (watch2.poll && !poll) continue;
         if (map === watchers && key === dir) continue;
         if (!isUnderDir(key, dir)) continue;
-        watch.handle.close();
+        watch2.handle.close();
         map.delete(key);
       }
     }
@@ -92,7 +93,7 @@ function createNfWatcherCore(io, options = {}, now = Date.now) {
           if (watchers.has(dir2) || covers(dir2, shouldPoll)) continue;
           try {
             watchers.set(dir2, {
-              handle: io.watch(p, { recursive: true, poll }, (filename) => {
+              handle: watch(p, { recursive: true, poll }, (filename) => {
                 if (filename) notify(toPosix(join(p, filename)));
               }),
               poll: shouldPoll
@@ -116,7 +117,7 @@ function createNfWatcherCore(io, options = {}, now = Date.now) {
         if (fileDirWatchers.has(dir)) continue;
         try {
           fileDirWatchers.set(dir, {
-            handle: io.watch(dir, { recursive: false, poll }, (filename) => {
+            handle: watch(dir, { recursive: false, poll }, (filename) => {
               if (!filename) return;
               const changed = toPosix(join(dir, filename));
               if (trackedFiles.has(changed)) notify(changed);
@@ -150,7 +151,7 @@ function toPaths(sources) {
   return typeof cache.keys === "function" ? cache.keys() : sources;
 }
 function syncNfFileWatcher(watcher, sources, linkedDirs = []) {
-  const files = [...toPaths(sources)].filter((k) => !k.includes("node_modules"));
+  const files = [...toPaths(sources)].filter(isOutsideNodeModules);
   if (files.length) watcher.addPaths(files);
   if (linkedDirs.length) watcher.addPaths(linkedDirs, { poll: true });
 }

package/dist/lib/utils/io/node-io-adapter.js

@@ -40,6 +40,15 @@ const nodeIo = {
       return path2;
     }
   },
+  // Only the native variant reports the spelling stored on disk: the JS realpathSync walks the
+  // components of the input string and rewrites only the ones that are symlinks.
+  realpathNative(path2) {
+    try {
+      return fs.realpathSync.native(path2);
+    } catch {
+      return path2;
+    }
+  },
   stat(path2) {
     try {
       const s = fs.lstatSync(path2);
@@ -96,6 +105,7 @@ function pollWatch(root, recursive, intervalMs, onEvent) {
         return;
       }
       for (const entry of entries) {
+        if (entry.name === "node_modules") continue;
         const full = path.join(dir, entry.name);
         if (entry.isDirectory()) {
           if (recursive) walk(full);

package/dist/lib/utils/path-patterns.d.ts

@@ -26,3 +26,11 @@ export declare function substituteWildcard(template: string, captured: string):
  * `libs/ui-**` reads as `libs/ui-*` and silently matches nothing one level down.
  */
 export declare function toGlobPattern({ prefix, suffix }: WildcardPattern): string;
+/**
+ * A dev checkout rather than an installed package. A symlink alone cannot tell them apart:
+ * pnpm's default linker points every dep at `…/node_modules/.pnpm/<pkg>@<ver>/node_modules/
+ * <pkg>`, while `npm link` resolves to the checkout. Matched anywhere in the path, since a
+ * monorepo's store can sit above the workspace root, and by segment so a checkout under
+ * `node_modules_backup` still counts.
+ */
+export declare const isOutsideNodeModules: (dir: string) => boolean;

package/dist/lib/utils/path-patterns.js

@@ -28,8 +28,10 @@ function substituteWildcard(template, captured) {
 function toGlobPattern({ prefix, suffix }) {
   return prefix.slice(0, prefix.lastIndexOf("/") + 1) + "**/*" + suffix;
 }
+const isOutsideNodeModules = (dir) => !toPosix(dir).split("/").includes("node_modules");
 export {
   captureWildcard,
+  isOutsideNodeModules,
   isUnderAnyDir,
   isUnderDir,
   matchesWildcard,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softarc/native-federation",
-  "version": "4.4.1",
+  "version": "4.5.0",
   "type": "module",
   "license": "MIT",
   "packageManager": "pnpm@11.18.0",
@@ -26,7 +26,7 @@
     "eslint": "^10.4.1",
     "globals": "^17.3.0",
     "jiti": "^2.6.1",
-    "jsdom": "^29.0.0",
+    "jsdom": "^30.0.0",
     "knip": "^6.26.0",
     "prettier": "^3.9.4",
     "tslib": "^2.3.0",