every-plugin 2.10.0 → 3.0.0-rc.0

package/src/runtime/mf-config.ts

@@ -1,34 +1,20 @@
-import { existsSync, readFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
-import pkg from "../../package.json";
+import { readFileSync } from "node:fs";
+import { buildMfCoreSharedDependencies, type CoreSharedDepName } from "../shared-deps-spec";
 
-const require = createRequire(import.meta.url);
 declare const __EVERY_PLUGIN_VERSION__: string | undefined;
 
 function readPackageVersion(): string {
   try {
-    return (require("../../package.json") as { version: string }).version;
-  } catch {
-    return "0.0.0";
-  }
-}
-
-function getInstalledPackageVersion(packageName: string, fallbackRange: string): string {
-  try {
-    let currentDir = dirname(require.resolve(packageName));
-    for (let i = 0; i < 5; i += 1) {
-      const packageJsonPath = join(currentDir, "package.json");
-      if (existsSync(packageJsonPath)) {
-        return (JSON.parse(readFileSync(packageJsonPath, "utf-8")) as { version: string }).version;
+    // Not createRequire(import.meta.url): under tsx the require's resolution
+    // base can come up empty in spawned child processes ("Cannot find module
+    // from ''"), reading 0.0.0 and tripping the shared-identity check.
+    return (
+      JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf-8")) as {
+        version: string;
       }
-      currentDir = dirname(currentDir);
-    }
-
-    throw new Error(`Could not resolve installed version for ${packageName}`);
+    ).version;
   } catch {
-    const match = fallbackRange.match(/\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/);
-    return match ? match[0] : fallbackRange.replace(/^[\^~>=<\s]+/, "");
+    return "0.0.0";
   }
 }
 
@@ -42,87 +28,6 @@ export interface SharedConfig {
   eager: boolean;
 }
 
-export const SHARE_CONFIG: SharedConfig = {
-  singleton: true,
-  requiredVersion: false,
-  strictVersion: false,
-  eager: false,
-};
-
-export const MF_CORE_SHARED_DEPS = {
-  "every-plugin": {
-    version: PLUGIN_VERSION,
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-  effect: {
-    version: getInstalledPackageVersion("effect", pkg.peerDependencies.effect),
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-  zod: {
-    version: getInstalledPackageVersion("zod", pkg.peerDependencies.zod),
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-  "@orpc/contract": {
-    version: getInstalledPackageVersion("@orpc/contract", pkg.peerDependencies["@orpc/contract"]),
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-  "@orpc/client": {
-    version: getInstalledPackageVersion("@orpc/client", pkg.peerDependencies["@orpc/client"]),
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-  "@orpc/server": {
-    version: getInstalledPackageVersion("@orpc/server", pkg.peerDependencies["@orpc/server"]),
-    shareScope: "default",
-    shareConfig: SHARE_CONFIG,
-  },
-} as const;
-
-export type CoreSharedDepName = keyof typeof MF_CORE_SHARED_DEPS;
+export const MF_CORE_SHARED_DEPS = buildMfCoreSharedDependencies({ ownVersion: PLUGIN_VERSION });
 
-export interface AppSharedDepConfig {
-  version: string;
-  requiredVersion?: string | false;
-  singleton?: boolean;
-  strictVersion?: boolean;
-  eager?: boolean;
-  shareScope?: string;
-}
-
-export type AppSharedDeps = Record<string, AppSharedDepConfig>;
-
-export function buildMergedSharedDeps(
-  appShared?: AppSharedDeps,
-): Record<string, { version: string; shareScope: string; shareConfig: SharedConfig }> {
-  const merged: Record<string, { version: string; shareScope: string; shareConfig: SharedConfig }> =
-    {};
-
-  for (const [name, config] of Object.entries(MF_CORE_SHARED_DEPS)) {
-    merged[name] = {
-      version: config.version,
-      shareScope: config.shareScope,
-      shareConfig: config.shareConfig,
-    };
-  }
-
-  if (appShared) {
-    for (const [name, config] of Object.entries(appShared)) {
-      merged[name] = {
-        version: config.version,
-        shareScope: config.shareScope ?? "default",
-        shareConfig: {
-          singleton: config.singleton ?? false,
-          requiredVersion: config.requiredVersion ?? false,
-          strictVersion: config.strictVersion ?? false,
-          eager: config.eager ?? false,
-        },
-      };
-    }
-  }
-
-  return merged;
-}
+export type { CoreSharedDepName };

package/src/runtime/services/module-federation.service.ts

@@ -1,15 +1,32 @@
 import { createInstance, getInstance } from "@module-federation/enhanced/runtime";
 import { setGlobalFederationInstance } from "@module-federation/runtime-core";
-import { Effect } from "effect";
+import { Context, Effect, Layer } from "effect";
+import { DEV_ENTRY_FILENAME } from "../../build/artifact-names";
 import type { AnyPlugin } from "../../types";
 import { ModuleFederationError } from "../errors";
 import { type CoreSharedDepName, MF_CORE_SHARED_DEPS } from "../mf-config";
 import { getNormalizedRemoteName } from "./normalize";
+import {
+  compareSharedIdentity,
+  describeSharedIdentityMismatch,
+  fetchRemoteIdentityManifest,
+} from "./shared-identity";
+
+function expectedSharedIdentity(): Map<string, string> {
+  return new Map(
+    Object.entries(MF_CORE_SHARED_DEPS).map(([name, config]) => [name, config.version]),
+  );
+}
 
 type RemoteModule = (new () => AnyPlugin) | { default: new () => AnyPlugin };
 
+export const loadEveryPluginSharedModule = () => import("../../index");
+
 const coreModuleLoaders: Record<CoreSharedDepName, () => Promise<unknown>> = {
-  "every-plugin": () => import("every-plugin"),
+  // Keep the host-provided framework share on the same source graph as the
+  // runtime. A package self-import can resolve the published entry when a
+  // workspace script is launched through its package manager shim.
+  "every-plugin": loadEveryPluginSharedModule,
   effect: () => import("effect"),
   zod: () => import("zod"),
   "@orpc/contract": () => import("@orpc/contract"),
@@ -72,129 +89,216 @@ const createModuleFederationInstance = Effect.cached(
 
       return instance;
     } catch (error) {
-      throw new Error(`Failed to initialize Module Federation: ${error}`);
+      throw new Error(`Failed to initialize Module Federation: ${String(error)}`);
     }
   }),
 );
 
-export class ModuleFederationService extends Effect.Service<ModuleFederationService>()(
-  "ModuleFederationService",
-  {
-    effect: Effect.gen(function* () {
-      const mf = yield* Effect.flatten(createModuleFederationInstance);
-
-      return {
-        registerRemote: (pluginId: string, url: string) =>
-          Effect.gen(function* () {
-            yield* Effect.logDebug(`[MF] Registering ${pluginId}`);
-
-            const remoteName = getNormalizedRemoteName(pluginId);
-            const type = url.endsWith("/mf-manifest.json")
-              ? ("manifest" as const)
-              : url.endsWith("/remoteEntry.js")
-                ? ("script" as const)
-                : undefined;
-
-            yield* Effect.try({
-              try: () =>
-                mf.registerRemotes([
-                  {
-                    name: remoteName,
-                    entry: url,
-                    ...(type ? { type } : {}),
-                  },
-                ]),
-              catch: (error): ModuleFederationError =>
-                new ModuleFederationError({
-                  pluginId,
-                  remoteUrl: url,
-                  cause: error instanceof Error ? error : new Error(String(error)),
-                }),
-            });
-
-            yield* Effect.logInfo(`[MF] ✅ Registered ${pluginId}`);
-          }),
-
-        loadRemoteConstructor: (pluginId: string, url: string) =>
-          Effect.gen(function* () {
-            const remoteName = getNormalizedRemoteName(pluginId);
-            yield* Effect.logDebug(`[MF] Loading remote ${remoteName}`);
-            const modulePath = `${remoteName}/plugin`;
-
-            const pluginConstructor = yield* Effect.tryPromise({
-              try: async () => {
-                const container = await mf.loadRemote<RemoteModule>(modulePath);
-                if (!container) {
-                  throw new Error(`No container returned for ${modulePath}`);
-                }
+// A built container's runtime code looks up its own chunks through the node
+// runtime's entry-URL fallback keyed by the container's SELF name
+// (`mf-manifest.json` metaData.name — the composition key, e.g.
+// "everything-dev_registry-plugin"), while the host registers the remote
+// under the plugin id ("registry"). When those differ, the fallback misses,
+// resolveUrl returns null, and the node runtime hands back an empty chunk as
+// if it had loaded — the exposed module then requires ids nothing registered
+// ("__webpack_modules__[r] is not a function"). Registering and loading the
+// remote under the container's own name keeps that lookup a hit.
+const remoteSelfNames = new Map<string, string>();
 
-                // Support multiple export patterns: direct function, default export, named exports
-                let Constructor: any;
-
-                if (typeof container === "function") {
-                  // Direct function export
-                  Constructor = container;
-                } else if (container.default) {
-                  // Default export
-                  Constructor = container.default;
-                } else {
-                  // Named export fallback - prioritize exports with 'binding' property (plugin classes)
-                  Constructor = Object.values(container).find(
-                    (exp) => typeof exp === "function" && (exp as any).binding !== undefined,
-                  );
+const resolveRemoteSelfName = (pluginId: string, url: string) =>
+  Effect.gen(function* () {
+    const memoKey = `${pluginId}@${url}`;
+    const memo = remoteSelfNames.get(memoKey);
+    if (memo) return memo;
 
-                  // Fallback to any function export if no binding found
-                  if (!Constructor) {
-                    Constructor = Object.values(container).find(
-                      (exp) => typeof exp === "function" && exp.prototype?.constructor === exp,
-                    );
-                  }
-                }
+    let selfName: string | null = null;
+    try {
+      const manifest = yield* Effect.promise(() => fetchRemoteIdentityManifest(url));
+      selfName = manifest?.metaData?.name?.trim() || null;
+    } catch {
+      selfName = null;
+    }
 
-                if (!Constructor || typeof Constructor !== "function") {
-                  const containerInfo =
-                    typeof container === "object"
-                      ? `Available exports: ${Object.keys(container).join(", ")}`
-                      : `Container type: ${typeof container}`;
-
-                  throw new Error(
-                    `No valid plugin constructor found for '${pluginId}'.\n` +
-                      `Supported patterns:\n` +
-                      `  - export const YourPlugin = createPlugin({...})\n` +
-                      `  - export default createPlugin({...})\n` +
-                      `${containerInfo}`,
-                  );
-                }
+    const resolved = selfName ?? getNormalizedRemoteName(pluginId);
+    remoteSelfNames.set(memoKey, resolved);
+    return resolved;
+  });
+
+export interface ModuleFederationServiceShape {
+  registerRemote: (pluginId: string, url: string) => Effect.Effect<void, ModuleFederationError>;
+  loadRemoteConstructor: (
+    pluginId: string,
+    url: string,
+  ) => Effect.Effect<new () => AnyPlugin, ModuleFederationError>;
+}
+
+export class ModuleFederationService extends Context.Service<
+  ModuleFederationService,
+  ModuleFederationServiceShape
+>()("ModuleFederationService") {}
+
+export const ModuleFederationServiceDefault = Layer.effect(
+  ModuleFederationService,
+  Effect.gen(function* () {
+    const mf = yield* Effect.flatten(createModuleFederationInstance);
+    const expectedIdentity = expectedSharedIdentity();
+
+    const buildSharedIdentityError = async (
+      pluginId: string,
+      url: string,
+    ): Promise<ModuleFederationError | null> => {
+      let manifest: Awaited<ReturnType<typeof fetchRemoteIdentityManifest>> | null = null;
+      try {
+        manifest = await fetchRemoteIdentityManifest(url);
+      } catch (error) {
+        console.warn(
+          `[SharedIdentity] Could not fetch mf-manifest.json for plugin "${pluginId}" at ${url} (${error instanceof Error ? error.message : String(error)}); proceeding without identity verification`,
+        );
+        return null;
+      }
+      if (!manifest) return null;
+      const mismatches = compareSharedIdentity(manifest.shared, expectedIdentity);
+      if (mismatches.length === 0) return null;
+      const warnOnly = process.env.BOS_MF_IDENTITY === "warn";
+      if (warnOnly) {
+        console.warn(
+          `${describeSharedIdentityMismatch(pluginId, mismatches, "this runtime")} (BOS_MF_IDENTITY=warn: loading anyway)`,
+        );
+        return null;
+      }
+      return new ModuleFederationError({
+        pluginId,
+        remoteUrl: url,
+        cause: new Error(describeSharedIdentityMismatch(pluginId, mismatches, "this runtime")),
+      });
+    };
 
-                // Validate it looks like a plugin constructor (has binding property)
-                if (!(Constructor as any).binding) {
-                  const containerInfo =
-                    typeof container === "object"
-                      ? `Found exports: ${Object.keys(container).join(", ")}`
-                      : `Container type: ${typeof container}`;
-
-                  throw new Error(
-                    `Invalid plugin constructor for '${pluginId}'. ` +
-                      `The exported value must be created with createPlugin(). ` +
-                      `Found a function but it's missing the required 'binding' property.\n` +
-                      `${containerInfo}`,
+    return {
+      registerRemote: (pluginId: string, url: string) =>
+        Effect.gen(function* () {
+          const remoteName = yield* resolveRemoteSelfName(pluginId, url);
+          yield* Effect.logDebug(`[MF][${pluginId}] Registering as "${remoteName}"`);
+
+          const type = url.endsWith("/mf-manifest.json")
+            ? ("manifest" as const)
+            : url.endsWith(`/${DEV_ENTRY_FILENAME}`)
+              ? ("script" as const)
+              : undefined;
+
+          yield* Effect.try({
+            try: () =>
+              mf.registerRemotes([
+                {
+                  name: remoteName,
+                  entry: url,
+                  ...(type ? { type } : {}),
+                },
+              ]),
+            catch: (error): ModuleFederationError =>
+              new ModuleFederationError({
+                pluginId,
+                remoteUrl: url,
+                cause: error instanceof Error ? error : new Error(String(error)),
+              }),
+          });
+
+          yield* Effect.logInfo(`[MF][${pluginId}] ✅ Registered`);
+        }),
+
+      loadRemoteConstructor: (pluginId: string, url: string) =>
+        Effect.gen(function* () {
+          const remoteName = yield* resolveRemoteSelfName(pluginId, url);
+          yield* Effect.logDebug(`[MF][${pluginId}] Loading remote ${remoteName}`);
+
+          const identityError = yield* Effect.promise(() =>
+            buildSharedIdentityError(pluginId, url),
+          );
+          if (identityError) {
+            yield* Effect.logError(
+              `[MF][${pluginId}] ❌ shared identity mismatch: ${
+                identityError.cause instanceof Error
+                  ? identityError.cause.message
+                  : String(identityError.cause ?? "shared identity mismatch")
+              }`,
+            );
+            return yield* identityError;
+          }
+
+          const modulePath = `${remoteName}/plugin`;
+
+          const pluginConstructor = yield* Effect.tryPromise({
+            try: async () => {
+              const container = await mf.loadRemote<RemoteModule>(modulePath);
+              if (!container) {
+                throw new Error(`No container returned for ${modulePath}`);
+              }
+
+              // Support multiple export patterns: direct function, default export, named exports
+              let Constructor: any;
+
+              if (typeof container === "function") {
+                // Direct function export
+                Constructor = container;
+              } else if (container.default) {
+                // Default export
+                Constructor = container.default;
+              } else {
+                // Named export fallback - prioritize exports with 'binding' property (plugin classes)
+                Constructor = Object.values(container).find(
+                  (exp) => typeof exp === "function" && (exp as any).binding !== undefined,
+                );
+
+                // Fallback to any function export if no binding found
+                if (!Constructor) {
+                  Constructor = Object.values(container).find(
+                    (exp) => typeof exp === "function" && exp.prototype?.constructor === exp,
                   );
                 }
+              }
 
-                return Constructor;
-              },
-              catch: (error): ModuleFederationError =>
-                new ModuleFederationError({
-                  pluginId,
-                  remoteUrl: url,
-                  cause: error instanceof Error ? error : new Error(String(error)),
-                }),
-            });
-
-            yield* Effect.logInfo(`[MF] ✅ Loaded constructor for ${pluginId}`);
-            return pluginConstructor;
-          }),
-      };
-    }),
-  },
-) {}
+              if (!Constructor || typeof Constructor !== "function") {
+                const containerInfo =
+                  typeof container === "object"
+                    ? `Available exports: ${Object.keys(container).join(", ")}`
+                    : `Container type: ${typeof container}`;
+
+                throw new Error(
+                  `No valid plugin constructor found for '${pluginId}'.\n` +
+                    `Supported patterns:\n` +
+                    `  - export const YourPlugin = createPlugin({...})\n` +
+                    `  - export default createPlugin({...})\n` +
+                    `${containerInfo}`,
+                );
+              }
+
+              // Validate it looks like a plugin constructor (has binding property)
+              if (!(Constructor as any).binding) {
+                const containerInfo =
+                  typeof container === "object"
+                    ? `Found exports: ${Object.keys(container).join(", ")}`
+                    : `Container type: ${typeof container}`;
+
+                throw new Error(
+                  `Invalid plugin constructor for '${pluginId}'. ` +
+                    `The exported value must be created with createPlugin(). ` +
+                    `Found a function but it's missing the required 'binding' property.\n` +
+                    `${containerInfo}`,
+                );
+              }
+
+              return Constructor;
+            },
+            catch: (error): ModuleFederationError =>
+              new ModuleFederationError({
+                pluginId,
+                remoteUrl: url,
+                cause: error instanceof Error ? error : new Error(String(error)),
+              }),
+          });
+
+          yield* Effect.logInfo(`[MF][${pluginId}] ✅ Loaded constructor`);
+          return pluginConstructor;
+        }),
+    };
+  }),
+);

package/src/runtime/services/normalize.ts

@@ -1,18 +1 @@
-/**
- * Normalizes a package name into the module federation remote name.
- * This function must produce identical results in both runtime and build contexts.
- *
- * Normalization rules:
- * - Convert to lowercase
- * - Strip a single leading '@' symbol
- * - Replace '/' with '_'
- * - Preserve hyphens and other characters
- *
- * Examples:
- * - "@scope/my-plugin" → "scope_my-plugin"
- * - "@SCOPE/Foo/Bar" → "scope_foo_bar"
- * - "foo/bar" → "foo_bar"
- * - "simple-plugin" → "simple-plugin"
- */
-export const getNormalizedRemoteName = (name: string): string =>
-  name.toLowerCase().replace(/^@/, "").replace(/\//g, "_");
+export { remoteName as getNormalizedRemoteName } from "../../identity";