everything-dev 1.43.0 → 1.44.1

package/dist/http-client.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.cjs","names":["Data","Duration","Effect","Schedule"],"sources":["../src/http-client.ts"],"sourcesContent":["import { Data, Duration, Effect, Schedule } from \"effect\";\n\n// --- Tagged errors ---\n\nexport class FetchNetworkError extends Data.TaggedError(\"FetchNetworkError\")<{\n  url: string;\n  cause: unknown;\n}> {}\n\nexport class FetchTimeoutError extends Data.TaggedError(\"FetchTimeoutError\")<{\n  url: string;\n}> {}\n\nexport class FetchHttpError extends Data.TaggedError(\"FetchHttpError\")<{\n  url: string;\n  status: number;\n  statusText: string;\n}> {}\n\nexport type FetchError = FetchNetworkError | FetchTimeoutError | FetchHttpError;\n\n// --- Options ---\n\nexport interface FetchOptions {\n  method?: string;\n  headers?: Record<string, string>;\n  body?: BodyInit;\n  redirect?: RequestRedirect;\n  timeout?: Duration.DurationInput;\n}\n\nexport interface FetchWithRetryOptions extends FetchOptions {\n  retries?: number;\n}\n\n// --- Defaults ---\n\nconst DEFAULT_TIMEOUT = \"10 seconds\";\nconst DEFAULT_RETRIES = 3;\n\nconst EXPONENTIAL_BASE = Duration.seconds(1);\nconst EXPONENTIAL_CAP = Duration.seconds(15);\n\n// --- Helpers ---\n\nconst isRetryable = (error: FetchError): boolean => {\n  if (error instanceof FetchNetworkError) return true;\n  if (error instanceof FetchTimeoutError) return true;\n  if (error instanceof FetchHttpError) return error.status >= 500;\n  return false;\n};\n\n// --- Low-level: just timeout + error classification, returns Response regardless of HTTP status ---\n\nconst fetchRawEff = (\n  url: string,\n  options?: FetchOptions,\n): Effect.Effect<Response, FetchNetworkError | FetchTimeoutError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const timeoutMs = Duration.toMillis(Duration.decode(options?.timeout ?? DEFAULT_TIMEOUT));\n      const controller = new AbortController();\n      const timer = setTimeout(() => controller.abort(), timeoutMs);\n      try {\n        return await fetch(url, {\n          method: options?.method ?? \"GET\",\n          headers: options?.headers,\n          body: options?.body,\n          redirect: options?.redirect,\n          signal: controller.signal,\n        });\n      } catch (error) {\n        if (error instanceof Error && error.name === \"AbortError\") {\n          throw new FetchTimeoutError({ url });\n        }\n        throw new FetchNetworkError({ url, cause: error });\n      } finally {\n        clearTimeout(timer);\n      }\n    },\n    catch: (error) => {\n      if (error instanceof FetchNetworkError || error instanceof FetchTimeoutError) {\n        return error;\n      }\n      return new FetchNetworkError({ url, cause: error });\n    },\n  });\n\n// --- Adds HTTP status checking: non-2xx becomes FetchHttpError ---\n\nconst fetchEff = (url: string, options?: FetchOptions): Effect.Effect<Response, FetchError> =>\n  fetchRawEff(url, options).pipe(\n    Effect.flatMap((response) => {\n      if (response.ok) return Effect.succeed(response);\n      return Effect.fail(\n        new FetchHttpError({ url, status: response.status, statusText: response.statusText }),\n      );\n    }),\n  );\n\n// --- With retry ---\n\nconst retrySchedule = Schedule.exponential(EXPONENTIAL_BASE).pipe(\n  Schedule.upTo(EXPONENTIAL_CAP),\n  Schedule.intersect(Schedule.recurs(DEFAULT_RETRIES)),\n);\n\nexport const fetchWithRetryEff = (\n  url: string,\n  options?: FetchWithRetryOptions,\n): Effect.Effect<Response, FetchError> => {\n  const retries = options?.retries ?? DEFAULT_RETRIES;\n\n  if (retries <= 0) return fetchEff(url, options);\n\n  const schedule =\n    options?.retries !== undefined\n      ? Schedule.exponential(EXPONENTIAL_BASE).pipe(\n          Schedule.upTo(EXPONENTIAL_CAP),\n          Schedule.intersect(Schedule.recurs(retries)),\n        )\n      : retrySchedule;\n\n  return fetchEff(url, options).pipe(\n    Effect.retry({\n      schedule,\n      while: isRetryable,\n    }),\n  );\n};\n\n// --- In-memory GET cache (per-process, prevents duplicate round trips) ---\n\nconst getCache = new Map<string, { data: unknown; expiresAt: number }>();\nconst GET_CACHE_TTL_MS = 30_000;\n\nfunction isCacheable(_url: string, options?: FetchWithRetryOptions): boolean {\n  if (options?.method && options.method !== \"GET\") return false;\n  if (options?.body) return false;\n  return true;\n}\n\n// --- Promise wrappers (bridge for non-Effect code) ---\n\nexport const fetchResponse = (url: string, options?: FetchOptions): Promise<Response> =>\n  Effect.runPromise(fetchRawEff(url, options));\n\nexport const fetchJsonOrNull = async <T>(\n  url: string,\n  options?: FetchWithRetryOptions,\n): Promise<T | null> => {\n  if (isCacheable(url, options)) {\n    const cached = getCache.get(url);\n    if (cached && cached.expiresAt > Date.now()) {\n      return cached.data as T;\n    }\n  }\n\n  const retries = options?.retries ?? DEFAULT_RETRIES;\n  const eff =\n    retries > 0 ? fetchWithRetryEff(url, { ...options, retries }) : fetchEff(url, options);\n\n  try {\n    const res = await Effect.runPromise(eff);\n    const data = (await res.json()) as T;\n    if (isCacheable(url, options)) {\n      getCache.set(url, { data, expiresAt: Date.now() + GET_CACHE_TTL_MS });\n    }\n    return data;\n  } catch (error) {\n    const msg =\n      error instanceof FetchNetworkError\n        ? `[http] Network error: ${error.url} — ${String(error.cause)}`\n        : error instanceof FetchTimeoutError\n          ? `[http] Timeout: ${error.url}`\n          : error instanceof FetchHttpError\n            ? `[http] HTTP ${error.status}: ${error.url}`\n            : `[http] Unknown error while fetching ${url}`;\n    console.error(msg);\n    return null;\n  }\n};\n"],"mappings":";;;;AAIA,IAAa,oBAAb,cAAuCA,YAAK,YAAY,oBAAoB,CAGzE;AAEH,IAAa,oBAAb,cAAuCA,YAAK,YAAY,oBAAoB,CAEzE;AAEH,IAAa,iBAAb,cAAoCA,YAAK,YAAY,iBAAiB,CAInE;AAoBH,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,mBAAmBC,gBAAS,QAAQ,EAAE;AAC5C,MAAM,kBAAkBA,gBAAS,QAAQ,GAAG;AAI5C,MAAM,eAAe,UAA+B;AAClD,KAAI,iBAAiB,kBAAmB,QAAO;AAC/C,KAAI,iBAAiB,kBAAmB,QAAO;AAC/C,KAAI,iBAAiB,eAAgB,QAAO,MAAM,UAAU;AAC5D,QAAO;;AAKT,MAAM,eACJ,KACA,YAEAC,cAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,YAAYD,gBAAS,SAASA,gBAAS,OAAO,SAAS,WAAW,gBAAgB,CAAC;EACzF,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC7D,MAAI;AACF,UAAO,MAAM,MAAM,KAAK;IACtB,QAAQ,SAAS,UAAU;IAC3B,SAAS,SAAS;IAClB,MAAM,SAAS;IACf,UAAU,SAAS;IACnB,QAAQ,WAAW;IACpB,CAAC;WACK,OAAO;AACd,OAAI,iBAAiB,SAAS,MAAM,SAAS,aAC3C,OAAM,IAAI,kBAAkB,EAAE,KAAK,CAAC;AAEtC,SAAM,IAAI,kBAAkB;IAAE;IAAK,OAAO;IAAO,CAAC;YAC1C;AACR,gBAAa,MAAM;;;CAGvB,QAAQ,UAAU;AAChB,MAAI,iBAAiB,qBAAqB,iBAAiB,kBACzD,QAAO;AAET,SAAO,IAAI,kBAAkB;GAAE;GAAK,OAAO;GAAO,CAAC;;CAEtD,CAAC;AAIJ,MAAM,YAAY,KAAa,YAC7B,YAAY,KAAK,QAAQ,CAAC,KACxBC,cAAO,SAAS,aAAa;AAC3B,KAAI,SAAS,GAAI,QAAOA,cAAO,QAAQ,SAAS;AAChD,QAAOA,cAAO,KACZ,IAAI,eAAe;EAAE;EAAK,QAAQ,SAAS;EAAQ,YAAY,SAAS;EAAY,CAAC,CACtF;EACD,CACH;AAIH,MAAM,gBAAgBC,gBAAS,YAAY,iBAAiB,CAAC,KAC3DA,gBAAS,KAAK,gBAAgB,EAC9BA,gBAAS,UAAUA,gBAAS,OAAO,gBAAgB,CAAC,CACrD;AAED,MAAa,qBACX,KACA,YACwC;CACxC,MAAM,UAAU,SAAS,WAAW;AAEpC,KAAI,WAAW,EAAG,QAAO,SAAS,KAAK,QAAQ;CAE/C,MAAM,WACJ,SAAS,YAAY,SACjBA,gBAAS,YAAY,iBAAiB,CAAC,KACrCA,gBAAS,KAAK,gBAAgB,EAC9BA,gBAAS,UAAUA,gBAAS,OAAO,QAAQ,CAAC,CAC7C,GACD;AAEN,QAAO,SAAS,KAAK,QAAQ,CAAC,KAC5BD,cAAO,MAAM;EACX;EACA,OAAO;EACR,CAAC,CACH;;AAKH,MAAM,2BAAW,IAAI,KAAmD;AACxE,MAAM,mBAAmB;AAEzB,SAAS,YAAY,MAAc,SAA0C;AAC3E,KAAI,SAAS,UAAU,QAAQ,WAAW,MAAO,QAAO;AACxD,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO;;AAKT,MAAa,iBAAiB,KAAa,YACzCA,cAAO,WAAW,YAAY,KAAK,QAAQ,CAAC;AAE9C,MAAa,kBAAkB,OAC7B,KACA,YACsB;AACtB,KAAI,YAAY,KAAK,QAAQ,EAAE;EAC7B,MAAM,SAAS,SAAS,IAAI,IAAI;AAChC,MAAI,UAAU,OAAO,YAAY,KAAK,KAAK,CACzC,QAAO,OAAO;;CAIlB,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,MACJ,UAAU,IAAI,kBAAkB,KAAK;EAAE,GAAG;EAAS;EAAS,CAAC,GAAG,SAAS,KAAK,QAAQ;AAExF,KAAI;EAEF,MAAM,OAAQ,OAAM,MADFA,cAAO,WAAW,IAAI,EAChB,MAAM;AAC9B,MAAI,YAAY,KAAK,QAAQ,CAC3B,UAAS,IAAI,KAAK;GAAE;GAAM,WAAW,KAAK,KAAK,GAAG;GAAkB,CAAC;AAEvE,SAAO;UACA,OAAO;EACd,MAAM,MACJ,iBAAiB,oBACb,yBAAyB,MAAM,IAAI,KAAK,OAAO,MAAM,MAAM,KAC3D,iBAAiB,oBACf,mBAAmB,MAAM,QACzB,iBAAiB,iBACf,eAAe,MAAM,OAAO,IAAI,MAAM,QACtC,uCAAuC;AACjD,UAAQ,MAAM,IAAI;AAClB,SAAO"}

package/dist/http-client.mjs

@@ -0,0 +1,100 @@
+import { Data, Duration, Effect, Schedule } from "effect";
+
+//#region src/http-client.ts
+var FetchNetworkError = class extends Data.TaggedError("FetchNetworkError") {};
+var FetchTimeoutError = class extends Data.TaggedError("FetchTimeoutError") {};
+var FetchHttpError = class extends Data.TaggedError("FetchHttpError") {};
+const DEFAULT_TIMEOUT = "10 seconds";
+const DEFAULT_RETRIES = 3;
+const EXPONENTIAL_BASE = Duration.seconds(1);
+const EXPONENTIAL_CAP = Duration.seconds(15);
+const isRetryable = (error) => {
+	if (error instanceof FetchNetworkError) return true;
+	if (error instanceof FetchTimeoutError) return true;
+	if (error instanceof FetchHttpError) return error.status >= 500;
+	return false;
+};
+const fetchRawEff = (url, options) => Effect.tryPromise({
+	try: async () => {
+		const timeoutMs = Duration.toMillis(Duration.decode(options?.timeout ?? DEFAULT_TIMEOUT));
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			return await fetch(url, {
+				method: options?.method ?? "GET",
+				headers: options?.headers,
+				body: options?.body,
+				redirect: options?.redirect,
+				signal: controller.signal
+			});
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError") throw new FetchTimeoutError({ url });
+			throw new FetchNetworkError({
+				url,
+				cause: error
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+	},
+	catch: (error) => {
+		if (error instanceof FetchNetworkError || error instanceof FetchTimeoutError) return error;
+		return new FetchNetworkError({
+			url,
+			cause: error
+		});
+	}
+});
+const fetchEff = (url, options) => fetchRawEff(url, options).pipe(Effect.flatMap((response) => {
+	if (response.ok) return Effect.succeed(response);
+	return Effect.fail(new FetchHttpError({
+		url,
+		status: response.status,
+		statusText: response.statusText
+	}));
+}));
+const retrySchedule = Schedule.exponential(EXPONENTIAL_BASE).pipe(Schedule.upTo(EXPONENTIAL_CAP), Schedule.intersect(Schedule.recurs(DEFAULT_RETRIES)));
+const fetchWithRetryEff = (url, options) => {
+	const retries = options?.retries ?? DEFAULT_RETRIES;
+	if (retries <= 0) return fetchEff(url, options);
+	const schedule = options?.retries !== void 0 ? Schedule.exponential(EXPONENTIAL_BASE).pipe(Schedule.upTo(EXPONENTIAL_CAP), Schedule.intersect(Schedule.recurs(retries))) : retrySchedule;
+	return fetchEff(url, options).pipe(Effect.retry({
+		schedule,
+		while: isRetryable
+	}));
+};
+const getCache = /* @__PURE__ */ new Map();
+const GET_CACHE_TTL_MS = 3e4;
+function isCacheable(_url, options) {
+	if (options?.method && options.method !== "GET") return false;
+	if (options?.body) return false;
+	return true;
+}
+const fetchResponse = (url, options) => Effect.runPromise(fetchRawEff(url, options));
+const fetchJsonOrNull = async (url, options) => {
+	if (isCacheable(url, options)) {
+		const cached = getCache.get(url);
+		if (cached && cached.expiresAt > Date.now()) return cached.data;
+	}
+	const retries = options?.retries ?? DEFAULT_RETRIES;
+	const eff = retries > 0 ? fetchWithRetryEff(url, {
+		...options,
+		retries
+	}) : fetchEff(url, options);
+	try {
+		const data = await (await Effect.runPromise(eff)).json();
+		if (isCacheable(url, options)) getCache.set(url, {
+			data,
+			expiresAt: Date.now() + GET_CACHE_TTL_MS
+		});
+		return data;
+	} catch (error) {
+		const msg = error instanceof FetchNetworkError ? `[http] Network error: ${error.url} — ${String(error.cause)}` : error instanceof FetchTimeoutError ? `[http] Timeout: ${error.url}` : error instanceof FetchHttpError ? `[http] HTTP ${error.status}: ${error.url}` : `[http] Unknown error while fetching ${url}`;
+		console.error(msg);
+		return null;
+	}
+};
+
+//#endregion
+export { fetchJsonOrNull, fetchResponse };
+//# sourceMappingURL=http-client.mjs.map

package/dist/http-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.mjs","names":[],"sources":["../src/http-client.ts"],"sourcesContent":["import { Data, Duration, Effect, Schedule } from \"effect\";\n\n// --- Tagged errors ---\n\nexport class FetchNetworkError extends Data.TaggedError(\"FetchNetworkError\")<{\n  url: string;\n  cause: unknown;\n}> {}\n\nexport class FetchTimeoutError extends Data.TaggedError(\"FetchTimeoutError\")<{\n  url: string;\n}> {}\n\nexport class FetchHttpError extends Data.TaggedError(\"FetchHttpError\")<{\n  url: string;\n  status: number;\n  statusText: string;\n}> {}\n\nexport type FetchError = FetchNetworkError | FetchTimeoutError | FetchHttpError;\n\n// --- Options ---\n\nexport interface FetchOptions {\n  method?: string;\n  headers?: Record<string, string>;\n  body?: BodyInit;\n  redirect?: RequestRedirect;\n  timeout?: Duration.DurationInput;\n}\n\nexport interface FetchWithRetryOptions extends FetchOptions {\n  retries?: number;\n}\n\n// --- Defaults ---\n\nconst DEFAULT_TIMEOUT = \"10 seconds\";\nconst DEFAULT_RETRIES = 3;\n\nconst EXPONENTIAL_BASE = Duration.seconds(1);\nconst EXPONENTIAL_CAP = Duration.seconds(15);\n\n// --- Helpers ---\n\nconst isRetryable = (error: FetchError): boolean => {\n  if (error instanceof FetchNetworkError) return true;\n  if (error instanceof FetchTimeoutError) return true;\n  if (error instanceof FetchHttpError) return error.status >= 500;\n  return false;\n};\n\n// --- Low-level: just timeout + error classification, returns Response regardless of HTTP status ---\n\nconst fetchRawEff = (\n  url: string,\n  options?: FetchOptions,\n): Effect.Effect<Response, FetchNetworkError | FetchTimeoutError> =>\n  Effect.tryPromise({\n    try: async () => {\n      const timeoutMs = Duration.toMillis(Duration.decode(options?.timeout ?? DEFAULT_TIMEOUT));\n      const controller = new AbortController();\n      const timer = setTimeout(() => controller.abort(), timeoutMs);\n      try {\n        return await fetch(url, {\n          method: options?.method ?? \"GET\",\n          headers: options?.headers,\n          body: options?.body,\n          redirect: options?.redirect,\n          signal: controller.signal,\n        });\n      } catch (error) {\n        if (error instanceof Error && error.name === \"AbortError\") {\n          throw new FetchTimeoutError({ url });\n        }\n        throw new FetchNetworkError({ url, cause: error });\n      } finally {\n        clearTimeout(timer);\n      }\n    },\n    catch: (error) => {\n      if (error instanceof FetchNetworkError || error instanceof FetchTimeoutError) {\n        return error;\n      }\n      return new FetchNetworkError({ url, cause: error });\n    },\n  });\n\n// --- Adds HTTP status checking: non-2xx becomes FetchHttpError ---\n\nconst fetchEff = (url: string, options?: FetchOptions): Effect.Effect<Response, FetchError> =>\n  fetchRawEff(url, options).pipe(\n    Effect.flatMap((response) => {\n      if (response.ok) return Effect.succeed(response);\n      return Effect.fail(\n        new FetchHttpError({ url, status: response.status, statusText: response.statusText }),\n      );\n    }),\n  );\n\n// --- With retry ---\n\nconst retrySchedule = Schedule.exponential(EXPONENTIAL_BASE).pipe(\n  Schedule.upTo(EXPONENTIAL_CAP),\n  Schedule.intersect(Schedule.recurs(DEFAULT_RETRIES)),\n);\n\nexport const fetchWithRetryEff = (\n  url: string,\n  options?: FetchWithRetryOptions,\n): Effect.Effect<Response, FetchError> => {\n  const retries = options?.retries ?? DEFAULT_RETRIES;\n\n  if (retries <= 0) return fetchEff(url, options);\n\n  const schedule =\n    options?.retries !== undefined\n      ? Schedule.exponential(EXPONENTIAL_BASE).pipe(\n          Schedule.upTo(EXPONENTIAL_CAP),\n          Schedule.intersect(Schedule.recurs(retries)),\n        )\n      : retrySchedule;\n\n  return fetchEff(url, options).pipe(\n    Effect.retry({\n      schedule,\n      while: isRetryable,\n    }),\n  );\n};\n\n// --- In-memory GET cache (per-process, prevents duplicate round trips) ---\n\nconst getCache = new Map<string, { data: unknown; expiresAt: number }>();\nconst GET_CACHE_TTL_MS = 30_000;\n\nfunction isCacheable(_url: string, options?: FetchWithRetryOptions): boolean {\n  if (options?.method && options.method !== \"GET\") return false;\n  if (options?.body) return false;\n  return true;\n}\n\n// --- Promise wrappers (bridge for non-Effect code) ---\n\nexport const fetchResponse = (url: string, options?: FetchOptions): Promise<Response> =>\n  Effect.runPromise(fetchRawEff(url, options));\n\nexport const fetchJsonOrNull = async <T>(\n  url: string,\n  options?: FetchWithRetryOptions,\n): Promise<T | null> => {\n  if (isCacheable(url, options)) {\n    const cached = getCache.get(url);\n    if (cached && cached.expiresAt > Date.now()) {\n      return cached.data as T;\n    }\n  }\n\n  const retries = options?.retries ?? DEFAULT_RETRIES;\n  const eff =\n    retries > 0 ? fetchWithRetryEff(url, { ...options, retries }) : fetchEff(url, options);\n\n  try {\n    const res = await Effect.runPromise(eff);\n    const data = (await res.json()) as T;\n    if (isCacheable(url, options)) {\n      getCache.set(url, { data, expiresAt: Date.now() + GET_CACHE_TTL_MS });\n    }\n    return data;\n  } catch (error) {\n    const msg =\n      error instanceof FetchNetworkError\n        ? `[http] Network error: ${error.url} — ${String(error.cause)}`\n        : error instanceof FetchTimeoutError\n          ? `[http] Timeout: ${error.url}`\n          : error instanceof FetchHttpError\n            ? `[http] HTTP ${error.status}: ${error.url}`\n            : `[http] Unknown error while fetching ${url}`;\n    console.error(msg);\n    return null;\n  }\n};\n"],"mappings":";;;AAIA,IAAa,oBAAb,cAAuC,KAAK,YAAY,oBAAoB,CAGzE;AAEH,IAAa,oBAAb,cAAuC,KAAK,YAAY,oBAAoB,CAEzE;AAEH,IAAa,iBAAb,cAAoC,KAAK,YAAY,iBAAiB,CAInE;AAoBH,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,mBAAmB,SAAS,QAAQ,EAAE;AAC5C,MAAM,kBAAkB,SAAS,QAAQ,GAAG;AAI5C,MAAM,eAAe,UAA+B;AAClD,KAAI,iBAAiB,kBAAmB,QAAO;AAC/C,KAAI,iBAAiB,kBAAmB,QAAO;AAC/C,KAAI,iBAAiB,eAAgB,QAAO,MAAM,UAAU;AAC5D,QAAO;;AAKT,MAAM,eACJ,KACA,YAEA,OAAO,WAAW;CAChB,KAAK,YAAY;EACf,MAAM,YAAY,SAAS,SAAS,SAAS,OAAO,SAAS,WAAW,gBAAgB,CAAC;EACzF,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC7D,MAAI;AACF,UAAO,MAAM,MAAM,KAAK;IACtB,QAAQ,SAAS,UAAU;IAC3B,SAAS,SAAS;IAClB,MAAM,SAAS;IACf,UAAU,SAAS;IACnB,QAAQ,WAAW;IACpB,CAAC;WACK,OAAO;AACd,OAAI,iBAAiB,SAAS,MAAM,SAAS,aAC3C,OAAM,IAAI,kBAAkB,EAAE,KAAK,CAAC;AAEtC,SAAM,IAAI,kBAAkB;IAAE;IAAK,OAAO;IAAO,CAAC;YAC1C;AACR,gBAAa,MAAM;;;CAGvB,QAAQ,UAAU;AAChB,MAAI,iBAAiB,qBAAqB,iBAAiB,kBACzD,QAAO;AAET,SAAO,IAAI,kBAAkB;GAAE;GAAK,OAAO;GAAO,CAAC;;CAEtD,CAAC;AAIJ,MAAM,YAAY,KAAa,YAC7B,YAAY,KAAK,QAAQ,CAAC,KACxB,OAAO,SAAS,aAAa;AAC3B,KAAI,SAAS,GAAI,QAAO,OAAO,QAAQ,SAAS;AAChD,QAAO,OAAO,KACZ,IAAI,eAAe;EAAE;EAAK,QAAQ,SAAS;EAAQ,YAAY,SAAS;EAAY,CAAC,CACtF;EACD,CACH;AAIH,MAAM,gBAAgB,SAAS,YAAY,iBAAiB,CAAC,KAC3D,SAAS,KAAK,gBAAgB,EAC9B,SAAS,UAAU,SAAS,OAAO,gBAAgB,CAAC,CACrD;AAED,MAAa,qBACX,KACA,YACwC;CACxC,MAAM,UAAU,SAAS,WAAW;AAEpC,KAAI,WAAW,EAAG,QAAO,SAAS,KAAK,QAAQ;CAE/C,MAAM,WACJ,SAAS,YAAY,SACjB,SAAS,YAAY,iBAAiB,CAAC,KACrC,SAAS,KAAK,gBAAgB,EAC9B,SAAS,UAAU,SAAS,OAAO,QAAQ,CAAC,CAC7C,GACD;AAEN,QAAO,SAAS,KAAK,QAAQ,CAAC,KAC5B,OAAO,MAAM;EACX;EACA,OAAO;EACR,CAAC,CACH;;AAKH,MAAM,2BAAW,IAAI,KAAmD;AACxE,MAAM,mBAAmB;AAEzB,SAAS,YAAY,MAAc,SAA0C;AAC3E,KAAI,SAAS,UAAU,QAAQ,WAAW,MAAO,QAAO;AACxD,KAAI,SAAS,KAAM,QAAO;AAC1B,QAAO;;AAKT,MAAa,iBAAiB,KAAa,YACzC,OAAO,WAAW,YAAY,KAAK,QAAQ,CAAC;AAE9C,MAAa,kBAAkB,OAC7B,KACA,YACsB;AACtB,KAAI,YAAY,KAAK,QAAQ,EAAE;EAC7B,MAAM,SAAS,SAAS,IAAI,IAAI;AAChC,MAAI,UAAU,OAAO,YAAY,KAAK,KAAK,CACzC,QAAO,OAAO;;CAIlB,MAAM,UAAU,SAAS,WAAW;CACpC,MAAM,MACJ,UAAU,IAAI,kBAAkB,KAAK;EAAE,GAAG;EAAS;EAAS,CAAC,GAAG,SAAS,KAAK,QAAQ;AAExF,KAAI;EAEF,MAAM,OAAQ,OAAM,MADF,OAAO,WAAW,IAAI,EAChB,MAAM;AAC9B,MAAI,YAAY,KAAK,QAAQ,CAC3B,UAAS,IAAI,KAAK;GAAE;GAAM,WAAW,KAAK,KAAK,GAAG;GAAkB,CAAC;AAEvE,SAAO;UACA,OAAO;EACd,MAAM,MACJ,iBAAiB,oBACb,yBAAyB,MAAM,IAAI,KAAK,OAAO,MAAM,MAAM,KAC3D,iBAAiB,oBACf,mBAAmB,MAAM,QACzB,iBAAiB,iBACf,eAAe,MAAM,OAAO,IAAI,MAAM,QACtC,uCAAuC;AACjD,UAAQ,MAAM,IAAI;AAClB,SAAO"}

package/dist/integrity.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_http_client = require('./http-client.cjs');
 const require_fastkv = require('./fastkv.cjs');
 let node_crypto = require("node:crypto");
 
@@ -40,7 +41,7 @@ async function computeSriHashFromResponse(response, url, options) {
 async function computeSriHashForUrl(url, options) {
 	try {
 		const entryUrl = resolveSriTargetUrl(url, options);
-		const response = await fetch(entryUrl);
+		const response = await require_http_client.fetchResponse(entryUrl, { timeout: "30 seconds" });
 		if (!response.ok) {
 			console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);
 			return null;
@@ -58,7 +59,7 @@ function resolveEntryUrl(url) {
 }
 async function verifySriForUrl(url, expectedIntegrity, options) {
 	const entryUrl = resolveSriTargetUrl(url, options);
-	const response = await fetch(entryUrl);
+	const response = await require_http_client.fetchResponse(entryUrl, { timeout: "30 seconds" });
 	if (!response.ok) {
 		console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);
 		return;

package/dist/integrity.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.cjs","names":["fetchBosConfigFromFastKv"],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetch(entryUrl);\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetch(entryUrl);\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n"],"mappings":";;;;;;AAGA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;AAC/D,QAAO,sCAAqB,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,SAAS,oBAAoB,KAAa,SAAiC;AACzE,QAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,IAAI;;AAGxE,SAAS,uBAAuB,SAAiC;AAC/D,QAAO,SAAS,YAAY;;AAG9B,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,QAAQ;CAChD,MAAM,sBAAsB,SAAS,QAAQ,IAAI,iBAAiB;AAElE,KAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,oBAAoB;AACjD,MAAI,OAAO,SAAS,cAAc,IAAI,gBAAgB,SACpD,OAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,GACnF;;AAIL,KAAI,CAAC,SAAS,KACZ,OAAM,IAAI,MAAM,mCAAmC,MAAM;CAG3D,MAAM,mCAAkB,SAAS;CACjC,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,IAAI,aAAa;AAEjB,QAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KACF;AAGF,gBAAc,MAAM;AACpB,MAAI,aAAa,UAAU;AACzB,SAAM,OAAO,QAAQ;AACrB,SAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,GAChF;;AAGH,OAAK,OAAO,MAAM;;AAGpB,QAAO,UAAU,KAAK,OAAO,SAAS;;AAGxC,eAAsB,qBACpB,KACA,SACwB;AACxB,KAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,QAAQ;EAElD,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAET,SAAO,MAAM,2BAA2B,UAAU,UAAU,QAAQ;UAC7D,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,SAAgB,gBAAgB,KAAqB;AACnD,KAAI,IAAI,SAAS,kBAAkB,CAAE,QAAO;AAC5C,KAAI,IAAI,SAAS,oBAAoB,CACnC,QAAO,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC;AACpD,QAAO,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;;AAGnC,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,QAAQ;CAElD,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,QAAQ;AAE9E,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;;AAIL,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,SAAS,KAAa,WAAyB;AAC7C,OAAK,OAAO,IAAI,KAAK,UAAU;;CAGjC,cAAc,SAAiB,WAAyB;AACtD,OAAK,OAAO,IAAI,gBAAgB,QAAQ,EAAE,UAAU;;CAGtD,IAAI,KAAiC;AACnC,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,IAAI,KAAsB;AACxB,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,UAA8C;AAC5C,SAAO,KAAK,OAAO,SAAS;;;AAIhC,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,KAAqB;CACxC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;AAEvB,KAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,IAAI,CACzC,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,KAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,CAC7C,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,QAAO;;AAGT,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,EAAE;CAE/B,IAAI;AACJ,KAAI;AACF,gBAAc,MAAMA,wCAAkD,OAAO;UACtE,OAAO;AACd,UAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACzG;AACD,SAAO;GAAE,UAAU;GAAO,YAAY,CAAC,qBAAqB;GAAE;;CAGhE,MAAM,cAAc,uBAAuB,YAAY;CACvD,MAAM,cAAc,uBAAuB,YAAY;AAEvD,MAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,IAAI;AACtC,MAAI,aAAa,cAAc,WAAW;AACxC,cAAW,KAAK,IAAI;AACpB,WAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,YACjF;;;AAIL,KAAI,WAAW,WAAW,KAAK,YAAY,OAAO,EAChD,SAAQ,IACN,gEAAgE,YAAY,KAAK,mBAClF;AAGH,QAAO;EAAE,UAAU,WAAW,WAAW;EAAG;EAAY"}
+{"version":3,"file":"integrity.cjs","names":["fetchResponse","fetchBosConfigFromFastKv"],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n"],"mappings":";;;;;;;AAIA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;AAC/D,QAAO,sCAAqB,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,SAAS,oBAAoB,KAAa,SAAiC;AACzE,QAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,IAAI;;AAGxE,SAAS,uBAAuB,SAAiC;AAC/D,QAAO,SAAS,YAAY;;AAG9B,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,QAAQ;CAChD,MAAM,sBAAsB,SAAS,QAAQ,IAAI,iBAAiB;AAElE,KAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,oBAAoB;AACjD,MAAI,OAAO,SAAS,cAAc,IAAI,gBAAgB,SACpD,OAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,GACnF;;AAIL,KAAI,CAAC,SAAS,KACZ,OAAM,IAAI,MAAM,mCAAmC,MAAM;CAG3D,MAAM,mCAAkB,SAAS;CACjC,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,IAAI,aAAa;AAEjB,QAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KACF;AAGF,gBAAc,MAAM;AACpB,MAAI,aAAa,UAAU;AACzB,SAAM,OAAO,QAAQ;AACrB,SAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,GAChF;;AAGH,OAAK,OAAO,MAAM;;AAGpB,QAAO,UAAU,KAAK,OAAO,SAAS;;AAGxC,eAAsB,qBACpB,KACA,SACwB;AACxB,KAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,QAAQ;EAElD,MAAM,WAAW,MAAMA,kCAAc,UAAU,EAAE,SAAS,cAAc,CAAC;AACzE,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAET,SAAO,MAAM,2BAA2B,UAAU,UAAU,QAAQ;UAC7D,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,SAAgB,gBAAgB,KAAqB;AACnD,KAAI,IAAI,SAAS,kBAAkB,CAAE,QAAO;AAC5C,KAAI,IAAI,SAAS,oBAAoB,CACnC,QAAO,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC;AACpD,QAAO,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;;AAGnC,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,QAAQ;CAElD,MAAM,WAAW,MAAMA,kCAAc,UAAU,EAAE,SAAS,cAAc,CAAC;AACzE,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,QAAQ;AAE9E,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;;AAIL,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,SAAS,KAAa,WAAyB;AAC7C,OAAK,OAAO,IAAI,KAAK,UAAU;;CAGjC,cAAc,SAAiB,WAAyB;AACtD,OAAK,OAAO,IAAI,gBAAgB,QAAQ,EAAE,UAAU;;CAGtD,IAAI,KAAiC;AACnC,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,IAAI,KAAsB;AACxB,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,UAA8C;AAC5C,SAAO,KAAK,OAAO,SAAS;;;AAIhC,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,KAAqB;CACxC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;AAEvB,KAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,IAAI,CACzC,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,KAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,CAC7C,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,QAAO;;AAGT,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,EAAE;CAE/B,IAAI;AACJ,KAAI;AACF,gBAAc,MAAMC,wCAAkD,OAAO;UACtE,OAAO;AACd,UAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACzG;AACD,SAAO;GAAE,UAAU;GAAO,YAAY,CAAC,qBAAqB;GAAE;;CAGhE,MAAM,cAAc,uBAAuB,YAAY;CACvD,MAAM,cAAc,uBAAuB,YAAY;AAEvD,MAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,IAAI;AACtC,MAAI,aAAa,cAAc,WAAW;AACxC,cAAW,KAAK,IAAI;AACpB,WAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,YACjF;;;AAIL,KAAI,WAAW,WAAW,KAAK,YAAY,OAAO,EAChD,SAAQ,IACN,gEAAgE,YAAY,KAAK,mBAClF;AAGH,QAAO;EAAE,UAAU,WAAW,WAAW;EAAG;EAAY"}

package/dist/integrity.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.d.cts","names":[],"sources":["../src/integrity.ts"],"mappings":";UAKU,aAAA;EACR,eAAA;EACA,QAAA;AAAA;AAAA,iBAGc,cAAA,CAAe,OAAA,WAAkB,MAAA;AAAA,iBAyD3B,oBAAA,CACpB,GAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,iBAmBa,eAAA,CAAgB,GAAA;AAAA,iBAOV,eAAA,CACpB,GAAA,UACA,iBAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,cAkBU,iBAAA;EAAA,QACH,MAAA;EAER,QAAA,CAAS,GAAA,UAAa,SAAA;EAItB,aAAA,CAAc,OAAA,UAAiB,SAAA;EAI/B,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA;EAIJ,OAAA,CAAA,GAAW,gBAAA;AAAA;AAAA,iBA6BS,wBAAA,CACpB,WAAA,EAAa,MAAA,mBACb,MAAA,WACC,OAAA;EAAU,QAAA;EAAmB,UAAA;AAAA"}
+{"version":3,"file":"integrity.d.cts","names":[],"sources":["../src/integrity.ts"],"mappings":";UAMU,aAAA;EACR,eAAA;EACA,QAAA;AAAA;AAAA,iBAGc,cAAA,CAAe,OAAA,WAAkB,MAAA;AAAA,iBAyD3B,oBAAA,CACpB,GAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,iBAmBa,eAAA,CAAgB,GAAA;AAAA,iBAOV,eAAA,CACpB,GAAA,UACA,iBAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,cAkBU,iBAAA;EAAA,QACH,MAAA;EAER,QAAA,CAAS,GAAA,UAAa,SAAA;EAItB,aAAA,CAAc,OAAA,UAAiB,SAAA;EAI/B,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA;EAIJ,OAAA,CAAA,GAAW,gBAAA;AAAA;AAAA,iBA6BS,wBAAA,CACpB,WAAA,EAAa,MAAA,mBACb,MAAA,WACC,OAAA;EAAU,QAAA;EAAmB,UAAA;AAAA"}

package/dist/integrity.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.d.mts","names":[],"sources":["../src/integrity.ts"],"mappings":";UAKU,aAAA;EACR,eAAA;EACA,QAAA;AAAA;AAAA,iBAGc,cAAA,CAAe,OAAA,WAAkB,MAAA;AAAA,iBAyD3B,oBAAA,CACpB,GAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,iBAmBa,eAAA,CAAgB,GAAA;AAAA,iBAOV,eAAA,CACpB,GAAA,UACA,iBAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,cAkBU,iBAAA;EAAA,QACH,MAAA;EAER,QAAA,CAAS,GAAA,UAAa,SAAA;EAItB,aAAA,CAAc,OAAA,UAAiB,SAAA;EAI/B,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA;EAIJ,OAAA,CAAA,GAAW,gBAAA;AAAA;AAAA,iBA6BS,wBAAA,CACpB,WAAA,EAAa,MAAA,mBACb,MAAA,WACC,OAAA;EAAU,QAAA;EAAmB,UAAA;AAAA"}
+{"version":3,"file":"integrity.d.mts","names":[],"sources":["../src/integrity.ts"],"mappings":";UAMU,aAAA;EACR,eAAA;EACA,QAAA;AAAA;AAAA,iBAGc,cAAA,CAAe,OAAA,WAAkB,MAAA;AAAA,iBAyD3B,oBAAA,CACpB,GAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,iBAmBa,eAAA,CAAgB,GAAA;AAAA,iBAOV,eAAA,CACpB,GAAA,UACA,iBAAA,UACA,OAAA,GAAU,aAAA,GACT,OAAA;AAAA,cAkBU,iBAAA;EAAA,QACH,MAAA;EAER,QAAA,CAAS,GAAA,UAAa,SAAA;EAItB,aAAA,CAAc,OAAA,UAAiB,SAAA;EAI/B,GAAA,CAAI,GAAA;EAIJ,GAAA,CAAI,GAAA;EAIJ,OAAA,CAAA,GAAW,gBAAA;AAAA;AAAA,iBA6BS,wBAAA,CACpB,WAAA,EAAa,MAAA,mBACb,MAAA,WACC,OAAA;EAAU,QAAA;EAAmB,UAAA;AAAA"}

package/dist/integrity.mjs

@@ -1,3 +1,4 @@
+import { fetchResponse } from "./http-client.mjs";
 import { fetchBosConfigFromFastKv } from "./fastkv.mjs";
 import { createHash } from "node:crypto";
 
@@ -38,7 +39,7 @@ async function computeSriHashFromResponse(response, url, options) {
 async function computeSriHashForUrl(url, options) {
 	try {
 		const entryUrl = resolveSriTargetUrl(url, options);
-		const response = await fetch(entryUrl);
+		const response = await fetchResponse(entryUrl, { timeout: "30 seconds" });
 		if (!response.ok) {
 			console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);
 			return null;
@@ -56,7 +57,7 @@ function resolveEntryUrl(url) {
 }
 async function verifySriForUrl(url, expectedIntegrity, options) {
 	const entryUrl = resolveSriTargetUrl(url, options);
-	const response = await fetch(entryUrl);
+	const response = await fetchResponse(entryUrl, { timeout: "30 seconds" });
 	if (!response.ok) {
 		console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);
 		return;

package/dist/integrity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetch(entryUrl);\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetch(entryUrl);\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n"],"mappings":";;;;AAGA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;AAC/D,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,SAAS,oBAAoB,KAAa,SAAiC;AACzE,QAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,IAAI;;AAGxE,SAAS,uBAAuB,SAAiC;AAC/D,QAAO,SAAS,YAAY;;AAG9B,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,QAAQ;CAChD,MAAM,sBAAsB,SAAS,QAAQ,IAAI,iBAAiB;AAElE,KAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,oBAAoB;AACjD,MAAI,OAAO,SAAS,cAAc,IAAI,gBAAgB,SACpD,OAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,GACnF;;AAIL,KAAI,CAAC,SAAS,KACZ,OAAM,IAAI,MAAM,mCAAmC,MAAM;CAG3D,MAAM,OAAO,WAAW,SAAS;CACjC,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,IAAI,aAAa;AAEjB,QAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KACF;AAGF,gBAAc,MAAM;AACpB,MAAI,aAAa,UAAU;AACzB,SAAM,OAAO,QAAQ;AACrB,SAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,GAChF;;AAGH,OAAK,OAAO,MAAM;;AAGpB,QAAO,UAAU,KAAK,OAAO,SAAS;;AAGxC,eAAsB,qBACpB,KACA,SACwB;AACxB,KAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,QAAQ;EAElD,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAET,SAAO,MAAM,2BAA2B,UAAU,UAAU,QAAQ;UAC7D,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,SAAgB,gBAAgB,KAAqB;AACnD,KAAI,IAAI,SAAS,kBAAkB,CAAE,QAAO;AAC5C,KAAI,IAAI,SAAS,oBAAoB,CACnC,QAAO,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC;AACpD,QAAO,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;;AAGnC,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,QAAQ;CAElD,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,QAAQ;AAE9E,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;;AAIL,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,SAAS,KAAa,WAAyB;AAC7C,OAAK,OAAO,IAAI,KAAK,UAAU;;CAGjC,cAAc,SAAiB,WAAyB;AACtD,OAAK,OAAO,IAAI,gBAAgB,QAAQ,EAAE,UAAU;;CAGtD,IAAI,KAAiC;AACnC,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,IAAI,KAAsB;AACxB,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,UAA8C;AAC5C,SAAO,KAAK,OAAO,SAAS;;;AAIhC,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,KAAqB;CACxC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;AAEvB,KAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,IAAI,CACzC,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,KAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,CAC7C,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,QAAO;;AAGT,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,EAAE;CAE/B,IAAI;AACJ,KAAI;AACF,gBAAc,MAAM,yBAAkD,OAAO;UACtE,OAAO;AACd,UAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACzG;AACD,SAAO;GAAE,UAAU;GAAO,YAAY,CAAC,qBAAqB;GAAE;;CAGhE,MAAM,cAAc,uBAAuB,YAAY;CACvD,MAAM,cAAc,uBAAuB,YAAY;AAEvD,MAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,IAAI;AACtC,MAAI,aAAa,cAAc,WAAW;AACxC,cAAW,KAAK,IAAI;AACpB,WAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,YACjF;;;AAIL,KAAI,WAAW,WAAW,KAAK,YAAY,OAAO,EAChD,SAAQ,IACN,gEAAgE,YAAY,KAAK,mBAClF;AAGH,QAAO;EAAE,UAAU,WAAW,WAAW;EAAG;EAAY"}
+{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\nimport { fetchResponse } from \"./http-client\";\n\nconst DEFAULT_MAX_SRI_RESPONSE_BYTES = 20 * 1024 * 1024;\n\ninterface SriUrlOptions {\n  resolveEntryUrl?: boolean;\n  maxBytes?: number;\n}\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nfunction resolveSriTargetUrl(url: string, options?: SriUrlOptions): string {\n  return options?.resolveEntryUrl === false ? url : resolveEntryUrl(url);\n}\n\nfunction getMaxSriResponseBytes(options?: SriUrlOptions): number {\n  return options?.maxBytes ?? DEFAULT_MAX_SRI_RESPONSE_BYTES;\n}\n\nasync function computeSriHashFromResponse(\n  response: Response,\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string> {\n  const maxBytes = getMaxSriResponseBytes(options);\n  const contentLengthHeader = response.headers.get(\"content-length\");\n\n  if (contentLengthHeader) {\n    const contentLength = Number(contentLengthHeader);\n    if (Number.isFinite(contentLength) && contentLength > maxBytes) {\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${contentLength})`,\n      );\n    }\n  }\n\n  if (!response.body) {\n    throw new Error(`[SRI] Missing response body for ${url}`);\n  }\n\n  const hash = createHash(\"sha384\");\n  const reader = response.body.getReader();\n  let totalBytes = 0;\n\n  while (true) {\n    const { done, value } = await reader.read();\n    if (done) {\n      break;\n    }\n\n    totalBytes += value.byteLength;\n    if (totalBytes > maxBytes) {\n      await reader.cancel();\n      throw new Error(\n        `[SRI] Response for ${url} exceeds max size of ${maxBytes} bytes (${totalBytes})`,\n      );\n    }\n\n    hash.update(value);\n  }\n\n  return `sha384-${hash.digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(\n  url: string,\n  options?: SriUrlOptions,\n): Promise<string | null> {\n  try {\n    const entryUrl = resolveSriTargetUrl(url, options);\n\n    const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    return await computeSriHashFromResponse(response, entryUrl, options);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(\n  url: string,\n  expectedIntegrity: string,\n  options?: SriUrlOptions,\n): Promise<void> {\n  const entryUrl = resolveSriTargetUrl(url, options);\n\n  const response = await fetchResponse(entryUrl, { timeout: \"30 seconds\" });\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const computed = await computeSriHashFromResponse(response, entryUrl, options);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n"],"mappings":";;;;;AAIA,MAAM,iCAAiC,KAAK,OAAO;AAOnD,SAAgB,eAAe,SAAkC;AAC/D,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,SAAS,oBAAoB,KAAa,SAAiC;AACzE,QAAO,SAAS,oBAAoB,QAAQ,MAAM,gBAAgB,IAAI;;AAGxE,SAAS,uBAAuB,SAAiC;AAC/D,QAAO,SAAS,YAAY;;AAG9B,eAAe,2BACb,UACA,KACA,SACiB;CACjB,MAAM,WAAW,uBAAuB,QAAQ;CAChD,MAAM,sBAAsB,SAAS,QAAQ,IAAI,iBAAiB;AAElE,KAAI,qBAAqB;EACvB,MAAM,gBAAgB,OAAO,oBAAoB;AACjD,MAAI,OAAO,SAAS,cAAc,IAAI,gBAAgB,SACpD,OAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,cAAc,GACnF;;AAIL,KAAI,CAAC,SAAS,KACZ,OAAM,IAAI,MAAM,mCAAmC,MAAM;CAG3D,MAAM,OAAO,WAAW,SAAS;CACjC,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,IAAI,aAAa;AAEjB,QAAO,MAAM;EACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,MAAM;AAC3C,MAAI,KACF;AAGF,gBAAc,MAAM;AACpB,MAAI,aAAa,UAAU;AACzB,SAAM,OAAO,QAAQ;AACrB,SAAM,IAAI,MACR,sBAAsB,IAAI,uBAAuB,SAAS,UAAU,WAAW,GAChF;;AAGH,OAAK,OAAO,MAAM;;AAGpB,QAAO,UAAU,KAAK,OAAO,SAAS;;AAGxC,eAAsB,qBACpB,KACA,SACwB;AACxB,KAAI;EACF,MAAM,WAAW,oBAAoB,KAAK,QAAQ;EAElD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,cAAc,CAAC;AACzE,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAET,SAAO,MAAM,2BAA2B,UAAU,UAAU,QAAQ;UAC7D,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,SAAgB,gBAAgB,KAAqB;AACnD,KAAI,IAAI,SAAS,kBAAkB,CAAE,QAAO;AAC5C,KAAI,IAAI,SAAS,oBAAoB,CACnC,QAAO,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC;AACpD,QAAO,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;;AAGnC,eAAsB,gBACpB,KACA,mBACA,SACe;CACf,MAAM,WAAW,oBAAoB,KAAK,QAAQ;CAElD,MAAM,WAAW,MAAM,cAAc,UAAU,EAAE,SAAS,cAAc,CAAC;AACzE,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAGF,MAAM,WAAW,MAAM,2BAA2B,UAAU,UAAU,QAAQ;AAE9E,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;;AAIL,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,SAAS,KAAa,WAAyB;AAC7C,OAAK,OAAO,IAAI,KAAK,UAAU;;CAGjC,cAAc,SAAiB,WAAyB;AACtD,OAAK,OAAO,IAAI,gBAAgB,QAAQ,EAAE,UAAU;;CAGtD,IAAI,KAAiC;AACnC,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,IAAI,KAAsB;AACxB,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,UAA8C;AAC5C,SAAO,KAAK,OAAO,SAAS;;;AAIhC,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,KAAqB;CACxC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;AAEvB,KAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,IAAI,CACzC,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,KAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,CAC7C,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,QAAO;;AAGT,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,EAAE;CAE/B,IAAI;AACJ,KAAI;AACF,gBAAc,MAAM,yBAAkD,OAAO;UACtE,OAAO;AACd,UAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACzG;AACD,SAAO;GAAE,UAAU;GAAO,YAAY,CAAC,qBAAqB;GAAE;;CAGhE,MAAM,cAAc,uBAAuB,YAAY;CACvD,MAAM,cAAc,uBAAuB,YAAY;AAEvD,MAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,IAAI;AACtC,MAAI,aAAa,cAAc,WAAW;AACxC,cAAW,KAAK,IAAI;AACpB,WAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,YACjF;;;AAIL,KAAI,WAAW,WAAW,KAAK,YAAY,OAAO,EAChD,SAAQ,IACN,gEAAgE,YAAY,KAAK,mBAClF;AAGH,QAAO;EAAE,UAAU,WAAW,WAAW;EAAG;EAAY"}

package/dist/mf.cjs

@@ -6,13 +6,21 @@ let _module_federation_runtime_core = require("@module-federation/runtime-core")
 
 //#region src/mf.ts
 let mfInstance = null;
+function fetchWithTimeout(url, init, timeoutMs) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	return fetch(url, {
+		...init,
+		signal: controller.signal
+	}).finally(() => clearTimeout(timer));
+}
 function patchManifestFetchForSsrPublicPath(mf) {
 	if (!mf || !mf.loaderHook?.lifecycle?.fetch?.on) return;
 	if (mf.__everythingDevPatchedManifestFetch === true) return;
 	mf.__everythingDevPatchedManifestFetch = true;
 	mf.loaderHook.lifecycle.fetch.on((url, init) => {
 		if (typeof url !== "string" || !url.endsWith("/mf-manifest.json")) return;
-		return fetch(url, init).then((res) => res.json()).then((json) => {
+		return fetchWithTimeout(url, init, 15e3).then((res) => res.json()).then((json) => {
 			json.metaData = json.metaData ?? {};
 			json.metaData.ssrPublicPath = json.metaData.ssrPublicPath ?? url.replace(/\/mf-manifest\.json$/, "/");
 			if (json.metaData.publicPath === "auto" || json.metaData.publicPath === "") json.metaData.publicPath = "/";
@@ -31,7 +39,7 @@ function installIntegrityFetchHook(mf, registry) {
 		if (typeof url !== "string") return;
 		const expectedHash = registry.get(url);
 		if (!expectedHash) return;
-		return fetch(url, init).then(async (res) => {
+		return fetchWithTimeout(url, init, 15e3).then(async (res) => {
 			const buffer = Buffer.from(await res.arrayBuffer());
 			const computed = require_integrity.computeSriHash(buffer);
 			if (computed !== expectedHash) {

package/dist/mf.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mf.cjs","names":["computeSriHash"],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        if (json.metaData.publicPath === \"auto\" || json.metaData.publicPath === \"\") {\n          json.metaData.publicPath = \"/\";\n        }\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetch(url, init as any).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;;;AAMA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,OAAI,KAAK,SAAS,eAAe,UAAU,KAAK,SAAS,eAAe,GACtE,MAAK,SAAS,aAAa;AAE7B,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,MAAM,KAAK,KAAY,CAAC,KAAK,OAAO,QAAQ;GACjD,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAWA,iCAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,iEAAwB;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,mEAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,sEAA4B;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,kEAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}
+{"version":3,"file":"mf.cjs","names":["computeSriHash"],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nfunction fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  return fetch(url, { ...init, signal: controller.signal }).finally(() => clearTimeout(timer));\n}\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetchWithTimeout(url as string, init as RequestInit, 15_000)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        if (json.metaData.publicPath === \"auto\" || json.metaData.publicPath === \"\") {\n          json.metaData.publicPath = \"/\";\n        }\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetchWithTimeout(url as string, init as RequestInit, 15_000).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;;;AAMA,IAAI,aAAwC;AAE5C,SAAS,iBAAiB,KAAa,MAAmB,WAAsC;CAC9F,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC7D,QAAO,MAAM,KAAK;EAAE,GAAG;EAAM,QAAQ,WAAW;EAAQ,CAAC,CAAC,cAAc,aAAa,MAAM,CAAC;;AAG9F,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,iBAAiB,KAAe,MAAqB,KAAO,CAChE,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,OAAI,KAAK,SAAS,eAAe,UAAU,KAAK,SAAS,eAAe,GACtE,MAAK,SAAS,aAAa;AAE7B,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,iBAAiB,KAAe,MAAqB,KAAO,CAAC,KAAK,OAAO,QAAQ;GACtF,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAWA,iCAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,iEAAwB;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,mEAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,sEAA4B;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,kEAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}

package/dist/mf.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"mf.d.cts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAyBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}
+{"version":3,"file":"mf.d.cts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAU5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAyBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}

package/dist/mf.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mf.d.mts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAyBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}
+{"version":3,"file":"mf.d.mts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAU5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAyBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}

package/dist/mf.mjs

@@ -4,13 +4,21 @@ import { setGlobalFederationInstance } from "@module-federation/runtime-core";
 
 //#region src/mf.ts
 let mfInstance = null;
+function fetchWithTimeout(url, init, timeoutMs) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	return fetch(url, {
+		...init,
+		signal: controller.signal
+	}).finally(() => clearTimeout(timer));
+}
 function patchManifestFetchForSsrPublicPath(mf) {
 	if (!mf || !mf.loaderHook?.lifecycle?.fetch?.on) return;
 	if (mf.__everythingDevPatchedManifestFetch === true) return;
 	mf.__everythingDevPatchedManifestFetch = true;
 	mf.loaderHook.lifecycle.fetch.on((url, init) => {
 		if (typeof url !== "string" || !url.endsWith("/mf-manifest.json")) return;
-		return fetch(url, init).then((res) => res.json()).then((json) => {
+		return fetchWithTimeout(url, init, 15e3).then((res) => res.json()).then((json) => {
 			json.metaData = json.metaData ?? {};
 			json.metaData.ssrPublicPath = json.metaData.ssrPublicPath ?? url.replace(/\/mf-manifest\.json$/, "/");
 			if (json.metaData.publicPath === "auto" || json.metaData.publicPath === "") json.metaData.publicPath = "/";
@@ -29,7 +37,7 @@ function installIntegrityFetchHook(mf, registry) {
 		if (typeof url !== "string") return;
 		const expectedHash = registry.get(url);
 		if (!expectedHash) return;
-		return fetch(url, init).then(async (res) => {
+		return fetchWithTimeout(url, init, 15e3).then(async (res) => {
 			const buffer = Buffer.from(await res.arrayBuffer());
 			const computed = computeSriHash(buffer);
 			if (computed !== expectedHash) {

package/dist/mf.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mf.mjs","names":[],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        if (json.metaData.publicPath === \"auto\" || json.metaData.publicPath === \"\") {\n          json.metaData.publicPath = \"/\";\n        }\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetch(url, init as any).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;AAMA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,OAAI,KAAK,SAAS,eAAe,UAAU,KAAK,SAAS,eAAe,GACtE,MAAK,SAAS,aAAa;AAE7B,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,MAAM,KAAK,KAAY,CAAC,KAAK,OAAO,QAAQ;GACjD,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAW,eAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,WAAW,aAAa;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,8BAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,cAAa,eAAe;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,6BAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}
+{"version":3,"file":"mf.mjs","names":[],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nfunction fetchWithTimeout(url: string, init: RequestInit, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), timeoutMs);\n  return fetch(url, { ...init, signal: controller.signal }).finally(() => clearTimeout(timer));\n}\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetchWithTimeout(url as string, init as RequestInit, 15_000)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        if (json.metaData.publicPath === \"auto\" || json.metaData.publicPath === \"\") {\n          json.metaData.publicPath = \"/\";\n        }\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetchWithTimeout(url as string, init as RequestInit, 15_000).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;AAMA,IAAI,aAAwC;AAE5C,SAAS,iBAAiB,KAAa,MAAmB,WAAsC;CAC9F,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,UAAU;AAC7D,QAAO,MAAM,KAAK;EAAE,GAAG;EAAM,QAAQ,WAAW;EAAQ,CAAC,CAAC,cAAc,aAAa,MAAM,CAAC;;AAG9F,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,iBAAiB,KAAe,MAAqB,KAAO,CAChE,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,OAAI,KAAK,SAAS,eAAe,UAAU,KAAK,SAAS,eAAe,GACtE,MAAK,SAAS,aAAa;AAE7B,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,iBAAiB,KAAe,MAAqB,KAAO,CAAC,KAAK,OAAO,QAAQ;GACtF,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAW,eAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,WAAW,aAAa;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,8BAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,cAAa,eAAe;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,6BAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}

package/dist/near-cli.cjs

@@ -1,7 +1,7 @@
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
 const require_theme = require('./utils/theme.cjs');
-let node_crypto = require("node:crypto");
 let effect = require("effect");
+let node_crypto = require("node:crypto");
 let execa = require("execa");
 
 //#region src/near-cli.ts

package/dist/near-cli.mjs

@@ -1,6 +1,6 @@
 import { colors } from "./utils/theme.mjs";
-import { generateKeyPairSync } from "node:crypto";
 import { Effect } from "effect";
+import { generateKeyPairSync } from "node:crypto";
 import { execa } from "execa";
 
 //#region src/near-cli.ts

package/dist/orchestrator.cjs

@@ -30,6 +30,12 @@ const probeHttpOk = (url, timeoutMs = 400) => effect.Effect.tryPromise({
 	},
 	catch: () => false
 });
+const LOCAL_PROBE_DEADLINE_MS = 9e4;
+const LOCAL_PROBE_INTERVAL_MS = 200;
+const REMOTE_PROBE_TIMEOUT_MS = 5e3;
+const REMOTE_PROBE_DEADLINE_MS = 6e4;
+const REMOTE_PROBE_BACKOFF_INITIAL_MS = 1e3;
+const REMOTE_PROBE_BACKOFF_MAX_MS = 15e3;
 const detectStatus = (line, descriptor) => {
 	const cleanLine = stripAnsi(line);
 	const errorPatterns = descriptor.errorPatterns ?? [];
@@ -185,10 +191,17 @@ const spawnDevProcess = (descriptor, callbacks) => effect.Effect.gen(function* (
 		callbacks.onStatus(name, "ready");
 		yield* effect.Deferred.succeed(readyDeferred, void 0).pipe(effect.Effect.ignore);
 	});
-	if (port > 0) {
-		const url = `http://127.0.0.1:${port}${descriptor.readinessPath}`;
-		yield* effect.Effect.forkScoped(effect.Effect.gen(function* () {
-			const deadline = Date.now() + 9e4;
+	const markError = (message) => effect.Effect.gen(function* () {
+		const currentStatus = yield* effect.Ref.get(statusRef);
+		if (currentStatus === "ready" || currentStatus === "error") return;
+		yield* effect.Ref.set(statusRef, "error");
+		callbacks.onStatus(name, "error");
+		yield* effect.Deferred.fail(readyDeferred, new Error(message)).pipe(effect.Effect.ignore);
+	});
+	yield* effect.Effect.forkScoped(effect.Effect.gen(function* () {
+		const deadline = Date.now() + LOCAL_PROBE_DEADLINE_MS;
+		if (port > 0) {
+			const url = `http://127.0.0.1:${port}${descriptor.readinessPath}`;
 			while (Date.now() < deadline) {
 				const status = yield* effect.Ref.get(statusRef);
 				if (status === "ready" || status === "error") return;
@@ -196,19 +209,26 @@ const spawnDevProcess = (descriptor, callbacks) => effect.Effect.gen(function* (
 					yield* markReady;
 					return;
 				}
-				yield* effect.Effect.sleep("200 millis");
+				yield* effect.Effect.sleep(`${LOCAL_PROBE_INTERVAL_MS} millis`);
 			}
-		}));
-	}
+		} else while (Date.now() < deadline) {
+			const status = yield* effect.Ref.get(statusRef);
+			if (status === "ready" || status === "error") return;
+			yield* effect.Effect.sleep("500 millis");
+		}
+		const status = yield* effect.Ref.get(statusRef);
+		if (status !== "ready" && status !== "error") {
+			callbacks.onLog(name, "Probe deadline exceeded after 90s", true);
+			yield* markError(`Probe deadline exceeded: ${name}`);
+		}
+	}));
 	const pid = Number(proc.pid);
 	yield* effect.Effect.forkScoped(effect.Effect.gen(function* () {
 		const exitCode = yield* proc.exitCode;
 		const currentStatus = yield* effect.Ref.get(statusRef);
 		if (currentStatus === "ready" || currentStatus === "error") return;
 		callbacks.onLog(name, `Process exited before ready (exit code: ${exitCode})`, true);
-		yield* effect.Ref.set(statusRef, "error");
-		callbacks.onStatus(name, "error");
-		yield* effect.Deferred.fail(readyDeferred, /* @__PURE__ */ new Error(`Process exited before ready: ${name}`)).pipe(effect.Effect.ignore);
+		yield* markError(`Process exited before ready: ${name}`);
 	}));
 	const handleLine = (line, isStderr) => effect.Effect.gen(function* () {
 		if (!line.trim()) return;
@@ -218,12 +238,8 @@ const spawnDevProcess = (descriptor, callbacks) => effect.Effect.gen(function* (
 		const currentStatus = yield* effect.Ref.get(statusRef);
 		if (currentStatus === "ready" || currentStatus === "error") return;
 		const detected = detectStatus(line, descriptor);
-		if (detected) {
-			yield* effect.Ref.set(statusRef, detected.status);
-			callbacks.onStatus(name, detected.status);
-			if (detected.status === "ready" || detected.status === "error") if (detected.status === "ready") yield* effect.Deferred.succeed(readyDeferred, void 0).pipe(effect.Effect.ignore);
-			else yield* effect.Deferred.fail(readyDeferred, /* @__PURE__ */ new Error(`Process failed: ${name}`)).pipe(effect.Effect.ignore);
-		}
+		if (detected) if (detected.status === "ready") yield* markReady;
+		else yield* markError(`Process failed: ${name}`);
 	});
 	yield* effect.Effect.forkScoped(effect.Stream.runForEach((line) => handleLine(line, false))(effect.Stream.splitLines(effect.Stream.decodeText(proc.stdout, "utf-8"))));
 	yield* effect.Effect.forkScoped(effect.Stream.runForEach((line) => handleLine(line, true))(effect.Stream.splitLines(effect.Stream.decodeText(proc.stderr, "utf-8"))));
@@ -247,25 +263,25 @@ const spawnRemoteProbe = (pkg, descriptor, callbacks) => effect.Effect.gen(funct
 	const readyDeferred = yield* effect.Deferred.make();
 	const statusRef = yield* effect.Ref.make("starting");
 	const markReady = effect.Effect.gen(function* () {
+		const currentStatus = yield* effect.Ref.get(statusRef);
+		if (currentStatus === "ready" || currentStatus === "error") return;
 		yield* effect.Ref.set(statusRef, "ready");
-		yield* effect.Deferred.succeed(readyDeferred, void 0);
+		yield* effect.Deferred.succeed(readyDeferred, void 0).pipe(effect.Effect.ignore);
 		callbacks.onStatus(pkg, "ready", "loaded");
 	});
 	const markError = effect.Effect.gen(function* () {
+		const currentStatus = yield* effect.Ref.get(statusRef);
+		if (currentStatus === "ready" || currentStatus === "error") return;
 		yield* effect.Ref.set(statusRef, "error");
-		yield* effect.Deferred.fail(readyDeferred, /* @__PURE__ */ new Error(`Remote ${pkg} unreachable`));
+		yield* effect.Deferred.fail(readyDeferred, /* @__PURE__ */ new Error(`Remote ${pkg} unreachable`)).pipe(effect.Effect.ignore);
 		callbacks.onStatus(pkg, "error", "unreachable");
 	});
 	const baseUrl = descriptor.url.replace(/\/$/, "");
 	const manifestUrl = `${baseUrl}/mf-manifest.json`;
 	const entryUrl = `${baseUrl}${descriptor.readinessPath}`;
 	const probeUrl = descriptor.readinessPath === "/health" ? `${baseUrl}/health` : manifestUrl;
-	const REMOTE_PROBE_TIMEOUT_MS = 5e3;
-	const REMOTE_PROBE_BACKOFF_INITIAL_MS = 1e3;
-	const REMOTE_PROBE_BACKOFF_MAX_MS = 15e3;
 	yield* effect.Effect.forkScoped(effect.Effect.gen(function* () {
-		yield* effect.Effect.sleep(`${Math.floor(Math.random() * 2e3)} millis`);
-		const deadline = Date.now() + 6e4;
+		const deadline = Date.now() + REMOTE_PROBE_DEADLINE_MS;
 		let delay = REMOTE_PROBE_BACKOFF_INITIAL_MS;
 		while (Date.now() < deadline) {
 			const status = yield* effect.Ref.get(statusRef);