everything-dev 1.7.1 → 1.8.0

package/dist/integrity.mjs

@@ -1,3 +1,4 @@
+import { fetchBosConfigFromFastKv } from "./fastkv.mjs";
 import { createHash } from "node:crypto";
 
 //#region src/integrity.ts
@@ -6,7 +7,7 @@ function computeSriHash(content) {
 }
 async function computeSriHashForUrl(url) {
 	try {
-		const entryUrl = url.endsWith("/remoteEntry.js") ? url : url.endsWith("/mf-manifest.json") ? `${url.replace(/\/mf-manifest\.json$/, "")}/remoteEntry.js` : `${url.replace(/\/$/, "")}/remoteEntry.js`;
+		const entryUrl = resolveEntryUrl(url);
 		const response = await fetch(entryUrl);
 		if (!response.ok) {
 			console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);
@@ -18,8 +19,13 @@ async function computeSriHashForUrl(url) {
 		return null;
 	}
 }
+function resolveEntryUrl(url) {
+	if (url.endsWith("/remoteEntry.js")) return url;
+	if (url.endsWith("/mf-manifest.json")) return `${url.replace(/\/mf-manifest\.json$/, "")}/remoteEntry.js`;
+	return `${url.replace(/\/$/, "")}/remoteEntry.js`;
+}
 async function verifySriForUrl(url, expectedIntegrity) {
-	const entryUrl = url.endsWith("/remoteEntry.js") ? url : url.endsWith("/mf-manifest.json") ? `${url.replace(/\/mf-manifest\.json$/, "")}/remoteEntry.js` : `${url.replace(/\/$/, "")}/remoteEntry.js`;
+	const entryUrl = resolveEntryUrl(url);
 	const response = await fetch(entryUrl);
 	if (!response.ok) {
 		console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);
@@ -29,7 +35,64 @@ async function verifySriForUrl(url, expectedIntegrity) {
 	if (computed !== expectedIntegrity) throw new Error(`[SRI] Integrity check failed for ${entryUrl}\n  Expected: ${expectedIntegrity}\n  Computed: ${computed}`);
 	console.log(`[SRI] Integrity verified for ${entryUrl}`);
 }
+var IntegrityRegistry = class {
+	hashes = /* @__PURE__ */ new Map();
+	register(url, integrity) {
+		this.hashes.set(url, integrity);
+	}
+	registerEntry(baseUrl, integrity) {
+		this.hashes.set(resolveEntryUrl(baseUrl), integrity);
+	}
+	get(url) {
+		return this.hashes.get(url);
+	}
+	has(url) {
+		return this.hashes.has(url);
+	}
+	entries() {
+		return this.hashes.entries();
+	}
+};
+function extractIntegrityHashes(config) {
+	const hashes = /* @__PURE__ */ new Map();
+	const app = config.app;
+	const plugins = config.plugins;
+	if (app) {
+		for (const [, entry] of Object.entries(app)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
+	}
+	if (plugins) {
+		for (const [, entry] of Object.entries(plugins)) if (entry?.integrity && entry?.production) hashes.set(resolveEntryUrl(entry.production), entry.integrity);
+	}
+	return hashes;
+}
+async function verifyConfigAgainstChain(localConfig, bosUrl) {
+	const mismatches = [];
+	let chainConfig;
+	try {
+		chainConfig = await fetchBosConfigFromFastKv(bosUrl);
+	} catch (error) {
+		console.warn(`[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`);
+		return {
+			verified: false,
+			mismatches: ["chain-fetch-failed"]
+		};
+	}
+	const localHashes = extractIntegrityHashes(localConfig);
+	const chainHashes = extractIntegrityHashes(chainConfig);
+	for (const [url, chainHash] of chainHashes) {
+		const localHash = localHashes.get(url);
+		if (localHash && localHash !== chainHash) {
+			mismatches.push(url);
+			console.error(`[Attestation] Integrity mismatch for ${url}\n  Local: ${localHash}\n  Chain: ${chainHash}`);
+		}
+	}
+	if (mismatches.length === 0 && localHashes.size > 0) console.log(`[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`);
+	return {
+		verified: mismatches.length === 0,
+		mismatches
+	};
+}
 
 //#endregion
-export { computeSriHash, computeSriHashForUrl, verifySriForUrl };
+export { IntegrityRegistry, computeSriHash, computeSriHashForUrl, resolveEntryUrl, verifyConfigAgainstChain, verifySriForUrl };
 //# sourceMappingURL=integrity.mjs.map

package/dist/integrity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(url: string): Promise<string | null> {\n  try {\n    const entryUrl = url.endsWith(\"/remoteEntry.js\")\n      ? url\n      : url.endsWith(\"/mf-manifest.json\")\n        ? `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`\n        : `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n\n    const response = await fetch(entryUrl);\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    const buffer = Buffer.from(await response.arrayBuffer());\n    return computeSriHash(buffer);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport async function verifySriForUrl(url: string, expectedIntegrity: string): Promise<void> {\n  const entryUrl = url.endsWith(\"/remoteEntry.js\")\n    ? url\n    : url.endsWith(\"/mf-manifest.json\")\n      ? `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`\n      : `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n\n  const response = await fetch(entryUrl);\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n  const computed = computeSriHash(buffer);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n\n  console.log(`[SRI] Integrity verified for ${entryUrl}`);\n}\n"],"mappings":";;;AAEA,SAAgB,eAAe,SAAkC;AAC/D,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,eAAsB,qBAAqB,KAAqC;AAC9E,KAAI;EACF,MAAM,WAAW,IAAI,SAAS,kBAAkB,GAC5C,MACA,IAAI,SAAS,oBAAoB,GAC/B,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC,mBAC3C,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;EAEhC,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAGT,SAAO,eADQ,OAAO,KAAK,MAAM,SAAS,aAAa,CAAC,CAC3B;UACtB,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,eAAsB,gBAAgB,KAAa,mBAA0C;CAC3F,MAAM,WAAW,IAAI,SAAS,kBAAkB,GAC5C,MACA,IAAI,SAAS,oBAAoB,GAC/B,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC,mBAC3C,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;CAEhC,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAIF,MAAM,WAAW,eADF,OAAO,KAAK,MAAM,SAAS,aAAa,CAAC,CACjB;AAEvC,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;AAGH,SAAQ,IAAI,gCAAgC,WAAW"}
+{"version":3,"file":"integrity.mjs","names":[],"sources":["../src/integrity.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { fetchBosConfigFromFastKv } from \"./fastkv\";\n\nexport function computeSriHash(content: string | Buffer): string {\n  return `sha384-${createHash(\"sha384\").update(content).digest(\"base64\")}`;\n}\n\nexport async function computeSriHashForUrl(url: string): Promise<string | null> {\n  try {\n    const entryUrl = resolveEntryUrl(url);\n\n    const response = await fetch(entryUrl);\n    if (!response.ok) {\n      console.warn(`[SRI] Failed to fetch ${entryUrl}: ${response.status} ${response.statusText}`);\n      return null;\n    }\n    const buffer = Buffer.from(await response.arrayBuffer());\n    return computeSriHash(buffer);\n  } catch (error) {\n    console.warn(\n      `[SRI] Error computing integrity for ${url}:`,\n      error instanceof Error ? error.message : error,\n    );\n    return null;\n  }\n}\n\nexport function resolveEntryUrl(url: string): string {\n  if (url.endsWith(\"/remoteEntry.js\")) return url;\n  if (url.endsWith(\"/mf-manifest.json\"))\n    return `${url.replace(/\\/mf-manifest\\.json$/, \"\")}/remoteEntry.js`;\n  return `${url.replace(/\\/$/, \"\")}/remoteEntry.js`;\n}\n\nexport async function verifySriForUrl(url: string, expectedIntegrity: string): Promise<void> {\n  const entryUrl = resolveEntryUrl(url);\n\n  const response = await fetch(entryUrl);\n  if (!response.ok) {\n    console.warn(`[SRI] Failed to fetch ${entryUrl} for verification: ${response.status}`);\n    return;\n  }\n\n  const buffer = Buffer.from(await response.arrayBuffer());\n  const computed = computeSriHash(buffer);\n\n  if (computed !== expectedIntegrity) {\n    throw new Error(\n      `[SRI] Integrity check failed for ${entryUrl}\\n  Expected: ${expectedIntegrity}\\n  Computed: ${computed}`,\n    );\n  }\n\n  console.log(`[SRI] Integrity verified for ${entryUrl}`);\n}\n\nexport class IntegrityRegistry {\n  private hashes = new Map<string, string>();\n\n  register(url: string, integrity: string): void {\n    this.hashes.set(url, integrity);\n  }\n\n  registerEntry(baseUrl: string, integrity: string): void {\n    this.hashes.set(resolveEntryUrl(baseUrl), integrity);\n  }\n\n  get(url: string): string | undefined {\n    return this.hashes.get(url);\n  }\n\n  has(url: string): boolean {\n    return this.hashes.has(url);\n  }\n\n  entries(): IterableIterator<[string, string]> {\n    return this.hashes.entries();\n  }\n}\n\nfunction extractIntegrityHashes(config: Record<string, unknown>): Map<string, string> {\n  const hashes = new Map<string, string>();\n  const app = config.app as Record<string, Record<string, unknown>> | undefined;\n  const plugins = config.plugins as Record<string, Record<string, unknown>> | undefined;\n\n  if (app) {\n    for (const [, entry] of Object.entries(app)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  if (plugins) {\n    for (const [, entry] of Object.entries(plugins)) {\n      if (entry?.integrity && entry?.production) {\n        hashes.set(resolveEntryUrl(entry.production as string), entry.integrity as string);\n      }\n    }\n  }\n\n  return hashes;\n}\n\nexport async function verifyConfigAgainstChain(\n  localConfig: Record<string, unknown>,\n  bosUrl: string,\n): Promise<{ verified: boolean; mismatches: string[] }> {\n  const mismatches: string[] = [];\n\n  let chainConfig: Record<string, unknown>;\n  try {\n    chainConfig = await fetchBosConfigFromFastKv<Record<string, unknown>>(bosUrl);\n  } catch (error) {\n    console.warn(\n      `[Attestation] Failed to fetch on-chain config: ${error instanceof Error ? error.message : String(error)}`,\n    );\n    return { verified: false, mismatches: [\"chain-fetch-failed\"] };\n  }\n\n  const localHashes = extractIntegrityHashes(localConfig);\n  const chainHashes = extractIntegrityHashes(chainConfig);\n\n  for (const [url, chainHash] of chainHashes) {\n    const localHash = localHashes.get(url);\n    if (localHash && localHash !== chainHash) {\n      mismatches.push(url);\n      console.error(\n        `[Attestation] Integrity mismatch for ${url}\\n  Local: ${localHash}\\n  Chain: ${chainHash}`,\n      );\n    }\n  }\n\n  if (mismatches.length === 0 && localHashes.size > 0) {\n    console.log(\n      `[Attestation] Local config verified against on-chain anchor (${localHashes.size} entries checked)`,\n    );\n  }\n\n  return { verified: mismatches.length === 0, mismatches };\n}\n"],"mappings":";;;;AAGA,SAAgB,eAAe,SAAkC;AAC/D,QAAO,UAAU,WAAW,SAAS,CAAC,OAAO,QAAQ,CAAC,OAAO,SAAS;;AAGxE,eAAsB,qBAAqB,KAAqC;AAC9E,KAAI;EACF,MAAM,WAAW,gBAAgB,IAAI;EAErC,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,MAAI,CAAC,SAAS,IAAI;AAChB,WAAQ,KAAK,yBAAyB,SAAS,IAAI,SAAS,OAAO,GAAG,SAAS,aAAa;AAC5F,UAAO;;AAGT,SAAO,eADQ,OAAO,KAAK,MAAM,SAAS,aAAa,CAAC,CAC3B;UACtB,OAAO;AACd,UAAQ,KACN,uCAAuC,IAAI,IAC3C,iBAAiB,QAAQ,MAAM,UAAU,MAC1C;AACD,SAAO;;;AAIX,SAAgB,gBAAgB,KAAqB;AACnD,KAAI,IAAI,SAAS,kBAAkB,CAAE,QAAO;AAC5C,KAAI,IAAI,SAAS,oBAAoB,CACnC,QAAO,GAAG,IAAI,QAAQ,wBAAwB,GAAG,CAAC;AACpD,QAAO,GAAG,IAAI,QAAQ,OAAO,GAAG,CAAC;;AAGnC,eAAsB,gBAAgB,KAAa,mBAA0C;CAC3F,MAAM,WAAW,gBAAgB,IAAI;CAErC,MAAM,WAAW,MAAM,MAAM,SAAS;AACtC,KAAI,CAAC,SAAS,IAAI;AAChB,UAAQ,KAAK,yBAAyB,SAAS,qBAAqB,SAAS,SAAS;AACtF;;CAIF,MAAM,WAAW,eADF,OAAO,KAAK,MAAM,SAAS,aAAa,CAAC,CACjB;AAEvC,KAAI,aAAa,kBACf,OAAM,IAAI,MACR,oCAAoC,SAAS,gBAAgB,kBAAkB,gBAAgB,WAChG;AAGH,SAAQ,IAAI,gCAAgC,WAAW;;AAGzD,IAAa,oBAAb,MAA+B;CAC7B,AAAQ,yBAAS,IAAI,KAAqB;CAE1C,SAAS,KAAa,WAAyB;AAC7C,OAAK,OAAO,IAAI,KAAK,UAAU;;CAGjC,cAAc,SAAiB,WAAyB;AACtD,OAAK,OAAO,IAAI,gBAAgB,QAAQ,EAAE,UAAU;;CAGtD,IAAI,KAAiC;AACnC,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,IAAI,KAAsB;AACxB,SAAO,KAAK,OAAO,IAAI,IAAI;;CAG7B,UAA8C;AAC5C,SAAO,KAAK,OAAO,SAAS;;;AAIhC,SAAS,uBAAuB,QAAsD;CACpF,MAAM,yBAAS,IAAI,KAAqB;CACxC,MAAM,MAAM,OAAO;CACnB,MAAM,UAAU,OAAO;AAEvB,KAAI,KACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,IAAI,CACzC,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,KAAI,SACF;OAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,CAC7C,KAAI,OAAO,aAAa,OAAO,WAC7B,QAAO,IAAI,gBAAgB,MAAM,WAAqB,EAAE,MAAM,UAAoB;;AAKxF,QAAO;;AAGT,eAAsB,yBACpB,aACA,QACsD;CACtD,MAAM,aAAuB,EAAE;CAE/B,IAAI;AACJ,KAAI;AACF,gBAAc,MAAM,yBAAkD,OAAO;UACtE,OAAO;AACd,UAAQ,KACN,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACzG;AACD,SAAO;GAAE,UAAU;GAAO,YAAY,CAAC,qBAAqB;GAAE;;CAGhE,MAAM,cAAc,uBAAuB,YAAY;CACvD,MAAM,cAAc,uBAAuB,YAAY;AAEvD,MAAK,MAAM,CAAC,KAAK,cAAc,aAAa;EAC1C,MAAM,YAAY,YAAY,IAAI,IAAI;AACtC,MAAI,aAAa,cAAc,WAAW;AACxC,cAAW,KAAK,IAAI;AACpB,WAAQ,MACN,wCAAwC,IAAI,aAAa,UAAU,aAAa,YACjF;;;AAIL,KAAI,WAAW,WAAW,KAAK,YAAY,OAAO,EAChD,SAAQ,IACN,gEAAgE,YAAY,KAAK,mBAClF;AAGH,QAAO;EAAE,UAAU,WAAW,WAAW;EAAG;EAAY"}

package/dist/mf.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_integrity = require('./integrity.cjs');
 let _module_federation_enhanced_runtime = require("@module-federation/enhanced/runtime");
 let _module_federation_runtime_core = require("@module-federation/runtime-core");
 
@@ -18,6 +19,36 @@ function patchManifestFetchForSsrPublicPath(mf) {
 		});
 	});
 }
+function installIntegrityFetchHook(mf, registry) {
+	if (!mf || !mf.loaderHook?.lifecycle?.fetch?.on) {
+		console.warn("[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline");
+		return;
+	}
+	if (mf.__everythingDevIntegrityHook === true) return;
+	mf.__everythingDevIntegrityHook = true;
+	mf.loaderHook.lifecycle.fetch.on((url, init) => {
+		if (typeof url !== "string") return;
+		const expectedHash = registry.get(url);
+		if (!expectedHash) return;
+		return fetch(url, init).then(async (res) => {
+			const buffer = Buffer.from(await res.arrayBuffer());
+			const computed = require_integrity.computeSriHash(buffer);
+			if (computed !== expectedHash) {
+				console.error(`[SRI] Integrity check failed in MF fetch pipeline for ${url}\n  Expected: ${expectedHash}\n  Computed: ${computed}`);
+				return new Response(`Integrity check failed for ${url}`, {
+					status: 500,
+					statusText: "Integrity Check Failed"
+				});
+			}
+			console.log(`[SRI] Integrity verified in pipeline for ${url}`);
+			return new Response(buffer, {
+				status: res.status,
+				statusText: res.statusText,
+				headers: res.headers
+			});
+		});
+	});
+}
 function getFederationInstance() {
 	if (mfInstance) return mfInstance;
 	const existing = (0, _module_federation_enhanced_runtime.getInstance)();
@@ -71,6 +102,7 @@ async function ensureNodeRuntimePlugin() {
 //#endregion
 exports.ensureNodeRuntimePlugin = ensureNodeRuntimePlugin;
 exports.getFederationInstance = getFederationInstance;
+exports.installIntegrityFetchHook = installIntegrityFetchHook;
 exports.loadRemoteModule = loadRemoteModule;
 exports.patchManifestFetchForSsrPublicPath = patchManifestFetchForSsrPublicPath;
 exports.registerRemote = registerRemote;

package/dist/mf.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mf.cjs","names":[],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;;AAKA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,iEAAwB;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,mEAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,sEAA4B;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,kEAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}
+{"version":3,"file":"mf.cjs","names":["computeSriHash"],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetch(url, init as any).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;;;AAMA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,MAAM,KAAK,KAAY,CAAC,KAAK,OAAO,QAAQ;GACjD,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAWA,iCAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,iEAAwB;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,mEAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,sEAA4B;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,kEAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}

package/dist/mf.d.cts

@@ -1,8 +1,10 @@
+import { IntegrityRegistry } from "./integrity.cjs";
 import { createInstance } from "@module-federation/enhanced/runtime";
 
 //#region src/mf.d.ts
 type FederationInstance = ReturnType<typeof createInstance>;
 declare function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void;
+declare function installIntegrityFetchHook(mf: FederationInstance, registry: IntegrityRegistry): void;
 declare function getFederationInstance(): FederationInstance;
 declare function registerRemote(opts: {
   name: string;
@@ -15,5 +17,5 @@ declare function loadRemoteModule<T>(specifier: string, options?: {
 }): Promise<T>;
 declare function ensureNodeRuntimePlugin(): Promise<void>;
 //#endregion
-export { ensureNodeRuntimePlugin, getFederationInstance, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
+export { ensureNodeRuntimePlugin, getFederationInstance, installIntegrityFetchHook, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
 //# sourceMappingURL=mf.d.cts.map

package/dist/mf.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"mf.d.cts","names":[],"sources":["../src/mf.ts"],"mappings":";;;KAGK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAsBvC,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}
+{"version":3,"file":"mf.d.cts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAsBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}

package/dist/mf.d.mts

@@ -1,8 +1,10 @@
+import { IntegrityRegistry } from "./integrity.mjs";
 import { createInstance } from "@module-federation/enhanced/runtime";
 
 //#region src/mf.d.ts
 type FederationInstance = ReturnType<typeof createInstance>;
 declare function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void;
+declare function installIntegrityFetchHook(mf: FederationInstance, registry: IntegrityRegistry): void;
 declare function getFederationInstance(): FederationInstance;
 declare function registerRemote(opts: {
   name: string;
@@ -15,5 +17,5 @@ declare function loadRemoteModule<T>(specifier: string, options?: {
 }): Promise<T>;
 declare function ensureNodeRuntimePlugin(): Promise<void>;
 //#endregion
-export { ensureNodeRuntimePlugin, getFederationInstance, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
+export { ensureNodeRuntimePlugin, getFederationInstance, installIntegrityFetchHook, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
 //# sourceMappingURL=mf.d.mts.map

package/dist/mf.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mf.d.mts","names":[],"sources":["../src/mf.ts"],"mappings":";;;KAGK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAsBvC,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}
+{"version":3,"file":"mf.d.mts","names":[],"sources":["../src/mf.ts"],"mappings":";;;;KAIK,kBAAA,GAAqB,UAAA,QAAkB,cAAA;AAAA,iBAI5B,kCAAA,CAAmC,EAAA,EAAI,kBAAA;AAAA,iBAsBvC,yBAAA,CACd,EAAA,EAAI,kBAAA,EACJ,QAAA,EAAU,iBAAA;AAAA,iBAuCI,qBAAA,CAAA,GAAyB,kBAAA;AAAA,iBAoBnB,cAAA,CAAe,IAAA;EACnC,IAAA;EACA,KAAA;EACA,IAAA;AAAA,IACE,OAAA;AAAA,iBAqBkB,gBAAA,GAAA,CACpB,SAAA,UACA,OAAA;EAAY,WAAA;EAAuB,IAAA;AAAA,IAClC,OAAA,CAAQ,CAAA;AAAA,iBAeW,uBAAA,CAAA,GAA2B,OAAA"}

package/dist/mf.mjs

@@ -1,3 +1,4 @@
+import { computeSriHash } from "./integrity.mjs";
 import { createInstance, getInstance } from "@module-federation/enhanced/runtime";
 import { setGlobalFederationInstance } from "@module-federation/runtime-core";
 
@@ -16,6 +17,36 @@ function patchManifestFetchForSsrPublicPath(mf) {
 		});
 	});
 }
+function installIntegrityFetchHook(mf, registry) {
+	if (!mf || !mf.loaderHook?.lifecycle?.fetch?.on) {
+		console.warn("[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline");
+		return;
+	}
+	if (mf.__everythingDevIntegrityHook === true) return;
+	mf.__everythingDevIntegrityHook = true;
+	mf.loaderHook.lifecycle.fetch.on((url, init) => {
+		if (typeof url !== "string") return;
+		const expectedHash = registry.get(url);
+		if (!expectedHash) return;
+		return fetch(url, init).then(async (res) => {
+			const buffer = Buffer.from(await res.arrayBuffer());
+			const computed = computeSriHash(buffer);
+			if (computed !== expectedHash) {
+				console.error(`[SRI] Integrity check failed in MF fetch pipeline for ${url}\n  Expected: ${expectedHash}\n  Computed: ${computed}`);
+				return new Response(`Integrity check failed for ${url}`, {
+					status: 500,
+					statusText: "Integrity Check Failed"
+				});
+			}
+			console.log(`[SRI] Integrity verified in pipeline for ${url}`);
+			return new Response(buffer, {
+				status: res.status,
+				statusText: res.statusText,
+				headers: res.headers
+			});
+		});
+	});
+}
 function getFederationInstance() {
 	if (mfInstance) return mfInstance;
 	const existing = getInstance();
@@ -67,5 +98,5 @@ async function ensureNodeRuntimePlugin() {
 }
 
 //#endregion
-export { ensureNodeRuntimePlugin, getFederationInstance, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
+export { ensureNodeRuntimePlugin, getFederationInstance, installIntegrityFetchHook, loadRemoteModule, patchManifestFetchForSsrPublicPath, registerRemote };
 //# sourceMappingURL=mf.mjs.map

package/dist/mf.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mf.mjs","names":[],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;AAKA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,WAAW,aAAa;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,8BAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,cAAa,eAAe;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,6BAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}
+{"version":3,"file":"mf.mjs","names":[],"sources":["../src/mf.ts"],"sourcesContent":["import { createInstance, getInstance } from \"@module-federation/enhanced/runtime\";\nimport { setGlobalFederationInstance } from \"@module-federation/runtime-core\";\nimport { computeSriHash, type IntegrityRegistry } from \"./integrity\";\n\ntype FederationInstance = ReturnType<typeof createInstance>;\n\nlet mfInstance: FederationInstance | null = null;\n\nexport function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) return;\n  if ((mf as any).__everythingDevPatchedManifestFetch === true) return;\n  (mf as any).__everythingDevPatchedManifestFetch = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\" || !url.endsWith(\"/mf-manifest.json\")) {\n      return;\n    }\n    return fetch(url, init as any)\n      .then((res) => res.json())\n      .then((json: any) => {\n        json.metaData = json.metaData ?? {};\n        json.metaData.ssrPublicPath =\n          json.metaData.ssrPublicPath ?? url.replace(/\\/mf-manifest\\.json$/, \"/\");\n        return new Response(JSON.stringify(json), {\n          headers: { \"content-type\": \"application/json\" },\n        });\n      });\n  });\n}\n\nexport function installIntegrityFetchHook(\n  mf: FederationInstance,\n  registry: IntegrityRegistry,\n): void {\n  if (!mf || !(mf as any).loaderHook?.lifecycle?.fetch?.on) {\n    console.warn(\"[SRI] MF lifecycle fetch hook not available, skipping integrity-in-pipeline\");\n    return;\n  }\n  if ((mf as any).__everythingDevIntegrityHook === true) return;\n  (mf as any).__everythingDevIntegrityHook = true;\n\n  (mf as any).loaderHook.lifecycle.fetch.on((url: unknown, init: unknown) => {\n    if (typeof url !== \"string\") return;\n\n    const expectedHash = registry.get(url);\n    if (!expectedHash) return;\n\n    return fetch(url, init as any).then(async (res) => {\n      const buffer = Buffer.from(await res.arrayBuffer());\n      const computed = computeSriHash(buffer);\n\n      if (computed !== expectedHash) {\n        console.error(\n          `[SRI] Integrity check failed in MF fetch pipeline for ${url}\\n  Expected: ${expectedHash}\\n  Computed: ${computed}`,\n        );\n        return new Response(`Integrity check failed for ${url}`, {\n          status: 500,\n          statusText: \"Integrity Check Failed\",\n        });\n      }\n\n      console.log(`[SRI] Integrity verified in pipeline for ${url}`);\n      return new Response(buffer, {\n        status: res.status,\n        statusText: res.statusText,\n        headers: res.headers,\n      });\n    });\n  });\n}\n\nexport function getFederationInstance(): FederationInstance {\n  if (mfInstance) return mfInstance;\n\n  const existing = getInstance();\n  if (existing) {\n    mfInstance = existing as FederationInstance;\n    setGlobalFederationInstance(mfInstance as any);\n    patchManifestFetchForSsrPublicPath(mfInstance);\n    return mfInstance;\n  }\n\n  mfInstance = createInstance({\n    name: \"host\",\n    remotes: [],\n  }) as FederationInstance;\n  setGlobalFederationInstance(mfInstance as any);\n  patchManifestFetchForSsrPublicPath(mfInstance);\n  return mfInstance;\n}\n\nexport async function registerRemote(opts: {\n  name: string;\n  entry: string;\n  type?: \"manifest\" | \"script\";\n}): Promise<void> {\n  const instance = getFederationInstance();\n\n  const inferType = (): \"manifest\" | \"script\" => {\n    if (opts.type) return opts.type;\n    if (opts.entry.endsWith(\"/mf-manifest.json\")) return \"manifest\";\n    if (opts.entry.endsWith(\"/remoteEntry.js\")) return \"script\";\n    return typeof window === \"undefined\" ? \"script\" : \"manifest\";\n  };\n\n  const remoteType = inferType();\n\n  instance.registerRemotes([\n    {\n      name: opts.name,\n      entry: opts.entry,\n      type: remoteType,\n    },\n  ]);\n}\n\nexport async function loadRemoteModule<T>(\n  specifier: string,\n  options?: { loadFactory?: boolean; from?: \"build\" | \"runtime\" },\n): Promise<T> {\n  const instance = getFederationInstance();\n\n  const isServer = typeof window === \"undefined\";\n  if (isServer) {\n    await (instance as any).initializeSharing?.(\"default\");\n  }\n\n  const mod = await instance.loadRemote<T>(specifier, options as any);\n  if (!mod) {\n    throw new Error(`Failed to load remote module: ${specifier}`);\n  }\n  return mod;\n}\n\nexport async function ensureNodeRuntimePlugin(): Promise<void> {\n  const instance = getFederationInstance();\n  if (typeof window !== \"undefined\") return;\n  if ((instance as any).__nodeRuntimePluginLoaded) return;\n\n  const mod: any = await import(\"@module-federation/node/runtimePlugin\");\n  const factory = mod?.default ?? mod;\n  const plugin = typeof factory === \"function\" ? factory() : null;\n  if (plugin) {\n    instance.registerPlugins([plugin]);\n  }\n  (instance as any).__nodeRuntimePluginLoaded = true;\n}\n"],"mappings":";;;;;AAMA,IAAI,aAAwC;AAE5C,SAAgB,mCAAmC,IAA8B;AAC/E,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,GAAI;AAC1D,KAAK,GAAW,wCAAwC,KAAM;AAC9D,CAAC,GAAW,sCAAsC;AAElD,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,SAAS,oBAAoB,CAC/D;AAEF,SAAO,MAAM,KAAK,KAAY,CAC3B,MAAM,QAAQ,IAAI,MAAM,CAAC,CACzB,MAAM,SAAc;AACnB,QAAK,WAAW,KAAK,YAAY,EAAE;AACnC,QAAK,SAAS,gBACZ,KAAK,SAAS,iBAAiB,IAAI,QAAQ,wBAAwB,IAAI;AACzE,UAAO,IAAI,SAAS,KAAK,UAAU,KAAK,EAAE,EACxC,SAAS,EAAE,gBAAgB,oBAAoB,EAChD,CAAC;IACF;GACJ;;AAGJ,SAAgB,0BACd,IACA,UACM;AACN,KAAI,CAAC,MAAM,CAAE,GAAW,YAAY,WAAW,OAAO,IAAI;AACxD,UAAQ,KAAK,8EAA8E;AAC3F;;AAEF,KAAK,GAAW,iCAAiC,KAAM;AACvD,CAAC,GAAW,+BAA+B;AAE3C,CAAC,GAAW,WAAW,UAAU,MAAM,IAAI,KAAc,SAAkB;AACzE,MAAI,OAAO,QAAQ,SAAU;EAE7B,MAAM,eAAe,SAAS,IAAI,IAAI;AACtC,MAAI,CAAC,aAAc;AAEnB,SAAO,MAAM,KAAK,KAAY,CAAC,KAAK,OAAO,QAAQ;GACjD,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,aAAa,CAAC;GACnD,MAAM,WAAW,eAAe,OAAO;AAEvC,OAAI,aAAa,cAAc;AAC7B,YAAQ,MACN,yDAAyD,IAAI,gBAAgB,aAAa,gBAAgB,WAC3G;AACD,WAAO,IAAI,SAAS,8BAA8B,OAAO;KACvD,QAAQ;KACR,YAAY;KACb,CAAC;;AAGJ,WAAQ,IAAI,4CAA4C,MAAM;AAC9D,UAAO,IAAI,SAAS,QAAQ;IAC1B,QAAQ,IAAI;IACZ,YAAY,IAAI;IAChB,SAAS,IAAI;IACd,CAAC;IACF;GACF;;AAGJ,SAAgB,wBAA4C;AAC1D,KAAI,WAAY,QAAO;CAEvB,MAAM,WAAW,aAAa;AAC9B,KAAI,UAAU;AACZ,eAAa;AACb,8BAA4B,WAAkB;AAC9C,qCAAmC,WAAW;AAC9C,SAAO;;AAGT,cAAa,eAAe;EAC1B,MAAM;EACN,SAAS,EAAE;EACZ,CAAC;AACF,6BAA4B,WAAkB;AAC9C,oCAAmC,WAAW;AAC9C,QAAO;;AAGT,eAAsB,eAAe,MAInB;CAChB,MAAM,WAAW,uBAAuB;CAExC,MAAM,kBAAyC;AAC7C,MAAI,KAAK,KAAM,QAAO,KAAK;AAC3B,MAAI,KAAK,MAAM,SAAS,oBAAoB,CAAE,QAAO;AACrD,MAAI,KAAK,MAAM,SAAS,kBAAkB,CAAE,QAAO;AACnD,SAAO,OAAO,WAAW,cAAc,WAAW;;CAGpD,MAAM,aAAa,WAAW;AAE9B,UAAS,gBAAgB,CACvB;EACE,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,MAAM;EACP,CACF,CAAC;;AAGJ,eAAsB,iBACpB,WACA,SACY;CACZ,MAAM,WAAW,uBAAuB;AAGxC,KADiB,OAAO,WAAW,YAEjC,OAAO,SAAiB,oBAAoB,UAAU;CAGxD,MAAM,MAAM,MAAM,SAAS,WAAc,WAAW,QAAe;AACnE,KAAI,CAAC,IACH,OAAM,IAAI,MAAM,iCAAiC,YAAY;AAE/D,QAAO;;AAGT,eAAsB,0BAAyC;CAC7D,MAAM,WAAW,uBAAuB;AACxC,KAAI,OAAO,WAAW,YAAa;AACnC,KAAK,SAAiB,0BAA2B;CAEjD,MAAM,MAAW,MAAM,OAAO;CAC9B,MAAM,UAAU,KAAK,WAAW;CAChC,MAAM,SAAS,OAAO,YAAY,aAAa,SAAS,GAAG;AAC3D,KAAI,OACF,UAAS,gBAAgB,CAAC,OAAO,CAAC;AAEpC,CAAC,SAAiB,4BAA4B"}