> For AI agents: the complete documentation index is available at https://mfdoctor.kevinbeier.com/1.0.0/llms.txt, the full documentation bundle is available at https://mfdoctor.kevinbeier.com/1.0.0/llms-full.txt.

# Rule reference

Rule pages are generated from package metadata. Each page explains the issue, impact, fix, and upstream evidence.

Browse by folder in the sidebar: Config, Shared, Artifact, Bridge, SSR, Reliability, Runtime, Runtime plugins, Federation, Performance, Vite, Security, and mfdoctor. Printed terminal `docs:` links open the same pages.

## Correctness

| Rule                                                                                                                                          | Severity | What it protects                                                                                                                                                                                                                                                       |
| --------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`artifact/expose-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/expose-missing.md)                                           | error    | The config promises an expose that the emitted manifest does not contain.                                                                                                                                                                                              |
| [`artifact/manifest-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-invalid.md)                                       | error    | The runtime and tooling cannot consume malformed or incomplete manifest JSON.                                                                                                                                                                                          |
| [`artifact/manifest-name-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-name-mismatch.md)                           | error    | Stale output can register a different container than the current config.                                                                                                                                                                                               |
| [`artifact/manifest-remote-entry-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-remote-entry-missing.md)             | error    | Consumers follow manifest metadata to a remote entry that was not emitted.                                                                                                                                                                                             |
| [`artifact/public-path-non-string-manifest`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/public-path-non-string-manifest.md)         | warning  | Module Federation skips manifest generation when bundler `output.publicPath` is not a string.                                                                                                                                                                          |
| [`artifact/public-path-suspicious`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/public-path-suspicious.md)                           | warning  | A malformed asset base makes remote chunks and styles resolve from the wrong URL.                                                                                                                                                                                      |
| [`artifact/remote-entry-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/remote-entry-missing.md)                               | error    | A producer has no executable container at its configured filename.                                                                                                                                                                                                     |
| [`bridge/lazy-plugin-unregistered`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/lazy-plugin-unregistered.md)                           | error    | Lazy Bridge React loading requires `@module-federation/bridge-react/plugin` in `runtimePlugins` or Bridge remotes fail at runtime.                                                                                                                                     |
| [`bridge/provider-shape-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/provider-shape-invalid.md)                               | error    | Incomplete `createRemoteAppComponent` / `createBridgeComponent` options omit required loader/module or root component contracts and break Bridge remotes.                                                                                                              |
| [`bridge/react-dom-prefix-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/react-dom-prefix-missing.md)                           | error    | Bridge React v18/v19 needs `react-dom/` (or `react-dom/client`) in `shared` so renderer subpaths negotiate one copy across host and remote.                                                                                                                            |
| [`bridge/react-version-entry-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/react-version-entry-mismatch.md)                   | error    | Importing `@module-federation/bridge-react/v18` against React 19 (or the reverse) selects the wrong Bridge API surface and can fail at runtime.                                                                                                                        |
| [`bridge/router-shared-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/router-shared-conflict.md)                               | error    | Bridge router aliases React Router; sharing `react-router` / `react-router-dom` at the same time can load duplicate router runtimes and break navigation.                                                                                                              |
| [`bridge/ssr-server-entry-leak`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/ssr-server-entry-leak.md)                                 | error    | Browser-only Bridge React entries must not load inside node/SSR builds; doing so leaks DOM-oriented Bridge code into the server bundle.                                                                                                                                |
| [`bridge/vue-share-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/vue-share-missing.md)                                         | error    | Vue Bridge remotes and hosts that omit `vue` (and `vue-router` when used) from `shared` can load duplicate Vue runtimes and break reactivity or routing.                                                                                                               |
| [`config/duplicate-plugin-registration`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/duplicate-plugin-registration.md)                 | error    | Registering Module Federation more than once on the same compiler breaks the core singleton contract.                                                                                                                                                                  |
| [`config/eager-tree-shaking-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/eager-tree-shaking-conflict.md)                     | error    | Eager modules live in the initial entry and cannot use the on-demand shared tree-shaking path.                                                                                                                                                                         |
| [`config/expose-key-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/expose-key-invalid.md)                                       | error    | Consumers cannot address an expose whose public key does not follow the `./Name` form.                                                                                                                                                                                 |
| [`config/expose-path-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/expose-path-missing.md)                                     | error    | The producer build cannot include a module that does not exist at the configured path.                                                                                                                                                                                 |
| [`config/external-runtime-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/external-runtime-conflict.md)                         | error    | The same build cannot externalize the runtime it is responsible for providing.                                                                                                                                                                                         |
| [`config/external-runtime-with-exposes`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/external-runtime-with-exposes.md)                 | error    | A runtime provider is only supported on a pure consumer and the upstream plugin throws otherwise.                                                                                                                                                                      |
| [`config/get-public-path-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/get-public-path-invalid.md)                             | error    | The runtime cannot evaluate an invalid stringified public-path function.                                                                                                                                                                                               |
| [`config/library-remote-type-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/library-remote-type-mismatch.md)                   | warning  | A consumer loader can fail when its remote type does not match the producer library format.                                                                                                                                                                            |
| [`config/name-required`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/name-required.md)                                                 | error    | The runtime uses the container name for global state and module lookup. Official plugins also reject a missing name at startup, so mfdoctor keeps this for offline checks rather than a showcase fixture.                                                              |
| [`config/plugin-package-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/plugin-package-mismatch.md)                             | warning  | Using the wrong integration can skip required bundler hooks and runtime generation.                                                                                                                                                                                    |
| [`config/remote-alias-prefix-collision`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-alias-prefix-collision.md)                 | error    | An alias that prefixes another remote name/alias makes multi-level path references ambiguous and is rejected by the runtime.                                                                                                                                           |
| [`config/remote-capability-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-capability-disabled.md)                       | error    | Tree-shaken remote-consumption code cannot load configured remotes.                                                                                                                                                                                                    |
| [`config/remote-entry-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-entry-invalid.md)                                   | error    | The runtime cannot resolve a remote without a usable entry or manifest address.                                                                                                                                                                                        |
| [`config/runtime-plugin-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/runtime-plugin-missing.md)                               | error    | A missing runtime plugin stops injected runtime behavior from loading.                                                                                                                                                                                                 |
| [`config/share-scope-undeclared`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/share-scope-undeclared.md)                               | error    | A dependency placed in a scope the container does not initialize cannot be reused there.                                                                                                                                                                               |
| [`config/shared-capability-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/shared-capability-disabled.md)                       | error    | Tree-shaken sharing code cannot register or consume configured shared packages.                                                                                                                                                                                        |
| [`config/transform-import-share-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/transform-import-share-conflict.md)             | warning  | transformImport (or equivalent) can rewrite packages that are also shared, bypassing or duplicating the share scope.                                                                                                                                                   |
| [`config/tree-shaking-server-calc-injection`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/tree-shaking-server-calc-injection.md)       | warning  | Runtime-injected used exports conflict with the deployment-owned `server-calc` contract.                                                                                                                                                                               |
| [`federation/external-runtime-provider-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/external-runtime-provider-missing.md) | error    | External-runtime remotes cannot start without a federation-wide provider.                                                                                                                                                                                              |
| [`federation/name-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/name-conflict.md)                                         | error    | Duplicate container names collide in runtime data and global chunk storage.                                                                                                                                                                                            |
| [`federation/share-scope-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/share-scope-mismatch.md)                           | error    | Projects in different scopes cannot reuse the same shared provider.                                                                                                                                                                                                    |
| [`federation/version-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/version-conflict.md)                                   | error    | No installed provider version satisfies every consumer range.                                                                                                                                                                                                          |
| [`runtime-plugins/invalid-factory`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime-plugins/invalid-factory.md)                           | warning  | A runtime plugin without a factory or usable `name` is ignored at runtime (silent no-op).                                                                                                                                                                              |
| [`shared/react-host-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/react-host-missing.md)                                       | warning  | A React host that loads remotes without sharing its imported React runtime can create separate React or renderer instances across the federation graph.                                                                                                                |
| [`shared/version-unsatisfied`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/version-unsatisfied.md)                                     | error    | The installed provider does not satisfy the configured consumer range.                                                                                                                                                                                                 |
| [`ssr/node-remote-manifest`](https://mfdoctor.kevinbeier.com/1.0.0/rules/ssr/node-remote-manifest.md)                                         | error    | Node/SSR consumers that load the browser `mf-manifest.json` miss the server remote graph and can fail to resolve remotes during SSR.                                                                                                                                   |
| [`ssr/node-runtime-plugin-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/ssr/node-runtime-plugin-missing.md)                           | error    | Without `@module-federation/node/runtimePlugin`, Node Federation hosts cannot load remotes with the server runtime contract.                                                                                                                                           |
| [`vite/alias-share-bypass`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/alias-share-bypass.md)                                           | warning  | resolve.alias can rewrite imports around the share scope and duplicate singleton packages.                                                                                                                                                                             |
| [`vite/host-init-inject-ssr`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/host-init-inject-ssr.md)                                       | error    | SSR and HTML-less frameworks need host init injected into the entry, not the HTML document, or federation bootstrap never runs on the server.                                                                                                                          |
| [`vite/remotes-prefer-module`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/remotes-prefer-module.md)                                     | warning  | Vite string remotes and missing/`var` type default to script-style loading. Vite↔Vite ESM remotes need explicit `type: 'module'`; mixed bundlers should declare an explicit non-default type (for example `global`) or document a `varFilename` producer interop path. |

## Reliability

| Rule                                                                                                                                                  | Severity | What it protects                                                                                                                                                                                                                                                                                                        |
| ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`artifact/dts-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/dts-disabled.md)                                                       | warning  | When a producer exposes modules but explicitly disables DTS, consumers receive no automatic checked declaration contract for those modules.                                                                                                                                                                             |
| [`artifact/manifest-assets-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-assets-disabled.md)                               | warning  | Disabled asset analysis removes shared and expose asset details from producer metadata.                                                                                                                                                                                                                                 |
| [`artifact/manifest-expose-assets-empty`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-expose-assets-empty.md)                       | warning  | Preload and debugging tools cannot map an expose to its assets.                                                                                                                                                                                                                                                         |
| [`artifact/manifest-shared-version-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-shared-version-mismatch.md)               | warning  | Stale version metadata can choose the wrong shared provider at runtime.                                                                                                                                                                                                                                                 |
| [`bridge/consumer-api-manual`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/consumer-api-manual.md)                                             | warning  | Hand-rolled `loadRemote` / remote mounts skip Bridge lifecycle helpers and lose documented loading/error contracts.                                                                                                                                                                                                     |
| [`bridge/export-app-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/export-app-missing.md)                                               | warning  | Bridge producers without `./export-app` break the conventional Bridge remote contract expected by hosts.                                                                                                                                                                                                                |
| [`bridge/missing-fallback-loading`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/missing-fallback-loading.md)                                   | warning  | Bridge remotes without `fallback`/`loading` leave consumers with a blank screen while the remote loads or fails.                                                                                                                                                                                                        |
| [`bridge/react-version-entry-prefer`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/react-version-entry-prefer.md)                               | warning  | The bare `@module-federation/bridge-react` entry can pick the wrong React Bridge API when the React major is known.                                                                                                                                                                                                     |
| [`bridge/vue-consumer-manual`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/vue-consumer-manual.md)                                             | warning  | Hand-rolled `loadRemote` mounts skip Vue Bridge lifecycle helpers and documented loading/error contracts.                                                                                                                                                                                                               |
| [`bridge/vue-server-entry`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/vue-server-entry.md)                                                   | warning  | Browser-only Vue Bridge entries in node/SSR builds miss the server/hydration contract and can leak client-only Bridge code.                                                                                                                                                                                             |
| [`bridge/vue-ssr-fresh-context`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/vue-ssr-fresh-context.md)                                         | warning  | Reusing one Vue app/router/store across SSR requests leaks request state between users.                                                                                                                                                                                                                                 |
| [`config/dts-output-dir-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/dts-output-dir-mismatch.md)                                     | warning  | A nested remote-entry `filename` that disagrees with `dts.generateTypes.outputDir` can publish type archives to the wrong path.                                                                                                                                                                                         |
| [`config/implementation-suspicious`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/implementation-suspicious.md)                                 | info     | A custom implementation can violate the runtime contract expected by the build plugin.                                                                                                                                                                                                                                  |
| [`config/remote-localhost-in-production`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-localhost-in-production.md)                       | warning  | Localhost remotes in CI/production builds cannot resolve on other machines and break deployments.                                                                                                                                                                                                                       |
| [`federation/circular-remote-graph`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/circular-remote-graph.md)                                 | warning  | A remote cycle is valid Module Federation topology by itself. mfdoctor warns only when a strongly connected group contains a `version-first` member that eagerly loads a remote during startup.                                                                                                                         |
| [`federation/missing-provider`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/missing-provider.md)                                           | error    | Every consumer disabled its fallback, so no build can provide the package.                                                                                                                                                                                                                                              |
| [`federation/share-strategy-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/share-strategy-mismatch.md)                             | warning  | Hosts and remotes that disagree on `version-first` vs `loaded-first` negotiate shared versions differently at startup.                                                                                                                                                                                                  |
| [`reliability/async-startup-library-promise`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/async-startup-library-promise.md)               | warning  | Async startup changes synchronous library entry exports into a Promise contract.                                                                                                                                                                                                                                        |
| [`reliability/external-runtime-provider-unverified`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/external-runtime-provider-unverified.md) | warning  | A remote fails if `_FEDERATION_RUNTIME_CORE` is absent or initialized too late.                                                                                                                                                                                                                                         |
| [`reliability/shared-import-false`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/shared-import-false.md)                                   | warning  | With `import: false`, no local fallback exists if another provider is missing.                                                                                                                                                                                                                                          |
| [`reliability/snapshot-capability-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/snapshot-capability-disabled.md)                 | warning  | Snapshot removal disables manifest remotes, preload, dynamic type hints, HMR, and DevTools data.                                                                                                                                                                                                                        |
| [`reliability/tree-shaking-server-calc-contract`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/tree-shaking-server-calc-contract.md)       | warning  | Server-calculated shared artifacts need a known fallback output and deployment pipeline.                                                                                                                                                                                                                                |
| [`reliability/version-first-offline-remotes`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/version-first-offline-remotes.md)               | warning  | An unavailable remote can break startup before its exposed module is requested. The `demo` policy only softens this recommendation when every remote is an explicitly known-local bare/relative entry or loopback URL during development; external, authenticated non-loopback, unknown, and CI remotes remain visible. |
| [`reliability/vite-fixed-parse-timeout`](https://mfdoctor.kevinbeier.com/1.0.0/rules/reliability/vite-fixed-parse-timeout.md)                         | info     | A busy large build can exceed a fixed timeout and produce incomplete remote/shared analysis.                                                                                                                                                                                                                            |
| [`runtime-plugins/create-script-cors-parity`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime-plugins/create-script-cors-parity.md)               | warning  | CORS on createScript without matching createLink makes preload and load use different cache keys.                                                                                                                                                                                                                       |
| [`runtime-plugins/create-script-without-link`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime-plugins/create-script-without-link.md)             | info     | A createScript hook without createLink can waste preload work when link-based loading is used.                                                                                                                                                                                                                          |
| [`runtime/error-correlated`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime/error-correlated.md)                                                 | error    | A stable RUNTIME error code from an imported browser trace was matched to offline build evidence.                                                                                                                                                                                                                       |
| [`runtime/init-failed`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime/init-failed.md)                                                           | error    | Container initialization failed before exposes or shared resolution could finish.                                                                                                                                                                                                                                       |
| [`runtime/remote-load-failed`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime/remote-load-failed.md)                                             | error    | A browser Observability trace failed while loading a remote manifest, entry, expose, or factory.                                                                                                                                                                                                                        |
| [`runtime/shared-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime/shared-mismatch.md)                                                   | error    | Runtime shared selection conflicts with installed versions, required ranges, or provider config.                                                                                                                                                                                                                        |
| [`shared/singleton-mismatch`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/singleton-mismatch.md)                                               | warning  | Projects disagree on whether multiple instances are allowed.                                                                                                                                                                                                                                                            |
| [`shared/singleton-risk`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/singleton-risk.md)                                                       | warning  | Multiple framework runtimes can split global state, contexts, hooks, or renderers.                                                                                                                                                                                                                                      |
| [`ssr/node-library-dts`](https://mfdoctor.kevinbeier.com/1.0.0/rules/ssr/node-library-dts.md)                                                         | warning  | Node/SSR producers that keep ESM-style `library.type` or enabled `dts` diverge from the commonjs dual-env contract used by server remotes.                                                                                                                                                                              |
| [`vite/hashed-remote-filename`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/hashed-remote-filename.md)                                           | warning  | Hashed remote entry filenames invalidate consumer URLs whenever the producer rebuilds.                                                                                                                                                                                                                                  |
| [`vite/manual-chunks-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/manual-chunks-conflict.md)                                           | info     | Custom manualChunks / codeSplitting.groups can fight federation bootstrap chunk ownership and create init-order cycles. This is an advisory signal because static config cannot prove a runtime cycle for every framework.                                                                                              |
| [`vite/server-origin`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/server-origin.md)                                                             | info     | Without `server.origin`, remote consumers may resolve assets against the wrong public origin in development.                                                                                                                                                                                                            |
| [`vite/ssr-nitro-externals`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/ssr-nitro-externals.md)                                                 | warning  | Shared React (or react-dom) can conflict with Nitro/SSR externals and `ssrEntryLoader` when the server expects a different module instance.                                                                                                                                                                             |

## Performance

| Rule                                                                                                                    | Severity | What it protects                                                                                                                                                                                                                                                                                   |
| ----------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`federation/ghost-shares`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/ghost-shares.md)                     | info     | A package is declared in `shared` by only one project and is unused elsewhere in the federation graph, creating one-sided version coupling.                                                                                                                                                        |
| [`federation/host-gaps`](https://mfdoctor.kevinbeier.com/1.0.0/rules/federation/host-gaps.md)                           | warning  | A package used by two or more federation projects is missing from every `shared` config, so each app may bundle its own copy.                                                                                                                                                                      |
| [`performance/asset-budget`](https://mfdoctor.kevinbeier.com/1.0.0/rules/performance/asset-budget.md)                   | warning  | Federation assets that exceed project budgets slow startup and transfer more bytes than planned. Overlapping manifest groups are merged before the comparison so one physical asset is not counted twice.                                                                                          |
| [`performance/version-first-startup`](https://mfdoctor.kevinbeier.com/1.0.0/rules/performance/version-first-startup.md) | info     | `version-first` loads all remote entries during initialization, adding startup work.                                                                                                                                                                                                               |
| [`performance/vite-bundle-all-css`](https://mfdoctor.kevinbeier.com/1.0.0/rules/performance/vite-bundle-all-css.md)     | warning  | Vite attaches all bundle CSS to every expose, which can duplicate transfer and style work.                                                                                                                                                                                                         |
| [`shared/candidate`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/candidate.md)                                   | info     | A stateful framework dependency may be bundled separately by host and remote.                                                                                                                                                                                                                      |
| [`shared/deep-import-bypass`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/deep-import-bypass.md)                 | warning  | Subpath imports bypass Module Federation shared-scope negotiation when only the root package is declared in `shared`, so each microfrontend may bundle its own copy.                                                                                                                               |
| [`shared/eager-without-singleton`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/eager-without-singleton.md)       | warning  | An eager non-singleton can add copies to initial chunks without guaranteeing reuse.                                                                                                                                                                                                                |
| [`shared/prefix-share-recommended`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/prefix-share-recommended.md)     | info     | Observed `react/...` or `react-dom/...` imports are not covered by the root shared key, so framework subpaths can bypass shared-scope negotiation and create duplicate renderer/runtime modules. Bridge projects use the focused `bridge/react-dom-prefix-missing` contract instead of this nudge. |
| [`shared/unused`](https://mfdoctor.kevinbeier.com/1.0.0/rules/shared/unused.md)                                         | warning  | Unused shared declarations add runtime bookkeeping and can signal stale config.                                                                                                                                                                                                                    |

## Security

| Rule                                                                                                                            | Severity | What it protects                                                                         |
| ------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------- |
| [`config/filename-invalid`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/filename-invalid.md)                             | error    | Unsafe paths can escape output layout; a non-JavaScript entry cannot run as a container. |
| [`config/remote-http-insecure`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-http-insecure.md)                     | warning  | Remote code fetched over plain HTTP can be changed in transit.                           |
| [`security/get-public-path-dynamic-code`](https://mfdoctor.kevinbeier.com/1.0.0/rules/security/get-public-path-dynamic-code.md) | warning  | Module Federation evaluates this string with `new Function` in the consumer.             |

## Tooling

| Rule                                                                                                                                | Severity | What it protects                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ----------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`artifact/manifest-disabled`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/manifest-disabled.md)                           | warning  | When a project has exposes or remotes but explicitly disables manifests, consumers lose metadata-powered preloading, dynamic type hints, and richer inspection. mfdoctor reports this as one warning rather than treating the deliberately disabled manifest as generic partial analysis.                                                                                                                                                                                                                                                                                                                                                                                         |
| [`artifact/types-metadata-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/types-metadata-missing.md)                 | warning  | The manifest cannot advertise generated type archives to consumers.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| [`artifact/types-missing`](https://mfdoctor.kevinbeier.com/1.0.0/rules/artifact/types-missing.md)                                   | warning  | No emitted declaration artifact was found for a typed producer.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| [`bridge/disable-alias-deprecated`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/disable-alias-deprecated.md)                 | info     | `bridge.disableAlias` is a deprecated escape hatch; explicit `enableBridgeRouter` communicates intent clearly.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| [`bridge/router-implicit-enable`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/router-implicit-enable.md)                     | info     | Rspack may auto-enable Bridge router when the Bridge package is present; leaving `bridge.enableBridgeRouter` implicit hides the routing contract from reviewers and CI.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| [`bridge/ssr-instanceid-hydration`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/ssr-instanceid-hydration.md)                 | info     | Without a stable `bridge.instanceId`, SSR Bridge hydration registries can collide across requests.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| [`bridge/tanstack-router-conflict`](https://mfdoctor.kevinbeier.com/1.0.0/rules/bridge/tanstack-router-conflict.md)                 | info     | Bridge router aliasing plus `@tanstack/react-router` can duplicate navigation ownership in one app.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| [`config/get-public-path-unused`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/get-public-path-unused.md)                     | info     | `getPublicPath` has no effect on a consumer that exposes no modules.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| [`config/observability-plugin-recommended`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/observability-plugin-recommended.md) | info     | Module Federation 2.5+ projects can opt into runtime health correlation, but a declared Observability Plugin is ineffective until its runtime entry is registered. The default nudge requires the package to be present; the production profile can recommend it for every supported federated surface.                                                                                                                                                                                                                                                                                                                                                                           |
| [`config/remote-manifest-recommended`](https://mfdoctor.kevinbeier.com/1.0.0/rules/config/remote-manifest-recommended.md)           | info     | A direct remote entry lacks manifest-powered type hints, preloading data, and richer DevTools data. The `demo` policy only softens this recommendation for explicitly known-local bare/relative entries or loopback URLs during development; external, authenticated non-loopback, unknown, and CI remotes remain visible.                                                                                                                                                                                                                                                                                                                                                        |
| [`doctor/partial-analysis`](https://mfdoctor.kevinbeier.com/1.0.0/rules/doctor/partial-analysis.md)                                 | warning  | Missing facts, unresolved dynamic imports, unreadable source files recorded in `imports.sourceReadFailures`, budget-limited persisted projects, or omitted workspace projects reduce confidence and can hide relevant findings. Source read failures make project or workspace input `unknown`; a pure analysis-budget cutoff is `partial`. Incomplete workspace evidence suppresses absence-based federation rules (`host-gaps`, `ghost-shares`, `missing-provider`, and `external-runtime-provider-missing`) while positive mismatches remain useful. Package-capable unresolved dynamics suppress workspace absence certainty without changing the ordinary project exit code. |
| [`runtime/remote-unknown`](https://mfdoctor.kevinbeier.com/1.0.0/rules/runtime/remote-unknown.md)                                   | warning  | The trace names a remote that is absent from loaded mfdoctor project facts.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| [`vite/remote-hmr-dev`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/remote-hmr-dev.md)                                         | info     | Without `remoteHmr`, local Vite remotes miss cross-container hot updates.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| [`vite/var-filename-interop`](https://mfdoctor.kevinbeier.com/1.0.0/rules/vite/var-filename-interop.md)                             | info     | `varFilename` emits an additional global-format remote entry so var hosts (webpack/rspack) can load this Vite producer.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
