For AI agents: the complete documentation index is available at https://mfdoctor.kevinbeier.com/llms.txt, the full documentation bundle is available at https://mfdoctor.kevinbeier.com/llms-full.txt, and this page is available as Markdown at https://mfdoctor.kevinbeier.com/configuration-audit.md.
mfdoctor
  • English
  • 2.0.3

      • Configuration audit

      This page separates common Module Federation config from Vite-only controls. Use it as a review checklist even when a rule does not yet automate the check.

      Common and Core/Rspack/Rsbuild options

      OptionMain riskPractical fix
      nameRuntime/global collisionUse one stable unique name per container
      filenameMissing, unsafe, or hashed remote entryUse a stable relative .js filename (no [contenthash])
      library + remoteTypeProducer/consumer format mismatchAlign global, module, CommonJS, or script contracts
      remotesBad URL, alias, scope, or offline startupPrefer HTTPS manifest URLs; test failure recovery
      dataPrefetch / prefetch remotesPrefetch/preload misconfig can break load orderUse prefetch after lazyLoadComponentPlugin with <remote>/<expose> ids; test preloadRemote load order. Not checked automatically (no normalize field, low confidence).
      shareScopeIsolated pools cannot reuse packagesAlign top-level, remote, and item scopes
      exposesBad public key or missing sourceUse ./Name keys and exact paths
      sharedDuplicate frameworks or unsatisfied versionsAlign singleton, versions, scope, strictness, and fallback
      shared[].packagePathWrong path redirects version/singleton resolutionPoint at an existing package directory or entry file
      shared[].layer / issuerLayerWebpack layer sharing isolates share pools; host/remote mismatch duplicates modulesAlign layer and issuerLayer across webpack-family projects that declare them. Not checked automatically (SDK confirms the keys; public shared docs and Vite omit them, low confidence).
      runtimePluginsMissing plugin or unsafe recoveryResolve every plugin and test each hook path
      getPublicPathDynamic-code and asset-base riskKeep the stringified function small, static, and reviewed
      implementationRuntime/plugin version skewResolve a compatible runtime-tools implementation
      dtsMissing/stale consumer contractsGenerate types in CI and choose an explicit abort policy
      devReload/type-HMR behavior differs from buildDocument disabled reload features and test remote HMR
      manifestMissing runtime metadata or incomplete asset dataEmit it for releases; keep producer asset analysis enabled
      shareStrategyStartup cost vs late remote failurePick version-first or loaded-first intentionally
      Host/remote shareStrategy mixInconsistent shared negotiation across the graphAlign federation-wide, or document intentional exceptions
      Circular remotesNested init / type extraction can deadlockKeep the remotes graph a DAG
      Remote alias prefixesRuntime rejects alias that prefixes another nameRename aliases so none is a prefix
      Nested producer DTSMissing extracted remote types in producer archiveEnable dts.generateTypes.extractRemoteTypes (config/nested-producer-dts-extract)
      dts.generateTypes.outputDirType zip path drifts from nested filenameAlign outputDir with the remote-entry directory layout
      dts.generateTypes.compilerInstanceDefault tsc can make DTS generation the bottleneckSet "tsgo" when type generation is slow
      Direct .js remotes + DTSNo type URL without manifests/remoteTypeUrlsPrefer manifests or set remoteTypeUrls
      Non-string output.publicPathManifest generation is skipped upstreamUse a string/auto publicPath when manifests are required
      Localhost remotes in CIDeployed builds cannot reach loopback remotesUse deployed URLs for CI/production mfdoctor runs
      experiments.asyncStartupEntry exports become async; ignored on old RspackRequires Rspack > 1.7.4; await Promise consumers
      externalRuntime pairHard load-order dependencyOne pure provider; externalize only downstream browser remotes
      snapshot/remote/shared removalTree-shaken capability still usedNever disable a configured capability
      shared tree shakingIncomplete deployment unionPublish the merged secondary artifact and update snapshots
      injectTreeShakingUsedExportsConflicts with server-calcDisable it for deployment-calculated exports
      treeShakingDirNo known fallback artifact locationConfigure and publish the directory
      shared tree-shaking pluginsSecondary build misses original transformsPackage only the needed build plugins and pin versions

      Official option pages: overview, shared, DTS, dev, manifest, and experiments.

      Vite-only options

      OptionMain riskPractical fix
      publicPathBrowser assets resolve from the wrong originCompare config with emitted manifest metadata
      bundleAllCSSEvery expose receives every stylesheetKeep false unless the global style contract is deliberate
      ignoreOriginProxy entry origin behavior changesUse only with a tested deployment base (vite/ignore-origin)
      virtualModuleDirInvalid or colliding virtual module folderUse one simple directory name without slashes (vite/virtual-module-dir)
      hostInitInjectLocationHTML-less/SSR app misses initUse entry when no usable HTML transform exists
      parser timeoutsPartial dependency discoveryUse an idle timeout for large active builds
      varFilenameSync script contract differs from ESM entryLoad it through a synchronous script and test the global name
      remoteHmrDev-only remote reload is Vite-plugin-onlyKeep on Vite hosts; ignored on Enhanced / webpack-family
      targetBrowser and Node output rules mixSet the real execution environment
      ssrExternalsServer-only package gets bundledExternalize explicit Node-only dependencies
      direct capability flagsUseful runtime feature is removedMatch flags to actual remotes/shared/snapshot use

      Vite source: option normalizer and plugin integration.

      Webpack, Rspack, Rsbuild, and Modern.js ignore Vite-only keys such as virtualModuleDir, hostInitInjectLocation, bundleAllCSS, remoteHmr, and varFilename. mfdoctor reports them as config/copied-vite-options-on-webpack. There is no Rsbuild or Modern.js analogue of vite/host-init-inject-ssr until those plugins expose a public host-init inject switch, see Limitations.

      Output verification

      Config review is not enough. In CI, confirm:

      1. the configured remote entry exists;
      2. manifest name and entry metadata match config;
      3. every expose appears and has assets;
      4. manifest shared versions match the lockfile install;
      5. type metadata and archives exist when DTS is enabled;
      6. every application's project.json passes federation-wide analysis.