#Rule reference
Rule pages are generated from package metadata. Each page explains the issue, impact, fix, and upstream evidence.
Browse by folder in the sidebar: Config, Shared, Artifact, Bridge, SSR, Reliability, Runtime, Runtime plugins, Federation, Performance, Vite, Security, and MFDoctor. Printed terminal docs: links open the same pages.
#Correctness
| Rule | Severity | What it protects |
|---|---|---|
artifact/expose-missing | error | The config promises an expose that the emitted manifest does not contain. |
artifact/manifest-invalid | error | The runtime and tooling cannot consume malformed or incomplete manifest JSON. |
artifact/manifest-name-mismatch | error | Stale output can register a different container than the current config. |
artifact/manifest-remote-entry-missing | error | Consumers follow manifest metadata to a remote entry that was not emitted. |
artifact/public-path-non-string-manifest | warning | Module Federation skips manifest generation when bundler output.publicPath is not a string. |
artifact/public-path-suspicious | warning | A malformed asset base makes remote chunks and styles resolve from the wrong URL. |
artifact/react-dom-server-in-web | error | react-dom/server (and related server entries) in a web/client Module Federation bundle crash or mis-target the browser runtime — a common MF/SSR boundary failure. |
artifact/remote-entry-missing | error | A producer has no executable container at its configured filename. |
bridge/lazy-plugin-unregistered | error | Lazy Bridge React loading requires @module-federation/bridge-react/plugin in runtimePlugins or Bridge remotes fail at runtime. |
bridge/provider-shape-invalid | error | Incomplete createRemoteAppComponent / createBridgeComponent options omit required loader/module or root component contracts and break Bridge remotes. |
bridge/react-dom-prefix-missing | error | Bridge React v18/v19 needs react-dom/ (or react-dom/client) in shared so renderer subpaths negotiate one copy across host and remote. |
bridge/react-version-entry-mismatch | error | Importing @module-federation/bridge-react/v18 against React 19 (or the reverse) selects the wrong Bridge API surface and can fail at runtime. |
bridge/router-shared-conflict | error | Bridge router aliases React Router; sharing react-router / react-router-dom at the same time can load duplicate router runtimes and break navigation. |
bridge/ssr-server-entry-leak | error | Browser-only Bridge React entries must not load inside node/SSR builds; doing so leaks DOM-oriented Bridge code into the server bundle. |
bridge/vue-share-missing | error | Vue Bridge remotes and hosts that omit vue (and vue-router when used) from shared can load duplicate Vue runtimes and break reactivity or routing. |
config/async-boundary-missing | error | A host entry that synchronously imports non-eager shared packages can hit RUNTIME-005 (loadShareSync) because Module Federation needs an async boundary before shared negotiation finishes. |
config/copied-webpack-options-on-vite | warning | Webpack ModuleFederationPlugin-only options pasted onto @module-federation/vite are ignored or misinterpreted, which leads to silent mis-shares or runtime crashes after a webpack-to-Vite migration. |
config/duplicate-plugin-registration | error | Registering Module Federation more than once on the same compiler breaks the core singleton contract. |
config/eager-tree-shaking-conflict | error | Eager modules live in the initial entry and cannot use the on-demand shared tree-shaking path. |
config/expose-key-invalid | error | Consumers cannot address an expose whose public key does not follow the ./Name form. |
config/expose-path-missing | error | The producer build cannot include a module that does not exist at the configured path. |
config/external-runtime-conflict | error | The same build cannot externalize the runtime it is responsible for providing. |
config/external-runtime-with-exposes | error | A runtime provider is only supported on a pure consumer and the upstream plugin throws otherwise. |
config/get-public-path-invalid | error | The runtime cannot evaluate an invalid stringified public-path function. |
config/library-remote-type-mismatch | warning | A consumer loader can fail when its remote type does not match the producer library format. |
config/name-required | error | The runtime uses the container name for global state and module lookup. Official plugins also reject a missing name at startup, so MFDoctor keeps this for offline checks rather than a showcase fixture. |
config/plugin-package-mismatch | warning | Using the wrong integration can skip required bundler hooks and runtime generation. |
config/remote-alias-prefix-collision | error | An alias that prefixes another remote name/alias makes multi-level path references ambiguous and is rejected by the runtime. |
config/remote-capability-disabled | error | Tree-shaken remote-consumption code cannot load configured remotes. |
config/remote-entry-invalid | error | The runtime cannot resolve a remote without a usable entry or manifest address. |
config/runtime-plugin-missing | error | A missing runtime plugin stops injected runtime behavior from loading. |
config/share-scope-undeclared | error | A dependency placed in a scope the container does not initialize cannot be reused there. |
config/shared-capability-disabled | error | Tree-shaken sharing code cannot register or consume configured shared packages. |
config/transform-import-share-conflict | warning | transformImport (or equivalent) can rewrite packages that are also shared, bypassing or duplicating the share scope. |
config/tree-shaking-server-calc-injection | warning | Runtime-injected used exports conflict with the deployment-owned server-calc contract. |
federation/external-runtime-provider-missing | error | External-runtime remotes cannot start without a federation-wide provider. |
federation/name-conflict | error | Duplicate container names collide in runtime data and global chunk storage. |
federation/share-scope-mismatch | error | Projects in different scopes cannot reuse the same shared provider. |
federation/version-conflict | error | No installed provider version satisfies every consumer range. |
runtime-plugins/invalid-factory | warning | A runtime plugin without a factory or usable name is ignored at runtime (silent no-op). |
shared/react-host-missing | warning | A React host that loads remotes without sharing its imported React runtime can create separate React or renderer instances across the federation graph. |
shared/subpath-version-unresolved | error | On Vite, prefix and package-subpath shared keys inherit provider version from the parent package. When that resolution fails, the shared entry ships with version: undefined, which breaks singleton / requiredVersion matching and can crash remotes that expect the host to provide the share. |
shared/version-unsatisfied | error | The installed provider does not satisfy the configured consumer range. |
ssr/node-remote-manifest | error | Node/SSR consumers that load the browser mf-manifest.json miss the server remote graph and can fail to resolve remotes during SSR. |
ssr/node-runtime-plugin-missing | error | Without @module-federation/node/runtimePlugin, Node Federation hosts cannot load remotes with the server runtime contract. |
vite/alias-share-bypass | warning | resolve.alias can rewrite imports around the share scope and duplicate singleton packages. |
vite/host-init-inject-ssr | error | SSR and HTML-less frameworks need host init injected into the entry, not the HTML document, or federation bootstrap never runs on the server. |
vite/remotes-prefer-module | warning | Vite string remotes and missing/var type default to script-style loading. Vite↔Vite ESM remotes need explicit type: 'module'; mixed bundlers should declare an explicit non-default type (for example global) or document a varFilename producer interop path. |
#Reliability
| Rule | Severity | What it protects |
|---|---|---|
artifact/dts-disabled | warning | When a producer exposes modules but explicitly disables DTS, consumers receive no automatic checked declaration contract for those modules. |
artifact/manifest-assets-disabled | warning | Disabled asset analysis removes shared and expose asset details from producer metadata. |
artifact/manifest-expose-assets-empty | warning | Preload and debugging tools cannot map an expose to its assets. |
artifact/manifest-shared-version-mismatch | warning | Stale version metadata can choose the wrong shared provider at runtime. |
bridge/consumer-api-manual | warning | Hand-rolled loadRemote / remote mounts skip Bridge lifecycle helpers and lose documented loading/error contracts. |
bridge/export-app-missing | warning | Bridge producers without ./export-app break the conventional Bridge remote contract expected by hosts. |
bridge/missing-fallback-loading | warning | Bridge remotes without fallback/loading leave consumers with a blank screen while the remote loads or fails. |
bridge/react-version-entry-prefer | warning | The bare @module-federation/bridge-react entry can pick the wrong React Bridge API when the React major is known. |
bridge/vue-consumer-manual | warning | Hand-rolled loadRemote mounts skip Vue Bridge lifecycle helpers and documented loading/error contracts. |
bridge/vue-server-entry | warning | Browser-only Vue Bridge entries in node/SSR builds miss the server/hydration contract and can leak client-only Bridge code. |
bridge/vue-ssr-fresh-context | warning | Reusing one Vue app/router/store across SSR requests leaks request state between users. |
config/dts-output-dir-mismatch | warning | A nested remote-entry filename that disagrees with dts.generateTypes.outputDir can publish type archives to the wrong path. |
config/implementation-suspicious | info | A custom implementation can violate the runtime contract expected by the build plugin. |
config/remote-localhost-in-production | warning | Localhost remotes in CI/production builds cannot resolve on other machines and break deployments. |
federation/circular-remote-graph | warning | A remote cycle is valid Module Federation topology by itself. MFDoctor warns only when a strongly connected group contains a version-first member that eagerly loads a remote during startup. |
federation/missing-provider | error | Workspace evidence shows consumers disabled their fallback and no build provides the package. A lone import: false without sibling absence proof is reliability/shared-import-false instead. |
federation/share-strategy-mismatch | warning | Hosts and remotes that disagree on version-first vs loaded-first negotiate shared versions differently at startup. |
reliability/async-startup-library-promise | warning | Async startup changes synchronous library entry exports into a Promise contract. |
reliability/external-runtime-provider-unverified | warning | A remote fails if _FEDERATION_RUNTIME_CORE is absent or initialized too late. |
reliability/shared-import-false | warning | With import: false, a federation participant has no local fallback if another provider is missing. When workspace evidence shows no provider at all, federation/missing-provider owns that finding instead. |
reliability/snapshot-capability-disabled | warning | Snapshot removal disables manifest remotes, preload, dynamic type hints, HMR, and DevTools data. |
reliability/tree-shaking-server-calc-contract | warning | Server-calculated shared artifacts need a known fallback output and deployment pipeline. |
reliability/version-first-offline-remotes | warning | An unavailable remote can break startup before its exposed module is requested. The demo policy only softens this recommendation when every remote is an explicitly known-local bare/relative entry or loopback URL during development; external, authenticated non-loopback, unknown, and CI remotes remain visible. |
reliability/vite-fixed-parse-timeout | info | A busy large build can exceed a fixed timeout and produce incomplete remote/shared analysis. |
runtime-plugins/create-script-cors-parity | warning | CORS on createScript without matching createLink makes preload and load use different cache keys. |
runtime-plugins/create-script-without-link | info | A createScript hook without createLink can waste preload work when link-based loading is used. |
runtime/error-correlated | error | A stable RUNTIME error code from an imported browser trace was matched to offline build evidence. |
runtime/init-failed | error | Container initialization failed before exposes or shared resolution could finish. |
runtime/remote-load-failed | error | A browser Observability trace failed while loading a remote manifest, entry, expose, or factory. |
runtime/shared-mismatch | error | Runtime shared selection conflicts with installed versions, required ranges, or provider config. |
shared/singleton-mismatch | warning | Projects disagree on whether multiple instances are allowed. |
shared/singleton-risk | warning | Multiple framework runtimes can split global state, contexts, hooks, or renderers. |
ssr/node-library-dts | warning | Node/SSR producers that keep ESM-style library.type or enabled dts diverge from the commonjs dual-env contract used by server remotes. |
vite/hashed-remote-filename | warning | Hashed remote entry filenames invalidate consumer URLs whenever the producer rebuilds. |
vite/manual-chunks-conflict | info | Custom manualChunks / codeSplitting.groups can fight federation bootstrap chunk ownership and create init-order cycles. This is an advisory signal because static config cannot prove a runtime cycle for every framework. |
vite/server-origin | info | Without server.origin, remote consumers may resolve assets against the wrong public origin in development. |
vite/ssr-nitro-externals | warning | Shared React (or react-dom) can conflict with Nitro/SSR externals and ssrEntryLoader when the server expects a different module instance. |
#Performance
| Rule | Severity | What it protects |
|---|---|---|
federation/ghost-shares | info | A package is declared in shared by only one project and is unused elsewhere in the federation graph, creating one-sided version coupling. |
federation/host-gaps | warning | A package used by two or more federation projects is missing from every shared config, so each app may bundle its own copy. |
performance/asset-budget | warning | Federation assets that exceed project budgets slow startup and transfer more bytes than planned. Overlapping manifest groups are merged before the comparison so one physical asset is not counted twice. |
performance/version-first-startup | info | version-first loads all remote entries during initialization, adding startup work. |
performance/vite-bundle-all-css | warning | Vite attaches all bundle CSS to every expose, which can duplicate transfer and style work. |
shared/candidate | info | A stateful framework dependency may be bundled separately by host and remote. |
shared/deep-import-bypass | warning | Subpath imports bypass Module Federation shared-scope negotiation when only the root package is declared in shared, so each microfrontend may bundle its own copy. |
shared/eager-without-singleton | warning | An eager non-singleton can add copies to initial chunks without guaranteeing reuse. |
shared/prefix-share-recommended | error | Observed react/... or react-dom/... imports are not covered by the root shared key, so framework subpaths can bypass shared-scope negotiation and create duplicate renderer/runtime modules. Bridge projects use the focused bridge/react-dom-prefix-missing contract instead of this rule. |
shared/unused | warning | Unused shared declarations add runtime bookkeeping and can signal stale config. |
#Security
| Rule | Severity | What it protects |
|---|---|---|
config/filename-invalid | error | Unsafe paths can escape output layout; a non-JavaScript entry cannot run as a container. |
config/remote-http-insecure | warning | Remote code fetched over plain HTTP can be changed in transit. |
security/get-public-path-dynamic-code | warning | Module Federation evaluates this string with new Function in the consumer. |
#Tooling
| Rule | Severity | What it protects |
|---|---|---|
artifact/manifest-disabled | warning | When a project has exposes or remotes but explicitly disables manifests, consumers lose metadata-powered preloading, dynamic type hints, and richer inspection. MFDoctor reports this as one warning rather than treating the deliberately disabled manifest as generic partial analysis. |
artifact/types-metadata-missing | warning | The manifest cannot advertise generated type archives to consumers. |
artifact/types-missing | warning | No emitted declaration artifact was found for a typed producer. |
bridge/disable-alias-deprecated | info | bridge.disableAlias is a deprecated escape hatch; explicit enableBridgeRouter communicates intent clearly. |
bridge/router-implicit-enable | info | Rspack may auto-enable Bridge router when the Bridge package is present; leaving bridge.enableBridgeRouter implicit hides the routing contract from reviewers and CI. |
bridge/ssr-instanceid-hydration | info | Without a stable bridge.instanceId, SSR Bridge hydration registries can collide across requests. |
bridge/tanstack-router-conflict | info | Bridge router aliasing plus @tanstack/react-router can duplicate navigation ownership in one app. |
config/get-public-path-unused | info | getPublicPath has no effect on a consumer that exposes no modules. |
config/observability-plugin-recommended | info | Module Federation 2.5+ projects can opt into runtime health correlation, but a declared Observability Plugin is ineffective until its runtime entry is registered. The default nudge requires the package to be present; the production profile can recommend it for every supported federated surface. |
config/remote-manifest-recommended | info | A direct remote entry lacks manifest-powered type hints, preloading data, and richer DevTools data. The demo policy only softens this recommendation for explicitly known-local bare/relative entries or loopback URLs during development; external, authenticated non-loopback, unknown, and CI remotes remain visible. |
doctor/partial-analysis | warning | Missing facts, unresolved dynamic imports, unreadable source files recorded in imports.sourceReadFailures, budget-limited persisted projects, or omitted workspace projects reduce confidence and can hide relevant findings. Source read failures make project or workspace input unknown; a pure analysis-budget cutoff is partial. Incomplete workspace evidence suppresses absence-based federation rules (host-gaps, ghost-shares, missing-provider, and external-runtime-provider-missing) while positive mismatches remain useful. Package-capable unresolved dynamics suppress workspace absence certainty without changing the ordinary project exit code. |
runtime/remote-unknown | warning | The trace names a remote that is absent from loaded MFDoctor project facts. |
vite/remote-hmr-dev | info | Without remoteHmr, local Vite remotes miss cross-container hot updates. |
vite/var-filename-interop | info | varFilename emits an additional global-format remote entry so var hosts (webpack/rspack) can load this Vite producer. |