feat: federation manifest, inspection and doctor commands

[gedu]

The problem

host and remotes live in separate repos, get upgraded at different times, and nothing checks that shared versions still agree. A package bumped on one side, or a native module only the host ships, shows up as a crash in production.

This is the first piece of tooling for that: at build time, Re.Pack can emit a JSON file describing what the container actually contains. Each repo emits its own manifest next to its container bundle, so for a host consuming a remote from another repo, the other side's manifest is just a fetch away from the same origin.

Two commands consume it:

• npx react-native federation-manifest reads a manifest from a file, a build directory or a URL
• npx react-native federation-doctor compares a host against its remotes and fails with a non-zero exit code on shared version drift, singleton/eager mismatches, or native modules a remote uses that the host does not list, so it can gate a release pipeline

I landed emission and the consumers together so there is something runnable in the first review, rather than a file format on its own.

• Opt-in: adding manifest: true to either plugin

[vercel]

@gedu is attempting to deploy a commit to the Callstack Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: c5df67f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@callstack/repack	Minor
@callstack/repack-plugin-expo-modules	Minor
@callstack/repack-plugin-nativewind	Minor
@callstack/repack-plugin-reanimated	Minor
@callstack/repack-dev-server	Minor
@callstack/repack-init	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[gedu]

Heads-up: I pushed one extra commit here, c5df67f0, that changes a doctor behavior you may want to glance at.

Shared eager mismatches where the host is eager and the remote is lazy (host: true / remote: false) used to fail the run as an EAGER_MISMATCH error. In practice that pattern is the Module Federation convention, not a bug: hosts ship shared deps eagerly, federated remotes load them lazily, and a healthy workspace hits this on every dep every time. Erroring on it makes the doctor useless as a CI gate.

That conventional direction now reports as EAGER_ADVISORY at warning severity, so the run exits 0 on it alone. The reverse case (host lazy, remote eager) and any other mismatch keep the exact same EAGER_MISMATCH code, severity, and message text as before, so anything scraping codes in CI is unaffected — EAGER_MISMATCH still only ever means error. The advisory got a new code instead of a severity change under the old one for that reason.

Tests pin both directions, including the byte-identical legacy message for the error case.

[dannyhw]

hey thanks for the pr, I haven't had a chance to get to this yet but I will soon. Thanks for your patience 🙏