@bleedingdev/modern-js-plugin-bff-extensions 3.9.0-ultramodern.1 → 3.9.0-ultramodern.10

package/src/backend-federation-manifest/metadata.ts

@@ -3,7 +3,7 @@
 import {
   backendFederationMetadata as sharedBackendFederationMetadata,
   backendFederationVersionBoundary as sharedBackendFederationVersionBoundary,
-} from '@modern-js/utils/universal';
+} from '@modern-js/backend-federation-contracts';
 import type { BackendFederationManifest } from './types';
 
 export function stringValue(value: unknown) {
@@ -56,12 +56,6 @@ export function deliveryUnitMetadata(
   return recordField(record, 'deliveryUnit');
 }
 
-/**
- * Resolves the delivery-unit identity root for a manifest (ADR-0019 §3):
- * prefers `versionBoundary.deliveryUnit`, falls back to the top-level
- * `backendFederation.deliveryUnit` record. Both are additive/optional so
- * legacy manifests without delivery-unit metadata continue to validate.
- */
 export function manifestDeliveryUnit(
   backendFederation: Record<string, unknown> | undefined,
   boundary: Record<string, unknown> | undefined,

package/src/backend-federation-manifest/remote.ts

@@ -1,10 +1,10 @@
 // @effect-diagnostics asyncFunction:off extendsNativeError:off globalTimers:off newPromise:off strictBooleanExpressions:off
 
+import { backendFederationExposeNames } from '@modern-js/backend-federation-contracts';
 import {
   BackendFederationRemoteEntryError,
   resolveBackendFederationRemoteEntryVerification,
 } from '@modern-js/server-runtime-extensions/backend-federation-security';
-import { backendFederationExposeNames } from '@modern-js/utils/universal';
 import {
   BACKEND_FEDERATION_EFFECT_EXPOSE,
   type BackendFederationRemote,

package/src/backend-federation-manifest/validation.ts

@@ -3,7 +3,7 @@
 import {
   formatBackendFederationValidationErrors,
   validateBackendFederationManifest as validateBackendFederationManifestContract,
-} from '@modern-js/utils/universal';
+} from '@modern-js/backend-federation-contracts';
 import {
   BACKEND_FEDERATION_CONTRACT_VERSION,
   BACKEND_FEDERATION_NODE_ADAPTER_VERSION,
@@ -48,11 +48,6 @@ function resolveExpectedBuildMarker(
     );
   }
 
-  // Intentionally no fallback to `buildVersion` here: this is only used to
-  // compare against manifest `deliveryUnit.buildMarker`, which is a
-  // separate, additive field. Callers that only pass `buildVersion` (the
-  // pre-ADR-0019 expectation shape) must not be forced to also match a
-  // delivery-unit build marker on the manifest.
   return expected.buildMarker;
 }
 
@@ -70,7 +65,6 @@ export function validateBackendFederationManifest(
   const manifestShape = validateBackendFederationManifestContract(manifest, {
     expectedContractVersion: false,
     expectedNodeAdapterVersion: false,
-    validateDeliveryUnit: false,
   });
   assertManifestAdapter(
     manifestShape.ok,
@@ -151,6 +145,11 @@ export function validateBackendFederationManifest(
   const manifestUnitId =
     stringValue(deliveryUnit.boundary?.unitId) ??
     stringValue(deliveryUnit.top?.unitId);
+  assertManifestAdapter(
+    manifestUnitId && stringValue(deliveryUnit.boundary?.buildMarker),
+    'manifest_invalid',
+    'Backend federation manifest requires delivery-unit unitId and buildMarker.',
+  );
   assertVersionValue(manifestUnitId, expected.unitId, 'deliveryUnit.unitId');
   assertVersionValue(
     stringValue(deliveryUnit.boundary?.buildMarker),
@@ -214,16 +213,14 @@ export function validateLoadedBackendFederationContract(
     stringValue(deliveryUnit.top?.unitId);
   const manifestBuildMarker = stringValue(deliveryUnit.boundary?.buildMarker);
 
-  // Only enforced when both sides declare the field: absence on either side
-  // is a legacy manifest/expose and must stay backward compatible.
-  assertConsistentValue(
-    manifestUnitId,
+  assertVersionValue(
     stringValue(compatibility.unitId),
+    manifestUnitId,
     'deliveryUnit.unitId vs expose compatibility.unitId',
   );
-  assertConsistentValue(
-    manifestBuildMarker,
+  assertVersionValue(
     stringValue(compatibility.build),
+    manifestBuildMarker,
     'deliveryUnit.buildMarker vs expose compatibility.build',
   );
 }

package/src/cross-project-policy/evaluation.ts

@@ -3,7 +3,7 @@ import {
   evaluateCrossProjectPolicy,
   type NormalizedCrossProjectPolicy,
   resolveCrossProjectRequestObservation,
-} from '@modern-js/bff-core/security/cross-project-policy';
+} from '@modern-js/server-runtime-extensions/bff-policy';
 
 export type ResolvedCrossProjectPolicy = NormalizedCrossProjectPolicy;
 

package/src/cross-project-policy/node.ts

@@ -1,12 +1,12 @@
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
-
+import '@modern-js/server-runtime-extensions/server-config';
+import type { ServerPluginAPI } from '@modern-js/server-core';
 import {
   deriveOperationVersion,
   type OperationContractSource,
   resolveCrossProjectPolicy,
-} from '@modern-js/bff-core';
-import type { ServerPluginAPI } from '@modern-js/server-core';
+} from '@modern-js/server-runtime-extensions/bff-policy/node';
 
 import type { ResolvedCrossProjectPolicy } from './evaluation';
 

package/src/cross-project-policy/producer-runtime.ts

@@ -0,0 +1,43 @@
+interface ProducerClientOptions {
+  requestId?: string;
+  requireEnvelope?: boolean;
+  identityBinding?: {
+    enabled?: boolean;
+    strict?: boolean;
+    protectedHeaders?: string[];
+  };
+  operationContract?: {
+    enabled?: boolean;
+    strict?: boolean;
+    requireSchemaHash?: boolean;
+    requireOperationVersion?: boolean;
+  };
+}
+
+/** Bind producer defaults once while preserving every per-call nested override. */
+export function createProducerClient<
+  Options extends ProducerClientOptions,
+  Result,
+>(
+  configure: (options: Options) => Result,
+  { requestId }: { requestId: string },
+) {
+  return (options?: Options): Result =>
+    configure({
+      requestId,
+      requireEnvelope: true,
+      ...options,
+      identityBinding: {
+        enabled: true,
+        strict: true,
+        ...options?.identityBinding,
+      },
+      operationContract: {
+        enabled: true,
+        strict: true,
+        requireSchemaHash: true,
+        requireOperationVersion: true,
+        ...options?.operationContract,
+      },
+    } as Options);
+}

package/src/effect-adapter/entry.ts

@@ -1,6 +1,7 @@
 // @effect-diagnostics nodeBuiltinImport:off strictBooleanExpressions:off
 
 import path from 'node:path';
+import '@modern-js/server-runtime-extensions/server-config';
 import type { ServerPluginAPI } from '@modern-js/server-core';
 import { API_DIR, findExists, fs, isProd } from '@modern-js/utils';
 

package/src/effect-adapter/index.ts

@@ -1,6 +1,7 @@
 // @effect-diagnostics anyUnknownInErrorContext:off asyncFunction:off nodeBuiltinImport:off strictBooleanExpressions:off
 
 import path from 'node:path';
+import '@modern-js/server-runtime-extensions/server-config';
 import {
   dispatchEffectBffRequest,
   type EffectApiModule,
@@ -244,3 +245,7 @@ export class EffectAdapter {
     this.handler = candidate;
   }
 }
+
+export const createRuntimeAdapters = (api: ServerPluginAPI) => [
+  new EffectAdapter(api),
+];

package/src/{client-generator → effect-source-loader}/built-entry.ts

@@ -41,9 +41,7 @@ export async function bundleBuiltEffectEntryForNode(options: {
       }`,
     );
   }
-  const { bundleEffectEntryForNode } = await import(
-    '../effect-source-loader/loader'
-  );
+  const { bundleEffectEntryForNode } = await import('./loader');
   return bundleEffectEntryForNode({
     appDir,
     entryPath: builtEntry,

package/src/effect-source-loader/http-api-runtime.ts

@@ -0,0 +1,39 @@
+import {
+  extractHttpApiFromModule,
+  type HttpApiLike,
+  type HttpApiReflect,
+} from '@modern-js/bff-effect/effect';
+import { HttpApi } from 'effect/unstable/httpapi';
+import { loadEffectSourceModule } from './loader';
+
+type HttpApiRuntime = {
+  isHttpApi: (value: unknown) => boolean;
+  reflect: HttpApiReflect;
+};
+
+export function getHttpApiRuntime(): Promise<HttpApiRuntime> {
+  return Promise.resolve({
+    isHttpApi: HttpApi.isHttpApi,
+    reflect: (api, handlers) => {
+      if (!HttpApi.isHttpApi(api)) {
+        throw new TypeError('[BFF][Effect] Expected an HttpApi contract.');
+      }
+      HttpApi.reflect(api, {
+        onGroup: handlers.onGroup ?? (() => {}),
+        onEndpoint: handlers.onEndpoint,
+      });
+    },
+  });
+}
+
+export function loadEffectApi(options: {
+  appDir: string;
+  resourcePath: string;
+  onDependency?: (dependency: string) => void;
+}): Promise<HttpApiLike | null> {
+  return getHttpApiRuntime().then(httpApiRuntime =>
+    loadEffectSourceModule(options).then(mod =>
+      extractHttpApiFromModule(mod, httpApiRuntime.isHttpApi),
+    ),
+  );
+}

package/src/effect-source-loader/index.ts

@@ -1,6 +1,9 @@
-export { resolveEffectEntryFile } from '../client-generator/paths';
-export { bundleEffectEntryForNode } from './loader';
 export {
-  generateEffectClientCode,
-  generateEffectWorkerRuntimeWrapper,
-} from './worker-runtime-wrapper';
+  bundleBuiltEffectEntryForNode,
+  resolveEffectEntryPaths,
+} from './built-entry';
+export { bundleEffectEntryForNode } from './loader';
+export { resolveEffectOperationContracts } from './operation-contracts';
+export { resolveEffectEntryFile } from './paths';
+export { bundleEffectWorkerRuntimeSource } from './worker-runtime-source';
+export { generateEffectWorkerRuntimeWrapper } from './worker-runtime-wrapper';

package/src/effect-source-loader/loader.ts

@@ -39,31 +39,37 @@ function preserveSourceModuleSemantics(): Plugin {
   return {
     name: 'modern-js-effect-source-semantics',
     setup(buildApi) {
-      buildApi.onLoad({ filter: /\.[cm]?[jt]sx?$/ }, async args => {
-        const loader = sourceLoader(args);
-        if (!loader) {
-          return undefined;
-        }
+      buildApi.onLoad(
+        { filter: /\.[cm]?[jt]sx?$/, namespace: 'file' },
+        async args => {
+          const loader = sourceLoader(args);
+          if (!loader) {
+            return undefined;
+          }
 
-        const source = await fs.promises.readFile(args.path, 'utf8');
-        const compiled = await transform(source, {
-          define: {
-            __dirname: JSON.stringify(path.dirname(args.path)),
-            __filename: JSON.stringify(args.path),
-            'import.meta.url': JSON.stringify(pathToFileURL(args.path).href),
-          },
-          jsx: 'automatic',
-          loader,
-          sourcefile: args.path,
-          target: NODE_TARGET,
-        });
+          const source = await fs.promises.readFile(args.path, 'utf8');
+          const canonicalSourcePath = await fs.promises.realpath(args.path);
+          const compiled = await transform(source, {
+            define: {
+              __dirname: JSON.stringify(path.dirname(canonicalSourcePath)),
+              __filename: JSON.stringify(canonicalSourcePath),
+              'import.meta.url': JSON.stringify(
+                pathToFileURL(canonicalSourcePath).href,
+              ),
+            },
+            jsx: 'automatic',
+            loader,
+            sourcefile: args.path,
+            target: NODE_TARGET,
+          });
 
-        return {
-          contents: compiled.code,
-          loader: 'js',
-          resolveDir: path.dirname(args.path),
-        };
-      });
+          return {
+            contents: compiled.code,
+            loader: 'js',
+            resolveDir: path.dirname(args.path),
+          };
+        },
+      );
     },
   };
 }
@@ -125,12 +131,8 @@ function isBareSpecifier(specifier: string) {
  * generated entry is relocatable and directly executable by Node 26.7.
  */
 function externalizeInstalledDependencies(options: {
-  format: 'cjs' | 'esm';
   runtimeResolveDir: string;
 }): Plugin {
-  const runtimeRequire = createRequire(
-    path.join(options.runtimeResolveDir, '__modern_effect_entry.cjs'),
-  );
   return {
     name: 'modern-js-effect-installed-dependencies',
     setup(buildApi) {
@@ -176,24 +178,8 @@ function externalizeInstalledDependencies(options: {
             resolveDir: options.runtimeResolveDir,
           });
           if (runtimeResolution.errors.length === 0 && runtimeResolution.path) {
-            if (options.format === 'cjs') {
-              let requiredPath: string;
-              try {
-                requiredPath = runtimeRequire.resolve(args.path);
-              } catch {
-                requiredPath = runtimeResolution.path;
-              }
-              if (await isEsmOnlyFile(requiredPath)) {
-                return {
-                  namespace: resolution.namespace,
-                  path: resolution.path,
-                  pluginData: resolution.pluginData,
-                  sideEffects: resolution.sideEffects,
-                  suffix: resolution.suffix,
-                  warnings: resolution.warnings,
-                };
-              }
-            }
+            // Node 26 loads installed ESM from CommonJS natively. Rebundling
+            // it here would split dependency identity from the BFF runtime.
             return { external: true, path: args.path };
           }
         }
@@ -227,7 +213,6 @@ export async function bundleEffectEntryForNode(options: {
     platform: 'node',
     plugins: [
       externalizeInstalledDependencies({
-        format: options.format,
         runtimeResolveDir: options.appDir,
       }),
       preserveSourceModuleSemantics(),
@@ -365,7 +350,6 @@ export async function loadEffectSourceModule(
     platform: 'node',
     plugins: [
       externalizeInstalledDependencies({
-        format: 'esm',
         runtimeResolveDir: appDir,
       }),
       preserveSourceModuleSemantics(),

package/src/effect-source-loader/operation-contracts.ts

@@ -0,0 +1,72 @@
+import {
+  collectEffectEndpoints,
+  toOperationContractSources,
+} from '@modern-js/bff-effect/effect';
+import {
+  buildOperationContractMap,
+  deriveOperationVersion,
+} from '@modern-js/server-runtime-extensions/bff-policy/node';
+import { fs, upath as path } from '@modern-js/utils';
+import { getHttpApiRuntime, loadEffectApi } from './http-api-runtime';
+
+function getPackageInfo(
+  resourcePath: string,
+  appDir: string,
+  onDependency?: (dependency: string) => void,
+): { name?: string; version?: string } {
+  for (const startDir of [path.dirname(resourcePath), appDir]) {
+    let current = path.resolve(startDir);
+    for (let depth = 0; depth < 32; depth += 1) {
+      const packageJsonPath = path.join(current, 'package.json');
+      if (fs.existsSync(packageJsonPath)) {
+        onDependency?.(packageJsonPath);
+        try {
+          const packageJson = fs.readJSONSync(packageJsonPath) as {
+            name?: string;
+            version?: string;
+          };
+          return { name: packageJson.name, version: packageJson.version };
+        } catch {
+          return {};
+        }
+      }
+      const parent = path.dirname(current);
+      if (parent === current) {
+        break;
+      }
+      current = parent;
+    }
+  }
+  return {};
+}
+
+/** Derives server policy metadata without emitting or typing a client. */
+export async function resolveEffectOperationContracts(options: {
+  appDir: string;
+  resourcePath: string;
+  prefix: string;
+  requestId?: string;
+  onDependency?: (dependency: string) => void;
+}) {
+  const api = await loadEffectApi(options);
+  if (api === null) {
+    return null;
+  }
+  const runtime = await getHttpApiRuntime();
+  const endpoints = collectEffectEndpoints(
+    runtime.reflect,
+    api,
+    options.prefix,
+  );
+  const packageInfo = getPackageInfo(
+    options.resourcePath,
+    options.appDir,
+    options.onDependency,
+  );
+  const requestId = options.requestId?.trim() || packageInfo.name || 'default';
+  return buildOperationContractMap({
+    handlers: toOperationContractSources(endpoints),
+    requestId,
+    operationVersion: deriveOperationVersion(packageInfo.version),
+  });
+}

package/src/effect-source-loader/rspack-loader.ts

@@ -0,0 +1,72 @@
+import { realpathSync } from 'node:fs';
+import path from 'node:path';
+import type { Rspack } from '@rsbuild/core';
+import {
+  bundleEffectWorkerRuntimeSource,
+  generateEffectWorkerRuntimeWrapper,
+  resolveEffectEntryFile,
+} from './index';
+
+export interface EffectBffLoaderOptions {
+  prefix: string;
+  appDir: string;
+  apiDir: string;
+  effectEntry: string;
+  requestId?: string;
+}
+
+export default async function loader(
+  this: Rspack.LoaderContext<EffectBffLoaderOptions>,
+  source: string,
+) {
+  this.cacheable();
+  delete require.cache[this.resourcePath];
+  const callback = this.async();
+  try {
+    const options = this.getOptions();
+    const entry = resolveEffectEntryFile(options);
+    if (!entry || realpathSync(entry) !== realpathSync(this.resourcePath))
+      throw new Error(
+        `Unexpected Effect BFF loader resource: ${this.resourcePath}`,
+      );
+    const query = new URLSearchParams(this.resourceQuery);
+    if (query.has('modern-bff-runtime-source')) {
+      const { transform } = await import('@swc/core');
+      const transformed = await transform(source, {
+        filename: this.resourcePath,
+        sourceMaps: false,
+        jsc: {
+          parser: {
+            syntax: 'typescript',
+            tsx: /\.[jt]sx$/.test(this.resourcePath),
+          },
+          target: 'es2024',
+        },
+        module: { type: 'es6' },
+      });
+      callback(
+        undefined,
+        await bundleEffectWorkerRuntimeSource(
+          transformed.code,
+          this.resourcePath,
+          this,
+        ),
+      );
+    } else if (query.has('modern-bff-runtime')) {
+      callback(
+        undefined,
+        await generateEffectWorkerRuntimeWrapper(
+          this,
+          options,
+          this.resourcePath,
+        ),
+      );
+    } else {
+      throw new Error(
+        'Effect BFF entries are server-only. Import the shared HttpApi contract and use HttpApiClient.make (or makeEffectHttpApiClient) for a fully inferred client.',
+      );
+    }
+  } catch (error) {
+    callback(error instanceof Error ? error : new Error(String(error)));
+  }
+}

package/src/effect-source-loader/worker-runtime-source.ts

@@ -0,0 +1,34 @@
+import path from 'node:path';
+import { build } from 'esbuild';
+
+/** Keep the worker implementation graph out of the API-to-client loader. */
+export async function bundleEffectWorkerRuntimeSource(
+  source: string,
+  resourcePath: string,
+  loader: { addDependency: (dependency: string) => void },
+) {
+  const result = await build({
+    absWorkingDir: path.dirname(resourcePath),
+    bundle: true,
+    format: 'esm',
+    metafile: true,
+    packages: 'external',
+    platform: 'neutral',
+    stdin: {
+      contents: source,
+      loader: 'js',
+      resolveDir: path.dirname(resourcePath),
+      sourcefile: resourcePath,
+    },
+    target: 'es2024',
+    write: false,
+  });
+  for (const dependency of Object.keys(result.metafile.inputs)) {
+    if (dependency !== '<stdin>') {
+      loader.addDependency(
+        path.resolve(path.dirname(resourcePath), dependency),
+      );
+    }
+  }
+  return result.outputFiles[0].text;
+}

package/src/effect-source-loader/worker-runtime-wrapper.ts

@@ -1,90 +1,20 @@
-// @effect-diagnostics asyncFunction:off strictBooleanExpressions:off
-import type { HttpMethodDecider } from '@modern-js/types';
-import type { EffectClientCodegenOptions } from '../client-generator/types';
-
-type EffectWorkerRuntimeGenerationOptions = {
-  apiDir: string;
-  appDir: string;
-  effectDataPlatformBatch?: {
-    allowedMethods?: string[];
-    enabled?: boolean;
-    endpoint?: string;
-    flushIntervalMs?: number;
-    maxBatchBytes?: number;
-    maxBatchSize?: number;
-    requestTimeoutMs?: number;
-  };
-  httpMethodDecider?: HttpMethodDecider;
-  port: number;
-  prefix: string;
-  requestCreator?: string;
-  requestId?: string;
-};
+import { resolveEffectOperationContracts } from './operation-contracts';
 
 export async function generateEffectWorkerRuntimeWrapper(
   loader: { addDependency: (dependency: string) => void },
-  options: EffectWorkerRuntimeGenerationOptions,
+  options: { appDir: string; prefix: string; requestId?: string },
   resourcePath: string,
 ) {
-  const { generateEffectClient } = await import(
-    '../client-generator/generator'
-  );
-  const artifacts = await generateEffectClient({
+  const operationContracts = await resolveEffectOperationContracts({
     appDir: options.appDir,
-    apiDir: options.apiDir,
     resourcePath,
     prefix: options.prefix,
-    port: Number(options.port),
-    target: 'bundle',
     requestId: options.requestId,
-    requestCreator: options.requestCreator,
-    httpMethodDecider: options.httpMethodDecider,
-    dataPlatformBatch: options.effectDataPlatformBatch,
     onDependency: dependency => loader.addDependency(dependency),
   });
   const sourceRequest = `${resourcePath}?modern-bff-runtime-source`;
-  const operationContracts = artifacts?.operationContracts ?? {};
-
   return `import * as effectBffModule from ${JSON.stringify(sourceRequest)};
-import { createEffectBffEdgeDispatcher } from '@modern-js/plugin-bff/effect-edge/dispatcher';
-
-const __generatedOperationContracts = ${JSON.stringify(operationContracts)};
-
-const __mergeGeneratedOperationContracts = policy => {
-  if (
-    !policy ||
-    !policy.expectedOperationContracts ||
-    typeof policy.expectedOperationContracts !== 'object' ||
-    Array.isArray(policy.expectedOperationContracts)
-  ) {
-    return policy;
-  }
-  return {
-    ...policy,
-    expectedOperationContracts: {
-      ...policy.expectedOperationContracts,
-      ...__generatedOperationContracts,
-    },
-  };
-};
-
-export const __modern_create_effect_bff_dispatcher = options =>
-  createEffectBffEdgeDispatcher({
-    ...options,
-    crossProjectPolicy: __mergeGeneratedOperationContracts(
-      options?.crossProjectPolicy,
-    ),
-    module: effectBffModule,
-  });
+import { createEffectBffEdgeDispatcherFactory } from '@modern-js/bff-effect/effect-edge';
+export const __modern_create_effect_bff_dispatcher = createEffectBffEdgeDispatcherFactory(effectBffModule, ${JSON.stringify(operationContracts ?? {})});
 `;
 }
-
-export async function generateEffectClientCode(
-  options: EffectClientCodegenOptions,
-) {
-  const { generateEffectClient } = await import(
-    '../client-generator/generator'
-  );
-  const artifacts = await generateEffectClient(options);
-  return artifacts === null ? null : artifacts.code;
-}

package/src/hono/cross-project-policy.ts

@@ -22,5 +22,6 @@ export const createHonoCrossProjectPolicyMiddleware = (
       return denial;
     }
 
-    return next();
+    const result: unknown = await next();
+    return result instanceof Response ? result : undefined;
   };