@bleedingdev/modern-js-plugin-bff-extensions 3.9.0-ultramodern.10 → 3.9.0-ultramodern.12

package/dist/esm-node/effect-adapter/cross-project-policy.mjs

@@ -3,7 +3,7 @@ import { collectEffectEndpoints, extractHttpApiFromModule, toOperationContractSo
 import { logger } from "@modern-js/utils";
 import { HttpApi } from "effect/unstable/httpapi";
 import { resolveAdapterCrossProjectPolicy } from "../cross-project-policy/index.mjs";
-function resolveEffectAdapterCrossProjectPolicy(api, prefix, mod) {
+function resolveEffectAdapterCrossProjectPolicy(api, prefix, mod, producer) {
     const contractSourcesPromise = null === mod ? Promise.resolve([]) : Promise.resolve().then(()=>extractHttpApiFromModule(mod, HttpApi.isHttpApi)).then((effectApi)=>{
         if (null === effectApi) return [];
         const reflect = (apiValue, handlers)=>{
@@ -19,7 +19,7 @@ function resolveEffectAdapterCrossProjectPolicy(api, prefix, mod) {
         return [];
     });
     return contractSourcesPromise.then((contractSources)=>{
-        const policy = resolveAdapterCrossProjectPolicy(api, contractSources);
+        const policy = resolveAdapterCrossProjectPolicy(api, contractSources, producer);
         if (policy?.enabled === true && 0 === contractSources.length) logger.warn('[BFF][Effect] Cross-project policy enabled but no HttpApi endpoints could be reflected; requests fail operation-contract matching unless allowUnknownOperations is enabled.');
         return policy;
     });

package/dist/esm-node/effect-adapter/entry.mjs

@@ -1,52 +1,16 @@
 import "node:module";
 import node_path from "node:path";
 import "@modern-js/server-runtime-extensions/server-config";
-import { API_DIR, findExists, fs, isProd } from "@modern-js/utils";
-const JS_OR_TS_EXTS = [
-    '.js',
-    '.jsx',
-    '.ts',
-    '.tsx',
-    '.mjs',
-    '.mts',
-    '.cjs',
-    '.cts'
-];
-function resolveJsOrTsEntry(entryWithoutOrWithExt) {
-    const extension = node_path.extname(entryWithoutOrWithExt);
-    if (JS_OR_TS_EXTS.includes(extension)) return fs.existsSync(entryWithoutOrWithExt) ? entryWithoutOrWithExt : void 0;
-    return findExists(JS_OR_TS_EXTS.map((ext)=>`${entryWithoutOrWithExt}${ext}`)) || void 0;
-}
-function builtEntryPath(entryPath) {
-    return entryPath.replace(/\.(?:[cm]?ts|tsx|jsx)$/u, '.js');
-}
-function relativeAppPath(appDirectory, entryPath) {
-    const relativePath = node_path.relative(appDirectory, entryPath);
-    return '..' === relativePath || relativePath.startsWith(`..${node_path.sep}`) ? void 0 : relativePath;
-}
-function isDependencyPath(relativePath) {
-    return relativePath?.split(/[\\/]/u).includes('node_modules') ?? false;
-}
+import { API_DIR, isProd } from "@modern-js/utils";
+import { resolveEffectEntry } from "../effect-source-loader/paths.mjs";
 function resolveEffectAdapterEntryFile(api) {
     const { appDirectory, apiDirectory, distDirectory } = api.getServerContext();
-    const appRoot = node_path.resolve(appDirectory || process.cwd());
-    const productionRoot = isProd() && distDirectory ? node_path.resolve(distDirectory) : void 0;
-    const configuredEntry = api.getServerConfig()?.bff?.effect?.entry;
-    if (configuredEntry) {
-        const sourceEntry = node_path.isAbsolute(configuredEntry) ? configuredEntry : node_path.resolve(appRoot, configuredEntry);
-        if (productionRoot) {
-            const relativeEntry = relativeAppPath(appRoot, sourceEntry);
-            if (void 0 === relativeEntry || isDependencyPath(relativeEntry)) return resolveJsOrTsEntry(sourceEntry);
-            return relativeEntry ? resolveJsOrTsEntry(builtEntryPath(node_path.resolve(productionRoot, relativeEntry))) : void 0;
-        }
-        return resolveJsOrTsEntry(sourceEntry);
-    }
-    const resolvedApiDirectory = node_path.resolve(appRoot, apiDirectory || API_DIR);
-    const productionApiDirectory = productionRoot ? void 0 !== relativeAppPath(productionRoot, resolvedApiDirectory) ? resolvedApiDirectory : (()=>{
-        const relativeApiDirectory = relativeAppPath(appRoot, resolvedApiDirectory);
-        if (isDependencyPath(relativeApiDirectory)) return resolvedApiDirectory;
-        return relativeApiDirectory ? node_path.resolve(productionRoot, relativeApiDirectory) : void 0;
-    })() : resolvedApiDirectory;
-    return productionApiDirectory ? resolveJsOrTsEntry(node_path.resolve(productionApiDirectory, 'index')) : void 0;
+    const appDir = node_path.resolve(appDirectory || process.cwd());
+    return resolveEffectEntry({
+        appDir,
+        apiDir: node_path.resolve(appDir, apiDirectory || API_DIR),
+        effectEntry: api.getServerConfig()?.bff?.effect?.entry,
+        distDir: isProd() && distDirectory ? node_path.resolve(distDirectory) : void 0
+    }).path;
 }
 export { resolveEffectAdapterEntryFile };

package/dist/esm-node/effect-adapter/index.mjs

@@ -2,6 +2,7 @@ import "node:module";
 import node_path from "node:path";
 import "@modern-js/server-runtime-extensions/server-config";
 import { dispatchEffectBffRequest, resolveEffectBffModuleHandler, useEffectContext } from "@modern-js/bff-effect/effect";
+import { resolveOperationProducer } from "@modern-js/server-runtime-extensions/bff-policy/node";
 import { createDisposableServerRuntimeHandle, registerServerRuntimeDisposer } from "@modern-js/server-runtime-extensions/runtime-lifecycle";
 import { fs, isProd, logger } from "@modern-js/utils";
 import { checkCrossProjectPolicyForRequest } from "../cross-project-policy/evaluation.mjs";
@@ -21,9 +22,9 @@ class EffectAdapter {
             this.handler = null;
             return;
         }
+        const { appDirectory } = this.api.getServerContext();
         let mod;
         try {
-            const { appDirectory } = this.api.getServerContext();
             mod = await (isProd() ? loadEffectBuiltModule(entryFile) : loadEffectSourceModule({
                 resourcePath: entryFile,
                 appDir: appDirectory || node_path.dirname(entryFile)
@@ -32,9 +33,16 @@ class EffectAdapter {
             logger.error(`[BFF][Effect] Failed to load Effect entry: ${entryFile}\n${String(error)}`);
             throw error;
         }
+        const producer = resolveOperationProducer({
+            directories: [
+                node_path.dirname(entryFile),
+                appDirectory
+            ],
+            requestId: this.api.getServerConfig()?.bff?.requestId
+        });
         const crossProjectPolicies = new Map(await Promise.all(this.prefixes.map(async (prefix)=>[
                 prefix,
-                await resolveEffectAdapterCrossProjectPolicy(this.api, prefix, mod)
+                await resolveEffectAdapterCrossProjectPolicy(this.api, prefix, mod, producer)
             ])));
         const effectConfig = this.api.getServerConfig()?.bff?.effect;
         const loaded = await resolveEffectBffModuleHandler(mod, {

package/dist/esm-node/effect-source-loader/built-entry.mjs

@@ -1,12 +1,11 @@
 import "node:module";
 import { fs, upath } from "@modern-js/utils";
-import { resolveEffectEntryFile } from "./paths.mjs";
-const BUILT_ENTRY_EXT = /\.(?:[cm]?ts|tsx|jsx)$/u;
+import { emittedEffectEntry, relativeEffectAppPath, resolveEffectEntryFile } from "./paths.mjs";
 function resolveBuiltEffectEntry(appDirectory, distDirectory, sourceEntry) {
     if (void 0 === sourceEntry || 0 === sourceEntry.length) return;
-    const relativeEntry = upath.relative(appDirectory, sourceEntry);
-    if ('..' === relativeEntry || relativeEntry.startsWith(`..${upath.sep}`)) throw new Error(`Effect BFF entry must be inside the application directory: ${sourceEntry}`);
-    const builtEntry = upath.resolve(distDirectory, relativeEntry).replace(BUILT_ENTRY_EXT, '.js');
+    const relativeEntry = relativeEffectAppPath(appDirectory, sourceEntry);
+    if (void 0 === relativeEntry) throw new Error(`Effect BFF entry must be inside the application directory: ${sourceEntry}`);
+    const builtEntry = emittedEffectEntry(upath.resolve(distDirectory, relativeEntry));
     return fs.existsSync(builtEntry) ? builtEntry : void 0;
 }
 async function bundleBuiltEffectEntryForNode(options) {
@@ -32,7 +31,7 @@ function resolveEffectEntryPaths(options) {
         apiDir,
         effectEntry
     });
-    const relativeEffectEntry = void 0 !== sourceEffectEntry && sourceEffectEntry.length > 0 ? upath.relative(appDir, sourceEffectEntry).replace(BUILT_ENTRY_EXT, '.js') : '';
+    const relativeEffectEntry = void 0 !== sourceEffectEntry && sourceEffectEntry.length > 0 ? emittedEffectEntry(upath.relative(appDir, sourceEffectEntry)) : '';
     return {
         sourceEffectEntry,
         relativeEffectEntry

package/dist/esm-node/effect-source-loader/loader.mjs

@@ -131,7 +131,8 @@ function externalizeInstalledDependencies(options) {
                     path: args.path
                 };
                 const realPath = await node_fs.promises.realpath(resolution.path).catch(()=>resolution.path);
-                if (realPath.includes(`${node_path.sep}node_modules${node_path.sep}`)) {
+                const loader = SOURCE_LOADERS.get(node_path.extname(realPath).toLowerCase());
+                if (realPath.includes(`${node_path.sep}node_modules${node_path.sep}`) && 'ts' !== loader && 'tsx' !== loader && 'jsx' !== loader) {
                     const runtimeResolution = await buildApi.resolve(args.path, {
                         importer: '',
                         kind: args.kind,

package/dist/esm-node/effect-source-loader/operation-contracts.mjs

@@ -1,46 +1,23 @@
 import "node:module";
 import { collectEffectEndpoints, toOperationContractSources } from "@modern-js/bff-effect/effect";
-import { buildOperationContractMap, deriveOperationVersion } from "@modern-js/server-runtime-extensions/bff-policy/node";
-import { fs, upath } from "@modern-js/utils";
+import { buildOperationContractMap, resolveOperationProducer } from "@modern-js/server-runtime-extensions/bff-policy/node";
+import { upath } from "@modern-js/utils";
 import { getHttpApiRuntime, loadEffectApi } from "./http-api-runtime.mjs";
-function getPackageInfo(resourcePath, appDir, onDependency) {
-    for (const startDir of [
-        upath.dirname(resourcePath),
-        appDir
-    ]){
-        let current = upath.resolve(startDir);
-        for(let depth = 0; depth < 32; depth += 1){
-            const packageJsonPath = upath.join(current, 'package.json');
-            if (fs.existsSync(packageJsonPath)) {
-                onDependency?.(packageJsonPath);
-                try {
-                    const packageJson = fs.readJSONSync(packageJsonPath);
-                    return {
-                        name: packageJson.name,
-                        version: packageJson.version
-                    };
-                } catch  {
-                    return {};
-                }
-            }
-            const parent = upath.dirname(current);
-            if (parent === current) break;
-            current = parent;
-        }
-    }
-    return {};
-}
 async function resolveEffectOperationContracts(options) {
     const api = await loadEffectApi(options);
     if (null === api) return null;
     const runtime = await getHttpApiRuntime();
     const endpoints = collectEffectEndpoints(runtime.reflect, api, options.prefix);
-    const packageInfo = getPackageInfo(options.resourcePath, options.appDir, options.onDependency);
-    const requestId = options.requestId?.trim() || packageInfo.name || 'default';
     return buildOperationContractMap({
         handlers: toOperationContractSources(endpoints),
-        requestId,
-        operationVersion: deriveOperationVersion(packageInfo.version)
+        ...resolveOperationProducer({
+            directories: [
+                upath.dirname(options.resourcePath),
+                options.appDir
+            ],
+            requestId: options.requestId,
+            onDependency: options.onDependency
+        })
     });
 }
 export { resolveEffectOperationContracts };

package/dist/esm-node/effect-source-loader/paths.mjs

@@ -10,16 +10,35 @@ const JS_OR_TS_EXTS = [
     '.cjs',
     '.cts'
 ];
-function resolveEffectEntryFile(options) {
-    const { appDir, apiDir, effectEntry } = options;
-    const resolveEntry = (entryWithoutExt)=>{
-        if ('' !== upath.extname(entryWithoutExt)) return fs.existsSync(entryWithoutExt) ? entryWithoutExt : void 0;
-        return findExists(JS_OR_TS_EXTS.map((ext)=>`${entryWithoutExt}${ext}`)) || void 0;
+const emittedEffectEntry = (entry)=>entry.replace(/\.(?:[cm]?ts|tsx|jsx)$/u, '.js');
+function relativeEffectAppPath(appDir, entry) {
+    const relative = upath.relative(appDir, entry);
+    return '..' === relative || relative.startsWith('../') || relative.split('/').includes('node_modules') ? void 0 : relative;
+}
+function existingEntry(entry) {
+    return upath.extname(entry) ? fs.existsSync(entry) ? entry : void 0 : findExists(JS_OR_TS_EXTS.map((ext)=>`${entry}${ext}`)) || void 0;
+}
+function resolveEffectEntry(options) {
+    const { appDir, apiDir, effectEntry, distDir } = options;
+    const entry = upath.resolve(appDir, effectEntry || upath.join(apiDir, 'index'));
+    if (distDir && void 0 !== relativeEffectAppPath(distDir, entry)) return {
+        kind: 'built-output',
+        path: existingEntry(emittedEffectEntry(entry))
+    };
+    const relative = relativeEffectAppPath(appDir, entry);
+    if (void 0 === relative) return {
+        kind: 'external-sdk',
+        path: existingEntry(entry)
     };
-    if (void 0 !== effectEntry && '' !== effectEntry) {
-        const entryWithoutExt = upath.isAbsolute(effectEntry) ? effectEntry : upath.resolve(appDir, effectEntry);
-        return resolveEntry(entryWithoutExt);
-    }
-    return resolveEntry(upath.resolve(apiDir, 'index'));
+    return distDir ? {
+        kind: 'built-output',
+        path: existingEntry(emittedEffectEntry(upath.resolve(distDir, relative)))
+    } : {
+        kind: 'app-source',
+        path: existingEntry(entry)
+    };
+}
+function resolveEffectEntryFile(options) {
+    return resolveEffectEntry(options).path;
 }
-export { resolveEffectEntryFile };
+export { emittedEffectEntry, relativeEffectAppPath, resolveEffectEntry, resolveEffectEntryFile };

package/dist/types/backend-federation/identity.d.ts

@@ -11,11 +11,8 @@ export type BackendFederationIdentityIssue = {
     path: string;
     message: string;
 };
-/**
- * Shared expected-identity validation for loaded backend federation modules.
- * Compares the expose's `backendFederationContract.compatibility` identity
- * (`unitId`, `build`) against the consumer's expected delivery-unit identity.
- * Missing identity metadata is an error.
- */
+/** Decode independently at each received-manifest / executed-expose boundary. */
+export declare function backendFederationCompatibility(loaded: unknown): Record<string, unknown> | undefined;
+export declare function validateBackendFederationCompatibility(compatibility: Record<string, unknown>, expected: Record<string, string | undefined>): BackendFederationIdentityIssue[];
 export declare function validateExpectedBackendFederationIdentity(loaded: unknown, expected: BackendFederationExpectedIdentity): BackendFederationIdentityIssue[];
 export declare function formatBackendFederationIdentityIssues(issues: BackendFederationIdentityIssue[]): string;

package/dist/types/cross-project-policy/node.d.ts

@@ -1,5 +1,5 @@
 import '@modern-js/server-runtime-extensions/server-config';
 import type { ServerPluginAPI } from '@modern-js/server-core';
-import { type OperationContractSource } from '@modern-js/server-runtime-extensions/bff-policy/node';
+import { type OperationContractSource, resolveOperationProducer } from '@modern-js/server-runtime-extensions/bff-policy/node';
 import type { ResolvedCrossProjectPolicy } from './evaluation.js';
-export declare const resolveAdapterCrossProjectPolicy: (api: ServerPluginAPI, handlers: OperationContractSource[]) => ResolvedCrossProjectPolicy | undefined;
+export declare const resolveAdapterCrossProjectPolicy: (api: ServerPluginAPI, handlers: OperationContractSource[], producer?: ReturnType<typeof resolveOperationProducer>) => ResolvedCrossProjectPolicy | undefined;

package/dist/types/effect-adapter/cross-project-policy.d.ts

@@ -1,4 +1,5 @@
 import { type EffectApiModule } from '@modern-js/bff-effect/effect';
 import type { ServerPluginAPI } from '@modern-js/server-core';
+import type { resolveOperationProducer } from '@modern-js/server-runtime-extensions/bff-policy/node';
 import type { ResolvedCrossProjectPolicy } from '../cross-project-policy/evaluation.js';
-export declare function resolveEffectAdapterCrossProjectPolicy(api: ServerPluginAPI, prefix: string, mod: EffectApiModule | null): Promise<ResolvedCrossProjectPolicy | undefined>;
+export declare function resolveEffectAdapterCrossProjectPolicy(api: ServerPluginAPI, prefix: string, mod: EffectApiModule | null, producer?: ReturnType<typeof resolveOperationProducer>): Promise<ResolvedCrossProjectPolicy | undefined>;

package/dist/types/effect-source-loader/paths.d.ts

@@ -1,5 +1,23 @@
-export declare function resolveEffectEntryFile(options: {
+export declare const emittedEffectEntry: (entry: string) => string;
+export declare function relativeEffectAppPath(appDir: string, entry: string): string | undefined;
+type EffectEntryOptions = {
     appDir: string;
     apiDir: string;
     effectEntry?: string;
-}): string | undefined;
+};
+export type EffectEntry = {
+    kind: 'app-source';
+    path: string | undefined;
+} | {
+    kind: 'built-output';
+    path: string | undefined;
+} | {
+    kind: 'external-sdk';
+    path: string | undefined;
+};
+/** Classify ownership before resolving files: production works without source. */
+export declare function resolveEffectEntry(options: EffectEntryOptions & {
+    distDir?: string;
+}): EffectEntry;
+export declare function resolveEffectEntryFile(options: EffectEntryOptions): string | undefined;
+export {};

package/package.json

@@ -18,7 +18,7 @@
     "modern.js",
     "ultramodern.js"
   ],
-  "version": "3.9.0-ultramodern.10",
+  "version": "3.9.0-ultramodern.12",
   "files": [
     "dist",
     "src"
@@ -193,14 +193,14 @@
     "node": ">=26.7.0"
   },
   "dependencies": {
-    "@modern-js/backend-federation-contracts": "npm:@bleedingdev/modern-js-backend-federation-contracts@3.9.0-ultramodern.10",
-    "@modern-js/bff-core": "npm:@bleedingdev/modern-js-bff-core@3.9.0-ultramodern.10",
-    "@modern-js/bff-effect": "npm:@bleedingdev/modern-js-bff-effect@3.9.0-ultramodern.10",
-    "@modern-js/runtime-extensions": "npm:@bleedingdev/modern-js-runtime-extensions@3.9.0-ultramodern.10",
-    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.9.0-ultramodern.10",
-    "@modern-js/server-runtime-extensions": "npm:@bleedingdev/modern-js-server-runtime-extensions@3.9.0-ultramodern.10",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.9.0-ultramodern.10",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.9.0-ultramodern.10",
+    "@modern-js/backend-federation-contracts": "npm:@bleedingdev/modern-js-backend-federation-contracts@3.9.0-ultramodern.12",
+    "@modern-js/bff-core": "npm:@bleedingdev/modern-js-bff-core@3.9.0-ultramodern.12",
+    "@modern-js/bff-effect": "npm:@bleedingdev/modern-js-bff-effect@3.9.0-ultramodern.12",
+    "@modern-js/runtime-extensions": "npm:@bleedingdev/modern-js-runtime-extensions@3.9.0-ultramodern.12",
+    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.9.0-ultramodern.12",
+    "@modern-js/server-runtime-extensions": "npm:@bleedingdev/modern-js-server-runtime-extensions@3.9.0-ultramodern.12",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.9.0-ultramodern.12",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.9.0-ultramodern.12",
     "@module-federation/runtime": "2.9.0",
     "@swc/core": "1.16.2",
     "esbuild": "^0.28.2"
@@ -219,7 +219,7 @@
   },
   "devDependencies": {
     "@effect/opentelemetry": "4.0.0-rc.112",
-    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.9.0-ultramodern.10",
+    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.9.0-ultramodern.12",
     "@rsbuild/core": "2.2.3",
     "@rslib/core": "1.0.0",
     "@scripts/rstest-config": "2.66.0",

package/src/backend-federation/identity.ts

@@ -17,59 +17,51 @@ export type BackendFederationIdentityIssue = {
   message: string;
 };
 
-/**
- * Shared expected-identity validation for loaded backend federation modules.
- * Compares the expose's `backendFederationContract.compatibility` identity
- * (`unitId`, `build`) against the consumer's expected delivery-unit identity.
- * Missing identity metadata is an error.
- */
-export function validateExpectedBackendFederationIdentity(
-  loaded: unknown,
-  expected: BackendFederationExpectedIdentity,
-): BackendFederationIdentityIssue[] {
-  const issues: BackendFederationIdentityIssue[] = [];
+/** Decode independently at each received-manifest / executed-expose boundary. */
+export function backendFederationCompatibility(loaded: unknown) {
   const contract = isRecord(loaded)
     ? loaded.backendFederationContract
     : undefined;
   const compatibility = isRecord(contract) ? contract.compatibility : undefined;
+  return isRecord(compatibility) ? compatibility : undefined;
+}
 
-  if (!isRecord(compatibility)) {
-    return [
-      {
-        path: 'backendFederationContract.compatibility',
-        message:
-          'loaded module declares no compatibility metadata; delivery-unit identity cannot be validated',
-      },
-    ];
-  }
-
-  const unitId = compatibility.unitId;
-  if (typeof unitId !== 'string' || unitId.length === 0) {
-    issues.push({
-      path: 'backendFederationContract.compatibility.unitId',
-      message: `missing delivery-unit id; expected ${expected.unitId}`,
-    });
-  } else if (unitId !== expected.unitId) {
-    issues.push({
-      path: 'backendFederationContract.compatibility.unitId',
-      message: `expected ${expected.unitId}, received ${unitId}`,
-    });
-  }
-
-  const build = compatibility.build;
-  if (typeof build !== 'string' || build.length === 0) {
-    issues.push({
-      path: 'backendFederationContract.compatibility.build',
-      message: `missing build marker; expected ${expected.buildMarker}`,
-    });
-  } else if (build !== expected.buildMarker) {
-    issues.push({
-      path: 'backendFederationContract.compatibility.build',
-      message: `expected ${expected.buildMarker}, received ${build}`,
-    });
-  }
+export function validateBackendFederationCompatibility(
+  compatibility: Record<string, unknown>,
+  expected: Record<string, string | undefined>,
+): BackendFederationIdentityIssue[] {
+  return Object.entries(expected).flatMap(([field, value]) =>
+    value === undefined ||
+    (typeof compatibility[field] === 'string' &&
+      compatibility[field].length > 0 &&
+      compatibility[field] === value)
+      ? []
+      : [
+          {
+            path: `backendFederationContract.compatibility.${field}`,
+            message: `expected ${value}, received ${typeof compatibility[field] === 'string' ? compatibility[field] : typeof compatibility[field]}`,
+          },
+        ],
+  );
+}
 
-  return issues;
+export function validateExpectedBackendFederationIdentity(
+  loaded: unknown,
+  expected: BackendFederationExpectedIdentity,
+): BackendFederationIdentityIssue[] {
+  const compatibility = backendFederationCompatibility(loaded);
+  return compatibility
+    ? validateBackendFederationCompatibility(compatibility, {
+        unitId: expected.unitId,
+        build: expected.buildMarker,
+      })
+    : [
+        {
+          path: 'backendFederationContract.compatibility',
+          message:
+            'loaded module declares no compatibility metadata; delivery-unit identity cannot be validated',
+        },
+      ];
 }
 
 export function formatBackendFederationIdentityIssues(

package/src/backend-federation-manifest/load.ts

@@ -25,6 +25,10 @@ import {
   validateLoadedBackendFederationContract,
 } from './validation';
 
+// One manifest+entry budget. Explicit outer 0 opts out; nested 0 cannot
+// disable a positive nested deadline.
+const DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS = 10_000;
+
 function createManifestLoadScope(
   options: BackendFederationManifestAdapterOptions,
 ) {
@@ -44,9 +48,14 @@ function createManifestLoadScope(
       );
     }
   }
+  const positivePolicyTimeouts = policyTimeouts.filter(timeout => timeout > 0);
   const timeoutMs =
     options.timeoutMs ??
-    (policyTimeouts.length > 0 ? Math.min(...policyTimeouts) : 0);
+    (policyTimeouts.length === 0
+      ? DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS
+      : positivePolicyTimeouts.length > 0
+        ? Math.min(...positivePolicyTimeouts)
+        : 0);
   const inputSignals = [
     options.signal,
     options.manifestPolicy?.signal,
@@ -140,6 +149,39 @@ function throwIfManifestLoadAborted(signal: AbortSignal) {
   }
 }
 
+// Stop waiting even when trusted plugin work ignores cancellation. The race
+// observes late rejections; it cannot stop that work from running.
+function settleOnSharedAbort<T>(
+  promise: Promise<T>,
+  signal: AbortSignal,
+): Promise<T> {
+  if (signal.aborted) {
+    // Observe work even when the pre-aborted path never reaches Promise.race.
+    promise.catch(() => {});
+    throwIfManifestLoadAborted(signal);
+  }
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      reject(
+        new BackendFederationManifestAdapterError(
+          'remote_unavailable',
+          '[BFF][Effect] Backend federation load was aborted before remote execution.',
+          signal.reason,
+        ),
+      );
+    };
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+
+  return Promise.race([promise, aborted]).finally(() => {
+    if (onAbort) {
+      signal.removeEventListener('abort', onAbort);
+    }
+  });
+}
+
 export async function loadBackendFederatedEffectApiFromManifest(
   options: BackendFederationManifestAdapterOptions,
 ): Promise<BackendFederatedEffectApiModule> {
@@ -150,16 +192,19 @@ export async function loadBackendFederatedEffectApiFromManifest(
   try {
     scope = createManifestLoadScope(options);
     throwIfManifestLoadAborted(scope.signal);
-    manifest = await loadBackendFederationManifest({
-      ...options,
-      manifestPolicy: {
-        ...options.manifestPolicy,
+    manifest = await settleOnSharedAbort(
+      loadBackendFederationManifest({
+        ...options,
+        manifestPolicy: {
+          ...options.manifestPolicy,
+          signal: scope.signal,
+          timeoutMs: 0,
+        },
         signal: scope.signal,
         timeoutMs: 0,
-      },
-      signal: scope.signal,
-      timeoutMs: 0,
-    });
+      }),
+      scope.signal,
+    );
     validateBackendFederationManifest(manifest, options.expected);
     remote = resolveBackendFederationRemoteFromManifest(
       manifest,
@@ -223,24 +268,27 @@ export async function loadBackendFederatedEffectApiFromManifest(
         'manifest_invalid',
         'Backend federation manifest requires delivery-unit identity.',
       );
-    const loaded = await loadBackendFederatedEffectApi({
-      hostName: options.hostName,
-      remote,
-      ...(options.plugins ? { plugins: options.plugins } : {}),
-      entryPolicy: {
-        ...options.entryPolicy,
-        signal: scope.signal,
-        timeoutMs: 0,
-      },
-      ...(options.runtime ? { runtime: options.runtime } : {}),
-      expected: { unitId, buildMarker },
-    }).catch((error: unknown) => {
-      throw new BackendFederationManifestAdapterError(
-        scope?.timedOut() === true ? 'timeout' : classifyLoadError(error),
-        `[BFF][Effect] Backend federation remote ${remote?.name ?? 'unknown'} could not load ${remote?.expose ?? BACKEND_FEDERATION_EFFECT_EXPOSE}.`,
-        error,
-      );
-    });
+    const loaded = await settleOnSharedAbort(
+      loadBackendFederatedEffectApi({
+        hostName: options.hostName,
+        remote,
+        ...(options.plugins ? { plugins: options.plugins } : {}),
+        entryPolicy: {
+          ...options.entryPolicy,
+          signal: scope.signal,
+          timeoutMs: 0,
+        },
+        ...(options.runtime ? { runtime: options.runtime } : {}),
+        expected: { unitId, buildMarker },
+      }).catch((error: unknown) => {
+        throw new BackendFederationManifestAdapterError(
+          scope?.timedOut() === true ? 'timeout' : classifyLoadError(error),
+          `[BFF][Effect] Backend federation remote ${remote?.name ?? 'unknown'} could not load ${remote?.expose ?? BACKEND_FEDERATION_EFFECT_EXPOSE}.`,
+          error,
+        );
+      }),
+      scope.signal,
+    );
 
     validateLoadedBackendFederationContract(loaded, manifest, remote);