@bleedingdev/modern-js-plugin-bff-extensions 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/src/backend-federation/runtime.ts

@@ -1,99 +1,25 @@
 import { ModuleFederation } from '@module-federation/runtime';
 
-import { loadBackendFederationExpose } from './entry';
-import { createBackendFederationLoadEntryPlugin } from './plugin';
+import { createBackendFederationIntegrityPlugin } from './integrity-plugin';
 import { collectRemotes } from './remotes';
-import type {
-  BackendFederationRemote,
-  BackendFederationRuntimeOptions,
-} from './types';
-
-let nextRuntimeId = 0;
-
-function parseRemoteRequest(request: string) {
-  const [remoteName, ...exposeParts] = request.split('/');
-  if (
-    remoteName === undefined ||
-    remoteName.length === 0 ||
-    exposeParts.length === 0
-  ) {
-    return;
-  }
-  return remoteName;
-}
-
-function createLocalEntryPlugin(
-  options: BackendFederationRuntimeOptions,
-  remotes: BackendFederationRemote[],
-) {
-  return createBackendFederationLoadEntryPlugin({
-    resolveEntry(resolvedRemote) {
-      const remote = remotes.find(
-        candidate => candidate.name === resolvedRemote.name,
-      );
-      if (remote === undefined) {
-        return;
-      }
-      return {
-        get(expose: string) {
-          return () => loadBackendFederationExpose(remote, expose, options);
-        },
-      };
-    },
-  });
-}
-
-function isolateRegisteredRemoteEntries(remotes: BackendFederationRemote[]) {
-  const runtimeId = nextRuntimeId;
-  nextRuntimeId += 1;
-  return remotes.map(remote => ({
-    ...remote,
-    entry: `${remote.entry}#modernjs-backend-runtime-${runtimeId}`,
-  }));
-}
-
-class BackendFederationRuntime extends ModuleFederation {
-  readonly #remoteNames: ReadonlySet<string>;
-
-  constructor(
-    options: BackendFederationRuntimeOptions,
-    remotes: BackendFederationRemote[],
-  ) {
-    super({
-      name: options.hostName,
-      remotes: isolateRegisteredRemoteEntries(remotes),
-      shared: {},
-      plugins: [createLocalEntryPlugin(options, remotes)],
-    });
-    this.#remoteNames = new Set(remotes.map(remote => remote.name));
-  }
-
-  override loadRemote<T>(
-    request: string,
-    loadOptions?: NonNullable<Parameters<ModuleFederation['loadRemote']>[1]>,
-  ): Promise<T | null> {
-    const remoteName = parseRemoteRequest(request);
-    if (remoteName === undefined) {
-      return Promise.reject(
-        new Error(
-          `[BFF][Effect] Invalid backend federation request ${request}.`,
-        ),
-      );
-    }
-    if (!this.#remoteNames.has(remoteName)) {
-      return Promise.reject(
-        new Error(
-          `[BFF][Effect] Missing backend federation remote ${remoteName}.`,
-        ),
-      );
-    }
-    return super.loadRemote<T>(request, loadOptions);
-  }
-}
+import type { BackendFederationRuntimeOptions } from './types';
 
 export function createBackendFederationRuntime(
   options: BackendFederationRuntimeOptions,
 ): ModuleFederation {
   const remotes = collectRemotes(options);
-  return new BackendFederationRuntime(options, remotes);
+  return new ModuleFederation({
+    name: options.hostName,
+    // Remotes use the default share scope, where host shares are registered.
+    remotes: remotes.map(({ name, entry, type }) => ({
+      name,
+      entry,
+      ...(type ? { type } : {}),
+    })),
+    shared: options.shared ?? {},
+    plugins: [
+      ...(options.plugins ?? []),
+      createBackendFederationIntegrityPlugin(options, remotes),
+    ],
+  });
 }

package/src/backend-federation/types.ts

@@ -1,9 +1,9 @@
+import type { BACKEND_FEDERATION_EFFECT_EXPOSE } from '@modern-js/backend-federation-contracts';
 import type { EffectApiModule } from '@modern-js/bff-effect/effect';
 import type {
   BackendFederationRemoteEntryPolicy,
   BackendFederationRemoteEntryVerification,
 } from '@modern-js/server-runtime-extensions/backend-federation-security';
-import type { BACKEND_FEDERATION_EFFECT_EXPOSE } from '@modern-js/utils/universal';
 import type {
   ModuleFederation,
   ModuleFederationRuntimePlugin,
@@ -14,8 +14,6 @@ export type BackendFederationRemote = {
   name: string;
   entry: string;
   type?: 'commonjs-module' | 'module' | string;
-  entryGlobalName?: string;
-  shareScope?: string | string[];
   expose?: typeof BACKEND_FEDERATION_EFFECT_EXPOSE;
   verification?: BackendFederationRemoteEntryVerification;
 };
@@ -25,6 +23,8 @@ export type BackendFederationRuntimeOptions = {
   remote?: BackendFederationRemote;
   remotes?: BackendFederationRemote[];
   plugins?: ModuleFederationRuntimePlugin[];
+  /** Host shares handed to every remote container's `init()`. */
+  shared?: ConstructorParameters<typeof ModuleFederation>[0]['shared'];
   entryPolicy?: BackendFederationRemoteEntryPolicy;
 };
 
@@ -85,19 +85,4 @@ export type BackendFederationLoadOptions = BackendFederationRuntimeOptions & {
 export type BackendFederationIdentityLoadOptions =
   BackendFederationLoadOptions & {
     expected: BackendFederationExpectedIdentity;
-    /**
-     * Tolerate legacy exposes without identity metadata (mismatching declared
-     * values still fail). Prefer leaving this unset: identity-less exposes
-     * cannot be validated against a resolved delivery-unit record.
-     */
-    allowMissingIdentityMetadata?: boolean;
   };
-
-export type BackendFederationLoadEntryPlugin = ModuleFederationRuntimePlugin & {
-  loadEntry?: (args: {
-    remoteInfo: BackendFederationRemote;
-  }) =>
-    | BackendFederationEntryExports
-    | undefined
-    | Promise<BackendFederationEntryExports | undefined>;
-};

package/src/backend-federation/validate-loaded.ts

@@ -9,8 +9,7 @@ import { isRecord } from './utils';
 export function validateLoadedBackendFederatedEffectApi(
   loaded: unknown,
   options: {
-    allowMissingIdentityMetadata?: boolean;
-    expected?: BackendFederationExpectedIdentity;
+    expected: BackendFederationExpectedIdentity;
     remoteName: string;
     remoteRequest: string;
   },
@@ -52,14 +51,10 @@ export function validateLoadedBackendFederatedEffectApi(
     );
   }
 
-  if (options.expected !== undefined) {
+  {
     const issues = validateExpectedBackendFederationIdentity(
       loaded,
       options.expected,
-      {
-        allowMissingIdentityMetadata:
-          options.allowMissingIdentityMetadata === true,
-      },
     );
     if (issues.length > 0) {
       throw new Error(

package/src/backend-federation-manifest/load.ts

@@ -7,6 +7,12 @@ import {
 } from '../backend-federation';
 import { loadBackendFederatedEffectApi } from '../backend-federation/load';
 import { BackendFederationManifestAdapterError } from './errors';
+import {
+  backendFederationMetadata,
+  manifestDeliveryUnit,
+  stringValue,
+  versionBoundaryMetadata,
+} from './metadata';
 import { loadBackendFederationManifest } from './reference';
 import { resolveBackendFederationRemoteFromManifest } from './remote';
 import type {
@@ -19,6 +25,10 @@ import {
   validateLoadedBackendFederationContract,
 } from './validation';
 
+// One manifest+entry budget. Explicit outer 0 opts out; nested 0 cannot
+// disable a positive nested deadline.
+const DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS = 10_000;
+
 function createManifestLoadScope(
   options: BackendFederationManifestAdapterOptions,
 ) {
@@ -38,9 +48,14 @@ function createManifestLoadScope(
       );
     }
   }
+  const positivePolicyTimeouts = policyTimeouts.filter(timeout => timeout > 0);
   const timeoutMs =
     options.timeoutMs ??
-    (policyTimeouts.length > 0 ? Math.min(...policyTimeouts) : 0);
+    (policyTimeouts.length === 0
+      ? DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS
+      : positivePolicyTimeouts.length > 0
+        ? Math.min(...positivePolicyTimeouts)
+        : 0);
   const inputSignals = [
     options.signal,
     options.manifestPolicy?.signal,
@@ -134,6 +149,39 @@ function throwIfManifestLoadAborted(signal: AbortSignal) {
   }
 }
 
+// Stop waiting even when trusted plugin work ignores cancellation. The race
+// observes late rejections; it cannot stop that work from running.
+function settleOnSharedAbort<T>(
+  promise: Promise<T>,
+  signal: AbortSignal,
+): Promise<T> {
+  if (signal.aborted) {
+    // Observe work even when the pre-aborted path never reaches Promise.race.
+    promise.catch(() => {});
+    throwIfManifestLoadAborted(signal);
+  }
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      reject(
+        new BackendFederationManifestAdapterError(
+          'remote_unavailable',
+          '[BFF][Effect] Backend federation load was aborted before remote execution.',
+          signal.reason,
+        ),
+      );
+    };
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+
+  return Promise.race([promise, aborted]).finally(() => {
+    if (onAbort) {
+      signal.removeEventListener('abort', onAbort);
+    }
+  });
+}
+
 export async function loadBackendFederatedEffectApiFromManifest(
   options: BackendFederationManifestAdapterOptions,
 ): Promise<BackendFederatedEffectApiModule> {
@@ -144,16 +192,19 @@ export async function loadBackendFederatedEffectApiFromManifest(
   try {
     scope = createManifestLoadScope(options);
     throwIfManifestLoadAborted(scope.signal);
-    manifest = await loadBackendFederationManifest({
-      ...options,
-      manifestPolicy: {
-        ...options.manifestPolicy,
+    manifest = await settleOnSharedAbort(
+      loadBackendFederationManifest({
+        ...options,
+        manifestPolicy: {
+          ...options.manifestPolicy,
+          signal: scope.signal,
+          timeoutMs: 0,
+        },
         signal: scope.signal,
         timeoutMs: 0,
-      },
-      signal: scope.signal,
-      timeoutMs: 0,
-    });
+      }),
+      scope.signal,
+    );
     validateBackendFederationManifest(manifest, options.expected);
     remote = resolveBackendFederationRemoteFromManifest(
       manifest,
@@ -204,37 +255,41 @@ export async function loadBackendFederatedEffectApiFromManifest(
       );
     }
 
-    const loaded = await loadBackendFederatedEffectApi({
-      hostName: options.hostName,
-      remote,
-      ...(options.plugins ? { plugins: options.plugins } : {}),
-      entryPolicy: {
-        ...options.entryPolicy,
-        signal: scope.signal,
-        timeoutMs: 0,
-      },
-      ...(options.runtime ? { runtime: options.runtime } : {}),
-      // MV-G23: route the manifest adapter through the raw loader's shared
-      // delivery-unit identity validation when an identity is expected.
-      ...(options.expected?.unitId && options.expected.buildMarker
-        ? {
-            expected: {
-              unitId: options.expected.unitId,
-              buildMarker: options.expected.buildMarker,
-            },
-            // The manifest's identity is already validated against
-            // `expected`; legacy exposes without identity metadata stay
-            // loadable (mismatching declared values still fail).
-            allowMissingIdentityMetadata: true,
-          }
-        : {}),
-    }).catch((error: unknown) => {
+    const deliveryUnit = manifestDeliveryUnit(
+      backendFederationMetadata(manifest),
+      versionBoundaryMetadata(manifest),
+    );
+    const unitId =
+      stringValue(deliveryUnit.boundary?.unitId) ??
+      stringValue(deliveryUnit.top?.unitId);
+    const buildMarker = stringValue(deliveryUnit.boundary?.buildMarker);
+    if (!unitId || !buildMarker)
       throw new BackendFederationManifestAdapterError(
-        scope?.timedOut() === true ? 'timeout' : classifyLoadError(error),
-        `[BFF][Effect] Backend federation remote ${remote?.name ?? 'unknown'} could not load ${remote?.expose ?? BACKEND_FEDERATION_EFFECT_EXPOSE}.`,
-        error,
+        'manifest_invalid',
+        'Backend federation manifest requires delivery-unit identity.',
       );
-    });
+    const loaded = await settleOnSharedAbort(
+      loadBackendFederatedEffectApi({
+        hostName: options.hostName,
+        remote,
+        ...(options.plugins ? { plugins: options.plugins } : {}),
+        ...(options.shared ? { shared: options.shared } : {}),
+        entryPolicy: {
+          ...options.entryPolicy,
+          signal: scope.signal,
+          timeoutMs: 0,
+        },
+        ...(options.runtime ? { runtime: options.runtime } : {}),
+        expected: { unitId, buildMarker },
+      }).catch((error: unknown) => {
+        throw new BackendFederationManifestAdapterError(
+          scope?.timedOut() === true ? 'timeout' : classifyLoadError(error),
+          `[BFF][Effect] Backend federation remote ${remote?.name ?? 'unknown'} could not load ${remote?.expose ?? BACKEND_FEDERATION_EFFECT_EXPOSE}.`,
+          error,
+        );
+      }),
+      scope.signal,
+    );
 
     validateLoadedBackendFederationContract(loaded, manifest, remote);
 

package/src/backend-federation-manifest/metadata.ts

@@ -3,7 +3,7 @@
 import {
   backendFederationMetadata as sharedBackendFederationMetadata,
   backendFederationVersionBoundary as sharedBackendFederationVersionBoundary,
-} from '@modern-js/utils/universal';
+} from '@modern-js/backend-federation-contracts';
 import type { BackendFederationManifest } from './types';
 
 export function stringValue(value: unknown) {
@@ -56,12 +56,6 @@ export function deliveryUnitMetadata(
   return recordField(record, 'deliveryUnit');
 }
 
-/**
- * Resolves the delivery-unit identity root for a manifest (ADR-0019 §3):
- * prefers `versionBoundary.deliveryUnit`, falls back to the top-level
- * `backendFederation.deliveryUnit` record. Both are additive/optional so
- * legacy manifests without delivery-unit metadata continue to validate.
- */
 export function manifestDeliveryUnit(
   backendFederation: Record<string, unknown> | undefined,
   boundary: Record<string, unknown> | undefined,

package/src/backend-federation-manifest/node.ts

@@ -1,14 +1,15 @@
 import { evaluateNodeBackendFederationCommonJs } from '@modern-js/server-runtime-extensions/backend-federation-security/node';
-
 import type { BackendFederatedEffectApiModule } from '../backend-federation';
+import { withEffectBffHostShared } from '../backend-federation/node-shared';
 import { loadBackendFederatedEffectApiFromManifest as loadUniversalBackendFederatedEffectApiFromManifest } from './load';
 import type { BackendFederationManifestAdapterOptions } from './types';
 
-export function loadBackendFederatedEffectApiFromManifest(
+export async function loadBackendFederatedEffectApiFromManifest(
   options: BackendFederationManifestAdapterOptions,
 ): Promise<BackendFederatedEffectApiModule> {
   return loadUniversalBackendFederatedEffectApiFromManifest({
     ...options,
+    shared: withEffectBffHostShared(options.shared),
     entryPolicy: {
       ...options.entryPolicy,
       evaluateCommonJs:

package/src/backend-federation-manifest/remote.ts

@@ -1,10 +1,10 @@
 // @effect-diagnostics asyncFunction:off extendsNativeError:off globalTimers:off newPromise:off strictBooleanExpressions:off
 
+import { backendFederationExposeNames } from '@modern-js/backend-federation-contracts';
 import {
   BackendFederationRemoteEntryError,
   resolveBackendFederationRemoteEntryVerification,
 } from '@modern-js/server-runtime-extensions/backend-federation-security';
-import { backendFederationExposeNames } from '@modern-js/utils/universal';
 import {
   BACKEND_FEDERATION_EFFECT_EXPOSE,
   type BackendFederationRemote,
@@ -91,12 +91,6 @@ export function resolveBackendFederationRemoteFromManifest(
     entry: remoteEntryUrl,
     type: remoteType,
     ...(verification ? { verification } : {}),
-    ...(remoteOverride.entryGlobalName
-      ? { entryGlobalName: remoteOverride.entryGlobalName }
-      : {}),
     expose,
-    ...(remoteOverride.shareScope
-      ? { shareScope: remoteOverride.shareScope }
-      : {}),
   };
 }

package/src/backend-federation-manifest/types.ts

@@ -12,6 +12,7 @@ import type {
 import type {
   BackendFederatedEffectApiModule,
   BackendFederationRemote,
+  BackendFederationRuntimeOptions,
 } from '../backend-federation';
 import type { BackendFederationManifestAdapterError } from './errors';
 
@@ -68,6 +69,7 @@ export type BackendFederationManifestAdapterOptions = {
   plugins?: ModuleFederationRuntimePlugin[];
   remote?: Partial<BackendFederationRemote>;
   runtime?: ModuleFederation;
+  shared?: BackendFederationRuntimeOptions['shared'];
   signal?: AbortSignal;
   timeoutMs?: number;
 };

package/src/backend-federation-manifest/validation.ts

@@ -3,13 +3,18 @@
 import {
   formatBackendFederationValidationErrors,
   validateBackendFederationManifest as validateBackendFederationManifestContract,
-} from '@modern-js/utils/universal';
+} from '@modern-js/backend-federation-contracts';
 import {
   BACKEND_FEDERATION_CONTRACT_VERSION,
   BACKEND_FEDERATION_NODE_ADAPTER_VERSION,
   type BackendFederatedEffectApiModule,
   type BackendFederationRemote,
 } from '../backend-federation';
+import {
+  backendFederationCompatibility,
+  formatBackendFederationIdentityIssues,
+  validateBackendFederationCompatibility,
+} from '../backend-federation/identity';
 import {
   assertConsistentValue,
   assertManifestAdapter,
@@ -19,7 +24,6 @@ import {
 import {
   backendFederationMetadata,
   manifestDeliveryUnit,
-  recordField,
   stringValue,
   versionBoundaryMetadata,
 } from './metadata';
@@ -48,11 +52,6 @@ function resolveExpectedBuildMarker(
     );
   }
 
-  // Intentionally no fallback to `buildVersion` here: this is only used to
-  // compare against manifest `deliveryUnit.buildMarker`, which is a
-  // separate, additive field. Callers that only pass `buildVersion` (the
-  // pre-ADR-0019 expectation shape) must not be forced to also match a
-  // delivery-unit build marker on the manifest.
   return expected.buildMarker;
 }
 
@@ -70,7 +69,6 @@ export function validateBackendFederationManifest(
   const manifestShape = validateBackendFederationManifestContract(manifest, {
     expectedContractVersion: false,
     expectedNodeAdapterVersion: false,
-    validateDeliveryUnit: false,
   });
   assertManifestAdapter(
     manifestShape.ok,
@@ -151,6 +149,11 @@ export function validateBackendFederationManifest(
   const manifestUnitId =
     stringValue(deliveryUnit.boundary?.unitId) ??
     stringValue(deliveryUnit.top?.unitId);
+  assertManifestAdapter(
+    manifestUnitId && stringValue(deliveryUnit.boundary?.buildMarker),
+    'manifest_invalid',
+    'Backend federation manifest requires delivery-unit unitId and buildMarker.',
+  );
   assertVersionValue(manifestUnitId, expected.unitId, 'deliveryUnit.unitId');
   assertVersionValue(
     stringValue(deliveryUnit.boundary?.buildMarker),
@@ -167,7 +170,7 @@ export function validateLoadedBackendFederationContract(
   const loadedContract = loaded.backendFederationContract;
   const backendFederation = backendFederationMetadata(manifest);
   const boundary = versionBoundaryMetadata(manifest);
-  const compatibility = recordField(loadedContract, 'compatibility');
+  const compatibility = backendFederationCompatibility(loaded);
 
   assertManifestAdapter(
     compatibility,
@@ -187,26 +190,6 @@ export function validateLoadedBackendFederationContract(
     remote.name,
     'expose name',
   );
-  assertVersionValue(
-    stringValue(compatibility.contractVersion),
-    stringValue(backendFederation?.contractVersion),
-    'expose contractVersion',
-  );
-  assertVersionValue(
-    stringValue(compatibility.nodeAdapterVersion),
-    stringValue(backendFederation?.nodeAdapterVersion),
-    'expose nodeAdapterVersion',
-  );
-  assertVersionValue(
-    stringValue(compatibility.packageName),
-    stringValue(boundary?.packageName),
-    'expose packageName',
-  );
-  assertVersionValue(
-    stringValue(compatibility.build),
-    stringValue(boundary?.buildVersion),
-    'expose buildVersion',
-  );
 
   const deliveryUnit = manifestDeliveryUnit(backendFederation, boundary);
   const manifestUnitId =
@@ -214,17 +197,24 @@ export function validateLoadedBackendFederationContract(
     stringValue(deliveryUnit.top?.unitId);
   const manifestBuildMarker = stringValue(deliveryUnit.boundary?.buildMarker);
 
-  // Only enforced when both sides declare the field: absence on either side
-  // is a legacy manifest/expose and must stay backward compatible.
-  assertConsistentValue(
-    manifestUnitId,
-    stringValue(compatibility.unitId),
-    'deliveryUnit.unitId vs expose compatibility.unitId',
-  );
-  assertConsistentValue(
-    manifestBuildMarker,
+  const issues = validateBackendFederationCompatibility(compatibility, {
+    contractVersion: stringValue(backendFederation?.contractVersion),
+    nodeAdapterVersion: stringValue(backendFederation?.nodeAdapterVersion),
+    packageName: stringValue(boundary?.packageName),
+    unitId: manifestUnitId,
+    build: manifestBuildMarker ?? stringValue(boundary?.buildVersion),
+  });
+  // Manifest validation establishes buildVersion/buildMarker consistency; the
+  // executed expose is still checked independently against that trusted record.
+  assertVersionValue(
     stringValue(compatibility.build),
-    'deliveryUnit.buildMarker vs expose compatibility.build',
+    stringValue(boundary?.buildVersion),
+    'expose buildVersion',
+  );
+  assertManifestAdapter(
+    issues.length === 0,
+    'version_mismatch',
+    `[BFF][Effect] ${formatBackendFederationIdentityIssues(issues)}.`,
   );
 }
 

package/src/cross-project-policy/evaluation.ts

@@ -3,7 +3,7 @@ import {
   evaluateCrossProjectPolicy,
   type NormalizedCrossProjectPolicy,
   resolveCrossProjectRequestObservation,
-} from '@modern-js/bff-core/security/cross-project-policy';
+} from '@modern-js/server-runtime-extensions/bff-policy';
 
 export type ResolvedCrossProjectPolicy = NormalizedCrossProjectPolicy;
 

package/src/cross-project-policy/node.ts

@@ -1,48 +1,17 @@
-import { readFileSync } from 'node:fs';
-import path from 'node:path';
-
+import '@modern-js/server-runtime-extensions/server-config';
+import type { ServerPluginAPI } from '@modern-js/server-core';
 import {
-  deriveOperationVersion,
   type OperationContractSource,
   resolveCrossProjectPolicy,
-} from '@modern-js/bff-core';
-import type { ServerPluginAPI } from '@modern-js/server-core';
+  resolveOperationProducer,
+} from '@modern-js/server-runtime-extensions/bff-policy/node';
 
 import type { ResolvedCrossProjectPolicy } from './evaluation';
 
-const readNearestPackageVersion = (
-  startDir: string | undefined,
-): string | undefined => {
-  if (!startDir) {
-    return undefined;
-  }
-
-  let current = path.resolve(startDir);
-  for (let depth = 0; depth < 10; depth += 1) {
-    try {
-      const packageJson = JSON.parse(
-        readFileSync(path.join(current, 'package.json'), 'utf8'),
-      ) as { version?: unknown };
-      if (typeof packageJson.version === 'string') {
-        return packageJson.version;
-      }
-    } catch {
-      // The producer package may be nested below its package.json.
-    }
-
-    const parent = path.dirname(current);
-    if (parent === current) {
-      return undefined;
-    }
-    current = parent;
-  }
-
-  return undefined;
-};
-
 export const resolveAdapterCrossProjectPolicy = (
   api: ServerPluginAPI,
   handlers: OperationContractSource[],
+  producer?: ReturnType<typeof resolveOperationProducer>,
 ): ResolvedCrossProjectPolicy | undefined => {
   const bff = api.getServerConfig()?.bff;
   const { apiDirectory, appDirectory } = api.getServerContext() as {
@@ -53,11 +22,11 @@ export const resolveAdapterCrossProjectPolicy = (
   return resolveCrossProjectPolicy({
     crossProjectPolicy: bff?.crossProjectPolicy,
     handlers,
-    requestId: bff?.requestId,
     isCrossProjectServer: bff?.isCrossProjectServer,
-    operationVersion: deriveOperationVersion(
-      readNearestPackageVersion(apiDirectory) ??
-        readNearestPackageVersion(appDirectory),
-    ),
+    ...(producer ??
+      resolveOperationProducer({
+        directories: [apiDirectory, appDirectory],
+        requestId: bff?.requestId || 'default',
+      })),
   });
 };