@bleedingdev/modern-js-plugin-bff-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.10

package/README.md

@@ -1,7 +1,7 @@
 # @modern-js/plugin-bff-extensions
 
 Fork-owned integration extensions for UltraModern.js BFFs. This package keeps
-Effect adapter lifecycle integration, server source loading,
+Effect server lifecycle integration, server source loading,
 cross-project policy, Hono middleware, and backend federation out of the
 upstream-owned `@modern-js/plugin-bff` implementation.
 
@@ -12,20 +12,37 @@ upstream Modern.js project.
 ## Entry points
 
 - `/hono` exposes the peer-independent Hono route binder.
-- `/cross-project-policy`, `/effect-adapter`, and `/effect-source-loader` expose Node tooling and server integration.
+- `/cross-project-policy`, `/effect-server`, and `/effect-source-loader` expose Node tooling and server integration.
 - `/cross-project-generation` renders the generated producer client runtime
   consumed by `@modern-js/plugin-bff`.
 - `/backend-federation` exposes the portable federation runtime, while
   `/backend-federation/edge` rejects Node evaluators and non-binding remotes.
-- `/backend-federation/node` enables the hardened Node entry evaluator.
+  The runtime is a real Module Federation instance: caller `plugins` see its
+  lifecycle hooks, and a last integrity plugin loads each remote once per
+  runtime. `http(s):` entries must be SHA-256 and length verified, `data:` and
+  `file:` entries are evaluated or imported, and `binding:`, `service:` and
+  `static:` entries come from `createBackendFederationLoadEntryPlugin()`. Any
+  other entry fails with an error that names the remote. CommonJS containers are
+  evaluated per runtime; ES module containers are cached by Node per URL and
+  therefore shared between runtimes.
+- `/backend-federation/node` enables the hardened Node entry evaluator and
+  shares the Effect handler factory registry with remote containers through
+  their `init()` share scope.
 - `/backend-federation-manifest` exposes manifest contracts and resolution,
   while
   `/backend-federation-manifest/node` enables its hardened Node evaluator.
+  `loadBackendFederatedEffectApiFromManifest` enforces one shared
+  manifest-plus-entry load deadline (default 10s, override via `timeoutMs`,
+  0 to opt out) instead of resetting a fresh timeout per network hop. The
+  load settles on that shared deadline/abort even when a caller-pinned
+  entry provider plugin, its `init`/`get`, or a custom runtime's `loadRemote`
+  never settles; it cannot stop that uncooperative work from still running,
+  only stop waiting on it.
 
 Effect and its OpenTelemetry integration are exact-cohort optional peers. A
 Hono-only consumer can import `/hono` without installing Effect.
 
-There is deliberately no adapter-kit or re-export-only compatibility layer.
+There is deliberately no adapter registry or re-export-only compatibility layer.
 
 Effect server tooling derives operation-contract metadata without generating
 client code. Import shared `HttpApi` contracts in clients and use native

package/dist/cjs/backend-federation/edge.js

@@ -42,7 +42,7 @@ const external_edge_runtime_js_namespaceObject = require("./edge-runtime.js");
 const external_utils_js_namespaceObject = require("./utils.js");
 const external_identity_js_namespaceObject = require("./identity.js");
 function loadBackendFederatedEffectApi(options) {
-    if (void 0 !== options.runtime || void 0 !== options.entryPolicy) return Promise.reject(new Error('[BFF][Effect] Edge backend federation does not execute custom runtimes or entry evaluators. Register a static or service-binding entry provider.'));
+    if (void 0 !== options.runtime || void 0 !== options.entryPolicy || void 0 !== options.shared) return Promise.reject(new Error('[BFF][Effect] Edge backend federation does not execute custom runtimes, entry evaluators or host shares. Register a static or service-binding entry provider.'));
     const remoteName = options.remote?.name ?? options.remoteName;
     if (void 0 === remoteName || 0 === remoteName.length) return Promise.reject(new Error('[BFF][Effect] Missing backend federation remote name.'));
     if (!options.expected?.unitId || !options.expected.buildMarker) return Promise.reject(new Error('[BFF][Effect] Backend federation requires expected.unitId and expected.buildMarker.'));

package/dist/cjs/backend-federation/identity.js

@@ -28,47 +28,48 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
+    backendFederationCompatibility: ()=>backendFederationCompatibility,
     formatBackendFederationIdentityIssues: ()=>formatBackendFederationIdentityIssues,
+    validateBackendFederationCompatibility: ()=>validateBackendFederationCompatibility,
     validateExpectedBackendFederationIdentity: ()=>validateExpectedBackendFederationIdentity
 });
 const external_utils_js_namespaceObject = require("./utils.js");
-function validateExpectedBackendFederationIdentity(loaded, expected) {
-    const issues = [];
+function backendFederationCompatibility(loaded) {
     const contract = (0, external_utils_js_namespaceObject.isRecord)(loaded) ? loaded.backendFederationContract : void 0;
     const compatibility = (0, external_utils_js_namespaceObject.isRecord)(contract) ? contract.compatibility : void 0;
-    if (!(0, external_utils_js_namespaceObject.isRecord)(compatibility)) return [
+    return (0, external_utils_js_namespaceObject.isRecord)(compatibility) ? compatibility : void 0;
+}
+function validateBackendFederationCompatibility(compatibility, expected) {
+    return Object.entries(expected).flatMap(([field, value])=>void 0 === value || 'string' == typeof compatibility[field] && compatibility[field].length > 0 && compatibility[field] === value ? [] : [
+            {
+                path: `backendFederationContract.compatibility.${field}`,
+                message: `expected ${value}, received ${'string' == typeof compatibility[field] ? compatibility[field] : typeof compatibility[field]}`
+            }
+        ]);
+}
+function validateExpectedBackendFederationIdentity(loaded, expected) {
+    const compatibility = backendFederationCompatibility(loaded);
+    return compatibility ? validateBackendFederationCompatibility(compatibility, {
+        unitId: expected.unitId,
+        build: expected.buildMarker
+    }) : [
         {
             path: 'backendFederationContract.compatibility',
             message: 'loaded module declares no compatibility metadata; delivery-unit identity cannot be validated'
         }
     ];
-    const unitId = compatibility.unitId;
-    if ('string' != typeof unitId || 0 === unitId.length) issues.push({
-        path: 'backendFederationContract.compatibility.unitId',
-        message: `missing delivery-unit id; expected ${expected.unitId}`
-    });
-    else if (unitId !== expected.unitId) issues.push({
-        path: 'backendFederationContract.compatibility.unitId',
-        message: `expected ${expected.unitId}, received ${unitId}`
-    });
-    const build = compatibility.build;
-    if ('string' != typeof build || 0 === build.length) issues.push({
-        path: 'backendFederationContract.compatibility.build',
-        message: `missing build marker; expected ${expected.buildMarker}`
-    });
-    else if (build !== expected.buildMarker) issues.push({
-        path: 'backendFederationContract.compatibility.build',
-        message: `expected ${expected.buildMarker}, received ${build}`
-    });
-    return issues;
 }
 function formatBackendFederationIdentityIssues(issues) {
     return issues.map((issue)=>`${issue.path}: ${issue.message}`).join('; ');
 }
+exports.backendFederationCompatibility = __webpack_exports__.backendFederationCompatibility;
 exports.formatBackendFederationIdentityIssues = __webpack_exports__.formatBackendFederationIdentityIssues;
+exports.validateBackendFederationCompatibility = __webpack_exports__.validateBackendFederationCompatibility;
 exports.validateExpectedBackendFederationIdentity = __webpack_exports__.validateExpectedBackendFederationIdentity;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "backendFederationCompatibility",
     "formatBackendFederationIdentityIssues",
+    "validateBackendFederationCompatibility",
     "validateExpectedBackendFederationIdentity"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/cjs/backend-federation/integrity-plugin.js

@@ -0,0 +1,112 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    PROVIDED_ENTRY_SCHEME: ()=>PROVIDED_ENTRY_SCHEME,
+    createBackendFederationIntegrityPlugin: ()=>createBackendFederationIntegrityPlugin,
+    registerRemoteContainer: ()=>registerRemoteContainer
+});
+const backend_federation_security_namespaceObject = require("@modern-js/server-runtime-extensions/backend-federation-security");
+const runtime_namespaceObject = require("@module-federation/runtime");
+const PROVIDED_ENTRY_SCHEME = /^(?:binding|service|static):/u;
+function decodeDataUrl(remote) {
+    const commaIndex = remote.entry.indexOf(',');
+    if (commaIndex < 0) throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} has an invalid data URL entry.`);
+    return new TextEncoder().encode(decodeURIComponent(remote.entry.slice(commaIndex + 1)));
+}
+async function importContainer(remote) {
+    const namespace = await import(remote.entry);
+    return namespace.default ?? namespace;
+}
+function loadContainer(remote, options) {
+    const verified = Boolean(remote.verification || options.entryPolicy?.expected);
+    const scheme = /^[a-z][a-z0-9+.-]*:/iu.exec(remote.entry)?.[0].toLowerCase();
+    if ('https:' === scheme || 'http:' === scheme) {
+        if (!verified) throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} requires verified entry bytes before network execution.`);
+        return (0, backend_federation_security_namespaceObject.loadVerifiedBackendFederationEntry)({
+            ...options.entryPolicy,
+            remote,
+            ...remote.verification ? {
+                verification: remote.verification
+            } : {}
+        });
+    }
+    if (verified) throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} declares entry verification, but only http(s) entries are fetched and verified.`);
+    if ('data:' === scheme && 'module' !== remote.type) return Promise.resolve((0, backend_federation_security_namespaceObject.evaluateBackendFederationCommonJsEntry)(remote, decodeDataUrl(remote), options.entryPolicy?.evaluateCommonJs));
+    if ('data:' === scheme || 'file:' === scheme) return importContainer(remote);
+    throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} uses unsupported entry ${remote.entry}. Use a verified http(s) entry, a data: or file: entry, or a binding:, service: or static: entry served by createBackendFederationLoadEntryPlugin().`);
+}
+function registerRemoteContainer(origin, remoteInfo, container) {
+    const module = new runtime_namespaceObject.Module({
+        host: origin,
+        remoteInfo
+    });
+    module.remoteEntryExports = container;
+    origin.moduleCache.set(remoteInfo.name, module);
+}
+function createBackendFederationIntegrityPlugin(options, remotes) {
+    const loading = new Map();
+    const register = async (origin, remoteInfo)=>{
+        const remote = remotes.find((candidate)=>candidate.name === remoteInfo.name);
+        if (void 0 === remote) throw new Error(`[BFF][Effect] Missing backend federation remote ${remoteInfo.name}.`);
+        if (PROVIDED_ENTRY_SCHEME.test(remote.entry)) {
+            if (origin.moduleCache.get(remote.name)?.remoteEntryExports === void 0) throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} has no entry provider for ${remote.entry}. Pass createBackendFederationLoadEntryPlugin() in plugins.`);
+            return;
+        }
+        const container = await loadContainer(remote, options);
+        if ('function' != typeof container?.get) throw new Error(`[BFF][Effect] Backend federation remote ${remote.name} entry must expose get().`);
+        registerRemoteContainer(origin, remoteInfo, container);
+    };
+    return {
+        name: 'modernjs-backend-federation-integrity',
+        afterMatchRemote ({ origin, remoteInfo }) {
+            if (void 0 === remoteInfo) return;
+            let pending = loading.get(remoteInfo.name);
+            if (void 0 === pending) {
+                pending = register(origin, remoteInfo);
+                loading.set(remoteInfo.name, pending);
+                pending.catch(()=>{
+                    if (loading.get(remoteInfo.name) === pending) loading.delete(remoteInfo.name);
+                });
+            }
+            return pending;
+        }
+    };
+}
+exports.PROVIDED_ENTRY_SCHEME = __webpack_exports__.PROVIDED_ENTRY_SCHEME;
+exports.createBackendFederationIntegrityPlugin = __webpack_exports__.createBackendFederationIntegrityPlugin;
+exports.registerRemoteContainer = __webpack_exports__.registerRemoteContainer;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "PROVIDED_ENTRY_SCHEME",
+    "createBackendFederationIntegrityPlugin",
+    "registerRemoteContainer"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/backend-federation/node-shared.js

@@ -0,0 +1,85 @@
+"use strict";
+const __rslib_import_meta_url__ = /*#__PURE__*/ function() {
+    return "u" < typeof document ? new (require('url'.replace('', ''))).URL('file:' + __filename).href : document.currentScript && document.currentScript.src || new URL('main.js', document.baseURI).href;
+}();
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    effectBffHostShared: ()=>effectBffHostShared,
+    withEffectBffHostShared: ()=>withEffectBffHostShared
+});
+const external_node_module_namespaceObject = require("node:module");
+const fromAdapter = (0, external_node_module_namespaceObject.createRequire)(__rslib_import_meta_url__);
+const effectPackageJson = fromAdapter.resolve('@modern-js/bff-effect/package.json');
+const fromEffectPackage = (0, external_node_module_namespaceObject.createRequire)(effectPackageJson);
+let hostShared;
+function effectBffHostShared() {
+    if (void 0 !== hostShared) return hostShared;
+    const { EFFECT_BFF_CONTEXT_STORAGE_SHARE, EFFECT_BFF_HANDLER_FACTORY_REGISTRY_SHARE } = fromEffectPackage('@modern-js/bff-effect/effect-edge');
+    const { getEffectContextStorage } = fromEffectPackage('@modern-js/bff-effect/context');
+    const handlerFactoryRegistry = fromEffectPackage("#effect-entry-shape-registry");
+    const version = fromAdapter(effectPackageJson).version;
+    hostShared = {
+        [EFFECT_BFF_HANDLER_FACTORY_REGISTRY_SHARE]: {
+            version,
+            lib: ()=>handlerFactoryRegistry,
+            shareConfig: {
+                singleton: true,
+                requiredVersion: false
+            }
+        },
+        [EFFECT_BFF_CONTEXT_STORAGE_SHARE]: {
+            version,
+            lib: getEffectContextStorage,
+            shareConfig: {
+                singleton: true,
+                requiredVersion: false
+            }
+        }
+    };
+    return hostShared;
+}
+function withEffectBffHostShared(shared) {
+    const host = effectBffHostShared();
+    const reserved = Object.keys(host).find((name)=>shared && name in shared);
+    if (void 0 !== reserved) throw new Error(`[BFF][Effect] Share ${reserved} is reserved for the Node host. Remove it from options.shared.`);
+    return {
+        ...shared,
+        ...host
+    };
+}
+exports.effectBffHostShared = __webpack_exports__.effectBffHostShared;
+exports.withEffectBffHostShared = __webpack_exports__.withEffectBffHostShared;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "effectBffHostShared",
+    "withEffectBffHostShared"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/backend-federation/node.js

@@ -28,21 +28,26 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
+    effectBffHostShared: ()=>external_node_shared_js_namespaceObject.effectBffHostShared,
     loadBackendFederatedEffectApi: ()=>loadBackendFederatedEffectApi
 });
 const node_namespaceObject = require("@modern-js/server-runtime-extensions/backend-federation-security/node");
 const external_load_js_namespaceObject = require("./load.js");
-function loadBackendFederatedEffectApi(options) {
+const external_node_shared_js_namespaceObject = require("./node-shared.js");
+async function loadBackendFederatedEffectApi(options) {
     return (0, external_load_js_namespaceObject.loadBackendFederatedEffectApi)({
         ...options,
+        shared: (0, external_node_shared_js_namespaceObject.withEffectBffHostShared)(options.shared),
         entryPolicy: {
             ...options.entryPolicy,
             evaluateCommonJs: options.entryPolicy?.evaluateCommonJs ?? node_namespaceObject.evaluateNodeBackendFederationCommonJs
         }
     });
 }
+exports.effectBffHostShared = __webpack_exports__.effectBffHostShared;
 exports.loadBackendFederatedEffectApi = __webpack_exports__.loadBackendFederatedEffectApi;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "effectBffHostShared",
     "loadBackendFederatedEffectApi"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/cjs/backend-federation/plugin.js

@@ -27,33 +27,52 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    createBackendFederationLoadEntryPlugin: ()=>createBackendFederationLoadEntryPlugin
+});
+const external_integrity_plugin_js_namespaceObject = require("./integrity-plugin.js");
+function toContainer(entry) {
+    return {
+        get (id) {
+            return ()=>Promise.resolve(entry.get(id)).then((factory)=>factory());
+        },
+        init (...args) {
+            return entry.init?.(...args);
+        }
+    };
+}
 function createBackendFederationLoadEntryPlugin(options) {
+    const provided = new WeakMap();
     return {
         name: 'modernjs-backend-federation-load-entry',
-        loadEntry ({ remoteInfo }) {
-            return Promise.resolve(options.resolveEntry({
-                name: remoteInfo.name,
-                entry: remoteInfo.entry,
-                type: remoteInfo.type,
-                entryGlobalName: remoteInfo.entryGlobalName,
-                shareScope: remoteInfo.shareScope
-            })).then((entry)=>{
-                if (void 0 === entry) return;
-                return {
-                    get (id) {
-                        return ()=>Promise.resolve(entry.get(id)).then((factory)=>factory());
-                    },
-                    init (...args) {
-                        return entry.init?.(...args);
-                    }
-                };
-            });
+        afterMatchRemote ({ origin, remoteInfo }) {
+            if (void 0 === remoteInfo || !external_integrity_plugin_js_namespaceObject.PROVIDED_ENTRY_SCHEME.test(remoteInfo.entry)) return;
+            let entries = provided.get(origin);
+            if (entries?.has(remoteInfo.name) !== true && origin.moduleCache.get(remoteInfo.name)?.remoteEntryExports !== void 0) return;
+            if (void 0 === entries) {
+                entries = new Map();
+                provided.set(origin, entries);
+            }
+            const runtimeEntries = entries;
+            let pending = runtimeEntries.get(remoteInfo.name);
+            if (void 0 === pending) {
+                pending = Promise.resolve(options.resolveEntry({
+                    name: remoteInfo.name,
+                    entry: remoteInfo.entry,
+                    type: remoteInfo.type
+                })).then((entry)=>{
+                    if (void 0 !== entry) (0, external_integrity_plugin_js_namespaceObject.registerRemoteContainer)(origin, remoteInfo, toContainer(entry));
+                });
+                const settled = pending;
+                runtimeEntries.set(remoteInfo.name, settled);
+                settled.catch(()=>{
+                    if (runtimeEntries.get(remoteInfo.name) === settled) runtimeEntries.delete(remoteInfo.name);
+                });
+            }
+            return pending;
         }
     };
 }
-__webpack_require__.d(__webpack_exports__, {
-    createBackendFederationLoadEntryPlugin: ()=>createBackendFederationLoadEntryPlugin
-});
 exports.createBackendFederationLoadEntryPlugin = __webpack_exports__.createBackendFederationLoadEntryPlugin;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "createBackendFederationLoadEntryPlugin"

package/dist/cjs/backend-federation/runtime.js

@@ -31,93 +31,25 @@ __webpack_require__.d(__webpack_exports__, {
     createBackendFederationRuntime: ()=>createBackendFederationRuntime
 });
 const runtime_namespaceObject = require("@module-federation/runtime");
-const external_entry_js_namespaceObject = require("./entry.js");
-const external_plugin_js_namespaceObject = require("./plugin.js");
+const external_integrity_plugin_js_namespaceObject = require("./integrity-plugin.js");
 const external_remotes_js_namespaceObject = require("./remotes.js");
-function _check_private_redeclaration(obj, privateCollection) {
-    if (privateCollection.has(obj)) throw new TypeError("Cannot initialize the same private elements twice on an object");
-}
-function _class_apply_descriptor_get(receiver, descriptor) {
-    if (descriptor.get) return descriptor.get.call(receiver);
-    return descriptor.value;
-}
-function _class_apply_descriptor_set(receiver, descriptor, value) {
-    if (descriptor.set) descriptor.set.call(receiver, value);
-    else {
-        if (!descriptor.writable) throw new TypeError("attempted to set read only private field");
-        descriptor.value = value;
-    }
-}
-function _class_extract_field_descriptor(receiver, privateMap, action) {
-    if (!privateMap.has(receiver)) throw new TypeError("attempted to " + action + " private field on non-instance");
-    return privateMap.get(receiver);
-}
-function _class_private_field_get(receiver, privateMap) {
-    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "get");
-    return _class_apply_descriptor_get(receiver, descriptor);
-}
-function _class_private_field_init(obj, privateMap, value) {
-    _check_private_redeclaration(obj, privateMap);
-    privateMap.set(obj, value);
-}
-function _class_private_field_set(receiver, privateMap, value) {
-    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "set");
-    _class_apply_descriptor_set(receiver, descriptor, value);
-    return value;
-}
-let nextRuntimeId = 0;
-function parseRemoteRequest(request) {
-    const [remoteName, ...exposeParts] = request.split('/');
-    if (void 0 === remoteName || 0 === remoteName.length || 0 === exposeParts.length) return;
-    return remoteName;
-}
-function createLocalEntryPlugin(options, remotes) {
-    return (0, external_plugin_js_namespaceObject.createBackendFederationLoadEntryPlugin)({
-        resolveEntry (resolvedRemote) {
-            const remote = remotes.find((candidate)=>candidate.name === resolvedRemote.name);
-            if (void 0 === remote) return;
-            return {
-                get (expose) {
-                    return ()=>(0, external_entry_js_namespaceObject.loadBackendFederationExpose)(remote, expose, options);
-                }
-            };
-        }
-    });
-}
-function isolateRegisteredRemoteEntries(remotes) {
-    const runtimeId = nextRuntimeId;
-    nextRuntimeId += 1;
-    return remotes.map((remote)=>({
-            ...remote,
-            entry: `${remote.entry}#modernjs-backend-runtime-${runtimeId}`
-        }));
-}
-var _remoteNames = /*#__PURE__*/ new WeakMap();
-class BackendFederationRuntime extends runtime_namespaceObject.ModuleFederation {
-    loadRemote(request, loadOptions) {
-        const remoteName = parseRemoteRequest(request);
-        if (void 0 === remoteName) return Promise.reject(new Error(`[BFF][Effect] Invalid backend federation request ${request}.`));
-        if (!_class_private_field_get(this, _remoteNames).has(remoteName)) return Promise.reject(new Error(`[BFF][Effect] Missing backend federation remote ${remoteName}.`));
-        return super.loadRemote(request, loadOptions);
-    }
-    constructor(options, remotes){
-        super({
-            name: options.hostName,
-            remotes: isolateRegisteredRemoteEntries(remotes),
-            shared: {},
-            plugins: [
-                createLocalEntryPlugin(options, remotes)
-            ]
-        }), _class_private_field_init(this, _remoteNames, {
-            writable: true,
-            value: void 0
-        });
-        _class_private_field_set(this, _remoteNames, new Set(remotes.map((remote)=>remote.name)));
-    }
-}
 function createBackendFederationRuntime(options) {
     const remotes = (0, external_remotes_js_namespaceObject.collectRemotes)(options);
-    return new BackendFederationRuntime(options, remotes);
+    return new runtime_namespaceObject.ModuleFederation({
+        name: options.hostName,
+        remotes: remotes.map(({ name, entry, type })=>({
+                name,
+                entry,
+                ...type ? {
+                    type
+                } : {}
+            })),
+        shared: options.shared ?? {},
+        plugins: [
+            ...options.plugins ?? [],
+            (0, external_integrity_plugin_js_namespaceObject.createBackendFederationIntegrityPlugin)(options, remotes)
+        ]
+    });
 }
 exports.createBackendFederationRuntime = __webpack_exports__.createBackendFederationRuntime;
 for(var __rspack_i in __webpack_exports__)if (-1 === [

package/dist/cjs/backend-federation-manifest/load.js

@@ -37,6 +37,7 @@ const external_metadata_js_namespaceObject = require("./metadata.js");
 const external_reference_js_namespaceObject = require("./reference.js");
 const external_remote_js_namespaceObject = require("./remote.js");
 const external_validation_js_namespaceObject = require("./validation.js");
+const DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS = 10000;
 function createManifestLoadScope(options) {
     const controller = new AbortController();
     const policyTimeouts = [
@@ -48,7 +49,8 @@ function createManifestLoadScope(options) {
         ...policyTimeouts
     ].filter((timeout)=>void 0 !== timeout);
     for (const timeout of configuredTimeouts)if (!Number.isSafeInteger(timeout) || timeout < 0) throw new external_errors_js_namespaceObject.BackendFederationManifestAdapterError('manifest_invalid', '[BFF][Effect] Backend federation timeoutMs must be a non-negative safe integer.');
-    const timeoutMs = options.timeoutMs ?? (policyTimeouts.length > 0 ? Math.min(...policyTimeouts) : 0);
+    const positivePolicyTimeouts = policyTimeouts.filter((timeout)=>timeout > 0);
+    const timeoutMs = options.timeoutMs ?? (0 === policyTimeouts.length ? DEFAULT_SHARED_MANIFEST_LOAD_TIMEOUT_MS : positivePolicyTimeouts.length > 0 ? Math.min(...positivePolicyTimeouts) : 0);
     const inputSignals = [
         options.signal,
         options.manifestPolicy?.signal,
@@ -102,6 +104,27 @@ function isCallerPinnedStaticRemote(options, remote) {
 function throwIfManifestLoadAborted(signal) {
     if (signal.aborted) throw new external_errors_js_namespaceObject.BackendFederationManifestAdapterError('remote_unavailable', '[BFF][Effect] Backend federation load was aborted before remote execution.', signal.reason);
 }
+function settleOnSharedAbort(promise, signal) {
+    if (signal.aborted) {
+        promise.catch(()=>{});
+        throwIfManifestLoadAborted(signal);
+    }
+    let onAbort;
+    const aborted = new Promise((_resolve, reject)=>{
+        onAbort = ()=>{
+            reject(new external_errors_js_namespaceObject.BackendFederationManifestAdapterError('remote_unavailable', '[BFF][Effect] Backend federation load was aborted before remote execution.', signal.reason));
+        };
+        signal.addEventListener('abort', onAbort, {
+            once: true
+        });
+    });
+    return Promise.race([
+        promise,
+        aborted
+    ]).finally(()=>{
+        if (onAbort) signal.removeEventListener('abort', onAbort);
+    });
+}
 async function loadBackendFederatedEffectApiFromManifest(options) {
     let manifest;
     let remote;
@@ -109,7 +132,7 @@ async function loadBackendFederatedEffectApiFromManifest(options) {
     try {
         scope = createManifestLoadScope(options);
         throwIfManifestLoadAborted(scope.signal);
-        manifest = await (0, external_reference_js_namespaceObject.loadBackendFederationManifest)({
+        manifest = await settleOnSharedAbort((0, external_reference_js_namespaceObject.loadBackendFederationManifest)({
             ...options,
             manifestPolicy: {
                 ...options.manifestPolicy,
@@ -118,7 +141,7 @@ async function loadBackendFederatedEffectApiFromManifest(options) {
             },
             signal: scope.signal,
             timeoutMs: 0
-        });
+        }), scope.signal);
         (0, external_validation_js_namespaceObject.validateBackendFederationManifest)(manifest, options.expected);
         remote = (0, external_remote_js_namespaceObject.resolveBackendFederationRemoteFromManifest)(manifest, options.remote);
         throwIfManifestLoadAborted(scope.signal);
@@ -132,12 +155,15 @@ async function loadBackendFederatedEffectApiFromManifest(options) {
         const unitId = (0, external_metadata_js_namespaceObject.stringValue)(deliveryUnit.boundary?.unitId) ?? (0, external_metadata_js_namespaceObject.stringValue)(deliveryUnit.top?.unitId);
         const buildMarker = (0, external_metadata_js_namespaceObject.stringValue)(deliveryUnit.boundary?.buildMarker);
         if (!unitId || !buildMarker) throw new external_errors_js_namespaceObject.BackendFederationManifestAdapterError('manifest_invalid', 'Backend federation manifest requires delivery-unit identity.');
-        const loaded = await (0, load_js_namespaceObject.loadBackendFederatedEffectApi)({
+        const loaded = await settleOnSharedAbort((0, load_js_namespaceObject.loadBackendFederatedEffectApi)({
             hostName: options.hostName,
             remote,
             ...options.plugins ? {
                 plugins: options.plugins
             } : {},
+            ...options.shared ? {
+                shared: options.shared
+            } : {},
             entryPolicy: {
                 ...options.entryPolicy,
                 signal: scope.signal,
@@ -152,7 +178,7 @@ async function loadBackendFederatedEffectApiFromManifest(options) {
             }
         }).catch((error)=>{
             throw new external_errors_js_namespaceObject.BackendFederationManifestAdapterError(scope?.timedOut() === true ? 'timeout' : (0, external_validation_js_namespaceObject.classifyLoadError)(error), `[BFF][Effect] Backend federation remote ${remote?.name ?? 'unknown'} could not load ${remote?.expose ?? index_js_namespaceObject.BACKEND_FEDERATION_EFFECT_EXPOSE}.`, error);
-        });
+        }), scope.signal);
         (0, external_validation_js_namespaceObject.validateLoadedBackendFederationContract)(loaded, manifest, remote);
         return loaded;
     } catch (error) {

package/dist/cjs/backend-federation-manifest/node.js

@@ -31,10 +31,12 @@ __webpack_require__.d(__webpack_exports__, {
     loadBackendFederatedEffectApiFromManifest: ()=>loadBackendFederatedEffectApiFromManifest
 });
 const node_namespaceObject = require("@modern-js/server-runtime-extensions/backend-federation-security/node");
+const node_shared_js_namespaceObject = require("../backend-federation/node-shared.js");
 const external_load_js_namespaceObject = require("./load.js");
-function loadBackendFederatedEffectApiFromManifest(options) {
+async function loadBackendFederatedEffectApiFromManifest(options) {
     return (0, external_load_js_namespaceObject.loadBackendFederatedEffectApiFromManifest)({
         ...options,
+        shared: (0, node_shared_js_namespaceObject.withEffectBffHostShared)(options.shared),
         entryPolicy: {
             ...options.entryPolicy,
             evaluateCommonJs: options.entryPolicy?.evaluateCommonJs ?? node_namespaceObject.evaluateNodeBackendFederationCommonJs