@bleedingdev/modern-js-bff-core 3.2.0-ultramodern.0

package/dist/cjs/router/index.js

@@ -0,0 +1,284 @@
+"use strict";
+var __webpack_modules__ = {
+    "../types" (module) {
+        module.exports = require("../types.js");
+    },
+    "../utils" (module) {
+        module.exports = require("../utils/index.js");
+    },
+    "./constants" (module) {
+        module.exports = require("./constants.js");
+    },
+    "./types" (module) {
+        module.exports = require("./types.js");
+    },
+    "./utils?198b" (module) {
+        module.exports = require("./utils.js");
+    },
+    "@modern-js/utils" (module) {
+        module.exports = require("@modern-js/utils");
+    },
+    path (module) {
+        module.exports = require("path");
+    },
+    "reflect-metadata" (module) {
+        module.exports = require("reflect-metadata");
+    }
+};
+var __webpack_module_cache__ = {};
+function __webpack_require__(moduleId) {
+    var cachedModule = __webpack_module_cache__[moduleId];
+    if (void 0 !== cachedModule) return cachedModule.exports;
+    var module = __webpack_module_cache__[moduleId] = {
+        exports: {}
+    };
+    __webpack_modules__[moduleId](module, module.exports, __webpack_require__);
+    return module.exports;
+}
+(()=>{
+    __webpack_require__.n = (module)=>{
+        var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
+        __webpack_require__.d(getter, {
+            a: getter
+        });
+        return getter;
+    };
+})();
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+(()=>{
+    __webpack_require__.r(__webpack_exports__);
+    __webpack_require__.d(__webpack_exports__, {
+        ApiRouter: ()=>ApiRouter
+    });
+    var _modern_js_utils__rspack_import_0 = __webpack_require__("@modern-js/utils");
+    var path__rspack_import_1 = __webpack_require__("path");
+    var path__rspack_import_1_default = /*#__PURE__*/ __webpack_require__.n(path__rspack_import_1);
+    __webpack_require__("reflect-metadata");
+    var _types__rspack_import_3 = __webpack_require__("../types");
+    var _utils__rspack_import_4 = __webpack_require__("../utils");
+    var _constants__rspack_import_5 = __webpack_require__("./constants");
+    var _utils__rspack_import_6 = __webpack_require__("./utils?198b");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _constants__rspack_import_5)if ([
+        "ApiRouter",
+        "default"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_constants__rspack_import_5[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    var _types__rspack_import_7 = __webpack_require__("./types");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _types__rspack_import_7)if ([
+        "ApiRouter",
+        "default"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_7[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    class ApiRouter {
+        isExistLambda() {
+            return this.existLambdaDir;
+        }
+        getLambdaDir() {
+            return this.lambdaDir;
+        }
+        isApiFile(filename) {
+            if (this.apiFiles.includes(filename)) return true;
+            return false;
+        }
+        async getSingleModuleHandlers(filename) {
+            const moduleInfo = await this.getModuleInfo(filename);
+            if (moduleInfo) return this.getModuleHandlerInfos(moduleInfo);
+            return null;
+        }
+        getHandlerInfo(filename, originFuncName, handler) {
+            const httpMethod = this.getHttpMethod(originFuncName, handler);
+            const routeName = this.getRouteName(filename, handler);
+            const action = this.getAction(handler);
+            const responseObj = {
+                handler,
+                name: originFuncName,
+                httpMethod,
+                routeName,
+                filename,
+                routePath: this.getRoutePath(this.prefix, routeName)
+            };
+            if (action) responseObj.action = action;
+            if (httpMethod && routeName) return responseObj;
+            return null;
+        }
+        getSafeRoutePath(filename, handler) {
+            this.loadApiFiles();
+            this.validateValidApifile(filename);
+            return this.getRouteName(filename, handler);
+        }
+        getRouteName(filename, handler) {
+            if (handler) {
+                const trigger = Reflect.getMetadata(_types__rspack_import_3.OperatorType.Trigger, handler);
+                if (trigger && trigger.type === _types__rspack_import_3.TriggerType.Http) {
+                    if (!trigger.path) throw new Error(`The http trigger ${trigger.name} needs to specify a path`);
+                    return trigger.path;
+                }
+            }
+            let routePath = (0, _utils__rspack_import_6.getPathFromFilename)(this.lambdaDir, filename);
+            if ('inputParams' === this.httpMethodDecider) if (routePath.endsWith('/')) routePath += `${handler?.name}`;
+            else routePath += `/${handler?.name}`;
+            return routePath;
+        }
+        getHttpMethod(originHandlerName, handler) {
+            if (handler) {
+                const trigger = Reflect.getMetadata(_types__rspack_import_3.OperatorType.Trigger, handler);
+                if (trigger && _types__rspack_import_3.httpMethods.includes(trigger.method)) return trigger.method;
+            }
+            if ('functionName' === this.httpMethodDecider) {
+                const upperName = originHandlerName.toUpperCase();
+                switch(upperName){
+                    case 'GET':
+                        return _types__rspack_import_3.HttpMethod.Get;
+                    case 'POST':
+                        return _types__rspack_import_3.HttpMethod.Post;
+                    case 'PUT':
+                        return _types__rspack_import_3.HttpMethod.Put;
+                    case 'DELETE':
+                    case 'DEL':
+                        return _types__rspack_import_3.HttpMethod.Delete;
+                    case 'CONNECT':
+                        return _types__rspack_import_3.HttpMethod.Connect;
+                    case 'TRACE':
+                        return _types__rspack_import_3.HttpMethod.Trace;
+                    case 'PATCH':
+                        return _types__rspack_import_3.HttpMethod.Patch;
+                    case 'OPTIONS':
+                        return _types__rspack_import_3.HttpMethod.Options;
+                    case 'DEFAULT':
+                        return _types__rspack_import_3.HttpMethod.Get;
+                    default:
+                        if ('test' !== process.env.NODE_ENV) _modern_js_utils__rspack_import_0.logger.warn(`Only api handlers are allowd to be exported, please remove the function ${originHandlerName} from exports`);
+                        return null;
+                }
+            }
+            if (!handler) return null;
+            if ('function' == typeof handler && handler.length > 0) return _types__rspack_import_3.HttpMethod.Post;
+            return _types__rspack_import_3.HttpMethod.Get;
+        }
+        getAction(handler) {
+            if (handler) {
+                const trigger = Reflect.getMetadata(_types__rspack_import_3.OperatorType.Trigger, handler);
+                if (trigger?.action) return trigger.action;
+            }
+        }
+        loadApiFiles() {
+            if (!this.existLambdaDir) return [];
+            const apiFiles = this.apiFiles = (0, _utils__rspack_import_6.getFiles)(this.lambdaDir, _constants__rspack_import_5.API_FILE_RULES);
+            return apiFiles;
+        }
+        getApiFiles() {
+            if (!this.existLambdaDir) return [];
+            if (this.apiFiles.length > 0) return this.apiFiles;
+            return this.loadApiFiles();
+        }
+        async getApiHandlers() {
+            const filenames = this.getApiFiles();
+            const moduleInfos = await this.getModuleInfos(filenames);
+            const apiHandlers = this.getHandlerInfos(moduleInfos);
+            (0, _utils__rspack_import_4.debug)('apiHandlers', apiHandlers.length, apiHandlers);
+            return apiHandlers;
+        }
+        initPrefix(prefix) {
+            if ('/' === prefix) return '';
+            return prefix || '/api';
+        }
+        validateAbsolute(filename, paramsName) {
+            if ('string' == typeof filename && !path__rspack_import_1_default().isAbsolute(filename)) throw new Error(`The ${paramsName} ${filename} is not a abolute path`);
+        }
+        async getModuleInfos(filenames) {
+            const moduleInfos = await Promise.all(filenames.map((filename)=>this.getModuleInfo(filename)));
+            return moduleInfos.filter(Boolean);
+        }
+        async getModuleInfo(filename) {
+            try {
+                const module = await (0, _utils__rspack_import_6.requireHandlerModule)(filename);
+                return {
+                    filename,
+                    module
+                };
+            } catch (err) {
+                if ('production' === process.env.NODE_ENV) {
+                    const error = new Error(`Failed to load BFF module '${filename}': ${err.message}`, {
+                        cause: err
+                    });
+                    throw error;
+                }
+                console.error(`Failed to load BFF module '${filename}':`, err);
+                return null;
+            }
+        }
+        getHandlerInfos(moduleInfos) {
+            let apiHandlers = [];
+            moduleInfos.forEach((moduleInfo)=>{
+                const handlerInfos = this.getModuleHandlerInfos(moduleInfo);
+                if (handlerInfos) apiHandlers = apiHandlers.concat(handlerInfos);
+            });
+            const sortedHandlers = (0, _utils__rspack_import_6.sortRoutes)(apiHandlers);
+            return sortedHandlers;
+        }
+        getModuleHandlerInfos(moduleInfo) {
+            const { module, filename } = moduleInfo;
+            const { httpMethodDecider } = this;
+            return Object.entries(module).filter(([, handler])=>'function' == typeof handler).map(([key])=>{
+                const handler = module[key];
+                if ('inputParams' === httpMethodDecider) Object.assign(handler, {
+                    [_utils__rspack_import_4.INPUT_PARAMS_DECIDER]: true
+                });
+                const handlerInfo = this.getHandlerInfo(filename, key, handler);
+                return handlerInfo;
+            }).filter((handlerInfo)=>Boolean(handlerInfo));
+        }
+        validateValidApifile(filename) {
+            if (!this.apiFiles.includes(filename)) throw new Error(`The ${filename} is not a valid api file.`);
+        }
+        getRoutePath(prefix, routeName) {
+            const finalRouteName = '/' === routeName ? '' : routeName;
+            if ('' === prefix && '' === finalRouteName) return '/';
+            return `${prefix}${finalRouteName}`;
+        }
+        constructor({ appDir, apiDir, lambdaDir, prefix, isBuild, httpMethodDecider = 'functionName' }){
+            this.apiFiles = [];
+            this.getExactLambdaDir = (apiDir, originLambdaDir)=>originLambdaDir || path__rspack_import_1_default().join(apiDir, _constants__rspack_import_5.FRAMEWORK_MODE_LAMBDA_DIR);
+            this.validateAbsolute(apiDir, 'apiDir');
+            this.validateAbsolute(lambdaDir, 'lambdaDir');
+            this.prefix = this.initPrefix(prefix);
+            this.appDir = appDir;
+            this.apiDir = apiDir;
+            this.httpMethodDecider = httpMethodDecider;
+            this.isBuild = isBuild;
+            this.lambdaDir = this.getExactLambdaDir(this.apiDir, lambdaDir);
+            this.existLambdaDir = _modern_js_utils__rspack_import_0.fs.existsSync(this.lambdaDir);
+            (0, _utils__rspack_import_4.debug)("apiDir:", this.apiDir, "lambdaDir:", this.lambdaDir);
+        }
+    }
+})();
+exports.ApiRouter = __webpack_exports__.ApiRouter;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "ApiRouter"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/router/types.js

@@ -0,0 +1,18 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+for(var __rspack_i in __webpack_exports__)exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/router/utils.js

@@ -0,0 +1,97 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.n = (module)=>{
+        var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
+        __webpack_require__.d(getter, {
+            a: getter
+        });
+        return getter;
+    };
+})();
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    getFiles: ()=>getFiles,
+    getPathFromFilename: ()=>getPathFromFilename,
+    isHandler: ()=>isHandler,
+    requireHandlerModule: ()=>requireHandlerModule,
+    sortRoutes: ()=>sortRoutes
+});
+const utils_namespaceObject = require("@modern-js/utils");
+const external_path_namespaceObject = require("path");
+var external_path_default = /*#__PURE__*/ __webpack_require__.n(external_path_namespaceObject);
+const external_constants_js_namespaceObject = require("./constants.js");
+const getFiles = (lambdaDir, rules)=>utils_namespaceObject.globby.sync(rules, {
+        cwd: lambdaDir,
+        gitignore: true
+    }).map((file)=>external_path_default().resolve(lambdaDir, file));
+const getPathFromFilename = (baseDir, filename)=>{
+    const relativeName = filename.substring(baseDir.length);
+    const relativePath = relativeName.split('.').slice(0, -1).join('.');
+    const nameSplit = relativePath.split(external_path_default().sep).map((item)=>{
+        if (item.length > 2) {
+            if (item.startsWith('[') && item.endsWith(']')) return `:${item.substring(1, item.length - 1)}`;
+        }
+        return item;
+    });
+    const name = nameSplit.join('/');
+    const finalName = name.endsWith(external_constants_js_namespaceObject.INDEX_SUFFIX) ? name.substring(0, name.length - external_constants_js_namespaceObject.INDEX_SUFFIX.length) : name;
+    return clearRouteName(finalName);
+};
+const clearRouteName = (routeName)=>{
+    let finalRouteName = routeName.trim();
+    if (!finalRouteName.startsWith('/')) finalRouteName = `/${finalRouteName}`;
+    if (finalRouteName.length > 1 && finalRouteName.endsWith('/')) finalRouteName = finalRouteName.substring(0, finalRouteName.length - 1);
+    return finalRouteName;
+};
+const isHandler = (input)=>input && 'function' == typeof input;
+const isFunction = (input)=>input && '[object Function]' === ({}).toString.call(input);
+const requireHandlerModule = async (modulePath)=>{
+    const module = await (0, utils_namespaceObject.compatibleRequire)(modulePath, false);
+    if (isFunction(module)) return {
+        default: module
+    };
+    return module;
+};
+const routeValue = (routePath)=>{
+    if (routePath.includes(':')) return 11;
+    return 1;
+};
+const sortRoutes = (apiHandlers)=>apiHandlers.sort((handlerA, handlerB)=>routeValue(handlerA.routeName) - routeValue(handlerB.routeName));
+exports.getFiles = __webpack_exports__.getFiles;
+exports.getPathFromFilename = __webpack_exports__.getPathFromFilename;
+exports.isHandler = __webpack_exports__.isHandler;
+exports.requireHandlerModule = __webpack_exports__.requireHandlerModule;
+exports.sortRoutes = __webpack_exports__.sortRoutes;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "getFiles",
+    "getPathFromFilename",
+    "isHandler",
+    "requireHandlerModule",
+    "sortRoutes"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/security/crossProjectPolicy.js

@@ -0,0 +1,137 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    BFF_ENVELOPE_HEADER: ()=>BFF_ENVELOPE_HEADER,
+    BFF_OPERATION_CONTEXT_DETAIL_HEADER: ()=>BFF_OPERATION_CONTEXT_DETAIL_HEADER,
+    BFF_OPERATION_CONTEXT_HEADER: ()=>BFF_OPERATION_CONTEXT_HEADER,
+    evaluateCrossProjectPolicy: ()=>evaluateCrossProjectPolicy
+});
+const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
+const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
+const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
+const DEFAULT_DENY_STATUS = 403;
+const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
+const normalizeStatusCode = (statusCode)=>{
+    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
+    return DEFAULT_DENY_STATUS;
+};
+const readHeader = (headers, headerName)=>{
+    const lowerHeaderName = headerName.toLowerCase();
+    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
+        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
+        if (null == value) return;
+        return String(value);
+    }
+};
+const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
+const createViolation = (reason, message, status)=>({
+        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
+        reason,
+        message,
+        status
+    });
+const evaluateCrossProjectPolicy = (headers, policy)=>{
+    if (!policy?.enabled) return null;
+    const status = normalizeStatusCode(policy.denyStatus);
+    const requireEnvelope = policy.requireEnvelope ?? true;
+    const requireOperationContext = policy.requireOperationContext ?? true;
+    const requireOperationContextDetails = policy.requireOperationContextDetails ?? true;
+    const requireOperationSchemaHash = policy.requireOperationSchemaHash ?? true;
+    const requireOperationVersion = policy.requireOperationVersion ?? true;
+    const allowUnknownOperations = policy.allowUnknownOperations ?? false;
+    const envelopeHeader = normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER);
+    const operationContextHeader = normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER);
+    const operationContextDetailHeader = normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER);
+    const envelopeRaw = readHeader(headers, envelopeHeader);
+    if (!envelopeRaw) {
+        if (!requireEnvelope) return null;
+        return createViolation('missing_envelope', `Missing cross-project envelope header "${envelopeHeader}"`, status);
+    }
+    let envelope;
+    try {
+        const parsed = JSON.parse(envelopeRaw);
+        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
+        envelope = parsed;
+    } catch (_error) {
+        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${envelopeHeader}"`, status);
+    }
+    const requestId = String(envelope.requestId || '').trim();
+    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', status);
+    const namespaces = (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean);
+    if (namespaces.length > 0) {
+        const namespace = extractNamespace(requestId);
+        if (!namespace || !namespaces.includes(namespace)) return createViolation('namespace_not_allowed', `Producer namespace "${namespace || 'unknown'}" is not allowed`, status);
+    }
+    if (requireOperationContext) {
+        const operationContext = readHeader(headers, operationContextHeader);
+        if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${operationContextHeader}"`, status);
+        if (!operationContext.startsWith(`${requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${operationContextHeader}" does not match requestId "${requestId}"`, status);
+        const operationContextDetailsRaw = readHeader(headers, operationContextDetailHeader);
+        if (!operationContextDetailsRaw) {
+            if (requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${operationContextDetailHeader}"`, status);
+            return null;
+        }
+        let operationContextDetails;
+        try {
+            const parsed = JSON.parse(operationContextDetailsRaw);
+            if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
+            operationContextDetails = parsed;
+        } catch (_error) {
+            return createViolation('invalid_operation_context_details', `Invalid operation context details header "${operationContextDetailHeader}"`, status);
+        }
+        const detailRequestId = String(operationContextDetails.requestId || '').trim();
+        if (detailRequestId && detailRequestId !== requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${requestId}"`, status);
+        const detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
+        if (requireOperationSchemaHash && !detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${operationContextDetailHeader}" must include schemaHash`, status);
+        const detailOperationVersion = operationContextDetails.operationVersion;
+        if (requireOperationVersion && 'number' != typeof detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${operationContextDetailHeader}" must include operationVersion`, status);
+        const expectedContracts = policy.expectedOperationContracts;
+        if (expectedContracts && 'object' == typeof expectedContracts && Object.keys(expectedContracts).length > 0) {
+            const method = String(operationContextDetails.method || '').toUpperCase();
+            const routePath = String(operationContextDetails.routePath || '').trim();
+            const operationId = String(operationContextDetails.operationId || '').trim();
+            const expectedContract = expectedContracts[`${method}:${routePath}`] || expectedContracts[`operation:${operationId}`];
+            if (expectedContract) {
+                if (expectedContract.schemaHash && detailSchemaHash && expectedContract.schemaHash !== detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, status);
+                if ('number' == typeof expectedContract.operationVersion && 'number' == typeof detailOperationVersion && expectedContract.operationVersion !== detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, status);
+            } else if (!allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, status);
+        }
+    }
+    return null;
+};
+exports.BFF_ENVELOPE_HEADER = __webpack_exports__.BFF_ENVELOPE_HEADER;
+exports.BFF_OPERATION_CONTEXT_DETAIL_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_DETAIL_HEADER;
+exports.BFF_OPERATION_CONTEXT_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_HEADER;
+exports.evaluateCrossProjectPolicy = __webpack_exports__.evaluateCrossProjectPolicy;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "BFF_ENVELOPE_HEADER",
+    "BFF_OPERATION_CONTEXT_DETAIL_HEADER",
+    "BFF_OPERATION_CONTEXT_HEADER",
+    "evaluateCrossProjectPolicy"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/security/operationContracts.js

@@ -0,0 +1,100 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    DEFAULT_OPERATION_VERSION: ()=>DEFAULT_OPERATION_VERSION,
+    buildOperationContractMap: ()=>buildOperationContractMap,
+    createOperationEntries: ()=>createOperationEntries,
+    createOperationSchemaHash: ()=>createOperationSchemaHash
+});
+const external_crypto_namespaceObject = require("crypto");
+const DEFAULT_OPERATION_VERSION = 1;
+const createOperationEntries = (handlers)=>handlers.map((item)=>({
+            name: item.name,
+            httpMethod: String(item.httpMethod || '').toUpperCase(),
+            routePath: item.routePath
+        })).sort((a, b)=>{
+        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
+        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
+        return keyA.localeCompare(keyB);
+    });
+const createOperationSchemaHash = (operationEntries, requestId)=>(0, external_crypto_namespaceObject.createHash)('sha256').update(JSON.stringify({
+        operations: operationEntries.map((item)=>({
+                name: item.name,
+                httpMethod: item.httpMethod,
+                routePath: item.routePath
+            })),
+        requestId
+    })).digest('hex');
+const buildOperationContractMap = ({ handlers, requestId })=>{
+    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
+    const byModule = new Map();
+    handlers.forEach((item)=>{
+        const moduleId = 'string' == typeof item.filename && item.filename.length > 0 ? item.filename : '__anonymous__';
+        const group = byModule.get(moduleId) || [];
+        group.push({
+            name: item.name,
+            httpMethod: item.httpMethod.toUpperCase(),
+            routePath: item.routePath,
+            filename: item.filename
+        });
+        byModule.set(moduleId, group);
+    });
+    const contracts = {};
+    byModule.forEach((moduleEntries)=>{
+        const entries = createOperationEntries(moduleEntries);
+        const schemaHash = createOperationSchemaHash(entries, normalizedRequestId);
+        const filename = moduleEntries[0]?.filename;
+        entries.forEach((entry)=>{
+            const operationId = `${normalizedRequestId}:${entry.name}`;
+            const contract = {
+                requestId: normalizedRequestId,
+                operationVersion: DEFAULT_OPERATION_VERSION,
+                schemaHash,
+                method: entry.httpMethod,
+                routePath: entry.routePath,
+                operationId,
+                handlerName: entry.name,
+                filename
+            };
+            contracts[`${entry.httpMethod}:${entry.routePath}`] = contract;
+            contracts[`operation:${operationId}`] = contract;
+        });
+    });
+    return contracts;
+};
+exports.DEFAULT_OPERATION_VERSION = __webpack_exports__.DEFAULT_OPERATION_VERSION;
+exports.buildOperationContractMap = __webpack_exports__.buildOperationContractMap;
+exports.createOperationEntries = __webpack_exports__.createOperationEntries;
+exports.createOperationSchemaHash = __webpack_exports__.createOperationSchemaHash;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "DEFAULT_OPERATION_VERSION",
+    "buildOperationContractMap",
+    "createOperationEntries",
+    "createOperationSchemaHash"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});