@bleedingdev/modern-js-bff-core 3.2.0-ultramodern.120 → 3.2.0-ultramodern.121

package/dist/cjs/client/generateClient.js

@@ -31,10 +31,22 @@ __webpack_require__.d(__webpack_exports__, {
     INNER_CLIENT_REQUEST_CREATOR: ()=>INNER_CLIENT_REQUEST_CREATOR,
     generateClient: ()=>generateClient
 });
-require("path");
+const external_path_namespaceObject = require("path");
 const index_js_namespaceObject = require("../router/index.js");
 const operationContracts_js_namespaceObject = require("../security/operationContracts.js");
 const external_result_js_namespaceObject = require("./result.js");
+const getPackageInfo = (appDir)=>{
+    try {
+        const packageJsonPath = external_path_namespaceObject.resolve(appDir, './package.json');
+        const packageJson = require(packageJsonPath);
+        return {
+            name: packageJson.name,
+            version: packageJson.version
+        };
+    } catch (error) {
+        return {};
+    }
+};
 const INNER_CLIENT_REQUEST_CREATOR = '@modern-js/plugin-bff/client';
 const generateClient = async ({ appDir, resourcePath, apiDir, lambdaDir, prefix, port, target, requestCreator, fetcher, requireResolve = require.resolve, httpMethodDecider, domain, requestId })=>{
     requestCreator = requestCreator || INNER_CLIENT_REQUEST_CREATOR;
@@ -47,25 +59,65 @@ const generateClient = async ({ appDir, resourcePath, apiDir, lambdaDir, prefix,
     });
     const handlerInfos = await apiRouter.getSingleModuleHandlers(resourcePath);
     if (!handlerInfos) return (0, external_result_js_namespaceObject.Err)(`generate client error: Cannot require module ${resourcePath}`);
-    const operationEntries = (0, operationContracts_js_namespaceObject.createOperationEntries)(handlerInfos);
-    const operationVersion = 1;
-    const schemaHash = (0, operationContracts_js_namespaceObject.createOperationSchemaHash)(operationEntries, requestId || 'default');
+    const normalizedRequestId = requestId || 'default';
+    const operationVersion = (0, operationContracts_js_namespaceObject.deriveOperationVersion)(getPackageInfo(appDir).version);
+    const operationContracts = (0, operationContracts_js_namespaceObject.buildOperationContractMap)({
+        handlers: handlerInfos,
+        requestId: normalizedRequestId,
+        operationVersion
+    });
+    const operationEntries = handlerInfos.map((handlerInfo)=>{
+        const upperHttpMethod = handlerInfo.httpMethod.toUpperCase();
+        const contract = operationContracts[`${upperHttpMethod}:${handlerInfo.routePath}`];
+        return {
+            name: handlerInfo.name,
+            httpMethod: upperHttpMethod,
+            routePath: handlerInfo.routePath,
+            schemaHash: contract?.schemaHash ?? ''
+        };
+    }).sort((a, b)=>{
+        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
+        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
+        return keyA.localeCompare(keyB);
+    });
+    const schemaHash = (0, operationContracts_js_namespaceObject.createOperationSchemaHash)(operationEntries, normalizedRequestId);
+    let hasUploadHandler = false;
     let handlersCode = '';
     for (const handlerInfo of handlerInfos){
         const { name, httpMethod, routePath, action } = handlerInfo;
         let exportStatement = `var ${name} =`;
         if ('default' === name.toLowerCase()) exportStatement = 'default';
         const upperHttpMethod = httpMethod.toUpperCase();
-        const serializedRouteName = JSON.stringify(routePath);
-        const serializedMethod = JSON.stringify(upperHttpMethod);
-        const serializedMethodDecider = JSON.stringify(httpMethodDecider ? httpMethodDecider : 'functionName');
-        const serializedOperationContext = JSON.stringify({
+        const operationSchemaHash = operationContracts[`${upperHttpMethod}:${routePath}`]?.schemaHash ?? '';
+        const operationContext = {
             operationId: name,
             routePath,
             method: upperHttpMethod,
-            schemaHash,
+            schemaHash: operationSchemaHash,
             operationVersion
-        });
+        };
+        if ('upload' === action) {
+            hasUploadHandler = true;
+            const uploadOptions = {
+                path: routePath,
+                ...domain ? {
+                    domain
+                } : {},
+                ...requestId ? {
+                    requestId
+                } : {},
+                ...requestId ? {
+                    operationContext
+                } : {}
+            };
+            handlersCode += `export ${exportStatement} createUploader(${JSON.stringify(uploadOptions)});
+      `;
+            continue;
+        }
+        const serializedRouteName = JSON.stringify(routePath);
+        const serializedMethod = JSON.stringify(upperHttpMethod);
+        const serializedMethodDecider = JSON.stringify(httpMethodDecider ? httpMethodDecider : 'functionName');
+        const serializedOperationContext = JSON.stringify(operationContext);
         const tailArgs = `, ${fetcher ? 'fetch' : 'undefined'}, ${requestId ? JSON.stringify(requestId) : 'undefined'}, ${serializedOperationContext}`;
         if ('server' === target) handlersCode += `export ${exportStatement} createRequest(${serializedRouteName}, ${serializedMethod}, process.env.PORT || ${String(port)}, ${serializedMethodDecider}${tailArgs});
       `;
@@ -74,9 +126,10 @@ const generateClient = async ({ appDir, resourcePath, apiDir, lambdaDir, prefix,
     }
     const serializedRequestCreator = JSON.stringify(requestCreator);
     const serializedFetcher = fetcher ? JSON.stringify(fetcher) : void 0;
+    const namedRequestImports = `createRequest${hasUploadHandler ? ', createUploader' : ''}`;
     const importCode = requestId ? `import * as requestRuntime from ${serializedRequestCreator};
-const { createRequest } = requestRuntime;
-${serializedFetcher ? `import { fetch } from ${serializedFetcher};\n` : ''}` : `import { createRequest } from ${serializedRequestCreator};
+const { ${namedRequestImports} } = requestRuntime;
+${serializedFetcher ? `import { fetch } from ${serializedFetcher};\n` : ''}` : `import { ${namedRequestImports} } from ${serializedRequestCreator};
 ${serializedFetcher ? `import { fetch } from ${serializedFetcher};\n` : ''}`;
     const bootstrapCode = requestId ? `export const initProducerClient = (options = {}) => {
   const configure = requestRuntime.configure;

package/dist/cjs/index.js

@@ -1,5 +1,8 @@
 "use strict";
 var __webpack_modules__ = {
+    "./adapter-kit" (module) {
+        module.exports = require("./adapter-kit/index.js");
+    },
     "./api" (module) {
         module.exports = require("./api.js");
     },
@@ -24,6 +27,9 @@ var __webpack_modules__ = {
     "./security/operationContracts" (module) {
         module.exports = require("./security/operationContracts.js");
     },
+    "./security/resolveCrossProjectPolicy" (module) {
+        module.exports = require("./security/resolveCrossProjectPolicy.js");
+    },
     "./types" (module) {
         module.exports = require("./types.js");
     },
@@ -78,10 +84,42 @@ function __webpack_require__(moduleId) {
 var __webpack_exports__ = {};
 (()=>{
     __webpack_require__.r(__webpack_exports__);
-    var _api__rspack_import_0 = __webpack_require__("./api");
-    var _client__rspack_import_1 = __webpack_require__("./client");
+    var _adapter_kit__rspack_import_0 = __webpack_require__("./adapter-kit");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _adapter_kit__rspack_import_0)if ([
+        "HttpError",
+        "registerPaths",
+        "createStorage",
+        "isWithMetaHandler",
+        "default",
+        "HANDLER_WITH_META",
+        "ValidationError",
+        "getRelativeRuntimePath",
+        "INPUT_PARAMS_DECIDER",
+        "isInputParamsDeciderHandler",
+        "Api"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_adapter_kit__rspack_import_0[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    var _api__rspack_import_1 = __webpack_require__("./api");
+    var _client__rspack_import_2 = __webpack_require__("./client");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _client__rspack_import_2)if ([
+        "HttpError",
+        "registerPaths",
+        "createStorage",
+        "isWithMetaHandler",
+        "default",
+        "HANDLER_WITH_META",
+        "ValidationError",
+        "getRelativeRuntimePath",
+        "INPUT_PARAMS_DECIDER",
+        "isInputParamsDeciderHandler",
+        "Api"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_client__rspack_import_2[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    var _contracts_eventContracts__rspack_import_3 = __webpack_require__("./contracts/eventContracts");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _client__rspack_import_1)if ([
+    for(const __rspack_import_key in _contracts_eventContracts__rspack_import_3)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -93,11 +131,12 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_client__rspack_import_1[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_contracts_eventContracts__rspack_import_3[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _contracts_eventContracts__rspack_import_2 = __webpack_require__("./contracts/eventContracts");
+    var _errors_http__rspack_import_4 = __webpack_require__("./errors/http");
+    var _operators_http__rspack_import_5 = __webpack_require__("./operators/http");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _contracts_eventContracts__rspack_import_2)if ([
+    for(const __rspack_import_key in _operators_http__rspack_import_5)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -109,12 +148,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_contracts_eventContracts__rspack_import_2[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_operators_http__rspack_import_5[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _errors_http__rspack_import_3 = __webpack_require__("./errors/http");
-    var _operators_http__rspack_import_4 = __webpack_require__("./operators/http");
+    var _router__rspack_import_6 = __webpack_require__("./router");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _operators_http__rspack_import_4)if ([
+    for(const __rspack_import_key in _router__rspack_import_6)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -126,11 +164,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_operators_http__rspack_import_4[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_router__rspack_import_6[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _router__rspack_import_5 = __webpack_require__("./router");
+    var _security_crossProjectPolicy__rspack_import_7 = __webpack_require__("./security/crossProjectPolicy");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _router__rspack_import_5)if ([
+    for(const __rspack_import_key in _security_crossProjectPolicy__rspack_import_7)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -142,11 +180,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_router__rspack_import_5[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_crossProjectPolicy__rspack_import_7[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _security_crossProjectPolicy__rspack_import_6 = __webpack_require__("./security/crossProjectPolicy");
+    var _security_operationContracts__rspack_import_8 = __webpack_require__("./security/operationContracts");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _security_crossProjectPolicy__rspack_import_6)if ([
+    for(const __rspack_import_key in _security_operationContracts__rspack_import_8)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -158,11 +196,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_crossProjectPolicy__rspack_import_6[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_operationContracts__rspack_import_8[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _security_operationContracts__rspack_import_7 = __webpack_require__("./security/operationContracts");
+    var _security_resolveCrossProjectPolicy__rspack_import_9 = __webpack_require__("./security/resolveCrossProjectPolicy");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _security_operationContracts__rspack_import_7)if ([
+    for(const __rspack_import_key in _security_resolveCrossProjectPolicy__rspack_import_9)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -174,11 +212,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_operationContracts__rspack_import_7[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_resolveCrossProjectPolicy__rspack_import_9[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _types__rspack_import_8 = __webpack_require__("./types");
+    var _types__rspack_import_10 = __webpack_require__("./types");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _types__rspack_import_8)if ([
+    for(const __rspack_import_key in _types__rspack_import_10)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -190,20 +228,20 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_8[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_10[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _utils__rspack_import_9 = __webpack_require__("./utils?637c");
+    var _utils__rspack_import_11 = __webpack_require__("./utils?637c");
     __webpack_require__.d(__webpack_exports__, {
-        Api: ()=>_api__rspack_import_0.Api,
-        HANDLER_WITH_META: ()=>_utils__rspack_import_9.HANDLER_WITH_META,
-        HttpError: ()=>_errors_http__rspack_import_3.HttpError,
-        INPUT_PARAMS_DECIDER: ()=>_utils__rspack_import_9.INPUT_PARAMS_DECIDER,
-        ValidationError: ()=>_errors_http__rspack_import_3.ValidationError,
-        createStorage: ()=>_utils__rspack_import_9.createStorage,
-        getRelativeRuntimePath: ()=>_utils__rspack_import_9.getRelativeRuntimePath,
-        isInputParamsDeciderHandler: ()=>_utils__rspack_import_9.isInputParamsDeciderHandler,
-        isWithMetaHandler: ()=>_utils__rspack_import_9.isWithMetaHandler,
-        registerPaths: ()=>_utils__rspack_import_9.registerPaths
+        Api: ()=>_api__rspack_import_1.Api,
+        HANDLER_WITH_META: ()=>_utils__rspack_import_11.HANDLER_WITH_META,
+        HttpError: ()=>_errors_http__rspack_import_4.HttpError,
+        INPUT_PARAMS_DECIDER: ()=>_utils__rspack_import_11.INPUT_PARAMS_DECIDER,
+        ValidationError: ()=>_errors_http__rspack_import_4.ValidationError,
+        createStorage: ()=>_utils__rspack_import_11.createStorage,
+        getRelativeRuntimePath: ()=>_utils__rspack_import_11.getRelativeRuntimePath,
+        isInputParamsDeciderHandler: ()=>_utils__rspack_import_11.isInputParamsDeciderHandler,
+        isWithMetaHandler: ()=>_utils__rspack_import_11.isWithMetaHandler,
+        registerPaths: ()=>_utils__rspack_import_11.registerPaths
     });
 })();
 exports.Api = __webpack_exports__.Api;

package/dist/cjs/security/crossProjectPolicy.js

@@ -78,10 +78,18 @@ const evaluateCrossProjectPolicy = (headers, policy)=>{
     }
     const requestId = String(envelope.requestId || '').trim();
     if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', status);
+    const claimedNamespace = extractNamespace(requestId);
+    let effectiveNamespace = claimedNamespace;
+    if ('function' == typeof policy.verifyProducerIdentity) {
+        const verifiedNamespaceRaw = policy.verifyProducerIdentity(headers);
+        const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
+        if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for this request', status);
+        if (verifiedNamespace !== claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, status);
+        effectiveNamespace = verifiedNamespace;
+    }
     const namespaces = (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean);
     if (namespaces.length > 0) {
-        const namespace = extractNamespace(requestId);
-        if (!namespace || !namespaces.includes(namespace)) return createViolation('namespace_not_allowed', `Producer namespace "${namespace || 'unknown'}" is not allowed`, status);
+        if (!effectiveNamespace || !namespaces.includes(effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${effectiveNamespace || 'unknown'}" is not allowed`, status);
     }
     if (requireOperationContext) {
         const operationContext = readHeader(headers, operationContextHeader);

package/dist/cjs/security/operationContracts.js

@@ -1,5 +1,19 @@
 "use strict";
-var __webpack_require__ = {};
+var __webpack_modules__ = {
+    zod (module) {
+        module.exports = require("zod");
+    }
+};
+var __webpack_module_cache__ = {};
+function __webpack_require__(moduleId) {
+    var cachedModule = __webpack_module_cache__[moduleId];
+    if (void 0 !== cachedModule) return cachedModule.exports;
+    var module = __webpack_module_cache__[moduleId] = {
+        exports: {}
+    };
+    __webpack_modules__[moduleId](module, module.exports, __webpack_require__);
+    return module.exports;
+}
 (()=>{
     __webpack_require__.d = (exports1, getters, values)=>{
         var define = (defs, kind)=>{
@@ -26,78 +40,156 @@ var __webpack_require__ = {};
     };
 })();
 var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-__webpack_require__.d(__webpack_exports__, {
-    DEFAULT_OPERATION_VERSION: ()=>DEFAULT_OPERATION_VERSION,
-    buildOperationContractMap: ()=>buildOperationContractMap,
-    createOperationEntries: ()=>createOperationEntries,
-    createOperationSchemaHash: ()=>createOperationSchemaHash
-});
-const external_crypto_namespaceObject = require("crypto");
-const DEFAULT_OPERATION_VERSION = 1;
-const createOperationEntries = (handlers)=>handlers.map((item)=>({
-            name: item.name,
-            httpMethod: String(item.httpMethod || '').toUpperCase(),
-            routePath: item.routePath
-        })).sort((a, b)=>{
-        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
-        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
-        return keyA.localeCompare(keyB);
+(()=>{
+    __webpack_require__.r(__webpack_exports__);
+    __webpack_require__.d(__webpack_exports__, {
+        DEFAULT_OPERATION_VERSION: ()=>DEFAULT_OPERATION_VERSION,
+        buildOperationContractMap: ()=>buildOperationContractMap,
+        createOperationContractHash: ()=>createOperationContractHash,
+        createOperationEntries: ()=>createOperationEntries,
+        createOperationSchemaHash: ()=>createOperationSchemaHash,
+        deriveOperationVersion: ()=>deriveOperationVersion,
+        serializeOperationSchemas: ()=>serializeOperationSchemas
     });
-const createOperationSchemaHash = (operationEntries, requestId)=>(0, external_crypto_namespaceObject.createHash)('sha256').update(JSON.stringify({
-        operations: operationEntries.map((item)=>({
+    const external_crypto_namespaceObject = require("crypto");
+    require("reflect-metadata");
+    const external_types_js_namespaceObject = require("../types.js");
+    const DEFAULT_OPERATION_VERSION = 1;
+    const deriveOperationVersion = (packageVersion)=>{
+        if ('string' != typeof packageVersion) return DEFAULT_OPERATION_VERSION;
+        const match = packageVersion.trim().match(/^v?(\d+)\./);
+        if (!match) return DEFAULT_OPERATION_VERSION;
+        const major = Number.parseInt(match[1], 10);
+        return Number.isInteger(major) && major >= 0 ? major : DEFAULT_OPERATION_VERSION;
+    };
+    const stableStringify = (value)=>{
+        if (Array.isArray(value)) return `[${value.map((item)=>stableStringify(item)).join(',')}]`;
+        if (value && 'object' == typeof value) {
+            const entries = Object.entries(value).filter(([, entryValue])=>void 0 !== entryValue).sort(([a], [b])=>a.localeCompare(b)).map(([key, entryValue])=>`${JSON.stringify(key)}:${stableStringify(entryValue)}`);
+            return `{${entries.join(',')}}`;
+        }
+        return JSON.stringify(value) ?? 'null';
+    };
+    const sha256 = (text)=>(0, external_crypto_namespaceObject.createHash)('sha256').update(text).digest('hex');
+    let cachedZodToJSONSchema;
+    const resolveZodToJSONSchema = ()=>{
+        if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
+        try {
+            const zod = __webpack_require__("zod");
+            const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
+            cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
+        } catch  {
+            cachedZodToJSONSchema = null;
+        }
+        return cachedZodToJSONSchema;
+    };
+    const INPUT_SCHEMA_METADATA_KEYS = [
+        external_types_js_namespaceObject.HttpMetadata.Data,
+        external_types_js_namespaceObject.HttpMetadata.Query,
+        external_types_js_namespaceObject.HttpMetadata.Params,
+        external_types_js_namespaceObject.HttpMetadata.Headers,
+        external_types_js_namespaceObject.HttpMetadata.Files
+    ];
+    const serializeSchema = (schema)=>{
+        const toJSONSchema = resolveZodToJSONSchema();
+        if (toJSONSchema) try {
+            return toJSONSchema(schema, {
+                io: 'input',
+                unrepresentable: 'any'
+            });
+        } catch  {}
+        return {
+            __unserializableSchema: true
+        };
+    };
+    const serializeOperationSchemas = (handler)=>{
+        if ('function' != typeof handler) return;
+        const serialized = {};
+        for (const metadataKey of INPUT_SCHEMA_METADATA_KEYS){
+            let schema;
+            try {
+                schema = Reflect.getMetadata(metadataKey, handler);
+            } catch  {
+                schema = void 0;
+            }
+            if (null != schema) serialized[metadataKey] = serializeSchema(schema);
+        }
+        return Object.keys(serialized).length > 0 ? serialized : void 0;
+    };
+    const createOperationContractHash = (operation, requestId)=>sha256(stableStringify({
+            httpMethod: String(operation.httpMethod || '').toUpperCase(),
+            name: operation.name,
+            requestId,
+            routePath: operation.routePath,
+            ...operation.schemas ? {
+                schemas: operation.schemas
+            } : {}
+        }));
+    const createOperationEntries = (handlers)=>handlers.map((item)=>({
                 name: item.name,
-                httpMethod: item.httpMethod,
+                httpMethod: String(item.httpMethod || '').toUpperCase(),
                 routePath: item.routePath
-            })),
-        requestId
-    })).digest('hex');
-const buildOperationContractMap = ({ handlers, requestId })=>{
-    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
-    const byModule = new Map();
-    handlers.forEach((item)=>{
-        const moduleId = 'string' == typeof item.filename && item.filename.length > 0 ? item.filename : '__anonymous__';
-        const group = byModule.get(moduleId) || [];
-        group.push({
-            name: item.name,
-            httpMethod: item.httpMethod.toUpperCase(),
-            routePath: item.routePath,
-            filename: item.filename
+            })).sort((a, b)=>{
+            const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
+            const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
+            return keyA.localeCompare(keyB);
         });
-        byModule.set(moduleId, group);
-    });
-    const contracts = {};
-    byModule.forEach((moduleEntries)=>{
-        const entries = createOperationEntries(moduleEntries);
-        const schemaHash = createOperationSchemaHash(entries, normalizedRequestId);
-        const filename = moduleEntries[0]?.filename;
-        entries.forEach((entry)=>{
-            const operationId = `${normalizedRequestId}:${entry.name}`;
+    const createOperationSchemaHash = (operationEntries, requestId)=>sha256(stableStringify({
+            operations: [
+                ...operationEntries
+            ].map((item)=>({
+                    hash: item.schemaHash ?? createOperationContractHash({
+                        name: item.name,
+                        httpMethod: item.httpMethod,
+                        routePath: item.routePath
+                    }, requestId)
+                })).sort((a, b)=>a.hash.localeCompare(b.hash)),
+            requestId
+        }));
+    const buildOperationContractMap = ({ handlers, requestId, operationVersion })=>{
+        const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
+        const normalizedOperationVersion = 'number' == typeof operationVersion && Number.isInteger(operationVersion) ? operationVersion : DEFAULT_OPERATION_VERSION;
+        const contracts = {};
+        handlers.forEach((item)=>{
+            const httpMethod = String(item.httpMethod || '').toUpperCase();
+            const schemaHash = createOperationContractHash({
+                name: item.name,
+                httpMethod,
+                routePath: item.routePath,
+                schemas: serializeOperationSchemas(item.handler)
+            }, normalizedRequestId);
+            const operationId = `${normalizedRequestId}:${item.name}`;
             const contract = {
                 requestId: normalizedRequestId,
-                operationVersion: DEFAULT_OPERATION_VERSION,
+                operationVersion: normalizedOperationVersion,
                 schemaHash,
-                method: entry.httpMethod,
-                routePath: entry.routePath,
+                method: httpMethod,
+                routePath: item.routePath,
                 operationId,
-                handlerName: entry.name,
-                filename
+                handlerName: item.name,
+                filename: item.filename
             };
-            contracts[`${entry.httpMethod}:${entry.routePath}`] = contract;
+            contracts[`${httpMethod}:${item.routePath}`] = contract;
             contracts[`operation:${operationId}`] = contract;
         });
-    });
-    return contracts;
-};
+        return contracts;
+    };
+})();
 exports.DEFAULT_OPERATION_VERSION = __webpack_exports__.DEFAULT_OPERATION_VERSION;
 exports.buildOperationContractMap = __webpack_exports__.buildOperationContractMap;
+exports.createOperationContractHash = __webpack_exports__.createOperationContractHash;
 exports.createOperationEntries = __webpack_exports__.createOperationEntries;
 exports.createOperationSchemaHash = __webpack_exports__.createOperationSchemaHash;
+exports.deriveOperationVersion = __webpack_exports__.deriveOperationVersion;
+exports.serializeOperationSchemas = __webpack_exports__.serializeOperationSchemas;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "DEFAULT_OPERATION_VERSION",
     "buildOperationContractMap",
+    "createOperationContractHash",
     "createOperationEntries",
-    "createOperationSchemaHash"
+    "createOperationSchemaHash",
+    "deriveOperationVersion",
+    "serializeOperationSchemas"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/cjs/security/resolveCrossProjectPolicy.js

@@ -0,0 +1,65 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    resolveCrossProjectPolicy: ()=>resolveCrossProjectPolicy
+});
+const external_operationContracts_js_namespaceObject = require("./operationContracts.js");
+const resolveCrossProjectPolicy = (input)=>{
+    const { crossProjectPolicy, handlers, requestId, isCrossProjectServer, operationVersion } = input;
+    if (!crossProjectPolicy && !isCrossProjectServer) return;
+    const policy = crossProjectPolicy ?? {};
+    const effectiveRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId : 'default';
+    const generatedContracts = (0, external_operationContracts_js_namespaceObject.buildOperationContractMap)({
+        handlers,
+        requestId: effectiveRequestId,
+        operationVersion
+    });
+    return {
+        ...policy,
+        enabled: policy.enabled ?? Boolean(isCrossProjectServer),
+        requireEnvelope: policy.requireEnvelope ?? true,
+        requireOperationContext: policy.requireOperationContext ?? true,
+        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
+        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
+        requireOperationVersion: policy.requireOperationVersion ?? true,
+        allowUnknownOperations: policy.allowUnknownOperations ?? false,
+        expectedOperationContracts: {
+            ...policy.expectedOperationContracts ?? {},
+            ...generatedContracts
+        }
+    };
+};
+exports.resolveCrossProjectPolicy = __webpack_exports__.resolveCrossProjectPolicy;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "resolveCrossProjectPolicy"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});