@bleedingdev/modern-js-bff-core 3.5.0-ultramodern.36 → 3.5.0-ultramodern.38

package/dist/cjs/adapter-kit/parity.js

@@ -137,7 +137,8 @@ const createParityBffConfig = ()=>({
             enabled: true,
             allowedNamespaces: [
                 shared_js_namespaceObject.PARITY_REQUEST_ID
-            ]
+            ],
+            allowClientAssertedNamespace: true
         }
     });
 const getParityContracts = ()=>(0, operationContracts_js_namespaceObject.buildOperationContractMap)({

package/dist/cjs/index.js

@@ -9,9 +9,6 @@ var __webpack_modules__ = {
     "./client" (module) {
         module.exports = require("./client/index.js");
     },
-    "./contracts/eventContracts" (module) {
-        module.exports = require("./contracts/eventContracts.js");
-    },
     "./errors/http" (module) {
         module.exports = require("./errors/http.js");
     },
@@ -117,26 +114,10 @@ var __webpack_exports__ = {};
         "Api"
     ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_client__rspack_import_2[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _contracts_eventContracts__rspack_import_3 = __webpack_require__("./contracts/eventContracts");
-    var __rspack_reexport = {};
-    for(const __rspack_import_key in _contracts_eventContracts__rspack_import_3)if ([
-        "HttpError",
-        "registerPaths",
-        "createStorage",
-        "isWithMetaHandler",
-        "default",
-        "HANDLER_WITH_META",
-        "ValidationError",
-        "getRelativeRuntimePath",
-        "INPUT_PARAMS_DECIDER",
-        "isInputParamsDeciderHandler",
-        "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_contracts_eventContracts__rspack_import_3[__rspack_import_key];
-    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _errors_http__rspack_import_4 = __webpack_require__("./errors/http");
-    var _operators_http__rspack_import_5 = __webpack_require__("./operators/http");
+    var _errors_http__rspack_import_3 = __webpack_require__("./errors/http");
+    var _operators_http__rspack_import_4 = __webpack_require__("./operators/http");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _operators_http__rspack_import_5)if ([
+    for(const __rspack_import_key in _operators_http__rspack_import_4)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -148,11 +129,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_operators_http__rspack_import_5[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_operators_http__rspack_import_4[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _router__rspack_import_6 = __webpack_require__("./router");
+    var _router__rspack_import_5 = __webpack_require__("./router");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _router__rspack_import_6)if ([
+    for(const __rspack_import_key in _router__rspack_import_5)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -164,11 +145,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_router__rspack_import_6[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_router__rspack_import_5[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _security_crossProjectPolicy__rspack_import_7 = __webpack_require__("./security/crossProjectPolicy");
+    var _security_crossProjectPolicy__rspack_import_6 = __webpack_require__("./security/crossProjectPolicy");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _security_crossProjectPolicy__rspack_import_7)if ([
+    for(const __rspack_import_key in _security_crossProjectPolicy__rspack_import_6)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -180,11 +161,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_crossProjectPolicy__rspack_import_7[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_crossProjectPolicy__rspack_import_6[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _security_operationContracts__rspack_import_8 = __webpack_require__("./security/operationContracts");
+    var _security_operationContracts__rspack_import_7 = __webpack_require__("./security/operationContracts");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _security_operationContracts__rspack_import_8)if ([
+    for(const __rspack_import_key in _security_operationContracts__rspack_import_7)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -196,11 +177,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_operationContracts__rspack_import_8[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_operationContracts__rspack_import_7[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _security_resolveCrossProjectPolicy__rspack_import_9 = __webpack_require__("./security/resolveCrossProjectPolicy");
+    var _security_resolveCrossProjectPolicy__rspack_import_8 = __webpack_require__("./security/resolveCrossProjectPolicy");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _security_resolveCrossProjectPolicy__rspack_import_9)if ([
+    for(const __rspack_import_key in _security_resolveCrossProjectPolicy__rspack_import_8)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -212,11 +193,11 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_resolveCrossProjectPolicy__rspack_import_9[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_security_resolveCrossProjectPolicy__rspack_import_8[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _types__rspack_import_10 = __webpack_require__("./types");
+    var _types__rspack_import_9 = __webpack_require__("./types");
     var __rspack_reexport = {};
-    for(const __rspack_import_key in _types__rspack_import_10)if ([
+    for(const __rspack_import_key in _types__rspack_import_9)if ([
         "HttpError",
         "registerPaths",
         "createStorage",
@@ -228,20 +209,20 @@ var __webpack_exports__ = {};
         "INPUT_PARAMS_DECIDER",
         "isInputParamsDeciderHandler",
         "Api"
-    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_10[__rspack_import_key];
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_9[__rspack_import_key];
     __webpack_require__.d(__webpack_exports__, __rspack_reexport);
-    var _utils__rspack_import_11 = __webpack_require__("./utils?637c");
+    var _utils__rspack_import_10 = __webpack_require__("./utils?637c");
     __webpack_require__.d(__webpack_exports__, {
         Api: ()=>_api__rspack_import_1.Api,
-        HANDLER_WITH_META: ()=>_utils__rspack_import_11.HANDLER_WITH_META,
-        HttpError: ()=>_errors_http__rspack_import_4.HttpError,
-        INPUT_PARAMS_DECIDER: ()=>_utils__rspack_import_11.INPUT_PARAMS_DECIDER,
-        ValidationError: ()=>_errors_http__rspack_import_4.ValidationError,
-        createStorage: ()=>_utils__rspack_import_11.createStorage,
-        getRelativeRuntimePath: ()=>_utils__rspack_import_11.getRelativeRuntimePath,
-        isInputParamsDeciderHandler: ()=>_utils__rspack_import_11.isInputParamsDeciderHandler,
-        isWithMetaHandler: ()=>_utils__rspack_import_11.isWithMetaHandler,
-        registerPaths: ()=>_utils__rspack_import_11.registerPaths
+        HANDLER_WITH_META: ()=>_utils__rspack_import_10.HANDLER_WITH_META,
+        HttpError: ()=>_errors_http__rspack_import_3.HttpError,
+        INPUT_PARAMS_DECIDER: ()=>_utils__rspack_import_10.INPUT_PARAMS_DECIDER,
+        ValidationError: ()=>_errors_http__rspack_import_3.ValidationError,
+        createStorage: ()=>_utils__rspack_import_10.createStorage,
+        getRelativeRuntimePath: ()=>_utils__rspack_import_10.getRelativeRuntimePath,
+        isInputParamsDeciderHandler: ()=>_utils__rspack_import_10.isInputParamsDeciderHandler,
+        isWithMetaHandler: ()=>_utils__rspack_import_10.isWithMetaHandler,
+        registerPaths: ()=>_utils__rspack_import_10.registerPaths
     });
 })();
 exports.Api = __webpack_exports__.Api;

package/dist/cjs/security/crossProjectPolicy.js

@@ -31,7 +31,7 @@ const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
 const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
 const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity in production';
+const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
@@ -53,11 +53,10 @@ const createViolation = (reason, message, status)=>({
         message,
         status
     });
-const isProductionMode = ()=>"u" > typeof process && process.env?.NODE_ENV === 'production';
 const warnAdvisoryNamespaceAllowlist = ()=>{
     if (hasWarnedAdvisoryNamespaceAllowlist) return;
     hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. Non-production requests will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
+    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
 const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         headers,
@@ -69,6 +68,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
         requireOperationVersion: policy.requireOperationVersion ?? true,
         allowUnknownOperations: policy.allowUnknownOperations ?? false,
+        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
         verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
         allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
         envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
@@ -81,7 +81,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
     if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (isProductionMode()) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
+        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
         warnAdvisoryNamespaceAllowlist();
     }
 };

package/dist/esm/adapter-kit/parity.mjs

@@ -99,7 +99,8 @@ const createParityBffConfig = ()=>({
             enabled: true,
             allowedNamespaces: [
                 PARITY_REQUEST_ID
-            ]
+            ],
+            allowClientAssertedNamespace: true
         }
     });
 const getParityContracts = ()=>buildOperationContractMap({

package/dist/esm/index.mjs

@@ -1,6 +1,5 @@
 export * from "./adapter-kit/index.mjs";
 export * from "./client/index.mjs";
-export * from "./contracts/eventContracts.mjs";
 export * from "./operators/http.mjs";
 export * from "./router/index.mjs";
 export * from "./security/crossProjectPolicy.mjs";

package/dist/esm/security/crossProjectPolicy.mjs

@@ -2,7 +2,7 @@ const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
 const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
 const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity in production';
+const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
@@ -24,11 +24,10 @@ const createViolation = (reason, message, status)=>({
         message,
         status
     });
-const isProductionMode = ()=>"u" > typeof process && process.env?.NODE_ENV === 'production';
 const warnAdvisoryNamespaceAllowlist = ()=>{
     if (hasWarnedAdvisoryNamespaceAllowlist) return;
     hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. Non-production requests will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
+    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
 const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         headers,
@@ -40,6 +39,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
         requireOperationVersion: policy.requireOperationVersion ?? true,
         allowUnknownOperations: policy.allowUnknownOperations ?? false,
+        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
         verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
         allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
         envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
@@ -52,7 +52,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
     if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (isProductionMode()) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
+        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
         warnAdvisoryNamespaceAllowlist();
     }
 };

package/dist/esm/security/operationContracts.mjs

@@ -4,7 +4,7 @@ import { HttpMetadata } from "../types.mjs";
 import { __webpack_require__ } from "../rslib-runtime.mjs";
 import * as __rspack_external_zod from "zod";
 __webpack_require__.add({
-    6284 (module) {
+    7347 (module) {
         module.exports = __rspack_external_zod;
     }
 });
@@ -29,7 +29,7 @@ let cachedZodToJSONSchema;
 const resolveZodToJSONSchema = ()=>{
     if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
     try {
-        const zod = __webpack_require__(6284);
+        const zod = __webpack_require__(7347);
         const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
         cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
     } catch  {

package/dist/esm-node/adapter-kit/parity.mjs

@@ -100,7 +100,8 @@ const createParityBffConfig = ()=>({
             enabled: true,
             allowedNamespaces: [
                 PARITY_REQUEST_ID
-            ]
+            ],
+            allowClientAssertedNamespace: true
         }
     });
 const getParityContracts = ()=>buildOperationContractMap({

package/dist/esm-node/index.mjs

@@ -1,7 +1,6 @@
 import "node:module";
 export * from "./adapter-kit/index.mjs";
 export * from "./client/index.mjs";
-export * from "./contracts/eventContracts.mjs";
 export * from "./operators/http.mjs";
 export * from "./router/index.mjs";
 export * from "./security/crossProjectPolicy.mjs";

package/dist/esm-node/security/crossProjectPolicy.mjs

@@ -3,7 +3,7 @@ const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
 const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
 const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity in production';
+const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
@@ -25,11 +25,10 @@ const createViolation = (reason, message, status)=>({
         message,
         status
     });
-const isProductionMode = ()=>"u" > typeof process && process.env?.NODE_ENV === 'production';
 const warnAdvisoryNamespaceAllowlist = ()=>{
     if (hasWarnedAdvisoryNamespaceAllowlist) return;
     hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. Non-production requests will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
+    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
 const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         headers,
@@ -41,6 +40,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
         requireOperationVersion: policy.requireOperationVersion ?? true,
         allowUnknownOperations: policy.allowUnknownOperations ?? false,
+        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
         verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
         allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
         envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
@@ -53,7 +53,7 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
     if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (isProductionMode()) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
+        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
         warnAdvisoryNamespaceAllowlist();
     }
 };

package/dist/types/adapter-kit/parity.d.ts

@@ -15,6 +15,7 @@ export declare const createParityBffConfig: () => {
     crossProjectPolicy: {
         enabled: boolean;
         allowedNamespaces: string[];
+        allowClientAssertedNamespace: boolean;
     };
 };
 export declare const createAdapterParityScenarios: () => AdapterParityScenario[];
@@ -26,7 +27,7 @@ export type ParityHttpResponse = {
     body: unknown;
     text: string;
 };
-export type AdapterParityResult = {
+type AdapterParityResult = {
     status: number;
     payload: unknown;
 };

package/dist/types/index.d.ts

@@ -2,7 +2,6 @@ export * from './adapter-kit';
 export { Api } from './api';
 export * from './client';
 export type * from './compatible';
-export * from './contracts/eventContracts';
 export { HttpError, ValidationError } from './errors/http';
 export * from './operators/http';
 export * from './router';

package/dist/types/security/crossProjectPolicy.d.ts

@@ -10,16 +10,16 @@
  * authorization boundary: any caller can echo an allowed `requestId` and a
  * matching operation context.
  *
- * To use `allowedNamespaces` in production, supply
+ * To use `allowedNamespaces`, supply
  * {@link CrossProjectPolicyConfig.verifyProducerIdentity}: a server-side
  * hook that derives the producer namespace from a VERIFIED channel (mTLS
  * peer identity, gateway-authenticated JWT claims, service-mesh headers
- * stripped at the edge, ...). Production requests fail closed when a
- * namespace allowlist is configured without this hook. In non-production,
- * the evaluator logs a one-time warning and keeps the legacy advisory
- * behavior: the client-asserted namespace must match the allowlist. When the
- * hook is present, the client-asserted namespace must match the verified
- * namespace and the allowlist is checked against the verified value.
+ * stripped at the edge, ...). Requests fail closed when a namespace allowlist
+ * is configured without this hook unless `allowClientAssertedNamespace` is
+ * explicitly enabled. That escape hatch keeps legacy local/demo ergonomics:
+ * the client-asserted namespace must match the allowlist. When the hook is
+ * present, the client-asserted namespace must match the verified namespace
+ * and the allowlist is checked against the verified value.
  *
  * Client-side counterparts in `@modern-js/create-request` (identity binding,
  * operation contract validation) are developer-experience aids that fail
@@ -48,6 +48,12 @@ export interface CrossProjectPolicyConfig {
     requireOperationSchemaHash?: boolean;
     requireOperationVersion?: boolean;
     allowedNamespaces?: string[];
+    /**
+     * Explicit local/demo escape hatch for legacy clients that only provide
+     * client-built requestId namespaces. Defaults to false. Enabling this keeps
+     * `allowedNamespaces` advisory and must not be used as authorization.
+     */
+    allowClientAssertedNamespace?: boolean;
     envelopeHeader?: string;
     operationContextHeader?: string;
     operationContextDetailHeader?: string;
@@ -63,9 +69,9 @@ export interface CrossProjectPolicyConfig {
      * against the verified value instead of the client-asserted one. Returning
      * `undefined` (identity could not be verified) denies the request.
      *
-     * In production, `allowedNamespaces` requires this hook and fails closed
-     * without it. In non-production, namespace checks without this hook remain
-     * advisory only — see the module-level threat model.
+     * By default, `allowedNamespaces` requires this hook and fails closed
+     * without it. Set `allowClientAssertedNamespace` only for local/demo
+     * ergonomics where advisory client-asserted namespace checks are acceptable.
      */
     verifyProducerIdentity?: (headers: Record<string, unknown>) => string | undefined;
 }

package/package.json

@@ -17,7 +17,7 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.5.0-ultramodern.36",
+  "version": "3.5.0-ultramodern.38",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/cjs/index.js",
   "exports": {
@@ -35,19 +35,19 @@
     "@swc/helpers": "^0.5.23",
     "koa-compose": "^4.1.0",
     "reflect-metadata": "^0.2.2",
-    "type-fest": "5.7.0",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.36"
+    "type-fest": "5.8.0",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.38"
   },
   "devDependencies": {
-    "@rslib/core": "0.23.1",
+    "@rslib/core": "0.23.2",
     "@types/koa-compose": "^3.2.9",
-    "@types/node": "^26.0.1",
-    "@typescript/native-preview": "7.0.0-dev.20260628.1",
+    "@types/node": "^26.1.1",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "tsconfig-paths": "^4.2.0",
     "zod": "^4.4.3",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.36",
-    "@scripts/rstest-config": "2.66.0",
-    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.5.0-ultramodern.36"
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.38",
+    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.5.0-ultramodern.38",
+    "@scripts/rstest-config": "2.66.0"
   },
   "peerDependencies": {
     "tsconfig-paths": "^4.2.0",

package/dist/cjs/contracts/eventContracts.js

@@ -1,72 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-const defineEventContract = (input)=>{
-    const normalizedName = input.name.trim();
-    if (!normalizedName) throw new Error('Event contract name must be non-empty');
-    if (!Number.isFinite(input.version) || input.version <= 0) throw new Error('Event contract version must be a positive number');
-    if (!input.schemaHash || !input.schemaHash.trim()) throw new Error('Event contract schemaHash must be non-empty');
-    return {
-        name: normalizedName,
-        version: Math.floor(input.version),
-        schemaHash: input.schemaHash.trim(),
-        description: input.description
-    };
-};
-const createEventEnvelope = (contract, payload, meta)=>({
-        name: contract.name,
-        version: contract.version,
-        schemaHash: contract.schemaHash,
-        timestamp: Date.now(),
-        payload,
-        ...meta ? {
-            meta
-        } : {}
-    });
-const isEventEnvelope = (value)=>{
-    if (!value || 'object' != typeof value || Array.isArray(value)) return false;
-    const candidate = value;
-    return 'string' == typeof candidate.name && candidate.name.length > 0 && 'number' == typeof candidate.version && candidate.version > 0 && 'string' == typeof candidate.schemaHash && candidate.schemaHash.length > 0 && 'number' == typeof candidate.timestamp && Number.isFinite(candidate.timestamp) && 'payload' in candidate;
-};
-__webpack_require__.d(__webpack_exports__, {}, {
-    createEventEnvelope: createEventEnvelope,
-    defineEventContract: defineEventContract,
-    isEventEnvelope: isEventEnvelope
-});
-exports.createEventEnvelope = __webpack_exports__.createEventEnvelope;
-exports.defineEventContract = __webpack_exports__.defineEventContract;
-exports.isEventEnvelope = __webpack_exports__.isEventEnvelope;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "createEventEnvelope",
-    "defineEventContract",
-    "isEventEnvelope"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/esm/contracts/eventContracts.mjs

@@ -1,28 +0,0 @@
-const defineEventContract = (input)=>{
-    const normalizedName = input.name.trim();
-    if (!normalizedName) throw new Error('Event contract name must be non-empty');
-    if (!Number.isFinite(input.version) || input.version <= 0) throw new Error('Event contract version must be a positive number');
-    if (!input.schemaHash || !input.schemaHash.trim()) throw new Error('Event contract schemaHash must be non-empty');
-    return {
-        name: normalizedName,
-        version: Math.floor(input.version),
-        schemaHash: input.schemaHash.trim(),
-        description: input.description
-    };
-};
-const createEventEnvelope = (contract, payload, meta)=>({
-        name: contract.name,
-        version: contract.version,
-        schemaHash: contract.schemaHash,
-        timestamp: Date.now(),
-        payload,
-        ...meta ? {
-            meta
-        } : {}
-    });
-const isEventEnvelope = (value)=>{
-    if (!value || 'object' != typeof value || Array.isArray(value)) return false;
-    const candidate = value;
-    return 'string' == typeof candidate.name && candidate.name.length > 0 && 'number' == typeof candidate.version && candidate.version > 0 && 'string' == typeof candidate.schemaHash && candidate.schemaHash.length > 0 && 'number' == typeof candidate.timestamp && Number.isFinite(candidate.timestamp) && 'payload' in candidate;
-};
-export { createEventEnvelope, defineEventContract, isEventEnvelope };

package/dist/esm-node/contracts/eventContracts.mjs

@@ -1,29 +0,0 @@
-import "node:module";
-const defineEventContract = (input)=>{
-    const normalizedName = input.name.trim();
-    if (!normalizedName) throw new Error('Event contract name must be non-empty');
-    if (!Number.isFinite(input.version) || input.version <= 0) throw new Error('Event contract version must be a positive number');
-    if (!input.schemaHash || !input.schemaHash.trim()) throw new Error('Event contract schemaHash must be non-empty');
-    return {
-        name: normalizedName,
-        version: Math.floor(input.version),
-        schemaHash: input.schemaHash.trim(),
-        description: input.description
-    };
-};
-const createEventEnvelope = (contract, payload, meta)=>({
-        name: contract.name,
-        version: contract.version,
-        schemaHash: contract.schemaHash,
-        timestamp: Date.now(),
-        payload,
-        ...meta ? {
-            meta
-        } : {}
-    });
-const isEventEnvelope = (value)=>{
-    if (!value || 'object' != typeof value || Array.isArray(value)) return false;
-    const candidate = value;
-    return 'string' == typeof candidate.name && candidate.name.length > 0 && 'number' == typeof candidate.version && candidate.version > 0 && 'string' == typeof candidate.schemaHash && candidate.schemaHash.length > 0 && 'number' == typeof candidate.timestamp && Number.isFinite(candidate.timestamp) && 'payload' in candidate;
-};
-export { createEventEnvelope, defineEventContract, isEventEnvelope };

package/dist/types/contracts/eventContracts.d.ts

@@ -1,22 +0,0 @@
-export type EventContract<Name extends string = string, Payload = unknown> = {
-    name: Name;
-    version: number;
-    schemaHash: string;
-    description?: string;
-};
-export type EventEnvelope<TContract extends EventContract = EventContract, TMeta extends Record<string, unknown> = Record<string, unknown>> = {
-    name: TContract['name'];
-    version: TContract['version'];
-    schemaHash: TContract['schemaHash'];
-    timestamp: number;
-    payload: TContract extends EventContract<string, infer TPayload> ? TPayload : unknown;
-    meta?: TMeta;
-};
-export declare const defineEventContract: <Name extends string, Payload = unknown>(input: {
-    name: Name;
-    version: number;
-    schemaHash: string;
-    description?: string;
-}) => EventContract<Name, Payload>;
-export declare const createEventEnvelope: <TContract extends EventContract, TMeta extends Record<string, unknown> = Record<string, unknown>>(contract: TContract, payload: TContract extends EventContract<string, infer TPayload> ? TPayload : unknown, meta?: TMeta) => EventEnvelope<TContract, TMeta>;
-export declare const isEventEnvelope: (value: unknown) => value is EventEnvelope<EventContract, Record<string, unknown>>;