@bleedingdev/modern-js-bff-core 3.8.2-ultramodern.9 → 3.8.3-ultramodern.2

package/dist/cjs/adapter-kit/parity-scenarios/operation-context.js

@@ -60,6 +60,11 @@ const createOperationContextSuccessScenarios = ({ helloContract, validEnvelope,
             }
         }
     ];
+const getMismatchedOperationVersion = (contract)=>{
+    const operationVersion = contract.operationVersion;
+    if ('number' != typeof operationVersion) throw new Error('Adapter parity hello contract requires operationVersion');
+    return operationVersion + 1;
+};
 const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, validOperationId })=>[
         (0, external_shared_js_namespaceObject.deniedScenario)('policy denies missing operation context', 'missing_operation_context', {
             'x-modernjs-bff-envelope': validEnvelope
@@ -113,17 +118,6 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 schemaHash: helloContract.schemaHash
             })
         }),
-        (0, external_shared_js_namespaceObject.deniedScenario)('policy denies unknown operation contract', 'unknown_operation_contract', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': (0, external_shared_js_namespaceObject.detailHeader)({
-                requestId: external_shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/does-not-exist',
-                schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion
-            })
-        }),
         (0, external_shared_js_namespaceObject.deniedScenario)('policy denies operation schema hash mismatch', 'operation_schema_hash_mismatch', {
             'x-modernjs-bff-envelope': validEnvelope,
             'x-operation-id': validOperationId,
@@ -143,7 +137,7 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 method: 'GET',
                 routePath: '/hello',
                 schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion + 1
+                operationVersion: getMismatchedOperationVersion(helloContract)
             })
         })
     ];

package/dist/cjs/adapter-kit/parity.js

@@ -132,7 +132,7 @@ const createParityApiHandlerInfos = ()=>[
         }
     ];
 const createParityBffConfig = ()=>({
-        requestId: shared_js_namespaceObject.PARITY_REQUEST_ID,
+        requestId: shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID,
         crossProjectPolicy: {
             enabled: true,
             allowedNamespaces: [
@@ -143,13 +143,13 @@ const createParityBffConfig = ()=>({
     });
 const getParityContracts = ()=>(0, operationContracts_js_namespaceObject.buildOperationContractMap)({
         handlers: createParityApiHandlerInfos(),
-        requestId: shared_js_namespaceObject.PARITY_REQUEST_ID
+        requestId: shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID
     });
 const createAdapterParityScenarios = ()=>{
     const contracts = getParityContracts();
     const helloContract = contracts['GET:/hello'];
     const validEnvelope = (0, shared_js_namespaceObject.envelopeHeader)(shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = `${shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID}:parity`;
+    const validOperationId = helloContract.operationId;
     const context = {
         helloContract,
         validEnvelope,

package/dist/cjs/security/crossProjectPolicy.js

@@ -33,6 +33,90 @@ const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
 const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
+const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
+const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
+const hasUnsafePathEncoding = (requestPath)=>{
+    let decoded = requestPath;
+    for(let depth = 0; depth < 8; depth += 1){
+        if (/%(?:2f|5c)/i.test(decoded)) return true;
+        try {
+            const next = decodeURIComponent(decoded);
+            if (next === decoded) return false;
+            decoded = next;
+        } catch  {
+            return true;
+        }
+    }
+    return decoded.includes('%');
+};
+const routeSegmentsMatch = (templateSegments, requestSegments)=>{
+    let templateIndex = 0;
+    let requestIndex = 0;
+    while(templateIndex < templateSegments.length){
+        const segment = templateSegments[templateIndex];
+        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+        const optional = segment.startsWith(':') && segment.endsWith('?');
+        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
+        if (wildcard) return true;
+        const requestSegment = requestSegments[requestIndex];
+        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
+        if (!segment.startsWith(':') && segment !== requestSegment) return false;
+        templateIndex += 1;
+        requestIndex += 1;
+    }
+    return requestIndex === requestSegments.length;
+};
+const routeTemplateMatchScore = (routePath, requestPath)=>{
+    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
+    const templateSegments = splitRoutePath(routePath);
+    const requestSegments = splitRoutePath(requestPath);
+    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
+        const removedPrefix = templateSegments.slice(0, prefixLength);
+        if (removedPrefix.some(isDynamicRouteSegment)) break;
+        const mountedTemplate = templateSegments.slice(prefixLength);
+        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
+        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
+        const dynamicSegments = mountedTemplate.length - literalSegments;
+        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
+    }
+};
+const resolveCrossProjectRequestObservation = (request, policy)=>{
+    const requestMethod = String(request.method || '').trim().toUpperCase();
+    const routePaths = [
+        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
+            if (key.startsWith('operation:')) return [];
+            const separator = key.indexOf(':');
+            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
+            return [
+                key.slice(separator + 1)
+            ];
+        }))
+    ];
+    if (0 === routePaths.length) return;
+    if (hasUnsafePathEncoding(request.pathname)) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    const matches = routePaths.flatMap((routePath)=>{
+        const score = routeTemplateMatchScore(routePath, request.pathname);
+        return void 0 === score ? [] : [
+            {
+                routePath,
+                score
+            }
+        ];
+    });
+    if (0 === matches.length) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    matches.sort((left, right)=>right.score - left.score);
+    return {
+        method: request.method,
+        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
+    };
+};
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
     if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
@@ -58,7 +142,7 @@ const warnAdvisoryNamespaceAllowlist = ()=>{
     hasWarnedAdvisoryNamespaceAllowlist = true;
     console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
-const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
+const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
         headers,
         policy,
         status: normalizeStatusCode(policy.denyStatus),
@@ -77,6 +161,10 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requestId: '',
         detailSchemaHash: '',
         detailOperationVersion: void 0,
+        observedRequest: observedRequest ? {
+            method: String(observedRequest.method || '').trim().toUpperCase(),
+            routePath: String(observedRequest.routePath || '').trim()
+        } : void 0,
         complete: false
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
@@ -163,8 +251,16 @@ const checkOperationContract = (state)=>{
         const method = String(state.operationContextDetails.method || '').toUpperCase();
         const routePath = String(state.operationContextDetails.routePath || '').trim();
         const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const expectedContract = expectedContracts[`${method}:${routePath}`] || expectedContracts[`operation:${operationId}`];
+        const observedMethod = state.observedRequest?.method;
+        const observedRoutePath = state.observedRequest?.routePath;
+        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
+        const contractMethod = observedMethod || method;
+        const contractRoutePath = observedRoutePath || routePath;
+        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
         if (expectedContract) {
+            const assertedOperationId = operationId || state.operationContext || '';
+            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
+            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
             if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
             if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
         } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
@@ -179,9 +275,9 @@ const CROSS_PROJECT_POLICY_CHECKS = [
     checkOperationContextDetails,
     checkOperationContract
 ];
-const evaluateCrossProjectPolicy = (headers, policy)=>{
+const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
     if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy);
+    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
     for (const check of CROSS_PROJECT_POLICY_CHECKS){
         const violation = check(state);
         if (violation) return violation;
@@ -193,17 +289,20 @@ __webpack_require__.d(__webpack_exports__, {}, {
     BFF_ENVELOPE_HEADER: BFF_ENVELOPE_HEADER,
     BFF_OPERATION_CONTEXT_DETAIL_HEADER: BFF_OPERATION_CONTEXT_DETAIL_HEADER,
     BFF_OPERATION_CONTEXT_HEADER: BFF_OPERATION_CONTEXT_HEADER,
-    evaluateCrossProjectPolicy: evaluateCrossProjectPolicy
+    evaluateCrossProjectPolicy: evaluateCrossProjectPolicy,
+    resolveCrossProjectRequestObservation: resolveCrossProjectRequestObservation
 });
 exports.BFF_ENVELOPE_HEADER = __webpack_exports__.BFF_ENVELOPE_HEADER;
 exports.BFF_OPERATION_CONTEXT_DETAIL_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_DETAIL_HEADER;
 exports.BFF_OPERATION_CONTEXT_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_HEADER;
 exports.evaluateCrossProjectPolicy = __webpack_exports__.evaluateCrossProjectPolicy;
+exports.resolveCrossProjectRequestObservation = __webpack_exports__.resolveCrossProjectRequestObservation;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "BFF_ENVELOPE_HEADER",
     "BFF_OPERATION_CONTEXT_DETAIL_HEADER",
     "BFF_OPERATION_CONTEXT_HEADER",
-    "evaluateCrossProjectPolicy"
+    "evaluateCrossProjectPolicy",
+    "resolveCrossProjectRequestObservation"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/esm/adapter-kit/parity-scenarios/operation-context.mjs

@@ -27,6 +27,11 @@ const createOperationContextSuccessScenarios = ({ helloContract, validEnvelope,
             }
         }
     ];
+const getMismatchedOperationVersion = (contract)=>{
+    const operationVersion = contract.operationVersion;
+    if ('number' != typeof operationVersion) throw new Error('Adapter parity hello contract requires operationVersion');
+    return operationVersion + 1;
+};
 const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, validOperationId })=>[
         deniedScenario('policy denies missing operation context', 'missing_operation_context', {
             'x-modernjs-bff-envelope': validEnvelope
@@ -80,17 +85,6 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 schemaHash: helloContract.schemaHash
             })
         }),
-        deniedScenario('policy denies unknown operation contract', 'unknown_operation_contract', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/does-not-exist',
-                schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion
-            })
-        }),
         deniedScenario('policy denies operation schema hash mismatch', 'operation_schema_hash_mismatch', {
             'x-modernjs-bff-envelope': validEnvelope,
             'x-operation-id': validOperationId,
@@ -110,7 +104,7 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 method: 'GET',
                 routePath: '/hello',
                 schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion + 1
+                operationVersion: getMismatchedOperationVersion(helloContract)
             })
         })
     ];

package/dist/esm/adapter-kit/parity.mjs

@@ -94,7 +94,7 @@ const createParityApiHandlerInfos = ()=>[
         }
     ];
 const createParityBffConfig = ()=>({
-        requestId: PARITY_REQUEST_ID,
+        requestId: PARITY_PRODUCER_REQUEST_ID,
         crossProjectPolicy: {
             enabled: true,
             allowedNamespaces: [
@@ -105,13 +105,13 @@ const createParityBffConfig = ()=>({
     });
 const getParityContracts = ()=>buildOperationContractMap({
         handlers: createParityApiHandlerInfos(),
-        requestId: PARITY_REQUEST_ID
+        requestId: PARITY_PRODUCER_REQUEST_ID
     });
 const createAdapterParityScenarios = ()=>{
     const contracts = getParityContracts();
     const helloContract = contracts['GET:/hello'];
     const validEnvelope = envelopeHeader(PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = `${PARITY_PRODUCER_REQUEST_ID}:parity`;
+    const validOperationId = helloContract.operationId;
     const context = {
         helloContract,
         validEnvelope,

package/dist/esm/security/crossProjectPolicy.mjs

@@ -4,6 +4,90 @@ const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
 const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
+const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
+const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
+const hasUnsafePathEncoding = (requestPath)=>{
+    let decoded = requestPath;
+    for(let depth = 0; depth < 8; depth += 1){
+        if (/%(?:2f|5c)/i.test(decoded)) return true;
+        try {
+            const next = decodeURIComponent(decoded);
+            if (next === decoded) return false;
+            decoded = next;
+        } catch  {
+            return true;
+        }
+    }
+    return decoded.includes('%');
+};
+const routeSegmentsMatch = (templateSegments, requestSegments)=>{
+    let templateIndex = 0;
+    let requestIndex = 0;
+    while(templateIndex < templateSegments.length){
+        const segment = templateSegments[templateIndex];
+        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+        const optional = segment.startsWith(':') && segment.endsWith('?');
+        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
+        if (wildcard) return true;
+        const requestSegment = requestSegments[requestIndex];
+        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
+        if (!segment.startsWith(':') && segment !== requestSegment) return false;
+        templateIndex += 1;
+        requestIndex += 1;
+    }
+    return requestIndex === requestSegments.length;
+};
+const routeTemplateMatchScore = (routePath, requestPath)=>{
+    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
+    const templateSegments = splitRoutePath(routePath);
+    const requestSegments = splitRoutePath(requestPath);
+    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
+        const removedPrefix = templateSegments.slice(0, prefixLength);
+        if (removedPrefix.some(isDynamicRouteSegment)) break;
+        const mountedTemplate = templateSegments.slice(prefixLength);
+        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
+        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
+        const dynamicSegments = mountedTemplate.length - literalSegments;
+        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
+    }
+};
+const resolveCrossProjectRequestObservation = (request, policy)=>{
+    const requestMethod = String(request.method || '').trim().toUpperCase();
+    const routePaths = [
+        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
+            if (key.startsWith('operation:')) return [];
+            const separator = key.indexOf(':');
+            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
+            return [
+                key.slice(separator + 1)
+            ];
+        }))
+    ];
+    if (0 === routePaths.length) return;
+    if (hasUnsafePathEncoding(request.pathname)) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    const matches = routePaths.flatMap((routePath)=>{
+        const score = routeTemplateMatchScore(routePath, request.pathname);
+        return void 0 === score ? [] : [
+            {
+                routePath,
+                score
+            }
+        ];
+    });
+    if (0 === matches.length) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    matches.sort((left, right)=>right.score - left.score);
+    return {
+        method: request.method,
+        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
+    };
+};
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
     if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
@@ -29,7 +113,7 @@ const warnAdvisoryNamespaceAllowlist = ()=>{
     hasWarnedAdvisoryNamespaceAllowlist = true;
     console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
-const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
+const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
         headers,
         policy,
         status: normalizeStatusCode(policy.denyStatus),
@@ -48,6 +132,10 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requestId: '',
         detailSchemaHash: '',
         detailOperationVersion: void 0,
+        observedRequest: observedRequest ? {
+            method: String(observedRequest.method || '').trim().toUpperCase(),
+            routePath: String(observedRequest.routePath || '').trim()
+        } : void 0,
         complete: false
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
@@ -134,8 +222,16 @@ const checkOperationContract = (state)=>{
         const method = String(state.operationContextDetails.method || '').toUpperCase();
         const routePath = String(state.operationContextDetails.routePath || '').trim();
         const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const expectedContract = expectedContracts[`${method}:${routePath}`] || expectedContracts[`operation:${operationId}`];
+        const observedMethod = state.observedRequest?.method;
+        const observedRoutePath = state.observedRequest?.routePath;
+        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
+        const contractMethod = observedMethod || method;
+        const contractRoutePath = observedRoutePath || routePath;
+        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
         if (expectedContract) {
+            const assertedOperationId = operationId || state.operationContext || '';
+            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
+            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
             if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
             if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
         } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
@@ -150,9 +246,9 @@ const CROSS_PROJECT_POLICY_CHECKS = [
     checkOperationContextDetails,
     checkOperationContract
 ];
-const evaluateCrossProjectPolicy = (headers, policy)=>{
+const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
     if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy);
+    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
     for (const check of CROSS_PROJECT_POLICY_CHECKS){
         const violation = check(state);
         if (violation) return violation;
@@ -160,4 +256,4 @@ const evaluateCrossProjectPolicy = (headers, policy)=>{
     }
     return null;
 };
-export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy };
+export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy, resolveCrossProjectRequestObservation };

package/dist/esm-node/adapter-kit/parity-scenarios/operation-context.mjs

@@ -28,6 +28,11 @@ const createOperationContextSuccessScenarios = ({ helloContract, validEnvelope,
             }
         }
     ];
+const getMismatchedOperationVersion = (contract)=>{
+    const operationVersion = contract.operationVersion;
+    if ('number' != typeof operationVersion) throw new Error('Adapter parity hello contract requires operationVersion');
+    return operationVersion + 1;
+};
 const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, validOperationId })=>[
         deniedScenario('policy denies missing operation context', 'missing_operation_context', {
             'x-modernjs-bff-envelope': validEnvelope
@@ -81,17 +86,6 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 schemaHash: helloContract.schemaHash
             })
         }),
-        deniedScenario('policy denies unknown operation contract', 'unknown_operation_contract', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/does-not-exist',
-                schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion
-            })
-        }),
         deniedScenario('policy denies operation schema hash mismatch', 'operation_schema_hash_mismatch', {
             'x-modernjs-bff-envelope': validEnvelope,
             'x-operation-id': validOperationId,
@@ -111,7 +105,7 @@ const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, v
                 method: 'GET',
                 routePath: '/hello',
                 schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion + 1
+                operationVersion: getMismatchedOperationVersion(helloContract)
             })
         })
     ];

package/dist/esm-node/adapter-kit/parity.mjs

@@ -95,7 +95,7 @@ const createParityApiHandlerInfos = ()=>[
         }
     ];
 const createParityBffConfig = ()=>({
-        requestId: PARITY_REQUEST_ID,
+        requestId: PARITY_PRODUCER_REQUEST_ID,
         crossProjectPolicy: {
             enabled: true,
             allowedNamespaces: [
@@ -106,13 +106,13 @@ const createParityBffConfig = ()=>({
     });
 const getParityContracts = ()=>buildOperationContractMap({
         handlers: createParityApiHandlerInfos(),
-        requestId: PARITY_REQUEST_ID
+        requestId: PARITY_PRODUCER_REQUEST_ID
     });
 const createAdapterParityScenarios = ()=>{
     const contracts = getParityContracts();
     const helloContract = contracts['GET:/hello'];
     const validEnvelope = envelopeHeader(PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = `${PARITY_PRODUCER_REQUEST_ID}:parity`;
+    const validOperationId = helloContract.operationId;
     const context = {
         helloContract,
         validEnvelope,

package/dist/esm-node/security/crossProjectPolicy.mjs

@@ -5,6 +5,90 @@ const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
 const DEFAULT_DENY_STATUS = 403;
 const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
 let hasWarnedAdvisoryNamespaceAllowlist = false;
+const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
+const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
+const hasUnsafePathEncoding = (requestPath)=>{
+    let decoded = requestPath;
+    for(let depth = 0; depth < 8; depth += 1){
+        if (/%(?:2f|5c)/i.test(decoded)) return true;
+        try {
+            const next = decodeURIComponent(decoded);
+            if (next === decoded) return false;
+            decoded = next;
+        } catch  {
+            return true;
+        }
+    }
+    return decoded.includes('%');
+};
+const routeSegmentsMatch = (templateSegments, requestSegments)=>{
+    let templateIndex = 0;
+    let requestIndex = 0;
+    while(templateIndex < templateSegments.length){
+        const segment = templateSegments[templateIndex];
+        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
+        const optional = segment.startsWith(':') && segment.endsWith('?');
+        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
+        if (wildcard) return true;
+        const requestSegment = requestSegments[requestIndex];
+        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
+        if (!segment.startsWith(':') && segment !== requestSegment) return false;
+        templateIndex += 1;
+        requestIndex += 1;
+    }
+    return requestIndex === requestSegments.length;
+};
+const routeTemplateMatchScore = (routePath, requestPath)=>{
+    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
+    const templateSegments = splitRoutePath(routePath);
+    const requestSegments = splitRoutePath(requestPath);
+    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
+        const removedPrefix = templateSegments.slice(0, prefixLength);
+        if (removedPrefix.some(isDynamicRouteSegment)) break;
+        const mountedTemplate = templateSegments.slice(prefixLength);
+        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
+        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
+        const dynamicSegments = mountedTemplate.length - literalSegments;
+        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
+    }
+};
+const resolveCrossProjectRequestObservation = (request, policy)=>{
+    const requestMethod = String(request.method || '').trim().toUpperCase();
+    const routePaths = [
+        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
+            if (key.startsWith('operation:')) return [];
+            const separator = key.indexOf(':');
+            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
+            return [
+                key.slice(separator + 1)
+            ];
+        }))
+    ];
+    if (0 === routePaths.length) return;
+    if (hasUnsafePathEncoding(request.pathname)) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    const matches = routePaths.flatMap((routePath)=>{
+        const score = routeTemplateMatchScore(routePath, request.pathname);
+        return void 0 === score ? [] : [
+            {
+                routePath,
+                score
+            }
+        ];
+    });
+    if (0 === matches.length) return {
+        method: request.method,
+        routePath: request.pathname
+    };
+    matches.sort((left, right)=>right.score - left.score);
+    return {
+        method: request.method,
+        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
+    };
+};
 const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
 const normalizeStatusCode = (statusCode)=>{
     if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
@@ -30,7 +114,7 @@ const warnAdvisoryNamespaceAllowlist = ()=>{
     hasWarnedAdvisoryNamespaceAllowlist = true;
     console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
 };
-const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
+const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
         headers,
         policy,
         status: normalizeStatusCode(policy.denyStatus),
@@ -49,6 +133,10 @@ const createCrossProjectPolicyEvaluationState = (headers, policy)=>({
         requestId: '',
         detailSchemaHash: '',
         detailOperationVersion: void 0,
+        observedRequest: observedRequest ? {
+            method: String(observedRequest.method || '').trim().toUpperCase(),
+            routePath: String(observedRequest.routePath || '').trim()
+        } : void 0,
         complete: false
     });
 const checkNamespaceAllowlistVerifier = (state)=>{
@@ -135,8 +223,16 @@ const checkOperationContract = (state)=>{
         const method = String(state.operationContextDetails.method || '').toUpperCase();
         const routePath = String(state.operationContextDetails.routePath || '').trim();
         const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const expectedContract = expectedContracts[`${method}:${routePath}`] || expectedContracts[`operation:${operationId}`];
+        const observedMethod = state.observedRequest?.method;
+        const observedRoutePath = state.observedRequest?.routePath;
+        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
+        const contractMethod = observedMethod || method;
+        const contractRoutePath = observedRoutePath || routePath;
+        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
         if (expectedContract) {
+            const assertedOperationId = operationId || state.operationContext || '';
+            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
+            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
             if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
             if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
         } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
@@ -151,9 +247,9 @@ const CROSS_PROJECT_POLICY_CHECKS = [
     checkOperationContextDetails,
     checkOperationContract
 ];
-const evaluateCrossProjectPolicy = (headers, policy)=>{
+const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
     if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy);
+    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
     for (const check of CROSS_PROJECT_POLICY_CHECKS){
         const violation = check(state);
         if (violation) return violation;
@@ -161,4 +257,4 @@ const evaluateCrossProjectPolicy = (headers, policy)=>{
     }
     return null;
 };
-export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy };
+export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy, resolveCrossProjectRequestObservation };

package/dist/types/security/crossProjectPolicy.d.ts

@@ -32,6 +32,20 @@ export declare const BFF_OPERATION_CONTEXT_DETAIL_HEADER = "x-modernjs-bff-opera
 export type CrossProjectOperationContract = {
     schemaHash?: string;
     operationVersion?: number;
+    operationId?: string;
+};
+/**
+ * Request facts observed by the server adapter rather than asserted by the
+ * client. `routePath` is the matched route template when the router exposes
+ * one (for example `/api/customers/:id`), not the client-provided detail.
+ */
+export type CrossProjectRequestObservation = {
+    method: string;
+    routePath: string;
+};
+export type CrossProjectRequestTarget = {
+    method: string;
+    pathname: string;
 };
 export type CrossProjectPolicyViolationReason = 'missing_envelope' | 'invalid_envelope' | 'missing_request_id' | 'namespace_not_allowed' | 'missing_operation_context' | 'operation_context_mismatch' | 'missing_operation_context_details' | 'invalid_operation_context_details' | 'operation_context_details_request_id_mismatch' | 'missing_operation_schema_hash' | 'missing_operation_version' | 'unknown_operation_contract' | 'operation_schema_hash_mismatch' | 'operation_version_mismatch' | 'producer_identity_mismatch';
 export type CrossProjectPolicyViolation = {
@@ -75,4 +89,22 @@ export interface CrossProjectPolicyConfig {
      */
     verifyProducerIdentity?: (headers: Record<string, unknown>) => string | undefined;
 }
-export declare const evaluateCrossProjectPolicy: (headers: Record<string, unknown>, policy?: CrossProjectPolicyConfig) => CrossProjectPolicyViolation | null;
+/** Serializable, fully-defaulted policy accepted by edge dispatchers. */
+export type NormalizedCrossProjectPolicy = CrossProjectPolicyConfig & {
+    enabled: boolean;
+    requireEnvelope: boolean;
+    requireOperationContext: boolean;
+    requireOperationContextDetails: boolean;
+    requireOperationSchemaHash: boolean;
+    requireOperationVersion: boolean;
+    allowUnknownOperations: boolean;
+    expectedOperationContracts: Record<string, CrossProjectOperationContract>;
+};
+/**
+ * Resolves a concrete adapter request to the server-owned route template in
+ * the operation contract map. Effect receives requests after its BFF mount
+ * prefix has been stripped, so leading literal route segments may be mount
+ * prefixes. Ambiguous matches fail closed by retaining the concrete path.
+ */
+export declare const resolveCrossProjectRequestObservation: (request: CrossProjectRequestTarget, policy: Pick<CrossProjectPolicyConfig, 'expectedOperationContracts'>) => CrossProjectRequestObservation | undefined;
+export declare const evaluateCrossProjectPolicy: (headers: Record<string, unknown>, policy?: CrossProjectPolicyConfig, observedRequest?: CrossProjectRequestObservation) => CrossProjectPolicyViolation | null;

package/dist/types/security/resolveCrossProjectPolicy.d.ts

@@ -1,4 +1,4 @@
-import type { CrossProjectOperationContract, CrossProjectPolicyConfig } from './crossProjectPolicy';
+import type { CrossProjectPolicyConfig, NormalizedCrossProjectPolicy } from './crossProjectPolicy';
 import { type OperationContractSource } from './operationContracts';
 /**
  * Runtime input collected by BFF server adapters (hono/effect/...) before
@@ -25,16 +25,7 @@ export interface ResolveCrossProjectPolicyInput {
 /**
  * Fully-defaulted policy returned by {@link resolveCrossProjectPolicy}.
  */
-export type ResolvedCrossProjectPolicy = CrossProjectPolicyConfig & {
-    enabled: boolean;
-    requireEnvelope: boolean;
-    requireOperationContext: boolean;
-    requireOperationContextDetails: boolean;
-    requireOperationSchemaHash: boolean;
-    requireOperationVersion: boolean;
-    allowUnknownOperations: boolean;
-    expectedOperationContracts: Record<string, CrossProjectOperationContract>;
-};
+export type ResolvedCrossProjectPolicy = NormalizedCrossProjectPolicy;
 /**
  * Normalizes the user-facing cross-project policy config into the evaluator
  * input shared by every BFF server adapter:

package/package.json

@@ -17,7 +17,7 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.8.2-ultramodern.9",
+  "version": "3.8.3-ultramodern.2",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/cjs/index.js",
   "exports": {
@@ -28,18 +28,26 @@
         "require": "./dist/cjs/index.js"
       },
       "default": "./dist/cjs/index.js"
+    },
+    "./security/cross-project-policy": {
+      "types": "./dist/types/security/crossProjectPolicy.d.ts",
+      "node": {
+        "import": "./dist/esm-node/security/crossProjectPolicy.mjs",
+        "require": "./dist/cjs/security/crossProjectPolicy.js"
+      },
+      "default": "./dist/esm/security/crossProjectPolicy.mjs"
     }
   },
   "dependencies": {
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.8.2-ultramodern.9",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.8.3-ultramodern.2",
     "@swc/helpers": "^0.5.23",
     "koa-compose": "^4.1.0",
     "reflect-metadata": "^0.2.2",
     "type-fest": "5.8.0"
   },
   "devDependencies": {
-    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.8.2-ultramodern.9",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.8.2-ultramodern.9",
+    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.8.3-ultramodern.2",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.8.3-ultramodern.2",
     "@rslib/core": "0.23.2",
     "@scripts/rstest-config": "2.66.0",
     "@types/koa-compose": "^3.2.9",
@@ -63,7 +71,7 @@
   },
   "scripts": {
     "dev": "rslib build --watch",
-    "build": "rslib build && pnpm -w tsgo:dts \"$PWD\"",
+    "build": "rslib build",
     "test": "rstest --passWithNoTests"
   }
 }