@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.2 → 3.9.0-ultramodern.20

package/dist/cjs/adapter-kit/parity-scenarios/shared.js

@@ -1,71 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-const PARITY_REQUEST_ID = 'crm';
-const PARITY_PRODUCER_REQUEST_ID = 'crm.producer-a';
-const envelopeHeader = (requestId)=>JSON.stringify(void 0 === requestId ? {} : {
-        requestId
-    });
-const detailHeader = (details)=>JSON.stringify(details);
-const deniedScenario = (name, reason, headers)=>({
-        name,
-        policy: true,
-        request: {
-            method: 'get',
-            path: '/hello',
-            headers
-        },
-        expected: {
-            kind: 'denied',
-            status: 403,
-            reason
-        }
-    });
-__webpack_require__.d(__webpack_exports__, {}, {
-    PARITY_PRODUCER_REQUEST_ID: PARITY_PRODUCER_REQUEST_ID,
-    PARITY_REQUEST_ID: PARITY_REQUEST_ID,
-    deniedScenario: deniedScenario,
-    detailHeader: detailHeader,
-    envelopeHeader: envelopeHeader
-});
-exports.PARITY_PRODUCER_REQUEST_ID = __webpack_exports__.PARITY_PRODUCER_REQUEST_ID;
-exports.PARITY_REQUEST_ID = __webpack_exports__.PARITY_REQUEST_ID;
-exports.deniedScenario = __webpack_exports__.deniedScenario;
-exports.detailHeader = __webpack_exports__.detailHeader;
-exports.envelopeHeader = __webpack_exports__.envelopeHeader;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "PARITY_PRODUCER_REQUEST_ID",
-    "PARITY_REQUEST_ID",
-    "deniedScenario",
-    "detailHeader",
-    "envelopeHeader"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/cjs/adapter-kit/parity.js

@@ -1,204 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-__webpack_require__.d(__webpack_exports__, {
-    PARITY_PRODUCER_REQUEST_ID: ()=>shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID,
-    PARITY_REQUEST_ID: ()=>shared_js_namespaceObject.PARITY_REQUEST_ID,
-    assertParityResult: ()=>assertParityResult,
-    createAdapterParityScenarios: ()=>createAdapterParityScenarios,
-    createParityApiHandlerInfos: ()=>createParityApiHandlerInfos,
-    createParityBffConfig: ()=>createParityBffConfig,
-    toParityResult: ()=>toParityResult
-});
-const operationContracts_js_namespaceObject = require("../security/operationContracts.js");
-const external_types_js_namespaceObject = require("../types.js");
-const cross_project_denial_js_namespaceObject = require("./parity-scenarios/cross-project-denial.js");
-const envelope_js_namespaceObject = require("./parity-scenarios/envelope.js");
-const operation_context_js_namespaceObject = require("./parity-scenarios/operation-context.js");
-const schema_js_namespaceObject = require("./parity-scenarios/schema.js");
-const shared_js_namespaceObject = require("./parity-scenarios/shared.js");
-const PARITY_FIXTURE_FILENAME = 'bff-core/adapter-kit/parity-fixture.ts';
-const HANDLER_WITH_SCHEMA = 'HANDLER_WITH_SCHEMA';
-const isRecord = (value)=>Boolean(value) && 'object' == typeof value;
-const createSchemaFixtureHandler = ()=>{
-    const handler = (input)=>{
-        const data = isRecord(input) && isRecord(input.data) ? input.data : void 0;
-        const id = data?.id;
-        if ('number' == typeof id) return {
-            type: 'HandleSuccess',
-            value: {
-                id
-            }
-        };
-        if ('boom' === id) return {
-            type: 'OutputValidationError',
-            message: 'invalid output'
-        };
-        return {
-            type: 'InputValidationError',
-            message: 'invalid input'
-        };
-    };
-    return Object.assign(handler, {
-        [HANDLER_WITH_SCHEMA]: true
-    });
-};
-const createParityApiHandlerInfos = ()=>[
-        {
-            name: 'getHello',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Get,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>({
-                    message: 'hello'
-                })
-        },
-        {
-            name: 'postHello',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Post,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>'hello'
-        },
-        {
-            name: 'getNothing',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Get,
-            routeName: '/nothing',
-            routePath: '/nothing',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>void 0
-        },
-        {
-            name: 'postEcho',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Post,
-            routeName: '/echo',
-            routePath: '/echo',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (input)=>{
-                const normalized = isRecord(input) ? input : {};
-                return {
-                    data: normalized.data ?? null,
-                    query: normalized.query ?? {},
-                    cookie: normalized.cookies ?? null
-                };
-            }
-        },
-        {
-            name: 'getItem',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Get,
-            routeName: '/items/:id',
-            routePath: '/items/:id',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (id, input)=>({
-                    id,
-                    query: isRecord(input) ? input.query ?? {} : {}
-                })
-        },
-        {
-            name: 'patchSchema',
-            httpMethod: external_types_js_namespaceObject.HttpMethod.Patch,
-            routeName: '/schema',
-            routePath: '/schema',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: createSchemaFixtureHandler()
-        }
-    ];
-const createParityBffConfig = ()=>({
-        requestId: shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID,
-        crossProjectPolicy: {
-            enabled: true,
-            allowedNamespaces: [
-                shared_js_namespaceObject.PARITY_REQUEST_ID
-            ],
-            allowClientAssertedNamespace: true
-        }
-    });
-const getParityContracts = ()=>(0, operationContracts_js_namespaceObject.buildOperationContractMap)({
-        handlers: createParityApiHandlerInfos(),
-        requestId: shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID
-    });
-const createAdapterParityScenarios = ()=>{
-    const contracts = getParityContracts();
-    const helloContract = contracts['GET:/hello'];
-    const validEnvelope = (0, shared_js_namespaceObject.envelopeHeader)(shared_js_namespaceObject.PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = helloContract.operationId;
-    const context = {
-        helloContract,
-        validEnvelope,
-        validOperationId
-    };
-    return [
-        ...(0, envelope_js_namespaceObject.createEnvelopeParityScenarios)(),
-        ...(0, schema_js_namespaceObject.createSchemaParityScenarios)(),
-        ...(0, operation_context_js_namespaceObject.createOperationContextSuccessScenarios)(context),
-        ...(0, cross_project_denial_js_namespaceObject.createCrossProjectDenialScenarios)(),
-        ...(0, operation_context_js_namespaceObject.createOperationContextDenialScenarios)(context)
-    ];
-};
-const toParityResult = (res)=>({
-        status: res.status,
-        payload: res.type.includes('json') ? res.body : '' === res.text ? void 0 : res.text
-    });
-const formatValue = (value)=>JSON.stringify(value);
-const assertParityResult = (scenario, res)=>{
-    const result = toParityResult(res);
-    const failures = [];
-    const { expected } = scenario;
-    if (result.status !== expected.status) failures.push(`status: expected ${expected.status}, received ${result.status}`);
-    if ('payload' === expected.kind) {
-        if (formatValue(result.payload) !== formatValue(expected.payload)) failures.push(`payload: expected ${formatValue(expected.payload)}, received ${formatValue(result.payload)}`);
-    } else {
-        const payload = isRecord(result.payload) ? result.payload : {};
-        if ('BFF_CROSS_PROJECT_POLICY_DENIED' !== payload.code) failures.push(`denial code: expected "BFF_CROSS_PROJECT_POLICY_DENIED", received ${formatValue(payload.code)}`);
-        if (payload.reason !== expected.reason) failures.push(`denial reason: expected "${expected.reason}", received ${formatValue(payload.reason)}`);
-        if ('string' != typeof payload.message || 0 === payload.message.length) failures.push(`denial message: expected non-empty string, received ${formatValue(payload.message)}`);
-    }
-    if (failures.length > 0) throw new Error(`Adapter parity scenario "${scenario.name}" failed:\n- ${failures.join('\n- ')}`);
-};
-exports.PARITY_PRODUCER_REQUEST_ID = __webpack_exports__.PARITY_PRODUCER_REQUEST_ID;
-exports.PARITY_REQUEST_ID = __webpack_exports__.PARITY_REQUEST_ID;
-exports.assertParityResult = __webpack_exports__.assertParityResult;
-exports.createAdapterParityScenarios = __webpack_exports__.createAdapterParityScenarios;
-exports.createParityApiHandlerInfos = __webpack_exports__.createParityApiHandlerInfos;
-exports.createParityBffConfig = __webpack_exports__.createParityBffConfig;
-exports.toParityResult = __webpack_exports__.toParityResult;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "PARITY_PRODUCER_REQUEST_ID",
-    "PARITY_REQUEST_ID",
-    "assertParityResult",
-    "createAdapterParityScenarios",
-    "createParityApiHandlerInfos",
-    "createParityBffConfig",
-    "toParityResult"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/cjs/security/crossProjectPolicy.js

@@ -1,309 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
-const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
-const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
-const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
-let hasWarnedAdvisoryNamespaceAllowlist = false;
-const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
-const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
-const hasUnsafePathEncoding = (requestPath)=>{
-    let decoded = requestPath;
-    for(let depth = 0; depth < 8; depth += 1){
-        if (/%(?:2f|5c)/i.test(decoded)) return true;
-        try {
-            const next = decodeURIComponent(decoded);
-            if (next === decoded) return false;
-            decoded = next;
-        } catch  {
-            return true;
-        }
-    }
-    return decoded.includes('%');
-};
-const routeSegmentsMatch = (templateSegments, requestSegments)=>{
-    let templateIndex = 0;
-    let requestIndex = 0;
-    while(templateIndex < templateSegments.length){
-        const segment = templateSegments[templateIndex];
-        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-        const optional = segment.startsWith(':') && segment.endsWith('?');
-        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
-        if (wildcard) return true;
-        const requestSegment = requestSegments[requestIndex];
-        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
-        if (!segment.startsWith(':') && segment !== requestSegment) return false;
-        templateIndex += 1;
-        requestIndex += 1;
-    }
-    return requestIndex === requestSegments.length;
-};
-const routeTemplateMatchScore = (routePath, requestPath)=>{
-    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
-    const templateSegments = splitRoutePath(routePath);
-    const requestSegments = splitRoutePath(requestPath);
-    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
-        const removedPrefix = templateSegments.slice(0, prefixLength);
-        if (removedPrefix.some(isDynamicRouteSegment)) break;
-        const mountedTemplate = templateSegments.slice(prefixLength);
-        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
-        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
-        const dynamicSegments = mountedTemplate.length - literalSegments;
-        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
-    }
-};
-const resolveCrossProjectRequestObservation = (request, policy)=>{
-    const requestMethod = String(request.method || '').trim().toUpperCase();
-    const routePaths = [
-        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
-            if (key.startsWith('operation:')) return [];
-            const separator = key.indexOf(':');
-            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
-            return [
-                key.slice(separator + 1)
-            ];
-        }))
-    ];
-    if (0 === routePaths.length) return;
-    if (hasUnsafePathEncoding(request.pathname)) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    const matches = routePaths.flatMap((routePath)=>{
-        const score = routeTemplateMatchScore(routePath, request.pathname);
-        return void 0 === score ? [] : [
-            {
-                routePath,
-                score
-            }
-        ];
-    });
-    if (0 === matches.length) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    matches.sort((left, right)=>right.score - left.score);
-    return {
-        method: request.method,
-        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
-    };
-};
-const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
-const normalizeStatusCode = (statusCode)=>{
-    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
-    return DEFAULT_DENY_STATUS;
-};
-const readHeader = (headers, headerName)=>{
-    const lowerHeaderName = headerName.toLowerCase();
-    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
-        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
-        if (null == value) return;
-        return String(value);
-    }
-};
-const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
-const createViolation = (reason, message, status)=>({
-        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
-        reason,
-        message,
-        status
-    });
-const warnAdvisoryNamespaceAllowlist = ()=>{
-    if (hasWarnedAdvisoryNamespaceAllowlist) return;
-    hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
-};
-const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
-        headers,
-        policy,
-        status: normalizeStatusCode(policy.denyStatus),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
-        verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
-        allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
-        envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
-        operationContextHeader: normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER),
-        operationContextDetailHeader: normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER),
-        requestId: '',
-        detailSchemaHash: '',
-        detailOperationVersion: void 0,
-        observedRequest: observedRequest ? {
-            method: String(observedRequest.method || '').trim().toUpperCase(),
-            routePath: String(observedRequest.routePath || '').trim()
-        } : void 0,
-        complete: false
-    });
-const checkNamespaceAllowlistVerifier = (state)=>{
-    if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
-        warnAdvisoryNamespaceAllowlist();
-    }
-};
-const checkEnvelopeHeader = (state)=>{
-    const envelopeRaw = readHeader(state.headers, state.envelopeHeader);
-    if (!envelopeRaw) {
-        if (!state.requireEnvelope) {
-            state.complete = true;
-            return;
-        }
-        return createViolation('missing_envelope', `Missing cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    let envelope;
-    try {
-        const parsed = JSON.parse(envelopeRaw);
-        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
-        envelope = parsed;
-    } catch (_error) {
-        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    const requestId = String(envelope.requestId || '').trim();
-    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', state.status);
-    state.requestId = requestId;
-    state.claimedNamespace = extractNamespace(requestId);
-    state.effectiveNamespace = state.claimedNamespace;
-};
-const checkProducerIdentity = (state)=>{
-    if (!state.verifyProducerIdentity) return;
-    const verifiedNamespaceRaw = state.verifyProducerIdentity(state.headers);
-    const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
-    if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for request', state.status);
-    if (verifiedNamespace !== state.claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${state.claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, state.status);
-    state.effectiveNamespace = verifiedNamespace;
-};
-const checkNamespaceAllowlist = (state)=>{
-    if (state.allowedNamespaces.length > 0) {
-        if (!state.effectiveNamespace || !state.allowedNamespaces.includes(state.effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${state.effectiveNamespace || 'unknown'}" not allowed`, state.status);
-    }
-};
-const checkOperationContext = (state)=>{
-    if (!state.requireOperationContext) {
-        state.complete = true;
-        return;
-    }
-    const operationContext = readHeader(state.headers, state.operationContextHeader);
-    if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${state.operationContextHeader}"`, state.status);
-    if (!operationContext.startsWith(`${state.requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${state.operationContextHeader}" does not match requestId "${state.requestId}"`, state.status);
-    state.operationContext = operationContext;
-};
-const checkOperationContextDetails = (state)=>{
-    const operationContextDetailsRaw = readHeader(state.headers, state.operationContextDetailHeader);
-    if (!operationContextDetailsRaw) {
-        if (state.requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${state.operationContextDetailHeader}"`, state.status);
-        state.complete = true;
-        return;
-    }
-    let operationContextDetails;
-    try {
-        const parsed = JSON.parse(operationContextDetailsRaw);
-        if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
-        operationContextDetails = parsed;
-    } catch (_error) {
-        return createViolation('invalid_operation_context_details', `Invalid operation context details header "${state.operationContextDetailHeader}"`, state.status);
-    }
-    const detailRequestId = String(operationContextDetails.requestId || '').trim();
-    if (detailRequestId && detailRequestId !== state.requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${state.requestId}"`, state.status);
-    const detailOperationId = String(operationContextDetails.operationId || '').trim();
-    if (state.operationContext && detailOperationId && detailOperationId !== state.operationContext) return createViolation('operation_context_mismatch', `Operation context details operationId "${detailOperationId}" does not match operation context "${state.operationContext}"`, state.status);
-    state.operationContextDetails = operationContextDetails;
-    state.detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
-    if (state.requireOperationSchemaHash && !state.detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${state.operationContextDetailHeader}" must include schemaHash`, state.status);
-    state.detailOperationVersion = operationContextDetails.operationVersion;
-    if (state.requireOperationVersion && 'number' != typeof state.detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${state.operationContextDetailHeader}" must include operationVersion`, state.status);
-};
-const checkOperationContract = (state)=>{
-    if (!state.operationContextDetails) return;
-    const expectedContracts = state.policy.expectedOperationContracts;
-    if (expectedContracts && 'object' == typeof expectedContracts) {
-        const method = String(state.operationContextDetails.method || '').toUpperCase();
-        const routePath = String(state.operationContextDetails.routePath || '').trim();
-        const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const observedMethod = state.observedRequest?.method;
-        const observedRoutePath = state.observedRequest?.routePath;
-        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
-        const contractMethod = observedMethod || method;
-        const contractRoutePath = observedRoutePath || routePath;
-        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
-        if (expectedContract) {
-            const assertedOperationId = operationId || state.operationContext || '';
-            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
-            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
-            if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-            if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-        } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
-    }
-};
-const CROSS_PROJECT_POLICY_CHECKS = [
-    checkNamespaceAllowlistVerifier,
-    checkEnvelopeHeader,
-    checkProducerIdentity,
-    checkNamespaceAllowlist,
-    checkOperationContext,
-    checkOperationContextDetails,
-    checkOperationContract
-];
-const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
-    if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
-    for (const check of CROSS_PROJECT_POLICY_CHECKS){
-        const violation = check(state);
-        if (violation) return violation;
-        if (state.complete) break;
-    }
-    return null;
-};
-__webpack_require__.d(__webpack_exports__, {}, {
-    BFF_ENVELOPE_HEADER: BFF_ENVELOPE_HEADER,
-    BFF_OPERATION_CONTEXT_DETAIL_HEADER: BFF_OPERATION_CONTEXT_DETAIL_HEADER,
-    BFF_OPERATION_CONTEXT_HEADER: BFF_OPERATION_CONTEXT_HEADER,
-    evaluateCrossProjectPolicy: evaluateCrossProjectPolicy,
-    resolveCrossProjectRequestObservation: resolveCrossProjectRequestObservation
-});
-exports.BFF_ENVELOPE_HEADER = __webpack_exports__.BFF_ENVELOPE_HEADER;
-exports.BFF_OPERATION_CONTEXT_DETAIL_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_DETAIL_HEADER;
-exports.BFF_OPERATION_CONTEXT_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_HEADER;
-exports.evaluateCrossProjectPolicy = __webpack_exports__.evaluateCrossProjectPolicy;
-exports.resolveCrossProjectRequestObservation = __webpack_exports__.resolveCrossProjectRequestObservation;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "BFF_ENVELOPE_HEADER",
-    "BFF_OPERATION_CONTEXT_DETAIL_HEADER",
-    "BFF_OPERATION_CONTEXT_HEADER",
-    "evaluateCrossProjectPolicy",
-    "resolveCrossProjectRequestObservation"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});