@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.2 → 3.9.0-ultramodern.20

package/dist/esm-node/security/crossProjectPolicy.mjs

@@ -1,260 +0,0 @@
-import "node:module";
-const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
-const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
-const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
-const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
-let hasWarnedAdvisoryNamespaceAllowlist = false;
-const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
-const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
-const hasUnsafePathEncoding = (requestPath)=>{
-    let decoded = requestPath;
-    for(let depth = 0; depth < 8; depth += 1){
-        if (/%(?:2f|5c)/i.test(decoded)) return true;
-        try {
-            const next = decodeURIComponent(decoded);
-            if (next === decoded) return false;
-            decoded = next;
-        } catch  {
-            return true;
-        }
-    }
-    return decoded.includes('%');
-};
-const routeSegmentsMatch = (templateSegments, requestSegments)=>{
-    let templateIndex = 0;
-    let requestIndex = 0;
-    while(templateIndex < templateSegments.length){
-        const segment = templateSegments[templateIndex];
-        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-        const optional = segment.startsWith(':') && segment.endsWith('?');
-        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
-        if (wildcard) return true;
-        const requestSegment = requestSegments[requestIndex];
-        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
-        if (!segment.startsWith(':') && segment !== requestSegment) return false;
-        templateIndex += 1;
-        requestIndex += 1;
-    }
-    return requestIndex === requestSegments.length;
-};
-const routeTemplateMatchScore = (routePath, requestPath)=>{
-    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
-    const templateSegments = splitRoutePath(routePath);
-    const requestSegments = splitRoutePath(requestPath);
-    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
-        const removedPrefix = templateSegments.slice(0, prefixLength);
-        if (removedPrefix.some(isDynamicRouteSegment)) break;
-        const mountedTemplate = templateSegments.slice(prefixLength);
-        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
-        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
-        const dynamicSegments = mountedTemplate.length - literalSegments;
-        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
-    }
-};
-const resolveCrossProjectRequestObservation = (request, policy)=>{
-    const requestMethod = String(request.method || '').trim().toUpperCase();
-    const routePaths = [
-        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
-            if (key.startsWith('operation:')) return [];
-            const separator = key.indexOf(':');
-            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
-            return [
-                key.slice(separator + 1)
-            ];
-        }))
-    ];
-    if (0 === routePaths.length) return;
-    if (hasUnsafePathEncoding(request.pathname)) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    const matches = routePaths.flatMap((routePath)=>{
-        const score = routeTemplateMatchScore(routePath, request.pathname);
-        return void 0 === score ? [] : [
-            {
-                routePath,
-                score
-            }
-        ];
-    });
-    if (0 === matches.length) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    matches.sort((left, right)=>right.score - left.score);
-    return {
-        method: request.method,
-        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
-    };
-};
-const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
-const normalizeStatusCode = (statusCode)=>{
-    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
-    return DEFAULT_DENY_STATUS;
-};
-const readHeader = (headers, headerName)=>{
-    const lowerHeaderName = headerName.toLowerCase();
-    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
-        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
-        if (null == value) return;
-        return String(value);
-    }
-};
-const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
-const createViolation = (reason, message, status)=>({
-        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
-        reason,
-        message,
-        status
-    });
-const warnAdvisoryNamespaceAllowlist = ()=>{
-    if (hasWarnedAdvisoryNamespaceAllowlist) return;
-    hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
-};
-const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
-        headers,
-        policy,
-        status: normalizeStatusCode(policy.denyStatus),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
-        verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
-        allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
-        envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
-        operationContextHeader: normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER),
-        operationContextDetailHeader: normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER),
-        requestId: '',
-        detailSchemaHash: '',
-        detailOperationVersion: void 0,
-        observedRequest: observedRequest ? {
-            method: String(observedRequest.method || '').trim().toUpperCase(),
-            routePath: String(observedRequest.routePath || '').trim()
-        } : void 0,
-        complete: false
-    });
-const checkNamespaceAllowlistVerifier = (state)=>{
-    if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
-        warnAdvisoryNamespaceAllowlist();
-    }
-};
-const checkEnvelopeHeader = (state)=>{
-    const envelopeRaw = readHeader(state.headers, state.envelopeHeader);
-    if (!envelopeRaw) {
-        if (!state.requireEnvelope) {
-            state.complete = true;
-            return;
-        }
-        return createViolation('missing_envelope', `Missing cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    let envelope;
-    try {
-        const parsed = JSON.parse(envelopeRaw);
-        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
-        envelope = parsed;
-    } catch (_error) {
-        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    const requestId = String(envelope.requestId || '').trim();
-    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', state.status);
-    state.requestId = requestId;
-    state.claimedNamespace = extractNamespace(requestId);
-    state.effectiveNamespace = state.claimedNamespace;
-};
-const checkProducerIdentity = (state)=>{
-    if (!state.verifyProducerIdentity) return;
-    const verifiedNamespaceRaw = state.verifyProducerIdentity(state.headers);
-    const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
-    if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for request', state.status);
-    if (verifiedNamespace !== state.claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${state.claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, state.status);
-    state.effectiveNamespace = verifiedNamespace;
-};
-const checkNamespaceAllowlist = (state)=>{
-    if (state.allowedNamespaces.length > 0) {
-        if (!state.effectiveNamespace || !state.allowedNamespaces.includes(state.effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${state.effectiveNamespace || 'unknown'}" not allowed`, state.status);
-    }
-};
-const checkOperationContext = (state)=>{
-    if (!state.requireOperationContext) {
-        state.complete = true;
-        return;
-    }
-    const operationContext = readHeader(state.headers, state.operationContextHeader);
-    if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${state.operationContextHeader}"`, state.status);
-    if (!operationContext.startsWith(`${state.requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${state.operationContextHeader}" does not match requestId "${state.requestId}"`, state.status);
-    state.operationContext = operationContext;
-};
-const checkOperationContextDetails = (state)=>{
-    const operationContextDetailsRaw = readHeader(state.headers, state.operationContextDetailHeader);
-    if (!operationContextDetailsRaw) {
-        if (state.requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${state.operationContextDetailHeader}"`, state.status);
-        state.complete = true;
-        return;
-    }
-    let operationContextDetails;
-    try {
-        const parsed = JSON.parse(operationContextDetailsRaw);
-        if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
-        operationContextDetails = parsed;
-    } catch (_error) {
-        return createViolation('invalid_operation_context_details', `Invalid operation context details header "${state.operationContextDetailHeader}"`, state.status);
-    }
-    const detailRequestId = String(operationContextDetails.requestId || '').trim();
-    if (detailRequestId && detailRequestId !== state.requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${state.requestId}"`, state.status);
-    const detailOperationId = String(operationContextDetails.operationId || '').trim();
-    if (state.operationContext && detailOperationId && detailOperationId !== state.operationContext) return createViolation('operation_context_mismatch', `Operation context details operationId "${detailOperationId}" does not match operation context "${state.operationContext}"`, state.status);
-    state.operationContextDetails = operationContextDetails;
-    state.detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
-    if (state.requireOperationSchemaHash && !state.detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${state.operationContextDetailHeader}" must include schemaHash`, state.status);
-    state.detailOperationVersion = operationContextDetails.operationVersion;
-    if (state.requireOperationVersion && 'number' != typeof state.detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${state.operationContextDetailHeader}" must include operationVersion`, state.status);
-};
-const checkOperationContract = (state)=>{
-    if (!state.operationContextDetails) return;
-    const expectedContracts = state.policy.expectedOperationContracts;
-    if (expectedContracts && 'object' == typeof expectedContracts) {
-        const method = String(state.operationContextDetails.method || '').toUpperCase();
-        const routePath = String(state.operationContextDetails.routePath || '').trim();
-        const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const observedMethod = state.observedRequest?.method;
-        const observedRoutePath = state.observedRequest?.routePath;
-        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
-        const contractMethod = observedMethod || method;
-        const contractRoutePath = observedRoutePath || routePath;
-        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
-        if (expectedContract) {
-            const assertedOperationId = operationId || state.operationContext || '';
-            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
-            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
-            if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-            if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-        } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
-    }
-};
-const CROSS_PROJECT_POLICY_CHECKS = [
-    checkNamespaceAllowlistVerifier,
-    checkEnvelopeHeader,
-    checkProducerIdentity,
-    checkNamespaceAllowlist,
-    checkOperationContext,
-    checkOperationContextDetails,
-    checkOperationContract
-];
-const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
-    if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
-    for (const check of CROSS_PROJECT_POLICY_CHECKS){
-        const violation = check(state);
-        if (violation) return violation;
-        if (state.complete) break;
-    }
-    return null;
-};
-export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy, resolveCrossProjectRequestObservation };

package/dist/esm-node/security/operationContracts.mjs

@@ -1,130 +0,0 @@
-import "node:module";
-import { createRequire } from "node:module";
-import { createHash } from "crypto";
-import "reflect-metadata";
-import { HttpMetadata } from "../types.mjs";
-import { fileURLToPath as __rspack_fileURLToPath } from "node:url";
-var __rspack_import_meta_filename__ = __rspack_fileURLToPath(import.meta.url);
-const DEFAULT_OPERATION_VERSION = 1;
-const deriveOperationVersion = (packageVersion)=>{
-    if ('string' != typeof packageVersion) return DEFAULT_OPERATION_VERSION;
-    const match = packageVersion.trim().match(/^v?(\d+)\./);
-    if (!match) return DEFAULT_OPERATION_VERSION;
-    const major = Number.parseInt(match[1], 10);
-    return Number.isInteger(major) && major >= 0 ? major : DEFAULT_OPERATION_VERSION;
-};
-const stableStringify = (value)=>{
-    if (Array.isArray(value)) return `[${value.map((item)=>stableStringify(item)).join(',')}]`;
-    if (value && 'object' == typeof value) {
-        const entries = Object.entries(value).filter(([, entryValue])=>void 0 !== entryValue).sort(([a], [b])=>a.localeCompare(b)).map(([key, entryValue])=>`${JSON.stringify(key)}:${stableStringify(entryValue)}`);
-        return `{${entries.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
-};
-const sha256 = (text)=>createHash('sha256').update(text).digest('hex');
-let cachedZodToJSONSchema;
-const ZOD_SPECIFIER = "zod";
-const resolveZodToJSONSchema = ()=>{
-    if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
-    try {
-        const load = createRequire(__rspack_import_meta_filename__);
-        const zod = load(ZOD_SPECIFIER);
-        const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
-        cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
-    } catch  {
-        cachedZodToJSONSchema = null;
-    }
-    return cachedZodToJSONSchema;
-};
-const INPUT_SCHEMA_METADATA_KEYS = [
-    HttpMetadata.Data,
-    HttpMetadata.Query,
-    HttpMetadata.Params,
-    HttpMetadata.Headers,
-    HttpMetadata.Files
-];
-const serializeSchema = (schema)=>{
-    const toJSONSchema = resolveZodToJSONSchema();
-    if (toJSONSchema) try {
-        return toJSONSchema(schema, {
-            io: 'input',
-            unrepresentable: 'any'
-        });
-    } catch  {}
-    return {
-        __unserializableSchema: true
-    };
-};
-const serializeOperationSchemas = (handler)=>{
-    if ('function' != typeof handler) return;
-    const serialized = {};
-    for (const metadataKey of INPUT_SCHEMA_METADATA_KEYS){
-        let schema;
-        try {
-            schema = Reflect.getMetadata(metadataKey, handler);
-        } catch  {
-            schema = void 0;
-        }
-        if (null != schema) serialized[metadataKey] = serializeSchema(schema);
-    }
-    return Object.keys(serialized).length > 0 ? serialized : void 0;
-};
-const createOperationContractHash = (operation, requestId)=>sha256(stableStringify({
-        httpMethod: String(operation.httpMethod || '').toUpperCase(),
-        name: operation.name,
-        requestId,
-        routePath: operation.routePath,
-        ...operation.schemas ? {
-            schemas: operation.schemas
-        } : {}
-    }));
-const createOperationEntries = (handlers)=>handlers.map((item)=>({
-            name: item.name,
-            httpMethod: String(item.httpMethod || '').toUpperCase(),
-            routePath: item.routePath
-        })).sort((a, b)=>{
-        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
-        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
-        return keyA.localeCompare(keyB);
-    });
-const createOperationSchemaHash = (operationEntries, requestId)=>sha256(stableStringify({
-        operations: [
-            ...operationEntries
-        ].map((item)=>({
-                hash: item.schemaHash ?? createOperationContractHash({
-                    name: item.name,
-                    httpMethod: item.httpMethod,
-                    routePath: item.routePath
-                }, requestId)
-            })).sort((a, b)=>a.hash.localeCompare(b.hash)),
-        requestId
-    }));
-const buildOperationContractMap = ({ handlers, requestId, operationVersion })=>{
-    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
-    const normalizedOperationVersion = 'number' == typeof operationVersion && Number.isInteger(operationVersion) ? operationVersion : DEFAULT_OPERATION_VERSION;
-    const contracts = {};
-    handlers.forEach((item)=>{
-        const httpMethod = String(item.httpMethod || '').toUpperCase();
-        const schemaHash = createOperationContractHash({
-            name: item.name,
-            httpMethod,
-            routePath: item.routePath,
-            schemas: serializeOperationSchemas(item.handler)
-        }, normalizedRequestId);
-        const operationId = `${normalizedRequestId}:${item.name}`;
-        const contract = {
-            requestId: normalizedRequestId,
-            operationVersion: normalizedOperationVersion,
-            schemaHash,
-            method: httpMethod,
-            routePath: item.routePath,
-            operationId,
-            handlerName: item.name,
-            filename: item.filename
-        };
-        contracts[`${httpMethod}:${item.routePath}`] = contract;
-        contracts[`operation:${operationId}`] = contract;
-    });
-    return contracts;
-};
-export { DEFAULT_OPERATION_VERSION, buildOperationContractMap, createOperationContractHash, createOperationEntries, createOperationSchemaHash, deriveOperationVersion, serializeOperationSchemas };

package/dist/esm-node/security/resolveCrossProjectPolicy.mjs

@@ -1,28 +0,0 @@
-import "node:module";
-import { buildOperationContractMap } from "./operationContracts.mjs";
-const resolveCrossProjectPolicy = (input)=>{
-    const { crossProjectPolicy, handlers, requestId, isCrossProjectServer, operationVersion } = input;
-    if (!crossProjectPolicy && !isCrossProjectServer) return;
-    const policy = crossProjectPolicy ?? {};
-    const effectiveRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId : 'default';
-    const generatedContracts = buildOperationContractMap({
-        handlers,
-        requestId: effectiveRequestId,
-        operationVersion
-    });
-    return {
-        ...policy,
-        enabled: policy.enabled ?? Boolean(isCrossProjectServer),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        expectedOperationContracts: {
-            ...policy.expectedOperationContracts ?? {},
-            ...generatedContracts
-        }
-    };
-};
-export { resolveCrossProjectPolicy };

package/dist/esm-node/utils/alias.mjs

@@ -1,58 +0,0 @@
-import "node:module";
-import fs from "fs";
-import module_0 from "module";
-import * as __rspack_external_os from "os";
-import * as __rspack_external_path from "path";
-const getRelativeRuntimePath = (appDirectory, serverRuntimePath)=>{
-    let relativeRuntimePath = '';
-    relativeRuntimePath = 'win32' === __rspack_external_os.platform() ? `../${__rspack_external_path.relative(appDirectory, serverRuntimePath)}` : __rspack_external_path.join('../', __rspack_external_path.relative(appDirectory, serverRuntimePath));
-    if ('development' === process.env.NODE_ENV || 'test' === process.env.NODE_ENV) relativeRuntimePath = `./${__rspack_external_path.relative(appDirectory, serverRuntimePath)}`;
-    return relativeRuntimePath;
-};
-const sortByLongestPrefix = (arr)=>arr.concat().sort((a, b)=>b.length - a.length);
-const createMatchPath = (paths)=>{
-    const sortedKeys = sortByLongestPrefix(Object.keys(paths));
-    const sortedPaths = {};
-    sortedKeys.forEach((key)=>{
-        sortedPaths[key] = paths[key];
-    });
-    return (request)=>{
-        const found = Object.keys(sortedPaths).find((key)=>request.startsWith(key));
-        if (found) {
-            let foundPaths = sortedPaths[found];
-            if (!Array.isArray(foundPaths)) foundPaths = [
-                foundPaths
-            ];
-            foundPaths = foundPaths.filter((foundPath)=>__rspack_external_path.isAbsolute(foundPath));
-            for (const p of foundPaths){
-                const foundPath = request.replace(found, p);
-                if (fs.existsSync(foundPath)) return foundPath;
-            }
-            return request.replace(found, foundPaths[0]);
-        }
-        return null;
-    };
-};
-const registerPaths = (paths)=>{
-    const originalResolveFilename = module_0._resolveFilename;
-    const { builtinModules } = module_0;
-    const matchPath = createMatchPath(paths);
-    module_0._resolveFilename = function(request, _parent) {
-        const isCoreModule = builtinModules.includes(request);
-        if (!isCoreModule) {
-            const matched = matchPath(request);
-            if (matched) {
-                const modifiedArguments = [
-                    matched,
-                    ...[].slice.call(arguments, 1)
-                ];
-                return originalResolveFilename.apply(this, modifiedArguments);
-            }
-        }
-        return originalResolveFilename.apply(this, arguments);
-    };
-    return ()=>{
-        module_0._resolveFilename = originalResolveFilename;
-    };
-};
-export { createMatchPath, getRelativeRuntimePath, registerPaths };

package/dist/types/adapter-kit/index.d.ts

@@ -1,90 +0,0 @@
-import 'reflect-metadata';
-import type { ResponseMeta } from '../operators/http.js';
-import type { APIHandlerInfo, ApiHandler } from '../router/index.js';
-import { type CrossProjectPolicyConfig, type CrossProjectPolicyViolation } from '../security/crossProjectPolicy.js';
-import { HttpMethod } from '../types.js';
-/** Lowercase route-registration method shared by supported adapter routers. */
-export type ApiRouteMethod = Lowercase<`${HttpMethod}`>;
-/**
- * Maps an `APIHandlerInfo.httpMethod` onto the lowercase router method.
- * Unknown methods fail fast with a descriptive error instead of the
- * `app[method] is not a function` TypeError the adapters used to throw.
- */
-export declare const toApiRouteMethod: (httpMethod: APIHandlerInfo['httpMethod']) => ApiRouteMethod;
-/** Route middlewares attached by BFF operators via reflect metadata. */
-export declare const getRouteMiddlewares: <Middleware = unknown>(handler: ApiHandler) => Middleware[];
-export type ApiRoutePlanEntry<Middleware = unknown> = {
-    method: ApiRouteMethod;
-    routePath: string;
-    handler: ApiHandler;
-    middlewares: Middleware[];
-};
-/**
- * Computes the framework-agnostic registration plan for a set of API
- * handlers: registration order, lowercase route method and operator
- * middlewares. Adapters only translate each entry into framework calls.
- */
-export declare const planApiRoutes: <Middleware = unknown>(handlerInfos: APIHandlerInfo[]) => ApiRoutePlanEntry<Middleware>[];
-/**
- * Marker used by `@modern-js/bff-runtime` schema handlers. Re-declared here
- * (value-compatible) so adapters do not need a runtime dependency on
- * `@modern-js/bff-runtime` just to detect the handler mode.
- */
-export declare const HANDLER_WITH_SCHEMA = "HANDLER_WITH_SCHEMA";
-export declare const isSchemaApiHandler: (handler: unknown) => boolean;
-export type ApiHandlerMode = 'meta' | 'schema' | 'inputParamsDecider' | 'plain';
-/**
- * Detects how an API handler expects to be invoked. The probe order (meta →
- * schema → input-params-decider → plain) is shared by every adapter.
- *
- * Adapters call this once at route-registration time, not per request:
- * meta/schema markers are attached by decorators at module load, so a handler
- * marked after registration would not be picked up.
- */
-export declare const getApiHandlerMode: (handler: ApiHandler) => ApiHandlerMode;
-/** Result envelope produced by `@modern-js/bff-runtime` schema handlers. */
-export type SchemaHandlerResult = {
-    type: 'HandleSuccess';
-    value: unknown;
-} | {
-    type: 'InputValidationError' | 'OutputValidationError';
-    message: unknown;
-};
-export type SchemaHandlerHttpOutcome = {
-    success: boolean;
-    status: number;
-    body: unknown;
-};
-/**
- * Maps a schema-handler result onto the HTTP outcome both adapters must
- * produce: 200/value on success, 400/message on input validation errors and
- * 500/message for any other failure.
- */
-export declare const mapSchemaHandlerResult: (result: SchemaHandlerResult) => SchemaHandlerHttpOutcome;
-/**
- * Reads the response metadata (headers/redirect/status) attached to a meta
- * handler. Returns an empty list when no metadata is present so adapters can
- * iterate unconditionally.
- */
-export declare const getResponseMetaList: (handler: ApiHandler) => ResponseMeta[];
-export type ApiHandlerInput = {
-    params: Record<string, unknown>;
-} & Record<string, unknown>;
-/**
- * Positional invocation convention for plain function handlers: route params
- * in declaration order followed by the full input object.
- */
-export declare const buildPositionalHandlerArgs: (input: ApiHandlerInput, routePath?: string) => unknown[];
-export type CrossProjectPolicyDenial = {
-    status: number;
-    body: {
-        code: CrossProjectPolicyViolation['code'];
-        reason: CrossProjectPolicyViolation['reason'];
-        message: string;
-    };
-};
-/**
- * Evaluates the cross-project policy for a request and, on violation,
- * returns the exact HTTP status and JSON body every adapter must send.
- */
-export declare const checkCrossProjectPolicy: (headers: Record<string, unknown>, policy: CrossProjectPolicyConfig | undefined) => CrossProjectPolicyDenial | null;

package/dist/types/adapter-kit/parity-scenarios/cross-project-denial.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createCrossProjectDenialScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/envelope.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createEnvelopeParityScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/operation-context.d.ts

@@ -1,3 +0,0 @@
-import type { AdapterParityScenario, AdapterParityScenarioContext } from './shared.js';
-export declare const createOperationContextSuccessScenarios: ({ helloContract, validEnvelope, validOperationId, }: AdapterParityScenarioContext) => AdapterParityScenario[];
-export declare const createOperationContextDenialScenarios: ({ helloContract, validEnvelope, validOperationId, }: AdapterParityScenarioContext) => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/schema.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createSchemaParityScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/shared.d.ts

@@ -1,32 +0,0 @@
-import type { CrossProjectOperationContract, CrossProjectPolicyViolationReason } from '../../security/crossProjectPolicy.js';
-export declare const PARITY_REQUEST_ID = "crm";
-export declare const PARITY_PRODUCER_REQUEST_ID = "crm.producer-a";
-export type ParityExpectation = {
-    kind: 'payload';
-    status: number;
-    payload: unknown;
-} | {
-    kind: 'denied';
-    status: number;
-    reason: CrossProjectPolicyViolationReason;
-};
-export type AdapterParityScenario = {
-    name: string;
-    /** Run against policy-enabled server instead of the open one. */
-    policy: boolean;
-    request: {
-        method: 'get' | 'post' | 'patch';
-        path: string;
-        headers?: Record<string, string>;
-        body?: unknown;
-    };
-    expected: ParityExpectation;
-};
-export type AdapterParityScenarioContext = {
-    helloContract: CrossProjectOperationContract;
-    validEnvelope: string;
-    validOperationId: string;
-};
-export declare const envelopeHeader: (requestId: unknown) => string;
-export declare const detailHeader: (details: Record<string, unknown>) => string;
-export declare const deniedScenario: (name: string, reason: CrossProjectPolicyViolationReason, headers: Record<string, string>) => AdapterParityScenario;

package/dist/types/adapter-kit/parity.d.ts

@@ -1,43 +0,0 @@
-import type { APIHandlerInfo } from '../router/index.js';
-import type { AdapterParityScenario } from './parity-scenarios/shared.js';
-export type { AdapterParityScenario, ParityExpectation, } from './parity-scenarios/shared.js';
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, } from './parity-scenarios/shared.js';
-/**
- * Handler fixtures registered in both adapters before running the table.
- */
-export declare const createParityApiHandlerInfos: () => APIHandlerInfo[];
-/**
- * `bff` config slice for policy-enabled parity server. All `require*`
- * switches stay at strict defaults.
- */
-export declare const createParityBffConfig: () => {
-    requestId: string;
-    crossProjectPolicy: {
-        enabled: boolean;
-        allowedNamespaces: string[];
-        allowClientAssertedNamespace: boolean;
-    };
-};
-export declare const createAdapterParityScenarios: () => AdapterParityScenario[];
-/** Structural slice of supertest response used for normalization. */
-export type ParityHttpResponse = {
-    status: number;
-    /** Content-type mime, e.g. `application/json`. */
-    type: string;
-    body: unknown;
-    text: string;
-};
-type AdapterParityResult = {
-    status: number;
-    payload: unknown;
-};
-/**
- * Normalizes raw HTTP response into an observable payload value so JSON and
- * text encodings of the same scalar compare equal.
- */
-export declare const toParityResult: (res: ParityHttpResponse) => AdapterParityResult;
-/**
- * Framework-agnostic assertion: throws a descriptive error when adapter
- * response deviates from the scenario expectation.
- */
-export declare const assertParityResult: (scenario: AdapterParityScenario, res: ParityHttpResponse) => void;