@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.4 → 3.9.0-ultramodern.6

package/dist/cjs/security/crossProjectPolicy.js

@@ -1,309 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
-const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
-const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
-const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
-let hasWarnedAdvisoryNamespaceAllowlist = false;
-const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
-const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
-const hasUnsafePathEncoding = (requestPath)=>{
-    let decoded = requestPath;
-    for(let depth = 0; depth < 8; depth += 1){
-        if (/%(?:2f|5c)/i.test(decoded)) return true;
-        try {
-            const next = decodeURIComponent(decoded);
-            if (next === decoded) return false;
-            decoded = next;
-        } catch  {
-            return true;
-        }
-    }
-    return decoded.includes('%');
-};
-const routeSegmentsMatch = (templateSegments, requestSegments)=>{
-    let templateIndex = 0;
-    let requestIndex = 0;
-    while(templateIndex < templateSegments.length){
-        const segment = templateSegments[templateIndex];
-        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-        const optional = segment.startsWith(':') && segment.endsWith('?');
-        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
-        if (wildcard) return true;
-        const requestSegment = requestSegments[requestIndex];
-        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
-        if (!segment.startsWith(':') && segment !== requestSegment) return false;
-        templateIndex += 1;
-        requestIndex += 1;
-    }
-    return requestIndex === requestSegments.length;
-};
-const routeTemplateMatchScore = (routePath, requestPath)=>{
-    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
-    const templateSegments = splitRoutePath(routePath);
-    const requestSegments = splitRoutePath(requestPath);
-    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
-        const removedPrefix = templateSegments.slice(0, prefixLength);
-        if (removedPrefix.some(isDynamicRouteSegment)) break;
-        const mountedTemplate = templateSegments.slice(prefixLength);
-        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
-        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
-        const dynamicSegments = mountedTemplate.length - literalSegments;
-        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
-    }
-};
-const resolveCrossProjectRequestObservation = (request, policy)=>{
-    const requestMethod = String(request.method || '').trim().toUpperCase();
-    const routePaths = [
-        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
-            if (key.startsWith('operation:')) return [];
-            const separator = key.indexOf(':');
-            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
-            return [
-                key.slice(separator + 1)
-            ];
-        }))
-    ];
-    if (0 === routePaths.length) return;
-    if (hasUnsafePathEncoding(request.pathname)) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    const matches = routePaths.flatMap((routePath)=>{
-        const score = routeTemplateMatchScore(routePath, request.pathname);
-        return void 0 === score ? [] : [
-            {
-                routePath,
-                score
-            }
-        ];
-    });
-    if (0 === matches.length) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    matches.sort((left, right)=>right.score - left.score);
-    return {
-        method: request.method,
-        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
-    };
-};
-const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
-const normalizeStatusCode = (statusCode)=>{
-    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
-    return DEFAULT_DENY_STATUS;
-};
-const readHeader = (headers, headerName)=>{
-    const lowerHeaderName = headerName.toLowerCase();
-    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
-        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
-        if (null == value) return;
-        return String(value);
-    }
-};
-const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
-const createViolation = (reason, message, status)=>({
-        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
-        reason,
-        message,
-        status
-    });
-const warnAdvisoryNamespaceAllowlist = ()=>{
-    if (hasWarnedAdvisoryNamespaceAllowlist) return;
-    hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
-};
-const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
-        headers,
-        policy,
-        status: normalizeStatusCode(policy.denyStatus),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
-        verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
-        allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
-        envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
-        operationContextHeader: normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER),
-        operationContextDetailHeader: normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER),
-        requestId: '',
-        detailSchemaHash: '',
-        detailOperationVersion: void 0,
-        observedRequest: observedRequest ? {
-            method: String(observedRequest.method || '').trim().toUpperCase(),
-            routePath: String(observedRequest.routePath || '').trim()
-        } : void 0,
-        complete: false
-    });
-const checkNamespaceAllowlistVerifier = (state)=>{
-    if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
-        warnAdvisoryNamespaceAllowlist();
-    }
-};
-const checkEnvelopeHeader = (state)=>{
-    const envelopeRaw = readHeader(state.headers, state.envelopeHeader);
-    if (!envelopeRaw) {
-        if (!state.requireEnvelope) {
-            state.complete = true;
-            return;
-        }
-        return createViolation('missing_envelope', `Missing cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    let envelope;
-    try {
-        const parsed = JSON.parse(envelopeRaw);
-        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
-        envelope = parsed;
-    } catch (_error) {
-        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    const requestId = String(envelope.requestId || '').trim();
-    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', state.status);
-    state.requestId = requestId;
-    state.claimedNamespace = extractNamespace(requestId);
-    state.effectiveNamespace = state.claimedNamespace;
-};
-const checkProducerIdentity = (state)=>{
-    if (!state.verifyProducerIdentity) return;
-    const verifiedNamespaceRaw = state.verifyProducerIdentity(state.headers);
-    const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
-    if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for request', state.status);
-    if (verifiedNamespace !== state.claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${state.claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, state.status);
-    state.effectiveNamespace = verifiedNamespace;
-};
-const checkNamespaceAllowlist = (state)=>{
-    if (state.allowedNamespaces.length > 0) {
-        if (!state.effectiveNamespace || !state.allowedNamespaces.includes(state.effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${state.effectiveNamespace || 'unknown'}" not allowed`, state.status);
-    }
-};
-const checkOperationContext = (state)=>{
-    if (!state.requireOperationContext) {
-        state.complete = true;
-        return;
-    }
-    const operationContext = readHeader(state.headers, state.operationContextHeader);
-    if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${state.operationContextHeader}"`, state.status);
-    if (!operationContext.startsWith(`${state.requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${state.operationContextHeader}" does not match requestId "${state.requestId}"`, state.status);
-    state.operationContext = operationContext;
-};
-const checkOperationContextDetails = (state)=>{
-    const operationContextDetailsRaw = readHeader(state.headers, state.operationContextDetailHeader);
-    if (!operationContextDetailsRaw) {
-        if (state.requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${state.operationContextDetailHeader}"`, state.status);
-        state.complete = true;
-        return;
-    }
-    let operationContextDetails;
-    try {
-        const parsed = JSON.parse(operationContextDetailsRaw);
-        if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
-        operationContextDetails = parsed;
-    } catch (_error) {
-        return createViolation('invalid_operation_context_details', `Invalid operation context details header "${state.operationContextDetailHeader}"`, state.status);
-    }
-    const detailRequestId = String(operationContextDetails.requestId || '').trim();
-    if (detailRequestId && detailRequestId !== state.requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${state.requestId}"`, state.status);
-    const detailOperationId = String(operationContextDetails.operationId || '').trim();
-    if (state.operationContext && detailOperationId && detailOperationId !== state.operationContext) return createViolation('operation_context_mismatch', `Operation context details operationId "${detailOperationId}" does not match operation context "${state.operationContext}"`, state.status);
-    state.operationContextDetails = operationContextDetails;
-    state.detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
-    if (state.requireOperationSchemaHash && !state.detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${state.operationContextDetailHeader}" must include schemaHash`, state.status);
-    state.detailOperationVersion = operationContextDetails.operationVersion;
-    if (state.requireOperationVersion && 'number' != typeof state.detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${state.operationContextDetailHeader}" must include operationVersion`, state.status);
-};
-const checkOperationContract = (state)=>{
-    if (!state.operationContextDetails) return;
-    const expectedContracts = state.policy.expectedOperationContracts;
-    if (expectedContracts && 'object' == typeof expectedContracts) {
-        const method = String(state.operationContextDetails.method || '').toUpperCase();
-        const routePath = String(state.operationContextDetails.routePath || '').trim();
-        const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const observedMethod = state.observedRequest?.method;
-        const observedRoutePath = state.observedRequest?.routePath;
-        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
-        const contractMethod = observedMethod || method;
-        const contractRoutePath = observedRoutePath || routePath;
-        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
-        if (expectedContract) {
-            const assertedOperationId = operationId || state.operationContext || '';
-            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
-            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
-            if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-            if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-        } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
-    }
-};
-const CROSS_PROJECT_POLICY_CHECKS = [
-    checkNamespaceAllowlistVerifier,
-    checkEnvelopeHeader,
-    checkProducerIdentity,
-    checkNamespaceAllowlist,
-    checkOperationContext,
-    checkOperationContextDetails,
-    checkOperationContract
-];
-const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
-    if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
-    for (const check of CROSS_PROJECT_POLICY_CHECKS){
-        const violation = check(state);
-        if (violation) return violation;
-        if (state.complete) break;
-    }
-    return null;
-};
-__webpack_require__.d(__webpack_exports__, {}, {
-    BFF_ENVELOPE_HEADER: BFF_ENVELOPE_HEADER,
-    BFF_OPERATION_CONTEXT_DETAIL_HEADER: BFF_OPERATION_CONTEXT_DETAIL_HEADER,
-    BFF_OPERATION_CONTEXT_HEADER: BFF_OPERATION_CONTEXT_HEADER,
-    evaluateCrossProjectPolicy: evaluateCrossProjectPolicy,
-    resolveCrossProjectRequestObservation: resolveCrossProjectRequestObservation
-});
-exports.BFF_ENVELOPE_HEADER = __webpack_exports__.BFF_ENVELOPE_HEADER;
-exports.BFF_OPERATION_CONTEXT_DETAIL_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_DETAIL_HEADER;
-exports.BFF_OPERATION_CONTEXT_HEADER = __webpack_exports__.BFF_OPERATION_CONTEXT_HEADER;
-exports.evaluateCrossProjectPolicy = __webpack_exports__.evaluateCrossProjectPolicy;
-exports.resolveCrossProjectRequestObservation = __webpack_exports__.resolveCrossProjectRequestObservation;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "BFF_ENVELOPE_HEADER",
-    "BFF_OPERATION_CONTEXT_DETAIL_HEADER",
-    "BFF_OPERATION_CONTEXT_HEADER",
-    "evaluateCrossProjectPolicy",
-    "resolveCrossProjectRequestObservation"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/cjs/security/operationContracts.js

@@ -1,183 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-__webpack_require__.d(__webpack_exports__, {
-    DEFAULT_OPERATION_VERSION: ()=>DEFAULT_OPERATION_VERSION,
-    buildOperationContractMap: ()=>buildOperationContractMap,
-    createOperationContractHash: ()=>createOperationContractHash,
-    createOperationEntries: ()=>createOperationEntries,
-    createOperationSchemaHash: ()=>createOperationSchemaHash,
-    deriveOperationVersion: ()=>deriveOperationVersion,
-    serializeOperationSchemas: ()=>serializeOperationSchemas
-});
-const external_node_module_namespaceObject = require("node:module");
-const external_crypto_namespaceObject = require("crypto");
-require("reflect-metadata");
-const external_types_js_namespaceObject = require("../types.js");
-const DEFAULT_OPERATION_VERSION = 1;
-const deriveOperationVersion = (packageVersion)=>{
-    if ('string' != typeof packageVersion) return DEFAULT_OPERATION_VERSION;
-    const match = packageVersion.trim().match(/^v?(\d+)\./);
-    if (!match) return DEFAULT_OPERATION_VERSION;
-    const major = Number.parseInt(match[1], 10);
-    return Number.isInteger(major) && major >= 0 ? major : DEFAULT_OPERATION_VERSION;
-};
-const stableStringify = (value)=>{
-    if (Array.isArray(value)) return `[${value.map((item)=>stableStringify(item)).join(',')}]`;
-    if (value && 'object' == typeof value) {
-        const entries = Object.entries(value).filter(([, entryValue])=>void 0 !== entryValue).sort(([a], [b])=>a.localeCompare(b)).map(([key, entryValue])=>`${JSON.stringify(key)}:${stableStringify(entryValue)}`);
-        return `{${entries.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
-};
-const sha256 = (text)=>(0, external_crypto_namespaceObject.createHash)('sha256').update(text).digest('hex');
-let cachedZodToJSONSchema;
-const ZOD_SPECIFIER = "zod";
-const resolveZodToJSONSchema = ()=>{
-    if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
-    try {
-        const load = (0, external_node_module_namespaceObject.createRequire)(__filename);
-        const zod = load(ZOD_SPECIFIER);
-        const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
-        cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
-    } catch  {
-        cachedZodToJSONSchema = null;
-    }
-    return cachedZodToJSONSchema;
-};
-const INPUT_SCHEMA_METADATA_KEYS = [
-    external_types_js_namespaceObject.HttpMetadata.Data,
-    external_types_js_namespaceObject.HttpMetadata.Query,
-    external_types_js_namespaceObject.HttpMetadata.Params,
-    external_types_js_namespaceObject.HttpMetadata.Headers,
-    external_types_js_namespaceObject.HttpMetadata.Files
-];
-const serializeSchema = (schema)=>{
-    const toJSONSchema = resolveZodToJSONSchema();
-    if (toJSONSchema) try {
-        return toJSONSchema(schema, {
-            io: 'input',
-            unrepresentable: 'any'
-        });
-    } catch  {}
-    return {
-        __unserializableSchema: true
-    };
-};
-const serializeOperationSchemas = (handler)=>{
-    if ('function' != typeof handler) return;
-    const serialized = {};
-    for (const metadataKey of INPUT_SCHEMA_METADATA_KEYS){
-        let schema;
-        try {
-            schema = Reflect.getMetadata(metadataKey, handler);
-        } catch  {
-            schema = void 0;
-        }
-        if (null != schema) serialized[metadataKey] = serializeSchema(schema);
-    }
-    return Object.keys(serialized).length > 0 ? serialized : void 0;
-};
-const createOperationContractHash = (operation, requestId)=>sha256(stableStringify({
-        httpMethod: String(operation.httpMethod || '').toUpperCase(),
-        name: operation.name,
-        requestId,
-        routePath: operation.routePath,
-        ...operation.schemas ? {
-            schemas: operation.schemas
-        } : {}
-    }));
-const createOperationEntries = (handlers)=>handlers.map((item)=>({
-            name: item.name,
-            httpMethod: String(item.httpMethod || '').toUpperCase(),
-            routePath: item.routePath
-        })).sort((a, b)=>{
-        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
-        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
-        return keyA.localeCompare(keyB);
-    });
-const createOperationSchemaHash = (operationEntries, requestId)=>sha256(stableStringify({
-        operations: [
-            ...operationEntries
-        ].map((item)=>({
-                hash: item.schemaHash ?? createOperationContractHash({
-                    name: item.name,
-                    httpMethod: item.httpMethod,
-                    routePath: item.routePath
-                }, requestId)
-            })).sort((a, b)=>a.hash.localeCompare(b.hash)),
-        requestId
-    }));
-const buildOperationContractMap = ({ handlers, requestId, operationVersion })=>{
-    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
-    const normalizedOperationVersion = 'number' == typeof operationVersion && Number.isInteger(operationVersion) ? operationVersion : DEFAULT_OPERATION_VERSION;
-    const contracts = {};
-    handlers.forEach((item)=>{
-        const httpMethod = String(item.httpMethod || '').toUpperCase();
-        const schemaHash = createOperationContractHash({
-            name: item.name,
-            httpMethod,
-            routePath: item.routePath,
-            schemas: serializeOperationSchemas(item.handler)
-        }, normalizedRequestId);
-        const operationId = `${normalizedRequestId}:${item.name}`;
-        const contract = {
-            requestId: normalizedRequestId,
-            operationVersion: normalizedOperationVersion,
-            schemaHash,
-            method: httpMethod,
-            routePath: item.routePath,
-            operationId,
-            handlerName: item.name,
-            filename: item.filename
-        };
-        contracts[`${httpMethod}:${item.routePath}`] = contract;
-        contracts[`operation:${operationId}`] = contract;
-    });
-    return contracts;
-};
-exports.DEFAULT_OPERATION_VERSION = __webpack_exports__.DEFAULT_OPERATION_VERSION;
-exports.buildOperationContractMap = __webpack_exports__.buildOperationContractMap;
-exports.createOperationContractHash = __webpack_exports__.createOperationContractHash;
-exports.createOperationEntries = __webpack_exports__.createOperationEntries;
-exports.createOperationSchemaHash = __webpack_exports__.createOperationSchemaHash;
-exports.deriveOperationVersion = __webpack_exports__.deriveOperationVersion;
-exports.serializeOperationSchemas = __webpack_exports__.serializeOperationSchemas;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "DEFAULT_OPERATION_VERSION",
-    "buildOperationContractMap",
-    "createOperationContractHash",
-    "createOperationEntries",
-    "createOperationSchemaHash",
-    "deriveOperationVersion",
-    "serializeOperationSchemas"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/cjs/security/resolveCrossProjectPolicy.js

@@ -1,65 +0,0 @@
-"use strict";
-var __webpack_require__ = {};
-(()=>{
-    __webpack_require__.d = (exports1, getters, values)=>{
-        var define = (defs, kind)=>{
-            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-                enumerable: true,
-                [kind]: defs[key]
-            });
-        };
-        define(getters, "get");
-        define(values, "value");
-    };
-})();
-(()=>{
-    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
-})();
-(()=>{
-    __webpack_require__.r = (exports1)=>{
-        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
-            value: 'Module'
-        });
-        Object.defineProperty(exports1, '__esModule', {
-            value: true
-        });
-    };
-})();
-var __webpack_exports__ = {};
-__webpack_require__.r(__webpack_exports__);
-__webpack_require__.d(__webpack_exports__, {
-    resolveCrossProjectPolicy: ()=>resolveCrossProjectPolicy
-});
-const external_operationContracts_js_namespaceObject = require("./operationContracts.js");
-const resolveCrossProjectPolicy = (input)=>{
-    const { crossProjectPolicy, handlers, requestId, isCrossProjectServer, operationVersion } = input;
-    if (!crossProjectPolicy && !isCrossProjectServer) return;
-    const policy = crossProjectPolicy ?? {};
-    const effectiveRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId : 'default';
-    const generatedContracts = (0, external_operationContracts_js_namespaceObject.buildOperationContractMap)({
-        handlers,
-        requestId: effectiveRequestId,
-        operationVersion
-    });
-    return {
-        ...policy,
-        enabled: policy.enabled ?? Boolean(isCrossProjectServer),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        expectedOperationContracts: {
-            ...policy.expectedOperationContracts ?? {},
-            ...generatedContracts
-        }
-    };
-};
-exports.resolveCrossProjectPolicy = __webpack_exports__.resolveCrossProjectPolicy;
-for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "resolveCrossProjectPolicy"
-].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
-Object.defineProperty(exports, '__esModule', {
-    value: true
-});

package/dist/esm/adapter-kit/index.mjs

@@ -1,79 +0,0 @@
-import "reflect-metadata";
-import { evaluateCrossProjectPolicy } from "../security/crossProjectPolicy.mjs";
-import { HttpMetadata, HttpMethod } from "../types.mjs";
-import { isInputParamsDeciderHandler, isWithMetaHandler } from "../utils/index.mjs";
-const API_ROUTE_METHODS = {
-    [HttpMethod.Get]: 'get',
-    [HttpMethod.Post]: 'post',
-    [HttpMethod.Put]: 'put',
-    [HttpMethod.Delete]: 'delete',
-    [HttpMethod.Connect]: 'connect',
-    [HttpMethod.Trace]: 'trace',
-    [HttpMethod.Patch]: 'patch',
-    [HttpMethod.Options]: 'options',
-    [HttpMethod.Head]: 'head'
-};
-const toApiRouteMethod = (httpMethod)=>{
-    const method = API_ROUTE_METHODS[httpMethod];
-    if (!method) throw new Error(`[bff-core] Unsupported HTTP method "${String(httpMethod)}" in API handler info`);
-    return method;
-};
-const getRouteMiddlewares = (handler)=>{
-    const middlewares = Reflect.getMetadata('middleware', handler);
-    return Array.isArray(middlewares) ? middlewares : [];
-};
-const planApiRoutes = (handlerInfos)=>handlerInfos.map(({ routePath, handler, httpMethod })=>({
-            method: toApiRouteMethod(httpMethod),
-            routePath,
-            handler,
-            middlewares: getRouteMiddlewares(handler)
-        }));
-const HANDLER_WITH_SCHEMA = 'HANDLER_WITH_SCHEMA';
-const isSchemaApiHandler = (handler)=>{
-    if ('function' != typeof handler) return false;
-    const marked = handler;
-    return true === marked[HANDLER_WITH_SCHEMA];
-};
-const getApiHandlerMode = (handler)=>{
-    if (isWithMetaHandler(handler)) return 'meta';
-    if (isSchemaApiHandler(handler)) return 'schema';
-    if (isInputParamsDeciderHandler(handler)) return 'inputParamsDecider';
-    return 'plain';
-};
-const mapSchemaHandlerResult = (result)=>{
-    if ('HandleSuccess' === result.type) return {
-        success: true,
-        status: 200,
-        body: result.value
-    };
-    return {
-        success: false,
-        status: 'InputValidationError' === result.type ? 400 : 500,
-        body: result.message
-    };
-};
-const getResponseMetaList = (handler)=>{
-    const responseMeta = Reflect.getMetadata(HttpMetadata.Response, handler);
-    return Array.isArray(responseMeta) ? responseMeta : [];
-};
-const buildPositionalHandlerArgs = (input, routePath)=>{
-    const paramNames = routePath?.match(/:(\w+)/g)?.map((param)=>param.slice(1)) ?? [];
-    const positionalParams = paramNames.length > 0 ? paramNames.map((param)=>input.params[param]) : Object.values(input.params);
-    return [
-        ...positionalParams,
-        input
-    ];
-};
-const checkCrossProjectPolicy = (headers, policy)=>{
-    const violation = evaluateCrossProjectPolicy(headers, policy);
-    if (!violation) return null;
-    return {
-        status: violation.status,
-        body: {
-            code: violation.code,
-            reason: violation.reason,
-            message: violation.message
-        }
-    };
-};
-export { HANDLER_WITH_SCHEMA, buildPositionalHandlerArgs, checkCrossProjectPolicy, getApiHandlerMode, getResponseMetaList, getRouteMiddlewares, isSchemaApiHandler, mapSchemaHandlerResult, planApiRoutes, toApiRouteMethod };

package/dist/esm/adapter-kit/parity-scenarios/cross-project-denial.mjs

@@ -1,17 +0,0 @@
-import { deniedScenario, envelopeHeader } from "./shared.mjs";
-const createCrossProjectDenialScenarios = ()=>[
-        deniedScenario('policy denies missing envelope', 'missing_envelope', {}),
-        deniedScenario('policy denies invalid envelope', 'invalid_envelope', {
-            'x-modernjs-bff-envelope': 'not-json'
-        }),
-        deniedScenario('policy denies envelope that is valid JSON but not an object', 'invalid_envelope', {
-            'x-modernjs-bff-envelope': '123'
-        }),
-        deniedScenario('policy denies missing requestId', 'missing_request_id', {
-            'x-modernjs-bff-envelope': envelopeHeader(void 0)
-        }),
-        deniedScenario('policy denies namespace outside allowlist', 'namespace_not_allowed', {
-            'x-modernjs-bff-envelope': envelopeHeader('billing.producer-z')
-        })
-    ];
-export { createCrossProjectDenialScenarios };