@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.4 → 3.9.0-ultramodern.6

package/dist/esm-node/adapter-kit/parity-scenarios/operation-context.mjs

@@ -1,112 +0,0 @@
-import "node:module";
-import { PARITY_PRODUCER_REQUEST_ID, deniedScenario, detailHeader } from "./shared.mjs";
-const createOperationContextSuccessScenarios = ({ helloContract, validEnvelope, validOperationId })=>[
-        {
-            name: 'policy pass with full operation context',
-            policy: true,
-            request: {
-                method: 'get',
-                path: '/hello',
-                headers: {
-                    'x-modernjs-bff-envelope': validEnvelope,
-                    'x-operation-id': validOperationId,
-                    'x-modernjs-bff-operation-context': detailHeader({
-                        requestId: PARITY_PRODUCER_REQUEST_ID,
-                        method: 'GET',
-                        routePath: '/hello',
-                        schemaHash: helloContract.schemaHash,
-                        operationVersion: helloContract.operationVersion
-                    })
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    message: 'hello'
-                }
-            }
-        }
-    ];
-const getMismatchedOperationVersion = (contract)=>{
-    const operationVersion = contract.operationVersion;
-    if ('number' != typeof operationVersion) throw new Error('Adapter parity hello contract requires operationVersion');
-    return operationVersion + 1;
-};
-const createOperationContextDenialScenarios = ({ helloContract, validEnvelope, validOperationId })=>[
-        deniedScenario('policy denies missing operation context', 'missing_operation_context', {
-            'x-modernjs-bff-envelope': validEnvelope
-        }),
-        deniedScenario('policy denies operation context mismatch', 'operation_context_mismatch', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': 'someone-else:parity'
-        }),
-        deniedScenario('policy denies missing operation context details', 'missing_operation_context_details', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId
-        }),
-        deniedScenario('policy denies JSON-array operation context details', 'invalid_operation_context_details', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': '[]'
-        }),
-        deniedScenario('policy denies invalid operation context details', 'invalid_operation_context_details', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': 'not-json'
-        }),
-        deniedScenario('policy denies detail requestId mismatch', 'operation_context_details_request_id_mismatch', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: 'crm.producer-b',
-                method: 'GET',
-                routePath: '/hello',
-                schemaHash: helloContract.schemaHash,
-                operationVersion: helloContract.operationVersion
-            })
-        }),
-        deniedScenario('policy denies missing operation schema hash', 'missing_operation_schema_hash', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/hello',
-                operationVersion: helloContract.operationVersion
-            })
-        }),
-        deniedScenario('policy denies missing operation version', 'missing_operation_version', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/hello',
-                schemaHash: helloContract.schemaHash
-            })
-        }),
-        deniedScenario('policy denies operation schema hash mismatch', 'operation_schema_hash_mismatch', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/hello',
-                schemaHash: 'deadbeef',
-                operationVersion: helloContract.operationVersion
-            })
-        }),
-        deniedScenario('policy denies operation version mismatch', 'operation_version_mismatch', {
-            'x-modernjs-bff-envelope': validEnvelope,
-            'x-operation-id': validOperationId,
-            'x-modernjs-bff-operation-context': detailHeader({
-                requestId: PARITY_PRODUCER_REQUEST_ID,
-                method: 'GET',
-                routePath: '/hello',
-                schemaHash: helloContract.schemaHash,
-                operationVersion: getMismatchedOperationVersion(helloContract)
-            })
-        })
-    ];
-export { createOperationContextDenialScenarios, createOperationContextSuccessScenarios };

package/dist/esm-node/adapter-kit/parity-scenarios/schema.mjs

@@ -1,72 +0,0 @@
-import "node:module";
-const createSchemaParityScenarios = ()=>[
-        {
-            name: 'schema handler success',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 777
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'HandleSuccess',
-                    value: {
-                        id: 777
-                    }
-                }
-            }
-        },
-        {
-            name: 'schema handler input validation error',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 'aaa'
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'InputValidationError',
-                    message: 'invalid input'
-                }
-            }
-        },
-        {
-            name: 'schema handler output validation error',
-            policy: false,
-            request: {
-                method: 'patch',
-                path: '/schema',
-                headers: {
-                    'content-type': 'application/json'
-                },
-                body: {
-                    id: 'boom'
-                }
-            },
-            expected: {
-                kind: 'payload',
-                status: 200,
-                payload: {
-                    type: 'OutputValidationError',
-                    message: 'invalid output'
-                }
-            }
-        }
-    ];
-export { createSchemaParityScenarios };

package/dist/esm-node/adapter-kit/parity-scenarios/shared.mjs

@@ -1,22 +0,0 @@
-import "node:module";
-const PARITY_REQUEST_ID = 'crm';
-const PARITY_PRODUCER_REQUEST_ID = 'crm.producer-a';
-const envelopeHeader = (requestId)=>JSON.stringify(void 0 === requestId ? {} : {
-        requestId
-    });
-const detailHeader = (details)=>JSON.stringify(details);
-const deniedScenario = (name, reason, headers)=>({
-        name,
-        policy: true,
-        request: {
-            method: 'get',
-            path: '/hello',
-            headers
-        },
-        expected: {
-            kind: 'denied',
-            status: 403,
-            reason
-        }
-    });
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, deniedScenario, detailHeader, envelopeHeader };

package/dist/esm-node/adapter-kit/parity.mjs

@@ -1,149 +0,0 @@
-import "node:module";
-import { buildOperationContractMap } from "../security/operationContracts.mjs";
-import { HttpMethod } from "../types.mjs";
-import { createCrossProjectDenialScenarios } from "./parity-scenarios/cross-project-denial.mjs";
-import { createEnvelopeParityScenarios } from "./parity-scenarios/envelope.mjs";
-import { createOperationContextDenialScenarios, createOperationContextSuccessScenarios } from "./parity-scenarios/operation-context.mjs";
-import { createSchemaParityScenarios } from "./parity-scenarios/schema.mjs";
-import { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, envelopeHeader } from "./parity-scenarios/shared.mjs";
-const PARITY_FIXTURE_FILENAME = 'bff-core/adapter-kit/parity-fixture.ts';
-const HANDLER_WITH_SCHEMA = 'HANDLER_WITH_SCHEMA';
-const isRecord = (value)=>Boolean(value) && 'object' == typeof value;
-const createSchemaFixtureHandler = ()=>{
-    const handler = (input)=>{
-        const data = isRecord(input) && isRecord(input.data) ? input.data : void 0;
-        const id = data?.id;
-        if ('number' == typeof id) return {
-            type: 'HandleSuccess',
-            value: {
-                id
-            }
-        };
-        if ('boom' === id) return {
-            type: 'OutputValidationError',
-            message: 'invalid output'
-        };
-        return {
-            type: 'InputValidationError',
-            message: 'invalid input'
-        };
-    };
-    return Object.assign(handler, {
-        [HANDLER_WITH_SCHEMA]: true
-    });
-};
-const createParityApiHandlerInfos = ()=>[
-        {
-            name: 'getHello',
-            httpMethod: HttpMethod.Get,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>({
-                    message: 'hello'
-                })
-        },
-        {
-            name: 'postHello',
-            httpMethod: HttpMethod.Post,
-            routeName: '/hello',
-            routePath: '/hello',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>'hello'
-        },
-        {
-            name: 'getNothing',
-            httpMethod: HttpMethod.Get,
-            routeName: '/nothing',
-            routePath: '/nothing',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: ()=>void 0
-        },
-        {
-            name: 'postEcho',
-            httpMethod: HttpMethod.Post,
-            routeName: '/echo',
-            routePath: '/echo',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (input)=>{
-                const normalized = isRecord(input) ? input : {};
-                return {
-                    data: normalized.data ?? null,
-                    query: normalized.query ?? {},
-                    cookie: normalized.cookies ?? null
-                };
-            }
-        },
-        {
-            name: 'getItem',
-            httpMethod: HttpMethod.Get,
-            routeName: '/items/:id',
-            routePath: '/items/:id',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: (id, input)=>({
-                    id,
-                    query: isRecord(input) ? input.query ?? {} : {}
-                })
-        },
-        {
-            name: 'patchSchema',
-            httpMethod: HttpMethod.Patch,
-            routeName: '/schema',
-            routePath: '/schema',
-            filename: PARITY_FIXTURE_FILENAME,
-            handler: createSchemaFixtureHandler()
-        }
-    ];
-const createParityBffConfig = ()=>({
-        requestId: PARITY_PRODUCER_REQUEST_ID,
-        crossProjectPolicy: {
-            enabled: true,
-            allowedNamespaces: [
-                PARITY_REQUEST_ID
-            ],
-            allowClientAssertedNamespace: true
-        }
-    });
-const getParityContracts = ()=>buildOperationContractMap({
-        handlers: createParityApiHandlerInfos(),
-        requestId: PARITY_PRODUCER_REQUEST_ID
-    });
-const createAdapterParityScenarios = ()=>{
-    const contracts = getParityContracts();
-    const helloContract = contracts['GET:/hello'];
-    const validEnvelope = envelopeHeader(PARITY_PRODUCER_REQUEST_ID);
-    const validOperationId = helloContract.operationId;
-    const context = {
-        helloContract,
-        validEnvelope,
-        validOperationId
-    };
-    return [
-        ...createEnvelopeParityScenarios(),
-        ...createSchemaParityScenarios(),
-        ...createOperationContextSuccessScenarios(context),
-        ...createCrossProjectDenialScenarios(),
-        ...createOperationContextDenialScenarios(context)
-    ];
-};
-const toParityResult = (res)=>({
-        status: res.status,
-        payload: res.type.includes('json') ? res.body : '' === res.text ? void 0 : res.text
-    });
-const formatValue = (value)=>JSON.stringify(value);
-const assertParityResult = (scenario, res)=>{
-    const result = toParityResult(res);
-    const failures = [];
-    const { expected } = scenario;
-    if (result.status !== expected.status) failures.push(`status: expected ${expected.status}, received ${result.status}`);
-    if ('payload' === expected.kind) {
-        if (formatValue(result.payload) !== formatValue(expected.payload)) failures.push(`payload: expected ${formatValue(expected.payload)}, received ${formatValue(result.payload)}`);
-    } else {
-        const payload = isRecord(result.payload) ? result.payload : {};
-        if ('BFF_CROSS_PROJECT_POLICY_DENIED' !== payload.code) failures.push(`denial code: expected "BFF_CROSS_PROJECT_POLICY_DENIED", received ${formatValue(payload.code)}`);
-        if (payload.reason !== expected.reason) failures.push(`denial reason: expected "${expected.reason}", received ${formatValue(payload.reason)}`);
-        if ('string' != typeof payload.message || 0 === payload.message.length) failures.push(`denial message: expected non-empty string, received ${formatValue(payload.message)}`);
-    }
-    if (failures.length > 0) throw new Error(`Adapter parity scenario "${scenario.name}" failed:\n- ${failures.join('\n- ')}`);
-};
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, assertParityResult, createAdapterParityScenarios, createParityApiHandlerInfos, createParityBffConfig, toParityResult };

package/dist/esm-node/security/crossProjectPolicy.mjs

@@ -1,260 +0,0 @@
-import "node:module";
-const BFF_ENVELOPE_HEADER = 'x-modernjs-bff-envelope';
-const BFF_OPERATION_CONTEXT_HEADER = 'x-operation-id';
-const BFF_OPERATION_CONTEXT_DETAIL_HEADER = 'x-modernjs-bff-operation-context';
-const DEFAULT_DENY_STATUS = 403;
-const NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE = 'cross-project namespace allowlist requires verifyProducerIdentity';
-let hasWarnedAdvisoryNamespaceAllowlist = false;
-const splitRoutePath = (routePath)=>routePath.split('/').filter(Boolean);
-const isDynamicRouteSegment = (segment)=>segment.startsWith(':') || '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-const hasTrailingSlash = (routePath)=>routePath.length > 1 && routePath.endsWith('/');
-const hasUnsafePathEncoding = (requestPath)=>{
-    let decoded = requestPath;
-    for(let depth = 0; depth < 8; depth += 1){
-        if (/%(?:2f|5c)/i.test(decoded)) return true;
-        try {
-            const next = decodeURIComponent(decoded);
-            if (next === decoded) return false;
-            decoded = next;
-        } catch  {
-            return true;
-        }
-    }
-    return decoded.includes('%');
-};
-const routeSegmentsMatch = (templateSegments, requestSegments)=>{
-    let templateIndex = 0;
-    let requestIndex = 0;
-    while(templateIndex < templateSegments.length){
-        const segment = templateSegments[templateIndex];
-        const wildcard = '*' === segment || segment.startsWith('*') || segment.startsWith('{*');
-        const optional = segment.startsWith(':') && segment.endsWith('?');
-        if (templateIndex < templateSegments.length - 1 && (wildcard || optional)) return false;
-        if (wildcard) return true;
-        const requestSegment = requestSegments[requestIndex];
-        if (void 0 === requestSegment) return optional && templateIndex === templateSegments.length - 1;
-        if (!segment.startsWith(':') && segment !== requestSegment) return false;
-        templateIndex += 1;
-        requestIndex += 1;
-    }
-    return requestIndex === requestSegments.length;
-};
-const routeTemplateMatchScore = (routePath, requestPath)=>{
-    if (hasTrailingSlash(routePath) !== hasTrailingSlash(requestPath)) return;
-    const templateSegments = splitRoutePath(routePath);
-    const requestSegments = splitRoutePath(requestPath);
-    for(let prefixLength = 0; prefixLength <= templateSegments.length; prefixLength += 1){
-        const removedPrefix = templateSegments.slice(0, prefixLength);
-        if (removedPrefix.some(isDynamicRouteSegment)) break;
-        const mountedTemplate = templateSegments.slice(prefixLength);
-        if (!routeSegmentsMatch(mountedTemplate, requestSegments)) continue;
-        const literalSegments = mountedTemplate.filter((segment)=>!isDynamicRouteSegment(segment)).length;
-        const dynamicSegments = mountedTemplate.length - literalSegments;
-        return (0 === prefixLength ? 1000000 : 0) + 10000 * literalSegments - 100 * dynamicSegments - prefixLength;
-    }
-};
-const resolveCrossProjectRequestObservation = (request, policy)=>{
-    const requestMethod = String(request.method || '').trim().toUpperCase();
-    const routePaths = [
-        ...new Set(Object.keys(policy.expectedOperationContracts ?? {}).flatMap((key)=>{
-            if (key.startsWith('operation:')) return [];
-            const separator = key.indexOf(':');
-            if (-1 === separator || key.slice(0, separator).trim().toUpperCase() !== requestMethod) return [];
-            return [
-                key.slice(separator + 1)
-            ];
-        }))
-    ];
-    if (0 === routePaths.length) return;
-    if (hasUnsafePathEncoding(request.pathname)) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    const matches = routePaths.flatMap((routePath)=>{
-        const score = routeTemplateMatchScore(routePath, request.pathname);
-        return void 0 === score ? [] : [
-            {
-                routePath,
-                score
-            }
-        ];
-    });
-    if (0 === matches.length) return {
-        method: request.method,
-        routePath: request.pathname
-    };
-    matches.sort((left, right)=>right.score - left.score);
-    return {
-        method: request.method,
-        routePath: matches[1]?.score === matches[0]?.score ? request.pathname : matches[0].routePath
-    };
-};
-const normalizeHeaderName = (headerName, fallback)=>(headerName || fallback).trim().toLowerCase();
-const normalizeStatusCode = (statusCode)=>{
-    if ('number' == typeof statusCode && Number.isFinite(statusCode) && statusCode >= 400 && statusCode <= 599) return Math.floor(statusCode);
-    return DEFAULT_DENY_STATUS;
-};
-const readHeader = (headers, headerName)=>{
-    const lowerHeaderName = headerName.toLowerCase();
-    for (const [name, value] of Object.entries(headers || {}))if (name.toLowerCase() === lowerHeaderName) {
-        if (Array.isArray(value)) return value.length > 0 ? String(value[0]) : void 0;
-        if (null == value) return;
-        return String(value);
-    }
-};
-const extractNamespace = (requestId)=>requestId.split(/[/:.]/)[0]?.trim().toLowerCase();
-const createViolation = (reason, message, status)=>({
-        code: 'BFF_CROSS_PROJECT_POLICY_DENIED',
-        reason,
-        message,
-        status
-    });
-const warnAdvisoryNamespaceAllowlist = ()=>{
-    if (hasWarnedAdvisoryNamespaceAllowlist) return;
-    hasWarnedAdvisoryNamespaceAllowlist = true;
-    console.warn(`[Modern.js BFF] ${NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE}. allowClientAssertedNamespace=true will continue to evaluate allowlist against client-asserted requestId namespaces only.`);
-};
-const createCrossProjectPolicyEvaluationState = (headers, policy, observedRequest)=>({
-        headers,
-        policy,
-        status: normalizeStatusCode(policy.denyStatus),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        allowClientAssertedNamespace: policy.allowClientAssertedNamespace ?? false,
-        verifyProducerIdentity: 'function' == typeof policy.verifyProducerIdentity ? policy.verifyProducerIdentity : void 0,
-        allowedNamespaces: (policy.allowedNamespaces || []).map((item)=>item.trim().toLowerCase()).filter(Boolean),
-        envelopeHeader: normalizeHeaderName(policy.envelopeHeader, BFF_ENVELOPE_HEADER),
-        operationContextHeader: normalizeHeaderName(policy.operationContextHeader, BFF_OPERATION_CONTEXT_HEADER),
-        operationContextDetailHeader: normalizeHeaderName(policy.operationContextDetailHeader, BFF_OPERATION_CONTEXT_DETAIL_HEADER),
-        requestId: '',
-        detailSchemaHash: '',
-        detailOperationVersion: void 0,
-        observedRequest: observedRequest ? {
-            method: String(observedRequest.method || '').trim().toUpperCase(),
-            routePath: String(observedRequest.routePath || '').trim()
-        } : void 0,
-        complete: false
-    });
-const checkNamespaceAllowlistVerifier = (state)=>{
-    if (state.allowedNamespaces.length > 0 && void 0 === state.verifyProducerIdentity) {
-        if (!state.allowClientAssertedNamespace) return createViolation('producer_identity_mismatch', NAMESPACE_ALLOWLIST_REQUIRES_VERIFIER_MESSAGE, state.status);
-        warnAdvisoryNamespaceAllowlist();
-    }
-};
-const checkEnvelopeHeader = (state)=>{
-    const envelopeRaw = readHeader(state.headers, state.envelopeHeader);
-    if (!envelopeRaw) {
-        if (!state.requireEnvelope) {
-            state.complete = true;
-            return;
-        }
-        return createViolation('missing_envelope', `Missing cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    let envelope;
-    try {
-        const parsed = JSON.parse(envelopeRaw);
-        if (!parsed || 'object' != typeof parsed) throw new Error('invalid envelope object');
-        envelope = parsed;
-    } catch (_error) {
-        return createViolation('invalid_envelope', `Invalid cross-project envelope header "${state.envelopeHeader}"`, state.status);
-    }
-    const requestId = String(envelope.requestId || '').trim();
-    if (!requestId) return createViolation('missing_request_id', 'Cross-project envelope does not include a valid requestId', state.status);
-    state.requestId = requestId;
-    state.claimedNamespace = extractNamespace(requestId);
-    state.effectiveNamespace = state.claimedNamespace;
-};
-const checkProducerIdentity = (state)=>{
-    if (!state.verifyProducerIdentity) return;
-    const verifiedNamespaceRaw = state.verifyProducerIdentity(state.headers);
-    const verifiedNamespace = 'string' == typeof verifiedNamespaceRaw ? verifiedNamespaceRaw.trim().toLowerCase() : void 0;
-    if (!verifiedNamespace) return createViolation('producer_identity_mismatch', 'Producer identity could not be verified for request', state.status);
-    if (verifiedNamespace !== state.claimedNamespace) return createViolation('producer_identity_mismatch', `Envelope namespace "${state.claimedNamespace || 'unknown'}" does not match verified producer identity "${verifiedNamespace}"`, state.status);
-    state.effectiveNamespace = verifiedNamespace;
-};
-const checkNamespaceAllowlist = (state)=>{
-    if (state.allowedNamespaces.length > 0) {
-        if (!state.effectiveNamespace || !state.allowedNamespaces.includes(state.effectiveNamespace)) return createViolation('namespace_not_allowed', `Producer namespace "${state.effectiveNamespace || 'unknown'}" not allowed`, state.status);
-    }
-};
-const checkOperationContext = (state)=>{
-    if (!state.requireOperationContext) {
-        state.complete = true;
-        return;
-    }
-    const operationContext = readHeader(state.headers, state.operationContextHeader);
-    if (!operationContext) return createViolation('missing_operation_context', `Missing operation context header "${state.operationContextHeader}"`, state.status);
-    if (!operationContext.startsWith(`${state.requestId}:`)) return createViolation('operation_context_mismatch', `Operation context header "${state.operationContextHeader}" does not match requestId "${state.requestId}"`, state.status);
-    state.operationContext = operationContext;
-};
-const checkOperationContextDetails = (state)=>{
-    const operationContextDetailsRaw = readHeader(state.headers, state.operationContextDetailHeader);
-    if (!operationContextDetailsRaw) {
-        if (state.requireOperationContextDetails) return createViolation('missing_operation_context_details', `Missing operation context details header "${state.operationContextDetailHeader}"`, state.status);
-        state.complete = true;
-        return;
-    }
-    let operationContextDetails;
-    try {
-        const parsed = JSON.parse(operationContextDetailsRaw);
-        if (!parsed || 'object' != typeof parsed || Array.isArray(parsed)) throw new Error('invalid operation context details object');
-        operationContextDetails = parsed;
-    } catch (_error) {
-        return createViolation('invalid_operation_context_details', `Invalid operation context details header "${state.operationContextDetailHeader}"`, state.status);
-    }
-    const detailRequestId = String(operationContextDetails.requestId || '').trim();
-    if (detailRequestId && detailRequestId !== state.requestId) return createViolation('operation_context_details_request_id_mismatch', `Operation context details requestId "${detailRequestId}" does not match envelope requestId "${state.requestId}"`, state.status);
-    const detailOperationId = String(operationContextDetails.operationId || '').trim();
-    if (state.operationContext && detailOperationId && detailOperationId !== state.operationContext) return createViolation('operation_context_mismatch', `Operation context details operationId "${detailOperationId}" does not match operation context "${state.operationContext}"`, state.status);
-    state.operationContextDetails = operationContextDetails;
-    state.detailSchemaHash = String(operationContextDetails.schemaHash || '').trim();
-    if (state.requireOperationSchemaHash && !state.detailSchemaHash) return createViolation('missing_operation_schema_hash', `Operation context details header "${state.operationContextDetailHeader}" must include schemaHash`, state.status);
-    state.detailOperationVersion = operationContextDetails.operationVersion;
-    if (state.requireOperationVersion && 'number' != typeof state.detailOperationVersion) return createViolation('missing_operation_version', `Operation context details header "${state.operationContextDetailHeader}" must include operationVersion`, state.status);
-};
-const checkOperationContract = (state)=>{
-    if (!state.operationContextDetails) return;
-    const expectedContracts = state.policy.expectedOperationContracts;
-    if (expectedContracts && 'object' == typeof expectedContracts) {
-        const method = String(state.operationContextDetails.method || '').toUpperCase();
-        const routePath = String(state.operationContextDetails.routePath || '').trim();
-        const operationId = String(state.operationContextDetails.operationId || '').trim();
-        const observedMethod = state.observedRequest?.method;
-        const observedRoutePath = state.observedRequest?.routePath;
-        if (observedMethod && observedRoutePath && (method !== observedMethod || routePath !== observedRoutePath)) return createViolation('operation_context_mismatch', `Client operation "${operationId || `${method}:${routePath}`}" does not match observed request "${observedMethod}:${observedRoutePath}"`, state.status);
-        const contractMethod = observedMethod || method;
-        const contractRoutePath = observedRoutePath || routePath;
-        const expectedContract = expectedContracts[`${contractMethod}:${contractRoutePath}`] || (state.observedRequest ? void 0 : expectedContracts[`operation:${operationId}`]);
-        if (expectedContract) {
-            const assertedOperationId = operationId || state.operationContext || '';
-            const canonicalRouteOperationId = `${state.requestId}:${contractMethod}:${contractRoutePath}`;
-            if (state.observedRequest && assertedOperationId !== expectedContract.operationId && assertedOperationId !== canonicalRouteOperationId) return createViolation('operation_context_mismatch', `Client operation "${assertedOperationId}" does not identify observed contract "${expectedContract.operationId || canonicalRouteOperationId}"`, state.status);
-            if (expectedContract.schemaHash && state.detailSchemaHash && expectedContract.schemaHash !== state.detailSchemaHash) return createViolation('operation_schema_hash_mismatch', `Operation schema hash mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-            if ('number' == typeof expectedContract.operationVersion && 'number' == typeof state.detailOperationVersion && expectedContract.operationVersion !== state.detailOperationVersion) return createViolation('operation_version_mismatch', `Operation version mismatch for "${operationId || `${method}:${routePath}`}"`, state.status);
-        } else if (!state.allowUnknownOperations) return createViolation('unknown_operation_contract', `No expected operation contract found for operation "${operationId || `${method}:${routePath}`}"`, state.status);
-    }
-};
-const CROSS_PROJECT_POLICY_CHECKS = [
-    checkNamespaceAllowlistVerifier,
-    checkEnvelopeHeader,
-    checkProducerIdentity,
-    checkNamespaceAllowlist,
-    checkOperationContext,
-    checkOperationContextDetails,
-    checkOperationContract
-];
-const evaluateCrossProjectPolicy = (headers, policy, observedRequest)=>{
-    if (!policy?.enabled) return null;
-    const state = createCrossProjectPolicyEvaluationState(headers, policy, observedRequest);
-    for (const check of CROSS_PROJECT_POLICY_CHECKS){
-        const violation = check(state);
-        if (violation) return violation;
-        if (state.complete) break;
-    }
-    return null;
-};
-export { BFF_ENVELOPE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, evaluateCrossProjectPolicy, resolveCrossProjectRequestObservation };