@bleedingdev/modern-js-bff-core 3.9.0-ultramodern.4 → 3.9.0-ultramodern.6

package/dist/esm-node/security/operationContracts.mjs

@@ -1,130 +0,0 @@
-import "node:module";
-import { createRequire } from "node:module";
-import { createHash } from "crypto";
-import "reflect-metadata";
-import { HttpMetadata } from "../types.mjs";
-import { fileURLToPath as __rspack_fileURLToPath } from "node:url";
-var __rspack_import_meta_filename__ = __rspack_fileURLToPath(import.meta.url);
-const DEFAULT_OPERATION_VERSION = 1;
-const deriveOperationVersion = (packageVersion)=>{
-    if ('string' != typeof packageVersion) return DEFAULT_OPERATION_VERSION;
-    const match = packageVersion.trim().match(/^v?(\d+)\./);
-    if (!match) return DEFAULT_OPERATION_VERSION;
-    const major = Number.parseInt(match[1], 10);
-    return Number.isInteger(major) && major >= 0 ? major : DEFAULT_OPERATION_VERSION;
-};
-const stableStringify = (value)=>{
-    if (Array.isArray(value)) return `[${value.map((item)=>stableStringify(item)).join(',')}]`;
-    if (value && 'object' == typeof value) {
-        const entries = Object.entries(value).filter(([, entryValue])=>void 0 !== entryValue).sort(([a], [b])=>a.localeCompare(b)).map(([key, entryValue])=>`${JSON.stringify(key)}:${stableStringify(entryValue)}`);
-        return `{${entries.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
-};
-const sha256 = (text)=>createHash('sha256').update(text).digest('hex');
-let cachedZodToJSONSchema;
-const ZOD_SPECIFIER = "zod";
-const resolveZodToJSONSchema = ()=>{
-    if (void 0 !== cachedZodToJSONSchema) return cachedZodToJSONSchema;
-    try {
-        const load = createRequire(__rspack_import_meta_filename__);
-        const zod = load(ZOD_SPECIFIER);
-        const candidate = zod?.toJSONSchema ?? zod?.z?.toJSONSchema;
-        cachedZodToJSONSchema = 'function' == typeof candidate ? candidate : null;
-    } catch  {
-        cachedZodToJSONSchema = null;
-    }
-    return cachedZodToJSONSchema;
-};
-const INPUT_SCHEMA_METADATA_KEYS = [
-    HttpMetadata.Data,
-    HttpMetadata.Query,
-    HttpMetadata.Params,
-    HttpMetadata.Headers,
-    HttpMetadata.Files
-];
-const serializeSchema = (schema)=>{
-    const toJSONSchema = resolveZodToJSONSchema();
-    if (toJSONSchema) try {
-        return toJSONSchema(schema, {
-            io: 'input',
-            unrepresentable: 'any'
-        });
-    } catch  {}
-    return {
-        __unserializableSchema: true
-    };
-};
-const serializeOperationSchemas = (handler)=>{
-    if ('function' != typeof handler) return;
-    const serialized = {};
-    for (const metadataKey of INPUT_SCHEMA_METADATA_KEYS){
-        let schema;
-        try {
-            schema = Reflect.getMetadata(metadataKey, handler);
-        } catch  {
-            schema = void 0;
-        }
-        if (null != schema) serialized[metadataKey] = serializeSchema(schema);
-    }
-    return Object.keys(serialized).length > 0 ? serialized : void 0;
-};
-const createOperationContractHash = (operation, requestId)=>sha256(stableStringify({
-        httpMethod: String(operation.httpMethod || '').toUpperCase(),
-        name: operation.name,
-        requestId,
-        routePath: operation.routePath,
-        ...operation.schemas ? {
-            schemas: operation.schemas
-        } : {}
-    }));
-const createOperationEntries = (handlers)=>handlers.map((item)=>({
-            name: item.name,
-            httpMethod: String(item.httpMethod || '').toUpperCase(),
-            routePath: item.routePath
-        })).sort((a, b)=>{
-        const keyA = `${a.routePath}:${a.httpMethod}:${a.name}`;
-        const keyB = `${b.routePath}:${b.httpMethod}:${b.name}`;
-        return keyA.localeCompare(keyB);
-    });
-const createOperationSchemaHash = (operationEntries, requestId)=>sha256(stableStringify({
-        operations: [
-            ...operationEntries
-        ].map((item)=>({
-                hash: item.schemaHash ?? createOperationContractHash({
-                    name: item.name,
-                    httpMethod: item.httpMethod,
-                    routePath: item.routePath
-                }, requestId)
-            })).sort((a, b)=>a.hash.localeCompare(b.hash)),
-        requestId
-    }));
-const buildOperationContractMap = ({ handlers, requestId, operationVersion })=>{
-    const normalizedRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId.trim() : 'default';
-    const normalizedOperationVersion = 'number' == typeof operationVersion && Number.isInteger(operationVersion) ? operationVersion : DEFAULT_OPERATION_VERSION;
-    const contracts = {};
-    handlers.forEach((item)=>{
-        const httpMethod = String(item.httpMethod || '').toUpperCase();
-        const schemaHash = createOperationContractHash({
-            name: item.name,
-            httpMethod,
-            routePath: item.routePath,
-            schemas: serializeOperationSchemas(item.handler)
-        }, normalizedRequestId);
-        const operationId = `${normalizedRequestId}:${item.name}`;
-        const contract = {
-            requestId: normalizedRequestId,
-            operationVersion: normalizedOperationVersion,
-            schemaHash,
-            method: httpMethod,
-            routePath: item.routePath,
-            operationId,
-            handlerName: item.name,
-            filename: item.filename
-        };
-        contracts[`${httpMethod}:${item.routePath}`] = contract;
-        contracts[`operation:${operationId}`] = contract;
-    });
-    return contracts;
-};
-export { DEFAULT_OPERATION_VERSION, buildOperationContractMap, createOperationContractHash, createOperationEntries, createOperationSchemaHash, deriveOperationVersion, serializeOperationSchemas };

package/dist/esm-node/security/resolveCrossProjectPolicy.mjs

@@ -1,28 +0,0 @@
-import "node:module";
-import { buildOperationContractMap } from "./operationContracts.mjs";
-const resolveCrossProjectPolicy = (input)=>{
-    const { crossProjectPolicy, handlers, requestId, isCrossProjectServer, operationVersion } = input;
-    if (!crossProjectPolicy && !isCrossProjectServer) return;
-    const policy = crossProjectPolicy ?? {};
-    const effectiveRequestId = 'string' == typeof requestId && requestId.trim().length > 0 ? requestId : 'default';
-    const generatedContracts = buildOperationContractMap({
-        handlers,
-        requestId: effectiveRequestId,
-        operationVersion
-    });
-    return {
-        ...policy,
-        enabled: policy.enabled ?? Boolean(isCrossProjectServer),
-        requireEnvelope: policy.requireEnvelope ?? true,
-        requireOperationContext: policy.requireOperationContext ?? true,
-        requireOperationContextDetails: policy.requireOperationContextDetails ?? true,
-        requireOperationSchemaHash: policy.requireOperationSchemaHash ?? true,
-        requireOperationVersion: policy.requireOperationVersion ?? true,
-        allowUnknownOperations: policy.allowUnknownOperations ?? false,
-        expectedOperationContracts: {
-            ...policy.expectedOperationContracts ?? {},
-            ...generatedContracts
-        }
-    };
-};
-export { resolveCrossProjectPolicy };

package/dist/types/adapter-kit/index.d.ts

@@ -1,90 +0,0 @@
-import 'reflect-metadata';
-import type { ResponseMeta } from '../operators/http.js';
-import type { APIHandlerInfo, ApiHandler } from '../router/index.js';
-import { type CrossProjectPolicyConfig, type CrossProjectPolicyViolation } from '../security/crossProjectPolicy.js';
-import { HttpMethod } from '../types.js';
-/** Lowercase route-registration method shared by supported adapter routers. */
-export type ApiRouteMethod = Lowercase<`${HttpMethod}`>;
-/**
- * Maps an `APIHandlerInfo.httpMethod` onto the lowercase router method.
- * Unknown methods fail fast with a descriptive error instead of the
- * `app[method] is not a function` TypeError the adapters used to throw.
- */
-export declare const toApiRouteMethod: (httpMethod: APIHandlerInfo['httpMethod']) => ApiRouteMethod;
-/** Route middlewares attached by BFF operators via reflect metadata. */
-export declare const getRouteMiddlewares: <Middleware = unknown>(handler: ApiHandler) => Middleware[];
-export type ApiRoutePlanEntry<Middleware = unknown> = {
-    method: ApiRouteMethod;
-    routePath: string;
-    handler: ApiHandler;
-    middlewares: Middleware[];
-};
-/**
- * Computes the framework-agnostic registration plan for a set of API
- * handlers: registration order, lowercase route method and operator
- * middlewares. Adapters only translate each entry into framework calls.
- */
-export declare const planApiRoutes: <Middleware = unknown>(handlerInfos: APIHandlerInfo[]) => ApiRoutePlanEntry<Middleware>[];
-/**
- * Marker used by `@modern-js/bff-runtime` schema handlers. Re-declared here
- * (value-compatible) so adapters do not need a runtime dependency on
- * `@modern-js/bff-runtime` just to detect the handler mode.
- */
-export declare const HANDLER_WITH_SCHEMA = "HANDLER_WITH_SCHEMA";
-export declare const isSchemaApiHandler: (handler: unknown) => boolean;
-export type ApiHandlerMode = 'meta' | 'schema' | 'inputParamsDecider' | 'plain';
-/**
- * Detects how an API handler expects to be invoked. The probe order (meta →
- * schema → input-params-decider → plain) is shared by every adapter.
- *
- * Adapters call this once at route-registration time, not per request:
- * meta/schema markers are attached by decorators at module load, so a handler
- * marked after registration would not be picked up.
- */
-export declare const getApiHandlerMode: (handler: ApiHandler) => ApiHandlerMode;
-/** Result envelope produced by `@modern-js/bff-runtime` schema handlers. */
-export type SchemaHandlerResult = {
-    type: 'HandleSuccess';
-    value: unknown;
-} | {
-    type: 'InputValidationError' | 'OutputValidationError';
-    message: unknown;
-};
-export type SchemaHandlerHttpOutcome = {
-    success: boolean;
-    status: number;
-    body: unknown;
-};
-/**
- * Maps a schema-handler result onto the HTTP outcome both adapters must
- * produce: 200/value on success, 400/message on input validation errors and
- * 500/message for any other failure.
- */
-export declare const mapSchemaHandlerResult: (result: SchemaHandlerResult) => SchemaHandlerHttpOutcome;
-/**
- * Reads the response metadata (headers/redirect/status) attached to a meta
- * handler. Returns an empty list when no metadata is present so adapters can
- * iterate unconditionally.
- */
-export declare const getResponseMetaList: (handler: ApiHandler) => ResponseMeta[];
-export type ApiHandlerInput = {
-    params: Record<string, unknown>;
-} & Record<string, unknown>;
-/**
- * Positional invocation convention for plain function handlers: route params
- * in declaration order followed by the full input object.
- */
-export declare const buildPositionalHandlerArgs: (input: ApiHandlerInput, routePath?: string) => unknown[];
-export type CrossProjectPolicyDenial = {
-    status: number;
-    body: {
-        code: CrossProjectPolicyViolation['code'];
-        reason: CrossProjectPolicyViolation['reason'];
-        message: string;
-    };
-};
-/**
- * Evaluates the cross-project policy for a request and, on violation,
- * returns the exact HTTP status and JSON body every adapter must send.
- */
-export declare const checkCrossProjectPolicy: (headers: Record<string, unknown>, policy: CrossProjectPolicyConfig | undefined) => CrossProjectPolicyDenial | null;

package/dist/types/adapter-kit/parity-scenarios/cross-project-denial.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createCrossProjectDenialScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/envelope.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createEnvelopeParityScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/operation-context.d.ts

@@ -1,3 +0,0 @@
-import type { AdapterParityScenario, AdapterParityScenarioContext } from './shared.js';
-export declare const createOperationContextSuccessScenarios: ({ helloContract, validEnvelope, validOperationId, }: AdapterParityScenarioContext) => AdapterParityScenario[];
-export declare const createOperationContextDenialScenarios: ({ helloContract, validEnvelope, validOperationId, }: AdapterParityScenarioContext) => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/schema.d.ts

@@ -1,2 +0,0 @@
-import type { AdapterParityScenario } from './shared.js';
-export declare const createSchemaParityScenarios: () => AdapterParityScenario[];

package/dist/types/adapter-kit/parity-scenarios/shared.d.ts

@@ -1,32 +0,0 @@
-import type { CrossProjectOperationContract, CrossProjectPolicyViolationReason } from '../../security/crossProjectPolicy.js';
-export declare const PARITY_REQUEST_ID = "crm";
-export declare const PARITY_PRODUCER_REQUEST_ID = "crm.producer-a";
-export type ParityExpectation = {
-    kind: 'payload';
-    status: number;
-    payload: unknown;
-} | {
-    kind: 'denied';
-    status: number;
-    reason: CrossProjectPolicyViolationReason;
-};
-export type AdapterParityScenario = {
-    name: string;
-    /** Run against policy-enabled server instead of the open one. */
-    policy: boolean;
-    request: {
-        method: 'get' | 'post' | 'patch';
-        path: string;
-        headers?: Record<string, string>;
-        body?: unknown;
-    };
-    expected: ParityExpectation;
-};
-export type AdapterParityScenarioContext = {
-    helloContract: CrossProjectOperationContract;
-    validEnvelope: string;
-    validOperationId: string;
-};
-export declare const envelopeHeader: (requestId: unknown) => string;
-export declare const detailHeader: (details: Record<string, unknown>) => string;
-export declare const deniedScenario: (name: string, reason: CrossProjectPolicyViolationReason, headers: Record<string, string>) => AdapterParityScenario;

package/dist/types/adapter-kit/parity.d.ts

@@ -1,43 +0,0 @@
-import type { APIHandlerInfo } from '../router/index.js';
-import type { AdapterParityScenario } from './parity-scenarios/shared.js';
-export type { AdapterParityScenario, ParityExpectation, } from './parity-scenarios/shared.js';
-export { PARITY_PRODUCER_REQUEST_ID, PARITY_REQUEST_ID, } from './parity-scenarios/shared.js';
-/**
- * Handler fixtures registered in both adapters before running the table.
- */
-export declare const createParityApiHandlerInfos: () => APIHandlerInfo[];
-/**
- * `bff` config slice for policy-enabled parity server. All `require*`
- * switches stay at strict defaults.
- */
-export declare const createParityBffConfig: () => {
-    requestId: string;
-    crossProjectPolicy: {
-        enabled: boolean;
-        allowedNamespaces: string[];
-        allowClientAssertedNamespace: boolean;
-    };
-};
-export declare const createAdapterParityScenarios: () => AdapterParityScenario[];
-/** Structural slice of supertest response used for normalization. */
-export type ParityHttpResponse = {
-    status: number;
-    /** Content-type mime, e.g. `application/json`. */
-    type: string;
-    body: unknown;
-    text: string;
-};
-type AdapterParityResult = {
-    status: number;
-    payload: unknown;
-};
-/**
- * Normalizes raw HTTP response into an observable payload value so JSON and
- * text encodings of the same scalar compare equal.
- */
-export declare const toParityResult: (res: ParityHttpResponse) => AdapterParityResult;
-/**
- * Framework-agnostic assertion: throws a descriptive error when adapter
- * response deviates from the scenario expectation.
- */
-export declare const assertParityResult: (scenario: AdapterParityScenario, res: ParityHttpResponse) => void;

package/dist/types/security/crossProjectPolicy.d.ts

@@ -1,110 +0,0 @@
-/**
- * Cross-project BFF policy evaluator.
- *
- * THREAT MODEL — read before relying on this module:
- *
- * Every header this evaluator inspects (envelope, operation id, operation
- * context details) is constructed by the CLIENT from public, open-source
- * formats. Without an out-of-band identity binding the checks below are a
- * version-skew and misconfiguration gate, not an authentication or
- * authorization boundary: any caller can echo an allowed `requestId` and a
- * matching operation context.
- *
- * To use `allowedNamespaces`, supply
- * {@link CrossProjectPolicyConfig.verifyProducerIdentity}: a server-side
- * hook that derives the producer namespace from a VERIFIED channel (mTLS
- * peer identity, gateway-authenticated JWT claims, service-mesh headers
- * stripped at the edge, ...). Requests fail closed when a namespace allowlist
- * is configured without this hook unless `allowClientAssertedNamespace` is
- * explicitly enabled. That escape hatch keeps legacy local/demo ergonomics:
- * the client-asserted namespace must match the allowlist. When the hook is
- * present, the client-asserted namespace must match the verified namespace
- * and the allowlist is checked against the verified value.
- *
- * Client-side counterparts in `@modern-js/create-request` (identity binding,
- * operation contract validation) are developer-experience aids that fail
- * fast in well-behaved clients; they protect nothing against a malicious
- * caller.
- */
-export declare const BFF_ENVELOPE_HEADER = "x-modernjs-bff-envelope";
-export declare const BFF_OPERATION_CONTEXT_HEADER = "x-operation-id";
-export declare const BFF_OPERATION_CONTEXT_DETAIL_HEADER = "x-modernjs-bff-operation-context";
-export type CrossProjectOperationContract = {
-    schemaHash?: string;
-    operationVersion?: number;
-    operationId?: string;
-};
-/**
- * Request facts observed by the server adapter rather than asserted by the
- * client. `routePath` is the matched route template when the router exposes
- * one (for example `/api/customers/:id`), not the client-provided detail.
- */
-export type CrossProjectRequestObservation = {
-    method: string;
-    routePath: string;
-};
-export type CrossProjectRequestTarget = {
-    method: string;
-    pathname: string;
-};
-export type CrossProjectPolicyViolationReason = 'missing_envelope' | 'invalid_envelope' | 'missing_request_id' | 'namespace_not_allowed' | 'missing_operation_context' | 'operation_context_mismatch' | 'missing_operation_context_details' | 'invalid_operation_context_details' | 'operation_context_details_request_id_mismatch' | 'missing_operation_schema_hash' | 'missing_operation_version' | 'unknown_operation_contract' | 'operation_schema_hash_mismatch' | 'operation_version_mismatch' | 'producer_identity_mismatch';
-export type CrossProjectPolicyViolation = {
-    code: 'BFF_CROSS_PROJECT_POLICY_DENIED';
-    reason: CrossProjectPolicyViolationReason;
-    message: string;
-    status: number;
-};
-export interface CrossProjectPolicyConfig {
-    enabled?: boolean;
-    requireEnvelope?: boolean;
-    requireOperationContext?: boolean;
-    requireOperationContextDetails?: boolean;
-    requireOperationSchemaHash?: boolean;
-    requireOperationVersion?: boolean;
-    allowedNamespaces?: string[];
-    /**
-     * Explicit local/demo escape hatch for legacy clients that only provide
-     * client-built requestId namespaces. Defaults to false. Enabling this keeps
-     * `allowedNamespaces` advisory and must not be used as authorization.
-     */
-    allowClientAssertedNamespace?: boolean;
-    envelopeHeader?: string;
-    operationContextHeader?: string;
-    operationContextDetailHeader?: string;
-    expectedOperationContracts?: Record<string, CrossProjectOperationContract>;
-    allowUnknownOperations?: boolean;
-    denyStatus?: number;
-    /**
-     * Server-side hook binding producer namespace to VERIFIED identity
-     * channel (mTLS peer, gateway-authenticated JWT, mesh identity headers).
-     *
-     * When provided, the namespace asserted by the client envelope must match
-     * the namespace returned by this hook, and `allowedNamespaces` is checked
-     * against the verified value instead of the client-asserted one. Returning
-     * `undefined` (identity could not be verified) denies the request.
-     *
-     * By default, `allowedNamespaces` requires this hook and fails closed
-     * without it. Set `allowClientAssertedNamespace` only for local/demo
-     * ergonomics where advisory client-asserted namespace checks are acceptable.
-     */
-    verifyProducerIdentity?: (headers: Record<string, unknown>) => string | undefined;
-}
-/** Serializable, fully-defaulted policy accepted by edge dispatchers. */
-export type NormalizedCrossProjectPolicy = CrossProjectPolicyConfig & {
-    enabled: boolean;
-    requireEnvelope: boolean;
-    requireOperationContext: boolean;
-    requireOperationContextDetails: boolean;
-    requireOperationSchemaHash: boolean;
-    requireOperationVersion: boolean;
-    allowUnknownOperations: boolean;
-    expectedOperationContracts: Record<string, CrossProjectOperationContract>;
-};
-/**
- * Resolves a concrete adapter request to the server-owned route template in
- * the operation contract map. Effect receives requests after its BFF mount
- * prefix has been stripped, so leading literal route segments may be mount
- * prefixes. Ambiguous matches fail closed by retaining the concrete path.
- */
-export declare const resolveCrossProjectRequestObservation: (request: CrossProjectRequestTarget, policy: Pick<CrossProjectPolicyConfig, 'expectedOperationContracts'>) => CrossProjectRequestObservation | undefined;
-export declare const evaluateCrossProjectPolicy: (headers: Record<string, unknown>, policy?: CrossProjectPolicyConfig, observedRequest?: CrossProjectRequestObservation) => CrossProjectPolicyViolation | null;

package/dist/types/security/operationContracts.d.ts

@@ -1,84 +0,0 @@
-import 'reflect-metadata';
-import type { ApiHandler } from '../router/types.js';
-export type OperationContractEntry = {
-    name: string;
-    httpMethod: string;
-    routePath: string;
-};
-export type OperationContractDefinition = {
-    requestId: string;
-    operationVersion: number;
-    schemaHash: string;
-    method: string;
-    routePath: string;
-    operationId: string;
-    handlerName: string;
-    filename?: string;
-};
-export type OperationContractMap = Record<string, OperationContractDefinition>;
-export declare const DEFAULT_OPERATION_VERSION = 1;
-/**
- * Derives the operation version from a producer package version: the semver
- * major is the contract version, so consumers regenerated against an older
- * producer major fail the `operation_version_mismatch` gate instead of
- * silently calling an incompatible API.
- *
- * Falls back to {@link DEFAULT_OPERATION_VERSION} when no parseable version
- * is available.
- */
-export declare const deriveOperationVersion: (packageVersion?: unknown) => number;
-/**
- * Serializes the zod input schemas attached to an operator-decorated handler
- * (`Data`/`Query`/`Params`/`Headers`/`Upload` metadata) into JSON-schema
- * documents. Returns `undefined` for handlers without schema metadata
- * (plain handlers, farrow schema-mode handlers).
- */
-export declare const serializeOperationSchemas: (handler: ApiHandler | undefined) => Record<string, unknown> | undefined;
-export type OperationContractHashInput = OperationContractEntry & {
-    /** Serialized schema documents; omit for schema-less operations. */
-    schemas?: Record<string, unknown> | undefined;
-};
-/**
- * Per-operation contract hash. The hash covers the operation identity
- * (name, method, route, producer requestId) plus the serialized input
- * schemas, so:
- *
- * - changing an input schema changes the hash of exactly that operation;
- * - reordering routes or adding unrelated operations never rotates the hash
- *   of other operations (each operation is hashed independently).
- */
-export declare const createOperationContractHash: (operation: OperationContractHashInput, requestId: string) => string;
-export declare const createOperationEntries: (handlers: Array<{
-    name: string;
-    httpMethod: string;
-    routePath: string;
-}>) => OperationContractEntry[];
-/**
- * Aggregate hash over a set of per-operation contract hashes. Used for the
- * module-level `operationSchemaHash` manifest export; stable across route
- * reordering because the per-operation hashes are sorted before hashing.
- */
-export declare const createOperationSchemaHash: (operationEntries: Array<OperationContractEntry & {
-    schemaHash?: string;
-}>, requestId: string) => string;
-export type OperationContractSource = {
-    name: string;
-    httpMethod: string;
-    routePath: string;
-    filename?: string;
-    /**
-     * Optional handler function used to serialize schema metadata. Sources
-     * without a handler (e.g. reflected Effect HttpApi endpoints) hash the
-     * route identity only.
-     */
-    handler?: ApiHandler;
-};
-export declare const buildOperationContractMap: ({ handlers, requestId, operationVersion, }: {
-    handlers: OperationContractSource[];
-    requestId?: string;
-    /**
-     * Producer contract version, usually `deriveOperationVersion(pkg.version)`.
-     * Defaults to {@link DEFAULT_OPERATION_VERSION}.
-     */
-    operationVersion?: number;
-}) => OperationContractMap;

package/dist/types/security/resolveCrossProjectPolicy.d.ts

@@ -1,39 +0,0 @@
-import type { CrossProjectPolicyConfig, NormalizedCrossProjectPolicy } from './crossProjectPolicy.js';
-import { type OperationContractSource } from './operationContracts.js';
-/**
- * Runtime input collected by BFF server adapters (hono/effect/...) before
- * the cross-project policy can be enforced.
- *
- * `crossProjectPolicy` accepts the raw `bff.crossProjectPolicy` user config —
- * `BffCrossProjectPolicyUserConfig` is a structural subset of
- * `CrossProjectPolicyConfig`, so no casts are required at the call site.
- */
-export interface ResolveCrossProjectPolicyInput {
-    crossProjectPolicy?: CrossProjectPolicyConfig;
-    /** Registered API handlers used to derive the operation-contract map. */
-    handlers: OperationContractSource[];
-    /** Logical producer ID (`bff.requestId`). */
-    requestId?: string;
-    /** Marker injected by generated cross-project SDK plugins. */
-    isCrossProjectServer?: boolean;
-    /**
-     * Producer contract version (usually derived from the producer
-     * package.json major via `deriveOperationVersion`).
-     */
-    operationVersion?: number;
-}
-/**
- * Fully-defaulted policy returned by {@link resolveCrossProjectPolicy}.
- */
-export type ResolvedCrossProjectPolicy = NormalizedCrossProjectPolicy;
-/**
- * Normalizes the user-facing cross-project policy config into the evaluator
- * input shared by every BFF server adapter:
- *
- * - returns `undefined` when neither a policy nor the cross-project server
- *   marker is present (policy middleware must not be installed);
- * - applies the documented defaults for all `require*` switches;
- * - merges generated operation contracts (derived from the registered
- *   handlers) over any user-provided `expectedOperationContracts`.
- */
-export declare const resolveCrossProjectPolicy: (input: ResolveCrossProjectPolicyInput) => ResolvedCrossProjectPolicy | undefined;