@bleedingdev/modern-js-plugin-bff 3.2.0-ultramodern.98 → 3.4.0-ultramodern.0

package/dist/types/runtime/effect/adapter.d.ts

@@ -1,4 +1,5 @@
 import type { ServerMiddleware, ServerPluginAPI } from '@modern-js/server-core';
+import { type ResolvedCrossProjectPolicy } from '../../utils/crossProjectServerPolicy';
 interface MiddlewareOptions {
     prefix: string;
     enableHandleWeb?: boolean;
@@ -7,12 +8,36 @@ export declare class EffectAdapter {
     api: ServerPluginAPI;
     isEffect: boolean;
     effectMiddleware: ServerMiddleware | null;
+    crossProjectPolicy: ResolvedCrossProjectPolicy | undefined;
     private handler;
     private dispose;
+    private prefix;
+    /**
+     * True when the loaded handler does NOT run the policy seam internally
+     * (plain `handler` exports); the adapter middleware enforces it instead.
+     */
+    private policyEnforcedInMiddleware;
     constructor(api: ServerPluginAPI);
     registerMiddleware: (options: MiddlewareOptions) => Promise<void>;
     onApiHandlersUpdated: () => Promise<void>;
     private resolveEntryFile;
+    private isApiRequestPath;
+    /**
+     * Contract sources for the lambda-lane handlers hosted alongside the
+     * effect entry. Cross-project SDKs generate per-operation contracts for
+     * `api/lambda` handlers with the exact same `ApiRouter` derivation used
+     * here, so the server-side expected-contract map must include them —
+     * otherwise every lambda-lane operation of a hosted producer SDK would be
+     * denied as `unknown_operation_contract`.
+     */
+    private collectLambdaContractSources;
+    /**
+     * Resolves the cross-project policy from the reflected HttpApi endpoints
+     * (plus any hosted lambda-lane handlers) so the expected operation
+     * contracts match the hashes the client generators stamp into generated
+     * SDKs.
+     */
+    private refreshCrossProjectPolicy;
     private loadEffectHandlerFromModule;
     private reloadHandler;
     private disposeCurrentHandler;

package/dist/types/runtime/effect/context.d.ts

@@ -2,4 +2,4 @@ import type { EffectContext } from './operation-context';
 export { type CreateEffectOperationContextOptions, createEffectOperationContext, type EffectContext, } from './operation-context';
 export declare const runWithEffectContext: <T>(context: EffectContext, cb: () => T) => T;
 export declare const useEffectContext: () => EffectContext;
-export declare const useOperationContext: () => OperationContext;
+export declare const useOperationContext: () => import("@modern-js/create-request").OperationContext;

package/dist/types/runtime/effect/endpoint-contracts.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Shared Effect HttpApi endpoint reflection used by BOTH sides of the
+ * cross-project contract:
+ *
+ * - the client generator (`utils/effectClientGenerator`) stamps each
+ *   generated operation with a per-endpoint contract hash;
+ * - the effect server adapter derives the expected operation-contract map
+ *   for the cross-project policy from the same endpoints.
+ *
+ * Keeping route-path normalization and the endpoint -> contract mapping in
+ * one module is what guarantees the two hashes agree.
+ */
+import { type OperationContractSource } from '@modern-js/bff-core';
+export type EffectEndpointMeta = {
+    apiId: string;
+    groupName: string;
+    endpointName: string;
+    method: string;
+    routePath: string;
+};
+export type HttpApiLike = {
+    identifier?: unknown;
+};
+export type HttpApiGroupLike = {
+    identifier?: unknown;
+};
+export type HttpApiEndpointLike = {
+    name?: unknown;
+    method?: unknown;
+    path?: unknown;
+};
+export type HttpApiReflect = (api: unknown, handlers: {
+    /** Group metadata is unused by contract collection; kept as a no-op. */
+    onGroup?: () => void;
+    onEndpoint: (input: {
+        group: HttpApiGroupLike;
+        endpoint: HttpApiEndpointLike;
+    }) => void;
+}) => void;
+export declare function ensureLeadingSlash(pathname: string): string;
+export declare function normalizeEffectPrefix(prefix: string): string;
+export declare function getEffectRoutePath(prefix: string, endpointPath: string): string;
+export declare function resolveEffectApiId(api: HttpApiLike): string;
+export declare function collectEffectEndpoints(reflect: HttpApiReflect, api: HttpApiLike, prefix: string): EffectEndpointMeta[];
+/**
+ * Maps reflected endpoints onto operation-contract sources for
+ * `buildOperationContractMap`/`resolveCrossProjectPolicy`. Effect endpoints
+ * carry no zod metadata, so the contract hash covers the endpoint identity.
+ */
+export declare function toOperationContractSources(endpoints: EffectEndpointMeta[]): OperationContractSource[];
+export declare function createEffectOperationContractSource(endpoint: EffectEndpointMeta): OperationContractSource;
+/**
+ * Extracts the HttpApi instance from a loaded effect entry module. Mirrors
+ * the module shapes accepted by `resolveEffectBffModuleHandler`:
+ * `{ api }`, `{ default: { api } }` and zero-arg default factories.
+ */
+export declare function extractHttpApiFromModule(mod: unknown, isHttpApi: (value: unknown) => boolean): Promise<HttpApiLike | null>;
+/**
+ * Per-endpoint contract hash; MUST stay in sync with the server-side
+ * contract map (it is the same bff-core hash over the same inputs).
+ */
+export declare function createEffectEndpointContractHash(endpoint: EffectEndpointMeta, requestId: string): string;

package/dist/types/runtime/effect/handler.d.ts

@@ -1,8 +1,10 @@
+import type { FileSystem, Path } from 'effect';
+import * as Context from 'effect/Context';
 import type * as EffectType from 'effect/Effect';
 import * as Layer from 'effect/Layer';
+import { Etag, HttpPlatform, HttpRouter } from 'effect/unstable/http';
 import { type HttpApi, type HttpApiClient, type HttpApiGroup } from 'effect/unstable/httpapi';
 import { type Rpc, type RpcGroup } from 'effect/unstable/rpc';
-export * as OpenTelemetry from '@effect/opentelemetry';
 export * as Config from 'effect/Config';
 export * as Effect from 'effect/Effect';
 export * as Layer from 'effect/Layer';
@@ -13,7 +15,8 @@ export { HttpTraceContext } from 'effect/unstable/http';
 export * from 'effect/unstable/httpapi';
 export { HttpApiBuilder } from 'effect/unstable/httpapi';
 export * from 'effect/unstable/rpc';
-export type EffectRuntimeLayer = Layer.Layer<never, unknown, unknown>;
+export type EffectRuntimeRequirements = Etag.Generator | FileSystem.FileSystem | HttpPlatform.HttpPlatform | HttpRouter.HttpRouter | HttpRouter.Request<'Error', any> | HttpRouter.Request<'GlobalError', any> | HttpRouter.Request<'GlobalRequires', any> | HttpRouter.Request<'Requires', any> | Path.Path;
+export type EffectRuntimeLayer = Layer.Layer<never, never, EffectRuntimeRequirements>;
 export type EffectRpcSerialization = 'json' | 'ndjson' | 'jsonRpc' | 'ndJsonRpc' | 'msgPack';
 export type EffectRpcRuntimeLayer<TRpcs extends Rpc.Any = Rpc.Any> = Layer.Layer<Rpc.ToHandler<TRpcs> | Rpc.Middleware<TRpcs> | Rpc.ServicesServer<TRpcs>, unknown, never>;
 export type EffectRpcBffDefinition<TRpcs extends Rpc.Any = Rpc.Any, TRpcLayer extends EffectRpcRuntimeLayer<TRpcs> = EffectRpcRuntimeLayer<TRpcs>> = {
@@ -127,10 +130,39 @@ export type EffectDataPlatformValidationOptions = {
      */
     batch?: EffectDataPlatformBatchOptions;
 };
+/**
+ * Server-seam request validator applied to every HttpApi request — direct,
+ * batched (per item) and rpc. Returning a Response short-circuits the
+ * request; returning `null`/`undefined` lets it through. Used by the effect
+ * adapter to enforce the cross-project policy at one seam so batched items
+ * cannot bypass it.
+ */
+export type EffectRequestValidator = (request: Request) => Response | null | undefined;
+/**
+ * Brand stamped on `createHandler` factories that are guaranteed to forward
+ * `options.validateRequest` into `createHttpApiHandler` — i.e. the policy
+ * seam runs inside the produced handler, including per batched item.
+ *
+ * `defineEffectBff` brands its factory automatically. Hand-written factories
+ * are NOT assumed to honor `validateRequest` (the option is newer than the
+ * factory shape), so the effect adapter falls back to middleware enforcement
+ * for unbranded factories instead of silently skipping the policy. Custom
+ * factories that do forward `validateRequest` into `createHttpApiHandler`
+ * may opt in by setting this symbol property to `true`.
+ *
+ * Registered via `Symbol.for` so independently loaded runtime copies agree.
+ */
+export declare const EFFECT_VALIDATOR_AWARE_FACTORY: symbol;
+/**
+ * True when `factory` is branded as validator-aware (see
+ * {@link EFFECT_VALIDATOR_AWARE_FACTORY}).
+ */
+export declare function isValidatorAwareHandlerFactory(factory: unknown): boolean;
 export type EffectBffHandlerFactory<TApi extends HttpApi.AnyWithProps = HttpApi.AnyWithProps, TLayer extends EffectRuntimeLayer = EffectRuntimeLayer> = (options?: {
     openapi?: EffectBffOpenApiConfig;
     rpc?: Partial<EffectRpcBffHandlerOptions>;
     dataPlatform?: Partial<EffectDataPlatformValidationOptions>;
+    validateRequest?: EffectRequestValidator;
 }) => ReturnType<typeof createHttpApiHandler>;
 export type EffectBffRuntime<TApi extends HttpApi.AnyWithProps = HttpApi.AnyWithProps, TLayer extends EffectRuntimeLayer = EffectRuntimeLayer> = {
     createHandler: EffectBffHandlerFactory<TApi, TLayer>;
@@ -141,7 +173,7 @@ export type EffectBffOpenApiConfig = boolean | {
 };
 export type EffectRpcBffHandlerFactory<TRpcs extends Rpc.Any = Rpc.Any> = (options?: Partial<EffectRpcBffHandlerOptions>) => ReturnType<typeof createRpcApiHandler<TRpcs>>;
 declare function createRpcApiHandler<TRpcs extends Rpc.Any = Rpc.Any>(options: EffectRpcBffDefinition<TRpcs>): {
-    readonly handler: (request: globalThis.Request, context?: import("effect/Context").Context<never> | undefined) => Promise<Response>;
+    readonly handler: (request: globalThis.Request, context?: Context.Context<never> | undefined) => Promise<Response>;
     readonly dispose: () => Promise<void>;
 };
 export declare function defineEffectBff<TApi extends HttpApi.AnyWithProps, TLayer extends EffectRuntimeLayer, TRpcs extends Rpc.Any = Rpc.Any>(definition: {
@@ -164,7 +196,8 @@ export declare function createHttpApiHandler<TApi extends HttpApi.AnyWithProps =
     openapi?: EffectBffOpenApiConfig;
     rpc?: EffectRpcBffDefinition<TRpcs>;
     dataPlatform?: EffectDataPlatformValidationOptions;
+    validateRequest?: EffectRequestValidator;
 }): {
-    handler: (request: Request, context?: Parameters<(request: globalThis.Request, context: import("effect/Context").Context<any>) => Promise<Response>>[1]) => Promise<Response>;
+    handler: (request: Request, context?: Parameters<(request: globalThis.Request, context: Context.Context<any>) => Promise<Response>>[1]) => Promise<Response>;
     dispose: () => Promise<void>;
 };

package/dist/types/runtime/effect/index.d.ts

@@ -1,2 +1,3 @@
+export * as OpenTelemetry from '@effect/opentelemetry';
 export { type CreateEffectOperationContextOptions, createEffectOperationContext, type EffectContext, useEffectContext, useOperationContext, } from './context';
 export * from './handler';

package/dist/types/runtime/effect/module.d.ts

@@ -1,10 +1,11 @@
 import type * as EffectServiceContext from 'effect/Context';
-import { type EffectBffOpenApiConfig, type EffectDataPlatformValidationOptions } from './handler';
+import { type EffectBffOpenApiConfig, type EffectDataPlatformValidationOptions, type EffectRequestValidator } from './handler';
 import type { EffectContext } from './operation-context';
-export type EffectBffRequestHandler = (request: Request, context?: EffectServiceContext.Context<never> | EffectContext) => Promise<Response> | Response;
+export type EffectBffRequestHandler = (request: Request, context?: EffectServiceContext.Context<any> | EffectContext) => Promise<Response> | Response;
 export type EffectBffHandlerFactory = (options?: {
     openapi?: EffectBffOpenApiConfig;
     dataPlatform?: EffectDataPlatformValidationOptions;
+    validateRequest?: EffectRequestValidator;
 }) => {
     handler: EffectBffRequestHandler;
     dispose: () => Promise<void>;
@@ -19,10 +20,29 @@ export type EffectApiModule = {
 export type LoadedEffectBffHandler = {
     handler: EffectBffRequestHandler;
     dispose?: () => Promise<void>;
+    /**
+     * True when the handler is known to apply `validateRequest` internally
+     * (including per batched item): `{ api, layer }` modules resolved through
+     * `createHttpApiHandler`, and `createHandler` factories branded by
+     * `defineEffectBff` (see `EFFECT_VALIDATOR_AWARE_FACTORY`). Plain
+     * `handler` exports and unbranded custom factories leave this unset; the
+     * adapter middleware must enforce the policy itself for those.
+     */
+    appliesRequestValidator?: boolean;
 };
 export type ResolveEffectBffModuleHandlerOptions = {
     openapi?: EffectBffOpenApiConfig;
     dataPlatform?: EffectDataPlatformValidationOptions;
+    /**
+     * Server-seam request validator (cross-project policy). Applied by
+     * `createHttpApiHandler` to direct, batched and rpc requests.
+     *
+     * Note: plain `handler` exports and unbranded custom `createHandler`
+     * factories bypass this seam — the effect adapter enforces the policy in
+     * its middleware for those shapes instead (see
+     * `LoadedEffectBffHandler.appliesRequestValidator`).
+     */
+    validateRequest?: EffectRequestValidator;
     onWarning?: (message: string) => void;
 };
 export declare function resolveEffectBffModuleHandler(mod: EffectApiModule, options?: ResolveEffectBffModuleHandlerOptions): Promise<LoadedEffectBffHandler | null>;

package/dist/types/runtime/effect-client/runtime.d.ts

@@ -0,0 +1,71 @@
+export type GeneratedEffectEndpoint = {
+    apiId: string;
+    group: string;
+    endpoint: string;
+    method: string;
+    routePath: string;
+    /** Per-endpoint operation contract hash (bff-core hash). */
+    schemaHash: string;
+    operationVersion: number;
+};
+export type GeneratedEffectBatchConfig = {
+    enabled: boolean;
+    endpoint: string;
+    flushIntervalMs: number;
+    maxBatchSize: number;
+    maxBatchBytes: number;
+    requestTimeoutMs: number;
+    allowedMethods: string[];
+};
+export type GeneratedEffectClientConfig = {
+    appNamespace: string;
+    /** Cross-project producer id; absent for same-project clients. */
+    requestId?: string;
+    port: number;
+    /** Resolve the port from process.env.PORT first (server bundles). */
+    useEnvPort?: boolean;
+    defaultOrigin: string;
+    httpMethodDecider?: string;
+    batch: GeneratedEffectBatchConfig;
+};
+export type EffectOperationDescriptor = {
+    appNamespace: string;
+    apiId: string;
+    group: string;
+    endpoint: string;
+    operationId: string;
+    routePath: string;
+    method: string;
+    operationVersion: number;
+    schemaHash: string;
+    version: number;
+};
+export type EffectClientOperation = (request?: unknown) => Promise<unknown>;
+export type EffectClientGroup = Record<string, EffectClientOperation>;
+export type EffectClient = Record<string, EffectClientGroup>;
+export type EffectOperationManifest = Record<string, Record<string, EffectOperationDescriptor>>;
+export type EffectRequestContextInput = Record<string, unknown>;
+export type EffectRequestContext = {
+    headers: Record<string, string>;
+} & Record<string, unknown>;
+/** Structural slice of `@modern-js/create-request` the runtime relies on. */
+export type EffectRequestRuntime = {
+    createRequest: (options: {
+        path: string;
+        method: string;
+        port: number | string;
+        operationContext: Record<string, unknown>;
+        httpMethodDecider: string;
+        requestId?: string;
+    }) => (...args: unknown[]) => Promise<unknown>;
+    configure?: (options: Record<string, unknown>) => void;
+    createRequestContextHeaders?: (input: EffectRequestContextInput) => Record<string, string>;
+};
+export type GeneratedEffectClientModule = {
+    client: EffectClient;
+    operationManifest: EffectOperationManifest;
+    createEffectRequestContext: (requestContext: EffectRequestContextInput) => EffectRequestContext;
+};
+export declare const createGeneratedEffectClient: (manifest: {
+    endpoints: GeneratedEffectEndpoint[];
+}, config: GeneratedEffectClientConfig, requestRuntime: EffectRequestRuntime) => GeneratedEffectClientModule;

package/dist/types/runtime/hono/adapter.d.ts

@@ -1,5 +1,6 @@
 import type { MiddlewareHandler, ServerMiddleware, ServerPluginAPI } from '@modern-js/server-core';
 import { Hono } from '@modern-js/server-core';
+import { type ResolvedCrossProjectPolicy } from '../../utils/crossProjectServerPolicy';
 interface MiddlewareOptions {
     prefix: string;
     enableHandleWeb?: boolean;
@@ -9,6 +10,8 @@ export declare class HonoAdapter {
     apiServer: Hono | null;
     api: ServerPluginAPI;
     isHono: boolean;
+    prefix: string;
+    crossProjectPolicy: ResolvedCrossProjectPolicy | undefined;
     constructor(api: ServerPluginAPI);
     setHandlers: () => Promise<void>;
     registerApiRoutes: () => Promise<void>;

package/dist/types/runtime/safe-failure.d.ts

@@ -0,0 +1 @@
+export declare const createSafeFailureResponse: (error: unknown) => Response;

package/dist/types/server.d.ts

@@ -1,3 +1,3 @@
 import type { ServerPlugin } from '@modern-js/server-core';
-declare const _default: () => ServerPlugin;
 export default _default;
+declare function _default(): ServerPlugin;

package/dist/types/utils/createHonoRoutes.d.ts

@@ -3,8 +3,8 @@ import type { Context } from '@modern-js/server-core';
 type Handler = APIHandlerInfo['handler'];
 declare const createHonoRoutes: (handlerInfos?: APIHandlerInfo[]) => {
     method: any;
-    path: APIHandlerInfo;
-    handler: any[] | ((c: Context) => Promise<any>);
+    path: string;
+    handler: any[] | ((c: Context) => Promise<void | Response>);
 }[];
-export declare const createHonoHandler: (handler: Handler) => (c: Context) => Promise<any>;
+export declare const createHonoHandler: (handler: Handler) => (c: Context) => Promise<void | Response>;
 export default createHonoRoutes;

package/dist/types/utils/crossProjectServerPolicy.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Server-side cross-project policy wiring shared by the hono and effect BFF
+ * runtime adapters.
+ *
+ * The generated cross-project SDK force-enables `bff.crossProjectPolicy`
+ * (see `crossProjectApiPlugin`), so producer servers MUST actually evaluate
+ * it: this module resolves the policy once per adapter (deriving the
+ * operation-contract map and the producer operation version from the app's
+ * package.json major) and exposes a request check both adapters call before
+ * dispatching API handlers.
+ *
+ * The envelope/operation-context headers are client-asserted; see the threat
+ * model in `@modern-js/bff-core` `security/crossProjectPolicy.ts`. Operators
+ * who need a real trust boundary must additionally configure
+ * `verifyProducerIdentity` to bind the namespace to a verified channel.
+ */
+import { type OperationContractSource, type ResolvedCrossProjectPolicy } from '@modern-js/bff-core';
+import type { ServerPluginAPI } from '@modern-js/server-core';
+export type { ResolvedCrossProjectPolicy };
+/**
+ * Resolves the effective cross-project policy for a BFF runtime adapter.
+ * Returns `undefined` when no policy is configured and the server is not a
+ * generated cross-project producer (no middleware should be installed).
+ */
+export declare const resolveAdapterCrossProjectPolicy: (api: ServerPluginAPI, handlers: OperationContractSource[]) => ResolvedCrossProjectPolicy | undefined;
+/**
+ * Evaluates the policy against a header record and returns the denial
+ * Response every adapter must send, or `null` when the request passes.
+ */
+export declare const checkCrossProjectPolicyResponse: (headers: Record<string, unknown>, policy: ResolvedCrossProjectPolicy | undefined) => Response | null;
+/**
+ * Adapts the policy check to a WHATWG `Request` (effect lane seam): returns
+ * the denial Response or `null`.
+ */
+export declare const checkCrossProjectPolicyForRequest: (request: Request, policy: ResolvedCrossProjectPolicy | undefined) => Response | null;

package/dist/types/utils/effectClientGenerator.d.ts

@@ -1,4 +1,5 @@
 import type { HttpMethodDecider } from '@modern-js/types';
+import { type EffectEndpointMeta } from '../runtime/effect/endpoint-contracts';
 export type EffectClientCodegenOptions = {
     appDir: string;
     apiDir: string;
@@ -18,10 +19,23 @@ export type EffectClientCodegenOptions = {
         allowedMethods?: string[];
     };
 };
-export declare function renderEffectClientDeclaration(): string;
+export type GeneratedEffectClientArtifacts = {
+    code: string;
+    declaration: string;
+    endpoints: EffectEndpointMeta[];
+};
+export declare function renderEffectClientDeclaration(endpoints?: EffectEndpointMeta[]): string;
+/**
+ * Generates the Effect client module plus its type declaration. The module
+ * body is a thin manifest + one call into
+ * `@modern-js/plugin-bff/effect-client-runtime`; the declaration preserves
+ * the group/endpoint structure of the HttpApi instead of erasing it to
+ * `Record<string, ...>`.
+ */
+export declare function generateEffectClient(options: EffectClientCodegenOptions): Promise<GeneratedEffectClientArtifacts | null>;
 export declare function generateEffectClientCode(options: EffectClientCodegenOptions): Promise<string | null>;
 export declare function resolveEffectEntryFile(options: {
     appDir: string;
     apiDir: string;
     effectEntry?: string;
-}): any;
+}): string | false | undefined;

package/package.json

@@ -17,7 +17,7 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.2.0-ultramodern.98",
+  "version": "3.4.0-ultramodern.0",
   "types": "./dist/types/cli.d.ts",
   "main": "./dist/cjs/cli.js",
   "exports": {
@@ -82,6 +82,15 @@
       },
       "default": "./dist/cjs/runtime/effect-client/index.js"
     },
+    "./effect-client-runtime": {
+      "types": "./dist/types/runtime/effect-client/runtime.d.ts",
+      "modern:source": "./src/runtime/effect-client/runtime.ts",
+      "node": {
+        "import": "./dist/esm-node/runtime/effect-client/runtime.mjs",
+        "require": "./dist/cjs/runtime/effect-client/runtime.js"
+      },
+      "default": "./dist/esm/runtime/effect-client/runtime.mjs"
+    },
     "./data-platform": {
       "types": "./dist/types/runtime/data-platform/index.d.ts",
       "node": {
@@ -121,6 +130,9 @@
       "effect-client": [
         "./dist/types/runtime/effect-client/index.d.ts"
       ],
+      "effect-client-runtime": [
+        "./dist/types/runtime/effect-client/runtime.d.ts"
+      ],
       "data-platform": [
         "./dist/types/runtime/data-platform/index.d.ts"
       ],
@@ -130,43 +142,44 @@
     }
   },
   "dependencies": {
-    "@effect/opentelemetry": "4.0.0-beta.66",
+    "@effect/opentelemetry": "4.0.0-beta.84",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/api-logs": "0.218.0",
-    "@opentelemetry/resources": "2.7.1",
-    "@opentelemetry/sdk-logs": "0.218.0",
-    "@opentelemetry/sdk-metrics": "2.7.1",
-    "@opentelemetry/sdk-trace-base": "2.7.1",
-    "@opentelemetry/sdk-trace-node": "2.7.1",
-    "@opentelemetry/sdk-trace-web": "2.7.1",
+    "@opentelemetry/api-logs": "0.219.0",
+    "@opentelemetry/resources": "2.8.0",
+    "@opentelemetry/sdk-logs": "0.219.0",
+    "@opentelemetry/sdk-metrics": "2.8.0",
+    "@opentelemetry/sdk-trace-base": "2.8.0",
+    "@opentelemetry/sdk-trace-node": "2.8.0",
+    "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
-    "@swc/core": "1.15.40",
+    "@swc/core": "1.15.43",
     "@swc/helpers": "^0.5.23",
-    "effect": "4.0.0-beta.66",
+    "effect": "4.0.0-beta.84",
     "qs": "^6.15.2",
     "type-is": "^2.1.0",
-    "@modern-js/bff-core": "npm:@bleedingdev/modern-js-bff-core@3.2.0-ultramodern.98",
-    "@modern-js/builder": "npm:@bleedingdev/modern-js-builder@3.2.0-ultramodern.98",
-    "@modern-js/create-request": "npm:@bleedingdev/modern-js-create-request@3.2.0-ultramodern.98",
-    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.2.0-ultramodern.98",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.2.0-ultramodern.98",
-    "@modern-js/server-utils": "npm:@bleedingdev/modern-js-server-utils@3.2.0-ultramodern.98"
+    "@modern-js/create-request": "npm:@bleedingdev/modern-js-create-request@3.4.0-ultramodern.0",
+    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.4.0-ultramodern.0",
+    "@modern-js/bff-core": "npm:@bleedingdev/modern-js-bff-core@3.4.0-ultramodern.0",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.4.0-ultramodern.0",
+    "@modern-js/server-utils": "npm:@bleedingdev/modern-js-server-utils@3.4.0-ultramodern.0",
+    "@modern-js/builder": "npm:@bleedingdev/modern-js-builder@3.4.0-ultramodern.0"
   },
   "devDependencies": {
-    "@rsbuild/core": "2.0.7",
-    "@rslib/core": "0.21.5",
-    "@types/node": "^25.9.1",
+    "@rsbuild/core": "2.0.15",
+    "@rslib/core": "0.23.0",
+    "@types/node": "^26.0.0",
     "@types/qs": "^6.15.1",
     "@types/type-is": "^1.6.7",
-    "@typescript/native-preview": "7.0.0-dev.20260527.2",
-    "memfs": "^4.57.2",
+    "@typescript/native-preview": "7.0.0-dev.20260624.1",
+    "memfs": "^4.57.8",
+    "typescript": "^6.0.3",
     "zod": "^4.4.3",
-    "@modern-js/app-tools": "npm:@bleedingdev/modern-js-app-tools@3.2.0-ultramodern.98",
-    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.2.0-ultramodern.98",
-    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.2.0-ultramodern.98",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.2.0-ultramodern.98",
+    "@modern-js/app-tools": "npm:@bleedingdev/modern-js-app-tools@3.4.0-ultramodern.0",
+    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.4.0-ultramodern.0",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.4.0-ultramodern.0",
     "@scripts/rstest-config": "2.66.0",
-    "@modern-js/runtime": "npm:@bleedingdev/modern-js-runtime@3.2.0-ultramodern.98"
+    "@modern-js/bff-runtime": "npm:@bleedingdev/modern-js-bff-runtime@3.4.0-ultramodern.0",
+    "@modern-js/runtime": "npm:@bleedingdev/modern-js-runtime@3.4.0-ultramodern.0"
   },
   "sideEffects": false,
   "publishConfig": {