@bleedingdev/modern-js-plugin-bff 3.2.0-ultramodern.99 → 3.4.0-ultramodern.0

package/dist/cjs/utils/pluginGenerator.js

@@ -10,11 +10,15 @@ var __webpack_require__ = {};
     };
 })();
 (()=>{
-    __webpack_require__.d = (exports1, definition)=>{
-        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-            enumerable: true,
-            get: definition[key]
-        });
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
     };
 })();
 (()=>{

package/dist/cjs/utils/runtimeGenerator.js

@@ -10,11 +10,15 @@ var __webpack_require__ = {};
     };
 })();
 (()=>{
-    __webpack_require__.d = (exports1, definition)=>{
-        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
-            enumerable: true,
-            get: definition[key]
-        });
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
     };
 })();
 (()=>{

package/dist/esm/runtime/data-platform/index.mjs

@@ -1,3 +1,4 @@
+import { parseTraceparent } from "@modern-js/create-request";
 import { trace as api_trace } from "@opentelemetry/api";
 const DATA_BATCH_TRANSPORT_OTEL_EVENT = 'modernjs.data.batch';
 function createDataBatchTransportTelemetryAttributes(event) {
@@ -23,7 +24,6 @@ function emitDataBatchTransportEvent(onEvent, event) {
 const DEFAULT_DATA_ENVELOPE_HEADER = 'x-modernjs-data-envelope';
 const DEFAULT_DATA_BATCH_ENDPOINT = '/_data/batch';
 const DEFAULT_DATA_BATCH_HEADER = 'x-modernjs-data-batch';
-const TRACEPARENT_REGEX = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/i;
 function isPlainObject(value) {
     if ('object' != typeof value || null === value || Array.isArray(value)) return false;
     const proto = Object.getPrototypeOf(value);
@@ -120,18 +120,7 @@ function isValidHex(value, length) {
     return value.length === length && /^[0-9a-f]+$/.test(value);
 }
 function parseTraceparentHeader(header) {
-    const match = header.trim().match(TRACEPARENT_REGEX);
-    if (!match) return null;
-    const traceId = match[1].toLowerCase();
-    const spanId = match[2].toLowerCase();
-    const flags = match[3].toLowerCase();
-    if (isAllZeroHex(traceId) || isAllZeroHex(spanId)) return null;
-    const sampled = (0x1 & Number.parseInt(flags, 16)) === 1;
-    return {
-        traceId,
-        spanId,
-        sampled
-    };
+    return parseTraceparent(header) ?? null;
 }
 function formatTraceparentHeader(trace) {
     const traceId = trace.traceId.toLowerCase();

package/dist/esm/runtime/effect/adapter.mjs

@@ -1,6 +1,11 @@
+import { ApiRouter } from "@modern-js/bff-core";
 import { API_DIR, compatibleRequire, findExists, fs, isProd, logger } from "@modern-js/utils";
+import { HttpApi } from "effect/unstable/httpapi";
 import path from "path";
+import { checkCrossProjectPolicyForRequest, resolveAdapterCrossProjectPolicy } from "../../utils/crossProjectServerPolicy.mjs";
+import { createSafeFailureResponse } from "../safe-failure.mjs";
 import { createEffectOperationContext, runWithEffectContext } from "./context.mjs";
+import { collectEffectEndpoints, extractHttpApiFromModule, toOperationContractSources } from "./endpoint-contracts.mjs";
 import { resolveEffectBffModuleHandler } from "./module.mjs";
 const before = [
     'custom-server-hook',
@@ -46,10 +51,73 @@ class EffectAdapter {
         const entryWithoutExt = configuredEntry ? path.isAbsolute(configuredEntry) ? configuredEntry : path.resolve(appDirectory || process.cwd(), configuredEntry) : defaultEntry;
         return findExists(JS_OR_TS_EXTS.map((ext)=>`${entryWithoutExt}${ext}`));
     }
+    isApiRequestPath(requestPath, prefix, enableHandleWeb) {
+        if (!enableHandleWeb) return true;
+        const normalized = normalizePrefix(prefix);
+        if (!normalized) return true;
+        return requestPath === normalized || requestPath.startsWith(`${normalized}/`);
+    }
+    async collectLambdaContractSources() {
+        try {
+            const serverContext = this.api.getServerContext();
+            const appDir = serverContext.distDirectory || serverContext.appDirectory;
+            if (!appDir) return [];
+            const apiDir = 'string' == typeof serverContext.apiDirectory ? serverContext.apiDirectory : path.resolve(appDir, API_DIR);
+            const lambdaDir = 'string' == typeof serverContext.lambdaDirectory ? serverContext.lambdaDirectory : path.join(apiDir, 'lambda');
+            if (!await fs.pathExists(lambdaDir)) return [];
+            const apiRouter = new ApiRouter({
+                appDir,
+                apiDir,
+                lambdaDir,
+                prefix: this.prefix,
+                httpMethodDecider: this.api.getServerConfig()?.bff?.httpMethodDecider
+            });
+            const handlerInfos = await apiRouter.getApiHandlers();
+            return handlerInfos.map((info)=>({
+                    name: info.name,
+                    httpMethod: info.httpMethod,
+                    routePath: info.routePath,
+                    filename: info.filename,
+                    handler: info.handler
+                }));
+        } catch (error) {
+            logger.warn(`[BFF][Effect] Failed to derive lambda operation contracts for the cross-project policy: ${String(error)}`);
+            return [];
+        }
+    }
+    async refreshCrossProjectPolicy(mod) {
+        let contractSources = [];
+        if (mod) try {
+            const api = await extractHttpApiFromModule(mod, HttpApi.isHttpApi);
+            if (api) {
+                const reflect = (apiValue, handlers)=>HttpApi.reflect(apiValue, {
+                        onGroup: handlers.onGroup ?? (()=>{}),
+                        onEndpoint: handlers.onEndpoint
+                    });
+                contractSources = toOperationContractSources(collectEffectEndpoints(reflect, api, this.prefix));
+            }
+        } catch (error) {
+            logger.warn(`[BFF][Effect] Failed to reflect HttpApi endpoints for the cross-project policy: ${String(error)}`);
+        }
+        let policy = resolveAdapterCrossProjectPolicy(this.api, contractSources);
+        if (policy?.enabled) {
+            const lambdaSources = await this.collectLambdaContractSources();
+            if (lambdaSources.length > 0) {
+                contractSources = [
+                    ...contractSources,
+                    ...lambdaSources
+                ];
+                policy = resolveAdapterCrossProjectPolicy(this.api, contractSources);
+            }
+        }
+        this.crossProjectPolicy = policy;
+        if (this.crossProjectPolicy?.enabled && 0 === contractSources.length) logger.warn('[BFF][Effect] Cross-project policy is enabled but no HttpApi endpoints could be reflected; operation-contract matching is disabled for this server (envelope and operation-context checks still apply).');
+    }
     async loadEffectHandlerFromModule(mod) {
         return resolveEffectBffModuleHandler(mod, {
             openapi: this.api.getServerConfig()?.bff?.effect?.openapi,
             dataPlatform: this.api.getServerConfig()?.bff?.effect?.dataPlatform,
+            validateRequest: (request)=>checkCrossProjectPolicyForRequest(request, this.crossProjectPolicy),
             onWarning: (message)=>{
                 logger.warn(message);
             }
@@ -79,6 +147,7 @@ class EffectAdapter {
             this.handler = null;
             return;
         }
+        await this.refreshCrossProjectPolicy(mod);
         const loaded = await this.loadEffectHandlerFromModule(mod);
         if (!loaded) {
             logger.warn(`[BFF][Effect] Invalid Effect entry module: ${entryFile}. Export { api, layer } or handler.`);
@@ -87,6 +156,7 @@ class EffectAdapter {
         }
         this.handler = loaded.handler;
         this.dispose = loaded.dispose || null;
+        this.policyEnforcedInMiddleware = !loaded.appliesRequestValidator;
     }
     async disposeCurrentHandler() {
         if (!this.dispose) return;
@@ -110,15 +180,7 @@ class EffectAdapter {
         } catch (configError) {
             logger.error(`Error in serverConfig.onError handler: ${configError}`);
         }
-        const status = 'object' == typeof error && null !== error && 'status' in error && 'number' == typeof error.status ? error.status : 500;
-        return new Response(JSON.stringify({
-            message: error instanceof Error ? error.message : '[BFF] Internal Server Error'
-        }), {
-            status,
-            headers: {
-                'content-type': 'application/json; charset=utf-8'
-            }
-        });
+        return createSafeFailureResponse(error);
     }
     ensureJsonContext(c) {
         const maybeJsonContext = c;
@@ -145,6 +207,8 @@ class EffectAdapter {
         this.effectMiddleware = null;
         this.handler = null;
         this.dispose = null;
+        this.prefix = '/api';
+        this.policyEnforcedInMiddleware = false;
         this.registerMiddleware = async (options)=>{
             const { prefix, enableHandleWeb } = options;
             const { bffRuntimeFramework, middlewares: globalMiddlewares } = this.api.getServerContext();
@@ -152,6 +216,7 @@ class EffectAdapter {
                 this.isEffect = false;
                 return;
             }
+            this.prefix = prefix || this.prefix;
             await this.reloadHandler();
             this.effectMiddleware = {
                 name: 'effect-bff-handler',
@@ -164,6 +229,10 @@ class EffectAdapter {
                         if (enableHandleWeb) return void await next();
                         return this.handleRuntimeError(new Error('[BFF][Effect] Missing Effect entry. Define api/effect/index or configure bff.effect.entry.'), c);
                     }
+                    if (this.crossProjectPolicy?.enabled && this.policyEnforcedInMiddleware && this.isApiRequestPath(c.req.path, prefix, enableHandleWeb)) {
+                        const denial = checkCrossProjectPolicyForRequest(c.req.raw, this.crossProjectPolicy);
+                        if (denial) return denial;
+                    }
                     let response;
                     try {
                         const effectRequest = createRequestForMountedPrefix(c.req.raw, prefix);

package/dist/esm/runtime/effect/edge.mjs

@@ -1,3 +1,4 @@
+import { createSafeFailureResponse } from "../safe-failure.mjs";
 import { resolveEffectBffModuleHandler } from "./module.mjs";
 import { createEffectOperationContext } from "./operation-context.mjs";
 export * from "./handler.mjs";
@@ -39,15 +40,7 @@ function createEdgeEffectContext(originalRequest, effectRequest, options) {
     };
 }
 function createRuntimeErrorResponse(error) {
-    const status = 'object' == typeof error && null !== error && 'status' in error && 'number' == typeof error.status ? error.status : 500;
-    return new Response(JSON.stringify({
-        message: error instanceof Error ? error.message : '[BFF] Internal Server Error'
-    }), {
-        status,
-        headers: {
-            'content-type': 'application/json; charset=utf-8'
-        }
-    });
+    return createSafeFailureResponse(error);
 }
 async function dispatchEffectBffRequest(handler, request, options = {}) {
     const requestPathname = new URL(request.url).pathname;

package/dist/esm/runtime/effect/endpoint-contracts.mjs

@@ -0,0 +1,68 @@
+import { createOperationContractHash } from "@modern-js/bff-core";
+function ensureLeadingSlash(pathname) {
+    return pathname.startsWith('/') ? pathname : `/${pathname}`;
+}
+function normalizeEffectPrefix(prefix) {
+    if ('/' === prefix) return '';
+    return ensureLeadingSlash(prefix || '/api');
+}
+function getEffectRoutePath(prefix, endpointPath) {
+    const normalizedPrefix = normalizeEffectPrefix(prefix);
+    const normalizedEndpointPath = ensureLeadingSlash(endpointPath);
+    const finalEndpointPath = '/' === normalizedEndpointPath ? '' : endpointPath;
+    if (!normalizedPrefix && !finalEndpointPath) return '/';
+    return `${normalizedPrefix}${finalEndpointPath || ''}`;
+}
+function resolveEffectApiId(api) {
+    const fallback = 'EffectHttpApi';
+    if ('identifier' in api && 'string' == typeof api.identifier && api.identifier) return api.identifier;
+    return fallback;
+}
+function collectEffectEndpoints(reflect, api, prefix) {
+    const endpoints = [];
+    const apiId = resolveEffectApiId(api);
+    reflect(api, {
+        onGroup: ()=>{},
+        onEndpoint: ({ group, endpoint })=>{
+            endpoints.push({
+                apiId,
+                groupName: String(group.identifier),
+                endpointName: String(endpoint.name),
+                method: String(endpoint.method).toUpperCase(),
+                routePath: getEffectRoutePath(prefix, String(endpoint.path))
+            });
+        }
+    });
+    return endpoints.sort((a, b)=>{
+        if (a.groupName === b.groupName) return a.endpointName.localeCompare(b.endpointName);
+        return a.groupName.localeCompare(b.groupName);
+    });
+}
+function toOperationContractSources(endpoints) {
+    return endpoints.map(createEffectOperationContractSource);
+}
+function createEffectOperationContractSource(endpoint) {
+    return {
+        name: endpoint.endpointName,
+        httpMethod: endpoint.method,
+        routePath: endpoint.routePath
+    };
+}
+function isRecord(value) {
+    return 'object' == typeof value && null !== value;
+}
+async function extractHttpApiFromModule(mod, isHttpApi) {
+    if (!isRecord(mod)) return null;
+    if (isHttpApi(mod.api)) return mod.api;
+    const entry = mod.default;
+    if (isRecord(entry) && isHttpApi(entry.api)) return entry.api;
+    if ('function' == typeof entry && 0 === entry.length) {
+        const output = await entry();
+        if (isRecord(output) && isHttpApi(output.api)) return output.api;
+    }
+    return null;
+}
+function createEffectEndpointContractHash(endpoint, requestId) {
+    return createOperationContractHash(createEffectOperationContractSource(endpoint), requestId);
+}
+export { collectEffectEndpoints, createEffectEndpointContractHash, createEffectOperationContractSource, ensureLeadingSlash, extractHttpApiFromModule, getEffectRoutePath, normalizeEffectPrefix, resolveEffectApiId, toOperationContractSources };

package/dist/esm/runtime/effect/handler.mjs

@@ -1,9 +1,8 @@
 import * as __rspack_external_effect_Layer_16f7a8fc from "effect/Layer";
-import { HttpRouter, HttpServerResponse, HttpTraceContext } from "effect/unstable/http";
+import { HttpRouter, HttpServer, HttpServerResponse, HttpTraceContext } from "effect/unstable/http";
 import { HttpApiBuilder, OpenApi } from "effect/unstable/httpapi";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
 import { DEFAULT_DATA_BATCH_ENDPOINT, DEFAULT_DATA_BATCH_HEADER, DEFAULT_DATA_ENVELOPE_HEADER, decodeRequestEnvelopeHeader, validateRequestEnvelope, validateSelectionPlan } from "../data-platform/index.mjs";
-import * as __rspack_external__effect_opentelemetry_8bbbb5af from "@effect/opentelemetry";
 import * as __rspack_external_effect_Config_29be8a92 from "effect/Config";
 import * as __rspack_external_effect_Effect_194ac36c from "effect/Effect";
 import * as __rspack_external_effect_Option_4d691636 from "effect/Option";
@@ -11,6 +10,12 @@ import * as __rspack_external_effect_Schema_f8472650 from "effect/Schema";
 export * from "effect/unstable/http";
 export * from "effect/unstable/httpapi";
 export * from "effect/unstable/rpc";
+import * as __rspack_external_effect_Context_f1289ca3 from "effect/Context";
+const emptyEffectServiceContext = __rspack_external_effect_Context_f1289ca3.empty();
+const EFFECT_VALIDATOR_AWARE_FACTORY = Symbol.for('modernjs.effect.validatorAware');
+function isValidatorAwareHandlerFactory(factory) {
+    return 'function' == typeof factory && true === factory[EFFECT_VALIDATOR_AWARE_FACTORY];
+}
 function normalizeOpenApiPath(pathname) {
     if (!pathname.startsWith('/')) return `/${pathname}`;
     return pathname;
@@ -266,16 +271,38 @@ function defineEffectBff(definition) {
             layer: definition.layer,
             openapi: options?.openapi,
             rpc: mergedRpcOptions,
-            dataPlatform: mergeDataPlatformOptions(definition.dataPlatform, options?.dataPlatform)
+            dataPlatform: mergeDataPlatformOptions(definition.dataPlatform, options?.dataPlatform),
+            validateRequest: options?.validateRequest
         });
     };
-    const client = void 0;
+    Object.defineProperty(createHandler, EFFECT_VALIDATOR_AWARE_FACTORY, {
+        value: true
+    });
+    const client = createLoaderMaterializedClientPlaceholder();
     return {
         ...definition,
         createHandler,
         client
     };
 }
+const LOADER_CLIENT_IGNORED_KEYS = new Set([
+    'then',
+    'catch',
+    'finally',
+    'toJSON',
+    '$$typeof'
+]);
+function createLoaderMaterializedClientPlaceholder() {
+    const explain = (property)=>{
+        throw new Error(`[BFF][Effect] effectBff.client.${String(property)} is not available here: the typed client only exists when this module is imported through the "@api/effect/*" transformed path (the BFF loader replaces it with generated client code). On the server, use HttpApiClient or call the Effect layer directly.`);
+    };
+    return new Proxy(Object.create(null), {
+        get (_target, property) {
+            if ('symbol' == typeof property || LOADER_CLIENT_IGNORED_KEYS.has(property)) return;
+            return explain(property);
+        }
+    });
+}
 function defineEffectRpcBff(definition) {
     const createHandler = (options)=>createRpcApiHandler({
             ...definition,
@@ -287,7 +314,7 @@ function defineEffectRpcBff(definition) {
     };
 }
 function createHttpApiHandler(options) {
-    const apiLayer = options.layer;
+    const apiLayer = options.layer.pipe(__rspack_external_effect_Layer_16f7a8fc.provide(HttpServer.layerServices));
     const openApiLayer = createOpenApiLayer(options.api, options.openapi);
     const mergedLayer = openApiLayer ? __rspack_external_effect_Layer_16f7a8fc.mergeAll(apiLayer, openApiLayer) : apiLayer;
     const httpApiHandler = HttpRouter.toWebHandler(mergedLayer);
@@ -302,9 +329,11 @@ function createHttpApiHandler(options) {
     const envelopeHeader = options.dataPlatform?.envelopeHeader || DEFAULT_DATA_ENVELOPE_HEADER;
     const normalizedEnvelopeHeader = envelopeHeader.toLowerCase();
     const withDataPlatformValidation = async (request, context)=>{
+        const policyDenial = options.validateRequest?.(request);
+        if (policyDenial) return policyDenial;
         const validationError = validateDataPlatformRequestEnvelope(request, options.dataPlatform);
         if (validationError) return validationError;
-        return httpApiHandler.handler(request, context);
+        return httpApiHandler.handler(request, context ?? emptyEffectServiceContext);
     };
     const handleBatchRequest = async (request, context)=>{
         const mountedPrefix = getMountedPrefixFromContext(request, context);
@@ -423,7 +452,11 @@ function createHttpApiHandler(options) {
     const rpcHandler = createRpcApiHandler(options.rpc);
     return {
         handler: async (request, context)=>{
-            if (isRpcRequest(request, rpcPath)) return rpcHandler.handler(request, context);
+            if (isRpcRequest(request, rpcPath)) {
+                const policyDenial = options.validateRequest?.(request);
+                if (policyDenial) return policyDenial;
+                return rpcHandler.handler(request, context ?? emptyEffectServiceContext);
+            }
             return handleHttpApiRequest(request);
         },
         dispose: async ()=>{
@@ -434,4 +467,4 @@ function createHttpApiHandler(options) {
         }
     };
 }
-export { HttpApiBuilder, HttpTraceContext, __rspack_external__effect_opentelemetry_8bbbb5af as OpenTelemetry, __rspack_external_effect_Config_29be8a92 as Config, __rspack_external_effect_Effect_194ac36c as Effect, __rspack_external_effect_Layer_16f7a8fc as Layer, __rspack_external_effect_Option_4d691636 as Option, __rspack_external_effect_Schema_f8472650 as Schema, createHttpApiHandler, defineEffectBff, defineEffectRpcBff };
+export { EFFECT_VALIDATOR_AWARE_FACTORY, HttpApiBuilder, HttpTraceContext, __rspack_external_effect_Config_29be8a92 as Config, __rspack_external_effect_Effect_194ac36c as Effect, __rspack_external_effect_Layer_16f7a8fc as Layer, __rspack_external_effect_Option_4d691636 as Option, __rspack_external_effect_Schema_f8472650 as Schema, createHttpApiHandler, defineEffectBff, defineEffectRpcBff, isValidatorAwareHandlerFactory };

package/dist/esm/runtime/effect/index.mjs

@@ -1,2 +1,4 @@
+import * as __rspack_external__effect_opentelemetry_8bbbb5af from "@effect/opentelemetry";
 export * from "./handler.mjs";
 export { createEffectOperationContext, useEffectContext, useOperationContext } from "./context.mjs";
+export { __rspack_external__effect_opentelemetry_8bbbb5af as OpenTelemetry };

package/dist/esm/runtime/effect/module.mjs

@@ -1,5 +1,6 @@
 import { HttpApi } from "effect/unstable/httpapi";
-import { createHttpApiHandler } from "./handler.mjs";
+import { createHttpApiHandler, isValidatorAwareHandlerFactory } from "./handler.mjs";
+import * as __rspack_external_effect_Context_f1289ca3 from "effect/Context";
 function isRecord(value) {
     return 'object' == typeof value && null !== value;
 }
@@ -12,15 +13,33 @@ function isRequestHandler(value) {
 function isEffectApiDefinition(module) {
     return HttpApi.isHttpApi(module.api) && void 0 !== module.layer;
 }
-async function resolveEffectBffModuleHandler(mod, options = {}) {
-    let normalizedModule = mod;
-    const mergeRuntimeExports = (value)=>{
-        if (!isRecord(value) || !includesRuntimeExports(value)) return;
-        normalizedModule = {
-            ...normalizedModule,
-            ...value
-        };
+function isEffectServiceContext(context) {
+    return 'object' == typeof context && null !== context && 'mapUnsafe' in context;
+}
+const emptyEffectServiceContext = __rspack_external_effect_Context_f1289ca3.empty();
+function callEffectBffRequestHandler(handler, request, context) {
+    return void 0 === context ? handler(request) : handler(request, context);
+}
+function createLoadedHandler(webHandler, appliesRequestValidator) {
+    return {
+        handler: (request, context)=>callEffectBffRequestHandler(webHandler.handler, request, context),
+        dispose: webHandler.dispose,
+        ...appliesRequestValidator ? {
+            appliesRequestValidator: true
+        } : {}
     };
+}
+function createLoadedHttpApiHandler(webHandler) {
+    return {
+        handler: (request, context)=>{
+            const effectContext = isEffectServiceContext(context) ? context : emptyEffectServiceContext;
+            return webHandler.handler(request, effectContext);
+        },
+        dispose: webHandler.dispose,
+        appliesRequestValidator: true
+    };
+}
+function resolveNormalizedEffectBffModuleHandler(normalizedModule, options = {}) {
     if (isRequestHandler(normalizedModule.handler)) return {
         handler: normalizedModule.handler
     };
@@ -28,13 +47,6 @@ async function resolveEffectBffModuleHandler(mod, options = {}) {
     if (isRequestHandler(entry)) return {
         handler: entry
     };
-    if ('function' == typeof entry && 0 === entry.length) {
-        const out = await entry();
-        if (isRequestHandler(out)) return {
-            handler: out
-        };
-        mergeRuntimeExports(out);
-    }
     if (isRecord(entry)) normalizedModule = {
         ...normalizedModule,
         ...entry
@@ -50,16 +62,15 @@ async function resolveEffectBffModuleHandler(mod, options = {}) {
         handler: normalizedModule.handler
     };
     if ('function' == typeof normalizedModule.createHandler) {
-        const webHandler = normalizedModule.createHandler({
+        const factory = normalizedModule.createHandler;
+        const validatorAware = isValidatorAwareHandlerFactory(factory);
+        if (!validatorAware && void 0 !== options.validateRequest) options.onWarning?.('[BFF][Effect] Custom createHandler export detected: it cannot be verified to apply validateRequest (cross-project policy), so the policy is enforced by the adapter middleware on the outer request. Batched calls will be denied at the batch POST (it carries no per-operation contract); export defineEffectBff(...) to get per-batch-item enforcement.');
+        const webHandler = factory({
             openapi: options.openapi,
-            dataPlatform: options.dataPlatform
+            dataPlatform: options.dataPlatform,
+            validateRequest: options.validateRequest
         });
-        return {
-            handler: async (request, context)=>webHandler.handler(request, context),
-            dispose: async ()=>{
-                await webHandler.dispose();
-            }
-        };
+        return createLoadedHandler(webHandler, validatorAware);
     }
     if (isEffectApiDefinition(normalizedModule)) {
         options.onWarning?.('[BFF][Effect] Detected { api, layer } export without createHandler. Prefer `defineEffectBff(...)` from @modern-js/plugin-bff/server to avoid module instance mismatch.');
@@ -67,15 +78,36 @@ async function resolveEffectBffModuleHandler(mod, options = {}) {
             api: normalizedModule.api,
             layer: normalizedModule.layer,
             openapi: options.openapi,
-            dataPlatform: options.dataPlatform
+            dataPlatform: options.dataPlatform,
+            validateRequest: options.validateRequest
         });
-        return {
-            handler: async (request, context)=>webHandler.handler(request, context),
-            dispose: async ()=>{
-                await webHandler.dispose();
-            }
-        };
+        return createLoadedHttpApiHandler(webHandler);
     }
     return null;
 }
+function resolveEffectBffModuleHandler(mod, options = {}) {
+    let normalizedModule = mod;
+    const mergeRuntimeExports = (value)=>{
+        if (!isRecord(value) || !includesRuntimeExports(value)) return;
+        normalizedModule = {
+            ...normalizedModule,
+            ...value
+        };
+    };
+    if (isRequestHandler(normalizedModule.handler)) return Promise.resolve({
+        handler: normalizedModule.handler
+    });
+    const entry = normalizedModule.default;
+    if (isRequestHandler(entry)) return Promise.resolve({
+        handler: entry
+    });
+    if ('function' == typeof entry && 0 === entry.length) return Promise.resolve(entry()).then((out)=>{
+        if (isRequestHandler(out)) return {
+            handler: out
+        };
+        mergeRuntimeExports(out);
+        return resolveNormalizedEffectBffModuleHandler(normalizedModule, options);
+    });
+    return Promise.resolve(resolveNormalizedEffectBffModuleHandler(normalizedModule, options));
+}
 export { resolveEffectBffModuleHandler };

package/dist/esm/runtime/effect/operation-context.mjs

@@ -1,5 +1,4 @@
-import { BFF_LOCALE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, BFF_TRACEPARENT_HEADER } from "@modern-js/create-request";
-const TRACEPARENT_REGEX = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/i;
+import { BFF_LOCALE_HEADER, BFF_OPERATION_CONTEXT_DETAIL_HEADER, BFF_OPERATION_CONTEXT_HEADER, BFF_TRACEPARENT_HEADER, parseTraceparent } from "@modern-js/create-request";
 const readHeader = (headers, header)=>{
     const value = headers.get(header);
     return value && value.length > 0 ? value : void 0;
@@ -8,17 +7,6 @@ const copyStringField = (target, details, key)=>{
     const value = details[key];
     if ('string' == typeof value && value.length > 0) target[key] = value;
 };
-const parseTraceparent = (traceparent)=>{
-    if (!traceparent) return;
-    const match = traceparent.trim().match(TRACEPARENT_REGEX);
-    if (!match) return;
-    const [, traceId, spanId] = match;
-    if (!traceId || !spanId) return;
-    return {
-        traceId: traceId.toLowerCase(),
-        spanId: spanId.toLowerCase()
-    };
-};
 const readOperationContextDetails = (request)=>{
     const rawDetails = readHeader(request.headers, BFF_OPERATION_CONTEXT_DETAIL_HEADER);
     if (!rawDetails) return {};

package/dist/esm/runtime/effect-client/index.mjs

@@ -55,7 +55,7 @@ function makeEffectHttpApiClient(api, options) {
             for (const [header, value] of Object.entries(requestContextHeaders))if (void 0 === nextRequest.headers[header.toLowerCase()]) nextRequest = HttpClientRequest.setHeader(nextRequest, header, value);
             return nextRequest;
         }));
-        return options?.transformClient ? options.transformClient(contextClient) : contextClient;
+        return 'function' == typeof options?.transformClient ? options.transformClient(contextClient) : contextClient;
     };
     return HttpApiClient.make(api, {
         baseUrl: options?.baseUrl,