@bleedingdev/modern-js-runtime-extensions 3.9.0-ultramodern.1 → 3.9.0-ultramodern.10

package/dist/cjs/request-policy/client.js

@@ -0,0 +1,234 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    createPolicyClient: ()=>createPolicyClient
+});
+const external_policyCore_js_namespaceObject = require("./policyCore.js");
+const external_transport_js_namespaceObject = require("./transport.js");
+const external_types_js_namespaceObject = require("./types.js");
+const createPolicyClient = (nativeClient, environment)=>{
+    const isServerTarget = 'server' === environment.target;
+    const configuredRequests = new Map();
+    const realResolveHeaders = new Map();
+    const realRequireEnvelope = new Map();
+    const realAllowCrossOriginEnvelope = new Map();
+    const realTransportResilience = new Map();
+    const realIdentityBinding = new Map();
+    const realOperationContract = new Map();
+    const domainMap = new Map();
+    const attachEnvelopeHeaderIfRequired = (headers, requestId, url, incomingHeaders)=>{
+        const shouldRequireEnvelope = realRequireEnvelope.get(requestId) ?? (0, external_policyCore_js_namespaceObject.isSecuredRequestId)(requestId);
+        if (!shouldRequireEnvelope) return;
+        headers[external_types_js_namespaceObject.BFF_ENVELOPE_HEADER] = (0, external_policyCore_js_namespaceObject.buildEnvelopeHeaderValue)({
+            requestId,
+            target: environment.target,
+            sourceOrigin: environment.resolveSourceOrigin(incomingHeaders),
+            targetOrigin: (0, external_policyCore_js_namespaceObject.toOrigin)(url),
+            traceContext: (0, external_policyCore_js_namespaceObject.parseTraceparentValue)((0, external_policyCore_js_namespaceObject.readHeader)(headers, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER)),
+            allowCrossOriginEnvelope: realAllowCrossOriginEnvelope.get(requestId)
+        });
+    };
+    const attachSecuredOperationHeaders = (headers, requestId, method, path, operationContext)=>{
+        if (!(0, external_policyCore_js_namespaceObject.isSecuredRequestId)(requestId)) return;
+        (0, external_policyCore_js_namespaceObject.attachOperationContextHeaders)({
+            headers,
+            requestId,
+            target: environment.target,
+            method,
+            path,
+            operationContext,
+            operationContract: realOperationContract.get(requestId),
+            operationContextHeader: external_types_js_namespaceObject.BFF_OPERATION_CONTEXT_HEADER,
+            operationContextDetailHeader: external_types_js_namespaceObject.BFF_OPERATION_CONTEXT_DETAIL_HEADER
+        });
+    };
+    const applyIdentityAndForwardedHeaders = ({ headers, requestId, incomingHeaders, forwardedHeaders, allowedHeaders: targetAllowedHeaders })=>{
+        const identityBinding = realIdentityBinding.get(requestId);
+        const identityBindingEnabled = identityBinding?.enabled ?? (0, external_policyCore_js_namespaceObject.isSecuredRequestId)(requestId);
+        const identityBindingStrict = identityBinding?.strict ?? (0, external_policyCore_js_namespaceObject.isSecuredRequestId)(requestId);
+        const protectedIdentityHeaders = (identityBinding?.protectedHeaders || external_types_js_namespaceObject.BFF_DEFAULT_PROTECTED_IDENTITY_HEADERS).map((header)=>header.toLowerCase());
+        if (identityBindingEnabled) {
+            const derivedIdentityHeaders = {};
+            if (isServerTarget) for (const header of protectedIdentityHeaders){
+                const incomingHeaderValue = (0, external_policyCore_js_namespaceObject.readHeader)(incomingHeaders, header);
+                if (void 0 !== incomingHeaderValue) (0, external_policyCore_js_namespaceObject.writeHeader)(derivedIdentityHeaders, header, incomingHeaderValue);
+            }
+            const customDerivedHeaders = identityBinding?.deriveHeaders?.({
+                requestId,
+                target: environment.target,
+                incomingHeaders: isServerTarget ? {
+                    ...incomingHeaders
+                } : {},
+                protectedHeaders: [
+                    ...protectedIdentityHeaders
+                ]
+            });
+            if (customDerivedHeaders && 'object' == typeof customDerivedHeaders) for (const header of protectedIdentityHeaders){
+                const customValue = (0, external_policyCore_js_namespaceObject.readHeader)(customDerivedHeaders, header);
+                if (void 0 !== customValue) (0, external_policyCore_js_namespaceObject.writeHeader)(derivedIdentityHeaders, header, customValue);
+            }
+            for (const header of protectedIdentityHeaders){
+                const attemptedValue = (0, external_policyCore_js_namespaceObject.readHeader)(headers, header);
+                if (void 0 === attemptedValue) continue;
+                const violation = {
+                    requestId,
+                    target: environment.target,
+                    header,
+                    attemptedValue,
+                    derivedValue: (0, external_policyCore_js_namespaceObject.readHeader)(derivedIdentityHeaders, header),
+                    reason: 'client_override_blocked'
+                };
+                identityBinding?.onViolation?.(violation);
+                if (identityBindingStrict) throw new external_policyCore_js_namespaceObject.IdentityBindingViolationError(violation);
+                (0, external_policyCore_js_namespaceObject.deleteHeader)(headers, header);
+            }
+            Object.keys(derivedIdentityHeaders).forEach((header)=>{
+                if (isServerTarget) (0, external_policyCore_js_namespaceObject.writeHeader)(forwardedHeaders, header, derivedIdentityHeaders[header]);
+                else (0, external_policyCore_js_namespaceObject.writeHeader)(headers, header, derivedIdentityHeaders[header]);
+            });
+        }
+        if (isServerTarget) {
+            const resolveHeaders = realResolveHeaders.get(requestId);
+            if (resolveHeaders) {
+                const resolvedHeaders = resolveHeaders({
+                    requestId,
+                    allowedHeaders: targetAllowedHeaders,
+                    incomingHeaders: {
+                        ...forwardedHeaders
+                    }
+                });
+                if (resolvedHeaders && 'object' == typeof resolvedHeaders) for (const key of targetAllowedHeaders){
+                    const resolvedValue = (0, external_policyCore_js_namespaceObject.readHeader)(resolvedHeaders, key);
+                    if (void 0 !== resolvedValue) {
+                        if (identityBindingEnabled && protectedIdentityHeaders.includes(key.toLowerCase())) {
+                            (0, external_policyCore_js_namespaceObject.writeHeader)(forwardedHeaders, key.toLowerCase(), resolvedValue);
+                            continue;
+                        }
+                        (0, external_policyCore_js_namespaceObject.writeHeader)(forwardedHeaders, key, resolvedValue);
+                    }
+                }
+            }
+        }
+        return headers;
+    };
+    const configure = (options)=>{
+        const { request, interceptor, allowedHeaders, resolveHeaders, transport, requireEnvelope, allowCrossOriginEnvelope, identityBinding, operationContract, setDomain, requestId = 'default' } = options;
+        const hasExistingDomain = domainMap.has(requestId);
+        if ('default' !== requestId && !setDomain && !hasExistingDomain) throw new external_policyCore_js_namespaceObject.ProducerDomainNotConfiguredError(requestId);
+        let resolvedDomain;
+        nativeClient.configure({
+            request,
+            interceptor,
+            allowedHeaders,
+            requestId,
+            setDomain: setDomain ? (options)=>{
+                resolvedDomain = setDomain(options);
+                if ('default' !== requestId && (0, external_policyCore_js_namespaceObject.isEmptyDomain)(resolvedDomain)) throw new external_policyCore_js_namespaceObject.ProducerDomainNotConfiguredError(requestId);
+                return resolvedDomain;
+            } : void 0
+        });
+        realResolveHeaders.delete(requestId);
+        realTransportResilience.delete(requestId);
+        realIdentityBinding.delete(requestId);
+        realOperationContract.delete(requestId);
+        realRequireEnvelope.delete(requestId);
+        realAllowCrossOriginEnvelope.delete(requestId);
+        if (isServerTarget && 'function' == typeof resolveHeaders) realResolveHeaders.set(requestId, resolveHeaders);
+        if (transport && 'object' == typeof transport) realTransportResilience.set(requestId, transport);
+        if (identityBinding && 'object' == typeof identityBinding) realIdentityBinding.set(requestId, identityBinding);
+        if (operationContract && 'object' == typeof operationContract) realOperationContract.set(requestId, operationContract);
+        if ('boolean' == typeof requireEnvelope) realRequireEnvelope.set(requestId, requireEnvelope);
+        if ('boolean' == typeof allowCrossOriginEnvelope || 'function' == typeof allowCrossOriginEnvelope) realAllowCrossOriginEnvelope.set(requestId, allowCrossOriginEnvelope);
+        if ('string' == typeof resolvedDomain) domainMap.set(requestId, resolvedDomain);
+        configuredRequests.set(requestId, true);
+    };
+    const createHooks = (path, method, requestId, operationContext, upload = false)=>({
+            onStart: ({ configuredDomain })=>{
+                (0, external_policyCore_js_namespaceObject.resolveConfiguredRequest)(configuredRequests, requestId, false);
+                if (!upload && 'default' !== requestId && (0, external_policyCore_js_namespaceObject.isEmptyDomain)(configuredDomain)) throw new external_policyCore_js_namespaceObject.ProducerDomainNotConfiguredError(requestId);
+            },
+            prepareHeaders: applyIdentityAndForwardedHeaders,
+            dispatch: (context)=>{
+                const { incomingHeaders, url, init: { headers } } = context;
+                if (isServerTarget && !upload) {
+                    if (void 0 === (0, external_policyCore_js_namespaceObject.readHeader)(headers, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER)) {
+                        const incomingTraceparent = (0, external_policyCore_js_namespaceObject.firstHeaderValue)((0, external_policyCore_js_namespaceObject.readHeader)(incomingHeaders, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER));
+                        if ('string' == typeof incomingTraceparent) (0, external_policyCore_js_namespaceObject.writeHeader)(headers, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER, incomingTraceparent);
+                    }
+                    if (void 0 === (0, external_policyCore_js_namespaceObject.readHeader)(headers, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER) && operationContext?.traceparent) (0, external_policyCore_js_namespaceObject.writeHeader)(headers, external_policyCore_js_namespaceObject.TRACEPARENT_HEADER, operationContext.traceparent);
+                }
+                attachEnvelopeHeaderIfRequired(headers, requestId, url, incomingHeaders);
+                attachSecuredOperationHeaders(headers, requestId, method, path, operationContext);
+                return (0, external_transport_js_namespaceObject.executeWithResilience)({
+                    requestId,
+                    target: environment.target,
+                    method,
+                    url,
+                    init: context.init,
+                    fetcher: context.fetcher,
+                    transport: realTransportResilience.get(requestId)
+                });
+            }
+        });
+    const createRequest = (...args)=>{
+        const options = 'object' == typeof args[0] && null !== args[0] ? args[0] : {
+            path: args[0],
+            method: args[1],
+            port: args[2],
+            httpMethodDecider: args[3],
+            fetch: args[4],
+            requestId: args[5],
+            operationContext: args[6]
+        };
+        const { operationContext, requestId = 'default', ...nativeOptions } = options;
+        return nativeClient.createRequest({
+            ...nativeOptions,
+            requestId,
+            hooks: createHooks(options.path, options.method, requestId, operationContext)
+        });
+    };
+    const createUploader = ({ operationContext, requestId = 'default', ...options })=>nativeClient.createUploader({
+            ...options,
+            requestId,
+            hooks: createHooks(options.path, 'POST', requestId, operationContext, true)
+        });
+    return {
+        configure,
+        createRequest,
+        createUploader
+    };
+};
+exports.createPolicyClient = __webpack_exports__.createPolicyClient;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "createPolicyClient"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/request-policy/node.js

@@ -0,0 +1,149 @@
+"use strict";
+var __webpack_modules__ = {
+    "./client" (module) {
+        module.exports = require("./client.js");
+    },
+    "./policyCore" (module) {
+        module.exports = require("./policyCore.js");
+    },
+    "./requestContext" (module) {
+        module.exports = require("./requestContext.js");
+    },
+    "./types" (module) {
+        module.exports = require("./types.js");
+    },
+    "@modern-js/create-request/server" (module) {
+        module.exports = require("@modern-js/create-request/server");
+    }
+};
+var __webpack_module_cache__ = {};
+function __webpack_require__(moduleId) {
+    var cachedModule = __webpack_module_cache__[moduleId];
+    if (void 0 !== cachedModule) return cachedModule.exports;
+    var module = __webpack_module_cache__[moduleId] = {
+        exports: {}
+    };
+    __webpack_modules__[moduleId](module, module.exports, __webpack_require__);
+    return module.exports;
+}
+(()=>{
+    __webpack_require__.n = (module)=>{
+        var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
+        __webpack_require__.d(getter, {
+            a: getter
+        });
+        return getter;
+    };
+})();
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+(()=>{
+    __webpack_require__.r(__webpack_exports__);
+    var _modern_js_create_request_server__rspack_import_0 = __webpack_require__("@modern-js/create-request/server");
+    var _client__rspack_import_1 = __webpack_require__("./client");
+    var _policyCore__rspack_import_2 = __webpack_require__("./policyCore");
+    var _requestContext__rspack_import_3 = __webpack_require__("./requestContext");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _requestContext__rspack_import_3)if ([
+        "IdentityBindingViolationError",
+        "configure",
+        "OperationContractViolationError",
+        "default",
+        "ProducerClientNotInitializedError",
+        "ProducerDomainNotConfiguredError",
+        "createUploader",
+        "createClient",
+        "CrossOriginEnvelopePolicyError",
+        "createRequest"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_requestContext__rspack_import_3[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    var _types__rspack_import_4 = __webpack_require__("./types");
+    var __rspack_reexport = {};
+    for(const __rspack_import_key in _types__rspack_import_4)if ([
+        "IdentityBindingViolationError",
+        "configure",
+        "OperationContractViolationError",
+        "default",
+        "ProducerClientNotInitializedError",
+        "ProducerDomainNotConfiguredError",
+        "createUploader",
+        "createClient",
+        "CrossOriginEnvelopePolicyError",
+        "createRequest"
+    ].indexOf(__rspack_import_key) < 0) __rspack_reexport[__rspack_import_key] = ()=>_types__rspack_import_4[__rspack_import_key];
+    __webpack_require__.d(__webpack_exports__, __rspack_reexport);
+    const resolveSourceOrigin = (headers)=>{
+        const origin = (0, _policyCore__rspack_import_2.toOrigin)((0, _policyCore__rspack_import_2.firstHeaderValue)(headers.origin));
+        if (origin) return origin;
+        const referer = (0, _policyCore__rspack_import_2.toOrigin)((0, _policyCore__rspack_import_2.firstHeaderValue)(headers.referer));
+        if (referer) return referer;
+        const host = (0, _policyCore__rspack_import_2.firstHeaderValue)(headers.host);
+        if (!host) return;
+        const proto = (0, _policyCore__rspack_import_2.firstHeaderValue)(headers['x-forwarded-proto']) || 'http';
+        return `${proto}://${host}`;
+    };
+    const createClient = ()=>(0, _client__rspack_import_1.createPolicyClient)((0, _modern_js_create_request_server__rspack_import_0.createClient)(), {
+            target: 'server',
+            resolveSourceOrigin
+        });
+    const { configure, createRequest, createUploader } = createClient();
+    __webpack_require__.d(__webpack_exports__, {
+        CrossOriginEnvelopePolicyError: ()=>_policyCore__rspack_import_2.CrossOriginEnvelopePolicyError,
+        IdentityBindingViolationError: ()=>_policyCore__rspack_import_2.IdentityBindingViolationError,
+        OperationContractViolationError: ()=>_policyCore__rspack_import_2.OperationContractViolationError,
+        ProducerClientNotInitializedError: ()=>_policyCore__rspack_import_2.ProducerClientNotInitializedError,
+        ProducerDomainNotConfiguredError: ()=>_policyCore__rspack_import_2.ProducerDomainNotConfiguredError
+    }, {
+        configure: configure,
+        createClient: createClient,
+        createRequest: createRequest,
+        createUploader: createUploader
+    });
+})();
+exports.CrossOriginEnvelopePolicyError = __webpack_exports__.CrossOriginEnvelopePolicyError;
+exports.IdentityBindingViolationError = __webpack_exports__.IdentityBindingViolationError;
+exports.OperationContractViolationError = __webpack_exports__.OperationContractViolationError;
+exports.ProducerClientNotInitializedError = __webpack_exports__.ProducerClientNotInitializedError;
+exports.ProducerDomainNotConfiguredError = __webpack_exports__.ProducerDomainNotConfiguredError;
+exports.configure = __webpack_exports__.configure;
+exports.createClient = __webpack_exports__.createClient;
+exports.createRequest = __webpack_exports__.createRequest;
+exports.createUploader = __webpack_exports__.createUploader;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "CrossOriginEnvelopePolicyError",
+    "IdentityBindingViolationError",
+    "OperationContractViolationError",
+    "ProducerClientNotInitializedError",
+    "ProducerDomainNotConfiguredError",
+    "configure",
+    "createClient",
+    "createRequest",
+    "createUploader"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/request-policy/policyCore.js

@@ -0,0 +1,266 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    CrossOriginEnvelopePolicyError: ()=>CrossOriginEnvelopePolicyError,
+    IdentityBindingViolationError: ()=>IdentityBindingViolationError,
+    OperationContractViolationError: ()=>OperationContractViolationError,
+    ProducerClientNotInitializedError: ()=>ProducerClientNotInitializedError,
+    ProducerDomainNotConfiguredError: ()=>ProducerDomainNotConfiguredError,
+    TRACEPARENT_HEADER: ()=>TRACEPARENT_HEADER,
+    attachOperationContextHeaders: ()=>attachOperationContextHeaders,
+    buildEnvelopeHeaderValue: ()=>buildEnvelopeHeaderValue,
+    buildOperationContext: ()=>buildOperationContext,
+    deleteHeader: ()=>deleteHeader,
+    findHeaderKey: ()=>findHeaderKey,
+    firstHeaderValue: ()=>firstHeaderValue,
+    isEmptyDomain: ()=>isEmptyDomain,
+    isSecuredRequestId: ()=>isSecuredRequestId,
+    parseTraceparentValue: ()=>parseTraceparentValue,
+    readHeader: ()=>readHeader,
+    resolveConfiguredRequest: ()=>resolveConfiguredRequest,
+    toOrigin: ()=>toOrigin,
+    validateOperationContract: ()=>validateOperationContract,
+    writeHeader: ()=>writeHeader
+});
+const external_traceparent_js_namespaceObject = require("./traceparent.js");
+const TRACEPARENT_HEADER = 'traceparent';
+const readProcessEnv = (key)=>{
+    if ("u" < typeof process || void 0 === process.env || 'string' != typeof process.env[key]) return;
+    return process.env[key];
+};
+const isStrictDefaultRequestIdEnabled = ()=>'true' === readProcessEnv('MODERN_BFF_STRICT_DEFAULT_REQUEST_ID');
+const isSecuredRequestId = (requestId)=>'default' !== requestId || isStrictDefaultRequestIdEnabled();
+const isEmptyDomain = (domain)=>'string' != typeof domain || '' === domain.trim();
+const firstHeaderValue = (value)=>Array.isArray(value) ? value[0] : value;
+const findHeaderKey = (headers, header)=>{
+    const normalized = header.toLowerCase();
+    return Object.keys(headers).find((key)=>key.toLowerCase() === normalized);
+};
+const readHeader = (headers, header)=>{
+    const key = findHeaderKey(headers, header);
+    return 'string' == typeof key ? headers[key] : void 0;
+};
+const writeHeader = (headers, header, value)=>{
+    if (void 0 === value) return;
+    const key = findHeaderKey(headers, header);
+    if ('string' == typeof key && key !== header) delete headers[key];
+    headers[header] = value;
+};
+const deleteHeader = (headers, header)=>{
+    const key = findHeaderKey(headers, header);
+    if ('string' == typeof key) delete headers[key];
+};
+const toOrigin = (value)=>{
+    if (!value) return;
+    try {
+        return new URL(value).origin;
+    } catch (error) {
+        return;
+    }
+};
+const parseTraceparentValue = (value)=>(0, external_traceparent_js_namespaceObject.parseTraceparent)(firstHeaderValue(value));
+const buildOperationContext = ({ requestId, method, path, operationContext, traceparent })=>{
+    const routePath = operationContext?.routePath || path;
+    const operationMethod = (operationContext?.method || method || 'GET').toUpperCase();
+    const rawOperationId = operationContext?.operationId || `${operationMethod}:${routePath}`;
+    const operationId = rawOperationId.startsWith(`${requestId}:`) ? rawOperationId : `${requestId}:${rawOperationId}`;
+    const traceparentValue = operationContext?.traceparent || ('string' == typeof firstHeaderValue(traceparent) ? String(firstHeaderValue(traceparent)) : void 0);
+    const parsedTraceContext = operationContext?.traceId && operationContext?.spanId ? {
+        traceId: operationContext.traceId,
+        spanId: operationContext.spanId
+    } : parseTraceparentValue(traceparentValue);
+    return {
+        requestId,
+        operationId,
+        routePath,
+        method: operationMethod,
+        ...operationContext?.schemaHash ? {
+            schemaHash: operationContext.schemaHash
+        } : {},
+        ...'number' == typeof operationContext?.operationVersion ? {
+            operationVersion: operationContext.operationVersion
+        } : {},
+        ...traceparentValue ? {
+            traceparent: traceparentValue
+        } : {},
+        ...parsedTraceContext ? {
+            traceId: parsedTraceContext.traceId,
+            spanId: parsedTraceContext.spanId
+        } : {}
+    };
+};
+class ProducerClientNotInitializedError extends Error {
+    constructor(requestId){
+        super(`Producer client "${requestId}" is not initialized. Call initProducerClient() (or configure()) before using generated APIs for this requestId.`), this.code = 'BFF_PRODUCER_CLIENT_NOT_INITIALIZED';
+        this.name = 'ProducerClientNotInitializedError';
+    }
+}
+class ProducerDomainNotConfiguredError extends Error {
+    constructor(requestId){
+        super(`Producer client "${requestId}" must provide setDomain() during configure().`), this.code = 'BFF_PRODUCER_DOMAIN_NOT_CONFIGURED';
+        this.name = 'ProducerDomainNotConfiguredError';
+    }
+}
+class CrossOriginEnvelopePolicyError extends Error {
+    constructor(requestId, sourceOrigin, targetOrigin){
+        super(`Cross-origin envelope is not allowed for producer "${requestId}" (${sourceOrigin || 'unknown-origin'} -> ${targetOrigin || 'unknown-origin'}). Configure allowCrossOriginEnvelope to explicitly allow this flow.`), this.code = 'BFF_CROSS_ORIGIN_ENVELOPE_NOT_ALLOWED';
+        this.name = 'CrossOriginEnvelopePolicyError';
+    }
+}
+class IdentityBindingViolationError extends Error {
+    constructor(violation){
+        super(`Identity header "${violation.header}" for producer "${violation.requestId}" was rejected by server-derived identity binding.`), this.code = 'BFF_IDENTITY_BINDING_VIOLATION';
+        this.name = 'IdentityBindingViolationError';
+        this.violation = violation;
+    }
+}
+class OperationContractViolationError extends Error {
+    constructor(violation){
+        super(`Operation contract violation "${violation.reason}" for producer "${violation.requestId}" operation "${violation.operationId}".`), this.code = 'BFF_OPERATION_CONTRACT_VIOLATION';
+        this.name = 'OperationContractViolationError';
+        this.violation = violation;
+    }
+}
+const validateOperationContract = ({ requestId, target, contextPayload, operationContract })=>{
+    const operationContractEnabled = operationContract?.enabled ?? isSecuredRequestId(requestId);
+    if (!operationContractEnabled) return;
+    const strict = operationContract?.strict ?? true;
+    const requireSchemaHash = operationContract?.requireSchemaHash ?? true;
+    const requireOperationVersion = operationContract?.requireOperationVersion ?? true;
+    const maybeReportViolation = (reason)=>{
+        const violation = {
+            requestId,
+            target,
+            operationId: contextPayload.operationId,
+            routePath: contextPayload.routePath,
+            method: contextPayload.method,
+            schemaHash: 'string' == typeof contextPayload.schemaHash ? contextPayload.schemaHash : void 0,
+            operationVersion: 'number' == typeof contextPayload.operationVersion ? contextPayload.operationVersion : void 0,
+            reason
+        };
+        operationContract?.onViolation?.(violation);
+        if (strict) throw new OperationContractViolationError(violation);
+    };
+    if (requireSchemaHash && 'string' != typeof contextPayload.schemaHash) maybeReportViolation('missing_schema_hash');
+    if (requireOperationVersion && 'number' != typeof contextPayload.operationVersion) maybeReportViolation('missing_operation_version');
+};
+const resolveConfiguredRequest = (configuredRequests, requestId, fallback)=>{
+    const configuredRequest = configuredRequests.get(requestId);
+    if (configuredRequest) return configuredRequest;
+    if ('default' !== requestId) throw new ProducerClientNotInitializedError(requestId);
+    return fallback;
+};
+const buildEnvelopeHeaderValue = ({ requestId, target, sourceOrigin, targetOrigin, traceContext, allowCrossOriginEnvelope })=>{
+    const isCrossOrigin = Boolean(sourceOrigin) && Boolean(targetOrigin) && sourceOrigin !== targetOrigin;
+    if (isCrossOrigin) {
+        const isAllowed = 'function' == typeof allowCrossOriginEnvelope ? true === allowCrossOriginEnvelope({
+            requestId,
+            sourceOrigin,
+            targetOrigin,
+            target
+        }) : true === allowCrossOriginEnvelope;
+        if (!isAllowed) throw new CrossOriginEnvelopePolicyError(requestId, sourceOrigin, targetOrigin);
+    }
+    return JSON.stringify({
+        requestId,
+        target,
+        timestamp: Date.now(),
+        sourceOrigin,
+        targetOrigin,
+        ...traceContext ? {
+            traceId: traceContext.traceId,
+            spanId: traceContext.spanId
+        } : {}
+    });
+};
+const attachOperationContextHeaders = ({ headers, requestId, target, method, path, operationContext, operationContract, operationContextHeader, operationContextDetailHeader })=>{
+    if (void 0 === readHeader(headers, TRACEPARENT_HEADER) && operationContext?.traceparent) writeHeader(headers, TRACEPARENT_HEADER, operationContext.traceparent);
+    const contextPayload = buildOperationContext({
+        requestId,
+        method,
+        path,
+        operationContext,
+        traceparent: readHeader(headers, TRACEPARENT_HEADER)
+    });
+    validateOperationContract({
+        requestId,
+        target,
+        contextPayload,
+        operationContract
+    });
+    if (void 0 === readHeader(headers, operationContextHeader)) writeHeader(headers, operationContextHeader, contextPayload.operationId);
+    writeHeader(headers, operationContextDetailHeader, JSON.stringify(contextPayload));
+    return contextPayload;
+};
+exports.CrossOriginEnvelopePolicyError = __webpack_exports__.CrossOriginEnvelopePolicyError;
+exports.IdentityBindingViolationError = __webpack_exports__.IdentityBindingViolationError;
+exports.OperationContractViolationError = __webpack_exports__.OperationContractViolationError;
+exports.ProducerClientNotInitializedError = __webpack_exports__.ProducerClientNotInitializedError;
+exports.ProducerDomainNotConfiguredError = __webpack_exports__.ProducerDomainNotConfiguredError;
+exports.TRACEPARENT_HEADER = __webpack_exports__.TRACEPARENT_HEADER;
+exports.attachOperationContextHeaders = __webpack_exports__.attachOperationContextHeaders;
+exports.buildEnvelopeHeaderValue = __webpack_exports__.buildEnvelopeHeaderValue;
+exports.buildOperationContext = __webpack_exports__.buildOperationContext;
+exports.deleteHeader = __webpack_exports__.deleteHeader;
+exports.findHeaderKey = __webpack_exports__.findHeaderKey;
+exports.firstHeaderValue = __webpack_exports__.firstHeaderValue;
+exports.isEmptyDomain = __webpack_exports__.isEmptyDomain;
+exports.isSecuredRequestId = __webpack_exports__.isSecuredRequestId;
+exports.parseTraceparentValue = __webpack_exports__.parseTraceparentValue;
+exports.readHeader = __webpack_exports__.readHeader;
+exports.resolveConfiguredRequest = __webpack_exports__.resolveConfiguredRequest;
+exports.toOrigin = __webpack_exports__.toOrigin;
+exports.validateOperationContract = __webpack_exports__.validateOperationContract;
+exports.writeHeader = __webpack_exports__.writeHeader;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "CrossOriginEnvelopePolicyError",
+    "IdentityBindingViolationError",
+    "OperationContractViolationError",
+    "ProducerClientNotInitializedError",
+    "ProducerDomainNotConfiguredError",
+    "TRACEPARENT_HEADER",
+    "attachOperationContextHeaders",
+    "buildEnvelopeHeaderValue",
+    "buildOperationContext",
+    "deleteHeader",
+    "findHeaderKey",
+    "firstHeaderValue",
+    "isEmptyDomain",
+    "isSecuredRequestId",
+    "parseTraceparentValue",
+    "readHeader",
+    "resolveConfiguredRequest",
+    "toOrigin",
+    "validateOperationContract",
+    "writeHeader"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});