@beignet/core 0.0.26 → 0.0.28

package/src/server/server.ts

@@ -53,6 +53,7 @@ import type {
   HttpRequestLike,
   HttpResponse,
   HttpResponseLike,
+  RequestStageTimings,
   ResolvedRoute,
   RouteHook,
   ServerCaughtErrorHook,
@@ -61,6 +62,11 @@ import type {
 } from "./http.js";
 import type { ServerInstrumentationOptions } from "./instrumentation.js";
 import { createServerInstrumentation } from "./instrumentation.js";
+import {
+  getResponseFinalizerHook,
+  type ResponseFinalizerResponseOwner,
+  type ResponseFinalizerValidationState,
+} from "./internal-hooks.js";
 import {
   loadProviderConfig,
   parseStandardSchema,
@@ -71,6 +77,7 @@ import {
   enterActiveRequestContext,
   readContextActor,
   readContextTenant,
+  runWithActiveRequestContext,
   setActiveRequestIdentity,
 } from "./request-context.js";
 import type {
@@ -398,6 +405,30 @@ interface RouteBuilder<Ctx, C extends HttpContractConfig> {
   ) => (req: HttpRequestLike) => Promise<HttpResponse>;
 }
 
+/**
+ * Identity and hook metadata for a raw route.
+ *
+ * Raw routes are mounted by the adapter at their own path, so `method` and
+ * `path` describe the route to hooks, instrumentation, and error mapping
+ * instead of driving routing. `metadata` feeds metadata-driven hooks exactly
+ * like contract metadata does, for example `rateLimit` and `idempotency`.
+ */
+export type RawRouteInit = {
+  name: string;
+  method: HttpContractConfig["method"];
+  path: string;
+  metadata?: HttpContractConfig["metadata"];
+};
+
+/**
+ * Builder returned by `server.rawRoute(...)`.
+ */
+export interface RawRouteBuilder<Ctx> {
+  handle: (
+    fn: Handler<Ctx, HttpContractConfig>,
+  ) => (req: HttpRequestLike) => Promise<HttpResponse>;
+}
+
 /**
  * Runtime server object returned by `createServer(...)`.
  */
@@ -416,6 +447,21 @@ export interface ServerInstance<
   route: <CLike extends ContractLike>(
     contractLike: CLike,
   ) => RouteBuilder<Ctx, ResolveContract<CLike>>;
+  /**
+   * Build a handler for a route that cannot be a contract — webhooks,
+   * third-party auth callbacks, streaming endpoints — that still runs the
+   * whole server pipeline: correlation, `onRequest`, route hooks,
+   * `beforeHandle`, `beforeSend`, `afterSend`, context creation,
+   * instrumentation, and framework error mapping.
+   *
+   * Request parsing and validation are skipped and the request body is left
+   * unconsumed, so the handler owns body reading — for example webhook
+   * signature verification over the exact raw bytes. Metadata-driven hooks
+   * such as rate limiting and idempotency read `init.metadata`. Raw routes
+   * are not added to the route registry; mount the returned handler at the
+   * route's own path.
+   */
+  rawRoute: (init: RawRouteInit) => RawRouteBuilder<Ctx>;
   /**
    * Build a fully assembled request context from a framework-neutral request.
    *
@@ -428,10 +474,31 @@ export interface ServerInstance<
    * tasks, and background work.
    *
    * Requires `context.service` to be declared in `createServer(...)`.
+   *
+   * Only call this from long-lived runtimes such as servers, workers, and
+   * `bun test`. It enters the ambient correlation context with
+   * `AsyncLocalStorage.enterWith`, and resuming that frame across top-level
+   * await crashes Bun 1.3.x in plain scripts. Seeds and one-off scripts must
+   * use `runServiceContext(...)` instead.
    */
   createServiceContext: (
     ...args: ServiceContextInputArgs<ServiceInput>
   ) => Promise<Ctx>;
+  /**
+   * Build a service context and run `fn` inside a scoped ambient correlation
+   * frame, returning its result.
+   *
+   * This is the script-safe counterpart to `createServiceContext(...)`: the
+   * ambient frame is entered with `AsyncLocalStorage.run`, so plain scripts
+   * such as seeds and one-off maintenance work stay safe under top-level
+   * await. Requires `context.service` to be declared in `createServer(...)`.
+   */
+  runServiceContext: <T>(
+    ...args: [
+      ...ServiceContextInputArgs<ServiceInput>,
+      fn: (ctx: Ctx) => T | Promise<T>,
+    ]
+  ) => Promise<T>;
   /**
    * Contract configs registered through the `routes` option.
    */
@@ -453,7 +520,7 @@ type ExecutionResult<Ctx> = {
   owner?: ResponseOwner;
 };
 
-type ResponseOwner = "route" | "framework" | "transport";
+type ResponseOwner = ResponseFinalizerResponseOwner;
 
 type CompiledPath = {
   keys: string[];
@@ -1103,6 +1170,12 @@ function createRequestExecutor<
   routeHooks: readonly RouteHook<unknown, object>[] = [],
   optionsOverrides?: {
     skipRoutePreparation?: boolean;
+    /**
+     * Run the route through the full hook pipeline without contract
+     * preparation: no query/path/header/body parsing or validation, and the
+     * request body is left unconsumed for the handler.
+     */
+    rawRoute?: boolean;
   },
 ): (
   target: ExecutionTarget<Ctx, C>,
@@ -1124,6 +1197,27 @@ function createRequestExecutor<
     let headersValue: HandlerArgs<Ctx, C>["headers"] | undefined;
     let bodyValue: HandlerArgs<Ctx, C>["body"] | undefined;
     const startedAt = Date.now();
+    // Stage timings accumulate because retries re-enter the send phase and
+    // beforeHandle spans the route-hook and server-hook loops.
+    const stages: RequestStageTimings = {
+      onRequestMs: 0,
+      parseMs: 0,
+      contextMs: 0,
+      beforeHandleMs: 0,
+      handlerMs: 0,
+      sendMs: 0,
+    };
+    const timeStage = async <T>(
+      stage: keyof RequestStageTimings,
+      run: () => Promise<T> | T,
+    ): Promise<T> => {
+      const stageStartedAt = performance.now();
+      try {
+        return await run();
+      } finally {
+        stages[stage] += performance.now() - stageStartedAt;
+      }
+    };
 
     const resolveErrorResult = async (
       error: unknown,
@@ -1463,8 +1557,64 @@ function createRequestExecutor<
         }
       };
 
+      const applyResponseFinalizerHooks = async (
+        initialResult: ExecutionResult<Ctx>,
+        allowRetry: boolean,
+        responseValidation: ResponseFinalizerValidationState,
+      ): Promise<ExecutionResult<Ctx>> => {
+        const response = normalizeHttpResponse(initialResult.response);
+        const native = isWebResponse(response);
+        const owner = responseOwnerFor(response, initialResult.owner);
+
+        try {
+          for (const hook of hooks) {
+            const finalizer = getResponseFinalizerHook<Ctx>(hook);
+            if (!finalizer) continue;
+            await finalizer({
+              req,
+              ctx: initialResult.ctx,
+              contract,
+              path: pathValue,
+              query: queryValue,
+              headers: headersValue,
+              body: bodyValue,
+              response: responseForHooks(response),
+              error: initialResult.error,
+              native: native ? true : undefined,
+              owner,
+              responseValidation,
+            });
+          }
+
+          return {
+            ...initialResult,
+            response,
+          };
+        } catch (error) {
+          const mapped = await resolveErrorResult(
+            error,
+            initialResult.ctx,
+            pathValue,
+            queryValue,
+            headersValue,
+            bodyValue,
+            { owner: "framework" },
+          );
+          if (!allowRetry) {
+            return mapped;
+          }
+          const transformed = await applyTransformHooks(mapped, true);
+          return applyResponseFinalizerHooks(
+            transformed,
+            false,
+            "not-applicable",
+          );
+        }
+      };
+
       let result: ExecutionResult<Ctx> | undefined;
 
+      const onRequestStartedAt = performance.now();
       for (const hook of hooks) {
         if (!hook.onRequest) continue;
         try {
@@ -1495,14 +1645,14 @@ function createRequestExecutor<
           break;
         }
       }
+      stages.onRequestMs = performance.now() - onRequestStartedAt;
 
       if (!result) {
         if (optionsOverrides?.skipRoutePreparation) {
           let createdCtx!: Ctx;
           try {
-            createdCtx = await contextRuntime.createRequestContext(
-              req,
-              contract,
+            createdCtx = await timeStage("contextMs", () =>
+              contextRuntime.createRequestContext(req, contract),
             );
             baseCtx = createdCtx;
           } catch (error) {
@@ -1522,15 +1672,17 @@ function createRequestExecutor<
               result = {
                 ctx: createdCtx,
                 response: normalizeHttpResponse(
-                  await userHandler({
-                    req,
-                    ctx: createdCtx,
-                    contract,
-                    path: {} as HandlerArgs<Ctx, C>["path"],
-                    query: {} as HandlerArgs<Ctx, C>["query"],
-                    headers: rawHeaders as HandlerArgs<Ctx, C>["headers"],
-                    body: undefined as HandlerArgs<Ctx, C>["body"],
-                  }),
+                  await timeStage("handlerMs", () =>
+                    userHandler({
+                      req,
+                      ctx: createdCtx,
+                      contract,
+                      path: {} as HandlerArgs<Ctx, C>["path"],
+                      query: {} as HandlerArgs<Ctx, C>["query"],
+                      headers: rawHeaders as HandlerArgs<Ctx, C>["headers"],
+                      body: undefined as HandlerArgs<Ctx, C>["body"],
+                    }),
+                  ),
                 ),
                 owner: "framework",
               };
@@ -1547,6 +1699,7 @@ function createRequestExecutor<
             }
           }
         } else {
+          const parseStartedAt = performance.now();
           const rawQuery: Record<string, string | string[]> = {};
           for (const key of new Set(url.searchParams.keys())) {
             const values = url.searchParams.getAll(key);
@@ -1619,7 +1772,9 @@ function createRequestExecutor<
 
           // biome-ignore lint/suspicious/noExplicitAny: Type will be narrowed by schema validation
           let body: any;
-          if (!result) {
+          // Raw routes own body consumption: the handler reads `req` itself,
+          // for example to verify a webhook signature over the exact bytes.
+          if (!result && !optionsOverrides?.rawRoute) {
             try {
               body = await parseBody(req, maxRequestBodyBytes);
             } catch (error) {
@@ -1686,6 +1841,8 @@ function createRequestExecutor<
             }
           }
 
+          stages.parseMs = performance.now() - parseStartedAt;
+
           if (!result) {
             pathValue = path;
             queryValue = query;
@@ -1694,9 +1851,8 @@ function createRequestExecutor<
 
             let createdCtx!: Ctx;
             try {
-              createdCtx = await contextRuntime.createRequestContext(
-                req,
-                contract,
+              createdCtx = await timeStage("contextMs", () =>
+                contextRuntime.createRequestContext(req, contract),
               );
               baseCtx = createdCtx;
             } catch (error) {
@@ -1723,10 +1879,10 @@ function createRequestExecutor<
               };
 
               let currentCtx = createdCtx;
-              for (const hook of hooks) {
-                if (!hook.beforeHandle) continue;
+              const beforeHandleStartedAt = performance.now();
+              for (const hook of routeHooks) {
                 try {
-                  const hookResult = await hook.beforeHandle({
+                  const additions = await hook.resolve({
                     req,
                     ctx: currentCtx,
                     contract,
@@ -1735,33 +1891,11 @@ function createRequestExecutor<
                     headers,
                     body,
                   });
-                  if (isWebResponse(hookResult)) {
-                    result = {
-                      ctx: currentCtx,
-                      response: hookResult,
-                      owner: "transport",
-                    };
-                    break;
-                  }
-                  if (isHttpResponseLike(hookResult)) {
-                    result = {
-                      ctx: currentCtx,
-                      response: normalizeResponse(hookResult),
-                      owner: "framework",
-                    };
-                    break;
-                  }
-                  if (hookResult?.ctx !== undefined) {
-                    currentCtx = contextRuntime.finalizeContext(hookResult.ctx);
-                  }
-                  if (hookResult?.response) {
-                    const response = normalizeHttpResponse(hookResult.response);
-                    result = {
-                      ctx: currentCtx,
-                      response,
-                      owner: responseOwnerFor(response, "framework"),
-                    };
-                    break;
+                  if (additions && typeof additions === "object") {
+                    currentCtx = contextRuntime.finalizeContext({
+                      ...(currentCtx as object),
+                      ...additions,
+                    } as Ctx);
                   }
                 } catch (error) {
                   result = await resolveErrorResult(
@@ -1778,9 +1912,10 @@ function createRequestExecutor<
               }
 
               if (!result) {
-                for (const hook of routeHooks) {
+                for (const hook of hooks) {
+                  if (!hook.beforeHandle) continue;
                   try {
-                    const additions = await hook.resolve({
+                    const hookResult = await hook.beforeHandle({
                       req,
                       ctx: currentCtx,
                       contract,
@@ -1789,11 +1924,37 @@ function createRequestExecutor<
                       headers,
                       body,
                     });
-                    if (additions && typeof additions === "object") {
-                      currentCtx = contextRuntime.finalizeContext({
-                        ...(currentCtx as object),
-                        ...additions,
-                      } as Ctx);
+                    if (isWebResponse(hookResult)) {
+                      result = {
+                        ctx: currentCtx,
+                        response: hookResult,
+                        owner: "transport",
+                      };
+                      break;
+                    }
+                    if (isHttpResponseLike(hookResult)) {
+                      result = {
+                        ctx: currentCtx,
+                        response: normalizeResponse(hookResult),
+                        owner: "framework",
+                      };
+                      break;
+                    }
+                    if (hookResult?.ctx !== undefined) {
+                      currentCtx = contextRuntime.finalizeContext(
+                        hookResult.ctx,
+                      );
+                    }
+                    if (hookResult?.response) {
+                      const response = normalizeHttpResponse(
+                        hookResult.response,
+                      );
+                      result = {
+                        ctx: currentCtx,
+                        response,
+                        owner: responseOwnerFor(response, "framework"),
+                      };
+                      break;
                     }
                   } catch (error) {
                     result = await resolveErrorResult(
@@ -1809,6 +1970,7 @@ function createRequestExecutor<
                   }
                 }
               }
+              stages.beforeHandleMs = performance.now() - beforeHandleStartedAt;
 
               if (!result) {
                 // Hooks may have elevated the actor or resolved a tenant.
@@ -1823,7 +1985,9 @@ function createRequestExecutor<
                   result = {
                     ctx: currentCtx,
                     response: normalizeHttpResponse(
-                      await userHandler({ ...baseArgs, ctx: currentCtx }),
+                      await timeStage("handlerMs", () =>
+                        userHandler({ ...baseArgs, ctx: currentCtx }),
+                      ),
                     ),
                   };
                 } catch (error) {
@@ -1842,12 +2006,21 @@ function createRequestExecutor<
         }
       }
 
+      const sendStartedAt = performance.now();
       result = await applyTransformHooks(result, true);
 
       let finalResponse = normalizeHttpResponse(result.response);
       let finalError = result.error;
       let finalOwner = responseOwnerFor(finalResponse, result.owner);
+      let responseValidation: ResponseFinalizerValidationState =
+        "not-applicable";
       if (
+        finalOwner === "route" &&
+        !isWebResponse(finalResponse) &&
+        !(options.validateResponses ?? true)
+      ) {
+        responseValidation = "disabled";
+      } else if (
         finalOwner === "route" &&
         !isWebResponse(finalResponse) &&
         (options.validateResponses ?? true)
@@ -1858,33 +2031,52 @@ function createRequestExecutor<
             finalResponse,
             target.responseValidationExemptStatus,
           );
+          result = {
+            ...result,
+            response: finalResponse,
+          };
+          responseValidation = "validated";
         } catch (error) {
           if (error instanceof ResponseContractViolationError) {
-            result = await applyTransformHooks(
-              {
-                ctx: result.ctx,
-                response: toContractViolationResponse(error),
-                error,
-                owner: "framework",
-              },
-              false,
-            );
+            result = {
+              ctx: result.ctx,
+              response: toContractViolationResponse(error),
+              error,
+              owner: "framework",
+            };
+            finalResponse = normalizeHttpResponse(result.response);
+            finalError = result.error;
+            finalOwner = responseOwnerFor(finalResponse, result.owner);
+            result = await applyTransformHooks(result, true);
             finalResponse = normalizeHttpResponse(result.response);
             finalError = result.error;
             finalOwner = responseOwnerFor(finalResponse, result.owner);
+            responseValidation = "not-applicable";
           } else {
             throw error;
           }
         }
       }
+
+      result = await applyResponseFinalizerHooks(
+        result,
+        true,
+        responseValidation,
+      );
+      finalResponse = normalizeHttpResponse(result.response);
+      finalError = result.error;
+      finalOwner = responseOwnerFor(finalResponse, result.owner);
+
       if (!isWebResponse(finalResponse)) {
         finalResponse = withFrameworkErrorOwnerHeader(
           finalResponse,
           finalOwner,
         );
       }
+      stages.sendMs = performance.now() - sendStartedAt;
 
       const durationMs = Date.now() - startedAt;
+      const stageTimings = roundStageTimings(stages);
       for (const hook of hooks) {
         if (!hook.afterSend) continue;
         try {
@@ -1899,6 +2091,7 @@ function createRequestExecutor<
             response: responseForHooks(finalResponse),
             error: finalError,
             durationMs,
+            stages: stageTimings,
           });
         } catch {
           // Ignore after-response hook failures; they should never change the response.
@@ -1954,6 +2147,12 @@ function buildHandler<
   routeHooks: readonly RouteHook<unknown, object>[] = [],
   optionsOverrides?: {
     skipRoutePreparation?: boolean;
+    /**
+     * Run the route through the full hook pipeline without contract
+     * preparation: no query/path/header/body parsing or validation, and the
+     * request body is left unconsumed for the handler.
+     */
+    rawRoute?: boolean;
   },
   responseValidationExemptStatus?: number,
 ): (
@@ -2032,6 +2231,11 @@ export async function createServer<
   ];
   const contracts = options.routes ? contractsFromRoutes(options.routes) : [];
 
+  // Fail startup on hook misconfiguration before provider setup runs.
+  for (const hook of hooks) {
+    hook.validate?.({ contracts });
+  }
+
   const resolvedContext = resolveServerContext<Ctx, FinalPorts, ServiceInput>(
     options.context,
   );
@@ -2089,6 +2293,46 @@ export async function createServer<
     ambient.tenant = readContextTenant(ctx);
     return ctx;
   };
+  const runServiceContext = async <T>(
+    ...args: [
+      ...ServiceContextInputArgs<ServiceInput>,
+      fn: (ctx: Ctx) => T | Promise<T>,
+    ]
+  ): Promise<T> => {
+    const serviceFactory = resolvedContext.service;
+    if (!serviceFactory) {
+      throw new Error(
+        "Define context.service in createServer(...) to create service contexts.",
+      );
+    }
+
+    const fn = args[args.length - 1] as (ctx: Ctx) => T | Promise<T>;
+    const input = (args.length > 1 ? args[0] : undefined) as ServiceInput;
+    const { requestId, trace } = instrumentation.createServiceCorrelation();
+    const ambient: ActiveRequestContext = {
+      requestId,
+      traceId: trace.traceId,
+      spanId: trace.spanId,
+      parentSpanId: trace.parentSpanId,
+      traceparent: trace.traceparent,
+    };
+    // AsyncLocalStorage.run scopes the ambient frame to this callback, so the
+    // caller's continuation never resumes through an enterWith frame — the
+    // pattern that crashes Bun 1.3.x in plain scripts under top-level await.
+    return runWithActiveRequestContext(ambient, async () => {
+      const ctx = finalizeContext(
+        await serviceFactory({
+          ports: finalPorts,
+          input,
+          requestId,
+          trace,
+        }),
+      );
+      ambient.actor = readContextActor(ctx);
+      ambient.tenant = readContextTenant(ctx);
+      return await fn(ctx);
+    });
+  };
   const contextRuntime = {
     createRequestContext,
     finalizeContext,
@@ -2424,14 +2668,59 @@ export async function createServer<
       const contract = resolveContract(contractLike);
       return createBuilder(contract, true);
     },
+    rawRoute: (init) => ({
+      handle: (fn) => {
+        const built = buildHandler(
+          options,
+          finalPorts,
+          contextRuntime,
+          rawRouteContract(init),
+          fn,
+          hooks,
+          [],
+          { rawRoute: true },
+        );
+        // The adapter owns routing for raw routes — the handler is mounted
+        // at its own path — so path/method matching is skipped and
+        // `init.path` stays identity for hooks and instrumentation.
+        return (req) => built(req, {});
+      },
+    }),
     createRequestContext: (req) => createRequestContext(req),
     createServiceContext,
+    runServiceContext,
     contracts,
     stop,
     ports: finalPorts,
   };
 }
 
+function roundStageTimings(stages: RequestStageTimings): RequestStageTimings {
+  const round = (value: number) => Math.round(value * 100) / 100;
+  return {
+    onRequestMs: round(stages.onRequestMs),
+    parseMs: round(stages.parseMs),
+    contextMs: round(stages.contextMs),
+    beforeHandleMs: round(stages.beforeHandleMs),
+    handlerMs: round(stages.handlerMs),
+    sendMs: round(stages.sendMs),
+  };
+}
+
+function rawRouteContract(init: RawRouteInit): HttpContractConfig {
+  return {
+    kind: "http",
+    name: init.name,
+    method: init.method,
+    path: init.path,
+    pathParams: null,
+    query: null,
+    body: null,
+    responses: {},
+    metadata: init.metadata ?? {},
+  };
+}
+
 /**
  * Define and flatten route registrations with strong type inference.
  *

package/src/tasks/index.ts

@@ -121,6 +121,29 @@ export interface RunTaskOptions<Ctx> {
   ctx: Ctx;
 }
 
+/**
+ * Arguments `beignet task run` passes to the app's `createTaskContext` and
+ * `stopTaskContext` exports in `server/tasks.ts`.
+ */
+export interface TaskRunContextArgs<T extends TaskDef = TaskDef> {
+  /**
+   * Task definition being run.
+   */
+  task: T;
+  /**
+   * Stable task name being run.
+   */
+  taskName: string;
+  /**
+   * Schema-parsed task input.
+   */
+  input: unknown;
+  /**
+   * Tenant id or slug from `--tenant`, resolved by the app.
+   */
+  tenant?: string;
+}
+
 /**
  * Context-bound operational task helper factory.
  */