@beignet/core 0.0.36 → 0.0.38

package/src/tracing/index.ts

@@ -9,6 +9,29 @@
  */
 
 const TRACEPARENT_PATTERN = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+const MAX_TRACESTATE_LENGTH = 512;
+const MAX_TRACESTATE_MEMBERS = 32;
+const TRACESTATE_SIMPLE_KEY_PATTERN = /^[a-z][a-z0-9_*/-]{0,255}$/;
+const TRACESTATE_VENDOR_KEY_PATTERN =
+  /^[a-z0-9][a-z0-9_*/-]{0,240}@[a-z][a-z0-9_*/-]{0,13}$/;
+const TRACESTATE_VALUE_PATTERN =
+  /^[\x20-\x2b\x2d-\x3c\x3e-\x7e]{0,255}[\x21-\x2b\x2d-\x3c\x3e-\x7e]$/;
+
+/** Current version of Beignet's durable trace carrier. */
+export const TRACE_CARRIER_VERSION = 1 as const;
+
+/**
+ * Vendor-neutral trace context stored in durable messages and transport
+ * envelopes. Unknown versions and malformed values are ignored by consumers.
+ */
+export interface TraceCarrier {
+  /** Carrier schema version. */
+  readonly version: typeof TRACE_CARRIER_VERSION;
+  /** W3C traceparent value captured at the producing boundary. */
+  readonly traceparent: string;
+  /** Optional W3C tracestate value captured at the producing boundary. */
+  readonly tracestate?: string;
+}
 
 /**
  * Trace context used to correlate related activity.
@@ -161,6 +184,103 @@ export function resolveTracingPort(target: unknown): TracingPort | undefined {
   return resolveTracingPort(ports);
 }
 
+function validTracestate(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length > MAX_TRACESTATE_LENGTH) {
+    return undefined;
+  }
+
+  const members = normalized.split(",");
+  if (members.length > MAX_TRACESTATE_MEMBERS) return undefined;
+
+  const keys = new Set<string>();
+  for (const rawMember of members) {
+    const member = rawMember.trim();
+    const separator = member.indexOf("=");
+    if (separator <= 0) return undefined;
+
+    const key = member.slice(0, separator).trim();
+    const memberValue = member.slice(separator + 1).trimStart();
+    if (
+      (!TRACESTATE_SIMPLE_KEY_PATTERN.test(key) &&
+        !TRACESTATE_VENDOR_KEY_PATTERN.test(key)) ||
+      !TRACESTATE_VALUE_PATTERN.test(memberValue) ||
+      keys.has(key)
+    ) {
+      return undefined;
+    }
+    keys.add(key);
+  }
+
+  return normalized;
+}
+
+/**
+ * Parse an untrusted durable trace carrier.
+ *
+ * Invalid carriers return `undefined`; trace metadata must never prevent
+ * message delivery.
+ */
+export function parseTraceCarrier(value: unknown): TraceCarrier | undefined {
+  if (!isObject(value) || value.version !== TRACE_CARRIER_VERSION) {
+    return undefined;
+  }
+
+  const parsed = parseTraceparent(
+    typeof value.traceparent === "string" ? value.traceparent : undefined,
+  );
+  if (!parsed) return undefined;
+
+  if (value.tracestate !== undefined) {
+    const tracestate = validTracestate(value.tracestate);
+    if (!tracestate) return undefined;
+    return {
+      version: TRACE_CARRIER_VERSION,
+      traceparent: parsed.traceparent,
+      tracestate,
+    };
+  }
+
+  return {
+    version: TRACE_CARRIER_VERSION,
+    traceparent: parsed.traceparent,
+  };
+}
+
+/**
+ * Capture the current trace context from a tracing port, ports object, app
+ * context, or explicit trace context. Returns `undefined` when no valid
+ * context is available.
+ */
+export function captureTraceCarrier(target: unknown): TraceCarrier | undefined {
+  let context: TraceContextInput | undefined;
+  try {
+    context = resolveTraceContextInput(target);
+  } catch {
+    // Context-like inputs may be proxy-backed and reject unknown properties.
+  }
+
+  try {
+    context = resolveTracingPort(target)?.current() ?? context;
+  } catch {
+    // Tracing is best-effort and must not block the owning operation.
+  }
+
+  try {
+    if (!context?.traceparent) return undefined;
+
+    return parseTraceCarrier({
+      version: TRACE_CARRIER_VERSION,
+      traceparent: context.traceparent,
+      ...(context.tracestate ? { tracestate: context.tracestate } : {}),
+    });
+  } catch {
+    // Trace contexts are app-provided and remain best-effort inputs.
+    return undefined;
+  }
+}
+
 /** Resolve trace fields from a trace context or context-like object. */
 export function resolveTraceContextInput(
   target: unknown,

package/src/uploads/index.ts

@@ -1036,6 +1036,7 @@ export function createUploadRouter<Ctx>(
       assertFiles(definition, intents, { requireChecksum: false });
 
       const completed: CompletedUploadFile[] = [];
+      const storedKeys: string[] = [];
       for (const [index, file] of webFiles.entries()) {
         const intent = intents[index];
         if (!intent) continue;
@@ -1072,18 +1073,24 @@ export function createUploadRouter<Ctx>(
           metadata: storageMetadata,
           visibility: definition.file.visibility ?? "private",
         });
+        storedKeys.push(key);
         const completedFile = {
           ...verifiedIntent,
           uploadId,
           key,
           object,
         };
-        await assertVerifiedFile(definition, {
-          ctx,
-          metadata,
-          file: completedFile,
-          storage: options.storage,
-        });
+        try {
+          await assertVerifiedFile(definition, {
+            ctx,
+            metadata,
+            file: completedFile,
+            storage: options.storage,
+          });
+        } catch (error) {
+          await cleanupRejectedServerUpload(uploadName, storedKeys);
+          throw error;
+        }
         completed.push(completedFile);
       }
 
@@ -1114,6 +1121,37 @@ export function createUploadRouter<Ctx>(
     }
   }
 
+  async function cleanupRejectedServerUpload(
+    uploadName: string,
+    keys: readonly string[],
+  ): Promise<void> {
+    const failures: Array<{ key: string; error: string }> = [];
+
+    await Promise.all(
+      keys.map(async (key) => {
+        try {
+          await options.storage.delete(key);
+        } catch (error) {
+          failures.push({
+            key,
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }),
+    );
+
+    if (failures.length === 0) return;
+    instrumentation.custom({
+      name: "upload.server.cleanup.failed",
+      label: "Rejected upload cleanup failed",
+      summary: uploadName,
+      details: {
+        uploadName,
+        failures,
+      },
+    });
+  }
+
   function recordFailure(
     name: string,
     uploadName: string,

package/src/webhooks/index.ts

@@ -133,7 +133,8 @@ export type HmacWebhookTimestampFormat =
 export type HmacWebhookTimestampOptions =
   | {
       /**
-       * Header that carries the provider event timestamp.
+       * Header that carries the provider event timestamp. Header timestamps
+       * are authenticated as `<timestamp>.<rawBody>`.
        */
       header: string;
       payloadPath?: never;
@@ -461,7 +462,12 @@ export function createHmacWebhookVerifier(
         });
       }
 
-      const expected = await hmacHex(algorithm, options.secret, input.rawBody);
+      const signedBody = hmacSignedBody({
+        input,
+        provider: options.provider,
+        timestamp,
+      });
+      const expected = await hmacHex(algorithm, options.secret, signedBody);
       const actual = normalizeSignature(signature, options.signaturePrefix);
       if (!(await timingSafeStringEqual(actual, expected))) {
         throw new WebhookVerificationError({
@@ -573,6 +579,32 @@ function rawBodyText(rawBody: WebhookRawBody): string {
   return new TextDecoder().decode(rawBodyBytes(rawBody));
 }
 
+function hmacSignedBody(args: {
+  input: VerifyWebhookInput;
+  provider: string | undefined;
+  timestamp: NormalizedHmacTimestampOptions | undefined;
+}): WebhookRawBody {
+  if (!args.timestamp || args.timestamp.source === "payload") {
+    return args.input.rawBody;
+  }
+
+  const value = args.input.headers?.[args.timestamp.key];
+  if (value === undefined || value === null || value === "") {
+    throw new WebhookVerificationError({
+      message: `Missing ${args.timestamp.key} header.`,
+      provider: args.provider,
+      code: "missing_timestamp",
+    });
+  }
+
+  const prefix = new TextEncoder().encode(`${value}.`);
+  const body = rawBodyBytes(args.input.rawBody);
+  const signed = new Uint8Array(prefix.byteLength + body.byteLength);
+  signed.set(prefix);
+  signed.set(body, prefix.byteLength);
+  return signed;
+}
+
 function parseJsonBody(rawBody: WebhookRawBody): unknown {
   try {
     return JSON.parse(rawBodyText(rawBody));

package/dist/domain/events.d.ts

@@ -1,44 +0,0 @@
-import type { EventDef, InferEventPayload, StandardSchema } from "../events/index.js";
-/**
- * Domain event definition with a stable name and payload schema.
- */
-export type DomainEventDef<Name extends string = string, Payload extends StandardSchema = StandardSchema> = EventDef<Name, Payload>;
-/**
- * Infer the payload type from a DomainEventDef.
- *
- * @example
- * ```ts
- * const UserRegistered = defineDomainEvent(
- *   "user.registered",
- *   z.object({
- *     userId: z.string(),
- *     email: z.string().email(),
- *   })
- * );
- *
- * type Payload = InferEventPayload<typeof UserRegistered>;
- * // { userId: string; email: string }
- * ```
- */
-export type { InferEventPayload };
-/**
- * Create a new domain event definition.
- *
- * This is a domain-focused alias around `defineEvent(...)` for applications
- * that separate domain events from integration events.
- *
- * @example
- * ```ts
- * const UserRegistered = defineDomainEvent(
- *   "user.registered",
- *   z.object({
- *     userId: z.string(),
- *     email: z.string().email(),
- *   })
- * );
- *
- * type UserRegistered = typeof UserRegistered;
- * ```
- */
-export declare function defineDomainEvent<Name extends string, Payload extends StandardSchema>(name: Name, payload: Payload): DomainEventDef<Name, Payload>;
-//# sourceMappingURL=events.d.ts.map

package/dist/domain/events.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/domain/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACf,MAAM,oBAAoB,CAAC;AAG5B;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,OAAO,SAAS,cAAc,GAAG,cAAc,IAC7C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS,cAAc,EAC9B,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAE7D"}

package/dist/domain/events.js

@@ -1,24 +0,0 @@
-import { defineEvent } from "../events/index.js";
-/**
- * Create a new domain event definition.
- *
- * This is a domain-focused alias around `defineEvent(...)` for applications
- * that separate domain events from integration events.
- *
- * @example
- * ```ts
- * const UserRegistered = defineDomainEvent(
- *   "user.registered",
- *   z.object({
- *     userId: z.string(),
- *     email: z.string().email(),
- *   })
- * );
- *
- * type UserRegistered = typeof UserRegistered;
- * ```
- */
-export function defineDomainEvent(name, payload) {
-    return defineEvent(name, { payload });
-}
-//# sourceMappingURL=events.js.map

package/dist/domain/events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/domain/events.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6BjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAG/B,IAAU,EAAE,OAAgB;IAC5B,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACxC,CAAC"}