unnbound-events 2.1.0-beta.2 → 3.0.0-beta.0

package/README.md

@@ -1,6 +1,6 @@
 # Unnbound Events SDK
 
-Unified HTTP and SQS queue routing with a single API. Register handlers once, handle requests from both transports.
+Unified HTTP and SQS queue routing with a single API. Register handlers once, handle requests from both transports. `c.request.body` is always an `ArrayBuffer` of the exact bytes received on the wire — the SDK never parses; decoding is an explicit workflow choice.
 
 ## Install
 
@@ -18,7 +18,7 @@ const server = createServer();
 // Register route handlers
 server.post('/email/:userId', async (c) => {
   const { userId } = c.request.params;
-  const body = c.request.body;
+  const payload = JSON.parse(Buffer.from(c.request.body).toString('utf8'));
 
   return { status: 200, body: { sent: true } };
 });
@@ -36,7 +36,7 @@ The server automatically:
 
 ## Handlers
 
-Routes receive a context object with request details:
+Routes receive a context object with request details. `c.request.body` is an `ArrayBuffer` containing the entity exactly as received on the wire, for **every** content type (zero-length when there is no body) — decode what you need inside the handler:
 
 ```ts
 server.post('/users/:id', async (c) => {
@@ -44,21 +44,59 @@ server.post('/users/:id', async (c) => {
   const { id } = c.request.params;
   const query = c.request.query;
   const headers = c.request.headers;
-  const body = c.request.body;
+
+  // Decode the raw bytes for the payload you expect:
+
+  // JSON
+  const payload = JSON.parse(Buffer.from(c.request.body).toString('utf8'));
+
+  // Text
+  const text = new TextDecoder().decode(c.request.body);
+
+  // Multipart / form-data (boundary comes from the original content-type header)
+  const form = await new Response(c.request.body, {
+    headers: { 'content-type': c.request.headers['content-type'] },
+  }).formData();
+
+  // URL-encoded forms
+  const params = new URLSearchParams(Buffer.from(c.request.body).toString('utf8'));
+
+  // XML, EDI, CSV: use the library the workflow already depends on (xml2js, csv, @ontemper/edi)
 
   // Return response
   return {
     status: 200,
-    body: { id, ...body },
+    body: { id },
     headers: { 'x-custom': 'value' },
   };
 });
 ```
 
-**Response format:** `{ status?: number, body?: object, headers?: Record<string, string> }`
+**Response format:** `{ status?: number, body?: object | Uint8Array | ArrayBuffer, headers?: Record<string, string> }`
+
+Objects are JSON-serialized. `Uint8Array`/`ArrayBuffer` bodies are sent verbatim as binary (set `content-type` explicitly) — required for protocols like AS2 whose responses must not be JSON-mangled.
 
 Return `undefined`, `null`, or omit properties to default to `204 No Content`.
 
+## Upgrading from 2.0.x
+
+`c.request.body` used to vary by `content-type`. It is now always an `ArrayBuffer` of the exact bytes received.
+
+| `content-type` | 2.0.x | Current version |
+| --- | --- | --- |
+| `application/json` | parsed object | `ArrayBuffer` |
+| `application/x-www-form-urlencoded` | parsed object | `ArrayBuffer` |
+| `multipart/form-data` | parsed object | `ArrayBuffer` |
+| `text/plain` | `string` | `ArrayBuffer` |
+| anything else | `ArrayBuffer` | `ArrayBuffer` |
+
+Handlers for the first four must decode explicitly — see [Handlers](#handlers) for the per-type recipes. Handlers that already received bytes (XML, EDI, CSV, binary) are unaffected.
+
+Two things to check when upgrading an existing workflow:
+
+- A malformed JSON body used to arrive as `undefined`. It now arrives as raw bytes and `JSON.parse` throws — handle it where you decode.
+- `tsc` catches direct property access on the body, but not a body passed straight to a logger or serializer. Those compile clean and emit `{}` at runtime. Audit every `server.post` / `server.put` handler before deploying.
+
 ## Middleware
 
 Add logic that runs before/after handlers. Works for both HTTP and queue requests.

package/dist/index.d.ts

@@ -2,8 +2,6 @@ export { createEnqueuer } from './lib/enqueue';
 export type { ServerErrorOptions } from './lib/error';
 export { ServerError } from './lib/error';
 export type { EventMetadata, EventSource, IncomingEvent, IncomingRequest } from './lib/event';
-export type { As2Prepared, As2RawRequest } from './lib/routing/as2';
-export { as2Endpoint } from './lib/routing/as2';
 export type { Handler } from './lib/routing/endpoint';
 export type { MiddlewareHandler } from './lib/routing/middleware';
 export type { EventVariables, MaybePromise } from './lib/routing/types';

package/dist/index.js

@@ -1,11 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createServer = exports.as2Endpoint = exports.ServerError = exports.createEnqueuer = void 0;
+exports.createServer = exports.ServerError = exports.createEnqueuer = void 0;
 var enqueue_1 = require("./lib/enqueue");
 Object.defineProperty(exports, "createEnqueuer", { enumerable: true, get: function () { return enqueue_1.createEnqueuer; } });
 var error_1 = require("./lib/error");
 Object.defineProperty(exports, "ServerError", { enumerable: true, get: function () { return error_1.ServerError; } });
-var as2_1 = require("./lib/routing/as2");
-Object.defineProperty(exports, "as2Endpoint", { enumerable: true, get: function () { return as2_1.as2Endpoint; } });
 var server_1 = require("./lib/server");
 Object.defineProperty(exports, "createServer", { enumerable: true, get: function () { return server_1.createServer; } });

package/dist/lib/adapters/extended-sqs-client.d.ts

@@ -1,15 +1,29 @@
 import { type S3Client } from '@aws-sdk/client-s3';
 import { type Message, type ReceiveMessageCommand, SQSClient } from '@aws-sdk/client-sqs';
-import type { IncomingEvent, IncomingRequest } from '../event';
+import type { EventMetadata, IncomingRequest } from '../event';
 export interface S3Pointer {
     bucket: string;
     key: string;
 }
 export type S3PointerMessage = ['software.amazon.payloadoffloading.PayloadS3Pointer', S3Pointer];
 type SQSClientConfig = ConstructorParameters<typeof SQSClient>[0];
+/**
+ * Internal SQS envelope before it re-enters the HTTP router. Inline bodies
+ * remain decoded JSON values until QueueAdapter serializes them into request
+ * bytes, so this must not claim the public IncomingRequest body contract.
+ * This distinction changes only the type, not SQS delivery behavior.
+ */
+interface SqsEnvelopeRequest extends Omit<IncomingRequest, 'body'> {
+    body: unknown;
+}
+interface SqsEnvelopeEvent {
+    request: SqsEnvelopeRequest;
+    timestamp: number;
+    metadata: EventMetadata;
+}
 export interface ExtendedSqsMessage {
     message: Message;
-    event: IncomingEvent<IncomingRequest>;
+    event: SqsEnvelopeEvent;
 }
 export type ExtendedSQSClientConfig = SQSClientConfig & {
     s3: S3Client;

package/dist/lib/enqueue.d.ts

@@ -1,7 +1,8 @@
 import type { EventMetadata, IncomingRequest } from './event';
-export interface EnqueuedRequest extends Omit<IncomingRequest, 'url' | 'headers' | 'query'> {
+export interface EnqueuedRequest extends Omit<IncomingRequest, 'url' | 'headers' | 'query' | 'body'> {
     query?: IncomingRequest['query'];
     headers?: IncomingRequest['headers'];
+    body?: unknown;
 }
 /**
  * Create an enqueuer that posts to the ingress service via HTTP.

package/dist/lib/event.d.ts

@@ -1,15 +1,16 @@
 import type { StatusCode } from 'hono/utils/http-status';
 import type { HttpMethod } from 'unnbound-logger-sdk';
-export interface IncomingRequest<B = any> {
+export interface IncomingRequest {
     url: string;
     method: HttpMethod;
     path: string;
     headers: Record<string, string>;
     query: Record<string, any>;
-    body?: B;
+    /** Exact request bytes; empty for bodyless requests. */
+    body: ArrayBuffer;
 }
-export interface MatchedIncomingRequest<B = any> extends IncomingRequest<B> {
-    params?: Record<string, string> | undefined;
+export interface MatchedIncomingRequest extends IncomingRequest {
+    params?: Record<string, string>;
 }
 export type EventSource = 'http' | 'queue';
 export interface EventMetadata {
@@ -31,6 +32,6 @@ export interface StrictEventHandlerResult {
      * AS2 whose responses (signed S/MIME MDNs) must not be JSON-mangled. Set the
      * `content-type` header explicitly when returning binary.
      */
-    body?: object | Uint8Array | ArrayBuffer | undefined | null;
+    body?: object | Uint8Array | ArrayBuffer | null;
 }
-export type EventHandlerResult = Partial<StrictEventHandlerResult> | undefined | null | undefined;
+export type EventHandlerResult = Partial<StrictEventHandlerResult> | null | undefined;

package/dist/lib/routing/endpoint.d.ts

@@ -3,7 +3,6 @@ import type { EventHandlerResult, StrictEventHandlerResult } from '../event';
 import { type MiddlewareHandler } from './middleware';
 import type { EventEnvironment, EventVariables, MaybePromise } from './types';
 export type Handler<I, R = EventHandlerResult> = (input: I) => MaybePromise<R>;
-export declare const markSelfTraced: <I>(handler: (input: I) => Promise<StrictEventHandlerResult>) => Handler<I>;
 export interface Endpoint<I> {
     (path: string, handler: Handler<I>): MaybePromise<void>;
     (path: string, middleware: MiddlewareHandler<I>, handler: Handler<I>): MaybePromise<void>;

package/dist/lib/routing/endpoint.js

@@ -1,21 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.attachTraceHeaders = exports.respondWith = exports.patchEndpoint = exports.parseEndpointArguments = exports.buildEndpointArguments = exports.markSelfTraced = void 0;
+exports.attachTraceHeaders = exports.respondWith = exports.patchEndpoint = exports.parseEndpointArguments = exports.buildEndpointArguments = void 0;
 const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
 const utils_1 = require("../utils");
 const middleware_1 = require("./middleware");
-/**
- * Marks a handler that owns its customer trace and request span. The generic endpoint
- * wrapper binds the header-derived trace before running a handler; AS2 endpoints must
- * instead verify the protocol exchange first and only then choose the trace, so their
- * wrapper (see routing/as2.ts) emits the request span itself and returns a strict result.
- */
-const selfTraced = Symbol.for('unnbound-events.selfTraced');
-const markSelfTraced = (handler) => {
-    return Object.assign(handler, { [selfTraced]: true });
-};
-exports.markSelfTraced = markSelfTraced;
-const isSelfTraced = (handler) => selfTraced in handler;
 const buildEndpointArguments = (...args) => {
     const { path, middlewares, handler } = (0, exports.parseEndpointArguments)(...args);
     const patchedHandler = (0, exports.patchEndpoint)(handler);
@@ -33,12 +21,10 @@ const patchEndpoint = (handler) => {
         const state = context.get('state');
         // We have to recalculate the params because the handler path might contain url params
         state.request.params = { ...state.request.params, ...context.req.param() };
-        const result = isSelfTraced(handler)
-            ? await handler(state)
-            : await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
-                const result = await handler(state);
-                return { status: result?.status ?? 204, headers: result?.headers, body: result?.body };
-            }, (o) => (0, utils_1.buildIncomingPayload)(state, o));
+        const result = await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
+            const result = await handler(state);
+            return { status: result?.status ?? 204, headers: result?.headers, body: result?.body };
+        }, (o) => (0, utils_1.buildIncomingPayload)(state, o));
         return (0, exports.respondWith)(context, result);
     };
 };

package/dist/lib/server.js

@@ -30,7 +30,7 @@ class HttpQueueServer {
         }));
         this.app.onError((err, c) => {
             const error = error_1.ServerError.fromError(err);
-            unnbound_logger_sdk_1.logger.error({ err: error.toError() }, error.message);
+            this.logger.error({ err: error.toError() }, error.message);
             return (0, endpoint_1.respondWith)(c, error.toJson());
         });
         this.http = new http_adapter_1.HttpAdapter({ app: this.app, logger: this.logger, ...options.http });

package/dist/lib/utils.d.ts

@@ -1,10 +1,9 @@
 import type { HonoRequest } from 'hono';
 import { type Maybe } from 'unnbound-logger-sdk/dist/types';
-import type { EventHandlerResult, EventMetadata, EventSource, IncomingEvent, IncomingRequest, MatchedIncomingRequest, StrictEventHandlerResult } from './event';
+import type { EventHandlerResult, EventMetadata, EventSource, IncomingEvent, IncomingRequest, MatchedIncomingRequest } from './event';
 export declare const normalizeHeaders: (headers: Record<string, string | string[]>) => Record<string, string>;
 export declare const getIncomingEvent: (event: HonoRequest) => Promise<IncomingEvent<MatchedIncomingRequest>>;
-export declare const isCanonicalTraceId: (value: string | undefined | null) => value is string;
-export declare const getMetadataFromRequest: (request: IncomingRequest, source: EventSource) => EventMetadata;
+export declare const getMetadataFromRequest: (request: Pick<IncomingRequest, 'headers'>, source: EventSource) => EventMetadata;
 interface ForwardedMetadata {
     source: EventSource;
     timestamp: number;
@@ -26,27 +25,13 @@ export declare const buildIncomingPayload: (event: IncomingEvent<MatchedIncoming
         incoming: boolean;
         request: {
             headers: Record<string, string>;
-            body: object;
+            body: unknown;
         };
-        response?: StrictEventHandlerResult | undefined;
-    };
-};
-export declare const buildAs2IncomingPayload: (event: IncomingEvent<MatchedIncomingRequest>, result?: Maybe<EventHandlerResult>) => {
-    type: string;
-    source: EventSource;
-    delay: number | undefined;
-    http: {
-        url: string;
-        method: string;
-        query: Record<string, any>;
-        params: Record<string, string> | undefined;
-        ip: string | undefined;
-        incoming: boolean;
-        request: {
+        response?: {
+            status: import("hono/utils/http-status").StatusCode;
             headers: Record<string, string>;
-            body: object;
-        };
-        response?: StrictEventHandlerResult | undefined;
+            body: unknown;
+        } | undefined;
     };
 };
 export declare const batchArray: <T>(array: T[], size: number) => T[][];

package/dist/lib/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.batchArray = exports.buildAs2IncomingPayload = exports.buildIncomingPayload = exports.serializeMetadata = exports.getMetadataFromRequest = exports.isCanonicalTraceId = exports.getIncomingEvent = exports.normalizeHeaders = void 0;
+exports.batchArray = exports.buildIncomingPayload = exports.serializeMetadata = exports.getMetadataFromRequest = exports.getIncomingEvent = exports.normalizeHeaders = void 0;
 const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
 const trace_1 = require("unnbound-logger-sdk/dist/trace");
 const types_1 = require("unnbound-logger-sdk/dist/types");
@@ -41,42 +41,23 @@ const getIncomingRequest = async (request) => {
         path: request.path,
         headers,
         query: request.query(),
-        body: await parseBody(request, headers),
+        body: await readBody(request),
         params: parseParams(request),
     };
 };
-const parseBody = async (request, headers) => {
+const readBody = async (request) => {
     try {
-        if (headers['content-type']?.includes('application/json'))
-            return await request.json();
-        if (headers['content-type']?.includes('application/x-www-form-urlencoded'))
-            return await request.parseBody();
-        if (headers['content-type']?.includes('multipart/form-data'))
-            return await request.parseBody();
-        if (headers['content-type']?.includes('text/plain'))
-            return await request.text();
-        return request.arrayBuffer();
+        return await request.arrayBuffer();
     }
-    catch {
-        return undefined;
+    catch (error) {
+        throw new error_1.ServerError({ status: 400, message: 'Failed to read request body.', cause: error });
     }
 };
-/**
- * The customer trace ID the product groups logs by — a logger-SDK UUID. Public callers
- * can set the trace header, so anything non-canonical (oversized values, W3C
- * traceparents, arbitrary strings) is ignored and a fresh trace is minted instead.
- */
-const CANONICAL_TRACE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const isCanonicalTraceId = (value) => typeof value === 'string' && CANONICAL_TRACE_ID.test(value);
-exports.isCanonicalTraceId = isCanonicalTraceId;
-const getMetadataFromRequest = (request, source) => {
-    const headerTraceId = request.headers[types_1.defaultTraceHeaderKey];
-    return {
-        traceId: (0, exports.isCanonicalTraceId)(headerTraceId) ? headerTraceId : (0, unnbound_logger_sdk_1.getTraceId)(),
-        messageId: request.headers[types_1.defaultMessageHeaderKey] ?? (0, trace_1.getMessageId)(),
-        source,
-    };
-};
+const getMetadataFromRequest = (request, source) => ({
+    traceId: request.headers[types_1.defaultTraceHeaderKey] ?? (0, unnbound_logger_sdk_1.getTraceId)(),
+    messageId: request.headers[types_1.defaultMessageHeaderKey] ?? (0, trace_1.getMessageId)(),
+    source,
+});
 exports.getMetadataFromRequest = getMetadataFromRequest;
 const sourceKey = 'x-unnbound-source';
 const timestampKey = 'x-unnbound-timestamp';
@@ -89,14 +70,34 @@ const deserializeMetadata = (request) => ({
     source: request.headers[sourceKey],
     timestamp: request.headers[timestampKey] ? Number.parseInt(request.headers[timestampKey], 10) : undefined,
 });
-const describeBody = (body) => {
-    if (body instanceof Uint8Array || body instanceof ArrayBuffer) {
-        return { binary: true, byteLength: body.byteLength };
+const TRACE_BODY_MAX_BYTES = 32_768;
+const getMediaType = (contentType) => contentType?.split(';')[0].trim().toLowerCase() || undefined;
+const isTextishMediaType = (mediaType) => Boolean(mediaType &&
+    (mediaType.includes('json') ||
+        mediaType.startsWith('text/') ||
+        mediaType.includes('xml') ||
+        mediaType === 'application/x-www-form-urlencoded'));
+const describeBody = (body, contentType) => {
+    if (!(body instanceof Uint8Array || body instanceof ArrayBuffer))
+        return (0, utils_1.safeJsonParse)(body);
+    const bytes = body instanceof Uint8Array ? body : new Uint8Array(body);
+    const byteLength = bytes.byteLength;
+    const mediaType = getMediaType(contentType);
+    if (!isTextishMediaType(mediaType))
+        return { binary: true, byteLength };
+    try {
+        const truncated = byteLength > TRACE_BODY_MAX_BYTES;
+        const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, TRACE_BODY_MAX_BYTES), {
+            stream: truncated,
+        });
+        if (mediaType?.includes('json') && !truncated)
+            return (0, utils_1.safeJsonParse)(text);
+        return truncated ? { text, truncated: true, byteLength } : text;
+    }
+    catch {
+        return { binary: true, byteLength };
     }
-    return (0, utils_1.safeJsonParse)(body);
 };
-// Trace payloads are shipped to the logging pipeline; credentials must never ride along
-// regardless of body shape (JSON, text, or binary — e.g. AS2's signed/encrypted MIME).
 const REDACTED_TRACE_HEADERS = new Set([
     'authorization',
     'proxy-authorization',
@@ -110,38 +111,23 @@ const headersForTrace = (headers) => Object.fromEntries(Object.entries(headers).
     name,
     REDACTED_TRACE_HEADERS.has(name.toLowerCase()) ? '[redacted]' : value,
 ]));
-// AS2 routes carry partner-controlled protocol headers, so logging flips from a
-// redaction denylist to an allowlist: protocol identity/framing and Temper correlation
-// headers pass; everything else is redacted. Receipt-Delivery-Option (its URL may embed
-// query credentials) and Subject (business metadata) are deliberately NOT listed.
-const AS2_TRACE_HEADER_ALLOWLIST = new Set([
-    'as2-from',
-    'as2-to',
-    'as2-version',
-    'content-length',
-    'content-transfer-encoding',
-    'content-type',
-    'date',
-    'disposition-notification-options',
-    'disposition-notification-to',
-    'message-id',
-    'mime-version',
-    'x-message-id',
-    'x-unnbound-trace-id',
-]);
-const as2HeadersForTrace = (headers) => Object.fromEntries(Object.entries(headers).map(([name, value]) => [
-    name,
-    AS2_TRACE_HEADER_ALLOWLIST.has(name.toLowerCase()) ? value : '[redacted]',
-]));
-const buildResponsePayload = (headersPolicy, result) => ({
-    status: result?.status ?? 204,
-    headers: headersPolicy({
-        'content-type': 'application/json; charset=utf-8',
-        ...(result?.headers ? (0, exports.normalizeHeaders)(result.headers) : undefined),
-    }),
-    body: result?.body ? describeBody(result.body) : undefined,
-});
-const buildIncomingPayloadWith = (headersPolicy) => (event, result) => {
+const buildResponsePayload = (result) => {
+    const declaredHeaders = result?.headers
+        ? Object.fromEntries(Object.entries((0, exports.normalizeHeaders)(result.headers)).map(([name, value]) => [name.toLowerCase(), value]))
+        : undefined;
+    // Byte responses go out with exactly the declared headers (no content-type
+    // unless the handler set one); everything else is JSON-serialized on the
+    // wire. The trace mirrors that, and the declared content-type drives the
+    // display decode so byte responses labeled JSON/XML/text trace readably.
+    const isByteBody = result?.body instanceof Uint8Array || result?.body instanceof ArrayBuffer;
+    const traceHeaders = headersForTrace(declaredHeaders ?? {});
+    return {
+        status: result?.status ?? 204,
+        headers: isByteBody ? traceHeaders : { 'content-type': 'application/json; charset=utf-8', ...traceHeaders },
+        body: result?.body ? describeBody(result.body, declaredHeaders?.['content-type']) : undefined,
+    };
+};
+const buildIncomingPayload = (event, result) => {
     return {
         type: 'http',
         source: event.metadata.source,
@@ -156,19 +142,18 @@ const buildIncomingPayloadWith = (headersPolicy) => (event, result) => {
                 event.request.headers['x-real-ip']),
             incoming: true,
             request: {
-                headers: headersPolicy(event.request.headers),
-                body: describeBody(event.request.body),
+                headers: headersForTrace(event.request.headers),
+                body: describeBody(event.request.body, event.request.headers['content-type']),
             },
             ...(result && {
                 response: result.error
-                    ? buildResponsePayload(headersPolicy, error_1.ServerError.fromError(result.error).toJson())
-                    : buildResponsePayload(headersPolicy, result.result),
+                    ? buildResponsePayload(error_1.ServerError.fromError(result.error).toJson())
+                    : buildResponsePayload(result.result),
             }),
         },
     };
 };
-exports.buildIncomingPayload = buildIncomingPayloadWith(headersForTrace);
-exports.buildAs2IncomingPayload = buildIncomingPayloadWith(as2HeadersForTrace);
+exports.buildIncomingPayload = buildIncomingPayload;
 const batchArray = (array, size) => {
     return [...Array(Math.ceil(array.length / size))].map((_, i) => array.slice(i * size, i * size + size));
 };

package/package.json

@@ -1,9 +1,19 @@
 {
   "name": "unnbound-events",
   "description": "Unified events SDK to handle HTTP routes and queued messages with a single routing API.",
-  "version": "2.1.0-beta.2",
+  "version": "3.0.0-beta.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "format": "biome format --write .",
+    "format:check": "biome format .",
+    "prepublishOnly": "pnpm run build",
+    "start:example": "tsx watch examples/node-server.ts",
+    "version:bump": "npm version patch"
+  },
   "author": "Unnbound Team",
   "license": "MIT",
   "repository": {
@@ -20,7 +30,7 @@
     "@hono/node-server": "^1.19.11",
     "axios": "1.16.0",
     "hono": "^4.12.21",
-    "unnbound-logger-sdk": "3.1.0-beta.1"
+    "unnbound-logger-sdk": "^3.0.34"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",
@@ -35,14 +45,5 @@
   "engines": {
     "node": ">=22"
   },
-  "sideEffects": false,
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "format": "biome format --write .",
-    "format:check": "biome format .",
-    "start:example": "tsx watch examples/node-server.ts",
-    "version:bump": "npm version patch"
-  }
-}
+  "sideEffects": false
+}

package/dist/lib/routing/as2.d.ts

@@ -1,37 +0,0 @@
-import type { EventHandlerResult } from '../event';
-import { type Handler } from './endpoint';
-import type { EventVariables, MaybePromise } from './types';
-/** Raw wire request handed to the platform verification call, byte-exact. */
-export interface As2RawRequest {
-    headers: Record<string, string>;
-    body: ArrayBuffer | Uint8Array | string | undefined;
-}
-/**
- * Result of the platform verification call. `as2.receive` results carry the exchange's
- * canonical customer trace (recovered from the ledger for a loopback, server-minted for
- * an external inbound); `as2.confirm` results deliberately do not — an async MDN
- * callback is its own execution and stays on its own trace, linked by Message-ID.
- */
-export interface As2Prepared {
-    customerTraceId?: string | null;
-}
-/**
- * Verify-then-bind AS2 endpoint. The public `x-unnbound-trace-id` header is never AS2
- * continuation authority: the route starts on a fresh trace, runs `prepare` (the hidden
- * `as2.receive`/`as2.confirm` platform call) before any customer request span exists,
- * and only a verified ledger-backed trace may re-bind the request. Unverified traffic
- * fails on its own sanitized trace and can assert nothing. Request/response headers are
- * logged through the AS2 allowlist — Receipt-Delivery-Option and Subject never appear.
- *
- * ```ts
- * server.post('/as2/inbound', as2Endpoint(
- *   ({ headers, body }) => as2.receive({ headers, body: Buffer.from(body as ArrayBuffer), partner: 'AS2_PARTNER' }),
- *   async (result) => {
- *     if (result.kind !== 'received') return result.response;
- *     await processDocument(result.payload);
- *     return (await result.acknowledge()).response;
- *   },
- * ));
- * ```
- */
-export declare const as2Endpoint: <V extends object, P extends object>(prepare: (request: As2RawRequest, event: EventVariables<V>) => Promise<P>, handler: (prepared: P, event: EventVariables<V>) => MaybePromise<EventHandlerResult>) => Handler<EventVariables<V>>;

package/dist/lib/routing/as2.js

@@ -1,98 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.as2Endpoint = void 0;
-const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
-const error_1 = require("../error");
-const utils_1 = require("../utils");
-const endpoint_1 = require("./endpoint");
-/**
- * Transient platform failures a partner should re-send against. `As2SdkError` already computed
- * these from the platform response, but it arrives here as a plain unknown — this package cannot
- * import `@ontemper/as2` (the dependency runs the other way), so the shape is read defensively.
- */
-const RETRYABLE_AS2_STATUSES = [502, 503, 504];
-/**
- * AS2 partners drive their re-send behaviour off the status code, so collapsing every failure to
- * a flat 500 throws away the one signal telling them to try again — the same signal the
- * in-flight/parked path already sends deliberately as a 503. Lift the transient statuses onto the
- * wire; the message stays generic so no internal detail reaches the partner.
- */
-const toWireFailure = (error) => {
-    if (error && typeof error === 'object') {
-        const { name, status } = error;
-        const retryable = RETRYABLE_AS2_STATUSES.find((candidate) => candidate === status);
-        if (name === 'As2SdkError' && retryable) {
-            return new error_1.ServerError({
-                message: 'AS2 message could not be processed; retry later',
-                status: retryable,
-                cause: error,
-            });
-        }
-    }
-    return error_1.ServerError.fromError(error);
-};
-/**
- * Verify-then-bind AS2 endpoint. The public `x-unnbound-trace-id` header is never AS2
- * continuation authority: the route starts on a fresh trace, runs `prepare` (the hidden
- * `as2.receive`/`as2.confirm` platform call) before any customer request span exists,
- * and only a verified ledger-backed trace may re-bind the request. Unverified traffic
- * fails on its own sanitized trace and can assert nothing. Request/response headers are
- * logged through the AS2 allowlist — Receipt-Delivery-Option and Subject never appear.
- *
- * ```ts
- * server.post('/as2/inbound', as2Endpoint(
- *   ({ headers, body }) => as2.receive({ headers, body: Buffer.from(body as ArrayBuffer), partner: 'AS2_PARTNER' }),
- *   async (result) => {
- *     if (result.kind !== 'received') return result.response;
- *     await processDocument(result.payload);
- *     return (await result.acknowledge()).response;
- *   },
- * ));
- * ```
- */
-// P is constrained to object, not As2Prepared: prepared results are unions whose
-// members don't all carry customerTraceId (e.g. inFlight/parked), and TypeScript's
-// weak-type check would reject those. The As2Prepared contract is read defensively.
-const as2Endpoint = (prepare, handler) => {
-    return (0, endpoint_1.markSelfTraced)(async (event) => {
-        const requestTraceId = (0, unnbound_logger_sdk_1.getTraceId)();
-        let prepared;
-        try {
-            prepared = await (0, unnbound_logger_sdk_1.withTrace)(() => prepare({ headers: event.request.headers, body: event.request.body }, event), {
-                traceId: requestTraceId,
-            });
-        }
-        catch (error) {
-            return (0, unnbound_logger_sdk_1.withTrace)(async () => {
-                const failure = toWireFailure(error);
-                // Bookend the request on its own failure trace: the span records the sanitized
-                // AS2 payload and rethrows; the wire response carries no protocol claims.
-                await (0, unnbound_logger_sdk_1.startSpan)('Event request', () => Promise.reject(failure), (o) => (0, utils_1.buildAs2IncomingPayload)(event, o)).catch(() => undefined);
-                const result = failure.toJson();
-                return { ...result, headers: (0, endpoint_1.attachTraceHeaders)(result.headers) };
-            }, { traceId: requestTraceId });
-        }
-        const verified = prepared.customerTraceId;
-        const traceId = (0, utils_1.isCanonicalTraceId)(verified) ? verified : requestTraceId;
-        return (0, unnbound_logger_sdk_1.withTrace)(async () => {
-            // Response trace headers must be attached inside this scope: respondWith runs after
-            // the re-bound trace exits and would otherwise advertise the pre-bind trace.
-            try {
-                const result = await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
-                    const result = await handler(prepared, event);
-                    return { status: result?.status ?? 204, headers: result?.headers, body: result?.body };
-                }, (o) => (0, utils_1.buildAs2IncomingPayload)(event, o));
-                return { ...result, headers: (0, endpoint_1.attachTraceHeaders)(result.headers) };
-            }
-            catch (error) {
-                // The span above already logged the failure on the bound trace; respond with the
-                // sanitized shape instead of rethrowing into the header-derived middleware trace.
-                // `acknowledge()` runs in here too, so a transient platform failure keeps its
-                // retryable status rather than becoming an indistinguishable 500.
-                const result = toWireFailure(error).toJson();
-                return { ...result, headers: (0, endpoint_1.attachTraceHeaders)(result.headers) };
-            }
-        }, { traceId });
-    });
-};
-exports.as2Endpoint = as2Endpoint;