unnbound-events 3.0.0 → 3.1.1

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export { createEnqueuer } from './lib/enqueue';
 export type { ServerErrorOptions } from './lib/error';
 export { ServerError } from './lib/error';
 export type { EventMetadata, EventSource, IncomingEvent, IncomingRequest } from './lib/event';
+export type { As2Prepared, As2RawRequest } from './lib/routing/as2';
+export { as2Endpoint } from './lib/routing/as2';
 export type { Handler } from './lib/routing/endpoint';
 export type { MiddlewareHandler } from './lib/routing/middleware';
 export type { EventVariables, MaybePromise } from './lib/routing/types';

package/dist/index.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createServer = exports.ServerError = exports.createEnqueuer = void 0;
+exports.createServer = exports.as2Endpoint = exports.ServerError = exports.createEnqueuer = void 0;
 var enqueue_1 = require("./lib/enqueue");
 Object.defineProperty(exports, "createEnqueuer", { enumerable: true, get: function () { return enqueue_1.createEnqueuer; } });
 var error_1 = require("./lib/error");
 Object.defineProperty(exports, "ServerError", { enumerable: true, get: function () { return error_1.ServerError; } });
+var as2_1 = require("./lib/routing/as2");
+Object.defineProperty(exports, "as2Endpoint", { enumerable: true, get: function () { return as2_1.as2Endpoint; } });
 var server_1 = require("./lib/server");
 Object.defineProperty(exports, "createServer", { enumerable: true, get: function () { return server_1.createServer; } });

package/dist/lib/routing/as2-response.typecheck.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/routing/as2-response.typecheck.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function assertAs2ResponseAssignableToHandlerResult(response) {
+    // If As2HttpResponse ever widens `status` back to `number`, or StrictEventHandlerResult's
+    // `status` narrows further than Hono's StatusCode, this return stops compiling.
+    return response;
+}
+// Referenced so `noUnusedLocals`-style checks never flag this fixture as dead code.
+void assertAs2ResponseAssignableToHandlerResult;

package/dist/lib/routing/as2.d.ts

@@ -0,0 +1,61 @@
+import type { EventHandlerResult } from '../event';
+import { type Handler } from './endpoint';
+import type { EventVariables, MaybePromise } from './types';
+/** Raw wire request handed to the platform verification call, byte-exact. */
+export interface As2RawRequest {
+    headers: Record<string, string>;
+    body: ArrayBuffer | Uint8Array | string | undefined;
+}
+/**
+ * Result of the platform verification call. `as2.receive` results carry the exchange's
+ * canonical customer trace (recovered from the ledger for a loopback, server-minted for
+ * an external inbound); `as2.confirm` results deliberately do not — an async MDN
+ * callback is its own execution and stays on its own trace, linked by Message-ID.
+ */
+export interface As2Prepared {
+    customerTraceId?: string | null;
+}
+/**
+ * Verify-then-bind AS2 endpoint. The public `x-unnbound-trace-id` header is never AS2
+ * continuation authority: the route starts on a fresh trace, runs `prepare` (the hidden
+ * `as2.receive`/`as2.confirm` platform call) before any customer request span exists,
+ * and only a verified ledger-backed trace may re-bind the request. Unverified traffic
+ * fails on its own sanitized trace and can assert nothing. Request/response headers are
+ * logged through the AS2 allowlist — Receipt-Delivery-Option and Subject never appear.
+ *
+ * Do not attach route middleware that can answer an as2Endpoint request itself (auth
+ * shims, rate limiters): a middleware early-return never reaches this wrapper, so it is
+ * logged through the generic header policy on the public header-derived trace instead of
+ * the AS2 policy above. Rejection logic belongs inside `prepare`/`handler`.
+ *
+ * ```ts
+ * // identity/partner are plain objects built inline from ordinary scalar workflow
+ * // variables — never a variable name passed to `as2.receive`/`as2.send` (see
+ * // @ontemper/as2's README). partner.mdn.to only matters for outbound `as2.send`.
+ * const identity = { as2Id: 'ACME-TEMPER', keypairs: [{ certPem: process.env.AS2_CERT_PEM!, keyPem: process.env.AS2_KEY_PEM! }] };
+ * const partner = { as2Id: 'ACME', url: process.env.ACME_AS2_URL!, certs: [process.env.ACME_CERT_PEM!] };
+ *
+ * server.post('/as2/inbound', as2Endpoint(
+ *   ({ headers, body }) => as2.receive({ headers, body: Buffer.from(body as ArrayBuffer), partner, identity }),
+ *   async (result) => {
+ *     if (result.kind === 'received') {
+ *       // Delivery is at-least-once, so make processing idempotent by Message-ID.
+ *       await processDocument(result.payload);
+ *       const receipt = await result.acknowledge();
+ *       // Async MDN partners get no receipt unless you deliver it explicitly — the
+ *       // response below is deliberately an empty 200 in that mode.
+ *       if (receipt.mdnMode === 'async' && receipt.mdn && receipt.mdnDeliveryUrl) {
+ *         await as2.deliverMdn(receipt.mdn, receipt.mdnDeliveryUrl);
+ *       }
+ *       return receipt.response;
+ *     }
+ *     // Duplicate retries need the same async redelivery, or the partner never settles.
+ *     if (result.kind === 'duplicate' && result.mdnMode === 'async' && result.mdn && result.mdnDeliveryUrl) {
+ *       await as2.deliverMdn(result.mdn, result.mdnDeliveryUrl);
+ *     }
+ *     return result.response;
+ *   },
+ * ));
+ * ```
+ */
+export declare const as2Endpoint: <V extends object, P extends object>(prepare: (request: As2RawRequest, event: EventVariables<V>) => Promise<P>, handler: (prepared: P, event: EventVariables<V>) => MaybePromise<EventHandlerResult>) => Handler<EventVariables<V>>;

package/dist/lib/routing/as2.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.as2Endpoint = void 0;
+const node_crypto_1 = require("node:crypto");
+const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
+const error_1 = require("../error");
+const utils_1 = require("../utils");
+const endpoint_1 = require("./endpoint");
+const response_1 = require("./response");
+/**
+ * Transient platform failures a partner should re-send against. `As2SdkError` already computed
+ * these from the platform response, but it arrives here as a plain unknown — this package cannot
+ * import `@ontemper/as2` (the dependency runs the other way), so the shape is read defensively.
+ */
+const RETRYABLE_AS2_STATUSES = [502, 503, 504];
+/**
+ * Permanent client errors the partner must NOT re-send: an oversized document is 413, a
+ * malformed/undecryptable envelope is 400/422. Collapsing these to 500 tells the partner it
+ * was a transient server fault, so it retries a payload that can never succeed.
+ */
+const PERMANENT_AS2_STATUSES = [400, 413, 422];
+/**
+ * AS2 partners drive their re-send behaviour off the status code, so collapsing every failure to
+ * a flat 500 throws away the one signal telling them what to do — retry a transient fault, or
+ * stop resending a permanently bad payload. Lift both classes onto the wire from the platform's
+ * `As2SdkError` status; the message stays generic so no internal detail reaches the partner.
+ * Anything unrecognized still collapses to 500.
+ */
+const toWireFailure = (error) => {
+    if (error && typeof error === 'object') {
+        const { name, status } = error;
+        if (name === 'As2SdkError') {
+            // .find (not .some) so the matched literal narrows to StatusCode without a cast.
+            const retryable = RETRYABLE_AS2_STATUSES.find((candidate) => candidate === status);
+            if (retryable) {
+                return new error_1.ServerError({
+                    message: 'AS2 message could not be processed; retry later',
+                    status: retryable,
+                    cause: error,
+                });
+            }
+            const permanent = PERMANENT_AS2_STATUSES.find((candidate) => candidate === status);
+            if (permanent) {
+                return new error_1.ServerError({
+                    message: 'AS2 message was rejected and should not be resent',
+                    status: permanent,
+                    cause: error,
+                });
+            }
+        }
+    }
+    return error_1.ServerError.fromError(error);
+};
+/**
+ * Verify-then-bind AS2 endpoint. The public `x-unnbound-trace-id` header is never AS2
+ * continuation authority: the route starts on a fresh trace, runs `prepare` (the hidden
+ * `as2.receive`/`as2.confirm` platform call) before any customer request span exists,
+ * and only a verified ledger-backed trace may re-bind the request. Unverified traffic
+ * fails on its own sanitized trace and can assert nothing. Request/response headers are
+ * logged through the AS2 allowlist — Receipt-Delivery-Option and Subject never appear.
+ *
+ * Do not attach route middleware that can answer an as2Endpoint request itself (auth
+ * shims, rate limiters): a middleware early-return never reaches this wrapper, so it is
+ * logged through the generic header policy on the public header-derived trace instead of
+ * the AS2 policy above. Rejection logic belongs inside `prepare`/`handler`.
+ *
+ * ```ts
+ * // identity/partner are plain objects built inline from ordinary scalar workflow
+ * // variables — never a variable name passed to `as2.receive`/`as2.send` (see
+ * // @ontemper/as2's README). partner.mdn.to only matters for outbound `as2.send`.
+ * const identity = { as2Id: 'ACME-TEMPER', keypairs: [{ certPem: process.env.AS2_CERT_PEM!, keyPem: process.env.AS2_KEY_PEM! }] };
+ * const partner = { as2Id: 'ACME', url: process.env.ACME_AS2_URL!, certs: [process.env.ACME_CERT_PEM!] };
+ *
+ * server.post('/as2/inbound', as2Endpoint(
+ *   ({ headers, body }) => as2.receive({ headers, body: Buffer.from(body as ArrayBuffer), partner, identity }),
+ *   async (result) => {
+ *     if (result.kind === 'received') {
+ *       // Delivery is at-least-once, so make processing idempotent by Message-ID.
+ *       await processDocument(result.payload);
+ *       const receipt = await result.acknowledge();
+ *       // Async MDN partners get no receipt unless you deliver it explicitly — the
+ *       // response below is deliberately an empty 200 in that mode.
+ *       if (receipt.mdnMode === 'async' && receipt.mdn && receipt.mdnDeliveryUrl) {
+ *         await as2.deliverMdn(receipt.mdn, receipt.mdnDeliveryUrl);
+ *       }
+ *       return receipt.response;
+ *     }
+ *     // Duplicate retries need the same async redelivery, or the partner never settles.
+ *     if (result.kind === 'duplicate' && result.mdnMode === 'async' && result.mdn && result.mdnDeliveryUrl) {
+ *       await as2.deliverMdn(result.mdn, result.mdnDeliveryUrl);
+ *     }
+ *     return result.response;
+ *   },
+ * ));
+ * ```
+ */
+// P is constrained to object, not As2Prepared: prepared results are unions whose
+// members don't all carry customerTraceId (e.g. inFlight/parked), and TypeScript's
+// weak-type check would reject those. The As2Prepared contract is read defensively.
+const as2Endpoint = (prepare, handler) => {
+    return (0, endpoint_1.markSelfTraced)(async (event) => {
+        // Mint a fresh pre-verification trace, do NOT read the ambient one: getIncomingEvent has
+        // already adopted a partner-supplied canonical x-unnbound-trace-id by the time this wrapper
+        // runs, so getTraceId() would return a trace the partner chose. Unverified traffic must not
+        // be able to select the trace its prepare/failure/inFlight/parked spans land on — only a
+        // ledger-verified customerTraceId may re-bind below.
+        const requestTraceId = (0, node_crypto_1.randomUUID)();
+        let prepared;
+        try {
+            prepared = await (0, unnbound_logger_sdk_1.withTrace)(() => prepare({ headers: event.request.headers, body: event.request.body }, event), {
+                traceId: requestTraceId,
+            });
+        }
+        catch (error) {
+            return (0, unnbound_logger_sdk_1.withTrace)(async () => {
+                const failure = toWireFailure(error);
+                // Bookend the request on its own failure trace: the span records the sanitized
+                // AS2 payload and rethrows; the wire response carries no protocol claims.
+                await (0, unnbound_logger_sdk_1.startSpan)('Event request', () => Promise.reject(failure), (o) => (0, utils_1.buildAs2IncomingPayload)(event, o)).catch(() => undefined);
+                const result = failure.toJson();
+                return { ...result, headers: (0, response_1.attachTraceHeaders)(result.headers) };
+            }, { traceId: requestTraceId });
+        }
+        const verified = prepared.customerTraceId;
+        const traceId = (0, utils_1.isCanonicalTraceId)(verified) ? verified : requestTraceId;
+        return (0, unnbound_logger_sdk_1.withTrace)(async () => {
+            // Response trace headers must be attached inside this scope: respondWith runs after
+            // the re-bound trace exits and would otherwise advertise the pre-bind trace.
+            try {
+                const result = await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
+                    const result = await handler(prepared, event);
+                    return { status: (0, response_1.resolveStatus)(result), headers: result?.headers, body: result?.body };
+                }, (o) => (0, utils_1.buildAs2IncomingPayload)(event, o));
+                return { ...result, headers: (0, response_1.attachTraceHeaders)(result.headers) };
+            }
+            catch (error) {
+                // The span above already logged the failure on the bound trace; respond with the
+                // sanitized shape instead of rethrowing into the header-derived middleware trace.
+                // `acknowledge()` runs in here too, so a transient platform failure keeps its
+                // retryable status rather than becoming an indistinguishable 500.
+                const result = toWireFailure(error).toJson();
+                return { ...result, headers: (0, response_1.attachTraceHeaders)(result.headers) };
+            }
+        }, { traceId });
+    });
+};
+exports.as2Endpoint = as2Endpoint;

package/dist/lib/routing/endpoint.d.ts

@@ -1,8 +1,9 @@
 import type { Context } from 'hono';
-import type { EventHandlerResult } from '../event';
+import type { EventHandlerResult, StrictEventHandlerResult } from '../event';
 import { type MiddlewareHandler } from './middleware';
 import type { EventEnvironment, EventVariables, MaybePromise } from './types';
 export type Handler<I, R = EventHandlerResult> = (input: I) => MaybePromise<R>;
+export declare const markSelfTraced: <I>(handler: (input: I) => Promise<StrictEventHandlerResult>) => Handler<I>;
 export interface Endpoint<I> {
     (path: string, handler: Handler<I>): MaybePromise<void>;
     (path: string, middleware: MiddlewareHandler<I>, handler: Handler<I>): MaybePromise<void>;

package/dist/lib/routing/endpoint.js

@@ -1,10 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.patchEndpoint = exports.parseEndpointArguments = exports.buildEndpointArguments = void 0;
+exports.patchEndpoint = exports.parseEndpointArguments = exports.buildEndpointArguments = exports.markSelfTraced = void 0;
 const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
 const utils_1 = require("../utils");
 const middleware_1 = require("./middleware");
 const response_1 = require("./response");
+/**
+ * Marks a handler that owns its customer trace and request span. The generic endpoint
+ * wrapper binds the header-derived trace before running a handler; AS2 endpoints must
+ * instead verify the protocol exchange first and only then choose the trace, so their
+ * wrapper (see routing/as2.ts) emits the request span itself and returns a strict result.
+ */
+const selfTraced = Symbol.for('unnbound-events.selfTraced');
+const markSelfTraced = (handler) => {
+    return Object.assign(handler, { [selfTraced]: true });
+};
+exports.markSelfTraced = markSelfTraced;
+const isSelfTraced = (handler) => selfTraced in handler;
 const buildEndpointArguments = (...args) => {
     const { path, middlewares, handler } = (0, exports.parseEndpointArguments)(...args);
     const patchedHandler = (0, exports.patchEndpoint)(handler);
@@ -22,10 +34,12 @@ const patchEndpoint = (handler) => {
         const state = context.get('state');
         // We have to recalculate the params because the handler path might contain url params
         state.request.params = { ...state.request.params, ...context.req.param() };
-        const result = await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
-            const result = await handler(state);
-            return { status: (0, response_1.resolveStatus)(result), headers: result?.headers, body: result?.body };
-        }, (o) => (0, utils_1.buildIncomingPayload)(state, o));
+        const result = isSelfTraced(handler)
+            ? await handler(state)
+            : await (0, unnbound_logger_sdk_1.startSpan)('Event request', async () => {
+                const result = await handler(state);
+                return { status: (0, response_1.resolveStatus)(result), headers: result?.headers, body: result?.body };
+            }, (o) => (0, utils_1.buildIncomingPayload)(state, o));
         return (0, response_1.respondWith)(context, result);
     };
 };

package/dist/lib/routing/middleware.d.ts

@@ -1,7 +1,7 @@
 import type { MiddlewareHandler as HonoMiddlewareHandler, Next } from 'hono';
 import type { EventHandlerResult } from '../event';
 import type { EventEnvironment, EventVariables, MaybePromise } from './types';
-export type MiddlewareHandler<I> = (input: I, next: Next) => MaybePromise<EventHandlerResult | void>;
+export type MiddlewareHandler<I> = (input: I, next: Next) => MaybePromise<EventHandlerResult | undefined> | Promise<void>;
 export interface Middleware<I> {
     (...middlewares: MiddlewareHandler<I>[]): MaybePromise<void>;
     (path: string, ...middlewares: MiddlewareHandler<I>[]): MaybePromise<void>;

package/dist/lib/utils.d.ts

@@ -3,6 +3,7 @@ import { type Maybe } from 'unnbound-logger-sdk/dist/types';
 import type { EventHandlerResult, EventMetadata, EventSource, IncomingEvent, IncomingRequest, MatchedIncomingRequest } from './event';
 export declare const normalizeHeaders: (headers: Record<string, string | string[]>) => Record<string, string>;
 export declare const getIncomingEvent: (event: HonoRequest) => Promise<IncomingEvent<MatchedIncomingRequest>>;
+export declare const isCanonicalTraceId: (value: string | undefined | null) => value is string;
 export declare const getMetadataFromRequest: (request: Pick<IncomingRequest, 'headers'>, source: EventSource) => EventMetadata;
 interface ForwardedMetadata {
     source: EventSource;
@@ -19,7 +20,29 @@ export declare const buildIncomingPayload: (event: IncomingEvent<MatchedIncoming
     http: {
         url: string;
         method: string;
-        query: Record<string, any>;
+        query: Record<string, any> | undefined;
+        params: Record<string, string> | undefined;
+        ip: string | undefined;
+        incoming: boolean;
+        request: {
+            headers: Record<string, string>;
+            body: unknown;
+        };
+        response?: {
+            status: import("hono/utils/http-status").StatusCode;
+            headers: Record<string, string>;
+            body: unknown;
+        } | undefined;
+    };
+};
+export declare const buildAs2IncomingPayload: (event: IncomingEvent<MatchedIncomingRequest>, result?: Maybe<EventHandlerResult>) => {
+    type: string;
+    source: EventSource;
+    delay: number | undefined;
+    http: {
+        url: string;
+        method: string;
+        query: Record<string, any> | undefined;
         params: Record<string, string> | undefined;
         ip: string | undefined;
         incoming: boolean;

package/dist/lib/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.batchArray = exports.buildIncomingPayload = exports.serializeMetadata = exports.getMetadataFromRequest = exports.getIncomingEvent = exports.normalizeHeaders = void 0;
+exports.batchArray = exports.buildAs2IncomingPayload = exports.buildIncomingPayload = exports.serializeMetadata = exports.getMetadataFromRequest = exports.isCanonicalTraceId = exports.getIncomingEvent = exports.normalizeHeaders = void 0;
 const unnbound_logger_sdk_1 = require("unnbound-logger-sdk");
 const trace_1 = require("unnbound-logger-sdk/dist/trace");
 const types_1 = require("unnbound-logger-sdk/dist/types");
@@ -46,19 +46,69 @@ const getIncomingRequest = async (request) => {
         params: parseParams(request),
     };
 };
+/**
+ * Outer body ceiling for EVERY workflow endpoint, matched to the ingress contract
+ * (apps/ingress `maxRequestBodySize`, 100 MiB) — this reader runs for all routes before
+ * dispatch, so a tighter value here silently shrinks the supported payload of unrelated
+ * customer endpoints and strands queued S3-backed events in the 64–100 MiB band. AS2's own
+ * far tighter bounds live downstream where the route is known (the API route's 48 MiB
+ * bodyLimit and the engine's 24 MiB raw ceiling); per-tenant AS2 flood protection is T-3265.
+ * The cap still bounds one request from the declared length, or as the stream crosses it,
+ * before a full copy materializes.
+ */
+const MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;
 const readBody = async (request) => {
+    const declared = Number(request.header('content-length') ?? Number.NaN);
+    if (Number.isFinite(declared) && declared > MAX_REQUEST_BODY_BYTES) {
+        throw new error_1.ServerError({ status: 413, message: 'Request body too large.' });
+    }
     try {
-        return await request.arrayBuffer();
+        const stream = request.raw.body;
+        if (!stream)
+            return new ArrayBuffer(0);
+        const chunks = [];
+        let total = 0;
+        const reader = stream.getReader();
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            total += next.value.byteLength;
+            if (total > MAX_REQUEST_BODY_BYTES) {
+                await reader.cancel();
+                throw new error_1.ServerError({ status: 413, message: 'Request body too large.' });
+            }
+            chunks.push(next.value);
+        }
+        const bytes = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return bytes.buffer;
     }
     catch (error) {
+        if (error instanceof error_1.ServerError)
+            throw error;
         throw new error_1.ServerError({ status: 400, message: 'Failed to read request body.', cause: error });
     }
 };
-const getMetadataFromRequest = (request, source) => ({
-    traceId: request.headers[types_1.defaultTraceHeaderKey] ?? (0, unnbound_logger_sdk_1.getTraceId)(),
-    messageId: request.headers[types_1.defaultMessageHeaderKey] ?? (0, trace_1.getMessageId)(),
-    source,
-});
+/**
+ * AS2's verify-then-bind boundary uses this to accept only ledger-owned trace IDs.
+ * Generic event routes preserve their historical correlation-header contract below.
+ */
+const CANONICAL_TRACE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const isCanonicalTraceId = (value) => typeof value === 'string' && CANONICAL_TRACE_ID.test(value);
+exports.isCanonicalTraceId = isCanonicalTraceId;
+const getMetadataFromRequest = (request, source) => {
+    const headerTraceId = request.headers[types_1.defaultTraceHeaderKey];
+    return {
+        traceId: headerTraceId || (0, unnbound_logger_sdk_1.getTraceId)(),
+        messageId: request.headers[types_1.defaultMessageHeaderKey] ?? (0, trace_1.getMessageId)(),
+        source,
+    };
+};
 exports.getMetadataFromRequest = getMetadataFromRequest;
 const sourceKey = 'x-unnbound-source';
 const timestampKey = 'x-unnbound-timestamp';
@@ -112,13 +162,36 @@ const headersForTrace = (headers) => Object.fromEntries(Object.entries(headers).
     name,
     REDACTED_TRACE_HEADERS.has(name.toLowerCase()) ? '[redacted]' : value,
 ]));
-const buildResponsePayload = (result) => {
+// AS2 routes carry partner-controlled protocol headers, so logging flips from a
+// redaction denylist to an allowlist: protocol identity/framing and Temper correlation
+// headers pass; everything else is redacted. Receipt-Delivery-Option (its URL may embed
+// query credentials) and Subject (business metadata) are deliberately NOT listed.
+const AS2_TRACE_HEADER_ALLOWLIST = new Set([
+    'as2-from',
+    'as2-to',
+    'as2-version',
+    'content-length',
+    'content-transfer-encoding',
+    'content-type',
+    'date',
+    'disposition-notification-options',
+    'disposition-notification-to',
+    'message-id',
+    'mime-version',
+    'x-message-id',
+    'x-unnbound-trace-id',
+]);
+const as2HeadersForTrace = (headers) => Object.fromEntries(Object.entries(headers).map(([name, value]) => [
+    name,
+    AS2_TRACE_HEADER_ALLOWLIST.has(name.toLowerCase()) ? value : '[redacted]',
+]));
+const buildResponsePayloadWith = (headersPolicy, result) => {
     const declaredHeaders = result?.headers
         ? Object.fromEntries(Object.entries((0, exports.normalizeHeaders)(result.headers)).map(([name, value]) => [name.toLowerCase(), value]))
         : undefined;
     // Binary responses keep declared headers; JSON gets the SDK default.
     // The declared content type also controls trace decoding.
-    const traceHeaders = headersForTrace(declaredHeaders ?? {});
+    const traceHeaders = headersPolicy(declaredHeaders ?? {});
     const status = (0, response_1.resolveStatus)(result);
     // Mirror the wire: respondWith drops the body on contentless statuses, so the
     // trace must not claim one — nor a content type for a body never sent.
@@ -130,33 +203,49 @@ const buildResponsePayload = (result) => {
         body: body ? describeBody(body, declaredHeaders?.['content-type']) : undefined,
     };
 };
-const buildIncomingPayload = (event, result) => {
+/**
+ * Drop the URL's search component so no query-string credential (a `?token=…` on the
+ * inbound AS2 endpoint) survives into customer-visible trace data. The AS2 header allowlist
+ * already scrubs sensitive headers; the URL and its parsed query bypassed it entirely.
+ */
+const stripUrlQuery = (rawUrl) => {
+    try {
+        const url = new URL(rawUrl);
+        url.search = '';
+        return url.toString();
+    }
+    catch {
+        return rawUrl.split('?', 1)[0] ?? rawUrl;
+    }
+};
+const buildIncomingPayloadWith = (headersPolicy, redactUrlQuery = false) => (event, result) => {
     return {
         type: 'http',
         source: event.metadata.source,
         delay: event.metadata.source === 'queue' ? Date.now() - event.timestamp : undefined,
         http: {
-            url: event.request.url,
+            url: redactUrlQuery ? stripUrlQuery(event.request.url) : event.request.url,
             method: event.request.method.toLowerCase(),
-            query: event.request.query,
+            query: redactUrlQuery ? undefined : event.request.query,
             params: event.request.params,
             ip: (0, utils_1.normalizeIp)(event.request.headers['cf-connecting-ip'] ??
                 event.request.headers['x-forwarded-for'] ??
                 event.request.headers['x-real-ip']),
             incoming: true,
             request: {
-                headers: headersForTrace(event.request.headers),
+                headers: headersPolicy(event.request.headers),
                 body: describeBody(event.request.body, event.request.headers['content-type']),
             },
             ...(result && {
                 response: result.error
-                    ? buildResponsePayload(error_1.ServerError.fromError(result.error).toJson())
-                    : buildResponsePayload(result.result),
+                    ? buildResponsePayloadWith(headersPolicy, error_1.ServerError.fromError(result.error).toJson())
+                    : buildResponsePayloadWith(headersPolicy, result.result),
             }),
         },
     };
 };
-exports.buildIncomingPayload = buildIncomingPayload;
+exports.buildIncomingPayload = buildIncomingPayloadWith(headersForTrace);
+exports.buildAs2IncomingPayload = buildIncomingPayloadWith(as2HeadersForTrace, true);
 const batchArray = (array, size) => {
     return [...Array(Math.ceil(array.length / size))].map((_, i) => array.slice(i * size, i * size + size));
 };

package/package.json

@@ -1,19 +1,9 @@
 {
   "name": "unnbound-events",
   "description": "Unified events SDK to handle HTTP routes and queued messages with a single routing API.",
-  "version": "3.0.0",
+  "version": "3.1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "format": "biome format --write .",
-    "format:check": "biome format .",
-    "prepublishOnly": "pnpm run build",
-    "start:example": "tsx watch examples/node-server.ts",
-    "version:bump": "npm version patch"
-  },
   "author": "Unnbound Team",
   "license": "MIT",
   "repository": {
@@ -30,7 +20,7 @@
     "@hono/node-server": "^1.19.11",
     "axios": "1.16.0",
     "hono": "^4.12.21",
-    "unnbound-logger-sdk": "^3.0.34"
+    "unnbound-logger-sdk": "3.1.0"
   },
   "devDependencies": {
     "@types/jest": "^29.5.12",
@@ -45,5 +35,14 @@
   "engines": {
     "node": ">=22"
   },
-  "sideEffects": false
-}
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "format": "biome format --write .",
+    "format:check": "biome format .",
+    "start:example": "tsx watch examples/node-server.ts",
+    "version:bump": "npm version patch"
+  }
+}