fix(sdk): build the offloaded trigger payload path from a generated id

**Before:** triggering a task whose id contained a slash could fail once
the payload was large enough to be stored separately. The upload request
came back as a 400 with `Invalid packet storage path`, so the trigger
never completed. Whether an id hit it depended on where its slashes
fell: it affected ids that started or ended with a slash, that contained
two slashes in a row, or that contained a path component of exactly `.`
or `..`.

**After:** the task id takes no part in the storage path any more, so no
task id can produce one that fails.

A large trigger payload is uploaded to object storage rather than sent
inline, and the path used to be built from the task id. It was
percent-encoded so that it would stay inside a single path segment, but
the escape was decoded again when the upload request was handled, so the
slash came back as a real separator and the id spread across several
segments of the path. Some of the results were not valid storage paths,
and those were rejected.

The payload is now named with a generated id instead, so no task id can
produce an unusable storage path. Payloads that are already stored are
unaffected: the storage location is recorded when a payload is uploaded
and read back from there, rather than rebuilt from the task id.
Mono-RevId: 267fcbb3eb0f69db41e67c24b82a25f454d3052a

Author: claude[bot]

.changeset/slash-task-ids-large-payloads.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/sdk": patch
+---
+
+Fixes storage of large trigger payloads for task ids containing a slash, which could fail the trigger with an "Invalid packet storage path" error. It affected ids that started or ended with a slash, contained two slashes in a row, or contained a `.` or `..` path component. The storage path is now built from a generated id rather than from the task id, so no task id can produce an unusable one, and payloads that are already stored are still read from where they were written.

apps/webapp/test/objectStore.test.ts

@@ -1,5 +1,5 @@
 import { postgresAndMinioTest } from "@internal/testcontainers";
-import { type IOPacket } from "@trigger.dev/core/v3";
+import { generateFriendlyId, type IOPacket } from "@trigger.dev/core/v3";
 import { type PrismaClient } from "@trigger.dev/database";
 import { afterAll, describe, expect, it, vi } from "vitest";
 import { env } from "~/env.server";
@@ -163,6 +163,22 @@ describe("Object Storage", () => {
     });
   });
 
+  describe("offloaded trigger payload paths", () => {
+    /**
+     * The SDK names an offloaded trigger payload with the same generated id, so this
+     * pins the half of that contract the server owns: the guard must keep accepting
+     * every character the id generator can emit.
+     */
+    it("accepts the path shape the SDK builds for an offloaded payload", () => {
+      const id = generateFriendlyId("packet");
+      const path = `trigger/${id}/payload.json`;
+
+      expect(id).toMatch(/^packet_[123456789abcdefghijkmnopqrstuvwxyz]{21}$/);
+      expect(() => assertSafePacketRelativePath(path)).not.toThrow();
+      expect(resolveSafePacketRelativePath(path)).toBe(path);
+    });
+  });
+
   describe("normalizePacketRelativePath", () => {
     it("collapses redundant segments in safe paths", () => {
       expect(normalizePacketRelativePath("run/./payload.json")).toBe("run/payload.json");

packages/trigger-sdk/src/v3/shared.test.ts

@@ -1,8 +1,11 @@
 import { ApiClient } from "@trigger.dev/core/v3";
-import { describe, it, expect } from "vitest";
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { afterEach, describe, it, expect } from "vitest";
 import {
   offloadBatchItemPayloads,
   readableStreamToAsyncIterable,
+  trigger,
   uniqueBatchTaskIdentifiers,
 } from "./shared.js";
 
@@ -69,6 +72,126 @@ describe("offloadBatchItemPayloads", () => {
   });
 });
 
+describe("offloaded trigger payload paths", () => {
+  let server: Server | undefined;
+
+  afterEach(async () => {
+    const running = server;
+    server = undefined;
+    if (running) {
+      running.closeAllConnections?.();
+      await new Promise<void>((resolve) => running.close(() => resolve()));
+    }
+  });
+
+  /**
+   * Stand in for the presign route and the object store, recording the packet path
+   * the SDK actually puts on the wire.
+   */
+  const startPacketServer = async (): Promise<{ origin: string; requestedPaths: string[] }> => {
+    const requestedPaths: string[] = [];
+    let origin = "";
+
+    server = createServer((request, response) => {
+      const url = new URL(request.url ?? "/", origin);
+
+      if (url.pathname.startsWith("/api/v2/packets/")) {
+        const encoded = url.pathname.slice("/api/v2/packets/".length);
+        const storagePath = decodeURIComponent(encoded);
+        requestedPaths.push(storagePath);
+
+        response.writeHead(200, { "Content-Type": "application/json" });
+        response.end(JSON.stringify({ presignedUrl: `${origin}/upload`, storagePath }));
+        return;
+      }
+
+      request.resume();
+      request.on("end", () => {
+        response.writeHead(200, { "Content-Type": "application/json" });
+        response.end(JSON.stringify({ id: "run_test" }));
+      });
+    });
+
+    await new Promise<void>((resolve) => server!.listen(0, "127.0.0.1", resolve));
+    origin = `http://127.0.0.1:${(server!.address() as AddressInfo).port}`;
+
+    return { origin, requestedPaths };
+  };
+
+  const NASTY_TASK_IDS = [
+    "/my-task",
+    "jobs/my-task",
+    "my-task/",
+    "a//b",
+    "jobs/../x",
+    "..",
+    "my task",
+    "caf\u00e9",
+    "\ud800",
+  ];
+
+  it("builds a path from generated ids only, whatever the task id is", async () => {
+    const { origin, requestedPaths } = await startPacketServer();
+    const apiClient = new ApiClient(origin, "tr_dev_test");
+    const payload = JSON.stringify({ blob: "x".repeat(200_000) });
+
+    const items = NASTY_TASK_IDS.map((task, index) => ({
+      index,
+      task,
+      payload,
+      options: { payloadType: "application/json" },
+    }));
+
+    const result = await offloadBatchItemPayloads(items, apiClient);
+
+    expect(requestedPaths).toHaveLength(NASTY_TASK_IDS.length);
+
+    for (const path of requestedPaths) {
+      expect(path).toMatch(
+        /^trigger\/packet_[123456789abcdefghijkmnopqrstuvwxyz]{21}\/payload\.json$/
+      );
+      expect(path).not.toContain("%");
+    }
+
+    expect(new Set(requestedPaths).size).toBe(NASTY_TASK_IDS.length);
+    expect(new Set(result.map((item) => item.payload))).toEqual(new Set(requestedPaths));
+
+    for (const [index, item] of result.entries()) {
+      expect(item.options?.payloadType).toBe("application/store");
+      expect(item.task).toBe(NASTY_TASK_IDS[index]);
+    }
+  });
+
+  /**
+   * A lone surrogate is excluded here only because the trigger endpoint's own URL
+   * builder throws on it. That happens after the payload has been offloaded, so the
+   * offload path handles the id fine, as the batch case above shows; the uploaded
+   * object is simply orphaned when the trigger call fails.
+   */
+  const TRIGGERABLE_NASTY_TASK_IDS = NASTY_TASK_IDS.filter((taskId) => taskId !== "\ud800");
+
+  it.each(TRIGGERABLE_NASTY_TASK_IDS)(
+    "keeps the task id out of the path for trigger() of %j",
+    async (taskId) => {
+      const { origin, requestedPaths } = await startPacketServer();
+
+      const handle = await trigger(
+        taskId as never,
+        { blob: "x".repeat(200_000) } as never,
+        undefined,
+        { clientConfig: { baseURL: origin, accessToken: "tr_dev_test" } }
+      );
+
+      expect(handle.id).toBe("run_test");
+      expect(requestedPaths).toHaveLength(1);
+      expect(requestedPaths[0]).toMatch(
+        /^trigger\/packet_[123456789abcdefghijkmnopqrstuvwxyz]{21}\/payload\.json$/
+      );
+      expect(requestedPaths[0]).not.toContain("%");
+    }
+  );
+});
+
 describe("readableStreamToAsyncIterable", () => {
   it("yields all values from the stream", async () => {
     const values = [1, 2, 3, 4, 5];

packages/trigger-sdk/src/v3/shared.ts

@@ -17,6 +17,7 @@ import {
   createErrorTaskError,
   defaultRetryOptions,
   flattenIdempotencyKey,
+  generateFriendlyId,
   getIdempotencyKeyOptions,
   getSchemaParseFn,
   lifecycleHooks,
@@ -1770,7 +1771,7 @@ async function offloadBatchItemPayload(
 
   const exported = await conditionallyExportPacket(
     packet,
-    createTriggerPayloadPathPrefix(item.task),
+    createTriggerPayloadPathPrefix(),
     undefined,
     apiClient
   );
@@ -2301,8 +2302,7 @@ async function trigger_internal<TRunTypes extends AnyRunTypes>(
   const parsedPayload = parsePayload ? await parsePayload(payload) : payload;
   const { packet: triggerPayloadPacket, payloadSize } = await prepareTriggerPayload(
     parsedPayload,
-    apiClient,
-    id
+    apiClient
   );
 
   // Process idempotency key and extract options for storage
@@ -2566,8 +2566,7 @@ async function triggerAndWait_internal<TIdentifier extends string, TPayload, TOu
   const parsedPayload = parsePayload ? await parsePayload(payload) : payload;
   const { packet: triggerPayloadPacket, payloadSize } = await prepareTriggerPayload(
     parsedPayload,
-    apiClient,
-    id
+    apiClient
   );
 
   // Process idempotency key and extract options for storage
@@ -2657,8 +2656,7 @@ async function triggerAndSubscribe_internal<TIdentifier extends string, TPayload
   const parsedPayload = parsePayload ? await parsePayload(payload) : payload;
   const { packet: triggerPayloadPacket, payloadSize } = await prepareTriggerPayload(
     parsedPayload,
-    apiClient,
-    id
+    apiClient
   );
 
   const processedIdempotencyKey = await makeIdempotencyKey(options?.idempotencyKey);
@@ -3183,23 +3181,28 @@ function registerTaskLifecycleHooks<
 
 async function prepareTriggerPayload(
   payload: unknown,
-  apiClient: ApiClient,
-  taskId: string
+  apiClient: ApiClient
 ): Promise<{ packet: IOPacket; payloadSize: number }> {
   const payloadPacket = await stringifyIO(payload);
   // Measure the serialized size before any offload, so it reflects the real payload
   // size rather than the small "application/store" reference we may send instead.
   const { size: payloadSize } = packetRequiresOffloading(payloadPacket);
   const packet = await conditionallyExportPacket(
     payloadPacket,
-    createTriggerPayloadPathPrefix(taskId),
+    createTriggerPayloadPathPrefix(),
     undefined,
     apiClient
   );
   return { packet, payloadSize };
 }
 
-function createTriggerPayloadPathPrefix(taskId: string): string {
-  const safeTaskId = encodeURIComponent(taskId);
-  return `trigger/${safeTaskId}/${Date.now()}-${Math.random().toString(36).slice(2)}/payload`;
+/**
+ * Build the object-storage path prefix for an offloaded trigger payload.
+ *
+ * Every segment is generated here, so nothing caller-controlled reaches the key.
+ * The id's alphabet is lowercase alphanumeric, which no layer between here and the
+ * object store rewrites, so the path the SDK asks for is the path that gets stored.
+ */
+function createTriggerPayloadPathPrefix(): string {
+  return `trigger/${generateFriendlyId("packet")}/payload`;
 }