@amodalai/runtime 0.1.0

package/dist/src/middleware/auth.test.js

@@ -0,0 +1,268 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { describe, it, expect, vi, beforeEach, afterEach, beforeAll } from 'vitest';
+import express from 'express';
+import request from 'supertest';
+import { generateKeyPair, SignJWT, exportJWK, calculateJwkThumbprint } from 'jose';
+import { createAuthMiddleware, getAuthContext } from './auth.js';
+import { errorHandler } from './error-handler.js';
+// Mock fetch globally
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+function meResponse(orgId = 'org-123', appId = 'app-456', tenantId = 'ten-789') {
+    return {
+        ok: true,
+        json: async () => ({
+            org: { id: orgId },
+            app: { id: appId },
+            tenant: { id: tenantId },
+            apps: [{ id: appId }],
+            tenants: [{ id: tenantId }],
+            user: null,
+        }),
+    };
+}
+function createTestApp(platformApiUrl = 'http://localhost:4000', jwksUrl) {
+    const app = express();
+    app.use(express.json());
+    const authMiddleware = createAuthMiddleware({ platformApiUrl, jwksUrl });
+    app.get('/test', authMiddleware, (_req, res) => {
+        const ctx = getAuthContext(res);
+        res.json({
+            authenticated: true,
+            token: ctx?.token,
+            orgId: ctx?.orgId,
+            applicationId: ctx?.applicationId,
+            tenantId: ctx?.tenantId,
+            authMethod: ctx?.authMethod,
+            actor: ctx?.actor,
+        });
+    });
+    app.use(errorHandler);
+    return app;
+}
+describe('auth middleware', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('rejects requests without Authorization header', async () => {
+        const app = createTestApp();
+        const res = await request(app).get('/test');
+        expect(res.status).toBe(401);
+        expect(res.body.error.code).toBe('UNAUTHORIZED');
+        expect(res.body.error.message).toContain('Missing Authorization');
+    });
+    it('rejects non-Bearer auth schemes', async () => {
+        const app = createTestApp();
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Basic abc123');
+        expect(res.status).toBe(401);
+        expect(res.body.error.message).toContain('Bearer scheme');
+    });
+    it('rejects tokens without ak_ prefix when no JWKS configured', async () => {
+        // Create app without JWKS URL — will fail createJWTVerifier
+        const app = express();
+        app.use(express.json());
+        const authMiddleware = createAuthMiddleware({
+            platformApiUrl: 'http://localhost:4000',
+            jwksUrl: 'not-a-valid-url',
+        });
+        app.get('/test', authMiddleware, (_req, res) => {
+            res.json({ authenticated: true });
+        });
+        app.use(errorHandler);
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer some-jwt-token');
+        expect(res.status).toBe(401);
+    });
+    it('validates ak_ keys against platform API and returns full context', async () => {
+        mockFetch.mockResolvedValueOnce(meResponse('org-123', 'app-456', 'ten-789'));
+        const app = createTestApp();
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer ak_test-key');
+        expect(res.status).toBe(200);
+        expect(res.body.authenticated).toBe(true);
+        expect(res.body.token).toBe('ak_test-key');
+        expect(res.body.orgId).toBe('org-123');
+        expect(res.body.applicationId).toBe('app-456');
+        expect(res.body.tenantId).toBe('ten-789');
+        expect(res.body.authMethod).toBe('api_key');
+        // Verify fetch was called with correct args
+        expect(mockFetch).toHaveBeenCalledWith('http://localhost:4000/api/me', expect.objectContaining({
+            headers: expect.objectContaining({
+                Authorization: 'Bearer ak_test-key',
+            }),
+        }));
+    });
+    it('rejects invalid ak_ keys (platform returns non-ok)', async () => {
+        mockFetch.mockResolvedValueOnce({
+            ok: false,
+            status: 401,
+        });
+        const app = createTestApp();
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer ak_bad-key');
+        expect(res.status).toBe(401);
+        expect(res.body.error.code).toBe('UNAUTHORIZED');
+    });
+    it('caches validated keys', async () => {
+        mockFetch.mockResolvedValue(meResponse());
+        const app = createTestApp();
+        // First request — validates against platform API
+        await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer ak_cached-key');
+        expect(mockFetch).toHaveBeenCalledTimes(1);
+        // Second request — should use cache
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer ak_cached-key');
+        expect(res.status).toBe(200);
+        expect(mockFetch).toHaveBeenCalledTimes(1); // No additional fetch
+    });
+    it('returns 502 when platform API is unreachable', async () => {
+        mockFetch.mockRejectedValueOnce(new Error('Connection refused'));
+        const app = createTestApp();
+        const res = await request(app)
+            .get('/test')
+            .set('Authorization', 'Bearer ak_test-key');
+        expect(res.status).toBe(502);
+        expect(res.body.error.code).toBe('AUTH_UPSTREAM_ERROR');
+    });
+    describe('JWT verification', () => {
+        let privateKey;
+        let kid;
+        let jwksJson;
+        const jwksUrl = 'http://127.0.0.1:9999/.well-known/jwks.json';
+        beforeAll(async () => {
+            const pair = await generateKeyPair('ES256', { extractable: true });
+            privateKey = pair.privateKey;
+            const publicJwk = await exportJWK(pair.publicKey);
+            kid = await calculateJwkThumbprint(publicJwk);
+            jwksJson = {
+                keys: [{ ...publicJwk, kid, alg: 'ES256', use: 'sig' }],
+            };
+        });
+        it('validates platform JWTs locally without /api/me calls', async () => {
+            // Mock fetch to serve JWKS
+            mockFetch.mockImplementation(async (url) => {
+                if (url.includes('.well-known/jwks.json')) {
+                    return { ok: true, status: 200, json: async () => jwksJson };
+                }
+                throw new Error(`Unexpected fetch: ${url}`);
+            });
+            const token = await new SignJWT({
+                org_id: 'org-jwt',
+                app_id: 'app-jwt',
+                tenant_id: 'tenant-jwt',
+            })
+                .setProtectedHeader({ alg: 'ES256', kid })
+                .setIssuer('aitize-platform')
+                .setSubject('tenant-jwt')
+                .setIssuedAt()
+                .setExpirationTime('1h')
+                .sign(privateKey);
+            const app = createTestApp('http://localhost:4000', jwksUrl);
+            const res = await request(app)
+                .get('/test')
+                .set('Authorization', `Bearer ${token}`);
+            expect(res.status).toBe(200);
+            expect(res.body.token).toBe(token);
+            expect(res.body.orgId).toBe('org-jwt');
+            expect(res.body.applicationId).toBe('app-jwt');
+            expect(res.body.tenantId).toBe('tenant-jwt');
+            expect(res.body.authMethod).toBe('platform_jwt');
+            // Only JWKS fetch should have been made, not /api/me
+            for (const call of mockFetch.mock.calls) {
+                expect(String(call[0])).not.toContain('/api/me');
+            }
+        });
+        it('includes actor in AuthContext when JWT has actor claim', async () => {
+            mockFetch.mockImplementation(async (url) => {
+                if (url.includes('.well-known/jwks.json')) {
+                    return { ok: true, status: 200, json: async () => jwksJson };
+                }
+                throw new Error(`Unexpected fetch: ${url}`);
+            });
+            const token = await new SignJWT({
+                org_id: 'org-jwt',
+                app_id: 'app-jwt',
+                tenant_id: 'tenant-jwt',
+                actor: 'bob@example.com',
+            })
+                .setProtectedHeader({ alg: 'ES256', kid })
+                .setIssuer('aitize-platform')
+                .setSubject('tenant-jwt')
+                .setIssuedAt()
+                .setExpirationTime('1h')
+                .sign(privateKey);
+            const app = createTestApp('http://localhost:4000', jwksUrl);
+            const res = await request(app)
+                .get('/test')
+                .set('Authorization', `Bearer ${token}`);
+            expect(res.status).toBe(200);
+            expect(res.body.actor).toBe('bob@example.com');
+            expect(res.body.authMethod).toBe('platform_jwt');
+        });
+        it('omits actor from AuthContext when JWT has no actor claim', async () => {
+            mockFetch.mockImplementation(async (url) => {
+                if (url.includes('.well-known/jwks.json')) {
+                    return { ok: true, status: 200, json: async () => jwksJson };
+                }
+                throw new Error(`Unexpected fetch: ${url}`);
+            });
+            const token = await new SignJWT({
+                org_id: 'org-jwt',
+                app_id: 'app-jwt',
+                tenant_id: 'tenant-jwt',
+            })
+                .setProtectedHeader({ alg: 'ES256', kid })
+                .setIssuer('aitize-platform')
+                .setSubject('tenant-jwt')
+                .setIssuedAt()
+                .setExpirationTime('1h')
+                .sign(privateKey);
+            const app = createTestApp('http://localhost:4000', jwksUrl);
+            const res = await request(app)
+                .get('/test')
+                .set('Authorization', `Bearer ${token}`);
+            expect(res.status).toBe(200);
+            expect(res.body.actor).toBeUndefined();
+        });
+        it('rejects expired JWTs', async () => {
+            mockFetch.mockImplementation(async (url) => {
+                if (url.includes('.well-known/jwks.json')) {
+                    return { ok: true, status: 200, json: async () => jwksJson };
+                }
+                throw new Error(`Unexpected fetch: ${url}`);
+            });
+            const token = await new SignJWT({
+                org_id: 'org-1',
+                app_id: 'app-1',
+                tenant_id: 'tenant-1',
+            })
+                .setProtectedHeader({ alg: 'ES256', kid })
+                .setIssuer('aitize-platform')
+                .setSubject('tenant-1')
+                .setIssuedAt(Math.floor(Date.now() / 1000) - 7200)
+                .setExpirationTime(Math.floor(Date.now() / 1000) - 3600)
+                .sign(privateKey);
+            const app = createTestApp('http://localhost:4000', jwksUrl);
+            const res = await request(app)
+                .get('/test')
+                .set('Authorization', `Bearer ${token}`);
+            expect(res.status).toBe(401);
+        });
+    });
+});
+//# sourceMappingURL=auth.test.js.map

package/dist/src/middleware/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../src/middleware/auth.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACpF,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,MAAM,CAAC;AAEnF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,sBAAsB;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,SAAS,UAAU,CAAC,KAAK,GAAG,SAAS,EAAE,KAAK,GAAG,SAAS,EAAE,QAAQ,GAAG,SAAS;IAC5E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACjB,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;YAClB,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;YAClB,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACxB,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,IAAI;SACX,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,cAAc,GAAG,uBAAuB,EAAE,OAAgB;IAC/E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,MAAM,cAAc,GAAG,oBAAoB,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IAEzE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,GAAG,EAAE,KAAK;YACjB,KAAK,EAAE,GAAG,EAAE,KAAK;YACjB,aAAa,EAAE,GAAG,EAAE,aAAa;YACjC,QAAQ,EAAE,GAAG,EAAE,QAAQ;YACvB,UAAU,EAAE,GAAG,EAAE,UAAU;YAC3B,KAAK,EAAE,GAAG,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAExC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,4DAA4D;QAC5D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,MAAM,cAAc,GAAG,oBAAoB,CAAC;YAC1C,cAAc,EAAE,uBAAuB;YACvC,OAAO,EAAE,iBAAiB;SAC3B,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,SAAS,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAE9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE5C,4CAA4C;QAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,8BAA8B,EAC9B,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBAC/B,aAAa,EAAE,oBAAoB;aACpC,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,SAAS,CAAC,qBAAqB,CAAC;YAC9B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAE7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,iDAAiD;QACjD,MAAM,OAAO,CAAC,GAAG,CAAC;aACf,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAEhD,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE3C,oCAAoC;QACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAEhD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,SAAS,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAEjE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;aAC3B,GAAG,CAAC,OAAO,CAAC;aACZ,GAAG,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAE9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,IAAI,UAAqB,CAAC;QAC1B,IAAI,GAAW,CAAC;QAChB,IAAI,QAAkD,CAAC;QACvD,MAAM,OAAO,GAAG,6CAA6C,CAAC;QAE9D,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC9C,QAAQ,GAAG;gBACT,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACxD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,2BAA2B;YAC3B,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;gBACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;aACxB,CAAC;iBACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACzC,SAAS,CAAC,iBAAiB,CAAC;iBAC5B,UAAU,CAAC,YAAY,CAAC;iBACxB,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,MAAM,GAAG,GAAG,aAAa,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAC3B,GAAG,CAAC,OAAO,CAAC;iBACZ,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAEjD,qDAAqD;YACrD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;gBACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,iBAAiB;aACzB,CAAC;iBACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACzC,SAAS,CAAC,iBAAiB,CAAC;iBAC5B,UAAU,CAAC,YAAY,CAAC;iBACxB,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,MAAM,GAAG,GAAG,aAAa,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAC3B,GAAG,CAAC,OAAO,CAAC;iBACZ,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;gBACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,YAAY;aACxB,CAAC;iBACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACzC,SAAS,CAAC,iBAAiB,CAAC;iBAC5B,UAAU,CAAC,YAAY,CAAC;iBACxB,WAAW,EAAE;iBACb,iBAAiB,CAAC,IAAI,CAAC;iBACvB,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,MAAM,GAAG,GAAG,aAAa,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAC3B,GAAG,CAAC,OAAO,CAAC;iBACZ,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACpC,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;gBACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;gBAC9B,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,UAAU;aACtB,CAAC;iBACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACzC,SAAS,CAAC,iBAAiB,CAAC;iBAC5B,UAAU,CAAC,UAAU,CAAC;iBACtB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;iBACjD,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;iBACvD,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpB,MAAM,GAAG,GAAG,aAAa,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAC3B,GAAG,CAAC,OAAO,CAAC;iBACZ,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAE3C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/middleware/error-handler.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { ErrorResponse } from '../types.js';
+/**
+ * Express error middleware that returns structured JSON errors.
+ * Must be registered with 4 parameters for Express to recognize it as error middleware.
+ */
+export declare function errorHandler(err: Error, _req: Request, res: Response<ErrorResponse>, _next: NextFunction): void;
+/**
+ * Application-level error with status code and error code.
+ */
+export declare class AppError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(statusCode: number, code: string, message: string);
+}

package/dist/src/middleware/error-handler.js

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Express error middleware that returns structured JSON errors.
+ * Must be registered with 4 parameters for Express to recognize it as error middleware.
+ */
+export function errorHandler(err, _req, res, _next) {
+    const statusCode = getStatusCode(err);
+    const code = getErrorCode(err);
+    res.status(statusCode).json({
+        error: {
+            code,
+            message: err.message || 'Internal server error',
+        },
+    });
+}
+function getStatusCode(err) {
+    if ('statusCode' in err && typeof err.statusCode === 'number') {
+        return err.statusCode;
+    }
+    if ('status' in err && typeof err.status === 'number') {
+        return err.status;
+    }
+    return 500;
+}
+function getErrorCode(err) {
+    if ('code' in err && typeof err.code === 'string') {
+        return err.code;
+    }
+    return 'INTERNAL_ERROR';
+}
+/**
+ * Application-level error with status code and error code.
+ */
+export class AppError extends Error {
+    statusCode;
+    code;
+    constructor(statusCode, code, message) {
+        super(message);
+        this.name = 'AppError';
+        this.statusCode = statusCode;
+        this.code = code;
+    }
+}
+//# sourceMappingURL=error-handler.js.map

package/dist/src/middleware/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAU,EACV,IAAa,EACb,GAA4B,EAC5B,KAAmB;IAEnB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAE/B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QAC1B,KAAK,EAAE;YACL,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;SAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAU;IAC/B,IAAI,YAAY,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAU;IAC9B,IAAI,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,UAAU,CAAS;IACnB,IAAI,CAAS;IAEtB,YAAY,UAAkB,EAAE,IAAY,EAAE,OAAe;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/src/middleware/error-handler.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/middleware/error-handler.test.js

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { errorHandler, AppError } from './error-handler.js';
+function createMockRes() {
+    const res = {
+        status: vi.fn().mockReturnThis(),
+        json: vi.fn().mockReturnThis(),
+    };
+    return res;
+}
+describe('errorHandler', () => {
+    const req = {};
+    const next = vi.fn();
+    it('returns 500 for generic errors', () => {
+        const res = createMockRes();
+        errorHandler(new Error('boom'), req, res, next);
+        expect(res.status).toHaveBeenCalledWith(500);
+        expect(res.json).toHaveBeenCalledWith({
+            error: {
+                code: 'INTERNAL_ERROR',
+                message: 'boom',
+            },
+        });
+    });
+    it('uses statusCode from AppError', () => {
+        const res = createMockRes();
+        const err = new AppError(404, 'NOT_FOUND', 'Session not found');
+        errorHandler(err, req, res, next);
+        expect(res.status).toHaveBeenCalledWith(404);
+        expect(res.json).toHaveBeenCalledWith({
+            error: {
+                code: 'NOT_FOUND',
+                message: 'Session not found',
+            },
+        });
+    });
+    it('uses status property if present', () => {
+        const res = createMockRes();
+        const err = Object.assign(new Error('bad'), { status: 400 });
+        errorHandler(err, req, res, next);
+        expect(res.status).toHaveBeenCalledWith(400);
+    });
+    it('defaults message for empty error', () => {
+        const res = createMockRes();
+        errorHandler(new Error(''), req, res, next);
+        expect(res.json).toHaveBeenCalledWith({
+            error: {
+                code: 'INTERNAL_ERROR',
+                message: 'Internal server error',
+            },
+        });
+    });
+});
+describe('AppError', () => {
+    it('sets properties correctly', () => {
+        const err = new AppError(422, 'VALIDATION_ERROR', 'bad input');
+        expect(err.statusCode).toBe(422);
+        expect(err.code).toBe('VALIDATION_ERROR');
+        expect(err.message).toBe('bad input');
+        expect(err.name).toBe('AppError');
+        expect(err).toBeInstanceOf(Error);
+    });
+});
+//# sourceMappingURL=error-handler.test.js.map

package/dist/src/middleware/error-handler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.test.js","sourceRoot":"","sources":["../../../src/middleware/error-handler.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE5D,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG;QACV,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;QAChC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE;KAC/B,CAAC;IACF,OAAO,GAA0B,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,GAAG,GAAG,EAAa,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAkB,CAAC;IAErC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC;YACpC,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,MAAM;aAChB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;QAChE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC;YACpC,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC;YACpC,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,uBAAuB;aACjC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/middleware/request-validation.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { z } from 'zod';
+/**
+ * Express middleware factory that validates request body against a Zod schema.
+ * On success, replaces `req.body` with the parsed (and typed) result.
+ * On failure, passes an AppError to the next error handler.
+ */
+export declare function validate<T extends z.ZodType>(schema: T): (req: Request, res: Response, next: NextFunction) => void;

package/dist/src/middleware/request-validation.js

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { AppError } from './error-handler.js';
+/**
+ * Express middleware factory that validates request body against a Zod schema.
+ * On success, replaces `req.body` with the parsed (and typed) result.
+ * On failure, passes an AppError to the next error handler.
+ */
+export function validate(schema) {
+    return (req, _res, next) => {
+        const result = schema.safeParse(req.body);
+        if (!result.success) {
+            const messages = result.error.issues
+                .map((issue) => `${issue.path.join('.')}: ${issue.message}`)
+                .join('; ');
+            next(new AppError(400, 'VALIDATION_ERROR', messages));
+            return;
+        }
+        req.body = result.data;
+        next();
+    };
+}
+//# sourceMappingURL=request-validation.js.map

package/dist/src/middleware/request-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-validation.js","sourceRoot":"","sources":["../../../src/middleware/request-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,MAAS;IAET,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;iBAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/request-validation.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+export {};

package/dist/src/middleware/request-validation.test.js

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { describe, it, expect } from 'vitest';
+import { z } from 'zod';
+import { validate } from './request-validation.js';
+import { AppError } from './error-handler.js';
+const TestSchema = z.object({
+    name: z.string().min(1),
+    count: z.number().int().positive().optional(),
+});
+function callValidate(body) {
+    const middleware = validate(TestSchema);
+    const req = { body };
+    const res = {};
+    let nextArg = undefined;
+    const next = (arg) => {
+        nextArg = arg;
+    };
+    middleware(req, res, next);
+    return { nextArg, req };
+}
+describe('validate middleware', () => {
+    it('passes valid body through and replaces req.body with parsed data', () => {
+        const { nextArg, req } = callValidate({ name: 'test', count: 5 });
+        expect(nextArg).toBeUndefined(); // next() called without error
+        expect(req.body).toEqual({ name: 'test', count: 5 });
+    });
+    it('strips unknown fields from body', () => {
+        const { nextArg, req } = callValidate({
+            name: 'test',
+            extra: 'dropped',
+        });
+        expect(nextArg).toBeUndefined();
+        expect(req.body).toEqual({ name: 'test' });
+    });
+    it('rejects invalid body with AppError', () => {
+        const { nextArg } = callValidate({ count: -1 });
+        expect(nextArg).toBeInstanceOf(AppError);
+        const err = nextArg;
+        expect(err.statusCode).toBe(400);
+        expect(err.code).toBe('VALIDATION_ERROR');
+        expect(err.message).toContain('name');
+    });
+    it('reports multiple validation errors', () => {
+        const { nextArg } = callValidate({});
+        const err = nextArg;
+        expect(err.message).toContain('name');
+    });
+    it('rejects wrong types', () => {
+        const { nextArg } = callValidate({ name: 123 });
+        expect(nextArg).toBeInstanceOf(AppError);
+    });
+});
+//# sourceMappingURL=request-validation.test.js.map

package/dist/src/middleware/request-validation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-validation.test.js","sourceRoot":"","sources":["../../../src/middleware/request-validation.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,SAAS,YAAY,CACnB,IAAa;IAEb,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,GAAG,GAAqB,EAAE,IAAI,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,EAAc,CAAC;IAC3B,IAAI,OAAO,GAAY,SAAS,CAAC;IACjC,MAAM,IAAI,GAAiB,CAAC,GAAa,EAAE,EAAE;QAC3C,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC,CAAC;IACF,UAAU,CAAC,GAAc,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,8BAA8B;QAC/D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC;YACpC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,OAAmB,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,OAAmB,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/output/email-output.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { AutomationResult } from '../types.js';
+/**
+ * Stub email output — logs a warning that email is not yet implemented.
+ */
+export declare function sendEmailOutput(target: string, result: AutomationResult): Promise<void>;

package/dist/src/output/email-output.js

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+/**
+ * Stub email output — logs a warning that email is not yet implemented.
+ */
+export async function sendEmailOutput(target, result) {
+    process.stderr.write(`[WARN] Email output not implemented. Would send automation "${result.automation}" result to ${target}\n`);
+}
+//# sourceMappingURL=email-output.js.map

package/dist/src/output/email-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-output.js","sourceRoot":"","sources":["../../../src/output/email-output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,MAAwB;IAExB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+DAA+D,MAAM,CAAC,UAAU,eAAe,MAAM,IAAI,CAC1G,CAAC;AACJ,CAAC"}

package/dist/src/output/output-router.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import type { AutomationOutput } from '@amodalai/core';
+import type { AutomationResult } from '../types.js';
+/**
+ * Route automation output to the configured channel.
+ * Errors are caught and logged — output failures must never crash the server.
+ */
+export declare function routeOutput(output: AutomationOutput, result: AutomationResult): Promise<boolean>;

package/dist/src/output/output-router.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+import { sendSlackOutput } from './slack-output.js';
+import { sendWebhookOutput } from './webhook-output.js';
+import { sendEmailOutput } from './email-output.js';
+/**
+ * Route automation output to the configured channel.
+ * Errors are caught and logged — output failures must never crash the server.
+ */
+export async function routeOutput(output, result) {
+    try {
+        switch (output.channel) {
+            case 'slack':
+                await sendSlackOutput(output.target, result);
+                return true;
+            case 'webhook':
+                await sendWebhookOutput(output.target, result);
+                return true;
+            case 'email':
+                await sendEmailOutput(output.target, result);
+                return true;
+            default:
+                process.stderr.write(`[WARN] Unknown output channel: ${output.channel}\n`);
+                return false;
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[ERROR] Output routing failed for ${output.channel}:${output.target}: ${message}\n`);
+        return false;
+    }
+}
+//# sourceMappingURL=output-router.js.map

package/dist/src/output/output-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-router.js","sourceRoot":"","sources":["../../../src/output/output-router.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAwB,EACxB,MAAwB;IAExB,IAAI,CAAC;QACH,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,OAAO;gBACV,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,KAAK,SAAS;gBACZ,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC/C,OAAO,IAAI,CAAC;YACd,KAAK,OAAO;gBACV,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kCAAkC,MAAM,CAAC,OAAiB,IAAI,CAC/D,CAAC;gBACF,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CACrF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}