@dudousxd/nestjs-durable 0.52.0 → 0.52.1

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
+import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, RunRequest, RunReply, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
 export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunSchedulesOptions, RunStatus, RunWaiting, ScheduledWorkflow, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, TenantTokenSource, TenantVerifier, VerifiedTenant, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, hmacTenantVerifier, prevCronFireMs, readSearchAttributes, runSchedules, scheduleRunIdAt, scheduledRunId, signTenantToken } from '@dudousxd/nestjs-durable-core';
 import { z } from 'zod';
 import { ConcurrencyOption, StartRunDeps, RunRedisWorkerOptions, RunningWorker, DurableWorkerRuntime } from '@dudousxd/durable-worker';
@@ -1098,6 +1098,77 @@ declare class InAppWorkerBootstrap implements OnModuleInit, OnApplicationBootstr
  */
 declare function inAppWorkerProviders(): Provider[];
 
+/**
+ * The error `code` a responder replies with for a verb it does not know, so a newer tenant can tell
+ * "this control plane is older than me" from a real failure and fall back at once. Earlier
+ * responders reply `ok: true` with no `data` instead; `ProxyRunGateway` reads both.
+ */
+declare const UNSUPPORTED_RUN_REQUEST = "unsupported-request";
+/** The narrow slice of `Transport` the responder needs — a tenant's read/control request in, a
+ *  correlated reply out. Both are OPTIONAL on the full `Transport` interface (only broker
+ *  transports carry the run-request/reply protocol); the caller capability-checks before wiring
+ *  this up (see `durable.module.ts`). */
+interface RunRequestTransport {
+    onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
+    publishRunReply(reply: RunReply): Promise<void>;
+}
+/** Options for {@link RunRequestResponder}. */
+interface RunRequestResponderOptions {
+    /**
+     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
+     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
+     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
+     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
+     */
+    verifyTenant?: TenantVerifier | undefined;
+    /**
+     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
+     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
+     * never serves tenants boots silently.
+     */
+    warnWithoutVerifier?: boolean | undefined;
+}
+/**
+ * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
+ * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
+ * verb it loads the run via `getRunDetail` FIRST and compares `run.namespace` to the requesting
+ * `msg.tenant` — a mismatch short-circuits into a `cross-tenant` error reply WITHOUT calling the
+ * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
+ * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
+ * sent. This is the security boundary of the tenant run gateway — do not weaken it.
+ *
+ * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
+ * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
+ * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
+ * that throws becomes an error reply too.
+ */
+declare class RunRequestResponder {
+    private readonly transport;
+    private readonly gateway;
+    private readonly verifyTenant;
+    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
+    /** Register the consumer on the transport. Each request is answered independently; a handler
+     *  failure never throws back into the transport (errors are captured into an error reply). */
+    start(): void;
+    private handle;
+    private callVerb;
+}
+
+/**
+ * An error reply from the control plane. `code` carries the reply's machine-readable reason when it
+ * sent one — `unauthorized` (the tenant token was rejected), `cross-tenant` (the run belongs to
+ * another tenant), ... — so a caller can tell an authentication failure from a real one, as with
+ * Agora's proxy.
+ */
+/**
+ * The codes the run-request responder replies with. `string & {}` keeps a code from a newer control
+ * plane assignable without losing autocomplete on the known ones.
+ */
+type RunGatewayErrorCode = 'unauthorized' | 'cross-tenant' | typeof UNSUPPORTED_RUN_REQUEST | (string & {});
+declare class RunGatewayError extends Error {
+    readonly code: RunGatewayErrorCode | undefined;
+    constructor(message: string, code?: RunGatewayErrorCode);
+}
 /**
  * Tenant-side `RunGateway` — round-trips every verb as a `RunRequest`/`RunReply` pair over the
  * transport, correlated by a minted `requestId`, and bridges `subscribe` onto the transport's
@@ -1136,6 +1207,7 @@ declare class ProxyRunGateway implements RunGateway {
     tenantToken?: TenantTokenSource | undefined);
     private handleReply;
     private request;
+    private send;
     topology(): DurableTopology;
     /**
      * A control plane that predates {@link RunDetailOptions} ignores them and sends the full detail;
@@ -1187,62 +1259,6 @@ declare function isOperatorRole(options: DurableModuleOptions): boolean;
  */
 declare function isDrivingOperator(options: DurableModuleOptions): boolean;
 
-/**
- * The error `code` a responder replies with for a verb it does not know, so a newer tenant can tell
- * "this control plane is older than me" from a real failure and fall back at once. Earlier
- * responders reply `ok: true` with no `data` instead; `ProxyRunGateway` reads both.
- */
-declare const UNSUPPORTED_RUN_REQUEST = "unsupported-request";
-/** The narrow slice of `Transport` the responder needs — a tenant's read/control request in, a
- *  correlated reply out. Both are OPTIONAL on the full `Transport` interface (only broker
- *  transports carry the run-request/reply protocol); the caller capability-checks before wiring
- *  this up (see `durable.module.ts`). */
-interface RunRequestTransport {
-    onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
-    publishRunReply(reply: RunReply): Promise<void>;
-}
-/** Options for {@link RunRequestResponder}. */
-interface RunRequestResponderOptions {
-    /**
-     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
-     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
-     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
-     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
-     */
-    verifyTenant?: TenantVerifier | undefined;
-    /**
-     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
-     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
-     * never serves tenants boots silently.
-     */
-    warnWithoutVerifier?: boolean | undefined;
-}
-/**
- * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
- * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
- * verb it loads the run via `getRunDetail` FIRST and compares `run.namespace` to the requesting
- * `msg.tenant` — a mismatch short-circuits into a `cross-tenant` error reply WITHOUT calling the
- * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
- * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
- * sent. This is the security boundary of the tenant run gateway — do not weaken it.
- *
- * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
- * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
- * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
- * that throws becomes an error reply too.
- */
-declare class RunRequestResponder {
-    private readonly transport;
-    private readonly gateway;
-    private readonly verifyTenant;
-    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
-    /** Register the consumer on the transport. Each request is answered independently; a handler
-     *  failure never throws back into the transport (errors are captured into an error reply). */
-    start(): void;
-    private handle;
-    private callVerb;
-}
-
 declare const STEP_INTERCEPTOR_METADATA: unique symbol;
 /**
  * The shape a `@StepInterceptor()` provider must implement: `intercept(invocation, next)` wraps the
@@ -1433,4 +1449,4 @@ declare class WorkflowService {
     }): Promise<number>;
 }
 
-export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };
+export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, RunGatewayError, type RunGatewayErrorCode, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
+import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, RunRequest, RunReply, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
 export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunSchedulesOptions, RunStatus, RunWaiting, ScheduledWorkflow, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, TenantTokenSource, TenantVerifier, VerifiedTenant, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, hmacTenantVerifier, prevCronFireMs, readSearchAttributes, runSchedules, scheduleRunIdAt, scheduledRunId, signTenantToken } from '@dudousxd/nestjs-durable-core';
 import { z } from 'zod';
 import { ConcurrencyOption, StartRunDeps, RunRedisWorkerOptions, RunningWorker, DurableWorkerRuntime } from '@dudousxd/durable-worker';
@@ -1098,6 +1098,77 @@ declare class InAppWorkerBootstrap implements OnModuleInit, OnApplicationBootstr
  */
 declare function inAppWorkerProviders(): Provider[];
 
+/**
+ * The error `code` a responder replies with for a verb it does not know, so a newer tenant can tell
+ * "this control plane is older than me" from a real failure and fall back at once. Earlier
+ * responders reply `ok: true` with no `data` instead; `ProxyRunGateway` reads both.
+ */
+declare const UNSUPPORTED_RUN_REQUEST = "unsupported-request";
+/** The narrow slice of `Transport` the responder needs — a tenant's read/control request in, a
+ *  correlated reply out. Both are OPTIONAL on the full `Transport` interface (only broker
+ *  transports carry the run-request/reply protocol); the caller capability-checks before wiring
+ *  this up (see `durable.module.ts`). */
+interface RunRequestTransport {
+    onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
+    publishRunReply(reply: RunReply): Promise<void>;
+}
+/** Options for {@link RunRequestResponder}. */
+interface RunRequestResponderOptions {
+    /**
+     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
+     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
+     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
+     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
+     */
+    verifyTenant?: TenantVerifier | undefined;
+    /**
+     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
+     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
+     * never serves tenants boots silently.
+     */
+    warnWithoutVerifier?: boolean | undefined;
+}
+/**
+ * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
+ * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
+ * verb it loads the run via `getRunDetail` FIRST and compares `run.namespace` to the requesting
+ * `msg.tenant` — a mismatch short-circuits into a `cross-tenant` error reply WITHOUT calling the
+ * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
+ * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
+ * sent. This is the security boundary of the tenant run gateway — do not weaken it.
+ *
+ * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
+ * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
+ * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
+ * that throws becomes an error reply too.
+ */
+declare class RunRequestResponder {
+    private readonly transport;
+    private readonly gateway;
+    private readonly verifyTenant;
+    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
+    /** Register the consumer on the transport. Each request is answered independently; a handler
+     *  failure never throws back into the transport (errors are captured into an error reply). */
+    start(): void;
+    private handle;
+    private callVerb;
+}
+
+/**
+ * An error reply from the control plane. `code` carries the reply's machine-readable reason when it
+ * sent one — `unauthorized` (the tenant token was rejected), `cross-tenant` (the run belongs to
+ * another tenant), ... — so a caller can tell an authentication failure from a real one, as with
+ * Agora's proxy.
+ */
+/**
+ * The codes the run-request responder replies with. `string & {}` keeps a code from a newer control
+ * plane assignable without losing autocomplete on the known ones.
+ */
+type RunGatewayErrorCode = 'unauthorized' | 'cross-tenant' | typeof UNSUPPORTED_RUN_REQUEST | (string & {});
+declare class RunGatewayError extends Error {
+    readonly code: RunGatewayErrorCode | undefined;
+    constructor(message: string, code?: RunGatewayErrorCode);
+}
 /**
  * Tenant-side `RunGateway` — round-trips every verb as a `RunRequest`/`RunReply` pair over the
  * transport, correlated by a minted `requestId`, and bridges `subscribe` onto the transport's
@@ -1136,6 +1207,7 @@ declare class ProxyRunGateway implements RunGateway {
     tenantToken?: TenantTokenSource | undefined);
     private handleReply;
     private request;
+    private send;
     topology(): DurableTopology;
     /**
      * A control plane that predates {@link RunDetailOptions} ignores them and sends the full detail;
@@ -1187,62 +1259,6 @@ declare function isOperatorRole(options: DurableModuleOptions): boolean;
  */
 declare function isDrivingOperator(options: DurableModuleOptions): boolean;
 
-/**
- * The error `code` a responder replies with for a verb it does not know, so a newer tenant can tell
- * "this control plane is older than me" from a real failure and fall back at once. Earlier
- * responders reply `ok: true` with no `data` instead; `ProxyRunGateway` reads both.
- */
-declare const UNSUPPORTED_RUN_REQUEST = "unsupported-request";
-/** The narrow slice of `Transport` the responder needs — a tenant's read/control request in, a
- *  correlated reply out. Both are OPTIONAL on the full `Transport` interface (only broker
- *  transports carry the run-request/reply protocol); the caller capability-checks before wiring
- *  this up (see `durable.module.ts`). */
-interface RunRequestTransport {
-    onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
-    publishRunReply(reply: RunReply): Promise<void>;
-}
-/** Options for {@link RunRequestResponder}. */
-interface RunRequestResponderOptions {
-    /**
-     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
-     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
-     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
-     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
-     */
-    verifyTenant?: TenantVerifier | undefined;
-    /**
-     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
-     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
-     * never serves tenants boots silently.
-     */
-    warnWithoutVerifier?: boolean | undefined;
-}
-/**
- * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
- * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
- * verb it loads the run via `getRunDetail` FIRST and compares `run.namespace` to the requesting
- * `msg.tenant` — a mismatch short-circuits into a `cross-tenant` error reply WITHOUT calling the
- * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
- * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
- * sent. This is the security boundary of the tenant run gateway — do not weaken it.
- *
- * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
- * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
- * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
- * that throws becomes an error reply too.
- */
-declare class RunRequestResponder {
-    private readonly transport;
-    private readonly gateway;
-    private readonly verifyTenant;
-    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
-    /** Register the consumer on the transport. Each request is answered independently; a handler
-     *  failure never throws back into the transport (errors are captured into an error reply). */
-    start(): void;
-    private handle;
-    private callVerb;
-}
-
 declare const STEP_INTERCEPTOR_METADATA: unique symbol;
 /**
  * The shape a `@StepInterceptor()` provider must implement: `intercept(invocation, next)` wraps the
@@ -1433,4 +1449,4 @@ declare class WorkflowService {
     }): Promise<number>;
 }
 
-export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };
+export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, RunGatewayError, type RunGatewayErrorCode, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };

package/dist/index.js

@@ -1410,7 +1410,18 @@ function _ts_metadata6(metadataKey, metadataValue) {
   }
 }
 __name(_ts_metadata6, "_ts_metadata");
-var UnsupportedRunRequestError = class UnsupportedRunRequestError2 extends Error {
+var RunGatewayError = class extends Error {
+  static {
+    __name(this, "RunGatewayError");
+  }
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "RunGatewayError";
+    this.code = code;
+  }
+};
+var UnsupportedRunRequestError = class UnsupportedRunRequestError2 extends RunGatewayError {
   static {
     __name(this, "UnsupportedRunRequestError");
   }
@@ -1450,15 +1461,17 @@ var ProxyRunGateway = class {
     if (reply.result.ok) {
       pending.resolve(reply.result.data);
     } else if (reply.result.error.code === UNSUPPORTED_RUN_REQUEST) {
-      pending.reject(new UnsupportedRunRequestError(reply.result.error.message));
+      pending.reject(new UnsupportedRunRequestError(reply.result.error.message, UNSUPPORTED_RUN_REQUEST));
     } else {
-      const { message, code } = reply.result.error;
-      pending.reject(code !== void 0 ? Object.assign(new Error(message), {
-        code
-      }) : new Error(message));
+      pending.reject(new RunGatewayError(reply.result.error.message, reply.result.error.code));
     }
   }
   request(body) {
+    const source = this.tenantToken;
+    if (typeof source !== "function") return this.send(source ?? this.tenant, body);
+    return resolveTenantToken2(source).then((tenant) => this.send(tenant, body));
+  }
+  send(tenant, body) {
     return new Promise((resolve, reject) => {
       const requestId = globalThis.crypto.randomUUID();
       const timer = setTimeout(() => {
@@ -1470,17 +1483,11 @@ var ProxyRunGateway = class {
         reject,
         timer
       });
-      const source = this.tenantToken;
-      const dispatched = typeof source === "function" ? resolveTenantToken2(source).then((tenant) => this.transport.dispatchRunRequest?.({
+      this.transport.dispatchRunRequest?.({
         requestId,
         tenant,
         body
-      })) : this.transport.dispatchRunRequest?.({
-        requestId,
-        tenant: source ?? this.tenant,
-        body
-      });
-      dispatched?.catch((error) => {
+      })?.catch((error) => {
         const stillPending = this.pending.get(requestId);
         if (!stillPending) return;
         clearTimeout(stillPending.timer);
@@ -3030,6 +3037,7 @@ export {
   RUN_GATEWAY,
   RUN_REDIS_WORKER,
   RunGateway3 as RunGateway,
+  RunGatewayError,
   RunRequestResponder,
   STEP_INTERCEPTOR_METADATA,
   Step,