@forestadmin/workflow-executor 1.1.5 → 1.3.0

package/dist/http/executor-http-server.js

@@ -8,6 +8,8 @@ const router_1 = __importDefault(require("@koa/router"));
 const http_1 = __importDefault(require("http"));
 const koa_1 = __importDefault(require("koa"));
 const koa_jwt_1 = __importDefault(require("koa-jwt"));
+const bearer_claims_1 = require("./bearer-claims");
+const http_errors_1 = require("./http-errors");
 const step_serializer_1 = __importDefault(require("./step-serializer"));
 const console_logger_1 = __importDefault(require("../adapters/console-logger"));
 const errors_1 = require("../errors");
@@ -15,28 +17,41 @@ class ExecutorHttpServer {
     constructor(options) {
         this.server = null;
         this.options = options;
-        this.logger = options.logger ?? new console_logger_1.default();
+        this.logger = options.logger ?? (0, console_logger_1.default)();
         this.app = new koa_1.default();
-        // Error middleware — catches all errors (including JWT 401) and returns structured JSON
+        // Error-translation middleware — the single place converting thrown errors (typed HTTP
+        // errors, domain errors via toHttpError, JWT 401) into HTTP responses. Handlers just throw.
         this.app.use(async (ctx, next) => {
             try {
                 await next();
             }
             catch (err) {
-                const { status } = err;
-                if (status === 401) {
-                    ctx.status = 401;
-                    ctx.body = { error: 'Unauthorized' };
+                const httpError = (0, http_errors_1.toHttpError)(err);
+                if (!httpError) {
+                    this.logger('Error', 'Unhandled HTTP error', {
+                        method: ctx.method,
+                        path: ctx.path,
+                        error: (0, errors_1.extractErrorMessage)(err),
+                        stack: err instanceof Error ? err.stack : undefined,
+                    });
+                    ctx.status = 500;
+                    ctx.body = { error: 'Internal server error' };
                     return;
                 }
-                this.logger.error('Unhandled HTTP error', {
-                    method: ctx.method,
-                    path: ctx.path,
-                    error: (0, errors_1.extractErrorMessage)(err),
-                    stack: err instanceof Error ? err.stack : undefined,
-                });
-                ctx.status = 500;
-                ctx.body = { error: 'Internal server error' };
+                if (httpError.log) {
+                    this.logger('Error', 'HTTP request failed', {
+                        method: ctx.method,
+                        path: ctx.path,
+                        status: httpError.status,
+                        error: (0, errors_1.extractErrorMessage)(httpError.cause ?? httpError),
+                        // Prefer the cause's stack (points at the real fault site); fall back to the HTTP
+                        // error's own stack so a log:true error without a cause never logs an empty stack.
+                        stack: (httpError.cause instanceof Error ? httpError.cause.stack : undefined) ??
+                            httpError.stack,
+                    });
+                }
+                ctx.status = httpError.status;
+                ctx.body = { error: httpError.userMessage };
             }
         });
         // Health endpoint — before JWT so it's publicly accessible (infra probes don't send tokens)
@@ -53,6 +68,24 @@ class ExecutorHttpServer {
         // JWT middleware — validates Bearer token using authSecret
         // tokenKey: 'rawToken' exposes the raw token string on ctx.state.rawToken for downstream use
         this.app.use((0, koa_jwt_1.default)({ secret: options.authSecret, cookie: 'forest_session_token', tokenKey: 'rawToken' }));
+        // koa-jwt only validates the token's signature/expiry, not its payload shape. Validate the
+        // claims once, here, so every handler downstream gets a user with a guaranteed numeric id.
+        this.app.use(async (ctx, next) => {
+            const claims = bearer_claims_1.BearerClaimsSchema.safeParse(ctx.state.user);
+            if (!claims.success) {
+                // A token koa-jwt accepted (valid signature) but whose payload is malformed is rare and
+                // high-signal (token-issuance regression / version skew / forgery probe) — log it, unlike
+                // ordinary expired-token churn. Only the issue paths/codes, never the payload (PII).
+                this.logger('Warn', 'Bearer token has invalid claims', {
+                    method: ctx.method,
+                    path: ctx.path,
+                    issues: claims.error.issues.map(issue => ({ path: issue.path, code: issue.code })),
+                });
+                throw new http_errors_1.UnauthorizedHttpError();
+            }
+            ctx.state.user = { ...ctx.state.user, ...claims.data };
+            await next();
+        });
         const router = new router_1.default();
         // hasRunAccess authorization — only on GET (read-only route).
         // Trigger handles its own authz by comparing bearer user with step.user.
@@ -90,26 +123,23 @@ class ExecutorHttpServer {
     }
     async hasRunAccessMiddleware(ctx, next) {
         const user = ctx.state.user;
+        let allowed;
         try {
-            const allowed = await this.options.workflowPort.hasRunAccess(ctx.params.runId, user);
-            if (!allowed) {
-                ctx.status = 403;
-                ctx.body = { error: 'Forbidden' };
-                return;
-            }
+            allowed = await this.options.workflowPort.hasRunAccess(ctx.params.runId, user);
         }
         catch (err) {
-            this.logger.error('Failed to check run access', {
+            this.logger('Error', 'Failed to check run access', {
                 runId: ctx.params.runId,
                 method: ctx.method,
                 path: ctx.path,
                 error: (0, errors_1.extractErrorMessage)(err),
                 stack: err instanceof Error ? err.stack : undefined,
             });
-            ctx.status = 503;
-            ctx.body = { error: 'Service unavailable' };
-            return;
+            // log:false — already logged above with the richer runId context.
+            throw new http_errors_1.ServiceUnavailableHttpError('Service unavailable', { cause: err });
         }
+        if (!allowed)
+            throw new http_errors_1.ForbiddenHttpError();
         await next();
     }
     async handleGetRun(ctx) {
@@ -118,53 +148,13 @@ class ExecutorHttpServer {
     }
     async handleTrigger(ctx) {
         const { runId } = ctx.params;
-        const rawId = ctx.state.user?.id;
-        const bearerUserId = typeof rawId === 'number' ? rawId : Number(rawId);
-        if (!Number.isFinite(bearerUserId)) {
-            ctx.status = 400;
-            ctx.body = { error: 'Missing or invalid user id in token' };
-            return;
-        }
+        // Guaranteed a number by the bearer-claims middleware.
+        const bearerUserId = ctx.state.user.id;
         const pendingData = ctx.request.body?.pendingData;
-        try {
-            await this.options.runner.triggerPoll(runId, {
-                pendingData,
-                bearerUserId,
-            });
-        }
-        catch (err) {
-            if (err instanceof errors_1.RunNotFoundError) {
-                ctx.status = 404;
-                ctx.body = { error: 'Run not found or unavailable' };
-                return;
-            }
-            if (err instanceof errors_1.RunAlreadyInFlightError) {
-                ctx.status = 400;
-                ctx.body = { error: err.message };
-                return;
-            }
-            if (err instanceof errors_1.UserMismatchError) {
-                this.logger.error('User mismatch on trigger', { runId, bearerUserId });
-                ctx.status = 403;
-                ctx.body = { error: 'Forbidden' };
-                return;
-            }
-            if (err instanceof errors_1.WorkflowExecutorError) {
-                this.logger.error('Malformed run on trigger', {
-                    runId,
-                    bearerUserId,
-                    error: (0, errors_1.extractErrorMessage)(err),
-                    stack: err.stack,
-                });
-                ctx.status = 400;
-                ctx.body = { error: err.userMessage };
-                return;
-            }
-            throw err;
-        }
+        await this.options.runner.triggerPoll(runId, { pendingData, bearerUserId });
         ctx.status = 200;
         ctx.body = { triggered: true };
     }
 }
 exports.default = ExecutorHttpServer;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhlY3V0b3ItaHR0cC1zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaHR0cC9leGVjdXRvci1odHRwLXNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQU1BLGlFQUF5QztBQUN6Qyx5REFBaUM7QUFDakMsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUN0QixzREFBNkI7QUFFN0Isd0VBQXFEO0FBQ3JELGdGQUF1RDtBQUN2RCxzQ0FNbUI7QUFVbkIsTUFBcUIsa0JBQWtCO0lBTXJDLFlBQVksT0FBa0M7UUFGdEMsV0FBTSxHQUFrQixJQUFJLENBQUM7UUFHbkMsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUksd0JBQWEsRUFBRSxDQUFDO1FBQ3BELElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxhQUFHLEVBQUUsQ0FBQztRQUVyQix3RkFBd0Y7UUFDeEYsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRTtZQUMvQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLEVBQUUsQ0FBQztZQUNmLENBQUM7WUFBQyxPQUFPLEdBQVksRUFBRSxDQUFDO2dCQUN0QixNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsR0FBMEIsQ0FBQztnQkFFOUMsSUFBSSxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUM7b0JBQ25CLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO29CQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxDQUFDO29CQUVyQyxPQUFPO2dCQUNULENBQUM7Z0JBRUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsc0JBQXNCLEVBQUU7b0JBQ3hDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtvQkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO29CQUNkLEtBQUssRUFBRSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQztvQkFDL0IsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVM7aUJBQ3BELENBQUMsQ0FBQztnQkFDSCxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztnQkFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxDQUFDO1lBQ2hELENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUVILDRGQUE0RjtRQUM1RixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxLQUFLLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDbkQsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2dCQUN0QyxHQUFHLENBQUMsTUFBTSxHQUFHLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7Z0JBQ3JFLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQztnQkFFckIsT0FBTztZQUNULENBQUM7WUFFRCxNQUFNLElBQUksRUFBRSxDQUFDO1FBQ2YsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFBLG9CQUFVLEdBQUUsQ0FBQyxDQUFDO1FBRTNCLDJEQUEyRDtRQUMzRCw2RkFBNkY7UUFDN0YsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQ1YsSUFBQSxpQkFBTSxFQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUM3RixDQUFDO1FBRUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxnQkFBTSxFQUFFLENBQUM7UUFFNUIsOERBQThEO1FBQzlELHlFQUF5RTtRQUN6RSxNQUFNLENBQUMsR0FBRyxDQUNSLGNBQWMsRUFDZCxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUN0QyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FDN0IsQ0FBQztRQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUVuRSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUs7UUFDVCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JDLElBQUksQ0FBQyxNQUFNLEdBQUcsY0FBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7WUFDckQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJO1FBQ1IsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNqQixPQUFPLEVBQUUsQ0FBQztnQkFFVixPQUFPO1lBQ1QsQ0FBQztZQUVELElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFO2dCQUN0QixJQUFJLEdBQUcsRUFBRSxDQUFDO29CQUNSLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDZCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUM7b0JBQ25CLE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQUksUUFBUTtRQUNWLE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUM3QixDQUFDO0lBRU8sS0FBSyxDQUFDLHNCQUFzQixDQUFDLEdBQWdCLEVBQUUsSUFBYztRQUNuRSxNQUFNLElBQUksR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQWdCLENBQUM7UUFFeEMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFFckYsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO2dCQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxDQUFDO2dCQUVsQyxPQUFPO1lBQ1QsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsNEJBQTRCLEVBQUU7Z0JBQzlDLEtBQUssRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3ZCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtnQkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO2dCQUNkLEtBQUssRUFBRSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQztnQkFDL0IsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVM7YUFDcEQsQ0FBQyxDQUFDO1lBQ0gsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7WUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxDQUFDO1lBRTVDLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWSxDQUFDLEdBQWdCO1FBQ3pDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsb0JBQW9CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRSxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMseUJBQW9CLENBQUMsRUFBRSxDQUFDO0lBQ3hELENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQWdCO1FBQzFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQzdCLE1BQU0sS0FBSyxHQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBeUIsRUFBRSxFQUFFLENBQUM7UUFDdkQsTUFBTSxZQUFZLEdBQUcsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUV2RSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ25DLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1lBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUscUNBQXFDLEVBQUUsQ0FBQztZQUU1RCxPQUFPO1FBQ1QsQ0FBQztRQUVELE1BQU0sV0FBVyxHQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBa0MsRUFBRSxXQUFXLENBQUM7UUFFakYsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFO2dCQUMzQyxXQUFXO2dCQUNYLFlBQVk7YUFDYixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLElBQUksR0FBRyxZQUFZLHlCQUFnQixFQUFFLENBQUM7Z0JBQ3BDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO2dCQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLDhCQUE4QixFQUFFLENBQUM7Z0JBRXJELE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxHQUFHLFlBQVksZ0NBQXVCLEVBQUUsQ0FBQztnQkFDM0MsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7Z0JBQ2pCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUVsQyxPQUFPO1lBQ1QsQ0FBQztZQUVELElBQUksR0FBRyxZQUFZLDBCQUFpQixFQUFFLENBQUM7Z0JBQ3JDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLDBCQUEwQixFQUFFLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7Z0JBQ3ZFLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO2dCQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxDQUFDO2dCQUVsQyxPQUFPO1lBQ1QsQ0FBQztZQUVELElBQUksR0FBRyxZQUFZLDhCQUFxQixFQUFFLENBQUM7Z0JBQ3pDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLDBCQUEwQixFQUFFO29CQUM1QyxLQUFLO29CQUNMLFlBQVk7b0JBQ1osS0FBSyxFQUFFLElBQUEsNEJBQW1CLEVBQUMsR0FBRyxDQUFDO29CQUMvQixLQUFLLEVBQUUsR0FBRyxDQUFDLEtBQUs7aUJBQ2pCLENBQUMsQ0FBQztnQkFDSCxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztnQkFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBRXRDLE9BQU87WUFDVCxDQUFDO1lBRUQsTUFBTSxHQUFHLENBQUM7UUFDWixDQUFDO1FBRUQsR0FBRyxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUM7UUFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNqQyxDQUFDO0NBQ0Y7QUF0TUQscUNBc01DIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhlY3V0b3ItaHR0cC1zZXJ2ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaHR0cC9leGVjdXRvci1odHRwLXNlcnZlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUtBLGlFQUF5QztBQUN6Qyx5REFBaUM7QUFDakMsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUN0QixzREFBNkI7QUFFN0IsbURBQXdFO0FBQ3hFLCtDQUt1QjtBQUN2Qix3RUFBcUQ7QUFDckQsZ0ZBQTZEO0FBQzdELHNDQUFnRDtBQVVoRCxNQUFxQixrQkFBa0I7SUFNckMsWUFBWSxPQUFrQztRQUZ0QyxXQUFNLEdBQWtCLElBQUksQ0FBQztRQUduQyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN2QixJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBQSx3QkFBbUIsR0FBRSxDQUFDO1FBQ3RELElBQUksQ0FBQyxHQUFHLEdBQUcsSUFBSSxhQUFHLEVBQUUsQ0FBQztRQUVyQix1RkFBdUY7UUFDdkYsNEZBQTRGO1FBQzVGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxFQUFFLENBQUM7WUFDZixDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxTQUFTLEdBQUcsSUFBQSx5QkFBVyxFQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUVuQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7b0JBQ2YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLEVBQUU7d0JBQzNDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTt3QkFDbEIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO3dCQUNkLEtBQUssRUFBRSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQzt3QkFDL0IsS0FBSyxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVM7cUJBQ3BELENBQUMsQ0FBQztvQkFDSCxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztvQkFDakIsR0FBRyxDQUFDLElBQUksR0FBRyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxDQUFDO29CQUU5QyxPQUFPO2dCQUNULENBQUM7Z0JBRUQsSUFBSSxTQUFTLENBQUMsR0FBRyxFQUFFLENBQUM7b0JBQ2xCLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLHFCQUFxQixFQUFFO3dCQUMxQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07d0JBQ2xCLElBQUksRUFBRSxHQUFHLENBQUMsSUFBSTt3QkFDZCxNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07d0JBQ3hCLEtBQUssRUFBRSxJQUFBLDRCQUFtQixFQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksU0FBUyxDQUFDO3dCQUN4RCxrRkFBa0Y7d0JBQ2xGLG1GQUFtRjt3QkFDbkYsS0FBSyxFQUNILENBQUMsU0FBUyxDQUFDLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7NEJBQ3RFLFNBQVMsQ0FBQyxLQUFLO3FCQUNsQixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztnQkFFRCxHQUFHLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQUM7Z0JBQzlCLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlDLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUVILDRGQUE0RjtRQUM1RixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxLQUFLLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDbkQsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2dCQUN0QyxHQUFHLENBQUMsTUFBTSxHQUFHLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7Z0JBQ3JFLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQztnQkFFckIsT0FBTztZQUNULENBQUM7WUFFRCxNQUFNLElBQUksRUFBRSxDQUFDO1FBQ2YsQ0FBQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFBLG9CQUFVLEdBQUUsQ0FBQyxDQUFDO1FBRTNCLDJEQUEyRDtRQUMzRCw2RkFBNkY7UUFDN0YsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQ1YsSUFBQSxpQkFBTSxFQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUM3RixDQUFDO1FBRUYsMkZBQTJGO1FBQzNGLDJGQUEyRjtRQUMzRixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFO1lBQy9CLE1BQU0sTUFBTSxHQUFHLGtDQUFrQixDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBRTVELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ3BCLHdGQUF3RjtnQkFDeEYsMEZBQTBGO2dCQUMxRixxRkFBcUY7Z0JBQ3JGLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLGlDQUFpQyxFQUFFO29CQUNyRCxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07b0JBQ2xCLElBQUksRUFBRSxHQUFHLENBQUMsSUFBSTtvQkFDZCxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztpQkFDbkYsQ0FBQyxDQUFDO2dCQUVILE1BQU0sSUFBSSxtQ0FBcUIsRUFBRSxDQUFDO1lBQ3BDLENBQUM7WUFFRCxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksR0FBRyxFQUFFLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsR0FBRyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7WUFFdkQsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUNmLENBQUMsQ0FBQyxDQUFDO1FBRUgsTUFBTSxNQUFNLEdBQUcsSUFBSSxnQkFBTSxFQUFFLENBQUM7UUFFNUIsOERBQThEO1FBQzlELHlFQUF5RTtRQUN6RSxNQUFNLENBQUMsR0FBRyxDQUNSLGNBQWMsRUFDZCxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUN0QyxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FDN0IsQ0FBQztRQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUVuRSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUs7UUFDVCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JDLElBQUksQ0FBQyxNQUFNLEdBQUcsY0FBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7WUFDckQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJO1FBQ1IsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNqQixPQUFPLEVBQUUsQ0FBQztnQkFFVixPQUFPO1lBQ1QsQ0FBQztZQUVELElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFO2dCQUN0QixJQUFJLEdBQUcsRUFBRSxDQUFDO29CQUNSLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDZCxDQUFDO3FCQUFNLENBQUM7b0JBQ04sSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUM7b0JBQ25CLE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQUksUUFBUTtRQUNWLE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUM3QixDQUFDO0lBRU8sS0FBSyxDQUFDLHNCQUFzQixDQUFDLEdBQWdCLEVBQUUsSUFBYztRQUNuRSxNQUFNLElBQUksR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQW9CLENBQUM7UUFDNUMsSUFBSSxPQUFnQixDQUFDO1FBRXJCLElBQUksQ0FBQztZQUNILE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNqRixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLDRCQUE0QixFQUFFO2dCQUNqRCxLQUFLLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN2QixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07Z0JBQ2xCLElBQUksRUFBRSxHQUFHLENBQUMsSUFBSTtnQkFDZCxLQUFLLEVBQUUsSUFBQSw0QkFBbUIsRUFBQyxHQUFHLENBQUM7Z0JBQy9CLEtBQUssRUFBRSxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTO2FBQ3BELENBQUMsQ0FBQztZQUVILGtFQUFrRTtZQUNsRSxNQUFNLElBQUkseUNBQTJCLENBQUMscUJBQXFCLEVBQUUsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBRUQsSUFBSSxDQUFDLE9BQU87WUFBRSxNQUFNLElBQUksZ0NBQWtCLEVBQUUsQ0FBQztRQUU3QyxNQUFNLElBQUksRUFBRSxDQUFDO0lBQ2YsQ0FBQztJQUVPLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBZ0I7UUFDekMsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQy9FLEdBQUcsQ0FBQyxJQUFJLEdBQUcsRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyx5QkFBb0IsQ0FBQyxFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhLENBQUMsR0FBZ0I7UUFDMUMsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUM7UUFDN0IsdURBQXVEO1FBQ3ZELE1BQU0sWUFBWSxHQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBcUIsQ0FBQyxFQUFFLENBQUM7UUFFekQsTUFBTSxXQUFXLEdBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFrQyxFQUFFLFdBQVcsQ0FBQztRQUVqRixNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztRQUU1RSxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztRQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2pDLENBQUM7Q0FDRjtBQXRMRCxxQ0FzTEMifQ==

package/dist/http/http-errors.d.ts

@@ -0,0 +1,39 @@
+export declare abstract class BaseHttpError extends Error {
+    readonly status: number;
+    readonly userMessage: string;
+    readonly log: boolean;
+    cause?: unknown;
+    constructor(status: number, userMessage: string, options?: {
+        log?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class BadRequestHttpError extends BaseHttpError {
+    constructor(userMessage: string, options?: {
+        log?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class UnauthorizedHttpError extends BaseHttpError {
+    constructor();
+}
+export declare class ForbiddenHttpError extends BaseHttpError {
+    constructor(options?: {
+        log?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class NotFoundHttpError extends BaseHttpError {
+    constructor(userMessage: string, options?: {
+        log?: boolean;
+        cause?: unknown;
+    });
+}
+export declare class ServiceUnavailableHttpError extends BaseHttpError {
+    constructor(userMessage: string, options?: {
+        log?: boolean;
+        cause?: unknown;
+    });
+}
+export declare function toHttpError(err: unknown): BaseHttpError | null;
+//# sourceMappingURL=http-errors.d.ts.map

package/dist/http/http-errors.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceUnavailableHttpError = exports.NotFoundHttpError = exports.ForbiddenHttpError = exports.UnauthorizedHttpError = exports.BadRequestHttpError = exports.BaseHttpError = void 0;
+exports.toHttpError = toHttpError;
+/* eslint-disable max-classes-per-file */
+const errors_1 = require("../errors");
+// HTTP-typed errors: each carries its response semantics (status + user-facing body) so the
+// error-translation middleware can render any thrown error without per-handler branching. One
+// concrete class per status; handlers throw them directly, and toHttpError maps domain error
+// categories onto them.
+class BaseHttpError extends Error {
+    constructor(status, userMessage, options = {}) {
+        super(userMessage);
+        this.name = this.constructor.name;
+        this.status = status;
+        this.userMessage = userMessage;
+        this.log = options.log ?? false;
+        if (options.cause !== undefined)
+            this.cause = options.cause;
+    }
+}
+exports.BaseHttpError = BaseHttpError;
+class BadRequestHttpError extends BaseHttpError {
+    constructor(userMessage, options) {
+        super(400, userMessage, options);
+    }
+}
+exports.BadRequestHttpError = BadRequestHttpError;
+class UnauthorizedHttpError extends BaseHttpError {
+    constructor() {
+        super(401, 'Unauthorized');
+    }
+}
+exports.UnauthorizedHttpError = UnauthorizedHttpError;
+class ForbiddenHttpError extends BaseHttpError {
+    // 403 bodies stay opaque ('Forbidden') on purpose — never echo why access was denied.
+    constructor(options) {
+        super(403, 'Forbidden', options);
+    }
+}
+exports.ForbiddenHttpError = ForbiddenHttpError;
+class NotFoundHttpError extends BaseHttpError {
+    constructor(userMessage, options) {
+        super(404, userMessage, options);
+    }
+}
+exports.NotFoundHttpError = NotFoundHttpError;
+class ServiceUnavailableHttpError extends BaseHttpError {
+    constructor(userMessage, options) {
+        super(503, userMessage, options);
+    }
+}
+exports.ServiceUnavailableHttpError = ServiceUnavailableHttpError;
+// The single domain→HTTP mapping. Maps by domain category, not concrete class, so a new
+// NotFoundError/ConflictError/… is translated correctly without touching this function. Returns
+// null when the error has no HTTP translation — the middleware then responds 500 without leaking
+// internals.
+function toHttpError(err) {
+    if (err instanceof BaseHttpError)
+        return err;
+    // koa-jwt rejects with an error object carrying status 401.
+    if (err?.status === 401)
+        return new UnauthorizedHttpError();
+    // Category branches MUST precede the WorkflowExecutorError catch-all: every category extends it.
+    if (err instanceof errors_1.NotFoundError)
+        return new NotFoundHttpError(err.userMessage, { cause: err });
+    if (err instanceof errors_1.AccessDeniedError)
+        return new ForbiddenHttpError({ log: true, cause: err });
+    // Expected client churn (a double trigger): 400, not logged. Precedes the catch-all, which logs.
+    if (err instanceof errors_1.RunAlreadyInFlightError) {
+        return new BadRequestHttpError(err.userMessage, { cause: err });
+    }
+    if (err instanceof errors_1.UnavailableError) {
+        return new ServiceUnavailableHttpError(err.userMessage, { log: true, cause: err });
+    }
+    // Uncategorized domain error: 400 with its userMessage (safe default — never a silent 500).
+    if (err instanceof errors_1.WorkflowExecutorError) {
+        return new BadRequestHttpError(err.userMessage, { log: true, cause: err });
+    }
+    return null;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaHR0cC1lcnJvcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaHR0cC9odHRwLWVycm9ycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFzRUEsa0NBeUJDO0FBL0ZELHlDQUF5QztBQUN6QyxzQ0FNbUI7QUFFbkIsNEZBQTRGO0FBQzVGLDhGQUE4RjtBQUM5Riw2RkFBNkY7QUFDN0Ysd0JBQXdCO0FBQ3hCLE1BQXNCLGFBQWMsU0FBUSxLQUFLO0lBUS9DLFlBQ0UsTUFBYyxFQUNkLFdBQW1CLEVBQ25CLFVBQThDLEVBQUU7UUFFaEQsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25CLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUM7UUFDbEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLFdBQVcsR0FBRyxXQUFXLENBQUM7UUFDL0IsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLEtBQUssQ0FBQztRQUNoQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssU0FBUztZQUFFLElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQztJQUM5RCxDQUFDO0NBQ0Y7QUFwQkQsc0NBb0JDO0FBRUQsTUFBYSxtQkFBb0IsU0FBUSxhQUFhO0lBQ3BELFlBQVksV0FBbUIsRUFBRSxPQUE0QztRQUMzRSxLQUFLLENBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNuQyxDQUFDO0NBQ0Y7QUFKRCxrREFJQztBQUVELE1BQWEscUJBQXNCLFNBQVEsYUFBYTtJQUN0RDtRQUNFLEtBQUssQ0FBQyxHQUFHLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBSkQsc0RBSUM7QUFFRCxNQUFhLGtCQUFtQixTQUFRLGFBQWE7SUFDbkQsc0ZBQXNGO0lBQ3RGLFlBQVksT0FBNEM7UUFDdEQsS0FBSyxDQUFDLEdBQUcsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDbkMsQ0FBQztDQUNGO0FBTEQsZ0RBS0M7QUFFRCxNQUFhLGlCQUFrQixTQUFRLGFBQWE7SUFDbEQsWUFBWSxXQUFtQixFQUFFLE9BQTRDO1FBQzNFLEtBQUssQ0FBQyxHQUFHLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ25DLENBQUM7Q0FDRjtBQUpELDhDQUlDO0FBRUQsTUFBYSwyQkFBNEIsU0FBUSxhQUFhO0lBQzVELFlBQVksV0FBbUIsRUFBRSxPQUE0QztRQUMzRSxLQUFLLENBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNuQyxDQUFDO0NBQ0Y7QUFKRCxrRUFJQztBQUVELHdGQUF3RjtBQUN4RixnR0FBZ0c7QUFDaEcsaUdBQWlHO0FBQ2pHLGFBQWE7QUFDYixTQUFnQixXQUFXLENBQUMsR0FBWTtJQUN0QyxJQUFJLEdBQUcsWUFBWSxhQUFhO1FBQUUsT0FBTyxHQUFHLENBQUM7SUFFN0MsNERBQTREO0lBQzVELElBQUssR0FBMkIsRUFBRSxNQUFNLEtBQUssR0FBRztRQUFFLE9BQU8sSUFBSSxxQkFBcUIsRUFBRSxDQUFDO0lBRXJGLGlHQUFpRztJQUNqRyxJQUFJLEdBQUcsWUFBWSxzQkFBYTtRQUFFLE9BQU8sSUFBSSxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDaEcsSUFBSSxHQUFHLFlBQVksMEJBQWlCO1FBQUUsT0FBTyxJQUFJLGtCQUFrQixDQUFDLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUUvRixpR0FBaUc7SUFDakcsSUFBSSxHQUFHLFlBQVksZ0NBQXVCLEVBQUUsQ0FBQztRQUMzQyxPQUFPLElBQUksbUJBQW1CLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFFRCxJQUFJLEdBQUcsWUFBWSx5QkFBZ0IsRUFBRSxDQUFDO1FBQ3BDLE9BQU8sSUFBSSwyQkFBMkIsQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLEVBQUUsR0FBRyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBRUQsNEZBQTRGO0lBQzVGLElBQUksR0FBRyxZQUFZLDhCQUFxQixFQUFFLENBQUM7UUFDekMsT0FBTyxJQUFJLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==

package/dist/ports/logger-port.d.ts

@@ -1,6 +1,3 @@
-export interface Logger {
-    error(message: string, context: Record<string, unknown>): void;
-    warn(message: string, context: Record<string, unknown>): void;
-    info(message: string, context: Record<string, unknown>): void;
-}
+export type LoggerLevel = 'Debug' | 'Info' | 'Warn' | 'Error';
+export type Logger = (level: LoggerLevel, message: string, context?: Record<string, unknown>) => void;
 //# sourceMappingURL=logger-port.d.ts.map

package/dist/ports/workflow-port.d.ts

@@ -1,4 +1,4 @@
-import type { AvailableStepExecution, StepUser } from '../types/execution-context';
+import type { AvailableStepExecution } from '../types/execution-context';
 import type { CollectionSchema } from '../types/validated/collection';
 import type { StepOutcome } from '../types/validated/step-outcome';
 import type { ToolConfig } from '@forestadmin/ai-proxy';
@@ -25,6 +25,8 @@ export interface WorkflowPort {
     updateStepExecution(runId: string, stepOutcome: StepOutcome): Promise<AvailableRunDispatch | null>;
     getCollectionSchema(collectionName: string, runId: string): Promise<CollectionSchema>;
     getMcpServerConfigs(): Promise<Record<string, ToolConfig>>;
-    hasRunAccess(runId: string, user: StepUser): Promise<boolean>;
+    hasRunAccess(runId: string, user: {
+        id: number;
+    }): Promise<boolean>;
 }
 //# sourceMappingURL=workflow-port.d.ts.map

package/dist/remote-tool-fetcher.js

@@ -31,7 +31,7 @@ class RemoteToolFetcher {
         const availableMcpServerIds = Object.values(configs)
             .map(cfg => cfg.id)
             .filter((id) => Boolean(id));
-        this.logger.warn(Object.keys(configs).length === 0
+        this.logger('Warn', Object.keys(configs).length === 0
             ? 'MCP step targets a server but orchestrator returned no MCP configs'
             : 'MCP step targets a server not advertised by the orchestrator', { requestedMcpServerId: mcpServerId, mcpServerName, availableMcpServerIds });
     }
@@ -45,7 +45,7 @@ class RemoteToolFetcher {
             .map(([name]) => name);
         if (failedConfigNames.length === 0)
             return;
-        this.logger.error('MCP servers failed to load tools', {
+        this.logger('Error', 'MCP servers failed to load tools', {
             requestedMcpServerId: mcpServerId,
             mcpServerName,
             failedConfigNames,
@@ -53,4 +53,4 @@ class RemoteToolFetcher {
     }
 }
 exports.default = RemoteToolFetcher;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLXRvb2wtZmV0Y2hlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yZW1vdGUtdG9vbC1mZXRjaGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBTUEsb0RBS0M7QUFORCxrRkFBa0Y7QUFDbEYsU0FBZ0Isb0JBQW9CLENBQ2xDLE9BQW1DLEVBQ25DLFdBQW1CO0lBRW5CLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLENBQUM7QUFPRCxNQUFxQixpQkFBaUI7SUFLcEMsWUFBWSxZQUEwQixFQUFFLFdBQXdCLEVBQUUsTUFBYztRQUM5RSxJQUFJLENBQUMsWUFBWSxHQUFHLFlBQVksQ0FBQztRQUNqQyxJQUFJLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztRQUMvQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFtQjtRQUM3QixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztRQUM5RCxNQUFNLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDMUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFNUMsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxDQUFDO1FBRTFFLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFN0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDbEMsQ0FBQztJQUVELDZGQUE2RjtJQUM3RiwyRkFBMkY7SUFDM0Ysb0JBQW9CO0lBQ1osdUJBQXVCLENBQzdCLE9BQW1DLEVBQ25DLE1BQWtDLEVBQ2xDLFdBQW1CLEVBQ25CLGFBQWlDO1FBRWpDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFFM0MsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNqRCxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2FBQ2xCLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBZ0IsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTdDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUNkLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDL0IsQ0FBQyxDQUFDLG9FQUFvRTtZQUN0RSxDQUFDLENBQUMsOERBQThELEVBQ2xFLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUVELDRGQUE0RjtJQUM1Riw0RkFBNEY7SUFDNUYseUZBQXlGO0lBQ2pGLHlCQUF5QixDQUMvQixNQUFrQyxFQUNsQyxLQUFtQixFQUNuQixXQUFtQixFQUNuQixhQUFpQztRQUVqQyxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNsRSxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2FBQzdDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2FBQ3BELEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXpCLElBQUksaUJBQWlCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPO1FBRTNDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLGtDQUFrQyxFQUFFO1lBQ3BELG9CQUFvQixFQUFFLFdBQVc7WUFDakMsYUFBYTtZQUNiLGlCQUFpQjtTQUNsQixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUF4RUQsb0NBd0VDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3RlLXRvb2wtZmV0Y2hlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yZW1vdGUtdG9vbC1mZXRjaGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBTUEsb0RBS0M7QUFORCxrRkFBa0Y7QUFDbEYsU0FBZ0Isb0JBQW9CLENBQ2xDLE9BQW1DLEVBQ25DLFdBQW1CO0lBRW5CLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLENBQUM7QUFPRCxNQUFxQixpQkFBaUI7SUFLcEMsWUFBWSxZQUEwQixFQUFFLFdBQXdCLEVBQUUsTUFBYztRQUM5RSxJQUFJLENBQUMsWUFBWSxHQUFHLFlBQVksQ0FBQztRQUNqQyxJQUFJLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztRQUMvQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRUQsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFtQjtRQUM3QixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztRQUM5RCxNQUFNLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDMUQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFNUMsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxDQUFDO1FBRTFFLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFN0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBRTFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDbEMsQ0FBQztJQUVELDZGQUE2RjtJQUM3RiwyRkFBMkY7SUFDM0Ysb0JBQW9CO0lBQ1osdUJBQXVCLENBQzdCLE9BQW1DLEVBQ25DLE1BQWtDLEVBQ2xDLFdBQW1CLEVBQ25CLGFBQWlDO1FBRWpDLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFFM0MsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNqRCxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2FBQ2xCLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBZ0IsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTdDLElBQUksQ0FBQyxNQUFNLENBQ1QsTUFBTSxFQUNOLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDL0IsQ0FBQyxDQUFDLG9FQUFvRTtZQUN0RSxDQUFDLENBQUMsOERBQThELEVBQ2xFLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxDQUM1RSxDQUFDO0lBQ0osQ0FBQztJQUVELDRGQUE0RjtJQUM1Riw0RkFBNEY7SUFDNUYseUZBQXlGO0lBQ2pGLHlCQUF5QixDQUMvQixNQUFrQyxFQUNsQyxLQUFtQixFQUNuQixXQUFtQixFQUNuQixhQUFpQztRQUVqQyxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNsRSxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2FBQzdDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2FBQ3BELEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXpCLElBQUksaUJBQWlCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPO1FBRTNDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLGtDQUFrQyxFQUFFO1lBQ3ZELG9CQUFvQixFQUFFLFdBQVc7WUFDakMsYUFBYTtZQUNiLGlCQUFpQjtTQUNsQixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUF6RUQsb0NBeUVDIn0=