@lowdefy/api 5.5.1 → 6.0.0

package/dist/routes/agent/prepareAgent.js

@@ -0,0 +1,173 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import buildEndpointResult from '../../response/buildEndpointResult.js';
+import getEndpointConfig from '../endpoints/getEndpointConfig.js';
+import invokeEndpoint from '../endpoints/invokeEndpoint.js';
+import authorizeAgent from './authorizeAgent.js';
+import getAgentConfig from './getAgentConfig.js';
+import getAgentResolver from './getAgentResolver.js';
+import getConnectionConfig from '../connections/getConnectionConfig.js';
+import getConnection from '../connections/getConnection.js';
+// Shared agent invocation construction for the streaming chat route (callAgent)
+// and the headless CallAgent routine step (handleAgentCall): loads the agent
+// config, evaluates operators, creates the provider connection, and builds the
+// resolver context. mode ('chat' | 'generate') selects the resolver's execution
+// path; endpointDepth threads the endpoint call depth cap through agent tool
+// and hook endpoint calls.
+async function prepareAgent(context, { agentId, agentContext, endpointDepth = 0, mode = 'chat' }) {
+    const agentConfig = await getAgentConfig(context, {
+        agentId
+    });
+    authorizeAgent(context, {
+        agentConfig
+    });
+    // Evaluate operators in agent properties (e.g. _user, _secret, _payload)
+    agentConfig.properties = context.evaluateOperators({
+        input: agentConfig.properties ?? {},
+        location: agentConfig.agentId,
+        payload: agentContext,
+        state: {},
+        steps: {}
+    });
+    // Load connection config from build artifacts using agent's connectionId
+    const connectionConfig = await getConnectionConfig(context, {
+        connectionId: agentConfig.connectionId,
+        configKey: agentConfig['~k']
+    });
+    // Get connection plugin from registry
+    const connection = getConnection(context, {
+        connectionConfig
+    });
+    // Evaluate operators in connection properties
+    const connectionProperties = context.evaluateOperators({
+        input: connectionConfig.properties || {},
+        location: connectionConfig.connectionId,
+        payload: {},
+        state: {},
+        steps: {}
+    });
+    // Create connection instance (e.g., Anthropic provider)
+    const connectionInstance = connection.create({
+        connection: connectionProperties
+    });
+    // Get agent type from plugin registry
+    const agentType = getAgentResolver(context, {
+        agentConfig
+    });
+    // Build resolver context with callEndpoint that allows InternalApi endpoints
+    const resolverContext = {
+        agentContext,
+        i18n: context.i18n,
+        mode,
+        evaluateOperators: (input)=>context.evaluateOperators({
+                input,
+                location: agentConfig.agentId,
+                payload: agentContext,
+                state: {},
+                steps: {}
+            }),
+        callEndpoint: async (endpointId, { payload })=>{
+            const { error, response, status } = await invokeEndpoint(context, {
+                endpointId,
+                payload,
+                endpointDepth
+            });
+            return buildEndpointResult(context, {
+                error,
+                response,
+                status
+            });
+        },
+        getEndpointConfig: async ({ endpointId })=>{
+            return getEndpointConfig(context, {
+                endpointId
+            });
+        },
+        getAgentConfig: async ({ agentId: subAgentId })=>{
+            const subAgentConfig = await getAgentConfig(context, {
+                agentId: subAgentId
+            });
+            authorizeAgent(context, {
+                agentConfig: subAgentConfig
+            });
+            return subAgentConfig;
+        },
+        getConnectionForAgent: async ({ agentConfig: subAgentConfig })=>{
+            const subConnectionConfig = await getConnectionConfig(context, {
+                connectionId: subAgentConfig.connectionId,
+                configKey: subAgentConfig['~k']
+            });
+            const subConnection = getConnection(context, {
+                connectionConfig: subConnectionConfig
+            });
+            const subConnectionProperties = context.evaluateOperators({
+                input: subConnectionConfig.properties || {},
+                location: subConnectionConfig.connectionId,
+                payload: {},
+                state: {},
+                steps: {}
+            });
+            return subConnection.create({
+                connection: subConnectionProperties
+            });
+        },
+        resolveMcpSources: async ({ agentConfig: subAgentConfig })=>{
+            const resolvedMcp = [];
+            for (const mcpSource of subAgentConfig.mcp ?? []){
+                if (!type.isNone(mcpSource.connectionId)) {
+                    const mcpConnConfig = await getConnectionConfig(context, {
+                        connectionId: mcpSource.connectionId,
+                        configKey: subAgentConfig['~k']
+                    });
+                    const mcpConnection = getConnection(context, {
+                        connectionConfig: mcpConnConfig
+                    });
+                    const mcpConnProps = context.evaluateOperators({
+                        input: mcpConnConfig.properties || {},
+                        location: mcpConnConfig.connectionId,
+                        payload: {},
+                        state: {},
+                        steps: {}
+                    });
+                    const mcpConfig = mcpConnection.create({
+                        connection: mcpConnProps
+                    });
+                    const { connectionId: _, ...overrides } = mcpSource;
+                    resolvedMcp.push({
+                        ...mcpConfig,
+                        ...overrides
+                    });
+                } else {
+                    resolvedMcp.push(mcpSource);
+                }
+            }
+            return resolvedMcp;
+        }
+    };
+    // Resolve MCP connection references to inline config.
+    // Agent-level overrides (like confirm) may still contain operators —
+    // handleAgentChat evaluates those via its existing evaluateOperators call.
+    agentConfig.mcp = await resolverContext.resolveMcpSources({
+        agentConfig
+    });
+    return {
+        agentConfig,
+        connectionInstance,
+        agentType,
+        resolverContext
+    };
+}
+export default prepareAgent;

package/dist/routes/auth/createLogger.js

@@ -20,11 +20,8 @@
 };
 function createLogger({ logger }) {
     return {
-        error: (code, metadata)=>{
-            const error = metadata instanceof Error ? metadata : metadata?.error;
-            if (error) {
-                error.code = code;
-            }
+        // Auth.js v5 logger contract: error(error), warn(code), debug(message, metadata).
+        error: (error)=>{
             logger.error(error);
         },
         warn: (code)=>{

package/dist/routes/auth/createPrefixedCookies.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function slugifyPrefix(value) {
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+// Injects an app-specific prefix into each Auth.js cookie name so multiple apps
+// on the same host do not share a cookie jar (browsers do not scope cookies by
+// port). Only names are overridden — Auth.js v5 deep-merges `config.cookies`
+// into its defaults, so cookie options (httpOnly, secure, maxAge) stay in sync
+// with @auth/core's per-request defaults. Names mirror defaultCookies in
+// @auth/core/lib/utils/cookie.js.
+function createPrefixedCookies({ prefix, useSecureCookies }) {
+    const securePrefix = useSecureCookies ? '__Secure-' : '';
+    const hostPrefix = useSecureCookies ? '__Host-' : '';
+    return {
+        sessionToken: {
+            name: `${securePrefix}${prefix}.authjs.session-token`
+        },
+        callbackUrl: {
+            name: `${securePrefix}${prefix}.authjs.callback-url`
+        },
+        csrfToken: {
+            name: `${hostPrefix}${prefix}.authjs.csrf-token`
+        },
+        pkceCodeVerifier: {
+            name: `${securePrefix}${prefix}.authjs.pkce.code_verifier`
+        },
+        state: {
+            name: `${securePrefix}${prefix}.authjs.state`
+        },
+        nonce: {
+            name: `${securePrefix}${prefix}.authjs.nonce`
+        },
+        webauthnChallenge: {
+            name: `${securePrefix}${prefix}.authjs.challenge`
+        }
+    };
+}
+export { slugifyPrefix };
+export default createPrefixedCookies;

package/dist/routes/auth/{getNextAuthConfig.js → getAuthConfig.js}

@@ -19,10 +19,11 @@ import createCallbacks from './callbacks/createCallbacks.js';
 import createEvents from './events/createEvents.js';
 import createLogger from './createLogger.js';
 import createProviders from './createProviders.js';
-const nextAuthConfig = {};
+import resolveCookies from './resolveCookies.js';
+const authConfigCache = {};
 let initialized = false;
-function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
-    if (initialized) return nextAuthConfig;
+function getAuthConfig({ appMeta, authJson, dev, logger, plugins, secrets }) {
+    if (initialized) return authConfigCache;
     const operatorsParser = new ServerParser({
         lowdefyApp: appMeta,
         operators: {
@@ -40,36 +41,46 @@ function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
     if (operatorErrors.length > 0) {
         throw operatorErrors[0];
     }
-    nextAuthConfig.adapter = createAdapter({
+    authConfigCache.adapter = createAdapter({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.callbacks = createCallbacks({
+    authConfigCache.callbacks = createCallbacks({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.events = createEvents({
+    authConfigCache.events = createEvents({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.logger = createLogger({
+    authConfigCache.logger = createLogger({
         logger
     });
-    nextAuthConfig.providers = createProviders({
+    authConfigCache.providers = createProviders({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
-    nextAuthConfig.pages = authConfig.authPages;
-    nextAuthConfig.session = authConfig.session;
-    nextAuthConfig.theme = authConfig.theme;
-    nextAuthConfig.cookies = authConfig?.advanced?.cookies;
-    nextAuthConfig.originalRedirectCallback = nextAuthConfig.callbacks.redirect;
+    authConfigCache.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
+    authConfigCache.pages = authConfig.authPages;
+    authConfigCache.session = authConfig.session;
+    authConfigCache.theme = authConfig.theme;
+    authConfigCache.cookies = resolveCookies({
+        appMeta,
+        authConfig,
+        dev
+    });
+    // Auth.js v5 reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not
+    // supported — deployments must rename it (see the v5-to-v6 migration doc).
+    authConfigCache.secret = process.env.AUTH_SECRET;
+    // Self-hosted servers run behind arbitrary proxies; derive URLs from request
+    // headers (v4 derived them from NEXTAUTH_URL, aliased to AUTH_URL at startup).
+    authConfigCache.trustHost = true;
+    authConfigCache.basePath = '/api/auth';
     initialized = true;
-    return nextAuthConfig;
+    return authConfigCache;
 }
-export default getNextAuthConfig;
+export default getAuthConfig;

package/dist/routes/auth/resolveCookies.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import createPrefixedCookies, { slugifyPrefix } from './createPrefixedCookies.js';
+// Cookie name resolution, in order of precedence:
+//   1. An explicit `auth.advanced.cookies` object is used verbatim.
+//   2. An explicit `auth.advanced.cookiePrefix` namespaces cookie names (dev and prod).
+//   3. When running the dev server, derive a prefix from the app slug/name so multiple
+//      apps on localhost do not share a cookie jar (browsers do not scope cookies by
+//      port). Production is left untouched, returning undefined for Auth.js defaults.
+function resolveCookies({ appMeta, authConfig, dev }) {
+    const explicitCookies = authConfig?.advanced?.cookies;
+    if (!type.isNone(explicitCookies)) return explicitCookies;
+    const devPrefix = dev ? slugifyPrefix(appMeta?.slug ?? appMeta?.name ?? '') : '';
+    const prefix = authConfig?.advanced?.cookiePrefix ?? (devPrefix === '' ? undefined : devPrefix);
+    if (type.isNone(prefix) || prefix === '') return undefined;
+    // Auth.js v5 reads AUTH_URL with NEXTAUTH_URL as a v4 fallback.
+    const authUrl = process.env.AUTH_URL ?? process.env.NEXTAUTH_URL;
+    const useSecureCookies = authUrl?.startsWith('https://') ?? false;
+    return createPrefixedCookies({
+        prefix,
+        useSecureCookies
+    });
+}
+export default resolveCookies;

package/dist/routes/auth/strategies/createAuthStrategies.js

@@ -0,0 +1,77 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { ServerParser } from '@lowdefy/operators';
+import { _app, _secret } from '@lowdefy/operators-js/operators/server';
+import { type } from '@lowdefy/helpers';
+import { ConfigError } from '@lowdefy/errors';
+// Builds the API auth strategy verifiers from the auth.json build artifact.
+// Build has validated the config and written all defaults, so this resolves
+// the _secret operators and constructs each strategy type's verifier.
+// Verifier factories warn on short static keys at construction, so key
+// strength surfaces at startup, never as a build failure.
+function createAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
+    if (!type.isArray(authJson.strategies) || authJson.strategies.length === 0) {
+        return [];
+    }
+    const operatorsParser = new ServerParser({
+        lowdefyApp: appMeta,
+        operators: {
+            _app,
+            _secret
+        },
+        secrets,
+        user: {}
+    });
+    const { output: strategiesConfig, errors: operatorErrors } = operatorsParser.parse({
+        input: authJson.strategies,
+        location: 'auth.strategies',
+        payload: {}
+    });
+    if (operatorErrors.length > 0) {
+        // Startup fails on the first error; log the rest so they can all be
+        // fixed in one pass instead of one boot per error.
+        operatorErrors.slice(1).forEach((error)=>logger.error(error));
+        throw operatorErrors[0];
+    }
+    return strategiesConfig.map((strategy)=>{
+        const strategyPlugin = plugins.strategies[strategy.type];
+        if (type.isNone(strategyPlugin)) {
+            throw new ConfigError(`Auth strategy type "${strategy.type}" not found at strategy "${strategy.id}".`, {
+                configKey: strategy['~k']
+            });
+        }
+        let verify;
+        try {
+            verify = strategyPlugin({
+                logger,
+                properties: strategy.properties,
+                strategyId: strategy.id
+            });
+        } catch (error) {
+            throw new ConfigError(error.message, {
+                cause: error,
+                configKey: strategy['~k']
+            });
+        }
+        return {
+            attributes: strategy.attributes,
+            id: strategy.id,
+            roles: strategy.roles,
+            type: strategy.type,
+            verify
+        };
+    });
+}
+export default createAuthStrategies;

package/dist/routes/auth/strategies/getAuthStrategies.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createAuthStrategies from './createAuthStrategies.js';
+let strategies;
+// The strategy verifiers are constructed once per process at first use -
+// the server middleware tries them in config order on every request that
+// resolves no session.
+function getAuthStrategies({ appMeta, authJson, logger, plugins, secrets }) {
+    if (strategies) return strategies;
+    strategies = createAuthStrategies({
+        appMeta,
+        authJson,
+        logger,
+        plugins,
+        secrets
+    });
+    return strategies;
+}
+export default getAuthStrategies;

package/dist/routes/endpoints/addStepResult.js

@@ -12,12 +12,22 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { set } from '@lowdefy/helpers';
+*/ import { ConfigError } from '@lowdefy/errors';
+import { ReservedKeyError, set } from '@lowdefy/helpers';
 function addStepResult(context, routineContext, { result, stepId }) {
     const key = [
         stepId,
         ...routineContext.arrayIndices
     ].join('.');
-    set(routineContext.steps, key, result);
+    try {
+        set(routineContext.steps, key, result);
+    } catch (error) {
+        if (error instanceof ReservedKeyError) {
+            throw new ConfigError(`Reserved step id "${error.segment}" cannot be used`, {
+                cause: error
+            });
+        }
+        throw error;
+    }
 }
 export default addStepResult;

package/dist/routes/endpoints/authorizeApiEndpoint.js

@@ -12,14 +12,20 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { ConfigError } from '@lowdefy/errors';
-function authorizeApiEndpoint({ authorize, logger }, { endpointConfig }) {
+*/ import { AuthenticationError, ConfigError } from '@lowdefy/errors';
+import { type } from '@lowdefy/helpers';
+function authorizeApiEndpoint({ authorize, logger, user }, { endpointConfig }) {
     if (!authorize(endpointConfig)) {
         logger.debug({
             event: 'debug_api_authorize',
             authorized: false,
             auth_config: endpointConfig.auth
         });
+        // Unauthenticated on a protected endpoint - 401 tells the caller to fix
+        // its credentials. Wrong roles stay opaque below.
+        if (type.isNone(user)) {
+            throw new AuthenticationError(`Authentication required for API endpoint "${endpointConfig.endpointId}".`);
+        }
         throw new ConfigError(`API Endpoint "${endpointConfig.endpointId}" does not exist.`);
     }
     logger.debug({

package/dist/routes/endpoints/callEndpoint.js

@@ -13,11 +13,14 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { serializer } from '@lowdefy/helpers';
-import { ConfigError } from '@lowdefy/errors';
+import { AuthenticationError, ConfigError } from '@lowdefy/errors';
 import authorizeApiEndpoint from './authorizeApiEndpoint.js';
+import buildEndpointResult from '../../response/buildEndpointResult.js';
 import createEvaluateOperators from '../../context/createEvaluateOperators.js';
 import getEndpointConfig from './getEndpointConfig.js';
+import isUnauthenticatedHuman from './isUnauthenticatedHuman.js';
 import runRoutine from './runRoutine.js';
+import scheduleBackground from './scheduleBackground.js';
 async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
     const { logger } = context;
     context.blockId = blockId;
@@ -34,9 +37,11 @@ async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
     const endpointConfig = await getEndpointConfig(context, {
         endpointId
     });
-    // Block HTTP access to InternalApi endpoints — same error as missing endpoint
+    // Block HTTP access to InternalApi endpoints - same error as a missing
+    // endpoint, including the unauthenticated fork, so an internal endpoint is
+    // indistinguishable from one that does not exist on both paths.
     if (endpointConfig.type === 'InternalApi') {
-        const err = new ConfigError(`API Endpoint "${endpointId}" does not exist.`);
+        const err = await isUnauthenticatedHuman(context) ? new AuthenticationError(`Authentication required for API endpoint "${endpointId}".`) : new ConfigError(`API Endpoint "${endpointId}" does not exist.`);
         logger.debug({
             params: {
                 endpointId
@@ -56,18 +61,32 @@ async function callEndpoint(context, { blockId, endpointId, pageId, payload }) {
         state: {},
         endpointDepth: 0
     };
+    // async: true — acknowledge now, run the routine in the background.
+    // Auth was already checked above; the outcome lands in logs (scheduleBackground)
+    // and in whatever the routine itself records.
+    if (endpointConfig.async === true) {
+        scheduleBackground(context, {
+            event: 'background_endpoint',
+            endpointId
+        }, ()=>runRoutine(context, routineContext, {
+                routine: endpointConfig.routine
+            }));
+        return {
+            error: null,
+            response: serializer.serialize({
+                accepted: true
+            }),
+            status: 'accepted',
+            success: true
+        };
+    }
     const { error, response, status } = await runRoutine(context, routineContext, {
         routine: endpointConfig.routine
     });
-    const success = ![
-        'error',
-        'reject'
-    ].includes(status);
-    return {
-        error: serializer.serialize(error),
-        response: serializer.serialize(response),
-        status: success ? 'success' : status,
-        success
-    };
+    return buildEndpointResult(context, {
+        error,
+        response,
+        status
+    });
 }
 export default callEndpoint;

package/dist/routes/endpoints/control/controlReject.js

@@ -37,9 +37,11 @@ async function controlReject(context, routineContext, { control }) {
         cause,
         isReject: true
     });
+    // Log under `err` — see controlThrow: only the `err` key runs the pino error
+    // serializer, so `error` would drop the message from the log line.
     context.logger.warn({
         event: 'warn_control_reject',
-        error
+        err: error
     });
     return {
         status: 'reject',

package/dist/routes/endpoints/control/controlSetState.js

@@ -12,7 +12,8 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { set } from '@lowdefy/helpers';
+*/ import { ConfigError } from '@lowdefy/errors';
+import { ReservedKeyError, set } from '@lowdefy/helpers';
 function controlSetState(context, routineContext, { control }) {
     const { logger, evaluateOperators } = context;
     const { items } = routineContext;
@@ -30,7 +31,17 @@ function controlSetState(context, routineContext, { control }) {
         evaluated: evaluatedSetState
     });
     Object.entries(evaluatedSetState).forEach(([key, value])=>{
-        set(routineContext.state, key, value);
+        try {
+            set(routineContext.state, key, value);
+        } catch (error) {
+            if (error instanceof ReservedKeyError) {
+                throw new ConfigError(`Reserved key "${error.segment}" cannot be used in :set_state`, {
+                    cause: error,
+                    configKey: control['~k']
+                });
+            }
+            throw error;
+        }
     });
     return {
         status: 'continue'

package/dist/routes/endpoints/control/controlThrow.js

@@ -36,9 +36,12 @@ async function controlThrow(context, routineContext, { control }) {
     const error = new UserError(message, {
         cause
     });
+    // Log under `err` — the pino error serializer (createNodeLogger) is registered
+    // for the `err` key only; an Error passed as `error` is JSON-dumped without its
+    // non-enumerable `message`/`stack`, producing a log line with no message.
     context.logger.error({
         event: 'error_control_throw',
-        error
+        err: error
     });
     return {
         status: 'error',