@skedulo/integration-sdk 0.3.4 → 0.4.0

package/dist/actions/utils/action-names.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACTIONS = exports.DATA_FLOW_ID_HEADER = exports.ACTION_HEADER = void 0;
+exports.ACTIONS = exports.SCHEDULED_JOB_NAME_HEADER = exports.DATA_FLOW_ID_HEADER = exports.ACTION_HEADER = void 0;
 /**
  * HTTP header that carries the action name to the dispatcher.
  * Exported so consumers (UI, cross-function clients) don't hardcode it.
@@ -8,10 +8,18 @@ exports.ACTIONS = exports.DATA_FLOW_ID_HEADER = exports.ACTION_HEADER = void 0;
 exports.ACTION_HEADER = 'sked-integration-action';
 /**
  * HTTP header carrying the target flow id for per-flow actions. ElasticServer
- * scheduled webhooks post an empty body, so the flow id rides on this header;
- * the dispatcher merges it into the action input as `dataFlowId`.
+ * scheduled webhooks post an empty body (and triggered actions a bare array),
+ * so the flow id rides on this header; the dispatcher passes it to `parseInput`
+ * as `meta.dataFlowId`.
  */
 exports.DATA_FLOW_ID_HEADER = 'sked-data-flow-id';
+/**
+ * HTTP header carrying the target scheduled job's `webhook_name`. The ES
+ * scheduled webhook provisioned for a job posts an empty body, so the job
+ * identity rides on this header; the dispatcher passes it to `parseInput` as
+ * `meta.scheduledJobName`.
+ */
+exports.SCHEDULED_JOB_NAME_HEADER = 'sked-scheduled-job-name';
 /**
  * Wire-format action names, grouped by domain. Use these instead of hardcoded
  * strings on both sides of the dispatcher (SDK + UI / cross-function clients).
@@ -32,10 +40,15 @@ exports.ACTIONS = Object.freeze({
         getSampleRecords: 'metadata.get-sample-records',
     }),
     sync: Object.freeze({
-        push: 'sync.push',
-        scheduledPull: 'sync.scheduled-pull',
         runFlow: 'sync.run-flow',
-        runAllFlows: 'sync.run-all-flows',
+        runJob: 'sync.run-job',
+    }),
+    scheduledJob: Object.freeze({
+        create: 'scheduled-job.create',
+        update: 'scheduled-job.update',
+        delete: 'scheduled-job.delete',
+        list: 'scheduled-job.list',
+        get: 'scheduled-job.get',
     }),
     event: Object.freeze({
         onSkedulo: 'event.on-skedulo',

package/dist/actions/utils/action-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-names.js","sourceRoot":"","sources":["../../../src/actions/utils/action-names.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,aAAa,GAAG,yBAAyB,CAAC;AAEvD;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD;;;;;GAKG;AACU,QAAA,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,cAAc;KACvB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,sBAAsB;QAClC,SAAS,EAAE,qBAAqB;QAChC,YAAY,EAAE,wBAAwB;QACtC,aAAa,EAAE,0BAA0B;QACzC,gBAAgB,EAAE,6BAA6B;KAChD,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,WAAW;QACjB,aAAa,EAAE,qBAAqB;QACpC,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,oBAAoB;KAClC,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,iBAAiB;KAC5B,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,UAAU,EAAE,sBAAsB;QAClC,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,gBAAgB;KACvB,CAAC;CACM,CAAC,CAAC"}
+{"version":3,"file":"action-names.js","sourceRoot":"","sources":["../../../src/actions/utils/action-names.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,aAAa,GAAG,yBAAyB,CAAC;AAEvD;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD;;;;;GAKG;AACU,QAAA,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE;;;;;GAKG;AACU,QAAA,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,cAAc;KACvB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,sBAAsB;QAClC,SAAS,EAAE,qBAAqB;QAChC,YAAY,EAAE,wBAAwB;QACtC,aAAa,EAAE,0BAA0B;QACzC,gBAAgB,EAAE,6BAA6B;KAChD,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,OAAO,EAAE,eAAe;QACxB,MAAM,EAAE,cAAc;KACvB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,sBAAsB;QAC9B,IAAI,EAAE,oBAAoB;QAC1B,GAAG,EAAE,mBAAmB;KACzB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,iBAAiB;KAC5B,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,oBAAoB;QAC9B,UAAU,EAAE,sBAAsB;QAClC,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,gBAAgB;KACvB,CAAC;CACM,CAAC,CAAC"}

package/dist/actions/utils/define-action.d.ts

@@ -0,0 +1,36 @@
+import type { IntegrationContext } from '../../context';
+import { type Middleware } from './middleware';
+import type { Action, ParseMeta } from './types';
+export interface DefineActionOpts<I, O> {
+    name: string;
+    parseInput: (raw: unknown, meta?: ParseMeta) => I;
+    handler: (input: I, ctx: IntegrationContext) => Promise<O>;
+    /**
+     * Whether the action is safe to retry without side-effect duplication.
+     * Echoed via the error envelope (for failures) and surfaced as metadata to
+     * the dispatcher. Mutating actions without an idempotency key should be `false`.
+     */
+    idempotent?: boolean;
+    /** Emit an audit log on success. Set `true` for mutating actions. */
+    audit?: boolean;
+    /** Gate the handler on admin privileges before running the rest of the chain. */
+    requireAdmin?: boolean;
+    /** Extra middleware appended after the built-in stack (metrics, logging, audit). */
+    middleware?: ReadonlyArray<Middleware>;
+}
+/**
+ * Build an `Action` with the standard cross-cutting concerns wired in.
+ *
+ * ```ts
+ * defineAction({
+ *   name: ACTIONS.scheduledJob.create,
+ *   parseInput: parseCreate,
+ *   requireAdmin: true,
+ *   audit: true,
+ *   idempotent: false,
+ *   handler: async (input, ctx) => { ... },
+ * });
+ * ```
+ */
+export declare function defineAction<I, O>(opts: DefineActionOpts<I, O>): Action<I, O>;
+//# sourceMappingURL=define-action.d.ts.map

package/dist/actions/utils/define-action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-action.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/define-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,UAAU,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACxC;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAW7E"}

package/dist/actions/utils/define-action.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineAction = defineAction;
+const middleware_1 = require("./middleware");
+/**
+ * Stock middleware order (outermost → innermost):
+ *   metrics → logging → audit → [requireAdmin?] → [extras...] → handler
+ *
+ * Metrics outermost so failures still record counters. Logging just inside so
+ * the start/end log lines bracket business logic. Audit only fires on success,
+ * after the handler returns.
+ */
+const DEFAULT_MIDDLEWARE = [middleware_1.withMetrics, middleware_1.withLogging, middleware_1.withAudit];
+/**
+ * Build an `Action` with the standard cross-cutting concerns wired in.
+ *
+ * ```ts
+ * defineAction({
+ *   name: ACTIONS.scheduledJob.create,
+ *   parseInput: parseCreate,
+ *   requireAdmin: true,
+ *   audit: true,
+ *   idempotent: false,
+ *   handler: async (input, ctx) => { ... },
+ * });
+ * ```
+ */
+function defineAction(opts) {
+    var _a, _b;
+    const meta = {
+        actionName: opts.name,
+        idempotent: (_a = opts.idempotent) !== null && _a !== void 0 ? _a : false,
+        audit: (_b = opts.audit) !== null && _b !== void 0 ? _b : false,
+    };
+    const stack = [...DEFAULT_MIDDLEWARE];
+    if (opts.requireAdmin)
+        stack.push(middleware_1.requireAdmin);
+    if (opts.middleware)
+        stack.push(...opts.middleware);
+    const composed = (0, middleware_1.compose)(stack, opts.handler, meta);
+    return { name: opts.name, parseInput: opts.parseInput, handler: composed };
+}
+//# sourceMappingURL=define-action.js.map

package/dist/actions/utils/define-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-action.js","sourceRoot":"","sources":["../../../src/actions/utils/define-action.ts"],"names":[],"mappings":";;AAqDA,oCAWC;AA/DD,6CAOsB;AAqBtB;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAA8B,CAAC,wBAAW,EAAE,wBAAW,EAAE,sBAAS,CAAC,CAAC;AAE5F;;;;;;;;;;;;;GAaG;AACH,SAAgB,YAAY,CAAO,IAA4B;;IAC7D,MAAM,IAAI,GAAG;QACX,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,UAAU,EAAE,MAAA,IAAI,CAAC,UAAU,mCAAI,KAAK;QACpC,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,KAAK;KAC3B,CAAC;IACF,MAAM,KAAK,GAAiB,CAAC,GAAG,kBAAkB,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,yBAAc,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAA,oBAAO,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC"}

package/dist/actions/utils/errors.d.ts

@@ -1,18 +1,64 @@
 /**
- * Throw from `parseInput` when validation fails. Becomes a 400 in the envelope.
+ * Coarse-grained error category. Drives HTTP status mapping at the dispatcher
+ * and the `retryable` signal echoed in the failure envelope so callers (PSS,
+ * IS, UI) know whether to back off and retry.
  */
-export declare class InvalidInputError extends Error {
-    readonly details?: unknown | undefined;
-    readonly code = "INVALID_INPUT";
-    constructor(message: string, details?: unknown | undefined);
+export type ErrorCategory = 'invalid_input' | 'forbidden' | 'not_found' | 'conflict' | 'precondition_failed' | 'upstream_transient' | 'upstream_permanent' | 'not_implemented' | 'internal';
+/** Default HTTP status per category. */
+export declare function categoryToStatus(c: ErrorCategory): number;
+/** Default retryability per category. Only transient upstream failures retry. */
+export declare function categoryRetryable(c: ErrorCategory): boolean;
+interface ActionErrorOpts {
+    category?: ErrorCategory;
+    retryable?: boolean;
+    cause?: unknown;
 }
 /**
- * Throw from a handler to produce a structured failure envelope.
- * Use for known business errors (FLOW_NOT_FOUND, DIRECTION_IS_IMMUTABLE, etc.).
+ * Base class for all structured action failures. Throw a typed subclass
+ * (`InvalidInputError`, `ForbiddenError`, `NotFoundError`, …) — they pre-set
+ * `category` so HTTP status and retry signaling are automatic.
  */
 export declare class ActionError extends Error {
     readonly code: string;
     readonly details?: unknown | undefined;
-    constructor(code: string, message: string, details?: unknown | undefined);
+    /** Coarse category — drives HTTP status and `retryable`. */
+    readonly category: ErrorCategory;
+    /** Whether a retry could succeed. Defaults from `category`. */
+    readonly retryable: boolean;
+    constructor(code: string, message: string, details?: unknown | undefined, opts?: ActionErrorOpts);
+}
+/** Throw from `parseInput` (or a handler) when the input is malformed. */
+export declare class InvalidInputError extends ActionError {
+    constructor(message: string, details?: unknown);
+}
+export declare class ForbiddenError extends ActionError {
+    constructor(message: string, details?: unknown);
+}
+export declare class NotFoundError extends ActionError {
+    constructor(code: string, message: string, details?: unknown);
+}
+export declare class ConflictError extends ActionError {
+    constructor(code: string, message: string, details?: unknown);
+}
+export declare class PreconditionFailedError extends ActionError {
+    constructor(code: string, message: string, details?: unknown);
+}
+/** Vendor/IS responded with a transient failure (5xx, network, timeout). Safe to retry. */
+export declare class UpstreamTransientError extends ActionError {
+    constructor(message: string, opts?: {
+        cause?: unknown;
+        details?: unknown;
+    });
+}
+/** Vendor/IS rejected the request permanently (4xx semantics). Don't retry. */
+export declare class UpstreamPermanentError extends ActionError {
+    constructor(message: string, opts?: {
+        cause?: unknown;
+        details?: unknown;
+    });
+}
+export declare class NotImplementedError extends ActionError {
+    constructor(message: string, details?: unknown);
 }
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/actions/utils/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAIxB,OAAO,CAAC,EAAE,OAAO;IAHnC,QAAQ,CAAC,IAAI,mBAAmB;gBAE9B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,OAAO,YAAA;CAKpC;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAElB,IAAI,EAAE,MAAM;aAEZ,OAAO,CAAC,EAAE,OAAO;gBAFjB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,OAAO,YAAA;CAKpC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,WAAW,GACX,WAAW,GACX,UAAU,GACV,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,UAAU,CAAC;AAEf,wCAAwC;AACxC,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAqBzD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAE3D;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,WAAY,SAAQ,KAAK;aAOlB,IAAI,EAAE,MAAM;aAEZ,OAAO,CAAC,EAAE,OAAO;IARnC,4DAA4D;IAC5D,SAAgB,QAAQ,EAAE,aAAa,CAAC;IACxC,+DAA+D;IAC/D,SAAgB,SAAS,EAAE,OAAO,CAAC;gBAGjB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,OAAO,YAAA,EACjC,IAAI,GAAE,eAAoB;CAW7B;AAED,0EAA0E;AAC1E,qBAAa,iBAAkB,SAAQ,WAAW;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI/C;AAED,qBAAa,cAAe,SAAQ,WAAW;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI/C;AAED,qBAAa,aAAc,SAAQ,WAAW;gBAChC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,aAAc,SAAQ,WAAW;gBAChC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,uBAAwB,SAAQ,WAAW;gBAC1C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,2FAA2F;AAC3F,qBAAa,sBAAuB,SAAQ,WAAW;gBACzC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO;CAO/E;AAED,+EAA+E;AAC/E,qBAAa,sBAAuB,SAAQ,WAAW;gBACzC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO;CAO/E;AAED,qBAAa,mBAAoB,SAAQ,WAAW;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAI/C"}

package/dist/actions/utils/errors.js

@@ -1,29 +1,119 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ActionError = exports.InvalidInputError = void 0;
-/**
- * Throw from `parseInput` when validation fails. Becomes a 400 in the envelope.
- */
-class InvalidInputError extends Error {
-    constructor(message, details) {
-        super(message);
-        this.details = details;
-        this.code = 'INVALID_INPUT';
-        this.name = 'InvalidInputError';
+exports.NotImplementedError = exports.UpstreamPermanentError = exports.UpstreamTransientError = exports.PreconditionFailedError = exports.ConflictError = exports.NotFoundError = exports.ForbiddenError = exports.InvalidInputError = exports.ActionError = void 0;
+exports.categoryToStatus = categoryToStatus;
+exports.categoryRetryable = categoryRetryable;
+/** Default HTTP status per category. */
+function categoryToStatus(c) {
+    switch (c) {
+        case 'invalid_input':
+            return 422;
+        case 'forbidden':
+            return 403;
+        case 'not_found':
+            return 404;
+        case 'conflict':
+            return 409;
+        case 'precondition_failed':
+            return 412;
+        case 'upstream_transient':
+            return 503;
+        case 'upstream_permanent':
+            return 502;
+        case 'not_implemented':
+            return 501;
+        case 'internal':
+            return 500;
     }
 }
-exports.InvalidInputError = InvalidInputError;
+/** Default retryability per category. Only transient upstream failures retry. */
+function categoryRetryable(c) {
+    return c === 'upstream_transient';
+}
 /**
- * Throw from a handler to produce a structured failure envelope.
- * Use for known business errors (FLOW_NOT_FOUND, DIRECTION_IS_IMMUTABLE, etc.).
+ * Base class for all structured action failures. Throw a typed subclass
+ * (`InvalidInputError`, `ForbiddenError`, `NotFoundError`, …) — they pre-set
+ * `category` so HTTP status and retry signaling are automatic.
  */
 class ActionError extends Error {
-    constructor(code, message, details) {
+    constructor(code, message, details, opts = {}) {
+        var _a, _b;
         super(message);
         this.code = code;
         this.details = details;
         this.name = 'ActionError';
+        this.category = (_a = opts.category) !== null && _a !== void 0 ? _a : 'internal';
+        this.retryable = (_b = opts.retryable) !== null && _b !== void 0 ? _b : categoryRetryable(this.category);
+        if (opts.cause !== undefined) {
+            // Use ES2022 Error.cause — preserves the underlying stack across rewraps.
+            this.cause = opts.cause;
+        }
     }
 }
 exports.ActionError = ActionError;
+/** Throw from `parseInput` (or a handler) when the input is malformed. */
+class InvalidInputError extends ActionError {
+    constructor(message, details) {
+        super('INVALID_INPUT', message, details, { category: 'invalid_input' });
+        this.name = 'InvalidInputError';
+    }
+}
+exports.InvalidInputError = InvalidInputError;
+class ForbiddenError extends ActionError {
+    constructor(message, details) {
+        super('FORBIDDEN', message, details, { category: 'forbidden' });
+        this.name = 'ForbiddenError';
+    }
+}
+exports.ForbiddenError = ForbiddenError;
+class NotFoundError extends ActionError {
+    constructor(code, message, details) {
+        super(code, message, details, { category: 'not_found' });
+        this.name = 'NotFoundError';
+    }
+}
+exports.NotFoundError = NotFoundError;
+class ConflictError extends ActionError {
+    constructor(code, message, details) {
+        super(code, message, details, { category: 'conflict' });
+        this.name = 'ConflictError';
+    }
+}
+exports.ConflictError = ConflictError;
+class PreconditionFailedError extends ActionError {
+    constructor(code, message, details) {
+        super(code, message, details, { category: 'precondition_failed' });
+        this.name = 'PreconditionFailedError';
+    }
+}
+exports.PreconditionFailedError = PreconditionFailedError;
+/** Vendor/IS responded with a transient failure (5xx, network, timeout). Safe to retry. */
+class UpstreamTransientError extends ActionError {
+    constructor(message, opts = {}) {
+        super('UPSTREAM_TRANSIENT', message, opts.details, {
+            category: 'upstream_transient',
+            cause: opts.cause,
+        });
+        this.name = 'UpstreamTransientError';
+    }
+}
+exports.UpstreamTransientError = UpstreamTransientError;
+/** Vendor/IS rejected the request permanently (4xx semantics). Don't retry. */
+class UpstreamPermanentError extends ActionError {
+    constructor(message, opts = {}) {
+        super('UPSTREAM_PERMANENT', message, opts.details, {
+            category: 'upstream_permanent',
+            cause: opts.cause,
+        });
+        this.name = 'UpstreamPermanentError';
+    }
+}
+exports.UpstreamPermanentError = UpstreamPermanentError;
+class NotImplementedError extends ActionError {
+    constructor(message, details) {
+        super('NOT_IMPLEMENTED', message, details, { category: 'not_implemented' });
+        this.name = 'NotImplementedError';
+    }
+}
+exports.NotImplementedError = NotImplementedError;
 //# sourceMappingURL=errors.js.map

package/dist/actions/utils/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/actions/utils/errors.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,MAAa,iBAAkB,SAAQ,KAAK;IAE1C,YACE,OAAe,EACC,OAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,YAAO,GAAP,OAAO,CAAU;QAH1B,SAAI,GAAG,eAAe,CAAC;QAM9B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AATD,8CASC;AAED;;;GAGG;AACH,MAAa,WAAY,SAAQ,KAAK;IACpC,YACkB,IAAY,EAC5B,OAAe,EACC,OAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAU;QAGjC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AATD,kCASC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/actions/utils/errors.ts"],"names":[],"mappings":";;;AAiBA,4CAqBC;AAGD,8CAEC;AA3BD,wCAAwC;AACxC,SAAgB,gBAAgB,CAAC,CAAgB;IAC/C,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,eAAe;YAClB,OAAO,GAAG,CAAC;QACb,KAAK,WAAW;YACd,OAAO,GAAG,CAAC;QACb,KAAK,WAAW;YACd,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,qBAAqB;YACxB,OAAO,GAAG,CAAC;QACb,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAC;QACb,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,iBAAiB,CAAC,CAAgB;IAChD,OAAO,CAAC,KAAK,oBAAoB,CAAC;AACpC,CAAC;AAQD;;;;GAIG;AACH,MAAa,WAAY,SAAQ,KAAK;IAMpC,YACkB,IAAY,EAC5B,OAAe,EACC,OAAiB,EACjC,OAAwB,EAAE;;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAU;QAIjC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,MAAA,IAAI,CAAC,QAAQ,mCAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,MAAA,IAAI,CAAC,SAAS,mCAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,0EAA0E;YACzE,IAA4B,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnD,CAAC;IACH,CAAC;CACF;AArBD,kCAqBC;AAED,0EAA0E;AAC1E,MAAa,iBAAkB,SAAQ,WAAW;IAChD,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAED,MAAa,cAAe,SAAQ,WAAW;IAC7C,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC;AAED,MAAa,aAAc,SAAQ,WAAW;IAC5C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED,MAAa,aAAc,SAAQ,WAAW;IAC5C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED,MAAa,uBAAwB,SAAQ,WAAW;IACtD,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED,2FAA2F;AAC3F,MAAa,sBAAuB,SAAQ,WAAW;IACrD,YAAY,OAAe,EAAE,OAA+C,EAAE;QAC5E,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACjD,QAAQ,EAAE,oBAAoB;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AARD,wDAQC;AAED,+EAA+E;AAC/E,MAAa,sBAAuB,SAAQ,WAAW;IACrD,YAAY,OAAe,EAAE,OAA+C,EAAE;QAC5E,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACjD,QAAQ,EAAE,oBAAoB;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AARD,wDAQC;AAED,MAAa,mBAAoB,SAAQ,WAAW;IAClD,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC"}

package/dist/actions/utils/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKtC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAEtE"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,cAAc,EAAkB,MAAM,iBAAiB,CAAC;AAGjE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKtC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAEtE"}

package/dist/actions/utils/helpers.js

@@ -4,6 +4,7 @@ exports.resolveSystem = resolveSystem;
 exports.resolveLookupStrategy = resolveLookupStrategy;
 const skedulo_adapter_1 = require("../../adapters/skedulo.adapter");
 const constants_1 = require("../../constants");
+const errors_1 = require("./errors");
 /**
  * Resolve the adapter for the system named in an action's input. Falls back
  * to the action's own integrationType when `system` is omitted.
@@ -17,7 +18,7 @@ function resolveSystem(adapter, inputSystem) {
         return { system, adapter: skedulo_adapter_1.skeduloAdapter };
     if (system === adapter.integrationType)
         return { system, adapter };
-    throw new Error(`Unknown system: ${system}`);
+    throw new errors_1.InvalidInputError(`Unknown system: ${system}`);
 }
 /**
  * Resolve the configured lookup strategy on an adapter, defaulting to ExternalId.

package/dist/actions/utils/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/actions/utils/helpers.ts"],"names":[],"mappings":";;AAWA,sCAQC;AAKD,sDAEC;AAzBD,oEAAgE;AAChE,+CAAiE;AAEjE;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,OAAgB,EAChB,WAA+B;IAE/B,MAAM,MAAM,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC;IACtD,IAAI,MAAM,KAAK,0BAAc;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAc,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,OAAO,CAAC,eAAe;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAgB;;IACpD,OAAO,MAAA,MAAA,OAAO,CAAC,YAAY,0CAAE,cAAc,mCAAI,0BAAc,CAAC,UAAU,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/actions/utils/helpers.ts"],"names":[],"mappings":";;AAYA,sCAQC;AAKD,sDAEC;AA1BD,oEAAgE;AAChE,+CAAiE;AACjE,qCAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,OAAgB,EAChB,WAA+B;IAE/B,MAAM,MAAM,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC;IACtD,IAAI,MAAM,KAAK,0BAAc;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAc,EAAE,CAAC;IAC1E,IAAI,MAAM,KAAK,OAAO,CAAC,eAAe;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnE,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,OAAgB;;IACpD,OAAO,MAAA,MAAA,OAAO,CAAC,YAAY,0CAAE,cAAc,mCAAI,0BAAc,CAAC,UAAU,CAAC;AAC3E,CAAC"}

package/dist/actions/utils/metrics.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Minimal metrics surface so actions can emit counters/histograms without
+ * coupling to a specific backend (StatsD, OTel, Datadog). Tenant functions
+ * inject a real impl via `BaseAdapterHandlerConfig.metrics`; the SDK defaults
+ * to a no-op.
+ */
+export interface Metrics {
+    counter(name: string, value: number, tags?: Record<string, string>): void;
+    histogram(name: string, value: number, tags?: Record<string, string>): void;
+}
+export declare const noopMetrics: Metrics;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/actions/utils/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/metrics.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;CAC7E;AAED,eAAO,MAAM,WAAW,EAAE,OAOzB,CAAC"}

package/dist/actions/utils/metrics.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noopMetrics = void 0;
+exports.noopMetrics = {
+    counter() {
+        /* no-op */
+    },
+    histogram() {
+        /* no-op */
+    },
+};
+//# sourceMappingURL=metrics.js.map

package/dist/actions/utils/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/actions/utils/metrics.ts"],"names":[],"mappings":";;;AAWa,QAAA,WAAW,GAAY;IAClC,OAAO;QACL,WAAW;IACb,CAAC;IACD,SAAS;QACP,WAAW;IACb,CAAC;CACF,CAAC"}

package/dist/actions/utils/middleware.d.ts

@@ -0,0 +1,39 @@
+import type { IntegrationContext } from '../../context';
+/** The (input, ctx) → result function that middleware wraps. */
+export type ActionHandler<I, O> = (input: I, ctx: IntegrationContext) => Promise<O>;
+/** Metadata available to every middleware. Set once at definition time. */
+export interface MiddlewareMeta {
+    actionName: string;
+    /** Safe to retry without side effects. */
+    idempotent: boolean;
+    /** Emit an audit log line on success. */
+    audit: boolean;
+}
+/**
+ * A middleware wraps `next` and returns a new handler. Order is outer-to-inner:
+ * `compose([A, B], handler)` runs A → B → handler.
+ */
+export type Middleware = <I, O>(next: ActionHandler<I, O>, meta: MiddlewareMeta) => ActionHandler<I, O>;
+export declare function compose<I, O>(middlewares: ReadonlyArray<Middleware>, handler: ActionHandler<I, O>, meta: MiddlewareMeta): ActionHandler<I, O>;
+/**
+ * Log structured start/end lines for every action. Failure lines include the
+ * error code and message; the requestId threads through to downstream services.
+ */
+export declare const withLogging: Middleware;
+/**
+ * Emit a counter per (action, status[, code]) and a duration histogram. Tags
+ * stay low-cardinality — `code` is bounded by the error taxonomy.
+ */
+export declare const withMetrics: Middleware;
+/**
+ * Emit a single audit line on success when `meta.audit` is true. Mutating
+ * actions opt in via `defineAction({ audit: true })`. Failures are not audited
+ * (a rejected mutation didn't happen) — they show up in the standard logs.
+ */
+export declare const withAudit: Middleware;
+/**
+ * Gate the handler on admin privileges. Failure raises `ForbiddenError` so the
+ * dispatcher returns 403 and the error envelope is consistent across actions.
+ */
+export declare const requireAdmin: Middleware;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/actions/utils/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD,gEAAgE;AAChE,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,EAC5B,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EACzB,IAAI,EAAE,cAAc,KACjB,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzB,wBAAgB,OAAO,CAAC,CAAC,EAAE,CAAC,EAC1B,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,EACtC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EAC5B,IAAI,EAAE,cAAc,GACnB,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAErB;AAID;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,UAsBzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,UAezB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,UAUvB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,UAK1B,CAAC"}

package/dist/actions/utils/middleware.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAdmin = exports.withAudit = exports.withMetrics = exports.withLogging = void 0;
+exports.compose = compose;
+const helpers_1 = require("../../utils/helpers");
+const errors_1 = require("./errors");
+function compose(middlewares, handler, meta) {
+    return middlewares.reduceRight((next, mw) => mw(next, meta), handler);
+}
+// ── stock middlewares ────────────────────────────────────────────────────────
+/**
+ * Log structured start/end lines for every action. Failure lines include the
+ * error code and message; the requestId threads through to downstream services.
+ */
+const withLogging = (next, meta) => async (input, ctx) => {
+    var _a, _b;
+    const startedAt = Date.now();
+    ctx.logger.info(`[action.start] name=${meta.actionName} requestId=${ctx.requestId} ` +
+        `idempotent=${meta.idempotent}`);
+    try {
+        const result = await next(input, ctx);
+        ctx.logger.info(`[action.end] name=${meta.actionName} requestId=${ctx.requestId} ` +
+            `status=ok duration_ms=${Date.now() - startedAt}`);
+        return result;
+    }
+    catch (err) {
+        const e = err;
+        ctx.logger.warn(`[action.end] name=${meta.actionName} requestId=${ctx.requestId} ` +
+            `status=error duration_ms=${Date.now() - startedAt} ` +
+            `code=${(_a = e.code) !== null && _a !== void 0 ? _a : 'INTERNAL'} message=${(_b = e.message) !== null && _b !== void 0 ? _b : String(err)}`);
+        throw err;
+    }
+};
+exports.withLogging = withLogging;
+/**
+ * Emit a counter per (action, status[, code]) and a duration histogram. Tags
+ * stay low-cardinality — `code` is bounded by the error taxonomy.
+ */
+const withMetrics = (next, meta) => async (input, ctx) => {
+    var _a;
+    const startedAt = Date.now();
+    try {
+        const result = await next(input, ctx);
+        const dur = Date.now() - startedAt;
+        ctx.metrics.counter('action.calls', 1, { name: meta.actionName, status: 'ok' });
+        ctx.metrics.histogram('action.duration_ms', dur, { name: meta.actionName, status: 'ok' });
+        return result;
+    }
+    catch (err) {
+        const dur = Date.now() - startedAt;
+        const code = (_a = err.code) !== null && _a !== void 0 ? _a : 'INTERNAL';
+        ctx.metrics.counter('action.calls', 1, { name: meta.actionName, status: 'error', code });
+        ctx.metrics.histogram('action.duration_ms', dur, { name: meta.actionName, status: 'error' });
+        throw err;
+    }
+};
+exports.withMetrics = withMetrics;
+/**
+ * Emit a single audit line on success when `meta.audit` is true. Mutating
+ * actions opt in via `defineAction({ audit: true })`. Failures are not audited
+ * (a rejected mutation didn't happen) — they show up in the standard logs.
+ */
+const withAudit = (next, meta) => async (input, ctx) => {
+    var _a, _b, _c;
+    if (!meta.audit)
+        return next(input, ctx);
+    const result = await next(input, ctx);
+    const tenantId = (_c = (_b = (_a = ctx.skedContext) === null || _a === void 0 ? void 0 : _a.tenant) === null || _b === void 0 ? void 0 : _b.id) !== null && _c !== void 0 ? _c : 'unknown';
+    ctx.logger.info(`[audit] action=${meta.actionName} tenant=${tenantId} ` +
+        `requestId=${ctx.requestId} integration=${ctx.integrationType}`);
+    return result;
+};
+exports.withAudit = withAudit;
+/**
+ * Gate the handler on admin privileges. Failure raises `ForbiddenError` so the
+ * dispatcher returns 403 and the error envelope is consistent across actions.
+ */
+const requireAdmin = (next, meta) => async (input, ctx) => {
+    if (!(0, helpers_1.isAdminRequest)(ctx.skedContext)) {
+        throw new errors_1.ForbiddenError(`${meta.actionName} requires admin privileges`);
+    }
+    return next(input, ctx);
+};
+exports.requireAdmin = requireAdmin;
+//# sourceMappingURL=middleware.js.map

package/dist/actions/utils/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/actions/utils/middleware.ts"],"names":[],"mappings":";;;AAyBA,0BAMC;AA9BD,iDAAqD;AACrD,qCAA0C;AAuB1C,SAAgB,OAAO,CACrB,WAAsC,EACtC,OAA4B,EAC5B,IAAoB;IAEpB,OAAO,WAAW,CAAC,WAAW,CAAsB,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7F,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACI,MAAM,WAAW,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,uBAAuB,IAAI,CAAC,UAAU,cAAc,GAAG,CAAC,SAAS,GAAG;QAClE,cAAc,IAAI,CAAC,UAAU,EAAE,CAClC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,qBAAqB,IAAI,CAAC,UAAU,cAAc,GAAG,CAAC,SAAS,GAAG;YAChE,yBAAyB,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CACpD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA0C,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,qBAAqB,IAAI,CAAC,UAAU,cAAc,GAAG,CAAC,SAAS,GAAG;YAChE,4BAA4B,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG;YACrD,QAAQ,MAAA,CAAC,CAAC,IAAI,mCAAI,UAAU,YAAY,MAAA,CAAC,CAAC,OAAO,mCAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAtBW,QAAA,WAAW,eAsBtB;AAEF;;;GAGG;AACI,MAAM,WAAW,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACnC,MAAM,IAAI,GAAG,MAAC,GAAyB,CAAC,IAAI,mCAAI,UAAU,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAfW,QAAA,WAAW,eAetB;AAEF;;;;GAIG;AACI,MAAM,SAAS,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GACZ,MAAA,MAAA,MAAC,GAAG,CAAC,WAAwD,0CAAE,MAAM,0CAAE,EAAE,mCAAI,SAAS,CAAC;IACzF,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,kBAAkB,IAAI,CAAC,UAAU,WAAW,QAAQ,GAAG;QACrD,aAAa,GAAG,CAAC,SAAS,gBAAgB,GAAG,CAAC,eAAe,EAAE,CAClE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAVW,QAAA,SAAS,aAUpB;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAe,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3E,IAAI,CAAC,IAAA,wBAAc,EAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAc,CAAC,GAAG,IAAI,CAAC,UAAU,4BAA4B,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC,CAAC;AALW,QAAA,YAAY,gBAKvB"}

package/dist/actions/utils/types.d.ts

@@ -17,6 +17,8 @@ export interface ActionFailure {
         code: string;
         message: string;
         details?: unknown;
+        /** Whether the caller may retry. Set when the thrown error carries a category. */
+        retryable?: boolean;
     };
 }
 export type ActionResult<T> = ActionSuccess<T> | ActionFailure;
@@ -29,6 +31,8 @@ export type ActionResult<T> = ActionSuccess<T> | ActionFailure;
 export interface ParseMeta {
     /** From the `sked-data-flow-id` header. */
     dataFlowId?: number;
+    /** From the `sked-scheduled-job-name` header (a job's `webhook_name`). */
+    scheduledJobName?: string;
 }
 /**
  * One registered action. The registry holds a map of name → Action.
@@ -51,9 +55,6 @@ export interface Action<TInput, TOutput> {
      */
     handler: (input: TInput, ctx: IntegrationContext) => Promise<TOutput>;
 }
-/**
- * The registry is keyed by action name. Action types are erased here —
- * the typed dispatch client (Task 10) re-introduces type-level inference.
- */
+/** Registry keyed by action name; action input/output types are erased here. */
 export type ActionRegistry = Map<string, Action<any, any>>;
 //# sourceMappingURL=types.d.ts.map

package/dist/actions/utils/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO;IACrC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC;IACvD;;;OAGG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/actions/utils/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,CAAC,CAAC;CACX;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,kFAAkF;QAClF,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO;IACrC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC;IACvD;;;OAGG;IACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC"}