Preserve run-key HTTP errors

.changeset/preserve-run-key-status.md

@@ -0,0 +1,5 @@
+---
+'@workflow/world-vercel': patch
+---
+
+Preserve upstream HTTP status codes when fetching Workflow run encryption keys.

packages/world-vercel/src/encryption.test.ts

@@ -139,7 +139,10 @@ describe('fetchRunKey', () => {
       fetchRunKey(deploymentId, testProjectId, testRunId, {
         token: 'test-token',
       })
-    ).rejects.toThrow('HTTP 404');
+    ).rejects.toMatchObject({
+      message: expect.stringContaining('HTTP 404'),
+      status: 404,
+    });
   });
 });
 

packages/world-vercel/src/encryption.ts

@@ -18,6 +18,16 @@ import { instrumentedFetch, resolveVercelApiToken } from './http-core.js';
 
 const KEY_BYTES = 32; // 256 bits = 32 bytes (AES-256)
 
+class RunKeyFetchError extends Error {
+  readonly status: number;
+
+  constructor(message: string, status: number) {
+    super(message);
+    this.name = 'RunKeyFetchError';
+    this.status = status;
+  }
+}
+
 /**
  * Derive a per-run AES-256 encryption key using HKDF-SHA256.
  *
@@ -131,8 +141,9 @@ export async function fetchRunKey(
       } catch {
         body = '<unable to read response body>';
       }
-      return new Error(
-        `Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${res.status} ${res.statusText}${body ? ` — ${body}` : ''}`
+      return new RunKeyFetchError(
+        `Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${res.status} ${res.statusText}${body ? ` — ${body}` : ''}`,
+        res.status
       );
     },
   });