@shipfox/api-agent 5.0.0 → 7.1.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-agent",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "7.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -42,31 +42,25 @@
     "@opentelemetry/api": "^1.9.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-agent-dto": "5.0.0",
-    "@shipfox/api-auth-context": "5.0.0",
-    "@shipfox/api-secrets": "5.0.0",
+    "@shipfox/node-error-monitoring": "0.2.0",
+    "@shipfox/api-agent-dto": "6.0.0",
+    "@shipfox/api-auth-context": "7.1.0",
+    "@shipfox/api-secrets-dto": "6.0.0",
+    "@shipfox/inter-module": "0.2.0",
     "@shipfox/config": "1.2.2",
-    "@shipfox/node-drizzle": "0.3.1",
+    "@shipfox/node-drizzle": "0.3.2",
     "@shipfox/node-egress-guard": "0.1.1",
-    "@shipfox/node-fastify": "0.2.3",
-    "@shipfox/node-module": "0.3.2",
-    "@shipfox/node-opentelemetry": "0.5.2",
+    "@shipfox/node-fastify": "0.3.0",
+    "@shipfox/node-module": "0.5.0",
+    "@shipfox/node-opentelemetry": "0.6.0",
     "@shipfox/node-postgres": "0.4.2",
-    "@shipfox/redact": "0.2.2"
-  },
-  "devDependencies": {
-    "@types/pg": "^8.15.5",
-    "drizzle-kit": "^0.31.10",
-    "@shipfox/biome": "1.8.2",
-    "@shipfox/swc": "1.2.6",
-    "@shipfox/ts-config": "1.3.8",
-    "@shipfox/typescript": "1.1.7",
-    "@shipfox/vitest": "1.2.3"
+    "@shipfox/redact": "0.2.3"
   },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/core/custom-model-provider-config-service.ts

@@ -10,8 +10,9 @@ import {
   type UpdateCustomModelProviderBodyDto,
   type UpdateCustomModelProviderHeaderRequestDto,
 } from '@shipfox/api-agent-dto';
-import {deleteSecrets, getSecretsByNamespace, setSecrets} from '@shipfox/api-secrets';
 import {assertEgressAllowed} from '@shipfox/node-egress-guard';
+import {reportError} from '@shipfox/node-error-monitoring';
+import {logger} from '@shipfox/node-opentelemetry';
 import {
   deleteModelProviderConfig,
   getModelProviderConfig,
@@ -38,6 +39,7 @@ import {
   probeCustomModelProviderCredentials,
   runProviderProbe,
 } from './model-provider-validation.js';
+import {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';
 
 export interface CreateCustomModelProviderConfigParams {
   workspaceId: string;
@@ -55,6 +57,7 @@ export interface UpdateCustomModelProviderConfigParams {
 
 export interface CustomModelProviderConfigServiceOptions {
   probe?: typeof probeCustomModelProviderCredentials | undefined;
+  secrets?: AgentSecretsClient | undefined;
 }
 
 interface SplitHeaders {
@@ -69,6 +72,7 @@ export async function createCustomModelProviderConfig(
   options: CustomModelProviderConfigServiceOptions = {},
 ): Promise<ModelProviderConfig> {
   const probe = options.probe ?? probeCustomModelProviderCredentials;
+  const secrets = requireAgentSecretsClient(options.secrets);
 
   const existing = await getModelProviderConfig({
     workspaceId: params.workspaceId,
@@ -123,7 +127,7 @@ export async function createCustomModelProviderConfig(
   }
 
   try {
-    await setSecrets({
+    await secrets.setSecrets({
       workspaceId: params.workspaceId,
       namespace: agentSystemNamespace(params.body.slug),
       values: customCredentialsToStoreValues(secretCredentials),
@@ -134,7 +138,7 @@ export async function createCustomModelProviderConfig(
       workspaceId: params.workspaceId,
       providerId: params.body.slug,
     });
-    await deleteSecrets({
+    await secrets.deleteSecrets({
       workspaceId: params.workspaceId,
       namespace: agentSystemNamespace(params.body.slug),
     });
@@ -147,9 +151,10 @@ export async function updateCustomModelProviderConfig(
   options: CustomModelProviderConfigServiceOptions = {},
 ): Promise<ModelProviderConfig> {
   const probe = options.probe ?? probeCustomModelProviderCredentials;
+  const secrets = requireAgentSecretsClient(options.secrets);
 
   const existing = await getExistingCustomConfig(params.workspaceId, params.providerId);
-  const existingSecrets = await getCustomProviderSecrets({
+  const existingSecrets = await getCustomProviderSecrets(secrets, {
     workspaceId: params.workspaceId,
     providerId: params.providerId,
   });
@@ -204,7 +209,7 @@ export async function updateCustomModelProviderConfig(
   });
 
   const namespace = agentSystemNamespace(params.providerId);
-  await setSecrets({
+  await secrets.setSecrets({
     workspaceId: params.workspaceId,
     namespace,
     values: customCredentialsToStoreValues(newSecretCredentials),
@@ -227,16 +232,26 @@ export async function updateCustomModelProviderConfig(
       defaultThinking: existing.defaultThinking,
     });
   } catch (error) {
-    await rollbackCustomProviderSecretUpdate({
+    await rollbackCustomProviderSecretUpdate(secrets, {
       workspaceId: params.workspaceId,
       namespace,
       existingSecrets,
       attemptedSecrets: newSecretCredentials,
-    }).catch(() => undefined);
+    }).catch((rollbackError) => {
+      logger().error(
+        {err: rollbackError, workspaceId: params.workspaceId, providerId: params.providerId},
+        'Failed to roll back custom model provider secrets',
+      );
+      reportError(rollbackError, {
+        boundary: 'agent.cleanup',
+        operation: 'rollback-secret-update',
+        extra: {workspaceId: params.workspaceId, providerId: params.providerId},
+      });
+    });
     throw error;
   }
 
-  await pruneStaleCustomHeaderSecrets({
+  await pruneStaleCustomHeaderSecrets(secrets, {
     workspaceId: params.workspaceId,
     providerId: params.providerId,
     existingSecrets,
@@ -247,13 +262,17 @@ export async function updateCustomModelProviderConfig(
   return updated;
 }
 
-export async function resolveCustomModelProviderDiscoveryParams(params: {
-  workspaceId: string;
-  providerId: ModelProviderRef;
-  body: DiscoverCustomModelProviderModelsBySlugBodyDto;
-}): Promise<DiscoverCustomModelProviderModelsBodyDto> {
+export async function resolveCustomModelProviderDiscoveryParams(
+  params: {
+    workspaceId: string;
+    providerId: ModelProviderRef;
+    body: DiscoverCustomModelProviderModelsBySlugBodyDto;
+  },
+  options: {secrets?: AgentSecretsClient | undefined} = {},
+): Promise<DiscoverCustomModelProviderModelsBodyDto> {
+  const secrets = requireAgentSecretsClient(options.secrets);
   const existing = await getExistingCustomConfig(params.workspaceId, params.providerId);
-  const existingSecrets = await getCustomProviderSecrets({
+  const existingSecrets = await getCustomProviderSecrets(secrets, {
     workspaceId: params.workspaceId,
     providerId: params.providerId,
   });
@@ -434,11 +453,14 @@ function selectProbeModel(
   return model;
 }
 
-async function getCustomProviderSecrets(params: {
-  workspaceId: string;
-  providerId: ModelProviderRef;
-}): Promise<Record<string, string>> {
-  const values = await getSecretsByNamespace({
+async function getCustomProviderSecrets(
+  secrets: AgentSecretsClient,
+  params: {
+    workspaceId: string;
+    providerId: ModelProviderRef;
+  },
+): Promise<Record<string, string>> {
+  const {values} = await secrets.getSecretsByNamespace({
     workspaceId: params.workspaceId,
     namespace: agentSystemNamespace(params.providerId),
   });
@@ -474,12 +496,15 @@ function normalizedUrl(value: string): string {
   return normalizeCustomProviderBaseUrl(value);
 }
 
-async function rollbackCustomProviderSecretUpdate(params: {
-  workspaceId: string;
-  namespace: string;
-  existingSecrets: Record<string, string>;
-  attemptedSecrets: Record<string, string>;
-}): Promise<void> {
+async function rollbackCustomProviderSecretUpdate(
+  secrets: AgentSecretsClient,
+  params: {
+    workspaceId: string;
+    namespace: string;
+    existingSecrets: Record<string, string>;
+    attemptedSecrets: Record<string, string>;
+  },
+): Promise<void> {
   const attemptedKeys = Object.keys(params.attemptedSecrets);
   if (attemptedKeys.length === 0) return;
 
@@ -490,7 +515,7 @@ async function rollbackCustomProviderSecretUpdate(params: {
     }),
   );
   if (Object.keys(secretsToRestore).length > 0) {
-    await setSecrets({
+    await secrets.setSecrets({
       workspaceId: params.workspaceId,
       namespace: params.namespace,
       values: customCredentialsToStoreValues(secretsToRestore),
@@ -500,20 +525,23 @@ async function rollbackCustomProviderSecretUpdate(params: {
   const newKeys = attemptedKeys.filter((key) => params.existingSecrets[key] === undefined);
   if (newKeys.length === 0) return;
 
-  await deleteSecrets({
+  await secrets.deleteSecrets({
     workspaceId: params.workspaceId,
     namespace: params.namespace,
     keys: newKeys.map(customCredentialToStoreKey),
   });
 }
 
-async function pruneStaleCustomHeaderSecrets(params: {
-  workspaceId: string;
-  providerId: ModelProviderRef;
-  existingSecrets: Record<string, string>;
-  newSecrets: Record<string, string>;
-  replaceHeaders: boolean;
-}): Promise<void> {
+async function pruneStaleCustomHeaderSecrets(
+  secrets: AgentSecretsClient,
+  params: {
+    workspaceId: string;
+    providerId: ModelProviderRef;
+    existingSecrets: Record<string, string>;
+    newSecrets: Record<string, string>;
+    replaceHeaders: boolean;
+  },
+): Promise<void> {
   if (!params.replaceHeaders) return;
 
   const nextKeys = new Set(Object.keys(params.newSecrets));
@@ -522,7 +550,7 @@ async function pruneStaleCustomHeaderSecrets(params: {
   );
   if (staleKeys.length === 0) return;
 
-  await deleteSecrets({
+  await secrets.deleteSecrets({
     workspaceId: params.workspaceId,
     namespace: agentSystemNamespace(params.providerId),
     keys: staleKeys.map(customCredentialToStoreKey),

package/src/core/model-provider-config-service.test.ts

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto';
-import * as secretStore from '@shipfox/api-secrets';
 import * as modelProviderDb from '#db/index.js';
 import {getModelProviderConfig, upsertModelProviderConfig} from '#db/index.js';
+import {getSecretsByNamespace, setSecrets} from '#test/fixtures/secrets-client.js';
 import {agentSystemNamespace} from './credential-fingerprints.js';
 import {
   createCustomModelProviderConfig,
@@ -23,8 +23,6 @@ import {
   updateModelProviderConfigDefaultModel,
 } from './model-provider-config-service.js';
 
-const {getSecretsByNamespace, setSecrets} = secretStore;
-
 describe('testAndSaveModelProviderConfig', () => {
   let workspaceId: string;
 

package/src/core/model-provider-config-service.ts

@@ -5,7 +5,8 @@ import {
   modelProviderCredentialKeysMatch,
   type SupportedModelProviderId,
 } from '@shipfox/api-agent-dto';
-import {deleteSecrets, getSecretsByNamespace, setSecrets} from '@shipfox/api-secrets';
+import {reportError} from '@shipfox/node-error-monitoring';
+import {logger} from '@shipfox/node-opentelemetry';
 import {
   deleteModelProviderConfig as deleteModelProviderConfigRow,
   getModelProviderConfig,
@@ -22,6 +23,7 @@ import {
 } from './errors.js';
 import {buildModelProviderCatalog} from './model-provider-catalog.js';
 import {probeModelProviderCredentials, runProviderProbe} from './model-provider-validation.js';
+import {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';
 
 export interface TestAndSaveModelProviderConfigParams {
   workspaceId: string;
@@ -35,6 +37,7 @@ export interface TestAndSaveModelProviderConfigParams {
 
 export interface TestAndSaveModelProviderConfigOptions {
   probe?: typeof probeModelProviderCredentials;
+  secrets?: AgentSecretsClient | undefined;
   pruneStaleSecrets?:
     | ((params: {workspaceId: string; namespace: string; expectedKeys: string[]}) => Promise<void>)
     | undefined;
@@ -51,6 +54,7 @@ export async function testAndSaveModelProviderConfig(
   options: TestAndSaveModelProviderConfigOptions = {},
 ): Promise<ModelProviderConfig> {
   const probe = options.probe ?? probeModelProviderCredentials;
+  const secrets = requireAgentSecretsClient(options.secrets);
   const entry = getModelProviderEntry(params.providerId);
   if (entry === undefined || entry.support_status !== 'supported') {
     throw new UnsupportedModelProviderError(params.providerId);
@@ -83,10 +87,11 @@ export async function testAndSaveModelProviderConfig(
     secrets: Object.values(params.credentials),
     signal: params.signal,
   });
-  const pruneStaleSecrets = options.pruneStaleSecrets ?? pruneStaleProviderCredentialSecrets;
+  const pruneStaleSecrets =
+    options.pruneStaleSecrets ?? ((input) => pruneStaleProviderCredentialSecrets(secrets, input));
   const namespace = agentSystemNamespace(params.providerId);
   const values = credentialsToStoreValues(params.providerId, params.credentials);
-  await setSecrets({
+  await secrets.setSecrets({
     workspaceId: params.workspaceId,
     namespace,
     values,
@@ -105,7 +110,17 @@ export async function testAndSaveModelProviderConfig(
     workspaceId: params.workspaceId,
     namespace,
     expectedKeys: Object.keys(values),
-  }).catch(() => undefined);
+  }).catch((error) => {
+    logger().error(
+      {err: error, workspaceId: params.workspaceId, providerId: params.providerId},
+      'Failed to prune stale model provider secrets',
+    );
+    reportError(error, {
+      boundary: 'agent.cleanup',
+      operation: 'prune-stale-secrets',
+      extra: {workspaceId: params.workspaceId, providerId: params.providerId},
+    });
+  });
 
   return config;
 }
@@ -154,12 +169,13 @@ export async function updateModelProviderConfigDefaultModel(
   return config;
 }
 
-export async function deleteModelProviderConfig(params: {
-  workspaceId: string;
-  providerId: ModelProviderRef;
-}): Promise<boolean> {
+export async function deleteModelProviderConfig(
+  params: {workspaceId: string; providerId: ModelProviderRef},
+  options: {secrets?: AgentSecretsClient | undefined} = {},
+): Promise<boolean> {
+  const secrets = requireAgentSecretsClient(options.secrets);
   const deleted = await deleteModelProviderConfigRow(params);
-  await deleteSecrets({
+  await secrets.deleteSecrets({
     workspaceId: params.workspaceId,
     namespace: agentSystemNamespace(params.providerId),
   });
@@ -186,12 +202,11 @@ function resolveDefaultModel(
   return {probeModel: model, storedModel: requestedModel ?? null};
 }
 
-async function pruneStaleProviderCredentialSecrets(params: {
-  workspaceId: string;
-  namespace: string;
-  expectedKeys: string[];
-}): Promise<void> {
-  const stored = await getSecretsByNamespace({
+async function pruneStaleProviderCredentialSecrets(
+  secrets: AgentSecretsClient,
+  params: {workspaceId: string; namespace: string; expectedKeys: string[]},
+): Promise<void> {
+  const {values: stored} = await secrets.getSecretsByNamespace({
     workspaceId: params.workspaceId,
     namespace: params.namespace,
   });
@@ -199,7 +214,7 @@ async function pruneStaleProviderCredentialSecrets(params: {
   const staleKeys = Object.keys(stored).filter((key) => !expected.has(key));
   if (staleKeys.length === 0) return;
 
-  await deleteSecrets({
+  await secrets.deleteSecrets({
     workspaceId: params.workspaceId,
     namespace: params.namespace,
     keys: staleKeys,

package/src/core/resolve-runtime-credentials.test.ts

@@ -1,6 +1,6 @@
 import type {ModelProviderRef} from '@shipfox/api-agent-dto';
-import {SecretDecryptionError, setSecrets} from '@shipfox/api-secrets';
 import {deleteModelProviderConfig, upsertModelProviderConfig} from '#db/index.js';
+import {setSecrets} from '#test/fixtures/secrets-client.js';
 import {agentSystemNamespace, customCredentialsToStoreValues} from './credential-fingerprints.js';
 import {ModelProviderConfigNotFoundError} from './errors.js';
 import {resolveRuntimeCredentials} from './resolve-runtime-credentials.js';
@@ -245,7 +245,7 @@ describe('resolveRuntimeCredentials', () => {
   });
 
   it('does not expose credential material on store decryption errors', async () => {
-    const error = new SecretDecryptionError();
+    const error = new Error('Secret decryption failed');
     await upsertModelProviderConfig({
       workspaceId,
       providerId: 'anthropic',
@@ -264,7 +264,7 @@ describe('resolveRuntimeCredentials', () => {
       {getCredentialBag: vi.fn().mockRejectedValue(error)},
     );
 
-    await expect(result).rejects.toThrow(SecretDecryptionError);
+    await expect(result).rejects.toBe(error);
     try {
       await result;
     } catch (error) {

package/src/core/resolve-runtime-credentials.ts

@@ -7,7 +7,8 @@ import {
   modelProviderCredentialKeysMatch,
   type SupportedModelProviderId,
 } from '@shipfox/api-agent-dto';
-import {getSecretsByNamespace, SecretDecryptionError} from '@shipfox/api-secrets';
+import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {config} from '#config.js';
 import {getModelProviderConfig} from '#db/index.js';
 import {agentRuntimeConfigResolvedCount} from '#metrics/index.js';
@@ -18,6 +19,7 @@ import {
 } from './credential-fingerprints.js';
 import type {ModelProviderConfig} from './entities/model-provider-config.js';
 import {ModelProviderConfigNotFoundError} from './errors.js';
+import {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';
 
 export interface ResolveRuntimeCredentialsParams {
   workspaceId: string;
@@ -34,7 +36,10 @@ interface RuntimeCredentialsConfig {
 
 interface ResolveRuntimeCredentialsOptions {
   runtimeConfig?: RuntimeCredentialsConfig | undefined;
-  getCredentialBag?: typeof getSecretsByNamespace | undefined;
+  secrets?: AgentSecretsClient | undefined;
+  getCredentialBag?:
+    | ((params: {workspaceId: string; namespace: string}) => Promise<Record<string, string>>)
+    | undefined;
 }
 
 export async function resolveRuntimeCredentials(
@@ -42,7 +47,7 @@ export async function resolveRuntimeCredentials(
   options?: ResolveRuntimeCredentialsOptions,
 ): Promise<AgentRuntimeCredentialsResponseDto> {
   const runtimeConfig = options?.runtimeConfig ?? config;
-  const getCredentialBag = options?.getCredentialBag ?? getSecretsByNamespace;
+  const secrets = options?.secrets;
   const providerConfig = await getModelProviderConfig({
     workspaceId: params.workspaceId,
     providerId: params.provider,
@@ -50,10 +55,17 @@ export async function resolveRuntimeCredentials(
 
   if (providerConfig) {
     try {
-      const values = await getCredentialBag({
-        workspaceId: params.workspaceId,
-        namespace: agentSystemNamespace(params.provider),
-      });
+      const values = options?.getCredentialBag
+        ? await options.getCredentialBag({
+            workspaceId: params.workspaceId,
+            namespace: agentSystemNamespace(params.provider),
+          })
+        : (
+            await requireAgentSecretsClient(secrets).getSecretsByNamespace({
+              workspaceId: params.workspaceId,
+              namespace: agentSystemNamespace(params.provider),
+            })
+          ).values;
       if (providerConfig.kind === 'custom') {
         const credentials = storeValuesToCustomRuntimeCredentials(values);
         agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});
@@ -68,7 +80,9 @@ export async function resolveRuntimeCredentials(
       agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});
       return toResponse(params, credentials, providerConfig);
     } catch (error) {
-      if (error instanceof SecretDecryptionError) {
+      if (
+        isInterModuleKnownError(secretsInterModuleContract.methods.getSecretsByNamespace, error)
+      ) {
         agentRuntimeConfigResolvedCount.add(1, {
           source: 'workspace',
           outcome: 'decryption_failed',

package/src/core/secrets-client.ts

@@ -0,0 +1,13 @@
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
+
+export type AgentSecretsClient = Pick<
+  SecretsInterModuleClient,
+  'deleteSecrets' | 'getSecretsByNamespace' | 'setSecrets'
+>;
+
+export function requireAgentSecretsClient(
+  secrets: AgentSecretsClient | undefined,
+): AgentSecretsClient {
+  if (secrets) return secrets;
+  throw new Error('Agent Secrets client is not configured.');
+}

package/src/index.ts

@@ -1,7 +1,9 @@
 import type {ShipfoxModule} from '@shipfox/node-module';
+import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {db, migrationsPath} from '#db/index.js';
-import {agentE2eRoutes} from '#presentation/e2eRoutes/index.js';
-import {routes} from '#presentation/index.js';
+import {createAgentE2eRoutes} from '#presentation/e2eRoutes/index.js';
+import {createAgentInterModulePresentation} from '#presentation/inter-module.js';
+import {createAgentRoutes} from '#presentation/routes/index.js';
 
 export {
   type AgentConfigResolutionContext,
@@ -35,9 +37,12 @@ export {
   upsertModelProviderConfig,
 } from '#db/index.js';
 
-export const agentModule: ShipfoxModule = {
-  name: 'agent',
-  database: {db, migrationsPath},
-  routes,
-  e2eRoutes: [agentE2eRoutes],
-};
+export function createAgentModule(params: {secrets: AgentSecretsClient}): ShipfoxModule {
+  return {
+    name: 'agent',
+    database: {db, migrationsPath},
+    routes: createAgentRoutes(params.secrets),
+    e2eRoutes: [createAgentE2eRoutes(params.secrets)],
+    interModulePresentations: [createAgentInterModulePresentation(params)],
+  };
+}

package/src/presentation/e2eRoutes/create-model-provider.ts

@@ -1,9 +1,9 @@
 import {DEFAULT_AGENT_THINKING, getModelProviderEntry} from '@shipfox/api-agent-dto';
-import {setSecrets} from '@shipfox/api-secrets';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {agentSystemNamespace} from '#core/credential-fingerprints.js';
 import {listHarnessProviderModels} from '#core/harness/registry.js';
+import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {upsertModelProviderConfig} from '#db/index.js';
 
 const createE2eModelProviderBodySchema = z.object({
@@ -18,44 +18,46 @@ const createE2eModelProviderResponseSchema = z.object({
   provider_id: z.literal('anthropic'),
 });
 
-export const createE2eModelProviderRoute = defineRoute({
-  method: 'POST',
-  path: '/model-provider',
-  description: 'Create an Anthropic model provider config for E2E tests.',
-  schema: {
-    body: createE2eModelProviderBodySchema,
-    response: {201: createE2eModelProviderResponseSchema},
-  },
-  handler: async (request, reply) => {
-    const entry = getModelProviderEntry(request.body.provider_id);
-    if (entry === undefined || entry.default_model === null) {
-      throw new ClientError('Unsupported E2E model provider', 'unsupported-model-provider', {
-        status: 400,
+export function createE2eModelProviderRoute(secrets: AgentSecretsClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/model-provider',
+    description: 'Create an Anthropic model provider config for E2E tests.',
+    schema: {
+      body: createE2eModelProviderBodySchema,
+      response: {201: createE2eModelProviderResponseSchema},
+    },
+    handler: async (request, reply) => {
+      const entry = getModelProviderEntry(request.body.provider_id);
+      if (entry === undefined || entry.default_model === null) {
+        throw new ClientError('Unsupported E2E model provider', 'unsupported-model-provider', {
+          status: 400,
+        });
+      }
+      const defaultModel = request.body.default_model ?? entry.default_model;
+      const supportedModels = listHarnessProviderModels('claude', request.body.provider_id);
+      if (!supportedModels.some((model) => model.id === defaultModel)) {
+        throw new ClientError('Unsupported Anthropic default model', 'unsupported-model', {
+          status: 400,
+          details: {default_model: defaultModel},
+        });
+      }
+
+      await secrets.setSecrets({
+        workspaceId: request.body.workspace_id,
+        namespace: agentSystemNamespace(request.body.provider_id),
+        values: {API_KEY: request.body.api_key},
       });
-    }
-    const defaultModel = request.body.default_model ?? entry.default_model;
-    const supportedModels = listHarnessProviderModels('claude', request.body.provider_id);
-    if (!supportedModels.some((model) => model.id === defaultModel)) {
-      throw new ClientError('Unsupported Anthropic default model', 'unsupported-model', {
-        status: 400,
-        details: {default_model: defaultModel},
+      await upsertModelProviderConfig({
+        workspaceId: request.body.workspace_id,
+        providerId: request.body.provider_id,
+        defaultModel,
+        defaultThinking: DEFAULT_AGENT_THINKING,
+        setAsDefault: request.body.set_as_default,
       });
-    }
-
-    await setSecrets({
-      workspaceId: request.body.workspace_id,
-      namespace: agentSystemNamespace(request.body.provider_id),
-      values: {API_KEY: request.body.api_key},
-    });
-    await upsertModelProviderConfig({
-      workspaceId: request.body.workspace_id,
-      providerId: request.body.provider_id,
-      defaultModel,
-      defaultThinking: DEFAULT_AGENT_THINKING,
-      setAsDefault: request.body.set_as_default,
-    });
 
-    reply.code(201);
-    return {provider_id: request.body.provider_id};
-  },
-});
+      reply.code(201);
+      return {provider_id: request.body.provider_id};
+    },
+  });
+}

package/src/presentation/e2eRoutes/index.ts

@@ -1,7 +1,9 @@
 import type {RouteGroup} from '@shipfox/node-fastify';
+import type {AgentSecretsClient} from '#core/secrets-client.js';
 import {createE2eModelProviderRoute} from './create-model-provider.js';
 
-export const agentE2eRoutes: RouteGroup = {
-  prefix: '/agent',
-  routes: [createE2eModelProviderRoute],
-};
+export function createAgentE2eRoutes(secrets: AgentSecretsClient): RouteGroup {
+  return {prefix: '/agent', routes: [createE2eModelProviderRoute(secrets)]};
+}
+
+export const agentE2eRoutes = createAgentE2eRoutes(undefined as unknown as AgentSecretsClient);

package/src/presentation/index.ts

@@ -1 +1 @@
-export {agentRoutes as routes} from './routes/index.js';
+export {agentRoutes as routes, createAgentRoutes} from './routes/index.js';