@shipfox/api-definitions 12.0.0 → 12.2.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-definitions",
   "license": "MIT",
-  "version": "12.0.0",
+  "version": "12.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -26,25 +26,25 @@
     "js-yaml": "^4.1.0",
     "yaml": "^2.8.3",
     "zod": "^4.4.3",
-    "@shipfox/api-agent-dto": "12.0.0",
-    "@shipfox/api-auth-context": "12.0.0",
-    "@shipfox/api-definitions-dto": "12.0.0",
-    "@shipfox/api-integration-core-dto": "12.0.0",
-    "@shipfox/api-projects-dto": "12.0.0",
+    "@shipfox/api-agent-dto": "12.2.0",
+    "@shipfox/api-auth-context": "12.2.0",
+    "@shipfox/api-definitions-dto": "12.2.0",
+    "@shipfox/api-integration-core-dto": "12.2.0",
+    "@shipfox/api-projects-dto": "12.2.0",
     "@shipfox/api-secrets-dto": "12.0.0",
     "@shipfox/config": "1.2.4",
-    "@shipfox/expression": "2.0.0",
+    "@shipfox/expression": "2.1.0",
     "@shipfox/inter-module": "0.2.3",
     "@shipfox/node-drizzle": "0.3.5",
-    "@shipfox/node-fastify": "0.4.1",
+    "@shipfox/node-fastify": "0.4.2",
     "@shipfox/node-error-monitoring": "0.3.0",
-    "@shipfox/node-module": "1.0.5",
-    "@shipfox/node-opentelemetry": "0.6.3",
+    "@shipfox/node-module": "1.0.6",
+    "@shipfox/node-opentelemetry": "0.6.4",
     "@shipfox/node-outbox": "0.2.6",
     "@shipfox/node-postgres": "0.5.0",
-    "@shipfox/node-temporal": "0.4.4",
-    "@shipfox/runner-labels": "0.1.3",
-    "@shipfox/workflow-document": "3.0.0"
+    "@shipfox/node-temporal": "0.4.5",
+    "@shipfox/runner-labels": "0.2.0",
+    "@shipfox/workflow-document": "3.0.1"
   },
   "imports": {
     "#*": "./dist/*"

package/src/core/workflow-model/invalid-workflow-model-error.ts

@@ -26,7 +26,6 @@ export type WorkflowModelValidationIssueCode =
   | 'invalid-listener-filter'
   | 'invalid-model'
   | 'invalid-job-if'
-  | 'invalid-job-output'
   | 'invalid-job-success'
   | 'invalid-output-schema'
   | 'invalid-runner-label'

package/src/core/workflow-model/normalize-jobs.ts

@@ -404,57 +404,21 @@ function normalizeJobOutputs(params: {
       typeOverlay,
     }) ?? [{kind: 'literal' as const, value: source}];
     templates[key] = template;
-    types[key] = inferJobOutputType({
-      sourceName: params.sourceName,
-      key,
-      source,
-      template,
-      issues: params.issues,
-    });
+    types[key] = inferJobOutputType(template);
   }
 
   return {templates, types};
 }
 
-function inferJobOutputType(params: {
-  sourceName: string;
-  key: string;
-  source: string;
-  template: WorkflowFieldTemplate;
-  issues: WorkflowModelValidationIssue[];
-}): ExpressionType {
-  if (params.template.length !== 1) return 'string';
+function inferJobOutputType(template: WorkflowFieldTemplate): ExpressionType {
+  if (template.length !== 1) return 'string';
 
-  const [segment] = params.template;
+  const [segment] = template;
   if (segment?.kind !== 'deferred') return 'string';
 
   const resultType = segment.expression.resultType;
   if (resultType === undefined) return 'string';
-  if (isScalarExpressionType(resultType)) return resultType;
-
-  params.issues.push(
-    issue({
-      code: 'invalid-job-output',
-      message: `Job output "${params.key}" must resolve to a scalar value.`,
-      path: ['jobs', params.sourceName, 'outputs', params.key],
-      details: {
-        output: params.key,
-        source: params.source,
-      },
-    }),
-  );
-  return 'string';
-}
-
-function isScalarExpressionType(type: ExpressionType): boolean {
-  return (
-    type === 'string' ||
-    type === 'int' ||
-    type === 'double' ||
-    type === 'bool' ||
-    type === 'null' ||
-    type === 'timestamp'
-  );
+  return resultType;
 }
 
 function normalizeJobSteps(params: {

package/src/core/workflow-model/normalize-workflow-document.test.ts

@@ -69,11 +69,21 @@ const integrationValidationContext = {
         ],
       },
     ],
+    [
+      'jira',
+      {
+        selectors: [
+          {token: 'get_issue', kind: 'standalone', sensitivity: 'read', sensitive: false},
+          {token: 'add_comment', kind: 'standalone', sensitivity: 'write', sensitive: false},
+        ],
+      },
+    ],
   ]),
   workspaceConnectionSnapshot: new Map([
     ['github-main', {id: 'conn_1', provider: 'github', capabilities: ['agent_tools']}],
     ['sentry-main', {id: 'conn_2', provider: 'sentry', capabilities: []}],
     ['linear-main', {id: 'conn_3', provider: 'linear', capabilities: ['agent_tools']}],
+    ['jira-main', {id: 'conn_4', provider: 'jira', capabilities: ['agent_tools']}],
   ]),
   defaultConnectionSlug: 'github-main',
 } satisfies IntegrationValidationContext;
@@ -647,6 +657,56 @@ describe('normalizeWorkflowDocument', () => {
     });
   });
 
+  it('requires allow_write for Jira write tools', () => {
+    const document: WorkflowDocument = {
+      name: 'jira write integrations',
+      jobs: {
+        fix: {
+          steps: [
+            {
+              prompt: 'Comment on the issue.',
+              integrations: [{connection: 'jira-main', include: ['add_comment']}],
+            },
+          ],
+        },
+      },
+    };
+
+    const error = expectInvalid(document, {integrationValidationContext});
+
+    expect(error.issues).toMatchObject([
+      {
+        code: 'integration-write-not-allowed',
+        details: {tokens: ['add_comment']},
+      },
+    ]);
+  });
+
+  it('accepts Jira write tools when allow_write is true', () => {
+    const document: WorkflowDocument = {
+      name: 'jira write integrations',
+      jobs: {
+        fix: {
+          steps: [
+            {
+              prompt: 'Comment on the issue.',
+              integrations: [
+                {connection: 'jira-main', include: ['add_comment'], allow_write: true},
+              ],
+            },
+          ],
+        },
+      },
+    };
+
+    const model = normalizeWorkflowDocument(document, {integrationValidationContext});
+
+    expect(model.jobs[0]?.steps[0]).toMatchObject({
+      kind: 'agent',
+      integrations: [{connection: 'jira-main', include: ['add_comment'], allowWrite: true}],
+    });
+  });
+
   it('reports connection failures before token checks', () => {
     const document: WorkflowDocument = {
       name: 'missing connection',
@@ -2558,9 +2618,9 @@ describe('normalizeWorkflowDocument', () => {
     });
   });
 
-  it('reports non-scalar typed job output mappings', () => {
+  it('infers structured typed job output mappings', () => {
     const document: WorkflowDocument = {
-      name: 'bad job output type',
+      name: 'structured job output type',
       jobs: {
         build: {
           steps: [
@@ -2571,10 +2631,13 @@ describe('normalizeWorkflowDocument', () => {
                 metadata: {
                   type: 'json',
                   schema: {
-                    type: 'object',
-                    additionalProperties: false,
-                    required: ['digest'],
-                    properties: {digest: {type: 'string'}},
+                    type: 'array',
+                    items: {
+                      type: 'object',
+                      additionalProperties: false,
+                      required: ['severity'],
+                      properties: {severity: {type: 'string'}},
+                    },
                   },
                 },
               },
@@ -2587,14 +2650,78 @@ describe('normalizeWorkflowDocument', () => {
       },
     };
 
-    const error = expectInvalid(document);
+    const model = normalizeWorkflowDocument(document);
 
-    expect(error.issues).toEqual([
-      expect.objectContaining({
-        code: 'invalid-job-output',
-        path: ['jobs', 'build', 'outputs', 'metadata'],
-      }),
-    ]);
+    expect(model.jobs[0]?.outputTypes).toEqual({
+      metadata: {
+        kind: 'list',
+        element: {
+          kind: 'object',
+          fields: {severity: 'string'},
+        },
+      },
+    });
+  });
+
+  it('authorizes indexed reads from structured job outputs', () => {
+    const document: WorkflowDocument = {
+      name: 'indexed structured job output',
+      jobs: {
+        review: {
+          steps: [
+            {
+              key: 'inspect',
+              run: 'npm run inspect',
+              outputs: {
+                findings: {
+                  type: 'json',
+                  schema: {
+                    type: 'array',
+                    items: {
+                      type: 'object',
+                      additionalProperties: false,
+                      required: ['severity'],
+                      properties: {severity: {type: 'string'}},
+                    },
+                  },
+                },
+              },
+            },
+          ],
+          outputs: {
+            findings: interpolation('steps.inspect.outputs.findings'),
+          },
+        },
+        summarize: {
+          needs: ['review'],
+          steps: [
+            {
+              run: `printf '%s\\n' ${interpolation('jobs.review.outputs.findings[0].severity')}`,
+            },
+          ],
+        },
+      },
+    };
+
+    const model = normalizeWorkflowDocument(document);
+    const summarize = model.jobs.find((job) => job.key === 'summarize');
+
+    expect(summarize?.steps[0]).toMatchObject({
+      kind: 'run',
+      templates: {
+        command: [
+          {kind: 'literal', value: "printf '%s\\n' "},
+          {
+            kind: 'deferred',
+            expression: {
+              source: 'jobs.review.outputs.findings[0].severity',
+              check: 'typed',
+            },
+            roots: ['jobs'],
+          },
+        ],
+      },
+    });
   });
 
   it('rejects job output references without a direct needs edge', () => {

package/src/index.ts

@@ -6,6 +6,10 @@ import {
   type DefinitionsEventMap,
   definitionsEventSchemas,
 } from '@shipfox/api-definitions-dto';
+import {
+  INTEGRATION_CONNECTION_AVAILABLE,
+  type IntegrationsEventMap,
+} from '@shipfox/api-integration-core-dto';
 import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
 import {
   PROJECT_SOURCE_BOUND,
@@ -20,6 +24,7 @@ import {db, definitionsOutbox, migrationsPath} from '#db/index.js';
 import {createDefinitionRoutes} from '#presentation/index.js';
 import {createDefinitionsInterModulePresentation} from '#presentation/inter-module.js';
 import {
+  createOnIntegrationConnectionAvailable,
   onProjectSourceBound,
   onProjectSourceCommitObserved,
 } from '#presentation/subscribers/index.js';
@@ -46,7 +51,9 @@ export {db, definitionsOutbox, getDefinitionById, migrationsPath} from '#db/inde
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');
 
-const subscriber = subscriberFactory<DefinitionsEventMap & ProjectsEventMap>();
+const subscriber = subscriberFactory<
+  DefinitionsEventMap & IntegrationsEventMap & ProjectsEventMap
+>();
 
 export interface CreateDefinitionsModuleOptions {
   projects: ProjectsModuleClient;
@@ -73,6 +80,10 @@ export function createDefinitionsModule({
         logger().info({event}, 'Definition resolved');
         return Promise.resolve();
       }),
+      subscriber(
+        INTEGRATION_CONNECTION_AVAILABLE,
+        createOnIntegrationConnectionAvailable(projects),
+      ),
       subscriber(PROJECT_SOURCE_BOUND, onProjectSourceBound),
       subscriber(PROJECT_SOURCE_COMMIT_OBSERVED, onProjectSourceCommitObserved),
     ],

package/src/presentation/subscribers/index.ts

@@ -1,2 +1,3 @@
+export {createOnIntegrationConnectionAvailable} from './on-integration-connection-available.js';
 export {onProjectSourceBound} from './on-project-source-bound.js';
 export {onProjectSourceCommitObserved} from './on-project-source-commit-observed.js';

package/src/presentation/subscribers/on-integration-connection-available.test.ts

@@ -0,0 +1,132 @@
+import type {IntegrationConnectionAvailableEvent} from '@shipfox/api-integration-core-dto';
+import type {DomainEvent} from '@shipfox/node-outbox';
+import {createOnIntegrationConnectionAvailable} from './on-integration-connection-available.js';
+
+const startMock = vi.fn();
+
+vi.mock('@shipfox/node-temporal', () => ({
+  temporalClient: () => ({workflow: {start: startMock}}),
+}));
+
+function project(name: string, workspaceId: string) {
+  return {
+    id: crypto.randomUUID(),
+    workspaceId,
+    sourceConnectionId: crypto.randomUUID(),
+    sourceExternalRepositoryId: `github:${name}`,
+    sourceRepositoryOwner: 'shipfox',
+    name,
+  };
+}
+
+describe('onIntegrationConnectionAvailable', () => {
+  beforeEach(() => {
+    startMock.mockReset();
+    startMock.mockResolvedValue({});
+  });
+
+  it('paginates workspace projects and starts an event-keyed sync for each one', async () => {
+    const workspaceId = crypto.randomUUID();
+    const first = project('first', workspaceId);
+    const second = project('second', workspaceId);
+    const cursor = {createdAt: '2026-08-05T12:00:00.000Z', id: first.id};
+    const listProjectsByWorkspace = vi
+      .fn()
+      .mockResolvedValueOnce({projects: [first], nextCursor: cursor})
+      .mockResolvedValueOnce({projects: [second], nextCursor: null});
+    const handler = createOnIntegrationConnectionAvailable({listProjectsByWorkspace} as never);
+    const payload: IntegrationConnectionAvailableEvent = {
+      provider: 'linear',
+      workspaceId: first.workspaceId,
+      connectionId: crypto.randomUUID(),
+      slug: 'linear_shipfox',
+    };
+    const event: DomainEvent<IntegrationConnectionAvailableEvent> = {
+      id: crypto.randomUUID(),
+      type: 'integrations.connection.available',
+      payload,
+      createdAt: new Date(),
+    };
+
+    await handler(payload, event);
+
+    expect(listProjectsByWorkspace).toHaveBeenNthCalledWith(1, {
+      workspaceId: payload.workspaceId,
+      limit: 100,
+    });
+    expect(listProjectsByWorkspace).toHaveBeenNthCalledWith(2, {
+      workspaceId: payload.workspaceId,
+      limit: 100,
+      cursor,
+    });
+    expect(startMock).toHaveBeenCalledTimes(2);
+    for (const candidate of [first, second]) {
+      expect(startMock).toHaveBeenCalledWith('definitionSyncWorkflow', {
+        taskQueue: 'definitions-sync',
+        workflowId: `definition-sync:${candidate.id}:integration:${event.id}`,
+        workflowIdConflictPolicy: 'USE_EXISTING',
+        workflowIdReusePolicy: 'REJECT_DUPLICATE',
+        args: [
+          {
+            projectId: candidate.id,
+            workspaceId: candidate.workspaceId,
+            sourceConnectionId: candidate.sourceConnectionId,
+            sourceExternalRepositoryId: candidate.sourceExternalRepositoryId,
+            sourceRef: undefined,
+            sourceCommitSha: undefined,
+          },
+        ],
+      });
+    }
+  });
+
+  it('treats an already-started event-keyed sync as successfully delivered', async () => {
+    const workspaceId = crypto.randomUUID();
+    const candidate = project('first', workspaceId);
+    const alreadyStarted = new Error('Workflow execution already started');
+    alreadyStarted.name = 'WorkflowExecutionAlreadyStartedError';
+    startMock.mockRejectedValue(alreadyStarted);
+    const handler = createOnIntegrationConnectionAvailable({
+      listProjectsByWorkspace: vi.fn(() =>
+        Promise.resolve({projects: [candidate], nextCursor: null}),
+      ),
+    } as never);
+    const payload: IntegrationConnectionAvailableEvent = {
+      provider: 'linear',
+      workspaceId,
+      connectionId: crypto.randomUUID(),
+      slug: 'linear_shipfox',
+    };
+
+    await expect(
+      handler(payload, {
+        id: crypto.randomUUID(),
+        type: 'integrations.connection.available',
+        payload,
+        createdAt: new Date(),
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it('rethrows project lookup failures so the outbox event can retry', async () => {
+    const failure = new Error('projects unavailable');
+    const handler = createOnIntegrationConnectionAvailable({
+      listProjectsByWorkspace: vi.fn(() => Promise.reject(failure)),
+    } as never);
+    const payload: IntegrationConnectionAvailableEvent = {
+      provider: 'linear',
+      workspaceId: crypto.randomUUID(),
+      connectionId: crypto.randomUUID(),
+      slug: 'linear_shipfox',
+    };
+
+    await expect(
+      handler(payload, {
+        id: crypto.randomUUID(),
+        type: 'integrations.connection.available',
+        payload,
+        createdAt: new Date(),
+      }),
+    ).rejects.toBe(failure);
+  });
+});

package/src/presentation/subscribers/on-integration-connection-available.ts

@@ -0,0 +1,44 @@
+import type {IntegrationConnectionAvailableEvent} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
+import {boundedMap} from '@shipfox/node-module';
+import type {DomainEvent} from '@shipfox/node-outbox';
+import {startDefinitionSync} from './start-definition-sync.js';
+
+const PROJECT_PAGE_SIZE = 100;
+const SYNC_START_CONCURRENCY = 10;
+
+export function createOnIntegrationConnectionAvailable(
+  projects: Pick<ProjectsModuleClient, 'listProjectsByWorkspace'>,
+) {
+  return async function onIntegrationConnectionAvailable(
+    payload: IntegrationConnectionAvailableEvent,
+    event: DomainEvent<IntegrationConnectionAvailableEvent>,
+  ): Promise<void> {
+    let cursor: {createdAt: string; id: string} | undefined;
+
+    do {
+      const page = await projects.listProjectsByWorkspace({
+        workspaceId: payload.workspaceId,
+        limit: PROJECT_PAGE_SIZE,
+        ...(cursor ? {cursor} : {}),
+      });
+
+      await boundedMap(
+        page.projects,
+        SYNC_START_CONCURRENCY,
+        async (project) => {
+          await startDefinitionSync({
+            projectId: project.id,
+            workspaceId: project.workspaceId,
+            sourceConnectionId: project.sourceConnectionId,
+            externalRepositoryId: project.sourceExternalRepositoryId,
+            requestId: `integration:${event.id}`,
+          });
+        },
+        {stopOnError: true},
+      );
+
+      cursor = page.nextCursor ?? undefined;
+    } while (cursor);
+  };
+}

package/src/presentation/subscribers/start-definition-sync.ts

@@ -8,31 +8,47 @@ export interface StartDefinitionSyncParams {
   externalRepositoryId: string;
   sourceRef?: string | undefined;
   sourceCommitSha?: string | undefined;
+  requestId?: string | undefined;
 }
 
 export async function startDefinitionSync(params: StartDefinitionSyncParams): Promise<void> {
   const workflowId = buildWorkflowId(params);
 
-  await temporalClient().workflow.start(DEFINITION_SYNC_WORKFLOW, {
-    taskQueue: DEFINITIONS_TASK_QUEUE,
-    workflowId,
-    workflowIdConflictPolicy: 'USE_EXISTING',
-    workflowIdReusePolicy: 'ALLOW_DUPLICATE',
-    args: [
-      {
-        projectId: params.projectId,
-        workspaceId: params.workspaceId,
-        sourceConnectionId: params.sourceConnectionId,
-        sourceExternalRepositoryId: params.externalRepositoryId,
-        sourceRef: params.sourceRef,
-        sourceCommitSha: params.sourceCommitSha,
-      },
-    ],
-  });
+  try {
+    await temporalClient().workflow.start(DEFINITION_SYNC_WORKFLOW, {
+      taskQueue: DEFINITIONS_TASK_QUEUE,
+      workflowId,
+      workflowIdConflictPolicy: 'USE_EXISTING',
+      workflowIdReusePolicy: params.requestId ? 'REJECT_DUPLICATE' : 'ALLOW_DUPLICATE',
+      args: [
+        {
+          projectId: params.projectId,
+          workspaceId: params.workspaceId,
+          sourceConnectionId: params.sourceConnectionId,
+          sourceExternalRepositoryId: params.externalRepositoryId,
+          sourceRef: params.sourceRef,
+          sourceCommitSha: params.sourceCommitSha,
+        },
+      ],
+    });
+  } catch (error) {
+    if (
+      params.requestId &&
+      error instanceof Error &&
+      error.name === 'WorkflowExecutionAlreadyStartedError'
+    ) {
+      return;
+    }
+    throw error;
+  }
 }
 
 function buildWorkflowId(params: StartDefinitionSyncParams): string {
-  return params.sourceCommitSha
-    ? `definition-sync:${params.projectId}:${params.sourceCommitSha}`
-    : `definition-sync:${params.projectId}:bind`;
+  if (params.sourceCommitSha) {
+    return `definition-sync:${params.projectId}:${params.sourceCommitSha}`;
+  }
+  if (params.requestId) {
+    return `definition-sync:${params.projectId}:${params.requestId}`;
+  }
+  return `definition-sync:${params.projectId}:bind`;
 }