@shipfox/api-logs 6.0.0 → 8.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-logs",
   "license": "MIT",
-  "version": "6.0.0",
+  "version": "8.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -29,40 +29,19 @@
     "@temporalio/workflow": "1.18.1",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "6.0.0",
-    "@shipfox/api-agent-dto": "6.0.0",
+    "@shipfox/api-auth-context": "7.1.0",
     "@shipfox/api-logs-dto": "5.0.0",
-    "@shipfox/api-workflows-dto": "6.0.0",
+    "@shipfox/api-workflows-dto": "8.0.0",
     "@shipfox/config": "1.2.2",
     "@shipfox/node-drizzle": "0.3.2",
-    "@shipfox/node-fastify": "0.2.4",
-    "@shipfox/node-module": "0.4.0",
-    "@shipfox/node-opentelemetry": "0.5.2",
+    "@shipfox/node-fastify": "0.3.0",
+    "@shipfox/node-module": "0.5.0",
     "@shipfox/node-outbox": "0.2.4",
+    "@shipfox/node-opentelemetry": "0.6.0",
     "@shipfox/node-postgres": "0.4.2",
-    "@shipfox/node-temporal": "0.3.2"
-  },
-  "devDependencies": {
-    "@temporalio/client": "1.18.1",
-    "@temporalio/common": "1.18.1",
-    "@temporalio/testing": "1.18.1",
-    "@temporalio/worker": "1.18.1",
-    "@types/pg": "^8.15.5",
-    "drizzle-kit": "^0.31.10",
-    "fastify": "^5.3.3",
-    "fastify-type-provider-zod": "^6.0.0",
-    "fishery": "^2.4.0",
-    "@shipfox/node-auth-root-key": "0.2.0",
-    "@shipfox/api-auth": "6.0.0",
-    "@shipfox/api-auth-dto": "6.0.0",
-    "@shipfox/inter-module": "0.2.0",
-    "@shipfox/biome": "1.8.2",
-    "@shipfox/depcruise": "1.0.2",
-    "@shipfox/node-jwt": "0.3.0",
-    "@shipfox/swc": "1.2.6",
-    "@shipfox/ts-config": "1.3.8",
-    "@shipfox/typescript": "1.1.7",
-    "@shipfox/vitest": "1.2.3"
+    "@shipfox/node-temporal": "0.4.0",
+    "@shipfox/node-error-monitoring": "0.2.0",
+    "@shipfox/workflow-document": "2.1.1"
   },
   "scripts": {
     "build": "shipfox-swc && shipfox-temporal-bundle dist/temporal/workflows/index.js",

package/src/api/object-storage.ts

@@ -9,6 +9,8 @@ import {
 } from '@aws-sdk/client-s3';
 import {Upload} from '@aws-sdk/lib-storage';
 import {getSignedUrl} from '@aws-sdk/s3-request-presigner';
+import {reportError} from '@shipfox/node-error-monitoring';
+import {logger} from '@shipfox/node-opentelemetry';
 import {config} from '#config.js';
 import {type LogObjectKeyParams, logObjectKey} from '#core/entities/log-object.js';
 
@@ -140,12 +142,29 @@ export async function putCompactedObject(params: PutCompactedObjectParams): Prom
     params.signal.addEventListener(
       'abort',
       () => {
-        void upload.abort().catch(() => undefined);
+        void upload.abort().catch((error) => {
+          logger().error(
+            {err: error, objectKey: params.key},
+            'Failed to abort multipart log upload',
+          );
+          reportError(error, {
+            boundary: 'logs.cleanup',
+            operation: 'abort-multipart-upload',
+            extra: {objectKey: params.key},
+          });
+        });
       },
       {once: true},
     );
     if (params.signal.aborted) {
-      await upload.abort().catch(() => undefined);
+      await upload.abort().catch((error) => {
+        logger().error({err: error, objectKey: params.key}, 'Failed to abort multipart log upload');
+        reportError(error, {
+          boundary: 'logs.cleanup',
+          operation: 'abort-multipart-upload',
+          extra: {objectKey: params.key},
+        });
+      });
       throw new Error('Compaction upload aborted before it started');
     }
   }

package/src/core/append-logs.ts

@@ -1,5 +1,4 @@
 import {Buffer} from 'node:buffer';
-import {DEFAULT_HARNESS, type Harness} from '@shipfox/api-agent-dto';
 import {
   type LogRecord,
   parseLogRecordLine,
@@ -8,6 +7,7 @@ import {
 } from '@shipfox/api-logs-dto';
 import type {WorkflowsModuleClient} from '@shipfox/api-workflows-dto/inter-module';
 import {logger} from '@shipfox/node-opentelemetry';
+import {DEFAULT_HARNESS, type Harness} from '@shipfox/workflow-document';
 import {config} from '#config.js';
 import {accrueStoredBytes, claimCap, ensureJobAccounting, isJobCapped} from '#db/accounting.js';
 import {insertChunk} from '#db/chunks.js';

package/src/core/reap-stale-open-streams.ts

@@ -1,3 +1,4 @@
+import {reportError} from '@shipfox/node-error-monitoring';
 import {logger} from '@shipfox/node-opentelemetry';
 import {db} from '#db/db.js';
 import {listStaleOpenStreams} from '#db/streams.js';
@@ -53,6 +54,7 @@ export async function reapStaleOpenStreams(
     } catch (error) {
       result.failed += 1;
       logger().error({err: error, streamId: stream.id}, 'Failed to reap stale open log stream');
+      reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
     }
   }
 

package/src/core/retention.ts

@@ -1,3 +1,4 @@
+import {reportError} from '@shipfox/node-error-monitoring';
 import {logger} from '@shipfox/node-opentelemetry';
 import {deleteObjectsByPrefix} from '#api/object-storage.js';
 import {config} from '#config.js';
@@ -116,6 +117,7 @@ export async function runRetentionSweep(
           {err: error, streamId: stream.id},
           'Failed to delete expired log stream objects',
         );
+        reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
         continue;
       }
 
@@ -129,6 +131,7 @@ export async function runRetentionSweep(
           {err: error, streamId: stream.id},
           'Failed to delete expired log stream row',
         );
+        reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
         continue;
       }
 
@@ -143,6 +146,7 @@ export async function runRetentionSweep(
             {err: error, streamId: stream.id},
             'Failed to reload raced expired log stream',
           );
+          reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
           continue;
         }
         if (current) {
@@ -159,6 +163,7 @@ export async function runRetentionSweep(
               {err: error, streamId: stream.id},
               'Failed to delete raced expired log stream',
             );
+            reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
             continue;
           }
         }

package/src/core/session/parse-session.ts

@@ -1,5 +1,5 @@
-import type {Harness} from '@shipfox/api-agent-dto';
 import type {SessionViewRow} from '@shipfox/api-logs-dto';
+import type {Harness} from '@shipfox/workflow-document';
 import {parseClaudeSessionRecord} from './claude-parser.js';
 import {parsePiSessionRecord} from './pi-parser.js';
 import type {AgentSessionRecord} from './session-record.js';

package/src/presentation/routes/append-logs.test.ts

@@ -1,8 +1,7 @@
 import {Buffer} from 'node:buffer';
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
 import {AUTH_USER} from '@shipfox/api-auth-context';
 import {type AuthMethod, closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {fakeLeaseTokenAuthMethod, mintLeaseToken} from '#test/fixtures/lease-token.js';
 import {endLine, ndjsonBody, outputLine, recordLine} from '#test/fixtures/ndjson.js';
 import {createTestWorkflowsClient} from '#test/fixtures/workflows-client.js';
 import {createLogsRoutes} from './index.js';
@@ -36,7 +35,7 @@ describe('POST /runs/jobs/current/steps/:stepId/logs', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod(), stubUserAuth],
+      auth: [fakeLeaseTokenAuthMethod, stubUserAuth],
       routes: createLogsRoutes(createTestWorkflowsClient()),
       swagger: false,
     });

package/src/temporal/activities/compact-stream.ts

@@ -1,3 +1,5 @@
+import {reportError} from '@shipfox/node-error-monitoring';
+import {logger} from '@shipfox/node-opentelemetry';
 import {Context} from '@temporalio/activity';
 import {compactedObjectKey, deleteObject, putCompactedObject} from '#api/object-storage.js';
 import {compactedGzipStream} from '#core/compaction.js';
@@ -79,7 +81,17 @@ async function compactStream(
     stats.lastSeq !== expected.maxSeq ||
     stats.uncompressedBytes !== expected.uncompressedBytes
   ) {
-    await deleteObject(uploadKey).catch(() => undefined);
+    await deleteObject(uploadKey).catch((error) => {
+      logger().error(
+        {err: error, streamId: stream.id, objectKey: uploadKey},
+        'Failed to delete invalid compacted log object',
+      );
+      reportError(error, {
+        boundary: 'logs.cleanup',
+        operation: 'delete-invalid-compaction-object',
+        extra: {streamId: stream.id, objectKey: uploadKey},
+      });
+    });
     throw new Error(
       `Compaction integrity check failed for stream ${stream.id}: streamed ${stats.chunkCount} chunks / ${stats.uncompressedBytes} bytes up to seq ${stats.lastSeq}, table holds ${expected.count} / ${expected.uncompressedBytes} bytes up to seq ${expected.maxSeq}`,
     );

package/src/temporal/activities/compaction-reconcile.ts

@@ -1,3 +1,4 @@
+import {reportError} from '@shipfox/node-error-monitoring';
 import {logger} from '@shipfox/node-opentelemetry';
 import {temporalClient} from '@shipfox/node-temporal';
 import {config} from '#config.js';
@@ -41,6 +42,7 @@ export async function compactionReconcileActivity(): Promise<{restarted: number;
         {err: error, streamId: stream.id},
         'Failed to re-drive stale stream compaction',
       );
+      reportError(error, {boundary: 'logs.maintenance', extra: {streamId: stream.id}});
     }
   }
 

package/test/fixtures/lease-token.ts

@@ -1,9 +1,8 @@
-import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
-import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
+import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';
+import {JOB_LEASE_TOKEN_AUDIENCE, type JobLeaseTokenClaims} from '@shipfox/api-auth-dto';
+import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';
 
-// Matches test/env.ts; the lease-token auth method reads this same value from config.
-const SECRET = jobLeaseTokenKey();
+const leaseClaims = new Map<string, JobLeaseTokenClaims>();
 
 export interface MintLeaseTokenParams {
   jobId: string;
@@ -14,30 +13,35 @@ export interface MintLeaseTokenParams {
   workflowRunAttemptId?: string;
   currentStepId?: string;
   currentStepAttempt?: number;
-  secret?: string;
-  expiresIn?: string;
-  audience?: string;
 }
 
 export function mintLeaseToken(params: MintLeaseTokenParams): Promise<string> {
-  return signHs256({
-    payload: {
-      jobId: params.jobId,
-      jobExecutionId: params.jobExecutionId,
-      workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
-      workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
-      projectId: params.projectId ?? crypto.randomUUID(),
-      workspaceId: params.workspaceId ?? crypto.randomUUID(),
-      runnerSessionId: crypto.randomUUID(),
-      ...(params.currentStepId && params.currentStepAttempt !== undefined
-        ? {
-            currentStepId: params.currentStepId,
-            currentStepAttempt: params.currentStepAttempt,
-          }
-        : {}),
-    },
-    secret: params.secret ?? SECRET,
-    expiresIn: params.expiresIn ?? '90m',
-    audience: params.audience ?? JOB_LEASE_TOKEN_AUDIENCE,
+  const token = `test-auth-${crypto.randomUUID()}`;
+  leaseClaims.set(token, {
+    jobId: params.jobId,
+    jobExecutionId: params.jobExecutionId,
+    workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
+    workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
+    projectId: params.projectId ?? crypto.randomUUID(),
+    workspaceId: params.workspaceId ?? crypto.randomUUID(),
+    runnerSessionId: crypto.randomUUID(),
+    ...(params.currentStepId && params.currentStepAttempt !== undefined
+      ? {currentStepId: params.currentStepId, currentStepAttempt: params.currentStepAttempt}
+      : {}),
+    aud: JOB_LEASE_TOKEN_AUDIENCE,
+    iat: 0,
+    exp: Number.MAX_SAFE_INTEGER,
   });
+  return Promise.resolve(token);
 }
+
+export const fakeLeaseTokenAuthMethod: AuthMethod = {
+  name: AUTH_LEASED_JOB,
+  authenticate: (request) => {
+    const token = extractBearerToken(request.headers.authorization);
+    const claims = token ? leaseClaims.get(token) : undefined;
+    if (!claims) throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    setLeasedJobContext(request, claims);
+    return Promise.resolve();
+  },
+};