@shipfox/api-server 7.1.0 → 9.0.1

package/package.json

@@ -2,7 +2,7 @@
   "name": "@shipfox/api-server",
   "license": "MIT",
   "private": false,
-  "version": "7.1.0",
+  "version": "9.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -11,9 +11,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#*": "./dist/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -25,37 +22,40 @@
     }
   },
   "dependencies": {
-    "@shipfox/annotations": "7.1.0",
-    "@shipfox/api-agent": "7.1.0",
-    "@shipfox/annotations-dto": "6.0.0",
-    "@shipfox/api-agent-dto": "6.0.0",
-    "@shipfox/api-auth": "7.1.0",
-    "@shipfox/api-auth-dto": "7.1.0",
-    "@shipfox/api-definitions-dto": "6.0.0",
-    "@shipfox/api-dispatcher": "7.1.0",
-    "@shipfox/api-email-challenges": "0.3.0",
-    "@shipfox/api-definitions": "7.1.0",
-    "@shipfox/api-integration-core": "7.1.0",
-    "@shipfox/api-projects": "7.1.0",
-    "@shipfox/api-logs": "7.1.0",
-    "@shipfox/api-projects-dto": "6.0.0",
-    "@shipfox/api-runners": "7.1.0",
-    "@shipfox/api-runners-dto": "7.0.1",
-    "@shipfox/api-secrets": "7.1.0",
-    "@shipfox/api-integration-core-dto": "6.0.0",
-    "@shipfox/api-workflows": "7.1.0",
-    "@shipfox/api-secrets-dto": "6.0.0",
-    "@shipfox/api-triggers": "7.1.0",
-    "@shipfox/api-workspaces-dto": "6.0.0",
-    "@shipfox/api-workflows-dto": "6.0.0",
-    "@shipfox/api-workspaces": "7.1.0",
-    "@shipfox/config": "1.2.2",
-    "@shipfox/node-fastify": "0.3.0",
-    "@shipfox/node-error-monitoring": "0.2.0",
-    "@shipfox/node-jwt": "0.3.0",
-    "@shipfox/node-postgres": "0.4.2",
-    "@shipfox/node-module": "0.5.0",
-    "@shipfox/node-opentelemetry": "0.6.0"
+    "@shipfox/annotations": "9.0.1",
+    "@shipfox/annotations-dto": "9.0.1",
+    "@shipfox/api-agent": "9.0.1",
+    "@shipfox/api-agent-dto": "9.0.1",
+    "@shipfox/api-auth": "9.0.1",
+    "@shipfox/api-auth-dto": "9.0.1",
+    "@shipfox/api-definitions": "9.0.1",
+    "@shipfox/api-definitions-dto": "9.0.1",
+    "@shipfox/api-dispatcher": "9.0.1",
+    "@shipfox/api-email-challenges": "1.1.0",
+    "@shipfox/api-integration-core": "9.0.1",
+    "@shipfox/api-integration-core-dto": "9.0.1",
+    "@shipfox/api-logs": "9.0.1",
+    "@shipfox/api-projects": "9.0.1",
+    "@shipfox/api-projects-dto": "9.0.1",
+    "@shipfox/api-runners": "9.0.1",
+    "@shipfox/api-runners-dto": "9.0.1",
+    "@shipfox/api-secrets": "9.0.1",
+    "@shipfox/api-secrets-dto": "9.0.1",
+    "@shipfox/api-triggers": "9.0.1",
+    "@shipfox/api-workflows": "9.0.1",
+    "@shipfox/api-workflows-dto": "9.0.1",
+    "@shipfox/api-workspaces-dto": "9.0.1",
+    "@shipfox/api-workspaces": "9.0.1",
+    "@shipfox/config": "1.2.3",
+    "@shipfox/node-error-monitoring": "0.2.1",
+    "@shipfox/node-fastify": "0.3.1",
+    "@shipfox/node-jwt": "0.3.1",
+    "@shipfox/node-module": "1.0.0",
+    "@shipfox/node-opentelemetry": "0.6.1",
+    "@shipfox/node-postgres": "0.4.3"
+  },
+  "imports": {
+    "#*": "./dist/*"
   },
   "scripts": {
     "build": "shipfox-swc",

package/src/auth-token-interoperability.test.ts

@@ -0,0 +1,54 @@
+import {createLeaseTokenAuthMethod, issueJobLeaseToken} from '@shipfox/api-auth';
+import {AUTH_LEASED_JOB, requireLeasedJobContext} from '@shipfox/api-auth-context';
+import {closeApp, createApp, defineRoute} from '@shipfox/node-fastify';
+import {afterEach, describe, expect, it} from '@shipfox/vitest/vi';
+
+vi.hoisted(() => {
+  process.env.AUTH_ROOT_KEY ??= 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
+});
+
+const leaseRoute = defineRoute({
+  method: 'GET',
+  path: '/lease',
+  description: 'Auth composition test route.',
+  handler: (request) => {
+    const lease = requireLeasedJobContext(request);
+    return {job_id: lease.jobId, step_id: lease.currentStepId};
+  },
+});
+
+describe('Auth token interoperability', () => {
+  afterEach(async () => {
+    await closeApp();
+  });
+
+  it('accepts an Auth-issued step lease through the server route boundary', async () => {
+    const jobId = crypto.randomUUID();
+    const stepId = crypto.randomUUID();
+    const token = await issueJobLeaseToken({
+      jobId,
+      jobExecutionId: crypto.randomUUID(),
+      workflowRunId: crypto.randomUUID(),
+      workflowRunAttemptId: crypto.randomUUID(),
+      projectId: crypto.randomUUID(),
+      workspaceId: crypto.randomUUID(),
+      runnerSessionId: crypto.randomUUID(),
+      currentStepId: stepId,
+      currentStepAttempt: 1,
+    });
+    const app = await createApp({
+      auth: [createLeaseTokenAuthMethod()],
+      routes: [{prefix: '/runs/jobs/current', auth: AUTH_LEASED_JOB, routes: [leaseRoute]}],
+      swagger: false,
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/runs/jobs/current/lease',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({job_id: jobId, step_id: stepId});
+  }, 15_000);
+});

package/src/index.ts

@@ -1,4 +1,5 @@
 export {
+  type DefaultModulesExtension,
   type DefaultModulesOptions,
   type DefaultRunnersModuleFactory,
   defaultModules,

package/src/modules.test.ts

@@ -2,15 +2,18 @@ import {annotationsInterModuleContract} from '@shipfox/annotations-dto/inter-mod
 import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
 import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';
 import {definitionsInterModuleContract} from '@shipfox/api-definitions-dto/inter-module';
-import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto';
-import {projectsInterModuleContract} from '@shipfox/api-projects-dto';
+import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto/inter-module';
+import {projectsInterModuleContract} from '@shipfox/api-projects-dto/inter-module';
 import {runnersInterModuleContract} from '@shipfox/api-runners-dto/inter-module';
 import {
   type SecretsInterModuleClient,
   secretsInterModuleContract,
 } from '@shipfox/api-secrets-dto/inter-module';
 import {workflowsInterModuleContract} from '@shipfox/api-workflows-dto/inter-module';
-import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
+import {
+  type WorkspacesInterModuleClient,
+  workspacesInterModuleContract,
+} from '@shipfox/api-workspaces-dto/inter-module';
 import {defineInterModulePresentation} from '@shipfox/inter-module';
 import {defaultModules} from './modules.js';
 
@@ -30,6 +33,8 @@ const mocks = vi.hoisted(() => ({
   deleteSecrets: vi.fn(),
   getIntegrationConnectionById: vi.fn(),
   getSecret: vi.fn(),
+  getWorkspaceCreator: vi.fn(),
+  listMembershipsForTokenClaims: vi.fn(),
   setSecrets: vi.fn(),
 }));
 
@@ -96,7 +101,8 @@ vi.mock('@shipfox/api-workspaces', () => ({
       {
         contract: workspacesInterModuleContract,
         handlers: {
-          listMembershipsForTokenClaims: vi.fn(),
+          listMembershipsForTokenClaims: mocks.listMembershipsForTokenClaims,
+          getWorkspaceCreator: mocks.getWorkspaceCreator,
           preflightInvitationAcceptance: vi.fn(),
           acceptInvitation: vi.fn(),
           requireActiveMembership: vi.fn(),
@@ -123,6 +129,8 @@ describe('defaultModules', () => {
     mocks.deleteSecrets.mockReset();
     mocks.getIntegrationConnectionById.mockReset();
     mocks.getSecret.mockReset();
+    mocks.getWorkspaceCreator.mockReset();
+    mocks.listMembershipsForTokenClaims.mockReset();
     mocks.setSecrets.mockReset();
 
     mocks.createIntegrationsContext.mockResolvedValue({
@@ -147,6 +155,8 @@ describe('defaultModules', () => {
     mocks.createWorkspaceConnectionSnapshotLoader.mockReturnValue(vi.fn());
     mocks.deleteSecrets.mockResolvedValue({deleted: 1});
     mocks.getSecret.mockResolvedValue({value: 'secret'});
+    mocks.listMembershipsForTokenClaims.mockResolvedValue({memberships: []});
+    mocks.getWorkspaceCreator.mockResolvedValue({creatorUserId: null});
     mocks.setSecrets.mockResolvedValue({});
     mocks.createProjectsModule.mockReturnValue({
       name: 'projects',
@@ -182,7 +192,11 @@ describe('defaultModules', () => {
       interModulePresentations: [
         {
           contract: agentInterModuleContract,
-          handlers: {resolveAgentConfig: vi.fn(), resolveRuntimeCredentials: vi.fn()},
+          handlers: {
+            getValidationCatalog: vi.fn(),
+            resolveAgentConfig: vi.fn(),
+            resolveRuntimeCredentials: vi.fn(),
+          },
         },
       ],
     });
@@ -248,6 +262,27 @@ describe('defaultModules', () => {
     ]);
   });
 
+  it('registers one presentation for every composed inter-module client before sealing', async () => {
+    const modules = await defaultModules();
+    const presentationModules = modules.flatMap((module) =>
+      (module.interModulePresentations ?? []).map(({contract}) => contract.module),
+    );
+    const composedClientModules = [
+      agentInterModuleContract,
+      annotationsInterModuleContract,
+      authInterModuleContract,
+      definitionsInterModuleContract,
+      integrationsInterModuleContract,
+      projectsInterModuleContract,
+      runnersInterModuleContract,
+      secretsInterModuleContract,
+      workflowsInterModuleContract,
+      workspacesInterModuleContract,
+    ].map((contract) => contract.module);
+
+    expect(presentationModules.sort()).toEqual(composedClientModules.sort());
+  });
+
   it('injects Auth into the Runners module', async () => {
     await defaultModules();
 
@@ -288,6 +323,34 @@ describe('defaultModules', () => {
     ]);
   });
 
+  it('extends the default module list with the composed Workspaces client', async () => {
+    let workspaces: WorkspacesInterModuleClient | undefined;
+    const extensionModule = {name: 'cloud'};
+    const extension = vi.fn((options: {workspaces: WorkspacesInterModuleClient}) => {
+      workspaces = options.workspaces;
+      return [extensionModule];
+    });
+
+    const modules = await defaultModules({extension});
+    const userId = crypto.randomUUID();
+    const memberships = await workspaces?.listMembershipsForTokenClaims({userId});
+    const workspaceId = crypto.randomUUID();
+    const creator = await workspaces?.getWorkspaceCreator({workspaceId});
+
+    expect(extension).toHaveBeenCalledWith({workspaces: expect.any(Object)});
+    expect(memberships).toEqual({memberships: []});
+    expect(creator).toEqual({creatorUserId: null});
+    expect(mocks.listMembershipsForTokenClaims).toHaveBeenCalledWith(
+      {userId},
+      expect.objectContaining({signal: expect.any(AbortSignal)}),
+    );
+    expect(mocks.getWorkspaceCreator).toHaveBeenCalledWith(
+      {workspaceId},
+      expect.objectContaining({signal: expect.any(AbortSignal)}),
+    );
+    expect(modules.at(-1)).toBe(extensionModule);
+  });
+
   it('injects Workflows into integrations and logs and namespaces provider secrets', async () => {
     await defaultModules();
 

package/src/modules.ts

@@ -13,10 +13,10 @@ import {definitionsInterModuleContract} from '@shipfox/api-definitions-dto/inter
 import {dispatcherModule} from '@shipfox/api-dispatcher';
 import {emailChallengesModule} from '@shipfox/api-email-challenges';
 import {createIntegrationsContext, type WebhookDeliverySource} from '@shipfox/api-integration-core';
-import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto';
+import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto/inter-module';
 import {createLogsModule} from '@shipfox/api-logs';
 import {createProjectsModule} from '@shipfox/api-projects';
-import {projectsInterModuleContract} from '@shipfox/api-projects-dto';
+import {projectsInterModuleContract} from '@shipfox/api-projects-dto/inter-module';
 import {createRunnersModule} from '@shipfox/api-runners';
 import {runnersInterModuleContract} from '@shipfox/api-runners-dto/inter-module';
 import {createSecretsModule} from '@shipfox/api-secrets';
@@ -25,7 +25,10 @@ import {createTriggersModule} from '@shipfox/api-triggers';
 import {createWorkflowsModule} from '@shipfox/api-workflows';
 import {workflowsInterModuleContract} from '@shipfox/api-workflows-dto/inter-module';
 import {workspacesModule} from '@shipfox/api-workspaces';
-import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
+import {
+  type WorkspacesInterModuleClient,
+  workspacesInterModuleContract,
+} from '@shipfox/api-workspaces-dto/inter-module';
 import {reportError} from '@shipfox/node-error-monitoring';
 import {durationToSeconds} from '@shipfox/node-jwt';
 import type {ShipfoxModule} from '@shipfox/node-module';
@@ -38,9 +41,13 @@ import {logger} from '@shipfox/node-opentelemetry';
 export interface DefaultModulesOptions {
   webhookDeliverySource?: WebhookDeliverySource | undefined;
   runnersModule?: DefaultRunnersModuleFactory | undefined;
+  extension?: DefaultModulesExtension | undefined;
 }
 
 export type DefaultRunnersModuleFactory = (options: {auth: AuthInterModuleClient}) => ShipfoxModule;
+export type DefaultModulesExtension = (options: {
+  workspaces: WorkspacesInterModuleClient;
+}) => ShipfoxModule[];
 
 export async function defaultModules(
   options: DefaultModulesOptions = {},
@@ -151,8 +158,10 @@ export async function defaultModules(
   const projectsModule = createProjectsModule({integrations: integrationsClient});
   const definitionsModule = createDefinitionsModule({
     projects: projectsClient,
+    agent: agentClient,
     integrations: integrationsClient,
   });
+  const extensionModules = options.extension?.({workspaces: workspacesClient}) ?? [];
 
   const modules = [
     emailChallengesModule,
@@ -181,6 +190,7 @@ export async function defaultModules(
     }),
     createTriggersModule({workflows: workflowsClient}),
     dispatcherModule,
+    ...extensionModules,
   ];
   registerInterModulePresentations({transport: interModuleTransport, modules});
   interModuleTransport.seal();

package/test/published/_environment.mjs

@@ -0,0 +1,61 @@
+export function publishedTestEnvironment() {
+  // Use the active workspace's isolated Postgres instead of a fixed CI port, which
+  // could point at an unrelated local database when this contract runs in a worktree.
+  const postgresHost = process.env.POSTGRES_HOST ?? '127.0.0.1';
+  const postgresPort = process.env.POSTGRES_PORT ?? '5432';
+  const postgresUsername = process.env.POSTGRES_USERNAME ?? 'shipfox';
+  const postgresPassword = process.env.POSTGRES_PASSWORD ?? 'password';
+  const postgresDatabase = 'api_test';
+
+  return {
+    AUTH_ROOT_KEY: 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=',
+    DATABASE_URL: `postgres://${postgresUsername}:${postgresPassword}@${postgresHost}:${postgresPort}/${postgresDatabase}`,
+    GITEA_BASE_URL: 'https://gitea.example.com',
+    GITEA_SERVICE_TOKEN: 'external-consumer-token',
+    GITEA_SERVICE_USERNAME: 'shipfox-bot',
+    GITEA_WEBHOOK_SECRET: 'external-consumer-webhook-secret',
+    GITHUB_API_BASE_URL: 'https://api.github.com',
+    GITHUB_APP_CLIENT_ID: 'external-consumer-client-id',
+    GITHUB_APP_CLIENT_SECRET: 'external-consumer-client-secret',
+    GITHUB_APP_ID: '1',
+    GITHUB_APP_PRIVATE_KEY: 'external-consumer-private-key',
+    GITHUB_APP_SLUG: 'shipfox-external-consumer',
+    GITHUB_APP_USERNAME: 'shipfox-external-consumer',
+    GITHUB_APP_WEBHOOK_SECRET: 'external-consumer-webhook-secret',
+    GITHUB_INSTALL_STATE_SECRET: 'external-consumer-install-state-secret',
+    JIRA_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    JIRA_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    JIRA_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/jira/callback',
+    JIRA_WEBHOOK_BASE_URL: 'https://shipfox.example.com',
+    JIRA_WEBHOOK_SIGNING_SECRET: 'external-consumer-webhook-secret',
+    LINEAR_MCP_ENDPOINT: 'https://mcp.linear.app/mcp',
+    LINEAR_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    LINEAR_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    LINEAR_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/linear/callback',
+    LINEAR_WEBHOOK_SIGNING_SECRET: 'external-consumer-webhook-secret',
+    SLACK_API_BASE_URL: 'https://slack.example.com/api',
+    SLACK_OAUTH_CLIENT_ID: 'external-consumer-client-id',
+    SLACK_OAUTH_CLIENT_SECRET: 'external-consumer-client-secret',
+    SLACK_OAUTH_REDIRECT_URL: 'https://shipfox.example.com/integrations/slack/callback',
+    SLACK_SIGNING_SECRET: 'external-consumer-signing-secret',
+    LOG_STORAGE_S3_ACCESS_KEY_ID: 'external-consumer-access-key',
+    LOG_STORAGE_S3_BUCKET: 'shipfox-logs',
+    LOG_STORAGE_S3_ENDPOINT: 'http://127.0.0.1:3900',
+    LOG_STORAGE_S3_FORCE_PATH_STYLE: 'true',
+    LOG_STORAGE_S3_REGION: 'garage',
+    LOG_STORAGE_S3_SECRET_ACCESS_KEY: 'external-consumer-secret-key',
+    POSTGRES_DATABASE: postgresDatabase,
+    POSTGRES_HOST: postgresHost,
+    POSTGRES_MAX_CONNECTIONS: '5',
+    POSTGRES_PASSWORD: postgresPassword,
+    POSTGRES_PORT: postgresPort,
+    POSTGRES_USERNAME: postgresUsername,
+    SECRETS_ENCRYPTION_KEK: 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=',
+    SENTRY_APP_CLIENT_ID: 'external-consumer-client-id',
+    SENTRY_APP_CLIENT_SECRET: 'external-consumer-client-secret',
+    SENTRY_APP_SLUG: 'shipfox-external-consumer',
+    SENTRY_APP_VERIFY_INSTALL: 'true',
+    TEMPORAL_ADDRESS: '127.0.0.1:7233',
+    WORKSPACE_JWT_SECRET: 'external-consumer-workspace-secret',
+  };
+}

package/test/published/composition.ts

@@ -0,0 +1,19 @@
+import {createRunnersModule} from '@shipfox/api-runners';
+import {createServer, defaultModules} from '@shipfox/api-server';
+
+void createServer({
+  modules: [
+    ...(await defaultModules({
+      runnersModule: ({auth}) =>
+        createRunnersModule({
+          auth,
+          installationProvisioning: {
+            policy: {
+              filterEligibleWorkspaceIds: async (workspaceIds) => new Set(workspaceIds),
+            },
+          },
+        }),
+    })),
+    {name: 'external-dummy'},
+  ],
+});

package/test/published/development-conditions.development.mjs

@@ -0,0 +1,3 @@
+await import('@shipfox/api-server/instrumentation');
+
+process.exit(0);

package/test/published/login-methods-route.mjs

@@ -0,0 +1,22 @@
+const {loginMethodsResponseSchema} = await import('@shipfox/api-auth-dto');
+const {createLoginMethodsRoute} = await import('@shipfox/api-server');
+const {createApp} = await import('@shipfox/node-fastify');
+
+const app = await createApp({
+  auth: [],
+  routes: [createLoginMethodsRoute({loginMethods: [{id: 'external-provider'}]})],
+  swagger: false,
+});
+
+try {
+  const response = await app.inject({method: 'GET', url: '/auth/login-methods'});
+  if (response.statusCode !== 200) {
+    throw new Error('Packed login-method catalog route did not respond.');
+  }
+  const body = loginMethodsResponseSchema.parse(response.json());
+  if (body.login_methods[0]?.id !== 'external-provider') {
+    throw new Error('Packed login-method catalog route returned an unexpected contract.');
+  }
+} finally {
+  await app.close();
+}

package/test/published/workflow-bundles.mjs

@@ -0,0 +1,50 @@
+process.env.INTEGRATIONS_ENABLE_SENTRY_PROVIDER = 'true';
+process.env.NODE_ENV = 'production';
+
+const {readdir, readFile} = await import('node:fs/promises');
+const {dirname, join} = await import('node:path');
+const {defaultModules} = await import('@shipfox/api-server');
+const {loadProductionWorkflowBundle} = await import('@shipfox/node-temporal');
+const modules = await defaultModules();
+const workflowPaths = new Set(
+  modules.flatMap((module) => module.workers ?? []).map((worker) => worker.workflowsPath),
+);
+
+if (!workflowPaths.size) throw new Error('Packed API server declares no workflow entrypoints.');
+
+const bundles = new Map();
+for (const workflowsPath of workflowPaths) {
+  const workflowBundle = loadProductionWorkflowBundle(workflowsPath);
+  bundles.set(workflowsPath, workflowBundle);
+
+  const code = await readFile(workflowBundle.codePath, 'utf8');
+  if (/@shipfox[/\\][^/\\]+[/\\]src[/\\]/u.test(code)) {
+    throw new Error(`Workflow bundle for ${workflowsPath} resolved a first-party source path.`);
+  }
+}
+
+const declaredCodePaths = new Set([...bundles.values()].map(({codePath}) => codePath));
+if (declaredCodePaths.size !== workflowPaths.size) {
+  throw new Error('Packed API workflow entrypoints do not map one-to-one to prebuilt bundles.');
+}
+
+const workflowDirectories = new Set(
+  [...workflowPaths].map((workflowsPath) => dirname(workflowsPath)),
+);
+const emittedBundles = (
+  await Promise.all(
+    [...workflowDirectories].map(async (directory) =>
+      (
+        await readdir(directory)
+      )
+        .filter((entry) => entry.endsWith('.bundle.js'))
+        .map((entry) => join(directory, entry)),
+    ),
+  )
+).flat();
+const unreferencedBundles = emittedBundles.filter((codePath) => !declaredCodePaths.has(codePath));
+if (unreferencedBundles.length) {
+  throw new Error(
+    `Packed API contains unreferenced workflow bundles: ${unreferencedBundles.join(', ')}`,
+  );
+}