@shipfox/api-workflows 2.0.0

package/dist/presentation/routes/agent-runtime-config.js

@@ -0,0 +1,71 @@
+import { ModelProviderConfigNotFoundError } from '@shipfox/api-agent/core/errors';
+import { resolveRuntimeCredentials } from '@shipfox/api-agent/core/resolve-runtime-credentials';
+import { agentRuntimeCredentialsResponseSchema, materializedAgentStepConfigSchema } from '@shipfox/api-agent-dto';
+import { SecretDecryptionError } from '@shipfox/api-secrets';
+import { agentRuntimeConfigQuerySchema } from '@shipfox/api-workflows-dto';
+import { captureException } from '@shipfox/node-error-monitoring';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { ZodError } from 'zod';
+import { loadRunningLeasedStep } from './leased-step.js';
+export const agentRuntimeConfigRoute = defineRoute({
+    method: 'GET',
+    path: '/agent-runtime-config',
+    description: "Returns the resolved harness, provider, model, thinking effort, and decrypted provider credential bundle for the runner's currently leased running agent step. The job is identified by the lease token and the step is bound to that job before credentials are returned.",
+    schema: {
+        querystring: agentRuntimeConfigQuerySchema,
+        response: {
+            200: agentRuntimeCredentialsResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof SecretDecryptionError) {
+            captureException(error);
+            throw new ClientError('Model provider credentials could not be decrypted', 'model-provider-credentials-invalid', {
+                status: 409,
+                cause: error
+            });
+        }
+        if (error instanceof ModelProviderConfigNotFoundError) {
+            throw new ClientError('Model provider credentials are not configured', 'model-provider-not-configured', {
+                status: 409
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { step_id: stepId, attempt } = request.query;
+        const { step, workspaceId } = await loadRunningLeasedStep({
+            request,
+            stepId,
+            attempt
+        });
+        if (step.type !== 'agent') {
+            throw new ClientError('Step is not an agent step', 'step-not-agent', {
+                status: 409
+            });
+        }
+        let agentConfig;
+        try {
+            agentConfig = materializedAgentStepConfigSchema.parse(step.config);
+        } catch (error) {
+            if (error instanceof ZodError) {
+                throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
+                    status: 409,
+                    cause: error
+                });
+            }
+            throw error;
+        }
+        const runtimeConfig = await resolveRuntimeCredentials({
+            workspaceId,
+            harness: agentConfig.harness,
+            provider: agentConfig.provider,
+            model: agentConfig.model,
+            thinking: agentConfig.thinking
+        });
+        reply.header('cache-control', 'no-store');
+        return runtimeConfig;
+    }
+});
+
+//# sourceMappingURL=agent-runtime-config.js.map

package/dist/presentation/routes/agent-runtime-config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/agent-runtime-config.ts"],"sourcesContent":["import {ModelProviderConfigNotFoundError} from '@shipfox/api-agent/core/errors';\nimport {resolveRuntimeCredentials} from '@shipfox/api-agent/core/resolve-runtime-credentials';\nimport {\n  agentRuntimeCredentialsResponseSchema,\n  type MaterializedAgentStepConfigDto,\n  materializedAgentStepConfigSchema,\n} from '@shipfox/api-agent-dto';\nimport {SecretDecryptionError} from '@shipfox/api-secrets';\nimport {agentRuntimeConfigQuerySchema} from '@shipfox/api-workflows-dto';\nimport {captureException} from '@shipfox/node-error-monitoring';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {ZodError} from 'zod';\nimport {loadRunningLeasedStep} from './leased-step.js';\n\nexport const agentRuntimeConfigRoute = defineRoute({\n  method: 'GET',\n  path: '/agent-runtime-config',\n  description:\n    \"Returns the resolved harness, provider, model, thinking effort, and decrypted provider credential bundle for the runner's currently leased running agent step. The job is identified by the lease token and the step is bound to that job before credentials are returned.\",\n  schema: {\n    querystring: agentRuntimeConfigQuerySchema,\n    response: {\n      200: agentRuntimeCredentialsResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof SecretDecryptionError) {\n      captureException(error);\n      throw new ClientError(\n        'Model provider credentials could not be decrypted',\n        'model-provider-credentials-invalid',\n        {\n          status: 409,\n          cause: error,\n        },\n      );\n    }\n    if (error instanceof ModelProviderConfigNotFoundError) {\n      throw new ClientError(\n        'Model provider credentials are not configured',\n        'model-provider-not-configured',\n        {\n          status: 409,\n        },\n      );\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {step_id: stepId, attempt} = request.query;\n    const {step, workspaceId} = await loadRunningLeasedStep({request, stepId, attempt});\n\n    if (step.type !== 'agent') {\n      throw new ClientError('Step is not an agent step', 'step-not-agent', {status: 409});\n    }\n\n    let agentConfig: MaterializedAgentStepConfigDto;\n    try {\n      agentConfig = materializedAgentStepConfigSchema.parse(step.config);\n    } catch (error) {\n      if (error instanceof ZodError) {\n        throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {\n          status: 409,\n          cause: error,\n        });\n      }\n      throw error;\n    }\n\n    const runtimeConfig = await resolveRuntimeCredentials({\n      workspaceId,\n      harness: agentConfig.harness,\n      provider: agentConfig.provider,\n      model: agentConfig.model,\n      thinking: agentConfig.thinking,\n    });\n\n    reply.header('cache-control', 'no-store');\n    return runtimeConfig;\n  },\n});\n"],"names":["ModelProviderConfigNotFoundError","resolveRuntimeCredentials","agentRuntimeCredentialsResponseSchema","materializedAgentStepConfigSchema","SecretDecryptionError","agentRuntimeConfigQuerySchema","captureException","ClientError","defineRoute","ZodError","loadRunningLeasedStep","agentRuntimeConfigRoute","method","path","description","schema","querystring","response","errorHandler","error","status","cause","handler","request","reply","step_id","stepId","attempt","query","step","workspaceId","type","agentConfig","parse","config","runtimeConfig","harness","provider","model","thinking","header"],"mappings":"AAAA,SAAQA,gCAAgC,QAAO,iCAAiC;AAChF,SAAQC,yBAAyB,QAAO,sDAAsD;AAC9F,SACEC,qCAAqC,EAErCC,iCAAiC,QAC5B,yBAAyB;AAChC,SAAQC,qBAAqB,QAAO,uBAAuB;AAC3D,SAAQC,6BAA6B,QAAO,6BAA6B;AACzE,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,QAAQ,QAAO,MAAM;AAC7B,SAAQC,qBAAqB,QAAO,mBAAmB;AAEvD,OAAO,MAAMC,0BAA0BH,YAAY;IACjDI,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,aAAaX;QACbY,UAAU;YACR,KAAKf;QACP;IACF;IACAgB,cAAc,CAACC;QACb,IAAIA,iBAAiBf,uBAAuB;YAC1CE,iBAAiBa;YACjB,MAAM,IAAIZ,YACR,qDACA,sCACA;gBACEa,QAAQ;gBACRC,OAAOF;YACT;QAEJ;QACA,IAAIA,iBAAiBnB,kCAAkC;YACrD,MAAM,IAAIO,YACR,iDACA,iCACA;gBACEa,QAAQ;YACV;QAEJ;QACA,MAAMD;IACR;IACAG,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,SAASC,MAAM,EAAEC,OAAO,EAAC,GAAGJ,QAAQK,KAAK;QAChD,MAAM,EAACC,IAAI,EAAEC,WAAW,EAAC,GAAG,MAAMpB,sBAAsB;YAACa;YAASG;YAAQC;QAAO;QAEjF,IAAIE,KAAKE,IAAI,KAAK,SAAS;YACzB,MAAM,IAAIxB,YAAY,6BAA6B,kBAAkB;gBAACa,QAAQ;YAAG;QACnF;QAEA,IAAIY;QACJ,IAAI;YACFA,cAAc7B,kCAAkC8B,KAAK,CAACJ,KAAKK,MAAM;QACnE,EAAE,OAAOf,OAAO;YACd,IAAIA,iBAAiBV,UAAU;gBAC7B,MAAM,IAAIF,YAAY,gCAAgC,6BAA6B;oBACjFa,QAAQ;oBACRC,OAAOF;gBACT;YACF;YACA,MAAMA;QACR;QAEA,MAAMgB,gBAAgB,MAAMlC,0BAA0B;YACpD6B;YACAM,SAASJ,YAAYI,OAAO;YAC5BC,UAAUL,YAAYK,QAAQ;YAC9BC,OAAON,YAAYM,KAAK;YACxBC,UAAUP,YAAYO,QAAQ;QAChC;QAEAf,MAAMgB,MAAM,CAAC,iBAAiB;QAC9B,OAAOL;IACT;AACF,GAAG"}

package/dist/presentation/routes/cancel-run.d.ts

@@ -0,0 +1,2 @@
+export declare const cancelRunRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=cancel-run.d.ts.map

package/dist/presentation/routes/cancel-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel-run.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/cancel-run.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,cAAc,iDA4BzB,CAAC"}

package/dist/presentation/routes/cancel-run.js

@@ -0,0 +1,46 @@
+import { workflowRunDtoSchema } from '@shipfox/api-workflows-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { WorkflowRunNotCancellableError, WorkflowRunNotFoundError } from '#core/errors.js';
+import { cancelWorkflowRun } from '#db/index.js';
+import { toRunDto } from '#presentation/dto/index.js';
+import { requireAccessibleRun } from './require-accessible-run.js';
+export const cancelRunRoute = defineRoute({
+    method: 'POST',
+    path: '/:id/cancel',
+    description: 'Cancel an in-progress workflow run',
+    schema: {
+        params: z.object({
+            id: z.string().uuid()
+        }),
+        response: {
+            200: workflowRunDtoSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof WorkflowRunNotCancellableError) {
+            throw new ClientError(error.message, 'run-already-finished', {
+                status: 409
+            });
+        }
+        if (error instanceof WorkflowRunNotFoundError) {
+            throw new ClientError('Run not found', 'not-found', {
+                status: 404
+            });
+        }
+        throw error;
+    },
+    handler: async (request)=>{
+        const { id } = request.params;
+        const run = await requireAccessibleRun({
+            request,
+            id
+        });
+        const cancelled = await cancelWorkflowRun({
+            workflowRunId: run.id
+        });
+        return toRunDto(cancelled);
+    }
+});
+
+//# sourceMappingURL=cancel-run.js.map

package/dist/presentation/routes/cancel-run.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/cancel-run.ts"],"sourcesContent":["import {workflowRunDtoSchema} from '@shipfox/api-workflows-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {WorkflowRunNotCancellableError, WorkflowRunNotFoundError} from '#core/errors.js';\nimport {cancelWorkflowRun} from '#db/index.js';\nimport {toRunDto} from '#presentation/dto/index.js';\nimport {requireAccessibleRun} from './require-accessible-run.js';\n\nexport const cancelRunRoute = defineRoute({\n  method: 'POST',\n  path: '/:id/cancel',\n  description: 'Cancel an in-progress workflow run',\n  schema: {\n    params: z.object({\n      id: z.string().uuid(),\n    }),\n    response: {\n      200: workflowRunDtoSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof WorkflowRunNotCancellableError) {\n      throw new ClientError(error.message, 'run-already-finished', {status: 409});\n    }\n    if (error instanceof WorkflowRunNotFoundError) {\n      throw new ClientError('Run not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const {id} = request.params;\n    const run = await requireAccessibleRun({request, id});\n\n    const cancelled = await cancelWorkflowRun({workflowRunId: run.id});\n    return toRunDto(cancelled);\n  },\n});\n"],"names":["workflowRunDtoSchema","ClientError","defineRoute","z","WorkflowRunNotCancellableError","WorkflowRunNotFoundError","cancelWorkflowRun","toRunDto","requireAccessibleRun","cancelRunRoute","method","path","description","schema","params","object","id","string","uuid","response","errorHandler","error","message","status","handler","request","run","cancelled","workflowRunId"],"mappings":"AAAA,SAAQA,oBAAoB,QAAO,6BAA6B;AAChE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,8BAA8B,EAAEC,wBAAwB,QAAO,kBAAkB;AACzF,SAAQC,iBAAiB,QAAO,eAAe;AAC/C,SAAQC,QAAQ,QAAO,6BAA6B;AACpD,SAAQC,oBAAoB,QAAO,8BAA8B;AAEjE,OAAO,MAAMC,iBAAiBP,YAAY;IACxCQ,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,QAAQX,EAAEY,MAAM,CAAC;YACfC,IAAIb,EAAEc,MAAM,GAAGC,IAAI;QACrB;QACAC,UAAU;YACR,KAAKnB;QACP;IACF;IACAoB,cAAc,CAACC;QACb,IAAIA,iBAAiBjB,gCAAgC;YACnD,MAAM,IAAIH,YAAYoB,MAAMC,OAAO,EAAE,wBAAwB;gBAACC,QAAQ;YAAG;QAC3E;QACA,IAAIF,iBAAiBhB,0BAA0B;YAC7C,MAAM,IAAIJ,YAAY,iBAAiB,aAAa;gBAACsB,QAAQ;YAAG;QAClE;QACA,MAAMF;IACR;IACAG,SAAS,OAAOC;QACd,MAAM,EAACT,EAAE,EAAC,GAAGS,QAAQX,MAAM;QAC3B,MAAMY,MAAM,MAAMlB,qBAAqB;YAACiB;YAAST;QAAE;QAEnD,MAAMW,YAAY,MAAMrB,kBAAkB;YAACsB,eAAeF,IAAIV,EAAE;QAAA;QAChE,OAAOT,SAASoB;IAClB;AACF,GAAG"}

package/dist/presentation/routes/checkout-token.d.ts

@@ -0,0 +1,2 @@
+export declare const checkoutTokenRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=checkout-token.d.ts.map

package/dist/presentation/routes/checkout-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-token.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/checkout-token.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,kBAAkB,iDA8C7B,CAAC"}

package/dist/presentation/routes/checkout-token.js

@@ -0,0 +1,64 @@
+import { requireLeasedJobContext } from '@shipfox/api-auth-context';
+import { integrationRouteErrorHandler } from '@shipfox/api-integration-core';
+import { isJobLeaseActive } from '@shipfox/api-runners';
+import { checkoutTokenResponseSchema } from '@shipfox/api-workflows-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { createJobCheckoutSpec } from '#core/checkout.js';
+import { CheckoutIntentUnresolvedError, JobNotFoundError, WorkflowRunNotFoundError } from '#core/errors.js';
+import { sourceControl } from '#core/source-control.js';
+import { toCheckoutTokenDto } from '#presentation/dto/checkout-token.js';
+export const checkoutTokenRoute = defineRoute({
+    method: 'POST',
+    path: '/checkout-token',
+    description: "Exchanges the runner's job lease for short-lived, read-only checkout credentials for the job's repository. The job is identified by the access token, so no job ID is needed. The checkout target is resolved server-side from the job's run and project; no credential material is stored on the job or run. Returns the repository URL, ref, and (when the provider needs auth) a short-lived credential that expires soon.",
+    schema: {
+        response: {
+            200: checkoutTokenResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof JobNotFoundError) {
+            throw new ClientError(error.message, 'job-not-found', {
+                status: 404
+            });
+        }
+        if (error instanceof WorkflowRunNotFoundError) {
+            throw new ClientError(error.message, 'run-not-found', {
+                status: 404
+            });
+        }
+        if (error instanceof CheckoutIntentUnresolvedError) {
+            throw new ClientError(error.message, 'checkout-unavailable', {
+                status: 404
+            });
+        }
+        // Connection and provider errors (and the structural provider-error detection)
+        // map through the shared handler, which re-throws unknowns to the global handler.
+        return integrationRouteErrorHandler(error);
+    },
+    handler: async (request, reply)=>{
+        const leasedJob = requireLeasedJobContext(request);
+        const leaseIsActive = await isJobLeaseActive({
+            jobId: leasedJob.jobId,
+            jobExecutionId: leasedJob.jobExecutionId,
+            runnerSessionId: leasedJob.runnerSessionId
+        });
+        if (!leaseIsActive) {
+            throw new ClientError('Job lease is no longer active', 'lease-not-active', {
+                status: 404
+            });
+        }
+        const checkout = await createJobCheckoutSpec({
+            jobId: leasedJob.jobId,
+            sourceControl: sourceControl()
+        });
+        // The body carries short-lived git credentials; forbid any intermediary or
+        // client cache from retaining them.
+        reply.header('cache-control', 'no-store');
+        return toCheckoutTokenDto(checkout.spec, {
+            persist: checkout.persistCredentials
+        });
+    }
+});
+
+//# sourceMappingURL=checkout-token.js.map

package/dist/presentation/routes/checkout-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/checkout-token.ts"],"sourcesContent":["import {requireLeasedJobContext} from '@shipfox/api-auth-context';\nimport {integrationRouteErrorHandler} from '@shipfox/api-integration-core';\nimport {isJobLeaseActive} from '@shipfox/api-runners';\nimport {checkoutTokenResponseSchema} from '@shipfox/api-workflows-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {createJobCheckoutSpec} from '#core/checkout.js';\nimport {\n  CheckoutIntentUnresolvedError,\n  JobNotFoundError,\n  WorkflowRunNotFoundError,\n} from '#core/errors.js';\nimport {sourceControl} from '#core/source-control.js';\nimport {toCheckoutTokenDto} from '#presentation/dto/checkout-token.js';\n\nexport const checkoutTokenRoute = defineRoute({\n  method: 'POST',\n  path: '/checkout-token',\n  description:\n    \"Exchanges the runner's job lease for short-lived, read-only checkout credentials for the job's repository. The job is identified by the access token, so no job ID is needed. The checkout target is resolved server-side from the job's run and project; no credential material is stored on the job or run. Returns the repository URL, ref, and (when the provider needs auth) a short-lived credential that expires soon.\",\n  schema: {\n    response: {\n      200: checkoutTokenResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof JobNotFoundError) {\n      throw new ClientError(error.message, 'job-not-found', {status: 404});\n    }\n    if (error instanceof WorkflowRunNotFoundError) {\n      throw new ClientError(error.message, 'run-not-found', {status: 404});\n    }\n    if (error instanceof CheckoutIntentUnresolvedError) {\n      throw new ClientError(error.message, 'checkout-unavailable', {status: 404});\n    }\n    // Connection and provider errors (and the structural provider-error detection)\n    // map through the shared handler, which re-throws unknowns to the global handler.\n    return integrationRouteErrorHandler(error);\n  },\n  handler: async (request, reply) => {\n    const leasedJob = requireLeasedJobContext(request);\n\n    const leaseIsActive = await isJobLeaseActive({\n      jobId: leasedJob.jobId,\n      jobExecutionId: leasedJob.jobExecutionId,\n      runnerSessionId: leasedJob.runnerSessionId,\n    });\n    if (!leaseIsActive) {\n      throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});\n    }\n\n    const checkout = await createJobCheckoutSpec({\n      jobId: leasedJob.jobId,\n      sourceControl: sourceControl(),\n    });\n\n    // The body carries short-lived git credentials; forbid any intermediary or\n    // client cache from retaining them.\n    reply.header('cache-control', 'no-store');\n    return toCheckoutTokenDto(checkout.spec, {persist: checkout.persistCredentials});\n  },\n});\n"],"names":["requireLeasedJobContext","integrationRouteErrorHandler","isJobLeaseActive","checkoutTokenResponseSchema","ClientError","defineRoute","createJobCheckoutSpec","CheckoutIntentUnresolvedError","JobNotFoundError","WorkflowRunNotFoundError","sourceControl","toCheckoutTokenDto","checkoutTokenRoute","method","path","description","schema","response","errorHandler","error","message","status","handler","request","reply","leasedJob","leaseIsActive","jobId","jobExecutionId","runnerSessionId","checkout","header","spec","persist","persistCredentials"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,4BAA4B;AAClE,SAAQC,4BAA4B,QAAO,gCAAgC;AAC3E,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,2BAA2B,QAAO,6BAA6B;AACvE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,qBAAqB,QAAO,oBAAoB;AACxD,SACEC,6BAA6B,EAC7BC,gBAAgB,EAChBC,wBAAwB,QACnB,kBAAkB;AACzB,SAAQC,aAAa,QAAO,0BAA0B;AACtD,SAAQC,kBAAkB,QAAO,sCAAsC;AAEvE,OAAO,MAAMC,qBAAqBP,YAAY;IAC5CQ,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,UAAU;YACR,KAAKd;QACP;IACF;IACAe,cAAc,CAACC;QACb,IAAIA,iBAAiBX,kBAAkB;YACrC,MAAM,IAAIJ,YAAYe,MAAMC,OAAO,EAAE,iBAAiB;gBAACC,QAAQ;YAAG;QACpE;QACA,IAAIF,iBAAiBV,0BAA0B;YAC7C,MAAM,IAAIL,YAAYe,MAAMC,OAAO,EAAE,iBAAiB;gBAACC,QAAQ;YAAG;QACpE;QACA,IAAIF,iBAAiBZ,+BAA+B;YAClD,MAAM,IAAIH,YAAYe,MAAMC,OAAO,EAAE,wBAAwB;gBAACC,QAAQ;YAAG;QAC3E;QACA,+EAA+E;QAC/E,kFAAkF;QAClF,OAAOpB,6BAA6BkB;IACtC;IACAG,SAAS,OAAOC,SAASC;QACvB,MAAMC,YAAYzB,wBAAwBuB;QAE1C,MAAMG,gBAAgB,MAAMxB,iBAAiB;YAC3CyB,OAAOF,UAAUE,KAAK;YACtBC,gBAAgBH,UAAUG,cAAc;YACxCC,iBAAiBJ,UAAUI,eAAe;QAC5C;QACA,IAAI,CAACH,eAAe;YAClB,MAAM,IAAItB,YAAY,iCAAiC,oBAAoB;gBAACiB,QAAQ;YAAG;QACzF;QAEA,MAAMS,WAAW,MAAMxB,sBAAsB;YAC3CqB,OAAOF,UAAUE,KAAK;YACtBjB,eAAeA;QACjB;QAEA,2EAA2E;QAC3E,oCAAoC;QACpCc,MAAMO,MAAM,CAAC,iBAAiB;QAC9B,OAAOpB,mBAAmBmB,SAASE,IAAI,EAAE;YAACC,SAASH,SAASI,kBAAkB;QAAA;IAChF;AACF,GAAG"}

package/dist/presentation/routes/get-run-aggregates.d.ts

@@ -0,0 +1,2 @@
+export declare const getRunAggregatesRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=get-run-aggregates.d.ts.map

package/dist/presentation/routes/get-run-aggregates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-run-aggregates.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/get-run-aggregates.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,qBAAqB,iDA2DhC,CAAC"}

package/dist/presentation/routes/get-run-aggregates.js

@@ -0,0 +1,60 @@
+import { ProjectNotFoundError, requireProjectAccess } from '@shipfox/api-projects';
+import { workflowRunAggregatesQuerySchema, workflowRunAggregatesResponseSchema } from '@shipfox/api-workflows-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { logger } from '@shipfox/node-opentelemetry';
+import { getWorkflowRunAggregates } from '#db/index.js';
+export const getRunAggregatesRoute = defineRoute({
+    method: 'GET',
+    path: '/aggregates',
+    description: 'Get faceted workflow run counts for a project',
+    schema: {
+        querystring: workflowRunAggregatesQuerySchema,
+        response: {
+            200: workflowRunAggregatesResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof ProjectNotFoundError) {
+            throw new ClientError(error.message, 'project-not-found', {
+                status: 404
+            });
+        }
+        throw error;
+    },
+    handler: async (request)=>{
+        const startedAt = performance.now();
+        const { project_id: projectId, status, definition_id: definitionId, trigger_source: triggerSource, created_from: createdFrom, created_to: createdTo } = request.query;
+        const { project } = await requireProjectAccess({
+            request,
+            projectId
+        });
+        const filters = {
+            status,
+            definitionId,
+            triggerSource,
+            createdFrom: createdFrom ? new Date(createdFrom) : undefined,
+            createdTo: createdTo ? new Date(createdTo) : undefined
+        };
+        const aggregates = await getWorkflowRunAggregates({
+            projectId: project.id,
+            filters
+        });
+        logger().info({
+            projectId: project.id,
+            filterKeys: Object.entries(filters).filter(([, value])=>value !== undefined).map(([key])=>key),
+            aggregateBucketSizes: {
+                status: aggregates.status.length,
+                triggerSource: aggregates.triggerSource.length,
+                workflow: aggregates.workflow.length
+            },
+            durationMs: Math.round(performance.now() - startedAt)
+        }, 'Aggregated workflow runs');
+        return {
+            status: aggregates.status,
+            trigger_source: aggregates.triggerSource,
+            workflow: aggregates.workflow
+        };
+    }
+});
+
+//# sourceMappingURL=get-run-aggregates.js.map

package/dist/presentation/routes/get-run-aggregates.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/get-run-aggregates.ts"],"sourcesContent":["import {ProjectNotFoundError, requireProjectAccess} from '@shipfox/api-projects';\nimport {\n  workflowRunAggregatesQuerySchema,\n  workflowRunAggregatesResponseSchema,\n} from '@shipfox/api-workflows-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {getWorkflowRunAggregates} from '#db/index.js';\n\nexport const getRunAggregatesRoute = defineRoute({\n  method: 'GET',\n  path: '/aggregates',\n  description: 'Get faceted workflow run counts for a project',\n  schema: {\n    querystring: workflowRunAggregatesQuerySchema,\n    response: {\n      200: workflowRunAggregatesResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof ProjectNotFoundError) {\n      throw new ClientError(error.message, 'project-not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const startedAt = performance.now();\n    const {\n      project_id: projectId,\n      status,\n      definition_id: definitionId,\n      trigger_source: triggerSource,\n      created_from: createdFrom,\n      created_to: createdTo,\n    } = request.query;\n\n    const {project} = await requireProjectAccess({request, projectId});\n    const filters = {\n      status,\n      definitionId,\n      triggerSource,\n      createdFrom: createdFrom ? new Date(createdFrom) : undefined,\n      createdTo: createdTo ? new Date(createdTo) : undefined,\n    };\n    const aggregates = await getWorkflowRunAggregates({projectId: project.id, filters});\n\n    logger().info(\n      {\n        projectId: project.id,\n        filterKeys: Object.entries(filters)\n          .filter(([, value]) => value !== undefined)\n          .map(([key]) => key),\n        aggregateBucketSizes: {\n          status: aggregates.status.length,\n          triggerSource: aggregates.triggerSource.length,\n          workflow: aggregates.workflow.length,\n        },\n        durationMs: Math.round(performance.now() - startedAt),\n      },\n      'Aggregated workflow runs',\n    );\n\n    return {\n      status: aggregates.status,\n      trigger_source: aggregates.triggerSource,\n      workflow: aggregates.workflow,\n    };\n  },\n});\n"],"names":["ProjectNotFoundError","requireProjectAccess","workflowRunAggregatesQuerySchema","workflowRunAggregatesResponseSchema","ClientError","defineRoute","logger","getWorkflowRunAggregates","getRunAggregatesRoute","method","path","description","schema","querystring","response","errorHandler","error","message","status","handler","request","startedAt","performance","now","project_id","projectId","definition_id","definitionId","trigger_source","triggerSource","created_from","createdFrom","created_to","createdTo","query","project","filters","Date","undefined","aggregates","id","info","filterKeys","Object","entries","filter","value","map","key","aggregateBucketSizes","length","workflow","durationMs","Math","round"],"mappings":"AAAA,SAAQA,oBAAoB,EAAEC,oBAAoB,QAAO,wBAAwB;AACjF,SACEC,gCAAgC,EAChCC,mCAAmC,QAC9B,6BAA6B;AACpC,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,wBAAwB,QAAO,eAAe;AAEtD,OAAO,MAAMC,wBAAwBH,YAAY;IAC/CI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,aAAaX;QACbY,UAAU;YACR,KAAKX;QACP;IACF;IACAY,cAAc,CAACC;QACb,IAAIA,iBAAiBhB,sBAAsB;YACzC,MAAM,IAAII,YAAYY,MAAMC,OAAO,EAAE,qBAAqB;gBAACC,QAAQ;YAAG;QACxE;QACA,MAAMF;IACR;IACAG,SAAS,OAAOC;QACd,MAAMC,YAAYC,YAAYC,GAAG;QACjC,MAAM,EACJC,YAAYC,SAAS,EACrBP,MAAM,EACNQ,eAAeC,YAAY,EAC3BC,gBAAgBC,aAAa,EAC7BC,cAAcC,WAAW,EACzBC,YAAYC,SAAS,EACtB,GAAGb,QAAQc,KAAK;QAEjB,MAAM,EAACC,OAAO,EAAC,GAAG,MAAMlC,qBAAqB;YAACmB;YAASK;QAAS;QAChE,MAAMW,UAAU;YACdlB;YACAS;YACAE;YACAE,aAAaA,cAAc,IAAIM,KAAKN,eAAeO;YACnDL,WAAWA,YAAY,IAAII,KAAKJ,aAAaK;QAC/C;QACA,MAAMC,aAAa,MAAMhC,yBAAyB;YAACkB,WAAWU,QAAQK,EAAE;YAAEJ;QAAO;QAEjF9B,SAASmC,IAAI,CACX;YACEhB,WAAWU,QAAQK,EAAE;YACrBE,YAAYC,OAAOC,OAAO,CAACR,SACxBS,MAAM,CAAC,CAAC,GAAGC,MAAM,GAAKA,UAAUR,WAChCS,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;YAClBC,sBAAsB;gBACpB/B,QAAQqB,WAAWrB,MAAM,CAACgC,MAAM;gBAChCrB,eAAeU,WAAWV,aAAa,CAACqB,MAAM;gBAC9CC,UAAUZ,WAAWY,QAAQ,CAACD,MAAM;YACtC;YACAE,YAAYC,KAAKC,KAAK,CAAChC,YAAYC,GAAG,KAAKF;QAC7C,GACA;QAGF,OAAO;YACLH,QAAQqB,WAAWrB,MAAM;YACzBU,gBAAgBW,WAAWV,aAAa;YACxCsB,UAAUZ,WAAWY,QAAQ;QAC/B;IACF;AACF,GAAG"}

package/dist/presentation/routes/get-run.d.ts

@@ -0,0 +1,2 @@
+export declare const getRunRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=get-run.d.ts.map

package/dist/presentation/routes/get-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-run.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/get-run.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,WAAW,iDAmDtB,CAAC"}

package/dist/presentation/routes/get-run.js

@@ -0,0 +1,60 @@
+import { workflowRunDetailResponseSchema } from '@shipfox/api-workflows-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { getWorkflowRunDetail } from '#db/index.js';
+import { toJobDto, toJobExecutionDto, toRunAttemptDto, toRunDto, toStepAttemptDto, toStepDto } from '#presentation/dto/index.js';
+import { requireAccessibleRun } from './require-accessible-run.js';
+export const getRunRoute = defineRoute({
+    method: 'GET',
+    path: '/:id',
+    description: 'Get a workflow run by ID with jobs and steps',
+    schema: {
+        params: z.object({
+            id: z.string().uuid()
+        }),
+        querystring: z.object({
+            attempt: z.coerce.number().int().positive().optional()
+        }),
+        response: {
+            200: workflowRunDetailResponseSchema
+        }
+    },
+    handler: async (request)=>{
+        const { id } = request.params;
+        await requireAccessibleRun({
+            request,
+            id
+        });
+        const run = await getWorkflowRunDetail(id, request.query.attempt);
+        if (!run) {
+            throw new ClientError('Run not found', 'not-found', {
+                status: 404
+            });
+        }
+        const jobDtos = run.jobs.map((job)=>({
+                ...toJobDto(job),
+                job_executions: job.jobExecutions.map((jobExecution)=>({
+                        ...toJobExecutionDto(jobExecution),
+                        steps: jobExecution.steps.map((step)=>{
+                            const attempts = step.attempts.map(toStepAttemptDto);
+                            const latestTerminalAttempt = attempts.filter((attempt)=>attempt.status !== 'running').at(-1);
+                            return {
+                                ...toStepDto(step),
+                                exit_code: latestTerminalAttempt?.exit_code ?? null,
+                                outputs: latestTerminalAttempt?.outputs ?? null,
+                                response: latestTerminalAttempt?.response ?? null,
+                                gate_result: latestTerminalAttempt?.gate_result ?? null,
+                                attempts
+                            };
+                        })
+                    }))
+            }));
+        return {
+            ...toRunDto(run, run.latestAttempt),
+            run_attempt: toRunAttemptDto(run.runAttempt),
+            jobs: jobDtos
+        };
+    }
+});
+
+//# sourceMappingURL=get-run.js.map

package/dist/presentation/routes/get-run.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/get-run.ts"],"sourcesContent":["import {workflowRunDetailResponseSchema} from '@shipfox/api-workflows-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {getWorkflowRunDetail} from '#db/index.js';\nimport {\n  toJobDto,\n  toJobExecutionDto,\n  toRunAttemptDto,\n  toRunDto,\n  toStepAttemptDto,\n  toStepDto,\n} from '#presentation/dto/index.js';\nimport {requireAccessibleRun} from './require-accessible-run.js';\n\nexport const getRunRoute = defineRoute({\n  method: 'GET',\n  path: '/:id',\n  description: 'Get a workflow run by ID with jobs and steps',\n  schema: {\n    params: z.object({\n      id: z.string().uuid(),\n    }),\n    querystring: z.object({\n      attempt: z.coerce.number().int().positive().optional(),\n    }),\n    response: {\n      200: workflowRunDetailResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const {id} = request.params;\n    await requireAccessibleRun({request, id});\n\n    const run = await getWorkflowRunDetail(id, request.query.attempt);\n    if (!run) {\n      throw new ClientError('Run not found', 'not-found', {status: 404});\n    }\n\n    const jobDtos = run.jobs.map((job) => ({\n      ...toJobDto(job),\n      job_executions: job.jobExecutions.map((jobExecution) => ({\n        ...toJobExecutionDto(jobExecution),\n        steps: jobExecution.steps.map((step) => {\n          const attempts = step.attempts.map(toStepAttemptDto);\n          const latestTerminalAttempt = attempts\n            .filter((attempt) => attempt.status !== 'running')\n            .at(-1);\n          return {\n            ...toStepDto(step),\n            exit_code: latestTerminalAttempt?.exit_code ?? null,\n            outputs: latestTerminalAttempt?.outputs ?? null,\n            response: latestTerminalAttempt?.response ?? null,\n            gate_result: latestTerminalAttempt?.gate_result ?? null,\n            attempts,\n          };\n        }),\n      })),\n    }));\n\n    return {\n      ...toRunDto(run, run.latestAttempt),\n      run_attempt: toRunAttemptDto(run.runAttempt),\n      jobs: jobDtos,\n    };\n  },\n});\n"],"names":["workflowRunDetailResponseSchema","ClientError","defineRoute","z","getWorkflowRunDetail","toJobDto","toJobExecutionDto","toRunAttemptDto","toRunDto","toStepAttemptDto","toStepDto","requireAccessibleRun","getRunRoute","method","path","description","schema","params","object","id","string","uuid","querystring","attempt","coerce","number","int","positive","optional","response","handler","request","run","query","status","jobDtos","jobs","map","job","job_executions","jobExecutions","jobExecution","steps","step","attempts","latestTerminalAttempt","filter","at","exit_code","outputs","gate_result","latestAttempt","run_attempt","runAttempt"],"mappings":"AAAA,SAAQA,+BAA+B,QAAO,6BAA6B;AAC3E,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,oBAAoB,QAAO,eAAe;AAClD,SACEC,QAAQ,EACRC,iBAAiB,EACjBC,eAAe,EACfC,QAAQ,EACRC,gBAAgB,EAChBC,SAAS,QACJ,6BAA6B;AACpC,SAAQC,oBAAoB,QAAO,8BAA8B;AAEjE,OAAO,MAAMC,cAAcV,YAAY;IACrCW,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,QAAQd,EAAEe,MAAM,CAAC;YACfC,IAAIhB,EAAEiB,MAAM,GAAGC,IAAI;QACrB;QACAC,aAAanB,EAAEe,MAAM,CAAC;YACpBK,SAASpB,EAAEqB,MAAM,CAACC,MAAM,GAAGC,GAAG,GAAGC,QAAQ,GAAGC,QAAQ;QACtD;QACAC,UAAU;YACR,KAAK7B;QACP;IACF;IACA8B,SAAS,OAAOC;QACd,MAAM,EAACZ,EAAE,EAAC,GAAGY,QAAQd,MAAM;QAC3B,MAAMN,qBAAqB;YAACoB;YAASZ;QAAE;QAEvC,MAAMa,MAAM,MAAM5B,qBAAqBe,IAAIY,QAAQE,KAAK,CAACV,OAAO;QAChE,IAAI,CAACS,KAAK;YACR,MAAM,IAAI/B,YAAY,iBAAiB,aAAa;gBAACiC,QAAQ;YAAG;QAClE;QAEA,MAAMC,UAAUH,IAAII,IAAI,CAACC,GAAG,CAAC,CAACC,MAAS,CAAA;gBACrC,GAAGjC,SAASiC,IAAI;gBAChBC,gBAAgBD,IAAIE,aAAa,CAACH,GAAG,CAAC,CAACI,eAAkB,CAAA;wBACvD,GAAGnC,kBAAkBmC,aAAa;wBAClCC,OAAOD,aAAaC,KAAK,CAACL,GAAG,CAAC,CAACM;4BAC7B,MAAMC,WAAWD,KAAKC,QAAQ,CAACP,GAAG,CAAC5B;4BACnC,MAAMoC,wBAAwBD,SAC3BE,MAAM,CAAC,CAACvB,UAAYA,QAAQW,MAAM,KAAK,WACvCa,EAAE,CAAC,CAAC;4BACP,OAAO;gCACL,GAAGrC,UAAUiC,KAAK;gCAClBK,WAAWH,uBAAuBG,aAAa;gCAC/CC,SAASJ,uBAAuBI,WAAW;gCAC3CpB,UAAUgB,uBAAuBhB,YAAY;gCAC7CqB,aAAaL,uBAAuBK,eAAe;gCACnDN;4BACF;wBACF;oBACF,CAAA;YACF,CAAA;QAEA,OAAO;YACL,GAAGpC,SAASwB,KAAKA,IAAImB,aAAa,CAAC;YACnCC,aAAa7C,gBAAgByB,IAAIqB,UAAU;YAC3CjB,MAAMD;QACR;IACF;AACF,GAAG"}

package/dist/presentation/routes/get-step-secrets.d.ts

@@ -0,0 +1,2 @@
+export declare const getStepSecretsRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=get-step-secrets.d.ts.map

package/dist/presentation/routes/get-step-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-step-secrets.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/get-step-secrets.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,mBAAmB,iDAiE9B,CAAC"}

package/dist/presentation/routes/get-step-secrets.js

@@ -0,0 +1,115 @@
+import { getSecret, SecretDecryptionError } from '@shipfox/api-secrets';
+import { materializedSecretBindingSchema, stepSecretsParamsSchema, stepSecretsQuerySchema, stepSecretsResponseSchema } from '@shipfox/api-secrets-dto';
+import { captureException } from '@shipfox/node-error-monitoring';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { logger } from '@shipfox/node-opentelemetry';
+import { ZodError, z } from 'zod';
+import { loadRunningLeasedStep } from './leased-step.js';
+const secretBindingsSchema = z.array(materializedSecretBindingSchema);
+export const getStepSecretsRoute = defineRoute({
+    method: 'GET',
+    path: '/steps/:stepId/secrets',
+    description: "Returns decrypted secret values referenced by the runner's currently leased running run step. The job scope and secret bindings are re-derived from server state; the runner supplies only the step id and current attempt.",
+    schema: {
+        params: stepSecretsParamsSchema,
+        querystring: stepSecretsQuerySchema,
+        response: {
+            200: stepSecretsResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof SecretDecryptionError) {
+            captureException(error);
+            throw new ClientError('Step secret could not be decrypted', 'secret-value-invalid', {
+                status: 409,
+                cause: error
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const { stepId } = request.params;
+        const { attempt } = request.query;
+        const { leasedJob, step, workspaceId, projectId } = await loadRunningLeasedStep({
+            request,
+            stepId,
+            attempt
+        });
+        if (step.type !== 'run') {
+            throw new ClientError('Step is not a run step', 'step-not-run', {
+                status: 409
+            });
+        }
+        const secretBindings = parseSecretBindings(step.config.secret_bindings);
+        const references = distinctSecretReferences(secretBindings);
+        const secrets = await Promise.all(references.map(async (reference)=>{
+            const value = await getSecret({
+                workspaceId,
+                projectId,
+                namespace: '',
+                key: reference.key,
+                store: reference.store
+            });
+            if (value === null) {
+                throw new ClientError('Secret not found', 'secret-not-found', {
+                    status: 422
+                });
+            }
+            return {
+                ...reference,
+                value
+            };
+        }));
+        logger().info({
+            jobId: leasedJob.jobId,
+            workspaceId,
+            stepId,
+            keyCount: references.length
+        }, 'Resolved step secrets');
+        logger().debug({
+            jobId: leasedJob.jobId,
+            workspaceId,
+            stepId,
+            keys: references.map((ref)=>ref.key)
+        }, 'Resolved step secret keys');
+        reply.header('cache-control', 'no-store');
+        return {
+            secrets
+        };
+    }
+});
+function parseSecretBindings(value) {
+    try {
+        return secretBindingsSchema.parse(value ?? []);
+    } catch (error) {
+        if (error instanceof ZodError) {
+            throw new ClientError('Step secret bindings are invalid', 'secret-bindings-invalid', {
+                status: 409,
+                cause: error
+            });
+        }
+        throw error;
+    }
+}
+function distinctSecretReferences(bindings) {
+    const seen = new Set();
+    const references = [];
+    for (const binding of bindings){
+        for (const segment of binding.segments){
+            if (segment.kind !== 'secret') continue;
+            const id = secretReferenceId(segment);
+            if (seen.has(id)) continue;
+            seen.add(id);
+            references.push({
+                store: segment.store,
+                key: segment.key
+            });
+        }
+    }
+    return references;
+}
+function secretReferenceId(reference) {
+    return `${reference.store}\0${reference.key}`;
+}
+
+//# sourceMappingURL=get-step-secrets.js.map

package/dist/presentation/routes/get-step-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/get-step-secrets.ts"],"sourcesContent":["import {getSecret, SecretDecryptionError} from '@shipfox/api-secrets';\nimport {\n  materializedSecretBindingSchema,\n  type StepSecretDto,\n  stepSecretsParamsSchema,\n  stepSecretsQuerySchema,\n  stepSecretsResponseSchema,\n} from '@shipfox/api-secrets-dto';\nimport {captureException} from '@shipfox/node-error-monitoring';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {ZodError, z} from 'zod';\nimport {loadRunningLeasedStep} from './leased-step.js';\n\nconst secretBindingsSchema = z.array(materializedSecretBindingSchema);\n\nexport const getStepSecretsRoute = defineRoute({\n  method: 'GET',\n  path: '/steps/:stepId/secrets',\n  description:\n    \"Returns decrypted secret values referenced by the runner's currently leased running run step. The job scope and secret bindings are re-derived from server state; the runner supplies only the step id and current attempt.\",\n  schema: {\n    params: stepSecretsParamsSchema,\n    querystring: stepSecretsQuerySchema,\n    response: {\n      200: stepSecretsResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof SecretDecryptionError) {\n      captureException(error);\n      throw new ClientError('Step secret could not be decrypted', 'secret-value-invalid', {\n        status: 409,\n        cause: error,\n      });\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const {stepId} = request.params;\n    const {attempt} = request.query;\n    const {leasedJob, step, workspaceId, projectId} = await loadRunningLeasedStep({\n      request,\n      stepId,\n      attempt,\n    });\n\n    if (step.type !== 'run') {\n      throw new ClientError('Step is not a run step', 'step-not-run', {status: 409});\n    }\n\n    const secretBindings = parseSecretBindings(step.config.secret_bindings);\n    const references = distinctSecretReferences(secretBindings);\n    const secrets = await Promise.all(\n      references.map(async (reference): Promise<StepSecretDto> => {\n        const value = await getSecret({\n          workspaceId,\n          projectId,\n          namespace: '',\n          key: reference.key,\n          store: reference.store,\n        });\n        if (value === null) {\n          throw new ClientError('Secret not found', 'secret-not-found', {status: 422});\n        }\n        return {...reference, value};\n      }),\n    );\n\n    logger().info(\n      {jobId: leasedJob.jobId, workspaceId, stepId, keyCount: references.length},\n      'Resolved step secrets',\n    );\n    logger().debug(\n      {jobId: leasedJob.jobId, workspaceId, stepId, keys: references.map((ref) => ref.key)},\n      'Resolved step secret keys',\n    );\n\n    reply.header('cache-control', 'no-store');\n    return {secrets};\n  },\n});\n\nfunction parseSecretBindings(value: unknown): z.infer<typeof secretBindingsSchema> {\n  try {\n    return secretBindingsSchema.parse(value ?? []);\n  } catch (error) {\n    if (error instanceof ZodError) {\n      throw new ClientError('Step secret bindings are invalid', 'secret-bindings-invalid', {\n        status: 409,\n        cause: error,\n      });\n    }\n    throw error;\n  }\n}\n\nfunction distinctSecretReferences(\n  bindings: ReadonlyArray<z.infer<typeof materializedSecretBindingSchema>>,\n): Array<Pick<StepSecretDto, 'store' | 'key'>> {\n  const seen = new Set<string>();\n  const references: Array<Pick<StepSecretDto, 'store' | 'key'>> = [];\n  for (const binding of bindings) {\n    for (const segment of binding.segments) {\n      if (segment.kind !== 'secret') continue;\n      const id = secretReferenceId(segment);\n      if (seen.has(id)) continue;\n      seen.add(id);\n      references.push({store: segment.store, key: segment.key});\n    }\n  }\n  return references;\n}\n\nfunction secretReferenceId(reference: Pick<StepSecretDto, 'store' | 'key'>): string {\n  return `${reference.store}\\0${reference.key}`;\n}\n"],"names":["getSecret","SecretDecryptionError","materializedSecretBindingSchema","stepSecretsParamsSchema","stepSecretsQuerySchema","stepSecretsResponseSchema","captureException","ClientError","defineRoute","logger","ZodError","z","loadRunningLeasedStep","secretBindingsSchema","array","getStepSecretsRoute","method","path","description","schema","params","querystring","response","errorHandler","error","status","cause","handler","request","reply","stepId","attempt","query","leasedJob","step","workspaceId","projectId","type","secretBindings","parseSecretBindings","config","secret_bindings","references","distinctSecretReferences","secrets","Promise","all","map","reference","value","namespace","key","store","info","jobId","keyCount","length","debug","keys","ref","header","parse","bindings","seen","Set","binding","segment","segments","kind","id","secretReferenceId","has","add","push"],"mappings":"AAAA,SAAQA,SAAS,EAAEC,qBAAqB,QAAO,uBAAuB;AACtE,SACEC,+BAA+B,EAE/BC,uBAAuB,EACvBC,sBAAsB,EACtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,QAAQ,EAAEC,CAAC,QAAO,MAAM;AAChC,SAAQC,qBAAqB,QAAO,mBAAmB;AAEvD,MAAMC,uBAAuBF,EAAEG,KAAK,CAACZ;AAErC,OAAO,MAAMa,sBAAsBP,YAAY;IAC7CQ,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,QAAQjB;QACRkB,aAAajB;QACbkB,UAAU;YACR,KAAKjB;QACP;IACF;IACAkB,cAAc,CAACC;QACb,IAAIA,iBAAiBvB,uBAAuB;YAC1CK,iBAAiBkB;YACjB,MAAM,IAAIjB,YAAY,sCAAsC,wBAAwB;gBAClFkB,QAAQ;gBACRC,OAAOF;YACT;QACF;QACA,MAAMA;IACR;IACAG,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,MAAM,EAAC,GAAGF,QAAQR,MAAM;QAC/B,MAAM,EAACW,OAAO,EAAC,GAAGH,QAAQI,KAAK;QAC/B,MAAM,EAACC,SAAS,EAAEC,IAAI,EAAEC,WAAW,EAAEC,SAAS,EAAC,GAAG,MAAMxB,sBAAsB;YAC5EgB;YACAE;YACAC;QACF;QAEA,IAAIG,KAAKG,IAAI,KAAK,OAAO;YACvB,MAAM,IAAI9B,YAAY,0BAA0B,gBAAgB;gBAACkB,QAAQ;YAAG;QAC9E;QAEA,MAAMa,iBAAiBC,oBAAoBL,KAAKM,MAAM,CAACC,eAAe;QACtE,MAAMC,aAAaC,yBAAyBL;QAC5C,MAAMM,UAAU,MAAMC,QAAQC,GAAG,CAC/BJ,WAAWK,GAAG,CAAC,OAAOC;YACpB,MAAMC,QAAQ,MAAMjD,UAAU;gBAC5BmC;gBACAC;gBACAc,WAAW;gBACXC,KAAKH,UAAUG,GAAG;gBAClBC,OAAOJ,UAAUI,KAAK;YACxB;YACA,IAAIH,UAAU,MAAM;gBAClB,MAAM,IAAI1C,YAAY,oBAAoB,oBAAoB;oBAACkB,QAAQ;gBAAG;YAC5E;YACA,OAAO;gBAAC,GAAGuB,SAAS;gBAAEC;YAAK;QAC7B;QAGFxC,SAAS4C,IAAI,CACX;YAACC,OAAOrB,UAAUqB,KAAK;YAAEnB;YAAaL;YAAQyB,UAAUb,WAAWc,MAAM;QAAA,GACzE;QAEF/C,SAASgD,KAAK,CACZ;YAACH,OAAOrB,UAAUqB,KAAK;YAAEnB;YAAaL;YAAQ4B,MAAMhB,WAAWK,GAAG,CAAC,CAACY,MAAQA,IAAIR,GAAG;QAAC,GACpF;QAGFtB,MAAM+B,MAAM,CAAC,iBAAiB;QAC9B,OAAO;YAAChB;QAAO;IACjB;AACF,GAAG;AAEH,SAASL,oBAAoBU,KAAc;IACzC,IAAI;QACF,OAAOpC,qBAAqBgD,KAAK,CAACZ,SAAS,EAAE;IAC/C,EAAE,OAAOzB,OAAO;QACd,IAAIA,iBAAiBd,UAAU;YAC7B,MAAM,IAAIH,YAAY,oCAAoC,2BAA2B;gBACnFkB,QAAQ;gBACRC,OAAOF;YACT;QACF;QACA,MAAMA;IACR;AACF;AAEA,SAASmB,yBACPmB,QAAwE;IAExE,MAAMC,OAAO,IAAIC;IACjB,MAAMtB,aAA0D,EAAE;IAClE,KAAK,MAAMuB,WAAWH,SAAU;QAC9B,KAAK,MAAMI,WAAWD,QAAQE,QAAQ,CAAE;YACtC,IAAID,QAAQE,IAAI,KAAK,UAAU;YAC/B,MAAMC,KAAKC,kBAAkBJ;YAC7B,IAAIH,KAAKQ,GAAG,CAACF,KAAK;YAClBN,KAAKS,GAAG,CAACH;YACT3B,WAAW+B,IAAI,CAAC;gBAACrB,OAAOc,QAAQd,KAAK;gBAAED,KAAKe,QAAQf,GAAG;YAAA;QACzD;IACF;IACA,OAAOT;AACT;AAEA,SAAS4B,kBAAkBtB,SAA+C;IACxE,OAAO,GAAGA,UAAUI,KAAK,CAAC,EAAE,EAAEJ,UAAUG,GAAG,EAAE;AAC/C"}

package/dist/presentation/routes/index.d.ts

@@ -0,0 +1,4 @@
+import type { RouteGroup } from '@shipfox/node-fastify';
+export declare const leaseTokenRouteGroup: RouteGroup;
+export declare const workflowRoutes: RouteGroup[];
+//# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAatD,eAAO,MAAM,oBAAoB,EAAE,UAWlC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAAU,EActC,CAAC"}

package/dist/presentation/routes/index.js

@@ -0,0 +1,41 @@
+import { AUTH_LEASED_JOB, AUTH_USER } from '@shipfox/api-auth-context';
+import { agentRuntimeConfigRoute } from './agent-runtime-config.js';
+import { cancelRunRoute } from './cancel-run.js';
+import { checkoutTokenRoute } from './checkout-token.js';
+import { getRunRoute } from './get-run.js';
+import { getRunAggregatesRoute } from './get-run-aggregates.js';
+import { getStepSecretsRoute } from './get-step-secrets.js';
+import { listRunAttemptsRoute } from './list-run-attempts.js';
+import { listRunsRoute } from './list-runs.js';
+import { nextStepRoute } from './next-step.js';
+import { reportStepRoute } from './report-step.js';
+import { rerunRunRoute } from './rerun-run.js';
+export const leaseTokenRouteGroup = {
+    // The lease token names the job, so the path carries no job id ("current").
+    prefix: '/runs/jobs/current',
+    auth: AUTH_LEASED_JOB,
+    routes: [
+        nextStepRoute,
+        reportStepRoute,
+        checkoutTokenRoute,
+        agentRuntimeConfigRoute,
+        getStepSecretsRoute
+    ]
+};
+export const workflowRoutes = [
+    {
+        prefix: '/workflows/runs',
+        auth: AUTH_USER,
+        routes: [
+            listRunsRoute,
+            getRunAggregatesRoute,
+            listRunAttemptsRoute,
+            getRunRoute,
+            cancelRunRoute,
+            rerunRunRoute
+        ]
+    },
+    leaseTokenRouteGroup
+];
+
+//# sourceMappingURL=index.js.map

package/dist/presentation/routes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import {AUTH_LEASED_JOB, AUTH_USER} from '@shipfox/api-auth-context';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {agentRuntimeConfigRoute} from './agent-runtime-config.js';\nimport {cancelRunRoute} from './cancel-run.js';\nimport {checkoutTokenRoute} from './checkout-token.js';\nimport {getRunRoute} from './get-run.js';\nimport {getRunAggregatesRoute} from './get-run-aggregates.js';\nimport {getStepSecretsRoute} from './get-step-secrets.js';\nimport {listRunAttemptsRoute} from './list-run-attempts.js';\nimport {listRunsRoute} from './list-runs.js';\nimport {nextStepRoute} from './next-step.js';\nimport {reportStepRoute} from './report-step.js';\nimport {rerunRunRoute} from './rerun-run.js';\n\nexport const leaseTokenRouteGroup: RouteGroup = {\n  // The lease token names the job, so the path carries no job id (\"current\").\n  prefix: '/runs/jobs/current',\n  auth: AUTH_LEASED_JOB,\n  routes: [\n    nextStepRoute,\n    reportStepRoute,\n    checkoutTokenRoute,\n    agentRuntimeConfigRoute,\n    getStepSecretsRoute,\n  ],\n};\n\nexport const workflowRoutes: RouteGroup[] = [\n  {\n    prefix: '/workflows/runs',\n    auth: AUTH_USER,\n    routes: [\n      listRunsRoute,\n      getRunAggregatesRoute,\n      listRunAttemptsRoute,\n      getRunRoute,\n      cancelRunRoute,\n      rerunRunRoute,\n    ],\n  },\n  leaseTokenRouteGroup,\n];\n"],"names":["AUTH_LEASED_JOB","AUTH_USER","agentRuntimeConfigRoute","cancelRunRoute","checkoutTokenRoute","getRunRoute","getRunAggregatesRoute","getStepSecretsRoute","listRunAttemptsRoute","listRunsRoute","nextStepRoute","reportStepRoute","rerunRunRoute","leaseTokenRouteGroup","prefix","auth","routes","workflowRoutes"],"mappings":"AAAA,SAAQA,eAAe,EAAEC,SAAS,QAAO,4BAA4B;AAErE,SAAQC,uBAAuB,QAAO,4BAA4B;AAClE,SAAQC,cAAc,QAAO,kBAAkB;AAC/C,SAAQC,kBAAkB,QAAO,sBAAsB;AACvD,SAAQC,WAAW,QAAO,eAAe;AACzC,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SAAQC,mBAAmB,QAAO,wBAAwB;AAC1D,SAAQC,oBAAoB,QAAO,yBAAyB;AAC5D,SAAQC,aAAa,QAAO,iBAAiB;AAC7C,SAAQC,aAAa,QAAO,iBAAiB;AAC7C,SAAQC,eAAe,QAAO,mBAAmB;AACjD,SAAQC,aAAa,QAAO,iBAAiB;AAE7C,OAAO,MAAMC,uBAAmC;IAC9C,4EAA4E;IAC5EC,QAAQ;IACRC,MAAMf;IACNgB,QAAQ;QACNN;QACAC;QACAP;QACAF;QACAK;KACD;AACH,EAAE;AAEF,OAAO,MAAMU,iBAA+B;IAC1C;QACEH,QAAQ;QACRC,MAAMd;QACNe,QAAQ;YACNP;YACAH;YACAE;YACAH;YACAF;YACAS;SACD;IACH;IACAC;CACD,CAAC"}

package/dist/presentation/routes/leased-step.d.ts

@@ -0,0 +1,14 @@
+import { type LeasedJobContext } from '@shipfox/api-auth-context';
+import type { Step } from '#core/entities/step.js';
+export interface LoadedRunningLeasedStep {
+    leasedJob: LeasedJobContext;
+    step: Step;
+    workspaceId: string;
+    projectId: string;
+}
+export declare function loadRunningLeasedStep(params: {
+    request: object;
+    stepId: string;
+    attempt: number;
+}): Promise<LoadedRunningLeasedStep>;
+//# sourceMappingURL=leased-step.d.ts.map

package/dist/presentation/routes/leased-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leased-step.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/leased-step.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,gBAAgB,EAA0B,MAAM,2BAA2B,CAAC;AAGzF,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAGjD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoCnC"}