@shipfox/api-workflows 4.0.0 → 6.0.0

package/src/presentation/routes/agent-runtime-config.ts

@@ -1,81 +1,106 @@
-import {ModelProviderConfigNotFoundError} from '@shipfox/api-agent/core/errors';
-import {resolveRuntimeCredentials} from '@shipfox/api-agent/core/resolve-runtime-credentials';
 import {
   agentRuntimeCredentialsResponseSchema,
   type MaterializedAgentStepConfigDto,
   materializedAgentStepConfigSchema,
 } from '@shipfox/api-agent-dto';
-import {SecretDecryptionError} from '@shipfox/api-secrets';
+import {
+  type AgentInterModuleClient,
+  agentInterModuleContract,
+} from '@shipfox/api-agent-dto/inter-module';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {agentRuntimeConfigQuerySchema} from '@shipfox/api-workflows-dto';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {captureException} from '@shipfox/node-error-monitoring';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {ZodError} from 'zod';
 import {loadRunningLeasedStep} from './leased-step.js';
 
-export const agentRuntimeConfigRoute = defineRoute({
-  method: 'GET',
-  path: '/agent-runtime-config',
-  description:
-    "Returns the resolved harness, provider, model, thinking effort, and decrypted provider credential bundle for the runner's currently leased running agent step. The job is identified by the lease token and the step is bound to that job before credentials are returned.",
-  schema: {
-    querystring: agentRuntimeConfigQuerySchema,
-    response: {
-      200: agentRuntimeCredentialsResponseSchema,
+export function createAgentRuntimeConfigRoute(params: {
+  agent: AgentInterModuleClient;
+  runners: RunnersInterModuleClient;
+}) {
+  return defineRoute({
+    method: 'GET',
+    path: '/agent-runtime-config',
+    description:
+      "Returns the resolved harness, provider, model, thinking effort, and decrypted provider credential bundle for the runner's currently leased running agent step. The job is identified by the lease token and the step is bound to that job before credentials are returned.",
+    schema: {
+      querystring: agentRuntimeConfigQuerySchema,
+      response: {
+        200: agentRuntimeCredentialsResponseSchema,
+      },
+    },
+    errorHandler: (error) => {
+      if (
+        isInterModuleKnownError(
+          agentInterModuleContract.methods.resolveRuntimeCredentials,
+          error,
+        ) &&
+        error.code === 'model-provider-credentials-invalid'
+      ) {
+        captureException(error);
+        throw new ClientError(
+          'Model provider credentials could not be decrypted',
+          'model-provider-credentials-invalid',
+          {
+            status: 409,
+            cause: error,
+          },
+        );
+      }
+      if (
+        isInterModuleKnownError(
+          agentInterModuleContract.methods.resolveRuntimeCredentials,
+          error,
+        ) &&
+        error.code === 'model-provider-not-configured'
+      ) {
+        throw new ClientError(
+          'Model provider credentials are not configured',
+          'model-provider-not-configured',
+          {
+            status: 409,
+          },
+        );
+      }
+      throw error;
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof SecretDecryptionError) {
-      captureException(error);
-      throw new ClientError(
-        'Model provider credentials could not be decrypted',
-        'model-provider-credentials-invalid',
-        {
-          status: 409,
-          cause: error,
-        },
-      );
-    }
-    if (error instanceof ModelProviderConfigNotFoundError) {
-      throw new ClientError(
-        'Model provider credentials are not configured',
-        'model-provider-not-configured',
-        {
-          status: 409,
-        },
-      );
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {step_id: stepId, attempt} = request.query;
-    const {step, workspaceId} = await loadRunningLeasedStep({request, stepId, attempt});
+    handler: async (request, reply) => {
+      const {step_id: stepId, attempt} = request.query;
+      const {step, workspaceId} = await loadRunningLeasedStep({
+        runners: params.runners,
+        request,
+        stepId,
+        attempt,
+      });
 
-    if (step.type !== 'agent') {
-      throw new ClientError('Step is not an agent step', 'step-not-agent', {status: 409});
-    }
+      if (step.type !== 'agent') {
+        throw new ClientError('Step is not an agent step', 'step-not-agent', {status: 409});
+      }
 
-    let agentConfig: MaterializedAgentStepConfigDto;
-    try {
-      agentConfig = materializedAgentStepConfigSchema.parse(step.config);
-    } catch (error) {
-      if (error instanceof ZodError) {
-        throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
-          status: 409,
-          cause: error,
-        });
+      let agentConfig: MaterializedAgentStepConfigDto;
+      try {
+        agentConfig = materializedAgentStepConfigSchema.parse(step.config);
+      } catch (error) {
+        if (error instanceof ZodError) {
+          throw new ClientError('Agent step config is invalid', 'agent-step-config-invalid', {
+            status: 409,
+            cause: error,
+          });
+        }
+        throw error;
       }
-      throw error;
-    }
 
-    const runtimeConfig = await resolveRuntimeCredentials({
-      workspaceId,
-      harness: agentConfig.harness,
-      provider: agentConfig.provider,
-      model: agentConfig.model,
-      thinking: agentConfig.thinking,
-    });
+      const runtimeConfig = await params.agent.resolveRuntimeCredentials({
+        workspaceId,
+        harness: agentConfig.harness,
+        provider: agentConfig.provider,
+        model: agentConfig.model,
+        thinking: agentConfig.thinking,
+      });
 
-    reply.header('cache-control', 'no-store');
-    return runtimeConfig;
-  },
-});
+      reply.header('cache-control', 'no-store');
+      return runtimeConfig;
+    },
+  });
+}

package/src/presentation/routes/cancel-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import {requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
@@ -12,16 +12,11 @@ import {cancelRunRoute} from './cancel-run.js';
 
 const projectAccessState = vi.hoisted(() => ({workspaceId: ''}));
 
-vi.mock('@shipfox/api-projects', () => ({
-  requireProjectAccess: vi.fn(({projectId}) =>
-    Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
-    }),
-  ),
-}));
-
-const mockRequireProjectAccess = vi.mocked(requireProjectAccess);
+const getProjectById = vi.fn();
+const projects = {
+  getProjectById,
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('POST /api/workflows/runs/:id/cancel', () => {
   let app: FastifyInstance;
@@ -44,7 +39,7 @@ describe('POST /api/workflows/runs/:id/cancel', () => {
       );
       done();
     });
-    app.post('/api/workflows/runs/:id/cancel', cancelRunRoute);
+    app.post('/api/workflows/runs/:id/cancel', cancelRunRoute(projects));
     await app.ready();
   });
 
@@ -53,7 +48,7 @@ describe('POST /api/workflows/runs/:id/cancel', () => {
     projectId = crypto.randomUUID();
     definitionId = crypto.randomUUID();
     projectAccessState.workspaceId = workspaceId;
-    mockRequireProjectAccess.mockImplementation(({projectId: requestedProjectId}) =>
+    getProjectById.mockImplementation(({projectId: requestedProjectId}) =>
       Promise.resolve({
         project: {
           id: requestedProjectId,
@@ -61,10 +56,7 @@ describe('POST /api/workflows/runs/:id/cancel', () => {
           sourceConnectionId: crypto.randomUUID(),
           sourceExternalRepositoryId: `repo:${crypto.randomUUID()}`,
           name: 'Project',
-          createdAt: new Date(),
-          updatedAt: new Date(),
         },
-        workspaceId,
       }),
     );
   });
@@ -97,7 +89,7 @@ describe('POST /api/workflows/runs/:id/cancel', () => {
 
   test('maps a run disappearing during cancellation to 404', () => {
     let mapped: unknown;
-    const errorHandler = cancelRunRoute.errorHandler as (error: Error) => void;
+    const errorHandler = cancelRunRoute(projects).errorHandler as (error: Error) => void;
 
     try {
       errorHandler(new WorkflowRunNotFoundError(crypto.randomUUID()));
@@ -111,9 +103,7 @@ describe('POST /api/workflows/runs/:id/cancel', () => {
 
   test('returns 404 when project access is denied', async () => {
     const run = await createRun();
-    mockRequireProjectAccess.mockRejectedValueOnce(
-      new ClientError('Forbidden', 'forbidden', {status: 403}),
-    );
+    getProjectById.mockRejectedValueOnce(new ClientError('Forbidden', 'forbidden', {status: 403}));
 
     const res = await app.inject({
       method: 'POST',

package/src/presentation/routes/cancel-run.ts

@@ -1,3 +1,4 @@
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {workflowRunDtoSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -6,32 +7,34 @@ import {cancelWorkflowRun} from '#db/index.js';
 import {toRunDto} from '#presentation/dto/index.js';
 import {requireAccessibleRun} from './require-accessible-run.js';
 
-export const cancelRunRoute = defineRoute({
-  method: 'POST',
-  path: '/:id/cancel',
-  description: 'Cancel an in-progress workflow run',
-  schema: {
-    params: z.object({
-      id: z.string().uuid(),
-    }),
-    response: {
-      200: workflowRunDtoSchema,
+export function cancelRunRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/:id/cancel',
+    description: 'Cancel an in-progress workflow run',
+    schema: {
+      params: z.object({
+        id: z.string().uuid(),
+      }),
+      response: {
+        200: workflowRunDtoSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof WorkflowRunNotCancellableError) {
-      throw new ClientError(error.message, 'run-already-finished', {status: 409});
-    }
-    if (error instanceof WorkflowRunNotFoundError) {
-      throw new ClientError('Run not found', 'not-found', {status: 404});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const {id} = request.params;
-    const run = await requireAccessibleRun({request, id});
+    errorHandler: (error) => {
+      if (error instanceof WorkflowRunNotCancellableError) {
+        throw new ClientError(error.message, 'run-already-finished', {status: 409});
+      }
+      if (error instanceof WorkflowRunNotFoundError) {
+        throw new ClientError('Run not found', 'not-found', {status: 404});
+      }
+      throw error;
+    },
+    handler: async (request) => {
+      const {id} = request.params;
+      const run = await requireAccessibleRun({request, id, projects});
 
-    const cancelled = await cancelWorkflowRun({workflowRunId: run.id});
-    return toRunDto(cancelled);
-  },
-});
+      const cancelled = await cancelWorkflowRun({workflowRunId: run.id});
+      return toRunDto(cancelled);
+    },
+  });
+}

package/src/presentation/routes/checkout-token.test.ts

@@ -1,27 +1,22 @@
 import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
-import {
-  type CheckoutSpec,
-  IntegrationCheckoutUnsupportedError,
-  IntegrationConnectionInactiveError,
-  IntegrationProviderError,
-  type IntegrationSourceControlService,
-} from '@shipfox/api-integration-core';
-import {getProjectById} from '@shipfox/api-projects';
+import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import {createInterModuleKnownError} from '@shipfox/inter-module';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
-import {clearSourceControl, setSourceControl} from '#core/source-control.js';
 import {jobFactory} from '#test/factories/job.js';
 import {projectFactory} from '#test/factories/project.js';
 import {mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
 import {mintLeaseToken} from '#test/fixtures/lease-token.js';
-import {leaseTokenRouteGroup} from './index.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createLeaseTokenRouteGroup} from './index.js';
 
-vi.mock('@shipfox/api-projects', () => ({getProjectById: vi.fn()}));
-const mockGetProjectById = vi.mocked(getProjectById);
+const getProjectById = vi.fn();
+const projects = {getProjectById} as Pick<ProjectsModuleClient, 'getProjectById'>;
 
 const URL = '/runs/jobs/current/checkout-token';
 
-const githubSpec = (token: string): CheckoutSpec => ({
+const githubSpec = (token: string) => ({
   repositoryUrl: 'https://github.com/acme/repo.git',
   ref: 'main',
   credentials: {username: 'x-access-token', token, expiresAt: new Date('2026-06-10T12:00:00.000Z')},
@@ -33,10 +28,19 @@ describe('POST /runs/jobs/current/checkout-token', () => {
   const {logger, lines: logLines, clear: clearLogLines} = createCapturingLogger();
 
   beforeAll(async () => {
-    setSourceControl({createCheckoutSpec} as unknown as IntegrationSourceControlService);
     app = await createApp({
       auth: [createLeaseTokenAuthMethod()],
-      routes: [leaseTokenRouteGroup],
+      routes: [
+        createLeaseTokenRouteGroup({
+          agent: {} as never,
+          annotations: {} as never,
+          auth: {} as never,
+          integrations: {createCheckoutSpec} as never,
+          projects: projects as never,
+          runners: runnersTestClient,
+          secrets: {} as never,
+        }),
+      ],
       swagger: false,
       fastifyOptions: {loggerInstance: logger},
     });
@@ -45,13 +49,12 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   beforeEach(() => {
     createCheckoutSpec.mockReset();
-    mockGetProjectById.mockReset();
+    getProjectById.mockReset();
     clearLogLines();
   });
 
   afterAll(async () => {
     await closeApp();
-    clearSourceControl();
   });
 
   describe('lease-token auth', () => {
@@ -97,7 +100,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('returns basic auth for a GitHub-style spec with credentials', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockResolvedValue(githubSpec('ghs-secret-token'));
     const token = await mintActiveLeaseToken({jobId: job.id});
@@ -127,12 +130,12 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('omits auth for a credential-free (debug) spec', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockResolvedValue({
       repositoryUrl: 'https://example.com/acme/repo.git',
       ref: 'trunk',
-    } satisfies CheckoutSpec);
+    });
     const token = await mintActiveLeaseToken({jobId: job.id});
 
     const res = await app.inject({
@@ -172,7 +175,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
     'skipped',
   ] as const)('returns 404 and mints nothing without an active lease for %s job', async (status) => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id, status}});
     const token = await mintLeaseToken({jobId: job.id});
 
@@ -189,7 +192,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('returns checkout credentials while the parent job projection is still pending', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create(
       {},
       {transient: {projectId: project.id, status: 'pending'}},
@@ -216,7 +219,9 @@ describe('POST /runs/jobs/current/checkout-token', () => {
       [projectA.id, projectA],
       [projectB.id, projectB],
     ]);
-    mockGetProjectById.mockImplementation((id: string) => Promise.resolve(projectsById.get(id)));
+    getProjectById.mockImplementation((input: {projectId: string}) =>
+      Promise.resolve({project: projectsById.get(input.projectId) ?? null}),
+    );
     const jobA = await jobFactory.create({}, {transient: {projectId: projectA.id}});
     const jobB = await jobFactory.create({}, {transient: {projectId: projectB.id}});
     createCheckoutSpec.mockResolvedValue(githubSpec('token'));
@@ -242,7 +247,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('passes the project workspace, never the lease workspace claim', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockResolvedValue(githubSpec('token'));
     const token = await mintActiveLeaseToken({
@@ -258,7 +263,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
   });
 
   test('returns 404 when the run has no project linkage', async () => {
-    mockGetProjectById.mockResolvedValue(undefined);
+    getProjectById.mockResolvedValue({project: null});
     const project = {id: crypto.randomUUID(), workspaceId: crypto.randomUUID()};
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     const token = await mintActiveLeaseToken({jobId: job.id});
@@ -275,10 +280,14 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('maps a rate-limited provider error to 429 with retry_after_seconds', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockRejectedValue(
-      new IntegrationProviderError('rate-limited', 'slow down', 60),
+      createInterModuleKnownError(
+        integrationsInterModuleContract.methods.createCheckoutSpec,
+        'provider-failure',
+        {reason: 'rate-limited', retryAfterSeconds: 60},
+      ),
     );
     const token = await mintActiveLeaseToken({jobId: job.id});
 
@@ -295,10 +304,14 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('maps an inactive connection error to 422', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockRejectedValue(
-      new IntegrationConnectionInactiveError(project.sourceConnectionId),
+      createInterModuleKnownError(
+        integrationsInterModuleContract.methods.createCheckoutSpec,
+        'connection-inactive',
+        {connectionId: project.sourceConnectionId},
+      ),
     );
     const token = await mintActiveLeaseToken({jobId: job.id});
 
@@ -313,9 +326,15 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('maps an unsupported-checkout provider error to 422', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
-    createCheckoutSpec.mockRejectedValue(new IntegrationCheckoutUnsupportedError('github'));
+    createCheckoutSpec.mockRejectedValue(
+      createInterModuleKnownError(
+        integrationsInterModuleContract.methods.createCheckoutSpec,
+        'checkout-unsupported',
+        {provider: 'github'},
+      ),
+    );
     const token = await mintActiveLeaseToken({jobId: job.id});
 
     const res = await app.inject({
@@ -330,7 +349,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('surfaces an unexpected provider error as a 500 server-error', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     createCheckoutSpec.mockRejectedValue(new Error('unexpected provider failure'));
     const token = await mintActiveLeaseToken({jobId: job.id});
@@ -347,7 +366,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   test('never writes the minted token to a log line', async () => {
     const project = projectFactory.build();
-    mockGetProjectById.mockResolvedValue(project);
+    getProjectById.mockResolvedValue({project});
     const job = await jobFactory.create({}, {transient: {projectId: project.id}});
     const secret = 'ghs-super-secret-token-value';
     createCheckoutSpec.mockResolvedValue(githubSpec(secret));