@shipfox/api-workflows 5.0.0 → 7.0.1

package/src/presentation/routes/next-step.test.ts

@@ -1,3 +1,4 @@
+import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
 import {createLeaseTokenAuthMethod, verifyJobLeaseToken} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {eq, sql} from 'drizzle-orm';
@@ -12,9 +13,14 @@ import {
   getWorkflowRunByAttemptId,
 } from '#db/workflow-runs.js';
 import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
+import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
+import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
 import {mintLeaseToken} from '#test/fixtures/lease-token.js';
-import {leaseTokenRouteGroup} from './index.js';
+import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
+import {createLeaseTokenRouteGroup} from './index.js';
 
 const URL = '/runs/jobs/current/steps/next';
 
@@ -42,14 +48,10 @@ async function setRunnerToolCapabilities(
   `);
 }
 
-async function annotationCount(jobExecutionId: string): Promise<number> {
-  const result = await db().execute<{count: string}>(sql`
-    SELECT count(*)::text AS count
-    FROM annotations_annotations
-    WHERE job_execution_id = ${jobExecutionId}
-  `);
-  return Number(result.rows[0]?.count ?? '0');
-}
+const annotationWrites = vi.fn<AnnotationsInterModuleClient['replaceOrRemoveAnnotation']>();
+const annotationsTestClient: AnnotationsInterModuleClient = {
+  replaceOrRemoveAnnotation: annotationWrites.mockResolvedValue({}),
+};
 
 describe('POST /runs/jobs/current/steps/next', () => {
   let app: FastifyInstance;
@@ -57,7 +59,17 @@ describe('POST /runs/jobs/current/steps/next', () => {
   beforeAll(async () => {
     app = await createApp({
       auth: [createLeaseTokenAuthMethod()],
-      routes: [leaseTokenRouteGroup],
+      routes: [
+        createLeaseTokenRouteGroup({
+          agent: agentTestClient,
+          annotations: annotationsTestClient,
+          auth: workflowsTestAuthClient,
+          integrations: {} as never,
+          projects: projectsTestClient,
+          runners: runnersTestClient,
+          secrets: createTestSecretsClient(),
+        }),
+      ],
       swagger: false,
     });
     await app.ready();
@@ -199,6 +211,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
   });
 
   test('writes the tool capability warning only on fresh dispatch', async () => {
+    annotationWrites.mockClear();
     const {jobId, steps} = await arrangeJobWithSteps(1);
     await db()
       .update(stepsTable)
@@ -232,7 +245,13 @@ describe('POST /runs/jobs/current/steps/next', () => {
 
     expect(first.statusCode).toBe(200);
     expect(second.statusCode).toBe(200);
-    expect(await annotationCount(lease.jobExecutionId)).toBe(1);
+    expect(annotationWrites).toHaveBeenCalledTimes(1);
+    expect(annotationWrites).toHaveBeenCalledWith(
+      expect.objectContaining({
+        jobExecutionId: lease.jobExecutionId,
+        annotation: expect.objectContaining({op: 'replace'}),
+      }),
+    );
   });
 
   test('returns 404 for a valid token without an active lease', async () => {

package/src/presentation/routes/next-step.ts

@@ -1,5 +1,8 @@
-import {issueJobLeaseToken, jobLeaseParamsFrom} from '@shipfox/api-auth';
+import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
 import {requireLeasedJobContext} from '@shipfox/api-auth-context';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {nextStepResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {warnAgentToolCapabilityMismatchOnDispatch} from '#core/agent-tool-capability-warning.js';
@@ -7,56 +10,73 @@ import {JobLeaseNotActiveError, JobNotFoundError} from '#core/errors.js';
 import {nextStepForLeasedJobExecution} from '#core/job-execution.js';
 import {toStepDto} from '#presentation/dto/step.js';
 
-export const nextStepRoute = defineRoute({
-  method: 'POST',
-  path: '/steps/next',
-  description:
-    'Returns the next step for the runner to run on its job. The job is identified by the access token, so no job ID is needed. Calling this again before reporting the current step returns that same step, so retries are safe. When no runnable steps remain, the response reports that there are no more steps to run, along with the job status; the runner then stops. Finalization is driven server-side from recorded step results and dispatch-time skips, not by the runner calling a job-completion endpoint.',
-  schema: {
-    response: {
-      200: nextStepResponseSchema,
+export function createNextStepRoute(params: {
+  agent: AgentInterModuleClient;
+  annotations: AnnotationsInterModuleClient;
+  auth: AuthInterModuleClient;
+  runners: RunnersInterModuleClient;
+}) {
+  return defineRoute({
+    method: 'POST',
+    path: '/steps/next',
+    description:
+      'Returns the next step for the runner to run on its job. The job is identified by the access token, so no job ID is needed. Calling this again before reporting the current step returns that same step, so retries are safe. When no runnable steps remain, the response reports that there are no more steps to run, along with the job status; the runner then stops. Finalization is driven server-side from recorded step results and dispatch-time skips, not by the runner calling a job-completion endpoint.',
+    schema: {
+      response: {
+        200: nextStepResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof JobNotFoundError) {
-      throw new ClientError(error.message, 'job-not-found', {status: 404});
-    }
-    if (error instanceof JobLeaseNotActiveError) {
-      throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const leasedJob = requireLeasedJobContext(request);
-
-    const next = await nextStepForLeasedJobExecution({
-      jobId: leasedJob.jobId,
-      jobExecutionId: leasedJob.jobExecutionId,
-      runnerSessionId: leasedJob.runnerSessionId,
-    });
+    errorHandler: (error) => {
+      if (error instanceof JobNotFoundError) {
+        throw new ClientError(error.message, 'job-not-found', {status: 404});
+      }
+      if (error instanceof JobLeaseNotActiveError) {
+        throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
+      }
+      throw error;
+    },
+    handler: async (request) => {
+      const leasedJob = requireLeasedJobContext(request);
+      const next = await nextStepForLeasedJobExecution({
+        jobId: leasedJob.jobId,
+        jobExecutionId: leasedJob.jobExecutionId,
+        runnerSessionId: leasedJob.runnerSessionId,
+        agent: params.agent,
+      });
 
-    if (next.kind === 'step') {
-      const leaseToken = await issueJobLeaseToken(
-        jobLeaseParamsFrom(leasedJob, {
+      if (next.kind === 'step') {
+        const {token: leaseToken} = await params.auth.mintJobLeaseToken({
+          workflowRunId: leasedJob.workflowRunId,
+          ...(leasedJob.workflowRunAttempt === undefined
+            ? {}
+            : {workflowRunAttempt: leasedJob.workflowRunAttempt}),
+          workflowRunAttemptId: leasedJob.workflowRunAttemptId,
+          jobId: leasedJob.jobId,
+          jobExecutionId: leasedJob.jobExecutionId,
+          projectId: leasedJob.projectId,
+          workspaceId: leasedJob.workspaceId,
+          runnerSessionId: leasedJob.runnerSessionId,
           currentStepId: next.step.id,
           currentStepAttempt: next.step.currentAttempt,
-        }),
-      );
-      if (next.dispatched) {
-        await warnAgentToolCapabilityMismatchOnDispatch({
-          leaseIdentity: leasedJob,
-          step: next.step,
         });
+        if (next.dispatched) {
+          await warnAgentToolCapabilityMismatchOnDispatch({
+            annotations: params.annotations,
+            runners: params.runners,
+            leaseIdentity: leasedJob,
+            step: next.step,
+          });
+        }
+        // The runner echoes this back on report so a stale report from a superseded
+        // attempt is ignored.
+        return {
+          kind: 'step' as const,
+          step: toStepDto(next.step),
+          attempt: next.step.currentAttempt,
+          lease_token: leaseToken,
+        };
       }
-      // The runner echoes this back on report so a stale report from a superseded
-      // attempt is ignored.
-      return {
-        kind: 'step' as const,
-        step: toStepDto(next.step),
-        attempt: next.step.currentAttempt,
-        lease_token: leaseToken,
-      };
-    }
-    return {kind: 'done' as const, status: next.status};
-  },
-});
+      return {kind: 'done' as const, status: next.status};
+    },
+  });
+}

package/src/presentation/routes/project-access.ts

@@ -0,0 +1,16 @@
+import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import {ClientError} from '@shipfox/node-fastify';
+import type {FastifyRequest} from 'fastify';
+
+export async function requireProjectAccess(
+  request: FastifyRequest,
+  projectId: string,
+  projects: ProjectsModuleClient,
+) {
+  const result = await projects.getProjectById({projectId});
+  if (result.project === null)
+    throw new ClientError('Project not found', 'project-not-found', {status: 404});
+  requireWorkspaceAccess({request, workspaceId: result.project.workspaceId});
+  return result.project;
+}

package/src/presentation/routes/report-step.test.ts

@@ -9,9 +9,15 @@ import {
   getWorkflowRunByAttemptId,
 } from '#db/workflow-runs.js';
 import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
+import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
+import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
+import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
 import {mintLeaseToken} from '#test/fixtures/lease-token.js';
-import {leaseTokenRouteGroup} from './index.js';
+import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
+import {createLeaseTokenRouteGroup} from './index.js';
 
 function reportUrl(stepId: string): string {
   return `/runs/jobs/current/steps/${stepId}/report`;
@@ -27,7 +33,17 @@ describe('POST /runs/jobs/current/steps/:stepId/report', () => {
   beforeAll(async () => {
     app = await createApp({
       auth: [createLeaseTokenAuthMethod()],
-      routes: [leaseTokenRouteGroup],
+      routes: [
+        createLeaseTokenRouteGroup({
+          agent: agentTestClient,
+          annotations: annotationsTestClient,
+          auth: workflowsTestAuthClient,
+          integrations: {} as never,
+          projects: projectsTestClient,
+          runners: runnersTestClient,
+          secrets: createTestSecretsClient(),
+        }),
+      ],
       swagger: false,
     });
     await app.ready();

package/src/presentation/routes/report-step.ts

@@ -1,5 +1,5 @@
 import {requireLeasedJobContext} from '@shipfox/api-auth-context';
-import {isJobLeaseActive} from '@shipfox/api-runners';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {reportStepBodySchema, reportStepResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -7,55 +7,57 @@ import {StepAttemptAheadError, StepNotFoundError, StepNotRunningError} from '#co
 import {recordStepResult} from '#core/job-execution.js';
 import {fromStepErrorDto} from '#presentation/dto/step.js';
 
-export const reportStepRoute = defineRoute({
-  method: 'POST',
-  path: '/steps/:stepId/report',
-  description:
-    'Reports whether a step succeeded or failed. The job is identified by the access token. Reporting the same step more than once is safe: once a step has finished, later reports for it are ignored. The runner does not call a separate job-completion endpoint — finalization is driven server-side from the recorded step results, and the `cancel` flag tells the runner to stop once the job has finished without full success.',
-  schema: {
-    params: z.object({stepId: z.string().uuid()}),
-    body: reportStepBodySchema,
-    response: {
-      200: reportStepResponseSchema,
+export function createReportStepRoute(runners: RunnersInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/steps/:stepId/report',
+    description:
+      'Reports whether a step succeeded or failed. The job is identified by the access token. Reporting the same step more than once is safe: once a step has finished, later reports for it are ignored. The runner does not call a separate job-completion endpoint — finalization is driven server-side from the recorded step results, and the `cancel` flag tells the runner to stop once the job has finished without full success.',
+    schema: {
+      params: z.object({stepId: z.string().uuid()}),
+      body: reportStepBodySchema,
+      response: {
+        200: reportStepResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof StepNotFoundError) {
-      throw new ClientError(error.message, 'step-not-found', {status: 404});
-    }
-    if (error instanceof StepNotRunningError) {
-      throw new ClientError(error.message, 'step-not-running', {status: 409});
-    }
-    if (error instanceof StepAttemptAheadError) {
-      throw new ClientError(error.message, 'step-attempt-ahead', {status: 409});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const {stepId} = request.params;
-    const leasedJob = requireLeasedJobContext(request);
+    errorHandler: (error) => {
+      if (error instanceof StepNotFoundError) {
+        throw new ClientError(error.message, 'step-not-found', {status: 404});
+      }
+      if (error instanceof StepNotRunningError) {
+        throw new ClientError(error.message, 'step-not-running', {status: 409});
+      }
+      if (error instanceof StepAttemptAheadError) {
+        throw new ClientError(error.message, 'step-attempt-ahead', {status: 409});
+      }
+      throw error;
+    },
+    handler: async (request) => {
+      const {stepId} = request.params;
+      const leasedJob = requireLeasedJobContext(request);
 
-    const leaseIsActive = await isJobLeaseActive({
-      jobId: leasedJob.jobId,
-      jobExecutionId: leasedJob.jobExecutionId,
-      runnerSessionId: leasedJob.runnerSessionId,
-    });
-    if (!leaseIsActive) {
-      throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
-    }
+      const {active: leaseIsActive} = await runners.getLeaseState({
+        jobId: leasedJob.jobId,
+        jobExecutionId: leasedJob.jobExecutionId,
+        runnerSessionId: leasedJob.runnerSessionId,
+      });
+      if (!leaseIsActive) {
+        throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
+      }
 
-    const outcome = await recordStepResult({
-      jobExecutionId: leasedJob.jobExecutionId,
-      stepId,
-      status: request.body.status,
-      error: fromStepErrorDto(request.body.error),
-      output: request.body.output ?? null,
-      response: request.body.response ?? null,
-      exitCode: request.body.exit_code ?? request.body.error?.exit_code ?? null,
-      logOutcome: request.body.log_outcome,
-      ...(request.body.attempt !== undefined ? {attempt: request.body.attempt} : {}),
-    });
+      const outcome = await recordStepResult({
+        jobExecutionId: leasedJob.jobExecutionId,
+        stepId,
+        status: request.body.status,
+        error: fromStepErrorDto(request.body.error),
+        output: request.body.output ?? null,
+        response: request.body.response ?? null,
+        exitCode: request.body.exit_code ?? request.body.error?.exit_code ?? null,
+        logOutcome: request.body.log_outcome,
+        ...(request.body.attempt !== undefined ? {attempt: request.body.attempt} : {}),
+      });
 
-    return {ok: true, cancel: outcome.jobFinished && outcome.status === 'failed'};
-  },
-});
+      return {ok: true, cancel: outcome.jobFinished && outcome.status === 'failed'};
+    },
+  });
+}

package/src/presentation/routes/require-accessible-run.ts

@@ -1,22 +1,25 @@
-import {requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 import type {WorkflowRun} from '#core/entities/workflow-run.js';
 import {getWorkflowRunById} from '#db/index.js';
+import {requireProjectAccess} from './project-access.js';
 
 export async function requireAccessibleRun({
   request,
   id,
+  projects,
 }: {
   request: FastifyRequest;
   id: string;
+  projects: ProjectsModuleClient;
 }): Promise<WorkflowRun> {
   const run = await getWorkflowRunById(id);
   if (!run) {
     throw new ClientError('Run not found', 'not-found', {status: 404});
   }
 
-  await requireProjectAccess({request, projectId: run.projectId}).catch((err: unknown) => {
+  await requireProjectAccess(request, run.projectId, projects).catch((err: unknown) => {
     if (err instanceof ClientError && (err.status === 403 || err.status === 404)) {
       throw new ClientError('Run not found', 'not-found', {status: 404});
     }

package/src/presentation/routes/rerun-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import {requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
@@ -15,16 +15,11 @@ import {rerunRunRoute} from './rerun-run.js';
 
 const projectAccessState = vi.hoisted(() => ({workspaceId: ''}));
 
-vi.mock('@shipfox/api-projects', () => ({
-  requireProjectAccess: vi.fn(({projectId}) =>
-    Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
-    }),
-  ),
-}));
-
-const mockRequireProjectAccess = vi.mocked(requireProjectAccess);
+const getProjectById = vi.fn();
+const projects = {
+  getProjectById,
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('POST /api/workflows/runs/:id/rerun', () => {
   let app: FastifyInstance;
@@ -46,7 +41,7 @@ describe('POST /api/workflows/runs/:id/rerun', () => {
       );
       done();
     });
-    app.post('/api/workflows/runs/:id/rerun', rerunRunRoute);
+    app.post('/api/workflows/runs/:id/rerun', rerunRunRoute(projects));
     await app.ready();
   });
 
@@ -54,7 +49,7 @@ describe('POST /api/workflows/runs/:id/rerun', () => {
     workspaceId = crypto.randomUUID();
     projectId = crypto.randomUUID();
     projectAccessState.workspaceId = workspaceId;
-    mockRequireProjectAccess.mockImplementation(({projectId: requestedProjectId}) =>
+    getProjectById.mockImplementation(({projectId: requestedProjectId}) =>
       Promise.resolve({
         project: {
           id: requestedProjectId,
@@ -62,10 +57,7 @@ describe('POST /api/workflows/runs/:id/rerun', () => {
           sourceConnectionId: crypto.randomUUID(),
           sourceExternalRepositoryId: `repo:${crypto.randomUUID()}`,
           name: 'Project',
-          createdAt: new Date(),
-          updatedAt: new Date(),
         },
-        workspaceId,
       }),
     );
   });
@@ -174,9 +166,7 @@ describe('POST /api/workflows/runs/:id/rerun', () => {
       payload: {mode: 'all'},
     });
     const source = await createTerminalRun('failed');
-    mockRequireProjectAccess.mockRejectedValueOnce(
-      new ClientError('Forbidden', 'forbidden', {status: 403}),
-    );
+    getProjectById.mockRejectedValueOnce(new ClientError('Forbidden', 'forbidden', {status: 403}));
 
     const inaccessible = await app.inject({
       method: 'POST',

package/src/presentation/routes/rerun-run.ts

@@ -1,4 +1,5 @@
 import {requireUserContext} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {rerunWorkflowRunBodySchema, workflowRunResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -7,42 +8,44 @@ import {createRerunWorkflowRun} from '#db/index.js';
 import {toRunDto} from '#presentation/dto/index.js';
 import {requireAccessibleRun} from './require-accessible-run.js';
 
-export const rerunRunRoute = defineRoute({
-  method: 'POST',
-  path: '/:id/rerun',
-  description: 'Re-run a terminal workflow run',
-  schema: {
-    params: z.object({
-      id: z.string().uuid(),
-    }),
-    body: rerunWorkflowRunBodySchema,
-    response: {
-      200: workflowRunResponseSchema,
+export function rerunRunRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/:id/rerun',
+    description: 'Re-run a terminal workflow run',
+    schema: {
+      params: z.object({
+        id: z.string().uuid(),
+      }),
+      body: rerunWorkflowRunBodySchema,
+      response: {
+        200: workflowRunResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof SourceRunNotFoundError) {
-      throw new ClientError('Run not found', 'not-found', {status: 404});
-    }
-    if (error instanceof RunNotTerminalError) {
-      throw new ClientError('Run is not terminal', 'run-not-terminal', {status: 409});
-    }
-    if (error instanceof NoFailedJobsError) {
-      throw new ClientError('Run has no failed jobs', 'no-failed-jobs', {status: 409});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const {id} = request.params;
-    const sourceRun = await requireAccessibleRun({request, id});
+    errorHandler: (error) => {
+      if (error instanceof SourceRunNotFoundError) {
+        throw new ClientError('Run not found', 'not-found', {status: 404});
+      }
+      if (error instanceof RunNotTerminalError) {
+        throw new ClientError('Run is not terminal', 'run-not-terminal', {status: 409});
+      }
+      if (error instanceof NoFailedJobsError) {
+        throw new ClientError('Run has no failed jobs', 'no-failed-jobs', {status: 409});
+      }
+      throw error;
+    },
+    handler: async (request) => {
+      const {id} = request.params;
+      const sourceRun = await requireAccessibleRun({request, id, projects});
 
-    const actor = requireUserContext(request);
-    const run = await createRerunWorkflowRun({
-      workflowRunId: sourceRun.id,
-      mode: request.body.mode,
-      actorUserId: actor.userId,
-    });
+      const actor = requireUserContext(request);
+      const run = await createRerunWorkflowRun({
+        workflowRunId: sourceRun.id,
+        mode: request.body.mode,
+        actorUserId: actor.userId,
+      });
 
-    return toRunDto(run, run.currentAttempt);
-  },
-});
+      return toRunDto(run, run.currentAttempt);
+    },
+  });
+}

package/src/temporal/activities/index.ts

@@ -1,16 +1,21 @@
+import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
+import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {
   activateJobListenerActivity,
   bulkSetStepStatuses,
-  cancelRunnerJobsActivity,
-  drainListenerEventsActivity,
-  enqueueJobExecutionForRunner,
+  createCancelRunnerJobsActivity,
+  createDrainListenerEventsActivity,
+  createEnqueueJobExecutionForRunner,
+  createReleaseLeaseActivity,
   evaluateJobActivationsActivity,
   failJobExecutionAsTimedOutActivity,
   failRunAsTimedOutActivity,
   loadRunAttemptDag,
   peekListenerBufferActivity,
   recordListenerFiringOutcomeActivity,
-  releaseLeaseActivity,
   resolveJobListenerActivity,
   resolveJobStatusFromJobExecutionsActivity,
   resolveLeaseExpiredJobExecutionActivity,
@@ -20,26 +25,41 @@ import {
   settleListenerJobExecutionActivity,
 } from './orchestration-activities.js';
 
-export function createOrchestrationActivities() {
+export function createOrchestrationActivities(params: {
+  agent: AgentInterModuleClient;
+  integrations: IntegrationsModuleClient;
+  projects: ProjectsModuleClient;
+  runners: RunnersInterModuleClient;
+  secrets: Pick<SecretsInterModuleClient, 'getVariablesByNamespace'>;
+}) {
   return {
     loadRunAttemptDag,
     setRunAttemptStatus,
     setJobStatus,
-    setJobExecutionStatus,
+    setJobExecutionStatus: async (activityParams: Parameters<typeof setJobExecutionStatus>[0]) =>
+      await setJobExecutionStatus(activityParams, params.secrets),
     bulkSetStepStatuses,
-    cancelRunnerJobsActivity,
-    enqueueJobExecutionForRunner,
+    cancelRunnerJobsActivity: createCancelRunnerJobsActivity(params.runners),
+    enqueueJobExecutionForRunner: createEnqueueJobExecutionForRunner(params.runners),
     evaluateJobActivationsActivity,
-    failJobExecutionAsTimedOutActivity,
+    failJobExecutionAsTimedOutActivity: async (
+      activityParams: Parameters<typeof failJobExecutionAsTimedOutActivity>[0],
+    ) => await failJobExecutionAsTimedOutActivity(activityParams, params.secrets),
     failRunAsTimedOutActivity,
     activateJobListenerActivity,
-    drainListenerEventsActivity,
+    drainListenerEventsActivity: createDrainListenerEventsActivity({
+      agent: params.agent,
+      integrations: params.integrations,
+      projects: params.projects,
+    }),
     peekListenerBufferActivity,
     resolveJobListenerActivity,
     settleListenerJobExecutionActivity,
     recordListenerFiringOutcomeActivity,
-    resolveLeaseExpiredJobExecutionActivity,
+    resolveLeaseExpiredJobExecutionActivity: async (
+      activityParams: Parameters<typeof resolveLeaseExpiredJobExecutionActivity>[0],
+    ) => await resolveLeaseExpiredJobExecutionActivity(activityParams, params.secrets),
     resolveJobStatusFromJobExecutionsActivity,
-    releaseLeaseActivity,
+    releaseLeaseActivity: createReleaseLeaseActivity(params.runners),
   };
 }