@shipfox/api-workflows 7.1.0 → 9.0.1

package/src/db/workflow-runs/job-executions.ts

@@ -17,7 +17,6 @@ import {
 } from '#metrics/instance.js';
 import {db, type Tx} from '../db.js';
 import {writeWorkflowsOutboxEvent} from '../outbox-writes.js';
-import {runningJobExecutions} from '../runner-lease-table.js';
 import {jobExecutions, toJobExecution} from '../schema/job-executions.js';
 import {jobs, toJob} from '../schema/jobs.js';
 import {stepAttempts, toStepAttempt} from '../schema/step-attempts.js';
@@ -33,26 +32,6 @@ import {
 } from './shared.js';
 import {bulkUpdateStepStatuses, getStepsByJobExecutionIdForUpdate} from './steps.js';
 
-export async function lockActiveJobExecutionLeaseForUpdate(
-  params: {jobId: string; jobExecutionId: string; runnerSessionId: string},
-  tx: Tx,
-): Promise<boolean> {
-  const rows = await tx
-    .select({id: runningJobExecutions.id})
-    .from(runningJobExecutions)
-    .where(
-      and(
-        eq(runningJobExecutions.jobId, params.jobId),
-        eq(runningJobExecutions.jobExecutionId, params.jobExecutionId),
-        eq(runningJobExecutions.runnerSessionId, params.runnerSessionId),
-      ),
-    )
-    .limit(1)
-    .for('update');
-
-  return rows.length > 0;
-}
-
 export async function getJobExecutionById(id: string, tx?: Tx): Promise<JobExecution | undefined> {
   const rows = await (tx ?? db())
     .select()

package/src/db/workflow-runs/run-create.test.ts

@@ -1,4 +1,3 @@
-import {normalizeWorkflowDocument} from '@shipfox/api-definitions';
 import {WORKFLOWS_WORKFLOW_RUN_ATTEMPT_CREATED} from '@shipfox/api-workflows-dto';
 import {and, eq, sql} from 'drizzle-orm';
 import type {AgentDefaultsResolver} from '#core/agent-defaults.js';
@@ -7,6 +6,7 @@ import {nextStepForJob, recordStepResult} from '#core/job-execution.js';
 import {resolveTestAgentDefaults} from '#test/fixtures/agent-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
 import {buildModel, expression, shellRef, template} from '#test/helpers/workflow-runs.js';
+import {workflowModel} from '#test/index.js';
 import {db} from '../db.js';
 import {workflowsOutbox} from '../schema/outbox.js';
 import {workflowRuns} from '../schema/workflow-runs.js';
@@ -330,7 +330,7 @@ describe('workflow run queries', () => {
       const displayNameSource = ['Review batch $', '{{ execution.index }}'].join('');
       const stepNameSource = ['Review $', '{{ execution.index }}'].join('');
       const promptSource = ['Review $', '{{ execution.events[0].data.body }}'].join('');
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Listening workflow',
         runner: 'ubuntu-latest',
         jobs: {
@@ -339,10 +339,10 @@ describe('workflow run queries', () => {
             listening: {
               on: [{source: 'github', event: 'pull_request_review'}],
               until: [{source: 'github', event: 'pull_request'}],
-              timeout: '30d',
-              max_executions: 3,
-              batch: {debounce: '5s', max_size: 10, max_wait: '1h'},
-              on_resolve: 'cancel',
+              timeoutMs: 30 * 24 * 60 * 60 * 1000,
+              maxExecutions: 3,
+              batch: {debounceMs: 5000, maxSize: 10, maxWaitMs: 60 * 60 * 1000},
+              onResolve: 'cancel',
             },
             steps: [{name: stepNameSource, prompt: promptSource}],
           },
@@ -400,7 +400,7 @@ describe('workflow run queries', () => {
     test('persists the listening workflow model on the run attempt', async () => {
       const displayNameSource = ['Review batch $', '{{ execution.index }}'].join('');
       const promptSource = ['Review $', '{{ execution.events[0].data.body }}'].join('');
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Listening workflow',
         runner: 'ubuntu-latest',
         jobs: {
@@ -409,10 +409,10 @@ describe('workflow run queries', () => {
             listening: {
               on: [{source: 'github', event: 'pull_request_review'}],
               until: [{source: 'github', event: 'pull_request'}],
-              timeout: '30d',
-              max_executions: 3,
-              batch: {debounce: '5s', max_size: 10, max_wait: '1h'},
-              on_resolve: 'cancel',
+              timeoutMs: 30 * 24 * 60 * 60 * 1000,
+              maxExecutions: 3,
+              batch: {debounceMs: 5000, maxSize: 10, maxWaitMs: 60 * 60 * 1000},
+              onResolve: 'cancel',
             },
             steps: [{prompt: promptSource}],
           },
@@ -441,7 +441,7 @@ describe('workflow run queries', () => {
     });
 
     test('does not load variables referenced only by listening job executions at run creation', async () => {
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Listening vars workflow',
         runner: 'ubuntu-latest',
         jobs: {
@@ -449,6 +449,7 @@ describe('workflow run queries', () => {
             listening: {
               on: [{source: 'github', event: 'pull_request_review'}],
               until: [{source: 'github', event: 'pull_request'}],
+              onResolve: 'finish',
             },
             steps: [
               {
@@ -483,7 +484,7 @@ describe('workflow run queries', () => {
       {
         field: 'run',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing run var',
             runner: 'ubuntu-latest',
             jobs: {build: {steps: [{run: `echo ${template('vars.REQUIRED')}`}]}},
@@ -493,7 +494,7 @@ describe('workflow run queries', () => {
       {
         field: 'env',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing env var',
             runner: 'ubuntu-latest',
             jobs: {
@@ -507,7 +508,7 @@ describe('workflow run queries', () => {
       {
         field: 'agent.prompt',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing prompt var',
             runner: 'ubuntu-latest',
             jobs: {fix: {steps: [{prompt: template('vars.REQUIRED')}]}},
@@ -517,7 +518,7 @@ describe('workflow run queries', () => {
       {
         field: 'agent.model',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing model var',
             runner: 'ubuntu-latest',
             jobs: {fix: {steps: [{prompt: 'Fix it', model: template('vars.REQUIRED')}]}},
@@ -527,7 +528,7 @@ describe('workflow run queries', () => {
       {
         field: 'agent.provider',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing provider var',
             runner: 'ubuntu-latest',
             jobs: {fix: {steps: [{prompt: 'Fix it', provider: template('vars.REQUIRED')}]}},
@@ -537,17 +538,23 @@ describe('workflow run queries', () => {
       {
         field: 'job.runner',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing runner var',
             runner: 'ubuntu-latest',
-            jobs: {build: {runner: template('vars.REQUIRED'), steps: [{run: 'echo ok'}]}},
+            jobs: {
+              build: {
+                runner: [],
+                runnerTemplates: [template('vars.REQUIRED')],
+                steps: [{run: 'echo ok'}],
+              },
+            },
           }),
         expected: {field: 'job.runner', source: 'vars.REQUIRED'},
       },
       {
         field: 'step.name',
         model: () =>
-          normalizeWorkflowDocument({
+          workflowModel({
             name: 'Missing step name var',
             runner: 'ubuntu-latest',
             jobs: {build: {steps: [{name: template('vars.REQUIRED'), run: 'echo ok'}]}},
@@ -614,7 +621,7 @@ describe('workflow run queries', () => {
     });
 
     test('persists resolved step config and authored step config separately', async () => {
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Interpolated workflow',
         runner: 'ubuntu-latest',
         env: {RUN_ID: template('run.id'), REF: template('event.ref')},
@@ -665,7 +672,7 @@ describe('workflow run queries', () => {
     });
 
     test('resolves webhook trigger payload body and headers into step config', async () => {
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Webhook workflow',
         runner: 'ubuntu-latest',
         env: {
@@ -711,7 +718,7 @@ describe('workflow run queries', () => {
     });
 
     test('fails for missing available untrusted interpolation paths', async () => {
-      const model = normalizeWorkflowDocument({
+      const model = workflowModel({
         name: 'Diagnostic workflow',
         runner: 'ubuntu-latest',
         env: {REF: template('event.ref')},

package/src/db/workflow-runs/run-create.ts

@@ -1,6 +1,6 @@
 import {createWorkflowModelSnapshot, type WorkflowModel} from '@shipfox/api-definitions-dto';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {analyzeContextKeyAccess, type ResolvedFieldSegment} from '@shipfox/expression';
 import {logger} from '@shipfox/node-opentelemetry';

package/src/db/workflow-runs.ts

@@ -9,7 +9,6 @@ export {
   getJobExecutionsByJobId,
   getJobExecutionsByWorkflowRunAttemptId,
   getLatestJobExecutionByJobId,
-  lockActiveJobExecutionLeaseForUpdate,
   recordJobExecutionQueuedAt,
   recordJobExecutionStartedAt,
   resolveJobExecutionAfterLeaseExpiry,

package/src/index.ts

@@ -4,8 +4,8 @@ import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
 import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
 import type {DefinitionsInterModuleClient} from '@shipfox/api-definitions-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {
   RUNNER_JOB_CLAIMED,
   RUNNER_JOB_LEASE_EXPIRED,
@@ -95,7 +95,7 @@ export function createWorkflowsModule({
 }): ShipfoxModule {
   return {
     name: 'workflows',
-    database: {db, migrationsPath},
+    database: {db, migrationsPath, databaseNamespace: 'workflows'},
     routes: createWorkflowRoutes({
       agent,
       annotations,

package/src/presentation/dto/checkout-token.test.ts

@@ -1,6 +1,12 @@
-import type {CheckoutSpec} from '@shipfox/api-integration-core';
 import {toCheckoutTokenDto} from './checkout-token.js';
 
+type CheckoutSpec = {
+  repositoryUrl: string;
+  ref: string;
+  credentials?: {username: string; token: string; expiresAt: Date};
+  gitAuthor?: {name: string; email: string};
+};
+
 describe('toCheckoutTokenDto', () => {
   it('maps credentials to basic auth with an ISO expiry', () => {
     const spec: CheckoutSpec = {

package/src/presentation/inter-module.ts

@@ -1,12 +1,8 @@
-import {
-  DEFAULT_HARNESS,
-  harnessSchema,
-  materializedAgentStepConfigSchema,
-} from '@shipfox/api-agent-dto';
+import {materializedAgentStepConfigSchema} from '@shipfox/api-agent-dto';
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
 import type {DefinitionsInterModuleClient} from '@shipfox/api-definitions-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {workflowsInterModuleContract} from '@shipfox/api-workflows-dto/inter-module';
@@ -15,6 +11,7 @@ import {
   defineInterModulePresentation,
   type InterModulePresentation,
 } from '@shipfox/inter-module';
+import {DEFAULT_HARNESS, harnessSchema} from '@shipfox/workflow-document';
 import {InvalidJobRunnerLabelsError} from '#core/errors.js';
 import {
   AgentConfigUnresolvableError,

package/src/presentation/routes/agent-runtime-config.test.ts

@@ -1,20 +1,11 @@
 import {
-  createAgentModule,
-  createCustomModelProviderConfig,
-  testAndSaveModelProviderConfig,
-} from '@shipfox/api-agent';
-import {resolveRuntimeCredentials} from '@shipfox/api-agent/core/resolve-runtime-credentials';
-import {agentInterModuleContract} from '@shipfox/api-agent-dto/inter-module';
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
+  type AgentInterModuleClient,
+  agentInterModuleContract,
+} from '@shipfox/api-agent-dto/inter-module';
 import type {WorkflowModel} from '@shipfox/api-definitions-dto';
-import {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';
 import {createInterModuleKnownError} from '@shipfox/inter-module';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
-import {
-  createInMemoryInterModuleTransport,
-  registerInterModulePresentations,
-} from '@shipfox/node-module/inter-module';
 import {eq} from 'drizzle-orm';
 import type {StepStatus} from '#core/entities/step.js';
 import {db} from '#db/db.js';
@@ -26,29 +17,39 @@ import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active
 import {resolveTestAgentDefaults} from '#test/fixtures/agent-inter-module.js';
 import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {fakeLeaseTokenAuthMethod, mintLeaseToken} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
 import {createLeaseTokenRouteGroup} from './index.js';
 
 const {captureExceptionMock} = vi.hoisted(() => ({captureExceptionMock: vi.fn()}));
-vi.mock('@shipfox/api-agent/core/resolve-runtime-credentials', async (importOriginal) => {
-  const actual =
-    await importOriginal<typeof import('@shipfox/api-agent/core/resolve-runtime-credentials')>();
-  return {...actual, resolveRuntimeCredentials: vi.fn(actual.resolveRuntimeCredentials)};
-});
 vi.mock('@shipfox/node-error-monitoring', () => ({captureException: captureExceptionMock}));
 
 const URL = '/runs/jobs/current/agent-runtime-config';
 const secrets = createTestSecretsClient();
-const agentTransport = createInMemoryInterModuleTransport();
-const agentTestClient = agentTransport.createClient(agentInterModuleContract);
-registerInterModulePresentations({
-  transport: agentTransport,
-  modules: [createAgentModule({secrets})],
-});
-agentTransport.seal();
+const runtimeConfigs = new Map<
+  string,
+  Awaited<ReturnType<AgentInterModuleClient['resolveRuntimeCredentials']>>
+>();
+const resolveRuntimeCredentials = vi.fn<AgentInterModuleClient['resolveRuntimeCredentials']>(
+  ({workspaceId}) => {
+    const runtimeConfig = runtimeConfigs.get(workspaceId);
+    if (runtimeConfig) return Promise.resolve(runtimeConfig);
+    return Promise.reject(
+      createInterModuleKnownError(
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'model-provider-not-configured',
+        {},
+      ),
+    );
+  },
+);
+const agentTestClient: AgentInterModuleClient = {
+  getValidationCatalog: vi.fn(),
+  resolveAgentConfig: vi.fn(),
+  resolveRuntimeCredentials,
+};
 
 describe('GET /runs/jobs/current/agent-runtime-config', () => {
   let app: FastifyInstance;
@@ -56,7 +57,7 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,
@@ -77,7 +78,8 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
   beforeEach(() => {
     clearLogLines();
     captureExceptionMock.mockReset();
-    vi.mocked(resolveRuntimeCredentials).mockClear();
+    runtimeConfigs.clear();
+    resolveRuntimeCredentials.mockClear();
   });
 
   afterAll(async () => {
@@ -91,38 +93,6 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
       expect(res.statusCode).toBe(401);
       expect(res.json().code).toBe('unauthorized');
     });
-
-    test('rejects an expired token', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        expiresIn: '-1s',
-      });
-
-      const res = await app.inject({
-        method: 'GET',
-        url: runtimeConfigUrl(crypto.randomUUID(), 1),
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-    });
-
-    test('rejects a token with the wrong audience', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        audience: 'user-session',
-      });
-
-      const res = await app.inject({
-        method: 'GET',
-        url: runtimeConfigUrl(crypto.randomUUID(), 1),
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-    });
   });
 
   test('returns decrypted runtime credentials for a running leased agent step', async () => {
@@ -193,67 +163,6 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
     expect(res.json().credentials.api_key).toBe('sk-gated-workspace-secret');
   });
 
-  test('returns custom provider descriptors for a running leased custom agent step', async () => {
-    const workspaceId = crypto.randomUUID();
-    await createCustomModelProviderConfig(
-      {
-        workspaceId,
-        body: {
-          slug: 'local-vllm',
-          display_name: 'Local vLLM',
-          api: 'openai-responses',
-          base_url: 'http://127.0.0.1:11434/v1',
-          api_key: 'sk-local-secret',
-          headers: [{name: 'authorization', value: 'Bearer local', secret: true}],
-          models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
-        },
-      },
-      {probe: async () => undefined, secrets},
-    );
-    const {job, step} = await createRunningAgentStep({
-      workspaceId,
-      resolveAgentDefaults: () => ({
-        harness: 'pi',
-        provider: 'local-vllm',
-        model: 'llama-3.1',
-        thinking: 'high',
-      }),
-      steps: [
-        {
-          provider: 'local-vllm',
-          model: 'llama-3.1',
-          thinking: 'high',
-          prompt: 'Fix the tests.',
-        },
-      ],
-    });
-    const token = await mintActiveLeaseToken({jobId: job.id});
-
-    const res = await app.inject({
-      method: 'GET',
-      url: runtimeConfigUrl(step.id, step.currentAttempt),
-      headers: {authorization: `Bearer ${token}`},
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toMatchObject({
-      harness: 'pi',
-      provider_id: 'local-vllm',
-      model: 'llama-3.1',
-      credentials: {
-        api_key: 'sk-local-secret',
-        'header:authorization': 'Bearer local',
-      },
-      custom_provider: {
-        api: 'openai-responses',
-        base_url: 'http://127.0.0.1:11434/v1',
-        secret_header_names: ['authorization'],
-        models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
-        requires_api_key: true,
-      },
-    });
-  });
-
   test('returns 404 when the lease token is no longer the active job lease', async () => {
     const {run, job, step} = await createRunningAgentStep();
     await insertRunningJobLease({
@@ -381,10 +290,10 @@ describe('GET /runs/jobs/current/agent-runtime-config', () => {
 
   test('returns 409 and reports when workspace credentials cannot be decrypted', async () => {
     const {job, step} = await createRunningAgentStep();
-    vi.mocked(resolveRuntimeCredentials).mockRejectedValueOnce(
+    resolveRuntimeCredentials.mockRejectedValueOnce(
       createInterModuleKnownError(
-        secretsInterModuleContract.methods.getSecretsByNamespace,
-        'secret-decryption-failed',
+        agentInterModuleContract.methods.resolveRuntimeCredentials,
+        'model-provider-credentials-invalid',
         {},
       ),
     );
@@ -430,15 +339,14 @@ function runtimeConfigUrl(stepId: string, attempt: number): string {
   return `${URL}?${search.toString()}`;
 }
 
-async function saveWorkspaceCredential(workspaceId: string, apiKey: string) {
-  return await testAndSaveModelProviderConfig(
-    {
-      workspaceId,
-      providerId: 'anthropic',
-      credentials: {api_key: apiKey},
-    },
-    {probe: async () => undefined, secrets},
-  );
+function saveWorkspaceCredential(workspaceId: string, apiKey: string): void {
+  runtimeConfigs.set(workspaceId, {
+    harness: 'pi',
+    provider_id: 'anthropic',
+    model: 'claude-opus-4-8',
+    thinking: 'xhigh',
+    credentials: {api_key: apiKey},
+  });
 }
 
 type TestStepInput =

package/src/presentation/routes/cancel-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';

package/src/presentation/routes/cancel-run.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {workflowRunDtoSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';

package/src/presentation/routes/checkout-token.test.ts

@@ -1,13 +1,12 @@
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
-import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import {integrationsInterModuleContract} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {createInterModuleKnownError} from '@shipfox/inter-module';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
 import {jobFactory} from '#test/factories/job.js';
 import {projectFactory} from '#test/factories/project.js';
 import {mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {fakeLeaseTokenAuthMethod, mintLeaseToken} from '#test/fixtures/lease-token.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createLeaseTokenRouteGroup} from './index.js';
 
@@ -29,7 +28,7 @@ describe('POST /runs/jobs/current/checkout-token', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: {} as never,
@@ -64,38 +63,6 @@ describe('POST /runs/jobs/current/checkout-token', () => {
       expect(res.statusCode).toBe(401);
       expect(res.json().code).toBe('unauthorized');
     });
-
-    test('rejects an expired token', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        expiresIn: '-1s',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-    });
-
-    test('rejects a token with the wrong audience', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        audience: 'user-session',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-    });
   });
 
   test('returns basic auth for a GitHub-style spec with credentials', async () => {

package/src/presentation/routes/checkout-token.ts

@@ -2,8 +2,8 @@ import {requireLeasedJobContext} from '@shipfox/api-auth-context';
 import {
   type IntegrationsModuleClient,
   integrationsInterModuleContract,
-} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {checkoutTokenResponseSchema} from '@shipfox/api-workflows-dto';
 import {isInterModuleKnownError} from '@shipfox/inter-module';

package/src/presentation/routes/get-run-aggregates.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
 import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';

package/src/presentation/routes/get-run-aggregates.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {
   workflowRunAggregatesQuerySchema,
   workflowRunAggregatesResponseSchema,

package/src/presentation/routes/get-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import {eq} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';

package/src/presentation/routes/get-run.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {workflowRunDetailResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';