@shipfox/api-workflows 7.1.0 → 9.0.1

package/src/presentation/routes/get-step-secrets.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
 import {eq} from 'drizzle-orm';
@@ -17,6 +16,7 @@ import {mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
 import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
+import {fakeLeaseTokenAuthMethod} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
@@ -31,7 +31,7 @@ describe('GET /runs/jobs/current/steps/:stepId/secrets', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,

package/src/presentation/routes/index.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
 import {
   AUTH_LEASED_JOB,
   AUTH_USER,
@@ -10,6 +9,7 @@ import type {FastifyRequest} from 'fastify';
 import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
+import {fakeLeaseTokenAuthMethod} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
@@ -50,7 +50,7 @@ describe('workflow route auth', () => {
 
   test('rejects API-key-only requests', async () => {
     const app = await createApp({
-      auth: [fakeUserAuth, createLeaseTokenAuthMethod()],
+      auth: [fakeUserAuth, fakeLeaseTokenAuthMethod],
       routes: workflowRoutes,
       swagger: false,
     });
@@ -71,7 +71,7 @@ describe('workflow route auth', () => {
 
   test('step routes reject requests without a lease token', async () => {
     const app = await createApp({
-      auth: [fakeUserAuth, createLeaseTokenAuthMethod()],
+      auth: [fakeUserAuth, fakeLeaseTokenAuthMethod],
       routes: workflowRoutes,
       swagger: false,
     });

package/src/presentation/routes/index.ts

@@ -2,8 +2,8 @@ import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
 import {AUTH_LEASED_JOB, AUTH_USER} from '@shipfox/api-auth-context';
 import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import type {RouteGroup} from '@shipfox/node-fastify';

package/src/presentation/routes/list-run-attempts.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';

package/src/presentation/routes/list-run-attempts.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {workflowRunAttemptsResponseSchema} from '@shipfox/api-workflows-dto';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';

package/src/presentation/routes/list-runs.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {encodeTimestampIdCursor} from '@shipfox/node-drizzle';
 import {eq} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';

package/src/presentation/routes/list-runs.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {
   workflowRunListQuerySchema,
   workflowRunListResponseSchema,

package/src/presentation/routes/next-step.test.ts

@@ -1,7 +1,6 @@
 import type {AnnotationsInterModuleClient} from '@shipfox/annotations-dto/inter-module';
-import {createLeaseTokenAuthMethod, verifyJobLeaseToken} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
-import {eq, sql} from 'drizzle-orm';
+import {eq} from 'drizzle-orm';
 import {JobNotFoundError} from '#core/errors.js';
 import {recordStepResult as recordJobExecutionStepResult} from '#core/job-execution.js';
 import {db} from '#db/db.js';
@@ -16,9 +15,16 @@ import {insertRunningJobLease, mintActiveLeaseToken} from '#test/fixtures/active
 import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {
+  fakeLeaseTokenAuthMethod,
+  getLeaseTokenClaims,
+  mintLeaseToken,
+} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
-import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {
+  runnersTestClient,
+  setRunnerToolCapabilities as setTestRunnerToolCapabilities,
+} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
 import {createLeaseTokenRouteGroup} from './index.js';
 
@@ -36,16 +42,11 @@ async function recordStepResult(
   return recordJobExecutionStepResult({...rest, jobExecutionId: step.jobExecutionId});
 }
 
-async function setRunnerToolCapabilities(
+function setRunnerToolCapabilities(
   runnerSessionId: string,
-  capabilities: Record<string, unknown>,
-): Promise<void> {
-  await db().execute(sql`
-    UPDATE runners_runner_sessions
-    SET tool_capabilities = ${JSON.stringify(capabilities)}::jsonb,
-      tool_capabilities_reported_at = now()
-    WHERE id = ${runnerSessionId}
-  `);
+  capabilities: {harnesses: {pi?: {tools: string[]}; claude?: {tools: string[]}}},
+): void {
+  setTestRunnerToolCapabilities(runnerSessionId, {capabilities, reportFresh: true});
 }
 
 const annotationWrites = vi.fn<AnnotationsInterModuleClient['replaceOrRemoveAnnotation']>();
@@ -58,7 +59,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,
@@ -108,62 +109,14 @@ describe('POST /runs/jobs/current/steps/next', () => {
       expect(res.statusCode).toBe(401);
       expect(res.json().code).toBe('unauthorized');
     });
-
-    test('rejects an expired token', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        expiresIn: '-1s',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
-
-    test('rejects a token signed with the wrong secret', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        secret: 'wrong-secret',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
-
-    test('rejects a token with the wrong audience (e.g. a user JWT)', async () => {
-      const token = await mintLeaseToken({
-        jobId: crypto.randomUUID(),
-        jobExecutionId: crypto.randomUUID(),
-        audience: 'user-session',
-      });
-
-      const res = await app.inject({
-        method: 'POST',
-        url: URL,
-        headers: {authorization: `Bearer ${token}`},
-      });
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json().code).toBe('unauthorized');
-    });
   });
 
   test('returns the lowest-position pending step and marks it running', async () => {
     const {jobId, steps} = await arrangeJobWithSteps(3);
     const token = await mintActiveLeaseToken({jobId});
+    const lease = getLeaseTokenClaims(token);
+    if (!lease) throw new Error('Expected minted lease token to verify');
+    const getLeaseState = vi.spyOn(runnersTestClient, 'getLeaseState');
 
     const res = await app.inject({
       method: 'POST',
@@ -172,12 +125,17 @@ describe('POST /runs/jobs/current/steps/next', () => {
     });
 
     expect(res.statusCode).toBe(200);
+    expect(getLeaseState).toHaveBeenCalledWith({
+      jobId: lease.jobId,
+      jobExecutionId: lease.jobExecutionId,
+      runnerSessionId: lease.runnerSessionId,
+    });
     const body = res.json();
     expect(body.kind).toBe('step');
     expect(body.step.id).toBe(steps[0]?.id);
     expect(body.step.status).toBe('running');
     expect(body.lease_token).toEqual(expect.any(String));
-    const scopedLease = await verifyJobLeaseToken(body.lease_token);
+    const scopedLease = getLeaseTokenClaims(body.lease_token);
     expect(scopedLease).toMatchObject({
       jobId,
       jobExecutionId: steps[0]?.jobExecutionId,
@@ -228,9 +186,9 @@ describe('POST /runs/jobs/current/steps/next', () => {
       })
       .where(eq(stepsTable.id, steps[0]?.id as string));
     const token = await mintActiveLeaseToken({jobId});
-    const lease = await verifyJobLeaseToken(token);
+    const lease = getLeaseTokenClaims(token);
     if (!lease) throw new Error('Expected minted lease token to verify');
-    await setRunnerToolCapabilities(lease.runnerSessionId, {harnesses: {pi: {tools: ['read']}}});
+    setRunnerToolCapabilities(lease.runnerSessionId, {harnesses: {pi: {tools: ['read']}}});
 
     const first = await app.inject({
       method: 'POST',
@@ -378,7 +336,7 @@ describe('POST /runs/jobs/current/steps/next', () => {
     expect(res.statusCode).toBe(200);
     const body = res.json();
     expect(body.attempt).toBe(2);
-    const scopedLease = await verifyJobLeaseToken(body.lease_token);
+    const scopedLease = getLeaseTokenClaims(body.lease_token);
     expect(scopedLease?.currentStepId).toBe(steps[0]?.id);
     expect(scopedLease?.currentStepAttempt).toBe(body.attempt);
   });

package/src/presentation/routes/next-step.ts

@@ -6,7 +6,7 @@ import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-modu
 import {nextStepResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {warnAgentToolCapabilityMismatchOnDispatch} from '#core/agent-tool-capability-warning.js';
-import {JobLeaseNotActiveError, JobNotFoundError} from '#core/errors.js';
+import {JobNotFoundError} from '#core/errors.js';
 import {nextStepForLeasedJobExecution} from '#core/job-execution.js';
 import {toStepDto} from '#presentation/dto/step.js';
 
@@ -30,17 +30,21 @@ export function createNextStepRoute(params: {
       if (error instanceof JobNotFoundError) {
         throw new ClientError(error.message, 'job-not-found', {status: 404});
       }
-      if (error instanceof JobLeaseNotActiveError) {
-        throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
-      }
       throw error;
     },
     handler: async (request) => {
       const leasedJob = requireLeasedJobContext(request);
-      const next = await nextStepForLeasedJobExecution({
+      const {active: leaseIsActive} = await params.runners.getLeaseState({
         jobId: leasedJob.jobId,
         jobExecutionId: leasedJob.jobExecutionId,
         runnerSessionId: leasedJob.runnerSessionId,
+      });
+      if (!leaseIsActive) {
+        throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
+      }
+
+      const next = await nextStepForLeasedJobExecution({
+        jobExecutionId: leasedJob.jobExecutionId,
         agent: params.agent,
       });
 

package/src/presentation/routes/project-access.ts

@@ -1,5 +1,5 @@
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 

package/src/presentation/routes/report-step.test.ts

@@ -1,4 +1,3 @@
-import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {nextStepForJob} from '#core/job-execution.js';
 import {
@@ -13,7 +12,7 @@ import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
 import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
 import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
 import {arrangeJobWithSteps} from '#test/fixtures/job-with-steps.js';
-import {mintLeaseToken} from '#test/fixtures/lease-token.js';
+import {fakeLeaseTokenAuthMethod, mintLeaseToken} from '#test/fixtures/lease-token.js';
 import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
 import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
 import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
@@ -32,7 +31,7 @@ describe('POST /runs/jobs/current/steps/:stepId/report', () => {
 
   beforeAll(async () => {
     app = await createApp({
-      auth: [createLeaseTokenAuthMethod()],
+      auth: [fakeLeaseTokenAuthMethod],
       routes: [
         createLeaseTokenRouteGroup({
           agent: agentTestClient,

package/src/presentation/routes/require-accessible-run.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 import type {WorkflowRun} from '#core/entities/workflow-run.js';

package/src/presentation/routes/rerun-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {ClientError} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';

package/src/presentation/routes/rerun-run.ts

@@ -1,5 +1,5 @@
 import {requireUserContext} from '@shipfox/api-auth-context';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {rerunWorkflowRunBodySchema, workflowRunResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';

package/src/temporal/activities/index.ts

@@ -1,6 +1,6 @@
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import type {SecretsInterModuleClient} from '@shipfox/api-secrets-dto/inter-module';
 import {

package/src/temporal/activities/orchestration-activities.ts

@@ -1,6 +1,6 @@
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
-import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto';
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {IntegrationsModuleClient} from '@shipfox/api-integration-core-dto/inter-module';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 import {
   type RunnersInterModuleClient,
   runnersInterModuleContract,

package/test/factories/workflow-model.ts

@@ -49,6 +49,7 @@ interface TestWorkflowJob {
   readonly success?: string | undefined;
   readonly outputs?: Readonly<Record<string, string>> | undefined;
   readonly env?: WorkflowModel['env'] | undefined;
+  readonly listening?: WorkflowModel['jobs'][number]['listening'] | undefined;
   readonly steps: readonly TestWorkflowStep[];
 }
 
@@ -70,7 +71,7 @@ export function workflowModel(input: TestWorkflowModelInput = {}): WorkflowModel
     return {
       id: jobId,
       key,
-      mode: 'one_shot' as const,
+      mode: job.listening === undefined ? ('one_shot' as const) : ('listening' as const),
       runner: normalizeStringArray(job.runner ?? input.runner ?? DEFAULT_RUNNER_LABELS),
       ...(job.runnerTemplates === undefined
         ? {}
@@ -90,6 +91,7 @@ export function workflowModel(input: TestWorkflowModelInput = {}): WorkflowModel
               {kind: 'literal' as const, value: job.name},
             ],
           }),
+      ...(job.listening === undefined ? {} : {listening: job.listening}),
       ...optionalScopedEnv(job.env),
       dependencies: normalizeStringArray(job.needs).map(stableId),
       steps: job.steps.map((step, stepIndex) => normalizeStep(step, jobId, stepIndex)),

package/test/fixtures/active-lease-token.ts

@@ -1,11 +1,10 @@
-import {db} from '#db/db.js';
-import {runnerSessions, runningJobExecutions} from '#db/runner-lease-table.js';
 import {
   getFirstJobExecutionByJobId,
   getJobById,
   getWorkflowRunByAttemptId,
 } from '#db/workflow-runs.js';
 import {mintLeaseToken} from './lease-token.js';
+import {registerActiveRunnerLease} from './runners-inter-module.js';
 
 export interface MintActiveLeaseTokenParams {
   jobId: string;
@@ -26,13 +25,9 @@ export async function mintActiveLeaseToken(params: MintActiveLeaseTokenParams):
   if (!run) throw new Error('Expected workflow run to exist');
   const runnerSessionId = crypto.randomUUID();
 
-  await insertRunningJobLease({
-    workspaceId: run.workspaceId,
-    workflowRunId: run.id,
-    workflowRunAttemptId: job.workflowRunAttemptId,
+  registerActiveRunnerLease({
     jobId: params.jobId,
     jobExecutionId: jobExecution.id,
-    projectId: run.projectId,
     runnerSessionId,
   });
 
@@ -57,29 +52,7 @@ export interface InsertRunningJobLeaseParams {
   runnerSessionId: string;
 }
 
-export async function insertRunningJobLease(params: InsertRunningJobLeaseParams): Promise<void> {
-  await db()
-    .insert(runnerSessions)
-    .values({
-      id: params.runnerSessionId,
-      workspaceId: params.workspaceId,
-      scope: 'workspace',
-      registrationTokenId: crypto.randomUUID(),
-      registrationTokenKind: 'manual',
-      labels: ['linux'],
-    });
-
-  await db()
-    .insert(runningJobExecutions)
-    .values({
-      workspaceId: params.workspaceId,
-      workflowRunId: params.workflowRunId,
-      workflowRunAttemptId: params.workflowRunAttemptId,
-      jobId: params.jobId,
-      jobExecutionId: params.jobExecutionId,
-      projectId: params.projectId,
-      runnerSessionId: params.runnerSessionId,
-      requiredLabels: ['linux'],
-      runnerLabels: ['linux'],
-    });
+export function insertRunningJobLease(params: InsertRunningJobLeaseParams): Promise<void> {
+  registerActiveRunnerLease(params);
+  return Promise.resolve();
 }

package/test/fixtures/agent-inter-module.ts

@@ -1,7 +1,38 @@
-import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
+import {
+  DEFAULT_HARNESS_TOOL_DEPLOYMENT_CONFIG,
+  listEnabledHarnessTools,
+  listHarnessDescriptors,
+  MODEL_PROVIDER_CATALOG_SEED,
+  MODEL_PROVIDER_IDS,
+} from '@shipfox/api-agent-dto';
+import type {
+  AgentInterModuleClient,
+  AgentValidationCatalog,
+} from '@shipfox/api-agent-dto/inter-module';
 import type {AgentDefaultsResolver} from '#core/agent-defaults.js';
 
+export const agentValidationCatalog: AgentValidationCatalog = {
+  version: 1,
+  providers: MODEL_PROVIDER_IDS.map((id) => ({
+    id,
+    support_status:
+      MODEL_PROVIDER_CATALOG_SEED.find((entry) => entry.id === id)?.support_status ?? 'unsupported',
+  })),
+  harnesses: listHarnessDescriptors().map((harness) => ({
+    id: harness.id,
+    supported_provider_ids: [...harness.supportedProviderIds],
+    thinking_levels: [...harness.thinkingLevels],
+    effective_tools: listEnabledHarnessTools(
+      harness.id,
+      DEFAULT_HARNESS_TOOL_DEPLOYMENT_CONFIG,
+    ).map((tool) => tool.name),
+  })),
+};
+
 export const agentTestClient: AgentInterModuleClient = {
+  getValidationCatalog() {
+    return Promise.resolve(agentValidationCatalog);
+  },
   resolveAgentConfig({config}) {
     return Promise.resolve(resolveTestAgentDefaults(config));
   },

package/test/fixtures/auth-inter-module.ts

@@ -1,22 +1,11 @@
-import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
 import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
-import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
-
-const leaseSecret = jobLeaseTokenKey();
+import {mintLeaseToken} from './lease-token.js';
 
 export const workflowsTestAuthClient: AuthInterModuleClient = {
   mintRunnerSessionToken() {
     throw new Error('Runner session token minting is not configured');
   },
   async mintJobLeaseToken(claims) {
-    return {
-      token: await signHs256({
-        payload: claims,
-        secret: leaseSecret,
-        expiresIn: '90m',
-        audience: JOB_LEASE_TOKEN_AUDIENCE,
-      }),
-    };
+    return {token: await mintLeaseToken(claims)};
   },
 };

package/test/fixtures/lease-token.ts

@@ -1,45 +1,59 @@
-import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
-import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
-import {signHs256} from '@shipfox/node-jwt';
+import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';
+import {JOB_LEASE_TOKEN_AUDIENCE, type JobLeaseTokenClaims} from '@shipfox/api-auth-dto';
+import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';
 import {getFirstJobExecutionByJobId} from '#db/workflow-runs.js';
 
-// Matches test/env.ts; the lease-token auth method reads this same value from config.
-const SECRET = jobLeaseTokenKey();
+const leaseClaims = new Map<string, JobLeaseTokenClaims>();
 
 export interface MintLeaseTokenParams {
   jobId: string;
   jobExecutionId?: string;
-  // Override informational claims to pair a job with chosen surrounding context.
   workflowRunId?: string;
   workflowRunAttemptId?: string;
   projectId?: string;
   workspaceId?: string;
   runnerSessionId?: string;
-  secret?: string;
-  expiresIn?: string;
-  audience?: string;
+  currentStepId?: string | undefined;
+  currentStepAttempt?: number | undefined;
 }
 
 export async function mintLeaseToken(params: MintLeaseTokenParams): Promise<string> {
-  let jobExecutionId = params.jobExecutionId;
-  if (jobExecutionId === undefined) {
-    const jobExecution = await getFirstJobExecutionByJobId(params.jobId);
-    if (!jobExecution) throw new Error('Expected job execution to exist');
-    jobExecutionId = jobExecution.id;
-  }
-
-  return signHs256({
-    payload: {
-      jobId: params.jobId,
-      jobExecutionId,
-      workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
-      workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
-      projectId: params.projectId ?? crypto.randomUUID(),
-      workspaceId: params.workspaceId ?? crypto.randomUUID(),
-      runnerSessionId: params.runnerSessionId ?? crypto.randomUUID(),
-    },
-    secret: params.secret ?? SECRET,
-    expiresIn: params.expiresIn ?? '90m',
-    audience: params.audience ?? JOB_LEASE_TOKEN_AUDIENCE,
+  const jobExecution =
+    params.jobExecutionId === undefined
+      ? await getFirstJobExecutionByJobId(params.jobId)
+      : undefined;
+  const jobExecutionId = params.jobExecutionId ?? jobExecution?.id;
+  if (!jobExecutionId) throw new Error('Expected job execution to exist');
+  const token = `test-auth-${crypto.randomUUID()}`;
+  leaseClaims.set(token, {
+    jobId: params.jobId,
+    jobExecutionId,
+    workflowRunId: params.workflowRunId ?? crypto.randomUUID(),
+    workflowRunAttemptId: params.workflowRunAttemptId ?? crypto.randomUUID(),
+    projectId: params.projectId ?? crypto.randomUUID(),
+    workspaceId: params.workspaceId ?? crypto.randomUUID(),
+    runnerSessionId: params.runnerSessionId ?? crypto.randomUUID(),
+    ...(params.currentStepId && params.currentStepAttempt !== undefined
+      ? {currentStepId: params.currentStepId, currentStepAttempt: params.currentStepAttempt}
+      : {}),
+    aud: JOB_LEASE_TOKEN_AUDIENCE,
+    iat: 0,
+    exp: Number.MAX_SAFE_INTEGER,
   });
+  return token;
+}
+
+export function getLeaseTokenClaims(token: string): JobLeaseTokenClaims | undefined {
+  return leaseClaims.get(token);
 }
+
+export const fakeLeaseTokenAuthMethod: AuthMethod = {
+  name: AUTH_LEASED_JOB,
+  authenticate: (request) => {
+    const token = extractBearerToken(request.headers.authorization);
+    const claims = token ? leaseClaims.get(token) : undefined;
+    if (!claims) throw new ClientError('Authentication required', 'unauthorized', {status: 401});
+    setLeasedJobContext(request, claims);
+    return Promise.resolve();
+  },
+};

package/test/fixtures/projects-inter-module.ts

@@ -1,4 +1,4 @@
-import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto/inter-module';
 
 export const projectsTestClient = {
   getProjectById: async () => ({project: undefined}),