@defrex/autobuild-postgres-store 0.12.0 → 0.14.0

package/src/store.ts

@@ -1,3 +1,17 @@
+import { readPersistedBuildDigests } from '@defrex/autobuild/store-adapter'
+import { assertPublicSnapshotReducer } from '@defrex/autobuild/store-adapter'
+import {
+  readReducerValue,
+  resolveReducerValue,
+  type ReducerValueRequest,
+  type ReducerValue,
+} from '@defrex/autobuild/store-adapter'
+import { validateTickFinish } from '@defrex/autobuild/store-adapter'
+import type {
+  RepoTickCompletion,
+  RepoTickFinish,
+  RepoTickObservation,
+} from '@defrex/autobuild/store-adapter'
 import { SQL } from 'bun'
 import {
   contentHash,
@@ -74,12 +88,9 @@ import {
   revisionsToPrune,
 } from '@defrex/autobuild/store-adapter'
 import {
-  DIGEST_EVENT_TYPES,
-  type DigestEventRow,
   REPOSITORY_STATE_EVENT_TYPES,
   REPOSITORY_LATEST_EVENT_TYPES,
   readRepoStateEventsWithAnchorRecheck,
-  reduceBuildDigest,
 } from '@defrex/autobuild/store-adapter'
 import {
   DEFAULT_TICKET_ASSET_LIMITS,
@@ -214,6 +225,7 @@ export class PostgresBuildStore implements BuildStore {
 
   private repoRecord(row: Row): RepositoryRecord {
     return {
+      ...(row.tick ? { tick: structuredClone(row.tick) as RepoTickObservation } : {}),
       repo: String(row.repo),
       createdAt: iso(row.created_at),
       updatedAt: iso(row.updated_at),
@@ -248,72 +260,58 @@ export class PostgresBuildStore implements BuildStore {
         ON CONFLICT (slug) DO NOTHING RETURNING slug`
       const row = await this.lockBuild(q, input.slug)
       if (!inserted[0]) throw new Error(`build "${input.slug}" already exists`)
-      if (created === undefined) return this.record(row)
+      if (created === undefined) return this.currentRecord(q, row)
       await this.appendLocked(q, input.slug, created, true)
-      return this.record(await this.lockBuild(q, input.slug))
+      return this.currentRecord(q, await this.lockBuild(q, input.slug))
     })
   }
 
+  /** Current ticket identity is a read projection; event/artifact bytes remain historical. */
+  private async currentRecord(q: Exec, row: Row): Promise<BuildRecord> {
+    const record = this.record(row)
+    if (record.ticket?.source !== 'hosted') return record
+    const ticket = await this.hostedTicketRow(q, record.repo, record.ticket.id)
+    const id = ticket?.readable_id
+    return id ? { ...record, ticket: { ...record.ticket, id: String(id) } } : record
+  }
+
   async getBuild(slug: string): Promise<BuildRecord | null> {
     return this.run(async (q) => {
       const rows: Row[] = await q`SELECT * FROM builds WHERE slug = ${slug}`
-      return rows[0] ? this.record(rows[0]) : null
+      return rows[0] ? this.currentRecord(q, rows[0]) : null
     })
   }
 
   async listBuilds(): Promise<BuildRecord[]> {
     return this.run(async (q) => {
-      const rows: Row[] = await q`SELECT * FROM builds ORDER BY created_at, slug`
-      return rows.map((row) => this.record(row))
+      if (!(await this.hasReadableTicketSchema(q))) {
+        const rows: Row[] = await q`SELECT * FROM builds ORDER BY created_at, slug`
+        return rows.map((row) => this.record(row))
+      }
+      const rows: Row[] = await q`SELECT b.*, t.readable_id AS projected_ticket_id FROM builds b
+        LEFT JOIN LATERAL (
+          SELECT readable_id FROM ab_tickets
+          WHERE b.ticket->>'source' = 'hosted' AND repo = b.repo
+            AND (id = b.ticket->>'id' OR lower(readable_id) = lower(b.ticket->>'id'))
+          LIMIT 1
+        ) t ON true
+        ORDER BY b.created_at, b.slug`
+      return rows.map((row) => {
+        const record = this.record(row)
+        return record.ticket && row.projected_ticket_id
+          ? { ...record, ticket: { ...record.ticket, id: String(row.projected_ticket_id) } }
+          : record
+      })
     })
   }
 
   async getRepoBuildDigests(repo: string): Promise<Map<string, BuildDigest>> {
-    // From the builds side (AUT-487), matching the SQLite adapter: the type
-    // filter lives in the ON clause so a build whose log holds none of the
-    // digest-relevant event types still yields its row, and only those
-    // types are fetched. The `events_type_build_seq` index (schema.ts) makes
-    // the join's per-build probes type-leading, so the cost grows with the
-    // actual signal, not with total history.
-    const rows: Row[] = await this.run((q) =>
-      q.unsafe(
-        `SELECT b.slug AS slug, e.seq AS seq, e.ts AS ts, e.type AS type,
-              CASE WHEN e.type = 'pr-attachment.reclaimed'
-                THEN (e.payload->>'hostedSeq')::bigint END AS "hostedSeq",
-              CASE WHEN e.type IN ('execution.started', 'execution.ended')
-                THEN e.payload->>'instance' END AS instance
-       FROM builds b
-       LEFT JOIN events e
-         ON e.build = b.slug AND e.type IN (${DIGEST_EVENT_TYPES.map((_, i) => `$${i + 2}`).join(', ')})
-       WHERE b.repo = $1
-       ORDER BY b.slug, e.seq`,
-        [repo, ...DIGEST_EVENT_TYPES],
-      ),
-    )
-    const eventsByBuild = new Map<string, DigestEventRow[]>()
-    for (const row of rows) {
-      if (row.seq === null || row.seq === undefined) continue
-      const events = eventsByBuild.get(String(row.slug)) ?? []
-      events.push({
-        type: String(row.type) as AbEvent['type'],
-        seq: num(row.seq),
-        ts: iso(row.ts),
-        ...(row.hostedSeq !== null && row.hostedSeq !== undefined
-          ? { hostedSeq: num(row.hostedSeq) }
-          : {}),
-        ...(row.instance !== null && row.instance !== undefined
-          ? { instance: String(row.instance) }
-          : {}),
-      })
-      eventsByBuild.set(String(row.slug), events)
-    }
-    const digests = new Map<string, BuildDigest>()
-    for (const row of rows) {
-      const slug = String(row.slug)
-      if (digests.has(slug)) continue
-      digests.set(slug, { slug, ...reduceBuildDigest(eventsByBuild.get(slug) ?? []) })
-    }
-    return digests
+    const records = await this.run(async (q) => {
+      const rows: Row[] =
+        await q`SELECT * FROM builds WHERE repo = ${repo} ORDER BY created_at, slug`
+      return rows.map((row) => this.record(row))
+    })
+    return readPersistedBuildDigests(this, repo, records)
   }
 
   private async appendLocked(
@@ -561,6 +559,59 @@ export class PostgresBuildStore implements BuildStore {
   async claimLease(slug: string, holder: string, ttlMs: number): Promise<boolean> {
     return this.claim('builds', slug, holder, ttlMs)
   }
+  async beginRepoTick(repo: string, holder: string): Promise<string | null> {
+    return this.tx(async (q) => {
+      const row = await this.lockRepo(q, repo)
+      if (
+        row.lease_holder !== holder ||
+        !row.lease_expires_at ||
+        Date.parse(iso(row.lease_expires_at)) <= this.clock().getTime()
+      )
+        return null
+      const startedAt = this.now()
+      const previous = row.tick as RepoTickObservation | undefined
+      const tick: RepoTickObservation = {
+        run: holder,
+        open: { startedAt },
+        ...(previous?.finished ? { finished: previous.finished } : {}),
+      }
+      await q`UPDATE repo_streams SET tick=${tick}, updated_at=${startedAt} WHERE repo=${repo}`
+      return startedAt
+    })
+  }
+
+  async finishRepoTick(
+    repo: string,
+    holder: string,
+    completion: RepoTickCompletion,
+    events: RepositoryEventWrite[],
+  ): Promise<RepoTickFinish | null> {
+    const validated = validateTickFinish(holder, completion, events)
+    return this.tx(async (q) => {
+      const row = await this.lockRepo(q, repo)
+      if (
+        row.lease_holder !== holder ||
+        !row.lease_expires_at ||
+        Date.parse(iso(row.lease_expires_at)) <= this.clock().getTime()
+      )
+        return null
+      const previous = row.tick as RepoTickObservation | undefined
+      if (previous?.run !== holder || !previous.open) throw new Error('no open repository tick')
+      const completedAt = this.now()
+      const envelopes: RepositoryEvent[] = []
+      for (const event of validated)
+        envelopes.push(
+          (await this.appendRepoLocked(q, repo, event, true, completedAt)) as RepositoryEvent,
+        )
+      const observation: RepoTickObservation = {
+        run: holder,
+        finished: { ...completion, run: holder, startedAt: previous.open.startedAt, completedAt },
+      }
+      await q`UPDATE repo_streams SET tick=${observation}, updated_at=${completedAt} WHERE repo=${repo}`
+      return { observation, events: envelopes }
+    })
+  }
+
   async claimRepoLease(repo: string, holder: string, ttlMs: number): Promise<boolean> {
     return this.claim('repo_streams', repo, holder, ttlMs)
   }
@@ -883,12 +934,12 @@ export class PostgresBuildStore implements BuildStore {
     repo: string,
     event: RepositoryEventWrite,
     alreadyLocked = false,
+    ts = this.now(),
   ): Promise<RepositoryEventEnvelope> {
     if (!alreadyLocked) await this.lockRepo(q, repo)
     const tails: Row[] =
       await q`SELECT COALESCE(MAX(seq), 0) AS seq FROM repo_events WHERE repo=${repo}`
     const seq = num(tails[0]?.seq) + 1
-    const ts = this.now()
     await q`INSERT INTO repo_events (repo, seq, ts, actor, type, payload) VALUES (${repo},${seq},${ts},${event.actor},${event.type},${event.payload})`
     await q`UPDATE repo_streams SET updated_at=${ts} WHERE repo=${repo}`
     return { repo, seq, ts, actor: event.actor, type: event.type, payload: event.payload }
@@ -1007,11 +1058,90 @@ export class PostgresBuildStore implements BuildStore {
     return code === '42P01'
   }
 
+  async getReducerValue(scope: SnapshotScope, request: ReducerValueRequest): Promise<ReducerValue> {
+    // Reject invalid requests before touching storage.
+    resolveReducerValue(scope, request)
+    return readReducerValue(scope, request, {
+      highWater: async () => {
+        const tail = await this.valueTail(scope)
+        if (tail === undefined) throw new Error('unknown reducer scope')
+        return tail
+      },
+      events: async (since, through) => {
+        const key = scope.kind === 'build' ? scope.slug : scope.repo
+        const rows: Row[] =
+          scope.kind === 'build'
+            ? await this.run(
+                (q) =>
+                  q`SELECT * FROM events WHERE build=${key} AND seq>${since} AND seq<=${through} ORDER BY seq`,
+              )
+            : await this.run(
+                (q) =>
+                  q`SELECT * FROM repo_events WHERE repo=${key} AND seq>${since} AND seq<=${through} ORDER BY seq`,
+              )
+        return rows.map((row) => ({
+          ...(scope.kind === 'build' ? { build: key } : { repo: key }),
+          seq: num(row.seq),
+          ts: iso(row.ts),
+          actor: json(row.actor),
+          type: String(row.type),
+          payload: json(row.payload),
+        })) as (AbEvent | RepositoryEvent)[]
+      },
+      put: (key, snapshot) => this.putSnapshot(scope, key, snapshot),
+      read: async (key) => {
+        const scopeKey = scope.kind === 'build' ? scope.slug : scope.repo
+        const rows: Row[] = await this.run(
+          (q) =>
+            q`SELECT version, cursor, state, state::text AS raw FROM reducer_snapshots WHERE scope_kind=${scope.kind} AND scope_key=${scopeKey} AND reducer=${key}`,
+        )
+        const row = rows[0]
+        if (!row) return null
+        let state: unknown = null
+        try {
+          state = json(row.state)
+        } catch {
+          /* malformed JSON cache string */
+        }
+        return {
+          snapshot: { version: num(row.version), cursor: num(row.cursor), state },
+          token: String(row.raw),
+        }
+      },
+      repair: async (key, observed, snapshot) => {
+        const scopeKey = scope.kind === 'build' ? scope.slug : scope.repo
+        const rows: Row[] = await this.run(
+          (q) =>
+            q`UPDATE reducer_snapshots SET version=${snapshot.version}::integer, cursor=${snapshot.cursor}::bigint, state=${JSON.stringify(snapshot.state)}::jsonb, updated_at=${this.now()}::timestamptz WHERE scope_kind=${scope.kind} AND scope_key=${scopeKey} AND reducer=${key} AND version=${observed.snapshot.version}::integer AND cursor=${observed.snapshot.cursor}::bigint AND state::text=${observed.token}
+          AND (${observed.snapshot.cursor}::bigint <= ${snapshot.cursor}::bigint OR ${observed.snapshot.cursor}::bigint > CASE WHEN ${scope.kind}='build' THEN COALESCE((SELECT MAX(seq) FROM events WHERE build=${scopeKey}),0) ELSE COALESCE((SELECT MAX(seq) FROM repo_events WHERE repo=${scopeKey}),0) END)
+          AND ${snapshot.cursor}::bigint <= CASE WHEN ${scope.kind}='build' THEN COALESCE((SELECT MAX(seq) FROM events WHERE build=${scopeKey}),0) ELSE COALESCE((SELECT MAX(seq) FROM repo_events WHERE repo=${scopeKey}),0) END RETURNING 1`,
+        )
+        return rows.length > 0
+      },
+    })
+  }
+
+  private async valueTail(scope: SnapshotScope): Promise<number | undefined> {
+    const key = scope.kind === 'build' ? scope.slug : scope.repo
+    const rows: Row[] =
+      scope.kind === 'build'
+        ? await this.run(
+            (q) =>
+              q`SELECT (SELECT COALESCE(MAX(seq),0) FROM events WHERE build=${key}) AS tail FROM builds WHERE slug=${key}`,
+          )
+        : await this.run(
+            (q) =>
+              q`SELECT (SELECT COALESCE(MAX(seq),0) FROM repo_events WHERE repo=${key}) AS tail FROM repo_streams WHERE repo=${key}`,
+          )
+    return rows[0] ? num(rows[0].tail) : undefined
+  }
+
   async getReducerSnapshot(
     scope: SnapshotScope,
     reducer: string,
     version: number,
   ): Promise<ReducerSnapshot | null> {
+    assertPublicSnapshotReducer(reducer)
     const key = scope.kind === 'build' ? scope.slug : scope.repo
     try {
       const rows: Row[] = await this.run(
@@ -1038,6 +1168,15 @@ export class PostgresBuildStore implements BuildStore {
     scope: SnapshotScope,
     reducer: string,
     snapshot: ReducerSnapshot,
+  ): Promise<boolean> {
+    assertPublicSnapshotReducer(reducer)
+    return this.putSnapshot(scope, reducer, snapshot)
+  }
+
+  private async putSnapshot(
+    scope: SnapshotScope,
+    reducer: string,
+    snapshot: ReducerSnapshot,
   ): Promise<boolean> {
     const key = scope.kind === 'build' ? scope.slug : scope.repo
     const state = JSON.stringify(snapshot.state ?? null)
@@ -1209,6 +1348,39 @@ export class PostgresBuildStore implements BuildStore {
     }
   }
 
+  private readableTicketSchema = false
+
+  /** Ticket tables are an independently migrated, optional store extension. */
+  private async hasReadableTicketSchema(q: Exec): Promise<boolean> {
+    if (!this.readableTicketSchema) {
+      const tables: Row[] = await q`SELECT to_regclass('ab_ticket_schema_migrations') AS tickets`
+      if (!tables[0]?.tickets) return false
+      const markers: Row[] =
+        await q`SELECT version FROM ab_ticket_schema_migrations WHERE singleton = true`
+      if (Number(markers[0]?.version ?? 0) < 3) return false
+      // Cache only presence: a store opened before migration must discover a later upgrade.
+      this.readableTicketSchema = true
+    }
+    return true
+  }
+
+  private async hostedTicketRow(q: Exec, repo: string, id: string): Promise<Row | undefined> {
+    if (!(await this.hasReadableTicketSchema(q))) return undefined
+    const rows: Row[] = await q`SELECT id, readable_id FROM ab_tickets
+      WHERE repo = ${repo} AND (id = ${id} OR lower(readable_id) = lower(${id}))`
+    return rows[0]
+  }
+
+  private async currentAssetMeta(q: Exec, row: Row): Promise<TicketAssetMeta> {
+    const meta = this.ticketAssetMeta(row)
+    const ticket = await this.hostedTicketRow(q, meta.repo, meta.ticketId)
+    return ticket?.readable_id ? { ...meta, ticketId: String(ticket.readable_id) } : meta
+  }
+
+  private async ticketStorageKey(q: Exec, repo: string, id: string): Promise<string> {
+    return String((await this.hostedTicketRow(q, repo, id))?.id ?? id)
+  }
+
   async putTicketAsset(
     repo: string,
     ticketId: string,
@@ -1218,16 +1390,28 @@ export class PostgresBuildStore implements BuildStore {
     const entries = await storeTicketAssetBlobs(this.blobs, asset.entries)
     const manifest = JSON.stringify(entries)
     return this.tx(async (q) => {
+      const key = await this.ticketStorageKey(q, repo, ticketId)
       // Serialize revision assignment per (repo, ticket, kind, name).
-      await q`SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([repo, ticketId, asset.kind, asset.name])}, 0))`
+      await q`SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([repo, key, asset.kind, asset.name])}, 0))`
       const tails: Row[] =
-        await q`SELECT COALESCE(MAX(revision), -1) AS revision FROM ticket_assets WHERE repo=${repo} AND ticket_id=${ticketId} AND kind=${asset.kind} AND name=${asset.name}`
+        await q`SELECT COALESCE(MAX(revision), -1) AS revision FROM ticket_assets WHERE repo=${repo} AND ticket_id=${key} AND kind=${asset.kind} AND name=${asset.name}`
       const revision = num(tails[0]?.revision) + 1
       const createdAt = this.now()
-      await q`INSERT INTO ticket_assets (repo,ticket_id,kind,name,revision,layout,manifest,size,removed,created_at) VALUES (${repo},${ticketId},${asset.kind},${asset.name},${revision},${asset.layout},${manifest}::jsonb,${size},false,${createdAt})`
+      await q`INSERT INTO ticket_assets (repo,ticket_id,kind,name,revision,layout,manifest,size,removed,created_at) VALUES (${repo},${key},${asset.kind},${asset.name},${revision},${asset.layout},${manifest}::jsonb,${size},false,${createdAt})`
+      const display = await this.currentAssetMeta(q, {
+        repo,
+        ticket_id: key,
+        kind: asset.kind,
+        name: asset.name,
+        revision,
+        layout: asset.layout,
+        size,
+        manifest: entries,
+        created_at: createdAt,
+      })
       return {
         repo,
-        ticketId,
+        ticketId: display.ticketId,
         kind: asset.kind,
         name: asset.name,
         revision,
@@ -1246,14 +1430,15 @@ export class PostgresBuildStore implements BuildStore {
     name: string,
     rev?: number,
   ): Promise<TicketAsset | null> {
-    const rows: Row[] = await this.run((q) =>
-      rev === undefined
-        ? q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${ticketId} AND kind=${kind} AND name=${name} ORDER BY revision DESC LIMIT 1`
-        : q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${ticketId} AND kind=${kind} AND name=${name} AND revision=${rev}`,
-    )
+    const rows: Row[] = await this.run(async (q) => {
+      const key = await this.ticketStorageKey(q, repo, ticketId)
+      return rev === undefined
+        ? q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${key} AND kind=${kind} AND name=${name} ORDER BY revision DESC LIMIT 1`
+        : q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${key} AND kind=${kind} AND name=${name} AND revision=${rev}`
+    })
     const row = rows[0]
     if (!row || row.removed === true) return null
-    return loadTicketAsset(this.blobs, this.ticketAssetMeta(row))
+    return loadTicketAsset(this.blobs, await this.run((q) => this.currentAssetMeta(q, row)))
   }
 
   async getPinnedTicketAsset(
@@ -1270,10 +1455,15 @@ export class PostgresBuildStore implements BuildStore {
     ticketId: string,
     opts?: { revisions?: boolean },
   ): Promise<TicketAssetSummary[]> {
-    const rows: Row[] = await this.run(
-      (q) =>
-        q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${ticketId} ORDER BY kind, name, revision`,
-    )
+    const rows: Row[] = await this.run(async (q) => {
+      const key = await this.ticketStorageKey(q, repo, ticketId)
+      const rows: Row[] =
+        await q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${key} ORDER BY kind, name, revision`
+      const projected: Row[] = []
+      for (const row of rows)
+        projected.push({ ...row, ticket_id: (await this.currentAssetMeta(q, row)).ticketId })
+      return projected
+    })
     if (opts?.revisions) {
       return rows
         .filter((row) => row.removed !== true)
@@ -1293,13 +1483,14 @@ export class PostgresBuildStore implements BuildStore {
     name: string,
   ): Promise<TicketAssetMeta | null> {
     return this.tx(async (q) => {
-      await q`SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([repo, ticketId, kind, name])}, 0))`
+      const key = await this.ticketStorageKey(q, repo, ticketId)
+      await q`SELECT pg_advisory_xact_lock(hashtextextended(${JSON.stringify([repo, key, kind, name])}, 0))`
       const rows: Row[] =
-        await q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${ticketId} AND kind=${kind} AND name=${name} ORDER BY revision DESC LIMIT 1`
+        await q`SELECT * FROM ticket_assets WHERE repo=${repo} AND ticket_id=${key} AND kind=${kind} AND name=${name} ORDER BY revision DESC LIMIT 1`
       const latest = rows[0]
       if (!latest || latest.removed === true) return null
-      await q`INSERT INTO ticket_assets (repo,ticket_id,kind,name,revision,layout,manifest,size,removed,created_at) VALUES (${repo},${ticketId},${kind},${name},${num(latest.revision) + 1},${String(latest.layout)},${'[]'}::jsonb,0,true,${this.now()})`
-      return this.ticketAssetMeta(latest)
+      await q`INSERT INTO ticket_assets (repo,ticket_id,kind,name,revision,layout,manifest,size,removed,created_at) VALUES (${repo},${key},${kind},${name},${num(latest.revision) + 1},${String(latest.layout)},${'[]'}::jsonb,0,true,${this.now()})`
+      return this.currentAssetMeta(q, latest)
     })
   }
 

package/src/ticket-grants.ts

@@ -0,0 +1,86 @@
+import { createHash, randomBytes } from 'node:crypto'
+import type { SQL } from 'bun'
+
+export interface TicketGrant {
+  id: string
+  repo: string
+  execution: string
+  kind: 'runner' | 'phase'
+  parent: string | null
+  expiresAt: string
+}
+export interface TicketGrantStore {
+  authenticate(token: string, now: Date): Promise<TicketGrant | null>
+  issue(
+    repo: string,
+    execution: string,
+    kind: 'runner' | 'phase',
+    parent: TicketGrant | null,
+    now: Date,
+  ): Promise<{ token: string; grant: TicketGrant }>
+  revoke(id: string, repo: string): Promise<void>
+  renew(id: string, repo: string, now: Date): Promise<void>
+}
+const digest = (token: string) => createHash('sha256').update(token).digest('hex')
+const ttl = 5 * 60_000
+export class PostgresTicketGrantStore implements TicketGrantStore {
+  constructor(private readonly sql: SQL) {}
+  async authenticate(token: string, now: Date): Promise<TicketGrant | null> {
+    const [row] = await this.sql`SELECT g.* FROM ticket_grants g JOIN LATERAL
+      (SELECT seq, action FROM project_journal WHERE repo = g.repo ORDER BY seq DESC LIMIT 1) r
+      ON r.seq = g.registration AND r.action = 'added'
+      WHERE g.digest = ${digest(token)} AND g.revoked_at IS NULL AND g.expires_at > ${now.toISOString()}
+      AND (g.parent IS NULL OR EXISTS (SELECT 1 FROM ticket_grants p WHERE p.id = g.parent
+        AND p.revoked_at IS NULL AND p.expires_at > ${now.toISOString()} AND p.registration = g.registration))`
+    return row
+      ? {
+          id: row.id,
+          repo: row.repo,
+          execution: row.execution,
+          kind: row.kind,
+          parent: row.parent,
+          expiresAt: new Date(row.expires_at).toISOString(),
+        }
+      : null
+  }
+  async issue(
+    repo: string,
+    execution: string,
+    kind: 'runner' | 'phase',
+    parent: TicketGrant | null,
+    now: Date,
+  ) {
+    if (
+      (kind === 'phase' &&
+        (parent?.kind !== 'runner' || parent.repo !== repo || parent.execution !== execution)) ||
+      (kind === 'runner' && parent)
+    )
+      throw new Error('invalid ticket grant parent')
+    const id = randomBytes(16).toString('hex')
+    const token = `abt_${randomBytes(32).toString('hex')}`
+    const expiresAt = new Date(
+      Math.min(now.getTime() + ttl, parent ? Date.parse(parent.expiresAt) : Infinity),
+    ).toISOString()
+    const rows = await this
+      .sql`INSERT INTO ticket_grants (id, digest, repo, registration, execution, kind, parent, expires_at)
+      SELECT ${id}, ${digest(token)}, ${repo}, r.seq, ${execution}, ${kind}, ${parent?.id ?? null}, ${expiresAt}
+      FROM (SELECT seq, action FROM project_journal WHERE repo = ${repo} ORDER BY seq DESC LIMIT 1) r
+      WHERE r.action = 'added' AND (${parent?.id ?? null}::text IS NULL OR EXISTS
+        (SELECT 1 FROM ticket_grants p WHERE p.id = ${parent?.id ?? null} AND p.registration = r.seq
+          AND p.revoked_at IS NULL AND p.expires_at > ${now.toISOString()})) RETURNING id`
+    if (!rows.length) throw new Error('project or parent grant is no longer active')
+    return { token, grant: { id, repo, execution, kind, parent: parent?.id ?? null, expiresAt } }
+  }
+  async revoke(id: string, repo: string) {
+    await this
+      .sql`UPDATE ticket_grants SET revoked_at = COALESCE(revoked_at, ${new Date().toISOString()}) WHERE id = ${id} AND repo = ${repo}`
+  }
+  async renew(id: string, repo: string, now: Date) {
+    await this.sql`WITH renewed AS (
+      UPDATE ticket_grants SET expires_at = ${new Date(now.getTime() + ttl).toISOString()}
+      WHERE id = ${id} AND repo = ${repo} AND kind = 'runner' AND revoked_at IS NULL AND expires_at > ${now.toISOString()}
+      RETURNING id, expires_at)
+      UPDATE ticket_grants SET expires_at = renewed.expires_at FROM renewed
+      WHERE ticket_grants.parent = renewed.id AND ticket_grants.revoked_at IS NULL`
+  }
+}