@relaycast/engine 8.2.2 → 8.3.1

package/dist/engine/node.d.ts

@@ -35,6 +35,7 @@ declare function publicNode(row: NodeRow): {
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {
@@ -58,6 +59,7 @@ declare function publicNode(row: NodeRow): {
 export declare function createNodeToken(db: Db, workspaceId: string, data: {
     node_id?: string;
     name: string;
+    machine_id?: string;
     kind?: NodeKind;
     role?: NodeRole;
     delivery_adapter?: string;
@@ -72,6 +74,7 @@ export declare function createNodeToken(db: Db, workspaceId: string, data: {
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {
@@ -119,6 +122,7 @@ export declare function getNodeByTokenHash(db: Db, tokenHash: string): Promise<{
     load: number;
     loadReported: boolean;
     lastHeartbeatAt: Date | null;
+    provenLiveAt: Date | null;
     createdAt: Date;
 }>;
 export declare function getNodeByName(db: Db, workspaceId: string, name: string): Promise<{
@@ -148,6 +152,7 @@ export declare function getNodeByName(db: Db, workspaceId: string, name: string)
     load: number;
     loadReported: boolean;
     lastHeartbeatAt: Date | null;
+    provenLiveAt: Date | null;
     createdAt: Date;
 }>;
 export declare function getNodeById(db: Db, workspaceId: string, nodeId: string): Promise<{
@@ -177,15 +182,102 @@ export declare function getNodeById(db: Db, workspaceId: string, nodeId: string)
     load: number;
     loadReported: boolean;
     lastHeartbeatAt: Date | null;
+    provenLiveAt: Date | null;
     createdAt: Date;
 }>;
+/**
+ * The broker a machine already has on the roster and is no longer running.
+ *
+ * Scoped to `broker` deliberately: a broker is the node-of-many fleet host and
+ * a machine runs one, so machine_id identifies it. A `direct` node is a
+ * node-of-one delivery host and a single machine legitimately runs many of
+ * them, so machine_id is not a key there and must never collapse them.
+ *
+ * A LIVE incumbent is never returned. Adopting one would rename a running
+ * broker and rotate its token out from under it — the caller cannot be that
+ * host coming back, because that host has not left. Only a node that is gone
+ * can be the one re-enrolling. Skipping the live row lets the caller fall
+ * through to a new node instead, which is the right answer for the legitimate
+ * duplicate too: a VM cloned from a snapshot, or containers baked from one
+ * image, carry the same machine_id and run CONCURRENTLY, so they are genuinely
+ * separate nodes. Declining the match costs an extra roster row; rejecting the
+ * enrollment outright would break a whole fleet booted from one image.
+ *
+ * Ordered oldest-first so a roster that already holds several rows for one
+ * machine converges onto its earliest reusable row instead of picking
+ * arbitrarily.
+ */
+export declare function getBrokerNodeByMachineId(db: Db, workspaceId: string, machineId: string): Promise<{
+    id: string;
+    workspaceId: string;
+    name: string;
+    tokenHash: string;
+    machineId: string | null;
+    kind: string;
+    role: string;
+    deliveryAdapter: string;
+    deliveryConfig: Record<string, unknown> | null;
+    capabilities: {
+        name: string;
+        kind?: string | undefined;
+        global?: boolean | undefined;
+        queue?: boolean | undefined;
+        metadata?: Record<string, import("@relaycast/types").FleetWireJsonValue> | undefined;
+    }[];
+    maxAgents: number;
+    activeAgents: number;
+    reservedAgents: number;
+    tags: string[];
+    version: string;
+    status: string;
+    handlersLive: boolean;
+    load: number;
+    loadReported: boolean;
+    lastHeartbeatAt: Date | null;
+    provenLiveAt: Date | null;
+    createdAt: Date;
+} | null>;
+/**
+ * The role an enroll is asking for, derived from the request alone.
+ *
+ * Enrollment's role default depends on `kind` (`ws` is a broker; `http_push`
+ * and `poll` are direct) and on `max_agents`, and the machine lookup has to
+ * know it *before* it runs. Otherwise a machine that already has a broker has
+ * that broker rotated -- and its transport rewritten to http_push or poll --
+ * by a node enrolling alongside it without an explicit `role`. That failure
+ * would be silent and would move a live node's identity, which is worse than
+ * the roster growth this dedupe exists to stop.
+ */
+export declare function requestedNodeRole(data: {
+    kind?: string;
+    role?: NodeRole;
+    max_agents?: number;
+}): NodeRole;
 /**
  * Resolve the node an enroll (POST /v1/nodes) targets: by node_id when
- * supplied, by name otherwise.
+ * supplied, then by name, then by machine_id.
+ *
+ * The machine_id step is what stops the roster refilling. A host that enrolls
+ * without a persisted node_id arrives under a fresh name on every boot, and
+ * each of those names used to mint a brand-new row that nothing ever reclaimed.
+ * Falling back to the machine's existing broker turns re-enrollment into a
+ * token rotation on the row that is already there.
+ *
+ * node_id and name still win, so a caller that pins either keeps the exact
+ * identity it asked for; passing node_id is the way to opt out of machine
+ * grouping and run two brokers on one host.
+ *
+ * The machine step only ever matches a node that is not live — see
+ * getBrokerNodeByMachineId — so a running broker is never adopted by another
+ * caller presenting its machine_id.
  */
 export declare function resolveNodeForEnroll(db: Db, workspaceId: string, data: {
     node_id?: string;
     name: string;
+    machine_id?: string;
+    kind?: string;
+    role?: NodeRole;
+    max_agents?: number;
 }): Promise<{
     id: string;
     workspaceId: string;
@@ -213,8 +305,9 @@ export declare function resolveNodeForEnroll(db: Db, workspaceId: string, data:
     load: number;
     loadReported: boolean;
     lastHeartbeatAt: Date | null;
+    provenLiveAt: Date | null;
     createdAt: Date;
-}>;
+} | null>;
 export interface RegisterNodeResult {
     node: ReturnType<typeof publicNode>;
     acceptance: FleetCapabilityAcceptance[];
@@ -226,6 +319,7 @@ export declare function heartbeatNode(db: Db, workspaceId: string, nodeId: strin
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {
@@ -272,6 +366,7 @@ export declare function ensureDirectNodeForAgent(db: Db, workspaceId: string, ag
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {
@@ -381,6 +476,7 @@ export declare function listNodes(db: Db, workspaceId: string, filters?: {
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {
@@ -406,6 +502,7 @@ export declare function getPublicNode(db: Db, workspaceId: string, name: string)
     name: string;
     kind: string;
     role: string;
+    machine_id: string | null;
     delivery_adapter: string;
     delivery: Record<string, unknown> | null;
     capabilities: {

package/dist/engine/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/engine/node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAEzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAqB,MAAM,EAA8D,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI/H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAwBjG,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG7F,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACnC,KAAK,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AACzC,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3C,KAAK,QAAQ,GAAG,IAAI,GAAG,WAAW,GAAG,MAAM,CAAC;AAC5C,KAAK,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAUD,KAAK,cAAc,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AA+CD,iBAAS,UAAU,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAqB/B;AAyDD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;;;;;;;;;;;;;;;;GA8FF;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAO5E;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM5E;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAMzC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACpC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;UAkFnC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,iBAiD1E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,uBAAuB,EAAE,OAAO,EAChC,IAAI,CAAC,EAAE,wBAAwB,iBAsBhC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,wBAAwB,iBAgDhC;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAgHD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACvD,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;UAG7E;AA+ID,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,iBAahB;AAgCD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;GA0D9D;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBA6BzG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;YA2BjF;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAgFjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CA8HjC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;UAmDhC;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,mBAAmB,EAAE,EACtC,cAAc,CAAC,EAAE,wBAAwB;;;;;;;;;GAiN1C;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;KAOrD;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;UAG5E;AAwGD,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,iBAiWhF"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/engine/node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAEzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACvB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAqB,MAAM,EAA8D,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI/H,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAwBjG,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG7F,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AACnC,KAAK,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AACzC,KAAK,QAAQ,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3C,KAAK,QAAQ,GAAG,IAAI,GAAG,WAAW,GAAG,MAAM,CAAC;AAC5C,KAAK,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,sBAAsB,CAAC;IACjC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAUD,KAAK,cAAc,GAAG,MAAM,GAAG,eAAe,CAAC;AAE/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AA+CD,iBAAS,UAAU,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;EAsB/B;AAyDD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;;;;;;;;;;;;;;;;;;;;;;;GAqGF;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjE;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAO5E;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAM5E;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAqC5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAMzG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAWnH;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IACpC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,MAAM,EAC3B,OAAO,EAAE,wBAAwB,EACjC,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAwF7B;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;UA4FnC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,iBAiD1E;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,uBAAuB,EAAE,OAAO,EAChC,IAAI,CAAC,EAAE,wBAAwB,iBAsBhC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,wBAAwB,iBAgDhC;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,IAAI,CAAC,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAgHD,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACvD,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;UAG7E;AA+ID,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,iBAahB;AAgCD,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;GA0D9D;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBA6BzG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;;;;;;;YA2BjF;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CAgFjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,OAAO,CAAC,sBAAsB,CAAC,CA8HjC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,CAAC,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;UAmDhC;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,mBAAmB,EAAE,EACtC,cAAc,CAAC,EAAE,wBAAwB;;;;;;;;;GAiN1C;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;;;;KAOrD;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;UAG5E;AAwGD,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,4BAA4B,iBAiWhF"}

package/dist/engine/node.js

@@ -1,4 +1,4 @@
-import { and, eq, inArray, ne, or, sql } from 'drizzle-orm';
+import { and, asc, eq, inArray, isNotNull, isNull, lt, lte, ne, or, sql } from 'drizzle-orm';
 import { FLEET_DELIVERY_CURSOR_CAPABILITY, parseFleetBrokerToRelaycastMessage, } from '@relaycast/types';
 import { actionInvocations, agents, agentNodeBindings, channelMembers, channels, nodeProviders, nodes } from '../db/schema.js';
 import { randomHex, sha256Hex } from '../lib/crypto.js';
@@ -8,7 +8,7 @@ import { isProviderAgentDeliveryReady } from '../ports/realtime.js';
 import { generateId } from './snowflake.js';
 import { assertRegistrableAgentName } from './agent.js';
 import { rotateAgentIdentity } from './agentIdentity.js';
-import { isNodeLive, nodeHasCapacity, nodeHasCapability } from './placement.js';
+import { isNodeLive, isReusableForMachineMatch, nodeHasCapacity, nodeHasCapability, NODE_LIVENESS_TTL_MS } from './placement.js';
 import { DEFAULT_PROVIDER_NAME, capabilityKind, heartbeatProvider, isProviderLive, markProviderOffline, materializeProviderActions, recomputeNodeAggregate, removeProvider, upsertProvider, } from './nodeProvider.js';
 import { serializeNodeOp } from './nodeLock.js';
 import { completeNodeInvocation, dispatchCapacitySpawn, rescheduleInvocationsForLostNode, rescheduleNodeInvocation, } from './action.js';
@@ -65,6 +65,7 @@ function publicNode(row) {
         name: row.name,
         kind: row.kind,
         role: row.role,
+        machine_id: row.machineId,
         delivery_adapter: row.deliveryAdapter,
         delivery: redactDeliveryConfig(row.deliveryConfig),
         capabilities: row.capabilities,
@@ -191,6 +192,12 @@ export async function createNodeToken(db, workspaceId, data) {
             deliveryAdapter,
             deliveryConfig,
             capabilities: normalizeCapabilities(data.capabilities ?? existing.capabilities),
+            machineId: data.machine_id ?? existing.machineId,
+            // The credential just changed, so whatever the previous holder proved
+            // no longer applies to this row. Without clearing it, a row reused once
+            // still looks proven and could be reused again immediately, revoking
+            // the token this call is handing out.
+            provenLiveAt: null,
             maxAgents,
             tags: data.tags ?? existing.tags,
             version: data.version ?? existing.version,
@@ -215,6 +222,7 @@ export async function createNodeToken(db, workspaceId, data) {
         deliveryAdapter,
         deliveryConfig,
         capabilities: normalizeCapabilities(data.capabilities ?? []),
+        machineId: data.machine_id ?? null,
         maxAgents,
         tags: data.tags ?? [],
         version: data.version ?? 'unknown',
@@ -247,15 +255,108 @@ export async function getNodeById(db, workspaceId, nodeId) {
         .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
     return node ?? null;
 }
+/**
+ * How many *reusable* rows sharing one machine_id the enroll lookup will
+ * consider. Live rows are excluded in SQL before this bound applies, so a
+ * machine with many live brokers cannot push its one offline row out of range.
+ */
+const MACHINE_MATCH_SCAN_LIMIT = 20;
+/**
+ * The broker a machine already has on the roster and is no longer running.
+ *
+ * Scoped to `broker` deliberately: a broker is the node-of-many fleet host and
+ * a machine runs one, so machine_id identifies it. A `direct` node is a
+ * node-of-one delivery host and a single machine legitimately runs many of
+ * them, so machine_id is not a key there and must never collapse them.
+ *
+ * A LIVE incumbent is never returned. Adopting one would rename a running
+ * broker and rotate its token out from under it — the caller cannot be that
+ * host coming back, because that host has not left. Only a node that is gone
+ * can be the one re-enrolling. Skipping the live row lets the caller fall
+ * through to a new node instead, which is the right answer for the legitimate
+ * duplicate too: a VM cloned from a snapshot, or containers baked from one
+ * image, carry the same machine_id and run CONCURRENTLY, so they are genuinely
+ * separate nodes. Declining the match costs an extra roster row; rejecting the
+ * enrollment outright would break a whole fleet booted from one image.
+ *
+ * Ordered oldest-first so a roster that already holds several rows for one
+ * machine converges onto its earliest reusable row instead of picking
+ * arbitrarily.
+ */
+export async function getBrokerNodeByMachineId(db, workspaceId, machineId) {
+    // Exclude live rows in SQL so the bound below counts only reusable
+    // candidates. Bounding first and filtering after would let a machine with
+    // enough live brokers hide its one offline row past the limit, and enrollment
+    // would insert a new row instead of reusing it.
+    const now = new Date();
+    const liveCutoff = new Date(now.getTime() - NODE_LIVENESS_TTL_MS);
+    const candidates = await db
+        .select()
+        .from(nodes)
+        .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.machineId, machineId), eq(nodes.role, 'broker'), 
+    // Mirrors isReusableForMachineMatch in full, so the scan bound below
+    // counts only rows that are actually reusable. A stale proof alone is not
+    // enough: a broker that registered recently has a fresh lastHeartbeatAt
+    // and is therefore live, and admitting those here would let them crowd
+    // the window and hide the one reusable row behind them.
+    isNotNull(nodes.provenLiveAt), lt(nodes.provenLiveAt, liveCutoff), 
+    // not live — mirrors isNodeLive
+    or(ne(nodes.status, 'online'), isNull(nodes.lastHeartbeatAt), lt(nodes.lastHeartbeatAt, liveCutoff)), 
+    // no future-dated heartbeat — server clock rollback
+    or(isNull(nodes.lastHeartbeatAt), lte(nodes.lastHeartbeatAt, now))))
+        .orderBy(asc(nodes.createdAt), asc(nodes.id))
+        .limit(MACHINE_MATCH_SCAN_LIMIT);
+    // The SQL above is a pre-filter for `isReusableForMachineMatch`, which is the
+    // single definition of reusability and mirrors it exactly — including
+    // treating an `online` row with a future heartbeat as live. Re-checking here
+    // keeps that definition authoritative rather than trusting the query alone.
+    return candidates.find((node) => isReusableForMachineMatch(node)) ?? null;
+}
+/**
+ * The role an enroll is asking for, derived from the request alone.
+ *
+ * Enrollment's role default depends on `kind` (`ws` is a broker; `http_push`
+ * and `poll` are direct) and on `max_agents`, and the machine lookup has to
+ * know it *before* it runs. Otherwise a machine that already has a broker has
+ * that broker rotated -- and its transport rewritten to http_push or poll --
+ * by a node enrolling alongside it without an explicit `role`. That failure
+ * would be silent and would move a live node's identity, which is worse than
+ * the roster growth this dedupe exists to stop.
+ */
+export function requestedNodeRole(data) {
+    if (data.role)
+        return data.role;
+    return normalizeLegacyNodeShape(data.kind ?? 'ws', data.max_agents !== undefined && data.max_agents > 1 ? 'broker' : undefined).role;
+}
 /**
  * Resolve the node an enroll (POST /v1/nodes) targets: by node_id when
- * supplied, by name otherwise.
+ * supplied, then by name, then by machine_id.
+ *
+ * The machine_id step is what stops the roster refilling. A host that enrolls
+ * without a persisted node_id arrives under a fresh name on every boot, and
+ * each of those names used to mint a brand-new row that nothing ever reclaimed.
+ * Falling back to the machine's existing broker turns re-enrollment into a
+ * token rotation on the row that is already there.
+ *
+ * node_id and name still win, so a caller that pins either keeps the exact
+ * identity it asked for; passing node_id is the way to opt out of machine
+ * grouping and run two brokers on one host.
+ *
+ * The machine step only ever matches a node that is not live — see
+ * getBrokerNodeByMachineId — so a running broker is never adopted by another
+ * caller presenting its machine_id.
  */
 export async function resolveNodeForEnroll(db, workspaceId, data) {
     if (data.node_id !== undefined) {
         return getNodeById(db, workspaceId, data.node_id);
     }
-    return getNodeByName(db, workspaceId, data.name);
+    const byName = await getNodeByName(db, workspaceId, data.name);
+    if (byName)
+        return byName;
+    if (data.machine_id !== undefined && requestedNodeRole(data) === 'broker') {
+        return getBrokerNodeByMachineId(db, workspaceId, data.machine_id);
+    }
+    return null;
 }
 export async function registerNode(db, workspaceId, authenticatedNodeId, message, provider) {
     if (message.node_id !== authenticatedNodeId) {
@@ -370,6 +471,9 @@ export async function heartbeatNode(db, workspaceId, nodeId, providerName, messa
             activeAgents: 1,
             handlersLive: false,
             lastHeartbeatAt: new Date(),
+            // A heartbeat frame arrived: this is proof of life, unlike the
+            // registration and disconnect writes that also touch lastHeartbeatAt.
+            provenLiveAt: new Date(),
         })
             .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)))
             .returning();
@@ -410,6 +514,13 @@ export async function heartbeatNode(db, workspaceId, nodeId, providerName, messa
             await tx.update(nodes).set({ name: message.name }).where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
         }
         await recomputeNodeAggregate(tx, workspaceId, nodeId, message.version !== undefined ? { version: message.version } : {});
+        // Stamped after the aggregate so it cannot be overwritten by it: the
+        // aggregate derives lastHeartbeatAt from provider rows, which registration
+        // also writes, whereas this column is only ever set by an arriving frame.
+        await tx
+            .update(nodes)
+            .set({ provenLiveAt: new Date() })
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.id, nodeId)));
     });
     const [updated] = await db
         .select()