@shipfox/api-runners 12.0.0 → 12.2.0

package/src/db/runner-instances.test.ts

@@ -10,7 +10,7 @@ import {
   listProvisionerTerminateIntents,
   reapStaleRunnerInstances,
   reconcileRunnerInstances,
-  reportRunnerInstances,
+  reportRunnerInstances as reportRunnerInstancesDb,
 } from '#db/runner-instances.js';
 import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
 import {reservations} from '#db/schema/reservations.js';
@@ -25,6 +25,12 @@ import {
   runnerSessionFactory,
 } from '#test/index.js';
 
+type ReportRunnerInstancesTestParams = Parameters<typeof reportRunnerInstancesDb>[0];
+
+function reportRunnerInstances(params: ReportRunnerInstancesTestParams) {
+  return reportRunnerInstancesDb(params);
+}
+
 function providerRunnerRowsFor(params: {workspaceId: string; provisionerId: string}) {
   return db()
     .select()
@@ -93,6 +99,7 @@ describe('reportRunnerInstances', () => {
     const reportedAt = new Date();
 
     const report = await reportRunnerInstances({
+      scope: 'installation',
       workspaceId: null,
       provisionerId,
       events: [event({providerRunnerId: 'installation-runner', reportedAt})],
@@ -118,6 +125,7 @@ describe('reportRunnerInstances', () => {
     const reportedAt = new Date();
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -140,6 +148,7 @@ describe('reportRunnerInstances', () => {
     const reportedAt = new Date();
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -160,6 +169,7 @@ describe('reportRunnerInstances', () => {
   it('accepts delayed events that move the lifecycle forward', async () => {
     const newest = new Date();
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -168,6 +178,7 @@ describe('reportRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -188,6 +199,7 @@ describe('reportRunnerInstances', () => {
   it('rejects older out-of-order events in the same lifecycle state', async () => {
     const newest = new Date();
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -201,6 +213,7 @@ describe('reportRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -222,6 +235,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(1);
     const reportedAt = new Date('2025-01-01T00:00:00.000Z');
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -235,6 +249,7 @@ describe('reportRunnerInstances', () => {
     });
 
     const terminal = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -247,6 +262,7 @@ describe('reportRunnerInstances', () => {
       ],
     });
     const revived = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -270,6 +286,7 @@ describe('reportRunnerInstances', () => {
 
   it('clamps future reported times so they do not pin provisioned runner state', async () => {
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -282,6 +299,7 @@ describe('reportRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -305,6 +323,7 @@ describe('reportRunnerInstances', () => {
     const terminatedAt = new Date('2025-01-01T00:03:00.000Z');
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -346,6 +365,7 @@ describe('reportRunnerInstances', () => {
     const terminatedAt = new Date('2025-01-01T00:03:00.000Z');
     const startedAt = new Date('2025-01-01T00:00:00.000Z');
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -358,6 +378,7 @@ describe('reportRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -378,6 +399,7 @@ describe('reportRunnerInstances', () => {
 
   it('uses server update time for active provisioned runner windows', async () => {
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -401,6 +423,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(2);
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', reservationId, state: 'failed'})],
@@ -429,6 +452,7 @@ describe('reportRunnerInstances', () => {
     if (!runner.providerRunnerId) throw new Error('Runner instance provider id missing');
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: runner.providerRunnerId, state: 'failed'})],
@@ -479,6 +503,7 @@ describe('reportRunnerInstances', () => {
     });
 
     const result = await reportRunnerInstances({
+      scope: 'installation',
       workspaceId: null,
       provisionerId: installationProvisioner.id,
       events: [event({providerRunnerId: 'installation-pre-enrollment-runner', state: 'failed'})],
@@ -521,6 +546,7 @@ describe('reportRunnerInstances', () => {
     });
 
     const result = await reportRunnerInstances({
+      scope: 'installation',
       workspaceId: null,
       provisionerId: installationProvisioner.id,
       events: [
@@ -552,6 +578,7 @@ describe('reportRunnerInstances', () => {
     });
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -581,11 +608,13 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(2);
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', reservationId, state: 'failed'})],
     });
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', reservationId, state: 'failed'})],
@@ -600,6 +629,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(2);
     const failedAt = new Date();
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -613,6 +643,7 @@ describe('reportRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -636,6 +667,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(2);
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -656,6 +688,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(3);
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -673,6 +706,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(1);
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', reservationId, state: 'failed'})],
@@ -695,6 +729,7 @@ describe('reportRunnerInstances', () => {
     if (!reservation) throw new Error('Expected reservation');
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -715,6 +750,7 @@ describe('reportRunnerInstances', () => {
     const reservationId = await createReservation(1);
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -750,6 +786,7 @@ describe('reportRunnerInstances', () => {
     });
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -776,6 +813,7 @@ describe('reportRunnerInstances', () => {
     const reportedAt = new Date('2025-01-01T00:00:00.000Z');
 
     const result = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -819,11 +857,13 @@ describe('reportRunnerInstances', () => {
     });
 
     const first = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', state: 'terminated'})],
     });
     const second = await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [event({providerRunnerId: 'provisioned-runner-1', state: 'terminated'})],
@@ -1365,6 +1405,7 @@ describe('reapStaleRunnerInstances', () => {
 
     await lockHolderReady.promise;
     const report = reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -1845,6 +1886,7 @@ describe('reconcileRunnerInstances', () => {
     });
 
     await reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -1877,6 +1919,7 @@ describe('reconcileRunnerInstances', () => {
 
     await lockHolderReady.promise;
     const report = reportRunnerInstances({
+      scope: 'workspace',
       workspaceId,
       provisionerId,
       events: [
@@ -2026,6 +2069,7 @@ describe('runner instance provider attachment', () => {
       providerRunnerId,
     });
     await reportRunnerInstances({
+      scope: 'installation',
       workspaceId: null,
       provisionerId,
       events: [

package/src/db/runner-instances.ts

@@ -1,5 +1,4 @@
 import {logger} from '@shipfox/node-opentelemetry';
-import {canonicalizeLabels} from '@shipfox/runner-labels';
 import {
   and,
   asc,
@@ -19,6 +18,7 @@ import {
 } from 'drizzle-orm';
 import {alias} from 'drizzle-orm/pg-core';
 import type {RunnerInstance, RunnerInstanceState} from '#core/entities/runner-instance.js';
+import {sanitizeRunnerLabels} from '#core/runner-labels.js';
 import type {Tx} from './db.js';
 import {db} from './db.js';
 import {
@@ -74,6 +74,7 @@ export interface RunnerInstanceReportEvent {
 }
 
 export interface ReportRunnerInstancesParams {
+  scope: 'installation' | 'workspace';
   workspaceId: string | null;
   provisionerId: string;
   events: RunnerInstanceReportEvent[];
@@ -165,7 +166,11 @@ export async function reportRunnerInstances(params: ReportRunnerInstancesParams)
       providerRunnerId: event.providerRunnerId,
       reservationId: event.reservationId,
       templateKey: event.templateKey,
-      labels: [...canonicalizeLabels(event.labels)],
+      labels: sanitizeRunnerLabels(event.labels, {
+        scope: params.scope,
+        logLevel: 'debug',
+        source: 'runner instance report',
+      }),
       state: event.state,
       reason: event.reason,
       runnerSessionId: event.runnerSessionId,

package/src/db/runner-sessions.ts

@@ -1,7 +1,10 @@
 import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
 import {and, asc, eq, gt, inArray, isNull, lt, notExists, or, sql} from 'drizzle-orm';
 import type {RunnerSession} from '#core/entities/runner-session.js';
+import {EmptyRunnerLabelsError} from '#core/errors.js';
+import {sanitizeRunnerLabelsOrThrow} from '#core/runner-labels.js';
 import {db} from './db.js';
+import {provisionerTokens} from './schema/provisioner-tokens.js';
 import {runnerActivationTokens} from './schema/runner-activation-tokens.js';
 import {runnerControlSessions} from './schema/runner-control-sessions.js';
 import {providerRunners} from './schema/runner-instances.js';
@@ -79,6 +82,16 @@ export async function createRunnerSessionConsumingActivationToken(params: {
       .for('update');
     if (!token?.workspaceId || !token.providerRunnerId)
       throw new Error('Runner activation token is invalid, expired, or has already been used');
+    const [provisioner] = await tx
+      .select({scope: provisionerTokens.scope})
+      .from(provisionerTokens)
+      .where(eq(provisionerTokens.id, token.provisionerId))
+      .limit(1);
+    const labels = sanitizeRunnerLabelsOrThrow(params.labels, {
+      scope: provisioner?.scope ?? 'workspace',
+      source: 'activation runner registration',
+    });
+    if (labels.length === 0) throw new EmptyRunnerLabelsError();
     const [session] = await tx
       .insert(runnerSessions)
       .values({
@@ -89,7 +102,7 @@ export async function createRunnerSessionConsumingActivationToken(params: {
         runnerInstanceId: token.runnerInstanceId,
         provisionerId: token.provisionerId,
         providerRunnerId: token.providerRunnerId,
-        labels: params.labels,
+        labels,
         toolCapabilities: params.toolCapabilities ?? null,
         toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,
         maxClaims: 1,

package/src/db/schema/runner-instances.ts

@@ -60,6 +60,9 @@ export const providerRunners = pgTable(
       .where(
         sql`${table.intendedReservationId} is not null and ${table.reservationReleasedAt} is null`,
       ),
+    index('runners_runner_instances_intended_reservation_idx')
+      .on(table.intendedReservationId)
+      .where(sql`${table.intendedReservationId} is not null`),
     index('runners_runner_instances_provisioner_reservation_idx')
       .on(table.provisionerId, table.reservationId)
       .where(sql`${table.reservationId} is not null`),

package/src/metrics/index.ts

@@ -1,3 +1,4 @@
+export type {RunnerReservationPromotionFailureReason} from './instance.js';
 export {
   jobExecutionClaimedCount,
   jobExecutionEnqueuedCount,
@@ -7,6 +8,7 @@ export {
   providerRunnerReconcileCallCount,
   providerRunnerTerminateIntentHonoredCount,
   providerRunnerTerminateIntentIssuedCount,
+  recordRunnerReservationPromotionFailure,
   recordRunnersRateLimitCheck,
   recordRunnersRateLimitPruneFailure,
 } from './instance.js';

package/src/metrics/instance.ts

@@ -83,6 +83,18 @@ export const reservationReleasedCount = meter.createCounter<Record<string, never
   {description: 'Reservation units released from terminal provisioned runner reports'},
 );
 
+export type RunnerReservationPromotionFailureReason =
+  | 'reservation-expired'
+  | 'reservation-not-found'
+  | 'already-assigned'
+  | 'not-assignable';
+
+export const runnerReservationPromotionFailureCount = meter.createCounter<{
+  reason: RunnerReservationPromotionFailureReason;
+}>('runners_reservation_promotion_failures', {
+  description: 'Runner reservation promotion failures during enrollment by reason',
+});
+
 export type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';
 export type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';
 export type RunnersRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
@@ -107,6 +119,12 @@ function recordMetric(record: () => void): void {
   }
 }
 
+export function recordRunnerReservationPromotionFailure(
+  reason: RunnerReservationPromotionFailureReason,
+): void {
+  recordMetric(() => runnerReservationPromotionFailureCount.add(1, {reason}));
+}
+
 export function recordRunnersRateLimitCheck(params: {
   action: RunnersRateLimitAction;
   scope: RunnersRateLimitScope;

package/src/presentation/routes/poll-demand.test.ts

@@ -87,6 +87,7 @@ describe('POST /provisioners/demand/poll', () => {
   it('returns demand stats and reservations when matching demand exists', async () => {
     await pendingJobFactory.create({workspaceId, requiredLabels: ['linux']});
 
+    const requestStartedAt = Date.now();
     const res = await app.inject({
       method: 'POST',
       url: '/provisioners/demand/poll',
@@ -102,6 +103,43 @@ describe('POST /provisioners/demand/poll', () => {
     });
     expect(res.json().reservations[0].reservation_id).toEqual(expect.any(String));
     expect(res.json().reservations[0].expires_at).toEqual(expect.any(String));
+    const expiresAt = Date.parse(res.json().reservations[0].expires_at);
+    expect(expiresAt).toBeGreaterThanOrEqual(requestStartedAt + 55_000);
+    expect(expiresAt).toBeLessThan(requestStartedAt + 65_000);
+  });
+
+  it('clamps a requested reservation TTL for workspace provisioners', async () => {
+    await pendingJobFactory.create({workspaceId, requiredLabels: ['linux']});
+
+    const requestStartedAt = Date.now();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/provisioners/demand/poll',
+      headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
+      payload: body({max_reservations: 1, reservation_ttl_seconds: 600}),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const expiresAt = Date.parse(res.json().reservations[0].expires_at);
+    expect(expiresAt).toBeGreaterThanOrEqual(requestStartedAt + 295_000);
+    expect(expiresAt).toBeLessThan(requestStartedAt + 305_000);
+  });
+
+  it('applies a requested reservation TTL below the ceiling', async () => {
+    await pendingJobFactory.create({workspaceId, requiredLabels: ['linux']});
+
+    const requestStartedAt = Date.now();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/provisioners/demand/poll',
+      headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
+      payload: body({max_reservations: 1, reservation_ttl_seconds: 120}),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const expiresAt = Date.parse(res.json().reservations[0].expires_at);
+    expect(expiresAt).toBeGreaterThanOrEqual(requestStartedAt + 115_000);
+    expect(expiresAt).toBeLessThan(requestStartedAt + 125_000);
   });
 
   it('rejects installation provisioner credentials from workspace demand polling', async () => {
@@ -173,6 +211,39 @@ describe('POST /provisioners/demand/poll', () => {
     expect(clearedSnapshots).toEqual([]);
   });
 
+  it('strips reserved labels from workspace template advertisements', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/provisioners/demand/poll',
+      headers: {authorization: `Bearer ${VALID_PROVISIONER_TOKEN}`},
+      payload: {
+        wait_seconds: 0,
+        max_reservations: 0,
+        templates: [
+          {
+            template_key: 'linux',
+            labels: ['linux', 'shipfox-managed'],
+            available_slots: 1,
+            starting: 0,
+            running: 0,
+          },
+        ],
+      },
+    });
+
+    const snapshots = await db()
+      .select()
+      .from(provisionerCapabilitySnapshots)
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, provisionerTokenId));
+
+    expect(res.statusCode).toBe(200);
+    expect(snapshots).toEqual([
+      expect.objectContaining({
+        labels: ['linux'],
+      }),
+    ]);
+  });
+
   it('returns terminate intent ids for active provisioned runners with cancelled latest jobs', async () => {
     await providerRunnerFactory.create({
       workspaceId,
@@ -330,10 +401,13 @@ describe('POST /provisioners/demand/poll', () => {
     expect(res.statusCode).toBe(401);
   });
 
-  function body(params: {max_reservations: number}) {
+  function body(params: {max_reservations: number; reservation_ttl_seconds?: number}) {
     return {
       wait_seconds: 0,
       max_reservations: params.max_reservations,
+      ...(params.reservation_ttl_seconds === undefined
+        ? {}
+        : {reservation_ttl_seconds: params.reservation_ttl_seconds}),
       templates: [
         {
           template_key: 'linux',
@@ -377,6 +451,7 @@ describe('POST /provisioners/demand/poll with installation provisioning configur
   let app: FastifyInstance;
   let workspaceId: string;
   let provisionerTokenId: string;
+  const filterEligibleWorkspaceIds = vi.fn().mockResolvedValue(new Set<string>());
 
   const fakeProvisionerAuth: AuthMethod = {
     name: AUTH_PROVISIONER_TOKEN,
@@ -402,7 +477,7 @@ describe('POST /provisioners/demand/poll with installation provisioning configur
       ],
       routes: createRunnerRoutes(runnersTestAuthClient, {
         installationProvisioning: {
-          policy: {filterEligibleWorkspaceIds: vi.fn().mockResolvedValue(new Set())},
+          policy: {filterEligibleWorkspaceIds},
         },
       }),
       swagger: false,
@@ -444,10 +519,31 @@ describe('POST /provisioners/demand/poll with installation provisioning configur
     expect(res.statusCode).toBe(200);
   });
 
-  function body(params: {max_reservations: number}) {
+  it('clamps a requested reservation TTL for installation provisioners', async () => {
+    await pendingJobFactory.create({workspaceId, requiredLabels: ['linux']});
+    filterEligibleWorkspaceIds.mockResolvedValueOnce(new Set([workspaceId]));
+
+    const requestStartedAt = Date.now();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/provisioners/demand/poll',
+      headers: {authorization: `Bearer ${INSTALLATION_PROVISIONER_TOKEN}`},
+      payload: body({max_reservations: 1, reservation_ttl_seconds: 600}),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const expiresAt = Date.parse(res.json().reservations[0].expires_at);
+    expect(expiresAt).toBeGreaterThanOrEqual(requestStartedAt + 295_000);
+    expect(expiresAt).toBeLessThan(requestStartedAt + 305_000);
+  });
+
+  function body(params: {max_reservations: number; reservation_ttl_seconds?: number}) {
     return {
       wait_seconds: 0,
       max_reservations: params.max_reservations,
+      ...(params.reservation_ttl_seconds === undefined
+        ? {}
+        : {reservation_ttl_seconds: params.reservation_ttl_seconds}),
       templates: [
         {
           template_key: 'linux',

package/src/presentation/routes/poll-demand.ts

@@ -9,6 +9,7 @@ import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {logger} from '@shipfox/node-opentelemetry';
 import {config} from '#config.js';
 import {pollDemand, releaseReservationGrants} from '#core/demand.js';
+import {sanitizeRunnerLabels} from '#core/runner-labels.js';
 import {publishWorkspaceProvisionerCapabilitySnapshot} from '#db/provisioner-capability-snapshots.js';
 import {
   listQueuedDemandWorkspaceIds,
@@ -21,10 +22,17 @@ import {toPollDemandResponseDto} from '#presentation/dto/index.js';
 
 const TERMINATE_INTENT_LIMIT = 1000;
 
-function toReservationTemplates(templates: PollDemandTemplateDto[]): ReservationTemplate[] {
+function toReservationTemplates(
+  templates: PollDemandTemplateDto[],
+  scope: 'installation' | 'workspace',
+): ReservationTemplate[] {
   return templates.map((template) => ({
     templateKey: template.template_key,
-    labels: template.labels,
+    labels: sanitizeRunnerLabels(template.labels, {
+      scope,
+      logLevel: 'debug',
+      source: 'provisioner template advertisement',
+    }),
     availableSlots: template.available_slots,
     starting: template.starting,
     running: template.running,
@@ -66,6 +74,10 @@ export function createPollDemandRoute(options: CreateRunnersModuleOptions = {})
         }
       });
       const provisionerContext = requireProvisionerContext(request);
+      const ttlSeconds = Math.min(
+        request.body.reservation_ttl_seconds ?? config.RESERVATION_TTL_SECONDS,
+        config.RESERVATION_TTL_MAX_SECONDS,
+      );
       if (provisionerContext.scope === 'installation') {
         if (!options.installationProvisioning) {
           throw new ClientError(
@@ -81,11 +93,11 @@ export function createPollDemandRoute(options: CreateRunnersModuleOptions = {})
           await options.installationProvisioning.policy.filterEligibleWorkspaceIds(
             candidateWorkspaceIds,
           );
-        const templates = toReservationTemplates(request.body.templates);
+        const templates = toReservationTemplates(request.body.templates, 'installation');
         const result = await pollInstallationDemandAndReserve({
           provisionerId: provisionerContext.provisionerTokenId,
           maxReservations: request.body.max_reservations,
-          ttlSeconds: config.RESERVATION_TTL_SECONDS,
+          ttlSeconds,
           templates,
           capabilityWindowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,
           eligibleWorkspaceIds,
@@ -101,7 +113,7 @@ export function createPollDemandRoute(options: CreateRunnersModuleOptions = {})
       }
       const {provisionerTokenId, workspaceId} = requireWorkspaceProvisionerContext(request);
 
-      const templates = toReservationTemplates(request.body.templates);
+      const templates = toReservationTemplates(request.body.templates, 'workspace');
       await publishWorkspaceProvisionerCapabilitySnapshot({
         workspaceId,
         provisionerId: provisionerTokenId,
@@ -113,7 +125,7 @@ export function createPollDemandRoute(options: CreateRunnersModuleOptions = {})
         provisionerId: provisionerTokenId,
         maxReservations: request.body.max_reservations,
         waitSeconds: request.body.wait_seconds,
-        ttlSeconds: config.RESERVATION_TTL_SECONDS,
+        ttlSeconds,
         terminateIntentLimit: TERMINATE_INTENT_LIMIT,
         templates,
         signal: abortController.signal,