@shipfox/api-runners 12.3.0 → 12.4.0

package/dist/db/ephemeral-registration-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/ephemeral-registration-tokens.ts"],"sourcesContent":["import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {and, asc, eq, gt, inArray, isNull, lt, sql} from 'drizzle-orm';\nimport type {EphemeralRegistrationToken} from '#core/entities/ephemeral-registration-token.js';\nimport {\n  ActiveEphemeralRegistrationTokenExistsError,\n  ActiveEphemeralRegistrationTokensExistError,\n  EmptyRunnerLabelsError,\n  RegistrationTokenBatchExceedsReservationError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RegistrationTokenWorkspaceMismatchError,\n  ReservationExpiredError,\n  ReservationNotFoundError,\n} from '#core/errors.js';\nimport {sanitizeRunnerLabelsOrThrow} from '#core/runner-labels.js';\nimport {db} from './db.js';\nimport {\n  ephemeralRegistrationTokens,\n  toEphemeralRegistrationToken,\n} from './schema/ephemeral-registration-tokens.js';\nimport {provisionerTokens} from './schema/provisioner-tokens.js';\nimport {reservations} from './schema/reservations.js';\nimport {providerRunners} from './schema/runner-instances.js';\nimport {runnerSessions, toRunnerSession} from './schema/runner-sessions.js';\n\nexport interface CreateEphemeralRegistrationTokenParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId?: string | null | undefined;\n  providerRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n  expiresAt: Date;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchRow {\n  providerRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId: string;\n  expiresAt: Date;\n  rows: CreateEphemeralRegistrationTokensBatchRow[];\n}\n\nexport async function createEphemeralRegistrationToken(\n  params: CreateEphemeralRegistrationTokenParams,\n): Promise<EphemeralRegistrationToken> {\n  const rows = await db().transaction(async (tx) => {\n    const providerRunnerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n      params.providerRunnerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${providerRunnerLockKey}))`);\n\n    const [active] = await tx\n      .select({id: ephemeralRegistrationTokens.id})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.providerRunnerId, params.providerRunnerId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .limit(1);\n\n    if (active) {\n      throw new ActiveEphemeralRegistrationTokenExistsError(\n        params.workspaceId,\n        params.provisionerId,\n        params.providerRunnerId,\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values({\n        workspaceId: params.workspaceId,\n        provisionerId: params.provisionerId,\n        reservationId: params.reservationId ?? null,\n        providerRunnerId: params.providerRunnerId,\n        hashedToken: params.hashedToken,\n        prefix: params.prefix,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n  });\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toEphemeralRegistrationToken(row);\n}\n\nexport async function createEphemeralRegistrationTokensBatch(\n  params: CreateEphemeralRegistrationTokensBatchParams,\n): Promise<EphemeralRegistrationToken[]> {\n  const rows = await db().transaction(async (tx) => {\n    const provisionerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionerLockKey}))`);\n    for (const providerRunnerId of [\n      ...new Set(params.rows.map((row) => row.providerRunnerId)),\n    ].sort()) {\n      const providerRunnerLockKey = [\n        'runners_ephemeral_registration_tokens',\n        params.workspaceId,\n        params.provisionerId,\n        providerRunnerId,\n      ].join(':');\n      await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${providerRunnerLockKey}))`);\n    }\n\n    const [reservation] = await tx\n      .select({\n        count: reservations.count,\n        isExpired: sql<boolean>`${reservations.expiresAt} <= now()`,\n      })\n      .from(reservations)\n      .where(\n        and(\n          eq(reservations.id, params.reservationId),\n          eq(reservations.workspaceId, params.workspaceId),\n          eq(reservations.provisionerId, params.provisionerId),\n        ),\n      )\n      .limit(1);\n\n    if (!reservation) throw new ReservationNotFoundError(params.reservationId);\n    if (reservation.isExpired) throw new ReservationExpiredError(params.reservationId);\n    if (params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n      );\n    }\n\n    const [existingForReservation] = await tx\n      .select({count: sql<number>`count(*)::int`})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.reservationId, params.reservationId),\n        ),\n      );\n    const alreadyMinted = existingForReservation?.count ?? 0;\n    if (alreadyMinted + params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n        alreadyMinted,\n      );\n    }\n\n    const providerRunnerIds = params.rows.map((row) => row.providerRunnerId);\n    const activeRows = await tx\n      .select({providerRunnerId: ephemeralRegistrationTokens.providerRunnerId})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          inArray(ephemeralRegistrationTokens.providerRunnerId, providerRunnerIds),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      );\n\n    if (activeRows.length > 0) {\n      throw new ActiveEphemeralRegistrationTokensExistError(\n        activeRows.map((row) => row.providerRunnerId),\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values(\n        params.rows.map((row) => ({\n          workspaceId: params.workspaceId,\n          provisionerId: params.provisionerId,\n          reservationId: params.reservationId,\n          providerRunnerId: row.providerRunnerId,\n          hashedToken: row.hashedToken,\n          prefix: row.prefix,\n          expiresAt: params.expiresAt,\n        })),\n      )\n      .returning();\n  });\n\n  return rows.map(toEphemeralRegistrationToken);\n}\n\nexport async function resolveEphemeralRegistrationTokenByHash(\n  hashedToken: string,\n): Promise<EphemeralRegistrationToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(ephemeralRegistrationTokens)\n    .where(eq(ephemeralRegistrationTokens.hashedToken, hashedToken))\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toEphemeralRegistrationToken(row);\n}\n\nexport interface DeleteExpiredEphemeralRegistrationTokensParams {\n  retentionDays: number;\n  limit?: number;\n}\n\n/**\n * Deletes ephemeral registration tokens that have reached a terminal state and\n * outlived the retention window. A token is terminal once it is consumed\n * (single use spent) or expired without consumption; the retention window is\n * measured from that terminal event so the audit record survives a bounded\n * debugging window. Active tokens that are neither consumed nor expired are\n * never deleted, so a live single-use credential is never removed early.\n */\nexport async function deleteExpiredEphemeralRegistrationTokens(\n  params: DeleteExpiredEphemeralRegistrationTokensParams,\n): Promise<number> {\n  // coalesce(consumed_at, expires_at) is the terminal timestamp: consumed_at\n  // when the token was spent, otherwise its expiry. Comparing it to the cutoff\n  // both selects deletable rows and orders the batch, and it matches the\n  // terminal index so idle GC ticks never scan live rows.\n  const terminalAt = sql`coalesce(${ephemeralRegistrationTokens.consumedAt}, ${ephemeralRegistrationTokens.expiresAt})`;\n  const retentionCutoff = sql`now() - (${params.retentionDays} || ' days')::interval`;\n\n  const deletableIds = db()\n    .select({id: ephemeralRegistrationTokens.id})\n    .from(ephemeralRegistrationTokens)\n    .where(lt(terminalAt, retentionCutoff))\n    .orderBy(asc(terminalAt), asc(ephemeralRegistrationTokens.id))\n    .limit(params.limit ?? 1000);\n\n  const deleted = await db()\n    .delete(ephemeralRegistrationTokens)\n    .where(inArray(ephemeralRegistrationTokens.id, deletableIds))\n    .returning({id: ephemeralRegistrationTokens.id});\n\n  return deleted.length;\n}\n\nexport async function createRunnerSessionConsumingEphemeralToken(params: {\n  ephemeralTokenId: string;\n  workspaceId: string;\n  labels: string[];\n  toolCapabilities?: RunnerToolCapabilitiesDto | null;\n  maxClaims: number;\n}) {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);\n\n    const consumed = await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedAt: sql`now()`})\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId),\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning({\n        id: ephemeralRegistrationTokens.id,\n        provisionerId: ephemeralRegistrationTokens.provisionerId,\n        providerRunnerId: ephemeralRegistrationTokens.providerRunnerId,\n      });\n\n    if (!consumed[0]) {\n      const [token] = await tx\n        .select({\n          workspaceId: ephemeralRegistrationTokens.workspaceId,\n          consumedAt: ephemeralRegistrationTokens.consumedAt,\n          isExpired: sql<boolean>`${ephemeralRegistrationTokens.expiresAt} <= now()`,\n        })\n        .from(ephemeralRegistrationTokens)\n        .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId))\n        .limit(1);\n\n      if (!token) {\n        throw new Error(`Ephemeral registration token not found: ${params.ephemeralTokenId}`);\n      }\n      if (token.workspaceId !== params.workspaceId) {\n        throw new RegistrationTokenWorkspaceMismatchError(\n          params.ephemeralTokenId,\n          params.workspaceId,\n        );\n      }\n      if (token.consumedAt) throw new RegistrationTokenConsumedError(params.ephemeralTokenId);\n      if (token.isExpired) throw new RegistrationTokenExpiredError(params.ephemeralTokenId);\n      throw new Error(\n        `Ephemeral registration token could not be consumed: ${params.ephemeralTokenId}`,\n      );\n    }\n\n    const [provisioner] = await tx\n      .select({scope: provisionerTokens.scope})\n      .from(provisionerTokens)\n      .where(eq(provisionerTokens.id, consumed[0].provisionerId))\n      .limit(1);\n    const labels = sanitizeRunnerLabelsOrThrow(params.labels, {\n      scope: provisioner?.scope ?? 'workspace',\n      source: 'ephemeral runner registration',\n    });\n    if (labels.length === 0) throw new EmptyRunnerLabelsError();\n\n    const [session] = await tx\n      .insert(runnerSessions)\n      .values({\n        workspaceId: params.workspaceId,\n        scope: 'workspace',\n        registrationTokenId: params.ephemeralTokenId,\n        registrationTokenKind: 'ephemeral',\n        provisionerId: consumed[0].provisionerId,\n        providerRunnerId: consumed[0].providerRunnerId,\n        labels,\n        toolCapabilities: params.toolCapabilities ?? null,\n        toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,\n        maxClaims: params.maxClaims,\n        claimsUsed: 0,\n      })\n      .returning();\n\n    if (!session) throw new Error('Insert returned no rows');\n\n    await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedSessionId: session.id})\n      .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId));\n\n    await tx\n      .update(providerRunners)\n      .set({runnerSessionId: session.id, updatedAt: sql`now()`})\n      .where(\n        and(\n          eq(providerRunners.workspaceId, params.workspaceId),\n          eq(providerRunners.provisionerId, consumed[0].provisionerId),\n          eq(providerRunners.providerRunnerId, consumed[0].providerRunnerId),\n          isNull(providerRunners.reservationReleasedAt),\n        ),\n      );\n\n    return toRunnerSession(session);\n  });\n}\n"],"names":["and","asc","eq","gt","inArray","isNull","lt","sql","ActiveEphemeralRegistrationTokenExistsError","ActiveEphemeralRegistrationTokensExistError","EmptyRunnerLabelsError","RegistrationTokenBatchExceedsReservationError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RegistrationTokenWorkspaceMismatchError","ReservationExpiredError","ReservationNotFoundError","sanitizeRunnerLabelsOrThrow","db","ephemeralRegistrationTokens","toEphemeralRegistrationToken","provisionerTokens","reservations","providerRunners","runnerSessions","toRunnerSession","createEphemeralRegistrationToken","params","rows","transaction","tx","providerRunnerLockKey","workspaceId","provisionerId","providerRunnerId","join","execute","active","select","id","from","where","consumedAt","expiresAt","limit","insert","values","reservationId","hashedToken","prefix","returning","row","Error","createEphemeralRegistrationTokensBatch","provisionerLockKey","Set","map","sort","reservation","count","isExpired","length","existingForReservation","alreadyMinted","providerRunnerIds","activeRows","resolveEphemeralRegistrationTokenByHash","undefined","deleteExpiredEphemeralRegistrationTokens","terminalAt","retentionCutoff","retentionDays","deletableIds","orderBy","deleted","delete","createRunnerSessionConsumingEphemeralToken","consumed","update","set","ephemeralTokenId","token","provisioner","scope","labels","source","session","registrationTokenId","registrationTokenKind","toolCapabilities","toolCapabilitiesReportedAt","maxClaims","claimsUsed","consumedSessionId","runnerSessionId","updatedAt","reservationReleasedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEvE,SACEC,2CAA2C,EAC3CC,2CAA2C,EAC3CC,sBAAsB,EACtBC,6CAA6C,EAC7CC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,uCAAuC,EACvCC,uBAAuB,EACvBC,wBAAwB,QACnB,kBAAkB;AACzB,SAAQC,2BAA2B,QAAO,yBAAyB;AACnE,SAAQC,EAAE,QAAO,UAAU;AAC3B,SACEC,2BAA2B,EAC3BC,4BAA4B,QACvB,4CAA4C;AACnD,SAAQC,iBAAiB,QAAO,iCAAiC;AACjE,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,eAAe,QAAO,+BAA+B;AAC7D,SAAQC,cAAc,EAAEC,eAAe,QAAO,8BAA8B;AA0B5E,OAAO,eAAeC,iCACpBC,MAA8C;IAE9C,MAAMC,OAAO,MAAMV,KAAKW,WAAW,CAAC,OAAOC;QACzC,MAAMC,wBAAwB;YAC5B;YACAJ,OAAOK,WAAW;YAClBL,OAAOM,aAAa;YACpBN,OAAOO,gBAAgB;SACxB,CAACC,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEwB,sBAAsB,EAAE,CAAC;QAEtF,MAAM,CAACM,OAAO,GAAG,MAAMP,GACpBQ,MAAM,CAAC;YAACC,IAAIpB,4BAA4BoB,EAAE;QAAA,GAC1CC,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE/B,GAAGiB,4BAA4Be,gBAAgB,EAAEP,OAAOO,gBAAgB,GACxE7B,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC,IAGvDqC,KAAK,CAAC;QAET,IAAIP,QAAQ;YACV,MAAM,IAAI7B,4CACRmB,OAAOK,WAAW,EAClBL,OAAOM,aAAa,EACpBN,OAAOO,gBAAgB;QAE3B;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAAC1B,6BACP2B,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BC,eAAeN,OAAOM,aAAa;YACnCc,eAAepB,OAAOoB,aAAa,IAAI;YACvCb,kBAAkBP,OAAOO,gBAAgB;YACzCc,aAAarB,OAAOqB,WAAW;YAC/BC,QAAQtB,OAAOsB,MAAM;YACrBN,WAAWhB,OAAOgB,SAAS;QAC7B,GACCO,SAAS;IACd;IAEA,MAAMC,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOhC,6BAA6B+B;AACtC;AAEA,OAAO,eAAeE,uCACpB1B,MAAoD;IAEpD,MAAMC,OAAO,MAAMV,KAAKW,WAAW,CAAC,OAAOC;QACzC,MAAMwB,qBAAqB;YACzB;YACA3B,OAAOK,WAAW;YAClBL,OAAOM,aAAa;SACrB,CAACE,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAE+C,mBAAmB,EAAE,CAAC;QACnF,KAAK,MAAMpB,oBAAoB;eAC1B,IAAIqB,IAAI5B,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;SACzD,CAACuB,IAAI,GAAI;YACR,MAAM1B,wBAAwB;gBAC5B;gBACAJ,OAAOK,WAAW;gBAClBL,OAAOM,aAAa;gBACpBC;aACD,CAACC,IAAI,CAAC;YACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEwB,sBAAsB,EAAE,CAAC;QACxF;QAEA,MAAM,CAAC2B,YAAY,GAAG,MAAM5B,GACzBQ,MAAM,CAAC;YACNqB,OAAOrC,aAAaqC,KAAK;YACzBC,WAAWrD,GAAY,CAAC,EAAEe,aAAaqB,SAAS,CAAC,SAAS,CAAC;QAC7D,GACCH,IAAI,CAAClB,cACLmB,KAAK,CACJzC,IACEE,GAAGoB,aAAaiB,EAAE,EAAEZ,OAAOoB,aAAa,GACxC7C,GAAGoB,aAAaU,WAAW,EAAEL,OAAOK,WAAW,GAC/C9B,GAAGoB,aAAaW,aAAa,EAAEN,OAAOM,aAAa,IAGtDW,KAAK,CAAC;QAET,IAAI,CAACc,aAAa,MAAM,IAAI1C,yBAAyBW,OAAOoB,aAAa;QACzE,IAAIW,YAAYE,SAAS,EAAE,MAAM,IAAI7C,wBAAwBY,OAAOoB,aAAa;QACjF,IAAIpB,OAAOC,IAAI,CAACiC,MAAM,GAAGH,YAAYC,KAAK,EAAE;YAC1C,MAAM,IAAIhD,8CACRgB,OAAOC,IAAI,CAACiC,MAAM,EAClBH,YAAYC,KAAK;QAErB;QAEA,MAAM,CAACG,uBAAuB,GAAG,MAAMhC,GACpCQ,MAAM,CAAC;YAACqB,OAAOpD,GAAW,CAAC,aAAa,CAAC;QAAA,GACzCiC,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE/B,GAAGiB,4BAA4B4B,aAAa,EAAEpB,OAAOoB,aAAa;QAGxE,MAAMgB,gBAAgBD,wBAAwBH,SAAS;QACvD,IAAII,gBAAgBpC,OAAOC,IAAI,CAACiC,MAAM,GAAGH,YAAYC,KAAK,EAAE;YAC1D,MAAM,IAAIhD,8CACRgB,OAAOC,IAAI,CAACiC,MAAM,EAClBH,YAAYC,KAAK,EACjBI;QAEJ;QAEA,MAAMC,oBAAoBrC,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;QACvE,MAAM+B,aAAa,MAAMnC,GACtBQ,MAAM,CAAC;YAACJ,kBAAkBf,4BAA4Be,gBAAgB;QAAA,GACtEM,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE7B,QAAQe,4BAA4Be,gBAAgB,EAAE8B,oBACtD3D,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC;QAI1D,IAAI0D,WAAWJ,MAAM,GAAG,GAAG;YACzB,MAAM,IAAIpD,4CACRwD,WAAWT,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;QAEhD;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAAC1B,6BACP2B,MAAM,CACLnB,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAS,CAAA;gBACxBnB,aAAaL,OAAOK,WAAW;gBAC/BC,eAAeN,OAAOM,aAAa;gBACnCc,eAAepB,OAAOoB,aAAa;gBACnCb,kBAAkBiB,IAAIjB,gBAAgB;gBACtCc,aAAaG,IAAIH,WAAW;gBAC5BC,QAAQE,IAAIF,MAAM;gBAClBN,WAAWhB,OAAOgB,SAAS;YAC7B,CAAA,IAEDO,SAAS;IACd;IAEA,OAAOtB,KAAK4B,GAAG,CAACpC;AAClB;AAEA,OAAO,eAAe8C,wCACpBlB,WAAmB;IAEnB,MAAMpB,OAAO,MAAMV,KAChBoB,MAAM,GACNE,IAAI,CAACrB,6BACLsB,KAAK,CAACvC,GAAGiB,4BAA4B6B,WAAW,EAAEA,cAClDJ,KAAK,CAAC;IAET,MAAMO,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,OAAOgB;IACjB,OAAO/C,6BAA6B+B;AACtC;AAOA;;;;;;;CAOC,GACD,OAAO,eAAeiB,yCACpBzC,MAAsD;IAEtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM0C,aAAa9D,GAAG,CAAC,SAAS,EAAEY,4BAA4BuB,UAAU,CAAC,EAAE,EAAEvB,4BAA4BwB,SAAS,CAAC,CAAC,CAAC;IACrH,MAAM2B,kBAAkB/D,GAAG,CAAC,SAAS,EAAEoB,OAAO4C,aAAa,CAAC,sBAAsB,CAAC;IAEnF,MAAMC,eAAetD,KAClBoB,MAAM,CAAC;QAACC,IAAIpB,4BAA4BoB,EAAE;IAAA,GAC1CC,IAAI,CAACrB,6BACLsB,KAAK,CAACnC,GAAG+D,YAAYC,kBACrBG,OAAO,CAACxE,IAAIoE,aAAapE,IAAIkB,4BAA4BoB,EAAE,GAC3DK,KAAK,CAACjB,OAAOiB,KAAK,IAAI;IAEzB,MAAM8B,UAAU,MAAMxD,KACnByD,MAAM,CAACxD,6BACPsB,KAAK,CAACrC,QAAQe,4BAA4BoB,EAAE,EAAEiC,eAC9CtB,SAAS,CAAC;QAACX,IAAIpB,4BAA4BoB,EAAE;IAAA;IAEhD,OAAOmC,QAAQb,MAAM;AACvB;AAEA,OAAO,eAAee,2CAA2CjD,MAMhE;IACC,OAAO,MAAMT,KAAKW,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEoB,OAAOK,WAAW,CAAC,EAAE,CAAC;QAEnF,MAAM6C,WAAW,MAAM/C,GACpBgD,MAAM,CAAC3D,6BACP4D,GAAG,CAAC;YAACrC,YAAYnC,GAAG,CAAC,KAAK,CAAC;QAAA,GAC3BkC,KAAK,CACJzC,IACEE,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOqD,gBAAgB,GAC1D9E,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D3B,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC,IAGvD2C,SAAS,CAAC;YACTX,IAAIpB,4BAA4BoB,EAAE;YAClCN,eAAed,4BAA4Bc,aAAa;YACxDC,kBAAkBf,4BAA4Be,gBAAgB;QAChE;QAEF,IAAI,CAAC2C,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,CAACI,MAAM,GAAG,MAAMnD,GACnBQ,MAAM,CAAC;gBACNN,aAAab,4BAA4Ba,WAAW;gBACpDU,YAAYvB,4BAA4BuB,UAAU;gBAClDkB,WAAWrD,GAAY,CAAC,EAAEY,4BAA4BwB,SAAS,CAAC,SAAS,CAAC;YAC5E,GACCH,IAAI,CAACrB,6BACLsB,KAAK,CAACvC,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOqD,gBAAgB,GAChEpC,KAAK,CAAC;YAET,IAAI,CAACqC,OAAO;gBACV,MAAM,IAAI7B,MAAM,CAAC,wCAAwC,EAAEzB,OAAOqD,gBAAgB,EAAE;YACtF;YACA,IAAIC,MAAMjD,WAAW,KAAKL,OAAOK,WAAW,EAAE;gBAC5C,MAAM,IAAIlB,wCACRa,OAAOqD,gBAAgB,EACvBrD,OAAOK,WAAW;YAEtB;YACA,IAAIiD,MAAMvC,UAAU,EAAE,MAAM,IAAI9B,+BAA+Be,OAAOqD,gBAAgB;YACtF,IAAIC,MAAMrB,SAAS,EAAE,MAAM,IAAI/C,8BAA8Bc,OAAOqD,gBAAgB;YACpF,MAAM,IAAI5B,MACR,CAAC,oDAAoD,EAAEzB,OAAOqD,gBAAgB,EAAE;QAEpF;QAEA,MAAM,CAACE,YAAY,GAAG,MAAMpD,GACzBQ,MAAM,CAAC;YAAC6C,OAAO9D,kBAAkB8D,KAAK;QAAA,GACtC3C,IAAI,CAACnB,mBACLoB,KAAK,CAACvC,GAAGmB,kBAAkBkB,EAAE,EAAEsC,QAAQ,CAAC,EAAE,CAAC5C,aAAa,GACxDW,KAAK,CAAC;QACT,MAAMwC,SAASnE,4BAA4BU,OAAOyD,MAAM,EAAE;YACxDD,OAAOD,aAAaC,SAAS;YAC7BE,QAAQ;QACV;QACA,IAAID,OAAOvB,MAAM,KAAK,GAAG,MAAM,IAAInD;QAEnC,MAAM,CAAC4E,QAAQ,GAAG,MAAMxD,GACrBe,MAAM,CAACrB,gBACPsB,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BmD,OAAO;YACPI,qBAAqB5D,OAAOqD,gBAAgB;YAC5CQ,uBAAuB;YACvBvD,eAAe4C,QAAQ,CAAC,EAAE,CAAC5C,aAAa;YACxCC,kBAAkB2C,QAAQ,CAAC,EAAE,CAAC3C,gBAAgB;YAC9CkD;YACAK,kBAAkB9D,OAAO8D,gBAAgB,IAAI;YAC7CC,4BAA4B/D,OAAO8D,gBAAgB,GAAGlF,GAAG,CAAC,KAAK,CAAC,GAAG;YACnEoF,WAAWhE,OAAOgE,SAAS;YAC3BC,YAAY;QACd,GACC1C,SAAS;QAEZ,IAAI,CAACoC,SAAS,MAAM,IAAIlC,MAAM;QAE9B,MAAMtB,GACHgD,MAAM,CAAC3D,6BACP4D,GAAG,CAAC;YAACc,mBAAmBP,QAAQ/C,EAAE;QAAA,GAClCE,KAAK,CAACvC,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOqD,gBAAgB;QAEnE,MAAMlD,GACHgD,MAAM,CAACvD,iBACPwD,GAAG,CAAC;YAACe,iBAAiBR,QAAQ/C,EAAE;YAAEwD,WAAWxF,GAAG,CAAC,KAAK,CAAC;QAAA,GACvDkC,KAAK,CACJzC,IACEE,GAAGqB,gBAAgBS,WAAW,EAAEL,OAAOK,WAAW,GAClD9B,GAAGqB,gBAAgBU,aAAa,EAAE4C,QAAQ,CAAC,EAAE,CAAC5C,aAAa,GAC3D/B,GAAGqB,gBAAgBW,gBAAgB,EAAE2C,QAAQ,CAAC,EAAE,CAAC3C,gBAAgB,GACjE7B,OAAOkB,gBAAgByE,qBAAqB;QAIlD,OAAOvE,gBAAgB6D;IACzB;AACF"}
+{"version":3,"sources":["../../src/db/ephemeral-registration-tokens.ts"],"sourcesContent":["import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {and, asc, eq, gt, inArray, isNull, lt, sql} from 'drizzle-orm';\nimport type {EphemeralRegistrationToken} from '#core/entities/ephemeral-registration-token.js';\nimport {\n  ActiveEphemeralRegistrationTokenExistsError,\n  ActiveEphemeralRegistrationTokensExistError,\n  EmptyRunnerLabelsError,\n  RegistrationTokenBatchExceedsReservationError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RegistrationTokenWorkspaceMismatchError,\n  ReservationExpiredError,\n  ReservationNotFoundError,\n} from '#core/errors.js';\nimport {sanitizeRunnerLabelsOrThrow} from '#core/runner-labels.js';\nimport {db} from './db.js';\nimport {\n  ephemeralRegistrationTokens,\n  toEphemeralRegistrationToken,\n} from './schema/ephemeral-registration-tokens.js';\nimport {provisionerTokens} from './schema/provisioner-tokens.js';\nimport {reservations} from './schema/reservations.js';\nimport {providerRunners} from './schema/runner-instances.js';\nimport {runnerSessions, toRunnerSession} from './schema/runner-sessions.js';\n\nexport interface CreateEphemeralRegistrationTokenParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId?: string | null | undefined;\n  providerRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n  expiresAt: Date;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchRow {\n  providerRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId: string;\n  expiresAt: Date;\n  rows: CreateEphemeralRegistrationTokensBatchRow[];\n}\n\nexport async function createEphemeralRegistrationToken(\n  params: CreateEphemeralRegistrationTokenParams,\n): Promise<EphemeralRegistrationToken> {\n  const rows = await db().transaction(async (tx) => {\n    const providerRunnerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n      params.providerRunnerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${providerRunnerLockKey}))`);\n\n    const [active] = await tx\n      .select({id: ephemeralRegistrationTokens.id})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.providerRunnerId, params.providerRunnerId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .limit(1);\n\n    if (active) {\n      throw new ActiveEphemeralRegistrationTokenExistsError(\n        params.workspaceId,\n        params.provisionerId,\n        params.providerRunnerId,\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values({\n        workspaceId: params.workspaceId,\n        provisionerId: params.provisionerId,\n        reservationId: params.reservationId ?? null,\n        providerRunnerId: params.providerRunnerId,\n        hashedToken: params.hashedToken,\n        prefix: params.prefix,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n  });\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toEphemeralRegistrationToken(row);\n}\n\nexport async function createEphemeralRegistrationTokensBatch(\n  params: CreateEphemeralRegistrationTokensBatchParams,\n): Promise<EphemeralRegistrationToken[]> {\n  const rows = await db().transaction(async (tx) => {\n    const provisionerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionerLockKey}))`);\n    for (const providerRunnerId of [\n      ...new Set(params.rows.map((row) => row.providerRunnerId)),\n    ].sort()) {\n      const providerRunnerLockKey = [\n        'runners_ephemeral_registration_tokens',\n        params.workspaceId,\n        params.provisionerId,\n        providerRunnerId,\n      ].join(':');\n      await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${providerRunnerLockKey}))`);\n    }\n\n    const [reservation] = await tx\n      .select({\n        count: reservations.count,\n        isExpired: sql<boolean>`${reservations.expiresAt} <= now()`,\n      })\n      .from(reservations)\n      .where(\n        and(\n          eq(reservations.id, params.reservationId),\n          eq(reservations.workspaceId, params.workspaceId),\n          eq(reservations.provisionerId, params.provisionerId),\n          eq(reservations.kind, 'launch'),\n        ),\n      )\n      .limit(1);\n\n    if (!reservation) throw new ReservationNotFoundError(params.reservationId);\n    if (reservation.isExpired) throw new ReservationExpiredError(params.reservationId);\n    if (params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n      );\n    }\n\n    const [existingForReservation] = await tx\n      .select({count: sql<number>`count(*)::int`})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.reservationId, params.reservationId),\n        ),\n      );\n    const alreadyMinted = existingForReservation?.count ?? 0;\n    if (alreadyMinted + params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n        alreadyMinted,\n      );\n    }\n\n    const providerRunnerIds = params.rows.map((row) => row.providerRunnerId);\n    const activeRows = await tx\n      .select({providerRunnerId: ephemeralRegistrationTokens.providerRunnerId})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          inArray(ephemeralRegistrationTokens.providerRunnerId, providerRunnerIds),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      );\n\n    if (activeRows.length > 0) {\n      throw new ActiveEphemeralRegistrationTokensExistError(\n        activeRows.map((row) => row.providerRunnerId),\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values(\n        params.rows.map((row) => ({\n          workspaceId: params.workspaceId,\n          provisionerId: params.provisionerId,\n          reservationId: params.reservationId,\n          providerRunnerId: row.providerRunnerId,\n          hashedToken: row.hashedToken,\n          prefix: row.prefix,\n          expiresAt: params.expiresAt,\n        })),\n      )\n      .returning();\n  });\n\n  return rows.map(toEphemeralRegistrationToken);\n}\n\nexport async function resolveEphemeralRegistrationTokenByHash(\n  hashedToken: string,\n): Promise<EphemeralRegistrationToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(ephemeralRegistrationTokens)\n    .where(eq(ephemeralRegistrationTokens.hashedToken, hashedToken))\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toEphemeralRegistrationToken(row);\n}\n\nexport interface DeleteExpiredEphemeralRegistrationTokensParams {\n  retentionDays: number;\n  limit?: number;\n}\n\n/**\n * Deletes ephemeral registration tokens that have reached a terminal state and\n * outlived the retention window. A token is terminal once it is consumed\n * (single use spent) or expired without consumption; the retention window is\n * measured from that terminal event so the audit record survives a bounded\n * debugging window. Active tokens that are neither consumed nor expired are\n * never deleted, so a live single-use credential is never removed early.\n */\nexport async function deleteExpiredEphemeralRegistrationTokens(\n  params: DeleteExpiredEphemeralRegistrationTokensParams,\n): Promise<number> {\n  // coalesce(consumed_at, expires_at) is the terminal timestamp: consumed_at\n  // when the token was spent, otherwise its expiry. Comparing it to the cutoff\n  // both selects deletable rows and orders the batch, and it matches the\n  // terminal index so idle GC ticks never scan live rows.\n  const terminalAt = sql`coalesce(${ephemeralRegistrationTokens.consumedAt}, ${ephemeralRegistrationTokens.expiresAt})`;\n  const retentionCutoff = sql`now() - (${params.retentionDays} || ' days')::interval`;\n\n  const deletableIds = db()\n    .select({id: ephemeralRegistrationTokens.id})\n    .from(ephemeralRegistrationTokens)\n    .where(lt(terminalAt, retentionCutoff))\n    .orderBy(asc(terminalAt), asc(ephemeralRegistrationTokens.id))\n    .limit(params.limit ?? 1000);\n\n  const deleted = await db()\n    .delete(ephemeralRegistrationTokens)\n    .where(inArray(ephemeralRegistrationTokens.id, deletableIds))\n    .returning({id: ephemeralRegistrationTokens.id});\n\n  return deleted.length;\n}\n\nexport async function createRunnerSessionConsumingEphemeralToken(params: {\n  ephemeralTokenId: string;\n  workspaceId: string;\n  labels: string[];\n  toolCapabilities?: RunnerToolCapabilitiesDto | null;\n  maxClaims: number;\n}) {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);\n\n    const consumed = await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedAt: sql`now()`})\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId),\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning({\n        id: ephemeralRegistrationTokens.id,\n        provisionerId: ephemeralRegistrationTokens.provisionerId,\n        providerRunnerId: ephemeralRegistrationTokens.providerRunnerId,\n      });\n\n    if (!consumed[0]) {\n      const [token] = await tx\n        .select({\n          workspaceId: ephemeralRegistrationTokens.workspaceId,\n          consumedAt: ephemeralRegistrationTokens.consumedAt,\n          isExpired: sql<boolean>`${ephemeralRegistrationTokens.expiresAt} <= now()`,\n        })\n        .from(ephemeralRegistrationTokens)\n        .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId))\n        .limit(1);\n\n      if (!token) {\n        throw new Error(`Ephemeral registration token not found: ${params.ephemeralTokenId}`);\n      }\n      if (token.workspaceId !== params.workspaceId) {\n        throw new RegistrationTokenWorkspaceMismatchError(\n          params.ephemeralTokenId,\n          params.workspaceId,\n        );\n      }\n      if (token.consumedAt) throw new RegistrationTokenConsumedError(params.ephemeralTokenId);\n      if (token.isExpired) throw new RegistrationTokenExpiredError(params.ephemeralTokenId);\n      throw new Error(\n        `Ephemeral registration token could not be consumed: ${params.ephemeralTokenId}`,\n      );\n    }\n\n    const [provisioner] = await tx\n      .select({scope: provisionerTokens.scope})\n      .from(provisionerTokens)\n      .where(eq(provisionerTokens.id, consumed[0].provisionerId))\n      .limit(1);\n    const labels = sanitizeRunnerLabelsOrThrow(params.labels, {\n      scope: provisioner?.scope ?? 'workspace',\n      source: 'ephemeral runner registration',\n    });\n    if (labels.length === 0) throw new EmptyRunnerLabelsError();\n\n    const [session] = await tx\n      .insert(runnerSessions)\n      .values({\n        workspaceId: params.workspaceId,\n        scope: 'workspace',\n        registrationTokenId: params.ephemeralTokenId,\n        registrationTokenKind: 'ephemeral',\n        provisionerId: consumed[0].provisionerId,\n        providerRunnerId: consumed[0].providerRunnerId,\n        labels,\n        toolCapabilities: params.toolCapabilities ?? null,\n        toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,\n        maxClaims: params.maxClaims,\n        claimsUsed: 0,\n      })\n      .returning();\n\n    if (!session) throw new Error('Insert returned no rows');\n\n    await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedSessionId: session.id})\n      .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId));\n\n    await tx\n      .update(providerRunners)\n      .set({runnerSessionId: session.id, updatedAt: sql`now()`})\n      .where(\n        and(\n          eq(providerRunners.workspaceId, params.workspaceId),\n          eq(providerRunners.provisionerId, consumed[0].provisionerId),\n          eq(providerRunners.providerRunnerId, consumed[0].providerRunnerId),\n          isNull(providerRunners.reservationReleasedAt),\n        ),\n      );\n\n    return toRunnerSession(session);\n  });\n}\n"],"names":["and","asc","eq","gt","inArray","isNull","lt","sql","ActiveEphemeralRegistrationTokenExistsError","ActiveEphemeralRegistrationTokensExistError","EmptyRunnerLabelsError","RegistrationTokenBatchExceedsReservationError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RegistrationTokenWorkspaceMismatchError","ReservationExpiredError","ReservationNotFoundError","sanitizeRunnerLabelsOrThrow","db","ephemeralRegistrationTokens","toEphemeralRegistrationToken","provisionerTokens","reservations","providerRunners","runnerSessions","toRunnerSession","createEphemeralRegistrationToken","params","rows","transaction","tx","providerRunnerLockKey","workspaceId","provisionerId","providerRunnerId","join","execute","active","select","id","from","where","consumedAt","expiresAt","limit","insert","values","reservationId","hashedToken","prefix","returning","row","Error","createEphemeralRegistrationTokensBatch","provisionerLockKey","Set","map","sort","reservation","count","isExpired","kind","length","existingForReservation","alreadyMinted","providerRunnerIds","activeRows","resolveEphemeralRegistrationTokenByHash","undefined","deleteExpiredEphemeralRegistrationTokens","terminalAt","retentionCutoff","retentionDays","deletableIds","orderBy","deleted","delete","createRunnerSessionConsumingEphemeralToken","consumed","update","set","ephemeralTokenId","token","provisioner","scope","labels","source","session","registrationTokenId","registrationTokenKind","toolCapabilities","toolCapabilitiesReportedAt","maxClaims","claimsUsed","consumedSessionId","runnerSessionId","updatedAt","reservationReleasedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEvE,SACEC,2CAA2C,EAC3CC,2CAA2C,EAC3CC,sBAAsB,EACtBC,6CAA6C,EAC7CC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,uCAAuC,EACvCC,uBAAuB,EACvBC,wBAAwB,QACnB,kBAAkB;AACzB,SAAQC,2BAA2B,QAAO,yBAAyB;AACnE,SAAQC,EAAE,QAAO,UAAU;AAC3B,SACEC,2BAA2B,EAC3BC,4BAA4B,QACvB,4CAA4C;AACnD,SAAQC,iBAAiB,QAAO,iCAAiC;AACjE,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,eAAe,QAAO,+BAA+B;AAC7D,SAAQC,cAAc,EAAEC,eAAe,QAAO,8BAA8B;AA0B5E,OAAO,eAAeC,iCACpBC,MAA8C;IAE9C,MAAMC,OAAO,MAAMV,KAAKW,WAAW,CAAC,OAAOC;QACzC,MAAMC,wBAAwB;YAC5B;YACAJ,OAAOK,WAAW;YAClBL,OAAOM,aAAa;YACpBN,OAAOO,gBAAgB;SACxB,CAACC,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEwB,sBAAsB,EAAE,CAAC;QAEtF,MAAM,CAACM,OAAO,GAAG,MAAMP,GACpBQ,MAAM,CAAC;YAACC,IAAIpB,4BAA4BoB,EAAE;QAAA,GAC1CC,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE/B,GAAGiB,4BAA4Be,gBAAgB,EAAEP,OAAOO,gBAAgB,GACxE7B,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC,IAGvDqC,KAAK,CAAC;QAET,IAAIP,QAAQ;YACV,MAAM,IAAI7B,4CACRmB,OAAOK,WAAW,EAClBL,OAAOM,aAAa,EACpBN,OAAOO,gBAAgB;QAE3B;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAAC1B,6BACP2B,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BC,eAAeN,OAAOM,aAAa;YACnCc,eAAepB,OAAOoB,aAAa,IAAI;YACvCb,kBAAkBP,OAAOO,gBAAgB;YACzCc,aAAarB,OAAOqB,WAAW;YAC/BC,QAAQtB,OAAOsB,MAAM;YACrBN,WAAWhB,OAAOgB,SAAS;QAC7B,GACCO,SAAS;IACd;IAEA,MAAMC,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOhC,6BAA6B+B;AACtC;AAEA,OAAO,eAAeE,uCACpB1B,MAAoD;IAEpD,MAAMC,OAAO,MAAMV,KAAKW,WAAW,CAAC,OAAOC;QACzC,MAAMwB,qBAAqB;YACzB;YACA3B,OAAOK,WAAW;YAClBL,OAAOM,aAAa;SACrB,CAACE,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAE+C,mBAAmB,EAAE,CAAC;QACnF,KAAK,MAAMpB,oBAAoB;eAC1B,IAAIqB,IAAI5B,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;SACzD,CAACuB,IAAI,GAAI;YACR,MAAM1B,wBAAwB;gBAC5B;gBACAJ,OAAOK,WAAW;gBAClBL,OAAOM,aAAa;gBACpBC;aACD,CAACC,IAAI,CAAC;YACP,MAAML,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEwB,sBAAsB,EAAE,CAAC;QACxF;QAEA,MAAM,CAAC2B,YAAY,GAAG,MAAM5B,GACzBQ,MAAM,CAAC;YACNqB,OAAOrC,aAAaqC,KAAK;YACzBC,WAAWrD,GAAY,CAAC,EAAEe,aAAaqB,SAAS,CAAC,SAAS,CAAC;QAC7D,GACCH,IAAI,CAAClB,cACLmB,KAAK,CACJzC,IACEE,GAAGoB,aAAaiB,EAAE,EAAEZ,OAAOoB,aAAa,GACxC7C,GAAGoB,aAAaU,WAAW,EAAEL,OAAOK,WAAW,GAC/C9B,GAAGoB,aAAaW,aAAa,EAAEN,OAAOM,aAAa,GACnD/B,GAAGoB,aAAauC,IAAI,EAAE,YAGzBjB,KAAK,CAAC;QAET,IAAI,CAACc,aAAa,MAAM,IAAI1C,yBAAyBW,OAAOoB,aAAa;QACzE,IAAIW,YAAYE,SAAS,EAAE,MAAM,IAAI7C,wBAAwBY,OAAOoB,aAAa;QACjF,IAAIpB,OAAOC,IAAI,CAACkC,MAAM,GAAGJ,YAAYC,KAAK,EAAE;YAC1C,MAAM,IAAIhD,8CACRgB,OAAOC,IAAI,CAACkC,MAAM,EAClBJ,YAAYC,KAAK;QAErB;QAEA,MAAM,CAACI,uBAAuB,GAAG,MAAMjC,GACpCQ,MAAM,CAAC;YAACqB,OAAOpD,GAAW,CAAC,aAAa,CAAC;QAAA,GACzCiC,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE/B,GAAGiB,4BAA4B4B,aAAa,EAAEpB,OAAOoB,aAAa;QAGxE,MAAMiB,gBAAgBD,wBAAwBJ,SAAS;QACvD,IAAIK,gBAAgBrC,OAAOC,IAAI,CAACkC,MAAM,GAAGJ,YAAYC,KAAK,EAAE;YAC1D,MAAM,IAAIhD,8CACRgB,OAAOC,IAAI,CAACkC,MAAM,EAClBJ,YAAYC,KAAK,EACjBK;QAEJ;QAEA,MAAMC,oBAAoBtC,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;QACvE,MAAMgC,aAAa,MAAMpC,GACtBQ,MAAM,CAAC;YAACJ,kBAAkBf,4BAA4Be,gBAAgB;QAAA,GACtEM,IAAI,CAACrB,6BACLsB,KAAK,CACJzC,IACEE,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D9B,GAAGiB,4BAA4Bc,aAAa,EAAEN,OAAOM,aAAa,GAClE7B,QAAQe,4BAA4Be,gBAAgB,EAAE+B,oBACtD5D,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC;QAI1D,IAAI2D,WAAWJ,MAAM,GAAG,GAAG;YACzB,MAAM,IAAIrD,4CACRyD,WAAWV,GAAG,CAAC,CAACL,MAAQA,IAAIjB,gBAAgB;QAEhD;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAAC1B,6BACP2B,MAAM,CACLnB,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAS,CAAA;gBACxBnB,aAAaL,OAAOK,WAAW;gBAC/BC,eAAeN,OAAOM,aAAa;gBACnCc,eAAepB,OAAOoB,aAAa;gBACnCb,kBAAkBiB,IAAIjB,gBAAgB;gBACtCc,aAAaG,IAAIH,WAAW;gBAC5BC,QAAQE,IAAIF,MAAM;gBAClBN,WAAWhB,OAAOgB,SAAS;YAC7B,CAAA,IAEDO,SAAS;IACd;IAEA,OAAOtB,KAAK4B,GAAG,CAACpC;AAClB;AAEA,OAAO,eAAe+C,wCACpBnB,WAAmB;IAEnB,MAAMpB,OAAO,MAAMV,KAChBoB,MAAM,GACNE,IAAI,CAACrB,6BACLsB,KAAK,CAACvC,GAAGiB,4BAA4B6B,WAAW,EAAEA,cAClDJ,KAAK,CAAC;IAET,MAAMO,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,OAAOiB;IACjB,OAAOhD,6BAA6B+B;AACtC;AAOA;;;;;;;CAOC,GACD,OAAO,eAAekB,yCACpB1C,MAAsD;IAEtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM2C,aAAa/D,GAAG,CAAC,SAAS,EAAEY,4BAA4BuB,UAAU,CAAC,EAAE,EAAEvB,4BAA4BwB,SAAS,CAAC,CAAC,CAAC;IACrH,MAAM4B,kBAAkBhE,GAAG,CAAC,SAAS,EAAEoB,OAAO6C,aAAa,CAAC,sBAAsB,CAAC;IAEnF,MAAMC,eAAevD,KAClBoB,MAAM,CAAC;QAACC,IAAIpB,4BAA4BoB,EAAE;IAAA,GAC1CC,IAAI,CAACrB,6BACLsB,KAAK,CAACnC,GAAGgE,YAAYC,kBACrBG,OAAO,CAACzE,IAAIqE,aAAarE,IAAIkB,4BAA4BoB,EAAE,GAC3DK,KAAK,CAACjB,OAAOiB,KAAK,IAAI;IAEzB,MAAM+B,UAAU,MAAMzD,KACnB0D,MAAM,CAACzD,6BACPsB,KAAK,CAACrC,QAAQe,4BAA4BoB,EAAE,EAAEkC,eAC9CvB,SAAS,CAAC;QAACX,IAAIpB,4BAA4BoB,EAAE;IAAA;IAEhD,OAAOoC,QAAQb,MAAM;AACvB;AAEA,OAAO,eAAee,2CAA2ClD,MAMhE;IACC,OAAO,MAAMT,KAAKW,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGM,OAAO,CAAC7B,GAAG,CAAC,sCAAsC,EAAEoB,OAAOK,WAAW,CAAC,EAAE,CAAC;QAEnF,MAAM8C,WAAW,MAAMhD,GACpBiD,MAAM,CAAC5D,6BACP6D,GAAG,CAAC;YAACtC,YAAYnC,GAAG,CAAC,KAAK,CAAC;QAAA,GAC3BkC,KAAK,CACJzC,IACEE,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOsD,gBAAgB,GAC1D/E,GAAGiB,4BAA4Ba,WAAW,EAAEL,OAAOK,WAAW,GAC9D3B,OAAOc,4BAA4BuB,UAAU,GAC7CvC,GAAGgB,4BAA4BwB,SAAS,EAAEpC,GAAG,CAAC,KAAK,CAAC,IAGvD2C,SAAS,CAAC;YACTX,IAAIpB,4BAA4BoB,EAAE;YAClCN,eAAed,4BAA4Bc,aAAa;YACxDC,kBAAkBf,4BAA4Be,gBAAgB;QAChE;QAEF,IAAI,CAAC4C,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,CAACI,MAAM,GAAG,MAAMpD,GACnBQ,MAAM,CAAC;gBACNN,aAAab,4BAA4Ba,WAAW;gBACpDU,YAAYvB,4BAA4BuB,UAAU;gBAClDkB,WAAWrD,GAAY,CAAC,EAAEY,4BAA4BwB,SAAS,CAAC,SAAS,CAAC;YAC5E,GACCH,IAAI,CAACrB,6BACLsB,KAAK,CAACvC,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOsD,gBAAgB,GAChErC,KAAK,CAAC;YAET,IAAI,CAACsC,OAAO;gBACV,MAAM,IAAI9B,MAAM,CAAC,wCAAwC,EAAEzB,OAAOsD,gBAAgB,EAAE;YACtF;YACA,IAAIC,MAAMlD,WAAW,KAAKL,OAAOK,WAAW,EAAE;gBAC5C,MAAM,IAAIlB,wCACRa,OAAOsD,gBAAgB,EACvBtD,OAAOK,WAAW;YAEtB;YACA,IAAIkD,MAAMxC,UAAU,EAAE,MAAM,IAAI9B,+BAA+Be,OAAOsD,gBAAgB;YACtF,IAAIC,MAAMtB,SAAS,EAAE,MAAM,IAAI/C,8BAA8Bc,OAAOsD,gBAAgB;YACpF,MAAM,IAAI7B,MACR,CAAC,oDAAoD,EAAEzB,OAAOsD,gBAAgB,EAAE;QAEpF;QAEA,MAAM,CAACE,YAAY,GAAG,MAAMrD,GACzBQ,MAAM,CAAC;YAAC8C,OAAO/D,kBAAkB+D,KAAK;QAAA,GACtC5C,IAAI,CAACnB,mBACLoB,KAAK,CAACvC,GAAGmB,kBAAkBkB,EAAE,EAAEuC,QAAQ,CAAC,EAAE,CAAC7C,aAAa,GACxDW,KAAK,CAAC;QACT,MAAMyC,SAASpE,4BAA4BU,OAAO0D,MAAM,EAAE;YACxDD,OAAOD,aAAaC,SAAS;YAC7BE,QAAQ;QACV;QACA,IAAID,OAAOvB,MAAM,KAAK,GAAG,MAAM,IAAIpD;QAEnC,MAAM,CAAC6E,QAAQ,GAAG,MAAMzD,GACrBe,MAAM,CAACrB,gBACPsB,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BoD,OAAO;YACPI,qBAAqB7D,OAAOsD,gBAAgB;YAC5CQ,uBAAuB;YACvBxD,eAAe6C,QAAQ,CAAC,EAAE,CAAC7C,aAAa;YACxCC,kBAAkB4C,QAAQ,CAAC,EAAE,CAAC5C,gBAAgB;YAC9CmD;YACAK,kBAAkB/D,OAAO+D,gBAAgB,IAAI;YAC7CC,4BAA4BhE,OAAO+D,gBAAgB,GAAGnF,GAAG,CAAC,KAAK,CAAC,GAAG;YACnEqF,WAAWjE,OAAOiE,SAAS;YAC3BC,YAAY;QACd,GACC3C,SAAS;QAEZ,IAAI,CAACqC,SAAS,MAAM,IAAInC,MAAM;QAE9B,MAAMtB,GACHiD,MAAM,CAAC5D,6BACP6D,GAAG,CAAC;YAACc,mBAAmBP,QAAQhD,EAAE;QAAA,GAClCE,KAAK,CAACvC,GAAGiB,4BAA4BoB,EAAE,EAAEZ,OAAOsD,gBAAgB;QAEnE,MAAMnD,GACHiD,MAAM,CAACxD,iBACPyD,GAAG,CAAC;YAACe,iBAAiBR,QAAQhD,EAAE;YAAEyD,WAAWzF,GAAG,CAAC,KAAK,CAAC;QAAA,GACvDkC,KAAK,CACJzC,IACEE,GAAGqB,gBAAgBS,WAAW,EAAEL,OAAOK,WAAW,GAClD9B,GAAGqB,gBAAgBU,aAAa,EAAE6C,QAAQ,CAAC,EAAE,CAAC7C,aAAa,GAC3D/B,GAAGqB,gBAAgBW,gBAAgB,EAAE4C,QAAQ,CAAC,EAAE,CAAC5C,gBAAgB,GACjE7B,OAAOkB,gBAAgB0E,qBAAqB;QAIlD,OAAOxE,gBAAgB8D;IACzB;AACF"}

package/dist/db/reservation-locks.d.ts

@@ -0,0 +1,6 @@
+import type { Tx } from './db.js';
+export declare function lockRunnerReservationAdvisoryKeysTx(tx: Tx, params: {
+    provisionerId: string;
+    reservationIds: readonly string[];
+}): Promise<void>;
+//# sourceMappingURL=reservation-locks.d.ts.map

package/dist/db/reservation-locks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reservation-locks.d.ts","sourceRoot":"","sources":["../../src/db/reservation-locks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAEhC,wBAAsB,mCAAmC,CACvD,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAC,GACjE,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/db/reservation-locks.js

@@ -0,0 +1,15 @@
+import { sql } from 'drizzle-orm';
+export async function lockRunnerReservationAdvisoryKeysTx(tx, params) {
+    const reservationIds = [
+        ...new Set(params.reservationIds)
+    ].sort();
+    if (reservationIds.length === 0) return;
+    const lockKeys = sql.join(reservationIds.map((reservationId)=>sql`(${`runners_assignment:${params.provisionerId}:${reservationId}`})`), sql`, `);
+    await tx.execute(sql`
+    select pg_advisory_xact_lock(hashtext(lock_key))
+    from (values ${lockKeys}) as reservation_locks(lock_key)
+    order by lock_key
+  `);
+}
+
+//# sourceMappingURL=reservation-locks.js.map

package/dist/db/reservation-locks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/reservation-locks.ts"],"sourcesContent":["import {sql} from 'drizzle-orm';\nimport type {Tx} from './db.js';\n\nexport async function lockRunnerReservationAdvisoryKeysTx(\n  tx: Tx,\n  params: {provisionerId: string; reservationIds: readonly string[]},\n): Promise<void> {\n  const reservationIds = [...new Set(params.reservationIds)].sort();\n  if (reservationIds.length === 0) return;\n\n  const lockKeys = sql.join(\n    reservationIds.map(\n      (reservationId) => sql`(${`runners_assignment:${params.provisionerId}:${reservationId}`})`,\n    ),\n    sql`, `,\n  );\n  await tx.execute(sql`\n    select pg_advisory_xact_lock(hashtext(lock_key))\n    from (values ${lockKeys}) as reservation_locks(lock_key)\n    order by lock_key\n  `);\n}\n"],"names":["sql","lockRunnerReservationAdvisoryKeysTx","tx","params","reservationIds","Set","sort","length","lockKeys","join","map","reservationId","provisionerId","execute"],"mappings":"AAAA,SAAQA,GAAG,QAAO,cAAc;AAGhC,OAAO,eAAeC,oCACpBC,EAAM,EACNC,MAAkE;IAElE,MAAMC,iBAAiB;WAAI,IAAIC,IAAIF,OAAOC,cAAc;KAAE,CAACE,IAAI;IAC/D,IAAIF,eAAeG,MAAM,KAAK,GAAG;IAEjC,MAAMC,WAAWR,IAAIS,IAAI,CACvBL,eAAeM,GAAG,CAChB,CAACC,gBAAkBX,GAAG,CAAC,CAAC,EAAE,CAAC,mBAAmB,EAAEG,OAAOS,aAAa,CAAC,CAAC,EAAED,eAAe,CAAC,CAAC,CAAC,GAE5FX,GAAG,CAAC,EAAE,CAAC;IAET,MAAME,GAAGW,OAAO,CAACb,GAAG,CAAC;;iBAEN,EAAEQ,SAAS;;EAE1B,CAAC;AACH"}

package/dist/db/reservations.d.ts

@@ -25,6 +25,8 @@ export interface PollDemandAndReserveParams {
     provisionerId: string;
     maxReservations: number;
     ttlSeconds: number;
+    /** Lifetime of the short reservation that gives rebound runners time to activate. */
+    activationGraceSeconds?: number;
     templates: ReservationTemplate[];
     capabilityWindowSeconds?: number;
 }
@@ -32,23 +34,34 @@ export interface InstallationPollDemandAndReserveParams {
     provisionerId: string;
     maxReservations: number;
     ttlSeconds: number;
+    /** Lifetime of the short reservation that gives rebound runners time to activate. */
+    activationGraceSeconds?: number;
     templates: ReservationTemplate[];
     capabilityWindowSeconds: number;
     eligibleWorkspaceIds: ReadonlySet<string>;
     signal?: AbortSignal;
     onReservations?: (reservations: ReservationGrant[]) => void;
 }
-export declare function pollDemandAndReserve(params: PollDemandAndReserveParams): Promise<{
+interface NewReservationUnits {
+    labels: string[];
+    count: number;
+}
+interface PollDemandAndReserveResult {
     stats: DemandStat[];
+    /** Only launch reservations are exposed to the provisioner. */
     reservations: ReservationGrant[];
-}>;
-export declare function pollDemandAndReserveTx(tx: Tx, params: PollDemandAndReserveParams): Promise<{
+    /** Internal allocation accounting for bound and launch rows together. */
+    newlyReservedUnits: NewReservationUnits[];
+}
+export declare function pollDemandAndReserve(params: PollDemandAndReserveParams): Promise<{
     stats: DemandStat[];
     reservations: ReservationGrant[];
 }>;
+export declare function pollDemandAndReserveTx(tx: Tx, params: PollDemandAndReserveParams): Promise<PollDemandAndReserveResult>;
 export declare function pollInstallationDemandAndReserve(params: InstallationPollDemandAndReserveParams): Promise<{
     stats: DemandStat[];
     reservations: ReservationGrant[];
+    newlyReservedCount?: number;
 }>;
 export declare function listQueuedDemandWorkspaceIds(): Promise<string[]>;
 export declare function deleteExpiredReservations(params?: {
@@ -63,4 +76,5 @@ export declare function releaseReservationUnits(tx: Tx, params: {
         count: number;
     }>;
 }): Promise<number>;
+export {};
 //# sourceMappingURL=reservations.d.ts.map

package/dist/db/reservations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reservations.d.ts","sourceRoot":"","sources":["../../src/db/reservations.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAUhC,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,sCAAsC;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;CAC7D;AAoBD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,YAAY,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAAC,CAIlE;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,YAAY,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAAC,CAGlE;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,sCAAsC,GAC7C,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,YAAY,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAAC,CA4ClE;AA+RD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAMtE;AA0BD,wBAAsB,yBAAyB,CAAC,MAAM,CAAC,EAAE;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAc1F;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AA0GD,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACzD,GACA,OAAO,CAAC,MAAM,CAAC,CA0CjB"}
+{"version":3,"file":"reservations.d.ts","sourceRoot":"","sources":["../../src/db/reservations.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAYhC,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,sCAAsC;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;CAC7D;AAoCD,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,0BAA0B;IAClC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,+DAA+D;IAC/D,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,yEAAyE;IACzE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;CAC3C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,YAAY,EAAE,gBAAgB,EAAE,CAAA;CAAC,CAAC,CAKlE;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAGrC;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,sCAAsC,GAC7C,OAAO,CAAC;IACT,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,CAsDD;AAieD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAMtE;AA0BD,wBAAsB,yBAAyB,CAAC,MAAM,CAAC,EAAE;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAc1F;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AAwHD,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,KAAK,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACzD,GACA,OAAO,CAAC,MAAM,CAAC,CA0CjB"}

package/dist/db/reservations.js

@@ -1,6 +1,9 @@
 import { canonicalizeLabels } from '@shipfox/runner-labels';
-import { and, arrayContains, asc, eq, exists, gt, inArray, isNotNull, isNull, lt, notExists, or, sql } from 'drizzle-orm';
+import { and, arrayContains, asc, eq, exists, gt, inArray, isNotNull, isNull, lt, notExists, notInArray, or, sql } from 'drizzle-orm';
+import { recordProviderRunnerActivationOutcome } from '#metrics/instance.js';
 import { db } from './db.js';
+import { lockRunnerReservationAdvisoryKeysTx } from './reservation-locks.js';
+import { terminalStates } from './runner-states.js';
 import { pendingJobExecutions } from './schema/pending-job-executions.js';
 import { provisionerCapabilitySnapshots } from './schema/provisioner-capability-snapshots.js';
 import { provisionerTokens } from './schema/provisioner-tokens.js';
@@ -9,9 +12,13 @@ import { runnerActivationTokens } from './schema/runner-activation-tokens.js';
 import { runnerControlSessions } from './schema/runner-control-sessions.js';
 import { providerRunners } from './schema/runner-instances.js';
 export async function pollDemandAndReserve(params) {
-    return await db().transaction(async (tx)=>{
+    const result = await db().transaction(async (tx)=>{
         return await pollDemandAndReserveTx(tx, params);
     });
+    return {
+        stats: result.stats,
+        reservations: result.reservations
+    };
 }
 export async function pollDemandAndReserveTx(tx, params) {
     await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);
@@ -38,13 +45,17 @@ export async function pollInstallationDemandAndReserve(params) {
             const locked = lockResult.rows[0];
             if (!locked?.locked) return {
                 stats: [],
-                reservations: []
+                reservations: [],
+                newlyReservedUnits: []
             };
             return await pollDemandAndReserveLockedTx(tx, {
                 workspaceId,
                 provisionerId: params.provisionerId,
                 maxReservations: remainingMaxReservations,
                 ttlSeconds: params.ttlSeconds,
+                ...params.activationGraceSeconds !== undefined ? {
+                    activationGraceSeconds: params.activationGraceSeconds
+                } : {},
                 templates: remainingTemplates.map((template)=>({
                         ...template,
                         availableSlots: template.remainingSlots
@@ -56,15 +67,21 @@ export async function pollInstallationDemandAndReserve(params) {
         results.push(result);
         consumeInstallationTemplateSlots(remainingTemplates, result.reservations);
         params.onReservations?.(result.reservations);
-        remainingMaxReservations -= result.reservations.reduce((total, reservation)=>total + reservation.count, 0);
+        remainingMaxReservations -= result.newlyReservedUnits.reduce((total, reservation)=>total + reservation.count, 0);
     }
+    const newlyReservedCount = results.reduce((total, result)=>total + result.newlyReservedUnits.reduce((subtotal, reservation)=>subtotal + reservation.count, 0), 0);
     return {
         stats: results.flatMap((result)=>result.stats),
-        reservations: results.flatMap((result)=>result.reservations)
+        reservations: results.flatMap((result)=>result.reservations),
+        ...newlyReservedCount > 0 ? {
+            newlyReservedCount
+        } : {}
     };
 }
-function consumeInstallationTemplateSlots(templates, reservations) {
-    for (const reservation of reservations){
+function consumeInstallationTemplateSlots(templates, launchGrants) {
+    // Adopted runners are already included in the running count behind availableSlots.
+    // Only units that still need a launch consume advertised template capacity.
+    for (const reservation of launchGrants){
         const satisfyingTemplates = templates.filter((template)=>isSubset(reservation.labels, template.labels)).sort((a, b)=>a.labels.length - b.labels.length || a.templateKey.localeCompare(b.templateKey));
         drawSlots(satisfyingTemplates, reservation.count);
     }
@@ -93,10 +110,10 @@ async function pollDemandAndReserveLockedTx(tx, params) {
             labelKey(row.requiredLabels),
             row.reserved
         ]));
-    const activeProvisionerReservationRows = await tx.select({
-        requiredLabels: reservations.requiredLabels,
-        reserved: sql`coalesce(sum(${reservations.count}), 0)::int`
-    }).from(reservations).where(and(eq(reservations.workspaceId, params.workspaceId), eq(reservations.provisionerId, params.provisionerId), gt(reservations.expiresAt, sql`now()`))).groupBy(reservations.requiredLabels);
+    const activeProvisionerReservationRows = await listActiveProvisionerReservationRowsTx(tx, {
+        workspaceId: params.workspaceId,
+        provisionerId: params.provisionerId
+    });
     const templates = params.templates.map((template)=>({
             templateKey: template.templateKey,
             labels: [
@@ -107,6 +124,7 @@ async function pollDemandAndReserveLockedTx(tx, params) {
     deductProvisionerReservations(templates, activeProvisionerReservationRows);
     const stats = [];
     const grants = [];
+    const newlyReservedUnits = [];
     let remainingMaxReservations = params.maxReservations;
     const workspaceIdField = params.capabilityWindowSeconds === undefined ? {} : {
         workspaceId: params.workspaceId
@@ -120,35 +138,68 @@ async function pollDemandAndReserveLockedTx(tx, params) {
         const grant = Math.min(unreserved, capacity, remainingMaxReservations);
         let reservedAfterGrant = reserved;
         if (grant > 0 && params.maxReservations > 0) {
-            const [inserted] = await tx.insert(reservations).values({
-                workspaceId: params.workspaceId,
-                provisionerId: params.provisionerId,
-                requiredLabels: demand.requiredLabels,
-                count: grant,
-                expiresAt: sql`now() + (${params.ttlSeconds} || ' seconds')::interval`
-            }).returning({
-                id: reservations.id,
-                expiresAt: reservations.expiresAt
-            });
-            if (!inserted) throw new Error('Insert returned no rows');
-            remainingMaxReservations -= grant;
-            drawSlots(satisfyingTemplates, grant);
-            await bindIdleRunnerInstancesTx(tx, {
+            const idleRunners = await listIdleRunnerInstancesTx(tx, {
                 provisionerId: params.provisionerId,
-                reservationId: inserted.id,
                 requiredLabels: demand.requiredLabels,
                 count: grant,
                 workspaceId: params.workspaceId,
                 scope: params.scope
             });
-            reservedAfterGrant += grant;
-            grants.push({
-                reservationId: inserted.id,
-                ...workspaceIdField,
+            remainingMaxReservations -= grant;
+            const boundCount = idleRunners.length;
+            if (boundCount > 0) {
+                const [boundReservation] = await tx.insert(reservations).values({
+                    workspaceId: params.workspaceId,
+                    provisionerId: params.provisionerId,
+                    requiredLabels: demand.requiredLabels,
+                    count: boundCount,
+                    kind: 'bound',
+                    expiresAt: sql`now() + (${params.activationGraceSeconds ?? params.ttlSeconds} || ' seconds')::interval`
+                }).returning({
+                    id: reservations.id
+                });
+                if (!boundReservation) throw new Error('Insert returned no rows');
+                await bindIdleRunnerInstancesTx(tx, {
+                    provisionerId: params.provisionerId,
+                    reservationId: boundReservation.id,
+                    workspaceId: params.workspaceId,
+                    requiredLabels: demand.requiredLabels,
+                    scope: params.scope,
+                    idleRunners
+                });
+            }
+            const launchCount = grant - boundCount;
+            drawSlots(satisfyingTemplates, launchCount);
+            let launchReservation;
+            if (launchCount > 0) {
+                const [inserted] = await tx.insert(reservations).values({
+                    workspaceId: params.workspaceId,
+                    provisionerId: params.provisionerId,
+                    requiredLabels: demand.requiredLabels,
+                    count: launchCount,
+                    kind: 'launch',
+                    expiresAt: sql`now() + (${params.ttlSeconds} || ' seconds')::interval`
+                }).returning({
+                    id: reservations.id,
+                    expiresAt: reservations.expiresAt
+                });
+                if (!inserted) throw new Error('Insert returned no rows');
+                launchReservation = inserted;
+            }
+            newlyReservedUnits.push({
                 labels: demand.requiredLabels,
-                count: grant,
-                expiresAt: inserted.expiresAt
+                count: grant
             });
+            reservedAfterGrant += grant;
+            if (launchReservation) {
+                grants.push({
+                    reservationId: launchReservation.id,
+                    ...workspaceIdField,
+                    labels: demand.requiredLabels,
+                    count: launchCount,
+                    expiresAt: launchReservation.expiresAt
+                });
+            }
         }
         stats.push({
             ...workspaceIdField,
@@ -160,33 +211,160 @@ async function pollDemandAndReserveLockedTx(tx, params) {
     }
     return {
         stats,
-        reservations: grants
+        reservations: grants,
+        newlyReservedUnits
     };
 }
-async function bindIdleRunnerInstancesTx(tx, params) {
-    // Reservation expiry is the activation grace deadline. A live reservation
-    // protects a runner that is still booting; an expired or missing row is stale.
-    const canBindRunner = ()=>and(or(and(isNull(providerRunners.workspaceId), isNull(providerRunners.reservationId)), and(isNotNull(providerRunners.reservationId), params.scope === 'installation' ? undefined : or(isNull(providerRunners.workspaceId), eq(providerRunners.workspaceId, params.workspaceId)), notExists(tx.select({
-            id: reservations.id
-        }).from(reservations).where(and(eq(reservations.id, providerRunners.reservationId), gt(reservations.expiresAt, sql`now()`)))))), or(isNull(providerRunners.intendedReservationId), notExists(tx.select({
-            id: reservations.id
-        }).from(reservations).where(and(eq(reservations.id, providerRunners.intendedReservationId), gt(reservations.expiresAt, sql`now()`))))), isNull(providerRunners.reservationReleasedAt), isNull(providerRunners.runnerSessionId));
-    const idleRunners = await tx.select({
-        id: providerRunners.id
-    }).from(providerRunners).where(and(eq(providerRunners.provisionerId, params.provisionerId), canBindRunner(), isNotNull(providerRunners.providerRunnerId), eq(providerRunners.state, 'running'), arrayContains(providerRunners.labels, params.requiredLabels), exists(tx.select({
+async function listActiveProvisionerReservationRowsTx(tx, params) {
+    const candidateRows = await tx.select({
+        id: reservations.id
+    }).from(reservations).where(and(eq(reservations.workspaceId, params.workspaceId), eq(reservations.provisionerId, params.provisionerId), gt(reservations.expiresAt, sql`now()`)));
+    const candidateIds = candidateRows.map((row)=>row.id);
+    if (candidateIds.length === 0) return [];
+    // Assignment and provider-report transactions use this key before changing runner
+    // links. Lock it before counting so an in-flight assignment cannot expose its unit twice.
+    await lockRunnerReservationAdvisoryKeysTx(tx, {
+        provisionerId: params.provisionerId,
+        reservationIds: candidateIds
+    });
+    const activeRows = await tx.select({
+        id: reservations.id,
+        requiredLabels: reservations.requiredLabels,
+        count: reservations.count
+    }).from(reservations).where(and(eq(reservations.workspaceId, params.workspaceId), eq(reservations.provisionerId, params.provisionerId), gt(reservations.expiresAt, sql`now()`))).orderBy(asc(reservations.id)).for('update');
+    if (activeRows.length === 0) return [];
+    const activeIds = activeRows.map((row)=>row.id);
+    const activeIdSet = new Set(activeIds);
+    const usedRunnerRows = await tx.select({
+        id: providerRunners.id,
+        reservationId: providerRunners.reservationId,
+        intendedReservationId: providerRunners.intendedReservationId,
+        state: providerRunners.state
+    }).from(providerRunners).where(and(eq(providerRunners.provisionerId, params.provisionerId), isNull(providerRunners.reservationReleasedAt), or(inArray(providerRunners.reservationId, activeIds), and(inArray(providerRunners.intendedReservationId, activeIds), notInArray(providerRunners.state, [
+        ...terminalStates
+    ])))));
+    const usedByReservation = new Map();
+    for (const runner of usedRunnerRows){
+        if (runner.reservationId && activeIdSet.has(runner.reservationId)) {
+            addUsedRunner(usedByReservation, runner.reservationId, runner.id);
+        }
+        if (runner.intendedReservationId && activeIdSet.has(runner.intendedReservationId) && !terminalStates.includes(runner.state)) {
+            addUsedRunner(usedByReservation, runner.intendedReservationId, runner.id);
+        }
+    }
+    return activeRows.flatMap((reservation)=>{
+        const used = usedByReservation.get(reservation.id)?.size ?? 0;
+        const pending = Math.max(0, reservation.count - used);
+        return pending > 0 ? [
+            {
+                requiredLabels: reservation.requiredLabels,
+                reserved: pending
+            }
+        ] : [];
+    });
+}
+function addUsedRunner(usedByReservation, reservationId, runnerId) {
+    const runnerIds = usedByReservation.get(reservationId);
+    if (runnerIds) runnerIds.add(runnerId);
+    else usedByReservation.set(reservationId, new Set([
+        runnerId
+    ]));
+}
+// An expired or missing reservation is stale. A live reservation protects a runner that is
+// still booting or waiting for its activation grace period.
+function canBindRunner(tx, params) {
+    return and(or(and(isNull(providerRunners.workspaceId), isNull(providerRunners.reservationId)), and(isNotNull(providerRunners.reservationId), params.scope === 'installation' ? undefined : or(isNull(providerRunners.workspaceId), eq(providerRunners.workspaceId, params.workspaceId)), notExists(tx.select({
+        id: reservations.id
+    }).from(reservations).where(and(eq(reservations.id, providerRunners.reservationId), gt(reservations.expiresAt, sql`now()`)))))), or(isNull(providerRunners.intendedReservationId), notExists(tx.select({
+        id: reservations.id
+    }).from(reservations).where(and(eq(reservations.id, providerRunners.intendedReservationId), gt(reservations.expiresAt, sql`now()`))))), isNull(providerRunners.reservationReleasedAt), isNull(providerRunners.runnerSessionId));
+}
+function isBindableRunner(tx, params) {
+    return and(eq(providerRunners.provisionerId, params.provisionerId), canBindRunner(tx, params), isNotNull(providerRunners.providerRunnerId), eq(providerRunners.state, 'running'), arrayContains(providerRunners.labels, params.requiredLabels), exists(tx.select({
         id: runnerControlSessions.id
-    }).from(runnerControlSessions).where(and(eq(runnerControlSessions.runnerInstanceId, providerRunners.id), eq(runnerControlSessions.provisionerId, params.provisionerId), isNull(runnerControlSessions.closedAt), gt(runnerControlSessions.expiresAt, sql`now()`)))))).orderBy(asc(providerRunners.createdAt), asc(providerRunners.id)).limit(params.count).for('update');
-    if (idleRunners.length === 0) return;
+    }).from(runnerControlSessions).where(and(eq(runnerControlSessions.runnerInstanceId, providerRunners.id), eq(runnerControlSessions.provisionerId, params.provisionerId), isNull(runnerControlSessions.closedAt), gt(runnerControlSessions.expiresAt, sql`now()`)))));
+}
+async function listIdleRunnerInstancesTx(tx, params) {
+    const lockedRunners = await selectIdleRunnerInstancesTx(tx, params);
+    if (lockedRunners.length === 0) return lockedRunners;
+    // A SELECT ... FOR UPDATE can wake with a fresh target row but the original
+    // statement snapshot for reservation subqueries. Re-check the full predicate
+    // in a new statement while retaining the row locks from the first query.
+    return await selectIdleRunnerInstancesTx(tx, {
+        ...params,
+        runnerIds: lockedRunners.map((runner)=>runner.id),
+        count: lockedRunners.length
+    });
+}
+async function selectIdleRunnerInstancesTx(tx, params) {
+    if (params.runnerIds) {
+        // The first pass retains the row locks. Recheck the full predicate in a fresh statement so
+        // reservation subqueries see the state that was current when the lock was acquired.
+        return await tx.select({
+            id: providerRunners.id,
+            launchKind: providerRunners.launchKind
+        }).from(providerRunners).where(and(inArray(providerRunners.id, params.runnerIds), isBindableRunner(tx, params))).orderBy(asc(providerRunners.createdAt), asc(providerRunners.id)).limit(params.count);
+    }
+    // Select the oldest candidates first, but leave row locking to a second pass. The cleanup
+    // path locks runner rows by id, so the locking pass must use that same order. A skipped row
+    // rolls back only this nested savepoint and retries the bounded candidate scan, allowing the
+    // next-oldest eligible runner to refill the grant without retaining a partial lock set.
+    const retrySelection = Symbol('retry bindable runner selection');
+    const idleRunners = await (async ()=>{
+        while(true){
+            try {
+                return await tx.transaction(async (lockTx)=>{
+                    const candidateRunners = await lockTx.select({
+                        id: providerRunners.id,
+                        launchKind: providerRunners.launchKind
+                    }).from(providerRunners).where(isBindableRunner(lockTx, params)).orderBy(asc(providerRunners.createdAt), asc(providerRunners.id)).limit(params.count);
+                    if (candidateRunners.length === 0) return candidateRunners;
+                    // PostgreSQL can acquire row locks before sorting a multi-row FOR UPDATE result. Lock
+                    // each selected candidate individually so both polling and cleanup use id order.
+                    const lockedRunners = [];
+                    for (const candidate of [
+                        ...candidateRunners
+                    ].sort(compareRunnerIds)){
+                        const [runner] = await lockTx.select({
+                            id: providerRunners.id,
+                            launchKind: providerRunners.launchKind
+                        }).from(providerRunners).where(and(eq(providerRunners.id, candidate.id), isBindableRunner(lockTx, params))).for('update');
+                        if (runner) lockedRunners.push(runner);
+                    }
+                    if (lockedRunners.length !== candidateRunners.length) throw retrySelection;
+                    return lockedRunners;
+                });
+            } catch (error) {
+                if (error !== retrySelection) throw error;
+            }
+        }
+    })();
+    return idleRunners;
+}
+async function bindIdleRunnerInstancesTx(tx, params) {
+    const idleRunnerIds = params.idleRunners.map((runner)=>runner.id);
     await tx.update(runnerActivationTokens).set({
         revokedAt: sql`now()`
-    }).where(and(inArray(runnerActivationTokens.runnerInstanceId, idleRunners.map((runner)=>runner.id)), isNull(runnerActivationTokens.consumedAt), isNull(runnerActivationTokens.revokedAt)));
-    await tx.update(providerRunners).set({
+    }).where(and(inArray(runnerActivationTokens.runnerInstanceId, idleRunnerIds), isNull(runnerActivationTokens.consumedAt), isNull(runnerActivationTokens.revokedAt)));
+    // listIdleRunnerInstancesTx re-checks the full eligibility predicate in a fresh statement
+    // after acquiring row locks. Those locks prevent the validated set from changing before this
+    // update runs.
+    const boundRunners = await tx.update(providerRunners).set({
         workspaceId: params.workspaceId,
         reservationId: params.reservationId,
         intendedReservationId: null,
         assignedAt: sql`now()`,
         updatedAt: sql`now()`
-    }).where(and(inArray(providerRunners.id, idleRunners.map((runner)=>runner.id)), canBindRunner()));
+    }).where(and(inArray(providerRunners.id, idleRunnerIds), isBindableRunner(tx, params))).returning({
+        id: providerRunners.id,
+        launchKind: providerRunners.launchKind
+    });
+    if (boundRunners.length !== params.idleRunners.length) throw new Error('Locked idle runner set changed before binding');
+    const reboundCount = boundRunners.filter((runner)=>runner.launchKind === 'demand').length;
+    if (reboundCount > 0) recordProviderRunnerActivationOutcome({
+        outcome: 'rebound',
+        count: reboundCount
+    });
 }
 async function listInstallationDemandWorkspaceIds(eligibleWorkspaceIds) {
     if (eligibleWorkspaceIds.size === 0) return [];
@@ -228,13 +406,27 @@ export async function deleteReservationsByIds(ids) {
 }
 async function deleteReservationsWithCleanupTx(tx, ids, params = {}) {
     if (ids.length === 0) return 0;
-    const affectedRunners = await tx.select({
+    const isAffectedRunner = ()=>or(and(inArray(providerRunners.reservationId, ids), isNull(providerRunners.runnerSessionId), isNull(providerRunners.reservationReleasedAt)), inArray(providerRunners.intendedReservationId, ids));
+    const candidateRunners = await tx.select({
         id: providerRunners.id,
         reservationId: providerRunners.reservationId,
         intendedReservationId: providerRunners.intendedReservationId,
         runnerSessionId: providerRunners.runnerSessionId,
         reservationReleasedAt: providerRunners.reservationReleasedAt
-    }).from(providerRunners).where(or(and(inArray(providerRunners.reservationId, ids), isNull(providerRunners.runnerSessionId), isNull(providerRunners.reservationReleasedAt)), inArray(providerRunners.intendedReservationId, ids))).orderBy(asc(providerRunners.id)).for('update');
+    }).from(providerRunners).where(isAffectedRunner()).orderBy(asc(providerRunners.id));
+    const affectedRunners = [];
+    for (const candidate of [
+        ...candidateRunners
+    ].sort(compareRunnerIds)){
+        const [runner] = await tx.select({
+            id: providerRunners.id,
+            reservationId: providerRunners.reservationId,
+            intendedReservationId: providerRunners.intendedReservationId,
+            runnerSessionId: providerRunners.runnerSessionId,
+            reservationReleasedAt: providerRunners.reservationReleasedAt
+        }).from(providerRunners).where(and(eq(providerRunners.id, candidate.id), isAffectedRunner())).for('update');
+        if (runner) affectedRunners.push(runner);
+    }
     const reservationRows = await tx.select({
         id: reservations.id
     }).from(reservations).where(and(inArray(reservations.id, ids), params.expiredOnly ? lt(reservations.expiresAt, sql`now()`) : undefined)).for('update');
@@ -290,6 +482,9 @@ function deductProvisionerReservations(templates, activeReservations) {
         drawSlots(satisfyingTemplates, reservation.reserved);
     }
 }
+function compareRunnerIds(left, right) {
+    return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+}
 function sortDemandRows(rows) {
     return [
         ...rows