@shipfox/api-runners 13.0.0 → 14.0.0

package/.turbo/turbo-build.log

@@ -1,6 +1,6 @@
 $ shipfox-swc && shipfox-temporal-bundle dist/temporal/workflows/index.js
-Successfully compiled: 105 files with swc (500.52ms)
-2026-08-14T18:57:08.640Z [INFO] asset workflow-bundle-0c3da2487e29e352d64e.js 3.17 MiB [emitted] [immutable] (name: main)
+Successfully compiled: 105 files with swc (698.46ms)
+2026-08-23T20:26:53.065Z [INFO] asset workflow-bundle-0c3da2487e29e352d64e.js 3.17 MiB [emitted] [immutable] (name: main)
 orphan modules 33.5 KiB [orphan] 21 modules
 runtime modules 1.13 KiB 5 modules
 modules by path ../../../node_modules/.pnpm/ 970 KiB 196 modules
@@ -14,6 +14,6 @@ optional modules 30 bytes [optional]
   __temporal_custom_payload_converter (ignored) 15 bytes [optional] [built] [code generated]
   __temporal_custom_failure_converter (ignored) 15 bytes [optional] [built] [code generated]
 ../../shared/node/temporal/dist/workflow-error-interceptor.js 1.21 KiB [built] [code generated]
-webpack 5.107.2 compiled successfully in 6538 ms
-2026-08-14T18:57:08.663Z [INFO] Workflow bundle created { size: '3.17MB' }
+webpack 5.107.2 compiled successfully in 6499 ms
+2026-08-23T20:26:53.076Z [INFO] Workflow bundle created { size: '3.17MB' }
 /home/runner/work/shipfox/shipfox/libs/api/runners/dist/temporal/workflows/index.js: 3326598 bytes

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @shipfox/api-runners
 
+## 14.0.0
+
+### Patch Changes
+
+- 69a92c4: Adds `installation_runners` (`managed` or `none`) to the active-provisioners response. The value is `managed` when reserved runner labels are configured or an installation-scope provisioner token is active, so client consumers can determine whether the installation provides runner capacity.
+- Updated dependencies [69a92c4]
+- Updated dependencies [4f30864]
+- Updated dependencies [b766ee3]
+  - @shipfox/api-runners-dto@14.0.0
+  - @shipfox/api-workflows-dto@14.0.0
+
+## 13.1.0
+
+### Patch Changes
+
+- 7de2e30: Release runner reservation units when a provisioned runner claims its first job.
+- Updated dependencies [0d3c2e3]
+  - @shipfox/api-workflows-dto@13.1.0
+
 ## 13.0.0
 
 ### Major Changes

package/dist/core/index.d.ts

@@ -9,7 +9,7 @@ export { EmptyRunnerLabelsError, ManualRegistrationTokenNotFoundError, Provision
 export { type ClaimJobExecutionResult, claimJobExecution } from './job-executions.js';
 export { createWorkspaceManualRegistrationToken, listUsableManualRegistrationTokens, revokeWorkspaceManualRegistrationToken, } from './manual-registration-tokens.js';
 export { hasActiveWorkspaceProvisionerCapability } from './provisioner-capability-snapshots.js';
-export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken, } from './provisioner-tokens.js';
+export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, type InstallationRunnersStatus, installationProvisionerTokenStatus, installationRunnersStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken, } from './provisioner-tokens.js';
 export { getRunnerAssignment, issueRunnerActivationToken } from './runner-activation.js';
 export { assignRunnerInstances } from './runner-assignments.js';
 export { attachRunnerControlProviderId, createRunnerInstancesWithBootstrapTokens, enrollRunnerControlSession, exchangeRunnerBootstrapToken, RunnerBootstrapTokenInvalidError, RunnerControlSessionInvalidError, touchRunnerControlSession, } from './runner-control-sessions.js';

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,gCAAgC,EAChC,KAAK,2BAA2B,GACjC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAC,0BAA0B,EAAC,MAAM,4CAA4C,CAAC;AAC3F,YAAY,EAAC,uBAAuB,EAAC,MAAM,yCAAyC,CAAC;AACrF,YAAY,EAAC,6BAA6B,EAAC,MAAM,+CAA+C,CAAC;AACjG,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,oCAAoC,EACpC,wCAAwC,EACxC,iDAAiD,EACjD,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,KAAK,uBAAuB,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,uCAAuC,EAAC,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EACL,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,sBAAsB,EACtB,8CAA8C,EAC9C,2BAA2B,EAC3B,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAC,mBAAmB,EAAE,0BAA0B,EAAC,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAC,qBAAqB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,wCAAwC,EACxC,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,YAAY,EACjB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,gCAAgC,EAChC,KAAK,2BAA2B,GACjC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAC,0BAA0B,EAAC,MAAM,4CAA4C,CAAC;AAC3F,YAAY,EAAC,uBAAuB,EAAC,MAAM,yCAAyC,CAAC;AACrF,YAAY,EAAC,6BAA6B,EAAC,MAAM,+CAA+C,CAAC;AACjG,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,oCAAoC,EACpC,wCAAwC,EACxC,iDAAiD,EACjD,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,KAAK,uBAAuB,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,uCAAuC,EAAC,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EACL,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,kCAAkC,EAClC,yBAAyB,EACzB,sBAAsB,EACtB,8CAA8C,EAC9C,2BAA2B,EAC3B,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAC,mBAAmB,EAAE,0BAA0B,EAAC,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAC,qBAAqB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,wCAAwC,EACxC,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,YAAY,EACjB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,+BAA+B,CAAC"}

package/dist/core/index.js

@@ -3,7 +3,7 @@ export { EmptyRunnerLabelsError, ManualRegistrationTokenNotFoundError, Provision
 export { claimJobExecution } from './job-executions.js';
 export { createWorkspaceManualRegistrationToken, listUsableManualRegistrationTokens, revokeWorkspaceManualRegistrationToken } from './manual-registration-tokens.js';
 export { hasActiveWorkspaceProvisionerCapability } from './provisioner-capability-snapshots.js';
-export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken } from './provisioner-tokens.js';
+export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, installationRunnersStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken } from './provisioner-tokens.js';
 export { getRunnerAssignment, issueRunnerActivationToken } from './runner-activation.js';
 export { assignRunnerInstances } from './runner-assignments.js';
 export { attachRunnerControlProviderId, createRunnerInstancesWithBootstrapTokens, enrollRunnerControlSession, exchangeRunnerBootstrapToken, RunnerBootstrapTokenInvalidError, RunnerControlSessionInvalidError, touchRunnerControlSession } from './runner-control-sessions.js';

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/index.ts"],"sourcesContent":["export {\n  type ListRunnerAdministratorInstancesParams,\n  type ListRunnerAdministratorInstancesResult,\n  listRunnerAdministratorInstances,\n  type RunnerAdministratorInstance,\n} from './admin-runner-instances.js';\nexport type {EphemeralRegistrationToken} from './entities/ephemeral-registration-token.js';\nexport type {ManualRegistrationToken} from './entities/manual-registration-token.js';\nexport type {ProvisionerCapabilitySnapshot} from './entities/provisioner-capability-snapshot.js';\nexport type {\n  ActiveProvisionerToken,\n  ProvisionerScope,\n  ProvisionerToken,\n} from './entities/provisioner-token.js';\nexport type {\n  RunnerInstance,\n  RunnerInstanceState,\n} from './entities/runner-instance.js';\nexport type {RunnerSession} from './entities/runner-session.js';\nexport {\n  EmptyRunnerLabelsError,\n  ManualRegistrationTokenNotFoundError,\n  ProvisionerAdminIdempotencyKeyReuseError,\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RunnerLabelsReservedError,\n  RunnerSessionExhaustedError,\n  RunningJobExecutionNotFoundError,\n} from './errors.js';\nexport {type ClaimJobExecutionResult, claimJobExecution} from './job-executions.js';\nexport {\n  createWorkspaceManualRegistrationToken,\n  listUsableManualRegistrationTokens,\n  revokeWorkspaceManualRegistrationToken,\n} from './manual-registration-tokens.js';\nexport {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';\nexport {\n  createAdministratorInstallationProvisionerToken,\n  createInstallationProvisionerToken,\n  createWorkspaceProvisionerToken,\n  installationProvisionerTokenStatus,\n  listActiveProvisioners,\n  listAdministratorInstallationProvisionerTokens,\n  listUsableProvisionerTokens,\n  revokeAdministratorInstallationProvisionerToken,\n  revokeInstallationProvisionerToken,\n  revokeWorkspaceProvisionerToken,\n} from './provisioner-tokens.js';\nexport {getRunnerAssignment, issueRunnerActivationToken} from './runner-activation.js';\nexport {assignRunnerInstances} from './runner-assignments.js';\nexport {\n  attachRunnerControlProviderId,\n  createRunnerInstancesWithBootstrapTokens,\n  enrollRunnerControlSession,\n  exchangeRunnerBootstrapToken,\n  RunnerBootstrapTokenInvalidError,\n  RunnerControlSessionInvalidError,\n  touchRunnerControlSession,\n} from './runner-control-sessions.js';\nexport {\n  type ActiveRunner,\n  attachRunnerInstanceProviderId,\n  listActiveRunners,\n  type ReconcileDesiredIntent,\n  type ReconciledBoundJobExecution,\n  type ReconciledRunnerInstance,\n  type ReconcileRunnerInstancesParams,\n  type ReconcileRunnerInstancesResult,\n  type ReportRunnerInstancesParams,\n  type ReportRunnerInstancesResult,\n  reconcileRunnerInstances,\n  reportRunnerInstances,\n} from './runner-instances.js';\nexport {\n  type RegisterRunnerSessionResult,\n  type RunnerRegistrationCredential,\n  registerRunnerSession,\n} from './runner-sessions.js';\nexport {\n  EMPTY_RUNNER_TOOL_CAPABILITIES,\n  effectiveRunnerToolCapabilities,\n} from './runner-tool-capabilities.js';\n"],"names":["listRunnerAdministratorInstances","EmptyRunnerLabelsError","ManualRegistrationTokenNotFoundError","ProvisionerAdminIdempotencyKeyReuseError","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RunnerLabelsReservedError","RunnerSessionExhaustedError","RunningJobExecutionNotFoundError","claimJobExecution","createWorkspaceManualRegistrationToken","listUsableManualRegistrationTokens","revokeWorkspaceManualRegistrationToken","hasActiveWorkspaceProvisionerCapability","createAdministratorInstallationProvisionerToken","createInstallationProvisionerToken","createWorkspaceProvisionerToken","installationProvisionerTokenStatus","listActiveProvisioners","listAdministratorInstallationProvisionerTokens","listUsableProvisionerTokens","revokeAdministratorInstallationProvisionerToken","revokeInstallationProvisionerToken","revokeWorkspaceProvisionerToken","getRunnerAssignment","issueRunnerActivationToken","assignRunnerInstances","attachRunnerControlProviderId","createRunnerInstancesWithBootstrapTokens","enrollRunnerControlSession","exchangeRunnerBootstrapToken","RunnerBootstrapTokenInvalidError","RunnerControlSessionInvalidError","touchRunnerControlSession","attachRunnerInstanceProviderId","listActiveRunners","reconcileRunnerInstances","reportRunnerInstances","registerRunnerSession","EMPTY_RUNNER_TOOL_CAPABILITIES","effectiveRunnerToolCapabilities"],"mappings":"AAAA,SAGEA,gCAAgC,QAE3B,8BAA8B;AAcrC,SACEC,sBAAsB,EACtBC,oCAAoC,EACpCC,wCAAwC,EACxCC,iDAAiD,EACjDC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,yBAAyB,EACzBC,2BAA2B,EAC3BC,gCAAgC,QAC3B,cAAc;AACrB,SAAsCC,iBAAiB,QAAO,sBAAsB;AACpF,SACEC,sCAAsC,EACtCC,kCAAkC,EAClCC,sCAAsC,QACjC,kCAAkC;AACzC,SAAQC,uCAAuC,QAAO,wCAAwC;AAC9F,SACEC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,sBAAsB,EACtBC,8CAA8C,EAC9CC,2BAA2B,EAC3BC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,QAC1B,0BAA0B;AACjC,SAAQC,mBAAmB,EAAEC,0BAA0B,QAAO,yBAAyB;AACvF,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SACEC,6BAA6B,EAC7BC,wCAAwC,EACxCC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,gCAAgC,EAChCC,gCAAgC,EAChCC,yBAAyB,QACpB,+BAA+B;AACtC,SAEEC,8BAA8B,EAC9BC,iBAAiB,EAQjBC,wBAAwB,EACxBC,qBAAqB,QAChB,wBAAwB;AAC/B,SAGEC,qBAAqB,QAChB,uBAAuB;AAC9B,SACEC,8BAA8B,EAC9BC,+BAA+B,QAC1B,gCAAgC"}
+{"version":3,"sources":["../../src/core/index.ts"],"sourcesContent":["export {\n  type ListRunnerAdministratorInstancesParams,\n  type ListRunnerAdministratorInstancesResult,\n  listRunnerAdministratorInstances,\n  type RunnerAdministratorInstance,\n} from './admin-runner-instances.js';\nexport type {EphemeralRegistrationToken} from './entities/ephemeral-registration-token.js';\nexport type {ManualRegistrationToken} from './entities/manual-registration-token.js';\nexport type {ProvisionerCapabilitySnapshot} from './entities/provisioner-capability-snapshot.js';\nexport type {\n  ActiveProvisionerToken,\n  ProvisionerScope,\n  ProvisionerToken,\n} from './entities/provisioner-token.js';\nexport type {\n  RunnerInstance,\n  RunnerInstanceState,\n} from './entities/runner-instance.js';\nexport type {RunnerSession} from './entities/runner-session.js';\nexport {\n  EmptyRunnerLabelsError,\n  ManualRegistrationTokenNotFoundError,\n  ProvisionerAdminIdempotencyKeyReuseError,\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RunnerLabelsReservedError,\n  RunnerSessionExhaustedError,\n  RunningJobExecutionNotFoundError,\n} from './errors.js';\nexport {type ClaimJobExecutionResult, claimJobExecution} from './job-executions.js';\nexport {\n  createWorkspaceManualRegistrationToken,\n  listUsableManualRegistrationTokens,\n  revokeWorkspaceManualRegistrationToken,\n} from './manual-registration-tokens.js';\nexport {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';\nexport {\n  createAdministratorInstallationProvisionerToken,\n  createInstallationProvisionerToken,\n  createWorkspaceProvisionerToken,\n  type InstallationRunnersStatus,\n  installationProvisionerTokenStatus,\n  installationRunnersStatus,\n  listActiveProvisioners,\n  listAdministratorInstallationProvisionerTokens,\n  listUsableProvisionerTokens,\n  revokeAdministratorInstallationProvisionerToken,\n  revokeInstallationProvisionerToken,\n  revokeWorkspaceProvisionerToken,\n} from './provisioner-tokens.js';\nexport {getRunnerAssignment, issueRunnerActivationToken} from './runner-activation.js';\nexport {assignRunnerInstances} from './runner-assignments.js';\nexport {\n  attachRunnerControlProviderId,\n  createRunnerInstancesWithBootstrapTokens,\n  enrollRunnerControlSession,\n  exchangeRunnerBootstrapToken,\n  RunnerBootstrapTokenInvalidError,\n  RunnerControlSessionInvalidError,\n  touchRunnerControlSession,\n} from './runner-control-sessions.js';\nexport {\n  type ActiveRunner,\n  attachRunnerInstanceProviderId,\n  listActiveRunners,\n  type ReconcileDesiredIntent,\n  type ReconciledBoundJobExecution,\n  type ReconciledRunnerInstance,\n  type ReconcileRunnerInstancesParams,\n  type ReconcileRunnerInstancesResult,\n  type ReportRunnerInstancesParams,\n  type ReportRunnerInstancesResult,\n  reconcileRunnerInstances,\n  reportRunnerInstances,\n} from './runner-instances.js';\nexport {\n  type RegisterRunnerSessionResult,\n  type RunnerRegistrationCredential,\n  registerRunnerSession,\n} from './runner-sessions.js';\nexport {\n  EMPTY_RUNNER_TOOL_CAPABILITIES,\n  effectiveRunnerToolCapabilities,\n} from './runner-tool-capabilities.js';\n"],"names":["listRunnerAdministratorInstances","EmptyRunnerLabelsError","ManualRegistrationTokenNotFoundError","ProvisionerAdminIdempotencyKeyReuseError","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RunnerLabelsReservedError","RunnerSessionExhaustedError","RunningJobExecutionNotFoundError","claimJobExecution","createWorkspaceManualRegistrationToken","listUsableManualRegistrationTokens","revokeWorkspaceManualRegistrationToken","hasActiveWorkspaceProvisionerCapability","createAdministratorInstallationProvisionerToken","createInstallationProvisionerToken","createWorkspaceProvisionerToken","installationProvisionerTokenStatus","installationRunnersStatus","listActiveProvisioners","listAdministratorInstallationProvisionerTokens","listUsableProvisionerTokens","revokeAdministratorInstallationProvisionerToken","revokeInstallationProvisionerToken","revokeWorkspaceProvisionerToken","getRunnerAssignment","issueRunnerActivationToken","assignRunnerInstances","attachRunnerControlProviderId","createRunnerInstancesWithBootstrapTokens","enrollRunnerControlSession","exchangeRunnerBootstrapToken","RunnerBootstrapTokenInvalidError","RunnerControlSessionInvalidError","touchRunnerControlSession","attachRunnerInstanceProviderId","listActiveRunners","reconcileRunnerInstances","reportRunnerInstances","registerRunnerSession","EMPTY_RUNNER_TOOL_CAPABILITIES","effectiveRunnerToolCapabilities"],"mappings":"AAAA,SAGEA,gCAAgC,QAE3B,8BAA8B;AAcrC,SACEC,sBAAsB,EACtBC,oCAAoC,EACpCC,wCAAwC,EACxCC,iDAAiD,EACjDC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,yBAAyB,EACzBC,2BAA2B,EAC3BC,gCAAgC,QAC3B,cAAc;AACrB,SAAsCC,iBAAiB,QAAO,sBAAsB;AACpF,SACEC,sCAAsC,EACtCC,kCAAkC,EAClCC,sCAAsC,QACjC,kCAAkC;AACzC,SAAQC,uCAAuC,QAAO,wCAAwC;AAC9F,SACEC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,EAE/BC,kCAAkC,EAClCC,yBAAyB,EACzBC,sBAAsB,EACtBC,8CAA8C,EAC9CC,2BAA2B,EAC3BC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,QAC1B,0BAA0B;AACjC,SAAQC,mBAAmB,EAAEC,0BAA0B,QAAO,yBAAyB;AACvF,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SACEC,6BAA6B,EAC7BC,wCAAwC,EACxCC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,gCAAgC,EAChCC,gCAAgC,EAChCC,yBAAyB,QACpB,+BAA+B;AACtC,SAEEC,8BAA8B,EAC9BC,iBAAiB,EAQjBC,wBAAwB,EACxBC,qBAAqB,QAChB,wBAAwB;AAC/B,SAGEC,qBAAqB,QAChB,uBAAuB;AAC9B,SACEC,8BAA8B,EAC9BC,+BAA+B,QAC1B,gCAAgC"}

package/dist/core/provisioner-tokens.d.ts

@@ -38,6 +38,14 @@ export interface InstallationProvisionerTokenAdministrationContext {
 }
 export type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';
 export declare function installationProvisionerTokenStatus(token: ProvisionerToken, now?: Date): InstallationProvisionerTokenStatus;
+export type InstallationRunnersStatus = 'managed' | 'none';
+/**
+ * Whether the installation itself provides runner capacity. Both signals are
+ * declarations of intent, not heartbeats: a quiet hosted fleet must not flip
+ * the value. Reserved labels dominate even when every installation token has
+ * expired or been revoked.
+ */
+export declare function installationRunnersStatus(reservedLabels?: readonly string[]): Promise<InstallationRunnersStatus>;
 export declare function listAdministratorInstallationProvisionerTokens(params: {
     limit: number;
     cursor?: TimestampIdCursor | undefined;

package/dist/core/provisioner-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,yBAAyB,CAAC;AAGhE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAM9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAehD;AAED,MAAM,WAAW,wCAAwC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,wCAAwC,GAC/C,OAAO,CAAC,qCAAqC,CAAC,CAYhD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAOD,MAAM,WAAW,iDAAiD;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAElF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,gBAAgB,EACvB,GAAG,OAAa,GACf,kCAAkC,CAIpC;AAED,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,kCAAkC,GAAG,SAAS,CAAC;CACzD;;;GAEA;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GACA,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CAoC7E;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAC5E,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CA2B3D"}
+{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,yBAAyB,CAAC;AAGhE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAM9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAehD;AAED,MAAM,WAAW,wCAAwC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,wCAAwC,GAC/C,OAAO,CAAC,qCAAqC,CAAC,CAYhD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAOD,MAAM,WAAW,iDAAiD;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAElF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,gBAAgB,EACvB,GAAG,OAAa,GACf,kCAAkC,CAIpC;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,cAAc,GAAE,SAAS,MAAM,EAAyB,GACvD,OAAO,CAAC,yBAAyB,CAAC,CAIpC;AAED,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,kCAAkC,GAAG,SAAS,CAAC;CACzD;;;GAEA;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GACA,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CAoC7E;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAC5E,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CA2B3D"}

package/dist/core/provisioner-tokens.js

@@ -3,7 +3,7 @@ import { createAdministrationActionEvent } from '@shipfox/api-common-dto';
 import { runnerSessionTokenKey } from '@shipfox/node-auth-root-key';
 import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
 import { createInstallationProvisionerTokenWithAudit, createProvisionerToken, listActiveProvisionerTokens, listInstallationProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb, revokeInstallationProvisionerTokenWithAudit, revokeProvisionerToken } from '#db/provisioner-tokens.js';
-import { config } from '../config.js';
+import { config, runnerReservedLabels } from '../config.js';
 import { ProvisionerAdminIdempotencyReplayUnavailableError, ProvisionerTokenNotFoundError } from './errors.js';
 export async function createWorkspaceProvisionerToken(params) {
     const rawToken = generateOpaqueToken('provisionerToken');
@@ -91,6 +91,19 @@ export function installationProvisionerTokenStatus(token, now = new Date()) {
     if (token.expiresAt && token.expiresAt <= now) return 'expired';
     return 'active';
 }
+/**
+ * Whether the installation itself provides runner capacity. Both signals are
+ * declarations of intent, not heartbeats: a quiet hosted fleet must not flip
+ * the value. Reserved labels dominate even when every installation token has
+ * expired or been revoked.
+ */ export async function installationRunnersStatus(reservedLabels = runnerReservedLabels) {
+    if (reservedLabels.length > 0) return 'managed';
+    const { tokens } = await listInstallationProvisionerTokens({
+        limit: 1,
+        status: 'active'
+    });
+    return tokens.length > 0 ? 'managed' : 'none';
+}
 export async function listAdministratorInstallationProvisionerTokens(params) {
     return await listInstallationProvisionerTokens(params);
 }

package/dist/core/provisioner-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport type {AdministrationRole} from '@shipfox/api-common-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createInstallationProvisionerTokenWithAudit,\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listInstallationProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,\n  revokeInstallationProvisionerTokenWithAudit,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    scope: 'workspace',\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport interface CreateInstallationProvisionerTokenParams {\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport async function createInstallationProvisionerToken(\n  params: CreateInstallationProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n  const token = await createProvisionerToken({\n    scope: 'installation',\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nexport async function revokeInstallationProvisionerToken(params: {\n  tokenId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeInstallationProvisionerTokenDb(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nconst ADMIN_OWNER_ROLE: AdministrationRole = 'admin-owner';\nconst ADMIN_OPERATOR_ROLE: AdministrationRole = 'admin-operator';\nconst CREATE_ADMIN_COMMAND = 'runners.provisioner_token.create';\nconst REVOKE_ADMIN_COMMAND = 'runners.provisioner_token.revoke';\n\nexport interface InstallationProvisionerTokenAdministrationContext {\n  actorId: string;\n  actorRole: AdministrationRole;\n  idempotencyKey: string;\n  correlationId: string;\n  reason: string;\n}\n\nfunction administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction idempotentProvisionerToken(seed: string): string {\n  const generated = generateOpaqueToken('provisionerToken');\n  const tokenPrefix = generated.slice(0, -43);\n  const key = createHmac('sha256', runnerSessionTokenKey())\n    .update('shipfox/provisioner-token-idempotency/v1')\n    .digest();\n  const suffix = createHmac('sha256', key).update(seed).digest('base64url');\n  return `${tokenPrefix}${suffix}`;\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdministrationRole;\n  requiredRole: AdministrationRole;\n  command: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole,\n    command: params.command,\n    targetType: 'provisioner-token',\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';\n\nexport function installationProvisionerTokenStatus(\n  token: ProvisionerToken,\n  now = new Date(),\n): InstallationProvisionerTokenStatus {\n  if (token.revokedAt) return 'revoked';\n  if (token.expiresAt && token.expiresAt <= now) return 'expired';\n  return 'active';\n}\n\nexport async function listAdministratorInstallationProvisionerTokens(params: {\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  status?: InstallationProvisionerTokenStatus | undefined;\n}) {\n  return await listInstallationProvisionerTokens(params);\n}\n\nexport async function createAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {\n    name?: string | undefined;\n    ttlSeconds?: number | undefined;\n  },\n): Promise<{token: ProvisionerToken; rawToken: string; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(CREATE_ADMIN_COMMAND, {\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    reason: params.reason,\n  });\n  const rawToken = idempotentProvisionerToken(\n    `${params.actorId}:${params.idempotencyKey}:${requestFingerprint}`,\n  );\n  const result = await createInstallationProvisionerTokenWithAudit({\n    actorId: params.actorId,\n    command: CREATE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OWNER_ROLE,\n        command: CREATE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (result.replayed && hashOpaqueToken(rawToken) !== result.token.hashedToken) {\n    throw new ProvisionerAdminIdempotencyReplayUnavailableError();\n  }\n  return {...result, rawToken, correlationId: result.correlationId};\n}\n\nexport async function revokeAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {tokenId: string},\n): Promise<{token: ProvisionerToken; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(REVOKE_ADMIN_COMMAND, {\n    tokenId: params.tokenId,\n    reason: params.reason,\n  });\n  const result = await revokeInstallationProvisionerTokenWithAudit({\n    tokenId: params.tokenId,\n    actorId: params.actorId,\n    command: REVOKE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (!result) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return result;\n}\n"],"names":["createHmac","createAdministrationActionEvent","runnerSessionTokenKey","extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createInstallationProvisionerTokenWithAudit","createProvisionerToken","listActiveProvisionerTokens","listInstallationProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeInstallationProvisionerToken","revokeInstallationProvisionerTokenDb","revokeInstallationProvisionerTokenWithAudit","revokeProvisionerToken","config","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","scope","workspaceId","hashedToken","prefix","name","createdByUserId","createInstallationProvisionerToken","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId","ADMIN_OWNER_ROLE","ADMIN_OPERATOR_ROLE","CREATE_ADMIN_COMMAND","REVOKE_ADMIN_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","idempotentProvisionerToken","seed","generated","tokenPrefix","slice","key","update","digest","suffix","administrationEvent","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","toISOString","installationProvisionerTokenStatus","revokedAt","listAdministratorInstallationProvisionerTokens","createAdministratorInstallationProvisionerToken","idempotencyKey","requestFingerprint","event","replayed","revokeAdministratorInstallationProvisionerToken"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AAEvC,SAAQC,+BAA+B,QAAO,0BAA0B;AACxE,SAAQC,qBAAqB,QAAO,8BAA8B;AAElE,SAAQC,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,2CAA2C,EAC3CC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iCAAiC,EACjCC,wCAAwC,EACxCC,sCAAsCC,oCAAoC,EAC1EC,2CAA2C,EAC3CC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,QAAO,eAAe;AAEpC,SACEC,iDAAiD,EACjDC,6BAA6B,QACxB,cAAc;AAcrB,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWhB,oBAAoB;IACrC,MAAMiB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMnB,uBAAuB;QACzCoB,OAAO;QACPC,aAAaT,OAAOS,WAAW;QAC/BC,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAQA,OAAO,eAAea,mCACpBd,MAAgD;IAEhD,MAAMC,WAAWhB,oBAAoB;IACrC,MAAMiB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IACxF,MAAMC,QAAQ,MAAMnB,uBAAuB;QACzCoB,OAAO;QACPE,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IACA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASc,4BAA4BN,WAAmB;IAC7D,OAAOlB,yCAAyCkB;AAClD;AAEA,OAAO,SAASO,uBAAuBP,WAAmB;IACxD,OAAOpB,4BAA4B;QACjCoB;QACAQ,eAAerB,OAAOsB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCnB,MAIrD;IACC,MAAMO,QAAQ,MAAMZ,uBAAuBK;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,OAAO,eAAef,mCAAmCQ,MAGxD;IACC,MAAMO,QAAQ,MAAMd,qCAAqCO;IACzD,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,MAAMc,mBAAuC;AAC7C,MAAMC,sBAA0C;AAChD,MAAMC,uBAAuB;AAC7B,MAAMC,uBAAuB;AAU7B,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IACvE,OAAOzC,gBAAgB,GAAGwC,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,2BAA2BC,IAAY;IAC9C,MAAMC,YAAY/C,oBAAoB;IACtC,MAAMgD,cAAcD,UAAUE,KAAK,CAAC,GAAG,CAAC;IACxC,MAAMC,MAAMtD,WAAW,UAAUE,yBAC9BqD,MAAM,CAAC,4CACPC,MAAM;IACT,MAAMC,SAASzD,WAAW,UAAUsD,KAAKC,MAAM,CAACL,MAAMM,MAAM,CAAC;IAC7D,OAAO,GAAGJ,cAAcK,QAAQ;AAClC;AAEA,SAASC,oBAAoBvC,MAS5B;IACC,OAAOlB,gCAAgC;QACrC0D,SAASxC,OAAOwC,OAAO;QACvBC,WAAWzC,OAAOyC,SAAS;QAC3BC,cAAc1C,OAAO0C,YAAY;QACjChB,SAAS1B,OAAO0B,OAAO;QACvBiB,YAAY;QACZC,UAAU5C,OAAO4C,QAAQ;QACzBC,QAAQ7C,OAAO6C,MAAM;QACrBC,QAAQ;QACRC,eAAe/C,OAAO+C,aAAa;QACnCC,2BAA2BhD,OAAOgD,yBAAyB;QAC3DC,YAAY,IAAI7C,OAAO8C,WAAW;IACpC;AACF;AAIA,OAAO,SAASC,mCACd5C,KAAuB,EACvBF,MAAM,IAAID,MAAM;IAEhB,IAAIG,MAAM6C,SAAS,EAAE,OAAO;IAC5B,IAAI7C,MAAML,SAAS,IAAIK,MAAML,SAAS,IAAIG,KAAK,OAAO;IACtD,OAAO;AACT;AAEA,OAAO,eAAegD,+CAA+CrD,MAIpE;IACC,OAAO,MAAMV,kCAAkCU;AACjD;AAEA,OAAO,eAAesD,gDACpBtD,MAGC;IAED,MAAMgD,4BAA4B9D,gBAAgBc,OAAOuD,cAAc;IACvE,MAAMC,qBAAqB/B,iCAAiCF,sBAAsB;QAChFX,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B0C,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAM5C,WAAW6B,2BACf,GAAG9B,OAAOwC,OAAO,CAAC,CAAC,EAAExC,OAAOuD,cAAc,CAAC,CAAC,EAAEC,oBAAoB;IAEpE,MAAMV,SAAS,MAAM3D,4CAA4C;QAC/DqD,SAASxC,OAAOwC,OAAO;QACvBd,SAASH;QACTwB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAQ;QACA9C,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7BsD,OAAO,CAACrC,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcrB;gBACdK,SAASH;gBACTqB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAIF,OAAOY,QAAQ,IAAIxE,gBAAgBe,cAAc6C,OAAOvC,KAAK,CAACG,WAAW,EAAE;QAC7E,MAAM,IAAIb;IACZ;IACA,OAAO;QAAC,GAAGiD,MAAM;QAAE7C;QAAU8C,eAAeD,OAAOC,aAAa;IAAA;AAClE;AAEA,OAAO,eAAeY,gDACpB3D,MAA6E;IAE7E,MAAMgD,4BAA4B9D,gBAAgBc,OAAOuD,cAAc;IACvE,MAAMC,qBAAqB/B,iCAAiCD,sBAAsB;QAChFJ,SAASpB,OAAOoB,OAAO;QACvByB,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAMC,SAAS,MAAMpD,4CAA4C;QAC/D0B,SAASpB,OAAOoB,OAAO;QACvBoB,SAASxC,OAAOwC,OAAO;QACvBd,SAASF;QACTuB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAQ;QACAC,OAAO,CAACrC,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcpB;gBACdI,SAASF;gBACToB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAI,CAACF,QAAQ,MAAM,IAAIhD,8BAA8BE,OAAOoB,OAAO;IACnE,OAAO0B;AACT"}
+{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport type {AdministrationRole} from '@shipfox/api-common-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createInstallationProvisionerTokenWithAudit,\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listInstallationProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,\n  revokeInstallationProvisionerTokenWithAudit,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config, runnerReservedLabels} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    scope: 'workspace',\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport interface CreateInstallationProvisionerTokenParams {\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport async function createInstallationProvisionerToken(\n  params: CreateInstallationProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n  const token = await createProvisionerToken({\n    scope: 'installation',\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nexport async function revokeInstallationProvisionerToken(params: {\n  tokenId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeInstallationProvisionerTokenDb(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nconst ADMIN_OWNER_ROLE: AdministrationRole = 'admin-owner';\nconst ADMIN_OPERATOR_ROLE: AdministrationRole = 'admin-operator';\nconst CREATE_ADMIN_COMMAND = 'runners.provisioner_token.create';\nconst REVOKE_ADMIN_COMMAND = 'runners.provisioner_token.revoke';\n\nexport interface InstallationProvisionerTokenAdministrationContext {\n  actorId: string;\n  actorRole: AdministrationRole;\n  idempotencyKey: string;\n  correlationId: string;\n  reason: string;\n}\n\nfunction administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction idempotentProvisionerToken(seed: string): string {\n  const generated = generateOpaqueToken('provisionerToken');\n  const tokenPrefix = generated.slice(0, -43);\n  const key = createHmac('sha256', runnerSessionTokenKey())\n    .update('shipfox/provisioner-token-idempotency/v1')\n    .digest();\n  const suffix = createHmac('sha256', key).update(seed).digest('base64url');\n  return `${tokenPrefix}${suffix}`;\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdministrationRole;\n  requiredRole: AdministrationRole;\n  command: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole,\n    command: params.command,\n    targetType: 'provisioner-token',\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';\n\nexport function installationProvisionerTokenStatus(\n  token: ProvisionerToken,\n  now = new Date(),\n): InstallationProvisionerTokenStatus {\n  if (token.revokedAt) return 'revoked';\n  if (token.expiresAt && token.expiresAt <= now) return 'expired';\n  return 'active';\n}\n\nexport type InstallationRunnersStatus = 'managed' | 'none';\n\n/**\n * Whether the installation itself provides runner capacity. Both signals are\n * declarations of intent, not heartbeats: a quiet hosted fleet must not flip\n * the value. Reserved labels dominate even when every installation token has\n * expired or been revoked.\n */\nexport async function installationRunnersStatus(\n  reservedLabels: readonly string[] = runnerReservedLabels,\n): Promise<InstallationRunnersStatus> {\n  if (reservedLabels.length > 0) return 'managed';\n  const {tokens} = await listInstallationProvisionerTokens({limit: 1, status: 'active'});\n  return tokens.length > 0 ? 'managed' : 'none';\n}\n\nexport async function listAdministratorInstallationProvisionerTokens(params: {\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  status?: InstallationProvisionerTokenStatus | undefined;\n}) {\n  return await listInstallationProvisionerTokens(params);\n}\n\nexport async function createAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {\n    name?: string | undefined;\n    ttlSeconds?: number | undefined;\n  },\n): Promise<{token: ProvisionerToken; rawToken: string; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(CREATE_ADMIN_COMMAND, {\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    reason: params.reason,\n  });\n  const rawToken = idempotentProvisionerToken(\n    `${params.actorId}:${params.idempotencyKey}:${requestFingerprint}`,\n  );\n  const result = await createInstallationProvisionerTokenWithAudit({\n    actorId: params.actorId,\n    command: CREATE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OWNER_ROLE,\n        command: CREATE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (result.replayed && hashOpaqueToken(rawToken) !== result.token.hashedToken) {\n    throw new ProvisionerAdminIdempotencyReplayUnavailableError();\n  }\n  return {...result, rawToken, correlationId: result.correlationId};\n}\n\nexport async function revokeAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {tokenId: string},\n): Promise<{token: ProvisionerToken; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(REVOKE_ADMIN_COMMAND, {\n    tokenId: params.tokenId,\n    reason: params.reason,\n  });\n  const result = await revokeInstallationProvisionerTokenWithAudit({\n    tokenId: params.tokenId,\n    actorId: params.actorId,\n    command: REVOKE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (!result) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return result;\n}\n"],"names":["createHmac","createAdministrationActionEvent","runnerSessionTokenKey","extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createInstallationProvisionerTokenWithAudit","createProvisionerToken","listActiveProvisionerTokens","listInstallationProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeInstallationProvisionerToken","revokeInstallationProvisionerTokenDb","revokeInstallationProvisionerTokenWithAudit","revokeProvisionerToken","config","runnerReservedLabels","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","scope","workspaceId","hashedToken","prefix","name","createdByUserId","createInstallationProvisionerToken","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId","ADMIN_OWNER_ROLE","ADMIN_OPERATOR_ROLE","CREATE_ADMIN_COMMAND","REVOKE_ADMIN_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","idempotentProvisionerToken","seed","generated","tokenPrefix","slice","key","update","digest","suffix","administrationEvent","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","toISOString","installationProvisionerTokenStatus","revokedAt","installationRunnersStatus","reservedLabels","length","tokens","limit","status","listAdministratorInstallationProvisionerTokens","createAdministratorInstallationProvisionerToken","idempotencyKey","requestFingerprint","event","replayed","revokeAdministratorInstallationProvisionerToken"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AAEvC,SAAQC,+BAA+B,QAAO,0BAA0B;AACxE,SAAQC,qBAAqB,QAAO,8BAA8B;AAElE,SAAQC,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,2CAA2C,EAC3CC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iCAAiC,EACjCC,wCAAwC,EACxCC,sCAAsCC,oCAAoC,EAC1EC,2CAA2C,EAC3CC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,eAAe;AAE1D,SACEC,iDAAiD,EACjDC,6BAA6B,QACxB,cAAc;AAcrB,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWjB,oBAAoB;IACrC,MAAMkB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMpB,uBAAuB;QACzCqB,OAAO;QACPC,aAAaT,OAAOS,WAAW;QAC/BC,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAQA,OAAO,eAAea,mCACpBd,MAAgD;IAEhD,MAAMC,WAAWjB,oBAAoB;IACrC,MAAMkB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IACxF,MAAMC,QAAQ,MAAMpB,uBAAuB;QACzCqB,OAAO;QACPE,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IACA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASc,4BAA4BN,WAAmB;IAC7D,OAAOnB,yCAAyCmB;AAClD;AAEA,OAAO,SAASO,uBAAuBP,WAAmB;IACxD,OAAOrB,4BAA4B;QACjCqB;QACAQ,eAAetB,OAAOuB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCnB,MAIrD;IACC,MAAMO,QAAQ,MAAMb,uBAAuBM;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,OAAO,eAAehB,mCAAmCS,MAGxD;IACC,MAAMO,QAAQ,MAAMf,qCAAqCQ;IACzD,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,MAAMc,mBAAuC;AAC7C,MAAMC,sBAA0C;AAChD,MAAMC,uBAAuB;AAC7B,MAAMC,uBAAuB;AAU7B,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IACvE,OAAO1C,gBAAgB,GAAGyC,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,2BAA2BC,IAAY;IAC9C,MAAMC,YAAYhD,oBAAoB;IACtC,MAAMiD,cAAcD,UAAUE,KAAK,CAAC,GAAG,CAAC;IACxC,MAAMC,MAAMvD,WAAW,UAAUE,yBAC9BsD,MAAM,CAAC,4CACPC,MAAM;IACT,MAAMC,SAAS1D,WAAW,UAAUuD,KAAKC,MAAM,CAACL,MAAMM,MAAM,CAAC;IAC7D,OAAO,GAAGJ,cAAcK,QAAQ;AAClC;AAEA,SAASC,oBAAoBvC,MAS5B;IACC,OAAOnB,gCAAgC;QACrC2D,SAASxC,OAAOwC,OAAO;QACvBC,WAAWzC,OAAOyC,SAAS;QAC3BC,cAAc1C,OAAO0C,YAAY;QACjChB,SAAS1B,OAAO0B,OAAO;QACvBiB,YAAY;QACZC,UAAU5C,OAAO4C,QAAQ;QACzBC,QAAQ7C,OAAO6C,MAAM;QACrBC,QAAQ;QACRC,eAAe/C,OAAO+C,aAAa;QACnCC,2BAA2BhD,OAAOgD,yBAAyB;QAC3DC,YAAY,IAAI7C,OAAO8C,WAAW;IACpC;AACF;AAIA,OAAO,SAASC,mCACd5C,KAAuB,EACvBF,MAAM,IAAID,MAAM;IAEhB,IAAIG,MAAM6C,SAAS,EAAE,OAAO;IAC5B,IAAI7C,MAAML,SAAS,IAAIK,MAAML,SAAS,IAAIG,KAAK,OAAO;IACtD,OAAO;AACT;AAIA;;;;;CAKC,GACD,OAAO,eAAegD,0BACpBC,iBAAoC1D,oBAAoB;IAExD,IAAI0D,eAAeC,MAAM,GAAG,GAAG,OAAO;IACtC,MAAM,EAACC,MAAM,EAAC,GAAG,MAAMnE,kCAAkC;QAACoE,OAAO;QAAGC,QAAQ;IAAQ;IACpF,OAAOF,OAAOD,MAAM,GAAG,IAAI,YAAY;AACzC;AAEA,OAAO,eAAeI,+CAA+C3D,MAIpE;IACC,OAAO,MAAMX,kCAAkCW;AACjD;AAEA,OAAO,eAAe4D,gDACpB5D,MAGC;IAED,MAAMgD,4BAA4B/D,gBAAgBe,OAAO6D,cAAc;IACvE,MAAMC,qBAAqBrC,iCAAiCF,sBAAsB;QAChFX,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B0C,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAM5C,WAAW6B,2BACf,GAAG9B,OAAOwC,OAAO,CAAC,CAAC,EAAExC,OAAO6D,cAAc,CAAC,CAAC,EAAEC,oBAAoB;IAEpE,MAAMhB,SAAS,MAAM5D,4CAA4C;QAC/DsD,SAASxC,OAAOwC,OAAO;QACvBd,SAASH;QACTwB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAc;QACApD,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B4D,OAAO,CAAC3C,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcrB;gBACdK,SAASH;gBACTqB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAIF,OAAOkB,QAAQ,IAAI/E,gBAAgBgB,cAAc6C,OAAOvC,KAAK,CAACG,WAAW,EAAE;QAC7E,MAAM,IAAIb;IACZ;IACA,OAAO;QAAC,GAAGiD,MAAM;QAAE7C;QAAU8C,eAAeD,OAAOC,aAAa;IAAA;AAClE;AAEA,OAAO,eAAekB,gDACpBjE,MAA6E;IAE7E,MAAMgD,4BAA4B/D,gBAAgBe,OAAO6D,cAAc;IACvE,MAAMC,qBAAqBrC,iCAAiCD,sBAAsB;QAChFJ,SAASpB,OAAOoB,OAAO;QACvByB,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAMC,SAAS,MAAMrD,4CAA4C;QAC/D2B,SAASpB,OAAOoB,OAAO;QACvBoB,SAASxC,OAAOwC,OAAO;QACvBd,SAASF;QACTuB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAc;QACAC,OAAO,CAAC3C,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcpB;gBACdI,SAASF;gBACToB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAI,CAACF,QAAQ,MAAM,IAAIhD,8BAA8BE,OAAOoB,OAAO;IACnE,OAAO0B;AACT"}

package/dist/db/job-executions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-executions.d.ts","sourceRoot":"","sources":["../../src/db/job-executions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,0BAA0B,CAAC;AAiClC,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAkDhC,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAwBzE;AAKD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C1F;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;IACtB,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oCAAoC,EAAE,MAAM,CAAC;CAC9C,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAiMtC;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CACT,KAAK,CAAC;IACJ,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CACH,CAiGA;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC,CAOD;AAED,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAyBvC;AAED,wBAAsB,0CAA0C,CAC9D,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,GACA,OAAO,CAAC,+BAA+B,EAAE,CAAC,CA2E5C;AAMD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACrD,GAAG,OAAO,CAAC;IACV,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC3D,uBAAuB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC1D,mBAAmB,EAAE;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC,CAoED;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB"}
+{"version":3,"file":"job-executions.d.ts","sourceRoot":"","sources":["../../src/db/job-executions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,0BAA0B,CAAC;AAiClC,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAuDhC,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CAwBzE;AAKD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C1F;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;IACtB,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oCAAoC,EAAE,MAAM,CAAC;CAC9C,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA8PtC;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CACT,KAAK,CAAC;IACJ,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CACH,CAiGA;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC,CAOD;AAED,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAyBvC;AAED,wBAAsB,0CAA0C,CAC9D,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,GACA,OAAO,CAAC,+BAA+B,EAAE,CAAC,CA2E5C;AAMD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACrD,GAAG,OAAO,CAAC;IACV,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC3D,uBAAuB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC1D,mBAAmB,EAAE;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC,CAoED;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB"}

package/dist/db/job-executions.js

@@ -6,9 +6,11 @@ import { and, arrayContained, asc, count, desc, eq, gt, inArray, isNotNull, isNu
 import { EmptyRequiredLabelsError, RunnerSessionExhaustedError, RunningJobExecutionNotFoundError } from '#core/errors.js';
 import { jobExecutionEnqueuedCount, jobExecutionLeaseExpiredCount, recordJobExecutionQueueTime, recordProviderRunnerActivationToFirstClaim } from '#metrics/instance.js';
 import { db } from './db.js';
-import { releaseTerminalRunnerInstanceReservationsByIds } from './reservations.js';
+import { lockRunnerReservationAdvisoryKeysTx } from './reservation-locks.js';
+import { releaseReservationUnits, releaseTerminalRunnerInstanceReservationsByIds } from './reservations.js';
 import { runnersOutbox } from './schema/outbox.js';
 import { pendingJobExecutions } from './schema/pending-job-executions.js';
+import { reservations } from './schema/reservations.js';
 import { providerRunners } from './schema/runner-instances.js';
 import { runnerSessions } from './schema/runner-sessions.js';
 import { runningJobExecutions } from './schema/running-job-executions.js';
@@ -136,6 +138,20 @@ export async function claimPendingJobExecution(params) {
             provisionerId = session.provisionerId;
             providerRunnerId = session.providerRunnerId;
         }
+        const runnerInstanceCondition = runnerInstanceId ? eq(providerRunners.id, runnerInstanceId) : provisionerId && providerRunnerId ? and(eq(providerRunners.provisionerId, provisionerId), eq(providerRunners.providerRunnerId, providerRunnerId)) : null;
+        if (runnerInstanceCondition && provisionerId) {
+            const [runner] = await tx.select({
+                reservationId: providerRunners.reservationId,
+                intendedReservationId: providerRunners.intendedReservationId
+            }).from(providerRunners).where(runnerInstanceCondition).limit(1);
+            await lockRunnerReservationAdvisoryKeysTx(tx, {
+                provisionerId,
+                reservationIds: [
+                    runner?.reservationId,
+                    runner?.intendedReservationId
+                ].filter((reservationId)=>reservationId !== null && reservationId !== undefined)
+            });
+        }
         // `id` is a uuidv7 (time-ordered), so it is a deterministic FIFO tiebreaker
         // for rows sharing a created_at within a batch. Lock only the FIFO candidate before
         // attempting its execution advisory lock; putting pg_try_advisory_xact_lock in this
@@ -180,7 +196,6 @@ export async function claimPendingJobExecution(params) {
             provider: null,
             launchKind: params.maxClaims === null ? 'manual' : 'unknown'
         };
-        const runnerInstanceCondition = runnerInstanceId ? eq(providerRunners.id, runnerInstanceId) : provisionerId && providerRunnerId ? and(eq(providerRunners.provisionerId, provisionerId), eq(providerRunners.providerRunnerId, providerRunnerId)) : null;
         if (runnerInstanceCondition) {
             const [claimedRunner] = await tx.update(providerRunners).set({
                 firstClaimedAt: sql`coalesce(${providerRunners.firstClaimedAt}, ${claimed.claimedAt})`,
@@ -191,6 +206,8 @@ export async function claimPendingJobExecution(params) {
                 provider: providerRunners.providerKind,
                 launchKind: providerRunners.launchKind,
                 runnerInstanceId: providerRunners.id,
+                reservationId: providerRunners.reservationId,
+                intendedReservationId: providerRunners.intendedReservationId,
                 sessionCreatedAtEpochMs: sql`(
             select extract(epoch from ${runnerSessions.createdAt})::double precision * 1000
             from ${runnerSessions}
@@ -201,6 +218,31 @@ export async function claimPendingJobExecution(params) {
                 queueTimeObservation.provider = claimedRunner.provider;
                 queueTimeObservation.launchKind = claimedRunner.launchKind;
             }
+            if (claimedRunner?.isFirstClaim) {
+                const [releasedRunner] = await tx.update(providerRunners).set({
+                    intendedReservationId: null,
+                    reservationReleasedAt: sql`now()`,
+                    updatedAt: sql`now()`
+                }).where(and(eq(providerRunners.id, claimedRunner.runnerInstanceId), or(isNotNull(providerRunners.reservationId), isNotNull(providerRunners.intendedReservationId)), isNull(providerRunners.reservationReleasedAt))).returning({
+                    provisionerId: providerRunners.provisionerId
+                });
+                const reservationId = claimedRunner.intendedReservationId ?? claimedRunner.reservationId;
+                if (releasedRunner?.provisionerId && reservationId) {
+                    const [reservation] = await tx.select({
+                        workspaceId: reservations.workspaceId
+                    }).from(reservations).where(and(eq(reservations.id, reservationId), eq(reservations.provisionerId, releasedRunner.provisionerId))).limit(1);
+                    if (reservation) await releaseReservationUnits(tx, {
+                        workspaceId: reservation.workspaceId,
+                        provisionerId: releasedRunner.provisionerId,
+                        releases: [
+                            {
+                                reservationId,
+                                count: 1
+                            }
+                        ]
+                    });
+                }
+            }
             if (claimedRunner?.isFirstClaim && claimedRunner.firstClaimedAt !== null && claimedRunner.sessionCreatedAtEpochMs !== null && claimedRunner.sessionCreatedAtEpochMs !== undefined) activationToFirstClaimObservation = {
                 durationMilliseconds: claimedRunner.firstClaimedAt.getTime() - claimedRunner.sessionCreatedAtEpochMs,
                 provider: claimedRunner.provider,