@shipfox/api-runners 13.1.0 → 14.0.0

package/.turbo/turbo-build.log

@@ -1,6 +1,6 @@
 $ shipfox-swc && shipfox-temporal-bundle dist/temporal/workflows/index.js
-Successfully compiled: 105 files with swc (548ms)
-2026-08-23T10:00:31.690Z [INFO] asset workflow-bundle-0c3da2487e29e352d64e.js 3.17 MiB [emitted] [immutable] (name: main)
+Successfully compiled: 105 files with swc (698.46ms)
+2026-08-23T20:26:53.065Z [INFO] asset workflow-bundle-0c3da2487e29e352d64e.js 3.17 MiB [emitted] [immutable] (name: main)
 orphan modules 33.5 KiB [orphan] 21 modules
 runtime modules 1.13 KiB 5 modules
 modules by path ../../../node_modules/.pnpm/ 970 KiB 196 modules
@@ -14,6 +14,6 @@ optional modules 30 bytes [optional]
   __temporal_custom_payload_converter (ignored) 15 bytes [optional] [built] [code generated]
   __temporal_custom_failure_converter (ignored) 15 bytes [optional] [built] [code generated]
 ../../shared/node/temporal/dist/workflow-error-interceptor.js 1.21 KiB [built] [code generated]
-webpack 5.107.2 compiled successfully in 9390 ms
-2026-08-23T10:00:31.741Z [INFO] Workflow bundle created { size: '3.17MB' }
+webpack 5.107.2 compiled successfully in 6499 ms
+2026-08-23T20:26:53.076Z [INFO] Workflow bundle created { size: '3.17MB' }
 /home/runner/work/shipfox/shipfox/libs/api/runners/dist/temporal/workflows/index.js: 3326598 bytes

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @shipfox/api-runners
 
+## 14.0.0
+
+### Patch Changes
+
+- 69a92c4: Adds `installation_runners` (`managed` or `none`) to the active-provisioners response. The value is `managed` when reserved runner labels are configured or an installation-scope provisioner token is active, so client consumers can determine whether the installation provides runner capacity.
+- Updated dependencies [69a92c4]
+- Updated dependencies [4f30864]
+- Updated dependencies [b766ee3]
+  - @shipfox/api-runners-dto@14.0.0
+  - @shipfox/api-workflows-dto@14.0.0
+
 ## 13.1.0
 
 ### Patch Changes

package/dist/core/index.d.ts

@@ -9,7 +9,7 @@ export { EmptyRunnerLabelsError, ManualRegistrationTokenNotFoundError, Provision
 export { type ClaimJobExecutionResult, claimJobExecution } from './job-executions.js';
 export { createWorkspaceManualRegistrationToken, listUsableManualRegistrationTokens, revokeWorkspaceManualRegistrationToken, } from './manual-registration-tokens.js';
 export { hasActiveWorkspaceProvisionerCapability } from './provisioner-capability-snapshots.js';
-export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken, } from './provisioner-tokens.js';
+export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, type InstallationRunnersStatus, installationProvisionerTokenStatus, installationRunnersStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken, } from './provisioner-tokens.js';
 export { getRunnerAssignment, issueRunnerActivationToken } from './runner-activation.js';
 export { assignRunnerInstances } from './runner-assignments.js';
 export { attachRunnerControlProviderId, createRunnerInstancesWithBootstrapTokens, enrollRunnerControlSession, exchangeRunnerBootstrapToken, RunnerBootstrapTokenInvalidError, RunnerControlSessionInvalidError, touchRunnerControlSession, } from './runner-control-sessions.js';

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,gCAAgC,EAChC,KAAK,2BAA2B,GACjC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAC,0BAA0B,EAAC,MAAM,4CAA4C,CAAC;AAC3F,YAAY,EAAC,uBAAuB,EAAC,MAAM,yCAAyC,CAAC;AACrF,YAAY,EAAC,6BAA6B,EAAC,MAAM,+CAA+C,CAAC;AACjG,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,oCAAoC,EACpC,wCAAwC,EACxC,iDAAiD,EACjD,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,KAAK,uBAAuB,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,uCAAuC,EAAC,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EACL,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,EAC/B,kCAAkC,EAClC,sBAAsB,EACtB,8CAA8C,EAC9C,2BAA2B,EAC3B,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAC,mBAAmB,EAAE,0BAA0B,EAAC,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAC,qBAAqB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,wCAAwC,EACxC,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,YAAY,EACjB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sCAAsC,EAC3C,KAAK,sCAAsC,EAC3C,gCAAgC,EAChC,KAAK,2BAA2B,GACjC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAC,0BAA0B,EAAC,MAAM,4CAA4C,CAAC;AAC3F,YAAY,EAAC,uBAAuB,EAAC,MAAM,yCAAyC,CAAC;AACrF,YAAY,EAAC,6BAA6B,EAAC,MAAM,+CAA+C,CAAC;AACjG,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,cAAc,EACd,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,oCAAoC,EACpC,wCAAwC,EACxC,iDAAiD,EACjD,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,KAAK,uBAAuB,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAC,uCAAuC,EAAC,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EACL,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,kCAAkC,EAClC,yBAAyB,EACzB,sBAAsB,EACtB,8CAA8C,EAC9C,2BAA2B,EAC3B,+CAA+C,EAC/C,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAC,mBAAmB,EAAE,0BAA0B,EAAC,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAC,qBAAqB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,wCAAwC,EACxC,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,EAChC,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,YAAY,EACjB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,+BAA+B,CAAC"}

package/dist/core/index.js

@@ -3,7 +3,7 @@ export { EmptyRunnerLabelsError, ManualRegistrationTokenNotFoundError, Provision
 export { claimJobExecution } from './job-executions.js';
 export { createWorkspaceManualRegistrationToken, listUsableManualRegistrationTokens, revokeWorkspaceManualRegistrationToken } from './manual-registration-tokens.js';
 export { hasActiveWorkspaceProvisionerCapability } from './provisioner-capability-snapshots.js';
-export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken } from './provisioner-tokens.js';
+export { createAdministratorInstallationProvisionerToken, createInstallationProvisionerToken, createWorkspaceProvisionerToken, installationProvisionerTokenStatus, installationRunnersStatus, listActiveProvisioners, listAdministratorInstallationProvisionerTokens, listUsableProvisionerTokens, revokeAdministratorInstallationProvisionerToken, revokeInstallationProvisionerToken, revokeWorkspaceProvisionerToken } from './provisioner-tokens.js';
 export { getRunnerAssignment, issueRunnerActivationToken } from './runner-activation.js';
 export { assignRunnerInstances } from './runner-assignments.js';
 export { attachRunnerControlProviderId, createRunnerInstancesWithBootstrapTokens, enrollRunnerControlSession, exchangeRunnerBootstrapToken, RunnerBootstrapTokenInvalidError, RunnerControlSessionInvalidError, touchRunnerControlSession } from './runner-control-sessions.js';

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/index.ts"],"sourcesContent":["export {\n  type ListRunnerAdministratorInstancesParams,\n  type ListRunnerAdministratorInstancesResult,\n  listRunnerAdministratorInstances,\n  type RunnerAdministratorInstance,\n} from './admin-runner-instances.js';\nexport type {EphemeralRegistrationToken} from './entities/ephemeral-registration-token.js';\nexport type {ManualRegistrationToken} from './entities/manual-registration-token.js';\nexport type {ProvisionerCapabilitySnapshot} from './entities/provisioner-capability-snapshot.js';\nexport type {\n  ActiveProvisionerToken,\n  ProvisionerScope,\n  ProvisionerToken,\n} from './entities/provisioner-token.js';\nexport type {\n  RunnerInstance,\n  RunnerInstanceState,\n} from './entities/runner-instance.js';\nexport type {RunnerSession} from './entities/runner-session.js';\nexport {\n  EmptyRunnerLabelsError,\n  ManualRegistrationTokenNotFoundError,\n  ProvisionerAdminIdempotencyKeyReuseError,\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RunnerLabelsReservedError,\n  RunnerSessionExhaustedError,\n  RunningJobExecutionNotFoundError,\n} from './errors.js';\nexport {type ClaimJobExecutionResult, claimJobExecution} from './job-executions.js';\nexport {\n  createWorkspaceManualRegistrationToken,\n  listUsableManualRegistrationTokens,\n  revokeWorkspaceManualRegistrationToken,\n} from './manual-registration-tokens.js';\nexport {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';\nexport {\n  createAdministratorInstallationProvisionerToken,\n  createInstallationProvisionerToken,\n  createWorkspaceProvisionerToken,\n  installationProvisionerTokenStatus,\n  listActiveProvisioners,\n  listAdministratorInstallationProvisionerTokens,\n  listUsableProvisionerTokens,\n  revokeAdministratorInstallationProvisionerToken,\n  revokeInstallationProvisionerToken,\n  revokeWorkspaceProvisionerToken,\n} from './provisioner-tokens.js';\nexport {getRunnerAssignment, issueRunnerActivationToken} from './runner-activation.js';\nexport {assignRunnerInstances} from './runner-assignments.js';\nexport {\n  attachRunnerControlProviderId,\n  createRunnerInstancesWithBootstrapTokens,\n  enrollRunnerControlSession,\n  exchangeRunnerBootstrapToken,\n  RunnerBootstrapTokenInvalidError,\n  RunnerControlSessionInvalidError,\n  touchRunnerControlSession,\n} from './runner-control-sessions.js';\nexport {\n  type ActiveRunner,\n  attachRunnerInstanceProviderId,\n  listActiveRunners,\n  type ReconcileDesiredIntent,\n  type ReconciledBoundJobExecution,\n  type ReconciledRunnerInstance,\n  type ReconcileRunnerInstancesParams,\n  type ReconcileRunnerInstancesResult,\n  type ReportRunnerInstancesParams,\n  type ReportRunnerInstancesResult,\n  reconcileRunnerInstances,\n  reportRunnerInstances,\n} from './runner-instances.js';\nexport {\n  type RegisterRunnerSessionResult,\n  type RunnerRegistrationCredential,\n  registerRunnerSession,\n} from './runner-sessions.js';\nexport {\n  EMPTY_RUNNER_TOOL_CAPABILITIES,\n  effectiveRunnerToolCapabilities,\n} from './runner-tool-capabilities.js';\n"],"names":["listRunnerAdministratorInstances","EmptyRunnerLabelsError","ManualRegistrationTokenNotFoundError","ProvisionerAdminIdempotencyKeyReuseError","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RunnerLabelsReservedError","RunnerSessionExhaustedError","RunningJobExecutionNotFoundError","claimJobExecution","createWorkspaceManualRegistrationToken","listUsableManualRegistrationTokens","revokeWorkspaceManualRegistrationToken","hasActiveWorkspaceProvisionerCapability","createAdministratorInstallationProvisionerToken","createInstallationProvisionerToken","createWorkspaceProvisionerToken","installationProvisionerTokenStatus","listActiveProvisioners","listAdministratorInstallationProvisionerTokens","listUsableProvisionerTokens","revokeAdministratorInstallationProvisionerToken","revokeInstallationProvisionerToken","revokeWorkspaceProvisionerToken","getRunnerAssignment","issueRunnerActivationToken","assignRunnerInstances","attachRunnerControlProviderId","createRunnerInstancesWithBootstrapTokens","enrollRunnerControlSession","exchangeRunnerBootstrapToken","RunnerBootstrapTokenInvalidError","RunnerControlSessionInvalidError","touchRunnerControlSession","attachRunnerInstanceProviderId","listActiveRunners","reconcileRunnerInstances","reportRunnerInstances","registerRunnerSession","EMPTY_RUNNER_TOOL_CAPABILITIES","effectiveRunnerToolCapabilities"],"mappings":"AAAA,SAGEA,gCAAgC,QAE3B,8BAA8B;AAcrC,SACEC,sBAAsB,EACtBC,oCAAoC,EACpCC,wCAAwC,EACxCC,iDAAiD,EACjDC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,yBAAyB,EACzBC,2BAA2B,EAC3BC,gCAAgC,QAC3B,cAAc;AACrB,SAAsCC,iBAAiB,QAAO,sBAAsB;AACpF,SACEC,sCAAsC,EACtCC,kCAAkC,EAClCC,sCAAsC,QACjC,kCAAkC;AACzC,SAAQC,uCAAuC,QAAO,wCAAwC;AAC9F,SACEC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,EAC/BC,kCAAkC,EAClCC,sBAAsB,EACtBC,8CAA8C,EAC9CC,2BAA2B,EAC3BC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,QAC1B,0BAA0B;AACjC,SAAQC,mBAAmB,EAAEC,0BAA0B,QAAO,yBAAyB;AACvF,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SACEC,6BAA6B,EAC7BC,wCAAwC,EACxCC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,gCAAgC,EAChCC,gCAAgC,EAChCC,yBAAyB,QACpB,+BAA+B;AACtC,SAEEC,8BAA8B,EAC9BC,iBAAiB,EAQjBC,wBAAwB,EACxBC,qBAAqB,QAChB,wBAAwB;AAC/B,SAGEC,qBAAqB,QAChB,uBAAuB;AAC9B,SACEC,8BAA8B,EAC9BC,+BAA+B,QAC1B,gCAAgC"}
+{"version":3,"sources":["../../src/core/index.ts"],"sourcesContent":["export {\n  type ListRunnerAdministratorInstancesParams,\n  type ListRunnerAdministratorInstancesResult,\n  listRunnerAdministratorInstances,\n  type RunnerAdministratorInstance,\n} from './admin-runner-instances.js';\nexport type {EphemeralRegistrationToken} from './entities/ephemeral-registration-token.js';\nexport type {ManualRegistrationToken} from './entities/manual-registration-token.js';\nexport type {ProvisionerCapabilitySnapshot} from './entities/provisioner-capability-snapshot.js';\nexport type {\n  ActiveProvisionerToken,\n  ProvisionerScope,\n  ProvisionerToken,\n} from './entities/provisioner-token.js';\nexport type {\n  RunnerInstance,\n  RunnerInstanceState,\n} from './entities/runner-instance.js';\nexport type {RunnerSession} from './entities/runner-session.js';\nexport {\n  EmptyRunnerLabelsError,\n  ManualRegistrationTokenNotFoundError,\n  ProvisionerAdminIdempotencyKeyReuseError,\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RunnerLabelsReservedError,\n  RunnerSessionExhaustedError,\n  RunningJobExecutionNotFoundError,\n} from './errors.js';\nexport {type ClaimJobExecutionResult, claimJobExecution} from './job-executions.js';\nexport {\n  createWorkspaceManualRegistrationToken,\n  listUsableManualRegistrationTokens,\n  revokeWorkspaceManualRegistrationToken,\n} from './manual-registration-tokens.js';\nexport {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';\nexport {\n  createAdministratorInstallationProvisionerToken,\n  createInstallationProvisionerToken,\n  createWorkspaceProvisionerToken,\n  type InstallationRunnersStatus,\n  installationProvisionerTokenStatus,\n  installationRunnersStatus,\n  listActiveProvisioners,\n  listAdministratorInstallationProvisionerTokens,\n  listUsableProvisionerTokens,\n  revokeAdministratorInstallationProvisionerToken,\n  revokeInstallationProvisionerToken,\n  revokeWorkspaceProvisionerToken,\n} from './provisioner-tokens.js';\nexport {getRunnerAssignment, issueRunnerActivationToken} from './runner-activation.js';\nexport {assignRunnerInstances} from './runner-assignments.js';\nexport {\n  attachRunnerControlProviderId,\n  createRunnerInstancesWithBootstrapTokens,\n  enrollRunnerControlSession,\n  exchangeRunnerBootstrapToken,\n  RunnerBootstrapTokenInvalidError,\n  RunnerControlSessionInvalidError,\n  touchRunnerControlSession,\n} from './runner-control-sessions.js';\nexport {\n  type ActiveRunner,\n  attachRunnerInstanceProviderId,\n  listActiveRunners,\n  type ReconcileDesiredIntent,\n  type ReconciledBoundJobExecution,\n  type ReconciledRunnerInstance,\n  type ReconcileRunnerInstancesParams,\n  type ReconcileRunnerInstancesResult,\n  type ReportRunnerInstancesParams,\n  type ReportRunnerInstancesResult,\n  reconcileRunnerInstances,\n  reportRunnerInstances,\n} from './runner-instances.js';\nexport {\n  type RegisterRunnerSessionResult,\n  type RunnerRegistrationCredential,\n  registerRunnerSession,\n} from './runner-sessions.js';\nexport {\n  EMPTY_RUNNER_TOOL_CAPABILITIES,\n  effectiveRunnerToolCapabilities,\n} from './runner-tool-capabilities.js';\n"],"names":["listRunnerAdministratorInstances","EmptyRunnerLabelsError","ManualRegistrationTokenNotFoundError","ProvisionerAdminIdempotencyKeyReuseError","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RunnerLabelsReservedError","RunnerSessionExhaustedError","RunningJobExecutionNotFoundError","claimJobExecution","createWorkspaceManualRegistrationToken","listUsableManualRegistrationTokens","revokeWorkspaceManualRegistrationToken","hasActiveWorkspaceProvisionerCapability","createAdministratorInstallationProvisionerToken","createInstallationProvisionerToken","createWorkspaceProvisionerToken","installationProvisionerTokenStatus","installationRunnersStatus","listActiveProvisioners","listAdministratorInstallationProvisionerTokens","listUsableProvisionerTokens","revokeAdministratorInstallationProvisionerToken","revokeInstallationProvisionerToken","revokeWorkspaceProvisionerToken","getRunnerAssignment","issueRunnerActivationToken","assignRunnerInstances","attachRunnerControlProviderId","createRunnerInstancesWithBootstrapTokens","enrollRunnerControlSession","exchangeRunnerBootstrapToken","RunnerBootstrapTokenInvalidError","RunnerControlSessionInvalidError","touchRunnerControlSession","attachRunnerInstanceProviderId","listActiveRunners","reconcileRunnerInstances","reportRunnerInstances","registerRunnerSession","EMPTY_RUNNER_TOOL_CAPABILITIES","effectiveRunnerToolCapabilities"],"mappings":"AAAA,SAGEA,gCAAgC,QAE3B,8BAA8B;AAcrC,SACEC,sBAAsB,EACtBC,oCAAoC,EACpCC,wCAAwC,EACxCC,iDAAiD,EACjDC,6BAA6B,EAC7BC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,yBAAyB,EACzBC,2BAA2B,EAC3BC,gCAAgC,QAC3B,cAAc;AACrB,SAAsCC,iBAAiB,QAAO,sBAAsB;AACpF,SACEC,sCAAsC,EACtCC,kCAAkC,EAClCC,sCAAsC,QACjC,kCAAkC;AACzC,SAAQC,uCAAuC,QAAO,wCAAwC;AAC9F,SACEC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,EAE/BC,kCAAkC,EAClCC,yBAAyB,EACzBC,sBAAsB,EACtBC,8CAA8C,EAC9CC,2BAA2B,EAC3BC,+CAA+C,EAC/CC,kCAAkC,EAClCC,+BAA+B,QAC1B,0BAA0B;AACjC,SAAQC,mBAAmB,EAAEC,0BAA0B,QAAO,yBAAyB;AACvF,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SACEC,6BAA6B,EAC7BC,wCAAwC,EACxCC,0BAA0B,EAC1BC,4BAA4B,EAC5BC,gCAAgC,EAChCC,gCAAgC,EAChCC,yBAAyB,QACpB,+BAA+B;AACtC,SAEEC,8BAA8B,EAC9BC,iBAAiB,EAQjBC,wBAAwB,EACxBC,qBAAqB,QAChB,wBAAwB;AAC/B,SAGEC,qBAAqB,QAChB,uBAAuB;AAC9B,SACEC,8BAA8B,EAC9BC,+BAA+B,QAC1B,gCAAgC"}

package/dist/core/provisioner-tokens.d.ts

@@ -38,6 +38,14 @@ export interface InstallationProvisionerTokenAdministrationContext {
 }
 export type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';
 export declare function installationProvisionerTokenStatus(token: ProvisionerToken, now?: Date): InstallationProvisionerTokenStatus;
+export type InstallationRunnersStatus = 'managed' | 'none';
+/**
+ * Whether the installation itself provides runner capacity. Both signals are
+ * declarations of intent, not heartbeats: a quiet hosted fleet must not flip
+ * the value. Reserved labels dominate even when every installation token has
+ * expired or been revoked.
+ */
+export declare function installationRunnersStatus(reservedLabels?: readonly string[]): Promise<InstallationRunnersStatus>;
 export declare function listAdministratorInstallationProvisionerTokens(params: {
     limit: number;
     cursor?: TimestampIdCursor | undefined;

package/dist/core/provisioner-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,yBAAyB,CAAC;AAGhE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAM9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAehD;AAED,MAAM,WAAW,wCAAwC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,wCAAwC,GAC/C,OAAO,CAAC,qCAAqC,CAAC,CAYhD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAOD,MAAM,WAAW,iDAAiD;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAElF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,gBAAgB,EACvB,GAAG,OAAa,GACf,kCAAkC,CAIpC;AAED,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,kCAAkC,GAAG,SAAS,CAAC;CACzD;;;GAEA;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GACA,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CAoC7E;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAC5E,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CA2B3D"}
+{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,yBAAyB,CAAC;AAGhE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAa7D,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAM9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAehD;AAED,MAAM,WAAW,wCAAwC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,wCAAwC,GAC/C,OAAO,CAAC,qCAAqC,CAAC,CAYhD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAOD,MAAM,WAAW,iDAAiD;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAElF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,gBAAgB,EACvB,GAAG,OAAa,GACf,kCAAkC,CAIpC;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3D;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,cAAc,GAAE,SAAS,MAAM,EAAyB,GACvD,OAAO,CAAC,yBAAyB,CAAC,CAIpC;AAED,wBAAsB,8CAA8C,CAAC,MAAM,EAAE;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,kCAAkC,GAAG,SAAS,CAAC;CACzD;;;GAEA;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAC1D,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GACA,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CAoC7E;AAED,wBAAsB,+CAA+C,CACnE,MAAM,EAAE,iDAAiD,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAC5E,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAC,CAAC,CA2B3D"}

package/dist/core/provisioner-tokens.js

@@ -3,7 +3,7 @@ import { createAdministrationActionEvent } from '@shipfox/api-common-dto';
 import { runnerSessionTokenKey } from '@shipfox/node-auth-root-key';
 import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
 import { createInstallationProvisionerTokenWithAudit, createProvisionerToken, listActiveProvisionerTokens, listInstallationProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb, revokeInstallationProvisionerTokenWithAudit, revokeProvisionerToken } from '#db/provisioner-tokens.js';
-import { config } from '../config.js';
+import { config, runnerReservedLabels } from '../config.js';
 import { ProvisionerAdminIdempotencyReplayUnavailableError, ProvisionerTokenNotFoundError } from './errors.js';
 export async function createWorkspaceProvisionerToken(params) {
     const rawToken = generateOpaqueToken('provisionerToken');
@@ -91,6 +91,19 @@ export function installationProvisionerTokenStatus(token, now = new Date()) {
     if (token.expiresAt && token.expiresAt <= now) return 'expired';
     return 'active';
 }
+/**
+ * Whether the installation itself provides runner capacity. Both signals are
+ * declarations of intent, not heartbeats: a quiet hosted fleet must not flip
+ * the value. Reserved labels dominate even when every installation token has
+ * expired or been revoked.
+ */ export async function installationRunnersStatus(reservedLabels = runnerReservedLabels) {
+    if (reservedLabels.length > 0) return 'managed';
+    const { tokens } = await listInstallationProvisionerTokens({
+        limit: 1,
+        status: 'active'
+    });
+    return tokens.length > 0 ? 'managed' : 'none';
+}
 export async function listAdministratorInstallationProvisionerTokens(params) {
     return await listInstallationProvisionerTokens(params);
 }

package/dist/core/provisioner-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport type {AdministrationRole} from '@shipfox/api-common-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createInstallationProvisionerTokenWithAudit,\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listInstallationProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,\n  revokeInstallationProvisionerTokenWithAudit,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    scope: 'workspace',\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport interface CreateInstallationProvisionerTokenParams {\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport async function createInstallationProvisionerToken(\n  params: CreateInstallationProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n  const token = await createProvisionerToken({\n    scope: 'installation',\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nexport async function revokeInstallationProvisionerToken(params: {\n  tokenId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeInstallationProvisionerTokenDb(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nconst ADMIN_OWNER_ROLE: AdministrationRole = 'admin-owner';\nconst ADMIN_OPERATOR_ROLE: AdministrationRole = 'admin-operator';\nconst CREATE_ADMIN_COMMAND = 'runners.provisioner_token.create';\nconst REVOKE_ADMIN_COMMAND = 'runners.provisioner_token.revoke';\n\nexport interface InstallationProvisionerTokenAdministrationContext {\n  actorId: string;\n  actorRole: AdministrationRole;\n  idempotencyKey: string;\n  correlationId: string;\n  reason: string;\n}\n\nfunction administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction idempotentProvisionerToken(seed: string): string {\n  const generated = generateOpaqueToken('provisionerToken');\n  const tokenPrefix = generated.slice(0, -43);\n  const key = createHmac('sha256', runnerSessionTokenKey())\n    .update('shipfox/provisioner-token-idempotency/v1')\n    .digest();\n  const suffix = createHmac('sha256', key).update(seed).digest('base64url');\n  return `${tokenPrefix}${suffix}`;\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdministrationRole;\n  requiredRole: AdministrationRole;\n  command: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole,\n    command: params.command,\n    targetType: 'provisioner-token',\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';\n\nexport function installationProvisionerTokenStatus(\n  token: ProvisionerToken,\n  now = new Date(),\n): InstallationProvisionerTokenStatus {\n  if (token.revokedAt) return 'revoked';\n  if (token.expiresAt && token.expiresAt <= now) return 'expired';\n  return 'active';\n}\n\nexport async function listAdministratorInstallationProvisionerTokens(params: {\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  status?: InstallationProvisionerTokenStatus | undefined;\n}) {\n  return await listInstallationProvisionerTokens(params);\n}\n\nexport async function createAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {\n    name?: string | undefined;\n    ttlSeconds?: number | undefined;\n  },\n): Promise<{token: ProvisionerToken; rawToken: string; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(CREATE_ADMIN_COMMAND, {\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    reason: params.reason,\n  });\n  const rawToken = idempotentProvisionerToken(\n    `${params.actorId}:${params.idempotencyKey}:${requestFingerprint}`,\n  );\n  const result = await createInstallationProvisionerTokenWithAudit({\n    actorId: params.actorId,\n    command: CREATE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OWNER_ROLE,\n        command: CREATE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (result.replayed && hashOpaqueToken(rawToken) !== result.token.hashedToken) {\n    throw new ProvisionerAdminIdempotencyReplayUnavailableError();\n  }\n  return {...result, rawToken, correlationId: result.correlationId};\n}\n\nexport async function revokeAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {tokenId: string},\n): Promise<{token: ProvisionerToken; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(REVOKE_ADMIN_COMMAND, {\n    tokenId: params.tokenId,\n    reason: params.reason,\n  });\n  const result = await revokeInstallationProvisionerTokenWithAudit({\n    tokenId: params.tokenId,\n    actorId: params.actorId,\n    command: REVOKE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (!result) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return result;\n}\n"],"names":["createHmac","createAdministrationActionEvent","runnerSessionTokenKey","extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createInstallationProvisionerTokenWithAudit","createProvisionerToken","listActiveProvisionerTokens","listInstallationProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeInstallationProvisionerToken","revokeInstallationProvisionerTokenDb","revokeInstallationProvisionerTokenWithAudit","revokeProvisionerToken","config","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","scope","workspaceId","hashedToken","prefix","name","createdByUserId","createInstallationProvisionerToken","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId","ADMIN_OWNER_ROLE","ADMIN_OPERATOR_ROLE","CREATE_ADMIN_COMMAND","REVOKE_ADMIN_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","idempotentProvisionerToken","seed","generated","tokenPrefix","slice","key","update","digest","suffix","administrationEvent","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","toISOString","installationProvisionerTokenStatus","revokedAt","listAdministratorInstallationProvisionerTokens","createAdministratorInstallationProvisionerToken","idempotencyKey","requestFingerprint","event","replayed","revokeAdministratorInstallationProvisionerToken"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AAEvC,SAAQC,+BAA+B,QAAO,0BAA0B;AACxE,SAAQC,qBAAqB,QAAO,8BAA8B;AAElE,SAAQC,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,2CAA2C,EAC3CC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iCAAiC,EACjCC,wCAAwC,EACxCC,sCAAsCC,oCAAoC,EAC1EC,2CAA2C,EAC3CC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,QAAO,eAAe;AAEpC,SACEC,iDAAiD,EACjDC,6BAA6B,QACxB,cAAc;AAcrB,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWhB,oBAAoB;IACrC,MAAMiB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMnB,uBAAuB;QACzCoB,OAAO;QACPC,aAAaT,OAAOS,WAAW;QAC/BC,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAQA,OAAO,eAAea,mCACpBd,MAAgD;IAEhD,MAAMC,WAAWhB,oBAAoB;IACrC,MAAMiB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IACxF,MAAMC,QAAQ,MAAMnB,uBAAuB;QACzCoB,OAAO;QACPE,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IACA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASc,4BAA4BN,WAAmB;IAC7D,OAAOlB,yCAAyCkB;AAClD;AAEA,OAAO,SAASO,uBAAuBP,WAAmB;IACxD,OAAOpB,4BAA4B;QACjCoB;QACAQ,eAAerB,OAAOsB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCnB,MAIrD;IACC,MAAMO,QAAQ,MAAMZ,uBAAuBK;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,OAAO,eAAef,mCAAmCQ,MAGxD;IACC,MAAMO,QAAQ,MAAMd,qCAAqCO;IACzD,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,MAAMc,mBAAuC;AAC7C,MAAMC,sBAA0C;AAChD,MAAMC,uBAAuB;AAC7B,MAAMC,uBAAuB;AAU7B,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IACvE,OAAOzC,gBAAgB,GAAGwC,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,2BAA2BC,IAAY;IAC9C,MAAMC,YAAY/C,oBAAoB;IACtC,MAAMgD,cAAcD,UAAUE,KAAK,CAAC,GAAG,CAAC;IACxC,MAAMC,MAAMtD,WAAW,UAAUE,yBAC9BqD,MAAM,CAAC,4CACPC,MAAM;IACT,MAAMC,SAASzD,WAAW,UAAUsD,KAAKC,MAAM,CAACL,MAAMM,MAAM,CAAC;IAC7D,OAAO,GAAGJ,cAAcK,QAAQ;AAClC;AAEA,SAASC,oBAAoBvC,MAS5B;IACC,OAAOlB,gCAAgC;QACrC0D,SAASxC,OAAOwC,OAAO;QACvBC,WAAWzC,OAAOyC,SAAS;QAC3BC,cAAc1C,OAAO0C,YAAY;QACjChB,SAAS1B,OAAO0B,OAAO;QACvBiB,YAAY;QACZC,UAAU5C,OAAO4C,QAAQ;QACzBC,QAAQ7C,OAAO6C,MAAM;QACrBC,QAAQ;QACRC,eAAe/C,OAAO+C,aAAa;QACnCC,2BAA2BhD,OAAOgD,yBAAyB;QAC3DC,YAAY,IAAI7C,OAAO8C,WAAW;IACpC;AACF;AAIA,OAAO,SAASC,mCACd5C,KAAuB,EACvBF,MAAM,IAAID,MAAM;IAEhB,IAAIG,MAAM6C,SAAS,EAAE,OAAO;IAC5B,IAAI7C,MAAML,SAAS,IAAIK,MAAML,SAAS,IAAIG,KAAK,OAAO;IACtD,OAAO;AACT;AAEA,OAAO,eAAegD,+CAA+CrD,MAIpE;IACC,OAAO,MAAMV,kCAAkCU;AACjD;AAEA,OAAO,eAAesD,gDACpBtD,MAGC;IAED,MAAMgD,4BAA4B9D,gBAAgBc,OAAOuD,cAAc;IACvE,MAAMC,qBAAqB/B,iCAAiCF,sBAAsB;QAChFX,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B0C,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAM5C,WAAW6B,2BACf,GAAG9B,OAAOwC,OAAO,CAAC,CAAC,EAAExC,OAAOuD,cAAc,CAAC,CAAC,EAAEC,oBAAoB;IAEpE,MAAMV,SAAS,MAAM3D,4CAA4C;QAC/DqD,SAASxC,OAAOwC,OAAO;QACvBd,SAASH;QACTwB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAQ;QACA9C,aAAaxB,gBAAgBe;QAC7BU,QAAQ3B,qBAAqBiB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7BsD,OAAO,CAACrC,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcrB;gBACdK,SAASH;gBACTqB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAIF,OAAOY,QAAQ,IAAIxE,gBAAgBe,cAAc6C,OAAOvC,KAAK,CAACG,WAAW,EAAE;QAC7E,MAAM,IAAIb;IACZ;IACA,OAAO;QAAC,GAAGiD,MAAM;QAAE7C;QAAU8C,eAAeD,OAAOC,aAAa;IAAA;AAClE;AAEA,OAAO,eAAeY,gDACpB3D,MAA6E;IAE7E,MAAMgD,4BAA4B9D,gBAAgBc,OAAOuD,cAAc;IACvE,MAAMC,qBAAqB/B,iCAAiCD,sBAAsB;QAChFJ,SAASpB,OAAOoB,OAAO;QACvByB,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAMC,SAAS,MAAMpD,4CAA4C;QAC/D0B,SAASpB,OAAOoB,OAAO;QACvBoB,SAASxC,OAAOwC,OAAO;QACvBd,SAASF;QACTuB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAQ;QACAC,OAAO,CAACrC,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcpB;gBACdI,SAASF;gBACToB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAI,CAACF,QAAQ,MAAM,IAAIhD,8BAA8BE,OAAOoB,OAAO;IACnE,OAAO0B;AACT"}
+{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport type {AdministrationRole} from '@shipfox/api-common-dto';\nimport {createAdministrationActionEvent} from '@shipfox/api-common-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createInstallationProvisionerTokenWithAudit,\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listInstallationProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,\n  revokeInstallationProvisionerTokenWithAudit,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config, runnerReservedLabels} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {\n  ProvisionerAdminIdempotencyReplayUnavailableError,\n  ProvisionerTokenNotFoundError,\n} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    scope: 'workspace',\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport interface CreateInstallationProvisionerTokenParams {\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport async function createInstallationProvisionerToken(\n  params: CreateInstallationProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n  const token = await createProvisionerToken({\n    scope: 'installation',\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nexport async function revokeInstallationProvisionerToken(params: {\n  tokenId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeInstallationProvisionerTokenDb(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nconst ADMIN_OWNER_ROLE: AdministrationRole = 'admin-owner';\nconst ADMIN_OPERATOR_ROLE: AdministrationRole = 'admin-operator';\nconst CREATE_ADMIN_COMMAND = 'runners.provisioner_token.create';\nconst REVOKE_ADMIN_COMMAND = 'runners.provisioner_token.revoke';\n\nexport interface InstallationProvisionerTokenAdministrationContext {\n  actorId: string;\n  actorRole: AdministrationRole;\n  idempotencyKey: string;\n  correlationId: string;\n  reason: string;\n}\n\nfunction administrationCommandFingerprint(command: string, input: unknown): string {\n  return hashOpaqueToken(`${command}:${JSON.stringify(input)}`);\n}\n\nfunction idempotentProvisionerToken(seed: string): string {\n  const generated = generateOpaqueToken('provisionerToken');\n  const tokenPrefix = generated.slice(0, -43);\n  const key = createHmac('sha256', runnerSessionTokenKey())\n    .update('shipfox/provisioner-token-idempotency/v1')\n    .digest();\n  const suffix = createHmac('sha256', key).update(seed).digest('base64url');\n  return `${tokenPrefix}${suffix}`;\n}\n\nfunction administrationEvent(params: {\n  actorId: string;\n  actorRole: AdministrationRole;\n  requiredRole: AdministrationRole;\n  command: string;\n  targetId: string;\n  reason: string;\n  correlationId: string;\n  idempotencyKeyFingerprint: string;\n}) {\n  return createAdministrationActionEvent({\n    actorId: params.actorId,\n    actorRole: params.actorRole,\n    requiredRole: params.requiredRole,\n    command: params.command,\n    targetType: 'provisioner-token',\n    targetId: params.targetId,\n    reason: params.reason,\n    result: 'succeeded',\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    occurredAt: new Date().toISOString(),\n  });\n}\n\nexport type InstallationProvisionerTokenStatus = 'active' | 'expired' | 'revoked';\n\nexport function installationProvisionerTokenStatus(\n  token: ProvisionerToken,\n  now = new Date(),\n): InstallationProvisionerTokenStatus {\n  if (token.revokedAt) return 'revoked';\n  if (token.expiresAt && token.expiresAt <= now) return 'expired';\n  return 'active';\n}\n\nexport type InstallationRunnersStatus = 'managed' | 'none';\n\n/**\n * Whether the installation itself provides runner capacity. Both signals are\n * declarations of intent, not heartbeats: a quiet hosted fleet must not flip\n * the value. Reserved labels dominate even when every installation token has\n * expired or been revoked.\n */\nexport async function installationRunnersStatus(\n  reservedLabels: readonly string[] = runnerReservedLabels,\n): Promise<InstallationRunnersStatus> {\n  if (reservedLabels.length > 0) return 'managed';\n  const {tokens} = await listInstallationProvisionerTokens({limit: 1, status: 'active'});\n  return tokens.length > 0 ? 'managed' : 'none';\n}\n\nexport async function listAdministratorInstallationProvisionerTokens(params: {\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  status?: InstallationProvisionerTokenStatus | undefined;\n}) {\n  return await listInstallationProvisionerTokens(params);\n}\n\nexport async function createAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {\n    name?: string | undefined;\n    ttlSeconds?: number | undefined;\n  },\n): Promise<{token: ProvisionerToken; rawToken: string; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(CREATE_ADMIN_COMMAND, {\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    reason: params.reason,\n  });\n  const rawToken = idempotentProvisionerToken(\n    `${params.actorId}:${params.idempotencyKey}:${requestFingerprint}`,\n  );\n  const result = await createInstallationProvisionerTokenWithAudit({\n    actorId: params.actorId,\n    command: CREATE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    ttlSeconds: params.ttlSeconds,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OWNER_ROLE,\n        command: CREATE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (result.replayed && hashOpaqueToken(rawToken) !== result.token.hashedToken) {\n    throw new ProvisionerAdminIdempotencyReplayUnavailableError();\n  }\n  return {...result, rawToken, correlationId: result.correlationId};\n}\n\nexport async function revokeAdministratorInstallationProvisionerToken(\n  params: InstallationProvisionerTokenAdministrationContext & {tokenId: string},\n): Promise<{token: ProvisionerToken; correlationId: string}> {\n  const idempotencyKeyFingerprint = hashOpaqueToken(params.idempotencyKey);\n  const requestFingerprint = administrationCommandFingerprint(REVOKE_ADMIN_COMMAND, {\n    tokenId: params.tokenId,\n    reason: params.reason,\n  });\n  const result = await revokeInstallationProvisionerTokenWithAudit({\n    tokenId: params.tokenId,\n    actorId: params.actorId,\n    command: REVOKE_ADMIN_COMMAND,\n    correlationId: params.correlationId,\n    idempotencyKeyFingerprint,\n    requestFingerprint,\n    event: (tokenId) =>\n      administrationEvent({\n        actorId: params.actorId,\n        actorRole: params.actorRole,\n        requiredRole: ADMIN_OPERATOR_ROLE,\n        command: REVOKE_ADMIN_COMMAND,\n        targetId: tokenId,\n        reason: params.reason,\n        correlationId: params.correlationId,\n        idempotencyKeyFingerprint,\n      }),\n  });\n  if (!result) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return result;\n}\n"],"names":["createHmac","createAdministrationActionEvent","runnerSessionTokenKey","extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createInstallationProvisionerTokenWithAudit","createProvisionerToken","listActiveProvisionerTokens","listInstallationProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeInstallationProvisionerToken","revokeInstallationProvisionerTokenDb","revokeInstallationProvisionerTokenWithAudit","revokeProvisionerToken","config","runnerReservedLabels","ProvisionerAdminIdempotencyReplayUnavailableError","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","scope","workspaceId","hashedToken","prefix","name","createdByUserId","createInstallationProvisionerToken","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId","ADMIN_OWNER_ROLE","ADMIN_OPERATOR_ROLE","CREATE_ADMIN_COMMAND","REVOKE_ADMIN_COMMAND","administrationCommandFingerprint","command","input","JSON","stringify","idempotentProvisionerToken","seed","generated","tokenPrefix","slice","key","update","digest","suffix","administrationEvent","actorId","actorRole","requiredRole","targetType","targetId","reason","result","correlationId","idempotencyKeyFingerprint","occurredAt","toISOString","installationProvisionerTokenStatus","revokedAt","installationRunnersStatus","reservedLabels","length","tokens","limit","status","listAdministratorInstallationProvisionerTokens","createAdministratorInstallationProvisionerToken","idempotencyKey","requestFingerprint","event","replayed","revokeAdministratorInstallationProvisionerToken"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AAEvC,SAAQC,+BAA+B,QAAO,0BAA0B;AACxE,SAAQC,qBAAqB,QAAO,8BAA8B;AAElE,SAAQC,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,2CAA2C,EAC3CC,sBAAsB,EACtBC,2BAA2B,EAC3BC,iCAAiC,EACjCC,wCAAwC,EACxCC,sCAAsCC,oCAAoC,EAC1EC,2CAA2C,EAC3CC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,eAAe;AAE1D,SACEC,iDAAiD,EACjDC,6BAA6B,QACxB,cAAc;AAcrB,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWjB,oBAAoB;IACrC,MAAMkB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMpB,uBAAuB;QACzCqB,OAAO;QACPC,aAAaT,OAAOS,WAAW;QAC/BC,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAQA,OAAO,eAAea,mCACpBd,MAAgD;IAEhD,MAAMC,WAAWjB,oBAAoB;IACrC,MAAMkB,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IACxF,MAAMC,QAAQ,MAAMpB,uBAAuB;QACzCqB,OAAO;QACPE,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IACA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASc,4BAA4BN,WAAmB;IAC7D,OAAOnB,yCAAyCmB;AAClD;AAEA,OAAO,SAASO,uBAAuBP,WAAmB;IACxD,OAAOrB,4BAA4B;QACjCqB;QACAQ,eAAetB,OAAOuB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCnB,MAIrD;IACC,MAAMO,QAAQ,MAAMb,uBAAuBM;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,OAAO,eAAehB,mCAAmCS,MAGxD;IACC,MAAMO,QAAQ,MAAMf,qCAAqCQ;IACzD,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,MAAMc,mBAAuC;AAC7C,MAAMC,sBAA0C;AAChD,MAAMC,uBAAuB;AAC7B,MAAMC,uBAAuB;AAU7B,SAASC,iCAAiCC,OAAe,EAAEC,KAAc;IACvE,OAAO1C,gBAAgB,GAAGyC,QAAQ,CAAC,EAAEE,KAAKC,SAAS,CAACF,QAAQ;AAC9D;AAEA,SAASG,2BAA2BC,IAAY;IAC9C,MAAMC,YAAYhD,oBAAoB;IACtC,MAAMiD,cAAcD,UAAUE,KAAK,CAAC,GAAG,CAAC;IACxC,MAAMC,MAAMvD,WAAW,UAAUE,yBAC9BsD,MAAM,CAAC,4CACPC,MAAM;IACT,MAAMC,SAAS1D,WAAW,UAAUuD,KAAKC,MAAM,CAACL,MAAMM,MAAM,CAAC;IAC7D,OAAO,GAAGJ,cAAcK,QAAQ;AAClC;AAEA,SAASC,oBAAoBvC,MAS5B;IACC,OAAOnB,gCAAgC;QACrC2D,SAASxC,OAAOwC,OAAO;QACvBC,WAAWzC,OAAOyC,SAAS;QAC3BC,cAAc1C,OAAO0C,YAAY;QACjChB,SAAS1B,OAAO0B,OAAO;QACvBiB,YAAY;QACZC,UAAU5C,OAAO4C,QAAQ;QACzBC,QAAQ7C,OAAO6C,MAAM;QACrBC,QAAQ;QACRC,eAAe/C,OAAO+C,aAAa;QACnCC,2BAA2BhD,OAAOgD,yBAAyB;QAC3DC,YAAY,IAAI7C,OAAO8C,WAAW;IACpC;AACF;AAIA,OAAO,SAASC,mCACd5C,KAAuB,EACvBF,MAAM,IAAID,MAAM;IAEhB,IAAIG,MAAM6C,SAAS,EAAE,OAAO;IAC5B,IAAI7C,MAAML,SAAS,IAAIK,MAAML,SAAS,IAAIG,KAAK,OAAO;IACtD,OAAO;AACT;AAIA;;;;;CAKC,GACD,OAAO,eAAegD,0BACpBC,iBAAoC1D,oBAAoB;IAExD,IAAI0D,eAAeC,MAAM,GAAG,GAAG,OAAO;IACtC,MAAM,EAACC,MAAM,EAAC,GAAG,MAAMnE,kCAAkC;QAACoE,OAAO;QAAGC,QAAQ;IAAQ;IACpF,OAAOF,OAAOD,MAAM,GAAG,IAAI,YAAY;AACzC;AAEA,OAAO,eAAeI,+CAA+C3D,MAIpE;IACC,OAAO,MAAMX,kCAAkCW;AACjD;AAEA,OAAO,eAAe4D,gDACpB5D,MAGC;IAED,MAAMgD,4BAA4B/D,gBAAgBe,OAAO6D,cAAc;IACvE,MAAMC,qBAAqBrC,iCAAiCF,sBAAsB;QAChFX,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B0C,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAM5C,WAAW6B,2BACf,GAAG9B,OAAOwC,OAAO,CAAC,CAAC,EAAExC,OAAO6D,cAAc,CAAC,CAAC,EAAEC,oBAAoB;IAEpE,MAAMhB,SAAS,MAAM5D,4CAA4C;QAC/DsD,SAASxC,OAAOwC,OAAO;QACvBd,SAASH;QACTwB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAc;QACApD,aAAazB,gBAAgBgB;QAC7BU,QAAQ5B,qBAAqBkB;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBT,YAAYH,OAAOG,UAAU;QAC7B4D,OAAO,CAAC3C,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcrB;gBACdK,SAASH;gBACTqB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAIF,OAAOkB,QAAQ,IAAI/E,gBAAgBgB,cAAc6C,OAAOvC,KAAK,CAACG,WAAW,EAAE;QAC7E,MAAM,IAAIb;IACZ;IACA,OAAO;QAAC,GAAGiD,MAAM;QAAE7C;QAAU8C,eAAeD,OAAOC,aAAa;IAAA;AAClE;AAEA,OAAO,eAAekB,gDACpBjE,MAA6E;IAE7E,MAAMgD,4BAA4B/D,gBAAgBe,OAAO6D,cAAc;IACvE,MAAMC,qBAAqBrC,iCAAiCD,sBAAsB;QAChFJ,SAASpB,OAAOoB,OAAO;QACvByB,QAAQ7C,OAAO6C,MAAM;IACvB;IACA,MAAMC,SAAS,MAAMrD,4CAA4C;QAC/D2B,SAASpB,OAAOoB,OAAO;QACvBoB,SAASxC,OAAOwC,OAAO;QACvBd,SAASF;QACTuB,eAAe/C,OAAO+C,aAAa;QACnCC;QACAc;QACAC,OAAO,CAAC3C,UACNmB,oBAAoB;gBAClBC,SAASxC,OAAOwC,OAAO;gBACvBC,WAAWzC,OAAOyC,SAAS;gBAC3BC,cAAcpB;gBACdI,SAASF;gBACToB,UAAUxB;gBACVyB,QAAQ7C,OAAO6C,MAAM;gBACrBE,eAAe/C,OAAO+C,aAAa;gBACnCC;YACF;IACJ;IACA,IAAI,CAACF,QAAQ,MAAM,IAAIhD,8BAA8BE,OAAOoB,OAAO;IACnE,OAAO0B;AACT"}

package/dist/presentation/routes/list-active-provisioners.d.ts

@@ -1,2 +1,6 @@
+import { installationRunnersStatus } from '#core/index.js';
+type InstallationRunnersStatusReader = () => ReturnType<typeof installationRunnersStatus>;
+export declare function createListActiveProvisionersRoute(readInstallationRunnersStatus?: InstallationRunnersStatusReader): import("@shipfox/node-fastify").RouteDefinition;
 export declare const listActiveProvisionersRoute: import("@shipfox/node-fastify").RouteDefinition;
+export {};
 //# sourceMappingURL=list-active-provisioners.d.ts.map

package/dist/presentation/routes/list-active-provisioners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-active-provisioners.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/list-active-provisioners.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,2BAA2B,iDAiBtC,CAAC"}
+{"version":3,"file":"list-active-provisioners.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/list-active-provisioners.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,yBAAyB,EAAyB,MAAM,gBAAgB,CAAC;AAGjF,KAAK,+BAA+B,GAAG,MAAM,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE1F,wBAAgB,iCAAiC,CAC/C,6BAA6B,GAAE,+BAA2D,mDA6B3F;AAED,eAAO,MAAM,2BAA2B,iDAAsC,CAAC"}

package/dist/presentation/routes/list-active-provisioners.js

@@ -2,31 +2,43 @@ import { requireWorkspaceAccess } from '@shipfox/api-auth-context';
 import { listActiveProvisionersResponseSchema } from '@shipfox/api-runners-dto';
 import { defineRoute } from '@shipfox/node-fastify';
 import { z } from 'zod';
-import { listActiveProvisioners } from '#core/index.js';
+import { installationRunnersStatus, listActiveProvisioners } from '#core/index.js';
 import { toActiveProvisionerDto } from '#presentation/dto/index.js';
-export const listActiveProvisionersRoute = defineRoute({
-    method: 'GET',
-    path: '/',
-    description: 'List active provisioners for a workspace',
-    schema: {
-        params: z.object({
-            workspaceId: z.string().uuid()
-        }),
-        response: {
-            200: listActiveProvisionersResponseSchema
+export function createListActiveProvisionersRoute(readInstallationRunnersStatus = installationRunnersStatus) {
+    return defineRoute({
+        method: 'GET',
+        path: '/',
+        description: 'List active provisioners for a workspace',
+        schema: {
+            params: z.object({
+                workspaceId: z.string().uuid()
+            }),
+            response: {
+                200: listActiveProvisionersResponseSchema
+            }
+        },
+        handler: async (request)=>{
+            const { workspaceId } = request.params;
+            requireWorkspaceAccess({
+                request,
+                workspaceId
+            });
+            const [provisioners, installationRunners] = await Promise.all([
+                listActiveProvisioners(workspaceId),
+                readInstallationRunnersStatus().catch((error)=>{
+                    request.log.warn({
+                        err: error
+                    }, 'Could not resolve installation runner status');
+                    return 'none';
+                })
+            ]);
+            return {
+                provisioners: provisioners.map(toActiveProvisionerDto),
+                installation_runners: installationRunners
+            };
         }
-    },
-    handler: async (request)=>{
-        const { workspaceId } = request.params;
-        requireWorkspaceAccess({
-            request,
-            workspaceId
-        });
-        const provisioners = await listActiveProvisioners(workspaceId);
-        return {
-            provisioners: provisioners.map(toActiveProvisionerDto)
-        };
-    }
-});
+    });
+}
+export const listActiveProvisionersRoute = createListActiveProvisionersRoute();
 
 //# sourceMappingURL=list-active-provisioners.js.map

package/dist/presentation/routes/list-active-provisioners.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/list-active-provisioners.ts"],"sourcesContent":["import {requireWorkspaceAccess} from '@shipfox/api-auth-context';\nimport {listActiveProvisionersResponseSchema} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {listActiveProvisioners} from '#core/index.js';\nimport {toActiveProvisionerDto} from '#presentation/dto/index.js';\n\nexport const listActiveProvisionersRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List active provisioners for a workspace',\n  schema: {\n    params: z.object({workspaceId: z.string().uuid()}),\n    response: {\n      200: listActiveProvisionersResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const {workspaceId} = request.params;\n    requireWorkspaceAccess({request, workspaceId});\n\n    const provisioners = await listActiveProvisioners(workspaceId);\n    return {provisioners: provisioners.map(toActiveProvisionerDto)};\n  },\n});\n"],"names":["requireWorkspaceAccess","listActiveProvisionersResponseSchema","defineRoute","z","listActiveProvisioners","toActiveProvisionerDto","listActiveProvisionersRoute","method","path","description","schema","params","object","workspaceId","string","uuid","response","handler","request","provisioners","map"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,4BAA4B;AACjE,SAAQC,oCAAoC,QAAO,2BAA2B;AAC9E,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,sBAAsB,QAAO,iBAAiB;AACtD,SAAQC,sBAAsB,QAAO,6BAA6B;AAElE,OAAO,MAAMC,8BAA8BJ,YAAY;IACrDK,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,QAAQR,EAAES,MAAM,CAAC;YAACC,aAAaV,EAAEW,MAAM,GAAGC,IAAI;QAAE;QAChDC,UAAU;YACR,KAAKf;QACP;IACF;IACAgB,SAAS,OAAOC;QACd,MAAM,EAACL,WAAW,EAAC,GAAGK,QAAQP,MAAM;QACpCX,uBAAuB;YAACkB;YAASL;QAAW;QAE5C,MAAMM,eAAe,MAAMf,uBAAuBS;QAClD,OAAO;YAACM,cAAcA,aAAaC,GAAG,CAACf;QAAuB;IAChE;AACF,GAAG"}
+{"version":3,"sources":["../../../src/presentation/routes/list-active-provisioners.ts"],"sourcesContent":["import {requireWorkspaceAccess} from '@shipfox/api-auth-context';\nimport {listActiveProvisionersResponseSchema} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {installationRunnersStatus, listActiveProvisioners} from '#core/index.js';\nimport {toActiveProvisionerDto} from '#presentation/dto/index.js';\n\ntype InstallationRunnersStatusReader = () => ReturnType<typeof installationRunnersStatus>;\n\nexport function createListActiveProvisionersRoute(\n  readInstallationRunnersStatus: InstallationRunnersStatusReader = installationRunnersStatus,\n) {\n  return defineRoute({\n    method: 'GET',\n    path: '/',\n    description: 'List active provisioners for a workspace',\n    schema: {\n      params: z.object({workspaceId: z.string().uuid()}),\n      response: {\n        200: listActiveProvisionersResponseSchema,\n      },\n    },\n    handler: async (request) => {\n      const {workspaceId} = request.params;\n      requireWorkspaceAccess({request, workspaceId});\n\n      const [provisioners, installationRunners] = await Promise.all([\n        listActiveProvisioners(workspaceId),\n        readInstallationRunnersStatus().catch((error: unknown) => {\n          request.log.warn({err: error}, 'Could not resolve installation runner status');\n          return 'none' as const;\n        }),\n      ]);\n      return {\n        provisioners: provisioners.map(toActiveProvisionerDto),\n        installation_runners: installationRunners,\n      };\n    },\n  });\n}\n\nexport const listActiveProvisionersRoute = createListActiveProvisionersRoute();\n"],"names":["requireWorkspaceAccess","listActiveProvisionersResponseSchema","defineRoute","z","installationRunnersStatus","listActiveProvisioners","toActiveProvisionerDto","createListActiveProvisionersRoute","readInstallationRunnersStatus","method","path","description","schema","params","object","workspaceId","string","uuid","response","handler","request","provisioners","installationRunners","Promise","all","catch","error","log","warn","err","map","installation_runners","listActiveProvisionersRoute"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,4BAA4B;AACjE,SAAQC,oCAAoC,QAAO,2BAA2B;AAC9E,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,yBAAyB,EAAEC,sBAAsB,QAAO,iBAAiB;AACjF,SAAQC,sBAAsB,QAAO,6BAA6B;AAIlE,OAAO,SAASC,kCACdC,gCAAiEJ,yBAAyB;IAE1F,OAAOF,YAAY;QACjBO,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YACNC,QAAQV,EAAEW,MAAM,CAAC;gBAACC,aAAaZ,EAAEa,MAAM,GAAGC,IAAI;YAAE;YAChDC,UAAU;gBACR,KAAKjB;YACP;QACF;QACAkB,SAAS,OAAOC;YACd,MAAM,EAACL,WAAW,EAAC,GAAGK,QAAQP,MAAM;YACpCb,uBAAuB;gBAACoB;gBAASL;YAAW;YAE5C,MAAM,CAACM,cAAcC,oBAAoB,GAAG,MAAMC,QAAQC,GAAG,CAAC;gBAC5DnB,uBAAuBU;gBACvBP,gCAAgCiB,KAAK,CAAC,CAACC;oBACrCN,QAAQO,GAAG,CAACC,IAAI,CAAC;wBAACC,KAAKH;oBAAK,GAAG;oBAC/B,OAAO;gBACT;aACD;YACD,OAAO;gBACLL,cAAcA,aAAaS,GAAG,CAACxB;gBAC/ByB,sBAAsBT;YACxB;QACF;IACF;AACF;AAEA,OAAO,MAAMU,8BAA8BzB,oCAAoC"}