@shipfox/api-runners 13.1.0 → 14.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-runners",
   "license": "MIT",
-  "version": "13.1.0",
+  "version": "14.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -24,8 +24,8 @@
     "@shipfox/api-common-dto": "12.0.0",
     "@shipfox/api-auth-context": "12.2.0",
     "@shipfox/api-auth-dto": "12.0.0",
-    "@shipfox/api-runners-dto": "13.0.0",
-    "@shipfox/api-workflows-dto": "13.1.0",
+    "@shipfox/api-runners-dto": "14.0.0",
+    "@shipfox/api-workflows-dto": "14.0.0",
     "@shipfox/config": "1.2.4",
     "@shipfox/inter-module": "0.2.3",
     "@shipfox/node-drizzle": "0.3.5",

package/src/core/index.ts

@@ -40,7 +40,9 @@ export {
   createAdministratorInstallationProvisionerToken,
   createInstallationProvisionerToken,
   createWorkspaceProvisionerToken,
+  type InstallationRunnersStatus,
   installationProvisionerTokenStatus,
+  installationRunnersStatus,
   listActiveProvisioners,
   listAdministratorInstallationProvisionerTokens,
   listUsableProvisionerTokens,

package/src/core/provisioner-tokens.test.ts

@@ -6,6 +6,7 @@ import {provisionerTokenFactory} from '#test/index.js';
 import {
   createInstallationProvisionerToken,
   createWorkspaceProvisionerToken,
+  installationRunnersStatus,
   listUsableProvisionerTokens,
   revokeInstallationProvisionerToken,
   revokeWorkspaceProvisionerToken,
@@ -79,3 +80,48 @@ describe('provisioner token core', () => {
     await expect(result).rejects.toThrow(`Provisioner token not found: ${token.id}`);
   });
 });
+
+describe('installationRunnersStatus', () => {
+  beforeEach(async () => {
+    await db().delete(provisionerTokens).where(eq(provisionerTokens.scope, 'installation'));
+  });
+
+  it('reports managed when reserved labels are configured, without any token', async () => {
+    await expect(installationRunnersStatus(['linux'])).resolves.toBe('managed');
+  });
+
+  it('reports none without reserved labels and without installation tokens', async () => {
+    await expect(installationRunnersStatus([])).resolves.toBe('none');
+  });
+
+  it('reports managed when an installation token is active', async () => {
+    await provisionerTokenFactory.create({scope: 'installation'});
+
+    await expect(installationRunnersStatus([])).resolves.toBe('managed');
+  });
+
+  it('reports none when the only installation token has expired', async () => {
+    await provisionerTokenFactory.create({
+      scope: 'installation',
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+
+    await expect(installationRunnersStatus([])).resolves.toBe('none');
+  });
+
+  it('reports none when the only installation token is revoked', async () => {
+    const token = await provisionerTokenFactory.create({scope: 'installation'});
+    await revokeInstallationProvisionerToken({
+      tokenId: token.id,
+      revokedByUserId: crypto.randomUUID(),
+    });
+
+    await expect(installationRunnersStatus([])).resolves.toBe('none');
+  });
+
+  it('ignores workspace-scope tokens', async () => {
+    await provisionerTokenFactory.create({workspaceId: crypto.randomUUID()});
+
+    await expect(installationRunnersStatus([])).resolves.toBe('none');
+  });
+});

package/src/core/provisioner-tokens.ts

@@ -14,7 +14,7 @@ import {
   revokeInstallationProvisionerTokenWithAudit,
   revokeProvisionerToken,
 } from '#db/provisioner-tokens.js';
-import {config} from '../config.js';
+import {config, runnerReservedLabels} from '../config.js';
 import type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';
 import {
   ProvisionerAdminIdempotencyReplayUnavailableError,
@@ -167,6 +167,22 @@ export function installationProvisionerTokenStatus(
   return 'active';
 }
 
+export type InstallationRunnersStatus = 'managed' | 'none';
+
+/**
+ * Whether the installation itself provides runner capacity. Both signals are
+ * declarations of intent, not heartbeats: a quiet hosted fleet must not flip
+ * the value. Reserved labels dominate even when every installation token has
+ * expired or been revoked.
+ */
+export async function installationRunnersStatus(
+  reservedLabels: readonly string[] = runnerReservedLabels,
+): Promise<InstallationRunnersStatus> {
+  if (reservedLabels.length > 0) return 'managed';
+  const {tokens} = await listInstallationProvisionerTokens({limit: 1, status: 'active'});
+  return tokens.length > 0 ? 'managed' : 'none';
+}
+
 export async function listAdministratorInstallationProvisionerTokens(params: {
   limit: number;
   cursor?: TimestampIdCursor | undefined;

package/src/presentation/routes/list-active-provisioners.ts

@@ -2,24 +2,41 @@ import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {listActiveProvisionersResponseSchema} from '@shipfox/api-runners-dto';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {listActiveProvisioners} from '#core/index.js';
+import {installationRunnersStatus, listActiveProvisioners} from '#core/index.js';
 import {toActiveProvisionerDto} from '#presentation/dto/index.js';
 
-export const listActiveProvisionersRoute = defineRoute({
-  method: 'GET',
-  path: '/',
-  description: 'List active provisioners for a workspace',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    response: {
-      200: listActiveProvisionersResponseSchema,
+type InstallationRunnersStatusReader = () => ReturnType<typeof installationRunnersStatus>;
+
+export function createListActiveProvisionersRoute(
+  readInstallationRunnersStatus: InstallationRunnersStatusReader = installationRunnersStatus,
+) {
+  return defineRoute({
+    method: 'GET',
+    path: '/',
+    description: 'List active provisioners for a workspace',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      response: {
+        200: listActiveProvisionersResponseSchema,
+      },
+    },
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      requireWorkspaceAccess({request, workspaceId});
+
+      const [provisioners, installationRunners] = await Promise.all([
+        listActiveProvisioners(workspaceId),
+        readInstallationRunnersStatus().catch((error: unknown) => {
+          request.log.warn({err: error}, 'Could not resolve installation runner status');
+          return 'none' as const;
+        }),
+      ]);
+      return {
+        provisioners: provisioners.map(toActiveProvisionerDto),
+        installation_runners: installationRunners,
+      };
     },
-  },
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    requireWorkspaceAccess({request, workspaceId});
+  });
+}
 
-    const provisioners = await listActiveProvisioners(workspaceId);
-    return {provisioners: provisioners.map(toActiveProvisionerDto)};
-  },
-});
+export const listActiveProvisionersRoute = createListActiveProvisionersRoute();

package/src/presentation/routes/provisioner-tokens.test.ts

@@ -15,6 +15,7 @@ import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
 import {createProvisionerTokenAuthMethod} from '#presentation/auth/index.js';
 import {provisionerTokenFactory} from '#test/index.js';
 import {provisionerRoutes} from './index.js';
+import {createListActiveProvisionersRoute} from './list-active-provisioners.js';
 
 const userId = crypto.randomUUID();
 let authenticatedMemberships: ReadonlyArray<UserContextMembership> = [];
@@ -141,8 +142,51 @@ describe('provisioner token routes', () => {
             last_seen_at: expect.any(String),
           }),
         ],
+        // The test environment configures RUNNER_RESERVED_LABELS, so the
+        // installation always reports managed runner capacity.
+        installation_runners: 'managed',
       });
     });
+
+    it('reports managed installation runners from the reserved labels signal alone', async () => {
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/active`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json().installation_runners).toBe('managed');
+    });
+
+    it('keeps active provisioners available when installation status is unavailable', async () => {
+      await closeApp();
+      app = await createApp({
+        auth: [fakeUserAuth, createProvisionerTokenAuthMethod()],
+        routes: [
+          {
+            prefix: '/workspaces/:workspaceId/provisioners/active',
+            auth: AUTH_USER,
+            routes: [
+              createListActiveProvisionersRoute(() =>
+                Promise.reject(new Error('status lookup unavailable')),
+              ),
+            ],
+          },
+        ],
+        swagger: false,
+      });
+      await app.ready();
+
+      const res = await app.inject({
+        method: 'GET',
+        url: `/workspaces/${workspaceId}/provisioners/active`,
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({provisioners: [], installation_runners: 'none'});
+    });
   });
 
   describe('POST /workspaces/:workspaceId/provisioners/tokens', () => {