@shipfox/api-runners 2.0.0

package/dist/presentation/routes/mint-registration-tokens.js

@@ -0,0 +1,74 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { mintRegistrationTokensBatchBodySchema, mintRegistrationTokensBatchResponseSchema } from '@shipfox/api-runners-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { config } from '#config.js';
+import { mintEphemeralRegistrationTokensBatch } from '#core/ephemeral-registration-tokens.js';
+import { ActiveEphemeralRegistrationTokensExistError, RegistrationTokenBatchExceedsReservationError, RegistrationTokenBatchTooLargeError, ReservationExpiredError, ReservationNotFoundError } from '#core/errors.js';
+import { toMintRegistrationTokensProvisionedRunners, toMintRegistrationTokensResponseDto } from '#presentation/dto/index.js';
+import { createProvisionerMintRateLimitPreHandler } from './rate-limit.js';
+export const mintRegistrationTokensRoute = defineRoute({
+    method: 'POST',
+    path: '/runner-registration-tokens/batch',
+    description: 'Mint ephemeral runner registration tokens for reserved provisioned runners',
+    schema: {
+        body: mintRegistrationTokensBatchBodySchema,
+        response: {
+            200: mintRegistrationTokensBatchResponseSchema
+        }
+    },
+    preHandler: createProvisionerMintRateLimitPreHandler(),
+    errorHandler: (error)=>{
+        if (error instanceof ReservationNotFoundError) {
+            throw new ClientError('Reservation not found', 'reservation-not-found', {
+                status: 404
+            });
+        }
+        if (error instanceof ReservationExpiredError) {
+            throw new ClientError('Reservation has expired', 'reservation-expired', {
+                status: 409
+            });
+        }
+        if (error instanceof RegistrationTokenBatchExceedsReservationError) {
+            throw new ClientError('Batch exceeds reservation count', 'batch-exceeds-reservation', {
+                status: 409,
+                details: {
+                    requested: error.requested,
+                    reservation_count: error.reservationCount,
+                    already_minted: error.alreadyMinted
+                }
+            });
+        }
+        if (error instanceof ActiveEphemeralRegistrationTokensExistError) {
+            throw new ClientError('Registration token already active', 'registration-token-active', {
+                status: 409,
+                details: {
+                    provisioned_runner_ids: error.provisionedRunnerIds
+                }
+            });
+        }
+        if (error instanceof RegistrationTokenBatchTooLargeError) {
+            throw new ClientError('Registration token batch is too large', 'batch-too-large', {
+                status: 400,
+                details: {
+                    requested: error.requested,
+                    max: error.max
+                }
+            });
+        }
+        throw error;
+    },
+    handler: async (request)=>{
+        const { provisionerTokenId, workspaceId } = requireProvisionerContext(request);
+        const result = await mintEphemeralRegistrationTokensBatch({
+            workspaceId,
+            provisionerId: provisionerTokenId,
+            reservationId: request.body.reservation_id,
+            provisionedRunners: toMintRegistrationTokensProvisionedRunners(request.body.provisioned_runners),
+            ttlSeconds: config.EPHEMERAL_REGISTRATION_TOKEN_TTL_SECONDS,
+            maxBatchSize: config.REGISTRATION_TOKEN_BATCH_MAX
+        });
+        return toMintRegistrationTokensResponseDto(result);
+    }
+});
+
+//# sourceMappingURL=mint-registration-tokens.js.map

package/dist/presentation/routes/mint-registration-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/mint-registration-tokens.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {\n  mintRegistrationTokensBatchBodySchema,\n  mintRegistrationTokensBatchResponseSchema,\n} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {config} from '#config.js';\nimport {mintEphemeralRegistrationTokensBatch} from '#core/ephemeral-registration-tokens.js';\nimport {\n  ActiveEphemeralRegistrationTokensExistError,\n  RegistrationTokenBatchExceedsReservationError,\n  RegistrationTokenBatchTooLargeError,\n  ReservationExpiredError,\n  ReservationNotFoundError,\n} from '#core/errors.js';\nimport {\n  toMintRegistrationTokensProvisionedRunners,\n  toMintRegistrationTokensResponseDto,\n} from '#presentation/dto/index.js';\nimport {createProvisionerMintRateLimitPreHandler} from './rate-limit.js';\n\nexport const mintRegistrationTokensRoute = defineRoute({\n  method: 'POST',\n  path: '/runner-registration-tokens/batch',\n  description: 'Mint ephemeral runner registration tokens for reserved provisioned runners',\n  schema: {\n    body: mintRegistrationTokensBatchBodySchema,\n    response: {\n      200: mintRegistrationTokensBatchResponseSchema,\n    },\n  },\n  preHandler: createProvisionerMintRateLimitPreHandler(),\n  errorHandler: (error) => {\n    if (error instanceof ReservationNotFoundError) {\n      throw new ClientError('Reservation not found', 'reservation-not-found', {status: 404});\n    }\n    if (error instanceof ReservationExpiredError) {\n      throw new ClientError('Reservation has expired', 'reservation-expired', {status: 409});\n    }\n    if (error instanceof RegistrationTokenBatchExceedsReservationError) {\n      throw new ClientError('Batch exceeds reservation count', 'batch-exceeds-reservation', {\n        status: 409,\n        details: {\n          requested: error.requested,\n          reservation_count: error.reservationCount,\n          already_minted: error.alreadyMinted,\n        },\n      });\n    }\n    if (error instanceof ActiveEphemeralRegistrationTokensExistError) {\n      throw new ClientError('Registration token already active', 'registration-token-active', {\n        status: 409,\n        details: {provisioned_runner_ids: error.provisionedRunnerIds},\n      });\n    }\n    if (error instanceof RegistrationTokenBatchTooLargeError) {\n      throw new ClientError('Registration token batch is too large', 'batch-too-large', {\n        status: 400,\n        details: {\n          requested: error.requested,\n          max: error.max,\n        },\n      });\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);\n    const result = await mintEphemeralRegistrationTokensBatch({\n      workspaceId,\n      provisionerId: provisionerTokenId,\n      reservationId: request.body.reservation_id,\n      provisionedRunners: toMintRegistrationTokensProvisionedRunners(\n        request.body.provisioned_runners,\n      ),\n      ttlSeconds: config.EPHEMERAL_REGISTRATION_TOKEN_TTL_SECONDS,\n      maxBatchSize: config.REGISTRATION_TOKEN_BATCH_MAX,\n    });\n\n    return toMintRegistrationTokensResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","mintRegistrationTokensBatchBodySchema","mintRegistrationTokensBatchResponseSchema","ClientError","defineRoute","config","mintEphemeralRegistrationTokensBatch","ActiveEphemeralRegistrationTokensExistError","RegistrationTokenBatchExceedsReservationError","RegistrationTokenBatchTooLargeError","ReservationExpiredError","ReservationNotFoundError","toMintRegistrationTokensProvisionedRunners","toMintRegistrationTokensResponseDto","createProvisionerMintRateLimitPreHandler","mintRegistrationTokensRoute","method","path","description","schema","body","response","preHandler","errorHandler","error","status","details","requested","reservation_count","reservationCount","already_minted","alreadyMinted","provisioned_runner_ids","provisionedRunnerIds","max","handler","request","provisionerTokenId","workspaceId","result","provisionerId","reservationId","reservation_id","provisionedRunners","provisioned_runners","ttlSeconds","EPHEMERAL_REGISTRATION_TOKEN_TTL_SECONDS","maxBatchSize","REGISTRATION_TOKEN_BATCH_MAX"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SACEC,qCAAqC,EACrCC,yCAAyC,QACpC,2BAA2B;AAClC,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oCAAoC,QAAO,yCAAyC;AAC5F,SACEC,2CAA2C,EAC3CC,6CAA6C,EAC7CC,mCAAmC,EACnCC,uBAAuB,EACvBC,wBAAwB,QACnB,kBAAkB;AACzB,SACEC,0CAA0C,EAC1CC,mCAAmC,QAC9B,6BAA6B;AACpC,SAAQC,wCAAwC,QAAO,kBAAkB;AAEzE,OAAO,MAAMC,8BAA8BX,YAAY;IACrDY,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMnB;QACNoB,UAAU;YACR,KAAKnB;QACP;IACF;IACAoB,YAAYR;IACZS,cAAc,CAACC;QACb,IAAIA,iBAAiBb,0BAA0B;YAC7C,MAAM,IAAIR,YAAY,yBAAyB,yBAAyB;gBAACsB,QAAQ;YAAG;QACtF;QACA,IAAID,iBAAiBd,yBAAyB;YAC5C,MAAM,IAAIP,YAAY,2BAA2B,uBAAuB;gBAACsB,QAAQ;YAAG;QACtF;QACA,IAAID,iBAAiBhB,+CAA+C;YAClE,MAAM,IAAIL,YAAY,mCAAmC,6BAA6B;gBACpFsB,QAAQ;gBACRC,SAAS;oBACPC,WAAWH,MAAMG,SAAS;oBAC1BC,mBAAmBJ,MAAMK,gBAAgB;oBACzCC,gBAAgBN,MAAMO,aAAa;gBACrC;YACF;QACF;QACA,IAAIP,iBAAiBjB,6CAA6C;YAChE,MAAM,IAAIJ,YAAY,qCAAqC,6BAA6B;gBACtFsB,QAAQ;gBACRC,SAAS;oBAACM,wBAAwBR,MAAMS,oBAAoB;gBAAA;YAC9D;QACF;QACA,IAAIT,iBAAiBf,qCAAqC;YACxD,MAAM,IAAIN,YAAY,yCAAyC,mBAAmB;gBAChFsB,QAAQ;gBACRC,SAAS;oBACPC,WAAWH,MAAMG,SAAS;oBAC1BO,KAAKV,MAAMU,GAAG;gBAChB;YACF;QACF;QACA,MAAMV;IACR;IACAW,SAAS,OAAOC;QACd,MAAM,EAACC,kBAAkB,EAAEC,WAAW,EAAC,GAAGtC,0BAA0BoC;QACpE,MAAMG,SAAS,MAAMjC,qCAAqC;YACxDgC;YACAE,eAAeH;YACfI,eAAeL,QAAQhB,IAAI,CAACsB,cAAc;YAC1CC,oBAAoB/B,2CAClBwB,QAAQhB,IAAI,CAACwB,mBAAmB;YAElCC,YAAYxC,OAAOyC,wCAAwC;YAC3DC,cAAc1C,OAAO2C,4BAA4B;QACnD;QAEA,OAAOnC,oCAAoC0B;IAC7C;AACF,GAAG"}

package/dist/presentation/routes/poll-demand.d.ts

@@ -0,0 +1,2 @@
+export declare const pollDemandRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=poll-demand.d.ts.map

package/dist/presentation/routes/poll-demand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-demand.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/poll-demand.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe,iDA6C1B,CAAC"}

package/dist/presentation/routes/poll-demand.js

@@ -0,0 +1,53 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { pollDemandBodySchema, pollDemandResponseSchema } from '@shipfox/api-runners-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { config } from '#config.js';
+import { pollDemand, releaseReservationGrants } from '#core/demand.js';
+import { toPollDemandResponseDto } from '#presentation/dto/index.js';
+const TERMINATE_INTENT_LIMIT = 1000;
+export const pollDemandRoute = defineRoute({
+    method: 'POST',
+    path: '/demand/poll',
+    description: 'Poll aggregate runner demand and reserve capacity for a provisioner',
+    schema: {
+        body: pollDemandBodySchema,
+        response: {
+            200: pollDemandResponseSchema
+        }
+    },
+    handler: async (request, reply)=>{
+        const { provisionerTokenId, workspaceId } = requireProvisionerContext(request);
+        const abortController = new AbortController();
+        let responseFinished = false;
+        let responseReservations = [];
+        reply.raw.on('finish', ()=>{
+            responseFinished = true;
+        });
+        reply.raw.on('close', ()=>{
+            if (!responseFinished) {
+                abortController.abort();
+                void releaseReservationGrants(responseReservations).catch(()=>undefined);
+            }
+        });
+        const result = await pollDemand({
+            workspaceId,
+            provisionerId: provisionerTokenId,
+            maxReservations: request.body.max_reservations,
+            waitSeconds: request.body.wait_seconds,
+            ttlSeconds: config.RESERVATION_TTL_SECONDS,
+            terminateIntentLimit: TERMINATE_INTENT_LIMIT,
+            templates: request.body.templates.map((template)=>({
+                    templateKey: template.template_key,
+                    labels: template.labels,
+                    availableSlots: template.available_slots,
+                    starting: template.starting,
+                    running: template.running
+                })),
+            signal: abortController.signal
+        });
+        responseReservations = result.reservations;
+        return toPollDemandResponseDto(result);
+    }
+});
+
+//# sourceMappingURL=poll-demand.js.map

package/dist/presentation/routes/poll-demand.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/poll-demand.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {pollDemandBodySchema, pollDemandResponseSchema} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {config} from '#config.js';\nimport {pollDemand, releaseReservationGrants} from '#core/demand.js';\nimport type {ReservationGrant} from '#db/reservations.js';\nimport {toPollDemandResponseDto} from '#presentation/dto/index.js';\n\nconst TERMINATE_INTENT_LIMIT = 1000;\n\nexport const pollDemandRoute = defineRoute({\n  method: 'POST',\n  path: '/demand/poll',\n  description: 'Poll aggregate runner demand and reserve capacity for a provisioner',\n  schema: {\n    body: pollDemandBodySchema,\n    response: {\n      200: pollDemandResponseSchema,\n    },\n  },\n  handler: async (request, reply) => {\n    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);\n    const abortController = new AbortController();\n    let responseFinished = false;\n    let responseReservations: ReservationGrant[] = [];\n    reply.raw.on('finish', () => {\n      responseFinished = true;\n    });\n    reply.raw.on('close', () => {\n      if (!responseFinished) {\n        abortController.abort();\n        void releaseReservationGrants(responseReservations).catch(() => undefined);\n      }\n    });\n\n    const result = await pollDemand({\n      workspaceId,\n      provisionerId: provisionerTokenId,\n      maxReservations: request.body.max_reservations,\n      waitSeconds: request.body.wait_seconds,\n      ttlSeconds: config.RESERVATION_TTL_SECONDS,\n      terminateIntentLimit: TERMINATE_INTENT_LIMIT,\n      templates: request.body.templates.map((template) => ({\n        templateKey: template.template_key,\n        labels: template.labels,\n        availableSlots: template.available_slots,\n        starting: template.starting,\n        running: template.running,\n      })),\n      signal: abortController.signal,\n    });\n    responseReservations = result.reservations;\n\n    return toPollDemandResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","pollDemandBodySchema","pollDemandResponseSchema","defineRoute","config","pollDemand","releaseReservationGrants","toPollDemandResponseDto","TERMINATE_INTENT_LIMIT","pollDemandRoute","method","path","description","schema","body","response","handler","request","reply","provisionerTokenId","workspaceId","abortController","AbortController","responseFinished","responseReservations","raw","on","abort","catch","undefined","result","provisionerId","maxReservations","max_reservations","waitSeconds","wait_seconds","ttlSeconds","RESERVATION_TTL_SECONDS","terminateIntentLimit","templates","map","template","templateKey","template_key","labels","availableSlots","available_slots","starting","running","signal","reservations"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SAAQC,oBAAoB,EAAEC,wBAAwB,QAAO,2BAA2B;AACxF,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,UAAU,EAAEC,wBAAwB,QAAO,kBAAkB;AAErE,SAAQC,uBAAuB,QAAO,6BAA6B;AAEnE,MAAMC,yBAAyB;AAE/B,OAAO,MAAMC,kBAAkBN,YAAY;IACzCO,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMb;QACNc,UAAU;YACR,KAAKb;QACP;IACF;IACAc,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,kBAAkB,EAAEC,WAAW,EAAC,GAAGpB,0BAA0BiB;QACpE,MAAMI,kBAAkB,IAAIC;QAC5B,IAAIC,mBAAmB;QACvB,IAAIC,uBAA2C,EAAE;QACjDN,MAAMO,GAAG,CAACC,EAAE,CAAC,UAAU;YACrBH,mBAAmB;QACrB;QACAL,MAAMO,GAAG,CAACC,EAAE,CAAC,SAAS;YACpB,IAAI,CAACH,kBAAkB;gBACrBF,gBAAgBM,KAAK;gBACrB,KAAKrB,yBAAyBkB,sBAAsBI,KAAK,CAAC,IAAMC;YAClE;QACF;QAEA,MAAMC,SAAS,MAAMzB,WAAW;YAC9Be;YACAW,eAAeZ;YACfa,iBAAiBf,QAAQH,IAAI,CAACmB,gBAAgB;YAC9CC,aAAajB,QAAQH,IAAI,CAACqB,YAAY;YACtCC,YAAYhC,OAAOiC,uBAAuB;YAC1CC,sBAAsB9B;YACtB+B,WAAWtB,QAAQH,IAAI,CAACyB,SAAS,CAACC,GAAG,CAAC,CAACC,WAAc,CAAA;oBACnDC,aAAaD,SAASE,YAAY;oBAClCC,QAAQH,SAASG,MAAM;oBACvBC,gBAAgBJ,SAASK,eAAe;oBACxCC,UAAUN,SAASM,QAAQ;oBAC3BC,SAASP,SAASO,OAAO;gBAC3B,CAAA;YACAC,QAAQ5B,gBAAgB4B,MAAM;QAChC;QACAzB,uBAAuBM,OAAOoB,YAAY;QAE1C,OAAO3C,wBAAwBuB;IACjC;AACF,GAAG"}

package/dist/presentation/routes/rate-limit.d.ts

@@ -0,0 +1,4 @@
+import { type FastifyReply, type FastifyRequest } from '@shipfox/node-fastify';
+export declare function createProvisionerMintRateLimitPreHandler(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+export declare function createEphemeralRegisterRateLimitPreHandler(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAmF1F,wBAAgB,wCAAwC,KACxC,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAY3E;AAED,wBAAgB,0CAA0C,KAC1C,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAc3E"}

package/dist/presentation/routes/rate-limit.js

@@ -0,0 +1,94 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { ClientError } from '@shipfox/node-fastify';
+import { config } from '#config.js';
+import { checkRunnersRateLimit, RunnersRateLimitExceededError, RunnersRateLimitUnavailableError } from '#core/rate-limit.js';
+import { getRunnerContext } from '#presentation/auth/index.js';
+function routeName(request) {
+    return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
+}
+async function enforceRateLimit(params) {
+    try {
+        await checkRunnersRateLimit({
+            action: params.action,
+            scope: params.scope,
+            identifier: params.identifier,
+            limit: params.limit,
+            windowSeconds: params.windowSeconds
+        });
+    } catch (error) {
+        if (error instanceof RunnersRateLimitExceededError) {
+            params.request.log.warn({
+                action: error.action,
+                scope: error.scope,
+                route: routeName(params.request),
+                retryAfterSeconds: error.retryAfterSeconds,
+                identifierHmacPrefix: error.identifierHmacPrefix
+            }, 'Runners rate limit blocked request');
+            params.reply.header('Retry-After', String(error.retryAfterSeconds));
+            throw new ClientError('Rate limit exceeded', 'rate-limited', {
+                status: 429,
+                details: {
+                    retry_after_seconds: error.retryAfterSeconds
+                },
+                data: {
+                    action: error.action,
+                    scope: error.scope,
+                    route: routeName(params.request),
+                    identifierHmacPrefix: error.identifierHmacPrefix
+                },
+                cause: error
+            });
+        }
+        if (error instanceof RunnersRateLimitUnavailableError) {
+            params.request.log.error({
+                action: error.action,
+                scope: error.scope,
+                route: routeName(params.request),
+                identifierHmacPrefix: error.identifierHmacPrefix,
+                err: error
+            }, 'Runners rate limiter unavailable');
+            throw new ClientError('Runners rate limiter unavailable', 'runners-rate-limit-unavailable', {
+                status: 503,
+                data: {
+                    action: error.action,
+                    scope: error.scope,
+                    route: routeName(params.request),
+                    identifierHmacPrefix: error.identifierHmacPrefix
+                },
+                cause: error
+            });
+        }
+        throw error;
+    }
+}
+export function createProvisionerMintRateLimitPreHandler() {
+    return async (request, reply)=>{
+        const { provisionerTokenId } = requireProvisionerContext(request);
+        await enforceRateLimit({
+            request,
+            reply,
+            action: 'provisioner-mint',
+            scope: 'provisioner',
+            identifier: provisionerTokenId,
+            limit: config.PROVISIONER_MINT_RATE_LIMIT_MAX_REQUESTS,
+            windowSeconds: config.PROVISIONER_MINT_RATE_LIMIT_WINDOW_SECONDS
+        });
+    };
+}
+export function createEphemeralRegisterRateLimitPreHandler() {
+    return async (request, reply)=>{
+        const runner = getRunnerContext(request);
+        if (runner.kind !== 'ephemeral') return;
+        await enforceRateLimit({
+            request,
+            reply,
+            action: 'ephemeral-register',
+            scope: 'ephemeral-token',
+            identifier: runner.ephemeralTokenId,
+            limit: config.EPHEMERAL_REGISTER_RATE_LIMIT_MAX_REQUESTS,
+            windowSeconds: config.EPHEMERAL_REGISTER_RATE_LIMIT_WINDOW_SECONDS
+        });
+    };
+}
+
+//# sourceMappingURL=rate-limit.js.map

package/dist/presentation/routes/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {config} from '#config.js';\nimport {\n  checkRunnersRateLimit,\n  RunnersRateLimitExceededError,\n  RunnersRateLimitUnavailableError,\n} from '#core/rate-limit.js';\nimport {getRunnerContext} from '#presentation/auth/index.js';\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: 'provisioner-mint' | 'ephemeral-register';\n  scope: 'provisioner' | 'ephemeral-token';\n  identifier: string;\n  limit: number;\n  windowSeconds: number;\n}): Promise<void> {\n  try {\n    await checkRunnersRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n    });\n  } catch (error) {\n    if (error instanceof RunnersRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Runners rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof RunnersRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Runners rate limiter unavailable',\n      );\n      throw new ClientError('Runners rate limiter unavailable', 'runners-rate-limit-unavailable', {\n        status: 503,\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    throw error;\n  }\n}\n\nexport function createProvisionerMintRateLimitPreHandler() {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    const {provisionerTokenId} = requireProvisionerContext(request);\n    await enforceRateLimit({\n      request,\n      reply,\n      action: 'provisioner-mint',\n      scope: 'provisioner',\n      identifier: provisionerTokenId,\n      limit: config.PROVISIONER_MINT_RATE_LIMIT_MAX_REQUESTS,\n      windowSeconds: config.PROVISIONER_MINT_RATE_LIMIT_WINDOW_SECONDS,\n    });\n  };\n}\n\nexport function createEphemeralRegisterRateLimitPreHandler() {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    const runner = getRunnerContext(request);\n    if (runner.kind !== 'ephemeral') return;\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action: 'ephemeral-register',\n      scope: 'ephemeral-token',\n      identifier: runner.ephemeralTokenId,\n      limit: config.EPHEMERAL_REGISTER_RATE_LIMIT_MAX_REQUESTS,\n      windowSeconds: config.EPHEMERAL_REGISTER_RATE_LIMIT_WINDOW_SECONDS,\n    });\n  };\n}\n"],"names":["requireProvisionerContext","ClientError","config","checkRunnersRateLimit","RunnersRateLimitExceededError","RunnersRateLimitUnavailableError","getRunnerContext","routeName","request","routeOptions","url","split","enforceRateLimit","params","action","scope","identifier","limit","windowSeconds","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createProvisionerMintRateLimitPreHandler","provisionerTokenId","PROVISIONER_MINT_RATE_LIMIT_MAX_REQUESTS","PROVISIONER_MINT_RATE_LIMIT_WINDOW_SECONDS","createEphemeralRegisterRateLimitPreHandler","runner","kind","ephemeralTokenId","EPHEMERAL_REGISTER_RATE_LIMIT_MAX_REQUESTS","EPHEMERAL_REGISTER_RATE_LIMIT_WINDOW_SECONDS"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SAAQC,WAAW,QAA+C,wBAAwB;AAC1F,SAAQC,MAAM,QAAO,aAAa;AAClC,SACEC,qBAAqB,EACrBC,6BAA6B,EAC7BC,gCAAgC,QAC3B,sBAAsB;AAC7B,SAAQC,gBAAgB,QAAO,8BAA8B;AAE7D,SAASC,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAQ/B;IACC,IAAI;QACF,MAAMV,sBAAsB;YAC1BW,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBC,YAAYH,OAAOG,UAAU;YAC7BC,OAAOJ,OAAOI,KAAK;YACnBC,eAAeL,OAAOK,aAAa;QACrC;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBf,+BAA+B;YAClDS,OAAOL,OAAO,CAACY,GAAG,CAACC,IAAI,CACrB;gBACEP,QAAQK,MAAML,MAAM;gBACpBC,OAAOI,MAAMJ,KAAK;gBAClBO,OAAOf,UAAUM,OAAOL,OAAO;gBAC/Be,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFX,OAAOY,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAItB,YAAY,uBAAuB,gBAAgB;gBAC3D2B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJjB,QAAQK,MAAML,MAAM;oBACpBC,OAAOI,MAAMJ,KAAK;oBAClBO,OAAOf,UAAUM,OAAOL,OAAO;oBAC/BgB,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBd,kCAAkC;YACrDQ,OAAOL,OAAO,CAACY,GAAG,CAACD,KAAK,CACtB;gBACEL,QAAQK,MAAML,MAAM;gBACpBC,OAAOI,MAAMJ,KAAK;gBAClBO,OAAOf,UAAUM,OAAOL,OAAO;gBAC/BgB,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIlB,YAAY,oCAAoC,kCAAkC;gBAC1F2B,QAAQ;gBACRG,MAAM;oBACJjB,QAAQK,MAAML,MAAM;oBACpBC,OAAOI,MAAMJ,KAAK;oBAClBO,OAAOf,UAAUM,OAAOL,OAAO;oBAC/BgB,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe;IACd,OAAO,OAAO1B,SAAyBiB;QACrC,MAAM,EAACU,kBAAkB,EAAC,GAAGnC,0BAA0BQ;QACvD,MAAMI,iBAAiB;YACrBJ;YACAiB;YACAX,QAAQ;YACRC,OAAO;YACPC,YAAYmB;YACZlB,OAAOf,OAAOkC,wCAAwC;YACtDlB,eAAehB,OAAOmC,0CAA0C;QAClE;IACF;AACF;AAEA,OAAO,SAASC;IACd,OAAO,OAAO9B,SAAyBiB;QACrC,MAAMc,SAASjC,iBAAiBE;QAChC,IAAI+B,OAAOC,IAAI,KAAK,aAAa;QAEjC,MAAM5B,iBAAiB;YACrBJ;YACAiB;YACAX,QAAQ;YACRC,OAAO;YACPC,YAAYuB,OAAOE,gBAAgB;YACnCxB,OAAOf,OAAOwC,0CAA0C;YACxDxB,eAAehB,OAAOyC,4CAA4C;QACpE;IACF;AACF"}

package/dist/presentation/routes/reconcile-provisioned-runners.d.ts

@@ -0,0 +1,2 @@
+export declare const reconcileProvisionedRunnersRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=reconcile-provisioned-runners.d.ts.map

package/dist/presentation/routes/reconcile-provisioned-runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-provisioned-runners.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/reconcile-provisioned-runners.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,gCAAgC,iDAoB3C,CAAC"}

package/dist/presentation/routes/reconcile-provisioned-runners.js

@@ -0,0 +1,27 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { reconcileProvisionedRunnersBodySchema, reconcileProvisionedRunnersResponseSchema } from '@shipfox/api-runners-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { reconcileProvisionedRunners } from '#core/index.js';
+import { toReconcileProvisionedRunnersResponseDto } from '#presentation/dto/index.js';
+export const reconcileProvisionedRunnersRoute = defineRoute({
+    method: 'POST',
+    path: '/provisioned-runners/reconcile',
+    description: 'Reconcile provisioned runner state for a provisioner',
+    schema: {
+        body: reconcileProvisionedRunnersBodySchema,
+        response: {
+            200: reconcileProvisionedRunnersResponseSchema
+        }
+    },
+    handler: async (request)=>{
+        const { provisionerTokenId, workspaceId } = requireProvisionerContext(request);
+        const result = await reconcileProvisionedRunners({
+            workspaceId,
+            provisionerId: provisionerTokenId,
+            observedProvisionedRunnerIds: request.body.observed_provisioned_runner_ids
+        });
+        return toReconcileProvisionedRunnersResponseDto(result);
+    }
+});
+
+//# sourceMappingURL=reconcile-provisioned-runners.js.map

package/dist/presentation/routes/reconcile-provisioned-runners.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/reconcile-provisioned-runners.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {\n  reconcileProvisionedRunnersBodySchema,\n  reconcileProvisionedRunnersResponseSchema,\n} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {reconcileProvisionedRunners} from '#core/index.js';\nimport {toReconcileProvisionedRunnersResponseDto} from '#presentation/dto/index.js';\n\nexport const reconcileProvisionedRunnersRoute = defineRoute({\n  method: 'POST',\n  path: '/provisioned-runners/reconcile',\n  description: 'Reconcile provisioned runner state for a provisioner',\n  schema: {\n    body: reconcileProvisionedRunnersBodySchema,\n    response: {\n      200: reconcileProvisionedRunnersResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);\n    const result = await reconcileProvisionedRunners({\n      workspaceId,\n      provisionerId: provisionerTokenId,\n      observedProvisionedRunnerIds: request.body.observed_provisioned_runner_ids,\n    });\n\n    return toReconcileProvisionedRunnersResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","reconcileProvisionedRunnersBodySchema","reconcileProvisionedRunnersResponseSchema","defineRoute","reconcileProvisionedRunners","toReconcileProvisionedRunnersResponseDto","reconcileProvisionedRunnersRoute","method","path","description","schema","body","response","handler","request","provisionerTokenId","workspaceId","result","provisionerId","observedProvisionedRunnerIds","observed_provisioned_runner_ids"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SACEC,qCAAqC,EACrCC,yCAAyC,QACpC,2BAA2B;AAClC,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,2BAA2B,QAAO,iBAAiB;AAC3D,SAAQC,wCAAwC,QAAO,6BAA6B;AAEpF,OAAO,MAAMC,mCAAmCH,YAAY;IAC1DI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMV;QACNW,UAAU;YACR,KAAKV;QACP;IACF;IACAW,SAAS,OAAOC;QACd,MAAM,EAACC,kBAAkB,EAAEC,WAAW,EAAC,GAAGhB,0BAA0Bc;QACpE,MAAMG,SAAS,MAAMb,4BAA4B;YAC/CY;YACAE,eAAeH;YACfI,8BAA8BL,QAAQH,IAAI,CAACS,+BAA+B;QAC5E;QAEA,OAAOf,yCAAyCY;IAClD;AACF,GAAG"}

package/dist/presentation/routes/register.d.ts

@@ -0,0 +1,2 @@
+export declare const registerRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=register.d.ts.map

package/dist/presentation/routes/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/register.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,aAAa,iDA+DxB,CAAC"}

package/dist/presentation/routes/register.js

@@ -0,0 +1,63 @@
+import { registerRunnerBodySchema, registerRunnerResponseSchema } from '@shipfox/api-runners-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { EmptyRunnerLabelsError, RegistrationTokenConsumedError, RegistrationTokenExpiredError } from '#core/errors.js';
+import { registerRunnerSession } from '#core/runner-sessions.js';
+import { getRunnerContext } from '#presentation/auth/index.js';
+import { createEphemeralRegisterRateLimitPreHandler } from './rate-limit.js';
+export const registerRoute = defineRoute({
+    method: 'POST',
+    path: '/register',
+    description: 'Exchange a runner registration token for a runner session token',
+    schema: {
+        body: registerRunnerBodySchema,
+        response: {
+            200: registerRunnerResponseSchema
+        }
+    },
+    preHandler: createEphemeralRegisterRateLimitPreHandler(),
+    errorHandler: (error, request)=>{
+        if (error instanceof EmptyRunnerLabelsError) {
+            throw new ClientError(error.message, 'empty-runner-labels', {
+                status: 400
+            });
+        }
+        if (error instanceof RegistrationTokenConsumedError) {
+            const runner = getRunnerContext(request);
+            if (runner.kind === 'ephemeral') {
+                request.log.warn({
+                    ephemeralTokenId: error.ephemeralTokenId,
+                    provisionerId: runner.provisionerId
+                }, 'Ephemeral registration token reuse rejected');
+            }
+            throw new ClientError('Registration token has already been consumed', 'registration-token-consumed', {
+                status: 409
+            });
+        }
+        if (error instanceof RegistrationTokenExpiredError) {
+            throw new ClientError('Registration token has expired', 'registration-token-expired', {
+                status: 401
+            });
+        }
+        throw error;
+    },
+    handler: async (request)=>{
+        const runner = getRunnerContext(request);
+        const result = await registerRunnerSession({
+            credential: runner.kind === 'manual' ? {
+                kind: 'manual',
+                registrationTokenId: runner.registrationTokenId,
+                workspaceId: runner.workspaceId
+            } : runner,
+            labels: request.body.labels,
+            toolCapabilities: request.body.capabilities ?? null
+        });
+        return {
+            session_token: result.sessionToken,
+            session_id: result.session.id,
+            mode: result.mode,
+            max_claims: result.maxClaims
+        };
+    }
+});
+
+//# sourceMappingURL=register.js.map

package/dist/presentation/routes/register.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/register.ts"],"sourcesContent":["import {registerRunnerBodySchema, registerRunnerResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {\n  EmptyRunnerLabelsError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n} from '#core/errors.js';\nimport {registerRunnerSession} from '#core/runner-sessions.js';\nimport {getRunnerContext} from '#presentation/auth/index.js';\nimport {createEphemeralRegisterRateLimitPreHandler} from './rate-limit.js';\n\nexport const registerRoute = defineRoute({\n  method: 'POST',\n  path: '/register',\n  description: 'Exchange a runner registration token for a runner session token',\n  schema: {\n    body: registerRunnerBodySchema,\n    response: {\n      200: registerRunnerResponseSchema,\n    },\n  },\n  preHandler: createEphemeralRegisterRateLimitPreHandler(),\n  errorHandler: (error, request) => {\n    if (error instanceof EmptyRunnerLabelsError) {\n      throw new ClientError(error.message, 'empty-runner-labels', {status: 400});\n    }\n    if (error instanceof RegistrationTokenConsumedError) {\n      const runner = getRunnerContext(request);\n      if (runner.kind === 'ephemeral') {\n        request.log.warn(\n          {\n            ephemeralTokenId: error.ephemeralTokenId,\n            provisionerId: runner.provisionerId,\n          },\n          'Ephemeral registration token reuse rejected',\n        );\n      }\n      throw new ClientError(\n        'Registration token has already been consumed',\n        'registration-token-consumed',\n        {\n          status: 409,\n        },\n      );\n    }\n    if (error instanceof RegistrationTokenExpiredError) {\n      throw new ClientError('Registration token has expired', 'registration-token-expired', {\n        status: 401,\n      });\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const runner = getRunnerContext(request);\n    const result = await registerRunnerSession({\n      credential:\n        runner.kind === 'manual'\n          ? {\n              kind: 'manual',\n              registrationTokenId: runner.registrationTokenId,\n              workspaceId: runner.workspaceId,\n            }\n          : runner,\n      labels: request.body.labels,\n      toolCapabilities: request.body.capabilities ?? null,\n    });\n\n    return {\n      session_token: result.sessionToken,\n      session_id: result.session.id,\n      mode: result.mode,\n      max_claims: result.maxClaims,\n    };\n  },\n});\n"],"names":["registerRunnerBodySchema","registerRunnerResponseSchema","ClientError","defineRoute","EmptyRunnerLabelsError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","registerRunnerSession","getRunnerContext","createEphemeralRegisterRateLimitPreHandler","registerRoute","method","path","description","schema","body","response","preHandler","errorHandler","error","request","message","status","runner","kind","log","warn","ephemeralTokenId","provisionerId","handler","result","credential","registrationTokenId","workspaceId","labels","toolCapabilities","capabilities","session_token","sessionToken","session_id","session","id","mode","max_claims","maxClaims"],"mappings":"AAAA,SAAQA,wBAAwB,EAAEC,4BAA4B,QAAO,2BAA2B;AAChG,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SACEC,sBAAsB,EACtBC,8BAA8B,EAC9BC,6BAA6B,QACxB,kBAAkB;AACzB,SAAQC,qBAAqB,QAAO,2BAA2B;AAC/D,SAAQC,gBAAgB,QAAO,8BAA8B;AAC7D,SAAQC,0CAA0C,QAAO,kBAAkB;AAE3E,OAAO,MAAMC,gBAAgBP,YAAY;IACvCQ,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMf;QACNgB,UAAU;YACR,KAAKf;QACP;IACF;IACAgB,YAAYR;IACZS,cAAc,CAACC,OAAOC;QACpB,IAAID,iBAAiBf,wBAAwB;YAC3C,MAAM,IAAIF,YAAYiB,MAAME,OAAO,EAAE,uBAAuB;gBAACC,QAAQ;YAAG;QAC1E;QACA,IAAIH,iBAAiBd,gCAAgC;YACnD,MAAMkB,SAASf,iBAAiBY;YAChC,IAAIG,OAAOC,IAAI,KAAK,aAAa;gBAC/BJ,QAAQK,GAAG,CAACC,IAAI,CACd;oBACEC,kBAAkBR,MAAMQ,gBAAgB;oBACxCC,eAAeL,OAAOK,aAAa;gBACrC,GACA;YAEJ;YACA,MAAM,IAAI1B,YACR,gDACA,+BACA;gBACEoB,QAAQ;YACV;QAEJ;QACA,IAAIH,iBAAiBb,+BAA+B;YAClD,MAAM,IAAIJ,YAAY,kCAAkC,8BAA8B;gBACpFoB,QAAQ;YACV;QACF;QACA,MAAMH;IACR;IACAU,SAAS,OAAOT;QACd,MAAMG,SAASf,iBAAiBY;QAChC,MAAMU,SAAS,MAAMvB,sBAAsB;YACzCwB,YACER,OAAOC,IAAI,KAAK,WACZ;gBACEA,MAAM;gBACNQ,qBAAqBT,OAAOS,mBAAmB;gBAC/CC,aAAaV,OAAOU,WAAW;YACjC,IACAV;YACNW,QAAQd,QAAQL,IAAI,CAACmB,MAAM;YAC3BC,kBAAkBf,QAAQL,IAAI,CAACqB,YAAY,IAAI;QACjD;QAEA,OAAO;YACLC,eAAeP,OAAOQ,YAAY;YAClCC,YAAYT,OAAOU,OAAO,CAACC,EAAE;YAC7BC,MAAMZ,OAAOY,IAAI;YACjBC,YAAYb,OAAOc,SAAS;QAC9B;IACF;AACF,GAAG"}

package/dist/presentation/routes/report-provisioned-runners.d.ts

@@ -0,0 +1,2 @@
+export declare const reportProvisionedRunnersRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=report-provisioned-runners.d.ts.map

package/dist/presentation/routes/report-provisioned-runners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-provisioned-runners.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/report-provisioned-runners.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,6BAA6B,iDA8BxC,CAAC"}

package/dist/presentation/routes/report-provisioned-runners.js

@@ -0,0 +1,37 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { reportProvisionedRunnersBodySchema, reportProvisionedRunnersResponseSchema } from '@shipfox/api-runners-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { reportProvisionedRunners } from '#core/index.js';
+import { toReportProvisionedRunnersResponseDto } from '#presentation/dto/index.js';
+export const reportProvisionedRunnersRoute = defineRoute({
+    method: 'POST',
+    path: '/provisioned-runners/report',
+    description: 'Report provisioned runner lifecycle state',
+    schema: {
+        body: reportProvisionedRunnersBodySchema,
+        response: {
+            200: reportProvisionedRunnersResponseSchema
+        }
+    },
+    handler: async (request)=>{
+        const { provisionerTokenId, workspaceId } = requireProvisionerContext(request);
+        const result = await reportProvisionedRunners({
+            workspaceId,
+            provisionerId: provisionerTokenId,
+            events: request.body.events.map((event)=>({
+                    provisionedRunnerId: event.provisioned_runner_id,
+                    reservationId: event.reservation_id ?? null,
+                    templateKey: event.template_key ?? null,
+                    labels: event.labels,
+                    state: event.state,
+                    reason: event.reason ?? null,
+                    runnerSessionId: event.runner_session_id ?? null,
+                    providerKind: event.provider_kind ?? null,
+                    reportedAt: new Date(event.reported_at)
+                }))
+        });
+        return toReportProvisionedRunnersResponseDto(result);
+    }
+});
+
+//# sourceMappingURL=report-provisioned-runners.js.map

package/dist/presentation/routes/report-provisioned-runners.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/report-provisioned-runners.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {\n  reportProvisionedRunnersBodySchema,\n  reportProvisionedRunnersResponseSchema,\n} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {reportProvisionedRunners} from '#core/index.js';\nimport {toReportProvisionedRunnersResponseDto} from '#presentation/dto/index.js';\n\nexport const reportProvisionedRunnersRoute = defineRoute({\n  method: 'POST',\n  path: '/provisioned-runners/report',\n  description: 'Report provisioned runner lifecycle state',\n  schema: {\n    body: reportProvisionedRunnersBodySchema,\n    response: {\n      200: reportProvisionedRunnersResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);\n    const result = await reportProvisionedRunners({\n      workspaceId,\n      provisionerId: provisionerTokenId,\n      events: request.body.events.map((event) => ({\n        provisionedRunnerId: event.provisioned_runner_id,\n        reservationId: event.reservation_id ?? null,\n        templateKey: event.template_key ?? null,\n        labels: event.labels,\n        state: event.state,\n        reason: event.reason ?? null,\n        runnerSessionId: event.runner_session_id ?? null,\n        providerKind: event.provider_kind ?? null,\n        reportedAt: new Date(event.reported_at),\n      })),\n    });\n\n    return toReportProvisionedRunnersResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","reportProvisionedRunnersBodySchema","reportProvisionedRunnersResponseSchema","defineRoute","reportProvisionedRunners","toReportProvisionedRunnersResponseDto","reportProvisionedRunnersRoute","method","path","description","schema","body","response","handler","request","provisionerTokenId","workspaceId","result","provisionerId","events","map","event","provisionedRunnerId","provisioned_runner_id","reservationId","reservation_id","templateKey","template_key","labels","state","reason","runnerSessionId","runner_session_id","providerKind","provider_kind","reportedAt","Date","reported_at"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SACEC,kCAAkC,EAClCC,sCAAsC,QACjC,2BAA2B;AAClC,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,wBAAwB,QAAO,iBAAiB;AACxD,SAAQC,qCAAqC,QAAO,6BAA6B;AAEjF,OAAO,MAAMC,gCAAgCH,YAAY;IACvDI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMV;QACNW,UAAU;YACR,KAAKV;QACP;IACF;IACAW,SAAS,OAAOC;QACd,MAAM,EAACC,kBAAkB,EAAEC,WAAW,EAAC,GAAGhB,0BAA0Bc;QACpE,MAAMG,SAAS,MAAMb,yBAAyB;YAC5CY;YACAE,eAAeH;YACfI,QAAQL,QAAQH,IAAI,CAACQ,MAAM,CAACC,GAAG,CAAC,CAACC,QAAW,CAAA;oBAC1CC,qBAAqBD,MAAME,qBAAqB;oBAChDC,eAAeH,MAAMI,cAAc,IAAI;oBACvCC,aAAaL,MAAMM,YAAY,IAAI;oBACnCC,QAAQP,MAAMO,MAAM;oBACpBC,OAAOR,MAAMQ,KAAK;oBAClBC,QAAQT,MAAMS,MAAM,IAAI;oBACxBC,iBAAiBV,MAAMW,iBAAiB,IAAI;oBAC5CC,cAAcZ,MAAMa,aAAa,IAAI;oBACrCC,YAAY,IAAIC,KAAKf,MAAMgB,WAAW;gBACxC,CAAA;QACF;QAEA,OAAOhC,sCAAsCY;IAC/C;AACF,GAAG"}

package/dist/presentation/routes/request-job.d.ts

@@ -0,0 +1,2 @@
+export declare const requestJobRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=request-job.d.ts.map

package/dist/presentation/routes/request-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-job.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/request-job.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,eAAe,iDAwC1B,CAAC"}

package/dist/presentation/routes/request-job.js

@@ -0,0 +1,45 @@
+import { requireRunnerSessionContext } from '@shipfox/api-auth-context';
+import { claimedJobResponseSchema } from '@shipfox/api-runners-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { RunnerSessionExhaustedError } from '#core/errors.js';
+import { claimJobExecution } from '#core/job-executions.js';
+export const requestJobRoute = defineRoute({
+    method: 'POST',
+    path: '/request',
+    description: 'Claim the next available job execution and receive its lease token',
+    schema: {
+        response: {
+            200: claimedJobResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof RunnerSessionExhaustedError) {
+            throw new ClientError('Runner session claim limit exhausted', 'runner-session-exhausted', {
+                status: 409
+            });
+        }
+        throw error;
+    },
+    handler: async (_request, reply)=>{
+        const runner = requireRunnerSessionContext(_request);
+        const jobExecution = await claimJobExecution({
+            workspaceId: runner.workspaceId,
+            runnerSessionId: runner.runnerSessionId,
+            sessionLabels: runner.labels,
+            maxClaims: runner.maxClaims
+        });
+        if (!jobExecution) {
+            reply.status(204);
+            return;
+        }
+        return {
+            workflow_run_id: jobExecution.workflowRunId,
+            workflow_run_attempt_id: jobExecution.workflowRunAttemptId,
+            job_id: jobExecution.jobId,
+            job_execution_id: jobExecution.jobExecutionId,
+            lease_token: jobExecution.leaseToken
+        };
+    }
+});
+
+//# sourceMappingURL=request-job.js.map

package/dist/presentation/routes/request-job.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/request-job.ts"],"sourcesContent":["import {requireRunnerSessionContext} from '@shipfox/api-auth-context';\nimport {claimedJobResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {RunnerSessionExhaustedError} from '#core/errors.js';\nimport {claimJobExecution} from '#core/job-executions.js';\n\nexport const requestJobRoute = defineRoute({\n  method: 'POST',\n  path: '/request',\n  description: 'Claim the next available job execution and receive its lease token',\n  schema: {\n    response: {\n      200: claimedJobResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof RunnerSessionExhaustedError) {\n      throw new ClientError('Runner session claim limit exhausted', 'runner-session-exhausted', {\n        status: 409,\n      });\n    }\n    throw error;\n  },\n  handler: async (_request, reply) => {\n    const runner = requireRunnerSessionContext(_request);\n\n    const jobExecution = await claimJobExecution({\n      workspaceId: runner.workspaceId,\n      runnerSessionId: runner.runnerSessionId,\n      sessionLabels: runner.labels,\n      maxClaims: runner.maxClaims,\n    });\n\n    if (!jobExecution) {\n      reply.status(204);\n      return;\n    }\n\n    return {\n      workflow_run_id: jobExecution.workflowRunId,\n      workflow_run_attempt_id: jobExecution.workflowRunAttemptId,\n      job_id: jobExecution.jobId,\n      job_execution_id: jobExecution.jobExecutionId,\n      lease_token: jobExecution.leaseToken,\n    };\n  },\n});\n"],"names":["requireRunnerSessionContext","claimedJobResponseSchema","ClientError","defineRoute","RunnerSessionExhaustedError","claimJobExecution","requestJobRoute","method","path","description","schema","response","errorHandler","error","status","handler","_request","reply","runner","jobExecution","workspaceId","runnerSessionId","sessionLabels","labels","maxClaims","workflow_run_id","workflowRunId","workflow_run_attempt_id","workflowRunAttemptId","job_id","jobId","job_execution_id","jobExecutionId","lease_token","leaseToken"],"mappings":"AAAA,SAAQA,2BAA2B,QAAO,4BAA4B;AACtE,SAAQC,wBAAwB,QAAO,2BAA2B;AAClE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,2BAA2B,QAAO,kBAAkB;AAC5D,SAAQC,iBAAiB,QAAO,0BAA0B;AAE1D,OAAO,MAAMC,kBAAkBH,YAAY;IACzCI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,UAAU;YACR,KAAKV;QACP;IACF;IACAW,cAAc,CAACC;QACb,IAAIA,iBAAiBT,6BAA6B;YAChD,MAAM,IAAIF,YAAY,wCAAwC,4BAA4B;gBACxFY,QAAQ;YACV;QACF;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,UAAUC;QACxB,MAAMC,SAASlB,4BAA4BgB;QAE3C,MAAMG,eAAe,MAAMd,kBAAkB;YAC3Ce,aAAaF,OAAOE,WAAW;YAC/BC,iBAAiBH,OAAOG,eAAe;YACvCC,eAAeJ,OAAOK,MAAM;YAC5BC,WAAWN,OAAOM,SAAS;QAC7B;QAEA,IAAI,CAACL,cAAc;YACjBF,MAAMH,MAAM,CAAC;YACb;QACF;QAEA,OAAO;YACLW,iBAAiBN,aAAaO,aAAa;YAC3CC,yBAAyBR,aAAaS,oBAAoB;YAC1DC,QAAQV,aAAaW,KAAK;YAC1BC,kBAAkBZ,aAAaa,cAAc;YAC7CC,aAAad,aAAae,UAAU;QACtC;IACF;AACF,GAAG"}

package/dist/presentation/routes/revoke-manual-registration-token.d.ts

@@ -0,0 +1,2 @@
+export declare const revokeManualRegistrationTokenRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=revoke-manual-registration-token.d.ts.map

package/dist/presentation/routes/revoke-manual-registration-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-manual-registration-token.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/revoke-manual-registration-token.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,kCAAkC,iDAwB7C,CAAC"}

package/dist/presentation/routes/revoke-manual-registration-token.js

@@ -0,0 +1,42 @@
+import { revokeManualRegistrationTokenResponseSchema } from '@shipfox/api-runners-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { ManualRegistrationTokenNotFoundError, revokeWorkspaceManualRegistrationToken } from '#core/index.js';
+import { toManualRegistrationTokenDto } from '#presentation/dto/index.js';
+import { requireManualRegistrationTokenWorkspaceMembership } from './workspace-membership.js';
+export const revokeManualRegistrationTokenRoute = defineRoute({
+    method: 'POST',
+    path: '/:tokenId/revoke',
+    description: 'Stop a manual registration token from being used to connect to your account',
+    schema: {
+        params: z.object({
+            workspaceId: z.string().uuid(),
+            tokenId: z.string().uuid()
+        }),
+        response: {
+            200: revokeManualRegistrationTokenResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof ManualRegistrationTokenNotFoundError) {
+            throw new ClientError('Manual registration token not found', 'not-found', {
+                status: 404
+            });
+        }
+        throw error;
+    },
+    handler: async (request)=>{
+        const { workspaceId, tokenId } = request.params;
+        requireManualRegistrationTokenWorkspaceMembership({
+            request,
+            workspaceId
+        });
+        const revoked = await revokeWorkspaceManualRegistrationToken({
+            tokenId,
+            workspaceId
+        });
+        return toManualRegistrationTokenDto(revoked);
+    }
+});
+
+//# sourceMappingURL=revoke-manual-registration-token.js.map

package/dist/presentation/routes/revoke-manual-registration-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/revoke-manual-registration-token.ts"],"sourcesContent":["import {revokeManualRegistrationTokenResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {\n  ManualRegistrationTokenNotFoundError,\n  revokeWorkspaceManualRegistrationToken,\n} from '#core/index.js';\nimport {toManualRegistrationTokenDto} from '#presentation/dto/index.js';\nimport {requireManualRegistrationTokenWorkspaceMembership} from './workspace-membership.js';\n\nexport const revokeManualRegistrationTokenRoute = defineRoute({\n  method: 'POST',\n  path: '/:tokenId/revoke',\n  description: 'Stop a manual registration token from being used to connect to your account',\n  schema: {\n    params: z.object({workspaceId: z.string().uuid(), tokenId: z.string().uuid()}),\n    response: {\n      200: revokeManualRegistrationTokenResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof ManualRegistrationTokenNotFoundError) {\n      throw new ClientError('Manual registration token not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const {workspaceId, tokenId} = request.params;\n    requireManualRegistrationTokenWorkspaceMembership({request, workspaceId});\n\n    const revoked = await revokeWorkspaceManualRegistrationToken({tokenId, workspaceId});\n\n    return toManualRegistrationTokenDto(revoked);\n  },\n});\n"],"names":["revokeManualRegistrationTokenResponseSchema","ClientError","defineRoute","z","ManualRegistrationTokenNotFoundError","revokeWorkspaceManualRegistrationToken","toManualRegistrationTokenDto","requireManualRegistrationTokenWorkspaceMembership","revokeManualRegistrationTokenRoute","method","path","description","schema","params","object","workspaceId","string","uuid","tokenId","response","errorHandler","error","status","handler","request","revoked"],"mappings":"AAAA,SAAQA,2CAA2C,QAAO,2BAA2B;AACrF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SACEC,oCAAoC,EACpCC,sCAAsC,QACjC,iBAAiB;AACxB,SAAQC,4BAA4B,QAAO,6BAA6B;AACxE,SAAQC,iDAAiD,QAAO,4BAA4B;AAE5F,OAAO,MAAMC,qCAAqCN,YAAY;IAC5DO,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,QAAQV,EAAEW,MAAM,CAAC;YAACC,aAAaZ,EAAEa,MAAM,GAAGC,IAAI;YAAIC,SAASf,EAAEa,MAAM,GAAGC,IAAI;QAAE;QAC5EE,UAAU;YACR,KAAKnB;QACP;IACF;IACAoB,cAAc,CAACC;QACb,IAAIA,iBAAiBjB,sCAAsC;YACzD,MAAM,IAAIH,YAAY,uCAAuC,aAAa;gBAACqB,QAAQ;YAAG;QACxF;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC;QACd,MAAM,EAACT,WAAW,EAAEG,OAAO,EAAC,GAAGM,QAAQX,MAAM;QAC7CN,kDAAkD;YAACiB;YAAST;QAAW;QAEvE,MAAMU,UAAU,MAAMpB,uCAAuC;YAACa;YAASH;QAAW;QAElF,OAAOT,6BAA6BmB;IACtC;AACF,GAAG"}

package/dist/presentation/routes/revoke-provisioner-token.d.ts

@@ -0,0 +1,2 @@
+export declare const revokeProvisionerTokenRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=revoke-provisioner-token.d.ts.map

package/dist/presentation/routes/revoke-provisioner-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-provisioner-token.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/revoke-provisioner-token.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,2BAA2B,iDA6BtC,CAAC"}