@shipfox/api-runners 2.0.0

package/src/db/ephemeral-registration-tokens.test.ts

@@ -0,0 +1,332 @@
+import {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';
+import {and, eq, inArray} from 'drizzle-orm';
+import {
+  ActiveEphemeralRegistrationTokensExistError,
+  type RegistrationTokenBatchExceedsReservationError,
+} from '#core/errors.js';
+import {db} from '#db/db.js';
+import {
+  createEphemeralRegistrationTokensBatch,
+  deleteExpiredEphemeralRegistrationTokens,
+  resolveEphemeralRegistrationTokenByHash,
+} from '#db/ephemeral-registration-tokens.js';
+import {ephemeralRegistrationTokens} from '#db/schema/ephemeral-registration-tokens.js';
+import {reservations} from '#db/schema/reservations.js';
+import {ephemeralRegistrationTokenFactory} from '#test/index.js';
+
+describe('createEphemeralRegistrationTokensBatch', () => {
+  let workspaceId: string;
+  let provisionerId: string;
+  let reservationId: string;
+
+  beforeEach(async () => {
+    workspaceId = crypto.randomUUID();
+    provisionerId = crypto.randomUUID();
+    reservationId = await createReservation({count: 3});
+  });
+
+  it('persists all rows for the reservation in one batch', async () => {
+    const rawTokens = [
+      generateOpaqueToken('ephemeralRegistrationToken'),
+      generateOpaqueToken('ephemeralRegistrationToken'),
+    ];
+    const expiresAt = new Date(Date.now() + 300_000);
+
+    const result = await createEphemeralRegistrationTokensBatch({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      expiresAt,
+      rows: [
+        row('provisioned-runner-a', rawTokens[0] ?? ''),
+        row('provisioned-runner-b', rawTokens[1] ?? ''),
+      ],
+    });
+
+    expect(result).toHaveLength(2);
+    expect(result.map((token) => token.provisionedRunnerId).sort()).toEqual([
+      'provisioned-runner-a',
+      'provisioned-runner-b',
+    ]);
+    expect(result.every((token) => token.reservationId === reservationId)).toBe(true);
+    expect(result.every((token) => token.workspaceId === workspaceId)).toBe(true);
+    expect(result.every((token) => token.provisionerId === provisionerId)).toBe(true);
+    expect(
+      await resolveEphemeralRegistrationTokenByHash(hashOpaqueToken(rawTokens[0] ?? '')),
+    ).toEqual(expect.objectContaining({provisionedRunnerId: 'provisioned-runner-a'}));
+  });
+
+  it('rejects the batch and inserts no rows when any provisioned runner already has an active token', async () => {
+    await ephemeralRegistrationTokenFactory.create({
+      workspaceId,
+      provisionerId,
+      provisionedRunnerId: 'provisioned-runner-a',
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const rawToken = generateOpaqueToken('ephemeralRegistrationToken');
+
+    await expect(
+      createEphemeralRegistrationTokensBatch({
+        workspaceId,
+        provisionerId,
+        reservationId,
+        expiresAt: new Date(Date.now() + 300_000),
+        rows: [row('provisioned-runner-a', rawToken), row('provisioned-runner-b', rawToken)],
+      }),
+    ).rejects.toBeInstanceOf(ActiveEphemeralRegistrationTokensExistError);
+
+    const rows = await db()
+      .select()
+      .from(ephemeralRegistrationTokens)
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.workspaceId, workspaceId),
+          eq(ephemeralRegistrationTokens.provisionerId, provisionerId),
+        ),
+      );
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.provisionedRunnerId).toBe('provisioned-runner-a');
+  });
+
+  it('allows sequential batches that exactly reach the reservation count', async () => {
+    const expiresAt = new Date(Date.now() + 300_000);
+
+    await createEphemeralRegistrationTokensBatch({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      expiresAt,
+      rows: [
+        row('provisioned-runner-a', generateOpaqueToken('ephemeralRegistrationToken')),
+        row('provisioned-runner-b', generateOpaqueToken('ephemeralRegistrationToken')),
+      ],
+    });
+    const result = await createEphemeralRegistrationTokensBatch({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      expiresAt,
+      rows: [row('provisioned-runner-c', generateOpaqueToken('ephemeralRegistrationToken'))],
+    });
+
+    expect(result).toHaveLength(1);
+    expect(await countReservationTokens()).toBe(3);
+  });
+
+  it('rejects sequential batches that cumulatively exceed the reservation count', async () => {
+    const expiresAt = new Date(Date.now() + 300_000);
+    await createEphemeralRegistrationTokensBatch({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      expiresAt,
+      rows: [
+        row('provisioned-runner-a', generateOpaqueToken('ephemeralRegistrationToken')),
+        row('provisioned-runner-b', generateOpaqueToken('ephemeralRegistrationToken')),
+      ],
+    });
+
+    await expect(
+      createEphemeralRegistrationTokensBatch({
+        workspaceId,
+        provisionerId,
+        reservationId,
+        expiresAt,
+        rows: [
+          row('provisioned-runner-c', generateOpaqueToken('ephemeralRegistrationToken')),
+          row('provisioned-runner-d', generateOpaqueToken('ephemeralRegistrationToken')),
+        ],
+      }),
+    ).rejects.toMatchObject({
+      name: 'RegistrationTokenBatchExceedsReservationError',
+      requested: 2,
+      reservationCount: 3,
+      alreadyMinted: 2,
+    } satisfies Partial<RegistrationTokenBatchExceedsReservationError>);
+
+    expect(await countReservationTokens()).toBe(2);
+  });
+
+  it('counts consumed and expired tokens against the reservation total', async () => {
+    const consumed = await ephemeralRegistrationTokenFactory.create({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      provisionedRunnerId: 'provisioned-runner-consumed',
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    await db()
+      .update(ephemeralRegistrationTokens)
+      .set({consumedAt: new Date()})
+      .where(eq(ephemeralRegistrationTokens.id, consumed.id));
+    await ephemeralRegistrationTokenFactory.create({
+      workspaceId,
+      provisionerId,
+      reservationId,
+      provisionedRunnerId: 'provisioned-runner-expired',
+      expiresAt: new Date(Date.now() - 60_000),
+    });
+
+    await expect(
+      createEphemeralRegistrationTokensBatch({
+        workspaceId,
+        provisionerId,
+        reservationId,
+        expiresAt: new Date(Date.now() + 300_000),
+        rows: [
+          row('provisioned-runner-a', generateOpaqueToken('ephemeralRegistrationToken')),
+          row('provisioned-runner-b', generateOpaqueToken('ephemeralRegistrationToken')),
+        ],
+      }),
+    ).rejects.toMatchObject({
+      name: 'RegistrationTokenBatchExceedsReservationError',
+      requested: 2,
+      reservationCount: 3,
+      alreadyMinted: 2,
+    } satisfies Partial<RegistrationTokenBatchExceedsReservationError>);
+  });
+
+  async function createReservation(params: {count: number}): Promise<string> {
+    const [reservation] = await db()
+      .insert(reservations)
+      .values({
+        workspaceId,
+        provisionerId,
+        requiredLabels: ['linux'],
+        count: params.count,
+        expiresAt: new Date(Date.now() + 60_000),
+      })
+      .returning({id: reservations.id});
+    if (!reservation) throw new Error('Insert returned no rows');
+    return reservation.id;
+  }
+
+  async function countReservationTokens(): Promise<number> {
+    const rows = await db()
+      .select()
+      .from(ephemeralRegistrationTokens)
+      .where(eq(ephemeralRegistrationTokens.reservationId, reservationId));
+    return rows.length;
+  }
+
+  function row(provisionedRunnerId: string, rawToken: string) {
+    return {
+      provisionedRunnerId,
+      hashedToken: hashOpaqueToken(rawToken),
+      prefix: extractDisplayPrefix(rawToken),
+    };
+  }
+});
+
+describe('deleteExpiredEphemeralRegistrationTokens', () => {
+  const DAY_MS = 24 * 60 * 60 * 1000;
+  let workspaceId: string;
+  let provisionerId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+    provisionerId = crypto.randomUUID();
+  });
+
+  it('deletes consumed tokens whose consumption is older than the retention window', async () => {
+    const stale = await insertToken({consumedAt: daysAgo(8), expiresAt: daysAgo(8)});
+    const fresh = await insertToken({consumedAt: daysAgo(6), expiresAt: daysAgo(6)});
+
+    const deleted = await deleteExpiredEphemeralRegistrationTokens({retentionDays: 7, limit: 100});
+
+    const remaining = await listTokenIds([stale, fresh]);
+    expect(deleted).toBe(1);
+    expect(remaining).toEqual([fresh]);
+  });
+
+  it('deletes expired unconsumed tokens older than the retention window', async () => {
+    const stale = await insertToken({consumedAt: null, expiresAt: daysAgo(8)});
+    const fresh = await insertToken({consumedAt: null, expiresAt: daysAgo(6)});
+
+    const deleted = await deleteExpiredEphemeralRegistrationTokens({retentionDays: 7, limit: 100});
+
+    const remaining = await listTokenIds([stale, fresh]);
+    expect(deleted).toBe(1);
+    expect(remaining).toEqual([fresh]);
+  });
+
+  it('keeps active tokens that are neither consumed nor expired', async () => {
+    const active = await insertToken({consumedAt: null, expiresAt: daysFromNow(1)});
+
+    const deleted = await deleteExpiredEphemeralRegistrationTokens({retentionDays: 7, limit: 100});
+
+    const remaining = await listTokenIds([active]);
+    expect(deleted).toBe(0);
+    expect(remaining).toEqual([active]);
+  });
+
+  it('keeps recently consumed tokens even when their expiry has already passed', async () => {
+    const recentlyConsumed = await insertToken({consumedAt: daysAgo(1), expiresAt: daysAgo(6)});
+
+    const deleted = await deleteExpiredEphemeralRegistrationTokens({retentionDays: 7, limit: 100});
+
+    const remaining = await listTokenIds([recentlyConsumed]);
+    expect(deleted).toBe(0);
+    expect(remaining).toEqual([recentlyConsumed]);
+  });
+
+  it('honors the deletion limit', async () => {
+    const first = await insertToken({consumedAt: daysAgo(30), expiresAt: daysAgo(30)});
+    const second = await insertToken({consumedAt: daysAgo(20), expiresAt: daysAgo(20)});
+    const third = await insertToken({consumedAt: daysAgo(10), expiresAt: daysAgo(10)});
+
+    const deleted = await deleteExpiredEphemeralRegistrationTokens({retentionDays: 7, limit: 2});
+
+    const remaining = await listTokenIds([first, second, third]);
+    expect(deleted).toBe(2);
+    expect(remaining).toEqual([third]);
+  });
+
+  function daysAgo(days: number): Date {
+    return new Date(Date.now() - days * DAY_MS);
+  }
+
+  function daysFromNow(days: number): Date {
+    return new Date(Date.now() + days * DAY_MS);
+  }
+
+  async function insertToken(params: {
+    consumedAt: Date | null;
+    expiresAt: Date;
+    createdAt?: Date;
+  }): Promise<string> {
+    const id = crypto.randomUUID();
+
+    await db()
+      .insert(ephemeralRegistrationTokens)
+      .values({
+        id,
+        workspaceId,
+        provisionerId,
+        provisionedRunnerId: `provisioned-${id}`,
+        hashedToken: crypto.randomUUID(),
+        prefix: 'sfxr_test',
+        expiresAt: params.expiresAt,
+        consumedAt: params.consumedAt,
+        createdAt: params.createdAt ?? params.expiresAt,
+      });
+
+    return id;
+  }
+
+  async function listTokenIds(ids: string[]): Promise<string[]> {
+    if (ids.length === 0) return [];
+
+    const rows = await db()
+      .select({id: ephemeralRegistrationTokens.id})
+      .from(ephemeralRegistrationTokens)
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.workspaceId, workspaceId),
+          inArray(ephemeralRegistrationTokens.id, ids),
+        ),
+      );
+
+    return ids.filter((id) => rows.some((row) => row.id === id));
+  }
+});

package/src/db/ephemeral-registration-tokens.ts

@@ -0,0 +1,348 @@
+import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
+import {and, asc, eq, gt, inArray, isNull, lt, sql} from 'drizzle-orm';
+import type {EphemeralRegistrationToken} from '#core/entities/ephemeral-registration-token.js';
+import {
+  ActiveEphemeralRegistrationTokenExistsError,
+  ActiveEphemeralRegistrationTokensExistError,
+  RegistrationTokenBatchExceedsReservationError,
+  RegistrationTokenConsumedError,
+  RegistrationTokenExpiredError,
+  RegistrationTokenWorkspaceMismatchError,
+  ReservationExpiredError,
+  ReservationNotFoundError,
+} from '#core/errors.js';
+import {db} from './db.js';
+import {
+  ephemeralRegistrationTokens,
+  toEphemeralRegistrationToken,
+} from './schema/ephemeral-registration-tokens.js';
+import {provisionedRunners} from './schema/provisioned-runners.js';
+import {reservations} from './schema/reservations.js';
+import {runnerSessions, toRunnerSession} from './schema/runner-sessions.js';
+
+export interface CreateEphemeralRegistrationTokenParams {
+  workspaceId: string;
+  provisionerId: string;
+  reservationId?: string | null | undefined;
+  provisionedRunnerId: string;
+  hashedToken: string;
+  prefix: string;
+  expiresAt: Date;
+}
+
+export interface CreateEphemeralRegistrationTokensBatchRow {
+  provisionedRunnerId: string;
+  hashedToken: string;
+  prefix: string;
+}
+
+export interface CreateEphemeralRegistrationTokensBatchParams {
+  workspaceId: string;
+  provisionerId: string;
+  reservationId: string;
+  expiresAt: Date;
+  rows: CreateEphemeralRegistrationTokensBatchRow[];
+}
+
+export async function createEphemeralRegistrationToken(
+  params: CreateEphemeralRegistrationTokenParams,
+): Promise<EphemeralRegistrationToken> {
+  const rows = await db().transaction(async (tx) => {
+    const provisionedRunnerLockKey = [
+      'runners_ephemeral_registration_tokens',
+      params.workspaceId,
+      params.provisionerId,
+      params.provisionedRunnerId,
+    ].join(':');
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);
+
+    const [active] = await tx
+      .select({id: ephemeralRegistrationTokens.id})
+      .from(ephemeralRegistrationTokens)
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),
+          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),
+          eq(ephemeralRegistrationTokens.provisionedRunnerId, params.provisionedRunnerId),
+          isNull(ephemeralRegistrationTokens.consumedAt),
+          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),
+        ),
+      )
+      .limit(1);
+
+    if (active) {
+      throw new ActiveEphemeralRegistrationTokenExistsError(
+        params.workspaceId,
+        params.provisionerId,
+        params.provisionedRunnerId,
+      );
+    }
+
+    return await tx
+      .insert(ephemeralRegistrationTokens)
+      .values({
+        workspaceId: params.workspaceId,
+        provisionerId: params.provisionerId,
+        reservationId: params.reservationId ?? null,
+        provisionedRunnerId: params.provisionedRunnerId,
+        hashedToken: params.hashedToken,
+        prefix: params.prefix,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+  });
+
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toEphemeralRegistrationToken(row);
+}
+
+export async function createEphemeralRegistrationTokensBatch(
+  params: CreateEphemeralRegistrationTokensBatchParams,
+): Promise<EphemeralRegistrationToken[]> {
+  const rows = await db().transaction(async (tx) => {
+    const provisionerLockKey = [
+      'runners_ephemeral_registration_tokens',
+      params.workspaceId,
+      params.provisionerId,
+    ].join(':');
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionerLockKey}))`);
+    for (const provisionedRunnerId of [
+      ...new Set(params.rows.map((row) => row.provisionedRunnerId)),
+    ].sort()) {
+      const provisionedRunnerLockKey = [
+        'runners_ephemeral_registration_tokens',
+        params.workspaceId,
+        params.provisionerId,
+        provisionedRunnerId,
+      ].join(':');
+      await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);
+    }
+
+    const [reservation] = await tx
+      .select({
+        count: reservations.count,
+        isExpired: sql<boolean>`${reservations.expiresAt} <= now()`,
+      })
+      .from(reservations)
+      .where(
+        and(
+          eq(reservations.id, params.reservationId),
+          eq(reservations.workspaceId, params.workspaceId),
+          eq(reservations.provisionerId, params.provisionerId),
+        ),
+      )
+      .limit(1);
+
+    if (!reservation) throw new ReservationNotFoundError(params.reservationId);
+    if (reservation.isExpired) throw new ReservationExpiredError(params.reservationId);
+    if (params.rows.length > reservation.count) {
+      throw new RegistrationTokenBatchExceedsReservationError(
+        params.rows.length,
+        reservation.count,
+      );
+    }
+
+    const [existingForReservation] = await tx
+      .select({count: sql<number>`count(*)::int`})
+      .from(ephemeralRegistrationTokens)
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),
+          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),
+          eq(ephemeralRegistrationTokens.reservationId, params.reservationId),
+        ),
+      );
+    const alreadyMinted = existingForReservation?.count ?? 0;
+    if (alreadyMinted + params.rows.length > reservation.count) {
+      throw new RegistrationTokenBatchExceedsReservationError(
+        params.rows.length,
+        reservation.count,
+        alreadyMinted,
+      );
+    }
+
+    const provisionedRunnerIds = params.rows.map((row) => row.provisionedRunnerId);
+    const activeRows = await tx
+      .select({provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId})
+      .from(ephemeralRegistrationTokens)
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),
+          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),
+          inArray(ephemeralRegistrationTokens.provisionedRunnerId, provisionedRunnerIds),
+          isNull(ephemeralRegistrationTokens.consumedAt),
+          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),
+        ),
+      );
+
+    if (activeRows.length > 0) {
+      throw new ActiveEphemeralRegistrationTokensExistError(
+        activeRows.map((row) => row.provisionedRunnerId),
+      );
+    }
+
+    return await tx
+      .insert(ephemeralRegistrationTokens)
+      .values(
+        params.rows.map((row) => ({
+          workspaceId: params.workspaceId,
+          provisionerId: params.provisionerId,
+          reservationId: params.reservationId,
+          provisionedRunnerId: row.provisionedRunnerId,
+          hashedToken: row.hashedToken,
+          prefix: row.prefix,
+          expiresAt: params.expiresAt,
+        })),
+      )
+      .returning();
+  });
+
+  return rows.map(toEphemeralRegistrationToken);
+}
+
+export async function resolveEphemeralRegistrationTokenByHash(
+  hashedToken: string,
+): Promise<EphemeralRegistrationToken | undefined> {
+  const rows = await db()
+    .select()
+    .from(ephemeralRegistrationTokens)
+    .where(eq(ephemeralRegistrationTokens.hashedToken, hashedToken))
+    .limit(1);
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toEphemeralRegistrationToken(row);
+}
+
+export interface DeleteExpiredEphemeralRegistrationTokensParams {
+  retentionDays: number;
+  limit?: number;
+}
+
+/**
+ * Deletes ephemeral registration tokens that have reached a terminal state and
+ * outlived the retention window. A token is terminal once it is consumed
+ * (single use spent) or expired without consumption; the retention window is
+ * measured from that terminal event so the audit record survives a bounded
+ * debugging window. Active tokens that are neither consumed nor expired are
+ * never deleted, so a live single-use credential is never removed early.
+ */
+export async function deleteExpiredEphemeralRegistrationTokens(
+  params: DeleteExpiredEphemeralRegistrationTokensParams,
+): Promise<number> {
+  // coalesce(consumed_at, expires_at) is the terminal timestamp: consumed_at
+  // when the token was spent, otherwise its expiry. Comparing it to the cutoff
+  // both selects deletable rows and orders the batch, and it matches the
+  // terminal index so idle GC ticks never scan live rows.
+  const terminalAt = sql`coalesce(${ephemeralRegistrationTokens.consumedAt}, ${ephemeralRegistrationTokens.expiresAt})`;
+  const retentionCutoff = sql`now() - (${params.retentionDays} || ' days')::interval`;
+
+  const deletableIds = db()
+    .select({id: ephemeralRegistrationTokens.id})
+    .from(ephemeralRegistrationTokens)
+    .where(lt(terminalAt, retentionCutoff))
+    .orderBy(asc(terminalAt), asc(ephemeralRegistrationTokens.id))
+    .limit(params.limit ?? 1000);
+
+  const deleted = await db()
+    .delete(ephemeralRegistrationTokens)
+    .where(inArray(ephemeralRegistrationTokens.id, deletableIds))
+    .returning({id: ephemeralRegistrationTokens.id});
+
+  return deleted.length;
+}
+
+export async function createRunnerSessionConsumingEphemeralToken(params: {
+  ephemeralTokenId: string;
+  workspaceId: string;
+  labels: string[];
+  toolCapabilities?: RunnerToolCapabilitiesDto | null;
+  maxClaims: number;
+}) {
+  return await db().transaction(async (tx) => {
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);
+
+    const consumed = await tx
+      .update(ephemeralRegistrationTokens)
+      .set({consumedAt: sql`now()`})
+      .where(
+        and(
+          eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId),
+          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),
+          isNull(ephemeralRegistrationTokens.consumedAt),
+          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),
+        ),
+      )
+      .returning({
+        id: ephemeralRegistrationTokens.id,
+        provisionerId: ephemeralRegistrationTokens.provisionerId,
+        provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId,
+      });
+
+    if (!consumed[0]) {
+      const [token] = await tx
+        .select({
+          workspaceId: ephemeralRegistrationTokens.workspaceId,
+          consumedAt: ephemeralRegistrationTokens.consumedAt,
+          isExpired: sql<boolean>`${ephemeralRegistrationTokens.expiresAt} <= now()`,
+        })
+        .from(ephemeralRegistrationTokens)
+        .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId))
+        .limit(1);
+
+      if (!token) {
+        throw new Error(`Ephemeral registration token not found: ${params.ephemeralTokenId}`);
+      }
+      if (token.workspaceId !== params.workspaceId) {
+        throw new RegistrationTokenWorkspaceMismatchError(
+          params.ephemeralTokenId,
+          params.workspaceId,
+        );
+      }
+      if (token.consumedAt) throw new RegistrationTokenConsumedError(params.ephemeralTokenId);
+      if (token.isExpired) throw new RegistrationTokenExpiredError(params.ephemeralTokenId);
+      throw new Error(
+        `Ephemeral registration token could not be consumed: ${params.ephemeralTokenId}`,
+      );
+    }
+
+    const [session] = await tx
+      .insert(runnerSessions)
+      .values({
+        workspaceId: params.workspaceId,
+        scope: 'workspace',
+        registrationTokenId: params.ephemeralTokenId,
+        registrationTokenKind: 'ephemeral',
+        provisionerId: consumed[0].provisionerId,
+        provisionedRunnerId: consumed[0].provisionedRunnerId,
+        labels: params.labels,
+        toolCapabilities: params.toolCapabilities ?? null,
+        toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,
+        maxClaims: params.maxClaims,
+        claimsUsed: 0,
+      })
+      .returning();
+
+    if (!session) throw new Error('Insert returned no rows');
+
+    await tx
+      .update(ephemeralRegistrationTokens)
+      .set({consumedSessionId: session.id})
+      .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId));
+
+    await tx
+      .update(provisionedRunners)
+      .set({runnerSessionId: session.id, updatedAt: sql`now()`})
+      .where(
+        and(
+          eq(provisionedRunners.workspaceId, params.workspaceId),
+          eq(provisionedRunners.provisionerId, consumed[0].provisionerId),
+          eq(provisionedRunners.provisionedRunnerId, consumed[0].provisionedRunnerId),
+          isNull(provisionedRunners.reservationReleasedAt),
+        ),
+      );
+
+    return toRunnerSession(session);
+  });
+}