@shipfox/api-runners 2.0.0

package/src/db/runner-sessions.test.ts

@@ -0,0 +1,153 @@
+import {and, eq, inArray} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {deleteExpiredRunnerSessions} from '#db/runner-sessions.js';
+import {runnerSessions} from '#db/schema/runner-sessions.js';
+import {runningJobExecutions} from '#db/schema/running-job-executions.js';
+
+describe('deleteExpiredRunnerSessions', () => {
+  let workspaceId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+  });
+
+  it('deletes manual sessions older than the manual retention window', async () => {
+    const expired = await insertRunnerSession({kind: 'manual', createdDaysAgo: 31});
+    const active = await insertRunnerSession({kind: 'manual', createdDaysAgo: 29});
+
+    const deleted = await deleteExpiredRunnerSessions({
+      manualRetentionDays: 30,
+      ephemeralRetentionDays: 7,
+      limit: 100,
+    });
+
+    const remaining = await listRunnerSessionIds([expired, active]);
+    expect(deleted).toBeGreaterThanOrEqual(1);
+    expect(remaining).toEqual([active]);
+  });
+
+  it('deletes ephemeral sessions older than the ephemeral retention window', async () => {
+    const expired = await insertRunnerSession({kind: 'ephemeral', createdDaysAgo: 8});
+    const active = await insertRunnerSession({kind: 'ephemeral', createdDaysAgo: 6});
+
+    const deleted = await deleteExpiredRunnerSessions({
+      manualRetentionDays: 30,
+      ephemeralRetentionDays: 7,
+      limit: 100,
+    });
+
+    const remaining = await listRunnerSessionIds([expired, active]);
+    expect(deleted).toBeGreaterThanOrEqual(1);
+    expect(remaining).toEqual([active]);
+  });
+
+  it('applies the retention window for each registration token kind independently', async () => {
+    const manualExpired = await insertRunnerSession({kind: 'manual', createdDaysAgo: 31});
+    const manualActive = await insertRunnerSession({kind: 'manual', createdDaysAgo: 8});
+    const ephemeralExpired = await insertRunnerSession({kind: 'ephemeral', createdDaysAgo: 8});
+    const ephemeralActive = await insertRunnerSession({kind: 'ephemeral', createdDaysAgo: 6});
+
+    await deleteExpiredRunnerSessions({
+      manualRetentionDays: 30,
+      ephemeralRetentionDays: 7,
+      limit: 100,
+    });
+
+    const remaining = await listRunnerSessionIds([
+      manualExpired,
+      manualActive,
+      ephemeralExpired,
+      ephemeralActive,
+    ]);
+    expect(remaining).toEqual([manualActive, ephemeralActive]);
+  });
+
+  it('keeps expired sessions referenced by running jobs', async () => {
+    const expired = await insertRunnerSession({kind: 'manual', createdDaysAgo: 31});
+    await insertRunningJob(expired);
+
+    const deleted = await deleteExpiredRunnerSessions({
+      manualRetentionDays: 30,
+      ephemeralRetentionDays: 7,
+      limit: 100,
+    });
+
+    const remaining = await listRunnerSessionIds([expired]);
+    expect(deleted).toBe(0);
+    expect(remaining).toEqual([expired]);
+  });
+
+  it('honors the deletion limit', async () => {
+    const first = await insertRunnerSession({kind: 'manual', createdDaysAgo: 3652});
+    const second = await insertRunnerSession({kind: 'manual', createdDaysAgo: 3651});
+    const third = await insertRunnerSession({kind: 'manual', createdDaysAgo: 3650});
+
+    const deleted = await deleteExpiredRunnerSessions({
+      manualRetentionDays: 30,
+      ephemeralRetentionDays: 7,
+      limit: 2,
+    });
+
+    const remaining = await listRunnerSessionIds([first, second, third]);
+    expect(deleted).toBe(2);
+    expect(remaining).toHaveLength(1);
+  });
+
+  async function insertRunnerSession(params: {
+    kind: 'manual' | 'ephemeral';
+    createdDaysAgo: number;
+  }): Promise<string> {
+    const id = crypto.randomUUID();
+    const registrationTokenId = crypto.randomUUID();
+    const createdAt = new Date(Date.now() - params.createdDaysAgo * 24 * 60 * 60 * 1000);
+    const provisionerId = params.kind === 'ephemeral' ? crypto.randomUUID() : null;
+    const provisionedRunnerId =
+      params.kind === 'ephemeral' ? `provisioned-${crypto.randomUUID()}` : null;
+
+    await db()
+      .insert(runnerSessions)
+      .values({
+        id,
+        workspaceId,
+        scope: 'workspace',
+        registrationTokenId,
+        registrationTokenKind: params.kind,
+        provisionerId,
+        provisionedRunnerId,
+        labels: ['linux'],
+        maxClaims: params.kind === 'ephemeral' ? 1 : null,
+        claimsUsed: 0,
+        createdAt,
+        updatedAt: createdAt,
+      });
+
+    return id;
+  }
+
+  async function insertRunningJob(runnerSessionId: string): Promise<void> {
+    await db()
+      .insert(runningJobExecutions)
+      .values({
+        workspaceId,
+        workflowRunId: crypto.randomUUID(),
+        workflowRunAttemptId: crypto.randomUUID(),
+        jobId: crypto.randomUUID(),
+        jobExecutionId: crypto.randomUUID(),
+        projectId: crypto.randomUUID(),
+        runnerSessionId,
+        requiredLabels: ['linux'],
+        runnerLabels: ['linux'],
+      });
+  }
+
+  async function listRunnerSessionIds(ids: string[]): Promise<string[]> {
+    if (ids.length === 0) return [];
+
+    const rows = await db()
+      .select({id: runnerSessions.id})
+      .from(runnerSessions)
+      .where(and(eq(runnerSessions.workspaceId, workspaceId), inArray(runnerSessions.id, ids)));
+
+    return ids.filter((id) => rows.some((row) => row.id === id));
+  }
+});

package/src/db/runner-sessions.ts

@@ -0,0 +1,97 @@
+import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
+import {and, asc, eq, inArray, lt, notExists, or, sql} from 'drizzle-orm';
+import type {RunnerSession} from '#core/entities/runner-session.js';
+import {db} from './db.js';
+import {runnerSessions, toRunnerSession} from './schema/runner-sessions.js';
+import {runningJobExecutions} from './schema/running-job-executions.js';
+
+export interface CreateRunnerSessionParams {
+  workspaceId: string;
+  scope: 'workspace';
+  registrationTokenId: string;
+  labels: string[];
+  toolCapabilities?: RunnerToolCapabilitiesDto | null;
+}
+
+export async function createRunnerSession(
+  params: CreateRunnerSessionParams,
+): Promise<RunnerSession> {
+  const rows = await db()
+    .insert(runnerSessions)
+    .values({
+      workspaceId: params.workspaceId,
+      scope: params.scope,
+      registrationTokenId: params.registrationTokenId,
+      registrationTokenKind: 'manual',
+      labels: params.labels,
+      toolCapabilities: params.toolCapabilities ?? null,
+      toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,
+      maxClaims: null,
+      claimsUsed: 0,
+    })
+    .returning();
+
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toRunnerSession(row);
+}
+
+export async function getRunnerSessionById(runnerSessionId: string): Promise<RunnerSession | null> {
+  const rows = await db()
+    .select()
+    .from(runnerSessions)
+    .where(eq(runnerSessions.id, runnerSessionId))
+    .limit(1);
+
+  const row = rows[0];
+  return row ? toRunnerSession(row) : null;
+}
+
+export interface DeleteExpiredRunnerSessionsParams {
+  manualRetentionDays: number;
+  ephemeralRetentionDays: number;
+  limit?: number;
+}
+
+export async function deleteExpiredRunnerSessions(
+  params: DeleteExpiredRunnerSessionsParams,
+): Promise<number> {
+  const expiredIds = db()
+    .select({id: runnerSessions.id})
+    .from(runnerSessions)
+    .where(
+      and(
+        or(
+          and(
+            eq(runnerSessions.registrationTokenKind, 'manual'),
+            lt(
+              runnerSessions.createdAt,
+              sql`now() - (${params.manualRetentionDays} || ' days')::interval`,
+            ),
+          ),
+          and(
+            eq(runnerSessions.registrationTokenKind, 'ephemeral'),
+            lt(
+              runnerSessions.createdAt,
+              sql`now() - (${params.ephemeralRetentionDays} || ' days')::interval`,
+            ),
+          ),
+        ),
+        notExists(
+          db()
+            .select({id: runningJobExecutions.id})
+            .from(runningJobExecutions)
+            .where(eq(runningJobExecutions.runnerSessionId, runnerSessions.id)),
+        ),
+      ),
+    )
+    .orderBy(asc(runnerSessions.createdAt), asc(runnerSessions.id))
+    .limit(params.limit ?? 1000);
+
+  const deleted = await db()
+    .delete(runnerSessions)
+    .where(inArray(runnerSessions.id, expiredIds))
+    .returning({id: runnerSessions.id});
+
+  return deleted.length;
+}

package/src/db/schema/common.ts

@@ -0,0 +1,3 @@
+import {pgTableCreator} from 'drizzle-orm/pg-core';
+
+export const pgTable = pgTableCreator((name) => `runners_${name}`);

package/src/db/schema/ephemeral-registration-tokens.ts

@@ -0,0 +1,58 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {EphemeralRegistrationToken} from '#core/entities/ephemeral-registration-token.js';
+import {pgTable} from './common.js';
+
+export const ephemeralRegistrationTokens = pgTable(
+  'ephemeral_registration_tokens',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    provisionerId: uuid('provisioner_id').notNull(),
+    reservationId: uuid('reservation_id'),
+    provisionedRunnerId: text('provisioned_runner_id').notNull(),
+    hashedToken: text('hashed_token').notNull(),
+    prefix: text('prefix').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    consumedAt: timestamp('consumed_at', {withTimezone: true}),
+    consumedSessionId: uuid('consumed_session_id'),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('runners_ephemeral_registration_tokens_hashed_token_unique').on(table.hashedToken),
+    index('runners_ephemeral_registration_tokens_reservation_id_idx').on(table.reservationId),
+    index('runners_ephemeral_registration_tokens_active_provisioned_runner_idx').on(
+      table.workspaceId,
+      table.provisionerId,
+      table.provisionedRunnerId,
+      table.consumedAt,
+      table.expiresAt,
+    ),
+    index('runners_ephemeral_registration_tokens_terminal_idx').on(
+      sql`coalesce(${table.consumedAt}, ${table.expiresAt})`,
+      table.id,
+    ),
+  ],
+);
+
+export type EphemeralRegistrationTokenDb = typeof ephemeralRegistrationTokens.$inferSelect;
+export type EphemeralRegistrationTokenInsertDb = typeof ephemeralRegistrationTokens.$inferInsert;
+
+export function toEphemeralRegistrationToken(
+  row: EphemeralRegistrationTokenDb,
+): EphemeralRegistrationToken {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    provisionerId: row.provisionerId,
+    reservationId: row.reservationId,
+    provisionedRunnerId: row.provisionedRunnerId,
+    hashedToken: row.hashedToken,
+    prefix: row.prefix,
+    expiresAt: row.expiresAt,
+    consumedAt: row.consumedAt,
+    consumedSessionId: row.consumedSessionId,
+    createdAt: row.createdAt,
+  };
+}

package/src/db/schema/manual-registration-tokens.ts

@@ -0,0 +1,40 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {ManualRegistrationToken} from '#core/entities/manual-registration-token.js';
+import {pgTable} from './common.js';
+
+export const manualRegistrationTokens = pgTable(
+  'manual_registration_tokens',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    hashedToken: text('hashed_token').notNull(),
+    prefix: text('prefix').notNull(),
+    name: text('name'),
+    expiresAt: timestamp('expires_at', {withTimezone: true}),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('runners_manual_registration_tokens_hashed_token_unique').on(table.hashedToken),
+    index('runners_manual_registration_tokens_workspace_id_idx').on(table.workspaceId),
+  ],
+);
+
+export type ManualRegistrationTokenDb = typeof manualRegistrationTokens.$inferSelect;
+export type ManualRegistrationTokenInsertDb = typeof manualRegistrationTokens.$inferInsert;
+
+export function toManualRegistrationToken(row: ManualRegistrationTokenDb): ManualRegistrationToken {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    hashedToken: row.hashedToken,
+    prefix: row.prefix,
+    name: row.name,
+    expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/schema/outbox.ts

@@ -0,0 +1,4 @@
+import {createOutboxTable} from '@shipfox/node-outbox';
+import {pgTable} from './common.js';
+
+export const runnersOutbox = createOutboxTable(pgTable);

package/src/db/schema/pending-job-executions.ts

@@ -0,0 +1,25 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uuid} from 'drizzle-orm/pg-core';
+import {pgTable} from './common.js';
+
+export const pendingJobExecutions = pgTable(
+  'pending_jobs',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    workflowRunId: uuid('workflow_run_id').notNull(),
+    workflowRunAttemptId: uuid('workflow_run_attempt_id').notNull(),
+    jobId: uuid('job_id').notNull(),
+    jobExecutionId: uuid('job_execution_id').notNull().unique(),
+    projectId: uuid('project_id').notNull(),
+    requiredLabels: text('required_labels').array().notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    index('runners_pending_jobs_workspace_created_idx').on(table.workspaceId, table.createdAt),
+    index('runners_pending_jobs_job_id_idx').on(table.jobId),
+  ],
+);
+
+export type PendingJobExecutionDb = typeof pendingJobExecutions.$inferSelect;
+export type PendingJobExecutionInsertDb = typeof pendingJobExecutions.$inferInsert;

package/src/db/schema/provisioned-runners.ts

@@ -0,0 +1,89 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {index, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {ProvisionedRunner} from '#core/entities/provisioned-runner.js';
+import {pgTable} from './common.js';
+
+export const provisionedRunnerStateEnum = pgEnum('runners_provisioned_runner_state', [
+  'starting',
+  'running',
+  'stopping',
+  'stopped',
+  'failed',
+  'terminated',
+]);
+
+export const provisionedRunners = pgTable(
+  'provisioned_runners',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    provisionerId: uuid('provisioner_id').notNull(),
+    provisionedRunnerId: text('provisioned_runner_id').notNull(),
+    reservationId: uuid('reservation_id'),
+    templateKey: text('template_key'),
+    labels: text('labels').array().notNull(),
+    state: provisionedRunnerStateEnum('state').notNull(),
+    reason: text('reason'),
+    runnerSessionId: uuid('runner_session_id'),
+    providerKind: text('provider_kind'),
+    reportedAt: timestamp('reported_at', {withTimezone: true}).notNull(),
+    startedAt: timestamp('started_at', {withTimezone: true}),
+    stoppingAt: timestamp('stopping_at', {withTimezone: true}),
+    stoppedAt: timestamp('stopped_at', {withTimezone: true}),
+    failedAt: timestamp('failed_at', {withTimezone: true}),
+    terminatedAt: timestamp('terminated_at', {withTimezone: true}),
+    reservationReleasedAt: timestamp('reservation_released_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('runners_provisioned_runners_workspace_provisioner_runner_unique').on(
+      table.workspaceId,
+      table.provisionerId,
+      table.provisionedRunnerId,
+    ),
+    index('runners_provisioned_runners_workspace_state_updated_idx').on(
+      table.workspaceId,
+      table.state,
+      table.updatedAt,
+    ),
+    index('runners_provisioned_runners_stale_reaper_idx').on(
+      table.state,
+      table.updatedAt,
+      table.reportedAt,
+      table.workspaceId,
+    ),
+    index('runners_provisioned_runners_active_template_counts_idx')
+      .on(table.workspaceId, table.provisionerId, table.state, table.templateKey)
+      .where(sql`"state" in ('starting', 'running') and "template_key" is not null`),
+  ],
+);
+
+export type ProvisionedRunnerDb = typeof provisionedRunners.$inferSelect;
+export type ProvisionedRunnerInsertDb = typeof provisionedRunners.$inferInsert;
+
+export function toProvisionedRunner(row: ProvisionedRunnerDb): ProvisionedRunner {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    provisionerId: row.provisionerId,
+    provisionedRunnerId: row.provisionedRunnerId,
+    reservationId: row.reservationId,
+    templateKey: row.templateKey,
+    labels: row.labels,
+    state: row.state,
+    reason: row.reason,
+    runnerSessionId: row.runnerSessionId,
+    providerKind: row.providerKind,
+    reportedAt: row.reportedAt,
+    startedAt: row.startedAt,
+    stoppingAt: row.stoppingAt,
+    stoppedAt: row.stoppedAt,
+    failedAt: row.failedAt,
+    terminatedAt: row.terminatedAt,
+    reservationReleasedAt: row.reservationReleasedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/schema/provisioner-tokens.ts

@@ -0,0 +1,50 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {ProvisionerToken} from '#core/entities/provisioner-token.js';
+import {pgTable} from './common.js';
+
+export const provisionerTokens = pgTable(
+  'provisioner_tokens',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    hashedToken: text('hashed_token').notNull(),
+    prefix: text('prefix').notNull(),
+    name: text('name'),
+    createdByUserId: uuid('created_by_user_id').notNull(),
+    revokedByUserId: uuid('revoked_by_user_id'),
+    expiresAt: timestamp('expires_at', {withTimezone: true}),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    lastSeenAt: timestamp('last_seen_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('runners_provisioner_tokens_hashed_token_unique').on(table.hashedToken),
+    index('runners_provisioner_tokens_workspace_last_seen_idx').on(
+      table.workspaceId,
+      table.lastSeenAt.desc(),
+      table.id.desc(),
+    ),
+  ],
+);
+
+export type ProvisionerTokenDb = typeof provisionerTokens.$inferSelect;
+export type ProvisionerTokenInsertDb = typeof provisionerTokens.$inferInsert;
+
+export function toProvisionerToken(row: ProvisionerTokenDb): ProvisionerToken {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    hashedToken: row.hashedToken,
+    prefix: row.prefix,
+    name: row.name,
+    createdByUserId: row.createdByUserId,
+    revokedByUserId: row.revokedByUserId,
+    expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt,
+    lastSeenAt: row.lastSeenAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/schema/rate-limits.ts

@@ -0,0 +1,27 @@
+import {index, integer, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
+import {pgTable} from './common.js';
+
+export const runnersRateLimits = pgTable(
+  'rate_limits',
+  {
+    action: text('action').notNull(),
+    scope: text('scope').notNull(),
+    identifierHmac: text('identifier_hmac').notNull(),
+    windowStart: timestamp('window_start', {withTimezone: true}).notNull(),
+    count: integer('count').notNull().default(1),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('runners_rate_limits_window_unique').on(
+      table.action,
+      table.scope,
+      table.identifierHmac,
+      table.windowStart,
+    ),
+    index('runners_rate_limits_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export type RunnersRateLimitDb = typeof runnersRateLimits.$inferSelect;

package/src/db/schema/reservations.ts

@@ -0,0 +1,38 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {check, index, integer, text, timestamp, uuid} from 'drizzle-orm/pg-core';
+import type {Reservation} from '#core/entities/reservation.js';
+import {pgTable} from './common.js';
+
+export const reservations = pgTable(
+  'reservations',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    provisionerId: uuid('provisioner_id').notNull(),
+    requiredLabels: text('required_labels').array().notNull(),
+    count: integer('count').notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+  },
+  (table) => [
+    index('runners_reservations_workspace_expires_idx').on(table.workspaceId, table.expiresAt),
+    index('runners_reservations_expires_idx').on(table.expiresAt),
+    check('runners_reservations_count_positive_ck', sql`${table.count} > 0`),
+  ],
+);
+
+export type ReservationDb = typeof reservations.$inferSelect;
+export type ReservationInsertDb = typeof reservations.$inferInsert;
+
+export function toReservation(row: ReservationDb): Reservation {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    provisionerId: row.provisionerId,
+    requiredLabels: row.requiredLabels,
+    count: row.count,
+    createdAt: row.createdAt,
+    expiresAt: row.expiresAt,
+  };
+}

package/src/db/schema/runner-sessions.ts

@@ -0,0 +1,77 @@
+import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {check, index, integer, jsonb, pgEnum, text, timestamp, uuid} from 'drizzle-orm/pg-core';
+import type {RunnerSession} from '#core/entities/runner-session.js';
+import {pgTable} from './common.js';
+
+export const runnerSessionScopeEnum = pgEnum('runners_runner_session_scope', ['workspace']);
+export const runnerSessionRegistrationTokenKindEnum = pgEnum(
+  'runners_runner_session_registration_token_kind',
+  ['manual', 'ephemeral'],
+);
+
+export const runnerSessions = pgTable(
+  'runner_sessions',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    scope: runnerSessionScopeEnum('scope').notNull().default('workspace'),
+    registrationTokenId: uuid('registration_token_id').notNull(),
+    registrationTokenKind:
+      runnerSessionRegistrationTokenKindEnum('registration_token_kind').notNull(),
+    provisionerId: uuid('provisioner_id'),
+    provisionedRunnerId: text('provisioned_runner_id'),
+    labels: text('labels').array().notNull(),
+    toolCapabilities: jsonb('tool_capabilities').$type<RunnerToolCapabilitiesDto | null>(),
+    toolCapabilitiesReportedAt: timestamp('tool_capabilities_reported_at', {withTimezone: true}),
+    maxClaims: integer('max_claims'),
+    claimsUsed: integer('claims_used').notNull().default(0),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    index('runners_runner_sessions_kind_created_id_idx').on(
+      table.registrationTokenKind,
+      table.createdAt,
+      table.id,
+    ),
+    check(
+      'runners_runner_sessions_claims_ck',
+      sql`${table.claimsUsed} >= 0 AND ((${table.registrationTokenKind} = 'manual' AND ${table.maxClaims} IS NULL) OR (${table.registrationTokenKind} = 'ephemeral' AND ${table.maxClaims} IS NOT NULL AND ${table.maxClaims} > 0 AND ${table.claimsUsed} <= ${table.maxClaims}))`,
+    ),
+    check(
+      'runners_runner_sessions_link_ck',
+      sql`((${table.registrationTokenKind} = 'manual' AND ${table.provisionerId} IS NULL AND ${table.provisionedRunnerId} IS NULL) OR (${table.registrationTokenKind} = 'ephemeral' AND ${table.provisionerId} IS NOT NULL AND ${table.provisionedRunnerId} IS NOT NULL))`,
+    ),
+    index('runners_runner_sessions_provisioned_runner_updated_idx')
+      .on(table.workspaceId, table.provisionerId, table.provisionedRunnerId, table.updatedAt)
+      .where(sql`"provisioner_id" IS NOT NULL`),
+  ],
+);
+
+export type RunnerSessionDb = typeof runnerSessions.$inferSelect;
+export type RunnerSessionInsertDb = typeof runnerSessions.$inferInsert;
+
+export function toRunnerSession(row: RunnerSessionDb): RunnerSession {
+  if (row.scope !== 'workspace') {
+    throw new Error(`Unexpected runner session scope: ${row.scope}`);
+  }
+
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    scope: row.scope,
+    registrationTokenId: row.registrationTokenId,
+    registrationTokenKind: row.registrationTokenKind,
+    provisionerId: row.provisionerId,
+    provisionedRunnerId: row.provisionedRunnerId,
+    labels: row.labels,
+    toolCapabilities: row.toolCapabilities,
+    toolCapabilitiesReportedAt: row.toolCapabilitiesReportedAt,
+    maxClaims: row.maxClaims,
+    claimsUsed: row.claimsUsed,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}