@shipfox/api-runners 2.0.0

package/dist/core/provisioned-runners.js

@@ -0,0 +1,162 @@
+import { isTerminalState, listActiveProvisionedRunners, listActiveRunningJobExecutions, reconcileProvisionedRunners as reconcileProvisionedRunnersDb, reportProvisionedRunners as reportProvisionedRunnersDb } from '#db/index.js';
+import { provisionedRunnerAbsentTerminatedCount, provisionedRunnerReconcileCallCount, provisionedRunnerReportCount, provisionedRunnerTerminateIntentHonoredCount, provisionedRunnerTerminateIntentIssuedCount, reservationReleasedCount } from '#metrics/instance.js';
+import { config } from '../config.js';
+export async function reportProvisionedRunners(params) {
+    const result = await reportProvisionedRunnersDb(params);
+    for (const event of params.events){
+        provisionedRunnerReportCount.add(1, {
+            state: event.state
+        });
+    }
+    for (const intent of result.terminateIntentsHonored){
+        provisionedRunnerTerminateIntentHonoredCount.add(1, {
+            reason: intent.reason
+        });
+    }
+    if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);
+    return result;
+}
+export async function reconcileProvisionedRunners(params) {
+    const result = await reconcileProvisionedRunnersDb({
+        ...params,
+        terminateGraceSeconds: config.RUNNER_RECONCILE_TERMINATE_GRACE_SECONDS
+    });
+    if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);
+    provisionedRunnerReconcileCallCount.add(1);
+    if (result.absentIds.length > 0) provisionedRunnerAbsentTerminatedCount.add(result.absentIds.length);
+    const runners = reconcileProvisionedRunnersFromDbResult({
+        observedProvisionedRunnerIds: params.observedProvisionedRunnerIds,
+        observedRows: result.observedRows,
+        boundJobExecutionsByProvisionedRunnerId: result.boundJobExecutionsByProvisionedRunnerId
+    });
+    for (const runner of runners){
+        if (runner.desiredIntentReason) {
+            provisionedRunnerTerminateIntentIssuedCount.add(1, {
+                surface: 'reconcile',
+                reason: runner.desiredIntentReason
+            });
+        }
+    }
+    return {
+        runners,
+        terminatedAbsentProvisionedRunnerIds: result.absentIds
+    };
+}
+export function reconcileProvisionedRunnersFromDbResult(params) {
+    const rowsByProvisionedRunnerId = new Map(params.observedRows.map((row)=>[
+            row.provisionedRunnerId,
+            row
+        ]));
+    return params.observedProvisionedRunnerIds.map((provisionedRunnerId)=>{
+        const row = rowsByProvisionedRunnerId.get(provisionedRunnerId);
+        const boundJobExecution = params.boundJobExecutionsByProvisionedRunnerId.get(provisionedRunnerId);
+        const desiredIntentReason = getDesiredIntentReason(row, boundJobExecution);
+        return {
+            provisionedRunnerId,
+            state: row?.state ?? null,
+            reservationId: row?.reservationId ?? null,
+            runnerSessionId: row?.runnerSessionId ?? null,
+            boundJobExecution: boundJobExecution ? toReconciledBoundJobExecution(boundJobExecution) : null,
+            desiredIntent: desiredIntentReason ? 'terminate' : 'keep',
+            desiredIntentReason
+        };
+    });
+}
+export async function listActiveRunners(params) {
+    const [provisionedRunnerRows, jobExecutionRows] = await Promise.all([
+        listActiveProvisionedRunners({
+            workspaceId: params.workspaceId,
+            windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS
+        }),
+        listActiveRunningJobExecutions({
+            workspaceId: params.workspaceId,
+            windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS
+        })
+    ]);
+    return mergeActiveRunners(provisionedRunnerRows, jobExecutionRows);
+}
+function toReconciledBoundJobExecution(jobExecution) {
+    return {
+        jobId: jobExecution.jobId,
+        jobExecutionId: jobExecution.jobExecutionId,
+        workflowRunAttemptId: jobExecution.workflowRunAttemptId,
+        lastHeartbeatAt: jobExecution.lastHeartbeatAt,
+        cancellationRequestedAt: jobExecution.cancellationRequestedAt
+    };
+}
+export function desiredIntent(row, boundJobExecution) {
+    return getDesiredIntentReason(row, boundJobExecution) ? 'terminate' : 'keep';
+}
+function getDesiredIntentReason(row, boundJobExecution) {
+    if (!row) return null;
+    if (isTerminalState(row.state)) return 'terminal-state';
+    if (boundJobExecution?.cancellationRequestedAt) return 'job-cancelled';
+    return null;
+}
+function mergeActiveRunners(provisionedRunners, jobExecutions) {
+    const jobExecutionsByRunnerSessionId = new Map();
+    const jobExecutionsByProvisionedRunnerId = new Map();
+    for (const jobExecution of jobExecutions){
+        const runnerJobExecutions = jobExecutionsByRunnerSessionId.get(jobExecution.runnerSessionId) ?? [];
+        runnerJobExecutions.push(jobExecution);
+        jobExecutionsByRunnerSessionId.set(jobExecution.runnerSessionId, runnerJobExecutions);
+        if (jobExecution.provisionerId && jobExecution.provisionedRunnerId) {
+            const key = provisionedRunnerKey(jobExecution.provisionerId, jobExecution.provisionedRunnerId);
+            const provisionedRunnerJobExecutions = jobExecutionsByProvisionedRunnerId.get(key) ?? [];
+            provisionedRunnerJobExecutions.push(jobExecution);
+            jobExecutionsByProvisionedRunnerId.set(key, provisionedRunnerJobExecutions);
+        }
+    }
+    const merged = [];
+    const usedJobExecutionIds = new Set();
+    for (const provisionedRunner of provisionedRunners){
+        const provisionedRunnerJobExecutions = jobExecutionsByProvisionedRunnerId.get(provisionedRunnerKey(provisionedRunner.provisionerId, provisionedRunner.provisionedRunnerId)) ?? (provisionedRunner.runnerSessionId ? jobExecutionsByRunnerSessionId.get(provisionedRunner.runnerSessionId) : undefined);
+        if (!provisionedRunnerJobExecutions || provisionedRunnerJobExecutions.length === 0) {
+            merged.push(toActiveRunner(provisionedRunner, undefined));
+            continue;
+        }
+        let emitted = false;
+        for (const jobExecution of provisionedRunnerJobExecutions){
+            if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;
+            usedJobExecutionIds.add(jobExecution.jobExecutionId);
+            merged.push(toActiveRunner(provisionedRunner, jobExecution));
+            emitted = true;
+        }
+        if (!emitted) merged.push(toActiveRunner(provisionedRunner, undefined));
+    }
+    for (const jobExecution of jobExecutions){
+        if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;
+        merged.push(toActiveRunner(undefined, jobExecution));
+    }
+    return merged.sort(compareActiveRunners);
+}
+function provisionedRunnerKey(provisionerId, provisionedRunnerId) {
+    return `${provisionerId}:${provisionedRunnerId}`;
+}
+function toActiveRunner(provisionedRunner, jobExecution) {
+    return {
+        runnerSessionId: provisionedRunner?.runnerSessionId ?? jobExecution?.runnerSessionId ?? null,
+        provisionedRunnerId: provisionedRunner?.provisionedRunnerId ?? jobExecution?.provisionedRunnerId ?? null,
+        provisionerId: provisionedRunner?.provisionerId ?? jobExecution?.provisionerId ?? null,
+        state: jobExecution ? 'busy' : toActiveRunnerState(provisionedRunner?.state ?? 'running'),
+        labels: provisionedRunner?.labels ?? jobExecution?.runnerLabels ?? [],
+        templateKey: provisionedRunner?.templateKey ?? null,
+        providerKind: provisionedRunner?.providerKind ?? null,
+        jobId: jobExecution?.jobId ?? null,
+        workflowRunAttemptId: jobExecution?.workflowRunAttemptId ?? null,
+        projectId: jobExecution?.projectId ?? null,
+        reportedAt: provisionedRunner?.reportedAt ?? null,
+        lastHeartbeatAt: jobExecution?.lastHeartbeatAt ?? null
+    };
+}
+function toActiveRunnerState(state) {
+    if (state === 'starting' || state === 'stopping') return state;
+    return 'running';
+}
+function compareActiveRunners(a, b) {
+    const aTime = Math.max(a.lastHeartbeatAt?.getTime() ?? 0, a.reportedAt?.getTime() ?? 0);
+    const bTime = Math.max(b.lastHeartbeatAt?.getTime() ?? 0, b.reportedAt?.getTime() ?? 0);
+    return bTime - aTime;
+}
+
+//# sourceMappingURL=provisioned-runners.js.map

package/dist/core/provisioned-runners.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/provisioned-runners.ts"],"sourcesContent":["import type {ProvisionedRunner, ProvisionedRunnerState} from '#core/entities/provisioned-runner.js';\nimport {\n  isTerminalState,\n  listActiveProvisionedRunners,\n  listActiveRunningJobExecutions,\n  type ProvisionedRunnerReportEvent,\n  reconcileProvisionedRunners as reconcileProvisionedRunnersDb,\n  reportProvisionedRunners as reportProvisionedRunnersDb,\n} from '#db/index.js';\nimport type {\n  ActiveRunningJobExecution,\n  ProvisionedRunnerBoundJobExecution,\n} from '#db/job-executions.js';\nimport {\n  provisionedRunnerAbsentTerminatedCount,\n  provisionedRunnerReconcileCallCount,\n  provisionedRunnerReportCount,\n  provisionedRunnerTerminateIntentHonoredCount,\n  provisionedRunnerTerminateIntentIssuedCount,\n  reservationReleasedCount,\n} from '#metrics/instance.js';\nimport {config} from '../config.js';\n\nexport interface ReportProvisionedRunnersParams {\n  workspaceId: string;\n  provisionerId: string;\n  events: ProvisionedRunnerReportEvent[];\n}\n\nexport interface ReportProvisionedRunnersResult {\n  accepted: number;\n  reservationsReleased: number;\n}\n\nexport interface ReconcileProvisionedRunnersParams {\n  workspaceId: string;\n  provisionerId: string;\n  observedProvisionedRunnerIds: string[];\n}\n\nexport type ReconcileDesiredIntent = 'keep' | 'terminate';\ntype ReconcileDesiredIntentReason = 'job-cancelled' | 'terminal-state';\n\nexport interface ReconciledBoundJobExecution {\n  jobId: string;\n  jobExecutionId: string;\n  workflowRunAttemptId: string;\n  lastHeartbeatAt: Date;\n  cancellationRequestedAt: Date | null;\n}\n\nexport interface ReconciledProvisionedRunner {\n  provisionedRunnerId: string;\n  state: ProvisionedRunnerState | null;\n  reservationId: string | null;\n  runnerSessionId: string | null;\n  boundJobExecution: ReconciledBoundJobExecution | null;\n  desiredIntent: ReconcileDesiredIntent;\n  desiredIntentReason: ReconcileDesiredIntentReason | null;\n}\n\nexport interface ReconcileProvisionedRunnersResult {\n  runners: ReconciledProvisionedRunner[];\n  terminatedAbsentProvisionedRunnerIds: string[];\n}\n\nexport type ActiveRunnerState = 'starting' | 'running' | 'stopping' | 'busy';\n\nexport interface ActiveRunner {\n  runnerSessionId: string | null;\n  provisionedRunnerId: string | null;\n  provisionerId: string | null;\n  state: ActiveRunnerState;\n  labels: string[];\n  templateKey: string | null;\n  providerKind: string | null;\n  jobId: string | null;\n  workflowRunAttemptId: string | null;\n  projectId: string | null;\n  reportedAt: Date | null;\n  lastHeartbeatAt: Date | null;\n}\n\nexport async function reportProvisionedRunners(\n  params: ReportProvisionedRunnersParams,\n): Promise<ReportProvisionedRunnersResult> {\n  const result = await reportProvisionedRunnersDb(params);\n\n  for (const event of params.events) {\n    provisionedRunnerReportCount.add(1, {state: event.state});\n  }\n  for (const intent of result.terminateIntentsHonored) {\n    provisionedRunnerTerminateIntentHonoredCount.add(1, {reason: intent.reason});\n  }\n  if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);\n\n  return result;\n}\n\nexport async function reconcileProvisionedRunners(\n  params: ReconcileProvisionedRunnersParams,\n): Promise<ReconcileProvisionedRunnersResult> {\n  const result = await reconcileProvisionedRunnersDb({\n    ...params,\n    terminateGraceSeconds: config.RUNNER_RECONCILE_TERMINATE_GRACE_SECONDS,\n  });\n\n  if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);\n  provisionedRunnerReconcileCallCount.add(1);\n  if (result.absentIds.length > 0)\n    provisionedRunnerAbsentTerminatedCount.add(result.absentIds.length);\n\n  const runners = reconcileProvisionedRunnersFromDbResult({\n    observedProvisionedRunnerIds: params.observedProvisionedRunnerIds,\n    observedRows: result.observedRows,\n    boundJobExecutionsByProvisionedRunnerId: result.boundJobExecutionsByProvisionedRunnerId,\n  });\n  for (const runner of runners) {\n    if (runner.desiredIntentReason) {\n      provisionedRunnerTerminateIntentIssuedCount.add(1, {\n        surface: 'reconcile',\n        reason: runner.desiredIntentReason,\n      });\n    }\n  }\n\n  return {\n    runners,\n    terminatedAbsentProvisionedRunnerIds: result.absentIds,\n  };\n}\n\nexport function reconcileProvisionedRunnersFromDbResult(params: {\n  observedProvisionedRunnerIds: string[];\n  observedRows: ProvisionedRunner[];\n  boundJobExecutionsByProvisionedRunnerId: Map<string, ProvisionedRunnerBoundJobExecution>;\n}): ReconciledProvisionedRunner[] {\n  const rowsByProvisionedRunnerId = new Map(\n    params.observedRows.map((row) => [row.provisionedRunnerId, row]),\n  );\n\n  return params.observedProvisionedRunnerIds.map((provisionedRunnerId) => {\n    const row = rowsByProvisionedRunnerId.get(provisionedRunnerId);\n    const boundJobExecution =\n      params.boundJobExecutionsByProvisionedRunnerId.get(provisionedRunnerId);\n\n    const desiredIntentReason = getDesiredIntentReason(row, boundJobExecution);\n\n    return {\n      provisionedRunnerId,\n      state: row?.state ?? null,\n      reservationId: row?.reservationId ?? null,\n      runnerSessionId: row?.runnerSessionId ?? null,\n      boundJobExecution: boundJobExecution\n        ? toReconciledBoundJobExecution(boundJobExecution)\n        : null,\n      desiredIntent: desiredIntentReason ? 'terminate' : 'keep',\n      desiredIntentReason,\n    };\n  });\n}\n\nexport async function listActiveRunners(params: {workspaceId: string}): Promise<ActiveRunner[]> {\n  const [provisionedRunnerRows, jobExecutionRows] = await Promise.all([\n    listActiveProvisionedRunners({\n      workspaceId: params.workspaceId,\n      windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS,\n    }),\n    listActiveRunningJobExecutions({\n      workspaceId: params.workspaceId,\n      windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS,\n    }),\n  ]);\n\n  return mergeActiveRunners(provisionedRunnerRows, jobExecutionRows);\n}\n\nfunction toReconciledBoundJobExecution(\n  jobExecution: ProvisionedRunnerBoundJobExecution,\n): ReconciledBoundJobExecution {\n  return {\n    jobId: jobExecution.jobId,\n    jobExecutionId: jobExecution.jobExecutionId,\n    workflowRunAttemptId: jobExecution.workflowRunAttemptId,\n    lastHeartbeatAt: jobExecution.lastHeartbeatAt,\n    cancellationRequestedAt: jobExecution.cancellationRequestedAt,\n  };\n}\n\nexport function desiredIntent(\n  row: ProvisionedRunner | undefined,\n  boundJobExecution: ProvisionedRunnerBoundJobExecution | undefined,\n): ReconcileDesiredIntent {\n  return getDesiredIntentReason(row, boundJobExecution) ? 'terminate' : 'keep';\n}\n\nfunction getDesiredIntentReason(\n  row: ProvisionedRunner | undefined,\n  boundJobExecution: ProvisionedRunnerBoundJobExecution | undefined,\n): ReconcileDesiredIntentReason | null {\n  if (!row) return null;\n  if (isTerminalState(row.state)) return 'terminal-state';\n  if (boundJobExecution?.cancellationRequestedAt) return 'job-cancelled';\n  return null;\n}\n\nfunction mergeActiveRunners(\n  provisionedRunners: ProvisionedRunner[],\n  jobExecutions: ActiveRunningJobExecution[],\n): ActiveRunner[] {\n  const jobExecutionsByRunnerSessionId = new Map<string, ActiveRunningJobExecution[]>();\n  const jobExecutionsByProvisionedRunnerId = new Map<string, ActiveRunningJobExecution[]>();\n  for (const jobExecution of jobExecutions) {\n    const runnerJobExecutions =\n      jobExecutionsByRunnerSessionId.get(jobExecution.runnerSessionId) ?? [];\n    runnerJobExecutions.push(jobExecution);\n    jobExecutionsByRunnerSessionId.set(jobExecution.runnerSessionId, runnerJobExecutions);\n\n    if (jobExecution.provisionerId && jobExecution.provisionedRunnerId) {\n      const key = provisionedRunnerKey(\n        jobExecution.provisionerId,\n        jobExecution.provisionedRunnerId,\n      );\n      const provisionedRunnerJobExecutions = jobExecutionsByProvisionedRunnerId.get(key) ?? [];\n      provisionedRunnerJobExecutions.push(jobExecution);\n      jobExecutionsByProvisionedRunnerId.set(key, provisionedRunnerJobExecutions);\n    }\n  }\n\n  const merged: ActiveRunner[] = [];\n  const usedJobExecutionIds = new Set<string>();\n\n  for (const provisionedRunner of provisionedRunners) {\n    const provisionedRunnerJobExecutions =\n      jobExecutionsByProvisionedRunnerId.get(\n        provisionedRunnerKey(\n          provisionedRunner.provisionerId,\n          provisionedRunner.provisionedRunnerId,\n        ),\n      ) ??\n      (provisionedRunner.runnerSessionId\n        ? jobExecutionsByRunnerSessionId.get(provisionedRunner.runnerSessionId)\n        : undefined);\n    if (!provisionedRunnerJobExecutions || provisionedRunnerJobExecutions.length === 0) {\n      merged.push(toActiveRunner(provisionedRunner, undefined));\n      continue;\n    }\n\n    let emitted = false;\n    for (const jobExecution of provisionedRunnerJobExecutions) {\n      if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;\n      usedJobExecutionIds.add(jobExecution.jobExecutionId);\n      merged.push(toActiveRunner(provisionedRunner, jobExecution));\n      emitted = true;\n    }\n    if (!emitted) merged.push(toActiveRunner(provisionedRunner, undefined));\n  }\n\n  for (const jobExecution of jobExecutions) {\n    if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;\n    merged.push(toActiveRunner(undefined, jobExecution));\n  }\n\n  return merged.sort(compareActiveRunners);\n}\n\nfunction provisionedRunnerKey(provisionerId: string, provisionedRunnerId: string): string {\n  return `${provisionerId}:${provisionedRunnerId}`;\n}\n\nfunction toActiveRunner(\n  provisionedRunner: ProvisionedRunner | undefined,\n  jobExecution: ActiveRunningJobExecution | undefined,\n): ActiveRunner {\n  return {\n    runnerSessionId: provisionedRunner?.runnerSessionId ?? jobExecution?.runnerSessionId ?? null,\n    provisionedRunnerId:\n      provisionedRunner?.provisionedRunnerId ?? jobExecution?.provisionedRunnerId ?? null,\n    provisionerId: provisionedRunner?.provisionerId ?? jobExecution?.provisionerId ?? null,\n    state: jobExecution ? 'busy' : toActiveRunnerState(provisionedRunner?.state ?? 'running'),\n    labels: provisionedRunner?.labels ?? jobExecution?.runnerLabels ?? [],\n    templateKey: provisionedRunner?.templateKey ?? null,\n    providerKind: provisionedRunner?.providerKind ?? null,\n    jobId: jobExecution?.jobId ?? null,\n    workflowRunAttemptId: jobExecution?.workflowRunAttemptId ?? null,\n    projectId: jobExecution?.projectId ?? null,\n    reportedAt: provisionedRunner?.reportedAt ?? null,\n    lastHeartbeatAt: jobExecution?.lastHeartbeatAt ?? null,\n  };\n}\n\nfunction toActiveRunnerState(state: ProvisionedRunnerState): ActiveRunnerState {\n  if (state === 'starting' || state === 'stopping') return state;\n  return 'running';\n}\n\nfunction compareActiveRunners(a: ActiveRunner, b: ActiveRunner): number {\n  const aTime = Math.max(a.lastHeartbeatAt?.getTime() ?? 0, a.reportedAt?.getTime() ?? 0);\n  const bTime = Math.max(b.lastHeartbeatAt?.getTime() ?? 0, b.reportedAt?.getTime() ?? 0);\n  return bTime - aTime;\n}\n"],"names":["isTerminalState","listActiveProvisionedRunners","listActiveRunningJobExecutions","reconcileProvisionedRunners","reconcileProvisionedRunnersDb","reportProvisionedRunners","reportProvisionedRunnersDb","provisionedRunnerAbsentTerminatedCount","provisionedRunnerReconcileCallCount","provisionedRunnerReportCount","provisionedRunnerTerminateIntentHonoredCount","provisionedRunnerTerminateIntentIssuedCount","reservationReleasedCount","config","params","result","event","events","add","state","intent","terminateIntentsHonored","reason","reservationsReleased","terminateGraceSeconds","RUNNER_RECONCILE_TERMINATE_GRACE_SECONDS","absentIds","length","runners","reconcileProvisionedRunnersFromDbResult","observedProvisionedRunnerIds","observedRows","boundJobExecutionsByProvisionedRunnerId","runner","desiredIntentReason","surface","terminatedAbsentProvisionedRunnerIds","rowsByProvisionedRunnerId","Map","map","row","provisionedRunnerId","get","boundJobExecution","getDesiredIntentReason","reservationId","runnerSessionId","toReconciledBoundJobExecution","desiredIntent","listActiveRunners","provisionedRunnerRows","jobExecutionRows","Promise","all","workspaceId","windowSeconds","RUNNER_ACTIVE_WINDOW_SECONDS","mergeActiveRunners","jobExecution","jobId","jobExecutionId","workflowRunAttemptId","lastHeartbeatAt","cancellationRequestedAt","provisionedRunners","jobExecutions","jobExecutionsByRunnerSessionId","jobExecutionsByProvisionedRunnerId","runnerJobExecutions","push","set","provisionerId","key","provisionedRunnerKey","provisionedRunnerJobExecutions","merged","usedJobExecutionIds","Set","provisionedRunner","undefined","toActiveRunner","emitted","has","sort","compareActiveRunners","toActiveRunnerState","labels","runnerLabels","templateKey","providerKind","projectId","reportedAt","a","b","aTime","Math","max","getTime","bTime"],"mappings":"AACA,SACEA,eAAe,EACfC,4BAA4B,EAC5BC,8BAA8B,EAE9BC,+BAA+BC,6BAA6B,EAC5DC,4BAA4BC,0BAA0B,QACjD,eAAe;AAKtB,SACEC,sCAAsC,EACtCC,mCAAmC,EACnCC,4BAA4B,EAC5BC,4CAA4C,EAC5CC,2CAA2C,EAC3CC,wBAAwB,QACnB,uBAAuB;AAC9B,SAAQC,MAAM,QAAO,eAAe;AA8DpC,OAAO,eAAeR,yBACpBS,MAAsC;IAEtC,MAAMC,SAAS,MAAMT,2BAA2BQ;IAEhD,KAAK,MAAME,SAASF,OAAOG,MAAM,CAAE;QACjCR,6BAA6BS,GAAG,CAAC,GAAG;YAACC,OAAOH,MAAMG,KAAK;QAAA;IACzD;IACA,KAAK,MAAMC,UAAUL,OAAOM,uBAAuB,CAAE;QACnDX,6CAA6CQ,GAAG,CAAC,GAAG;YAACI,QAAQF,OAAOE,MAAM;QAAA;IAC5E;IACA,IAAIP,OAAOQ,oBAAoB,GAAG,GAAGX,yBAAyBM,GAAG,CAACH,OAAOQ,oBAAoB;IAE7F,OAAOR;AACT;AAEA,OAAO,eAAeZ,4BACpBW,MAAyC;IAEzC,MAAMC,SAAS,MAAMX,8BAA8B;QACjD,GAAGU,MAAM;QACTU,uBAAuBX,OAAOY,wCAAwC;IACxE;IAEA,IAAIV,OAAOQ,oBAAoB,GAAG,GAAGX,yBAAyBM,GAAG,CAACH,OAAOQ,oBAAoB;IAC7Ff,oCAAoCU,GAAG,CAAC;IACxC,IAAIH,OAAOW,SAAS,CAACC,MAAM,GAAG,GAC5BpB,uCAAuCW,GAAG,CAACH,OAAOW,SAAS,CAACC,MAAM;IAEpE,MAAMC,UAAUC,wCAAwC;QACtDC,8BAA8BhB,OAAOgB,4BAA4B;QACjEC,cAAchB,OAAOgB,YAAY;QACjCC,yCAAyCjB,OAAOiB,uCAAuC;IACzF;IACA,KAAK,MAAMC,UAAUL,QAAS;QAC5B,IAAIK,OAAOC,mBAAmB,EAAE;YAC9BvB,4CAA4CO,GAAG,CAAC,GAAG;gBACjDiB,SAAS;gBACTb,QAAQW,OAAOC,mBAAmB;YACpC;QACF;IACF;IAEA,OAAO;QACLN;QACAQ,sCAAsCrB,OAAOW,SAAS;IACxD;AACF;AAEA,OAAO,SAASG,wCAAwCf,MAIvD;IACC,MAAMuB,4BAA4B,IAAIC,IACpCxB,OAAOiB,YAAY,CAACQ,GAAG,CAAC,CAACC,MAAQ;YAACA,IAAIC,mBAAmB;YAAED;SAAI;IAGjE,OAAO1B,OAAOgB,4BAA4B,CAACS,GAAG,CAAC,CAACE;QAC9C,MAAMD,MAAMH,0BAA0BK,GAAG,CAACD;QAC1C,MAAME,oBACJ7B,OAAOkB,uCAAuC,CAACU,GAAG,CAACD;QAErD,MAAMP,sBAAsBU,uBAAuBJ,KAAKG;QAExD,OAAO;YACLF;YACAtB,OAAOqB,KAAKrB,SAAS;YACrB0B,eAAeL,KAAKK,iBAAiB;YACrCC,iBAAiBN,KAAKM,mBAAmB;YACzCH,mBAAmBA,oBACfI,8BAA8BJ,qBAC9B;YACJK,eAAed,sBAAsB,cAAc;YACnDA;QACF;IACF;AACF;AAEA,OAAO,eAAee,kBAAkBnC,MAA6B;IACnE,MAAM,CAACoC,uBAAuBC,iBAAiB,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAClEpD,6BAA6B;YAC3BqD,aAAaxC,OAAOwC,WAAW;YAC/BC,eAAe1C,OAAO2C,4BAA4B;QACpD;QACAtD,+BAA+B;YAC7BoD,aAAaxC,OAAOwC,WAAW;YAC/BC,eAAe1C,OAAO2C,4BAA4B;QACpD;KACD;IAED,OAAOC,mBAAmBP,uBAAuBC;AACnD;AAEA,SAASJ,8BACPW,YAAgD;IAEhD,OAAO;QACLC,OAAOD,aAAaC,KAAK;QACzBC,gBAAgBF,aAAaE,cAAc;QAC3CC,sBAAsBH,aAAaG,oBAAoB;QACvDC,iBAAiBJ,aAAaI,eAAe;QAC7CC,yBAAyBL,aAAaK,uBAAuB;IAC/D;AACF;AAEA,OAAO,SAASf,cACdR,GAAkC,EAClCG,iBAAiE;IAEjE,OAAOC,uBAAuBJ,KAAKG,qBAAqB,cAAc;AACxE;AAEA,SAASC,uBACPJ,GAAkC,EAClCG,iBAAiE;IAEjE,IAAI,CAACH,KAAK,OAAO;IACjB,IAAIxC,gBAAgBwC,IAAIrB,KAAK,GAAG,OAAO;IACvC,IAAIwB,mBAAmBoB,yBAAyB,OAAO;IACvD,OAAO;AACT;AAEA,SAASN,mBACPO,kBAAuC,EACvCC,aAA0C;IAE1C,MAAMC,iCAAiC,IAAI5B;IAC3C,MAAM6B,qCAAqC,IAAI7B;IAC/C,KAAK,MAAMoB,gBAAgBO,cAAe;QACxC,MAAMG,sBACJF,+BAA+BxB,GAAG,CAACgB,aAAaZ,eAAe,KAAK,EAAE;QACxEsB,oBAAoBC,IAAI,CAACX;QACzBQ,+BAA+BI,GAAG,CAACZ,aAAaZ,eAAe,EAAEsB;QAEjE,IAAIV,aAAaa,aAAa,IAAIb,aAAajB,mBAAmB,EAAE;YAClE,MAAM+B,MAAMC,qBACVf,aAAaa,aAAa,EAC1Bb,aAAajB,mBAAmB;YAElC,MAAMiC,iCAAiCP,mCAAmCzB,GAAG,CAAC8B,QAAQ,EAAE;YACxFE,+BAA+BL,IAAI,CAACX;YACpCS,mCAAmCG,GAAG,CAACE,KAAKE;QAC9C;IACF;IAEA,MAAMC,SAAyB,EAAE;IACjC,MAAMC,sBAAsB,IAAIC;IAEhC,KAAK,MAAMC,qBAAqBd,mBAAoB;QAClD,MAAMU,iCACJP,mCAAmCzB,GAAG,CACpC+B,qBACEK,kBAAkBP,aAAa,EAC/BO,kBAAkBrC,mBAAmB,MAGxCqC,CAAAA,kBAAkBhC,eAAe,GAC9BoB,+BAA+BxB,GAAG,CAACoC,kBAAkBhC,eAAe,IACpEiC,SAAQ;QACd,IAAI,CAACL,kCAAkCA,+BAA+B/C,MAAM,KAAK,GAAG;YAClFgD,OAAON,IAAI,CAACW,eAAeF,mBAAmBC;YAC9C;QACF;QAEA,IAAIE,UAAU;QACd,KAAK,MAAMvB,gBAAgBgB,+BAAgC;YACzD,IAAIE,oBAAoBM,GAAG,CAACxB,aAAaE,cAAc,GAAG;YAC1DgB,oBAAoB1D,GAAG,CAACwC,aAAaE,cAAc;YACnDe,OAAON,IAAI,CAACW,eAAeF,mBAAmBpB;YAC9CuB,UAAU;QACZ;QACA,IAAI,CAACA,SAASN,OAAON,IAAI,CAACW,eAAeF,mBAAmBC;IAC9D;IAEA,KAAK,MAAMrB,gBAAgBO,cAAe;QACxC,IAAIW,oBAAoBM,GAAG,CAACxB,aAAaE,cAAc,GAAG;QAC1De,OAAON,IAAI,CAACW,eAAeD,WAAWrB;IACxC;IAEA,OAAOiB,OAAOQ,IAAI,CAACC;AACrB;AAEA,SAASX,qBAAqBF,aAAqB,EAAE9B,mBAA2B;IAC9E,OAAO,GAAG8B,cAAc,CAAC,EAAE9B,qBAAqB;AAClD;AAEA,SAASuC,eACPF,iBAAgD,EAChDpB,YAAmD;IAEnD,OAAO;QACLZ,iBAAiBgC,mBAAmBhC,mBAAmBY,cAAcZ,mBAAmB;QACxFL,qBACEqC,mBAAmBrC,uBAAuBiB,cAAcjB,uBAAuB;QACjF8B,eAAeO,mBAAmBP,iBAAiBb,cAAca,iBAAiB;QAClFpD,OAAOuC,eAAe,SAAS2B,oBAAoBP,mBAAmB3D,SAAS;QAC/EmE,QAAQR,mBAAmBQ,UAAU5B,cAAc6B,gBAAgB,EAAE;QACrEC,aAAaV,mBAAmBU,eAAe;QAC/CC,cAAcX,mBAAmBW,gBAAgB;QACjD9B,OAAOD,cAAcC,SAAS;QAC9BE,sBAAsBH,cAAcG,wBAAwB;QAC5D6B,WAAWhC,cAAcgC,aAAa;QACtCC,YAAYb,mBAAmBa,cAAc;QAC7C7B,iBAAiBJ,cAAcI,mBAAmB;IACpD;AACF;AAEA,SAASuB,oBAAoBlE,KAA6B;IACxD,IAAIA,UAAU,cAAcA,UAAU,YAAY,OAAOA;IACzD,OAAO;AACT;AAEA,SAASiE,qBAAqBQ,CAAe,EAAEC,CAAe;IAC5D,MAAMC,QAAQC,KAAKC,GAAG,CAACJ,EAAE9B,eAAe,EAAEmC,aAAa,GAAGL,EAAED,UAAU,EAAEM,aAAa;IACrF,MAAMC,QAAQH,KAAKC,GAAG,CAACH,EAAE/B,eAAe,EAAEmC,aAAa,GAAGJ,EAAEF,UAAU,EAAEM,aAAa;IACrF,OAAOC,QAAQJ;AACjB"}

package/dist/core/provisioner-tokens.d.ts

@@ -0,0 +1,20 @@
+import type { ActiveProvisionerToken, ProvisionerToken } from './entities/provisioner-token.js';
+export interface CreateWorkspaceProvisionerTokenParams {
+    workspaceId: string;
+    createdByUserId: string;
+    name?: string | undefined;
+    ttlSeconds?: number | undefined;
+}
+export interface CreateWorkspaceProvisionerTokenResult {
+    token: ProvisionerToken;
+    rawToken: string;
+}
+export declare function createWorkspaceProvisionerToken(params: CreateWorkspaceProvisionerTokenParams): Promise<CreateWorkspaceProvisionerTokenResult>;
+export declare function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]>;
+export declare function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]>;
+export declare function revokeWorkspaceProvisionerToken(params: {
+    tokenId: string;
+    workspaceId: string;
+    revokedByUserId: string;
+}): Promise<ProvisionerToken>;
+//# sourceMappingURL=provisioner-tokens.d.ts.map

package/dist/core/provisioner-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAG9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAchD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B"}

package/dist/core/provisioner-tokens.js

@@ -0,0 +1,36 @@
+import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
+import { createProvisionerToken, listActiveProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, revokeProvisionerToken } from '#db/provisioner-tokens.js';
+import { config } from '../config.js';
+import { ProvisionerTokenNotFoundError } from './errors.js';
+export async function createWorkspaceProvisionerToken(params) {
+    const rawToken = generateOpaqueToken('provisionerToken');
+    const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;
+    const token = await createProvisionerToken({
+        workspaceId: params.workspaceId,
+        hashedToken: hashOpaqueToken(rawToken),
+        prefix: extractDisplayPrefix(rawToken),
+        name: params.name,
+        createdByUserId: params.createdByUserId,
+        expiresAt
+    });
+    return {
+        token,
+        rawToken
+    };
+}
+export function listUsableProvisionerTokens(workspaceId) {
+    return listUsableProvisionerTokensByWorkspaceId(workspaceId);
+}
+export function listActiveProvisioners(workspaceId) {
+    return listActiveProvisionerTokens({
+        workspaceId,
+        windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS
+    });
+}
+export async function revokeWorkspaceProvisionerToken(params) {
+    const token = await revokeProvisionerToken(params);
+    if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);
+    return token;
+}
+
+//# sourceMappingURL=provisioner-tokens.js.map

package/dist/core/provisioner-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {ProvisionerTokenNotFoundError} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n"],"names":["extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createProvisionerToken","listActiveProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeProvisionerToken","config","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","workspaceId","hashedToken","prefix","name","createdByUserId","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId"],"mappings":"AAAA,SAAQA,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wCAAwC,EACxCC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,QAAO,eAAe;AAEpC,SAAQC,6BAA6B,QAAO,cAAc;AAc1D,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWV,oBAAoB;IACrC,MAAMW,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMd,uBAAuB;QACzCe,aAAaR,OAAOQ,WAAW;QAC/BC,aAAajB,gBAAgBS;QAC7BS,QAAQpB,qBAAqBW;QAC7BU,MAAMX,OAAOW,IAAI;QACjBC,iBAAiBZ,OAAOY,eAAe;QACvCV;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASY,4BAA4BL,WAAmB;IAC7D,OAAOb,yCAAyCa;AAClD;AAEA,OAAO,SAASM,uBAAuBN,WAAmB;IACxD,OAAOd,4BAA4B;QACjCc;QACAO,eAAelB,OAAOmB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCjB,MAIrD;IACC,MAAMO,QAAQ,MAAMX,uBAAuBI;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOkB,OAAO;IAClE,OAAOX;AACT"}

package/dist/core/rate-limit.d.ts

@@ -0,0 +1,35 @@
+import { RateLimitExceededError, type RateLimitOutcome, type RateLimitPolicy, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
+export type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';
+export type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';
+export type RunnersRateLimitOutcome = RateLimitOutcome;
+export type RunnersRateLimitPolicy = RateLimitPolicy;
+export interface CheckRunnersRateLimitParams extends RunnersRateLimitPolicy {
+    action: RunnersRateLimitAction;
+    scope: RunnersRateLimitScope;
+    identifier: string;
+    now?: Date | undefined;
+    timeoutMs?: number | undefined;
+}
+export declare class RunnersRateLimitExceededError extends RateLimitExceededError<RunnersRateLimitAction, RunnersRateLimitScope> {
+    constructor(params: {
+        action: RunnersRateLimitAction;
+        scope: RunnersRateLimitScope;
+        retryAfterSeconds: number;
+        identifierHmacPrefix: string;
+    });
+}
+export declare class RunnersRateLimitUnavailableError extends RateLimitUnavailableError<RunnersRateLimitAction, RunnersRateLimitScope> {
+    constructor(params: {
+        action: RunnersRateLimitAction;
+        scope: RunnersRateLimitScope;
+        identifierHmacPrefix: string;
+        cause: unknown;
+    });
+}
+export declare function hashRunnersRateLimitIdentifier(params: {
+    action: RunnersRateLimitAction;
+    scope: RunnersRateLimitScope;
+    identifier: string;
+}): string;
+export declare function checkRunnersRateLimit(params: CheckRunnersRateLimitParams): Promise<void>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/core/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAKlC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAC/E,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,6BAA8B,SAAQ,sBAAsB,CACvE,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAIF;AAED,qBAAa,gCAAiC,SAAQ,yBAAyB,CAC7E,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAIF;AAKD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC9F"}

package/dist/core/rate-limit.js

@@ -0,0 +1,74 @@
+import { createHmac } from 'node:crypto';
+import { config as authConfig } from '@shipfox/api-auth/config';
+import { checkRateLimit, hashRateLimitIdentifier, RateLimitExceededError, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
+import { config } from '#config.js';
+import { consumeRunnersRateLimit, pruneExpiredRunnersRateLimits } from '#db/rate-limits.js';
+import { recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure } from '#metrics/index.js';
+export class RunnersRateLimitExceededError extends RateLimitExceededError {
+    constructor(params){
+        super(params);
+        this.name = 'RunnersRateLimitExceededError';
+    }
+}
+export class RunnersRateLimitUnavailableError extends RateLimitUnavailableError {
+    constructor(params){
+        super(params);
+        this.name = 'RunnersRateLimitUnavailableError';
+    }
+}
+const IDENTIFIER_HASH_DOMAIN = 'shipfox.runners.rate-limit.identifier.v1';
+const IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.runners.rate-limit.identifier-secret.v1';
+export function hashRunnersRateLimitIdentifier(params) {
+    return hashRateLimitIdentifier({
+        action: params.action,
+        scope: params.scope,
+        identifier: params.identifier,
+        secret: effectiveIdentifierSecret(),
+        domain: IDENTIFIER_HASH_DOMAIN
+    });
+}
+export async function checkRunnersRateLimit(params) {
+    try {
+        await checkRateLimit({
+            action: params.action,
+            scope: params.scope,
+            identifier: params.identifier,
+            limit: params.limit,
+            windowSeconds: params.windowSeconds,
+            identifierSecret: effectiveIdentifierSecret(),
+            identifierHashDomain: IDENTIFIER_HASH_DOMAIN,
+            consume: consumeRunnersRateLimit,
+            prune: pruneExpiredRunnersRateLimits,
+            onCheck: recordRunnersRateLimitCheck,
+            onPruneFailure: recordRunnersRateLimitPruneFailure,
+            now: params.now,
+            timeoutMs: params.timeoutMs ?? config.RUNNERS_RATE_LIMIT_TIMEOUT_MS
+        });
+    } catch (error) {
+        if (error instanceof RateLimitExceededError) {
+            throw new RunnersRateLimitExceededError({
+                action: error.action,
+                scope: error.scope,
+                retryAfterSeconds: error.retryAfterSeconds,
+                identifierHmacPrefix: error.identifierHmacPrefix
+            });
+        }
+        if (error instanceof RateLimitUnavailableError) {
+            throw new RunnersRateLimitUnavailableError({
+                action: error.action,
+                scope: error.scope,
+                identifierHmacPrefix: error.identifierHmacPrefix,
+                cause: error.cause
+            });
+        }
+        throw error;
+    }
+}
+function effectiveIdentifierSecret() {
+    if (config.RATE_LIMIT_IDENTIFIER_SECRET) {
+        return config.RATE_LIMIT_IDENTIFIER_SECRET;
+    }
+    return createHmac('sha256', authConfig.AUTH_JWT_SECRET).update(IDENTIFIER_SECRET_DERIVATION_DOMAIN).digest();
+}
+
+//# sourceMappingURL=rate-limit.js.map

package/dist/core/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport {config as authConfig} from '@shipfox/api-auth/config';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitOutcome,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {config} from '#config.js';\nimport {consumeRunnersRateLimit, pruneExpiredRunnersRateLimits} from '#db/rate-limits.js';\nimport {recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure} from '#metrics/index.js';\n\nexport type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';\nexport type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';\nexport type RunnersRateLimitOutcome = RateLimitOutcome;\nexport type RunnersRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckRunnersRateLimitParams extends RunnersRateLimitPolicy {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class RunnersRateLimitExceededError extends RateLimitExceededError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitExceededError';\n  }\n}\n\nexport class RunnersRateLimitUnavailableError extends RateLimitUnavailableError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitUnavailableError';\n  }\n}\n\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.runners.rate-limit.identifier.v1';\nconst IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.runners.rate-limit.identifier-secret.v1';\n\nexport function hashRunnersRateLimitIdentifier(params: {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkRunnersRateLimit(params: CheckRunnersRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeRunnersRateLimit,\n      prune: pruneExpiredRunnersRateLimits,\n      onCheck: recordRunnersRateLimitCheck,\n      onPruneFailure: recordRunnersRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? config.RUNNERS_RATE_LIMIT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new RunnersRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new RunnersRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n\nfunction effectiveIdentifierSecret(): Buffer | string {\n  if (config.RATE_LIMIT_IDENTIFIER_SECRET) {\n    return config.RATE_LIMIT_IDENTIFIER_SECRET;\n  }\n\n  return createHmac('sha256', authConfig.AUTH_JWT_SECRET)\n    .update(IDENTIFIER_SECRET_DERIVATION_DOMAIN)\n    .digest();\n}\n"],"names":["createHmac","config","authConfig","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","consumeRunnersRateLimit","pruneExpiredRunnersRateLimits","recordRunnersRateLimitCheck","recordRunnersRateLimitPruneFailure","RunnersRateLimitExceededError","params","name","RunnersRateLimitUnavailableError","IDENTIFIER_HASH_DOMAIN","IDENTIFIER_SECRET_DERIVATION_DOMAIN","hashRunnersRateLimitIdentifier","action","scope","identifier","secret","effectiveIdentifierSecret","domain","checkRunnersRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","RUNNERS_RATE_LIMIT_TIMEOUT_MS","error","retryAfterSeconds","identifierHmacPrefix","cause","RATE_LIMIT_IDENTIFIER_SECRET","AUTH_JWT_SECRET","update","digest"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SAAQC,UAAUC,UAAU,QAAO,2BAA2B;AAC9D,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAGtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQL,MAAM,QAAO,aAAa;AAClC,SAAQM,uBAAuB,EAAEC,6BAA6B,QAAO,qBAAqB;AAC1F,SAAQC,2BAA2B,EAAEC,kCAAkC,QAAO,oBAAoB;AAelG,OAAO,MAAMC,sCAAsCN;IAIjD,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,yCAAyCR;IAIpD,YAAYM,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,MAAME,yBAAyB;AAC/B,MAAMC,sCAAsC;AAE5C,OAAO,SAASC,+BAA+BL,MAI9C;IACC,OAAOR,wBAAwB;QAC7Bc,QAAQN,OAAOM,MAAM;QACrBC,OAAOP,OAAOO,KAAK;QACnBC,YAAYR,OAAOQ,UAAU;QAC7BC,QAAQC;QACRC,QAAQR;IACV;AACF;AAEA,OAAO,eAAeS,sBAAsBZ,MAAmC;IAC7E,IAAI;QACF,MAAMT,eAAe;YACnBe,QAAQN,OAAOM,MAAM;YACrBC,OAAOP,OAAOO,KAAK;YACnBC,YAAYR,OAAOQ,UAAU;YAC7BK,OAAOb,OAAOa,KAAK;YACnBC,eAAed,OAAOc,aAAa;YACnCC,kBAAkBL;YAClBM,sBAAsBb;YACtBc,SAAStB;YACTuB,OAAOtB;YACPuB,SAAStB;YACTuB,gBAAgBtB;YAChBuB,KAAKrB,OAAOqB,GAAG;YACfC,WAAWtB,OAAOsB,SAAS,IAAIjC,OAAOkC,6BAA6B;QACrE;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiB/B,wBAAwB;YAC3C,MAAM,IAAIM,8BAA8B;gBACtCO,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBkB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiB9B,2BAA2B;YAC9C,MAAM,IAAIQ,iCAAiC;gBACzCI,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBmB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF;AAEA,SAASd;IACP,IAAIrB,OAAOuC,4BAA4B,EAAE;QACvC,OAAOvC,OAAOuC,4BAA4B;IAC5C;IAEA,OAAOxC,WAAW,UAAUE,WAAWuC,eAAe,EACnDC,MAAM,CAAC1B,qCACP2B,MAAM;AACX"}

package/dist/core/runner-sessions.d.ts

@@ -0,0 +1,26 @@
+import type { RunnerToolCapabilitiesDto } from '@shipfox/api-runners-dto';
+import type { RunnerSession } from './entities/runner-session.js';
+export interface RegisterRunnerSessionResult {
+    session: RunnerSession;
+    sessionToken: string;
+    mode: 'manual' | 'ephemeral';
+    maxClaims: number | null;
+}
+export type RunnerRegistrationCredential = {
+    kind: 'manual';
+    registrationTokenId: string;
+    workspaceId: string;
+} | {
+    kind: 'ephemeral';
+    ephemeralTokenId: string;
+    workspaceId: string;
+    provisionerId: string;
+    reservationId: string | null;
+    provisionedRunnerId: string;
+};
+export declare function registerRunnerSession(params: {
+    credential: RunnerRegistrationCredential;
+    labels: string[];
+    toolCapabilities?: RunnerToolCapabilitiesDto | null;
+}): Promise<RegisterRunnerSessionResult>;
+//# sourceMappingURL=runner-sessions.d.ts.map

package/dist/core/runner-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-sessions.d.ts","sourceRoot":"","sources":["../../src/core/runner-sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,0BAA0B,CAAC;AAIxE,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,8BAA8B,CAAC;AAGhE,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,4BAA4B,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACrD,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA+BvC"}

package/dist/core/runner-sessions.js

@@ -0,0 +1,41 @@
+import { issueRunnerSessionToken } from '@shipfox/api-auth';
+import { canonicalizeLabels } from '@shipfox/runner-labels';
+import { createRunnerSessionConsumingEphemeralToken } from '#db/ephemeral-registration-tokens.js';
+import { createRunnerSession } from '#db/runner-sessions.js';
+import { EmptyRunnerLabelsError } from './errors.js';
+export async function registerRunnerSession(params) {
+    const labels = [
+        ...canonicalizeLabels(params.labels)
+    ];
+    if (labels.length === 0) throw new EmptyRunnerLabelsError();
+    const mode = params.credential.kind;
+    const maxClaims = params.credential.kind === 'ephemeral' ? 1 : null;
+    const session = params.credential.kind === 'manual' ? await createRunnerSession({
+        workspaceId: params.credential.workspaceId,
+        scope: 'workspace',
+        registrationTokenId: params.credential.registrationTokenId,
+        labels,
+        toolCapabilities: params.toolCapabilities ?? null
+    }) : await createRunnerSessionConsumingEphemeralToken({
+        ephemeralTokenId: params.credential.ephemeralTokenId,
+        workspaceId: params.credential.workspaceId,
+        labels,
+        toolCapabilities: params.toolCapabilities ?? null,
+        maxClaims: 1
+    });
+    const sessionToken = await issueRunnerSessionToken({
+        runnerSessionId: session.id,
+        workspaceId: session.workspaceId,
+        scope: session.scope,
+        labels: session.labels,
+        maxClaims
+    });
+    return {
+        session,
+        sessionToken,
+        mode,
+        maxClaims
+    };
+}
+
+//# sourceMappingURL=runner-sessions.js.map

package/dist/core/runner-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-sessions.ts"],"sourcesContent":["import {issueRunnerSessionToken} from '@shipfox/api-auth';\nimport type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {canonicalizeLabels} from '@shipfox/runner-labels';\nimport {createRunnerSessionConsumingEphemeralToken} from '#db/ephemeral-registration-tokens.js';\nimport {createRunnerSession} from '#db/runner-sessions.js';\nimport type {RunnerSession} from './entities/runner-session.js';\nimport {EmptyRunnerLabelsError} from './errors.js';\n\nexport interface RegisterRunnerSessionResult {\n  session: RunnerSession;\n  sessionToken: string;\n  mode: 'manual' | 'ephemeral';\n  maxClaims: number | null;\n}\n\nexport type RunnerRegistrationCredential =\n  | {\n      kind: 'manual';\n      registrationTokenId: string;\n      workspaceId: string;\n    }\n  | {\n      kind: 'ephemeral';\n      ephemeralTokenId: string;\n      workspaceId: string;\n      provisionerId: string;\n      reservationId: string | null;\n      provisionedRunnerId: string;\n    };\n\nexport async function registerRunnerSession(params: {\n  credential: RunnerRegistrationCredential;\n  labels: string[];\n  toolCapabilities?: RunnerToolCapabilitiesDto | null;\n}): Promise<RegisterRunnerSessionResult> {\n  const labels = [...canonicalizeLabels(params.labels)];\n  if (labels.length === 0) throw new EmptyRunnerLabelsError();\n\n  const mode = params.credential.kind;\n  const maxClaims = params.credential.kind === 'ephemeral' ? 1 : null;\n  const session =\n    params.credential.kind === 'manual'\n      ? await createRunnerSession({\n          workspaceId: params.credential.workspaceId,\n          scope: 'workspace',\n          registrationTokenId: params.credential.registrationTokenId,\n          labels,\n          toolCapabilities: params.toolCapabilities ?? null,\n        })\n      : await createRunnerSessionConsumingEphemeralToken({\n          ephemeralTokenId: params.credential.ephemeralTokenId,\n          workspaceId: params.credential.workspaceId,\n          labels,\n          toolCapabilities: params.toolCapabilities ?? null,\n          maxClaims: 1,\n        });\n  const sessionToken = await issueRunnerSessionToken({\n    runnerSessionId: session.id,\n    workspaceId: session.workspaceId,\n    scope: session.scope,\n    labels: session.labels,\n    maxClaims,\n  });\n\n  return {session, sessionToken, mode, maxClaims};\n}\n"],"names":["issueRunnerSessionToken","canonicalizeLabels","createRunnerSessionConsumingEphemeralToken","createRunnerSession","EmptyRunnerLabelsError","registerRunnerSession","params","labels","length","mode","credential","kind","maxClaims","session","workspaceId","scope","registrationTokenId","toolCapabilities","ephemeralTokenId","sessionToken","runnerSessionId","id"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,oBAAoB;AAE1D,SAAQC,kBAAkB,QAAO,yBAAyB;AAC1D,SAAQC,0CAA0C,QAAO,uCAAuC;AAChG,SAAQC,mBAAmB,QAAO,yBAAyB;AAE3D,SAAQC,sBAAsB,QAAO,cAAc;AAwBnD,OAAO,eAAeC,sBAAsBC,MAI3C;IACC,MAAMC,SAAS;WAAIN,mBAAmBK,OAAOC,MAAM;KAAE;IACrD,IAAIA,OAAOC,MAAM,KAAK,GAAG,MAAM,IAAIJ;IAEnC,MAAMK,OAAOH,OAAOI,UAAU,CAACC,IAAI;IACnC,MAAMC,YAAYN,OAAOI,UAAU,CAACC,IAAI,KAAK,cAAc,IAAI;IAC/D,MAAME,UACJP,OAAOI,UAAU,CAACC,IAAI,KAAK,WACvB,MAAMR,oBAAoB;QACxBW,aAAaR,OAAOI,UAAU,CAACI,WAAW;QAC1CC,OAAO;QACPC,qBAAqBV,OAAOI,UAAU,CAACM,mBAAmB;QAC1DT;QACAU,kBAAkBX,OAAOW,gBAAgB,IAAI;IAC/C,KACA,MAAMf,2CAA2C;QAC/CgB,kBAAkBZ,OAAOI,UAAU,CAACQ,gBAAgB;QACpDJ,aAAaR,OAAOI,UAAU,CAACI,WAAW;QAC1CP;QACAU,kBAAkBX,OAAOW,gBAAgB,IAAI;QAC7CL,WAAW;IACb;IACN,MAAMO,eAAe,MAAMnB,wBAAwB;QACjDoB,iBAAiBP,QAAQQ,EAAE;QAC3BP,aAAaD,QAAQC,WAAW;QAChCC,OAAOF,QAAQE,KAAK;QACpBR,QAAQM,QAAQN,MAAM;QACtBK;IACF;IAEA,OAAO;QAACC;QAASM;QAAcV;QAAMG;IAAS;AAChD"}

package/dist/core/runner-tool-capabilities.d.ts

@@ -0,0 +1,24 @@
+import type { RunnerToolCapabilitiesDto } from '@shipfox/api-runners-dto';
+type RunnerToolHarness = keyof RunnerToolCapabilitiesDto['harnesses'];
+export declare const EMPTY_RUNNER_TOOL_CAPABILITIES: RunnerToolCapabilitiesDto;
+export declare function effectiveRunnerToolCapabilities(params: {
+    toolCapabilities: RunnerToolCapabilitiesDto | null;
+    reportedAt: Date | null;
+    staleAfterSeconds: number;
+    now?: Date;
+}): RunnerToolCapabilitiesDto;
+export declare function unadvertisedRunnerTools(params: {
+    harness: RunnerToolHarness;
+    requestedTools: readonly string[];
+    capabilities: RunnerToolCapabilitiesDto;
+}): string[];
+export interface EffectiveRunnerToolCapabilitiesResult {
+    capabilities: RunnerToolCapabilitiesDto;
+    reportFresh: boolean;
+    harnessKnown(harness: RunnerToolHarness): boolean;
+}
+export declare function getEffectiveRunnerToolCapabilities(params: {
+    runnerSessionId: string;
+}): Promise<EffectiveRunnerToolCapabilitiesResult>;
+export {};
+//# sourceMappingURL=runner-tool-capabilities.d.ts.map

package/dist/core/runner-tool-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-tool-capabilities.d.ts","sourceRoot":"","sources":["../../src/core/runner-tool-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,0BAA0B,CAAC;AAIxE,KAAK,iBAAiB,GAAG,MAAM,yBAAyB,CAAC,WAAW,CAAC,CAAC;AAEtE,eAAO,MAAM,8BAA8B,EAAE,yBAE5C,CAAC;AAEF,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,gBAAgB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,yBAAyB,CAQ5B;AAeD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,yBAAyB,CAAC;CACzC,GAAG,MAAM,EAAE,CAGX;AAED,MAAM,WAAW,qCAAqC;IACpD,YAAY,EAAE,yBAAyB,CAAC;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;CACnD;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAmBjD"}

package/dist/core/runner-tool-capabilities.js

@@ -0,0 +1,43 @@
+import { config } from '#config.js';
+import { getRunnerSessionById } from '#db/runner-sessions.js';
+export const EMPTY_RUNNER_TOOL_CAPABILITIES = {
+    harnesses: {}
+};
+export function effectiveRunnerToolCapabilities(params) {
+    if (!params.toolCapabilities || !params.reportedAt) return EMPTY_RUNNER_TOOL_CAPABILITIES;
+    const now = params.now ?? new Date();
+    const ageMs = now.getTime() - params.reportedAt.getTime();
+    if (ageMs > params.staleAfterSeconds * 1000) return EMPTY_RUNNER_TOOL_CAPABILITIES;
+    return params.toolCapabilities;
+}
+function runnerToolCapabilityReportIsFresh(params) {
+    if (!params.toolCapabilities || !params.reportedAt) return false;
+    const now = params.now ?? new Date();
+    const ageMs = now.getTime() - params.reportedAt.getTime();
+    return ageMs <= params.staleAfterSeconds * 1000;
+}
+export function unadvertisedRunnerTools(params) {
+    const advertised = new Set(params.capabilities.harnesses[params.harness]?.tools ?? []);
+    return params.requestedTools.filter((tool)=>!advertised.has(tool));
+}
+export async function getEffectiveRunnerToolCapabilities(params) {
+    const runnerSession = await getRunnerSessionById(params.runnerSessionId);
+    const staleAfterSeconds = config.RUNNER_TOOL_CAPABILITIES_STALE_AFTER_SECONDS;
+    const capabilities = effectiveRunnerToolCapabilities({
+        toolCapabilities: runnerSession?.toolCapabilities ?? null,
+        reportedAt: runnerSession?.toolCapabilitiesReportedAt ?? null,
+        staleAfterSeconds
+    });
+    const reportFresh = runnerToolCapabilityReportIsFresh({
+        toolCapabilities: runnerSession?.toolCapabilities,
+        reportedAt: runnerSession?.toolCapabilitiesReportedAt,
+        staleAfterSeconds
+    });
+    return {
+        capabilities,
+        reportFresh,
+        harnessKnown: (harness)=>capabilities.harnesses[harness] !== undefined
+    };
+}
+
+//# sourceMappingURL=runner-tool-capabilities.js.map

package/dist/core/runner-tool-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-tool-capabilities.ts"],"sourcesContent":["import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {config} from '#config.js';\nimport {getRunnerSessionById} from '#db/runner-sessions.js';\n\ntype RunnerToolHarness = keyof RunnerToolCapabilitiesDto['harnesses'];\n\nexport const EMPTY_RUNNER_TOOL_CAPABILITIES: RunnerToolCapabilitiesDto = {\n  harnesses: {},\n};\n\nexport function effectiveRunnerToolCapabilities(params: {\n  toolCapabilities: RunnerToolCapabilitiesDto | null;\n  reportedAt: Date | null;\n  staleAfterSeconds: number;\n  now?: Date;\n}): RunnerToolCapabilitiesDto {\n  if (!params.toolCapabilities || !params.reportedAt) return EMPTY_RUNNER_TOOL_CAPABILITIES;\n\n  const now = params.now ?? new Date();\n  const ageMs = now.getTime() - params.reportedAt.getTime();\n  if (ageMs > params.staleAfterSeconds * 1000) return EMPTY_RUNNER_TOOL_CAPABILITIES;\n\n  return params.toolCapabilities;\n}\n\nfunction runnerToolCapabilityReportIsFresh(params: {\n  toolCapabilities: RunnerToolCapabilitiesDto | null | undefined;\n  reportedAt: Date | null | undefined;\n  staleAfterSeconds: number;\n  now?: Date;\n}): boolean {\n  if (!params.toolCapabilities || !params.reportedAt) return false;\n\n  const now = params.now ?? new Date();\n  const ageMs = now.getTime() - params.reportedAt.getTime();\n  return ageMs <= params.staleAfterSeconds * 1000;\n}\n\nexport function unadvertisedRunnerTools(params: {\n  harness: RunnerToolHarness;\n  requestedTools: readonly string[];\n  capabilities: RunnerToolCapabilitiesDto;\n}): string[] {\n  const advertised = new Set(params.capabilities.harnesses[params.harness]?.tools ?? []);\n  return params.requestedTools.filter((tool) => !advertised.has(tool));\n}\n\nexport interface EffectiveRunnerToolCapabilitiesResult {\n  capabilities: RunnerToolCapabilitiesDto;\n  reportFresh: boolean;\n  harnessKnown(harness: RunnerToolHarness): boolean;\n}\n\nexport async function getEffectiveRunnerToolCapabilities(params: {\n  runnerSessionId: string;\n}): Promise<EffectiveRunnerToolCapabilitiesResult> {\n  const runnerSession = await getRunnerSessionById(params.runnerSessionId);\n  const staleAfterSeconds = config.RUNNER_TOOL_CAPABILITIES_STALE_AFTER_SECONDS;\n  const capabilities = effectiveRunnerToolCapabilities({\n    toolCapabilities: runnerSession?.toolCapabilities ?? null,\n    reportedAt: runnerSession?.toolCapabilitiesReportedAt ?? null,\n    staleAfterSeconds,\n  });\n  const reportFresh = runnerToolCapabilityReportIsFresh({\n    toolCapabilities: runnerSession?.toolCapabilities,\n    reportedAt: runnerSession?.toolCapabilitiesReportedAt,\n    staleAfterSeconds,\n  });\n\n  return {\n    capabilities,\n    reportFresh,\n    harnessKnown: (harness) => capabilities.harnesses[harness] !== undefined,\n  };\n}\n"],"names":["config","getRunnerSessionById","EMPTY_RUNNER_TOOL_CAPABILITIES","harnesses","effectiveRunnerToolCapabilities","params","toolCapabilities","reportedAt","now","Date","ageMs","getTime","staleAfterSeconds","runnerToolCapabilityReportIsFresh","unadvertisedRunnerTools","advertised","Set","capabilities","harness","tools","requestedTools","filter","tool","has","getEffectiveRunnerToolCapabilities","runnerSession","runnerSessionId","RUNNER_TOOL_CAPABILITIES_STALE_AFTER_SECONDS","toolCapabilitiesReportedAt","reportFresh","harnessKnown","undefined"],"mappings":"AACA,SAAQA,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,QAAO,yBAAyB;AAI5D,OAAO,MAAMC,iCAA4D;IACvEC,WAAW,CAAC;AACd,EAAE;AAEF,OAAO,SAASC,gCAAgCC,MAK/C;IACC,IAAI,CAACA,OAAOC,gBAAgB,IAAI,CAACD,OAAOE,UAAU,EAAE,OAAOL;IAE3D,MAAMM,MAAMH,OAAOG,GAAG,IAAI,IAAIC;IAC9B,MAAMC,QAAQF,IAAIG,OAAO,KAAKN,OAAOE,UAAU,CAACI,OAAO;IACvD,IAAID,QAAQL,OAAOO,iBAAiB,GAAG,MAAM,OAAOV;IAEpD,OAAOG,OAAOC,gBAAgB;AAChC;AAEA,SAASO,kCAAkCR,MAK1C;IACC,IAAI,CAACA,OAAOC,gBAAgB,IAAI,CAACD,OAAOE,UAAU,EAAE,OAAO;IAE3D,MAAMC,MAAMH,OAAOG,GAAG,IAAI,IAAIC;IAC9B,MAAMC,QAAQF,IAAIG,OAAO,KAAKN,OAAOE,UAAU,CAACI,OAAO;IACvD,OAAOD,SAASL,OAAOO,iBAAiB,GAAG;AAC7C;AAEA,OAAO,SAASE,wBAAwBT,MAIvC;IACC,MAAMU,aAAa,IAAIC,IAAIX,OAAOY,YAAY,CAACd,SAAS,CAACE,OAAOa,OAAO,CAAC,EAAEC,SAAS,EAAE;IACrF,OAAOd,OAAOe,cAAc,CAACC,MAAM,CAAC,CAACC,OAAS,CAACP,WAAWQ,GAAG,CAACD;AAChE;AAQA,OAAO,eAAeE,mCAAmCnB,MAExD;IACC,MAAMoB,gBAAgB,MAAMxB,qBAAqBI,OAAOqB,eAAe;IACvE,MAAMd,oBAAoBZ,OAAO2B,4CAA4C;IAC7E,MAAMV,eAAeb,gCAAgC;QACnDE,kBAAkBmB,eAAenB,oBAAoB;QACrDC,YAAYkB,eAAeG,8BAA8B;QACzDhB;IACF;IACA,MAAMiB,cAAchB,kCAAkC;QACpDP,kBAAkBmB,eAAenB;QACjCC,YAAYkB,eAAeG;QAC3BhB;IACF;IAEA,OAAO;QACLK;QACAY;QACAC,cAAc,CAACZ,UAAYD,aAAad,SAAS,CAACe,QAAQ,KAAKa;IACjE;AACF"}