@shipfox/api-runners 2.0.0

package/dist/db/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAanE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B;AAED,MAAM,MAAM,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/db/db.js

@@ -0,0 +1,36 @@
+import { drizzle } from '@shipfox/node-drizzle';
+import { pgClient } from '@shipfox/node-postgres';
+import { ephemeralRegistrationTokens } from './schema/ephemeral-registration-tokens.js';
+import { manualRegistrationTokens } from './schema/manual-registration-tokens.js';
+import { runnersOutbox } from './schema/outbox.js';
+import { pendingJobExecutions } from './schema/pending-job-executions.js';
+import { provisionedRunners } from './schema/provisioned-runners.js';
+import { provisionerTokens } from './schema/provisioner-tokens.js';
+import { runnersRateLimits } from './schema/rate-limits.js';
+import { reservations } from './schema/reservations.js';
+import { runnerSessions } from './schema/runner-sessions.js';
+import { runningJobExecutions } from './schema/running-job-executions.js';
+export const schema = {
+    ephemeralRegistrationTokens,
+    pendingJobExecutions,
+    provisionedRunners,
+    provisionerTokens,
+    runnersRateLimits,
+    reservations,
+    runnerSessions,
+    manualRegistrationTokens,
+    runningJobExecutions,
+    runnersOutbox
+};
+let _db;
+export function db() {
+    if (!_db) _db = drizzle(pgClient(), {
+        schema
+    });
+    return _db;
+}
+export function closeDb() {
+    _db = undefined;
+}
+
+//# sourceMappingURL=db.js.map

package/dist/db/db.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {ephemeralRegistrationTokens} from './schema/ephemeral-registration-tokens.js';\nimport {manualRegistrationTokens} from './schema/manual-registration-tokens.js';\nimport {runnersOutbox} from './schema/outbox.js';\nimport {pendingJobExecutions} from './schema/pending-job-executions.js';\nimport {provisionedRunners} from './schema/provisioned-runners.js';\nimport {provisionerTokens} from './schema/provisioner-tokens.js';\nimport {runnersRateLimits} from './schema/rate-limits.js';\nimport {reservations} from './schema/reservations.js';\nimport {runnerSessions} from './schema/runner-sessions.js';\nimport {runningJobExecutions} from './schema/running-job-executions.js';\n\nexport const schema = {\n  ephemeralRegistrationTokens,\n  pendingJobExecutions,\n  provisionedRunners,\n  provisionerTokens,\n  runnersRateLimits,\n  reservations,\n  runnerSessions,\n  manualRegistrationTokens,\n  runningJobExecutions,\n  runnersOutbox,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n\nexport type Tx = Parameters<Parameters<NodePgDatabase<typeof schema>['transaction']>[0]>[0];\n"],"names":["drizzle","pgClient","ephemeralRegistrationTokens","manualRegistrationTokens","runnersOutbox","pendingJobExecutions","provisionedRunners","provisionerTokens","runnersRateLimits","reservations","runnerSessions","runningJobExecutions","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,2BAA2B,QAAO,4CAA4C;AACtF,SAAQC,wBAAwB,QAAO,yCAAyC;AAChF,SAAQC,aAAa,QAAO,qBAAqB;AACjD,SAAQC,oBAAoB,QAAO,qCAAqC;AACxE,SAAQC,kBAAkB,QAAO,kCAAkC;AACnE,SAAQC,iBAAiB,QAAO,iCAAiC;AACjE,SAAQC,iBAAiB,QAAO,0BAA0B;AAC1D,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,oBAAoB,QAAO,qCAAqC;AAExE,OAAO,MAAMC,SAAS;IACpBV;IACAG;IACAC;IACAC;IACAC;IACAC;IACAC;IACAP;IACAQ;IACAP;AACF,EAAE;AAEF,IAAIS;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMb,QAAQC,YAAY;QAACW;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/ephemeral-registration-tokens.d.ts

@@ -0,0 +1,47 @@
+import type { RunnerToolCapabilitiesDto } from '@shipfox/api-runners-dto';
+import type { EphemeralRegistrationToken } from '#core/entities/ephemeral-registration-token.js';
+export interface CreateEphemeralRegistrationTokenParams {
+    workspaceId: string;
+    provisionerId: string;
+    reservationId?: string | null | undefined;
+    provisionedRunnerId: string;
+    hashedToken: string;
+    prefix: string;
+    expiresAt: Date;
+}
+export interface CreateEphemeralRegistrationTokensBatchRow {
+    provisionedRunnerId: string;
+    hashedToken: string;
+    prefix: string;
+}
+export interface CreateEphemeralRegistrationTokensBatchParams {
+    workspaceId: string;
+    provisionerId: string;
+    reservationId: string;
+    expiresAt: Date;
+    rows: CreateEphemeralRegistrationTokensBatchRow[];
+}
+export declare function createEphemeralRegistrationToken(params: CreateEphemeralRegistrationTokenParams): Promise<EphemeralRegistrationToken>;
+export declare function createEphemeralRegistrationTokensBatch(params: CreateEphemeralRegistrationTokensBatchParams): Promise<EphemeralRegistrationToken[]>;
+export declare function resolveEphemeralRegistrationTokenByHash(hashedToken: string): Promise<EphemeralRegistrationToken | undefined>;
+export interface DeleteExpiredEphemeralRegistrationTokensParams {
+    retentionDays: number;
+    limit?: number;
+}
+/**
+ * Deletes ephemeral registration tokens that have reached a terminal state and
+ * outlived the retention window. A token is terminal once it is consumed
+ * (single use spent) or expired without consumption; the retention window is
+ * measured from that terminal event so the audit record survives a bounded
+ * debugging window. Active tokens that are neither consumed nor expired are
+ * never deleted, so a live single-use credential is never removed early.
+ */
+export declare function deleteExpiredEphemeralRegistrationTokens(params: DeleteExpiredEphemeralRegistrationTokensParams): Promise<number>;
+export declare function createRunnerSessionConsumingEphemeralToken(params: {
+    ephemeralTokenId: string;
+    workspaceId: string;
+    labels: string[];
+    toolCapabilities?: RunnerToolCapabilitiesDto | null;
+    maxClaims: number;
+}): Promise<import("../core/index.js").RunnerSession>;
+//# sourceMappingURL=ephemeral-registration-tokens.d.ts.map

package/dist/db/ephemeral-registration-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ephemeral-registration-tokens.d.ts","sourceRoot":"","sources":["../../src/db/ephemeral-registration-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAC,0BAA0B,EAAC,MAAM,gDAAgD,CAAC;AAoB/F,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yCAAyC;IACxD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4CAA4C;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,yCAAyC,EAAE,CAAC;CACnD;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,sCAAsC,GAC7C,OAAO,CAAC,0BAA0B,CAAC,CAiDrC;AAED,wBAAsB,sCAAsC,CAC1D,MAAM,EAAE,4CAA4C,GACnD,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAoGvC;AAED,wBAAsB,uCAAuC,CAC3D,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAUjD;AAED,MAAM,WAAW,8CAA8C;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,wCAAwC,CAC5D,MAAM,EAAE,8CAA8C,GACrD,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,0CAA0C,CAAC,MAAM,EAAE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gBAAgB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;CACnB,qDAsFA"}

package/dist/db/ephemeral-registration-tokens.js

@@ -0,0 +1,170 @@
+import { and, asc, eq, gt, inArray, isNull, lt, sql } from 'drizzle-orm';
+import { ActiveEphemeralRegistrationTokenExistsError, ActiveEphemeralRegistrationTokensExistError, RegistrationTokenBatchExceedsReservationError, RegistrationTokenConsumedError, RegistrationTokenExpiredError, RegistrationTokenWorkspaceMismatchError, ReservationExpiredError, ReservationNotFoundError } from '#core/errors.js';
+import { db } from './db.js';
+import { ephemeralRegistrationTokens, toEphemeralRegistrationToken } from './schema/ephemeral-registration-tokens.js';
+import { provisionedRunners } from './schema/provisioned-runners.js';
+import { reservations } from './schema/reservations.js';
+import { runnerSessions, toRunnerSession } from './schema/runner-sessions.js';
+export async function createEphemeralRegistrationToken(params) {
+    const rows = await db().transaction(async (tx)=>{
+        const provisionedRunnerLockKey = [
+            'runners_ephemeral_registration_tokens',
+            params.workspaceId,
+            params.provisionerId,
+            params.provisionedRunnerId
+        ].join(':');
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);
+        const [active] = await tx.select({
+            id: ephemeralRegistrationTokens.id
+        }).from(ephemeralRegistrationTokens).where(and(eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId), eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId), eq(ephemeralRegistrationTokens.provisionedRunnerId, params.provisionedRunnerId), isNull(ephemeralRegistrationTokens.consumedAt), gt(ephemeralRegistrationTokens.expiresAt, sql`now()`))).limit(1);
+        if (active) {
+            throw new ActiveEphemeralRegistrationTokenExistsError(params.workspaceId, params.provisionerId, params.provisionedRunnerId);
+        }
+        return await tx.insert(ephemeralRegistrationTokens).values({
+            workspaceId: params.workspaceId,
+            provisionerId: params.provisionerId,
+            reservationId: params.reservationId ?? null,
+            provisionedRunnerId: params.provisionedRunnerId,
+            hashedToken: params.hashedToken,
+            prefix: params.prefix,
+            expiresAt: params.expiresAt
+        }).returning();
+    });
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toEphemeralRegistrationToken(row);
+}
+export async function createEphemeralRegistrationTokensBatch(params) {
+    const rows = await db().transaction(async (tx)=>{
+        const provisionerLockKey = [
+            'runners_ephemeral_registration_tokens',
+            params.workspaceId,
+            params.provisionerId
+        ].join(':');
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionerLockKey}))`);
+        for (const provisionedRunnerId of [
+            ...new Set(params.rows.map((row)=>row.provisionedRunnerId))
+        ].sort()){
+            const provisionedRunnerLockKey = [
+                'runners_ephemeral_registration_tokens',
+                params.workspaceId,
+                params.provisionerId,
+                provisionedRunnerId
+            ].join(':');
+            await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);
+        }
+        const [reservation] = await tx.select({
+            count: reservations.count,
+            isExpired: sql`${reservations.expiresAt} <= now()`
+        }).from(reservations).where(and(eq(reservations.id, params.reservationId), eq(reservations.workspaceId, params.workspaceId), eq(reservations.provisionerId, params.provisionerId))).limit(1);
+        if (!reservation) throw new ReservationNotFoundError(params.reservationId);
+        if (reservation.isExpired) throw new ReservationExpiredError(params.reservationId);
+        if (params.rows.length > reservation.count) {
+            throw new RegistrationTokenBatchExceedsReservationError(params.rows.length, reservation.count);
+        }
+        const [existingForReservation] = await tx.select({
+            count: sql`count(*)::int`
+        }).from(ephemeralRegistrationTokens).where(and(eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId), eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId), eq(ephemeralRegistrationTokens.reservationId, params.reservationId)));
+        const alreadyMinted = existingForReservation?.count ?? 0;
+        if (alreadyMinted + params.rows.length > reservation.count) {
+            throw new RegistrationTokenBatchExceedsReservationError(params.rows.length, reservation.count, alreadyMinted);
+        }
+        const provisionedRunnerIds = params.rows.map((row)=>row.provisionedRunnerId);
+        const activeRows = await tx.select({
+            provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId
+        }).from(ephemeralRegistrationTokens).where(and(eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId), eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId), inArray(ephemeralRegistrationTokens.provisionedRunnerId, provisionedRunnerIds), isNull(ephemeralRegistrationTokens.consumedAt), gt(ephemeralRegistrationTokens.expiresAt, sql`now()`)));
+        if (activeRows.length > 0) {
+            throw new ActiveEphemeralRegistrationTokensExistError(activeRows.map((row)=>row.provisionedRunnerId));
+        }
+        return await tx.insert(ephemeralRegistrationTokens).values(params.rows.map((row)=>({
+                workspaceId: params.workspaceId,
+                provisionerId: params.provisionerId,
+                reservationId: params.reservationId,
+                provisionedRunnerId: row.provisionedRunnerId,
+                hashedToken: row.hashedToken,
+                prefix: row.prefix,
+                expiresAt: params.expiresAt
+            }))).returning();
+    });
+    return rows.map(toEphemeralRegistrationToken);
+}
+export async function resolveEphemeralRegistrationTokenByHash(hashedToken) {
+    const rows = await db().select().from(ephemeralRegistrationTokens).where(eq(ephemeralRegistrationTokens.hashedToken, hashedToken)).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toEphemeralRegistrationToken(row);
+}
+/**
+ * Deletes ephemeral registration tokens that have reached a terminal state and
+ * outlived the retention window. A token is terminal once it is consumed
+ * (single use spent) or expired without consumption; the retention window is
+ * measured from that terminal event so the audit record survives a bounded
+ * debugging window. Active tokens that are neither consumed nor expired are
+ * never deleted, so a live single-use credential is never removed early.
+ */ export async function deleteExpiredEphemeralRegistrationTokens(params) {
+    // coalesce(consumed_at, expires_at) is the terminal timestamp: consumed_at
+    // when the token was spent, otherwise its expiry. Comparing it to the cutoff
+    // both selects deletable rows and orders the batch, and it matches the
+    // terminal index so idle GC ticks never scan live rows.
+    const terminalAt = sql`coalesce(${ephemeralRegistrationTokens.consumedAt}, ${ephemeralRegistrationTokens.expiresAt})`;
+    const retentionCutoff = sql`now() - (${params.retentionDays} || ' days')::interval`;
+    const deletableIds = db().select({
+        id: ephemeralRegistrationTokens.id
+    }).from(ephemeralRegistrationTokens).where(lt(terminalAt, retentionCutoff)).orderBy(asc(terminalAt), asc(ephemeralRegistrationTokens.id)).limit(params.limit ?? 1000);
+    const deleted = await db().delete(ephemeralRegistrationTokens).where(inArray(ephemeralRegistrationTokens.id, deletableIds)).returning({
+        id: ephemeralRegistrationTokens.id
+    });
+    return deleted.length;
+}
+export async function createRunnerSessionConsumingEphemeralToken(params) {
+    return await db().transaction(async (tx)=>{
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);
+        const consumed = await tx.update(ephemeralRegistrationTokens).set({
+            consumedAt: sql`now()`
+        }).where(and(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId), eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId), isNull(ephemeralRegistrationTokens.consumedAt), gt(ephemeralRegistrationTokens.expiresAt, sql`now()`))).returning({
+            id: ephemeralRegistrationTokens.id,
+            provisionerId: ephemeralRegistrationTokens.provisionerId,
+            provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId
+        });
+        if (!consumed[0]) {
+            const [token] = await tx.select({
+                workspaceId: ephemeralRegistrationTokens.workspaceId,
+                consumedAt: ephemeralRegistrationTokens.consumedAt,
+                isExpired: sql`${ephemeralRegistrationTokens.expiresAt} <= now()`
+            }).from(ephemeralRegistrationTokens).where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId)).limit(1);
+            if (!token) {
+                throw new Error(`Ephemeral registration token not found: ${params.ephemeralTokenId}`);
+            }
+            if (token.workspaceId !== params.workspaceId) {
+                throw new RegistrationTokenWorkspaceMismatchError(params.ephemeralTokenId, params.workspaceId);
+            }
+            if (token.consumedAt) throw new RegistrationTokenConsumedError(params.ephemeralTokenId);
+            if (token.isExpired) throw new RegistrationTokenExpiredError(params.ephemeralTokenId);
+            throw new Error(`Ephemeral registration token could not be consumed: ${params.ephemeralTokenId}`);
+        }
+        const [session] = await tx.insert(runnerSessions).values({
+            workspaceId: params.workspaceId,
+            scope: 'workspace',
+            registrationTokenId: params.ephemeralTokenId,
+            registrationTokenKind: 'ephemeral',
+            provisionerId: consumed[0].provisionerId,
+            provisionedRunnerId: consumed[0].provisionedRunnerId,
+            labels: params.labels,
+            toolCapabilities: params.toolCapabilities ?? null,
+            toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,
+            maxClaims: params.maxClaims,
+            claimsUsed: 0
+        }).returning();
+        if (!session) throw new Error('Insert returned no rows');
+        await tx.update(ephemeralRegistrationTokens).set({
+            consumedSessionId: session.id
+        }).where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId));
+        await tx.update(provisionedRunners).set({
+            runnerSessionId: session.id,
+            updatedAt: sql`now()`
+        }).where(and(eq(provisionedRunners.workspaceId, params.workspaceId), eq(provisionedRunners.provisionerId, consumed[0].provisionerId), eq(provisionedRunners.provisionedRunnerId, consumed[0].provisionedRunnerId), isNull(provisionedRunners.reservationReleasedAt)));
+        return toRunnerSession(session);
+    });
+}
+
+//# sourceMappingURL=ephemeral-registration-tokens.js.map

package/dist/db/ephemeral-registration-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/ephemeral-registration-tokens.ts"],"sourcesContent":["import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {and, asc, eq, gt, inArray, isNull, lt, sql} from 'drizzle-orm';\nimport type {EphemeralRegistrationToken} from '#core/entities/ephemeral-registration-token.js';\nimport {\n  ActiveEphemeralRegistrationTokenExistsError,\n  ActiveEphemeralRegistrationTokensExistError,\n  RegistrationTokenBatchExceedsReservationError,\n  RegistrationTokenConsumedError,\n  RegistrationTokenExpiredError,\n  RegistrationTokenWorkspaceMismatchError,\n  ReservationExpiredError,\n  ReservationNotFoundError,\n} from '#core/errors.js';\nimport {db} from './db.js';\nimport {\n  ephemeralRegistrationTokens,\n  toEphemeralRegistrationToken,\n} from './schema/ephemeral-registration-tokens.js';\nimport {provisionedRunners} from './schema/provisioned-runners.js';\nimport {reservations} from './schema/reservations.js';\nimport {runnerSessions, toRunnerSession} from './schema/runner-sessions.js';\n\nexport interface CreateEphemeralRegistrationTokenParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId?: string | null | undefined;\n  provisionedRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n  expiresAt: Date;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchRow {\n  provisionedRunnerId: string;\n  hashedToken: string;\n  prefix: string;\n}\n\nexport interface CreateEphemeralRegistrationTokensBatchParams {\n  workspaceId: string;\n  provisionerId: string;\n  reservationId: string;\n  expiresAt: Date;\n  rows: CreateEphemeralRegistrationTokensBatchRow[];\n}\n\nexport async function createEphemeralRegistrationToken(\n  params: CreateEphemeralRegistrationTokenParams,\n): Promise<EphemeralRegistrationToken> {\n  const rows = await db().transaction(async (tx) => {\n    const provisionedRunnerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n      params.provisionedRunnerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);\n\n    const [active] = await tx\n      .select({id: ephemeralRegistrationTokens.id})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.provisionedRunnerId, params.provisionedRunnerId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .limit(1);\n\n    if (active) {\n      throw new ActiveEphemeralRegistrationTokenExistsError(\n        params.workspaceId,\n        params.provisionerId,\n        params.provisionedRunnerId,\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values({\n        workspaceId: params.workspaceId,\n        provisionerId: params.provisionerId,\n        reservationId: params.reservationId ?? null,\n        provisionedRunnerId: params.provisionedRunnerId,\n        hashedToken: params.hashedToken,\n        prefix: params.prefix,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n  });\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toEphemeralRegistrationToken(row);\n}\n\nexport async function createEphemeralRegistrationTokensBatch(\n  params: CreateEphemeralRegistrationTokensBatchParams,\n): Promise<EphemeralRegistrationToken[]> {\n  const rows = await db().transaction(async (tx) => {\n    const provisionerLockKey = [\n      'runners_ephemeral_registration_tokens',\n      params.workspaceId,\n      params.provisionerId,\n    ].join(':');\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionerLockKey}))`);\n    for (const provisionedRunnerId of [\n      ...new Set(params.rows.map((row) => row.provisionedRunnerId)),\n    ].sort()) {\n      const provisionedRunnerLockKey = [\n        'runners_ephemeral_registration_tokens',\n        params.workspaceId,\n        params.provisionerId,\n        provisionedRunnerId,\n      ].join(':');\n      await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${provisionedRunnerLockKey}))`);\n    }\n\n    const [reservation] = await tx\n      .select({\n        count: reservations.count,\n        isExpired: sql<boolean>`${reservations.expiresAt} <= now()`,\n      })\n      .from(reservations)\n      .where(\n        and(\n          eq(reservations.id, params.reservationId),\n          eq(reservations.workspaceId, params.workspaceId),\n          eq(reservations.provisionerId, params.provisionerId),\n        ),\n      )\n      .limit(1);\n\n    if (!reservation) throw new ReservationNotFoundError(params.reservationId);\n    if (reservation.isExpired) throw new ReservationExpiredError(params.reservationId);\n    if (params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n      );\n    }\n\n    const [existingForReservation] = await tx\n      .select({count: sql<number>`count(*)::int`})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          eq(ephemeralRegistrationTokens.reservationId, params.reservationId),\n        ),\n      );\n    const alreadyMinted = existingForReservation?.count ?? 0;\n    if (alreadyMinted + params.rows.length > reservation.count) {\n      throw new RegistrationTokenBatchExceedsReservationError(\n        params.rows.length,\n        reservation.count,\n        alreadyMinted,\n      );\n    }\n\n    const provisionedRunnerIds = params.rows.map((row) => row.provisionedRunnerId);\n    const activeRows = await tx\n      .select({provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId})\n      .from(ephemeralRegistrationTokens)\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          eq(ephemeralRegistrationTokens.provisionerId, params.provisionerId),\n          inArray(ephemeralRegistrationTokens.provisionedRunnerId, provisionedRunnerIds),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      );\n\n    if (activeRows.length > 0) {\n      throw new ActiveEphemeralRegistrationTokensExistError(\n        activeRows.map((row) => row.provisionedRunnerId),\n      );\n    }\n\n    return await tx\n      .insert(ephemeralRegistrationTokens)\n      .values(\n        params.rows.map((row) => ({\n          workspaceId: params.workspaceId,\n          provisionerId: params.provisionerId,\n          reservationId: params.reservationId,\n          provisionedRunnerId: row.provisionedRunnerId,\n          hashedToken: row.hashedToken,\n          prefix: row.prefix,\n          expiresAt: params.expiresAt,\n        })),\n      )\n      .returning();\n  });\n\n  return rows.map(toEphemeralRegistrationToken);\n}\n\nexport async function resolveEphemeralRegistrationTokenByHash(\n  hashedToken: string,\n): Promise<EphemeralRegistrationToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(ephemeralRegistrationTokens)\n    .where(eq(ephemeralRegistrationTokens.hashedToken, hashedToken))\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toEphemeralRegistrationToken(row);\n}\n\nexport interface DeleteExpiredEphemeralRegistrationTokensParams {\n  retentionDays: number;\n  limit?: number;\n}\n\n/**\n * Deletes ephemeral registration tokens that have reached a terminal state and\n * outlived the retention window. A token is terminal once it is consumed\n * (single use spent) or expired without consumption; the retention window is\n * measured from that terminal event so the audit record survives a bounded\n * debugging window. Active tokens that are neither consumed nor expired are\n * never deleted, so a live single-use credential is never removed early.\n */\nexport async function deleteExpiredEphemeralRegistrationTokens(\n  params: DeleteExpiredEphemeralRegistrationTokensParams,\n): Promise<number> {\n  // coalesce(consumed_at, expires_at) is the terminal timestamp: consumed_at\n  // when the token was spent, otherwise its expiry. Comparing it to the cutoff\n  // both selects deletable rows and orders the batch, and it matches the\n  // terminal index so idle GC ticks never scan live rows.\n  const terminalAt = sql`coalesce(${ephemeralRegistrationTokens.consumedAt}, ${ephemeralRegistrationTokens.expiresAt})`;\n  const retentionCutoff = sql`now() - (${params.retentionDays} || ' days')::interval`;\n\n  const deletableIds = db()\n    .select({id: ephemeralRegistrationTokens.id})\n    .from(ephemeralRegistrationTokens)\n    .where(lt(terminalAt, retentionCutoff))\n    .orderBy(asc(terminalAt), asc(ephemeralRegistrationTokens.id))\n    .limit(params.limit ?? 1000);\n\n  const deleted = await db()\n    .delete(ephemeralRegistrationTokens)\n    .where(inArray(ephemeralRegistrationTokens.id, deletableIds))\n    .returning({id: ephemeralRegistrationTokens.id});\n\n  return deleted.length;\n}\n\nexport async function createRunnerSessionConsumingEphemeralToken(params: {\n  ephemeralTokenId: string;\n  workspaceId: string;\n  labels: string[];\n  toolCapabilities?: RunnerToolCapabilitiesDto | null;\n  maxClaims: number;\n}) {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${params.workspaceId}))`);\n\n    const consumed = await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedAt: sql`now()`})\n      .where(\n        and(\n          eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId),\n          eq(ephemeralRegistrationTokens.workspaceId, params.workspaceId),\n          isNull(ephemeralRegistrationTokens.consumedAt),\n          gt(ephemeralRegistrationTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning({\n        id: ephemeralRegistrationTokens.id,\n        provisionerId: ephemeralRegistrationTokens.provisionerId,\n        provisionedRunnerId: ephemeralRegistrationTokens.provisionedRunnerId,\n      });\n\n    if (!consumed[0]) {\n      const [token] = await tx\n        .select({\n          workspaceId: ephemeralRegistrationTokens.workspaceId,\n          consumedAt: ephemeralRegistrationTokens.consumedAt,\n          isExpired: sql<boolean>`${ephemeralRegistrationTokens.expiresAt} <= now()`,\n        })\n        .from(ephemeralRegistrationTokens)\n        .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId))\n        .limit(1);\n\n      if (!token) {\n        throw new Error(`Ephemeral registration token not found: ${params.ephemeralTokenId}`);\n      }\n      if (token.workspaceId !== params.workspaceId) {\n        throw new RegistrationTokenWorkspaceMismatchError(\n          params.ephemeralTokenId,\n          params.workspaceId,\n        );\n      }\n      if (token.consumedAt) throw new RegistrationTokenConsumedError(params.ephemeralTokenId);\n      if (token.isExpired) throw new RegistrationTokenExpiredError(params.ephemeralTokenId);\n      throw new Error(\n        `Ephemeral registration token could not be consumed: ${params.ephemeralTokenId}`,\n      );\n    }\n\n    const [session] = await tx\n      .insert(runnerSessions)\n      .values({\n        workspaceId: params.workspaceId,\n        scope: 'workspace',\n        registrationTokenId: params.ephemeralTokenId,\n        registrationTokenKind: 'ephemeral',\n        provisionerId: consumed[0].provisionerId,\n        provisionedRunnerId: consumed[0].provisionedRunnerId,\n        labels: params.labels,\n        toolCapabilities: params.toolCapabilities ?? null,\n        toolCapabilitiesReportedAt: params.toolCapabilities ? sql`now()` : null,\n        maxClaims: params.maxClaims,\n        claimsUsed: 0,\n      })\n      .returning();\n\n    if (!session) throw new Error('Insert returned no rows');\n\n    await tx\n      .update(ephemeralRegistrationTokens)\n      .set({consumedSessionId: session.id})\n      .where(eq(ephemeralRegistrationTokens.id, params.ephemeralTokenId));\n\n    await tx\n      .update(provisionedRunners)\n      .set({runnerSessionId: session.id, updatedAt: sql`now()`})\n      .where(\n        and(\n          eq(provisionedRunners.workspaceId, params.workspaceId),\n          eq(provisionedRunners.provisionerId, consumed[0].provisionerId),\n          eq(provisionedRunners.provisionedRunnerId, consumed[0].provisionedRunnerId),\n          isNull(provisionedRunners.reservationReleasedAt),\n        ),\n      );\n\n    return toRunnerSession(session);\n  });\n}\n"],"names":["and","asc","eq","gt","inArray","isNull","lt","sql","ActiveEphemeralRegistrationTokenExistsError","ActiveEphemeralRegistrationTokensExistError","RegistrationTokenBatchExceedsReservationError","RegistrationTokenConsumedError","RegistrationTokenExpiredError","RegistrationTokenWorkspaceMismatchError","ReservationExpiredError","ReservationNotFoundError","db","ephemeralRegistrationTokens","toEphemeralRegistrationToken","provisionedRunners","reservations","runnerSessions","toRunnerSession","createEphemeralRegistrationToken","params","rows","transaction","tx","provisionedRunnerLockKey","workspaceId","provisionerId","provisionedRunnerId","join","execute","active","select","id","from","where","consumedAt","expiresAt","limit","insert","values","reservationId","hashedToken","prefix","returning","row","Error","createEphemeralRegistrationTokensBatch","provisionerLockKey","Set","map","sort","reservation","count","isExpired","length","existingForReservation","alreadyMinted","provisionedRunnerIds","activeRows","resolveEphemeralRegistrationTokenByHash","undefined","deleteExpiredEphemeralRegistrationTokens","terminalAt","retentionCutoff","retentionDays","deletableIds","orderBy","deleted","delete","createRunnerSessionConsumingEphemeralToken","consumed","update","set","ephemeralTokenId","token","session","scope","registrationTokenId","registrationTokenKind","labels","toolCapabilities","toolCapabilitiesReportedAt","maxClaims","claimsUsed","consumedSessionId","runnerSessionId","updatedAt","reservationReleasedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,OAAO,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEvE,SACEC,2CAA2C,EAC3CC,2CAA2C,EAC3CC,6CAA6C,EAC7CC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,uCAAuC,EACvCC,uBAAuB,EACvBC,wBAAwB,QACnB,kBAAkB;AACzB,SAAQC,EAAE,QAAO,UAAU;AAC3B,SACEC,2BAA2B,EAC3BC,4BAA4B,QACvB,4CAA4C;AACnD,SAAQC,kBAAkB,QAAO,kCAAkC;AACnE,SAAQC,YAAY,QAAO,2BAA2B;AACtD,SAAQC,cAAc,EAAEC,eAAe,QAAO,8BAA8B;AA0B5E,OAAO,eAAeC,iCACpBC,MAA8C;IAE9C,MAAMC,OAAO,MAAMT,KAAKU,WAAW,CAAC,OAAOC;QACzC,MAAMC,2BAA2B;YAC/B;YACAJ,OAAOK,WAAW;YAClBL,OAAOM,aAAa;YACpBN,OAAOO,mBAAmB;SAC3B,CAACC,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC1B,GAAG,CAAC,sCAAsC,EAAEqB,yBAAyB,EAAE,CAAC;QAEzF,MAAM,CAACM,OAAO,GAAG,MAAMP,GACpBQ,MAAM,CAAC;YAACC,IAAInB,4BAA4BmB,EAAE;QAAA,GAC1CC,IAAI,CAACpB,6BACLqB,KAAK,CACJtC,IACEE,GAAGe,4BAA4BY,WAAW,EAAEL,OAAOK,WAAW,GAC9D3B,GAAGe,4BAA4Ba,aAAa,EAAEN,OAAOM,aAAa,GAClE5B,GAAGe,4BAA4Bc,mBAAmB,EAAEP,OAAOO,mBAAmB,GAC9E1B,OAAOY,4BAA4BsB,UAAU,GAC7CpC,GAAGc,4BAA4BuB,SAAS,EAAEjC,GAAG,CAAC,KAAK,CAAC,IAGvDkC,KAAK,CAAC;QAET,IAAIP,QAAQ;YACV,MAAM,IAAI1B,4CACRgB,OAAOK,WAAW,EAClBL,OAAOM,aAAa,EACpBN,OAAOO,mBAAmB;QAE9B;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAACzB,6BACP0B,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BC,eAAeN,OAAOM,aAAa;YACnCc,eAAepB,OAAOoB,aAAa,IAAI;YACvCb,qBAAqBP,OAAOO,mBAAmB;YAC/Cc,aAAarB,OAAOqB,WAAW;YAC/BC,QAAQtB,OAAOsB,MAAM;YACrBN,WAAWhB,OAAOgB,SAAS;QAC7B,GACCO,SAAS;IACd;IAEA,MAAMC,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAO/B,6BAA6B8B;AACtC;AAEA,OAAO,eAAeE,uCACpB1B,MAAoD;IAEpD,MAAMC,OAAO,MAAMT,KAAKU,WAAW,CAAC,OAAOC;QACzC,MAAMwB,qBAAqB;YACzB;YACA3B,OAAOK,WAAW;YAClBL,OAAOM,aAAa;SACrB,CAACE,IAAI,CAAC;QACP,MAAML,GAAGM,OAAO,CAAC1B,GAAG,CAAC,sCAAsC,EAAE4C,mBAAmB,EAAE,CAAC;QACnF,KAAK,MAAMpB,uBAAuB;eAC7B,IAAIqB,IAAI5B,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,mBAAmB;SAC5D,CAACuB,IAAI,GAAI;YACR,MAAM1B,2BAA2B;gBAC/B;gBACAJ,OAAOK,WAAW;gBAClBL,OAAOM,aAAa;gBACpBC;aACD,CAACC,IAAI,CAAC;YACP,MAAML,GAAGM,OAAO,CAAC1B,GAAG,CAAC,sCAAsC,EAAEqB,yBAAyB,EAAE,CAAC;QAC3F;QAEA,MAAM,CAAC2B,YAAY,GAAG,MAAM5B,GACzBQ,MAAM,CAAC;YACNqB,OAAOpC,aAAaoC,KAAK;YACzBC,WAAWlD,GAAY,CAAC,EAAEa,aAAaoB,SAAS,CAAC,SAAS,CAAC;QAC7D,GACCH,IAAI,CAACjB,cACLkB,KAAK,CACJtC,IACEE,GAAGkB,aAAagB,EAAE,EAAEZ,OAAOoB,aAAa,GACxC1C,GAAGkB,aAAaS,WAAW,EAAEL,OAAOK,WAAW,GAC/C3B,GAAGkB,aAAaU,aAAa,EAAEN,OAAOM,aAAa,IAGtDW,KAAK,CAAC;QAET,IAAI,CAACc,aAAa,MAAM,IAAIxC,yBAAyBS,OAAOoB,aAAa;QACzE,IAAIW,YAAYE,SAAS,EAAE,MAAM,IAAI3C,wBAAwBU,OAAOoB,aAAa;QACjF,IAAIpB,OAAOC,IAAI,CAACiC,MAAM,GAAGH,YAAYC,KAAK,EAAE;YAC1C,MAAM,IAAI9C,8CACRc,OAAOC,IAAI,CAACiC,MAAM,EAClBH,YAAYC,KAAK;QAErB;QAEA,MAAM,CAACG,uBAAuB,GAAG,MAAMhC,GACpCQ,MAAM,CAAC;YAACqB,OAAOjD,GAAW,CAAC,aAAa,CAAC;QAAA,GACzC8B,IAAI,CAACpB,6BACLqB,KAAK,CACJtC,IACEE,GAAGe,4BAA4BY,WAAW,EAAEL,OAAOK,WAAW,GAC9D3B,GAAGe,4BAA4Ba,aAAa,EAAEN,OAAOM,aAAa,GAClE5B,GAAGe,4BAA4B2B,aAAa,EAAEpB,OAAOoB,aAAa;QAGxE,MAAMgB,gBAAgBD,wBAAwBH,SAAS;QACvD,IAAII,gBAAgBpC,OAAOC,IAAI,CAACiC,MAAM,GAAGH,YAAYC,KAAK,EAAE;YAC1D,MAAM,IAAI9C,8CACRc,OAAOC,IAAI,CAACiC,MAAM,EAClBH,YAAYC,KAAK,EACjBI;QAEJ;QAEA,MAAMC,uBAAuBrC,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAQA,IAAIjB,mBAAmB;QAC7E,MAAM+B,aAAa,MAAMnC,GACtBQ,MAAM,CAAC;YAACJ,qBAAqBd,4BAA4Bc,mBAAmB;QAAA,GAC5EM,IAAI,CAACpB,6BACLqB,KAAK,CACJtC,IACEE,GAAGe,4BAA4BY,WAAW,EAAEL,OAAOK,WAAW,GAC9D3B,GAAGe,4BAA4Ba,aAAa,EAAEN,OAAOM,aAAa,GAClE1B,QAAQa,4BAA4Bc,mBAAmB,EAAE8B,uBACzDxD,OAAOY,4BAA4BsB,UAAU,GAC7CpC,GAAGc,4BAA4BuB,SAAS,EAAEjC,GAAG,CAAC,KAAK,CAAC;QAI1D,IAAIuD,WAAWJ,MAAM,GAAG,GAAG;YACzB,MAAM,IAAIjD,4CACRqD,WAAWT,GAAG,CAAC,CAACL,MAAQA,IAAIjB,mBAAmB;QAEnD;QAEA,OAAO,MAAMJ,GACVe,MAAM,CAACzB,6BACP0B,MAAM,CACLnB,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAACL,MAAS,CAAA;gBACxBnB,aAAaL,OAAOK,WAAW;gBAC/BC,eAAeN,OAAOM,aAAa;gBACnCc,eAAepB,OAAOoB,aAAa;gBACnCb,qBAAqBiB,IAAIjB,mBAAmB;gBAC5Cc,aAAaG,IAAIH,WAAW;gBAC5BC,QAAQE,IAAIF,MAAM;gBAClBN,WAAWhB,OAAOgB,SAAS;YAC7B,CAAA,IAEDO,SAAS;IACd;IAEA,OAAOtB,KAAK4B,GAAG,CAACnC;AAClB;AAEA,OAAO,eAAe6C,wCACpBlB,WAAmB;IAEnB,MAAMpB,OAAO,MAAMT,KAChBmB,MAAM,GACNE,IAAI,CAACpB,6BACLqB,KAAK,CAACpC,GAAGe,4BAA4B4B,WAAW,EAAEA,cAClDJ,KAAK,CAAC;IAET,MAAMO,MAAMvB,IAAI,CAAC,EAAE;IACnB,IAAI,CAACuB,KAAK,OAAOgB;IACjB,OAAO9C,6BAA6B8B;AACtC;AAOA;;;;;;;CAOC,GACD,OAAO,eAAeiB,yCACpBzC,MAAsD;IAEtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM0C,aAAa3D,GAAG,CAAC,SAAS,EAAEU,4BAA4BsB,UAAU,CAAC,EAAE,EAAEtB,4BAA4BuB,SAAS,CAAC,CAAC,CAAC;IACrH,MAAM2B,kBAAkB5D,GAAG,CAAC,SAAS,EAAEiB,OAAO4C,aAAa,CAAC,sBAAsB,CAAC;IAEnF,MAAMC,eAAerD,KAClBmB,MAAM,CAAC;QAACC,IAAInB,4BAA4BmB,EAAE;IAAA,GAC1CC,IAAI,CAACpB,6BACLqB,KAAK,CAAChC,GAAG4D,YAAYC,kBACrBG,OAAO,CAACrE,IAAIiE,aAAajE,IAAIgB,4BAA4BmB,EAAE,GAC3DK,KAAK,CAACjB,OAAOiB,KAAK,IAAI;IAEzB,MAAM8B,UAAU,MAAMvD,KACnBwD,MAAM,CAACvD,6BACPqB,KAAK,CAAClC,QAAQa,4BAA4BmB,EAAE,EAAEiC,eAC9CtB,SAAS,CAAC;QAACX,IAAInB,4BAA4BmB,EAAE;IAAA;IAEhD,OAAOmC,QAAQb,MAAM;AACvB;AAEA,OAAO,eAAee,2CAA2CjD,MAMhE;IACC,OAAO,MAAMR,KAAKU,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGM,OAAO,CAAC1B,GAAG,CAAC,sCAAsC,EAAEiB,OAAOK,WAAW,CAAC,EAAE,CAAC;QAEnF,MAAM6C,WAAW,MAAM/C,GACpBgD,MAAM,CAAC1D,6BACP2D,GAAG,CAAC;YAACrC,YAAYhC,GAAG,CAAC,KAAK,CAAC;QAAA,GAC3B+B,KAAK,CACJtC,IACEE,GAAGe,4BAA4BmB,EAAE,EAAEZ,OAAOqD,gBAAgB,GAC1D3E,GAAGe,4BAA4BY,WAAW,EAAEL,OAAOK,WAAW,GAC9DxB,OAAOY,4BAA4BsB,UAAU,GAC7CpC,GAAGc,4BAA4BuB,SAAS,EAAEjC,GAAG,CAAC,KAAK,CAAC,IAGvDwC,SAAS,CAAC;YACTX,IAAInB,4BAA4BmB,EAAE;YAClCN,eAAeb,4BAA4Ba,aAAa;YACxDC,qBAAqBd,4BAA4Bc,mBAAmB;QACtE;QAEF,IAAI,CAAC2C,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,CAACI,MAAM,GAAG,MAAMnD,GACnBQ,MAAM,CAAC;gBACNN,aAAaZ,4BAA4BY,WAAW;gBACpDU,YAAYtB,4BAA4BsB,UAAU;gBAClDkB,WAAWlD,GAAY,CAAC,EAAEU,4BAA4BuB,SAAS,CAAC,SAAS,CAAC;YAC5E,GACCH,IAAI,CAACpB,6BACLqB,KAAK,CAACpC,GAAGe,4BAA4BmB,EAAE,EAAEZ,OAAOqD,gBAAgB,GAChEpC,KAAK,CAAC;YAET,IAAI,CAACqC,OAAO;gBACV,MAAM,IAAI7B,MAAM,CAAC,wCAAwC,EAAEzB,OAAOqD,gBAAgB,EAAE;YACtF;YACA,IAAIC,MAAMjD,WAAW,KAAKL,OAAOK,WAAW,EAAE;gBAC5C,MAAM,IAAIhB,wCACRW,OAAOqD,gBAAgB,EACvBrD,OAAOK,WAAW;YAEtB;YACA,IAAIiD,MAAMvC,UAAU,EAAE,MAAM,IAAI5B,+BAA+Ba,OAAOqD,gBAAgB;YACtF,IAAIC,MAAMrB,SAAS,EAAE,MAAM,IAAI7C,8BAA8BY,OAAOqD,gBAAgB;YACpF,MAAM,IAAI5B,MACR,CAAC,oDAAoD,EAAEzB,OAAOqD,gBAAgB,EAAE;QAEpF;QAEA,MAAM,CAACE,QAAQ,GAAG,MAAMpD,GACrBe,MAAM,CAACrB,gBACPsB,MAAM,CAAC;YACNd,aAAaL,OAAOK,WAAW;YAC/BmD,OAAO;YACPC,qBAAqBzD,OAAOqD,gBAAgB;YAC5CK,uBAAuB;YACvBpD,eAAe4C,QAAQ,CAAC,EAAE,CAAC5C,aAAa;YACxCC,qBAAqB2C,QAAQ,CAAC,EAAE,CAAC3C,mBAAmB;YACpDoD,QAAQ3D,OAAO2D,MAAM;YACrBC,kBAAkB5D,OAAO4D,gBAAgB,IAAI;YAC7CC,4BAA4B7D,OAAO4D,gBAAgB,GAAG7E,GAAG,CAAC,KAAK,CAAC,GAAG;YACnE+E,WAAW9D,OAAO8D,SAAS;YAC3BC,YAAY;QACd,GACCxC,SAAS;QAEZ,IAAI,CAACgC,SAAS,MAAM,IAAI9B,MAAM;QAE9B,MAAMtB,GACHgD,MAAM,CAAC1D,6BACP2D,GAAG,CAAC;YAACY,mBAAmBT,QAAQ3C,EAAE;QAAA,GAClCE,KAAK,CAACpC,GAAGe,4BAA4BmB,EAAE,EAAEZ,OAAOqD,gBAAgB;QAEnE,MAAMlD,GACHgD,MAAM,CAACxD,oBACPyD,GAAG,CAAC;YAACa,iBAAiBV,QAAQ3C,EAAE;YAAEsD,WAAWnF,GAAG,CAAC,KAAK,CAAC;QAAA,GACvD+B,KAAK,CACJtC,IACEE,GAAGiB,mBAAmBU,WAAW,EAAEL,OAAOK,WAAW,GACrD3B,GAAGiB,mBAAmBW,aAAa,EAAE4C,QAAQ,CAAC,EAAE,CAAC5C,aAAa,GAC9D5B,GAAGiB,mBAAmBY,mBAAmB,EAAE2C,QAAQ,CAAC,EAAE,CAAC3C,mBAAmB,GAC1E1B,OAAOc,mBAAmBwE,qBAAqB;QAIrD,OAAOrE,gBAAgByD;IACzB;AACF"}

package/dist/db/index.d.ts

@@ -0,0 +1,19 @@
+export { closeDb, db, schema } from './db.js';
+export type { CreateEphemeralRegistrationTokenParams, DeleteExpiredEphemeralRegistrationTokensParams, } from './ephemeral-registration-tokens.js';
+export { createEphemeralRegistrationToken, createRunnerSessionConsumingEphemeralToken, deleteExpiredEphemeralRegistrationTokens, resolveEphemeralRegistrationTokenByHash, } from './ephemeral-registration-tokens.js';
+export type { ClaimedJobExecution, EnqueueJobExecutionParams, ProvisionedRunnerBoundJobExecution, } from './job-executions.js';
+export { cancelRunnerJobs, claimPendingJobExecution, enqueueJobExecution, expireStuckJobExecutions, isJobLeaseActive, listActiveRunningJobExecutions, listRunningJobExecutionsByProvisionedRunnerTx, recordHeartbeat, releaseJobExecution, } from './job-executions.js';
+export type { CreateManualRegistrationTokenParams } from './manual-registration-tokens.js';
+export { createManualRegistrationToken, listUsableManualRegistrationTokensByWorkspaceId, resolveManualRegistrationTokenByHash, revokeManualRegistrationToken, } from './manual-registration-tokens.js';
+export type { ActiveProvisionedRunnerTemplateCount, ProvisionedRunnerReportEvent, ProvisionedRunnerTerminateIntent, ProvisionedRunnerTerminateIntentReason, ReapStaleProvisionedRunnersResult, ReconcileProvisionedRunnersDbResult, ReconcileProvisionedRunnersParams, ReportProvisionedRunnersParams, } from './provisioned-runners.js';
+export { isTerminalState, listActiveProvisionedRunnerCountsByTemplateTx, listActiveProvisionedRunners, listProvisionerTerminateIntentRowsTx, listProvisionerTerminateIntents, reapStaleProvisionedRunners, reconcileProvisionedRunners, reportProvisionedRunners, } from './provisioned-runners.js';
+export type { CreateProvisionerTokenParams } from './provisioner-tokens.js';
+export { createProvisionerToken, listActiveProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, resolveProvisionerTokenByHash, revokeProvisionerToken, touchProvisionerLastSeen, } from './provisioner-tokens.js';
+export { consumeRunnersRateLimit, pruneExpiredRunnersRateLimits, } from './rate-limits.js';
+export type { DemandStat, PollDemandAndReserveParams, ReservationGrant, ReservationTemplate, } from './reservations.js';
+export { deleteExpiredReservations, deleteReservationsByIds, pollDemandAndReserve, releaseReservationUnits, } from './reservations.js';
+export type { CreateRunnerSessionParams, DeleteExpiredRunnerSessionsParams, } from './runner-sessions.js';
+export { createRunnerSession, deleteExpiredRunnerSessions } from './runner-sessions.js';
+export { runnersOutbox } from './schema/outbox.js';
+export declare const migrationsPath: string;
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAC,MAAM,SAAS,CAAC;AAC5C,YAAY,EACV,sCAAsC,EACtC,8CAA8C,GAC/C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gCAAgC,EAChC,0CAA0C,EAC1C,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,6CAA6C,EAC7C,eAAe,EACf,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAC,mCAAmC,EAAC,MAAM,iCAAiC,CAAC;AACzF,OAAO,EACL,6BAA6B,EAC7B,+CAA+C,EAC/C,oCAAoC,EACpC,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,oCAAoC,EACpC,4BAA4B,EAC5B,gCAAgC,EAChC,sCAAsC,EACtC,iCAAiC,EACjC,mCAAmC,EACnC,iCAAiC,EACjC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,eAAe,EACf,6CAA6C,EAC7C,4BAA4B,EAC5B,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,4BAA4B,EAAC,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wCAAwC,EACxC,6BAA6B,EAC7B,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,mBAAmB,EAAE,2BAA2B,EAAC,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEjD,eAAO,MAAM,cAAc,QAAoE,CAAC"}

package/dist/db/index.js

@@ -0,0 +1,15 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export { closeDb, db, schema } from './db.js';
+export { createEphemeralRegistrationToken, createRunnerSessionConsumingEphemeralToken, deleteExpiredEphemeralRegistrationTokens, resolveEphemeralRegistrationTokenByHash } from './ephemeral-registration-tokens.js';
+export { cancelRunnerJobs, claimPendingJobExecution, enqueueJobExecution, expireStuckJobExecutions, isJobLeaseActive, listActiveRunningJobExecutions, listRunningJobExecutionsByProvisionedRunnerTx, recordHeartbeat, releaseJobExecution } from './job-executions.js';
+export { createManualRegistrationToken, listUsableManualRegistrationTokensByWorkspaceId, resolveManualRegistrationTokenByHash, revokeManualRegistrationToken } from './manual-registration-tokens.js';
+export { isTerminalState, listActiveProvisionedRunnerCountsByTemplateTx, listActiveProvisionedRunners, listProvisionerTerminateIntentRowsTx, listProvisionerTerminateIntents, reapStaleProvisionedRunners, reconcileProvisionedRunners, reportProvisionedRunners } from './provisioned-runners.js';
+export { createProvisionerToken, listActiveProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, resolveProvisionerTokenByHash, revokeProvisionerToken, touchProvisionerLastSeen } from './provisioner-tokens.js';
+export { consumeRunnersRateLimit, pruneExpiredRunnersRateLimits } from './rate-limits.js';
+export { deleteExpiredReservations, deleteReservationsByIds, pollDemandAndReserve, releaseReservationUnits } from './reservations.js';
+export { createRunnerSession, deleteExpiredRunnerSessions } from './runner-sessions.js';
+export { runnersOutbox } from './schema/outbox.js';
+export const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');
+
+//# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/index.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\n\nexport {closeDb, db, schema} from './db.js';\nexport type {\n  CreateEphemeralRegistrationTokenParams,\n  DeleteExpiredEphemeralRegistrationTokensParams,\n} from './ephemeral-registration-tokens.js';\nexport {\n  createEphemeralRegistrationToken,\n  createRunnerSessionConsumingEphemeralToken,\n  deleteExpiredEphemeralRegistrationTokens,\n  resolveEphemeralRegistrationTokenByHash,\n} from './ephemeral-registration-tokens.js';\nexport type {\n  ClaimedJobExecution,\n  EnqueueJobExecutionParams,\n  ProvisionedRunnerBoundJobExecution,\n} from './job-executions.js';\nexport {\n  cancelRunnerJobs,\n  claimPendingJobExecution,\n  enqueueJobExecution,\n  expireStuckJobExecutions,\n  isJobLeaseActive,\n  listActiveRunningJobExecutions,\n  listRunningJobExecutionsByProvisionedRunnerTx,\n  recordHeartbeat,\n  releaseJobExecution,\n} from './job-executions.js';\nexport type {CreateManualRegistrationTokenParams} from './manual-registration-tokens.js';\nexport {\n  createManualRegistrationToken,\n  listUsableManualRegistrationTokensByWorkspaceId,\n  resolveManualRegistrationTokenByHash,\n  revokeManualRegistrationToken,\n} from './manual-registration-tokens.js';\nexport type {\n  ActiveProvisionedRunnerTemplateCount,\n  ProvisionedRunnerReportEvent,\n  ProvisionedRunnerTerminateIntent,\n  ProvisionedRunnerTerminateIntentReason,\n  ReapStaleProvisionedRunnersResult,\n  ReconcileProvisionedRunnersDbResult,\n  ReconcileProvisionedRunnersParams,\n  ReportProvisionedRunnersParams,\n} from './provisioned-runners.js';\nexport {\n  isTerminalState,\n  listActiveProvisionedRunnerCountsByTemplateTx,\n  listActiveProvisionedRunners,\n  listProvisionerTerminateIntentRowsTx,\n  listProvisionerTerminateIntents,\n  reapStaleProvisionedRunners,\n  reconcileProvisionedRunners,\n  reportProvisionedRunners,\n} from './provisioned-runners.js';\nexport type {CreateProvisionerTokenParams} from './provisioner-tokens.js';\nexport {\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  resolveProvisionerTokenByHash,\n  revokeProvisionerToken,\n  touchProvisionerLastSeen,\n} from './provisioner-tokens.js';\nexport {\n  consumeRunnersRateLimit,\n  pruneExpiredRunnersRateLimits,\n} from './rate-limits.js';\nexport type {\n  DemandStat,\n  PollDemandAndReserveParams,\n  ReservationGrant,\n  ReservationTemplate,\n} from './reservations.js';\nexport {\n  deleteExpiredReservations,\n  deleteReservationsByIds,\n  pollDemandAndReserve,\n  releaseReservationUnits,\n} from './reservations.js';\nexport type {\n  CreateRunnerSessionParams,\n  DeleteExpiredRunnerSessionsParams,\n} from './runner-sessions.js';\nexport {createRunnerSession, deleteExpiredRunnerSessions} from './runner-sessions.js';\nexport {runnersOutbox} from './schema/outbox.js';\n\nexport const migrationsPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../drizzle');\n"],"names":["dirname","resolve","fileURLToPath","closeDb","db","schema","createEphemeralRegistrationToken","createRunnerSessionConsumingEphemeralToken","deleteExpiredEphemeralRegistrationTokens","resolveEphemeralRegistrationTokenByHash","cancelRunnerJobs","claimPendingJobExecution","enqueueJobExecution","expireStuckJobExecutions","isJobLeaseActive","listActiveRunningJobExecutions","listRunningJobExecutionsByProvisionedRunnerTx","recordHeartbeat","releaseJobExecution","createManualRegistrationToken","listUsableManualRegistrationTokensByWorkspaceId","resolveManualRegistrationTokenByHash","revokeManualRegistrationToken","isTerminalState","listActiveProvisionedRunnerCountsByTemplateTx","listActiveProvisionedRunners","listProvisionerTerminateIntentRowsTx","listProvisionerTerminateIntents","reapStaleProvisionedRunners","reconcileProvisionedRunners","reportProvisionedRunners","createProvisionerToken","listActiveProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","resolveProvisionerTokenByHash","revokeProvisionerToken","touchProvisionerLastSeen","consumeRunnersRateLimit","pruneExpiredRunnersRateLimits","deleteExpiredReservations","deleteReservationsByIds","pollDemandAndReserve","releaseReservationUnits","createRunnerSession","deleteExpiredRunnerSessions","runnersOutbox","migrationsPath","url"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AAEvC,SAAQC,OAAO,EAAEC,EAAE,EAAEC,MAAM,QAAO,UAAU;AAK5C,SACEC,gCAAgC,EAChCC,0CAA0C,EAC1CC,wCAAwC,EACxCC,uCAAuC,QAClC,qCAAqC;AAM5C,SACEC,gBAAgB,EAChBC,wBAAwB,EACxBC,mBAAmB,EACnBC,wBAAwB,EACxBC,gBAAgB,EAChBC,8BAA8B,EAC9BC,6CAA6C,EAC7CC,eAAe,EACfC,mBAAmB,QACd,sBAAsB;AAE7B,SACEC,6BAA6B,EAC7BC,+CAA+C,EAC/CC,oCAAoC,EACpCC,6BAA6B,QACxB,kCAAkC;AAWzC,SACEC,eAAe,EACfC,6CAA6C,EAC7CC,4BAA4B,EAC5BC,oCAAoC,EACpCC,+BAA+B,EAC/BC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,wBAAwB,QACnB,2BAA2B;AAElC,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wCAAwC,EACxCC,6BAA6B,EAC7BC,sBAAsB,EACtBC,wBAAwB,QACnB,0BAA0B;AACjC,SACEC,uBAAuB,EACvBC,6BAA6B,QACxB,mBAAmB;AAO1B,SACEC,yBAAyB,EACzBC,uBAAuB,EACvBC,oBAAoB,EACpBC,uBAAuB,QAClB,oBAAoB;AAK3B,SAAQC,mBAAmB,EAAEC,2BAA2B,QAAO,uBAAuB;AACtF,SAAQC,aAAa,QAAO,qBAAqB;AAEjD,OAAO,MAAMC,iBAAiB7C,QAAQD,QAAQE,cAAc,YAAY6C,GAAG,IAAI,iBAAiB"}

package/dist/db/job-executions.d.ts

@@ -0,0 +1,128 @@
+import { type RunnerToolCapabilitiesDto } from '@shipfox/api-runners-dto';
+import type { Tx } from './db.js';
+export interface EnqueueJobExecutionParams {
+    workspaceId: string;
+    workflowRunId: string;
+    workflowRunAttemptId: string;
+    jobId: string;
+    jobExecutionId: string;
+    projectId: string;
+    requiredLabels: string[];
+}
+export declare function enqueueJobExecution(params: EnqueueJobExecutionParams): Promise<void>;
+export interface ClaimedJobExecution {
+    workflowRunId: string;
+    workflowRunAttemptId: string;
+    jobId: string;
+    jobExecutionId: string;
+    projectId: string;
+}
+export interface ActiveRunningJobExecution {
+    workflowRunId: string;
+    workflowRunAttemptId: string;
+    jobId: string;
+    jobExecutionId: string;
+    projectId: string;
+    runnerSessionId: string;
+    provisionerId: string | null;
+    provisionedRunnerId: string | null;
+    requiredLabels: string[];
+    runnerLabels: string[];
+    startedAt: Date;
+    lastHeartbeatAt: Date;
+}
+export interface ProvisionedRunnerBoundJobExecution {
+    workflowRunId: string;
+    workflowRunAttemptId: string;
+    jobId: string;
+    jobExecutionId: string;
+    provisionedRunnerId: string;
+    startedAt: Date;
+    lastHeartbeatAt: Date;
+    cancellationRequestedAt: Date | null;
+}
+export declare function claimPendingJobExecution(params: {
+    workspaceId: string;
+    runnerSessionId: string;
+    sessionLabels: string[];
+    maxClaims: number | null;
+    runnerSessionLivenessThrottleSeconds: number;
+}): Promise<ClaimedJobExecution | null>;
+/**
+ * Releases a job execution's lease when the orchestration workflow finalizes it: deletes the
+ * running-job-execution row AND any lingering pending row for the same execution, in one tx.
+ * Idempotent (0-row no-op), no token scope (the workflow is authoritative), and
+ * emits no event — the workflow already owns the outcome. Sweeping the pending row
+ * too closes the at-least-once window where an enqueue retry left an orphan that a
+ * later claim would otherwise pick up for an already-finished job execution.
+ */
+export declare function releaseJobExecution(params: {
+    jobExecutionId: string;
+}): Promise<void>;
+/**
+ * Reaps stale leases (bounded by `limit`), emitting one
+ * `runners.job.lease_expired` event per reaped job execution.
+ *
+ * The cutoff is re-checked in the DELETE, not just the locking subquery, so a
+ * heartbeat landing mid-call spares the live row. Each reaped execution also sweeps its
+ * pending row: a failed best-effort `releaseJobExecution` would otherwise leave an orphan
+ * that a later claim re-runs as an already-finished job execution.
+ *
+ * Locks running-then-pending, the inverse of `claimPendingJobExecution` / `releaseJobExecution`.
+ * That pre-existing asymmetry opens a narrow deadlock window against a concurrent
+ * claim of the same orphan-pending job execution; Postgres breaks it and the cron retries.
+ */
+export declare function expireStuckJobExecutions(params: {
+    thresholdSeconds: number;
+    noFirstHeartbeatGraceSeconds: number;
+    limit?: number;
+}): Promise<Array<{
+    workflowRunId: string;
+    workflowRunAttemptId: string;
+    jobId: string;
+    jobExecutionId: string;
+}>>;
+export declare function getJobExecutionQueueDepth(): Promise<{
+    pendingJobExecutions: number;
+    runningJobExecutions: number;
+}>;
+export declare function listActiveRunningJobExecutions(params: {
+    workspaceId: string;
+    windowSeconds: number;
+    limit?: number;
+}): Promise<ActiveRunningJobExecution[]>;
+export declare function listRunningJobExecutionsByProvisionedRunnerTx(tx: Tx, params: {
+    workspaceId: string;
+    provisionerId: string;
+    provisionedRunnerIds: string[];
+}): Promise<ProvisionedRunnerBoundJobExecution[]>;
+export declare function isJobLeaseActive(params: {
+    jobId?: string;
+    jobExecutionId: string;
+    runnerSessionId: string;
+}): Promise<boolean>;
+export declare function recordHeartbeat(params: {
+    jobExecutionId: string;
+    runnerSessionId: string;
+    toolCapabilities?: RunnerToolCapabilitiesDto | null;
+}): Promise<{
+    cancellationRequested: boolean;
+    previousToolCapabilities: RunnerToolCapabilitiesDto | null;
+    currentToolCapabilities: RunnerToolCapabilitiesDto | null;
+    runningJobExecution: {
+        workflowRunId: string;
+        workflowRunAttemptId: string;
+        jobId: string;
+        jobExecutionId: string;
+        projectId: string;
+        workspaceId: string;
+        runnerSessionId: string;
+    };
+}>;
+export declare function requestJobExecutionCancellation(params: {
+    jobExecutionId: string;
+}): Promise<void>;
+export declare function cancelRunnerJobs(params: {
+    jobIds: string[];
+}): Promise<void>;
+//# sourceMappingURL=job-executions.d.ts.map

package/dist/db/job-executions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-executions.d.ts","sourceRoot":"","sources":["../../src/db/job-executions.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,0BAA0B,CAAC;AA0BlC,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAOhC,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AASD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC1F;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kCAAkC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,IAAI,CAAC;IACtB,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oCAAoC,EAAE,MAAM,CAAC;CAC9C,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA+GtC;AAmBD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAazF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CACT,KAAK,CAAC;IACJ,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CACH,CAsEA;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC,CAOD;AAED,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAyBvC;AAED,wBAAsB,6CAA6C,CACjE,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC,GACA,OAAO,CAAC,kCAAkC,EAAE,CAAC,CA2E/C;AAMD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACrD,GAAG,OAAO,CAAC;IACV,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC3D,uBAAuB,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC1D,mBAAmB,EAAE;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC,CAoED;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhF"}