@shipfox/api-runners 4.0.0 → 6.0.0

package/src/core/runner-instances.ts

@@ -0,0 +1,310 @@
+import type {RunnerInstance, RunnerInstanceState} from '#core/entities/runner-instance.js';
+import {
+  attachProviderRunnerId as attachProviderRunnerIdDb,
+  createPlannedProvisionedCapacity as createPlannedProvisionedCapacityDb,
+  isTerminalState,
+  listActiveRunnerInstances,
+  listActiveRunningJobExecutions,
+  type RunnerInstanceReportEvent,
+  reconcileRunnerInstances as reconcileRunnerInstancesDb,
+  reportRunnerInstances as reportRunnerInstancesDb,
+} from '#db/index.js';
+import type {
+  ActiveRunningJobExecution,
+  RunnerInstanceBoundJobExecution,
+} from '#db/job-executions.js';
+import {
+  providerRunnerAbsentTerminatedCount,
+  providerRunnerReconcileCallCount,
+  providerRunnerReportCount,
+  providerRunnerTerminateIntentHonoredCount,
+  providerRunnerTerminateIntentIssuedCount,
+  reservationReleasedCount,
+} from '#metrics/instance.js';
+import {config} from '../config.js';
+
+export interface ReportRunnerInstancesParams {
+  workspaceId: string | null;
+  provisionerId: string;
+  events: RunnerInstanceReportEvent[];
+}
+
+export function createPlannedProvisionedCapacity(params: {
+  provisionerId: string;
+  providerKind: string | null;
+  templateKey: string | null;
+}): Promise<{capacityId: string}> {
+  return createPlannedProvisionedCapacityDb(params);
+}
+
+export function attachProviderRunnerId(params: {
+  capacityId: string;
+  provisionerId: string;
+  providerRunnerId: string;
+}): Promise<boolean> {
+  return attachProviderRunnerIdDb(params);
+}
+
+export interface ReportRunnerInstancesResult {
+  accepted: number;
+  reservationsReleased: number;
+}
+
+export interface ReconcileRunnerInstancesParams {
+  workspaceId: string | null;
+  provisionerId: string;
+  observedRunnerInstanceIds: string[];
+}
+
+export type ReconcileDesiredIntent = 'keep' | 'terminate';
+type ReconcileDesiredIntentReason = 'job-cancelled' | 'terminal-state';
+
+export interface ReconciledBoundJobExecution {
+  jobId: string;
+  jobExecutionId: string;
+  workflowRunAttemptId: string;
+  lastHeartbeatAt: Date;
+  cancellationRequestedAt: Date | null;
+}
+
+export interface ReconciledRunnerInstance {
+  providerRunnerId: string;
+  state: RunnerInstanceState | null;
+  reservationId: string | null;
+  runnerSessionId: string | null;
+  boundJobExecution: ReconciledBoundJobExecution | null;
+  desiredIntent: ReconcileDesiredIntent;
+  desiredIntentReason: ReconcileDesiredIntentReason | null;
+}
+
+export interface ReconcileRunnerInstancesResult {
+  runners: ReconciledRunnerInstance[];
+  terminatedAbsentRunnerInstanceIds: string[];
+}
+
+export type ActiveRunnerState = 'starting' | 'running' | 'stopping' | 'busy';
+
+export interface ActiveRunner {
+  runnerSessionId: string | null;
+  providerRunnerId: string | null;
+  provisionerId: string | null;
+  state: ActiveRunnerState;
+  labels: string[];
+  templateKey: string | null;
+  providerKind: string | null;
+  jobId: string | null;
+  workflowRunAttemptId: string | null;
+  projectId: string | null;
+  reportedAt: Date | null;
+  lastHeartbeatAt: Date | null;
+}
+
+export async function reportRunnerInstances(
+  params: ReportRunnerInstancesParams,
+): Promise<ReportRunnerInstancesResult> {
+  const result = await reportRunnerInstancesDb(params);
+
+  for (const event of params.events) {
+    providerRunnerReportCount.add(1, {state: event.state});
+  }
+  for (const intent of result.terminateIntentsHonored) {
+    providerRunnerTerminateIntentHonoredCount.add(1, {reason: intent.reason});
+  }
+  if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);
+
+  return result;
+}
+
+export async function reconcileRunnerInstances(
+  params: ReconcileRunnerInstancesParams,
+): Promise<ReconcileRunnerInstancesResult> {
+  const result = await reconcileRunnerInstancesDb({
+    ...params,
+    terminateGraceSeconds: config.RUNNER_RECONCILE_TERMINATE_GRACE_SECONDS,
+  });
+
+  if (result.reservationsReleased > 0) reservationReleasedCount.add(result.reservationsReleased);
+  providerRunnerReconcileCallCount.add(1);
+  if (result.absentIds.length > 0) providerRunnerAbsentTerminatedCount.add(result.absentIds.length);
+
+  const runners = reconcileRunnerInstancesFromDbResult({
+    observedRunnerInstanceIds: params.observedRunnerInstanceIds,
+    observedRows: result.observedRows,
+    boundJobExecutionsByRunnerInstanceId: result.boundJobExecutionsByRunnerInstanceId,
+  });
+  for (const runner of runners) {
+    if (runner.desiredIntentReason) {
+      providerRunnerTerminateIntentIssuedCount.add(1, {
+        surface: 'reconcile',
+        reason: runner.desiredIntentReason,
+      });
+    }
+  }
+
+  return {
+    runners,
+    terminatedAbsentRunnerInstanceIds: result.absentIds,
+  };
+}
+
+export function reconcileRunnerInstancesFromDbResult(params: {
+  observedRunnerInstanceIds: string[];
+  observedRows: RunnerInstance[];
+  boundJobExecutionsByRunnerInstanceId: Map<string, RunnerInstanceBoundJobExecution>;
+}): ReconciledRunnerInstance[] {
+  const rowsByRunnerInstanceId = new Map(
+    params.observedRows.map((row) => [row.providerRunnerId, row]),
+  );
+
+  return params.observedRunnerInstanceIds.map((providerRunnerId) => {
+    const row = rowsByRunnerInstanceId.get(providerRunnerId);
+    const boundJobExecution = params.boundJobExecutionsByRunnerInstanceId.get(providerRunnerId);
+
+    const desiredIntentReason = getDesiredIntentReason(row, boundJobExecution);
+
+    return {
+      providerRunnerId,
+      state: row?.state ?? null,
+      reservationId: row?.reservationId ?? null,
+      runnerSessionId: row?.runnerSessionId ?? null,
+      boundJobExecution: boundJobExecution
+        ? toReconciledBoundJobExecution(boundJobExecution)
+        : null,
+      desiredIntent: desiredIntentReason ? 'terminate' : 'keep',
+      desiredIntentReason,
+    };
+  });
+}
+
+export async function listActiveRunners(params: {workspaceId: string}): Promise<ActiveRunner[]> {
+  const [providerRunnerRows, jobExecutionRows] = await Promise.all([
+    listActiveRunnerInstances({
+      workspaceId: params.workspaceId,
+      windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS,
+    }),
+    listActiveRunningJobExecutions({
+      workspaceId: params.workspaceId,
+      windowSeconds: config.RUNNER_ACTIVE_WINDOW_SECONDS,
+    }),
+  ]);
+
+  return mergeActiveRunners(providerRunnerRows, jobExecutionRows);
+}
+
+function toReconciledBoundJobExecution(
+  jobExecution: RunnerInstanceBoundJobExecution,
+): ReconciledBoundJobExecution {
+  return {
+    jobId: jobExecution.jobId,
+    jobExecutionId: jobExecution.jobExecutionId,
+    workflowRunAttemptId: jobExecution.workflowRunAttemptId,
+    lastHeartbeatAt: jobExecution.lastHeartbeatAt,
+    cancellationRequestedAt: jobExecution.cancellationRequestedAt,
+  };
+}
+
+export function desiredIntent(
+  row: RunnerInstance | undefined,
+  boundJobExecution: RunnerInstanceBoundJobExecution | undefined,
+): ReconcileDesiredIntent {
+  return getDesiredIntentReason(row, boundJobExecution) ? 'terminate' : 'keep';
+}
+
+function getDesiredIntentReason(
+  row: RunnerInstance | undefined,
+  boundJobExecution: RunnerInstanceBoundJobExecution | undefined,
+): ReconcileDesiredIntentReason | null {
+  if (!row) return null;
+  if (isTerminalState(row.state)) return 'terminal-state';
+  if (boundJobExecution?.cancellationRequestedAt) return 'job-cancelled';
+  return null;
+}
+
+function mergeActiveRunners(
+  providerRunners: RunnerInstance[],
+  jobExecutions: ActiveRunningJobExecution[],
+): ActiveRunner[] {
+  const jobExecutionsByRunnerSessionId = new Map<string, ActiveRunningJobExecution[]>();
+  const jobExecutionsByRunnerInstanceId = new Map<string, ActiveRunningJobExecution[]>();
+  for (const jobExecution of jobExecutions) {
+    const runnerJobExecutions =
+      jobExecutionsByRunnerSessionId.get(jobExecution.runnerSessionId) ?? [];
+    runnerJobExecutions.push(jobExecution);
+    jobExecutionsByRunnerSessionId.set(jobExecution.runnerSessionId, runnerJobExecutions);
+
+    if (jobExecution.provisionerId && jobExecution.providerRunnerId) {
+      const key = providerRunnerKey(jobExecution.provisionerId, jobExecution.providerRunnerId);
+      const providerRunnerJobExecutions = jobExecutionsByRunnerInstanceId.get(key) ?? [];
+      providerRunnerJobExecutions.push(jobExecution);
+      jobExecutionsByRunnerInstanceId.set(key, providerRunnerJobExecutions);
+    }
+  }
+
+  const merged: ActiveRunner[] = [];
+  const usedJobExecutionIds = new Set<string>();
+
+  for (const providerRunner of providerRunners) {
+    const providerRunnerJobExecutions =
+      jobExecutionsByRunnerInstanceId.get(
+        providerRunnerKey(providerRunner.provisionerId, providerRunner.providerRunnerId),
+      ) ??
+      (providerRunner.runnerSessionId
+        ? jobExecutionsByRunnerSessionId.get(providerRunner.runnerSessionId)
+        : undefined);
+    if (!providerRunnerJobExecutions || providerRunnerJobExecutions.length === 0) {
+      merged.push(toActiveRunner(providerRunner, undefined));
+      continue;
+    }
+
+    let emitted = false;
+    for (const jobExecution of providerRunnerJobExecutions) {
+      if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;
+      usedJobExecutionIds.add(jobExecution.jobExecutionId);
+      merged.push(toActiveRunner(providerRunner, jobExecution));
+      emitted = true;
+    }
+    if (!emitted) merged.push(toActiveRunner(providerRunner, undefined));
+  }
+
+  for (const jobExecution of jobExecutions) {
+    if (usedJobExecutionIds.has(jobExecution.jobExecutionId)) continue;
+    merged.push(toActiveRunner(undefined, jobExecution));
+  }
+
+  return merged.sort(compareActiveRunners);
+}
+
+function providerRunnerKey(provisionerId: string, providerRunnerId: string): string {
+  return `${provisionerId}:${providerRunnerId}`;
+}
+
+function toActiveRunner(
+  providerRunner: RunnerInstance | undefined,
+  jobExecution: ActiveRunningJobExecution | undefined,
+): ActiveRunner {
+  return {
+    runnerSessionId: providerRunner?.runnerSessionId ?? jobExecution?.runnerSessionId ?? null,
+    providerRunnerId: providerRunner?.providerRunnerId ?? jobExecution?.providerRunnerId ?? null,
+    provisionerId: providerRunner?.provisionerId ?? jobExecution?.provisionerId ?? null,
+    state: jobExecution ? 'busy' : toActiveRunnerState(providerRunner?.state ?? 'running'),
+    labels: providerRunner?.labels ?? jobExecution?.runnerLabels ?? [],
+    templateKey: providerRunner?.templateKey ?? null,
+    providerKind: providerRunner?.providerKind ?? null,
+    jobId: jobExecution?.jobId ?? null,
+    workflowRunAttemptId: jobExecution?.workflowRunAttemptId ?? null,
+    projectId: jobExecution?.projectId ?? null,
+    reportedAt: providerRunner?.reportedAt ?? null,
+    lastHeartbeatAt: jobExecution?.lastHeartbeatAt ?? null,
+  };
+}
+
+function toActiveRunnerState(state: RunnerInstanceState): ActiveRunnerState {
+  if (state === 'starting' || state === 'stopping') return state;
+  return 'running';
+}
+
+function compareActiveRunners(a: ActiveRunner, b: ActiveRunner): number {
+  const aTime = Math.max(a.lastHeartbeatAt?.getTime() ?? 0, a.reportedAt?.getTime() ?? 0);
+  const bTime = Math.max(b.lastHeartbeatAt?.getTime() ?? 0, b.reportedAt?.getTime() ?? 0);
+  return bTime - aTime;
+}

package/src/core/runner-sessions.test.ts

@@ -2,18 +2,21 @@ import {verifyRunnerSessionToken} from '@shipfox/api-auth';
 import {and, eq} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {ephemeralRegistrationTokens} from '#db/schema/ephemeral-registration-tokens.js';
-import {provisionedRunners} from '#db/schema/provisioned-runners.js';
+import {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
 import {runnerSessions} from '#db/schema/runner-sessions.js';
 import {
   ephemeralRegistrationTokenFactory,
   manualRegistrationTokenFactory,
-  provisionedRunnerFactory,
+  providerRunnerFactory,
+  runnersTestAuthClient,
 } from '#test/index.js';
 import {
   EmptyRunnerLabelsError,
   RegistrationTokenConsumedError,
   RegistrationTokenWorkspaceMismatchError,
 } from './errors.js';
+import {issueRunnerActivationToken} from './runner-activation.js';
 import {registerRunnerSession} from './runner-sessions.js';
 
 describe('registerRunnerSession', () => {
@@ -28,6 +31,7 @@ describe('registerRunnerSession', () => {
 
   it('canonicalizes labels, stores them, and embeds them in the session token', async () => {
     const result = await registerRunnerSession({
+      auth: runnersTestAuthClient,
       credential: {kind: 'manual', registrationTokenId, workspaceId},
       labels: [' Linux ', 'x64', 'linux'],
     });
@@ -37,7 +41,7 @@ describe('registerRunnerSession', () => {
     expect(result.session.labels).toEqual(['linux', 'x64']);
     expect(result.session.registrationTokenKind).toBe('manual');
     expect(result.session.provisionerId).toBeNull();
-    expect(result.session.provisionedRunnerId).toBeNull();
+    expect(result.session.providerRunnerId).toBeNull();
     expect(result.session.maxClaims).toBeNull();
     expect(result.session.claimsUsed).toBe(0);
 
@@ -55,6 +59,7 @@ describe('registerRunnerSession', () => {
   it('throws EmptyRunnerLabelsError when labels canonicalize to empty', async () => {
     await expect(
       registerRunnerSession({
+        auth: runnersTestAuthClient,
         credential: {kind: 'manual', registrationTokenId, workspaceId},
         labels: [' ', '\t'],
       }),
@@ -65,13 +70,14 @@ describe('registerRunnerSession', () => {
     const token = await ephemeralRegistrationTokenFactory.create({workspaceId});
 
     const result = await registerRunnerSession({
+      auth: runnersTestAuthClient,
       credential: {
         kind: 'ephemeral',
         ephemeralTokenId: token.id,
         workspaceId,
         provisionerId: token.provisionerId,
         reservationId: token.reservationId,
-        provisionedRunnerId: token.provisionedRunnerId,
+        providerRunnerId: token.providerRunnerId,
       },
       labels: [' Linux ', 'x64'],
     });
@@ -80,7 +86,7 @@ describe('registerRunnerSession', () => {
     expect(result.maxClaims).toBe(1);
     expect(result.session.registrationTokenKind).toBe('ephemeral');
     expect(result.session.provisionerId).toBe(token.provisionerId);
-    expect(result.session.provisionedRunnerId).toBe(token.provisionedRunnerId);
+    expect(result.session.providerRunnerId).toBe(token.providerRunnerId);
     expect(result.session.maxClaims).toBe(1);
     expect(result.session.claimsUsed).toBe(0);
 
@@ -96,7 +102,7 @@ describe('registerRunnerSession', () => {
       .from(runnerSessions)
       .where(eq(runnerSessions.id, result.session.id));
     expect(session?.provisionerId).toBe(token.provisionerId);
-    expect(session?.provisionedRunnerId).toBe(token.provisionedRunnerId);
+    expect(session?.providerRunnerId).toBe(token.providerRunnerId);
 
     const claims = await verifyRunnerSessionToken(result.sessionToken);
     expect(claims?.maxClaims).toBe(1);
@@ -104,37 +110,38 @@ describe('registerRunnerSession', () => {
 
   it('links an existing provisioned runner row when consuming an ephemeral token', async () => {
     const token = await ephemeralRegistrationTokenFactory.create({workspaceId});
-    await provisionedRunnerFactory.create({
+    await providerRunnerFactory.create({
       workspaceId,
       provisionerId: token.provisionerId,
-      provisionedRunnerId: token.provisionedRunnerId,
+      providerRunnerId: token.providerRunnerId,
       runnerSessionId: null,
       state: 'starting',
     });
 
     const result = await registerRunnerSession({
+      auth: runnersTestAuthClient,
       credential: {
         kind: 'ephemeral',
         ephemeralTokenId: token.id,
         workspaceId,
         provisionerId: token.provisionerId,
         reservationId: token.reservationId,
-        provisionedRunnerId: token.provisionedRunnerId,
+        providerRunnerId: token.providerRunnerId,
       },
       labels: ['linux'],
     });
 
-    const [provisionedRunner] = await db()
+    const [providerRunner] = await db()
       .select()
-      .from(provisionedRunners)
+      .from(providerRunners)
       .where(
         and(
-          eq(provisionedRunners.workspaceId, workspaceId),
-          eq(provisionedRunners.provisionerId, token.provisionerId),
-          eq(provisionedRunners.provisionedRunnerId, token.provisionedRunnerId),
+          eq(providerRunners.workspaceId, workspaceId),
+          eq(providerRunners.provisionerId, token.provisionerId),
+          eq(providerRunners.providerRunnerId, token.providerRunnerId),
         ),
       );
-    expect(provisionedRunner?.runnerSessionId).toBe(result.session.id);
+    expect(providerRunner?.runnerSessionId).toBe(result.session.id);
   });
 
   it('rejects a second consume of the same ephemeral token', async () => {
@@ -145,14 +152,14 @@ describe('registerRunnerSession', () => {
       workspaceId,
       provisionerId: token.provisionerId,
       reservationId: token.reservationId,
-      provisionedRunnerId: token.provisionedRunnerId,
+      providerRunnerId: token.providerRunnerId,
     };
 
-    await registerRunnerSession({credential, labels: ['linux']});
+    await registerRunnerSession({auth: runnersTestAuthClient, credential, labels: ['linux']});
 
-    await expect(registerRunnerSession({credential, labels: ['linux']})).rejects.toBeInstanceOf(
-      RegistrationTokenConsumedError,
-    );
+    await expect(
+      registerRunnerSession({auth: runnersTestAuthClient, credential, labels: ['linux']}),
+    ).rejects.toBeInstanceOf(RegistrationTokenConsumedError);
   });
 
   it('rejects consuming an ephemeral token for a different workspace', async () => {
@@ -160,13 +167,14 @@ describe('registerRunnerSession', () => {
 
     await expect(
       registerRunnerSession({
+        auth: runnersTestAuthClient,
         credential: {
           kind: 'ephemeral',
           ephemeralTokenId: token.id,
           workspaceId: crypto.randomUUID(),
           provisionerId: token.provisionerId,
           reservationId: token.reservationId,
-          provisionedRunnerId: token.provisionedRunnerId,
+          providerRunnerId: token.providerRunnerId,
         },
         labels: ['linux'],
       }),
@@ -183,7 +191,7 @@ describe('registerRunnerSession', () => {
           registrationTokenId: crypto.randomUUID(),
           registrationTokenKind: 'ephemeral',
           provisionerId: crypto.randomUUID(),
-          provisionedRunnerId: `provisioned-runner-${crypto.randomUUID()}`,
+          providerRunnerId: `provisioned-runner-${crypto.randomUUID()}`,
           labels: ['linux'],
           maxClaims: null,
           claimsUsed: 0,
@@ -207,3 +215,85 @@ describe('registerRunnerSession', () => {
     ).rejects.toThrow();
   });
 });
+
+describe('activation runner sessions', () => {
+  let workspaceId: string;
+  let provisionerId: string;
+  let runnerInstanceId: string;
+
+  beforeEach(async () => {
+    workspaceId = crypto.randomUUID();
+    provisionerId = crypto.randomUUID();
+    const runner = await providerRunnerFactory.create({workspaceId, provisionerId});
+    runnerInstanceId = runner.id;
+  });
+
+  it('replaces an unconsumed activation token when assignment delivery is retried', async () => {
+    const firstToken = await issueRunnerActivationToken({
+      runnerInstanceId,
+      provisionerId,
+      ttlSeconds: 60,
+    });
+    const replacementToken = await issueRunnerActivationToken({
+      runnerInstanceId,
+      provisionerId,
+      ttlSeconds: 60,
+    });
+
+    const tokens = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.runnerInstanceId, runnerInstanceId));
+
+    expect(firstToken).not.toBeNull();
+    expect(replacementToken).not.toBeNull();
+    expect(replacementToken).not.toBe(firstToken);
+    expect(tokens).toHaveLength(2);
+    expect(tokens.filter((token) => token.revokedAt === null)).toHaveLength(1);
+    expect(tokens.filter((token) => token.revokedAt !== null)).toHaveLength(1);
+  });
+
+  it('allows only one concurrent registration to consume an activation token', async () => {
+    const rawToken = await issueRunnerActivationToken({
+      runnerInstanceId,
+      provisionerId,
+      ttlSeconds: 60,
+    });
+    const [activationToken] = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.runnerInstanceId, runnerInstanceId));
+    if (!rawToken || !activationToken) throw new Error('Activation token was not created');
+
+    const registrations = await Promise.allSettled([
+      registerRunnerSession({
+        auth: runnersTestAuthClient,
+        credential: {kind: 'activation', activationTokenId: activationToken.id, workspaceId},
+        labels: ['linux'],
+      }),
+      registerRunnerSession({
+        auth: runnersTestAuthClient,
+        credential: {kind: 'activation', activationTokenId: activationToken.id, workspaceId},
+        labels: ['linux'],
+      }),
+    ]);
+
+    const [storedToken] = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.id, activationToken.id));
+    const sessions = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.runnerInstanceId, runnerInstanceId));
+
+    expect(
+      registrations.filter((registration) => registration.status === 'fulfilled'),
+    ).toHaveLength(1);
+    expect(registrations.filter((registration) => registration.status === 'rejected')).toHaveLength(
+      1,
+    );
+    expect(storedToken?.consumedAt).toBeInstanceOf(Date);
+    expect(sessions).toHaveLength(1);
+  });
+});

package/src/core/runner-sessions.ts

@@ -1,15 +1,18 @@
-import {issueRunnerSessionToken} from '@shipfox/api-auth';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
 import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';
 import {canonicalizeLabels} from '@shipfox/runner-labels';
 import {createRunnerSessionConsumingEphemeralToken} from '#db/ephemeral-registration-tokens.js';
-import {createRunnerSession} from '#db/runner-sessions.js';
+import {
+  createRunnerSession,
+  createRunnerSessionConsumingActivationToken,
+} from '#db/runner-sessions.js';
 import type {RunnerSession} from './entities/runner-session.js';
 import {EmptyRunnerLabelsError} from './errors.js';
 
 export interface RegisterRunnerSessionResult {
   session: RunnerSession;
   sessionToken: string;
-  mode: 'manual' | 'ephemeral';
+  mode: 'manual' | 'ephemeral' | 'activation';
   maxClaims: number | null;
 }
 
@@ -25,10 +28,12 @@ export type RunnerRegistrationCredential =
       workspaceId: string;
       provisionerId: string;
       reservationId: string | null;
-      provisionedRunnerId: string;
-    };
+      providerRunnerId: string;
+    }
+  | {kind: 'activation'; activationTokenId: string; workspaceId: string};
 
 export async function registerRunnerSession(params: {
+  auth: AuthInterModuleClient;
   credential: RunnerRegistrationCredential;
   labels: string[];
   toolCapabilities?: RunnerToolCapabilitiesDto | null;
@@ -37,7 +42,7 @@ export async function registerRunnerSession(params: {
   if (labels.length === 0) throw new EmptyRunnerLabelsError();
 
   const mode = params.credential.kind;
-  const maxClaims = params.credential.kind === 'ephemeral' ? 1 : null;
+  const maxClaims = params.credential.kind === 'manual' ? null : 1;
   const session =
     params.credential.kind === 'manual'
       ? await createRunnerSession({
@@ -47,14 +52,20 @@ export async function registerRunnerSession(params: {
           labels,
           toolCapabilities: params.toolCapabilities ?? null,
         })
-      : await createRunnerSessionConsumingEphemeralToken({
-          ephemeralTokenId: params.credential.ephemeralTokenId,
-          workspaceId: params.credential.workspaceId,
-          labels,
-          toolCapabilities: params.toolCapabilities ?? null,
-          maxClaims: 1,
-        });
-  const sessionToken = await issueRunnerSessionToken({
+      : params.credential.kind === 'ephemeral'
+        ? await createRunnerSessionConsumingEphemeralToken({
+            ephemeralTokenId: params.credential.ephemeralTokenId,
+            workspaceId: params.credential.workspaceId,
+            labels,
+            toolCapabilities: params.toolCapabilities ?? null,
+            maxClaims: 1,
+          })
+        : await createRunnerSessionConsumingActivationToken({
+            activationTokenId: params.credential.activationTokenId,
+            labels,
+            toolCapabilities: params.toolCapabilities ?? null,
+          });
+  const {token: sessionToken} = await params.auth.mintRunnerSessionToken({
     runnerSessionId: session.id,
     workspaceId: session.workspaceId,
     scope: session.scope,