@shipfox/api-runners 5.0.0 → 6.0.0

package/src/core/ephemeral-registration-tokens.test.ts

@@ -13,7 +13,7 @@ describe('mintEphemeralRegistrationToken', () => {
     const result = await mintEphemeralRegistrationToken({
       workspaceId,
       provisionerId,
-      provisionedRunnerId: 'gh-runner-7',
+      providerRunnerId: 'gh-runner-7',
       ttlSeconds: 600,
     });
 
@@ -22,7 +22,7 @@ describe('mintEphemeralRegistrationToken', () => {
     );
     expect(result.token.workspaceId).toBe(workspaceId);
     expect(result.token.provisionerId).toBe(provisionerId);
-    expect(result.token.provisionedRunnerId).toBe('gh-runner-7');
+    expect(result.token.providerRunnerId).toBe('gh-runner-7');
     expect(result.token.reservationId).toBeNull();
     expect(result.token.prefix).toBe(result.rawToken.slice(0, 12));
     const [row] = await db()
@@ -40,7 +40,7 @@ describe('mintEphemeralRegistrationToken', () => {
     const result = await mintEphemeralRegistrationToken({
       workspaceId: crypto.randomUUID(),
       provisionerId: crypto.randomUUID(),
-      provisionedRunnerId: 'gh-runner-7',
+      providerRunnerId: 'gh-runner-7',
       ttlSeconds,
     });
 
@@ -56,7 +56,7 @@ describe('mintEphemeralRegistrationToken', () => {
     const result = await mintEphemeralRegistrationToken({
       workspaceId: crypto.randomUUID(),
       provisionerId: crypto.randomUUID(),
-      provisionedRunnerId: 'gh-runner-7',
+      providerRunnerId: 'gh-runner-7',
       reservationId,
       ttlSeconds: 600,
     });
@@ -67,11 +67,11 @@ describe('mintEphemeralRegistrationToken', () => {
   it('rejects a second active token for the same provisioned runner', async () => {
     const workspaceId = crypto.randomUUID();
     const provisionerId = crypto.randomUUID();
-    const provisionedRunnerId = 'gh-runner-7';
+    const providerRunnerId = 'gh-runner-7';
     await mintEphemeralRegistrationToken({
       workspaceId,
       provisionerId,
-      provisionedRunnerId,
+      providerRunnerId,
       ttlSeconds: 600,
     });
 
@@ -79,7 +79,7 @@ describe('mintEphemeralRegistrationToken', () => {
       mintEphemeralRegistrationToken({
         workspaceId,
         provisionerId,
-        provisionedRunnerId,
+        providerRunnerId,
         ttlSeconds: 600,
       }),
     ).rejects.toBeInstanceOf(ActiveEphemeralRegistrationTokenExistsError);
@@ -88,21 +88,21 @@ describe('mintEphemeralRegistrationToken', () => {
   it('allows minting a replacement after the previous token expires', async () => {
     const workspaceId = crypto.randomUUID();
     const provisionerId = crypto.randomUUID();
-    const provisionedRunnerId = 'gh-runner-7';
+    const providerRunnerId = 'gh-runner-7';
     await mintEphemeralRegistrationToken({
       workspaceId,
       provisionerId,
-      provisionedRunnerId,
+      providerRunnerId,
       ttlSeconds: -1,
     });
 
     const replacement = await mintEphemeralRegistrationToken({
       workspaceId,
       provisionerId,
-      provisionedRunnerId,
+      providerRunnerId,
       ttlSeconds: 600,
     });
 
-    expect(replacement.token.provisionedRunnerId).toBe(provisionedRunnerId);
+    expect(replacement.token.providerRunnerId).toBe(providerRunnerId);
   });
 });

package/src/core/ephemeral-registration-tokens.ts

@@ -9,7 +9,7 @@ import {RegistrationTokenBatchTooLargeError} from './errors.js';
 export interface MintEphemeralRegistrationTokenParams {
   workspaceId: string;
   provisionerId: string;
-  provisionedRunnerId: string;
+  providerRunnerId: string;
   reservationId?: string | null | undefined;
   ttlSeconds: number;
 }
@@ -19,21 +19,21 @@ export interface MintEphemeralRegistrationTokenResult {
   rawToken: string;
 }
 
-export interface MintEphemeralRegistrationTokensBatchProvisionedRunner {
-  provisionedRunnerId: string;
+export interface MintEphemeralRegistrationTokensBatchRunnerInstance {
+  providerRunnerId: string;
 }
 
 export interface MintEphemeralRegistrationTokensBatchParams {
   workspaceId: string;
   provisionerId: string;
   reservationId: string;
-  provisionedRunners: MintEphemeralRegistrationTokensBatchProvisionedRunner[];
+  providerRunners: MintEphemeralRegistrationTokensBatchRunnerInstance[];
   ttlSeconds: number;
   maxBatchSize: number;
 }
 
 export interface MintEphemeralRegistrationTokensBatchResult {
-  provisionedRunnerId: string;
+  providerRunnerId: string;
   token: EphemeralRegistrationToken;
   rawToken: string;
 }
@@ -42,12 +42,12 @@ export async function mintEphemeralRegistrationToken(
   params: MintEphemeralRegistrationTokenParams,
 ): Promise<MintEphemeralRegistrationTokenResult> {
   const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);
-  const row = buildEphemeralTokenRow(params.provisionedRunnerId, expiresAt);
+  const row = buildEphemeralTokenRow(params.providerRunnerId, expiresAt);
   const token = await createEphemeralRegistrationToken({
     workspaceId: params.workspaceId,
     provisionerId: params.provisionerId,
     reservationId: params.reservationId ?? null,
-    provisionedRunnerId: params.provisionedRunnerId,
+    providerRunnerId: params.providerRunnerId,
     hashedToken: row.hashedToken,
     prefix: row.prefix,
     expiresAt: row.expiresAt,
@@ -59,16 +59,16 @@ export async function mintEphemeralRegistrationToken(
 export async function mintEphemeralRegistrationTokensBatch(
   params: MintEphemeralRegistrationTokensBatchParams,
 ): Promise<MintEphemeralRegistrationTokensBatchResult[]> {
-  if (params.provisionedRunners.length > params.maxBatchSize) {
+  if (params.providerRunners.length > params.maxBatchSize) {
     throw new RegistrationTokenBatchTooLargeError(
-      params.provisionedRunners.length,
+      params.providerRunners.length,
       params.maxBatchSize,
     );
   }
 
   const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);
-  const rows = params.provisionedRunners.map((provisionedRunner) =>
-    buildEphemeralTokenRow(provisionedRunner.provisionedRunnerId, expiresAt),
+  const rows = params.providerRunners.map((providerRunner) =>
+    buildEphemeralTokenRow(providerRunner.providerRunnerId, expiresAt),
   );
   const tokens = await createEphemeralRegistrationTokensBatch({
     workspaceId: params.workspaceId,
@@ -77,33 +77,31 @@ export async function mintEphemeralRegistrationTokensBatch(
     expiresAt,
     rows,
   });
-  const tokensByProvisionedRunnerId = new Map(
-    tokens.map((token) => [token.provisionedRunnerId, token]),
-  );
+  const tokensByRunnerInstanceId = new Map(tokens.map((token) => [token.providerRunnerId, token]));
 
   return rows.map((row) => {
-    const token = tokensByProvisionedRunnerId.get(row.provisionedRunnerId);
+    const token = tokensByRunnerInstanceId.get(row.providerRunnerId);
     if (!token) {
       throw new Error(
-        `Inserted token not returned for provisioned runner: ${row.provisionedRunnerId}`,
+        `Inserted token not returned for provisioned runner: ${row.providerRunnerId}`,
       );
     }
-    return {provisionedRunnerId: row.provisionedRunnerId, rawToken: row.rawToken, token};
+    return {providerRunnerId: row.providerRunnerId, rawToken: row.rawToken, token};
   });
 }
 
 interface EphemeralTokenRow {
-  provisionedRunnerId: string;
+  providerRunnerId: string;
   rawToken: string;
   hashedToken: string;
   prefix: string;
   expiresAt: Date;
 }
 
-function buildEphemeralTokenRow(provisionedRunnerId: string, expiresAt: Date): EphemeralTokenRow {
+function buildEphemeralTokenRow(providerRunnerId: string, expiresAt: Date): EphemeralTokenRow {
   const rawToken = generateOpaqueToken('ephemeralRegistrationToken');
   return {
-    provisionedRunnerId,
+    providerRunnerId,
     rawToken,
     hashedToken: hashOpaqueToken(rawToken),
     prefix: extractDisplayPrefix(rawToken),

package/src/core/errors.ts

@@ -63,10 +63,10 @@ export class ActiveEphemeralRegistrationTokenExistsError extends Error {
   constructor(
     public readonly workspaceId: string,
     public readonly provisionerId: string,
-    public readonly provisionedRunnerId: string,
+    public readonly providerRunnerId: string,
   ) {
     super(
-      `Active ephemeral registration token already exists for provisioned runner ${provisionedRunnerId} in workspace ${workspaceId}`,
+      `Active ephemeral registration token already exists for provisioned runner ${providerRunnerId} in workspace ${workspaceId}`,
     );
     this.name = 'ActiveEphemeralRegistrationTokenExistsError';
   }
@@ -86,6 +86,25 @@ export class ReservationExpiredError extends Error {
   }
 }
 
+export class CapacityNotAssignableError extends Error {
+  constructor(public readonly capacityId: string) {
+    super(`Capacity cannot be assigned: ${capacityId}`);
+    this.name = 'CapacityNotAssignableError';
+  }
+}
+export class CapacityAlreadyAssignedError extends Error {
+  constructor(public readonly capacityId: string) {
+    super(`Capacity is already assigned: ${capacityId}`);
+    this.name = 'CapacityAlreadyAssignedError';
+  }
+}
+export class ReservationAlreadyAssignedError extends Error {
+  constructor(public readonly reservationId: string) {
+    super(`Reservation is already assigned: ${reservationId}`);
+    this.name = 'ReservationAlreadyAssignedError';
+  }
+}
+
 export class RegistrationTokenBatchTooLargeError extends Error {
   constructor(
     public readonly requested: number,
@@ -112,9 +131,9 @@ export class RegistrationTokenBatchExceedsReservationError extends Error {
 }
 
 export class ActiveEphemeralRegistrationTokensExistError extends Error {
-  constructor(public readonly provisionedRunnerIds: string[]) {
+  constructor(public readonly providerRunnerIds: string[]) {
     super(
-      `Active ephemeral registration tokens already exist for provisioned runners: ${provisionedRunnerIds.join(', ')}`,
+      `Active ephemeral registration tokens already exist for provisioned runners: ${providerRunnerIds.join(', ')}`,
     );
     this.name = 'ActiveEphemeralRegistrationTokensExistError';
   }

package/src/core/index.ts

@@ -1,10 +1,17 @@
+export {assignCapacityBatch} from './capacity-assignments.js';
+export type {CapacityAssignment} from './entities/capacity-assignment.js';
 export type {EphemeralRegistrationToken} from './entities/ephemeral-registration-token.js';
 export type {ManualRegistrationToken} from './entities/manual-registration-token.js';
+export type {ProvisionerCapabilitySnapshot} from './entities/provisioner-capability-snapshot.js';
 export type {
-  ProvisionedRunner,
-  ProvisionedRunnerState,
-} from './entities/provisioned-runner.js';
-export type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';
+  ActiveProvisionerToken,
+  ProvisionerScope,
+  ProvisionerToken,
+} from './entities/provisioner-token.js';
+export type {
+  RunnerInstance,
+  RunnerInstanceState,
+} from './entities/runner-instance.js';
 export type {RunnerSession} from './entities/runner-session.js';
 export {
   type MintEphemeralRegistrationTokenParams,
@@ -26,25 +33,40 @@ export {
   listUsableManualRegistrationTokens,
   revokeWorkspaceManualRegistrationToken,
 } from './manual-registration-tokens.js';
+export {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';
 export {
-  type ActiveRunner,
-  listActiveRunners,
-  type ReconcileDesiredIntent,
-  type ReconciledBoundJobExecution,
-  type ReconciledProvisionedRunner,
-  type ReconcileProvisionedRunnersParams,
-  type ReconcileProvisionedRunnersResult,
-  type ReportProvisionedRunnersParams,
-  type ReportProvisionedRunnersResult,
-  reconcileProvisionedRunners,
-  reportProvisionedRunners,
-} from './provisioned-runners.js';
-export {
+  createInstallationProvisionerToken,
   createWorkspaceProvisionerToken,
   listActiveProvisioners,
   listUsableProvisionerTokens,
+  revokeInstallationProvisionerToken,
   revokeWorkspaceProvisionerToken,
 } from './provisioner-tokens.js';
+export {getRunnerAssignment, issueRunnerActivationToken} from './runner-activation.js';
+export {
+  attachRunnerControlProviderId,
+  createRunnerInstancesWithBootstrapTokens,
+  enrollRunnerControlSession,
+  exchangeRunnerBootstrapToken,
+  RunnerBootstrapTokenInvalidError,
+  RunnerControlSessionInvalidError,
+  touchRunnerControlSession,
+} from './runner-control-sessions.js';
+export {
+  type ActiveRunner,
+  attachProviderRunnerId,
+  createPlannedProvisionedCapacity,
+  listActiveRunners,
+  type ReconcileDesiredIntent,
+  type ReconciledBoundJobExecution,
+  type ReconciledRunnerInstance,
+  type ReconcileRunnerInstancesParams,
+  type ReconcileRunnerInstancesResult,
+  type ReportRunnerInstancesParams,
+  type ReportRunnerInstancesResult,
+  reconcileRunnerInstances,
+  reportRunnerInstances,
+} from './runner-instances.js';
 export {
   type RegisterRunnerSessionResult,
   type RunnerRegistrationCredential,

package/src/core/job-executions.ts

@@ -1,4 +1,4 @@
-import {issueJobLeaseToken} from '@shipfox/api-auth';
+import type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';
 import {claimPendingJobExecution} from '#db/job-executions.js';
 import {jobExecutionClaimedCount} from '#metrics/instance.js';
 import {config} from '../config.js';
@@ -12,6 +12,7 @@ export interface ClaimJobExecutionResult {
 }
 
 export async function claimJobExecution(params: {
+  auth: AuthInterModuleClient;
   workspaceId: string;
   runnerSessionId: string;
   sessionLabels: string[];
@@ -27,7 +28,7 @@ export async function claimJobExecution(params: {
   }
   jobExecutionClaimedCount.add(1, {outcome: 'claimed'});
 
-  const leaseToken = await issueJobLeaseToken({
+  const {token: leaseToken} = await params.auth.mintJobLeaseToken({
     workflowRunId: claimed.workflowRunId,
     workflowRunAttemptId: claimed.workflowRunAttemptId,
     jobId: claimed.jobId,

package/src/core/maintenance.test.ts

@@ -2,20 +2,16 @@ import {vi} from '@shipfox/vitest/vi';
 import {eq} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {ephemeralRegistrationTokens} from '#db/schema/ephemeral-registration-tokens.js';
-import {provisionedRunners} from '#db/schema/provisioned-runners.js';
 import {reservations} from '#db/schema/reservations.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
 import {runnerSessions} from '#db/schema/runner-sessions.js';
-import {provisionedRunnerReapedCount, reservationReleasedCount} from '#metrics/instance.js';
-import {
-  provisionedRunnerFactory,
-  provisionerTokenFactory,
-  reservationFactory,
-} from '#test/index.js';
+import {providerRunnerReapedCount, reservationReleasedCount} from '#metrics/instance.js';
+import {providerRunnerFactory, provisionerTokenFactory, reservationFactory} from '#test/index.js';
 import {
   deleteExpiredEphemeralRegistrationTokens,
   deleteExpiredRunnerReservations,
   deleteExpiredRunnerSessions,
-  reapStaleProvisionedRunners,
+  reapStaleRunnerInstances,
 } from './maintenance.js';
 
 describe('deleteExpiredRunnerReservations', () => {
@@ -55,7 +51,7 @@ describe('deleteExpiredRunnerReservations', () => {
   });
 });
 
-describe('reapStaleProvisionedRunners', () => {
+describe('reapStaleRunnerInstances', () => {
   it('returns reaped counts and records maintenance metrics', async () => {
     const workspaceId = crypto.randomUUID();
     const provisioner = await provisionerTokenFactory.create({workspaceId});
@@ -71,21 +67,21 @@ describe('reapStaleProvisionedRunners', () => {
       .from(reservations)
       .where(eq(reservations.workspaceId, workspaceId));
     if (!reservation) throw new Error('Expected reservation');
-    const provisionedRunner = await provisionedRunnerFactory.create({
+    const providerRunner = await providerRunnerFactory.create({
       workspaceId,
       provisionerId: provisioner.id,
-      provisionedRunnerId: 'provisioned-runner-1',
+      providerRunnerId: 'provisioned-runner-1',
       reservationId: reservation.id,
       reportedAt: new Date(Date.now() - 120_000),
     });
     await db()
-      .update(provisionedRunners)
+      .update(providerRunners)
       .set({updatedAt: new Date(Date.now() - 120_000)})
-      .where(eq(provisionedRunners.id, provisionedRunner.id));
-    const reapedSpy = vi.spyOn(provisionedRunnerReapedCount, 'add');
+      .where(eq(providerRunners.id, providerRunner.id));
+    const reapedSpy = vi.spyOn(providerRunnerReapedCount, 'add');
     const releasedSpy = vi.spyOn(reservationReleasedCount, 'add');
 
-    const result = await reapStaleProvisionedRunners({thresholdSeconds: 60, limit: 100});
+    const result = await reapStaleRunnerInstances({thresholdSeconds: 60, limit: 100});
 
     expect(result).toEqual({reaped: 1, reservationsReleased: 1});
     expect(reapedSpy).toHaveBeenCalledWith(1);
@@ -173,7 +169,7 @@ describe('deleteExpiredRunnerSessions', () => {
       registrationTokenId: crypto.randomUUID(),
       registrationTokenKind: params.kind,
       provisionerId,
-      provisionedRunnerId: params.kind === 'ephemeral' ? `provisioned-${params.id}` : null,
+      providerRunnerId: params.kind === 'ephemeral' ? `provisioned-${params.id}` : null,
       labels: ['linux'],
       maxClaims: params.kind === 'ephemeral' ? 1 : null,
       claimsUsed: 0,
@@ -240,7 +236,7 @@ describe('deleteExpiredEphemeralRegistrationTokens', () => {
       id: params.id,
       workspaceId,
       provisionerId: crypto.randomUUID(),
-      provisionedRunnerId: `provisioned-${params.id}`,
+      providerRunnerId: `provisioned-${params.id}`,
       hashedToken: crypto.randomUUID(),
       prefix: 'sfxr_test',
       expiresAt: params.expiresAt,

package/src/core/maintenance.ts

@@ -1,10 +1,10 @@
 import {config} from '#config.js';
 import {deleteExpiredEphemeralRegistrationTokens as deleteExpiredEphemeralRegistrationTokensDb} from '#db/ephemeral-registration-tokens.js';
 import {expireStuckJobExecutions} from '#db/job-executions.js';
-import {reapStaleProvisionedRunners as reapStaleProvisionedRunnersDb} from '#db/provisioned-runners.js';
 import {deleteExpiredReservations} from '#db/reservations.js';
+import {reapStaleRunnerInstances as reapStaleRunnerInstancesDb} from '#db/runner-instances.js';
 import {deleteExpiredRunnerSessions as deleteExpiredRunnerSessionsDb} from '#db/runner-sessions.js';
-import {provisionedRunnerReapedCount, reservationReleasedCount} from '#metrics/instance.js';
+import {providerRunnerReapedCount, reservationReleasedCount} from '#metrics/instance.js';
 import {STUCK_JOB_THRESHOLD_SECONDS} from './maintenance-policy.js';
 
 export interface DetectAndExpireStuckJobsParams {
@@ -30,17 +30,17 @@ export async function deleteExpiredRunnerReservations(params?: {
   return {deleted};
 }
 
-export async function reapStaleProvisionedRunners(params?: {
+export async function reapStaleRunnerInstances(params?: {
   thresholdSeconds?: number;
   limit?: number;
 }): Promise<{reaped: number; reservationsReleased: number}> {
-  const result = await reapStaleProvisionedRunnersDb({
+  const result = await reapStaleRunnerInstancesDb({
     thresholdSeconds:
       params?.thresholdSeconds ?? config.RUNNER_STALE_PROVISIONED_RUNNER_THRESHOLD_SECONDS,
     limit: params?.limit ?? config.RUNNER_STALE_PROVISIONED_RUNNER_REAPER_LIMIT,
   });
 
-  if (result.reaped > 0) provisionedRunnerReapedCount.add(result.reaped);
+  if (result.reaped > 0) providerRunnerReapedCount.add(result.reaped);
   if (result.reservationsReleased > 0) {
     reservationReleasedCount.add(result.reservationsReleased);
   }

package/src/core/provisioner-capability-snapshots.test.ts

@@ -0,0 +1,35 @@
+import {eq} from 'drizzle-orm';
+import {config} from '#config.js';
+import {db} from '#db/db.js';
+import {publishWorkspaceProvisionerCapabilitySnapshot} from '#db/provisioner-capability-snapshots.js';
+import {provisionerCapabilitySnapshots} from '#db/schema/provisioner-capability-snapshots.js';
+import {provisionerTokenFactory} from '#test/index.js';
+import {hasActiveWorkspaceProvisionerCapability} from './provisioner-capability-snapshots.js';
+
+describe('workspace provisioner capability core', () => {
+  it('applies the configured active window to capability matching', async () => {
+    const workspaceId = crypto.randomUUID();
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [
+        {templateKey: 'linux', labels: ['linux'], availableSlots: 1, starting: 0, running: 0},
+      ],
+    });
+    await db()
+      .update(provisionerCapabilitySnapshots)
+      .set({
+        advertisedAt: new Date(Date.now() - (config.PROVISIONER_ACTIVE_WINDOW_SECONDS + 1) * 1000),
+      })
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, provisioner.id));
+
+    const hasLinux = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux'],
+    });
+
+    expect(hasLinux).toBe(false);
+  });
+});

package/src/core/provisioner-capability-snapshots.ts

@@ -0,0 +1,12 @@
+import {config} from '#config.js';
+import {hasActiveWorkspaceProvisionerCapability as hasActiveWorkspaceProvisionerCapabilityDb} from '#db/provisioner-capability-snapshots.js';
+
+export function hasActiveWorkspaceProvisionerCapability(params: {
+  workspaceId: string;
+  requiredLabels: string[];
+}): Promise<boolean> {
+  return hasActiveWorkspaceProvisionerCapabilityDb({
+    ...params,
+    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,
+  });
+}

package/src/core/provisioner-tokens.test.ts

@@ -4,8 +4,10 @@ import {db} from '#db/db.js';
 import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
 import {provisionerTokenFactory} from '#test/index.js';
 import {
+  createInstallationProvisionerToken,
   createWorkspaceProvisionerToken,
   listUsableProvisionerTokens,
+  revokeInstallationProvisionerToken,
   revokeWorkspaceProvisionerToken,
 } from './provisioner-tokens.js';
 
@@ -34,6 +36,24 @@ describe('provisioner token core', () => {
     expect(rows[0]?.hashedToken).not.toBe(result.rawToken);
   });
 
+  it('creates and revokes an installation provisioner token without a workspace', async () => {
+    const createdByUserId = crypto.randomUUID();
+
+    const created = await createInstallationProvisionerToken({createdByUserId, name: 'cloud'});
+
+    expect(created.token).toMatchObject({
+      scope: 'installation',
+      workspaceId: null,
+      createdByUserId,
+    });
+    const revoked = await revokeInstallationProvisionerToken({
+      tokenId: created.token.id,
+      revokedByUserId: crypto.randomUUID(),
+    });
+    expect(revoked).toMatchObject({id: created.token.id, scope: 'installation'});
+    expect(revoked.revokedAt).toBeInstanceOf(Date);
+  });
+
   it('lists usable tokens and excludes revoked tokens after revoke', async () => {
     const workspaceId = crypto.randomUUID();
     const token = await provisionerTokenFactory.create({workspaceId});

package/src/core/provisioner-tokens.ts

@@ -3,6 +3,7 @@ import {
   createProvisionerToken,
   listActiveProvisionerTokens,
   listUsableProvisionerTokensByWorkspaceId,
+  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,
   revokeProvisionerToken,
 } from '#db/provisioner-tokens.js';
 import {config} from '../config.js';
@@ -28,6 +29,7 @@ export async function createWorkspaceProvisionerToken(
   const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;
 
   const token = await createProvisionerToken({
+    scope: 'workspace',
     workspaceId: params.workspaceId,
     hashedToken: hashOpaqueToken(rawToken),
     prefix: extractDisplayPrefix(rawToken),
@@ -39,6 +41,28 @@ export async function createWorkspaceProvisionerToken(
   return {token, rawToken};
 }
 
+export interface CreateInstallationProvisionerTokenParams {
+  createdByUserId: string;
+  name?: string | undefined;
+  ttlSeconds?: number | undefined;
+}
+
+export async function createInstallationProvisionerToken(
+  params: CreateInstallationProvisionerTokenParams,
+): Promise<CreateWorkspaceProvisionerTokenResult> {
+  const rawToken = generateOpaqueToken('provisionerToken');
+  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;
+  const token = await createProvisionerToken({
+    scope: 'installation',
+    hashedToken: hashOpaqueToken(rawToken),
+    prefix: extractDisplayPrefix(rawToken),
+    name: params.name,
+    createdByUserId: params.createdByUserId,
+    expiresAt,
+  });
+  return {token, rawToken};
+}
+
 export function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {
   return listUsableProvisionerTokensByWorkspaceId(workspaceId);
 }
@@ -59,3 +83,12 @@ export async function revokeWorkspaceProvisionerToken(params: {
   if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);
   return token;
 }
+
+export async function revokeInstallationProvisionerToken(params: {
+  tokenId: string;
+  revokedByUserId: string;
+}): Promise<ProvisionerToken> {
+  const token = await revokeInstallationProvisionerTokenDb(params);
+  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);
+  return token;
+}

package/src/core/rate-limit.test.ts

@@ -111,47 +111,31 @@ describe('checkRunnersRateLimit', () => {
     });
   });
 
-  it('uses the configured shared identifier secret when present', async () => {
+  it('uses the root-derived identifier key', async () => {
     vi.resetModules();
-    vi.doMock('#config.js', () => ({
-      config: {
-        RATE_LIMIT_IDENTIFIER_SECRET: 'configured-secret',
-        RUNNERS_RATE_LIMIT_TIMEOUT_MS: 250,
-      },
-    }));
-    vi.doMock('@shipfox/api-auth/config', () => ({
-      config: {
-        AUTH_JWT_SECRET: 'jwt-secret',
-      },
-    }));
+    vi.stubEnv('AUTH_ROOT_KEY', 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=');
 
     try {
-      const configuredSecretModule = await import('./rate-limit.js');
-      const configuredSecretHash = configuredSecretModule.hashRunnersRateLimitIdentifier({
+      const firstModule = await import('./rate-limit.js');
+      const firstHash = firstModule.hashRunnersRateLimitIdentifier({
         action: 'provisioner-mint',
         scope: 'provisioner',
         identifier: 'provisioner-token-id',
       });
-      vi.doMock('#config.js', () => ({
-        config: {
-          RATE_LIMIT_IDENTIFIER_SECRET: undefined,
-          RUNNERS_RATE_LIMIT_TIMEOUT_MS: 250,
-        },
-      }));
+      vi.stubEnv('AUTH_ROOT_KEY', 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=');
       vi.resetModules();
-      const derivedSecretModule = await import('./rate-limit.js');
-      const derivedSecretHash = derivedSecretModule.hashRunnersRateLimitIdentifier({
+      const secondModule = await import('./rate-limit.js');
+      const secondHash = secondModule.hashRunnersRateLimitIdentifier({
         action: 'provisioner-mint',
         scope: 'provisioner',
         identifier: 'provisioner-token-id',
       });
 
-      expect(configuredSecretHash).toMatch(HMAC_HEX_PATTERN);
-      expect(derivedSecretHash).toMatch(HMAC_HEX_PATTERN);
-      expect(configuredSecretHash).not.toBe(derivedSecretHash);
+      expect(firstHash).toMatch(HMAC_HEX_PATTERN);
+      expect(secondHash).toMatch(HMAC_HEX_PATTERN);
+      expect(firstHash).not.toBe(secondHash);
     } finally {
-      vi.doUnmock('#config.js');
-      vi.doUnmock('@shipfox/api-auth/config');
+      vi.unstubAllEnvs();
       vi.resetModules();
     }
   });