@shipfox/api-runners 5.0.0 → 6.0.0

package/src/db/job-executions.test.ts

@@ -8,7 +8,7 @@ import {eq, sql} from 'drizzle-orm';
 import {EmptyRequiredLabelsError, RunnerSessionExhaustedError} from '#core/errors.js';
 import {claimJobExecution} from '#core/job-executions.js';
 import {detectAndExpireStuckJobs} from '#core/maintenance.js';
-import {pendingJobFactory, runnerSessionFactory} from '#test/index.js';
+import {pendingJobFactory, runnerSessionFactory, runnersTestAuthClient} from '#test/index.js';
 import {db} from './db.js';
 import {
   cancelRunnerJobs,
@@ -385,10 +385,10 @@ describe('claimPendingJobExecution', () => {
 
   it('enforces a non-null session claim cap from the database', async () => {
     const provisionerId = crypto.randomUUID();
-    const provisionedRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
+    const providerRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
     await db()
       .update(runnerSessions)
-      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, provisionedRunnerId})
+      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, providerRunnerId})
       .where(eq(runnerSessions.id, runnerSessionId));
     await pendingJobFactory.create({workspaceId});
     await pendingJobFactory.create({workspaceId});
@@ -403,10 +403,10 @@ describe('claimPendingJobExecution', () => {
 
   it('does not spend a claim when a capped session polls an empty queue', async () => {
     const provisionerId = crypto.randomUUID();
-    const provisionedRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
+    const providerRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
     await db()
       .update(runnerSessions)
-      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, provisionedRunnerId})
+      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, providerRunnerId})
       .where(eq(runnerSessions.id, runnerSessionId));
 
     const empty = await claimPendingJobExecution({workspaceId, runnerSessionId, maxClaims: 1});
@@ -494,15 +494,15 @@ describe('claimPendingJobExecution', () => {
     expect(running[0]?.requiredLabels).toEqual(created.requiredLabels);
     expect(running[0]?.runnerLabels).toEqual(sessionLabels);
     expect(running[0]?.provisionerId).toBeNull();
-    expect(running[0]?.provisionedRunnerId).toBeNull();
+    expect(running[0]?.providerRunnerId).toBeNull();
   });
 
   it('copies an ephemeral session provisioned-runner link onto the running job', async () => {
     const provisionerId = crypto.randomUUID();
-    const provisionedRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
+    const providerRunnerId = `provisioned-runner-${crypto.randomUUID()}`;
     await db()
       .update(runnerSessions)
-      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, provisionedRunnerId})
+      .set({registrationTokenKind: 'ephemeral', maxClaims: 1, provisionerId, providerRunnerId})
       .where(eq(runnerSessions.id, runnerSessionId));
     const created = await pendingJobFactory.create({workspaceId});
 
@@ -513,7 +513,7 @@ describe('claimPendingJobExecution', () => {
       .from(runningJobExecutions)
       .where(eq(runningJobExecutions.jobId, created.jobId));
     expect(running?.provisionerId).toBe(provisionerId);
-    expect(running?.provisionedRunnerId).toBe(provisionedRunnerId);
+    expect(running?.providerRunnerId).toBe(providerRunnerId);
   });
 
   it('rejects a running job row with a partial provisioned-runner link', async () => {
@@ -563,7 +563,7 @@ describe('claimPendingJobExecution', () => {
       labels: sessionLabels,
       toolCapabilities: {harnesses: {pi: {tools: ['read']}}},
     });
-    const underProvisionedRunner = await runnerSessionFactory.create({
+    const underRunnerInstance = await runnerSessionFactory.create({
       workspaceId,
       labels: sessionLabels,
       toolCapabilities: {harnesses: {pi: {tools: []}}},
@@ -579,7 +579,7 @@ describe('claimPendingJobExecution', () => {
 
     const firstClaim = await claimPendingJobExecution({
       workspaceId,
-      runnerSessionId: underProvisionedRunner.id,
+      runnerSessionId: underRunnerInstance.id,
     });
     const secondClaim = await claimPendingJobExecution({
       workspaceId,
@@ -758,6 +758,7 @@ describe('claimJobExecution', () => {
     const created = await pendingJobFactory.create({workspaceId});
 
     const claimed = await claimJobExecution({
+      auth: runnersTestAuthClient,
       workspaceId,
       runnerSessionId,
       sessionLabels,
@@ -781,6 +782,7 @@ describe('claimJobExecution', () => {
 
   it('returns null and mints no token when the queue is empty', async () => {
     const claimed = await claimJobExecution({
+      auth: runnersTestAuthClient,
       workspaceId,
       runnerSessionId,
       sessionLabels,

package/src/db/job-executions.ts

@@ -110,19 +110,19 @@ export interface ActiveRunningJobExecution {
   projectId: string;
   runnerSessionId: string;
   provisionerId: string | null;
-  provisionedRunnerId: string | null;
+  providerRunnerId: string | null;
   requiredLabels: string[];
   runnerLabels: string[];
   startedAt: Date;
   lastHeartbeatAt: Date;
 }
 
-export interface ProvisionedRunnerBoundJobExecution {
+export interface RunnerInstanceBoundJobExecution {
   workflowRunId: string;
   workflowRunAttemptId: string;
   jobId: string;
   jobExecutionId: string;
-  provisionedRunnerId: string;
+  providerRunnerId: string;
   startedAt: Date;
   lastHeartbeatAt: Date;
   cancellationRequestedAt: Date | null;
@@ -145,29 +145,35 @@ export async function claimPendingJobExecution(params: {
 
   return await db().transaction(async (tx) => {
     let provisionerId: string | null = null;
-    let provisionedRunnerId: string | null = null;
+    let providerRunnerId: string | null = null;
 
     if (params.maxClaims !== null) {
       const [session] = await tx
         .select({
           maxClaims: runnerSessions.maxClaims,
           claimsUsed: runnerSessions.claimsUsed,
+          revokedAt: runnerSessions.revokedAt,
           provisionerId: runnerSessions.provisionerId,
-          provisionedRunnerId: runnerSessions.provisionedRunnerId,
+          providerRunnerId: runnerSessions.providerRunnerId,
         })
         .from(runnerSessions)
         .where(eq(runnerSessions.id, params.runnerSessionId))
         .limit(1)
         .for('update');
 
-      if (!session || session.maxClaims === null || session.claimsUsed >= session.maxClaims) {
+      if (
+        !session ||
+        session.revokedAt ||
+        session.maxClaims === null ||
+        session.claimsUsed >= session.maxClaims
+      ) {
         throw new RunnerSessionExhaustedError(params.runnerSessionId);
       }
 
       // Ephemeral sessions are the only capped sessions, and the DB check keeps
       // their provisioned-runner link present as a pair.
       provisionerId = session.provisionerId;
-      provisionedRunnerId = session.provisionedRunnerId;
+      providerRunnerId = session.providerRunnerId;
     }
 
     // `id` is a uuidv7 (time-ordered), so it is a deterministic FIFO tiebreaker
@@ -206,7 +212,7 @@ export async function claimPendingJobExecution(params: {
         projectId: row.projectId,
         runnerSessionId: params.runnerSessionId,
         provisionerId,
-        provisionedRunnerId,
+        providerRunnerId,
         requiredLabels: row.requiredLabels,
         runnerLabels: params.sessionLabels,
       })
@@ -409,7 +415,7 @@ export async function listActiveRunningJobExecutions(params: {
       projectId: runningJobExecutions.projectId,
       runnerSessionId: runningJobExecutions.runnerSessionId,
       provisionerId: runningJobExecutions.provisionerId,
-      provisionedRunnerId: runningJobExecutions.provisionedRunnerId,
+      providerRunnerId: runningJobExecutions.providerRunnerId,
       requiredLabels: runningJobExecutions.requiredLabels,
       runnerLabels: runningJobExecutions.runnerLabels,
       startedAt: runningJobExecutions.startedAt,
@@ -426,19 +432,19 @@ export async function listActiveRunningJobExecutions(params: {
     .limit(params.limit ?? 1000);
 }
 
-export async function listRunningJobExecutionsByProvisionedRunnerTx(
+export async function listRunningJobExecutionsByRunnerInstanceTx(
   tx: Tx,
   params: {
     workspaceId: string;
     provisionerId: string;
-    provisionedRunnerIds: string[];
+    providerRunnerIds: string[];
   },
-): Promise<ProvisionedRunnerBoundJobExecution[]> {
-  if (params.provisionedRunnerIds.length === 0) return [];
+): Promise<RunnerInstanceBoundJobExecution[]> {
+  if (params.providerRunnerIds.length === 0) return [];
 
   const duplicateRows = await tx
     .select({
-      provisionedRunnerId: runningJobExecutions.provisionedRunnerId,
+      providerRunnerId: runningJobExecutions.providerRunnerId,
       count: count(),
     })
     .from(runningJobExecutions)
@@ -446,21 +452,21 @@ export async function listRunningJobExecutionsByProvisionedRunnerTx(
       and(
         eq(runningJobExecutions.workspaceId, params.workspaceId),
         eq(runningJobExecutions.provisionerId, params.provisionerId),
-        inArray(runningJobExecutions.provisionedRunnerId, params.provisionedRunnerIds),
+        inArray(runningJobExecutions.providerRunnerId, params.providerRunnerIds),
       ),
     )
-    .groupBy(runningJobExecutions.provisionedRunnerId)
+    .groupBy(runningJobExecutions.providerRunnerId)
     .having(sql`count(*) > 1`);
 
-  const duplicateProvisionedRunnerIds = duplicateRows.flatMap((row) =>
-    row.provisionedRunnerId ? [row.provisionedRunnerId] : [],
+  const duplicateRunnerInstanceIds = duplicateRows.flatMap((row) =>
+    row.providerRunnerId ? [row.providerRunnerId] : [],
   );
-  if (duplicateProvisionedRunnerIds.length > 0) {
+  if (duplicateRunnerInstanceIds.length > 0) {
     logger().warn(
       {
         workspaceId: params.workspaceId,
         provisionerId: params.provisionerId,
-        provisionedRunnerIds: duplicateProvisionedRunnerIds,
+        providerRunnerIds: duplicateRunnerInstanceIds,
       },
       'multiple running job executions are bound to the same provisioned runner',
     );
@@ -471,17 +477,17 @@ export async function listRunningJobExecutionsByProvisionedRunnerTx(
     workflowRunAttemptId: string;
     jobId: string;
     jobExecutionId: string;
-    provisionedRunnerId: string;
+    providerRunnerId: string;
     startedAt: Date | string;
     lastHeartbeatAt: Date | string;
     cancellationRequestedAt: Date | string | null;
   }>(sql`
-    SELECT DISTINCT ON (${runningJobExecutions.provisionedRunnerId})
+    SELECT DISTINCT ON (${runningJobExecutions.providerRunnerId})
       ${runningJobExecutions.workflowRunId} AS "workflowRunId",
       ${runningJobExecutions.workflowRunAttemptId} AS "workflowRunAttemptId",
       ${runningJobExecutions.jobId} AS "jobId",
       ${runningJobExecutions.jobExecutionId} AS "jobExecutionId",
-      ${runningJobExecutions.provisionedRunnerId} AS "provisionedRunnerId",
+      ${runningJobExecutions.providerRunnerId} AS "providerRunnerId",
       ${runningJobExecutions.startedAt} AS "startedAt",
       ${runningJobExecutions.lastHeartbeatAt} AS "lastHeartbeatAt",
       ${runningJobExecutions.cancellationRequestedAt} AS "cancellationRequestedAt"
@@ -489,11 +495,11 @@ export async function listRunningJobExecutionsByProvisionedRunnerTx(
     WHERE
       ${runningJobExecutions.workspaceId} = ${params.workspaceId}
       AND ${runningJobExecutions.provisionerId} = ${params.provisionerId}
-      AND ${runningJobExecutions.provisionedRunnerId} IN (${sql.join(
-        params.provisionedRunnerIds.map((provisionedRunnerId) => sql`${provisionedRunnerId}`),
+      AND ${runningJobExecutions.providerRunnerId} IN (${sql.join(
+        params.providerRunnerIds.map((providerRunnerId) => sql`${providerRunnerId}`),
         sql`, `,
       )})
-    ORDER BY ${runningJobExecutions.provisionedRunnerId}, ${runningJobExecutions.startedAt} DESC, ${runningJobExecutions.jobExecutionId} DESC
+    ORDER BY ${runningJobExecutions.providerRunnerId}, ${runningJobExecutions.startedAt} DESC, ${runningJobExecutions.jobExecutionId} DESC
   `);
 
   return result.rows.map((row) => ({
@@ -501,7 +507,7 @@ export async function listRunningJobExecutionsByProvisionedRunnerTx(
     workflowRunAttemptId: row.workflowRunAttemptId,
     jobId: row.jobId,
     jobExecutionId: row.jobExecutionId,
-    provisionedRunnerId: row.provisionedRunnerId,
+    providerRunnerId: row.providerRunnerId,
     startedAt: toDate(row.startedAt),
     lastHeartbeatAt: toDate(row.lastHeartbeatAt),
     cancellationRequestedAt: row.cancellationRequestedAt

package/src/db/provisioner-capability-snapshots.test.ts

@@ -0,0 +1,175 @@
+import {and, eq} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {
+  hasActiveWorkspaceProvisionerCapability,
+  listActiveWorkspaceProvisionerCapabilitySnapshots,
+  listStaleWorkspaceProvisionerCapabilitySnapshots,
+  publishWorkspaceProvisionerCapabilitySnapshot,
+} from '#db/provisioner-capability-snapshots.js';
+import {provisionerCapabilitySnapshots} from '#db/schema/provisioner-capability-snapshots.js';
+import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
+import {provisionerTokenFactory} from '#test/index.js';
+
+describe('workspace provisioner capability snapshots', () => {
+  let workspaceId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+  });
+
+  it('atomically replaces one provisioner complete template snapshot', async () => {
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux', ['linux'], 4, 1, 3), template('macos', ['macos'], 2, 0, 2)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux-arm64', ['linux', 'arm64'], 0, 1, 0)],
+    });
+
+    const rows = await snapshotsFor(provisioner.id);
+    expect(rows).toEqual([
+      expect.objectContaining({
+        templateKey: 'linux-arm64',
+        labels: ['arm64', 'linux'],
+        availableSlots: 0,
+        starting: 1,
+        running: 0,
+      }),
+    ]);
+  });
+
+  it('keeps zero-slot overlapping capability active for every workspace provisioner', async () => {
+    const first = await provisionerTokenFactory.create({workspaceId});
+    const second = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: first.id,
+      templates: [template('linux', ['linux', 'x64'], 0, 0, 1)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: second.id,
+      templates: [template('linux-gpu', ['linux', 'gpu'], 2, 1, 1)],
+    });
+
+    const active = await listActiveWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const hasLinux = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux'],
+      windowSeconds: 60,
+    });
+    const hasLinuxX64 = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux', 'x64'],
+      windowSeconds: 60,
+    });
+
+    expect(active).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({provisionerId: first.id, availableSlots: 0}),
+        expect.objectContaining({provisionerId: second.id, labels: ['gpu', 'linux']}),
+      ]),
+    );
+    expect(hasLinux).toBe(true);
+    expect(hasLinuxX64).toBe(true);
+  });
+
+  it('requires every advertised label to be present, not just an overlap', async () => {
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux', ['linux'], 1, 0, 0)],
+    });
+
+    const hasLinuxArm64 = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux', 'arm64'],
+      windowSeconds: 60,
+    });
+
+    expect(hasLinuxArm64).toBe(false);
+  });
+
+  it('excludes stale and revoked provisioner capability from active matching', async () => {
+    const staleProvisioner = await provisionerTokenFactory.create({workspaceId});
+    const revokedProvisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: staleProvisioner.id,
+      templates: [template('stale-linux', ['linux'], 1, 0, 1)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: revokedProvisioner.id,
+      templates: [template('revoked-macos', ['macos'], 1, 0, 1)],
+    });
+    await db()
+      .update(provisionerCapabilitySnapshots)
+      .set({advertisedAt: new Date(Date.now() - 61_000)})
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, staleProvisioner.id));
+    await db()
+      .update(provisionerTokens)
+      .set({revokedAt: new Date()})
+      .where(eq(provisionerTokens.id, revokedProvisioner.id));
+
+    const active = await listActiveWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const stale = await listStaleWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const hasLinux = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux'],
+      windowSeconds: 60,
+    });
+    const hasMacos = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['macos'],
+      windowSeconds: 60,
+    });
+
+    expect(active).toEqual([]);
+    expect(stale.map((snapshot) => snapshot.provisionerId).sort()).toEqual(
+      [staleProvisioner.id, revokedProvisioner.id].sort(),
+    );
+    expect(hasLinux).toBe(false);
+    expect(hasMacos).toBe(false);
+  });
+
+  function snapshotsFor(provisionerId: string) {
+    return db()
+      .select()
+      .from(provisionerCapabilitySnapshots)
+      .where(
+        and(
+          eq(provisionerCapabilitySnapshots.workspaceId, workspaceId),
+          eq(provisionerCapabilitySnapshots.provisionerId, provisionerId),
+        ),
+      );
+  }
+
+  function template(
+    templateKey: string,
+    labels: string[],
+    availableSlots: number,
+    starting: number,
+    running: number,
+  ) {
+    return {templateKey, labels, availableSlots, starting, running};
+  }
+});

package/src/db/provisioner-capability-snapshots.ts

@@ -0,0 +1,130 @@
+import {canonicalizeLabels} from '@shipfox/runner-labels';
+import {and, arrayContains, eq, gt, isNotNull, isNull, lte, or, sql} from 'drizzle-orm';
+import type {ProvisionerCapabilitySnapshot} from '#core/entities/provisioner-capability-snapshot.js';
+import {db} from './db.js';
+import type {ReservationTemplate} from './reservations.js';
+import {
+  provisionerCapabilitySnapshots,
+  toProvisionerCapabilitySnapshot,
+} from './schema/provisioner-capability-snapshots.js';
+import {provisionerTokens} from './schema/provisioner-tokens.js';
+
+export async function publishWorkspaceProvisionerCapabilitySnapshot(params: {
+  workspaceId: string;
+  provisionerId: string;
+  templates: ReservationTemplate[];
+}): Promise<void> {
+  await db().transaction(async (tx) => {
+    await tx
+      .delete(provisionerCapabilitySnapshots)
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, params.provisionerId));
+
+    if (params.templates.length === 0) return;
+
+    await tx.insert(provisionerCapabilitySnapshots).values(
+      params.templates.map((template) => ({
+        workspaceId: params.workspaceId,
+        provisionerId: params.provisionerId,
+        templateKey: template.templateKey,
+        labels: [...canonicalizeLabels(template.labels)],
+        availableSlots: template.availableSlots,
+        starting: template.starting,
+        running: template.running,
+      })),
+    );
+  });
+}
+
+export async function listActiveWorkspaceProvisionerCapabilitySnapshots(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}): Promise<ProvisionerCapabilitySnapshot[]> {
+  const rows = await db()
+    .select({snapshot: provisionerCapabilitySnapshots})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(and(...activeWorkspaceProvisionerCapabilityConditions(params)));
+
+  return rows.map(({snapshot}) => toProvisionerCapabilitySnapshot(snapshot));
+}
+
+export async function listStaleWorkspaceProvisionerCapabilitySnapshots(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}): Promise<ProvisionerCapabilitySnapshot[]> {
+  const rows = await db()
+    .select({snapshot: provisionerCapabilitySnapshots})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(
+      and(
+        eq(provisionerCapabilitySnapshots.workspaceId, params.workspaceId),
+        or(
+          lte(
+            provisionerCapabilitySnapshots.advertisedAt,
+            sql`now() - (${params.windowSeconds} || ' seconds')::interval`,
+          ),
+          eq(provisionerTokens.scope, 'installation'),
+          isNull(provisionerTokens.workspaceId),
+          provisionerTokenIsUnavailable(),
+        ),
+      ),
+    );
+
+  return rows.map(({snapshot}) => toProvisionerCapabilitySnapshot(snapshot));
+}
+
+export async function hasActiveWorkspaceProvisionerCapability(params: {
+  workspaceId: string;
+  requiredLabels: string[];
+  windowSeconds: number;
+}): Promise<boolean> {
+  const [row] = await db()
+    .select({id: provisionerCapabilitySnapshots.id})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(
+      and(
+        ...activeWorkspaceProvisionerCapabilityConditions(params),
+        arrayContains(provisionerCapabilitySnapshots.labels, [
+          ...canonicalizeLabels(params.requiredLabels),
+        ]),
+      ),
+    )
+    .limit(1);
+
+  return row !== undefined;
+}
+
+function activeWorkspaceProvisionerCapabilityConditions(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}) {
+  return [
+    eq(provisionerCapabilitySnapshots.workspaceId, params.workspaceId),
+    eq(provisionerTokens.workspaceId, params.workspaceId),
+    eq(provisionerTokens.scope, 'workspace' as const),
+    isNull(provisionerTokens.revokedAt),
+    or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, sql`now()`)),
+    gt(
+      provisionerCapabilitySnapshots.advertisedAt,
+      sql`now() - (${params.windowSeconds} || ' seconds')::interval`,
+    ),
+  ];
+}
+
+function provisionerTokenIsUnavailable() {
+  return or(
+    isNotNull(provisionerTokens.revokedAt),
+    and(isNotNull(provisionerTokens.expiresAt), lte(provisionerTokens.expiresAt, sql`now()`)),
+  );
+}