@shipfox/api-runners 5.0.0 → 7.0.1

package/dist/presentation/routes/heartbeat.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/heartbeat.ts"],"sourcesContent":["import {issueJobLeaseToken, jobLeaseParamsFrom} from '@shipfox/api-auth';\nimport {requireLeasedJobContext} from '@shipfox/api-auth-context';\nimport {heartbeatBodySchema, heartbeatResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {RunningJobExecutionNotFoundError} from '#core/errors.js';\nimport {recordHeartbeat} from '#db/job-executions.js';\n\nexport const heartbeatRoute = defineRoute({\n  method: 'POST',\n  path: '/:jobId/heartbeat',\n  description:\n    'Keeps a running job execution alive while the runner is still working on it. Returns whether the server has asked the runner to cancel.',\n  schema: {\n    params: z.object({jobId: z.string().uuid()}),\n    body: heartbeatBodySchema.nullish(),\n    response: {\n      200: heartbeatResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof RunningJobExecutionNotFoundError) {\n      throw new ClientError(error.message, 'running-job-execution-not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const {jobId} = request.params;\n    const lease = requireLeasedJobContext(request);\n    if (lease.jobId !== jobId) {\n      throw new ClientError('Lease token does not match job', 'lease-job-mismatch', {\n        status: 404,\n      });\n    }\n\n    const heartbeatResult = await recordHeartbeat({\n      jobExecutionId: lease.jobExecutionId,\n      runnerSessionId: lease.runnerSessionId,\n      toolCapabilities: request.body?.capabilities ?? null,\n    });\n\n    if (\n      heartbeatResult.previousToolCapabilities &&\n      !sameToolCapabilities(\n        heartbeatResult.previousToolCapabilities,\n        heartbeatResult.currentToolCapabilities,\n      )\n    ) {\n      request.log.info(\n        {\n          runnerSessionId: lease.runnerSessionId,\n          jobExecutionId: lease.jobExecutionId,\n          previousHarnesses: Object.keys(heartbeatResult.previousToolCapabilities.harnesses),\n          currentHarnesses: heartbeatResult.currentToolCapabilities\n            ? Object.keys(heartbeatResult.currentToolCapabilities.harnesses)\n            : [],\n        },\n        'Runner heartbeat changed advertised tool capabilities',\n      );\n    }\n\n    const leaseToken = await issueJobLeaseToken(\n      jobLeaseParamsFrom(\n        heartbeatResult.runningJobExecution,\n        lease.currentStepId && lease.currentStepAttempt !== undefined\n          ? {\n              currentStepId: lease.currentStepId,\n              currentStepAttempt: lease.currentStepAttempt,\n            }\n          : undefined,\n      ),\n    );\n\n    return {cancel: heartbeatResult.cancellationRequested, lease_token: leaseToken};\n  },\n});\n\nfunction sameToolCapabilities(left: unknown, right: unknown): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n"],"names":["issueJobLeaseToken","jobLeaseParamsFrom","requireLeasedJobContext","heartbeatBodySchema","heartbeatResponseSchema","ClientError","defineRoute","z","RunningJobExecutionNotFoundError","recordHeartbeat","heartbeatRoute","method","path","description","schema","params","object","jobId","string","uuid","body","nullish","response","errorHandler","error","message","status","handler","request","lease","heartbeatResult","jobExecutionId","runnerSessionId","toolCapabilities","capabilities","previousToolCapabilities","sameToolCapabilities","currentToolCapabilities","log","info","previousHarnesses","Object","keys","harnesses","currentHarnesses","leaseToken","runningJobExecution","currentStepId","currentStepAttempt","undefined","cancel","cancellationRequested","lease_token","left","right","JSON","stringify"],"mappings":"AAAA,SAAQA,kBAAkB,EAAEC,kBAAkB,QAAO,oBAAoB;AACzE,SAAQC,uBAAuB,QAAO,4BAA4B;AAClE,SAAQC,mBAAmB,EAAEC,uBAAuB,QAAO,2BAA2B;AACtF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gCAAgC,QAAO,kBAAkB;AACjE,SAAQC,eAAe,QAAO,wBAAwB;AAEtD,OAAO,MAAMC,iBAAiBJ,YAAY;IACxCK,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,QAAQR,EAAES,MAAM,CAAC;YAACC,OAAOV,EAAEW,MAAM,GAAGC,IAAI;QAAE;QAC1CC,MAAMjB,oBAAoBkB,OAAO;QACjCC,UAAU;YACR,KAAKlB;QACP;IACF;IACAmB,cAAc,CAACC;QACb,IAAIA,iBAAiBhB,kCAAkC;YACrD,MAAM,IAAIH,YAAYmB,MAAMC,OAAO,EAAE,mCAAmC;gBAACC,QAAQ;YAAG;QACtF;QACA,MAAMF;IACR;IACAG,SAAS,OAAOC;QACd,MAAM,EAACX,KAAK,EAAC,GAAGW,QAAQb,MAAM;QAC9B,MAAMc,QAAQ3B,wBAAwB0B;QACtC,IAAIC,MAAMZ,KAAK,KAAKA,OAAO;YACzB,MAAM,IAAIZ,YAAY,kCAAkC,sBAAsB;gBAC5EqB,QAAQ;YACV;QACF;QAEA,MAAMI,kBAAkB,MAAMrB,gBAAgB;YAC5CsB,gBAAgBF,MAAME,cAAc;YACpCC,iBAAiBH,MAAMG,eAAe;YACtCC,kBAAkBL,QAAQR,IAAI,EAAEc,gBAAgB;QAClD;QAEA,IACEJ,gBAAgBK,wBAAwB,IACxC,CAACC,qBACCN,gBAAgBK,wBAAwB,EACxCL,gBAAgBO,uBAAuB,GAEzC;YACAT,QAAQU,GAAG,CAACC,IAAI,CACd;gBACEP,iBAAiBH,MAAMG,eAAe;gBACtCD,gBAAgBF,MAAME,cAAc;gBACpCS,mBAAmBC,OAAOC,IAAI,CAACZ,gBAAgBK,wBAAwB,CAACQ,SAAS;gBACjFC,kBAAkBd,gBAAgBO,uBAAuB,GACrDI,OAAOC,IAAI,CAACZ,gBAAgBO,uBAAuB,CAACM,SAAS,IAC7D,EAAE;YACR,GACA;QAEJ;QAEA,MAAME,aAAa,MAAM7C,mBACvBC,mBACE6B,gBAAgBgB,mBAAmB,EACnCjB,MAAMkB,aAAa,IAAIlB,MAAMmB,kBAAkB,KAAKC,YAChD;YACEF,eAAelB,MAAMkB,aAAa;YAClCC,oBAAoBnB,MAAMmB,kBAAkB;QAC9C,IACAC;QAIR,OAAO;YAACC,QAAQpB,gBAAgBqB,qBAAqB;YAAEC,aAAaP;QAAU;IAChF;AACF,GAAG;AAEH,SAAST,qBAAqBiB,IAAa,EAAEC,KAAc;IACzD,OAAOC,KAAKC,SAAS,CAACH,UAAUE,KAAKC,SAAS,CAACF;AACjD"}
+{"version":3,"sources":["../../../src/presentation/routes/heartbeat.ts"],"sourcesContent":["import {requireLeasedJobContext} from '@shipfox/api-auth-context';\nimport type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';\nimport {heartbeatBodySchema, heartbeatResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {RunningJobExecutionNotFoundError} from '#core/errors.js';\nimport {recordHeartbeat} from '#db/job-executions.js';\n\nexport function createHeartbeatRoute(auth: AuthInterModuleClient) {\n  return defineRoute({\n    method: 'POST',\n    path: '/:jobId/heartbeat',\n    description:\n      'Keeps a running job execution alive while the runner is still working on it. Returns whether the server has asked the runner to cancel.',\n    schema: {\n      params: z.object({jobId: z.string().uuid()}),\n      body: heartbeatBodySchema.nullish(),\n      response: {\n        200: heartbeatResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof RunningJobExecutionNotFoundError) {\n        throw new ClientError(error.message, 'running-job-execution-not-found', {status: 404});\n      }\n      throw error;\n    },\n    handler: async (request) => {\n      const {jobId} = request.params;\n      const lease = requireLeasedJobContext(request);\n      if (lease.jobId !== jobId) {\n        throw new ClientError('Lease token does not match job', 'lease-job-mismatch', {\n          status: 404,\n        });\n      }\n\n      const heartbeatResult = await recordHeartbeat({\n        jobExecutionId: lease.jobExecutionId,\n        runnerSessionId: lease.runnerSessionId,\n        toolCapabilities: request.body?.capabilities ?? null,\n      });\n\n      if (\n        heartbeatResult.previousToolCapabilities &&\n        !sameToolCapabilities(\n          heartbeatResult.previousToolCapabilities,\n          heartbeatResult.currentToolCapabilities,\n        )\n      ) {\n        request.log.info(\n          {\n            runnerSessionId: lease.runnerSessionId,\n            jobExecutionId: lease.jobExecutionId,\n            previousHarnesses: Object.keys(heartbeatResult.previousToolCapabilities.harnesses),\n            currentHarnesses: heartbeatResult.currentToolCapabilities\n              ? Object.keys(heartbeatResult.currentToolCapabilities.harnesses)\n              : [],\n          },\n          'Runner heartbeat changed advertised tool capabilities',\n        );\n      }\n\n      const {token: leaseToken} = await auth.mintJobLeaseToken({\n        workflowRunId: heartbeatResult.runningJobExecution.workflowRunId,\n        workflowRunAttemptId: heartbeatResult.runningJobExecution.workflowRunAttemptId,\n        jobId: heartbeatResult.runningJobExecution.jobId,\n        jobExecutionId: heartbeatResult.runningJobExecution.jobExecutionId,\n        projectId: heartbeatResult.runningJobExecution.projectId,\n        workspaceId: heartbeatResult.runningJobExecution.workspaceId,\n        runnerSessionId: heartbeatResult.runningJobExecution.runnerSessionId,\n        ...(lease.currentStepId && lease.currentStepAttempt !== undefined\n          ? {currentStepId: lease.currentStepId, currentStepAttempt: lease.currentStepAttempt}\n          : {}),\n      });\n\n      return {cancel: heartbeatResult.cancellationRequested, lease_token: leaseToken};\n    },\n  });\n}\n\nfunction sameToolCapabilities(left: unknown, right: unknown): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n"],"names":["requireLeasedJobContext","heartbeatBodySchema","heartbeatResponseSchema","ClientError","defineRoute","z","RunningJobExecutionNotFoundError","recordHeartbeat","createHeartbeatRoute","auth","method","path","description","schema","params","object","jobId","string","uuid","body","nullish","response","errorHandler","error","message","status","handler","request","lease","heartbeatResult","jobExecutionId","runnerSessionId","toolCapabilities","capabilities","previousToolCapabilities","sameToolCapabilities","currentToolCapabilities","log","info","previousHarnesses","Object","keys","harnesses","currentHarnesses","token","leaseToken","mintJobLeaseToken","workflowRunId","runningJobExecution","workflowRunAttemptId","projectId","workspaceId","currentStepId","currentStepAttempt","undefined","cancel","cancellationRequested","lease_token","left","right","JSON","stringify"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,4BAA4B;AAElE,SAAQC,mBAAmB,EAAEC,uBAAuB,QAAO,2BAA2B;AACtF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,gCAAgC,QAAO,kBAAkB;AACjE,SAAQC,eAAe,QAAO,wBAAwB;AAEtD,OAAO,SAASC,qBAAqBC,IAA2B;IAC9D,OAAOL,YAAY;QACjBM,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,QAAQT,EAAEU,MAAM,CAAC;gBAACC,OAAOX,EAAEY,MAAM,GAAGC,IAAI;YAAE;YAC1CC,MAAMlB,oBAAoBmB,OAAO;YACjCC,UAAU;gBACR,KAAKnB;YACP;QACF;QACAoB,cAAc,CAACC;YACb,IAAIA,iBAAiBjB,kCAAkC;gBACrD,MAAM,IAAIH,YAAYoB,MAAMC,OAAO,EAAE,mCAAmC;oBAACC,QAAQ;gBAAG;YACtF;YACA,MAAMF;QACR;QACAG,SAAS,OAAOC;YACd,MAAM,EAACX,KAAK,EAAC,GAAGW,QAAQb,MAAM;YAC9B,MAAMc,QAAQ5B,wBAAwB2B;YACtC,IAAIC,MAAMZ,KAAK,KAAKA,OAAO;gBACzB,MAAM,IAAIb,YAAY,kCAAkC,sBAAsB;oBAC5EsB,QAAQ;gBACV;YACF;YAEA,MAAMI,kBAAkB,MAAMtB,gBAAgB;gBAC5CuB,gBAAgBF,MAAME,cAAc;gBACpCC,iBAAiBH,MAAMG,eAAe;gBACtCC,kBAAkBL,QAAQR,IAAI,EAAEc,gBAAgB;YAClD;YAEA,IACEJ,gBAAgBK,wBAAwB,IACxC,CAACC,qBACCN,gBAAgBK,wBAAwB,EACxCL,gBAAgBO,uBAAuB,GAEzC;gBACAT,QAAQU,GAAG,CAACC,IAAI,CACd;oBACEP,iBAAiBH,MAAMG,eAAe;oBACtCD,gBAAgBF,MAAME,cAAc;oBACpCS,mBAAmBC,OAAOC,IAAI,CAACZ,gBAAgBK,wBAAwB,CAACQ,SAAS;oBACjFC,kBAAkBd,gBAAgBO,uBAAuB,GACrDI,OAAOC,IAAI,CAACZ,gBAAgBO,uBAAuB,CAACM,SAAS,IAC7D,EAAE;gBACR,GACA;YAEJ;YAEA,MAAM,EAACE,OAAOC,UAAU,EAAC,GAAG,MAAMpC,KAAKqC,iBAAiB,CAAC;gBACvDC,eAAelB,gBAAgBmB,mBAAmB,CAACD,aAAa;gBAChEE,sBAAsBpB,gBAAgBmB,mBAAmB,CAACC,oBAAoB;gBAC9EjC,OAAOa,gBAAgBmB,mBAAmB,CAAChC,KAAK;gBAChDc,gBAAgBD,gBAAgBmB,mBAAmB,CAAClB,cAAc;gBAClEoB,WAAWrB,gBAAgBmB,mBAAmB,CAACE,SAAS;gBACxDC,aAAatB,gBAAgBmB,mBAAmB,CAACG,WAAW;gBAC5DpB,iBAAiBF,gBAAgBmB,mBAAmB,CAACjB,eAAe;gBACpE,GAAIH,MAAMwB,aAAa,IAAIxB,MAAMyB,kBAAkB,KAAKC,YACpD;oBAACF,eAAexB,MAAMwB,aAAa;oBAAEC,oBAAoBzB,MAAMyB,kBAAkB;gBAAA,IACjF,CAAC,CAAC;YACR;YAEA,OAAO;gBAACE,QAAQ1B,gBAAgB2B,qBAAqB;gBAAEC,aAAaZ;YAAU;QAChF;IACF;AACF;AAEA,SAASV,qBAAqBuB,IAAa,EAAEC,KAAc;IACzD,OAAOC,KAAKC,SAAS,CAACH,UAAUE,KAAKC,SAAS,CAACF;AACjD"}

package/dist/presentation/routes/index.d.ts

@@ -1,4 +1,6 @@
+import type { AuthInterModuleClient } from '@shipfox/api-auth-dto/inter-module';
 import type { RouteGroup } from '@shipfox/node-fastify';
+import type { CreateRunnersModuleOptions } from '#installation-provisioning.js';
 export declare const provisionerRoutes: RouteGroup[];
-export declare const runnerRoutes: RouteGroup[];
+export declare function createRunnerRoutes(auth: AuthInterModuleClient, options?: CreateRunnersModuleOptions): RouteGroup[];
 //# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AA4DtD,eAAO,MAAM,iBAAiB,EAAE,UAAU,EAgBzC,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,UAAU,EAAgD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAC,0BAA0B,EAAC,MAAM,+BAA+B,CAAC;AAsF9E,eAAO,MAAM,iBAAiB,EAAE,UAAU,EAgBzC,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,qBAAqB,EAC3B,OAAO,GAAE,0BAA+B,GACvC,UAAU,EAAE,CAgBd"}

package/dist/presentation/routes/index.js

@@ -1,66 +1,88 @@
 import { AUTH_LEASED_JOB, AUTH_PROVISIONER_TOKEN, AUTH_RUNNER_REGISTRATION_TOKEN, AUTH_RUNNER_SESSION, AUTH_USER } from '@shipfox/api-auth-context';
+import { assignRunnerInstancesRoute } from './assign-runner-instances.js';
 import { createManualRegistrationTokenRoute } from './create-manual-registration-token.js';
 import { createProvisionerTokenRoute } from './create-provisioner-token.js';
 import { getProvisionerMeRoute } from './get-provisioner-me.js';
-import { heartbeatRoute } from './heartbeat.js';
+import { createHeartbeatRoute } from './heartbeat.js';
 import { listActiveProvisionersRoute } from './list-active-provisioners.js';
 import { listActiveRunnersRoute } from './list-active-runners.js';
 import { listManualRegistrationTokensRoute } from './list-manual-registration-tokens.js';
 import { listProvisionerTokensRoute } from './list-provisioner-tokens.js';
-import { mintRegistrationTokensRoute } from './mint-registration-tokens.js';
-import { pollDemandRoute } from './poll-demand.js';
-import { reconcileProvisionedRunnersRoute } from './reconcile-provisioned-runners.js';
-import { registerRoute } from './register.js';
-import { reportProvisionedRunnersRoute } from './report-provisioned-runners.js';
-import { requestJobRoute } from './request-job.js';
+import { createPollDemandRoute, pollDemandRoute } from './poll-demand.js';
+import { reconcileRunnerInstancesRoute } from './reconcile-runner-instances.js';
+import { createRegisterRoute } from './register.js';
+import { reportRunnerInstancesRoute } from './report-runner-instances.js';
+import { createRequestJobRoute } from './request-job.js';
 import { revokeManualRegistrationTokenRoute } from './revoke-manual-registration-token.js';
 import { revokeProvisionerTokenRoute } from './revoke-provisioner-token.js';
-const runnerOnlyRoutes = [
+import { attachRunnerControlProviderIdRoute, attachRunnerInstanceProviderIdRoute, createRunnerInstancesRoute, enrollRunnerRoute, exchangeRunnerBootstrapRoute, runnerAssignmentPollRoute, runnerControlHeartbeatRoute } from './runner-enrollment.js';
+function createRunnerOnlyRoutes(auth) {
+    return [
+        {
+            prefix: '/workspaces/:workspaceId/runners/manual-registration-tokens',
+            auth: AUTH_USER,
+            routes: [
+                listManualRegistrationTokensRoute,
+                createManualRegistrationTokenRoute,
+                revokeManualRegistrationTokenRoute
+            ]
+        },
+        {
+            prefix: '/workspaces/:workspaceId/runners/active',
+            auth: AUTH_USER,
+            routes: [
+                listActiveRunnersRoute
+            ]
+        },
+        {
+            prefix: '/runners',
+            auth: AUTH_RUNNER_REGISTRATION_TOKEN,
+            routes: [
+                createRegisterRoute(auth)
+            ]
+        },
+        {
+            prefix: '/runners/jobs',
+            auth: AUTH_RUNNER_SESSION,
+            routes: [
+                createRequestJobRoute(auth)
+            ]
+        },
+        {
+            prefix: '/runners/jobs',
+            auth: AUTH_LEASED_JOB,
+            routes: [
+                createHeartbeatRoute(auth)
+            ]
+        },
+        {
+            prefix: '/provisioners',
+            auth: AUTH_PROVISIONER_TOKEN,
+            routes: [
+                pollDemandRoute,
+                createRunnerInstancesRoute,
+                attachRunnerInstanceProviderIdRoute,
+                assignRunnerInstancesRoute,
+                reportRunnerInstancesRoute,
+                reconcileRunnerInstancesRoute
+            ]
+        }
+    ];
+}
+const runnerControlRoutes = [
     {
-        prefix: '/workspaces/:workspaceId/runners/manual-registration-tokens',
-        auth: AUTH_USER,
-        routes: [
-            listManualRegistrationTokensRoute,
-            createManualRegistrationTokenRoute,
-            revokeManualRegistrationTokenRoute
-        ]
-    },
-    {
-        prefix: '/workspaces/:workspaceId/runners/active',
-        auth: AUTH_USER,
+        prefix: '/runner-enrollment',
         routes: [
-            listActiveRunnersRoute
+            exchangeRunnerBootstrapRoute
         ]
     },
     {
-        prefix: '/runners',
-        auth: AUTH_RUNNER_REGISTRATION_TOKEN,
+        prefix: '/runner-control',
         routes: [
-            registerRoute
-        ]
-    },
-    {
-        prefix: '/runners/jobs',
-        auth: AUTH_RUNNER_SESSION,
-        routes: [
-            requestJobRoute
-        ]
-    },
-    {
-        prefix: '/runners/jobs',
-        auth: AUTH_LEASED_JOB,
-        routes: [
-            heartbeatRoute
-        ]
-    },
-    {
-        prefix: '/provisioners',
-        auth: AUTH_PROVISIONER_TOKEN,
-        routes: [
-            pollDemandRoute,
-            mintRegistrationTokensRoute,
-            reportProvisionedRunnersRoute,
-            reconcileProvisionedRunnersRoute
+            enrollRunnerRoute,
+            attachRunnerControlProviderIdRoute,
+            runnerControlHeartbeatRoute,
+            runnerAssignmentPollRoute
         ]
     }
 ];
@@ -89,9 +111,16 @@ export const provisionerRoutes = [
         ]
     }
 ];
-export const runnerRoutes = [
-    ...runnerOnlyRoutes,
-    ...provisionerRoutes
-];
+export function createRunnerRoutes(auth, options = {}) {
+    const runnerOnlyRoutes = createRunnerOnlyRoutes(auth);
+    return [
+        ...runnerOnlyRoutes.map((route)=>route.routes.includes(pollDemandRoute) ? {
+                ...route,
+                routes: route.routes.map((r)=>r === pollDemandRoute ? createPollDemandRoute(options) : r)
+            } : route),
+        ...runnerControlRoutes,
+        ...provisionerRoutes
+    ];
+}
 
 //# sourceMappingURL=index.js.map

package/dist/presentation/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import {\n  AUTH_LEASED_JOB,\n  AUTH_PROVISIONER_TOKEN,\n  AUTH_RUNNER_REGISTRATION_TOKEN,\n  AUTH_RUNNER_SESSION,\n  AUTH_USER,\n} from '@shipfox/api-auth-context';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {createManualRegistrationTokenRoute} from './create-manual-registration-token.js';\nimport {createProvisionerTokenRoute} from './create-provisioner-token.js';\nimport {getProvisionerMeRoute} from './get-provisioner-me.js';\nimport {heartbeatRoute} from './heartbeat.js';\nimport {listActiveProvisionersRoute} from './list-active-provisioners.js';\nimport {listActiveRunnersRoute} from './list-active-runners.js';\nimport {listManualRegistrationTokensRoute} from './list-manual-registration-tokens.js';\nimport {listProvisionerTokensRoute} from './list-provisioner-tokens.js';\nimport {mintRegistrationTokensRoute} from './mint-registration-tokens.js';\nimport {pollDemandRoute} from './poll-demand.js';\nimport {reconcileProvisionedRunnersRoute} from './reconcile-provisioned-runners.js';\nimport {registerRoute} from './register.js';\nimport {reportProvisionedRunnersRoute} from './report-provisioned-runners.js';\nimport {requestJobRoute} from './request-job.js';\nimport {revokeManualRegistrationTokenRoute} from './revoke-manual-registration-token.js';\nimport {revokeProvisionerTokenRoute} from './revoke-provisioner-token.js';\n\nconst runnerOnlyRoutes: RouteGroup[] = [\n  {\n    prefix: '/workspaces/:workspaceId/runners/manual-registration-tokens',\n    auth: AUTH_USER,\n    routes: [\n      listManualRegistrationTokensRoute,\n      createManualRegistrationTokenRoute,\n      revokeManualRegistrationTokenRoute,\n    ],\n  },\n  {\n    prefix: '/workspaces/:workspaceId/runners/active',\n    auth: AUTH_USER,\n    routes: [listActiveRunnersRoute],\n  },\n  {\n    prefix: '/runners',\n    auth: AUTH_RUNNER_REGISTRATION_TOKEN,\n    routes: [registerRoute],\n  },\n  {\n    prefix: '/runners/jobs',\n    auth: AUTH_RUNNER_SESSION,\n    routes: [requestJobRoute],\n  },\n  {\n    prefix: '/runners/jobs',\n    auth: AUTH_LEASED_JOB,\n    routes: [heartbeatRoute],\n  },\n  {\n    prefix: '/provisioners',\n    auth: AUTH_PROVISIONER_TOKEN,\n    routes: [\n      pollDemandRoute,\n      mintRegistrationTokensRoute,\n      reportProvisionedRunnersRoute,\n      reconcileProvisionedRunnersRoute,\n    ],\n  },\n];\n\nexport const provisionerRoutes: RouteGroup[] = [\n  {\n    prefix: '/workspaces/:workspaceId/provisioners/tokens',\n    auth: AUTH_USER,\n    routes: [listProvisionerTokensRoute, createProvisionerTokenRoute, revokeProvisionerTokenRoute],\n  },\n  {\n    prefix: '/workspaces/:workspaceId/provisioners/active',\n    auth: AUTH_USER,\n    routes: [listActiveProvisionersRoute],\n  },\n  {\n    prefix: '/provisioners',\n    auth: AUTH_PROVISIONER_TOKEN,\n    routes: [getProvisionerMeRoute],\n  },\n];\n\nexport const runnerRoutes: RouteGroup[] = [...runnerOnlyRoutes, ...provisionerRoutes];\n"],"names":["AUTH_LEASED_JOB","AUTH_PROVISIONER_TOKEN","AUTH_RUNNER_REGISTRATION_TOKEN","AUTH_RUNNER_SESSION","AUTH_USER","createManualRegistrationTokenRoute","createProvisionerTokenRoute","getProvisionerMeRoute","heartbeatRoute","listActiveProvisionersRoute","listActiveRunnersRoute","listManualRegistrationTokensRoute","listProvisionerTokensRoute","mintRegistrationTokensRoute","pollDemandRoute","reconcileProvisionedRunnersRoute","registerRoute","reportProvisionedRunnersRoute","requestJobRoute","revokeManualRegistrationTokenRoute","revokeProvisionerTokenRoute","runnerOnlyRoutes","prefix","auth","routes","provisionerRoutes","runnerRoutes"],"mappings":"AAAA,SACEA,eAAe,EACfC,sBAAsB,EACtBC,8BAA8B,EAC9BC,mBAAmB,EACnBC,SAAS,QACJ,4BAA4B;AAEnC,SAAQC,kCAAkC,QAAO,wCAAwC;AACzF,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SAAQC,cAAc,QAAO,iBAAiB;AAC9C,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SAAQC,sBAAsB,QAAO,2BAA2B;AAChE,SAAQC,iCAAiC,QAAO,uCAAuC;AACvF,SAAQC,0BAA0B,QAAO,+BAA+B;AACxE,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SAAQC,eAAe,QAAO,mBAAmB;AACjD,SAAQC,gCAAgC,QAAO,qCAAqC;AACpF,SAAQC,aAAa,QAAO,gBAAgB;AAC5C,SAAQC,6BAA6B,QAAO,kCAAkC;AAC9E,SAAQC,eAAe,QAAO,mBAAmB;AACjD,SAAQC,kCAAkC,QAAO,wCAAwC;AACzF,SAAQC,2BAA2B,QAAO,gCAAgC;AAE1E,MAAMC,mBAAiC;IACrC;QACEC,QAAQ;QACRC,MAAMnB;QACNoB,QAAQ;YACNb;YACAN;YACAc;SACD;IACH;IACA;QACEG,QAAQ;QACRC,MAAMnB;QACNoB,QAAQ;YAACd;SAAuB;IAClC;IACA;QACEY,QAAQ;QACRC,MAAMrB;QACNsB,QAAQ;YAACR;SAAc;IACzB;IACA;QACEM,QAAQ;QACRC,MAAMpB;QACNqB,QAAQ;YAACN;SAAgB;IAC3B;IACA;QACEI,QAAQ;QACRC,MAAMvB;QACNwB,QAAQ;YAAChB;SAAe;IAC1B;IACA;QACEc,QAAQ;QACRC,MAAMtB;QACNuB,QAAQ;YACNV;YACAD;YACAI;YACAF;SACD;IACH;CACD;AAED,OAAO,MAAMU,oBAAkC;IAC7C;QACEH,QAAQ;QACRC,MAAMnB;QACNoB,QAAQ;YAACZ;YAA4BN;YAA6Bc;SAA4B;IAChG;IACA;QACEE,QAAQ;QACRC,MAAMnB;QACNoB,QAAQ;YAACf;SAA4B;IACvC;IACA;QACEa,QAAQ;QACRC,MAAMtB;QACNuB,QAAQ;YAACjB;SAAsB;IACjC;CACD,CAAC;AAEF,OAAO,MAAMmB,eAA6B;OAAIL;OAAqBI;CAAkB,CAAC"}
+{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import {\n  AUTH_LEASED_JOB,\n  AUTH_PROVISIONER_TOKEN,\n  AUTH_RUNNER_REGISTRATION_TOKEN,\n  AUTH_RUNNER_SESSION,\n  AUTH_USER,\n} from '@shipfox/api-auth-context';\nimport type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport type {CreateRunnersModuleOptions} from '#installation-provisioning.js';\nimport {assignRunnerInstancesRoute} from './assign-runner-instances.js';\nimport {createManualRegistrationTokenRoute} from './create-manual-registration-token.js';\nimport {createProvisionerTokenRoute} from './create-provisioner-token.js';\nimport {getProvisionerMeRoute} from './get-provisioner-me.js';\nimport {createHeartbeatRoute} from './heartbeat.js';\nimport {listActiveProvisionersRoute} from './list-active-provisioners.js';\nimport {listActiveRunnersRoute} from './list-active-runners.js';\nimport {listManualRegistrationTokensRoute} from './list-manual-registration-tokens.js';\nimport {listProvisionerTokensRoute} from './list-provisioner-tokens.js';\nimport {createPollDemandRoute, pollDemandRoute} from './poll-demand.js';\nimport {reconcileRunnerInstancesRoute} from './reconcile-runner-instances.js';\nimport {createRegisterRoute} from './register.js';\nimport {reportRunnerInstancesRoute} from './report-runner-instances.js';\nimport {createRequestJobRoute} from './request-job.js';\nimport {revokeManualRegistrationTokenRoute} from './revoke-manual-registration-token.js';\nimport {revokeProvisionerTokenRoute} from './revoke-provisioner-token.js';\nimport {\n  attachRunnerControlProviderIdRoute,\n  attachRunnerInstanceProviderIdRoute,\n  createRunnerInstancesRoute,\n  enrollRunnerRoute,\n  exchangeRunnerBootstrapRoute,\n  runnerAssignmentPollRoute,\n  runnerControlHeartbeatRoute,\n} from './runner-enrollment.js';\n\nfunction createRunnerOnlyRoutes(auth: AuthInterModuleClient): RouteGroup[] {\n  return [\n    {\n      prefix: '/workspaces/:workspaceId/runners/manual-registration-tokens',\n      auth: AUTH_USER,\n      routes: [\n        listManualRegistrationTokensRoute,\n        createManualRegistrationTokenRoute,\n        revokeManualRegistrationTokenRoute,\n      ],\n    },\n    {\n      prefix: '/workspaces/:workspaceId/runners/active',\n      auth: AUTH_USER,\n      routes: [listActiveRunnersRoute],\n    },\n    {\n      prefix: '/runners',\n      auth: AUTH_RUNNER_REGISTRATION_TOKEN,\n      routes: [createRegisterRoute(auth)],\n    },\n    {\n      prefix: '/runners/jobs',\n      auth: AUTH_RUNNER_SESSION,\n      routes: [createRequestJobRoute(auth)],\n    },\n    {\n      prefix: '/runners/jobs',\n      auth: AUTH_LEASED_JOB,\n      routes: [createHeartbeatRoute(auth)],\n    },\n    {\n      prefix: '/provisioners',\n      auth: AUTH_PROVISIONER_TOKEN,\n      routes: [\n        pollDemandRoute,\n        createRunnerInstancesRoute,\n        attachRunnerInstanceProviderIdRoute,\n        assignRunnerInstancesRoute,\n        reportRunnerInstancesRoute,\n        reconcileRunnerInstancesRoute,\n      ],\n    },\n  ];\n}\n\nconst runnerControlRoutes: RouteGroup[] = [\n  {prefix: '/runner-enrollment', routes: [exchangeRunnerBootstrapRoute]},\n  {\n    prefix: '/runner-control',\n    routes: [\n      enrollRunnerRoute,\n      attachRunnerControlProviderIdRoute,\n      runnerControlHeartbeatRoute,\n      runnerAssignmentPollRoute,\n    ],\n  },\n];\n\nexport const provisionerRoutes: RouteGroup[] = [\n  {\n    prefix: '/workspaces/:workspaceId/provisioners/tokens',\n    auth: AUTH_USER,\n    routes: [listProvisionerTokensRoute, createProvisionerTokenRoute, revokeProvisionerTokenRoute],\n  },\n  {\n    prefix: '/workspaces/:workspaceId/provisioners/active',\n    auth: AUTH_USER,\n    routes: [listActiveProvisionersRoute],\n  },\n  {\n    prefix: '/provisioners',\n    auth: AUTH_PROVISIONER_TOKEN,\n    routes: [getProvisionerMeRoute],\n  },\n];\n\nexport function createRunnerRoutes(\n  auth: AuthInterModuleClient,\n  options: CreateRunnersModuleOptions = {},\n): RouteGroup[] {\n  const runnerOnlyRoutes = createRunnerOnlyRoutes(auth);\n  return [\n    ...runnerOnlyRoutes.map((route) =>\n      route.routes.includes(pollDemandRoute)\n        ? {\n            ...route,\n            routes: route.routes.map((r) =>\n              r === pollDemandRoute ? createPollDemandRoute(options) : r,\n            ),\n          }\n        : route,\n    ),\n    ...runnerControlRoutes,\n    ...provisionerRoutes,\n  ];\n}\n"],"names":["AUTH_LEASED_JOB","AUTH_PROVISIONER_TOKEN","AUTH_RUNNER_REGISTRATION_TOKEN","AUTH_RUNNER_SESSION","AUTH_USER","assignRunnerInstancesRoute","createManualRegistrationTokenRoute","createProvisionerTokenRoute","getProvisionerMeRoute","createHeartbeatRoute","listActiveProvisionersRoute","listActiveRunnersRoute","listManualRegistrationTokensRoute","listProvisionerTokensRoute","createPollDemandRoute","pollDemandRoute","reconcileRunnerInstancesRoute","createRegisterRoute","reportRunnerInstancesRoute","createRequestJobRoute","revokeManualRegistrationTokenRoute","revokeProvisionerTokenRoute","attachRunnerControlProviderIdRoute","attachRunnerInstanceProviderIdRoute","createRunnerInstancesRoute","enrollRunnerRoute","exchangeRunnerBootstrapRoute","runnerAssignmentPollRoute","runnerControlHeartbeatRoute","createRunnerOnlyRoutes","auth","prefix","routes","runnerControlRoutes","provisionerRoutes","createRunnerRoutes","options","runnerOnlyRoutes","map","route","includes","r"],"mappings":"AAAA,SACEA,eAAe,EACfC,sBAAsB,EACtBC,8BAA8B,EAC9BC,mBAAmB,EACnBC,SAAS,QACJ,4BAA4B;AAInC,SAAQC,0BAA0B,QAAO,+BAA+B;AACxE,SAAQC,kCAAkC,QAAO,wCAAwC;AACzF,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SAAQC,qBAAqB,QAAO,0BAA0B;AAC9D,SAAQC,oBAAoB,QAAO,iBAAiB;AACpD,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SAAQC,sBAAsB,QAAO,2BAA2B;AAChE,SAAQC,iCAAiC,QAAO,uCAAuC;AACvF,SAAQC,0BAA0B,QAAO,+BAA+B;AACxE,SAAQC,qBAAqB,EAAEC,eAAe,QAAO,mBAAmB;AACxE,SAAQC,6BAA6B,QAAO,kCAAkC;AAC9E,SAAQC,mBAAmB,QAAO,gBAAgB;AAClD,SAAQC,0BAA0B,QAAO,+BAA+B;AACxE,SAAQC,qBAAqB,QAAO,mBAAmB;AACvD,SAAQC,kCAAkC,QAAO,wCAAwC;AACzF,SAAQC,2BAA2B,QAAO,gCAAgC;AAC1E,SACEC,kCAAkC,EAClCC,mCAAmC,EACnCC,0BAA0B,EAC1BC,iBAAiB,EACjBC,4BAA4B,EAC5BC,yBAAyB,EACzBC,2BAA2B,QACtB,yBAAyB;AAEhC,SAASC,uBAAuBC,IAA2B;IACzD,OAAO;QACL;YACEC,QAAQ;YACRD,MAAM1B;YACN4B,QAAQ;gBACNpB;gBACAN;gBACAc;aACD;QACH;QACA;YACEW,QAAQ;YACRD,MAAM1B;YACN4B,QAAQ;gBAACrB;aAAuB;QAClC;QACA;YACEoB,QAAQ;YACRD,MAAM5B;YACN8B,QAAQ;gBAACf,oBAAoBa;aAAM;QACrC;QACA;YACEC,QAAQ;YACRD,MAAM3B;YACN6B,QAAQ;gBAACb,sBAAsBW;aAAM;QACvC;QACA;YACEC,QAAQ;YACRD,MAAM9B;YACNgC,QAAQ;gBAACvB,qBAAqBqB;aAAM;QACtC;QACA;YACEC,QAAQ;YACRD,MAAM7B;YACN+B,QAAQ;gBACNjB;gBACAS;gBACAD;gBACAlB;gBACAa;gBACAF;aACD;QACH;KACD;AACH;AAEA,MAAMiB,sBAAoC;IACxC;QAACF,QAAQ;QAAsBC,QAAQ;YAACN;SAA6B;IAAA;IACrE;QACEK,QAAQ;QACRC,QAAQ;YACNP;YACAH;YACAM;YACAD;SACD;IACH;CACD;AAED,OAAO,MAAMO,oBAAkC;IAC7C;QACEH,QAAQ;QACRD,MAAM1B;QACN4B,QAAQ;YAACnB;YAA4BN;YAA6Bc;SAA4B;IAChG;IACA;QACEU,QAAQ;QACRD,MAAM1B;QACN4B,QAAQ;YAACtB;SAA4B;IACvC;IACA;QACEqB,QAAQ;QACRD,MAAM7B;QACN+B,QAAQ;YAACxB;SAAsB;IACjC;CACD,CAAC;AAEF,OAAO,SAAS2B,mBACdL,IAA2B,EAC3BM,UAAsC,CAAC,CAAC;IAExC,MAAMC,mBAAmBR,uBAAuBC;IAChD,OAAO;WACFO,iBAAiBC,GAAG,CAAC,CAACC,QACvBA,MAAMP,MAAM,CAACQ,QAAQ,CAACzB,mBAClB;gBACE,GAAGwB,KAAK;gBACRP,QAAQO,MAAMP,MAAM,CAACM,GAAG,CAAC,CAACG,IACxBA,MAAM1B,kBAAkBD,sBAAsBsB,WAAWK;YAE7D,IACAF;WAEHN;WACAC;KACJ;AACH"}

package/dist/presentation/routes/poll-demand.d.ts

@@ -1,2 +1,4 @@
+import type { CreateRunnersModuleOptions } from '#installation-provisioning.js';
+export declare function createPollDemandRoute(options?: CreateRunnersModuleOptions): import("@shipfox/node-fastify").RouteDefinition;
 export declare const pollDemandRoute: import("@shipfox/node-fastify").RouteDefinition;
 //# sourceMappingURL=poll-demand.d.ts.map

package/dist/presentation/routes/poll-demand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll-demand.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/poll-demand.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe,iDA6C1B,CAAC"}
+{"version":3,"file":"poll-demand.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/poll-demand.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAC,0BAA0B,EAAC,MAAM,+BAA+B,CAAC;AAe9E,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,0BAA+B,mDAkF7E;AAED,eAAO,MAAM,eAAe,iDAA0B,CAAC"}

package/dist/presentation/routes/poll-demand.js

@@ -1,53 +1,94 @@
-import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { requireProvisionerContext, requireWorkspaceProvisionerContext } from '@shipfox/api-auth-context';
 import { pollDemandBodySchema, pollDemandResponseSchema } from '@shipfox/api-runners-dto';
-import { defineRoute } from '@shipfox/node-fastify';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { config } from '#config.js';
 import { pollDemand, releaseReservationGrants } from '#core/demand.js';
+import { publishWorkspaceProvisionerCapabilitySnapshot } from '#db/provisioner-capability-snapshots.js';
+import { listQueuedDemandWorkspaceIds, pollInstallationDemandAndReserve } from '#db/reservations.js';
 import { toPollDemandResponseDto } from '#presentation/dto/index.js';
 const TERMINATE_INTENT_LIMIT = 1000;
-export const pollDemandRoute = defineRoute({
-    method: 'POST',
-    path: '/demand/poll',
-    description: 'Poll aggregate runner demand and reserve capacity for a provisioner',
-    schema: {
-        body: pollDemandBodySchema,
-        response: {
-            200: pollDemandResponseSchema
-        }
-    },
-    handler: async (request, reply)=>{
-        const { provisionerTokenId, workspaceId } = requireProvisionerContext(request);
-        const abortController = new AbortController();
-        let responseFinished = false;
-        let responseReservations = [];
-        reply.raw.on('finish', ()=>{
-            responseFinished = true;
-        });
-        reply.raw.on('close', ()=>{
-            if (!responseFinished) {
-                abortController.abort();
-                void releaseReservationGrants(responseReservations).catch(()=>undefined);
+function toReservationTemplates(templates) {
+    return templates.map((template)=>({
+            templateKey: template.template_key,
+            labels: template.labels,
+            availableSlots: template.available_slots,
+            starting: template.starting,
+            running: template.running
+        }));
+}
+export function createPollDemandRoute(options = {}) {
+    return defineRoute({
+        method: 'POST',
+        path: '/demand/poll',
+        description: 'Poll aggregate runner demand and reserve capacity for a provisioner',
+        schema: {
+            body: pollDemandBodySchema,
+            response: {
+                200: pollDemandResponseSchema
+            }
+        },
+        handler: async (request, reply)=>{
+            const abortController = new AbortController();
+            let responseFinished = false;
+            let responseReservations = [];
+            reply.raw.on('finish', ()=>{
+                responseFinished = true;
+            });
+            reply.raw.on('close', ()=>{
+                if (!responseFinished) {
+                    abortController.abort();
+                    void releaseReservationGrants(responseReservations).catch(()=>undefined);
+                }
+            });
+            const provisionerContext = requireProvisionerContext(request);
+            if (provisionerContext.scope === 'installation') {
+                if (!options.installationProvisioning) {
+                    throw new ClientError('Installation provisioner credentials are not accepted on this host', 'forbidden', {
+                        status: 403
+                    });
+                }
+                const candidateWorkspaceIds = await listQueuedDemandWorkspaceIds();
+                const eligibleWorkspaceIds = await options.installationProvisioning.policy.filterEligibleWorkspaceIds(candidateWorkspaceIds);
+                const templates = toReservationTemplates(request.body.templates);
+                const result = await pollInstallationDemandAndReserve({
+                    provisionerId: provisionerContext.provisionerTokenId,
+                    maxReservations: request.body.max_reservations,
+                    ttlSeconds: config.RESERVATION_TTL_SECONDS,
+                    templates,
+                    capabilityWindowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,
+                    eligibleWorkspaceIds,
+                    signal: abortController.signal,
+                    onReservations: (reservations)=>{
+                        responseReservations.push(...reservations);
+                    }
+                });
+                return toPollDemandResponseDto({
+                    ...result,
+                    terminateRunnerInstanceIds: []
+                });
             }
-        });
-        const result = await pollDemand({
-            workspaceId,
-            provisionerId: provisionerTokenId,
-            maxReservations: request.body.max_reservations,
-            waitSeconds: request.body.wait_seconds,
-            ttlSeconds: config.RESERVATION_TTL_SECONDS,
-            terminateIntentLimit: TERMINATE_INTENT_LIMIT,
-            templates: request.body.templates.map((template)=>({
-                    templateKey: template.template_key,
-                    labels: template.labels,
-                    availableSlots: template.available_slots,
-                    starting: template.starting,
-                    running: template.running
-                })),
-            signal: abortController.signal
-        });
-        responseReservations = result.reservations;
-        return toPollDemandResponseDto(result);
-    }
-});
+            const { provisionerTokenId, workspaceId } = requireWorkspaceProvisionerContext(request);
+            const templates = toReservationTemplates(request.body.templates);
+            await publishWorkspaceProvisionerCapabilitySnapshot({
+                workspaceId,
+                provisionerId: provisionerTokenId,
+                templates
+            });
+            const result = await pollDemand({
+                workspaceId,
+                provisionerId: provisionerTokenId,
+                maxReservations: request.body.max_reservations,
+                waitSeconds: request.body.wait_seconds,
+                ttlSeconds: config.RESERVATION_TTL_SECONDS,
+                terminateIntentLimit: TERMINATE_INTENT_LIMIT,
+                templates,
+                signal: abortController.signal
+            });
+            responseReservations = result.reservations;
+            return toPollDemandResponseDto(result);
+        }
+    });
+}
+export const pollDemandRoute = createPollDemandRoute();
 
 //# sourceMappingURL=poll-demand.js.map

package/dist/presentation/routes/poll-demand.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/poll-demand.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {pollDemandBodySchema, pollDemandResponseSchema} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {config} from '#config.js';\nimport {pollDemand, releaseReservationGrants} from '#core/demand.js';\nimport type {ReservationGrant} from '#db/reservations.js';\nimport {toPollDemandResponseDto} from '#presentation/dto/index.js';\n\nconst TERMINATE_INTENT_LIMIT = 1000;\n\nexport const pollDemandRoute = defineRoute({\n  method: 'POST',\n  path: '/demand/poll',\n  description: 'Poll aggregate runner demand and reserve capacity for a provisioner',\n  schema: {\n    body: pollDemandBodySchema,\n    response: {\n      200: pollDemandResponseSchema,\n    },\n  },\n  handler: async (request, reply) => {\n    const {provisionerTokenId, workspaceId} = requireProvisionerContext(request);\n    const abortController = new AbortController();\n    let responseFinished = false;\n    let responseReservations: ReservationGrant[] = [];\n    reply.raw.on('finish', () => {\n      responseFinished = true;\n    });\n    reply.raw.on('close', () => {\n      if (!responseFinished) {\n        abortController.abort();\n        void releaseReservationGrants(responseReservations).catch(() => undefined);\n      }\n    });\n\n    const result = await pollDemand({\n      workspaceId,\n      provisionerId: provisionerTokenId,\n      maxReservations: request.body.max_reservations,\n      waitSeconds: request.body.wait_seconds,\n      ttlSeconds: config.RESERVATION_TTL_SECONDS,\n      terminateIntentLimit: TERMINATE_INTENT_LIMIT,\n      templates: request.body.templates.map((template) => ({\n        templateKey: template.template_key,\n        labels: template.labels,\n        availableSlots: template.available_slots,\n        starting: template.starting,\n        running: template.running,\n      })),\n      signal: abortController.signal,\n    });\n    responseReservations = result.reservations;\n\n    return toPollDemandResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","pollDemandBodySchema","pollDemandResponseSchema","defineRoute","config","pollDemand","releaseReservationGrants","toPollDemandResponseDto","TERMINATE_INTENT_LIMIT","pollDemandRoute","method","path","description","schema","body","response","handler","request","reply","provisionerTokenId","workspaceId","abortController","AbortController","responseFinished","responseReservations","raw","on","abort","catch","undefined","result","provisionerId","maxReservations","max_reservations","waitSeconds","wait_seconds","ttlSeconds","RESERVATION_TTL_SECONDS","terminateIntentLimit","templates","map","template","templateKey","template_key","labels","availableSlots","available_slots","starting","running","signal","reservations"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SAAQC,oBAAoB,EAAEC,wBAAwB,QAAO,2BAA2B;AACxF,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,UAAU,EAAEC,wBAAwB,QAAO,kBAAkB;AAErE,SAAQC,uBAAuB,QAAO,6BAA6B;AAEnE,MAAMC,yBAAyB;AAE/B,OAAO,MAAMC,kBAAkBN,YAAY;IACzCO,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMb;QACNc,UAAU;YACR,KAAKb;QACP;IACF;IACAc,SAAS,OAAOC,SAASC;QACvB,MAAM,EAACC,kBAAkB,EAAEC,WAAW,EAAC,GAAGpB,0BAA0BiB;QACpE,MAAMI,kBAAkB,IAAIC;QAC5B,IAAIC,mBAAmB;QACvB,IAAIC,uBAA2C,EAAE;QACjDN,MAAMO,GAAG,CAACC,EAAE,CAAC,UAAU;YACrBH,mBAAmB;QACrB;QACAL,MAAMO,GAAG,CAACC,EAAE,CAAC,SAAS;YACpB,IAAI,CAACH,kBAAkB;gBACrBF,gBAAgBM,KAAK;gBACrB,KAAKrB,yBAAyBkB,sBAAsBI,KAAK,CAAC,IAAMC;YAClE;QACF;QAEA,MAAMC,SAAS,MAAMzB,WAAW;YAC9Be;YACAW,eAAeZ;YACfa,iBAAiBf,QAAQH,IAAI,CAACmB,gBAAgB;YAC9CC,aAAajB,QAAQH,IAAI,CAACqB,YAAY;YACtCC,YAAYhC,OAAOiC,uBAAuB;YAC1CC,sBAAsB9B;YACtB+B,WAAWtB,QAAQH,IAAI,CAACyB,SAAS,CAACC,GAAG,CAAC,CAACC,WAAc,CAAA;oBACnDC,aAAaD,SAASE,YAAY;oBAClCC,QAAQH,SAASG,MAAM;oBACvBC,gBAAgBJ,SAASK,eAAe;oBACxCC,UAAUN,SAASM,QAAQ;oBAC3BC,SAASP,SAASO,OAAO;gBAC3B,CAAA;YACAC,QAAQ5B,gBAAgB4B,MAAM;QAChC;QACAzB,uBAAuBM,OAAOoB,YAAY;QAE1C,OAAO3C,wBAAwBuB;IACjC;AACF,GAAG"}
+{"version":3,"sources":["../../../src/presentation/routes/poll-demand.ts"],"sourcesContent":["import {\n  requireProvisionerContext,\n  requireWorkspaceProvisionerContext,\n} from '@shipfox/api-auth-context';\nimport type {PollDemandTemplateDto} from '@shipfox/api-runners-dto';\nimport {pollDemandBodySchema, pollDemandResponseSchema} from '@shipfox/api-runners-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {config} from '#config.js';\nimport {pollDemand, releaseReservationGrants} from '#core/demand.js';\nimport {publishWorkspaceProvisionerCapabilitySnapshot} from '#db/provisioner-capability-snapshots.js';\nimport {\n  listQueuedDemandWorkspaceIds,\n  pollInstallationDemandAndReserve,\n  type ReservationGrant,\n  type ReservationTemplate,\n} from '#db/reservations.js';\nimport type {CreateRunnersModuleOptions} from '#installation-provisioning.js';\nimport {toPollDemandResponseDto} from '#presentation/dto/index.js';\n\nconst TERMINATE_INTENT_LIMIT = 1000;\n\nfunction toReservationTemplates(templates: PollDemandTemplateDto[]): ReservationTemplate[] {\n  return templates.map((template) => ({\n    templateKey: template.template_key,\n    labels: template.labels,\n    availableSlots: template.available_slots,\n    starting: template.starting,\n    running: template.running,\n  }));\n}\n\nexport function createPollDemandRoute(options: CreateRunnersModuleOptions = {}) {\n  return defineRoute({\n    method: 'POST',\n    path: '/demand/poll',\n    description: 'Poll aggregate runner demand and reserve capacity for a provisioner',\n    schema: {\n      body: pollDemandBodySchema,\n      response: {\n        200: pollDemandResponseSchema,\n      },\n    },\n    handler: async (request, reply) => {\n      const abortController = new AbortController();\n      let responseFinished = false;\n      let responseReservations: ReservationGrant[] = [];\n      reply.raw.on('finish', () => {\n        responseFinished = true;\n      });\n      reply.raw.on('close', () => {\n        if (!responseFinished) {\n          abortController.abort();\n          void releaseReservationGrants(responseReservations).catch(() => undefined);\n        }\n      });\n      const provisionerContext = requireProvisionerContext(request);\n      if (provisionerContext.scope === 'installation') {\n        if (!options.installationProvisioning) {\n          throw new ClientError(\n            'Installation provisioner credentials are not accepted on this host',\n            'forbidden',\n            {\n              status: 403,\n            },\n          );\n        }\n        const candidateWorkspaceIds = await listQueuedDemandWorkspaceIds();\n        const eligibleWorkspaceIds =\n          await options.installationProvisioning.policy.filterEligibleWorkspaceIds(\n            candidateWorkspaceIds,\n          );\n        const templates = toReservationTemplates(request.body.templates);\n        const result = await pollInstallationDemandAndReserve({\n          provisionerId: provisionerContext.provisionerTokenId,\n          maxReservations: request.body.max_reservations,\n          ttlSeconds: config.RESERVATION_TTL_SECONDS,\n          templates,\n          capabilityWindowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n          eligibleWorkspaceIds,\n          signal: abortController.signal,\n          onReservations: (reservations) => {\n            responseReservations.push(...reservations);\n          },\n        });\n        return toPollDemandResponseDto({\n          ...result,\n          terminateRunnerInstanceIds: [],\n        });\n      }\n      const {provisionerTokenId, workspaceId} = requireWorkspaceProvisionerContext(request);\n\n      const templates = toReservationTemplates(request.body.templates);\n      await publishWorkspaceProvisionerCapabilitySnapshot({\n        workspaceId,\n        provisionerId: provisionerTokenId,\n        templates,\n      });\n\n      const result = await pollDemand({\n        workspaceId,\n        provisionerId: provisionerTokenId,\n        maxReservations: request.body.max_reservations,\n        waitSeconds: request.body.wait_seconds,\n        ttlSeconds: config.RESERVATION_TTL_SECONDS,\n        terminateIntentLimit: TERMINATE_INTENT_LIMIT,\n        templates,\n        signal: abortController.signal,\n      });\n      responseReservations = result.reservations;\n\n      return toPollDemandResponseDto(result);\n    },\n  });\n}\n\nexport const pollDemandRoute = createPollDemandRoute();\n"],"names":["requireProvisionerContext","requireWorkspaceProvisionerContext","pollDemandBodySchema","pollDemandResponseSchema","ClientError","defineRoute","config","pollDemand","releaseReservationGrants","publishWorkspaceProvisionerCapabilitySnapshot","listQueuedDemandWorkspaceIds","pollInstallationDemandAndReserve","toPollDemandResponseDto","TERMINATE_INTENT_LIMIT","toReservationTemplates","templates","map","template","templateKey","template_key","labels","availableSlots","available_slots","starting","running","createPollDemandRoute","options","method","path","description","schema","body","response","handler","request","reply","abortController","AbortController","responseFinished","responseReservations","raw","on","abort","catch","undefined","provisionerContext","scope","installationProvisioning","status","candidateWorkspaceIds","eligibleWorkspaceIds","policy","filterEligibleWorkspaceIds","result","provisionerId","provisionerTokenId","maxReservations","max_reservations","ttlSeconds","RESERVATION_TTL_SECONDS","capabilityWindowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","signal","onReservations","reservations","push","terminateRunnerInstanceIds","workspaceId","waitSeconds","wait_seconds","terminateIntentLimit","pollDemandRoute"],"mappings":"AAAA,SACEA,yBAAyB,EACzBC,kCAAkC,QAC7B,4BAA4B;AAEnC,SAAQC,oBAAoB,EAAEC,wBAAwB,QAAO,2BAA2B;AACxF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,UAAU,EAAEC,wBAAwB,QAAO,kBAAkB;AACrE,SAAQC,6CAA6C,QAAO,0CAA0C;AACtG,SACEC,4BAA4B,EAC5BC,gCAAgC,QAG3B,sBAAsB;AAE7B,SAAQC,uBAAuB,QAAO,6BAA6B;AAEnE,MAAMC,yBAAyB;AAE/B,SAASC,uBAAuBC,SAAkC;IAChE,OAAOA,UAAUC,GAAG,CAAC,CAACC,WAAc,CAAA;YAClCC,aAAaD,SAASE,YAAY;YAClCC,QAAQH,SAASG,MAAM;YACvBC,gBAAgBJ,SAASK,eAAe;YACxCC,UAAUN,SAASM,QAAQ;YAC3BC,SAASP,SAASO,OAAO;QAC3B,CAAA;AACF;AAEA,OAAO,SAASC,sBAAsBC,UAAsC,CAAC,CAAC;IAC5E,OAAOrB,YAAY;QACjBsB,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YACNC,MAAM7B;YACN8B,UAAU;gBACR,KAAK7B;YACP;QACF;QACA8B,SAAS,OAAOC,SAASC;YACvB,MAAMC,kBAAkB,IAAIC;YAC5B,IAAIC,mBAAmB;YACvB,IAAIC,uBAA2C,EAAE;YACjDJ,MAAMK,GAAG,CAACC,EAAE,CAAC,UAAU;gBACrBH,mBAAmB;YACrB;YACAH,MAAMK,GAAG,CAACC,EAAE,CAAC,SAAS;gBACpB,IAAI,CAACH,kBAAkB;oBACrBF,gBAAgBM,KAAK;oBACrB,KAAKlC,yBAAyB+B,sBAAsBI,KAAK,CAAC,IAAMC;gBAClE;YACF;YACA,MAAMC,qBAAqB7C,0BAA0BkC;YACrD,IAAIW,mBAAmBC,KAAK,KAAK,gBAAgB;gBAC/C,IAAI,CAACpB,QAAQqB,wBAAwB,EAAE;oBACrC,MAAM,IAAI3C,YACR,sEACA,aACA;wBACE4C,QAAQ;oBACV;gBAEJ;gBACA,MAAMC,wBAAwB,MAAMvC;gBACpC,MAAMwC,uBACJ,MAAMxB,QAAQqB,wBAAwB,CAACI,MAAM,CAACC,0BAA0B,CACtEH;gBAEJ,MAAMlC,YAAYD,uBAAuBoB,QAAQH,IAAI,CAAChB,SAAS;gBAC/D,MAAMsC,SAAS,MAAM1C,iCAAiC;oBACpD2C,eAAeT,mBAAmBU,kBAAkB;oBACpDC,iBAAiBtB,QAAQH,IAAI,CAAC0B,gBAAgB;oBAC9CC,YAAYpD,OAAOqD,uBAAuB;oBAC1C5C;oBACA6C,yBAAyBtD,OAAOuD,iCAAiC;oBACjEX;oBACAY,QAAQ1B,gBAAgB0B,MAAM;oBAC9BC,gBAAgB,CAACC;wBACfzB,qBAAqB0B,IAAI,IAAID;oBAC/B;gBACF;gBACA,OAAOpD,wBAAwB;oBAC7B,GAAGyC,MAAM;oBACTa,4BAA4B,EAAE;gBAChC;YACF;YACA,MAAM,EAACX,kBAAkB,EAAEY,WAAW,EAAC,GAAGlE,mCAAmCiC;YAE7E,MAAMnB,YAAYD,uBAAuBoB,QAAQH,IAAI,CAAChB,SAAS;YAC/D,MAAMN,8CAA8C;gBAClD0D;gBACAb,eAAeC;gBACfxC;YACF;YAEA,MAAMsC,SAAS,MAAM9C,WAAW;gBAC9B4D;gBACAb,eAAeC;gBACfC,iBAAiBtB,QAAQH,IAAI,CAAC0B,gBAAgB;gBAC9CW,aAAalC,QAAQH,IAAI,CAACsC,YAAY;gBACtCX,YAAYpD,OAAOqD,uBAAuB;gBAC1CW,sBAAsBzD;gBACtBE;gBACA+C,QAAQ1B,gBAAgB0B,MAAM;YAChC;YACAvB,uBAAuBc,OAAOW,YAAY;YAE1C,OAAOpD,wBAAwByC;QACjC;IACF;AACF;AAEA,OAAO,MAAMkB,kBAAkB9C,wBAAwB"}

package/dist/presentation/routes/reconcile-runner-instances.d.ts

@@ -0,0 +1,2 @@
+export declare const reconcileRunnerInstancesRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=reconcile-runner-instances.d.ts.map

package/dist/presentation/routes/reconcile-runner-instances.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-runner-instances.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/reconcile-runner-instances.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,6BAA6B,iDAoBxC,CAAC"}

package/dist/presentation/routes/reconcile-runner-instances.js

@@ -0,0 +1,27 @@
+import { requireProvisionerContext } from '@shipfox/api-auth-context';
+import { reconcileRunnerInstancesBodySchema, reconcileRunnerInstancesResponseSchema } from '@shipfox/api-runners-dto';
+import { defineRoute } from '@shipfox/node-fastify';
+import { reconcileRunnerInstances } from '#core/index.js';
+import { toReconcileRunnerInstancesResponseDto } from '#presentation/dto/index.js';
+export const reconcileRunnerInstancesRoute = defineRoute({
+    method: 'POST',
+    path: '/runner-instances/reconcile',
+    description: 'Reconcile provisioned runner state for a provisioner',
+    schema: {
+        body: reconcileRunnerInstancesBodySchema,
+        response: {
+            200: reconcileRunnerInstancesResponseSchema
+        }
+    },
+    handler: async (request)=>{
+        const context = requireProvisionerContext(request);
+        const result = await reconcileRunnerInstances({
+            workspaceId: context.scope === 'workspace' ? context.workspaceId : null,
+            provisionerId: context.provisionerTokenId,
+            observedRunnerInstanceIds: request.body.observed_provider_runner_ids
+        });
+        return toReconcileRunnerInstancesResponseDto(result);
+    }
+});
+
+//# sourceMappingURL=reconcile-runner-instances.js.map

package/dist/presentation/routes/reconcile-runner-instances.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/reconcile-runner-instances.ts"],"sourcesContent":["import {requireProvisionerContext} from '@shipfox/api-auth-context';\nimport {\n  reconcileRunnerInstancesBodySchema,\n  reconcileRunnerInstancesResponseSchema,\n} from '@shipfox/api-runners-dto';\nimport {defineRoute} from '@shipfox/node-fastify';\nimport {reconcileRunnerInstances} from '#core/index.js';\nimport {toReconcileRunnerInstancesResponseDto} from '#presentation/dto/index.js';\n\nexport const reconcileRunnerInstancesRoute = defineRoute({\n  method: 'POST',\n  path: '/runner-instances/reconcile',\n  description: 'Reconcile provisioned runner state for a provisioner',\n  schema: {\n    body: reconcileRunnerInstancesBodySchema,\n    response: {\n      200: reconcileRunnerInstancesResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const context = requireProvisionerContext(request);\n    const result = await reconcileRunnerInstances({\n      workspaceId: context.scope === 'workspace' ? context.workspaceId : null,\n      provisionerId: context.provisionerTokenId,\n      observedRunnerInstanceIds: request.body.observed_provider_runner_ids,\n    });\n\n    return toReconcileRunnerInstancesResponseDto(result);\n  },\n});\n"],"names":["requireProvisionerContext","reconcileRunnerInstancesBodySchema","reconcileRunnerInstancesResponseSchema","defineRoute","reconcileRunnerInstances","toReconcileRunnerInstancesResponseDto","reconcileRunnerInstancesRoute","method","path","description","schema","body","response","handler","request","context","result","workspaceId","scope","provisionerId","provisionerTokenId","observedRunnerInstanceIds","observed_provider_runner_ids"],"mappings":"AAAA,SAAQA,yBAAyB,QAAO,4BAA4B;AACpE,SACEC,kCAAkC,EAClCC,sCAAsC,QACjC,2BAA2B;AAClC,SAAQC,WAAW,QAAO,wBAAwB;AAClD,SAAQC,wBAAwB,QAAO,iBAAiB;AACxD,SAAQC,qCAAqC,QAAO,6BAA6B;AAEjF,OAAO,MAAMC,gCAAgCH,YAAY;IACvDI,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMV;QACNW,UAAU;YACR,KAAKV;QACP;IACF;IACAW,SAAS,OAAOC;QACd,MAAMC,UAAUf,0BAA0Bc;QAC1C,MAAME,SAAS,MAAMZ,yBAAyB;YAC5Ca,aAAaF,QAAQG,KAAK,KAAK,cAAcH,QAAQE,WAAW,GAAG;YACnEE,eAAeJ,QAAQK,kBAAkB;YACzCC,2BAA2BP,QAAQH,IAAI,CAACW,4BAA4B;QACtE;QAEA,OAAOjB,sCAAsCW;IAC/C;AACF,GAAG"}

package/dist/presentation/routes/register.d.ts

@@ -1,2 +1,3 @@
-export declare const registerRoute: import("@shipfox/node-fastify").RouteDefinition;
+import type { AuthInterModuleClient } from '@shipfox/api-auth-dto/inter-module';
+export declare function createRegisterRoute(auth: AuthInterModuleClient): import("@shipfox/node-fastify").RouteDefinition;
 //# sourceMappingURL=register.d.ts.map

package/dist/presentation/routes/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/register.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,aAAa,iDA+DxB,CAAC"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AAY9E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,mDAkE9D"}

package/dist/presentation/routes/register.js

@@ -4,60 +4,63 @@ import { EmptyRunnerLabelsError, RegistrationTokenConsumedError, RegistrationTok
 import { registerRunnerSession } from '#core/runner-sessions.js';
 import { getRunnerContext } from '#presentation/auth/index.js';
 import { createEphemeralRegisterRateLimitPreHandler } from './rate-limit.js';
-export const registerRoute = defineRoute({
-    method: 'POST',
-    path: '/register',
-    description: 'Exchange a runner registration token for a runner session token',
-    schema: {
-        body: registerRunnerBodySchema,
-        response: {
-            200: registerRunnerResponseSchema
-        }
-    },
-    preHandler: createEphemeralRegisterRateLimitPreHandler(),
-    errorHandler: (error, request)=>{
-        if (error instanceof EmptyRunnerLabelsError) {
-            throw new ClientError(error.message, 'empty-runner-labels', {
-                status: 400
-            });
-        }
-        if (error instanceof RegistrationTokenConsumedError) {
-            const runner = getRunnerContext(request);
-            if (runner.kind === 'ephemeral') {
-                request.log.warn({
-                    ephemeralTokenId: error.ephemeralTokenId,
-                    provisionerId: runner.provisionerId
-                }, 'Ephemeral registration token reuse rejected');
+export function createRegisterRoute(auth) {
+    return defineRoute({
+        method: 'POST',
+        path: '/register',
+        description: 'Exchange a runner registration token for a runner session token',
+        schema: {
+            body: registerRunnerBodySchema,
+            response: {
+                200: registerRunnerResponseSchema
             }
-            throw new ClientError('Registration token has already been consumed', 'registration-token-consumed', {
-                status: 409
-            });
-        }
-        if (error instanceof RegistrationTokenExpiredError) {
-            throw new ClientError('Registration token has expired', 'registration-token-expired', {
-                status: 401
+        },
+        preHandler: createEphemeralRegisterRateLimitPreHandler(),
+        errorHandler: (error, request)=>{
+            if (error instanceof EmptyRunnerLabelsError) {
+                throw new ClientError(error.message, 'empty-runner-labels', {
+                    status: 400
+                });
+            }
+            if (error instanceof RegistrationTokenConsumedError) {
+                const runner = getRunnerContext(request);
+                if (runner.kind === 'ephemeral') {
+                    request.log.warn({
+                        ephemeralTokenId: error.ephemeralTokenId,
+                        provisionerId: runner.provisionerId
+                    }, 'Ephemeral registration token reuse rejected');
+                }
+                throw new ClientError('Registration token has already been consumed', 'registration-token-consumed', {
+                    status: 409
+                });
+            }
+            if (error instanceof RegistrationTokenExpiredError) {
+                throw new ClientError('Registration token has expired', 'registration-token-expired', {
+                    status: 401
+                });
+            }
+            throw error;
+        },
+        handler: async (request)=>{
+            const runner = getRunnerContext(request);
+            const result = await registerRunnerSession({
+                auth,
+                credential: runner.kind === 'manual' ? {
+                    kind: 'manual',
+                    registrationTokenId: runner.registrationTokenId,
+                    workspaceId: runner.workspaceId
+                } : runner,
+                labels: request.body.labels,
+                toolCapabilities: request.body.capabilities ?? null
             });
+            return {
+                session_token: result.sessionToken,
+                session_id: result.session.id,
+                mode: result.mode,
+                max_claims: result.maxClaims
+            };
         }
-        throw error;
-    },
-    handler: async (request)=>{
-        const runner = getRunnerContext(request);
-        const result = await registerRunnerSession({
-            credential: runner.kind === 'manual' ? {
-                kind: 'manual',
-                registrationTokenId: runner.registrationTokenId,
-                workspaceId: runner.workspaceId
-            } : runner,
-            labels: request.body.labels,
-            toolCapabilities: request.body.capabilities ?? null
-        });
-        return {
-            session_token: result.sessionToken,
-            session_id: result.session.id,
-            mode: result.mode,
-            max_claims: result.maxClaims
-        };
-    }
-});
+    });
+}
 
 //# sourceMappingURL=register.js.map