@shipfox/api-runners 5.0.0 → 7.0.1

package/src/db/provisioner-capability-snapshots.test.ts

@@ -0,0 +1,175 @@
+import {and, eq} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {
+  hasActiveWorkspaceProvisionerCapability,
+  listActiveWorkspaceProvisionerCapabilitySnapshots,
+  listStaleWorkspaceProvisionerCapabilitySnapshots,
+  publishWorkspaceProvisionerCapabilitySnapshot,
+} from '#db/provisioner-capability-snapshots.js';
+import {provisionerCapabilitySnapshots} from '#db/schema/provisioner-capability-snapshots.js';
+import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
+import {provisionerTokenFactory} from '#test/index.js';
+
+describe('workspace provisioner capability snapshots', () => {
+  let workspaceId: string;
+
+  beforeEach(() => {
+    workspaceId = crypto.randomUUID();
+  });
+
+  it('atomically replaces one provisioner complete template snapshot', async () => {
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux', ['linux'], 4, 1, 3), template('macos', ['macos'], 2, 0, 2)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux-arm64', ['linux', 'arm64'], 0, 1, 0)],
+    });
+
+    const rows = await snapshotsFor(provisioner.id);
+    expect(rows).toEqual([
+      expect.objectContaining({
+        templateKey: 'linux-arm64',
+        labels: ['arm64', 'linux'],
+        availableSlots: 0,
+        starting: 1,
+        running: 0,
+      }),
+    ]);
+  });
+
+  it('keeps zero-slot overlapping capability active for every workspace provisioner', async () => {
+    const first = await provisionerTokenFactory.create({workspaceId});
+    const second = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: first.id,
+      templates: [template('linux', ['linux', 'x64'], 0, 0, 1)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: second.id,
+      templates: [template('linux-gpu', ['linux', 'gpu'], 2, 1, 1)],
+    });
+
+    const active = await listActiveWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const hasLinux = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux'],
+      windowSeconds: 60,
+    });
+    const hasLinuxX64 = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux', 'x64'],
+      windowSeconds: 60,
+    });
+
+    expect(active).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({provisionerId: first.id, availableSlots: 0}),
+        expect.objectContaining({provisionerId: second.id, labels: ['gpu', 'linux']}),
+      ]),
+    );
+    expect(hasLinux).toBe(true);
+    expect(hasLinuxX64).toBe(true);
+  });
+
+  it('requires every advertised label to be present, not just an overlap', async () => {
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: provisioner.id,
+      templates: [template('linux', ['linux'], 1, 0, 0)],
+    });
+
+    const hasLinuxArm64 = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux', 'arm64'],
+      windowSeconds: 60,
+    });
+
+    expect(hasLinuxArm64).toBe(false);
+  });
+
+  it('excludes stale and revoked provisioner capability from active matching', async () => {
+    const staleProvisioner = await provisionerTokenFactory.create({workspaceId});
+    const revokedProvisioner = await provisionerTokenFactory.create({workspaceId});
+
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: staleProvisioner.id,
+      templates: [template('stale-linux', ['linux'], 1, 0, 1)],
+    });
+    await publishWorkspaceProvisionerCapabilitySnapshot({
+      workspaceId,
+      provisionerId: revokedProvisioner.id,
+      templates: [template('revoked-macos', ['macos'], 1, 0, 1)],
+    });
+    await db()
+      .update(provisionerCapabilitySnapshots)
+      .set({advertisedAt: new Date(Date.now() - 61_000)})
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, staleProvisioner.id));
+    await db()
+      .update(provisionerTokens)
+      .set({revokedAt: new Date()})
+      .where(eq(provisionerTokens.id, revokedProvisioner.id));
+
+    const active = await listActiveWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const stale = await listStaleWorkspaceProvisionerCapabilitySnapshots({
+      workspaceId,
+      windowSeconds: 60,
+    });
+    const hasLinux = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['linux'],
+      windowSeconds: 60,
+    });
+    const hasMacos = await hasActiveWorkspaceProvisionerCapability({
+      workspaceId,
+      requiredLabels: ['macos'],
+      windowSeconds: 60,
+    });
+
+    expect(active).toEqual([]);
+    expect(stale.map((snapshot) => snapshot.provisionerId).sort()).toEqual(
+      [staleProvisioner.id, revokedProvisioner.id].sort(),
+    );
+    expect(hasLinux).toBe(false);
+    expect(hasMacos).toBe(false);
+  });
+
+  function snapshotsFor(provisionerId: string) {
+    return db()
+      .select()
+      .from(provisionerCapabilitySnapshots)
+      .where(
+        and(
+          eq(provisionerCapabilitySnapshots.workspaceId, workspaceId),
+          eq(provisionerCapabilitySnapshots.provisionerId, provisionerId),
+        ),
+      );
+  }
+
+  function template(
+    templateKey: string,
+    labels: string[],
+    availableSlots: number,
+    starting: number,
+    running: number,
+  ) {
+    return {templateKey, labels, availableSlots, starting, running};
+  }
+});

package/src/db/provisioner-capability-snapshots.ts

@@ -0,0 +1,130 @@
+import {canonicalizeLabels} from '@shipfox/runner-labels';
+import {and, arrayContains, eq, gt, isNotNull, isNull, lte, or, sql} from 'drizzle-orm';
+import type {ProvisionerCapabilitySnapshot} from '#core/entities/provisioner-capability-snapshot.js';
+import {db} from './db.js';
+import type {ReservationTemplate} from './reservations.js';
+import {
+  provisionerCapabilitySnapshots,
+  toProvisionerCapabilitySnapshot,
+} from './schema/provisioner-capability-snapshots.js';
+import {provisionerTokens} from './schema/provisioner-tokens.js';
+
+export async function publishWorkspaceProvisionerCapabilitySnapshot(params: {
+  workspaceId: string;
+  provisionerId: string;
+  templates: ReservationTemplate[];
+}): Promise<void> {
+  await db().transaction(async (tx) => {
+    await tx
+      .delete(provisionerCapabilitySnapshots)
+      .where(eq(provisionerCapabilitySnapshots.provisionerId, params.provisionerId));
+
+    if (params.templates.length === 0) return;
+
+    await tx.insert(provisionerCapabilitySnapshots).values(
+      params.templates.map((template) => ({
+        workspaceId: params.workspaceId,
+        provisionerId: params.provisionerId,
+        templateKey: template.templateKey,
+        labels: [...canonicalizeLabels(template.labels)],
+        availableSlots: template.availableSlots,
+        starting: template.starting,
+        running: template.running,
+      })),
+    );
+  });
+}
+
+export async function listActiveWorkspaceProvisionerCapabilitySnapshots(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}): Promise<ProvisionerCapabilitySnapshot[]> {
+  const rows = await db()
+    .select({snapshot: provisionerCapabilitySnapshots})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(and(...activeWorkspaceProvisionerCapabilityConditions(params)));
+
+  return rows.map(({snapshot}) => toProvisionerCapabilitySnapshot(snapshot));
+}
+
+export async function listStaleWorkspaceProvisionerCapabilitySnapshots(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}): Promise<ProvisionerCapabilitySnapshot[]> {
+  const rows = await db()
+    .select({snapshot: provisionerCapabilitySnapshots})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(
+      and(
+        eq(provisionerCapabilitySnapshots.workspaceId, params.workspaceId),
+        or(
+          lte(
+            provisionerCapabilitySnapshots.advertisedAt,
+            sql`now() - (${params.windowSeconds} || ' seconds')::interval`,
+          ),
+          eq(provisionerTokens.scope, 'installation'),
+          isNull(provisionerTokens.workspaceId),
+          provisionerTokenIsUnavailable(),
+        ),
+      ),
+    );
+
+  return rows.map(({snapshot}) => toProvisionerCapabilitySnapshot(snapshot));
+}
+
+export async function hasActiveWorkspaceProvisionerCapability(params: {
+  workspaceId: string;
+  requiredLabels: string[];
+  windowSeconds: number;
+}): Promise<boolean> {
+  const [row] = await db()
+    .select({id: provisionerCapabilitySnapshots.id})
+    .from(provisionerCapabilitySnapshots)
+    .innerJoin(
+      provisionerTokens,
+      eq(provisionerTokens.id, provisionerCapabilitySnapshots.provisionerId),
+    )
+    .where(
+      and(
+        ...activeWorkspaceProvisionerCapabilityConditions(params),
+        arrayContains(provisionerCapabilitySnapshots.labels, [
+          ...canonicalizeLabels(params.requiredLabels),
+        ]),
+      ),
+    )
+    .limit(1);
+
+  return row !== undefined;
+}
+
+function activeWorkspaceProvisionerCapabilityConditions(params: {
+  workspaceId: string;
+  windowSeconds: number;
+}) {
+  return [
+    eq(provisionerCapabilitySnapshots.workspaceId, params.workspaceId),
+    eq(provisionerTokens.workspaceId, params.workspaceId),
+    eq(provisionerTokens.scope, 'workspace' as const),
+    isNull(provisionerTokens.revokedAt),
+    or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, sql`now()`)),
+    gt(
+      provisionerCapabilitySnapshots.advertisedAt,
+      sql`now() - (${params.windowSeconds} || ' seconds')::interval`,
+    ),
+  ];
+}
+
+function provisionerTokenIsUnavailable() {
+  return or(
+    isNotNull(provisionerTokens.revokedAt),
+    and(isNotNull(provisionerTokens.expiresAt), lte(provisionerTokens.expiresAt, sql`now()`)),
+  );
+}

package/src/db/provisioner-tokens.test.ts

@@ -1,5 +1,5 @@
 import {hashOpaqueToken} from '@shipfox/node-tokens';
-import {sql} from 'drizzle-orm';
+import {eq, sql} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {
   createProvisionerToken,
@@ -9,7 +9,12 @@ import {
   revokeProvisionerToken,
   touchProvisionerLastSeen,
 } from '#db/provisioner-tokens.js';
-import {provisionerTokenFactory} from '#test/index.js';
+import {provisionerTokens} from '#db/schema/provisioner-tokens.js';
+import {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';
+import {runnerBootstrapTokens, runnerControlSessions} from '#db/schema/runner-control-sessions.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
+import {runnerSessions} from '#db/schema/runner-sessions.js';
+import {providerRunnerFactory, provisionerTokenFactory} from '#test/index.js';
 
 describe('provisioner token db', () => {
   it('creates and resolves a token', async () => {
@@ -17,6 +22,7 @@ describe('provisioner token db', () => {
     const rawToken = 'sf_pt_test-token';
     const createdByUserId = crypto.randomUUID();
     const token = await createProvisionerToken({
+      scope: 'workspace',
       workspaceId,
       hashedToken: hashOpaqueToken(rawToken),
       prefix: rawToken.slice(0, 12),
@@ -37,6 +43,28 @@ describe('provisioner token db', () => {
     expect(result).toBeUndefined();
   });
 
+  it('creates installation factory tokens without a workspace', async () => {
+    const token = await provisionerTokenFactory.create({scope: 'installation'});
+
+    expect(token).toMatchObject({scope: 'installation', workspaceId: null});
+  });
+
+  it('enforces valid scope and workspace combinations in PostgreSQL', async () => {
+    const insert = (scope: 'installation' | 'workspace', workspaceId: string | null) =>
+      db()
+        .insert(provisionerTokens)
+        .values({
+          scope,
+          workspaceId,
+          hashedToken: hashOpaqueToken(`${scope}-${workspaceId}`),
+          prefix: 'sf_pt_invalid',
+          createdByUserId: crypto.randomUUID(),
+        });
+
+    await expect(insert('installation', crypto.randomUUID())).rejects.toThrow();
+    await expect(insert('workspace', null)).rejects.toThrow();
+  });
+
   it('lists usable tokens for a workspace', async () => {
     const workspaceId = crypto.randomUUID();
     const usable = await provisionerTokenFactory.create({workspaceId, name: 'usable'});
@@ -74,6 +102,115 @@ describe('provisioner token db', () => {
     expect(revoked?.revokedByUserId).toBe(revokedByUserId);
   });
 
+  it("cascades revocation to the provisioner's unclaimed runner credentials and sessions", async () => {
+    const workspaceId = crypto.randomUUID();
+    const provisioner = await provisionerTokenFactory.create({workspaceId});
+    const runner = await providerRunnerFactory.create({
+      workspaceId,
+      provisionerId: provisioner.id,
+      runnerSessionId: null,
+    });
+    const future = new Date(Date.now() + 60_000);
+    const tokenValue = (name: string) => hashOpaqueToken(`${name}-${crypto.randomUUID()}`);
+    await db()
+      .insert(runnerBootstrapTokens)
+      .values({
+        runnerInstanceId: runner.id,
+        provisionerId: provisioner.id,
+        hashedToken: tokenValue('bootstrap'),
+        prefix: 'bootstrap',
+        expiresAt: future,
+      });
+    await db()
+      .insert(runnerControlSessions)
+      .values({
+        runnerInstanceId: runner.id,
+        provisionerId: provisioner.id,
+        hashedToken: tokenValue('control'),
+        prefix: 'control',
+        expiresAt: future,
+      });
+    await db()
+      .insert(runnerActivationTokens)
+      .values({
+        runnerInstanceId: runner.id,
+        hashedToken: tokenValue('activation'),
+        prefix: 'activation',
+        expiresAt: future,
+      });
+    const [unclaimedSession] = await db()
+      .insert(runnerSessions)
+      .values({
+        workspaceId,
+        scope: 'workspace',
+        registrationTokenId: crypto.randomUUID(),
+        registrationTokenKind: 'activation',
+        runnerInstanceId: runner.id,
+        provisionerId: provisioner.id,
+        providerRunnerId: runner.providerRunnerId,
+        labels: ['linux'],
+        maxClaims: 1,
+        claimsUsed: 0,
+      })
+      .returning();
+    const [claimedSession] = await db()
+      .insert(runnerSessions)
+      .values({
+        workspaceId,
+        scope: 'workspace',
+        registrationTokenId: crypto.randomUUID(),
+        registrationTokenKind: 'activation',
+        runnerInstanceId: crypto.randomUUID(),
+        provisionerId: provisioner.id,
+        providerRunnerId: crypto.randomUUID(),
+        labels: ['linux'],
+        maxClaims: 1,
+        claimsUsed: 1,
+      })
+      .returning();
+    if (!unclaimedSession || !claimedSession) throw new Error('Runner sessions were not created');
+
+    await revokeProvisionerToken({
+      tokenId: provisioner.id,
+      workspaceId,
+      revokedByUserId: crypto.randomUUID(),
+    });
+
+    const [bootstrap] = await db()
+      .select()
+      .from(runnerBootstrapTokens)
+      .where(eq(runnerBootstrapTokens.runnerInstanceId, runner.id));
+    const [control] = await db()
+      .select()
+      .from(runnerControlSessions)
+      .where(eq(runnerControlSessions.runnerInstanceId, runner.id));
+    const [activation] = await db()
+      .select()
+      .from(runnerActivationTokens)
+      .where(eq(runnerActivationTokens.runnerInstanceId, runner.id));
+    const [terminatedRunner] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.id));
+    const [revokedSession] = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.id, unclaimedSession.id));
+    const [preservedSession] = await db()
+      .select()
+      .from(runnerSessions)
+      .where(eq(runnerSessions.id, claimedSession.id));
+
+    expect(bootstrap?.revokedAt).toBeInstanceOf(Date);
+    expect(control).toMatchObject({closeReason: 'provisioner-revoked'});
+    expect(control?.closedAt).toBeInstanceOf(Date);
+    expect(activation?.revokedAt).toBeInstanceOf(Date);
+    expect(terminatedRunner).toMatchObject({state: 'terminated'});
+    expect(terminatedRunner?.terminatedAt).toBeInstanceOf(Date);
+    expect(revokedSession?.revokedAt).toBeInstanceOf(Date);
+    expect(preservedSession?.revokedAt).toBeNull();
+  });
+
   it('preserves the original revocation audit fields on repeat revoke', async () => {
     const workspaceId = crypto.randomUUID();
     const token = await provisionerTokenFactory.create({workspaceId});

package/src/db/provisioner-tokens.ts

@@ -1,10 +1,19 @@
-import {and, desc, eq, gt, isNull, or, sql} from 'drizzle-orm';
-import type {ActiveProvisionerToken, ProvisionerToken} from '#core/entities/provisioner-token.js';
+import {and, desc, eq, gt, inArray, isNull, or, sql} from 'drizzle-orm';
+import type {
+  ActiveProvisionerToken,
+  ProvisionerScope,
+  ProvisionerToken,
+} from '#core/entities/provisioner-token.js';
 import {db} from './db.js';
 import {provisionerTokens, toProvisionerToken} from './schema/provisioner-tokens.js';
+import {runnerActivationTokens} from './schema/runner-activation-tokens.js';
+import {runnerBootstrapTokens, runnerControlSessions} from './schema/runner-control-sessions.js';
+import {providerRunners} from './schema/runner-instances.js';
+import {runnerSessions} from './schema/runner-sessions.js';
 
 export interface CreateProvisionerTokenParams {
-  workspaceId: string;
+  scope: ProvisionerScope;
+  workspaceId?: string | undefined;
   hashedToken: string;
   prefix: string;
   createdByUserId: string;
@@ -12,13 +21,68 @@ export interface CreateProvisionerTokenParams {
   expiresAt?: Date | undefined;
 }
 
+async function cascadeProvisionerRevocation(
+  tx: Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0],
+  provisionerId: string,
+) {
+  await tx
+    .update(runnerBootstrapTokens)
+    .set({revokedAt: sql`now()`})
+    .where(eq(runnerBootstrapTokens.provisionerId, provisionerId));
+  await tx
+    .update(runnerControlSessions)
+    .set({closedAt: sql`now()`, closeReason: 'provisioner-revoked'})
+    .where(
+      and(
+        eq(runnerControlSessions.provisionerId, provisionerId),
+        isNull(runnerControlSessions.closedAt),
+      ),
+    );
+  await tx
+    .update(runnerActivationTokens)
+    .set({revokedAt: sql`now()`})
+    .where(
+      and(
+        isNull(runnerActivationTokens.consumedAt),
+        isNull(runnerActivationTokens.revokedAt),
+        inArray(
+          runnerActivationTokens.runnerInstanceId,
+          tx
+            .select({id: providerRunners.id})
+            .from(providerRunners)
+            .where(eq(providerRunners.provisionerId, provisionerId)),
+        ),
+      ),
+    );
+  await tx
+    .update(providerRunners)
+    .set({state: 'terminated', terminatedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(
+      and(
+        eq(providerRunners.provisionerId, provisionerId),
+        isNull(providerRunners.runnerSessionId),
+      ),
+    );
+  await tx
+    .update(runnerSessions)
+    .set({revokedAt: sql`now()`})
+    .where(
+      and(
+        eq(runnerSessions.provisionerId, provisionerId),
+        eq(runnerSessions.claimsUsed, 0),
+        isNull(runnerSessions.revokedAt),
+      ),
+    );
+}
+
 export async function createProvisionerToken(
   params: CreateProvisionerTokenParams,
 ): Promise<ProvisionerToken> {
   const rows = await db()
     .insert(provisionerTokens)
     .values({
-      workspaceId: params.workspaceId,
+      scope: params.scope,
+      workspaceId: params.workspaceId ?? null,
       hashedToken: params.hashedToken,
       prefix: params.prefix,
       createdByUserId: params.createdByUserId,
@@ -32,6 +96,42 @@ export async function createProvisionerToken(
   return toProvisionerToken(row);
 }
 
+export async function revokeInstallationProvisionerToken(params: {
+  tokenId: string;
+  revokedByUserId: string;
+}): Promise<ProvisionerToken | undefined> {
+  const rows = await db().transaction(async (tx) => {
+    const rows = await tx
+      .update(provisionerTokens)
+      .set({revokedAt: new Date(), revokedByUserId: params.revokedByUserId, updatedAt: new Date()})
+      .where(
+        and(
+          eq(provisionerTokens.id, params.tokenId),
+          eq(provisionerTokens.scope, 'installation'),
+          isNull(provisionerTokens.revokedAt),
+        ),
+      )
+      .returning();
+    if (rows[0]) {
+      await cascadeProvisionerRevocation(tx, params.tokenId);
+    }
+    return rows;
+  });
+
+  const row = rows[0];
+  if (row) return toProvisionerToken(row);
+
+  const existingRows = await db()
+    .select()
+    .from(provisionerTokens)
+    .where(
+      and(eq(provisionerTokens.id, params.tokenId), eq(provisionerTokens.scope, 'installation')),
+    )
+    .limit(1);
+  const existingRow = existingRows[0];
+  return existingRow ? toProvisionerToken(existingRow) : undefined;
+}
+
 export async function listUsableProvisionerTokensByWorkspaceId(
   workspaceId: string,
 ): Promise<ProvisionerToken[]> {
@@ -42,6 +142,7 @@ export async function listUsableProvisionerTokensByWorkspaceId(
     .where(
       and(
         eq(provisionerTokens.workspaceId, workspaceId),
+        eq(provisionerTokens.scope, 'workspace'),
         isNull(provisionerTokens.revokedAt),
         or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, now)),
       ),
@@ -70,17 +171,22 @@ export async function revokeProvisionerToken(params: {
   workspaceId: string;
   revokedByUserId: string;
 }): Promise<ProvisionerToken | undefined> {
-  const rows = await db()
-    .update(provisionerTokens)
-    .set({revokedAt: new Date(), revokedByUserId: params.revokedByUserId, updatedAt: new Date()})
-    .where(
-      and(
-        eq(provisionerTokens.id, params.tokenId),
-        eq(provisionerTokens.workspaceId, params.workspaceId),
-        isNull(provisionerTokens.revokedAt),
-      ),
-    )
-    .returning();
+  const rows = await db().transaction(async (tx) => {
+    const rows = await tx
+      .update(provisionerTokens)
+      .set({revokedAt: new Date(), revokedByUserId: params.revokedByUserId, updatedAt: new Date()})
+      .where(
+        and(
+          eq(provisionerTokens.id, params.tokenId),
+          eq(provisionerTokens.workspaceId, params.workspaceId),
+          eq(provisionerTokens.scope, 'workspace'),
+          isNull(provisionerTokens.revokedAt),
+        ),
+      )
+      .returning();
+    if (rows[0]) await cascadeProvisionerRevocation(tx, params.tokenId);
+    return rows;
+  });
 
   const row = rows[0];
   if (row) return toProvisionerToken(row);
@@ -92,6 +198,7 @@ export async function revokeProvisionerToken(params: {
       and(
         eq(provisionerTokens.id, params.tokenId),
         eq(provisionerTokens.workspaceId, params.workspaceId),
+        eq(provisionerTokens.scope, 'workspace'),
       ),
     )
     .limit(1);
@@ -129,6 +236,7 @@ export async function listActiveProvisionerTokens(params: {
     .where(
       and(
         eq(provisionerTokens.workspaceId, params.workspaceId),
+        eq(provisionerTokens.scope, 'workspace'),
         isNull(provisionerTokens.revokedAt),
         or(isNull(provisionerTokens.expiresAt), gt(provisionerTokens.expiresAt, sql`now()`)),
         sql`${provisionerTokens.lastSeenAt} > now() - (${params.windowSeconds} || ' seconds')::interval`,