@shipfox/api-runners 5.0.0 → 7.0.1

package/dist/core/provisioner-capability-snapshots.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/provisioner-capability-snapshots.ts"],"sourcesContent":["import {config} from '#config.js';\nimport {hasActiveWorkspaceProvisionerCapability as hasActiveWorkspaceProvisionerCapabilityDb} from '#db/provisioner-capability-snapshots.js';\n\nexport function hasActiveWorkspaceProvisionerCapability(params: {\n  workspaceId: string;\n  requiredLabels: string[];\n}): Promise<boolean> {\n  return hasActiveWorkspaceProvisionerCapabilityDb({\n    ...params,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n"],"names":["config","hasActiveWorkspaceProvisionerCapability","hasActiveWorkspaceProvisionerCapabilityDb","params","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS"],"mappings":"AAAA,SAAQA,MAAM,QAAO,aAAa;AAClC,SAAQC,2CAA2CC,yCAAyC,QAAO,0CAA0C;AAE7I,OAAO,SAASD,wCAAwCE,MAGvD;IACC,OAAOD,0CAA0C;QAC/C,GAAGC,MAAM;QACTC,eAAeJ,OAAOK,iCAAiC;IACzD;AACF"}

package/dist/core/provisioner-tokens.d.ts

@@ -10,6 +10,12 @@ export interface CreateWorkspaceProvisionerTokenResult {
     rawToken: string;
 }
 export declare function createWorkspaceProvisionerToken(params: CreateWorkspaceProvisionerTokenParams): Promise<CreateWorkspaceProvisionerTokenResult>;
+export interface CreateInstallationProvisionerTokenParams {
+    createdByUserId: string;
+    name?: string | undefined;
+    ttlSeconds?: number | undefined;
+}
+export declare function createInstallationProvisionerToken(params: CreateInstallationProvisionerTokenParams): Promise<CreateWorkspaceProvisionerTokenResult>;
 export declare function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]>;
 export declare function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]>;
 export declare function revokeWorkspaceProvisionerToken(params: {
@@ -17,4 +23,8 @@ export declare function revokeWorkspaceProvisionerToken(params: {
     workspaceId: string;
     revokedByUserId: string;
 }): Promise<ProvisionerToken>;
+export declare function revokeInstallationProvisionerToken(params: {
+    tokenId: string;
+    revokedByUserId: string;
+}): Promise<ProvisionerToken>;
 //# sourceMappingURL=provisioner-tokens.d.ts.map

package/dist/core/provisioner-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAG9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAchD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B"}
+{"version":3,"file":"provisioner-tokens.d.ts","sourceRoot":"","sources":["../../src/core/provisioner-tokens.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAC,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAG9F,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,qCAAqC;IACpD,KAAK,EAAE,gBAAgB,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAehD;AAED,MAAM,WAAW,wCAAwC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,wCAAwC,GAC/C,OAAO,CAAC,qCAAqC,CAAC,CAYhD;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5F;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAK7F;AAED,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI5B"}

package/dist/core/provisioner-tokens.js

@@ -1,11 +1,12 @@
 import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
-import { createProvisionerToken, listActiveProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, revokeProvisionerToken } from '#db/provisioner-tokens.js';
+import { createProvisionerToken, listActiveProvisionerTokens, listUsableProvisionerTokensByWorkspaceId, revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb, revokeProvisionerToken } from '#db/provisioner-tokens.js';
 import { config } from '../config.js';
 import { ProvisionerTokenNotFoundError } from './errors.js';
 export async function createWorkspaceProvisionerToken(params) {
     const rawToken = generateOpaqueToken('provisionerToken');
     const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;
     const token = await createProvisionerToken({
+        scope: 'workspace',
         workspaceId: params.workspaceId,
         hashedToken: hashOpaqueToken(rawToken),
         prefix: extractDisplayPrefix(rawToken),
@@ -18,6 +19,22 @@ export async function createWorkspaceProvisionerToken(params) {
         rawToken
     };
 }
+export async function createInstallationProvisionerToken(params) {
+    const rawToken = generateOpaqueToken('provisionerToken');
+    const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;
+    const token = await createProvisionerToken({
+        scope: 'installation',
+        hashedToken: hashOpaqueToken(rawToken),
+        prefix: extractDisplayPrefix(rawToken),
+        name: params.name,
+        createdByUserId: params.createdByUserId,
+        expiresAt
+    });
+    return {
+        token,
+        rawToken
+    };
+}
 export function listUsableProvisionerTokens(workspaceId) {
     return listUsableProvisionerTokensByWorkspaceId(workspaceId);
 }
@@ -32,5 +49,10 @@ export async function revokeWorkspaceProvisionerToken(params) {
     if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);
     return token;
 }
+export async function revokeInstallationProvisionerToken(params) {
+    const token = await revokeInstallationProvisionerTokenDb(params);
+    if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);
+    return token;
+}
 
 //# sourceMappingURL=provisioner-tokens.js.map

package/dist/core/provisioner-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {ProvisionerTokenNotFoundError} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n"],"names":["extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createProvisionerToken","listActiveProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeProvisionerToken","config","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","workspaceId","hashedToken","prefix","name","createdByUserId","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId"],"mappings":"AAAA,SAAQA,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wCAAwC,EACxCC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,QAAO,eAAe;AAEpC,SAAQC,6BAA6B,QAAO,cAAc;AAc1D,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWV,oBAAoB;IACrC,MAAMW,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMd,uBAAuB;QACzCe,aAAaR,OAAOQ,WAAW;QAC/BC,aAAajB,gBAAgBS;QAC7BS,QAAQpB,qBAAqBW;QAC7BU,MAAMX,OAAOW,IAAI;QACjBC,iBAAiBZ,OAAOY,eAAe;QACvCV;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASY,4BAA4BL,WAAmB;IAC7D,OAAOb,yCAAyCa;AAClD;AAEA,OAAO,SAASM,uBAAuBN,WAAmB;IACxD,OAAOd,4BAA4B;QACjCc;QACAO,eAAelB,OAAOmB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCjB,MAIrD;IACC,MAAMO,QAAQ,MAAMX,uBAAuBI;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOkB,OAAO;IAClE,OAAOX;AACT"}
+{"version":3,"sources":["../../src/core/provisioner-tokens.ts"],"sourcesContent":["import {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {\n  createProvisionerToken,\n  listActiveProvisionerTokens,\n  listUsableProvisionerTokensByWorkspaceId,\n  revokeInstallationProvisionerToken as revokeInstallationProvisionerTokenDb,\n  revokeProvisionerToken,\n} from '#db/provisioner-tokens.js';\nimport {config} from '../config.js';\nimport type {ActiveProvisionerToken, ProvisionerToken} from './entities/provisioner-token.js';\nimport {ProvisionerTokenNotFoundError} from './errors.js';\n\nexport interface CreateWorkspaceProvisionerTokenParams {\n  workspaceId: string;\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport interface CreateWorkspaceProvisionerTokenResult {\n  token: ProvisionerToken;\n  rawToken: string;\n}\n\nexport async function createWorkspaceProvisionerToken(\n  params: CreateWorkspaceProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n\n  const token = await createProvisionerToken({\n    scope: 'workspace',\n    workspaceId: params.workspaceId,\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n\n  return {token, rawToken};\n}\n\nexport interface CreateInstallationProvisionerTokenParams {\n  createdByUserId: string;\n  name?: string | undefined;\n  ttlSeconds?: number | undefined;\n}\n\nexport async function createInstallationProvisionerToken(\n  params: CreateInstallationProvisionerTokenParams,\n): Promise<CreateWorkspaceProvisionerTokenResult> {\n  const rawToken = generateOpaqueToken('provisionerToken');\n  const expiresAt = params.ttlSeconds ? new Date(Date.now() + params.ttlSeconds * 1000) : undefined;\n  const token = await createProvisionerToken({\n    scope: 'installation',\n    hashedToken: hashOpaqueToken(rawToken),\n    prefix: extractDisplayPrefix(rawToken),\n    name: params.name,\n    createdByUserId: params.createdByUserId,\n    expiresAt,\n  });\n  return {token, rawToken};\n}\n\nexport function listUsableProvisionerTokens(workspaceId: string): Promise<ProvisionerToken[]> {\n  return listUsableProvisionerTokensByWorkspaceId(workspaceId);\n}\n\nexport function listActiveProvisioners(workspaceId: string): Promise<ActiveProvisionerToken[]> {\n  return listActiveProvisionerTokens({\n    workspaceId,\n    windowSeconds: config.PROVISIONER_ACTIVE_WINDOW_SECONDS,\n  });\n}\n\nexport async function revokeWorkspaceProvisionerToken(params: {\n  tokenId: string;\n  workspaceId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeProvisionerToken(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n\nexport async function revokeInstallationProvisionerToken(params: {\n  tokenId: string;\n  revokedByUserId: string;\n}): Promise<ProvisionerToken> {\n  const token = await revokeInstallationProvisionerTokenDb(params);\n  if (!token) throw new ProvisionerTokenNotFoundError(params.tokenId);\n  return token;\n}\n"],"names":["extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","createProvisionerToken","listActiveProvisionerTokens","listUsableProvisionerTokensByWorkspaceId","revokeInstallationProvisionerToken","revokeInstallationProvisionerTokenDb","revokeProvisionerToken","config","ProvisionerTokenNotFoundError","createWorkspaceProvisionerToken","params","rawToken","expiresAt","ttlSeconds","Date","now","undefined","token","scope","workspaceId","hashedToken","prefix","name","createdByUserId","createInstallationProvisionerToken","listUsableProvisionerTokens","listActiveProvisioners","windowSeconds","PROVISIONER_ACTIVE_WINDOW_SECONDS","revokeWorkspaceProvisionerToken","tokenId"],"mappings":"AAAA,SAAQA,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SACEC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wCAAwC,EACxCC,sCAAsCC,oCAAoC,EAC1EC,sBAAsB,QACjB,4BAA4B;AACnC,SAAQC,MAAM,QAAO,eAAe;AAEpC,SAAQC,6BAA6B,QAAO,cAAc;AAc1D,OAAO,eAAeC,gCACpBC,MAA6C;IAE7C,MAAMC,WAAWZ,oBAAoB;IACrC,MAAMa,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IAExF,MAAMC,QAAQ,MAAMhB,uBAAuB;QACzCiB,OAAO;QACPC,aAAaT,OAAOS,WAAW;QAC/BC,aAAapB,gBAAgBW;QAC7BU,QAAQvB,qBAAqBa;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IAEA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAQA,OAAO,eAAea,mCACpBd,MAAgD;IAEhD,MAAMC,WAAWZ,oBAAoB;IACrC,MAAMa,YAAYF,OAAOG,UAAU,GAAG,IAAIC,KAAKA,KAAKC,GAAG,KAAKL,OAAOG,UAAU,GAAG,QAAQG;IACxF,MAAMC,QAAQ,MAAMhB,uBAAuB;QACzCiB,OAAO;QACPE,aAAapB,gBAAgBW;QAC7BU,QAAQvB,qBAAqBa;QAC7BW,MAAMZ,OAAOY,IAAI;QACjBC,iBAAiBb,OAAOa,eAAe;QACvCX;IACF;IACA,OAAO;QAACK;QAAON;IAAQ;AACzB;AAEA,OAAO,SAASc,4BAA4BN,WAAmB;IAC7D,OAAOhB,yCAAyCgB;AAClD;AAEA,OAAO,SAASO,uBAAuBP,WAAmB;IACxD,OAAOjB,4BAA4B;QACjCiB;QACAQ,eAAepB,OAAOqB,iCAAiC;IACzD;AACF;AAEA,OAAO,eAAeC,gCAAgCnB,MAIrD;IACC,MAAMO,QAAQ,MAAMX,uBAAuBI;IAC3C,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT;AAEA,OAAO,eAAeb,mCAAmCM,MAGxD;IACC,MAAMO,QAAQ,MAAMZ,qCAAqCK;IACzD,IAAI,CAACO,OAAO,MAAM,IAAIT,8BAA8BE,OAAOoB,OAAO;IAClE,OAAOb;AACT"}

package/dist/core/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAKlC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAC/E,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,6BAA8B,SAAQ,sBAAsB,CACvE,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAIF;AAED,qBAAa,gCAAiC,SAAQ,yBAAyB,CAC7E,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAIF;AAKD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC9F"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAKlC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAC/E,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAErD,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,6BAA8B,SAAQ,sBAAsB,CACvE,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAIF;AAED,qBAAa,gCAAiC,SAAQ,yBAAyB,CAC7E,sBAAsB,EACtB,qBAAqB,CACtB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,sBAAsB,CAAC;QAC/B,KAAK,EAAE,qBAAqB,CAAC;QAC7B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAIF;AAID,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC9F"}

package/dist/core/rate-limit.js

@@ -1,5 +1,4 @@
-import { createHmac } from 'node:crypto';
-import { config as authConfig } from '@shipfox/api-auth/config';
+import { rateLimitIdentifierKey } from '@shipfox/node-auth-root-key';
 import { checkRateLimit, hashRateLimitIdentifier, RateLimitExceededError, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
 import { config } from '#config.js';
 import { consumeRunnersRateLimit, pruneExpiredRunnersRateLimits } from '#db/rate-limits.js';
@@ -17,7 +16,6 @@ export class RunnersRateLimitUnavailableError extends RateLimitUnavailableError
     }
 }
 const IDENTIFIER_HASH_DOMAIN = 'shipfox.runners.rate-limit.identifier.v1';
-const IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.runners.rate-limit.identifier-secret.v1';
 export function hashRunnersRateLimitIdentifier(params) {
     return hashRateLimitIdentifier({
         action: params.action,
@@ -65,10 +63,7 @@ export async function checkRunnersRateLimit(params) {
     }
 }
 function effectiveIdentifierSecret() {
-    if (config.RATE_LIMIT_IDENTIFIER_SECRET) {
-        return config.RATE_LIMIT_IDENTIFIER_SECRET;
-    }
-    return createHmac('sha256', authConfig.AUTH_JWT_SECRET).update(IDENTIFIER_SECRET_DERIVATION_DOMAIN).digest();
+    return rateLimitIdentifierKey();
 }
 
 //# sourceMappingURL=rate-limit.js.map

package/dist/core/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport {config as authConfig} from '@shipfox/api-auth/config';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitOutcome,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {config} from '#config.js';\nimport {consumeRunnersRateLimit, pruneExpiredRunnersRateLimits} from '#db/rate-limits.js';\nimport {recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure} from '#metrics/index.js';\n\nexport type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';\nexport type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';\nexport type RunnersRateLimitOutcome = RateLimitOutcome;\nexport type RunnersRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckRunnersRateLimitParams extends RunnersRateLimitPolicy {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class RunnersRateLimitExceededError extends RateLimitExceededError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitExceededError';\n  }\n}\n\nexport class RunnersRateLimitUnavailableError extends RateLimitUnavailableError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitUnavailableError';\n  }\n}\n\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.runners.rate-limit.identifier.v1';\nconst IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.runners.rate-limit.identifier-secret.v1';\n\nexport function hashRunnersRateLimitIdentifier(params: {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkRunnersRateLimit(params: CheckRunnersRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeRunnersRateLimit,\n      prune: pruneExpiredRunnersRateLimits,\n      onCheck: recordRunnersRateLimitCheck,\n      onPruneFailure: recordRunnersRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? config.RUNNERS_RATE_LIMIT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new RunnersRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new RunnersRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n\nfunction effectiveIdentifierSecret(): Buffer | string {\n  if (config.RATE_LIMIT_IDENTIFIER_SECRET) {\n    return config.RATE_LIMIT_IDENTIFIER_SECRET;\n  }\n\n  return createHmac('sha256', authConfig.AUTH_JWT_SECRET)\n    .update(IDENTIFIER_SECRET_DERIVATION_DOMAIN)\n    .digest();\n}\n"],"names":["createHmac","config","authConfig","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","consumeRunnersRateLimit","pruneExpiredRunnersRateLimits","recordRunnersRateLimitCheck","recordRunnersRateLimitPruneFailure","RunnersRateLimitExceededError","params","name","RunnersRateLimitUnavailableError","IDENTIFIER_HASH_DOMAIN","IDENTIFIER_SECRET_DERIVATION_DOMAIN","hashRunnersRateLimitIdentifier","action","scope","identifier","secret","effectiveIdentifierSecret","domain","checkRunnersRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","RUNNERS_RATE_LIMIT_TIMEOUT_MS","error","retryAfterSeconds","identifierHmacPrefix","cause","RATE_LIMIT_IDENTIFIER_SECRET","AUTH_JWT_SECRET","update","digest"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SAAQC,UAAUC,UAAU,QAAO,2BAA2B;AAC9D,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAGtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQL,MAAM,QAAO,aAAa;AAClC,SAAQM,uBAAuB,EAAEC,6BAA6B,QAAO,qBAAqB;AAC1F,SAAQC,2BAA2B,EAAEC,kCAAkC,QAAO,oBAAoB;AAelG,OAAO,MAAMC,sCAAsCN;IAIjD,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,yCAAyCR;IAIpD,YAAYM,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,MAAME,yBAAyB;AAC/B,MAAMC,sCAAsC;AAE5C,OAAO,SAASC,+BAA+BL,MAI9C;IACC,OAAOR,wBAAwB;QAC7Bc,QAAQN,OAAOM,MAAM;QACrBC,OAAOP,OAAOO,KAAK;QACnBC,YAAYR,OAAOQ,UAAU;QAC7BC,QAAQC;QACRC,QAAQR;IACV;AACF;AAEA,OAAO,eAAeS,sBAAsBZ,MAAmC;IAC7E,IAAI;QACF,MAAMT,eAAe;YACnBe,QAAQN,OAAOM,MAAM;YACrBC,OAAOP,OAAOO,KAAK;YACnBC,YAAYR,OAAOQ,UAAU;YAC7BK,OAAOb,OAAOa,KAAK;YACnBC,eAAed,OAAOc,aAAa;YACnCC,kBAAkBL;YAClBM,sBAAsBb;YACtBc,SAAStB;YACTuB,OAAOtB;YACPuB,SAAStB;YACTuB,gBAAgBtB;YAChBuB,KAAKrB,OAAOqB,GAAG;YACfC,WAAWtB,OAAOsB,SAAS,IAAIjC,OAAOkC,6BAA6B;QACrE;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiB/B,wBAAwB;YAC3C,MAAM,IAAIM,8BAA8B;gBACtCO,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBkB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiB9B,2BAA2B;YAC9C,MAAM,IAAIQ,iCAAiC;gBACzCI,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBmB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF;AAEA,SAASd;IACP,IAAIrB,OAAOuC,4BAA4B,EAAE;QACvC,OAAOvC,OAAOuC,4BAA4B;IAC5C;IAEA,OAAOxC,WAAW,UAAUE,WAAWuC,eAAe,EACnDC,MAAM,CAAC1B,qCACP2B,MAAM;AACX"}
+{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {rateLimitIdentifierKey} from '@shipfox/node-auth-root-key';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitOutcome,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {config} from '#config.js';\nimport {consumeRunnersRateLimit, pruneExpiredRunnersRateLimits} from '#db/rate-limits.js';\nimport {recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure} from '#metrics/index.js';\n\nexport type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';\nexport type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';\nexport type RunnersRateLimitOutcome = RateLimitOutcome;\nexport type RunnersRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckRunnersRateLimitParams extends RunnersRateLimitPolicy {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class RunnersRateLimitExceededError extends RateLimitExceededError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitExceededError';\n  }\n}\n\nexport class RunnersRateLimitUnavailableError extends RateLimitUnavailableError<\n  RunnersRateLimitAction,\n  RunnersRateLimitScope\n> {\n  constructor(params: {\n    action: RunnersRateLimitAction;\n    scope: RunnersRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'RunnersRateLimitUnavailableError';\n  }\n}\n\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.runners.rate-limit.identifier.v1';\n\nexport function hashRunnersRateLimitIdentifier(params: {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkRunnersRateLimit(params: CheckRunnersRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeRunnersRateLimit,\n      prune: pruneExpiredRunnersRateLimits,\n      onCheck: recordRunnersRateLimitCheck,\n      onPruneFailure: recordRunnersRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? config.RUNNERS_RATE_LIMIT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new RunnersRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new RunnersRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n\nfunction effectiveIdentifierSecret(): Uint8Array {\n  return rateLimitIdentifierKey();\n}\n"],"names":["rateLimitIdentifierKey","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","config","consumeRunnersRateLimit","pruneExpiredRunnersRateLimits","recordRunnersRateLimitCheck","recordRunnersRateLimitPruneFailure","RunnersRateLimitExceededError","params","name","RunnersRateLimitUnavailableError","IDENTIFIER_HASH_DOMAIN","hashRunnersRateLimitIdentifier","action","scope","identifier","secret","effectiveIdentifierSecret","domain","checkRunnersRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","RUNNERS_RATE_LIMIT_TIMEOUT_MS","error","retryAfterSeconds","identifierHmacPrefix","cause"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,8BAA8B;AACnE,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAGtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,uBAAuB,EAAEC,6BAA6B,QAAO,qBAAqB;AAC1F,SAAQC,2BAA2B,EAAEC,kCAAkC,QAAO,oBAAoB;AAelG,OAAO,MAAMC,sCAAsCP;IAIjD,YAAYQ,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,yCAAyCT;IAIpD,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,MAAME,yBAAyB;AAE/B,OAAO,SAASC,+BAA+BJ,MAI9C;IACC,OAAOT,wBAAwB;QAC7Bc,QAAQL,OAAOK,MAAM;QACrBC,OAAON,OAAOM,KAAK;QACnBC,YAAYP,OAAOO,UAAU;QAC7BC,QAAQC;QACRC,QAAQP;IACV;AACF;AAEA,OAAO,eAAeQ,sBAAsBX,MAAmC;IAC7E,IAAI;QACF,MAAMV,eAAe;YACnBe,QAAQL,OAAOK,MAAM;YACrBC,OAAON,OAAOM,KAAK;YACnBC,YAAYP,OAAOO,UAAU;YAC7BK,OAAOZ,OAAOY,KAAK;YACnBC,eAAeb,OAAOa,aAAa;YACnCC,kBAAkBL;YAClBM,sBAAsBZ;YACtBa,SAASrB;YACTsB,OAAOrB;YACPsB,SAASrB;YACTsB,gBAAgBrB;YAChBsB,KAAKpB,OAAOoB,GAAG;YACfC,WAAWrB,OAAOqB,SAAS,IAAI3B,OAAO4B,6BAA6B;QACrE;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiB/B,wBAAwB;YAC3C,MAAM,IAAIO,8BAA8B;gBACtCM,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBkB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiB9B,2BAA2B;YAC9C,MAAM,IAAIS,iCAAiC;gBACzCG,QAAQkB,MAAMlB,MAAM;gBACpBC,OAAOiB,MAAMjB,KAAK;gBAClBmB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF;AAEA,SAASd;IACP,OAAOpB;AACT"}

package/dist/core/runner-activation.d.ts

@@ -0,0 +1,13 @@
+export declare function issueRunnerActivationToken(params: {
+    runnerInstanceId: string;
+    provisionerId: string;
+    ttlSeconds: number;
+}): Promise<string | null>;
+export declare function getRunnerAssignment(params: {
+    runnerInstanceId: string;
+    provisionerId: string;
+}): Promise<{
+    workspaceId: string | null;
+    runnerSessionId: string | null;
+} | null>;
+//# sourceMappingURL=runner-activation.d.ts.map

package/dist/core/runner-activation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-activation.d.ts","sourceRoot":"","sources":["../../src/core/runner-activation.ts"],"names":[],"mappings":"AAMA,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCzB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;;;UAeA"}

package/dist/core/runner-activation.js

@@ -0,0 +1,36 @@
+import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
+import { and, eq, isNull, sql } from 'drizzle-orm';
+import { db } from '#db/db.js';
+import { runnerActivationTokens } from '#db/schema/runner-activation-tokens.js';
+import { providerRunners } from '#db/schema/runner-instances.js';
+export async function issueRunnerActivationToken(params) {
+    return await db().transaction(async (tx)=>{
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`runners_activation:${params.runnerInstanceId}`}))`);
+        const [runner] = await tx.select({
+            workspaceId: providerRunners.workspaceId,
+            runnerSessionId: providerRunners.runnerSessionId,
+            state: providerRunners.state
+        }).from(providerRunners).where(and(eq(providerRunners.id, params.runnerInstanceId), eq(providerRunners.provisionerId, params.provisionerId))).limit(1).for('update');
+        if (!runner?.workspaceId || runner.runnerSessionId || runner.state !== 'running') return null;
+        await tx.update(runnerActivationTokens).set({
+            revokedAt: sql`now()`
+        }).where(and(eq(runnerActivationTokens.runnerInstanceId, params.runnerInstanceId), isNull(runnerActivationTokens.consumedAt), isNull(runnerActivationTokens.revokedAt)));
+        const rawToken = generateOpaqueToken('runnerActivationToken');
+        await tx.insert(runnerActivationTokens).values({
+            runnerInstanceId: params.runnerInstanceId,
+            hashedToken: hashOpaqueToken(rawToken),
+            prefix: extractDisplayPrefix(rawToken),
+            expiresAt: new Date(Date.now() + params.ttlSeconds * 1000)
+        });
+        return rawToken;
+    });
+}
+export async function getRunnerAssignment(params) {
+    const [runner] = await db().select({
+        workspaceId: providerRunners.workspaceId,
+        runnerSessionId: providerRunners.runnerSessionId
+    }).from(providerRunners).where(and(eq(providerRunners.id, params.runnerInstanceId), eq(providerRunners.provisionerId, params.provisionerId))).limit(1);
+    return runner?.workspaceId && !runner.runnerSessionId ? runner : null;
+}
+
+//# sourceMappingURL=runner-activation.js.map

package/dist/core/runner-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-activation.ts"],"sourcesContent":["import {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {and, eq, isNull, sql} from 'drizzle-orm';\nimport {db} from '#db/db.js';\nimport {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';\nimport {providerRunners} from '#db/schema/runner-instances.js';\n\nexport async function issueRunnerActivationToken(params: {\n  runnerInstanceId: string;\n  provisionerId: string;\n  ttlSeconds: number;\n}): Promise<string | null> {\n  return await db().transaction(async (tx) => {\n    await tx.execute(\n      sql`select pg_advisory_xact_lock(hashtext(${`runners_activation:${params.runnerInstanceId}`}))`,\n    );\n    const [runner] = await tx\n      .select({\n        workspaceId: providerRunners.workspaceId,\n        runnerSessionId: providerRunners.runnerSessionId,\n        state: providerRunners.state,\n      })\n      .from(providerRunners)\n      .where(\n        and(\n          eq(providerRunners.id, params.runnerInstanceId),\n          eq(providerRunners.provisionerId, params.provisionerId),\n        ),\n      )\n      .limit(1)\n      .for('update');\n    if (!runner?.workspaceId || runner.runnerSessionId || runner.state !== 'running') return null;\n\n    await tx\n      .update(runnerActivationTokens)\n      .set({revokedAt: sql`now()`})\n      .where(\n        and(\n          eq(runnerActivationTokens.runnerInstanceId, params.runnerInstanceId),\n          isNull(runnerActivationTokens.consumedAt),\n          isNull(runnerActivationTokens.revokedAt),\n        ),\n      );\n    const rawToken = generateOpaqueToken('runnerActivationToken');\n    await tx.insert(runnerActivationTokens).values({\n      runnerInstanceId: params.runnerInstanceId,\n      hashedToken: hashOpaqueToken(rawToken),\n      prefix: extractDisplayPrefix(rawToken),\n      expiresAt: new Date(Date.now() + params.ttlSeconds * 1000),\n    });\n    return rawToken;\n  });\n}\n\nexport async function getRunnerAssignment(params: {\n  runnerInstanceId: string;\n  provisionerId: string;\n}) {\n  const [runner] = await db()\n    .select({\n      workspaceId: providerRunners.workspaceId,\n      runnerSessionId: providerRunners.runnerSessionId,\n    })\n    .from(providerRunners)\n    .where(\n      and(\n        eq(providerRunners.id, params.runnerInstanceId),\n        eq(providerRunners.provisionerId, params.provisionerId),\n      ),\n    )\n    .limit(1);\n  return runner?.workspaceId && !runner.runnerSessionId ? runner : null;\n}\n"],"names":["extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","and","eq","isNull","sql","db","runnerActivationTokens","providerRunners","issueRunnerActivationToken","params","transaction","tx","execute","runnerInstanceId","runner","select","workspaceId","runnerSessionId","state","from","where","id","provisionerId","limit","for","update","set","revokedAt","consumedAt","rawToken","insert","values","hashedToken","prefix","expiresAt","Date","now","ttlSeconds","getRunnerAssignment"],"mappings":"AAAA,SAAQA,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SAAQC,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACjD,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,sBAAsB,QAAO,yCAAyC;AAC9E,SAAQC,eAAe,QAAO,iCAAiC;AAE/D,OAAO,eAAeC,2BAA2BC,MAIhD;IACC,OAAO,MAAMJ,KAAKK,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGC,OAAO,CACdR,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEK,OAAOI,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAEjG,MAAM,CAACC,OAAO,GAAG,MAAMH,GACpBI,MAAM,CAAC;YACNC,aAAaT,gBAAgBS,WAAW;YACxCC,iBAAiBV,gBAAgBU,eAAe;YAChDC,OAAOX,gBAAgBW,KAAK;QAC9B,GACCC,IAAI,CAACZ,iBACLa,KAAK,CACJnB,IACEC,GAAGK,gBAAgBc,EAAE,EAAEZ,OAAOI,gBAAgB,GAC9CX,GAAGK,gBAAgBe,aAAa,EAAEb,OAAOa,aAAa,IAGzDC,KAAK,CAAC,GACNC,GAAG,CAAC;QACP,IAAI,CAACV,QAAQE,eAAeF,OAAOG,eAAe,IAAIH,OAAOI,KAAK,KAAK,WAAW,OAAO;QAEzF,MAAMP,GACHc,MAAM,CAACnB,wBACPoB,GAAG,CAAC;YAACC,WAAWvB,GAAG,CAAC,KAAK,CAAC;QAAA,GAC1BgB,KAAK,CACJnB,IACEC,GAAGI,uBAAuBO,gBAAgB,EAAEJ,OAAOI,gBAAgB,GACnEV,OAAOG,uBAAuBsB,UAAU,GACxCzB,OAAOG,uBAAuBqB,SAAS;QAG7C,MAAME,WAAW9B,oBAAoB;QACrC,MAAMY,GAAGmB,MAAM,CAACxB,wBAAwByB,MAAM,CAAC;YAC7ClB,kBAAkBJ,OAAOI,gBAAgB;YACzCmB,aAAahC,gBAAgB6B;YAC7BI,QAAQnC,qBAAqB+B;YAC7BK,WAAW,IAAIC,KAAKA,KAAKC,GAAG,KAAK3B,OAAO4B,UAAU,GAAG;QACvD;QACA,OAAOR;IACT;AACF;AAEA,OAAO,eAAeS,oBAAoB7B,MAGzC;IACC,MAAM,CAACK,OAAO,GAAG,MAAMT,KACpBU,MAAM,CAAC;QACNC,aAAaT,gBAAgBS,WAAW;QACxCC,iBAAiBV,gBAAgBU,eAAe;IAClD,GACCE,IAAI,CAACZ,iBACLa,KAAK,CACJnB,IACEC,GAAGK,gBAAgBc,EAAE,EAAEZ,OAAOI,gBAAgB,GAC9CX,GAAGK,gBAAgBe,aAAa,EAAEb,OAAOa,aAAa,IAGzDC,KAAK,CAAC;IACT,OAAOT,QAAQE,eAAe,CAACF,OAAOG,eAAe,GAAGH,SAAS;AACnE"}

package/dist/core/runner-assignments.d.ts

@@ -0,0 +1,6 @@
+export declare function assignRunnerInstances(params: {
+    provisionerId: string;
+    reservationId: string;
+    runnerInstanceIds: string[];
+}): Promise<string[]>;
+//# sourceMappingURL=runner-assignments.d.ts.map

package/dist/core/runner-assignments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-assignments.d.ts","sourceRoot":"","sources":["../../src/core/runner-assignments.ts"],"names":[],"mappings":"AAEA,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAEpB"}

package/dist/core/runner-assignments.js

@@ -0,0 +1,6 @@
+import { assignRunnerInstances as assignRunnerInstancesDb } from '#db/runner-assignments.js';
+export function assignRunnerInstances(params) {
+    return assignRunnerInstancesDb(params);
+}
+
+//# sourceMappingURL=runner-assignments.js.map

package/dist/core/runner-assignments.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-assignments.ts"],"sourcesContent":["import {assignRunnerInstances as assignRunnerInstancesDb} from '#db/runner-assignments.js';\n\nexport function assignRunnerInstances(params: {\n  provisionerId: string;\n  reservationId: string;\n  runnerInstanceIds: string[];\n}): Promise<string[]> {\n  return assignRunnerInstancesDb(params);\n}\n"],"names":["assignRunnerInstances","assignRunnerInstancesDb","params"],"mappings":"AAAA,SAAQA,yBAAyBC,uBAAuB,QAAO,4BAA4B;AAE3F,OAAO,SAASD,sBAAsBE,MAIrC;IACC,OAAOD,wBAAwBC;AACjC"}

package/dist/core/runner-control-sessions.d.ts

@@ -0,0 +1,46 @@
+import type { RunnerToolCapabilitiesDto } from '@shipfox/api-runners-dto';
+export declare class RunnerBootstrapTokenInvalidError extends Error {
+    constructor();
+}
+export declare class RunnerControlSessionInvalidError extends Error {
+    constructor();
+}
+export declare function createRunnerInstancesWithBootstrapTokens(params: {
+    provisionerId: string;
+    providerKind?: string | null;
+    runnerInstances: Array<{
+        templateKey?: string | null;
+    }>;
+    ttlSeconds: number;
+}): Promise<Array<{
+    runnerInstanceId: string;
+    bootstrapToken: string;
+}>>;
+export declare function exchangeRunnerBootstrapToken(params: {
+    rawToken: string;
+    ttlSeconds: number;
+}): Promise<{
+    runnerInstanceId: string;
+    controlSessionToken: string;
+    expiresAt: Date;
+}>;
+export declare function resolveRunnerControlSession(rawToken: string): Promise<{
+    id: string;
+    runnerInstanceId: string;
+    provisionerId: string;
+} | undefined>;
+export declare function enrollRunnerControlSession(params: {
+    runnerInstanceId: string;
+    provisionerId: string;
+    labels: string[];
+    capabilities?: RunnerToolCapabilitiesDto | null;
+    providerKind: string;
+    protocolVersion: string;
+}): Promise<void>;
+export declare function attachRunnerControlProviderId(params: {
+    runnerInstanceId: string;
+    provisionerId: string;
+    providerRunnerId: string;
+}): Promise<boolean>;
+export declare function touchRunnerControlSession(runnerInstanceId: string, provisionerId: string): Promise<void>;
+//# sourceMappingURL=runner-control-sessions.d.ts.map

package/dist/core/runner-control-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-control-sessions.d.ts","sourceRoot":"","sources":["../../src/core/runner-control-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,0BAA0B,CAAC;AAUxE,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,wBAAsB,wCAAwC,CAAC,MAAM,EAAE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,KAAK,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,CAAC,CAAC;IACtD,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,KAAK,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAC,CAAC,CAAC,CA+BrE;AAED,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,CAAC,CA8BpF;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM;;;;eAmBjE;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB;AAED,wBAAsB,yBAAyB,CAAC,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAoB9F"}

package/dist/core/runner-control-sessions.js

@@ -0,0 +1,121 @@
+import { extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken } from '@shipfox/node-tokens';
+import { canonicalizeLabels } from '@shipfox/runner-labels';
+import { and, eq, gt, isNull, notInArray, or, sql } from 'drizzle-orm';
+import { db } from '#db/db.js';
+import { terminalStates } from '#db/runner-instances.js';
+import { provisionerTokens } from '#db/schema/provisioner-tokens.js';
+import { runnerBootstrapTokens, runnerControlSessions } from '#db/schema/runner-control-sessions.js';
+import { providerRunners } from '#db/schema/runner-instances.js';
+export class RunnerBootstrapTokenInvalidError extends Error {
+    constructor(){
+        super('Runner bootstrap token is invalid, expired, or has already been used');
+        this.name = 'RunnerBootstrapTokenInvalidError';
+    }
+}
+export class RunnerControlSessionInvalidError extends Error {
+    constructor(){
+        super('Runner control session is invalid, expired, or closed');
+        this.name = 'RunnerControlSessionInvalidError';
+    }
+}
+export async function createRunnerInstancesWithBootstrapTokens(params) {
+    const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);
+    return await db().transaction(async (tx)=>{
+        const instances = await tx.insert(providerRunners).values(params.runnerInstances.map((runner)=>({
+                provisionerId: params.provisionerId,
+                providerKind: params.providerKind ?? null,
+                templateKey: runner.templateKey ?? null,
+                state: 'starting',
+                labels: [],
+                reportedAt: new Date()
+            }))).returning({
+            id: providerRunners.id
+        });
+        const results = instances.map((instance)=>({
+                runnerInstanceId: instance.id,
+                bootstrapToken: generateOpaqueToken('runnerBootstrapToken')
+            }));
+        await tx.insert(runnerBootstrapTokens).values(results.map((result)=>({
+                runnerInstanceId: result.runnerInstanceId,
+                provisionerId: params.provisionerId,
+                hashedToken: hashOpaqueToken(result.bootstrapToken),
+                prefix: extractDisplayPrefix(result.bootstrapToken),
+                expiresAt
+            })));
+        return results;
+    });
+}
+export async function exchangeRunnerBootstrapToken(params) {
+    const controlSessionToken = generateOpaqueToken('runnerControlSession');
+    const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);
+    return await db().transaction(async (tx)=>{
+        const [bootstrap] = await tx.update(runnerBootstrapTokens).set({
+            consumedAt: sql`now()`
+        }).where(and(eq(runnerBootstrapTokens.hashedToken, hashOpaqueToken(params.rawToken)), isNull(runnerBootstrapTokens.consumedAt), isNull(runnerBootstrapTokens.revokedAt), gt(runnerBootstrapTokens.expiresAt, sql`now()`))).returning();
+        if (!bootstrap) throw new RunnerBootstrapTokenInvalidError();
+        const [session] = await tx.insert(runnerControlSessions).values({
+            runnerInstanceId: bootstrap.runnerInstanceId,
+            provisionerId: bootstrap.provisionerId,
+            hashedToken: hashOpaqueToken(controlSessionToken),
+            prefix: extractDisplayPrefix(controlSessionToken),
+            expiresAt
+        }).returning({
+            id: runnerControlSessions.id
+        });
+        if (!session) throw new Error('Runner control session insert returned no row');
+        return {
+            runnerInstanceId: bootstrap.runnerInstanceId,
+            controlSessionToken,
+            expiresAt
+        };
+    });
+}
+export async function resolveRunnerControlSession(rawToken) {
+    const [session] = await db().select({
+        id: runnerControlSessions.id,
+        runnerInstanceId: runnerControlSessions.runnerInstanceId,
+        provisionerId: runnerControlSessions.provisionerId
+    }).from(runnerControlSessions).leftJoin(provisionerTokens, eq(provisionerTokens.id, runnerControlSessions.provisionerId)).where(and(eq(runnerControlSessions.hashedToken, hashOpaqueToken(rawToken)), isNull(runnerControlSessions.closedAt), or(isNull(provisionerTokens.id), isNull(provisionerTokens.revokedAt)), gt(runnerControlSessions.expiresAt, sql`now()`))).limit(1);
+    return session;
+}
+export async function enrollRunnerControlSession(params) {
+    const updated = await db().update(providerRunners).set({
+        labels: [
+            ...canonicalizeLabels(params.labels)
+        ],
+        providerKind: params.providerKind,
+        protocolVersion: params.protocolVersion,
+        capabilities: params.capabilities ?? null,
+        state: 'running',
+        reportedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(providerRunners.id, params.runnerInstanceId), eq(providerRunners.provisionerId, params.provisionerId), notInArray(providerRunners.state, [
+        ...terminalStates
+    ]))).returning({
+        id: providerRunners.id
+    });
+    if (!updated[0]) throw new RunnerControlSessionInvalidError();
+    await touchRunnerControlSession(params.runnerInstanceId, params.provisionerId);
+}
+export async function attachRunnerControlProviderId(params) {
+    const rows = await db().update(providerRunners).set({
+        providerRunnerId: params.providerRunnerId,
+        updatedAt: sql`now()`
+    }).where(and(eq(providerRunners.id, params.runnerInstanceId), eq(providerRunners.provisionerId, params.provisionerId), isNull(providerRunners.providerRunnerId), notInArray(providerRunners.state, [
+        ...terminalStates
+    ]))).returning({
+        id: providerRunners.id
+    });
+    return rows.length === 1;
+}
+export async function touchRunnerControlSession(runnerInstanceId, provisionerId) {
+    await db().update(runnerControlSessions).set({
+        lastSeenAt: sql`now()`
+    }).where(and(eq(runnerControlSessions.runnerInstanceId, runnerInstanceId), eq(runnerControlSessions.provisionerId, provisionerId), isNull(runnerControlSessions.closedAt)));
+    await db().update(providerRunners).set({
+        reportedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(providerRunners.id, runnerInstanceId), eq(providerRunners.provisionerId, provisionerId)));
+}
+
+//# sourceMappingURL=runner-control-sessions.js.map

package/dist/core/runner-control-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-control-sessions.ts"],"sourcesContent":["import type {RunnerToolCapabilitiesDto} from '@shipfox/api-runners-dto';\nimport {extractDisplayPrefix, generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {canonicalizeLabels} from '@shipfox/runner-labels';\nimport {and, eq, gt, isNull, notInArray, or, sql} from 'drizzle-orm';\nimport {db} from '#db/db.js';\nimport {terminalStates} from '#db/runner-instances.js';\nimport {provisionerTokens} from '#db/schema/provisioner-tokens.js';\nimport {runnerBootstrapTokens, runnerControlSessions} from '#db/schema/runner-control-sessions.js';\nimport {providerRunners} from '#db/schema/runner-instances.js';\n\nexport class RunnerBootstrapTokenInvalidError extends Error {\n  constructor() {\n    super('Runner bootstrap token is invalid, expired, or has already been used');\n    this.name = 'RunnerBootstrapTokenInvalidError';\n  }\n}\n\nexport class RunnerControlSessionInvalidError extends Error {\n  constructor() {\n    super('Runner control session is invalid, expired, or closed');\n    this.name = 'RunnerControlSessionInvalidError';\n  }\n}\n\nexport async function createRunnerInstancesWithBootstrapTokens(params: {\n  provisionerId: string;\n  providerKind?: string | null;\n  runnerInstances: Array<{templateKey?: string | null}>;\n  ttlSeconds: number;\n}): Promise<Array<{runnerInstanceId: string; bootstrapToken: string}>> {\n  const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);\n  return await db().transaction(async (tx) => {\n    const instances = await tx\n      .insert(providerRunners)\n      .values(\n        params.runnerInstances.map((runner) => ({\n          provisionerId: params.provisionerId,\n          providerKind: params.providerKind ?? null,\n          templateKey: runner.templateKey ?? null,\n          state: 'starting' as const,\n          labels: [],\n          reportedAt: new Date(),\n        })),\n      )\n      .returning({id: providerRunners.id});\n    const results = instances.map((instance) => ({\n      runnerInstanceId: instance.id,\n      bootstrapToken: generateOpaqueToken('runnerBootstrapToken'),\n    }));\n    await tx.insert(runnerBootstrapTokens).values(\n      results.map((result) => ({\n        runnerInstanceId: result.runnerInstanceId,\n        provisionerId: params.provisionerId,\n        hashedToken: hashOpaqueToken(result.bootstrapToken),\n        prefix: extractDisplayPrefix(result.bootstrapToken),\n        expiresAt,\n      })),\n    );\n    return results;\n  });\n}\n\nexport async function exchangeRunnerBootstrapToken(params: {\n  rawToken: string;\n  ttlSeconds: number;\n}): Promise<{runnerInstanceId: string; controlSessionToken: string; expiresAt: Date}> {\n  const controlSessionToken = generateOpaqueToken('runnerControlSession');\n  const expiresAt = new Date(Date.now() + params.ttlSeconds * 1000);\n  return await db().transaction(async (tx) => {\n    const [bootstrap] = await tx\n      .update(runnerBootstrapTokens)\n      .set({consumedAt: sql`now()`})\n      .where(\n        and(\n          eq(runnerBootstrapTokens.hashedToken, hashOpaqueToken(params.rawToken)),\n          isNull(runnerBootstrapTokens.consumedAt),\n          isNull(runnerBootstrapTokens.revokedAt),\n          gt(runnerBootstrapTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n    if (!bootstrap) throw new RunnerBootstrapTokenInvalidError();\n    const [session] = await tx\n      .insert(runnerControlSessions)\n      .values({\n        runnerInstanceId: bootstrap.runnerInstanceId,\n        provisionerId: bootstrap.provisionerId,\n        hashedToken: hashOpaqueToken(controlSessionToken),\n        prefix: extractDisplayPrefix(controlSessionToken),\n        expiresAt,\n      })\n      .returning({id: runnerControlSessions.id});\n    if (!session) throw new Error('Runner control session insert returned no row');\n    return {runnerInstanceId: bootstrap.runnerInstanceId, controlSessionToken, expiresAt};\n  });\n}\n\nexport async function resolveRunnerControlSession(rawToken: string) {\n  const [session] = await db()\n    .select({\n      id: runnerControlSessions.id,\n      runnerInstanceId: runnerControlSessions.runnerInstanceId,\n      provisionerId: runnerControlSessions.provisionerId,\n    })\n    .from(runnerControlSessions)\n    .leftJoin(provisionerTokens, eq(provisionerTokens.id, runnerControlSessions.provisionerId))\n    .where(\n      and(\n        eq(runnerControlSessions.hashedToken, hashOpaqueToken(rawToken)),\n        isNull(runnerControlSessions.closedAt),\n        or(isNull(provisionerTokens.id), isNull(provisionerTokens.revokedAt)),\n        gt(runnerControlSessions.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n  return session;\n}\n\nexport async function enrollRunnerControlSession(params: {\n  runnerInstanceId: string;\n  provisionerId: string;\n  labels: string[];\n  capabilities?: RunnerToolCapabilitiesDto | null;\n  providerKind: string;\n  protocolVersion: string;\n}): Promise<void> {\n  const updated = await db()\n    .update(providerRunners)\n    .set({\n      labels: [...canonicalizeLabels(params.labels)],\n      providerKind: params.providerKind,\n      protocolVersion: params.protocolVersion,\n      capabilities: params.capabilities ?? null,\n      state: 'running',\n      reportedAt: sql`now()`,\n      updatedAt: sql`now()`,\n    })\n    .where(\n      and(\n        eq(providerRunners.id, params.runnerInstanceId),\n        eq(providerRunners.provisionerId, params.provisionerId),\n        notInArray(providerRunners.state, [...terminalStates]),\n      ),\n    )\n    .returning({id: providerRunners.id});\n  if (!updated[0]) throw new RunnerControlSessionInvalidError();\n  await touchRunnerControlSession(params.runnerInstanceId, params.provisionerId);\n}\n\nexport async function attachRunnerControlProviderId(params: {\n  runnerInstanceId: string;\n  provisionerId: string;\n  providerRunnerId: string;\n}): Promise<boolean> {\n  const rows = await db()\n    .update(providerRunners)\n    .set({providerRunnerId: params.providerRunnerId, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(providerRunners.id, params.runnerInstanceId),\n        eq(providerRunners.provisionerId, params.provisionerId),\n        isNull(providerRunners.providerRunnerId),\n        notInArray(providerRunners.state, [...terminalStates]),\n      ),\n    )\n    .returning({id: providerRunners.id});\n  return rows.length === 1;\n}\n\nexport async function touchRunnerControlSession(runnerInstanceId: string, provisionerId: string) {\n  await db()\n    .update(runnerControlSessions)\n    .set({lastSeenAt: sql`now()`})\n    .where(\n      and(\n        eq(runnerControlSessions.runnerInstanceId, runnerInstanceId),\n        eq(runnerControlSessions.provisionerId, provisionerId),\n        isNull(runnerControlSessions.closedAt),\n      ),\n    );\n  await db()\n    .update(providerRunners)\n    .set({reportedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(providerRunners.id, runnerInstanceId),\n        eq(providerRunners.provisionerId, provisionerId),\n      ),\n    );\n}\n"],"names":["extractDisplayPrefix","generateOpaqueToken","hashOpaqueToken","canonicalizeLabels","and","eq","gt","isNull","notInArray","or","sql","db","terminalStates","provisionerTokens","runnerBootstrapTokens","runnerControlSessions","providerRunners","RunnerBootstrapTokenInvalidError","Error","name","RunnerControlSessionInvalidError","createRunnerInstancesWithBootstrapTokens","params","expiresAt","Date","now","ttlSeconds","transaction","tx","instances","insert","values","runnerInstances","map","runner","provisionerId","providerKind","templateKey","state","labels","reportedAt","returning","id","results","instance","runnerInstanceId","bootstrapToken","result","hashedToken","prefix","exchangeRunnerBootstrapToken","controlSessionToken","bootstrap","update","set","consumedAt","where","rawToken","revokedAt","session","resolveRunnerControlSession","select","from","leftJoin","closedAt","limit","enrollRunnerControlSession","updated","protocolVersion","capabilities","updatedAt","touchRunnerControlSession","attachRunnerControlProviderId","rows","providerRunnerId","length","lastSeenAt"],"mappings":"AACA,SAAQA,oBAAoB,EAAEC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAChG,SAAQC,kBAAkB,QAAO,yBAAyB;AAC1D,SAAQC,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,UAAU,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,iBAAiB,QAAO,mCAAmC;AACnE,SAAQC,qBAAqB,EAAEC,qBAAqB,QAAO,wCAAwC;AACnG,SAAQC,eAAe,QAAO,iCAAiC;AAE/D,OAAO,MAAMC,yCAAyCC;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,yCAAyCF;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,eAAeE,yCAAyCC,MAK9D;IACC,MAAMC,YAAY,IAAIC,KAAKA,KAAKC,GAAG,KAAKH,OAAOI,UAAU,GAAG;IAC5D,OAAO,MAAMf,KAAKgB,WAAW,CAAC,OAAOC;QACnC,MAAMC,YAAY,MAAMD,GACrBE,MAAM,CAACd,iBACPe,MAAM,CACLT,OAAOU,eAAe,CAACC,GAAG,CAAC,CAACC,SAAY,CAAA;gBACtCC,eAAeb,OAAOa,aAAa;gBACnCC,cAAcd,OAAOc,YAAY,IAAI;gBACrCC,aAAaH,OAAOG,WAAW,IAAI;gBACnCC,OAAO;gBACPC,QAAQ,EAAE;gBACVC,YAAY,IAAIhB;YAClB,CAAA,IAEDiB,SAAS,CAAC;YAACC,IAAI1B,gBAAgB0B,EAAE;QAAA;QACpC,MAAMC,UAAUd,UAAUI,GAAG,CAAC,CAACW,WAAc,CAAA;gBAC3CC,kBAAkBD,SAASF,EAAE;gBAC7BI,gBAAgB7C,oBAAoB;YACtC,CAAA;QACA,MAAM2B,GAAGE,MAAM,CAAChB,uBAAuBiB,MAAM,CAC3CY,QAAQV,GAAG,CAAC,CAACc,SAAY,CAAA;gBACvBF,kBAAkBE,OAAOF,gBAAgB;gBACzCV,eAAeb,OAAOa,aAAa;gBACnCa,aAAa9C,gBAAgB6C,OAAOD,cAAc;gBAClDG,QAAQjD,qBAAqB+C,OAAOD,cAAc;gBAClDvB;YACF,CAAA;QAEF,OAAOoB;IACT;AACF;AAEA,OAAO,eAAeO,6BAA6B5B,MAGlD;IACC,MAAM6B,sBAAsBlD,oBAAoB;IAChD,MAAMsB,YAAY,IAAIC,KAAKA,KAAKC,GAAG,KAAKH,OAAOI,UAAU,GAAG;IAC5D,OAAO,MAAMf,KAAKgB,WAAW,CAAC,OAAOC;QACnC,MAAM,CAACwB,UAAU,GAAG,MAAMxB,GACvByB,MAAM,CAACvC,uBACPwC,GAAG,CAAC;YAACC,YAAY7C,GAAG,CAAC,KAAK,CAAC;QAAA,GAC3B8C,KAAK,CACJpD,IACEC,GAAGS,sBAAsBkC,WAAW,EAAE9C,gBAAgBoB,OAAOmC,QAAQ,IACrElD,OAAOO,sBAAsByC,UAAU,GACvChD,OAAOO,sBAAsB4C,SAAS,GACtCpD,GAAGQ,sBAAsBS,SAAS,EAAEb,GAAG,CAAC,KAAK,CAAC,IAGjD+B,SAAS;QACZ,IAAI,CAACW,WAAW,MAAM,IAAInC;QAC1B,MAAM,CAAC0C,QAAQ,GAAG,MAAM/B,GACrBE,MAAM,CAACf,uBACPgB,MAAM,CAAC;YACNc,kBAAkBO,UAAUP,gBAAgB;YAC5CV,eAAeiB,UAAUjB,aAAa;YACtCa,aAAa9C,gBAAgBiD;YAC7BF,QAAQjD,qBAAqBmD;YAC7B5B;QACF,GACCkB,SAAS,CAAC;YAACC,IAAI3B,sBAAsB2B,EAAE;QAAA;QAC1C,IAAI,CAACiB,SAAS,MAAM,IAAIzC,MAAM;QAC9B,OAAO;YAAC2B,kBAAkBO,UAAUP,gBAAgB;YAAEM;YAAqB5B;QAAS;IACtF;AACF;AAEA,OAAO,eAAeqC,4BAA4BH,QAAgB;IAChE,MAAM,CAACE,QAAQ,GAAG,MAAMhD,KACrBkD,MAAM,CAAC;QACNnB,IAAI3B,sBAAsB2B,EAAE;QAC5BG,kBAAkB9B,sBAAsB8B,gBAAgB;QACxDV,eAAepB,sBAAsBoB,aAAa;IACpD,GACC2B,IAAI,CAAC/C,uBACLgD,QAAQ,CAAClD,mBAAmBR,GAAGQ,kBAAkB6B,EAAE,EAAE3B,sBAAsBoB,aAAa,GACxFqB,KAAK,CACJpD,IACEC,GAAGU,sBAAsBiC,WAAW,EAAE9C,gBAAgBuD,YACtDlD,OAAOQ,sBAAsBiD,QAAQ,GACrCvD,GAAGF,OAAOM,kBAAkB6B,EAAE,GAAGnC,OAAOM,kBAAkB6C,SAAS,IACnEpD,GAAGS,sBAAsBQ,SAAS,EAAEb,GAAG,CAAC,KAAK,CAAC,IAGjDuD,KAAK,CAAC;IACT,OAAON;AACT;AAEA,OAAO,eAAeO,2BAA2B5C,MAOhD;IACC,MAAM6C,UAAU,MAAMxD,KACnB0C,MAAM,CAACrC,iBACPsC,GAAG,CAAC;QACHf,QAAQ;eAAIpC,mBAAmBmB,OAAOiB,MAAM;SAAE;QAC9CH,cAAcd,OAAOc,YAAY;QACjCgC,iBAAiB9C,OAAO8C,eAAe;QACvCC,cAAc/C,OAAO+C,YAAY,IAAI;QACrC/B,OAAO;QACPE,YAAY9B,GAAG,CAAC,KAAK,CAAC;QACtB4D,WAAW5D,GAAG,CAAC,KAAK,CAAC;IACvB,GACC8C,KAAK,CACJpD,IACEC,GAAGW,gBAAgB0B,EAAE,EAAEpB,OAAOuB,gBAAgB,GAC9CxC,GAAGW,gBAAgBmB,aAAa,EAAEb,OAAOa,aAAa,GACtD3B,WAAWQ,gBAAgBsB,KAAK,EAAE;WAAI1B;KAAe,IAGxD6B,SAAS,CAAC;QAACC,IAAI1B,gBAAgB0B,EAAE;IAAA;IACpC,IAAI,CAACyB,OAAO,CAAC,EAAE,EAAE,MAAM,IAAI/C;IAC3B,MAAMmD,0BAA0BjD,OAAOuB,gBAAgB,EAAEvB,OAAOa,aAAa;AAC/E;AAEA,OAAO,eAAeqC,8BAA8BlD,MAInD;IACC,MAAMmD,OAAO,MAAM9D,KAChB0C,MAAM,CAACrC,iBACPsC,GAAG,CAAC;QAACoB,kBAAkBpD,OAAOoD,gBAAgB;QAAEJ,WAAW5D,GAAG,CAAC,KAAK,CAAC;IAAA,GACrE8C,KAAK,CACJpD,IACEC,GAAGW,gBAAgB0B,EAAE,EAAEpB,OAAOuB,gBAAgB,GAC9CxC,GAAGW,gBAAgBmB,aAAa,EAAEb,OAAOa,aAAa,GACtD5B,OAAOS,gBAAgB0D,gBAAgB,GACvClE,WAAWQ,gBAAgBsB,KAAK,EAAE;WAAI1B;KAAe,IAGxD6B,SAAS,CAAC;QAACC,IAAI1B,gBAAgB0B,EAAE;IAAA;IACpC,OAAO+B,KAAKE,MAAM,KAAK;AACzB;AAEA,OAAO,eAAeJ,0BAA0B1B,gBAAwB,EAAEV,aAAqB;IAC7F,MAAMxB,KACH0C,MAAM,CAACtC,uBACPuC,GAAG,CAAC;QAACsB,YAAYlE,GAAG,CAAC,KAAK,CAAC;IAAA,GAC3B8C,KAAK,CACJpD,IACEC,GAAGU,sBAAsB8B,gBAAgB,EAAEA,mBAC3CxC,GAAGU,sBAAsBoB,aAAa,EAAEA,gBACxC5B,OAAOQ,sBAAsBiD,QAAQ;IAG3C,MAAMrD,KACH0C,MAAM,CAACrC,iBACPsC,GAAG,CAAC;QAACd,YAAY9B,GAAG,CAAC,KAAK,CAAC;QAAE4D,WAAW5D,GAAG,CAAC,KAAK,CAAC;IAAA,GAClD8C,KAAK,CACJpD,IACEC,GAAGW,gBAAgB0B,EAAE,EAAEG,mBACvBxC,GAAGW,gBAAgBmB,aAAa,EAAEA;AAG1C"}

package/dist/core/runner-instances.d.ts

@@ -0,0 +1,72 @@
+import type { RunnerInstance, RunnerInstanceState } from '#core/entities/runner-instance.js';
+import { type RunnerInstanceReportEvent } from '#db/index.js';
+import type { RunnerInstanceBoundJobExecution } from '#db/job-executions.js';
+export interface ReportRunnerInstancesParams {
+    workspaceId: string | null;
+    provisionerId: string;
+    events: RunnerInstanceReportEvent[];
+}
+export declare function attachRunnerInstanceProviderId(params: {
+    runnerInstanceId: string;
+    provisionerId: string;
+    providerRunnerId: string;
+}): Promise<boolean>;
+export interface ReportRunnerInstancesResult {
+    accepted: number;
+    reservationsReleased: number;
+}
+export interface ReconcileRunnerInstancesParams {
+    workspaceId: string | null;
+    provisionerId: string;
+    observedRunnerInstanceIds: string[];
+}
+export type ReconcileDesiredIntent = 'keep' | 'terminate';
+type ReconcileDesiredIntentReason = 'job-cancelled' | 'terminal-state';
+export interface ReconciledBoundJobExecution {
+    jobId: string;
+    jobExecutionId: string;
+    workflowRunAttemptId: string;
+    lastHeartbeatAt: Date;
+    cancellationRequestedAt: Date | null;
+}
+export interface ReconciledRunnerInstance {
+    providerRunnerId: string;
+    state: RunnerInstanceState | null;
+    reservationId: string | null;
+    runnerSessionId: string | null;
+    boundJobExecution: ReconciledBoundJobExecution | null;
+    desiredIntent: ReconcileDesiredIntent;
+    desiredIntentReason: ReconcileDesiredIntentReason | null;
+}
+export interface ReconcileRunnerInstancesResult {
+    runners: ReconciledRunnerInstance[];
+    terminatedAbsentRunnerInstanceIds: string[];
+}
+export type ActiveRunnerState = 'starting' | 'running' | 'stopping' | 'busy';
+export interface ActiveRunner {
+    runnerSessionId: string | null;
+    providerRunnerId: string | null;
+    provisionerId: string | null;
+    state: ActiveRunnerState;
+    labels: string[];
+    templateKey: string | null;
+    providerKind: string | null;
+    jobId: string | null;
+    workflowRunAttemptId: string | null;
+    projectId: string | null;
+    reportedAt: Date | null;
+    lastHeartbeatAt: Date | null;
+}
+export declare function reportRunnerInstances(params: ReportRunnerInstancesParams): Promise<ReportRunnerInstancesResult>;
+export declare function reconcileRunnerInstances(params: ReconcileRunnerInstancesParams): Promise<ReconcileRunnerInstancesResult>;
+export declare function reconcileRunnerInstancesFromDbResult(params: {
+    observedRunnerInstanceIds: string[];
+    observedRows: RunnerInstance[];
+    boundJobExecutionsByRunnerInstanceId: Map<string, RunnerInstanceBoundJobExecution>;
+}): ReconciledRunnerInstance[];
+export declare function listActiveRunners(params: {
+    workspaceId: string;
+}): Promise<ActiveRunner[]>;
+export declare function desiredIntent(row: RunnerInstance | undefined, boundJobExecution: RunnerInstanceBoundJobExecution | undefined): ReconcileDesiredIntent;
+export {};
+//# sourceMappingURL=runner-instances.d.ts.map

package/dist/core/runner-instances.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-instances.d.ts","sourceRoot":"","sources":["../../src/core/runner-instances.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,cAAc,EAAE,mBAAmB,EAAC,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAKL,KAAK,yBAAyB,EAG/B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAEV,+BAA+B,EAChC,MAAM,uBAAuB,CAAC;AAW/B,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,yBAAyB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,WAAW,CAAC;AAC1D,KAAK,4BAA4B,GAAG,eAAe,GAAG,gBAAgB,CAAC;AAEvE,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,IAAI,CAAC;IACtB,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,2BAA2B,GAAG,IAAI,CAAC;IACtD,aAAa,EAAE,sBAAsB,CAAC;IACtC,mBAAmB,EAAE,4BAA4B,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,iCAAiC,EAAE,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAYtC;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CA4BzC;AAED,wBAAgB,oCAAoC,CAAC,MAAM,EAAE;IAC3D,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,oCAAoC,EAAE,GAAG,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;CACpF,GAAG,wBAAwB,EAAE,CAuB7B;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAa9F;AAcD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,cAAc,GAAG,SAAS,EAC/B,iBAAiB,EAAE,+BAA+B,GAAG,SAAS,GAC7D,sBAAsB,CAExB"}