@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/services/executorPhaseADriftEvaluator.d.ts

@@ -0,0 +1,78 @@
+import { type VerifiedExecutorPhaseADriftRequest } from '../shared/executorPhaseADriftContracts.js';
+import type { ExecutorPhaseARs256Signer } from './executorPhaseAIssuerCore.js';
+export declare const EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS: number;
+export interface ExecutorPhaseADriftReplayStore {
+    claim(input: {
+        requestId: string;
+        requestSha256: string;
+        claimedAt: string;
+        retainUntil: string;
+    }): Promise<'claimed' | 'duplicate'>;
+}
+export interface ExecutorPhaseADriftState {
+    issuer: string;
+    audience: string;
+    publishedKeyIds: string[];
+    brokerRoutesAuthenticated: boolean;
+    sourceIdentityPatterns: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    principalTagKeys: string[];
+    roleTrustSha256: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    rolePolicySha256: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    maxSessionDurationSeconds: number;
+    cloudTrailEnabled: boolean;
+    alarmsEnabled: boolean;
+}
+export interface ExecutorPhaseADriftFinding {
+    code: string;
+    expectedSha256: string;
+    observedSha256: string;
+}
+export declare function evaluateExecutorPhaseADrift(expected: ExecutorPhaseADriftState, observed: ExecutorPhaseADriftState): ExecutorPhaseADriftFinding[];
+export declare function attestExecutorPhaseADrift(input: {
+    requestId: string;
+    runId: string;
+    accountId: string;
+    region: 'us-west-2';
+    expected: ExecutorPhaseADriftState;
+    observed: ExecutorPhaseADriftState;
+    collectedAt: Date;
+}, signer: ExecutorPhaseARs256Signer): Promise<{
+    payload: {
+        schema: "taskforce.executor-phase-a-drift-attestation-payload/v1";
+        requestId: string;
+        runId: string;
+        accountId: string;
+        region: "us-west-2";
+        status: "fail" | "pass";
+        findings: ExecutorPhaseADriftFinding[];
+        observedStateSha256: string;
+        collectedAt: string;
+        expiresAt: string;
+    };
+    envelope: {
+        algorithm: "RS256";
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}>;
+export declare function collectAndAttestExecutorPhaseADrift(request: VerifiedExecutorPhaseADriftRequest, expected: ExecutorPhaseADriftState, replayStore: ExecutorPhaseADriftReplayStore, collectObservedState: () => Promise<ExecutorPhaseADriftState>, signer: ExecutorPhaseARs256Signer, now?: () => Date): Promise<{
+    payload: {
+        schema: "taskforce.executor-phase-a-drift-attestation-payload/v1";
+        requestId: string;
+        runId: string;
+        accountId: string;
+        region: "us-west-2";
+        status: "fail" | "pass";
+        findings: ExecutorPhaseADriftFinding[];
+        observedStateSha256: string;
+        collectedAt: string;
+        expiresAt: string;
+    };
+    envelope: {
+        algorithm: "RS256";
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}>;

package/dist/services/executorPhaseADriftEvaluator.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { canonicalizeExecutorPhaseAJson } from '../shared/executorPhaseAApprovalReceipt.js';
+import { assertVerifiedExecutorPhaseADriftRequest, } from '../shared/executorPhaseADriftContracts.js';
+import { assertExecutorPhaseASchema } from '../shared/executorPhaseASchemaValidation.js';
+import { EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS } from '../shared/executorPhaseATiming.js';
+export const EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS = 10 * 60 * 1000;
+const CHECKS = [
+    { code: 'ISSUER_MISMATCH', select: (state) => state.issuer },
+    { code: 'AUDIENCE_MISMATCH', select: (state) => state.audience },
+    { code: 'PUBLISHED_KEY_SET_MISMATCH', select: (state) => [...state.publishedKeyIds].sort() },
+    { code: 'BROKER_ROUTE_AUTH_MISSING', select: (state) => state.brokerRoutesAuthenticated },
+    { code: 'SOURCE_IDENTITY_PATTERN_MISMATCH', select: (state) => state.sourceIdentityPatterns },
+    { code: 'PRINCIPAL_TAG_KEYS_MISMATCH', select: (state) => [...state.principalTagKeys].sort() },
+    { code: 'ROLE_TRUST_MISMATCH', select: (state) => state.roleTrustSha256 },
+    { code: 'ROLE_POLICY_MISMATCH', select: (state) => state.rolePolicySha256 },
+    { code: 'SESSION_DURATION_MISMATCH', select: (state) => state.maxSessionDurationSeconds },
+    { code: 'CLOUDTRAIL_DISABLED', select: (state) => state.cloudTrailEnabled },
+    { code: 'ALARMS_DISABLED', select: (state) => state.alarmsEnabled },
+];
+function digest(value) {
+    return createHash('sha256').update(canonicalizeExecutorPhaseAJson(value)).digest('hex');
+}
+export function evaluateExecutorPhaseADrift(expected, observed) {
+    const findings = [];
+    for (const check of CHECKS) {
+        const expectedValue = check.select(expected);
+        const observedValue = check.select(observed);
+        const expectedSha256 = digest(expectedValue);
+        const observedSha256 = digest(observedValue);
+        if (expectedSha256 !== observedSha256) {
+            findings.push({ code: check.code, expectedSha256, observedSha256 });
+        }
+    }
+    return findings;
+}
+export async function attestExecutorPhaseADrift(input, signer) {
+    const findings = evaluateExecutorPhaseADrift(input.expected, input.observed);
+    const payload = {
+        schema: 'taskforce.executor-phase-a-drift-attestation-payload/v1',
+        requestId: input.requestId,
+        runId: input.runId,
+        accountId: input.accountId,
+        region: input.region,
+        status: findings.length === 0 ? 'pass' : 'fail',
+        findings,
+        observedStateSha256: digest(input.observed),
+        collectedAt: input.collectedAt.toISOString(),
+        expiresAt: new Date(input.collectedAt.getTime() + 60_000).toISOString(),
+    };
+    const payloadBytes = canonicalizeExecutorPhaseAJson(payload);
+    const signature = await signer.sign(payloadBytes);
+    if (signature.length !== 256)
+        throw new TypeError('The drift signer returned a non-RSA-2048 signature.');
+    const attestation = {
+        payload,
+        envelope: {
+            algorithm: 'RS256',
+            keyId: signer.keyId,
+            payloadSha256: createHash('sha256').update(payloadBytes).digest('hex'),
+            signature: signature.toString('base64url'),
+        },
+    };
+    assertExecutorPhaseASchema('driftAttestation', attestation);
+    return attestation;
+}
+export async function collectAndAttestExecutorPhaseADrift(request, expected, replayStore, collectObservedState, signer, now = () => new Date()) {
+    assertVerifiedExecutorPhaseADriftRequest(request);
+    const claimedAt = now();
+    const issuedAt = Date.parse(request.payload.issuedAt);
+    const expiresAt = Date.parse(request.payload.expiresAt);
+    if (claimedAt.getTime() + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS < issuedAt
+        || claimedAt.getTime() >= expiresAt + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS) {
+        throw new TypeError('The verified drift request is not fresh at collection time.');
+    }
+    const claim = await replayStore.claim({
+        requestId: request.payload.requestId,
+        requestSha256: digest(request),
+        claimedAt: claimedAt.toISOString(),
+        retainUntil: new Date(claimedAt.getTime() + EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS).toISOString(),
+    });
+    if (claim !== 'claimed')
+        throw new TypeError('The drift request was already claimed.');
+    const observed = await collectObservedState();
+    return attestExecutorPhaseADrift({
+        requestId: request.payload.requestId,
+        runId: request.payload.runId,
+        accountId: request.payload.accountId,
+        region: request.payload.region,
+        expected,
+        observed,
+        collectedAt: now(),
+    }, signer);
+}

package/dist/services/executorPhaseAIssuerCore.d.ts

@@ -0,0 +1,126 @@
+import { type KeyObject } from 'node:crypto';
+import { type ExecutorPhaseAApprovalReceipt } from '../shared/executorPhaseAApprovalReceipt.js';
+import { type ExecutorPhaseAIssuerRedemptionRequest, type ExecutorPhaseAIssuerRedemptionResponse } from '../shared/executorPhaseAIssuerContracts.js';
+import { type ExecutorPhaseARunCapability, type ExecutorPhaseASenderProof, type ExecutorPhaseAWorkloadGrant, type VerifiedExecutorPhaseAWorkloadGrantBundle } from '../shared/executorPhaseARunAuthorization.js';
+export declare const EXECUTOR_PHASE_A_OIDC_PUBLIC_CACHE_MAX_AGE_SECONDS = 300;
+declare const TRANSITIVE_TAG_KEYS: readonly ["TaskforceRun", "TaskforceReceipt", "TaskforcePhase", "TaskforceWorkspaceHash", "TaskforceSource"];
+export interface ExecutorPhaseARs256Signer {
+    keyId: string;
+    sign(bytes: Buffer): Promise<Buffer>;
+}
+export interface ExecutorPhaseAOidcKey {
+    keyId: string;
+    publicKey: KeyObject;
+    status: 'active' | 'retiring' | 'disabled' | 'removed';
+    validFrom: string;
+    validUntil: string;
+    lastIssuedAt: string | null;
+    publishUntil: string | null;
+}
+export interface ExecutorPhaseAWorkloadJwtClaims {
+    iss: string;
+    aud: string;
+    sub: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    'https://aws.amazon.com/source_identity': string;
+    'https://aws.amazon.com/tags': {
+        principal_tags: Record<(typeof TRANSITIVE_TAG_KEYS)[number], [string]>;
+        transitive_tag_keys: typeof TRANSITIVE_TAG_KEYS;
+    };
+    taskforce: {
+        schema: 'taskforce.executor-phase-a-workload-jwt-claims/v1';
+        receiptId: string;
+        receiptSha256: string;
+        workspaceId: string;
+        taskId: string;
+        runId: string;
+        sourceCommit: string;
+        accountId: string;
+        region: 'us-west-2';
+        availabilityZone: string;
+        logicalEnvelopeSha256: string;
+        budgetsSha256: string;
+        roleArn: string;
+        brokerKeyFingerprint: string;
+        grantId: string;
+        grantSha256: string;
+        senderProofSha256: string;
+    };
+}
+export interface ExecutorPhaseAIssuerStateStore {
+    acquire(input: {
+        grantId: string;
+        grantSha256: string;
+        senderProofSha256: string;
+        requestId: string;
+        createdAt: string;
+    }): Promise<'acquired' | 'terminal'>;
+    releasePending(input: {
+        grantId: string;
+        requestId: string;
+        updatedAt: string;
+    }): Promise<void>;
+    markSigned(input: {
+        grantId: string;
+        tokenId: string;
+        kmsKeyId: string;
+        updatedAt: string;
+    }): Promise<void>;
+    markFailed(input: {
+        grantId: string;
+        errorCategory: string;
+        updatedAt: string;
+    }): Promise<void>;
+}
+export interface ExecutorPhaseAIssuerCoreInput {
+    requestId: string;
+    approvalReceipt: ExecutorPhaseAApprovalReceipt;
+    runCapability: ExecutorPhaseARunCapability;
+    workloadGrant: ExecutorPhaseAWorkloadGrant;
+    senderProof: ExecutorPhaseASenderProof;
+    brokerRequestSha256: string;
+    expectedPolicySha256: string;
+}
+export declare function buildExecutorPhaseAOidcJwks(keys: readonly ExecutorPhaseAOidcKey[], now?: Date): {
+    keys: {
+        kty: string;
+        n: string | undefined;
+        e: string | undefined;
+        use: string;
+        alg: string;
+        kid: string;
+    }[];
+};
+export declare function buildExecutorPhaseAOidcDiscovery(issuer: string): {
+    issuer: string;
+    jwks_uri: string;
+    response_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+};
+export declare function buildExecutorPhaseAWorkloadJwtClaims(bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, issuer: string, audience: string, tokenId: string, now: Date): ExecutorPhaseAWorkloadJwtClaims;
+export declare function signExecutorPhaseAWorkloadJwt(claims: ExecutorPhaseAWorkloadJwtClaims, signer: ExecutorPhaseARs256Signer): Promise<string>;
+export declare class ExecutorPhaseAIssuerCore {
+    private readonly options;
+    constructor(options: {
+        stateStore: ExecutorPhaseAIssuerStateStore;
+        redeem: (request: ExecutorPhaseAIssuerRedemptionRequest) => Promise<ExecutorPhaseAIssuerRedemptionResponse>;
+        issuerProofSigner: ExecutorPhaseARs256Signer;
+        oidcSigner: ExecutorPhaseARs256Signer;
+        cloudArtifactPublicKey: KeyObject;
+        cloudResponseKeys: readonly {
+            keyId: string;
+            publicKey: KeyObject;
+            status: 'active' | 'retiring' | 'disabled';
+        }[];
+        issuer: string;
+        audience: string;
+        now?: () => Date;
+        randomId: (kind: 'request' | 'token') => string;
+    });
+    issue(input: ExecutorPhaseAIssuerCoreInput): Promise<string>;
+}
+export {};

package/dist/services/executorPhaseAIssuerCore.js

@@ -0,0 +1,295 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { canonicalizeExecutorPhaseAJson, } from '../shared/executorPhaseAApprovalReceipt.js';
+import { executorPhaseAIssuerProofSignedBytes, executorPhaseAIssuerRedemptionAuditSha256, executorPhaseAIssuerRedemptionIntentSha256, EXECUTOR_PHASE_A_ISSUER_PROOF_PAYLOAD_SCHEMA, EXECUTOR_PHASE_A_ISSUER_PROOF_SCHEMA, EXECUTOR_PHASE_A_ISSUER_PROOF_TYPE, EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH, EXECUTOR_PHASE_A_ISSUER_REDEMPTION_REQUEST_SCHEMA, } from '../shared/executorPhaseAIssuerContracts.js';
+import { executorPhaseASourceIdentity, verifyExecutorPhaseARunCapabilityArtifact, verifyExecutorPhaseAWorkloadGrantBundle, } from '../shared/executorPhaseARunAuthorization.js';
+import { assertExecutorPhaseASchema } from '../shared/executorPhaseASchemaValidation.js';
+import { EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS } from '../shared/executorPhaseATiming.js';
+const JWT_TTL_SECONDS = 120;
+const RETIRING_KEY_OVERLAP_MS = 15 * 60 * 1000;
+export const EXECUTOR_PHASE_A_OIDC_PUBLIC_CACHE_MAX_AGE_SECONDS = 300;
+const TRANSITIVE_TAG_KEYS = [
+    'TaskforceRun',
+    'TaskforceReceipt',
+    'TaskforcePhase',
+    'TaskforceWorkspaceHash',
+    'TaskforceSource',
+];
+function timestamp(value, field) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed))
+        throw new TypeError(`${field} is invalid.`);
+    return parsed;
+}
+function sha256(value) {
+    return createHash('sha256').update(canonicalizeExecutorPhaseAJson(value)).digest('hex');
+}
+function assertRsa2048(publicKey) {
+    if (publicKey.asymmetricKeyType !== 'rsa')
+        throw new TypeError('The OIDC signing key must be RSA.');
+    const details = publicKey.asymmetricKeyDetails;
+    if (details?.modulusLength !== 2048)
+        throw new TypeError('The OIDC signing key must be RSA-2048.');
+    const jwk = publicKey.export({ format: 'jwk' });
+    if (jwk.kty !== 'RSA' || !jwk.n || !jwk.e || jwk.d)
+        throw new TypeError('The OIDC public key is not a public RSA JWK.');
+    return jwk;
+}
+export function buildExecutorPhaseAOidcJwks(keys, now = new Date()) {
+    const nowMs = now.getTime();
+    const active = keys.filter((key) => key.status === 'active');
+    const disabled = keys.filter((key) => key.status === 'disabled');
+    if (active.length !== 1
+        || disabled.length > 1
+        || timestamp(active[0].validFrom, 'key.validFrom') > nowMs
+        || nowMs >= timestamp(active[0].validUntil, 'key.validUntil')
+        || new Set(keys.map((key) => key.keyId)).size !== keys.length) {
+        throw new TypeError('The OIDC keyring must contain exactly one current active key, at most one disabled staging key, and no key-ID reuse.');
+    }
+    for (const key of keys) {
+        if (key.status === 'retiring') {
+            if (!key.lastIssuedAt || !key.publishUntil
+                || timestamp(key.validFrom, 'key.validFrom') > nowMs
+                || timestamp(key.publishUntil, 'key.publishUntil') < timestamp(key.lastIssuedAt, 'key.lastIssuedAt') + RETIRING_KEY_OVERLAP_MS) {
+                throw new TypeError('A retiring OIDC key must retain the required publication overlap.');
+            }
+        }
+        if (key.status === 'removed' && key.lastIssuedAt
+            && (!key.publishUntil || timestamp(key.publishUntil, 'key.publishUntil') < timestamp(key.lastIssuedAt, 'key.lastIssuedAt') + RETIRING_KEY_OVERLAP_MS)) {
+            throw new TypeError('A removed OIDC key did not retain the required publication overlap.');
+        }
+    }
+    const staging = keys.filter((key) => key.status === 'disabled'
+        && key.lastIssuedAt === null
+        && key.publishUntil !== null
+        && nowMs < timestamp(key.publishUntil, 'key.publishUntil')
+        && nowMs < timestamp(key.validUntil, 'key.validUntil'));
+    const retiring = keys.filter((key) => key.status === 'retiring'
+        && nowMs < timestamp(key.publishUntil, 'key.publishUntil'));
+    if (staging.length + retiring.length > 1) {
+        throw new TypeError('JWKS may publish only one disabled staging or retiring secondary key.');
+    }
+    const published = [active[0], ...staging, ...retiring];
+    if (published.length > 2)
+        throw new TypeError('JWKS must publish one active key and at most one secondary key.');
+    return {
+        keys: published.map((key) => {
+            const jwk = assertRsa2048(key.publicKey);
+            return { kty: 'RSA', n: jwk.n, e: jwk.e, use: 'sig', alg: 'RS256', kid: key.keyId };
+        }),
+    };
+}
+export function buildExecutorPhaseAOidcDiscovery(issuer) {
+    const origin = new URL(issuer);
+    if (origin.protocol !== 'https:' || origin.origin !== issuer)
+        throw new TypeError('The OIDC issuer must be an HTTPS origin.');
+    return {
+        issuer,
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+        response_types_supported: ['id_token'],
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: ['RS256'],
+    };
+}
+export function buildExecutorPhaseAWorkloadJwtClaims(bundle, issuer, audience, tokenId, now) {
+    if (!/^token-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/.test(tokenId))
+        throw new TypeError('The workload token ID is invalid.');
+    const capability = bundle.capability.payload;
+    const grant = bundle.grant.payload;
+    if (issuer !== capability.oidcIssuer || audience !== capability.oidcAudience) {
+        throw new TypeError('The JWT authority differs from the verified capability.');
+    }
+    const issuedAt = Math.floor(now.getTime() / 1000);
+    const deadline = Math.floor(Math.min(timestamp(grant.expiresAt, 'grant.expiresAt'), timestamp(grant.phase === 'cleanup' ? capability.cleanupDeadline : capability.mutationDeadline, 'phaseDeadline')) / 1000);
+    const expiresAt = Math.min(issuedAt + JWT_TTL_SECONDS, deadline);
+    if (expiresAt <= issuedAt)
+        throw new TypeError('The workload JWT has no remaining authorized lifetime.');
+    const runDigest = createHash('sha256').update(capability.runId, 'utf8').digest('base64url');
+    const claims = {
+        iss: issuer,
+        aud: audience,
+        sub: `tfr:${runDigest}:${grant.phase}`,
+        iat: issuedAt,
+        nbf: issuedAt,
+        exp: expiresAt,
+        jti: tokenId,
+        'https://aws.amazon.com/source_identity': executorPhaseASourceIdentity(capability.runId, grant.phase),
+        'https://aws.amazon.com/tags': {
+            principal_tags: {
+                TaskforceRun: [grant.sessionTags.TaskforceRun],
+                TaskforceReceipt: [grant.sessionTags.TaskforceReceipt],
+                TaskforcePhase: [grant.sessionTags.TaskforcePhase],
+                TaskforceWorkspaceHash: [grant.sessionTags.TaskforceWorkspaceHash],
+                TaskforceSource: [grant.sessionTags.TaskforceSource],
+            },
+            transitive_tag_keys: TRANSITIVE_TAG_KEYS,
+        },
+        taskforce: {
+            schema: 'taskforce.executor-phase-a-workload-jwt-claims/v1',
+            receiptId: capability.receiptId,
+            receiptSha256: capability.receiptSha256,
+            workspaceId: capability.workspaceId,
+            taskId: capability.taskId,
+            runId: capability.runId,
+            sourceCommit: capability.sourceCommit,
+            accountId: capability.accountId,
+            region: capability.region,
+            availabilityZone: capability.availabilityZone,
+            logicalEnvelopeSha256: capability.logicalEnvelopeSha256,
+            budgetsSha256: capability.budgetsSha256,
+            roleArn: grant.roleArn,
+            brokerKeyFingerprint: capability.brokerKeyFingerprint,
+            grantId: grant.grantId,
+            grantSha256: bundle.grantSha256,
+            senderProofSha256: bundle.senderProofSha256,
+        },
+    };
+    assertExecutorPhaseASchema('workloadJwtClaims', claims);
+    return claims;
+}
+export async function signExecutorPhaseAWorkloadJwt(claims, signer) {
+    assertExecutorPhaseASchema('workloadJwtClaims', claims);
+    const header = { alg: 'RS256', kid: signer.keyId, typ: 'JWT' };
+    const signingInput = `${canonicalizeExecutorPhaseAJson(header).toString('base64url')}.${canonicalizeExecutorPhaseAJson(claims).toString('base64url')}`;
+    const signature = await signer.sign(Buffer.from(signingInput, 'ascii'));
+    if (signature.length !== 256)
+        throw new TypeError('The OIDC signer returned a non-RSA-2048 signature.');
+    return `${signingInput}.${signature.toString('base64url')}`;
+}
+function verifyRedemptionResponse(response, request, cloudKeys, now) {
+    assertExecutorPhaseASchema('issuerRedemptionResponse', response);
+    const trustedKey = cloudKeys.find((key) => key.keyId === response.envelope.keyId && key.status !== 'disabled');
+    if (!trustedKey || trustedKey.publicKey.asymmetricKeyType !== 'ed25519') {
+        throw new TypeError('Taskforce Cloud used an untrusted redemption-response key.');
+    }
+    const payloadBytes = canonicalizeExecutorPhaseAJson(response.payload);
+    const signature = Buffer.from(response.envelope.signature, 'base64url');
+    const redeemedAt = timestamp(response.payload.redeemedAt, 'response.redeemedAt');
+    const proofIssuedAt = timestamp(request.issuerProof.payload.issuedAt, 'issuerProof.issuedAt');
+    const proofExpiresAt = timestamp(request.issuerProof.payload.expiresAt, 'issuerProof.expiresAt');
+    if (response.payload.requestId !== request.requestId
+        || response.payload.grantId !== request.workloadGrant.payload.grantId
+        || response.payload.grantSha256 !== sha256(request.workloadGrant)
+        || response.payload.senderProofSha256 !== sha256(request.senderProof)
+        || response.payload.auditSha256 !== executorPhaseAIssuerRedemptionAuditSha256({
+            requestId: response.payload.requestId,
+            grantId: response.payload.grantId,
+            grantSha256: response.payload.grantSha256,
+            senderProofSha256: response.payload.senderProofSha256,
+            redeemedAt: response.payload.redeemedAt,
+        })
+        || redeemedAt < proofIssuedAt - EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS
+        || redeemedAt > now.getTime() + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS
+        || redeemedAt >= proofExpiresAt + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS
+        || response.envelope.payloadSha256 !== createHash('sha256').update(payloadBytes).digest('hex')
+        || signature.length !== 64 || !verify(null, payloadBytes, trustedKey.publicKey, signature)) {
+        throw new TypeError('Taskforce Cloud returned an invalid issuer redemption decision.');
+    }
+}
+export class ExecutorPhaseAIssuerCore {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async issue(input) {
+        const now = this.options.now?.() || new Date();
+        let grantId = input.workloadGrant.payload.grantId;
+        let acquired = false;
+        let redemptionConfirmed = false;
+        try {
+            const verifiedCapability = verifyExecutorPhaseARunCapabilityArtifact(input.runCapability, input.approvalReceipt, this.options.cloudArtifactPublicKey, now);
+            const brokerPublicKey = createPublicKey({
+                key: Buffer.from(verifiedCapability.payload.brokerPublicKeySpkiBase64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            const intentShape = {
+                ...input,
+                issuerProof: {},
+                schema: EXECUTOR_PHASE_A_ISSUER_REDEMPTION_REQUEST_SCHEMA,
+            };
+            const requestSha256 = executorPhaseAIssuerRedemptionIntentSha256(intentShape);
+            const bundle = verifyExecutorPhaseAWorkloadGrantBundle(input.workloadGrant, verifiedCapability, input.senderProof, input.brokerRequestSha256, input.expectedPolicySha256, this.options.cloudArtifactPublicKey, brokerPublicKey, now);
+            const tokenId = this.options.randomId('token');
+            const claims = buildExecutorPhaseAWorkloadJwtClaims(bundle, this.options.issuer, this.options.audience, tokenId, now);
+            const acquireResult = await this.options.stateStore.acquire({
+                grantId,
+                grantSha256: bundle.grantSha256,
+                senderProofSha256: bundle.senderProofSha256,
+                requestId: input.requestId,
+                createdAt: now.toISOString(),
+            });
+            if (acquireResult !== 'acquired')
+                throw new TypeError('The workload grant already has terminal issuer state.');
+            acquired = true;
+            const proofPayload = {
+                schema: EXECUTOR_PHASE_A_ISSUER_PROOF_PAYLOAD_SCHEMA,
+                method: 'POST',
+                path: EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH,
+                requestSha256,
+                grantId,
+                grantSha256: bundle.grantSha256,
+                senderProofSha256: bundle.senderProofSha256,
+                requestId: input.requestId,
+                issuedAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + 60_000).toISOString(),
+            };
+            const signedProofBytes = executorPhaseAIssuerProofSignedBytes(proofPayload);
+            const proofSignature = await this.options.issuerProofSigner.sign(signedProofBytes);
+            if (proofSignature.length !== 256)
+                throw new TypeError('The issuer proof signer returned a non-RSA-2048 signature.');
+            const request = {
+                schema: EXECUTOR_PHASE_A_ISSUER_REDEMPTION_REQUEST_SCHEMA,
+                requestId: input.requestId,
+                approvalReceipt: input.approvalReceipt,
+                runCapability: input.runCapability,
+                workloadGrant: input.workloadGrant,
+                senderProof: input.senderProof,
+                brokerRequestSha256: input.brokerRequestSha256,
+                expectedPolicySha256: input.expectedPolicySha256,
+                issuerProof: {
+                    payload: proofPayload,
+                    envelope: {
+                        schema: EXECUTOR_PHASE_A_ISSUER_PROOF_SCHEMA,
+                        typ: EXECUTOR_PHASE_A_ISSUER_PROOF_TYPE,
+                        algorithm: 'RS256',
+                        keyId: this.options.issuerProofSigner.keyId,
+                        payloadSha256: createHash('sha256').update(signedProofBytes).digest('hex'),
+                        signature: proofSignature.toString('base64url'),
+                    },
+                },
+            };
+            assertExecutorPhaseASchema('issuerRedemptionRequest', request);
+            const response = await this.options.redeem(request);
+            verifyRedemptionResponse(response, request, this.options.cloudResponseKeys, this.options.now?.() || now);
+            redemptionConfirmed = true;
+            const jwt = await signExecutorPhaseAWorkloadJwt(claims, this.options.oidcSigner);
+            await this.options.stateStore.markSigned({
+                grantId,
+                tokenId,
+                kmsKeyId: this.options.oidcSigner.keyId,
+                updatedAt: (this.options.now?.() || now).toISOString(),
+            });
+            return jwt;
+        }
+        catch (error) {
+            if (acquired) {
+                const updatedAt = (this.options.now?.() || now).toISOString();
+                if (redemptionConfirmed) {
+                    await this.options.stateStore.markFailed({
+                        grantId,
+                        errorCategory: error instanceof TypeError ? 'invalid_artifact' : 'issuer_failure',
+                        updatedAt,
+                    }).catch(() => undefined);
+                }
+                else {
+                    await this.options.stateStore.releasePending({
+                        grantId,
+                        requestId: input.requestId,
+                        updatedAt,
+                    }).catch(() => undefined);
+                }
+            }
+            throw error;
+        }
+    }
+}

package/dist/services/executorPhaseAIssuerRedemptionService.d.ts

@@ -0,0 +1,34 @@
+import { type KeyObject } from 'node:crypto';
+import { type ExecutorPhaseAApprovalTrustPolicy } from '../shared/executorPhaseAApprovalReceipt.js';
+import { type ExecutorPhaseAIssuerProofTrustKey, type ExecutorPhaseAIssuerRedemptionRequest } from '../shared/executorPhaseAIssuerContracts.js';
+import { type ExecutorPhaseARunAuthorizationStore } from '../storage/executorPhaseARunAuthorizationStore.js';
+export declare class ExecutorPhaseAIssuerRedemptionError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(message: string, statusCode?: number, code?: string);
+}
+export interface ExecutorPhaseAIssuerRedemptionCloudKey {
+    keyId: string;
+    publicKey: KeyObject;
+    status: 'active' | 'retiring' | 'disabled';
+}
+export interface ExecutorPhaseAIssuerRedemptionSigningConfig {
+    keyId: string;
+    privateKey: KeyObject;
+}
+export declare class ExecutorPhaseAIssuerRedemptionService {
+    private readonly options;
+    constructor(options: {
+        store: ExecutorPhaseARunAuthorizationStore;
+        responseKeys: readonly ExecutorPhaseAIssuerRedemptionCloudKey[];
+        issuerProofKeys: readonly ExecutorPhaseAIssuerProofTrustKey[];
+        responseSigning: ExecutorPhaseAIssuerRedemptionSigningConfig;
+        approvalPolicy: ExecutorPhaseAApprovalTrustPolicy;
+        now?: () => Date;
+    });
+    redeem(request: ExecutorPhaseAIssuerRedemptionRequest): {
+        bytes: Buffer;
+        digest: string;
+        created: boolean;
+    };
+}