@taskforcehq/taskforce 0.3.329 → 0.3.330

package/dist/shared/userFeatureGrants.d.ts

@@ -0,0 +1,4 @@
+export declare const INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY: "internal.model.subscription_auth";
+export declare const SUPPORTED_INTERNAL_USER_FEATURE_KEYS: readonly ["internal.model.subscription_auth"];
+export type InternalUserFeatureKey = typeof SUPPORTED_INTERNAL_USER_FEATURE_KEYS[number];
+export declare function isSupportedInternalUserFeatureKey(value: unknown): value is InternalUserFeatureKey;

package/dist/shared/userFeatureGrants.js

@@ -0,0 +1,7 @@
+export const INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY = 'internal.model.subscription_auth';
+export const SUPPORTED_INTERNAL_USER_FEATURE_KEYS = [
+    INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY,
+];
+export function isSupportedInternalUserFeatureKey(value) {
+    return SUPPORTED_INTERNAL_USER_FEATURE_KEYS.includes(value);
+}

package/dist/storage/executorPhaseAApprovalReceiptStore.d.ts

@@ -0,0 +1,37 @@
+import type { DatabaseAdapter } from './databaseAdapter.js';
+export interface ExecutorPhaseAApprovalReceiptRecord {
+    receiptId: string;
+    workspaceId: string;
+    taskId: string;
+    taskReference: string;
+    runId: string;
+    receiptKind: 'main' | 'cleanup-only';
+    originalCapabilityId: string | null;
+    residualInventorySha256: string | null;
+    actorUserId: string;
+    preflightSha256: string;
+    logicalEnvelopeSha256: string;
+    canonicalPreflightBytes: Buffer;
+    canonicalReceiptBytes: Buffer;
+    receiptSha256: string;
+    keyId: string;
+    approvedAt: string;
+    expiresAt: string;
+    createdAt: string;
+}
+export declare class ExecutorPhaseAApprovalConflictError extends Error {
+    readonly code = "executor_phase_a_approval_conflict";
+    readonly statusCode = 409;
+    constructor();
+}
+export declare class ExecutorPhaseAApprovalReceiptStore {
+    private readonly db;
+    private readonly tenantId;
+    constructor(db: DatabaseAdapter, tenantId: string);
+    findRun(workspaceId: string, taskId: string, runId: string, receiptKind?: ExecutorPhaseAApprovalReceiptRecord['receiptKind']): ExecutorPhaseAApprovalReceiptRecord | null;
+    persist(candidate: ExecutorPhaseAApprovalReceiptRecord): {
+        record: ExecutorPhaseAApprovalReceiptRecord;
+        created: boolean;
+    };
+    private resolveRetry;
+}

package/dist/storage/executorPhaseAApprovalReceiptStore.js

@@ -0,0 +1,81 @@
+export class ExecutorPhaseAApprovalConflictError extends Error {
+    code = 'executor_phase_a_approval_conflict';
+    statusCode = 409;
+    constructor() {
+        super('A different approval already exists for this Phase A run.');
+        this.name = 'ExecutorPhaseAApprovalConflictError';
+    }
+}
+function fromRow(row) {
+    return {
+        receiptId: String(row.receipt_id),
+        workspaceId: String(row.workspace_id),
+        taskId: String(row.task_id),
+        taskReference: String(row.task_reference),
+        runId: String(row.run_id),
+        receiptKind: String(row.receipt_kind),
+        originalCapabilityId: row.original_capability_id == null ? null : String(row.original_capability_id),
+        residualInventorySha256: row.residual_inventory_sha256 == null ? null : String(row.residual_inventory_sha256),
+        actorUserId: String(row.actor_user_id),
+        preflightSha256: String(row.preflight_sha256),
+        logicalEnvelopeSha256: String(row.logical_envelope_sha256),
+        canonicalPreflightBytes: Buffer.from(row.canonical_preflight_bytes),
+        canonicalReceiptBytes: Buffer.from(row.canonical_receipt_bytes),
+        receiptSha256: String(row.receipt_sha256),
+        keyId: String(row.key_id),
+        approvedAt: String(row.approved_at),
+        expiresAt: String(row.expires_at),
+        createdAt: String(row.created_at),
+    };
+}
+export class ExecutorPhaseAApprovalReceiptStore {
+    db;
+    tenantId;
+    constructor(db, tenantId) {
+        this.db = db;
+        this.tenantId = tenantId;
+    }
+    findRun(workspaceId, taskId, runId, receiptKind = 'main') {
+        const row = this.db.prepare(`
+            SELECT * FROM executor_phase_a_approval_receipts
+            WHERE tenant_id = ? AND workspace_id = ? AND task_id = ? AND run_id = ? AND receipt_kind = ?
+            LIMIT 1
+        `).get(this.tenantId, workspaceId, taskId, runId, receiptKind);
+        return row ? fromRow(row) : null;
+    }
+    persist(candidate) {
+        const persist = this.db.transaction(() => {
+            const result = this.db.prepare(`
+                INSERT INTO executor_phase_a_approval_receipts (
+                    receipt_id, tenant_id, workspace_id, task_id, task_reference, run_id,
+                    receipt_kind, original_capability_id, residual_inventory_sha256,
+                    actor_user_id, preflight_sha256, logical_envelope_sha256,
+                    canonical_preflight_bytes, canonical_receipt_bytes, receipt_sha256,
+                    key_id, approved_at, expires_at, created_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                ON CONFLICT (tenant_id, workspace_id, task_id, run_id, receipt_kind) DO NOTHING
+            `).run(candidate.receiptId, this.tenantId, candidate.workspaceId, candidate.taskId, candidate.taskReference, candidate.runId, candidate.receiptKind, candidate.originalCapabilityId, candidate.residualInventorySha256, candidate.actorUserId, candidate.preflightSha256, candidate.logicalEnvelopeSha256, candidate.canonicalPreflightBytes, candidate.canonicalReceiptBytes, candidate.receiptSha256, candidate.keyId, candidate.approvedAt, candidate.expiresAt, candidate.createdAt);
+            const winner = this.findRun(candidate.workspaceId, candidate.taskId, candidate.runId, candidate.receiptKind);
+            if (!winner)
+                throw new Error('Phase A approval receipt insert completed without a durable winner.');
+            const created = Number(result?.changes ?? result?.rowCount ?? 0) > 0;
+            if (!created)
+                return this.resolveRetry(winner, candidate);
+            return { record: winner, created: true };
+        });
+        return persist();
+    }
+    resolveRetry(existing, candidate) {
+        if (existing.actorUserId !== candidate.actorUserId
+            || existing.receiptKind !== candidate.receiptKind
+            || existing.originalCapabilityId !== candidate.originalCapabilityId
+            || existing.residualInventorySha256 !== candidate.residualInventorySha256
+            || existing.taskReference !== candidate.taskReference
+            || existing.preflightSha256 !== candidate.preflightSha256
+            || existing.logicalEnvelopeSha256 !== candidate.logicalEnvelopeSha256
+            || !existing.canonicalPreflightBytes.equals(candidate.canonicalPreflightBytes)) {
+            throw new ExecutorPhaseAApprovalConflictError();
+        }
+        return { record: existing, created: false };
+    }
+}

package/dist/storage/executorPhaseARunAuthorizationStore.d.ts

@@ -0,0 +1,103 @@
+import { type ExecutorPhaseAPhase } from '../shared/executorPhaseAApprovalReceipt.js';
+import { type ExecutorPhaseARunAuthorizationStatus, type ExecutorPhaseARunCapabilityKind, type VerifiedExecutorPhaseARunCapability, type VerifiedExecutorPhaseAWorkloadGrantBundle } from '../shared/executorPhaseARunAuthorization.js';
+import type { DatabaseAdapter } from './databaseAdapter.js';
+export interface ExecutorPhaseARunCapabilityRecord {
+    capabilityId: string;
+    workspaceId: string;
+    taskId: string;
+    runId: string;
+    receiptId: string;
+    receiptSha256: string;
+    capabilityKind: ExecutorPhaseARunCapabilityKind;
+    originalCapabilityId: string | null;
+    residualInventorySha256: string | null;
+    actorUserId: string;
+    accountId: string;
+    region: 'us-west-2';
+    availabilityZone: string;
+    readPrincipalArn: string;
+    brokerKeyFingerprint: string;
+    capabilitySha256: string;
+    preflightSha256: string;
+    logicalEnvelopeSha256: string;
+    sourceCommit: string;
+    roleMapSha256: string;
+    oidcAudienceSha256: string;
+    issuedAt: string;
+    expiresAt: string;
+    mutationDeadline: string;
+    cleanupDeadline: string;
+    status: ExecutorPhaseARunAuthorizationStatus;
+    hardStoppedAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ExecutorPhaseAWorkloadGrantRecord {
+    grantId: string;
+    capabilityId: string;
+    workspaceId: string;
+    taskId: string;
+    runId: string;
+    receiptId: string;
+    phase: ExecutorPhaseAPhase;
+    roleArn: string;
+    grantSha256: string;
+    tokenId: string;
+    nonceId: string;
+    senderProofSha256: string;
+    brokerKeyFingerprint: string;
+    sourceIdentity: string;
+    sessionTagsSha256: string;
+    policySha256: string;
+    issuedAt: string;
+    expiresAt: string;
+    usedAt: string | null;
+    status: 'issued' | 'used' | 'revoked' | 'rejected' | 'expired';
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ExecutorPhaseASenderNonceRecord {
+    nonceId: string;
+    capabilityId: string;
+    requestSha256: string;
+    phase: ExecutorPhaseAPhase;
+    issuedAt: string;
+    expiresAt: string;
+    consumedAt: string | null;
+    status: 'issued' | 'consumed' | 'revoked' | 'expired';
+    createdAt: string;
+    updatedAt: string;
+}
+declare const verifiedCapabilityRecordBrand: unique symbol;
+declare const verifiedGrantRecordBrand: unique symbol;
+export type VerifiedExecutorPhaseARunCapabilityRecord = ExecutorPhaseARunCapabilityRecord & {
+    readonly [verifiedCapabilityRecordBrand]: true;
+};
+export type VerifiedExecutorPhaseAWorkloadGrantRecord = ExecutorPhaseAWorkloadGrantRecord & {
+    readonly [verifiedGrantRecordBrand]: true;
+};
+export interface ExecutorPhaseAGrantRedemptionResult {
+    bytes: Buffer;
+    digest: string;
+    created: boolean;
+    status: 'used';
+}
+export declare function executorPhaseACapabilityRecordFromVerified(artifact: VerifiedExecutorPhaseARunCapability): VerifiedExecutorPhaseARunCapabilityRecord;
+export declare function executorPhaseAGrantRecordFromVerified(bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, tokenId: string): VerifiedExecutorPhaseAWorkloadGrantRecord;
+export declare class ExecutorPhaseARunAuthorizationError extends Error {
+    readonly code = "executor_phase_a_run_authorization_invalid";
+    constructor(message: string);
+}
+export declare class ExecutorPhaseARunAuthorizationStore {
+    private readonly db;
+    private readonly tenantId;
+    constructor(db: DatabaseAdapter, tenantId: string);
+    findCapability(capabilityId: string): ExecutorPhaseARunCapabilityRecord | null;
+    persistCapability(candidate: VerifiedExecutorPhaseARunCapabilityRecord): ExecutorPhaseARunCapabilityRecord;
+    hardStop(capabilityId: string, stoppedAt: string): ExecutorPhaseARunCapabilityRecord;
+    issueNonce(candidate: ExecutorPhaseASenderNonceRecord): ExecutorPhaseASenderNonceRecord;
+    persistGrant(candidate: VerifiedExecutorPhaseAWorkloadGrantRecord, now: string): ExecutorPhaseAWorkloadGrantRecord;
+    redeemVerifiedGrant(bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, requestId: string, requestSha256: string, canonicalResponseBytes: Buffer, responseSha256: string, usedAt: string): ExecutorPhaseAGrantRedemptionResult;
+    private assertCapability;
+}
+export {};