@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/services/executorPhaseADriftEvaluator.d.ts

@@ -0,0 +1,78 @@
+import { type VerifiedExecutorPhaseADriftRequest } from '../shared/executorPhaseADriftContracts.js';
+import type { ExecutorPhaseARs256Signer } from './executorPhaseAIssuerCore.js';
+export declare const EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS: number;
+export interface ExecutorPhaseADriftReplayStore {
+    claim(input: {
+        requestId: string;
+        requestSha256: string;
+        claimedAt: string;
+        retainUntil: string;
+    }): Promise<'claimed' | 'duplicate'>;
+}
+export interface ExecutorPhaseADriftState {
+    issuer: string;
+    audience: string;
+    publishedKeyIds: string[];
+    brokerRoutesAuthenticated: boolean;
+    sourceIdentityPatterns: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    principalTagKeys: string[];
+    roleTrustSha256: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    rolePolicySha256: Record<'bootstrap' | 'ami-build' | 'provenance' | 'runtime' | 'cleanup', string>;
+    maxSessionDurationSeconds: number;
+    cloudTrailEnabled: boolean;
+    alarmsEnabled: boolean;
+}
+export interface ExecutorPhaseADriftFinding {
+    code: string;
+    expectedSha256: string;
+    observedSha256: string;
+}
+export declare function evaluateExecutorPhaseADrift(expected: ExecutorPhaseADriftState, observed: ExecutorPhaseADriftState): ExecutorPhaseADriftFinding[];
+export declare function attestExecutorPhaseADrift(input: {
+    requestId: string;
+    runId: string;
+    accountId: string;
+    region: 'us-west-2';
+    expected: ExecutorPhaseADriftState;
+    observed: ExecutorPhaseADriftState;
+    collectedAt: Date;
+}, signer: ExecutorPhaseARs256Signer): Promise<{
+    payload: {
+        schema: "taskforce.executor-phase-a-drift-attestation-payload/v1";
+        requestId: string;
+        runId: string;
+        accountId: string;
+        region: "us-west-2";
+        status: "fail" | "pass";
+        findings: ExecutorPhaseADriftFinding[];
+        observedStateSha256: string;
+        collectedAt: string;
+        expiresAt: string;
+    };
+    envelope: {
+        algorithm: "RS256";
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}>;
+export declare function collectAndAttestExecutorPhaseADrift(request: VerifiedExecutorPhaseADriftRequest, expected: ExecutorPhaseADriftState, replayStore: ExecutorPhaseADriftReplayStore, collectObservedState: () => Promise<ExecutorPhaseADriftState>, signer: ExecutorPhaseARs256Signer, now?: () => Date): Promise<{
+    payload: {
+        schema: "taskforce.executor-phase-a-drift-attestation-payload/v1";
+        requestId: string;
+        runId: string;
+        accountId: string;
+        region: "us-west-2";
+        status: "fail" | "pass";
+        findings: ExecutorPhaseADriftFinding[];
+        observedStateSha256: string;
+        collectedAt: string;
+        expiresAt: string;
+    };
+    envelope: {
+        algorithm: "RS256";
+        keyId: string;
+        payloadSha256: string;
+        signature: string;
+    };
+}>;

package/dist/services/executorPhaseADriftEvaluator.js

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { canonicalizeExecutorPhaseAJson } from '../shared/executorPhaseAApprovalReceipt.js';
+import { assertVerifiedExecutorPhaseADriftRequest, } from '../shared/executorPhaseADriftContracts.js';
+import { assertExecutorPhaseASchema } from '../shared/executorPhaseASchemaValidation.js';
+import { EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS } from '../shared/executorPhaseATiming.js';
+export const EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS = 10 * 60 * 1000;
+const CHECKS = [
+    { code: 'ISSUER_MISMATCH', select: (state) => state.issuer },
+    { code: 'AUDIENCE_MISMATCH', select: (state) => state.audience },
+    { code: 'PUBLISHED_KEY_SET_MISMATCH', select: (state) => [...state.publishedKeyIds].sort() },
+    { code: 'BROKER_ROUTE_AUTH_MISSING', select: (state) => state.brokerRoutesAuthenticated },
+    { code: 'SOURCE_IDENTITY_PATTERN_MISMATCH', select: (state) => state.sourceIdentityPatterns },
+    { code: 'PRINCIPAL_TAG_KEYS_MISMATCH', select: (state) => [...state.principalTagKeys].sort() },
+    { code: 'ROLE_TRUST_MISMATCH', select: (state) => state.roleTrustSha256 },
+    { code: 'ROLE_POLICY_MISMATCH', select: (state) => state.rolePolicySha256 },
+    { code: 'SESSION_DURATION_MISMATCH', select: (state) => state.maxSessionDurationSeconds },
+    { code: 'CLOUDTRAIL_DISABLED', select: (state) => state.cloudTrailEnabled },
+    { code: 'ALARMS_DISABLED', select: (state) => state.alarmsEnabled },
+];
+function digest(value) {
+    return createHash('sha256').update(canonicalizeExecutorPhaseAJson(value)).digest('hex');
+}
+export function evaluateExecutorPhaseADrift(expected, observed) {
+    const findings = [];
+    for (const check of CHECKS) {
+        const expectedValue = check.select(expected);
+        const observedValue = check.select(observed);
+        const expectedSha256 = digest(expectedValue);
+        const observedSha256 = digest(observedValue);
+        if (expectedSha256 !== observedSha256) {
+            findings.push({ code: check.code, expectedSha256, observedSha256 });
+        }
+    }
+    return findings;
+}
+export async function attestExecutorPhaseADrift(input, signer) {
+    const findings = evaluateExecutorPhaseADrift(input.expected, input.observed);
+    const payload = {
+        schema: 'taskforce.executor-phase-a-drift-attestation-payload/v1',
+        requestId: input.requestId,
+        runId: input.runId,
+        accountId: input.accountId,
+        region: input.region,
+        status: findings.length === 0 ? 'pass' : 'fail',
+        findings,
+        observedStateSha256: digest(input.observed),
+        collectedAt: input.collectedAt.toISOString(),
+        expiresAt: new Date(input.collectedAt.getTime() + 60_000).toISOString(),
+    };
+    const payloadBytes = canonicalizeExecutorPhaseAJson(payload);
+    const signature = await signer.sign(payloadBytes);
+    if (signature.length !== 256)
+        throw new TypeError('The drift signer returned a non-RSA-2048 signature.');
+    const attestation = {
+        payload,
+        envelope: {
+            algorithm: 'RS256',
+            keyId: signer.keyId,
+            payloadSha256: createHash('sha256').update(payloadBytes).digest('hex'),
+            signature: signature.toString('base64url'),
+        },
+    };
+    assertExecutorPhaseASchema('driftAttestation', attestation);
+    return attestation;
+}
+export async function collectAndAttestExecutorPhaseADrift(request, expected, replayStore, collectObservedState, signer, now = () => new Date()) {
+    assertVerifiedExecutorPhaseADriftRequest(request);
+    const claimedAt = now();
+    const issuedAt = Date.parse(request.payload.issuedAt);
+    const expiresAt = Date.parse(request.payload.expiresAt);
+    if (claimedAt.getTime() + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS < issuedAt
+        || claimedAt.getTime() >= expiresAt + EXECUTOR_PHASE_A_CROSS_SERVICE_CLOCK_SKEW_MS) {
+        throw new TypeError('The verified drift request is not fresh at collection time.');
+    }
+    const claim = await replayStore.claim({
+        requestId: request.payload.requestId,
+        requestSha256: digest(request),
+        claimedAt: claimedAt.toISOString(),
+        retainUntil: new Date(claimedAt.getTime() + EXECUTOR_PHASE_A_DRIFT_REPLAY_RETENTION_MS).toISOString(),
+    });
+    if (claim !== 'claimed')
+        throw new TypeError('The drift request was already claimed.');
+    const observed = await collectObservedState();
+    return attestExecutorPhaseADrift({
+        requestId: request.payload.requestId,
+        runId: request.payload.runId,
+        accountId: request.payload.accountId,
+        region: request.payload.region,
+        expected,
+        observed,
+        collectedAt: now(),
+    }, signer);
+}

package/dist/services/executorPhaseAIssuerCore.d.ts

@@ -0,0 +1,139 @@
+import { type KeyObject } from 'node:crypto';
+import { type ExecutorPhaseAApprovalReceipt } from '../shared/executorPhaseAApprovalReceipt.js';
+import { type ExecutorPhaseAIssuerRedemptionRequest, type ExecutorPhaseAIssuerRedemptionResponse } from '../shared/executorPhaseAIssuerContracts.js';
+import { type ExecutorPhaseARunCapability, type ExecutorPhaseASenderProof, type ExecutorPhaseAWorkloadGrant, type VerifiedExecutorPhaseAWorkloadGrantBundle } from '../shared/executorPhaseARunAuthorization.js';
+export declare const EXECUTOR_PHASE_A_OIDC_PUBLIC_CACHE_MAX_AGE_SECONDS = 300;
+declare const TRANSITIVE_TAG_KEYS: readonly ["TaskforceRun", "TaskforceReceipt", "TaskforcePhase", "TaskforceWorkspaceHash", "TaskforceSource"];
+export interface ExecutorPhaseARs256Signer {
+    keyId: string;
+    sign(bytes: Buffer): Promise<Buffer>;
+}
+export interface ExecutorPhaseAOidcKey {
+    keyId: string;
+    publicKey: KeyObject;
+    status: 'active' | 'retiring' | 'disabled' | 'removed';
+    validFrom: string;
+    validUntil: string;
+    lastIssuedAt: string | null;
+    publishUntil: string | null;
+}
+export interface ExecutorPhaseAOidcVerificationKey {
+    keyId: string;
+    publicKey: KeyObject;
+    status: 'active' | 'retiring' | 'disabled';
+    validFrom: string;
+    validUntil: string;
+}
+declare const verifiedWorkloadJwtClaimsBrand: unique symbol;
+export type VerifiedExecutorPhaseAWorkloadJwtClaims = ExecutorPhaseAWorkloadJwtClaims & {
+    readonly [verifiedWorkloadJwtClaimsBrand]: true;
+};
+export interface ExecutorPhaseAWorkloadJwtClaims {
+    iss: string;
+    aud: string;
+    sub: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    'https://aws.amazon.com/source_identity': string;
+    'https://aws.amazon.com/tags': {
+        principal_tags: Record<(typeof TRANSITIVE_TAG_KEYS)[number], [string]>;
+        transitive_tag_keys: typeof TRANSITIVE_TAG_KEYS;
+    };
+    taskforce: {
+        schema: 'taskforce.executor-phase-a-workload-jwt-claims/v1';
+        receiptId: string;
+        receiptSha256: string;
+        workspaceId: string;
+        taskId: string;
+        runId: string;
+        sourceCommit: string;
+        accountId: string;
+        region: 'us-west-2';
+        availabilityZone: string;
+        logicalEnvelopeSha256: string;
+        budgetsSha256: string;
+        roleArn: string;
+        brokerKeyFingerprint: string;
+        grantId: string;
+        grantSha256: string;
+        senderProofSha256: string;
+    };
+}
+export interface ExecutorPhaseAIssuerStateStore {
+    acquire(input: {
+        grantId: string;
+        grantSha256: string;
+        senderProofSha256: string;
+        requestId: string;
+        createdAt: string;
+    }): Promise<'acquired' | 'terminal'>;
+    releasePending(input: {
+        grantId: string;
+        requestId: string;
+        updatedAt: string;
+    }): Promise<void>;
+    markSigned(input: {
+        grantId: string;
+        tokenId: string;
+        kmsKeyId: string;
+        updatedAt: string;
+    }): Promise<void>;
+    markFailed(input: {
+        grantId: string;
+        errorCategory: string;
+        updatedAt: string;
+    }): Promise<void>;
+}
+export interface ExecutorPhaseAIssuerCoreInput {
+    requestId: string;
+    approvalReceipt: ExecutorPhaseAApprovalReceipt;
+    runCapability: ExecutorPhaseARunCapability;
+    workloadGrant: ExecutorPhaseAWorkloadGrant;
+    senderProof: ExecutorPhaseASenderProof;
+    brokerRequestSha256: string;
+    expectedPolicySha256: string;
+}
+export declare function buildExecutorPhaseAOidcJwks(keys: readonly ExecutorPhaseAOidcKey[], now?: Date): {
+    keys: {
+        kty: string;
+        n: string | undefined;
+        e: string | undefined;
+        use: string;
+        alg: string;
+        kid: string;
+    }[];
+};
+export declare function buildExecutorPhaseAOidcDiscovery(issuer: string): {
+    issuer: string;
+    jwks_uri: string;
+    response_types_supported: string[];
+    subject_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+};
+export declare function buildExecutorPhaseAWorkloadJwtClaims(bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, issuer: string, audience: string, tokenId: string, now: Date): ExecutorPhaseAWorkloadJwtClaims;
+export declare function signExecutorPhaseAWorkloadJwt(claims: ExecutorPhaseAWorkloadJwtClaims, signer: ExecutorPhaseARs256Signer): Promise<string>;
+export declare function verifyExecutorPhaseAWorkloadJwt(jwt: string, bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, keys: readonly ExecutorPhaseAOidcVerificationKey[], now?: Date): VerifiedExecutorPhaseAWorkloadJwtClaims;
+export declare function assertVerifiedExecutorPhaseAWorkloadJwtClaims(claims: VerifiedExecutorPhaseAWorkloadJwtClaims): void;
+export declare class ExecutorPhaseAIssuerCore {
+    private readonly options;
+    constructor(options: {
+        stateStore: ExecutorPhaseAIssuerStateStore;
+        redeem: (request: ExecutorPhaseAIssuerRedemptionRequest) => Promise<ExecutorPhaseAIssuerRedemptionResponse>;
+        issuerProofSigner: ExecutorPhaseARs256Signer;
+        oidcSigner: ExecutorPhaseARs256Signer;
+        cloudArtifactPublicKey: KeyObject;
+        cloudResponseKeys: readonly {
+            keyId: string;
+            publicKey: KeyObject;
+            status: 'active' | 'retiring' | 'disabled';
+        }[];
+        issuer: string;
+        audience: string;
+        now?: () => Date;
+        randomId: (kind: 'request' | 'token') => string;
+    });
+    issue(input: ExecutorPhaseAIssuerCoreInput): Promise<string>;
+}
+export {};