@wayai/executor-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WayAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,198 @@
+# @wayai/executor-sdk
+
+Receive and verify [Rekor](https://github.com/wayai-pro/rekor)'s HMAC-signed, idempotency-keyed
+webhooks and proxied calls — the **executor** side of the Rekor Executor Contract. Verify the
+signature, enforce timestamp skew, dedupe retries, and return the right HTTP status, in a few lines.
+
+Zero dependencies, dual ESM/CJS, runs anywhere with Web Crypto (Node ≥20, Cloudflare Workers, Deno,
+Bun). The executor is v0's capability; future capabilities will be added as exports here or under
+`@wayai/executor-sdk/<capability>` subpaths.
+
+```bash
+npm i @wayai/executor-sdk
+```
+
+## The wire
+
+Rekor signs every request it sends over **Signing v1**. The signature is HMAC-SHA256 over a canonical
+string, sent as `X-Data-Signature: v1,<hex>` (a space-delimited list so a key rotation can carry old +
+new). The canonical is:
+
+```
+["v1", id, String(unixTimestamp), method, path, body].join("\n")
+```
+
+| Header | Meaning |
+|--------|---------|
+| `X-Data-Signature` | `v1,<hex>` — HMAC over the canonical |
+| `X-Data-Timestamp` | unix seconds; generated per attempt (you reject stale ones) |
+| `X-Data-Id` | the signed message id (the value bound into the canonical) |
+| `X-Data-Idempotency-Key` | logical dedupe key on side-effecting calls (= `X-Data-Id` on writes) |
+| `X-Data-Delivery-Id` | per-delivery id on webhooks (for tracing) |
+
+`path` is the receiver URL's `pathname + search`. `body` is the **raw** request bytes. Verify
+**before** parsing the body. Skew enforcement is your job — Rekor only emits.
+
+## Quickstart — Fetch (Hono / Next.js / Workers / Deno)
+
+```ts
+import { createExecutor, toFetchHandler, ExecutorError } from '@wayai/executor-sdk';
+
+const handler = toFetchHandler(createExecutor({
+  secret: process.env.REKOR_SIGNING_SECRET!,
+  async handler(ctx) {
+    // ctx: { id, idempotencyKey?, deliveryId?, timestamp, body }  — body is the raw string
+    const event = JSON.parse(ctx.body);
+    // ... do the work, scoped to the signed request ...
+    return { status: 200, body: JSON.stringify({ ok: true }) };
+  },
+}));
+
+// Hono:        app.post('/rekor', (c) => handler(c.req.raw));
+// Next.js:     export const POST = (req: Request) => handler(req);
+// CF Workers:  export default { fetch: handler };
+```
+
+Throw an `ExecutorError` to control the response — `retriable` maps to the HTTP status family:
+
+```ts
+throw new ExecutorError({ code: 'UPSTREAM_DOWN', message: 'try later', retriable: true });  // → 503 (Rekor retries)
+throw new ExecutorError({ code: 'BAD_INPUT', message: 'no', retriable: false, status: 422 }); // → 422 (Rekor drops)
+```
+
+## Quickstart — Node / Express
+
+```ts
+import express from 'express';
+import { createExecutor, toNodeHandler } from '@wayai/executor-sdk';
+
+const app = express();
+const rekor = toNodeHandler(createExecutor({ secret: process.env.REKOR_SIGNING_SECRET!, handler: async (ctx) => { /* ... */ } }));
+
+// ⚠️ Mount BEFORE any body parser (express.json(), body-parser…). The adapter reads the raw stream;
+// if a parser consumed it first, the raw bytes are gone and verification fails.
+app.post('/rekor', rekor);
+```
+
+## Verifying responses → retry behavior
+
+Return the right **status** — that's the contract Rekor's retry logic reads:
+
+| Your response | Rekor |
+|---------------|-------|
+| `2xx` | ack, done |
+| `4xx` (except 429) | permanent failure — **not** retried |
+| `429` / `5xx` | transient — retried with backoff |
+
+> Note: Rekor's delivery currently retries **any** non-2xx response until the attempt budget is
+> exhausted, then dead-letters it. Returning a `4xx` is the right signal for "permanent, don't retry"
+> and is the convention to code against — Rekor's backend is converging on honoring it.
+
+`createExecutor` does this for you: a valid request runs your handler; a thrown `ExecutorError`
+becomes `{ status, code, message, retriable }` with the matching status; an unexpected throw becomes a
+retriable `500`-family response (and calls `onError`, which never receives the secret).
+
+## Idempotency
+
+Deliveries are deduped on `X-Data-Idempotency-Key` (webhooks fall back to the stable `X-Data-Id`).
+The first request runs; a duplicate **replays the cached response** without re-running your handler. A
+*retriable* failure clears the key so the retry actually re-runs; a *permanent* failure is cached.
+
+The default `MemoryStore` is **per-process** and bounded by the deliveries within one TTL window
+(default 24h) — a periodic sweep drops expired entries, so it doesn't grow forever, but a very
+high-volume receiver should size the TTL or use a shared store. Running more than one instance? Supply
+a shared store (Redis / a Durable Object / a DB) implementing `IdempotencyStore`:
+
+```ts
+import { createExecutor, type IdempotencyStore } from '@wayai/executor-sdk';
+const store: IdempotencyStore = { async claim(k, ttl) { /* SET NX */ }, async complete(k, r, ttl) {}, async fail(k) {} };
+createExecutor({ secret, store, handler });
+```
+
+(Read-only proxied requests carry a fresh id, so wrapping them is a harmless no-op — a network store
+turns every read into a write, so you needn't route reads through the executor.)
+
+## Signing requests to Rekor (async write-back)
+
+For a slow/async action, an executor does the work and POSTs the result back to a Rekor **inbound webhook**. That
+inbound request must be signed the same way Rekor signs outbound — `signRequest` produces the headers
+from the inbound webhook's shared secret (the inverse of the verify side; same canonical, conformance-pinned):
+
+```ts
+import { signRequest } from '@wayai/executor-sdk';
+
+const url = 'https://api.rekor.pro/inbound/<org>/<db>/<inbound_webhook_id>/ingest';
+const body = JSON.stringify({ collection: 'results', data: { ok: true } });
+const headers = await signRequest({ secret: process.env.REKOR_HOOK_SECRET!, method: 'POST', url, body });
+
+await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body });
+```
+
+`signRequest` returns `X-Data-Signature` / `X-Data-Timestamp` / `X-Data-Id` (id defaults to a fresh
+UUID, timestamp to now). Sign the **exact** body bytes you send, and use the full URL — its
+`pathname + search` is bound into the signature.
+
+## Pulling a credential (mTLS certs, binary secrets)
+
+When a source declares `executor_secrets`, each proxied dispatch carries a **short-lived, single-use
+grant**. Pull a declared credential by name with the inbound request — for a binary or per-tenant secret
+too large to inject inline (e.g. an mTLS client cert the executor presents to its upstream):
+
+```ts
+import { fetchExecutorCredential } from '@wayai/executor-sdk';
+
+// `req` is the inbound dispatch (a Fetch Request, a NormalizedRequest, or its headers).
+const cert = await fetchExecutorCredential(req, 'partner-cert'); // { name, contentType, value }
+const pfx = Buffer.from(cert.value, 'base64');                   // value is verbatim; decode per contentType
+```
+
+`value` is delivered verbatim (Rekor stores binary credentials base64-encoded — decode per `contentType`).
+The grant is **single-use per name**, so pull each credential **once per invocation and reuse** it; a
+re-pull fails. Throws `ExecutorError` if the request carries no grant, the name isn't declared, or the
+pull is denied (`403`, never retried) / unavailable (transient `5xx`/network → retried once).
+
+**Call only on a verified request** (e.g. inside your `createExecutor` handler). The grant headers aren't
+part of the request signature, so if your executor sits behind a TLS-terminating proxy, pin Rekor's origin
+to reject a rewritten callback URL: `fetchExecutorCredential(req, name, { allowedOrigins: ['https://api.rekor.pro'] })`.
+
+## Path matching (reverse proxies)
+
+The signature binds `path` = `new URL(receiverUrl).pathname + search` exactly as Rekor parsed it, with
+**no normalization**. A proxy that adds/strips a trailing slash, reorders or re-encodes query params,
+or normalizes percent-encoding will change the path your runtime sees and break verification. If you
+sit behind such a proxy, pass `pathOverride(req)` returning the path Rekor *signed*, byte-for-byte:
+
+```ts
+createExecutor({ secret, handler, pathOverride: () => '/rekor' });
+```
+
+## Security notes
+
+- **Verify before you trust** — never act on an unverified body.
+- **Raw body** — verify the exact bytes; don't `JSON.parse` (or let a framework parse) before verifying.
+- **Skew window** — default 300s, both directions; `toleranceSec` is clamped to ≥1 (you can't disable it).
+- **Secrets** — the signing secret never appears in `ctx`, the result, the error envelope, `onError`, or
+  any log this library emits (it emits none).
+- **Injected secrets** — operator-configured per-request secrets arrive as ordinary headers/body fields
+  on the verified request; read them like any other field. Use them in memory, never persist.
+- **Signature list** — bounded to a few candidates, so a hostile header can't force unbounded HMACs.
+- **Body size** — the adapters read the full raw body into memory before verifying (verification needs
+  the exact bytes). Cap request size at your framework/reverse proxy (e.g. a body-size limit on the
+  Rekor route) so an oversized request can't exhaust memory ahead of verification.
+
+## Dev bypass
+
+`createExecutor({ secret, handler, devBypass: true })` skips signature/skew verification (dedup still
+applies if the headers are present). **Local development only** — never enable in production.
+
+## API
+
+`createExecutor(options)` · `toFetchHandler(executor)` · `toNodeHandler(executor)` ·
+`verify(input)` / `verifySignatureHeader(secret, parts, header)` · `signRequest(input)` ·
+`fetchExecutorCredential(req, name, opts?)` ·
+`MemoryStore` / `IdempotencyStore` · `ExecutorError` / `toHttpStatus` ·
+`buildCanonical` / `unixSeconds` / `SIGNING_SCHEME` / `DATA_HEADERS`.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,399 @@
+'use strict';
+
+// src/core/hmac.ts
+async function signPayload(secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
+  return arrayBufferToHex(signature);
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i++) result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return result === 0;
+}
+function arrayBufferToHex(buffer) {
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/headers.ts
+function headerGetter(headers) {
+  if (headers instanceof Headers) return (name) => headers.get(name) ?? void 0;
+  const lower = {};
+  for (const [k, v] of Object.entries(headers)) lower[k.toLowerCase()] = v;
+  return (name) => {
+    const v = lower[name];
+    if (Array.isArray(v)) return v.length === 1 ? v[0] : void 0;
+    return v;
+  };
+}
+
+// src/core/canonical.ts
+var SIGNING_SCHEME = "v1";
+function buildCanonical(parts) {
+  return [SIGNING_SCHEME, parts.id, String(parts.timestamp), parts.method, parts.path, parts.body].join("\n");
+}
+function unixSeconds(nowMs) {
+  return Math.floor((nowMs ?? Date.now()) / 1e3);
+}
+
+// src/core/verify.ts
+var DATA_HEADERS = {
+  signature: "x-data-signature",
+  timestamp: "x-data-timestamp",
+  id: "x-data-id",
+  idempotencyKey: "x-data-idempotency-key",
+  deliveryId: "x-data-delivery-id",
+  // Executor credential pull: advertised on a proxied dispatch to a source declaring executor_secrets.
+  credentialUrl: "x-data-credential-url",
+  credentialToken: "x-data-credential-token",
+  credentialNames: "x-data-credential-names"
+};
+var MAX_SIG_ENTRIES = 4;
+async function verifySignatureHeader(secret, parts, header) {
+  const canonical = buildCanonical(parts);
+  let expected;
+  let checked = 0;
+  let matched = false;
+  for (const entry of header.split(" ")) {
+    const comma = entry.indexOf(",");
+    if (comma <= 0) continue;
+    if (entry.slice(0, comma) !== SIGNING_SCHEME) continue;
+    const hex = entry.slice(comma + 1);
+    if (hex.length === 0) continue;
+    if (++checked > MAX_SIG_ENTRIES) break;
+    if (expected === void 0) expected = await signPayload(secret, canonical);
+    if (timingSafeEqual(expected, hex)) matched = true;
+  }
+  return matched;
+}
+async function verify(input) {
+  const get = headerGetter(input.headers);
+  const signature = get(DATA_HEADERS.signature);
+  if (!signature) return { ok: false, reason: "missing_signature" };
+  const tsRaw = get(DATA_HEADERS.timestamp);
+  const id = get(DATA_HEADERS.id);
+  if (!tsRaw || !id) return { ok: false, reason: "malformed" };
+  if (!/^\d+$/.test(tsRaw)) return { ok: false, reason: "malformed" };
+  const timestamp = Number(tsRaw);
+  if (!Number.isFinite(timestamp)) return { ok: false, reason: "malformed" };
+  const t = input.toleranceSec;
+  const tolerance = Number.isFinite(t) ? Math.max(1, Math.floor(t)) : 300;
+  const now = unixSeconds(input.now);
+  if (Math.abs(now - timestamp) > tolerance) return { ok: false, reason: "stale_timestamp" };
+  const parts = { id, timestamp, method: input.method, path: input.path, body: input.rawBody };
+  const valid = await verifySignatureHeader(input.secret, parts, signature);
+  if (!valid) return { ok: false, reason: "invalid_signature" };
+  return {
+    ok: true,
+    id,
+    timestamp,
+    idempotencyKey: get(DATA_HEADERS.idempotencyKey),
+    deliveryId: get(DATA_HEADERS.deliveryId),
+    body: input.rawBody
+  };
+}
+
+// src/store/memory.ts
+var DEFAULT_SWEEP_EVERY = 1e3;
+var MemoryStore = class {
+  map = /* @__PURE__ */ new Map();
+  nowMs;
+  sweepEvery;
+  writes = 0;
+  constructor(opts) {
+    this.nowMs = opts?.now ?? (() => Date.now());
+    this.sweepEvery = opts?.sweepEvery ?? DEFAULT_SWEEP_EVERY;
+  }
+  /** Number of live entries currently held (after lazily ignoring nothing — counts raw map size). */
+  get size() {
+    return this.map.size;
+  }
+  live(key) {
+    const e = this.map.get(key);
+    if (!e) return void 0;
+    if (e.expiresAt <= this.nowMs()) {
+      this.map.delete(key);
+      return void 0;
+    }
+    return e;
+  }
+  /** Amortized O(1)/write: every SWEEP_EVERY writes, drop all expired entries so the map can't grow forever. */
+  maybeSweep() {
+    if (++this.writes < this.sweepEvery) return;
+    this.writes = 0;
+    const now = this.nowMs();
+    for (const [k, e] of this.map) if (e.expiresAt <= now) this.map.delete(k);
+  }
+  async claim(key, ttlSec) {
+    const e = this.live(key);
+    if (!e) {
+      this.map.set(key, { state: "pending", expiresAt: this.nowMs() + ttlSec * 1e3 });
+      this.maybeSweep();
+      return { state: "fresh" };
+    }
+    if (e.state === "done" && e.result) return { state: "done", result: e.result };
+    return { state: "in_progress" };
+  }
+  async complete(key, result, ttlSec) {
+    this.map.set(key, { state: "done", result, expiresAt: this.nowMs() + ttlSec * 1e3 });
+    this.maybeSweep();
+  }
+  async fail(key) {
+    this.map.delete(key);
+  }
+};
+
+// src/errors/envelope.ts
+var ExecutorError = class extends Error {
+  code;
+  retriable;
+  httpStatus;
+  constructor(args) {
+    super(args.message);
+    this.name = "ExecutorError";
+    this.code = args.code;
+    this.retriable = args.retriable;
+    this.httpStatus = args.status;
+  }
+  toEnvelope() {
+    return { status: toHttpStatus(this), code: this.code, message: this.message, retriable: this.retriable };
+  }
+};
+function toHttpStatus(e) {
+  const s = e.httpStatus;
+  if (e.retriable) {
+    return s !== void 0 && (s === 429 || s >= 500 && s <= 599) ? s : 503;
+  }
+  return s !== void 0 && s >= 400 && s <= 499 ? s : 400;
+}
+function jsonResponseBody(env) {
+  return JSON.stringify(env);
+}
+
+// src/executor.ts
+var JSON_CT = "application/json";
+function errorResponse(env) {
+  return { status: env.status, body: jsonResponseBody(env), contentType: JSON_CT };
+}
+function reasonResponse(reason) {
+  const status = reason === "malformed" ? 400 : reason === "stale_timestamp" ? 403 : 401;
+  return errorResponse({ status, code: reason.toUpperCase(), message: `signature ${reason}`, retriable: false });
+}
+function bypassContext(req) {
+  const get = headerGetter(req.headers);
+  const id = get(DATA_HEADERS.id);
+  const tsRaw = get(DATA_HEADERS.timestamp);
+  return {
+    id: id ?? "",
+    idempotencyKey: get(DATA_HEADERS.idempotencyKey),
+    deliveryId: get(DATA_HEADERS.deliveryId),
+    timestamp: tsRaw && /^\d+$/.test(tsRaw) ? Number(tsRaw) : 0,
+    body: req.rawBody
+  };
+}
+function createExecutor(opts) {
+  const store = opts.store ?? new MemoryStore();
+  const ttl = opts.idempotencyTtlSec ?? 86400;
+  async function run(ctx) {
+    const key = ctx.idempotencyKey || ctx.id;
+    if (!key) return await invoke(ctx);
+    const claim = await store.claim(key, ttl);
+    if (claim.state === "done") {
+      return { status: claim.result.status, body: claim.result.body, contentType: claim.result.contentType ?? JSON_CT };
+    }
+    if (claim.state === "in_progress") {
+      return errorResponse({ status: 503, code: "IN_PROGRESS", message: "duplicate delivery in progress", retriable: true });
+    }
+    try {
+      const res = await invoke(ctx);
+      await store.complete(key, { status: res.status, body: res.body, contentType: res.contentType }, ttl);
+      return res;
+    } catch (err) {
+      const env = toEnvelope(err);
+      const res = errorResponse(env);
+      if (env.retriable) {
+        await store.fail(key);
+      } else {
+        await store.complete(key, { status: res.status, body: res.body, contentType: res.contentType }, ttl);
+      }
+      if (!(err instanceof ExecutorError)) opts.onError?.(err, ctx);
+      return res;
+    }
+  }
+  async function invoke(ctx) {
+    const result = await opts.handler(ctx);
+    if (!result) return { status: 204, body: "", contentType: JSON_CT };
+    return { status: result.status, body: result.body, contentType: result.contentType ?? JSON_CT };
+  }
+  return {
+    async handle(req) {
+      const path = opts.pathOverride ? opts.pathOverride(req) : req.path;
+      if (opts.devBypass) {
+        const ctx = bypassContext(req);
+        return ctx ? await run(ctx) : reasonResponse("malformed");
+      }
+      const result = await verify({
+        secret: opts.secret,
+        headers: req.headers,
+        method: req.method,
+        path,
+        rawBody: req.rawBody,
+        toleranceSec: opts.toleranceSec
+      });
+      if (!result.ok) return reasonResponse(result.reason);
+      return await run({
+        id: result.id,
+        idempotencyKey: result.idempotencyKey,
+        deliveryId: result.deliveryId,
+        timestamp: result.timestamp,
+        body: result.body
+      });
+    }
+  };
+}
+function toEnvelope(err) {
+  if (err instanceof ExecutorError) return err.toEnvelope();
+  return { status: toHttpStatus({ retriable: true }), code: "INTERNAL", message: "handler error", retriable: true };
+}
+
+// src/adapters/fetch.ts
+function toFetchHandler(executor) {
+  return async (req) => {
+    const rawBody = await req.text();
+    const url = new URL(req.url);
+    const res = await executor.handle({
+      method: req.method,
+      path: url.pathname + url.search,
+      headers: req.headers,
+      rawBody
+    });
+    return new Response(res.body || null, { status: res.status, headers: { "content-type": res.contentType } });
+  };
+}
+
+// src/adapters/node.ts
+function toNodeHandler(executor) {
+  return async (req, res) => {
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    const rawBody = Buffer.concat(chunks).toString("utf8");
+    const out = await executor.handle({
+      method: req.method ?? "GET",
+      path: req.url ?? "/",
+      headers: req.headers,
+      rawBody
+    });
+    res.writeHead(out.status, { "content-type": out.contentType });
+    res.end(out.body);
+  };
+}
+
+// src/core/sign.ts
+async function signRequest(input) {
+  const id = input.id ?? crypto.randomUUID();
+  const timestamp = input.timestamp ?? unixSeconds();
+  const body = input.body ?? "";
+  const { pathname, search } = new URL(input.url);
+  const hex = await signPayload(input.secret, buildCanonical({ id, timestamp, method: input.method, path: pathname + search, body }));
+  return {
+    "X-Data-Signature": `${SIGNING_SCHEME},${hex}`,
+    "X-Data-Timestamp": String(timestamp),
+    "X-Data-Id": id
+  };
+}
+
+// src/core/credential.ts
+function resolveHeaders(source) {
+  if (source instanceof Headers) return source;
+  const nested = source.headers;
+  if (nested instanceof Headers) return nested;
+  if (nested && typeof nested === "object") return nested;
+  return source;
+}
+async function fetchExecutorCredential(source, name, opts = {}) {
+  const get = headerGetter(resolveHeaders(source));
+  const url = get(DATA_HEADERS.credentialUrl);
+  const token = get(DATA_HEADERS.credentialToken);
+  const namesHeader = get(DATA_HEADERS.credentialNames);
+  if (!url || !token || namesHeader === void 0) {
+    throw new ExecutorError({ code: "no_credential_grant", message: "Request carries no executor credential grant", retriable: false });
+  }
+  if (opts.allowedOrigins && opts.allowedOrigins.length > 0) {
+    let origin;
+    try {
+      origin = new URL(url).origin;
+    } catch {
+      throw new ExecutorError({ code: "credential_bad_url", message: "Credential callback URL is not a valid URL", retriable: false });
+    }
+    const allowed = opts.allowedOrigins.map((o) => {
+      try {
+        return new URL(o).origin;
+      } catch {
+        return o;
+      }
+    });
+    if (!allowed.includes(origin)) {
+      throw new ExecutorError({ code: "credential_untrusted_url", message: `Credential callback URL origin '${origin}' is not in allowedOrigins`, retriable: false });
+    }
+  }
+  const names = namesHeader.split(",").map((n) => n.trim()).filter(Boolean);
+  if (!names.includes(name)) {
+    throw new ExecutorError({ code: "undeclared_credential", message: `Credential '${name}' is not in the grant (declared: ${names.join(", ") || "none"})`, retriable: false });
+  }
+  const doFetch = opts.fetchImpl ?? fetch;
+  const body = JSON.stringify({ token, name });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let res;
+    try {
+      res = await doFetch(url, { method: "POST", headers: { "content-type": "application/json" }, body, redirect: "manual" });
+    } catch {
+      if (attempt === 0) continue;
+      throw new ExecutorError({ code: "credential_unreachable", message: "Credential pull is unreachable", retriable: true });
+    }
+    if (res.status === 403) {
+      throw new ExecutorError({ code: "credential_denied", message: `Credential '${name}' pull was denied (grant invalid, expired, or already used)`, retriable: false, status: 403 });
+    }
+    if (res.status >= 500) {
+      if (attempt === 0) continue;
+      throw new ExecutorError({ code: "credential_unavailable", message: `Credential pull failed (status ${res.status})`, retriable: true, status: res.status });
+    }
+    if (!res.ok) {
+      throw new ExecutorError({ code: "credential_fetch_failed", message: `Credential pull failed (status ${res.status})`, retriable: false, status: res.status });
+    }
+    const parsed = await res.json().catch(() => null);
+    const data = parsed?.data;
+    if (!data || typeof data.value !== "string") {
+      throw new ExecutorError({ code: "credential_malformed", message: "Credential pull returned an unexpected body", retriable: false });
+    }
+    return { name: data.name ?? name, contentType: data.content_type ?? "application/octet-stream", value: data.value };
+  }
+  throw new ExecutorError({ code: "credential_unavailable", message: "Credential pull failed", retriable: true });
+}
+
+exports.DATA_HEADERS = DATA_HEADERS;
+exports.ExecutorError = ExecutorError;
+exports.MAX_SIG_ENTRIES = MAX_SIG_ENTRIES;
+exports.MemoryStore = MemoryStore;
+exports.SIGNING_SCHEME = SIGNING_SCHEME;
+exports.buildCanonical = buildCanonical;
+exports.createExecutor = createExecutor;
+exports.fetchExecutorCredential = fetchExecutorCredential;
+exports.jsonResponseBody = jsonResponseBody;
+exports.signRequest = signRequest;
+exports.toFetchHandler = toFetchHandler;
+exports.toHttpStatus = toHttpStatus;
+exports.toNodeHandler = toNodeHandler;
+exports.unixSeconds = unixSeconds;
+exports.verify = verify;
+exports.verifySignatureHeader = verifySignatureHeader;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map