witnora 0.10.0 → 0.10.2

package/dist/vendor/witnora-probe/config.js

@@ -0,0 +1,63 @@
+import { readFile } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { EnvironmentCredentialResolver } from "./credential-resolver.js";
+import { DeterministicGitHubEmulatorAdapter, GitHubLiveApiAdapter, GitHubSandboxHttpAdapter } from "./emulator.js";
+export async function loadProbeConfig(path, environment = process.env) {
+    const absolute = resolve(path);
+    const root = dirname(absolute);
+    const file = JSON.parse(await readFile(absolute, "utf8"));
+    const encryption = environment[file.storageEncryptionKeyEnv];
+    if (!encryption)
+        throw new Error(`Storage encryption key environment variable is not set: ${file.storageEncryptionKeyEnv}.`);
+    const storageEncryptionKey = Buffer.from(encryption, "base64");
+    if (storageEncryptionKey.byteLength !== 32)
+        throw new Error("Storage encryption key must decode to exactly 32 bytes.");
+    const requestVerificationKeys = {};
+    for (const key of file.requestVerificationKeys) {
+        requestVerificationKeys[key.keyId] = {
+            publicKeyPem: await readFile(resolve(root, key.publicKeyPemPath), "utf8"),
+            role: key.role,
+            validFrom: key.validFrom,
+            validUntil: key.validUntil,
+            ...(key.revokedAt ? { revokedAt: key.revokedAt } : {}),
+        };
+    }
+    const resolver = new EnvironmentCredentialResolver(environment);
+    const adapters = [];
+    if (file.githubEmulator) {
+        adapters.push(new DeterministicGitHubEmulatorAdapter(file.githubEmulator.pullRequests, {
+            requireCredential: Boolean(file.githubEmulator.requiredCredentialRef),
+        }));
+    }
+    if (file.githubTarget)
+        adapters.push(new GitHubSandboxHttpAdapter(file.githubTarget.url));
+    if (file.githubLive)
+        adapters.push(new GitHubLiveApiAdapter(file.githubLive.apiBase));
+    if (adapters.length === 0)
+        throw new Error("At least one Probe target adapter must be configured.");
+    const credentialReference = file.githubLive?.requiredCredentialRef ?? file.githubTarget?.requiredCredentialRef ?? file.githubEmulator?.requiredCredentialRef;
+    return {
+        host: file.host ?? "0.0.0.0",
+        port: file.port ?? 8080,
+        stateDirectory: resolve(root, file.stateDirectory),
+        requestBodyLimitBytes: file.requestBodyLimitBytes ?? 64 * 1024,
+        observationTimeoutMs: file.observationTimeoutMs ?? 5_000,
+        shutdownTimeoutMs: file.shutdownTimeoutMs ?? 10_000,
+        retry: {
+            maxAttempts: file.retry?.maxAttempts ?? 4,
+            baseDelayMs: file.retry?.baseDelayMs ?? 500,
+            scanIntervalMs: file.retry?.scanIntervalMs ?? 1_000,
+        },
+        bindings: file.bindings,
+        requestVerificationKeys,
+        probeSigningKey: {
+            keyCertificateId: file.probeSigningKey.keyCertificateId,
+            privateKeyPem: await readFile(resolve(root, file.probeSigningKey.privateKeyPemPath), "utf8"),
+        },
+        probeVersion: file.probeVersion,
+        storageEncryptionKey,
+        adapters,
+        credentialReference,
+        credentialResolver: resolver,
+    };
+}

package/dist/vendor/witnora-probe/credential-resolver.d.ts

@@ -0,0 +1,6 @@
+import type { CredentialResolver } from "./types.js";
+export declare class EnvironmentCredentialResolver implements CredentialResolver {
+    private readonly environment;
+    constructor(environment?: NodeJS.ProcessEnv);
+    resolve(reference: string): Promise<string>;
+}

package/dist/vendor/witnora-probe/credential-resolver.js

@@ -0,0 +1,17 @@
+export class EnvironmentCredentialResolver {
+    environment;
+    constructor(environment = process.env) {
+        this.environment = environment;
+    }
+    async resolve(reference) {
+        if (!reference.startsWith("env:"))
+            throw new Error("Only env:<VARIABLE_NAME> credential references are supported.");
+        const name = reference.slice(4);
+        if (!/^[A-Z][A-Z0-9_]{1,127}$/.test(name))
+            throw new Error("Credential reference contains an invalid environment variable name.");
+        const value = this.environment[name];
+        if (!value)
+            throw new Error(`Referenced read credential is unavailable: env:${name}.`);
+        return value;
+    }
+}

package/dist/vendor/witnora-probe/crypto.d.ts

@@ -0,0 +1,2 @@
+export declare function signCanonical(value: unknown, privateKeyPem: string): string;
+export declare function verifyCanonical(value: unknown, signature: string, publicKeyPem: string): boolean;

package/dist/vendor/witnora-probe/crypto.js

@@ -0,0 +1,14 @@
+import { createPublicKey, sign, verify } from "node:crypto";
+import { canonicalJson } from "./canonical.js";
+export function signCanonical(value, privateKeyPem) {
+    const bytes = Buffer.from(canonicalJson(value), "utf8");
+    return sign(null, bytes, privateKeyPem).toString("base64");
+}
+export function verifyCanonical(value, signature, publicKeyPem) {
+    try {
+        return verify(null, Buffer.from(canonicalJson(value), "utf8"), createPublicKey(publicKeyPem), Buffer.from(signature, "base64"));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/vendor/witnora-probe/emulator.d.ts

@@ -0,0 +1,51 @@
+import type { AdapterObservation, GitHubPullRequestReadQueryV02, ObservationTargetAdapter } from "./types.js";
+export interface GitHubEmulatorPullRequest {
+    repository: string;
+    pullRequestNumber: number;
+    merged: boolean;
+    headSha: string;
+    baseBranch: string;
+    updatedAt: string;
+    mergeCommitSha?: string;
+}
+export declare class DeterministicGitHubEmulatorAdapter implements ObservationTargetAdapter {
+    private readonly pullRequests;
+    readonly id = "github-emulator-read-api";
+    private failuresRemaining;
+    constructor(pullRequests: GitHubEmulatorPullRequest[], options?: {
+        failuresBeforeSuccess?: number;
+        requireCredential?: boolean;
+    });
+    private readonly requireCredential;
+    supports(query: unknown): query is GitHubPullRequestReadQueryV02;
+    observe(input: {
+        query: unknown;
+        credential?: string;
+        signal: AbortSignal;
+    }): Promise<AdapterObservation>;
+}
+export declare class RetryableObservationError extends Error {
+    readonly retryable = true;
+}
+export declare class GitHubSandboxHttpAdapter implements ObservationTargetAdapter {
+    private readonly targetUrl;
+    readonly id = "github-sandbox-read-api";
+    constructor(targetUrl: string);
+    supports(query: unknown): query is GitHubPullRequestReadQueryV02;
+    observe(input: {
+        query: unknown;
+        credential?: string;
+        signal: AbortSignal;
+    }): Promise<AdapterObservation>;
+}
+export declare class GitHubLiveApiAdapter implements ObservationTargetAdapter {
+    private readonly apiBase;
+    readonly id = "github-live-read-api";
+    constructor(apiBase?: string);
+    supports(query: unknown): query is GitHubPullRequestReadQueryV02;
+    observe(input: {
+        query: unknown;
+        credential?: string;
+        signal: AbortSignal;
+    }): Promise<AdapterObservation>;
+}

package/dist/vendor/witnora-probe/emulator.js

@@ -0,0 +1,164 @@
+export class DeterministicGitHubEmulatorAdapter {
+    pullRequests;
+    id = "github-emulator-read-api";
+    failuresRemaining;
+    constructor(pullRequests, options = {}) {
+        this.pullRequests = pullRequests;
+        this.failuresRemaining = options.failuresBeforeSuccess ?? 0;
+        this.requireCredential = options.requireCredential ?? false;
+    }
+    requireCredential;
+    supports(query) {
+        if (!query || typeof query !== "object")
+            return false;
+        const value = query;
+        return value.type === "github.pull_request.read.v0.2"
+            && typeof value.repository === "string"
+            && Number.isInteger(value.pullRequestNumber)
+            && Number(value.pullRequestNumber) > 0;
+    }
+    async observe(input) {
+        if (!this.supports(input.query))
+            throw new Error("GitHub emulator query is invalid.");
+        const query = input.query;
+        if (input.signal.aborted)
+            throw new Error("Observation aborted.");
+        if (this.requireCredential && !input.credential) {
+            throw new Error("Read credential rejected by GitHub emulator.");
+        }
+        if (this.failuresRemaining > 0) {
+            this.failuresRemaining -= 1;
+            throw new RetryableObservationError("GitHub emulator injected a transient read failure.");
+        }
+        const pullRequest = this.pullRequests.find((item) => item.repository === query.repository && item.pullRequestNumber === query.pullRequestNumber);
+        if (!pullRequest)
+            throw new Error("GitHub emulator pull request does not exist.");
+        const normalizedObservation = {
+            type: "github.pull_request.outcome.v0.2",
+            merged: pullRequest.merged,
+            headSha: pullRequest.headSha,
+            baseBranch: pullRequest.baseBranch,
+        };
+        return {
+            normalizedObservation,
+            rawObservation: structuredClone(pullRequest),
+            observationSource: this.id,
+            sourceObservedAt: pullRequest.updatedAt,
+            targetVersion: pullRequest.mergeCommitSha ?? pullRequest.headSha,
+            targetAuditReference: undefined,
+            limitations: ["TARGET_STATE_RECONCILED", "TARGET_AUDIT_LOG_NOT_VERIFIED"],
+        };
+    }
+}
+export class RetryableObservationError extends Error {
+    retryable = true;
+}
+export class GitHubSandboxHttpAdapter {
+    targetUrl;
+    id = "github-sandbox-read-api";
+    constructor(targetUrl) {
+        this.targetUrl = targetUrl;
+    }
+    supports(query) {
+        if (!query || typeof query !== "object")
+            return false;
+        const value = query;
+        return value.type === "github.pull_request.read.v0.2"
+            && typeof value.repository === "string"
+            && Number.isInteger(value.pullRequestNumber)
+            && Number(value.pullRequestNumber) > 0;
+    }
+    async observe(input) {
+        if (!this.supports(input.query))
+            throw new Error("GitHub sandbox query is invalid.");
+        if (!input.credential)
+            throw new Error("GitHub sandbox read credential is unavailable.");
+        const response = await fetch(`${this.targetUrl.replace(/\/$/u, "")}/v0.2/github/pull-request`, {
+            headers: { authorization: `Bearer ${input.credential}` },
+            signal: input.signal,
+        });
+        if (!response.ok) {
+            if (response.status >= 400 && response.status < 500) {
+                throw new Error(`GitHub sandbox read was rejected with status ${response.status}.`);
+            }
+            throw new RetryableObservationError(`GitHub sandbox read failed with status ${response.status}.`);
+        }
+        const state = await response.json();
+        const repository = `${state.owner}/${state.repository}`;
+        if (repository !== input.query.repository || state.pullRequestNumber !== input.query.pullRequestNumber) {
+            throw new Error("GitHub sandbox response does not match the bound read query.");
+        }
+        return {
+            normalizedObservation: {
+                type: "github.pull_request.outcome.v0.2",
+                merged: state.merged,
+                headSha: state.headSha,
+                baseBranch: state.baseBranch,
+                ...((state.consumedGrantIds?.length ?? 0) > 0 ? { consumedGrantId: state.consumedGrantIds?.at(-1) } : {}),
+            },
+            rawObservation: state,
+            observationSource: this.id,
+            sourceObservedAt: state.mergedAt ?? new Date().toISOString(),
+            targetVersion: state.mergeCommitSha ?? String(state.targetVersion),
+            limitations: ["TARGET_STATE_RECONCILED", "TARGET_AUDIT_LOG_NOT_VERIFIED"],
+        };
+    }
+}
+export class GitHubLiveApiAdapter {
+    apiBase;
+    id = "github-live-read-api";
+    constructor(apiBase = "https://api.github.com") {
+        this.apiBase = apiBase;
+    }
+    supports(query) {
+        if (!query || typeof query !== "object")
+            return false;
+        const value = query;
+        return value.type === "github.pull_request.read.v0.2"
+            && typeof value.repository === "string"
+            && value.repository.includes("/")
+            && Number.isInteger(value.pullRequestNumber)
+            && Number(value.pullRequestNumber) > 0;
+    }
+    async observe(input) {
+        if (!this.supports(input.query))
+            throw new Error("GitHub live query is invalid.");
+        if (!input.credential)
+            throw new Error("GitHub live read credential is unavailable.");
+        const [owner, repository, ...rest] = input.query.repository.split("/");
+        if (!owner || !repository || rest.length > 0)
+            throw new Error("GitHub live repository must be owner/name.");
+        const response = await fetch(`${this.apiBase.replace(/\/$/u, "")}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}/pulls/${input.query.pullRequestNumber}`, {
+            headers: githubHeaders(input.credential),
+            signal: input.signal,
+        });
+        if (!response.ok) {
+            if (response.status >= 500)
+                throw new RetryableObservationError(`GitHub live read failed with status ${response.status}.`);
+            throw new Error(`GitHub live read was rejected with status ${response.status}.`);
+        }
+        const pull = await response.json();
+        const head = pull.head;
+        const base = pull.base;
+        return {
+            normalizedObservation: {
+                type: "github.pull_request.outcome.v0.2",
+                merged: pull.merged === true,
+                headSha: String(head.sha),
+                baseBranch: String(base.ref),
+            },
+            rawObservation: pull,
+            observationSource: this.id,
+            sourceObservedAt: String(pull.merged_at ?? pull.updated_at),
+            targetVersion: String(pull.merge_commit_sha ?? head.sha),
+            limitations: ["TARGET_STATE_RECONCILED", "GITHUB_PULL_API_ONLY", "TARGET_AUDIT_LOG_NOT_VERIFIED"],
+        };
+    }
+}
+function githubHeaders(credential) {
+    return {
+        authorization: `Bearer ${credential}`,
+        accept: "application/vnd.github+json",
+        "x-github-api-version": "2022-11-28",
+    };
+}

package/dist/vendor/witnora-probe/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./canonical.js";
+export * from "./credential-resolver.js";
+export * from "./crypto.js";
+export * from "./emulator.js";
+export * from "./logger.js";
+export * from "./metrics.js";
+export * from "./probe.js";
+export * from "./request-verifier.js";
+export * from "./server.js";
+export * from "./storage.js";
+export * from "./types.js";

package/dist/vendor/witnora-probe/index.js

@@ -0,0 +1,11 @@
+export * from "./canonical.js";
+export * from "./credential-resolver.js";
+export * from "./crypto.js";
+export * from "./emulator.js";
+export * from "./logger.js";
+export * from "./metrics.js";
+export * from "./probe.js";
+export * from "./request-verifier.js";
+export * from "./server.js";
+export * from "./storage.js";
+export * from "./types.js";

package/dist/vendor/witnora-probe/logger.d.ts

@@ -0,0 +1,3 @@
+import type { StructuredLogger } from "./types.js";
+export declare function redact(value: unknown): unknown;
+export declare function createJsonLogger(write?: (line: string) => void): StructuredLogger;

package/dist/vendor/witnora-probe/logger.js

@@ -0,0 +1,26 @@
+const SENSITIVE_KEY = /(credential|secret|token|password|authorization|private.?key|raw.?observation)/i;
+const SENSITIVE_VALUE = /(bearer\s+[a-z0-9._~-]+|sk[-_][a-z0-9_-]{8,}|rk_(?:test|live)_[a-z0-9]+)/i;
+export function redact(value) {
+    if (typeof value === "string")
+        return SENSITIVE_VALUE.test(value) ? "[REDACTED]" : value;
+    if (Array.isArray(value))
+        return value.map(redact);
+    if (value && typeof value === "object") {
+        const output = {};
+        for (const [key, item] of Object.entries(value)) {
+            output[key] = SENSITIVE_KEY.test(key) ? "[REDACTED]" : redact(item);
+        }
+        return output;
+    }
+    return value;
+}
+export function createJsonLogger(write = console.log) {
+    const emit = (level, event, fields = {}) => {
+        write(JSON.stringify(redact({ timestamp: new Date().toISOString(), level, event, ...fields })));
+    };
+    return {
+        info: (event, fields) => emit("info", event, fields),
+        warn: (event, fields) => emit("warn", event, fields),
+        error: (event, fields) => emit("error", event, fields),
+    };
+}

package/dist/vendor/witnora-probe/metrics.d.ts

@@ -0,0 +1,12 @@
+declare const COUNTER_NAMES: readonly ["probe_requests_total", "probe_attestations_total", "probe_replay_rejections_total", "probe_stale_observations_total", "probe_signature_failures_total", "probe_target_read_failures_total"];
+declare const GAUGE_NAMES: readonly ["probe_queue_depth", "probe_clock_skew_seconds"];
+export type ProbeCounterName = typeof COUNTER_NAMES[number];
+export type ProbeGaugeName = typeof GAUGE_NAMES[number];
+export declare class ProbeMetrics {
+    private readonly counters;
+    private readonly gauges;
+    increment(name: ProbeCounterName, amount?: number): void;
+    set(name: ProbeGaugeName, value: number): void;
+    render(): string;
+}
+export {};

package/dist/vendor/witnora-probe/metrics.js

@@ -0,0 +1,31 @@
+const COUNTER_NAMES = [
+    "probe_requests_total",
+    "probe_attestations_total",
+    "probe_replay_rejections_total",
+    "probe_stale_observations_total",
+    "probe_signature_failures_total",
+    "probe_target_read_failures_total",
+];
+const GAUGE_NAMES = [
+    "probe_queue_depth",
+    "probe_clock_skew_seconds",
+];
+export class ProbeMetrics {
+    counters = new Map(COUNTER_NAMES.map((name) => [name, 0]));
+    gauges = new Map(GAUGE_NAMES.map((name) => [name, 0]));
+    increment(name, amount = 1) {
+        this.counters.set(name, (this.counters.get(name) ?? 0) + amount);
+    }
+    set(name, value) {
+        if (!Number.isFinite(value))
+            return;
+        this.gauges.set(name, value);
+    }
+    render() {
+        return [
+            ...COUNTER_NAMES.map((name) => `# TYPE ${name} counter\n${name} ${this.counters.get(name) ?? 0}`),
+            ...GAUGE_NAMES.map((name) => `# TYPE ${name} gauge\n${name} ${this.gauges.get(name) ?? 0}`),
+            "",
+        ].join("\n");
+    }
+}

package/dist/vendor/witnora-probe/probe.d.ts

@@ -0,0 +1,22 @@
+import { ProbeMetrics } from "./metrics.js";
+import { type ProbeConfig, type ProbeObservationAttestationV02, type ProbeObserveBodyV02, type StructuredLogger } from "./types.js";
+export declare class WitnoraProbe {
+    private readonly config;
+    private readonly logger;
+    readonly metrics: ProbeMetrics;
+    private readonly store;
+    private readonly nonces;
+    private retryTimer?;
+    private accepting;
+    private active;
+    private draining;
+    constructor(config: ProbeConfig, logger: StructuredLogger);
+    start(): void;
+    isReady(): boolean;
+    observe(body: ProbeObserveBodyV02): Promise<ProbeObservationAttestationV02>;
+    shutdown(): Promise<void>;
+    drainRetryQueue(now?: Date): Promise<void>;
+    private executeWithRetries;
+    private readTarget;
+    private createAttestation;
+}

package/dist/vendor/witnora-probe/probe.js

@@ -0,0 +1,208 @@
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { canonicalJson, sha256Canonical } from "./canonical.js";
+import { signCanonical } from "./crypto.js";
+import { observationRequestDigest, RequestVerificationError, verifyObservationRequest, } from "./request-verifier.js";
+import { EncryptedJsonStore, PersistentNonceCache } from "./storage.js";
+import { ProbeMetrics } from "./metrics.js";
+import { OBSERVATION_ATTESTATION_PROTOCOL, } from "./types.js";
+export class WitnoraProbe {
+    config;
+    logger;
+    metrics = new ProbeMetrics();
+    store;
+    nonces;
+    retryTimer;
+    accepting = true;
+    active = 0;
+    draining = false;
+    constructor(config, logger) {
+        this.config = config;
+        this.logger = logger;
+        this.store = new EncryptedJsonStore(config.stateDirectory, config.storageEncryptionKey);
+        this.nonces = new PersistentNonceCache(join(config.stateDirectory, "nonces"));
+    }
+    start() {
+        if (this.retryTimer)
+            return;
+        this.retryTimer = setInterval(() => void this.drainRetryQueue(), this.config.retry.scanIntervalMs);
+        this.retryTimer.unref();
+    }
+    isReady() {
+        return this.accepting && Object.keys(this.config.requestVerificationKeys).length > 0 && this.config.adapters.length > 0;
+    }
+    async observe(body) {
+        this.metrics.increment("probe_requests_total");
+        if (!this.accepting)
+            throw new RequestVerificationError("SHUTTING_DOWN", "Probe is shutting down.", 503);
+        const request = verifyObservationRequest(body, this.config.bindings, this.config.requestVerificationKeys);
+        if (!(await this.nonces.claim(request.nonce, request.expiresAt))) {
+            this.metrics.increment("probe_replay_rejections_total");
+            throw new RequestVerificationError("NONCE_REPLAY", "Observation request nonce has already been used.", 409);
+        }
+        return this.executeWithRetries(body, 1);
+    }
+    async shutdown() {
+        this.accepting = false;
+        if (this.retryTimer)
+            clearInterval(this.retryTimer);
+        this.retryTimer = undefined;
+        const deadline = Date.now() + this.config.shutdownTimeoutMs;
+        while (this.active > 0 && Date.now() < deadline)
+            await new Promise((resolve) => setTimeout(resolve, 10));
+        this.logger.info("probe.shutdown", { activeObservations: this.active });
+    }
+    async drainRetryQueue(now = new Date()) {
+        if (this.draining)
+            return;
+        this.draining = true;
+        try {
+            for (const id of await this.store.list("retry")) {
+                const item = await this.store.get("retry", id);
+                if (!item || Date.parse(item.nextAttemptAt) > now.getTime() || Date.parse(item.leaseUntil) > now.getTime())
+                    continue;
+                try {
+                    verifyObservationRequest(item.body, this.config.bindings, this.config.requestVerificationKeys, now);
+                    item.leaseUntil = new Date(now.getTime() + this.config.observationTimeoutMs + this.config.retry.baseDelayMs + 1_000).toISOString();
+                    await this.store.put("retry", id, item);
+                    await this.executeWithRetries(item.body, item.attempt);
+                }
+                catch (error) {
+                    this.logger.warn("probe.retry_rejected", { requestId: item.body.request.requestId, error: errorCode(error) });
+                    await this.store.delete("retry", id);
+                }
+            }
+        }
+        finally {
+            this.draining = false;
+        }
+    }
+    async executeWithRetries(body, firstAttempt) {
+        const request = body.request;
+        let attempt = firstAttempt;
+        while (attempt <= this.config.retry.maxAttempts) {
+            this.active += 1;
+            try {
+                const observed = await this.readTarget(body.query);
+                const result = await this.createAttestation(body, observed);
+                await this.store.put("attestations", request.requestId, result);
+                await this.store.delete("retry", request.requestId);
+                this.metrics.set("probe_queue_depth", (await this.store.list("retry")).length);
+                this.metrics.increment("probe_attestations_total");
+                this.logger.info("probe.observation_attested", {
+                    requestId: request.requestId,
+                    requestDigest: result.requestDigest,
+                    outcomeStatus: result.outcomeStatus,
+                    attempt,
+                });
+                return result;
+            }
+            catch (error) {
+                const retryable = isRetryable(error) && attempt < this.config.retry.maxAttempts;
+                if (!retryable) {
+                    this.metrics.increment("probe_target_read_failures_total");
+                    await this.store.delete("retry", request.requestId);
+                    this.metrics.set("probe_queue_depth", (await this.store.list("retry")).length);
+                    this.logger.error("probe.observation_failed", { requestId: request.requestId, attempt, error: errorCode(error) });
+                    throw error;
+                }
+                const nextAttemptAt = new Date(Date.now() + this.config.retry.baseDelayMs * 2 ** (attempt - 1)).toISOString();
+                const leaseUntil = new Date(Date.parse(nextAttemptAt) + this.config.observationTimeoutMs + 1_000).toISOString();
+                await this.store.put("retry", request.requestId, {
+                    body,
+                    attempt: attempt + 1,
+                    nextAttemptAt,
+                    leaseUntil,
+                    lastErrorCode: errorCode(error),
+                });
+                this.metrics.set("probe_queue_depth", (await this.store.list("retry")).length);
+                this.logger.warn("probe.observation_queued", {
+                    requestId: request.requestId,
+                    requestDigest: observationRequestDigest(request),
+                    attempt,
+                    error: errorCode(error),
+                });
+                await sleepUntil(nextAttemptAt);
+                attempt += 1;
+            }
+            finally {
+                this.active -= 1;
+            }
+        }
+        throw new Error("Observation retry loop exhausted unexpectedly.");
+    }
+    async readTarget(query) {
+        const adapter = this.config.adapters.find((candidate) => candidate.supports(query));
+        if (!adapter)
+            throw new RequestVerificationError("QUERY_NOT_SUPPORTED", "No configured read adapter supports this query.", 403);
+        const credential = this.config.credentialReference
+            ? await this.config.credentialResolver.resolve(this.config.credentialReference)
+            : undefined;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.config.observationTimeoutMs);
+        try {
+            return await adapter.observe({ query, credential, signal: controller.signal });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    async createAttestation(body, observed) {
+        const request = body.request;
+        const observedAt = new Date();
+        const sourceObservedAt = Date.parse(observed.sourceObservedAt);
+        if (!Number.isFinite(sourceObservedAt))
+            throw new Error("Adapter returned an invalid sourceObservedAt timestamp.");
+        if (sourceObservedAt > observedAt.getTime() + 30_000)
+            throw new Error("Adapter returned a future-dated source observation beyond clock skew.");
+        this.metrics.set("probe_clock_skew_seconds", (observedAt.getTime() - sourceObservedAt) / 1_000);
+        const rawObservationCommitment = sha256Canonical(observed.rawObservation);
+        const unsigned = {
+            protocolVersion: OBSERVATION_ATTESTATION_PROTOCOL,
+            attestationId: randomUUID(),
+            requestId: request.requestId,
+            requestDigest: observationRequestDigest(request),
+            nonce: request.nonce,
+            tenantRef: request.tenantRef,
+            projectRef: request.projectRef,
+            environment: request.environment,
+            actionDigest: request.actionDigest,
+            contractDigest: request.contractDigest,
+            resourceCommitment: request.resourceCommitment,
+            predicateDigest: request.predicateDigest,
+            probeId: request.probeId,
+            probeVersion: this.config.probeVersion,
+            observationSource: observed.observationSource,
+            observedAt: observedAt.toISOString(),
+            dataFreshnessMs: Math.max(0, observedAt.getTime() - sourceObservedAt),
+            normalizedObservation: observed.normalizedObservation,
+            rawObservationCommitment,
+            targetVersion: observed.targetVersion,
+            ...(observed.targetAuditReference ? { targetAuditReference: observed.targetAuditReference } : {}),
+            outcomeStatus: canonicalJson(observed.normalizedObservation) === canonicalJson(body.expected) ? "VERIFIED" : "NOT_VERIFIED",
+            limitations: observed.limitations,
+            keyCertificateId: this.config.probeSigningKey.keyCertificateId,
+        };
+        const result = { ...unsigned, signature: signCanonical(unsigned, this.config.probeSigningKey.privateKeyPem) };
+        await this.store.put("raw-observations", request.requestId, {
+            observedAt: unsigned.observedAt,
+            observationSource: observed.observationSource,
+            rawObservation: observed.rawObservation,
+        });
+        return result;
+    }
+}
+function isRetryable(error) {
+    return Boolean(error && typeof error === "object" && "retryable" in error && error.retryable === true);
+}
+function errorCode(error) {
+    if (error instanceof RequestVerificationError)
+        return error.code;
+    if (error instanceof Error)
+        return error.name || "ERROR";
+    return "UNKNOWN_ERROR";
+}
+async function sleepUntil(timestamp) {
+    const delay = Math.max(0, Date.parse(timestamp) - Date.now());
+    await new Promise((resolve) => setTimeout(resolve, delay));
+}