WIP: Wire attestation tokens into edge-core-js context - #6154

diff --git a/src/__tests__/util/attestation.test.ts b/src/__tests__/util/attestation.test.ts
--- a/src/__tests__/util/attestation.test.ts
+++ b/src/__tests__/util/attestation.test.ts
@@ -2158,6 +2158,37 @@
       expect(listener.mock.calls).toContainEqual([undefined])
     })
 
+    it('fires with undefined when a cached token becomes unservable', async () => {
+      // Refresh is armed while the token is still servable, and a failed
+      // refresh then waits out FAILURE_BACKOFF_MS. Listeners must still drop
+      // the JWT at the skew window - not whenever that later tick happens.
+      const { CLOCK_SKEW_MS, FAILURE_BACKOFF_MS, MIN_REFRESH_MS } =
+        attestationTimingForTests
+      const lifetimeMs = MIN_REFRESH_MS + CLOCK_SKEW_MS + 10 * 1000
+      const listener = jest.fn<(token: string | undefined) => void>()
+      onAttestationToken(listener)
+      listener.mockClear()
+      mockSuccessfulHandshake(lifetimeMs / 1000)
+      initAttestation()
+      await flush()
+      expect(listener.mock.calls).toEqual([['jwt-token']])
+      listener.mockClear()
+
+      mockCheapFailingHandshake()
+      await jest.advanceTimersByTimeAsync(MIN_REFRESH_MS)
+      await flush()
+      // Still inside the servable window, so the failure path must not clear.
+      expect(listener.mock.calls).toEqual([])
+      await expect(getAttestationToken()).resolves.toBe('jwt-token')
+
+      // Cross the skew window, but stay well short of the failure backoff.
+      await jest.advanceTimersByTimeAsync(CLOCK_SKEW_MS + 10 * 1000)
+      await flush()
+      expect(CLOCK_SKEW_MS + 10 * 1000).toBeLessThan(FAILURE_BACKOFF_MS)
+      expect(listener.mock.calls).toEqual([[undefined]])
+      await expect(getAttestationToken()).resolves.toBeUndefined()
+    })
+
     it('stops notifying after unsubscribe', async () => {
       const { REFRESH_LEAD_MS } = attestationTimingForTests
       const REFRESH_UNTIL_MS = 5 * 60 * 1000

diff --git a/src/util/attestation.ts b/src/util/attestation.ts
--- a/src/util/attestation.ts
+++ b/src/util/attestation.ts
@@ -119,6 +119,11 @@
 let cachedToken: CachedToken | undefined
 let inFlight: Promise<void> | undefined
 let refreshTimer: ReturnType<typeof setTimeout> | undefined
+// Drop the JWT when it crosses the skew window, so push listeners (edge-core)
+// stop sending a token getAttestationToken would already withhold. The
+// handshake timer is not this clock: it is armed while the token is still
+// servable, and a failed refresh can leave the next tick behind a backoff.
+let serveUntilTimer: ReturnType<typeof setTimeout> | undefined
 // `undefined` means no prior stamp. Initializing these to `0` worked with
 // `Date.now()` (epoch is always far past) but a monotonic clock starts near
 // zero, so `0` would look like "just now" and park every first handshake behind
@@ -146,6 +151,19 @@
 
 const setCachedToken = (next: CachedToken | undefined): void => {
   cachedToken = next
+  if (serveUntilTimer != null) clearTimeout(serveUntilTimer)
+  serveUntilTimer = undefined
+  if (cachedToken != null) {
+    const serveMs = cachedToken.expiresMono - CLOCK_SKEW_MS - monotonicNow()
+    if (serveMs > 0) {
+      serveUntilTimer = setTimeout(() => {
+        serveUntilTimer = undefined
+        if (cachedToken != null && !canServeToken()) {
+          setCachedToken(undefined)
+        }
+      }, serveMs)
+    }
+  }
   const token = canServeToken() ? cachedToken?.token : undefined
   for (const listener of tokenListeners) {
     try {
@@ -181,6 +199,8 @@
   inFlight = undefined
   if (refreshTimer != null) clearTimeout(refreshTimer)
   refreshTimer = undefined
+  if (serveUntilTimer != null) clearTimeout(serveUntilTimer)
+  serveUntilTimer = undefined
   lastFailureAt = undefined
   lastHandshakeAt = undefined
   consecutiveFailures = 0