@deployfoundation/foundation-deploy 0.2.53 → 0.2.55

package/README.md

@@ -55,7 +55,7 @@ bun run packages/infra/bin/foundation-deploy.ts <command> --instance <path>
 | `slack-manifest` | Print the instance's Slack app manifest as JSON (the Slack CLI's `get-manifest` hook contract). |
 | `stage-customization` | Validate and stage a tenant-owned runtime config. |
 | `crm-key` | Write the company CRM's `crm/1` key, piped in with `--stdin`, into `<secretPrefix>/crm/http` (`crm.provider` kind `http`). |
-| `crm-check` | Run the `crm/1` conformance suite: the read cases against the instance's CRM with its stored key, or, with `--base-url --tenant --key-stdin` and no instance, any server, write cases included. |
+| `crm-check` | Run the `crm/1` conformance suite: the read cases against the instance's CRM with its stored key, or, with `--base-url --tenant --key-stdin` and no instance, any server, write cases included, every case strict given the server's harness endpoint (`--harness-url`) and the deployment's inputs (docs/crm-provider-contract.md#crm-check). A CRM can also import the suite: `@deployfoundation/foundation-deploy/crm-conformance`. |
 | `crm-replay` | Replay the agent's CRM writes (JSONL) into the instance's own table after a rollback to the DynamoDB provider. |
 
 `--instance <path>` is required for every command (or `FOUNDATION_INSTANCE_FILE`

package/dist/bin/app.js

@@ -8,16 +8,16 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-spq5kr1t.js";
+} from "../chunk-68jxyg2n.js";
 import"../chunk-pxhftba1.js";
-import"../chunk-dz91avrb.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-fjdgxw8h.js";
-import"../chunk-96fjaysn.js";
+} from "../chunk-pmjbzsq3.js";
+import"../chunk-dz91avrb.js";
+import"../chunk-rvx0cncy.js";
 import"../chunk-5wgwscd0.js";
 
 // bin/app.ts

package/dist/bin/foundation-deploy.js

@@ -1,17 +1,5 @@
 #!/usr/bin/env node
 // @bun
-import {
-  RELEASE_BUCKET_ENV,
-  RELEASE_VERSION_RE,
-  manifestKey,
-  releaseCacheDir,
-  skillsKey,
-  verifyManifest
-} from "../chunk-pxhftba1.js";
-import {
-  DEFAULT_RELEASE_BUCKET,
-  expectedKeyArn
-} from "../chunk-dz91avrb.js";
 import {
   argv,
   aws,
@@ -32,16 +20,28 @@ import {
   secretExists,
   stackExists,
   stackOutput
-} from "../chunk-nvsj7bbw.js";
+} from "../chunk-345e0grd.js";
+import {
+  RELEASE_BUCKET_ENV,
+  RELEASE_VERSION_RE,
+  manifestKey,
+  releaseCacheDir,
+  skillsKey,
+  verifyManifest
+} from "../chunk-pxhftba1.js";
 import {
   CUSTOMIZATION_ARTIFACT_NAME,
   instanceNames,
   mongoCollectionPolicyEnv,
   slackCommandPrefix,
   versionedConfigKey
-} from "../chunk-fjdgxw8h.js";
-import"../chunk-m76jt5rc.js";
-import"../chunk-3614v9rr.js";
+} from "../chunk-pmjbzsq3.js";
+import {
+  DEFAULT_RELEASE_BUCKET,
+  expectedKeyArn
+} from "../chunk-dz91avrb.js";
+import"../chunk-hvntk8p5.js";
+import"../chunk-xt9gdsa0.js";
 import {
   BASE_SLACK_EVENTS,
   CAPABILITY_IDS,
@@ -53,7 +53,7 @@ import {
   requiredGithubPermissions,
   requiredSlackCommands,
   requiredSlackScopes
-} from "../chunk-96fjaysn.js";
+} from "../chunk-rvx0cncy.js";
 import {
   __require
 } from "../chunk-5wgwscd0.js";
@@ -2449,6 +2449,20 @@ crm-check options
   --write              with --base-url only: also run the write cases, which
                        create records and spend the week's outreach allowance;
                        point it at a sandbox tenant
+  with --base-url --write, what the remaining write cases need:
+  --harness-url <url>  the CRM's harness endpoint (crm-harness/1), which does
+  --harness-key-stdin  what only a person can; its key comes on stdin
+  --readonly-key-stdin a key for the same tenant without write scopes, on stdin
+  --status-policy <file>
+                       the deployment's capabilities.crm.statusPolicy (JSON
+                       or YAML)
+  --suppressed-statuses <file>
+                       its capabilities.crm.outreach.suppressedStatuses
+  --spend-weekly-allowance
+                       drive this week's outreach caps to their limits
+                       (a throwaway database only)
+  Keys on stdin go one per line, in this order: the crm/1 key, the read-only
+  key, the harness key (each only when its flag is given).
 
 crm-replay options
   --from <file>        REQUIRED: the writes to replay, one JSON object per line
@@ -2462,6 +2476,22 @@ function flag2(args, name) {
   const index = args.indexOf(name);
   return index === -1 ? undefined : args[index + 1];
 }
+function valueFlag(args, name, what) {
+  if (!args.includes(name))
+    return;
+  const value = flag2(args, name);
+  if (value === undefined || value.startsWith("-"))
+    throw new Error(`${name} needs ${what}`);
+  return value;
+}
+var CRM_CHECK_TARGET_FLAGS = [
+  "--harness-url",
+  "--harness-key-stdin",
+  "--readonly-key-stdin",
+  "--status-policy",
+  "--suppressed-statuses",
+  "--spend-weekly-allowance"
+];
 function contextFor(args) {
   const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
   return awsContext({
@@ -2540,12 +2570,22 @@ ${USAGE}`);
     const tenantId = flag2(args, "--tenant");
     if (baseUrl === undefined || tenantId === undefined || !args.includes("--key-stdin"))
       throw new Error("crm-check --base-url needs --tenant <id> and --key-stdin");
-    const { crmCheckTarget, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+    const harnessUrl = valueFlag(args, "--harness-url", "the CRM's harness endpoint URL");
+    if (harnessUrl !== undefined !== args.includes("--harness-key-stdin"))
+      throw new Error("crm-check --harness-url <url> and --harness-key-stdin go together: the harness key comes on stdin");
+    const statusPolicyFile = valueFlag(args, "--status-policy", "a file");
+    const suppressedStatusesFile = valueFlag(args, "--suppressed-statuses", "a file");
+    const { crmCheckTarget, defaultCrmCommandDeps } = await import("../chunk-ztrhakgc.js");
     return crmCheckTarget({
       baseUrl,
       tenantId,
       write: args.includes("--write"),
-      allowSkips: args.includes("--allow-skips")
+      allowSkips: args.includes("--allow-skips"),
+      readOnlyKeyStdin: args.includes("--readonly-key-stdin"),
+      spendWeeklyAllowance: args.includes("--spend-weekly-allowance"),
+      ...harnessUrl === undefined ? {} : { harnessUrl },
+      ...statusPolicyFile === undefined ? {} : { statusPolicyFile },
+      ...suppressedStatusesFile === undefined ? {} : { suppressedStatusesFile }
     }, defaultCrmCommandDeps());
   }
   if (command === "github-app-create") {
@@ -2613,21 +2653,24 @@ ${USAGE}`);
       return 0;
     }
     case "crm-key": {
-      const { crmKey, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      const { crmKey, defaultCrmCommandDeps } = await import("../chunk-ztrhakgc.js");
       await crmKey(ctx, { stdin: args.includes("--stdin") }, defaultCrmCommandDeps());
       return 0;
     }
     case "crm-check": {
       if (args.includes("--write"))
         throw new Error("crm-check --write creates records and spends the week's outreach allowance, so it never runs against the instance's own tenant: use --base-url with a sandbox tenant");
-      const { crmCheck, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      const targetOnly = CRM_CHECK_TARGET_FLAGS.filter((name) => args.includes(name));
+      if (targetOnly.length > 0)
+        throw new Error(`crm-check --instance runs the read cases with the deployment's own key and policy; ${targetOnly.join(", ")} feed the write cases: use --base-url --write with a sandbox tenant`);
+      const { crmCheck, defaultCrmCommandDeps } = await import("../chunk-ztrhakgc.js");
       return crmCheck(ctx, { allowSkips: args.includes("--allow-skips") }, defaultCrmCommandDeps());
     }
     case "crm-replay": {
       const from = flag2(args, "--from");
       if (from === undefined || from.startsWith("-"))
         throw new Error("crm-replay needs --from <file>: the writes to replay, as JSONL");
-      const { crmReplay, defaultCrmCommandDeps } = await import("../chunk-1pww63wd.js");
+      const { crmReplay, defaultCrmCommandDeps } = await import("../chunk-ztrhakgc.js");
       const result = await crmReplay(ctx, { from }, defaultCrmCommandDeps());
       return result.refused.length > 0 ? 1 : 0;
     }

package/dist/{chunk-nvsj7bbw.js → chunk-345e0grd.js}

@@ -1,7 +1,7 @@
 import {
   instanceNames,
   loadInstanceFile
-} from "./chunk-fjdgxw8h.js";
+} from "./chunk-pmjbzsq3.js";
 
 // src/deploy/aws.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";

package/dist/{chunk-spq5kr1t.js → chunk-68jxyg2n.js}

@@ -17,7 +17,7 @@ import {
   provisionsIntegration,
   requiresAuthenticatedQueue,
   slackCommandPrefixes
-} from "./chunk-fjdgxw8h.js";
+} from "./chunk-pmjbzsq3.js";
 import {
   capabilityScheduledJobs,
   crmOutreachConfigured,
@@ -28,7 +28,7 @@ import {
   parseSchedule,
   scheduledJobBindings,
   webhookJobBindings
-} from "./chunk-96fjaysn.js";
+} from "./chunk-rvx0cncy.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -1942,8 +1942,10 @@ function addConfigLoadAlarm(stack, args) {
       `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
       "config failed to load, so it runs on its last good config with company-data",
       "capabilities off, or on the built-in fallback. The config_fallback_active or",
-      "config_reload_failed line in the runtime's live log group names the refused field.",
-      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync."
+      "config_reload_failed line in the runtime's live log group says why: its error_message",
+      "names the refused field (record keys shown as *), the YAML error and line, or the",
+      "S3/KMS error and the IAM action it cites (error_type s3_read_failed).",
+      "Fix config.yaml or the grant, run foundation-deploy check, then deploy or config:sync."
     ].join(" "),
     metric: filter.metric({ statistic: "Sum", period: cdk2.Duration.hours(1) }),
     threshold: 1,
@@ -2736,6 +2738,13 @@ class FoundationNetwork extends cdk5.Stack {
         actions: ["s3:GetObject"],
         resources: [`arn:${this.partition}:s3:::prod-${this.region}-starport-layer-bucket/*`]
       }));
+      s3Endpoint.addToPolicy(new iam6.PolicyStatement({
+        sid: "AmplifyArtifactsBucket",
+        effect: iam6.Effect.ALLOW,
+        principals: [new iam6.AnyPrincipal],
+        actions: ["s3:GetObject"],
+        resources: [`arn:${this.partition}:s3:::aws-amplify-prod-${this.region}-artifacts/*`]
+      }));
     }
     if (!skipEndpoints.has("dynamodb")) {
       const dynamoEndpoint = this.vpc.addGatewayEndpoint("DynamoDbEndpoint", {

package/dist/{chunk-mh1206ne.js → chunk-7k4e3d7n.js}

@@ -15,7 +15,7 @@ import {
   classifyOutreach,
   movesToDraftedStatus,
   outreachWeekStart
-} from "./chunk-p7zkm4pp.js";
+} from "./chunk-caqstrxb.js";
 import {
   CRM_MAX_ACTIVITY_PAGE_SIZE,
   CRM_MAX_CURSOR_CHARS,
@@ -29,8 +29,8 @@ import {
   parseCrmOutreachQueueResponse,
   parseCrmSearchResponse,
   parseCrmTimestamp
-} from "./chunk-3614v9rr.js";
-import"./chunk-96fjaysn.js";
+} from "./chunk-xt9gdsa0.js";
+import"./chunk-rvx0cncy.js";
 import"./chunk-5wgwscd0.js";
 
 // ../capability-crm/src/proxy/repository.ts

package/dist/{chunk-p7zkm4pp.js → chunk-caqstrxb.js}

@@ -5,7 +5,7 @@ import {
   CRM_OUTREACH_REPLY_ACTIVITY,
   CRM_OUTREACH_SENT_ACTIVITY,
   CrmInputError
-} from "./chunk-3614v9rr.js";
+} from "./chunk-xt9gdsa0.js";
 
 // ../capability-crm/src/proxy/policy.ts
 class CrmPolicyRefusedError extends Error {

package/dist/chunk-gpq7e1kq.js

@@ -0,0 +1,101 @@
+import {
+  CrmConformanceHarnessError
+} from "./chunk-vcz9zbb3.js";
+import {
+  CRM_HTTP_HEADERS,
+  crmHttpBaseUrl,
+  isCrmHttpKey,
+  readCrmHttpBody
+} from "./chunk-hvntk8p5.js";
+import"./chunk-caqstrxb.js";
+import"./chunk-xt9gdsa0.js";
+import"./chunk-rvx0cncy.js";
+import"./chunk-5wgwscd0.js";
+
+// ../capability-crm/src/contract/http-harness.ts
+var CRM_HARNESS_CONTRACT = "crm-harness/1";
+var USER_AGENT = "foundation-crm-conformance/1";
+var TIMEOUT_MS = 1e4;
+var MAX_REPLY_BYTES = 64 * 1024;
+function crmHarnessUrl(value) {
+  try {
+    return crmHttpBaseUrl(value);
+  } catch {
+    throw new Error("the harness URL must be an HTTPS URL with no userinfo, query or fragment");
+  }
+}
+function createCrmHttpHarness(options) {
+  const url = crmHarnessUrl(options.url);
+  if (!isCrmHttpKey(options.apiKey)) {
+    throw new Error("the harness key must be 16 to 1024 visible ASCII characters");
+  }
+  const { apiKey, tenantId } = options;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  async function call(request) {
+    const signal = AbortSignal.timeout(TIMEOUT_MS);
+    let response;
+    try {
+      response = await fetchImpl(url, {
+        method: "POST",
+        redirect: "error",
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          accept: "application/json",
+          "content-type": "application/json",
+          "user-agent": USER_AGENT,
+          [CRM_HTTP_HEADERS.contract]: CRM_HARNESS_CONTRACT
+        },
+        body: JSON.stringify(request),
+        signal
+      });
+    } catch {
+      throw new CrmConformanceHarnessError(`${request.action} ${signal.aborted ? "did not answer in time" : "could not reach the harness"}`);
+    }
+    let text;
+    try {
+      text = await readCrmHttpBody(response, MAX_REPLY_BYTES, signal);
+    } catch {
+      throw new CrmConformanceHarnessError(`${request.action} reply is too large or unreadable`);
+    }
+    if (response.status < 200 || response.status > 299) {
+      throw new CrmConformanceHarnessError(`${request.action} answered HTTP ${response.status}`);
+    }
+    return text;
+  }
+  return {
+    async setStatusAsPerson(recordType, recordId, status) {
+      await call({ action: "set_status_as_person", tenantId, recordType, recordId, status });
+    },
+    async setDoNotContact(recordType, recordId) {
+      await call({ action: "set_do_not_contact", tenantId, recordType, recordId });
+    },
+    async suppressEmail(email) {
+      await call({ action: "suppress_email", tenantId, email });
+    },
+    async addPersonNote(recordType, recordId, summary) {
+      const text = await call({
+        action: "add_person_note",
+        tenantId,
+        recordType,
+        recordId,
+        summary
+      });
+      let activityId;
+      try {
+        const reply = JSON.parse(text);
+        if (typeof reply === "object" && reply !== null && "activityId" in reply) {
+          activityId = reply.activityId;
+        }
+      } catch {}
+      if (typeof activityId !== "string" || !/^[\x21-\x7e]{1,256}$/.test(activityId)) {
+        throw new CrmConformanceHarnessError("add_person_note answered no activityId");
+      }
+      return activityId;
+    }
+  };
+}
+export {
+  CRM_HARNESS_CONTRACT,
+  createCrmHttpHarness,
+  crmHarnessUrl
+};

package/dist/{chunk-m76jt5rc.js → chunk-hvntk8p5.js}

@@ -12,7 +12,7 @@ import {
   parseCrmOutreachState,
   parseCrmProviderMeta,
   parseCrmSearchResponse
-} from "./chunk-3614v9rr.js";
+} from "./chunk-xt9gdsa0.js";
 
 // ../connectors/src/crm-http.ts
 import { randomUUID } from "node:crypto";

package/dist/chunk-p6yjbtqz.js

@@ -0,0 +1,13 @@
+import {
+  CrmConformanceHarnessError,
+  runCrmConformance
+} from "./chunk-vcz9zbb3.js";
+import"./chunk-hvntk8p5.js";
+import"./chunk-caqstrxb.js";
+import"./chunk-xt9gdsa0.js";
+import"./chunk-rvx0cncy.js";
+import"./chunk-5wgwscd0.js";
+export {
+  CrmConformanceHarnessError,
+  runCrmConformance
+};

package/dist/{chunk-fjdgxw8h.js → chunk-pmjbzsq3.js}

@@ -2,7 +2,7 @@ import {
   INTEGRATION_CAPABILITY_IDS,
   PROACTIVE_CHANNEL_MODES,
   SLACK_COMMAND_PREFIX_RE
-} from "./chunk-96fjaysn.js";
+} from "./chunk-rvx0cncy.js";
 
 // ../core/src/instance.ts
 import { parse as parseYaml } from "yaml";

package/dist/{chunk-96fjaysn.js → chunk-rvx0cncy.js}

@@ -1,8 +1,3 @@
-// ../core/src/config.ts
-import { createHash as createHash2 } from "node:crypto";
-import { parse as parseYaml } from "yaml";
-import { z as z4 } from "zod";
-
 // ../core/src/capabilities.ts
 import { z } from "zod";
 
@@ -936,6 +931,11 @@ function requiredSlackCommandSuffixes(enabled) {
   return [...suffixes].sort();
 }
 
+// ../core/src/config.ts
+import { createHash as createHash2 } from "node:crypto";
+import { parse as parseYaml } from "yaml";
+import { z as z4 } from "zod";
+
 // ../core/src/jobs.ts
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
 import { z as z3 } from "zod";
@@ -1234,6 +1234,33 @@ function parseInstanceConfig(yamlText) {
       throw new Error(`job ${job.id} owner ${job.owner} must be an instance admin`);
   return cfg;
 }
+var ZOD_ISSUE_CODES = new Set(Object.values(z4.ZodIssueCode));
+var ZOD_PARSED_TYPES = new Set(Object.values(z4.ZodParsedType));
+var YAML_ERROR_CODES = new Set([
+  "ALIAS_PROPS",
+  "BAD_ALIAS",
+  "BAD_COLLECTION_TYPE",
+  "BAD_DIRECTIVE",
+  "BAD_DQ_ESCAPE",
+  "BAD_INDENT",
+  "BAD_PROP_ORDER",
+  "BAD_SCALAR_START",
+  "BLOCK_AS_IMPLICIT_KEY",
+  "BLOCK_IN_FLOW",
+  "DUPLICATE_KEY",
+  "IMPOSSIBLE",
+  "KEY_OVER_1024_CHARS",
+  "MISSING_CHAR",
+  "MULTILINE_IMPLICIT_KEY",
+  "MULTIPLE_ANCHORS",
+  "MULTIPLE_DOCS",
+  "MULTIPLE_TAGS",
+  "NON_STRING_KEY",
+  "RESOURCE_EXHAUSTION",
+  "TAB_AS_INDENT",
+  "TAG_RESOLVE_FAILED",
+  "UNEXPECTED_TOKEN"
+]);
 
 // ../core/src/logger.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -1295,4 +1322,4 @@ function wrapUntrusted(source, content) {
 ${safe}
 </${UNTRUSTED_TAG}>`;
 }
-export { parseSchedule, BASE_SLACK_EVENTS, SLACK_COMMAND_PREFIX_RE, CAPABILITY_IDS, INTEGRATION_CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, PROACTIVE_CHANNEL_MODES, encodeProactiveChannels, wrapUntrusted };
+export { parseSchedule, RawCrmStatusPolicy, RawCrmStatusesByType, BASE_SLACK_EVENTS, SLACK_COMMAND_PREFIX_RE, CAPABILITY_IDS, INTEGRATION_CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, PROACTIVE_CHANNEL_MODES, encodeProactiveChannels, wrapUntrusted };

package/dist/{chunk-jf5rw6h4.js → chunk-vcz9zbb3.js}

@@ -6,21 +6,26 @@ import {
   createCrmHttpClient,
   encodeCrmActor,
   readCrmHttpBody
-} from "./chunk-m76jt5rc.js";
+} from "./chunk-hvntk8p5.js";
 import {
   outreachWeekStart,
   personOwnedStatuses
-} from "./chunk-p7zkm4pp.js";
+} from "./chunk-caqstrxb.js";
 import {
   CRM_NOTE_ACTIVITY,
   CRM_OUTREACH_DRAFTED_ACTIVITY,
   CRM_REQUIRED_PROVIDER_OPERATIONS
-} from "./chunk-3614v9rr.js";
-import"./chunk-96fjaysn.js";
-import"./chunk-5wgwscd0.js";
+} from "./chunk-xt9gdsa0.js";
 
 // ../capability-crm/src/contract/conformance.ts
 import { randomUUID } from "node:crypto";
+class CrmConformanceHarnessError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CrmConformanceHarnessError";
+  }
+}
+
 class Skip extends Error {
   reason;
   needs;
@@ -386,9 +391,11 @@ class Suite {
     return;
   }
   async transitionCase() {
-    const transition = this.target.disallowedTransition;
-    if (transition === undefined)
-      throw new Skip("no disallowedTransition given");
+    const given = this.target.disallowedTransition;
+    const transition = given ?? this.policyDisallowedTransition();
+    if (transition === undefined) {
+      throw new Skip(this.target.statusPolicy === undefined ? "no disallowedTransition or statusPolicy given" : "the statusPolicy allows every move from a new record's status");
+    }
     const fixture = await this.fixture("transition");
     const recordId = transition.recordType === "company" ? fixture.companyId : fixture.contactId;
     const current = await this.profile(transition.recordType, recordId);
@@ -398,6 +405,23 @@ class Suite {
       status: transition.to,
       idempotencyKey: this.key()
     }, { status: current.status, statusVersion: current.statusVersion ?? 0 }), "refused", "transition_not_allowed");
+    return given === undefined ? `${transition.recordType} → ${transition.to}, from the statusPolicy` : undefined;
+  }
+  policyDisallowedTransition() {
+    const policy = this.target.statusPolicy;
+    if (policy === undefined)
+      return;
+    const meta = this.requireMeta();
+    for (const recordType of ["company", "contact"]) {
+      const rule = policy[recordType];
+      const [first, ...others] = meta.statuses[recordType];
+      if (rule === undefined || first === undefined)
+        continue;
+      const exits = Object.hasOwn(rule.agentTransitions, first) ? rule.agentTransitions[first] ?? [] : [];
+      const to = others.find((status) => !exits.includes(status));
+      if (to !== undefined)
+        return { recordType, to };
+    }
     return;
   }
   async statusLockedCase() {
@@ -1102,6 +1126,8 @@ async function expectError(call, code, reason) {
 function describe(error) {
   if (error instanceof Failure)
     return error.message;
+  if (error instanceof CrmConformanceHarnessError)
+    return `harness: ${error.message}`;
   if (error instanceof CrmHttpError) {
     return [
       error.code,
@@ -1112,6 +1138,5 @@ function describe(error) {
   }
   return `unexpected ${error instanceof Error ? error.name : typeof error}`;
 }
-export {
-  runCrmConformance
-};
+
+export { CrmConformanceHarnessError, runCrmConformance };

package/dist/{chunk-3614v9rr.js → chunk-xt9gdsa0.js}

@@ -1,6 +1,6 @@
 import {
   wrapUntrusted
-} from "./chunk-96fjaysn.js";
+} from "./chunk-rvx0cncy.js";
 
 // ../connectors/src/crm.ts
 var CRM_MAX_BATCH_SIZE = 100;