witnora 0.13.12 → 0.14.0

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts

@@ -0,0 +1,85 @@
+export declare const PRODUCTION_EVALUATOR_OBSERVATION_VERSION: "witnora.production_evaluator_observation.v0.1";
+export type ProductionEvaluatorTemplate = "CRM_RECORD_STATE" | "TICKET_STATUS" | "EMAIL_DELIVERY" | "DATABASE_READ_ONLY" | "WEBHOOK_DELIVERY" | "QUEUE_JOB_COMPLETION" | "PAYMENT_REFUND_RESULT" | "BROWSER_WORKFLOW_OUTCOME";
+type SafeScalar = string | number | boolean | null;
+type SafeFields = Record<string, SafeScalar>;
+export interface ProductionEvaluatorRequest {
+    resourceId: string;
+    criterionId: string;
+    expected: SafeFields;
+    parameters?: SafeScalar[];
+}
+export interface ProductionEvaluatorObservation {
+    schemaVersion: typeof PRODUCTION_EVALUATOR_OBSERVATION_VERSION;
+    template: ProductionEvaluatorTemplate;
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    criterion: {
+        id: string;
+        expectedDigestSha256: string;
+    };
+    scope: {
+        resourceIdSha256: string;
+        credentialHandleSha256: string;
+    };
+    result: "SATISFIED" | "NOT_SATISFIED" | "NOT_OBSERVED";
+    observation: {
+        fields: SafeFields;
+        digestSha256: string;
+        observedAt: string;
+    };
+    evaluatorIdentity?: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    limitations: string[];
+}
+export interface ProductionOutcomeEvaluator {
+    readonly template: ProductionEvaluatorTemplate;
+    evaluate(request: ProductionEvaluatorRequest): Promise<ProductionEvaluatorObservation>;
+}
+interface CommonOptions {
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential(handle: string): Promise<string>;
+    select(value: Record<string, unknown>): Record<string, unknown>;
+    timeoutMs?: number;
+    now?: () => Date;
+}
+export interface HttpProductionEvaluatorOptions extends CommonOptions {
+    allowedOrigin: string;
+    resourcePath(resourceId: string): string;
+    fetch?: typeof fetch;
+}
+export interface DatabaseReadOnlyEvaluatorOptions extends CommonOptions {
+    statementId: string;
+    executePrepared(input: {
+        statementId: string;
+        parameters: SafeScalar[];
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export interface BrowserWorkflowOutcomeEvaluatorOptions extends CommonOptions {
+    observerIdentity: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    observe(input: {
+        resourceId: string;
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export declare const createCrmRecordStateEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createTicketStatusEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createEmailDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createWebhookDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createQueueJobCompletionEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createPaymentRefundResultEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare function createDatabaseReadOnlyEvaluator(options: DatabaseReadOnlyEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function createBrowserWorkflowOutcomeEvaluator(options: BrowserWorkflowOutcomeEvaluatorOptions): ProductionOutcomeEvaluator;
+export {};
+//# sourceMappingURL=production-evaluator-kit.d.ts.map

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-evaluator-kit.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/production-evaluator-kit.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wCAAwC,EAAG,+CAAwD,CAAC;AACjH,MAAM,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,0BAA0B,CAAC;AAC9N,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AACnD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,WAAW,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,iBAAiB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACxF;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,8BAA+B,SAAQ,aAAa;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,gCAAiC,SAAQ,aAAa;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtJ;AAED,MAAM,WAAW,sCAAuC,SAAQ,aAAa;IAC3E,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,OAAO,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnH;AAED,eAAO,MAAM,6BAA6B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC3I,eAAO,MAAM,2BAA2B,GAAI,SAAS,8BAA8B,+BAAkD,CAAC;AACtI,eAAO,MAAM,4BAA4B,GAAI,SAAS,8BAA8B,+BAAmD,CAAC;AACxI,eAAO,MAAM,8BAA8B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC5I,eAAO,MAAM,iCAAiC,GAAI,SAAS,8BAA8B,+BAAyD,CAAC;AACnJ,eAAO,MAAM,kCAAkC,GAAI,SAAS,8BAA8B,+BAA0D,CAAC;AAErJ,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gCAAgC,GAAG,0BAA0B,CAOrH;AAED,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,sCAAsC,GAAG,0BAA0B,CAGjI"}

package/dist/vendor/onegent-runtime/production-evaluator-kit.js

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { isIP } from "node:net";
+import { canonicalJson } from "./trust-crypto.js";
+export const PRODUCTION_EVALUATOR_OBSERVATION_VERSION = "witnora.production_evaluator_observation.v0.1";
+export const createCrmRecordStateEvaluator = (options) => createHttpEvaluator("CRM_RECORD_STATE", options);
+export const createTicketStatusEvaluator = (options) => createHttpEvaluator("TICKET_STATUS", options);
+export const createEmailDeliveryEvaluator = (options) => createHttpEvaluator("EMAIL_DELIVERY", options);
+export const createWebhookDeliveryEvaluator = (options) => createHttpEvaluator("WEBHOOK_DELIVERY", options);
+export const createQueueJobCompletionEvaluator = (options) => createHttpEvaluator("QUEUE_JOB_COMPLETION", options);
+export const createPaymentRefundResultEvaluator = (options) => createHttpEvaluator("PAYMENT_REFUND_RESULT", options);
+export function createDatabaseReadOnlyEvaluator(options) {
+    validateCommon(options);
+    identifier(options.statementId, "statementId");
+    return evaluator("DATABASE_READ_ONLY", options, async (request, credential, signal) => {
+        const parameters = request.parameters ?? [request.resourceId];
+        if (parameters.length > 20 || parameters.some((value) => typeof value === "string" && value.length > 500))
+            throw new Error("Database evaluator parameters exceed the bounded contract.");
+        return options.executePrepared({ statementId: options.statementId, parameters, credential, signal });
+    });
+}
+export function createBrowserWorkflowOutcomeEvaluator(options) {
+    validateCommon(options);
+    componentIdentity(options.observerIdentity);
+    return evaluator("BROWSER_WORKFLOW_OUTCOME", options, (request, credential, signal) => options.observe({ resourceId: request.resourceId, credential, signal }), options.observerIdentity);
+}
+function createHttpEvaluator(template, options) {
+    validateCommon(options);
+    const origin = safeOrigin(options.allowedOrigin);
+    const requestFetch = options.fetch ?? fetch;
+    return evaluator(template, options, async (request, credential, signal) => {
+        const path = options.resourcePath(request.resourceId);
+        if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//") || path.includes("..") || path.length > 1_000)
+            throw new Error("Evaluator resource path is outside the fixed origin contract.");
+        const url = new URL(path, origin);
+        if (url.origin !== origin)
+            throw new Error("Evaluator resource path changed the fixed origin.");
+        const response = await requestFetch(url, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${credential}` }, redirect: "error", signal });
+        if (!response.ok)
+            throw new Error(`Read-only evaluator returned HTTP ${response.status}.`);
+        const contentLength = Number(response.headers.get("content-length") ?? 0);
+        if (contentLength > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (bytes.length > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Read-only evaluator response must be a JSON object.");
+        return parsed;
+    });
+}
+function evaluator(template, options, observe, evaluatorIdentity) {
+    return Object.freeze({
+        template,
+        async evaluate(request) {
+            const resourceId = identifier(request.resourceId, "resourceId");
+            const criterionId = identifier(request.criterionId, "criterionId");
+            const expected = safeFields(request.expected, "expected");
+            const credential = await options.resolveCredential(options.credentialHandle);
+            if (typeof credential !== "string" || credential.length < 1 || credential.length > 8_192)
+                throw new Error("Read-only evaluator credential was unavailable.");
+            const timeoutMs = boundedTimeout(options.timeoutMs);
+            const raw = await observe({ ...request, resourceId, criterionId, expected }, credential, AbortSignal.timeout(timeoutMs));
+            const fields = safeFields(options.select(raw), "selected observation");
+            const result = Object.entries(expected).every(([key, value]) => Object.is(fields[key], value)) ? "SATISFIED" : "NOT_SATISFIED";
+            const observedAt = (options.now ?? (() => new Date()))().toISOString();
+            return {
+                schemaVersion: PRODUCTION_EVALUATOR_OBSERVATION_VERSION, template, provider: identifier(options.provider, "provider"), environment: options.environment,
+                criterion: { id: criterionId, expectedDigestSha256: sha256(canonicalJson(expected)) },
+                scope: { resourceIdSha256: sha256(resourceId), credentialHandleSha256: sha256(options.credentialHandle) },
+                result, observation: { fields, digestSha256: sha256(canonicalJson(fields)), observedAt },
+                ...(evaluatorIdentity ? { evaluatorIdentity } : {}),
+                limitations: [
+                    "This result proves one bounded read-only observation and does not authorize a write or generalize to future executions.",
+                    "Credentials and raw provider payloads remain in the customer environment; only allowlisted scalar fields and digests are returned.",
+                ],
+            };
+        },
+    });
+}
+function validateCommon(options) {
+    identifier(options.provider, "provider");
+    identifier(options.credentialHandle, "credentialHandle");
+    if (!["sandbox", "staging", "production"].includes(options.environment))
+        throw new Error("environment is invalid.");
+    boundedTimeout(options.timeoutMs);
+}
+function safeOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Evaluator origin is invalid.");
+    }
+    const literalLoopback = (url.hostname === "127.0.0.1" || url.hostname === "[::1]") && isIP(url.hostname.replace(/^\[|\]$/g, ""));
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && literalLoopback))
+        throw new Error("Remote evaluator origins must use HTTPS; local development must use a literal loopback address.");
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        throw new Error("Evaluator origin must contain only scheme, host, and port.");
+    return url.origin;
+}
+function safeFields(value, field) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${field} must be an object.`);
+    const entries = Object.entries(value);
+    if (entries.length > 32)
+        throw new Error(`${field} contains too many fields.`);
+    const result = {};
+    for (const [key, item] of entries.sort(([left], [right]) => left.localeCompare(right))) {
+        if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(key) || /(secret|token|credential|password|authorization|cookie|email|phone|name|address|payload|body|text|prompt)/i.test(key))
+            throw new Error(`${field} contains an unsafe field.`);
+        if (item !== null && typeof item !== "string" && typeof item !== "number" && typeof item !== "boolean")
+            throw new Error(`${field}.${key} must be a scalar.`);
+        if (typeof item === "string" && item.length > 500 || typeof item === "number" && !Number.isFinite(item))
+            throw new Error(`${field}.${key} exceeds the bounded contract.`);
+        result[key] = item;
+    }
+    return result;
+}
+function componentIdentity(value) {
+    identifier(value.id, "observerIdentity.id");
+    identifier(value.version, "observerIdentity.version");
+    if (!/^[a-f0-9]{64}$/.test(value.digestSha256))
+        throw new Error("observerIdentity.digestSha256 is invalid.");
+}
+function identifier(value, field) { if (typeof value !== "string" || !value.trim() || value.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._:/@-]*$/.test(value))
+    throw new Error(`${field} is invalid.`); return value; }
+function boundedTimeout(value = 5_000) { if (!Number.isSafeInteger(value) || value < 100 || value > 10_000)
+    throw new Error("Evaluator timeout must be from 100 to 10000 ms."); return value; }
+function sha256(value) { return createHash("sha256").update(value).digest("hex"); }

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts

@@ -0,0 +1,40 @@
+import type { SourceSigner } from "./trust-types.js";
+export declare const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION: "witnora.signed_change_manifest.v0.1";
+export interface ChangeManifestComponentIdentity {
+    id: string;
+    version: string;
+    digestSha256: string;
+}
+export interface SignedChangeManifestPayload {
+    schemaVersion: typeof SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION;
+    manifestId: string;
+    projectId: string;
+    agentId: string;
+    agentVersion: string;
+    environment: "sandbox" | "staging" | "production";
+    observedAt: string;
+    modelDigest?: string;
+    promptWorkflowDigest?: string;
+    toolManifestDigest?: string;
+    policyRevision?: string;
+    evaluatorIdentity?: ChangeManifestComponentIdentity;
+    adapterIdentity?: ChangeManifestComponentIdentity;
+    previousManifestDigest?: string;
+}
+export interface SignedChangeManifestEnvelope {
+    payload: SignedChangeManifestPayload;
+    signature: {
+        algorithm: "Ed25519";
+        keyId: string;
+        signature: string;
+    };
+}
+export declare function createSignedChangeManifestEnvelope(payload: SignedChangeManifestPayload, signer: SourceSigner): SignedChangeManifestEnvelope;
+export declare function uploadSignedChangeManifest(options: {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    envelope: SignedChangeManifestEnvelope;
+    fetch?: typeof fetch;
+}): Promise<unknown>;
+//# sourceMappingURL=signed-change-manifest.d.ts.map

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-change-manifest.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/signed-change-manifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,eAAO,MAAM,qCAAqC,EAAG,qCAA8C,CAAC;AACpG,MAAM,WAAW,+BAA+B;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,OAAO,qCAAqC,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;IACpD,eAAe,CAAC,EAAE,+BAA+B,CAAC;IAClD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AACD,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,2BAA2B,CAAC;IACrC,SAAS,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,YAAY,GAAG,4BAA4B,CAM3I;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhM"}

package/dist/vendor/onegent-runtime/signed-change-manifest.js

@@ -0,0 +1,22 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { canonicalJson } from "./trust-crypto.js";
+export const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION = "witnora.signed_change_manifest.v0.1";
+export function createSignedChangeManifestEnvelope(payload, signer) {
+    if (payload.schemaVersion !== SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION)
+        throw new Error("Signed Change Manifest schemaVersion is unsupported.");
+    return {
+        payload: structuredClone(payload),
+        signature: { algorithm: "Ed25519", keyId: signer.keyId, signature: sign(null, Buffer.from(canonicalJson(payload)), createPrivateKey(signer.privateKeyPem)).toString("base64url") },
+    };
+}
+export async function uploadSignedChangeManifest(options) {
+    const response = await (options.fetch ?? fetch)(`${options.baseUrl.replace(/\/$/, "")}/v1/projects/${encodeURIComponent(options.projectId)}/change-manifests`, {
+        method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${options.apiKey}` }, body: JSON.stringify(options.envelope), redirect: "error", signal: AbortSignal.timeout(10_000),
+    });
+    const text = await response.text();
+    if (Buffer.byteLength(text) > 256 * 1024)
+        throw new Error("Witnora Change Manifest response exceeded 256 KiB.");
+    if (!response.ok)
+        throw new Error(`Witnora Change Manifest upload returned HTTP ${response.status}.`);
+    return JSON.parse(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.12",
+  "version": "0.14.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -44,6 +44,14 @@
       "types": "./dist/vendor/onegent-runtime/business-task-evaluator.d.ts",
       "import": "./dist/vendor/onegent-runtime/business-task-evaluator.js"
     },
+    "./production-evaluator-kit": {
+      "types": "./dist/vendor/onegent-runtime/production-evaluator-kit.d.ts",
+      "import": "./dist/vendor/onegent-runtime/production-evaluator-kit.js"
+    },
+    "./change-manifest": {
+      "types": "./dist/vendor/onegent-runtime/signed-change-manifest.d.ts",
+      "import": "./dist/vendor/onegent-runtime/signed-change-manifest.js"
+    },
     "./deployment-enforcement": {
       "types": "./dist/internal/control-client/deployment-enforcement.d.ts",
       "import": "./dist/internal/control-client/deployment-enforcement.js"