witnora 0.13.12 → 0.15.0

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts

@@ -0,0 +1,85 @@
+export declare const PRODUCTION_EVALUATOR_OBSERVATION_VERSION: "witnora.production_evaluator_observation.v0.1";
+export type ProductionEvaluatorTemplate = "CRM_RECORD_STATE" | "TICKET_STATUS" | "EMAIL_DELIVERY" | "DATABASE_READ_ONLY" | "WEBHOOK_DELIVERY" | "QUEUE_JOB_COMPLETION" | "PAYMENT_REFUND_RESULT" | "BROWSER_WORKFLOW_OUTCOME";
+type SafeScalar = string | number | boolean | null;
+type SafeFields = Record<string, SafeScalar>;
+export interface ProductionEvaluatorRequest {
+    resourceId: string;
+    criterionId: string;
+    expected: SafeFields;
+    parameters?: SafeScalar[];
+}
+export interface ProductionEvaluatorObservation {
+    schemaVersion: typeof PRODUCTION_EVALUATOR_OBSERVATION_VERSION;
+    template: ProductionEvaluatorTemplate;
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    criterion: {
+        id: string;
+        expectedDigestSha256: string;
+    };
+    scope: {
+        resourceIdSha256: string;
+        credentialHandleSha256: string;
+    };
+    result: "SATISFIED" | "NOT_SATISFIED" | "NOT_OBSERVED";
+    observation: {
+        fields: SafeFields;
+        digestSha256: string;
+        observedAt: string;
+    };
+    evaluatorIdentity?: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    limitations: string[];
+}
+export interface ProductionOutcomeEvaluator {
+    readonly template: ProductionEvaluatorTemplate;
+    evaluate(request: ProductionEvaluatorRequest): Promise<ProductionEvaluatorObservation>;
+}
+interface CommonOptions {
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential(handle: string): Promise<string>;
+    select(value: Record<string, unknown>): Record<string, unknown>;
+    timeoutMs?: number;
+    now?: () => Date;
+}
+export interface HttpProductionEvaluatorOptions extends CommonOptions {
+    allowedOrigin: string;
+    resourcePath(resourceId: string): string;
+    fetch?: typeof fetch;
+}
+export interface DatabaseReadOnlyEvaluatorOptions extends CommonOptions {
+    statementId: string;
+    executePrepared(input: {
+        statementId: string;
+        parameters: SafeScalar[];
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export interface BrowserWorkflowOutcomeEvaluatorOptions extends CommonOptions {
+    observerIdentity: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    observe(input: {
+        resourceId: string;
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export declare const createCrmRecordStateEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createTicketStatusEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createEmailDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createWebhookDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createQueueJobCompletionEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createPaymentRefundResultEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare function createDatabaseReadOnlyEvaluator(options: DatabaseReadOnlyEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function createBrowserWorkflowOutcomeEvaluator(options: BrowserWorkflowOutcomeEvaluatorOptions): ProductionOutcomeEvaluator;
+export {};
+//# sourceMappingURL=production-evaluator-kit.d.ts.map

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-evaluator-kit.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/production-evaluator-kit.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wCAAwC,EAAG,+CAAwD,CAAC;AACjH,MAAM,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,0BAA0B,CAAC;AAC9N,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AACnD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,WAAW,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,iBAAiB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACxF;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,8BAA+B,SAAQ,aAAa;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,gCAAiC,SAAQ,aAAa;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtJ;AAED,MAAM,WAAW,sCAAuC,SAAQ,aAAa;IAC3E,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,OAAO,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnH;AAED,eAAO,MAAM,6BAA6B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC3I,eAAO,MAAM,2BAA2B,GAAI,SAAS,8BAA8B,+BAAkD,CAAC;AACtI,eAAO,MAAM,4BAA4B,GAAI,SAAS,8BAA8B,+BAAmD,CAAC;AACxI,eAAO,MAAM,8BAA8B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC5I,eAAO,MAAM,iCAAiC,GAAI,SAAS,8BAA8B,+BAAyD,CAAC;AACnJ,eAAO,MAAM,kCAAkC,GAAI,SAAS,8BAA8B,+BAA0D,CAAC;AAErJ,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gCAAgC,GAAG,0BAA0B,CAOrH;AAED,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,sCAAsC,GAAG,0BAA0B,CAGjI"}

package/dist/vendor/onegent-runtime/production-evaluator-kit.js

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { isIP } from "node:net";
+import { canonicalJson } from "./trust-crypto.js";
+export const PRODUCTION_EVALUATOR_OBSERVATION_VERSION = "witnora.production_evaluator_observation.v0.1";
+export const createCrmRecordStateEvaluator = (options) => createHttpEvaluator("CRM_RECORD_STATE", options);
+export const createTicketStatusEvaluator = (options) => createHttpEvaluator("TICKET_STATUS", options);
+export const createEmailDeliveryEvaluator = (options) => createHttpEvaluator("EMAIL_DELIVERY", options);
+export const createWebhookDeliveryEvaluator = (options) => createHttpEvaluator("WEBHOOK_DELIVERY", options);
+export const createQueueJobCompletionEvaluator = (options) => createHttpEvaluator("QUEUE_JOB_COMPLETION", options);
+export const createPaymentRefundResultEvaluator = (options) => createHttpEvaluator("PAYMENT_REFUND_RESULT", options);
+export function createDatabaseReadOnlyEvaluator(options) {
+    validateCommon(options);
+    identifier(options.statementId, "statementId");
+    return evaluator("DATABASE_READ_ONLY", options, async (request, credential, signal) => {
+        const parameters = request.parameters ?? [request.resourceId];
+        if (parameters.length > 20 || parameters.some((value) => typeof value === "string" && value.length > 500))
+            throw new Error("Database evaluator parameters exceed the bounded contract.");
+        return options.executePrepared({ statementId: options.statementId, parameters, credential, signal });
+    });
+}
+export function createBrowserWorkflowOutcomeEvaluator(options) {
+    validateCommon(options);
+    componentIdentity(options.observerIdentity);
+    return evaluator("BROWSER_WORKFLOW_OUTCOME", options, (request, credential, signal) => options.observe({ resourceId: request.resourceId, credential, signal }), options.observerIdentity);
+}
+function createHttpEvaluator(template, options) {
+    validateCommon(options);
+    const origin = safeOrigin(options.allowedOrigin);
+    const requestFetch = options.fetch ?? fetch;
+    return evaluator(template, options, async (request, credential, signal) => {
+        const path = options.resourcePath(request.resourceId);
+        if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//") || path.includes("..") || path.length > 1_000)
+            throw new Error("Evaluator resource path is outside the fixed origin contract.");
+        const url = new URL(path, origin);
+        if (url.origin !== origin)
+            throw new Error("Evaluator resource path changed the fixed origin.");
+        const response = await requestFetch(url, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${credential}` }, redirect: "error", signal });
+        if (!response.ok)
+            throw new Error(`Read-only evaluator returned HTTP ${response.status}.`);
+        const contentLength = Number(response.headers.get("content-length") ?? 0);
+        if (contentLength > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (bytes.length > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Read-only evaluator response must be a JSON object.");
+        return parsed;
+    });
+}
+function evaluator(template, options, observe, evaluatorIdentity) {
+    return Object.freeze({
+        template,
+        async evaluate(request) {
+            const resourceId = identifier(request.resourceId, "resourceId");
+            const criterionId = identifier(request.criterionId, "criterionId");
+            const expected = safeFields(request.expected, "expected");
+            const credential = await options.resolveCredential(options.credentialHandle);
+            if (typeof credential !== "string" || credential.length < 1 || credential.length > 8_192)
+                throw new Error("Read-only evaluator credential was unavailable.");
+            const timeoutMs = boundedTimeout(options.timeoutMs);
+            const raw = await observe({ ...request, resourceId, criterionId, expected }, credential, AbortSignal.timeout(timeoutMs));
+            const fields = safeFields(options.select(raw), "selected observation");
+            const result = Object.entries(expected).every(([key, value]) => Object.is(fields[key], value)) ? "SATISFIED" : "NOT_SATISFIED";
+            const observedAt = (options.now ?? (() => new Date()))().toISOString();
+            return {
+                schemaVersion: PRODUCTION_EVALUATOR_OBSERVATION_VERSION, template, provider: identifier(options.provider, "provider"), environment: options.environment,
+                criterion: { id: criterionId, expectedDigestSha256: sha256(canonicalJson(expected)) },
+                scope: { resourceIdSha256: sha256(resourceId), credentialHandleSha256: sha256(options.credentialHandle) },
+                result, observation: { fields, digestSha256: sha256(canonicalJson(fields)), observedAt },
+                ...(evaluatorIdentity ? { evaluatorIdentity } : {}),
+                limitations: [
+                    "This result proves one bounded read-only observation and does not authorize a write or generalize to future executions.",
+                    "Credentials and raw provider payloads remain in the customer environment; only allowlisted scalar fields and digests are returned.",
+                ],
+            };
+        },
+    });
+}
+function validateCommon(options) {
+    identifier(options.provider, "provider");
+    identifier(options.credentialHandle, "credentialHandle");
+    if (!["sandbox", "staging", "production"].includes(options.environment))
+        throw new Error("environment is invalid.");
+    boundedTimeout(options.timeoutMs);
+}
+function safeOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Evaluator origin is invalid.");
+    }
+    const literalLoopback = (url.hostname === "127.0.0.1" || url.hostname === "[::1]") && isIP(url.hostname.replace(/^\[|\]$/g, ""));
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && literalLoopback))
+        throw new Error("Remote evaluator origins must use HTTPS; local development must use a literal loopback address.");
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        throw new Error("Evaluator origin must contain only scheme, host, and port.");
+    return url.origin;
+}
+function safeFields(value, field) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${field} must be an object.`);
+    const entries = Object.entries(value);
+    if (entries.length > 32)
+        throw new Error(`${field} contains too many fields.`);
+    const result = {};
+    for (const [key, item] of entries.sort(([left], [right]) => left.localeCompare(right))) {
+        if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(key) || /(secret|token|credential|password|authorization|cookie|email|phone|name|address|payload|body|text|prompt)/i.test(key))
+            throw new Error(`${field} contains an unsafe field.`);
+        if (item !== null && typeof item !== "string" && typeof item !== "number" && typeof item !== "boolean")
+            throw new Error(`${field}.${key} must be a scalar.`);
+        if (typeof item === "string" && item.length > 500 || typeof item === "number" && !Number.isFinite(item))
+            throw new Error(`${field}.${key} exceeds the bounded contract.`);
+        result[key] = item;
+    }
+    return result;
+}
+function componentIdentity(value) {
+    identifier(value.id, "observerIdentity.id");
+    identifier(value.version, "observerIdentity.version");
+    if (!/^[a-f0-9]{64}$/.test(value.digestSha256))
+        throw new Error("observerIdentity.digestSha256 is invalid.");
+}
+function identifier(value, field) { if (typeof value !== "string" || !value.trim() || value.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._:/@-]*$/.test(value))
+    throw new Error(`${field} is invalid.`); return value; }
+function boundedTimeout(value = 5_000) { if (!Number.isSafeInteger(value) || value < 100 || value > 10_000)
+    throw new Error("Evaluator timeout must be from 100 to 10000 ms."); return value; }
+function sha256(value) { return createHash("sha256").update(value).digest("hex"); }

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts

@@ -0,0 +1,92 @@
+import { type BrowserWorkflowOutcomeEvaluatorOptions, type DatabaseReadOnlyEvaluatorOptions, type HttpProductionEvaluatorOptions, type ProductionOutcomeEvaluator, type ProductionEvaluatorTemplate } from "./production-evaluator-kit.js";
+export declare const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION: "witnora.provider_integration_pack.v0.1";
+export type ProviderIntegrationPackId = "STRIPE_REFUND" | "SALESFORCE_RECORD" | "HUBSPOT_CRM_RECORD" | "ZENDESK_TICKET" | "INTERCOM_TICKET" | "POSTGRES_RECORD" | "MYSQL_RECORD" | "WEBHOOK_DELIVERY" | "QUEUE_JOB" | "EMAIL_DELIVERY" | "BROWSER_WORKFLOW";
+export interface ProviderIntegrationPack {
+    schemaVersion: typeof PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION;
+    id: ProviderIntegrationPackId;
+    provider: string;
+    title: string;
+    template: ProductionEvaluatorTemplate;
+    environments: Array<"sandbox" | "staging" | "production">;
+    credential: {
+        access: "READ_ONLY";
+        scopes: string[];
+        suggestedHandle: string;
+        healthCheck: "RESOURCE_GET" | "PREPARED_SELECT" | "OBSERVER_READ";
+    };
+    fieldAllowlist: string[];
+    commonCriteria: Array<{
+        id: string;
+        question: string;
+        field: string;
+        suggestedValues: Array<string | number | boolean>;
+    }>;
+    endpoint: {
+        origin?: string;
+        configurableOrigin: boolean;
+        resourcePattern: string;
+    };
+    boundaries: {
+        writes: false;
+        redirects: false;
+        rawPayloadUpload: false;
+        rawCredentialUpload: false;
+    };
+    contractDigestSha256: string;
+}
+type HttpPackOptions = {
+    packId: Exclude<ProviderIntegrationPackId, "POSTGRES_RECORD" | "MYSQL_RECORD" | "BROWSER_WORKFLOW">;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: HttpProductionEvaluatorOptions["resolveCredential"];
+    allowedOrigin?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type DatabasePackOptions = {
+    packId: "POSTGRES_RECORD" | "MYSQL_RECORD";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: DatabaseReadOnlyEvaluatorOptions["resolveCredential"];
+    statementId: string;
+    executePrepared: DatabaseReadOnlyEvaluatorOptions["executePrepared"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type BrowserPackOptions = {
+    packId: "BROWSER_WORKFLOW";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: BrowserWorkflowOutcomeEvaluatorOptions["resolveCredential"];
+    observerIdentity: BrowserWorkflowOutcomeEvaluatorOptions["observerIdentity"];
+    observe: BrowserWorkflowOutcomeEvaluatorOptions["observe"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+export type CreateProviderPackEvaluatorOptions = HttpPackOptions | DatabasePackOptions | BrowserPackOptions;
+export interface ProviderPackPreflightResult {
+    schemaVersion: "witnora.provider_pack_preflight.v0.1";
+    packId: ProviderIntegrationPackId;
+    state: "READY" | "FIELD_NOT_OBSERVED";
+    productionWrites: 0;
+    credentialResolvedLocally: true;
+    observedFieldNames: string[];
+    observationDigestSha256: string;
+    limitations: string[];
+}
+export declare function listProviderIntegrationPacks(): ProviderIntegrationPack[];
+export declare function getProviderIntegrationPack(id: ProviderIntegrationPackId): ProviderIntegrationPack;
+export declare function createProviderPackEvaluator(options: CreateProviderPackEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function preflightProviderIntegration(input: {
+    evaluator: ProductionOutcomeEvaluator;
+    packId: ProviderIntegrationPackId;
+    resourceId: string;
+    criterion: {
+        id: string;
+        field: string;
+        expected: string | number | boolean | null;
+    };
+}): Promise<ProviderPackPreflightResult>;
+export {};
+//# sourceMappingURL=provider-integration-packs.d.ts.map

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACpF,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAoBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}

package/dist/vendor/onegent-runtime/provider-integration-packs.js

@@ -0,0 +1,76 @@
+import { createHash } from "node:crypto";
+import { createBrowserWorkflowOutcomeEvaluator, createCrmRecordStateEvaluator, createDatabaseReadOnlyEvaluator, createEmailDeliveryEvaluator, createPaymentRefundResultEvaluator, createQueueJobCompletionEvaluator, createTicketStatusEvaluator, createWebhookDeliveryEvaluator, } from "./production-evaluator-kit.js";
+import { canonicalJson } from "./trust-crypto.js";
+export const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION = "witnora.provider_integration_pack.v0.1";
+const BASE = [
+    pack("STRIPE_REFUND", "stripe", "Stripe refund result", "PAYMENT_REFUND_RESULT", ["sandbox", "production"], ["refunds:read"], "env://STRIPE_SECRET_KEY", ["status", "amount", "currency", "failure_reason"], "/v1/refunds/{resourceId}", "https://api.stripe.com", [criterion("refund-complete", "Which Stripe status means the refund completed?", "status", ["succeeded"])]),
+    pack("SALESFORCE_RECORD", "salesforce", "Salesforce record state", "CRM_RECORD_STATE", ["sandbox", "production"], ["API enabled with object and field read-only permission set"], "env://SALESFORCE_ACCESS_TOKEN", ["Status__c", "Refund_Status__c", "IsClosed", "StageName"], "/services/data/v61.0/sobjects/{object}/{resourceId}", undefined, [criterion("crm-state", "Which Salesforce field and value establish success?", "Status__c", ["Completed", "Approved"])]),
+    pack("HUBSPOT_CRM_RECORD", "hubspot", "HubSpot CRM record", "CRM_RECORD_STATE", ["sandbox", "production"], ["crm.objects.read"], "env://HUBSPOT_ACCESS_TOKEN", ["hs_pipeline_stage", "hs_status", "closedate", "amount"], "/crm/v3/objects/{object}/{resourceId}", "https://api.hubapi.com", [criterion("crm-state", "Which HubSpot property means the business task completed?", "hs_status", ["closed", "completed"])]),
+    pack("ZENDESK_TICKET", "zendesk", "Zendesk ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://ZENDESK_API_TOKEN", ["status", "priority", "type", "via.channel"], "/api/v2/tickets/{resourceId}.json", undefined, [criterion("ticket-complete", "Which Zendesk status means the ticket is complete?", "status", ["solved", "closed"])]),
+    pack("INTERCOM_TICKET", "intercom", "Intercom ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://INTERCOM_ACCESS_TOKEN", ["state", "priority", "ticket_type", "open"], "/tickets/{resourceId}", "https://api.intercom.io", [criterion("ticket-complete", "Which Intercom state means the ticket is complete?", "state", ["closed"])]),
+    pack("POSTGRES_RECORD", "postgresql", "PostgreSQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_POSTGRES_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("MYSQL_RECORD", "mysql", "MySQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_MYSQL_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("WEBHOOK_DELIVERY", "webhook", "Webhook delivery status", "WEBHOOK_DELIVERY", ["sandbox", "staging", "production"], ["delivery:read"], "env://WITNORA_WEBHOOK_READ_TOKEN", ["status", "delivered", "attempts", "response_code"], "/deliveries/{resourceId}", undefined, [criterion("webhook-delivered", "What delivery state counts as received?", "delivered", [true])]),
+    pack("QUEUE_JOB", "queue", "Queue or job completion", "QUEUE_JOB_COMPLETION", ["sandbox", "staging", "production"], ["jobs:read"], "env://WITNORA_QUEUE_READ_TOKEN", ["status", "completed", "attempts", "result_code"], "/jobs/{resourceId}", undefined, [criterion("job-complete", "What job state means processing completed?", "status", ["completed", "succeeded"])]),
+    pack("EMAIL_DELIVERY", "email", "Email delivery result", "EMAIL_DELIVERY", ["sandbox", "staging", "production"], ["messages:read"], "env://WITNORA_EMAIL_READ_TOKEN", ["status", "delivered", "bounce_type", "response_code"], "/messages/{resourceId}", undefined, [criterion("email-delivered", "What provider state means the message was delivered?", "delivered", [true])]),
+    pack("BROWSER_WORKFLOW", "browser", "Browser workflow outcome", "BROWSER_WORKFLOW_OUTCOME", ["sandbox", "staging", "production"], ["read-only observer"], "file://.witnora/secrets/browser-probe", ["status", "completed", "state", "result"], "observer://{resourceId}", undefined, [criterion("workflow-complete", "Which observable page state means the workflow completed?", "completed", [true])]),
+];
+export function listProviderIntegrationPacks() { return BASE.map((item) => structuredClone(item)); }
+export function getProviderIntegrationPack(id) {
+    const found = BASE.find((item) => item.id === id);
+    if (!found)
+        throw new Error("Provider integration pack is not supported.");
+    return structuredClone(found);
+}
+export function createProviderPackEvaluator(options) {
+    const spec = getProviderIntegrationPack(options.packId);
+    if (!spec.environments.includes(options.environment))
+        throw new Error("Provider pack does not support this environment.");
+    const select = selector(spec.fieldAllowlist);
+    const common = { provider: spec.provider, environment: options.environment, credentialHandle: options.credentialHandle, resolveCredential: options.resolveCredential, select, timeoutMs: options.timeoutMs, now: options.now };
+    if (options.packId === "POSTGRES_RECORD" || options.packId === "MYSQL_RECORD")
+        return createDatabaseReadOnlyEvaluator({ ...common, statementId: options.statementId, executePrepared: options.executePrepared });
+    if (options.packId === "BROWSER_WORKFLOW")
+        return createBrowserWorkflowOutcomeEvaluator({ ...common, observerIdentity: options.observerIdentity, observe: options.observe });
+    const http = options;
+    const origin = http.allowedOrigin ?? spec.endpoint.origin;
+    if (!origin)
+        throw new Error("Provider pack requires the customer-specific HTTPS origin discovered during local setup.");
+    const resourcePath = resourcePathBuilder(spec.endpoint.resourcePattern);
+    const input = { ...common, allowedOrigin: origin, resourcePath, fetch: http.fetch };
+    switch (spec.template) {
+        case "CRM_RECORD_STATE": return createCrmRecordStateEvaluator(input);
+        case "TICKET_STATUS": return createTicketStatusEvaluator(input);
+        case "EMAIL_DELIVERY": return createEmailDeliveryEvaluator(input);
+        case "WEBHOOK_DELIVERY": return createWebhookDeliveryEvaluator(input);
+        case "QUEUE_JOB_COMPLETION": return createQueueJobCompletionEvaluator(input);
+        case "PAYMENT_REFUND_RESULT": return createPaymentRefundResultEvaluator(input);
+        default: throw new Error("Provider pack evaluator template is unsupported.");
+    }
+}
+export async function preflightProviderIntegration(input) {
+    const pack = getProviderIntegrationPack(input.packId);
+    if (!pack.fieldAllowlist.includes(input.criterion.field))
+        throw new Error("Preflight criterion is outside the provider field allowlist.");
+    const observation = await input.evaluator.evaluate({ resourceId: input.resourceId, criterionId: input.criterion.id, expected: { [input.criterion.field]: input.criterion.expected } });
+    const observedFieldNames = Object.keys(observation.observation.fields).sort();
+    return {
+        schemaVersion: "witnora.provider_pack_preflight.v0.1", packId: input.packId,
+        state: observedFieldNames.includes(input.criterion.field) ? "READY" : "FIELD_NOT_OBSERVED",
+        productionWrites: 0, credentialResolvedLocally: true, observedFieldNames,
+        observationDigestSha256: observation.observation.digestSha256,
+        limitations: [...observation.limitations, "Preflight validates one read-only provider observation; it does not approve a production action or establish a release decision."],
+    };
+}
+function pack(id, provider, title, template, environments, scopes, suggestedHandle, fields, resourcePattern, origin, criteria) {
+    const value = { schemaVersion: PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION, id, provider, title, template, environments, credential: { access: "READ_ONLY", scopes, suggestedHandle, healthCheck: template === "DATABASE_READ_ONLY" ? "PREPARED_SELECT" : template === "BROWSER_WORKFLOW_OUTCOME" ? "OBSERVER_READ" : "RESOURCE_GET" }, fieldAllowlist: fields, commonCriteria: criteria, endpoint: { ...(origin ? { origin } : {}), configurableOrigin: !origin, resourcePattern }, boundaries: { writes: false, redirects: false, rawPayloadUpload: false, rawCredentialUpload: false } };
+    const material = { id, fields: [...fields], scopes: [...scopes], environments: [...environments], criteria: criteria.map((item) => ({ id: item.id, field: item.field, values: [...item.suggestedValues] })) };
+    return { ...value, contractDigestSha256: createHash("sha256").update(canonicalJson(material)).digest("hex") };
+}
+function criterion(id, question, field, suggestedValues) { return { id, question, field, suggestedValues }; }
+function selector(fields) {
+    return (value) => Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return selected === undefined ? [] : [[field, selected]]; }));
+}
+function resourcePathBuilder(pattern) {
+    return (resourceId) => pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", "records");
+}

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts

@@ -0,0 +1,40 @@
+import type { SourceSigner } from "./trust-types.js";
+export declare const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION: "witnora.signed_change_manifest.v0.1";
+export interface ChangeManifestComponentIdentity {
+    id: string;
+    version: string;
+    digestSha256: string;
+}
+export interface SignedChangeManifestPayload {
+    schemaVersion: typeof SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION;
+    manifestId: string;
+    projectId: string;
+    agentId: string;
+    agentVersion: string;
+    environment: "sandbox" | "staging" | "production";
+    observedAt: string;
+    modelDigest?: string;
+    promptWorkflowDigest?: string;
+    toolManifestDigest?: string;
+    policyRevision?: string;
+    evaluatorIdentity?: ChangeManifestComponentIdentity;
+    adapterIdentity?: ChangeManifestComponentIdentity;
+    previousManifestDigest?: string;
+}
+export interface SignedChangeManifestEnvelope {
+    payload: SignedChangeManifestPayload;
+    signature: {
+        algorithm: "Ed25519";
+        keyId: string;
+        signature: string;
+    };
+}
+export declare function createSignedChangeManifestEnvelope(payload: SignedChangeManifestPayload, signer: SourceSigner): SignedChangeManifestEnvelope;
+export declare function uploadSignedChangeManifest(options: {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    envelope: SignedChangeManifestEnvelope;
+    fetch?: typeof fetch;
+}): Promise<unknown>;
+//# sourceMappingURL=signed-change-manifest.d.ts.map

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-change-manifest.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/signed-change-manifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,eAAO,MAAM,qCAAqC,EAAG,qCAA8C,CAAC;AACpG,MAAM,WAAW,+BAA+B;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,OAAO,qCAAqC,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;IACpD,eAAe,CAAC,EAAE,+BAA+B,CAAC;IAClD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AACD,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,2BAA2B,CAAC;IACrC,SAAS,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,YAAY,GAAG,4BAA4B,CAM3I;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhM"}

package/dist/vendor/onegent-runtime/signed-change-manifest.js

@@ -0,0 +1,22 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { canonicalJson } from "./trust-crypto.js";
+export const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION = "witnora.signed_change_manifest.v0.1";
+export function createSignedChangeManifestEnvelope(payload, signer) {
+    if (payload.schemaVersion !== SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION)
+        throw new Error("Signed Change Manifest schemaVersion is unsupported.");
+    return {
+        payload: structuredClone(payload),
+        signature: { algorithm: "Ed25519", keyId: signer.keyId, signature: sign(null, Buffer.from(canonicalJson(payload)), createPrivateKey(signer.privateKeyPem)).toString("base64url") },
+    };
+}
+export async function uploadSignedChangeManifest(options) {
+    const response = await (options.fetch ?? fetch)(`${options.baseUrl.replace(/\/$/, "")}/v1/projects/${encodeURIComponent(options.projectId)}/change-manifests`, {
+        method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${options.apiKey}` }, body: JSON.stringify(options.envelope), redirect: "error", signal: AbortSignal.timeout(10_000),
+    });
+    const text = await response.text();
+    if (Buffer.byteLength(text) > 256 * 1024)
+        throw new Error("Witnora Change Manifest response exceeded 256 KiB.");
+    if (!response.ok)
+        throw new Error(`Witnora Change Manifest upload returned HTTP ${response.status}.`);
+    return JSON.parse(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.12",
+  "version": "0.15.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -44,6 +44,18 @@
       "types": "./dist/vendor/onegent-runtime/business-task-evaluator.d.ts",
       "import": "./dist/vendor/onegent-runtime/business-task-evaluator.js"
     },
+    "./production-evaluator-kit": {
+      "types": "./dist/vendor/onegent-runtime/production-evaluator-kit.d.ts",
+      "import": "./dist/vendor/onegent-runtime/production-evaluator-kit.js"
+    },
+    "./provider-integration-packs": {
+      "types": "./dist/vendor/onegent-runtime/provider-integration-packs.d.ts",
+      "import": "./dist/vendor/onegent-runtime/provider-integration-packs.js"
+    },
+    "./change-manifest": {
+      "types": "./dist/vendor/onegent-runtime/signed-change-manifest.d.ts",
+      "import": "./dist/vendor/onegent-runtime/signed-change-manifest.js"
+    },
     "./deployment-enforcement": {
       "types": "./dist/internal/control-client/deployment-enforcement.d.ts",
       "import": "./dist/internal/control-client/deployment-enforcement.js"