witnora 0.14.0 → 0.15.0

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts

@@ -0,0 +1,92 @@
+import { type BrowserWorkflowOutcomeEvaluatorOptions, type DatabaseReadOnlyEvaluatorOptions, type HttpProductionEvaluatorOptions, type ProductionOutcomeEvaluator, type ProductionEvaluatorTemplate } from "./production-evaluator-kit.js";
+export declare const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION: "witnora.provider_integration_pack.v0.1";
+export type ProviderIntegrationPackId = "STRIPE_REFUND" | "SALESFORCE_RECORD" | "HUBSPOT_CRM_RECORD" | "ZENDESK_TICKET" | "INTERCOM_TICKET" | "POSTGRES_RECORD" | "MYSQL_RECORD" | "WEBHOOK_DELIVERY" | "QUEUE_JOB" | "EMAIL_DELIVERY" | "BROWSER_WORKFLOW";
+export interface ProviderIntegrationPack {
+    schemaVersion: typeof PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION;
+    id: ProviderIntegrationPackId;
+    provider: string;
+    title: string;
+    template: ProductionEvaluatorTemplate;
+    environments: Array<"sandbox" | "staging" | "production">;
+    credential: {
+        access: "READ_ONLY";
+        scopes: string[];
+        suggestedHandle: string;
+        healthCheck: "RESOURCE_GET" | "PREPARED_SELECT" | "OBSERVER_READ";
+    };
+    fieldAllowlist: string[];
+    commonCriteria: Array<{
+        id: string;
+        question: string;
+        field: string;
+        suggestedValues: Array<string | number | boolean>;
+    }>;
+    endpoint: {
+        origin?: string;
+        configurableOrigin: boolean;
+        resourcePattern: string;
+    };
+    boundaries: {
+        writes: false;
+        redirects: false;
+        rawPayloadUpload: false;
+        rawCredentialUpload: false;
+    };
+    contractDigestSha256: string;
+}
+type HttpPackOptions = {
+    packId: Exclude<ProviderIntegrationPackId, "POSTGRES_RECORD" | "MYSQL_RECORD" | "BROWSER_WORKFLOW">;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: HttpProductionEvaluatorOptions["resolveCredential"];
+    allowedOrigin?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type DatabasePackOptions = {
+    packId: "POSTGRES_RECORD" | "MYSQL_RECORD";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: DatabaseReadOnlyEvaluatorOptions["resolveCredential"];
+    statementId: string;
+    executePrepared: DatabaseReadOnlyEvaluatorOptions["executePrepared"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type BrowserPackOptions = {
+    packId: "BROWSER_WORKFLOW";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: BrowserWorkflowOutcomeEvaluatorOptions["resolveCredential"];
+    observerIdentity: BrowserWorkflowOutcomeEvaluatorOptions["observerIdentity"];
+    observe: BrowserWorkflowOutcomeEvaluatorOptions["observe"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+export type CreateProviderPackEvaluatorOptions = HttpPackOptions | DatabasePackOptions | BrowserPackOptions;
+export interface ProviderPackPreflightResult {
+    schemaVersion: "witnora.provider_pack_preflight.v0.1";
+    packId: ProviderIntegrationPackId;
+    state: "READY" | "FIELD_NOT_OBSERVED";
+    productionWrites: 0;
+    credentialResolvedLocally: true;
+    observedFieldNames: string[];
+    observationDigestSha256: string;
+    limitations: string[];
+}
+export declare function listProviderIntegrationPacks(): ProviderIntegrationPack[];
+export declare function getProviderIntegrationPack(id: ProviderIntegrationPackId): ProviderIntegrationPack;
+export declare function createProviderPackEvaluator(options: CreateProviderPackEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function preflightProviderIntegration(input: {
+    evaluator: ProductionOutcomeEvaluator;
+    packId: ProviderIntegrationPackId;
+    resourceId: string;
+    criterion: {
+        id: string;
+        field: string;
+        expected: string | number | boolean | null;
+    };
+}): Promise<ProviderPackPreflightResult>;
+export {};
+//# sourceMappingURL=provider-integration-packs.d.ts.map

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACpF,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAoBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}

package/dist/vendor/onegent-runtime/provider-integration-packs.js

@@ -0,0 +1,76 @@
+import { createHash } from "node:crypto";
+import { createBrowserWorkflowOutcomeEvaluator, createCrmRecordStateEvaluator, createDatabaseReadOnlyEvaluator, createEmailDeliveryEvaluator, createPaymentRefundResultEvaluator, createQueueJobCompletionEvaluator, createTicketStatusEvaluator, createWebhookDeliveryEvaluator, } from "./production-evaluator-kit.js";
+import { canonicalJson } from "./trust-crypto.js";
+export const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION = "witnora.provider_integration_pack.v0.1";
+const BASE = [
+    pack("STRIPE_REFUND", "stripe", "Stripe refund result", "PAYMENT_REFUND_RESULT", ["sandbox", "production"], ["refunds:read"], "env://STRIPE_SECRET_KEY", ["status", "amount", "currency", "failure_reason"], "/v1/refunds/{resourceId}", "https://api.stripe.com", [criterion("refund-complete", "Which Stripe status means the refund completed?", "status", ["succeeded"])]),
+    pack("SALESFORCE_RECORD", "salesforce", "Salesforce record state", "CRM_RECORD_STATE", ["sandbox", "production"], ["API enabled with object and field read-only permission set"], "env://SALESFORCE_ACCESS_TOKEN", ["Status__c", "Refund_Status__c", "IsClosed", "StageName"], "/services/data/v61.0/sobjects/{object}/{resourceId}", undefined, [criterion("crm-state", "Which Salesforce field and value establish success?", "Status__c", ["Completed", "Approved"])]),
+    pack("HUBSPOT_CRM_RECORD", "hubspot", "HubSpot CRM record", "CRM_RECORD_STATE", ["sandbox", "production"], ["crm.objects.read"], "env://HUBSPOT_ACCESS_TOKEN", ["hs_pipeline_stage", "hs_status", "closedate", "amount"], "/crm/v3/objects/{object}/{resourceId}", "https://api.hubapi.com", [criterion("crm-state", "Which HubSpot property means the business task completed?", "hs_status", ["closed", "completed"])]),
+    pack("ZENDESK_TICKET", "zendesk", "Zendesk ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://ZENDESK_API_TOKEN", ["status", "priority", "type", "via.channel"], "/api/v2/tickets/{resourceId}.json", undefined, [criterion("ticket-complete", "Which Zendesk status means the ticket is complete?", "status", ["solved", "closed"])]),
+    pack("INTERCOM_TICKET", "intercom", "Intercom ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://INTERCOM_ACCESS_TOKEN", ["state", "priority", "ticket_type", "open"], "/tickets/{resourceId}", "https://api.intercom.io", [criterion("ticket-complete", "Which Intercom state means the ticket is complete?", "state", ["closed"])]),
+    pack("POSTGRES_RECORD", "postgresql", "PostgreSQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_POSTGRES_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("MYSQL_RECORD", "mysql", "MySQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_MYSQL_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("WEBHOOK_DELIVERY", "webhook", "Webhook delivery status", "WEBHOOK_DELIVERY", ["sandbox", "staging", "production"], ["delivery:read"], "env://WITNORA_WEBHOOK_READ_TOKEN", ["status", "delivered", "attempts", "response_code"], "/deliveries/{resourceId}", undefined, [criterion("webhook-delivered", "What delivery state counts as received?", "delivered", [true])]),
+    pack("QUEUE_JOB", "queue", "Queue or job completion", "QUEUE_JOB_COMPLETION", ["sandbox", "staging", "production"], ["jobs:read"], "env://WITNORA_QUEUE_READ_TOKEN", ["status", "completed", "attempts", "result_code"], "/jobs/{resourceId}", undefined, [criterion("job-complete", "What job state means processing completed?", "status", ["completed", "succeeded"])]),
+    pack("EMAIL_DELIVERY", "email", "Email delivery result", "EMAIL_DELIVERY", ["sandbox", "staging", "production"], ["messages:read"], "env://WITNORA_EMAIL_READ_TOKEN", ["status", "delivered", "bounce_type", "response_code"], "/messages/{resourceId}", undefined, [criterion("email-delivered", "What provider state means the message was delivered?", "delivered", [true])]),
+    pack("BROWSER_WORKFLOW", "browser", "Browser workflow outcome", "BROWSER_WORKFLOW_OUTCOME", ["sandbox", "staging", "production"], ["read-only observer"], "file://.witnora/secrets/browser-probe", ["status", "completed", "state", "result"], "observer://{resourceId}", undefined, [criterion("workflow-complete", "Which observable page state means the workflow completed?", "completed", [true])]),
+];
+export function listProviderIntegrationPacks() { return BASE.map((item) => structuredClone(item)); }
+export function getProviderIntegrationPack(id) {
+    const found = BASE.find((item) => item.id === id);
+    if (!found)
+        throw new Error("Provider integration pack is not supported.");
+    return structuredClone(found);
+}
+export function createProviderPackEvaluator(options) {
+    const spec = getProviderIntegrationPack(options.packId);
+    if (!spec.environments.includes(options.environment))
+        throw new Error("Provider pack does not support this environment.");
+    const select = selector(spec.fieldAllowlist);
+    const common = { provider: spec.provider, environment: options.environment, credentialHandle: options.credentialHandle, resolveCredential: options.resolveCredential, select, timeoutMs: options.timeoutMs, now: options.now };
+    if (options.packId === "POSTGRES_RECORD" || options.packId === "MYSQL_RECORD")
+        return createDatabaseReadOnlyEvaluator({ ...common, statementId: options.statementId, executePrepared: options.executePrepared });
+    if (options.packId === "BROWSER_WORKFLOW")
+        return createBrowserWorkflowOutcomeEvaluator({ ...common, observerIdentity: options.observerIdentity, observe: options.observe });
+    const http = options;
+    const origin = http.allowedOrigin ?? spec.endpoint.origin;
+    if (!origin)
+        throw new Error("Provider pack requires the customer-specific HTTPS origin discovered during local setup.");
+    const resourcePath = resourcePathBuilder(spec.endpoint.resourcePattern);
+    const input = { ...common, allowedOrigin: origin, resourcePath, fetch: http.fetch };
+    switch (spec.template) {
+        case "CRM_RECORD_STATE": return createCrmRecordStateEvaluator(input);
+        case "TICKET_STATUS": return createTicketStatusEvaluator(input);
+        case "EMAIL_DELIVERY": return createEmailDeliveryEvaluator(input);
+        case "WEBHOOK_DELIVERY": return createWebhookDeliveryEvaluator(input);
+        case "QUEUE_JOB_COMPLETION": return createQueueJobCompletionEvaluator(input);
+        case "PAYMENT_REFUND_RESULT": return createPaymentRefundResultEvaluator(input);
+        default: throw new Error("Provider pack evaluator template is unsupported.");
+    }
+}
+export async function preflightProviderIntegration(input) {
+    const pack = getProviderIntegrationPack(input.packId);
+    if (!pack.fieldAllowlist.includes(input.criterion.field))
+        throw new Error("Preflight criterion is outside the provider field allowlist.");
+    const observation = await input.evaluator.evaluate({ resourceId: input.resourceId, criterionId: input.criterion.id, expected: { [input.criterion.field]: input.criterion.expected } });
+    const observedFieldNames = Object.keys(observation.observation.fields).sort();
+    return {
+        schemaVersion: "witnora.provider_pack_preflight.v0.1", packId: input.packId,
+        state: observedFieldNames.includes(input.criterion.field) ? "READY" : "FIELD_NOT_OBSERVED",
+        productionWrites: 0, credentialResolvedLocally: true, observedFieldNames,
+        observationDigestSha256: observation.observation.digestSha256,
+        limitations: [...observation.limitations, "Preflight validates one read-only provider observation; it does not approve a production action or establish a release decision."],
+    };
+}
+function pack(id, provider, title, template, environments, scopes, suggestedHandle, fields, resourcePattern, origin, criteria) {
+    const value = { schemaVersion: PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION, id, provider, title, template, environments, credential: { access: "READ_ONLY", scopes, suggestedHandle, healthCheck: template === "DATABASE_READ_ONLY" ? "PREPARED_SELECT" : template === "BROWSER_WORKFLOW_OUTCOME" ? "OBSERVER_READ" : "RESOURCE_GET" }, fieldAllowlist: fields, commonCriteria: criteria, endpoint: { ...(origin ? { origin } : {}), configurableOrigin: !origin, resourcePattern }, boundaries: { writes: false, redirects: false, rawPayloadUpload: false, rawCredentialUpload: false } };
+    const material = { id, fields: [...fields], scopes: [...scopes], environments: [...environments], criteria: criteria.map((item) => ({ id: item.id, field: item.field, values: [...item.suggestedValues] })) };
+    return { ...value, contractDigestSha256: createHash("sha256").update(canonicalJson(material)).digest("hex") };
+}
+function criterion(id, question, field, suggestedValues) { return { id, question, field, suggestedValues }; }
+function selector(fields) {
+    return (value) => Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return selected === undefined ? [] : [[field, selected]]; }));
+}
+function resourcePathBuilder(pattern) {
+    return (resourceId) => pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", "records");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -48,6 +48,10 @@
       "types": "./dist/vendor/onegent-runtime/production-evaluator-kit.d.ts",
       "import": "./dist/vendor/onegent-runtime/production-evaluator-kit.js"
     },
+    "./provider-integration-packs": {
+      "types": "./dist/vendor/onegent-runtime/provider-integration-packs.d.ts",
+      "import": "./dist/vendor/onegent-runtime/provider-integration-packs.js"
+    },
     "./change-manifest": {
       "types": "./dist/vendor/onegent-runtime/signed-change-manifest.d.ts",
       "import": "./dist/vendor/onegent-runtime/signed-change-manifest.js"