witnora 0.14.0 → 0.15.1

package/dist/gateway.js

@@ -669,6 +669,7 @@ export async function createConfiguredWorkflowHarness(input) {
                 workerReady: !closing && !lastError,
                 ...(lastTickAt ? { lastTickAt } : {}),
                 ...(lastError ? { lastError } : {}),
+                ...(input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA && input.config.realPathActivations?.length ? { realPathActivations: structuredClone(input.config.realPathActivations) } : {}),
             };
         },
         tick,
@@ -1116,7 +1117,8 @@ export function parseManagedWorkflowHarnessConfig(raw) {
         && Array.isArray(workflowIds);
     const managed = value.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
         && safeRelativeModulePath(value.evaluatorModulePath)
-        && validDigest(value.evaluatorModuleSha256 ?? "");
+        && validDigest(value.evaluatorModuleSha256 ?? "")
+        && validRealPathActivations(value.realPathActivations);
     if (value.enabled !== true || !validDigest(value.evaluatorContractSha256 ?? "") || !workflowIdsValid || (!external && !managed)) {
         throw new Error("workflow-harness.json requires an enabled, digest-pinned literal-loopback evaluator and a local credential handle.");
     }
@@ -1128,6 +1130,25 @@ export function parseManagedWorkflowHarnessConfig(raw) {
     }
     return value;
 }
+function validRealPathActivations(value) {
+    if (value === undefined)
+        return true;
+    if (!Array.isArray(value) || value.length < 1 || value.length > 50)
+        return false;
+    return value.every((item) => Boolean(item && typeof item === "object" && !Array.isArray(item)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.integrationId ?? ""))
+        && validDigest(item.integrationDigestSha256)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.taskContractId ?? ""))
+        && validDigest(item.taskContractDigestSha256)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.agentId ?? ""))
+        && typeof item.agentVersion === "string"
+        && ["sandbox", "staging", "production"].includes(item.environment)
+        && validDigest(item.providerContractDigestSha256)
+        && item.acceptance?.kind === "READ_ONLY_PROVIDER_PREFLIGHT"
+        && item.acceptance?.productionWrites === 0
+        && validDigest(item.acceptance?.observationDigestSha256)
+        && Number.isFinite(Date.parse(item.acceptance?.passedAt ?? ""))));
+}
 export async function activateManagedWorkflowHarness(options) {
     const repository = resolve(options.repository ?? process.cwd());
     const directory = join(repository, ".witnora", "gateway");
@@ -1163,14 +1184,19 @@ export async function activateManagedWorkflowHarness(options) {
         ...(options.workflowIds ? { workflowIds: options.workflowIds } : {}),
         ...(options.pollIntervalMs === undefined ? {} : { pollIntervalMs: options.pollIntervalMs }),
         ...(options.maxConcurrency === undefined ? {} : { maxConcurrency: options.maxConcurrency }),
+        ...(options.realPathActivations?.length ? { realPathActivations: structuredClone(options.realPathActivations) } : {}),
     }));
     const path = join(directory, "workflow-harness.json");
     const serialized = `${JSON.stringify(config, null, 2)}\n`;
     let created = false;
     if (await exists(path)) {
         const current = await readFile(path, "utf8");
-        if (current !== serialized)
-            throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+        if (current !== serialized) {
+            const parsed = parseManagedWorkflowHarnessConfig(current);
+            if (parsed.schemaVersion !== MANAGED_WORKFLOW_HARNESS_SCHEMA || canonicalHarnessConfig(parsed) !== canonicalHarnessConfig(config))
+                throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+            await writeFile(path, serialized, { encoding: "utf8", mode: 0o600 });
+        }
     }
     else {
         await writeFile(path, serialized, { encoding: "utf8", mode: 0o600, flag: "wx" });
@@ -1178,6 +1204,10 @@ export async function activateManagedWorkflowHarness(options) {
     }
     return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created };
 }
+function canonicalHarnessConfig(value) {
+    const { realPathActivations: _activations, ...stable } = value;
+    return JSON.stringify(stable);
+}
 export async function configureManagedWorkflowHarness(options) {
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
     if (!await exists(join(directory, "gateway.json")))

package/dist/internal/control-client/remote-collector.d.ts

@@ -63,6 +63,24 @@ export interface AssuranceHarnessHeartbeat {
     workerReady: boolean;
     lastTickAt?: string;
     lastError?: string;
+    realPathActivations?: RealPathHarnessActivation[];
+}
+export interface RealPathHarnessActivation {
+    integrationId: string;
+    integrationDigestSha256: string;
+    taskContractId: string;
+    taskContractDigestSha256: string;
+    agentId: string;
+    agentVersion: string;
+    environment: "sandbox" | "staging" | "production";
+    providerPackId: string;
+    providerContractDigestSha256: string;
+    acceptance: {
+        kind: "READ_ONLY_PROVIDER_PREFLIGHT";
+        passedAt: string;
+        productionWrites: 0;
+        observationDigestSha256: string;
+    };
 }
 export interface RemoteCollectorClientOptions {
     baseUrl: string;

package/dist/internal/control-client/remote-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAmBvR,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}
+{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAC;IACjH,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IACzF,cAAc,EAAE,MAAM,CAAC;IAAC,4BAA4B,EAAE,MAAM,CAAC;IAC7D,UAAU,EAAE;QAAE,IAAI,EAAE,8BAA8B,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,CAAC,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9H;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAmBvR,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}

package/dist/onboard.js

@@ -10,6 +10,7 @@ import { writeTryEvidence } from "./try.js";
 import { doctorCustomerGateway, activateManagedWorkflowHarness, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
+import { activateRealPathIntegrations } from "./real-path-activation.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -188,8 +189,10 @@ export async function runOnboard(options) {
         }
         const runtimeConfigured = await gatewayHasRuntimeWorker(repositoryPath);
         generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name, runtimeConfigured));
+        const realPathActivation = await activateRealPathIntegrations({ repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey, env: options.env, fetch: requestFetch });
+        generatedFiles.push(...realPathActivation.generatedFiles);
         try {
-            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath });
+            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath, realPathActivations: realPathActivation.activations });
             if (activation.created)
                 generatedFiles.push(activation.path);
             assuranceHarnessChanged = activation.created;
@@ -234,7 +237,7 @@ export async function runOnboard(options) {
             ? "Runtime: LOCAL_SANDBOX_READY. This proves only the generated localhost sandbox loop is ready; it does not establish coverage, CURRENT, or a verified customer outcome.\n"
             : `Runtime: RECORDED_ONLY. ${runtimeReadiness.limitations[0]}\n`);
         output(assuranceHarnessReadiness.state === "ACTIVE"
-            ? "Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.\n"
+            ? `Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.${realPathActivation.activations.length ? ` ${realPathActivation.activations.length} exact Stripe test-mode real-path binding(s) passed read-only preflight.` : ""}\n`
             : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
         output("The self-test remains isolated. The Gateway is ready in the background; run the agent normally. The first source-signed, server-reconciled Gateway run completes onboarding.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,

package/dist/real-path-activation.js

@@ -0,0 +1,100 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+export async function activateRealPathIntegrations(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const request = options.fetch ?? fetch;
+    const base = options.server.replace(/\/$/, "");
+    const response = await request(`${base}/v1/projects/${encodeURIComponent(options.projectId)}/real-path-integrations`, { headers: { authorization: `Bearer ${options.apiKey}` } });
+    if (response.status === 404)
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+    if (!response.ok)
+        throw new Error(`Could not load approved real-path integrations (${response.status}).`);
+    const body = await boundedJson(response);
+    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
+    const plans = approved.filter((plan) => plan.generated.providerPackId === "STRIPE_REFUND" && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
+    if (!plans.length)
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+    const secret = options.env?.STRIPE_SECRET_KEY ?? process.env.STRIPE_SECRET_KEY;
+    if (!secret?.startsWith("sk_test_") || secret.length < 12)
+        throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+    const activations = [];
+    const scenarios = [];
+    for (const plan of plans) {
+        const preflight = await stripePreflight(request, secret, plan, options.now?.() ?? new Date());
+        const acceptance = preflight.acceptance;
+        activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, acceptance });
+        scenarios.push({ plan, value: [preflight.scenario] });
+    }
+    const modulePath = join(repository, "witnora.assurance-harness.mjs");
+    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
+    const source = generatedStripeHarness(plans);
+    const moduleDigestSha256 = sha(source);
+    let created = false;
+    const generatedFiles = [];
+    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const prior = await readFile(manifestPath, "utf8").then((value) => JSON.parse(value)).catch(() => undefined);
+    if (current === undefined) {
+        await writeFile(modulePath, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        created = true;
+        generatedFiles.push(modulePath);
+    }
+    else if (sha(current) !== prior?.moduleDigestSha256)
+        throw new Error("Existing Assurance Harness is customer-modified or belongs to a different integration; refusing to overwrite it.");
+    else if (current !== source) {
+        const temporary = `${modulePath}.${randomUUID()}.tmp`;
+        await writeFile(temporary, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, modulePath);
+        generatedFiles.push(modulePath);
+    }
+    const manifest = { schemaVersion: "witnora.real_path_activation_manifest.v0.1", projectId: options.projectId, moduleDigestSha256, activations };
+    await mkdir(dirname(manifestPath), { recursive: true });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    generatedFiles.push(manifestPath);
+    for (const item of scenarios) {
+        const path = join(repository, ".witnora", "scenarios", `${item.plan.taskContractId}.json`);
+        await mkdir(dirname(path), { recursive: true });
+        try {
+            await writeFile(path, `${JSON.stringify(item.value, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            generatedFiles.push(path);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles };
+}
+async function stripePreflight(request, secret, plan, now) {
+    const response = await request("https://api.stripe.com/v1/refunds?limit=1", { headers: { authorization: `Bearer ${secret}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Stripe test-mode read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    if (body.object !== "list" || !Array.isArray(body.data))
+        throw new Error("Stripe test-mode preflight returned an unexpected contract.");
+    const first = body.data[0] && typeof body.data[0] === "object" && !Array.isArray(body.data[0]) ? body.data[0] : undefined;
+    if (!first || typeof first.id !== "string" || !/^re_[A-Za-z0-9_]{1,200}$/.test(first.id))
+        throw new Error("Stripe test-mode activation requires one existing test refund for the no-write acceptance.");
+    const observation = Object.fromEntries(["status", "amount", "currency", "failure_reason"].flatMap((key) => scalar(first[key]) ? [[key, first[key]]] : []));
+    if (observation[plan.generated.criterion.field] !== plan.generated.criterion.expected)
+        throw new Error("The latest Stripe test refund does not satisfy the approved business success definition.");
+    const parameterDigest = sha(first.id);
+    const resultDigest = sha(canonical(observation));
+    return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `stripe:${sha(first.id).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId: first.id }, inputDigestSha256: sha(canonical({ resourceId: first.id })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: parameterDigest })) } } };
+}
+function generatedStripeHarness(plans) {
+    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
+    return `import {createHash} from "node:crypto";\nimport {readFile} from "node:fs/promises";\nimport {join} from "node:path";\nconst contracts=${JSON.stringify(contracts)};\nconst sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");\nexport function createWitnoraBusinessTaskEvaluatorOptions(context){return {\n loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},\n evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^re_[A-Za-z0-9_]{1,200}$/.test(resourceId))throw new Error("Stripe refund resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");const response=await fetch("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),{headers:{authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Stripe read-only observation failed.");const raw=await response.json();const observed={status:raw.status,amount:raw.amount,currency:raw.currency,failure_reason:raw.failure_reason};const actual=observed[contract.criterion.field];return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}\n};}\n`;
+}
+function parsePlan(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Real-path integration response is invalid."); const plan = value; if (plan.schemaVersion !== "witnora.real_path_integration.v0.1" || !plan.id || !plan.taskContractId || !plan.subject?.agentId || !plan.subject.agentVersion || !plan.generated || plan.generated.boundaries?.rawPayloadUpload !== false || plan.generated.boundaries.rawCredentialUpload !== false || plan.generated.boundaries.evaluatorWrites !== false || plan.generated.boundaries.firstAcceptanceProductionWrites !== 0 || !digest(plan.digestSha256) || !digest(plan.taskContractDigestSha256) || !digest(plan.generated.providerContractDigestSha256))
+    throw new Error("Real-path integration response failed its safety contract."); return plan; }
+async function boundedJson(response) { const text = await response.text(); if (text.length > 1_048_576)
+    throw new Error("Real-path response exceeded the size limit."); const value = JSON.parse(text); if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Real-path response is invalid."); return value; }
+function scalar(value) { return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean"; }
+function digest(value) { return typeof value === "string" && /^[a-f0-9]{64}$/.test(value); }
+function canonical(value) { if (value === null || typeof value !== "object")
+    return JSON.stringify(value); if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`; return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`; }
+function sha(value) { return createHash("sha256").update(value).digest("hex"); }

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts

@@ -0,0 +1,92 @@
+import { type BrowserWorkflowOutcomeEvaluatorOptions, type DatabaseReadOnlyEvaluatorOptions, type HttpProductionEvaluatorOptions, type ProductionOutcomeEvaluator, type ProductionEvaluatorTemplate } from "./production-evaluator-kit.js";
+export declare const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION: "witnora.provider_integration_pack.v0.1";
+export type ProviderIntegrationPackId = "STRIPE_REFUND" | "SALESFORCE_RECORD" | "HUBSPOT_CRM_RECORD" | "ZENDESK_TICKET" | "INTERCOM_TICKET" | "POSTGRES_RECORD" | "MYSQL_RECORD" | "WEBHOOK_DELIVERY" | "QUEUE_JOB" | "EMAIL_DELIVERY" | "BROWSER_WORKFLOW";
+export interface ProviderIntegrationPack {
+    schemaVersion: typeof PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION;
+    id: ProviderIntegrationPackId;
+    provider: string;
+    title: string;
+    template: ProductionEvaluatorTemplate;
+    environments: Array<"sandbox" | "staging" | "production">;
+    credential: {
+        access: "READ_ONLY";
+        scopes: string[];
+        suggestedHandle: string;
+        healthCheck: "RESOURCE_GET" | "PREPARED_SELECT" | "OBSERVER_READ";
+    };
+    fieldAllowlist: string[];
+    commonCriteria: Array<{
+        id: string;
+        question: string;
+        field: string;
+        suggestedValues: Array<string | number | boolean>;
+    }>;
+    endpoint: {
+        origin?: string;
+        configurableOrigin: boolean;
+        resourcePattern: string;
+    };
+    boundaries: {
+        writes: false;
+        redirects: false;
+        rawPayloadUpload: false;
+        rawCredentialUpload: false;
+    };
+    contractDigestSha256: string;
+}
+type HttpPackOptions = {
+    packId: Exclude<ProviderIntegrationPackId, "POSTGRES_RECORD" | "MYSQL_RECORD" | "BROWSER_WORKFLOW">;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: HttpProductionEvaluatorOptions["resolveCredential"];
+    allowedOrigin?: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type DatabasePackOptions = {
+    packId: "POSTGRES_RECORD" | "MYSQL_RECORD";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: DatabaseReadOnlyEvaluatorOptions["resolveCredential"];
+    statementId: string;
+    executePrepared: DatabaseReadOnlyEvaluatorOptions["executePrepared"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+type BrowserPackOptions = {
+    packId: "BROWSER_WORKFLOW";
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential: BrowserWorkflowOutcomeEvaluatorOptions["resolveCredential"];
+    observerIdentity: BrowserWorkflowOutcomeEvaluatorOptions["observerIdentity"];
+    observe: BrowserWorkflowOutcomeEvaluatorOptions["observe"];
+    timeoutMs?: number;
+    now?: () => Date;
+};
+export type CreateProviderPackEvaluatorOptions = HttpPackOptions | DatabasePackOptions | BrowserPackOptions;
+export interface ProviderPackPreflightResult {
+    schemaVersion: "witnora.provider_pack_preflight.v0.1";
+    packId: ProviderIntegrationPackId;
+    state: "READY" | "FIELD_NOT_OBSERVED";
+    productionWrites: 0;
+    credentialResolvedLocally: true;
+    observedFieldNames: string[];
+    observationDigestSha256: string;
+    limitations: string[];
+}
+export declare function listProviderIntegrationPacks(): ProviderIntegrationPack[];
+export declare function getProviderIntegrationPack(id: ProviderIntegrationPackId): ProviderIntegrationPack;
+export declare function createProviderPackEvaluator(options: CreateProviderPackEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function preflightProviderIntegration(input: {
+    evaluator: ProductionOutcomeEvaluator;
+    packId: ProviderIntegrationPackId;
+    resourceId: string;
+    criterion: {
+        id: string;
+        field: string;
+        expected: string | number | boolean | null;
+    };
+}): Promise<ProviderPackPreflightResult>;
+export {};
+//# sourceMappingURL=provider-integration-packs.d.ts.map

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACpF,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAoBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}

package/dist/vendor/onegent-runtime/provider-integration-packs.js

@@ -0,0 +1,76 @@
+import { createHash } from "node:crypto";
+import { createBrowserWorkflowOutcomeEvaluator, createCrmRecordStateEvaluator, createDatabaseReadOnlyEvaluator, createEmailDeliveryEvaluator, createPaymentRefundResultEvaluator, createQueueJobCompletionEvaluator, createTicketStatusEvaluator, createWebhookDeliveryEvaluator, } from "./production-evaluator-kit.js";
+import { canonicalJson } from "./trust-crypto.js";
+export const PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION = "witnora.provider_integration_pack.v0.1";
+const BASE = [
+    pack("STRIPE_REFUND", "stripe", "Stripe refund result", "PAYMENT_REFUND_RESULT", ["sandbox", "production"], ["refunds:read"], "env://STRIPE_SECRET_KEY", ["status", "amount", "currency", "failure_reason"], "/v1/refunds/{resourceId}", "https://api.stripe.com", [criterion("refund-complete", "Which Stripe status means the refund completed?", "status", ["succeeded"])]),
+    pack("SALESFORCE_RECORD", "salesforce", "Salesforce record state", "CRM_RECORD_STATE", ["sandbox", "production"], ["API enabled with object and field read-only permission set"], "env://SALESFORCE_ACCESS_TOKEN", ["Status__c", "Refund_Status__c", "IsClosed", "StageName"], "/services/data/v61.0/sobjects/{object}/{resourceId}", undefined, [criterion("crm-state", "Which Salesforce field and value establish success?", "Status__c", ["Completed", "Approved"])]),
+    pack("HUBSPOT_CRM_RECORD", "hubspot", "HubSpot CRM record", "CRM_RECORD_STATE", ["sandbox", "production"], ["crm.objects.read"], "env://HUBSPOT_ACCESS_TOKEN", ["hs_pipeline_stage", "hs_status", "closedate", "amount"], "/crm/v3/objects/{object}/{resourceId}", "https://api.hubapi.com", [criterion("crm-state", "Which HubSpot property means the business task completed?", "hs_status", ["closed", "completed"])]),
+    pack("ZENDESK_TICKET", "zendesk", "Zendesk ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://ZENDESK_API_TOKEN", ["status", "priority", "type", "via.channel"], "/api/v2/tickets/{resourceId}.json", undefined, [criterion("ticket-complete", "Which Zendesk status means the ticket is complete?", "status", ["solved", "closed"])]),
+    pack("INTERCOM_TICKET", "intercom", "Intercom ticket status", "TICKET_STATUS", ["sandbox", "production"], ["tickets:read"], "env://INTERCOM_ACCESS_TOKEN", ["state", "priority", "ticket_type", "open"], "/tickets/{resourceId}", "https://api.intercom.io", [criterion("ticket-complete", "Which Intercom state means the ticket is complete?", "state", ["closed"])]),
+    pack("POSTGRES_RECORD", "postgresql", "PostgreSQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_POSTGRES_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("MYSQL_RECORD", "mysql", "MySQL prepared read", "DATABASE_READ_ONLY", ["sandbox", "staging", "production"], ["SELECT on approved view"], "env://WITNORA_MYSQL_READ_URL", ["status", "state", "result", "completed", "version"], "prepared://{statementId}", undefined, [criterion("record-state", "Which allowlisted result field proves success?", "status", ["completed", "succeeded"])]),
+    pack("WEBHOOK_DELIVERY", "webhook", "Webhook delivery status", "WEBHOOK_DELIVERY", ["sandbox", "staging", "production"], ["delivery:read"], "env://WITNORA_WEBHOOK_READ_TOKEN", ["status", "delivered", "attempts", "response_code"], "/deliveries/{resourceId}", undefined, [criterion("webhook-delivered", "What delivery state counts as received?", "delivered", [true])]),
+    pack("QUEUE_JOB", "queue", "Queue or job completion", "QUEUE_JOB_COMPLETION", ["sandbox", "staging", "production"], ["jobs:read"], "env://WITNORA_QUEUE_READ_TOKEN", ["status", "completed", "attempts", "result_code"], "/jobs/{resourceId}", undefined, [criterion("job-complete", "What job state means processing completed?", "status", ["completed", "succeeded"])]),
+    pack("EMAIL_DELIVERY", "email", "Email delivery result", "EMAIL_DELIVERY", ["sandbox", "staging", "production"], ["messages:read"], "env://WITNORA_EMAIL_READ_TOKEN", ["status", "delivered", "bounce_type", "response_code"], "/messages/{resourceId}", undefined, [criterion("email-delivered", "What provider state means the message was delivered?", "delivered", [true])]),
+    pack("BROWSER_WORKFLOW", "browser", "Browser workflow outcome", "BROWSER_WORKFLOW_OUTCOME", ["sandbox", "staging", "production"], ["read-only observer"], "file://.witnora/secrets/browser-probe", ["status", "completed", "state", "result"], "observer://{resourceId}", undefined, [criterion("workflow-complete", "Which observable page state means the workflow completed?", "completed", [true])]),
+];
+export function listProviderIntegrationPacks() { return BASE.map((item) => structuredClone(item)); }
+export function getProviderIntegrationPack(id) {
+    const found = BASE.find((item) => item.id === id);
+    if (!found)
+        throw new Error("Provider integration pack is not supported.");
+    return structuredClone(found);
+}
+export function createProviderPackEvaluator(options) {
+    const spec = getProviderIntegrationPack(options.packId);
+    if (!spec.environments.includes(options.environment))
+        throw new Error("Provider pack does not support this environment.");
+    const select = selector(spec.fieldAllowlist);
+    const common = { provider: spec.provider, environment: options.environment, credentialHandle: options.credentialHandle, resolveCredential: options.resolveCredential, select, timeoutMs: options.timeoutMs, now: options.now };
+    if (options.packId === "POSTGRES_RECORD" || options.packId === "MYSQL_RECORD")
+        return createDatabaseReadOnlyEvaluator({ ...common, statementId: options.statementId, executePrepared: options.executePrepared });
+    if (options.packId === "BROWSER_WORKFLOW")
+        return createBrowserWorkflowOutcomeEvaluator({ ...common, observerIdentity: options.observerIdentity, observe: options.observe });
+    const http = options;
+    const origin = http.allowedOrigin ?? spec.endpoint.origin;
+    if (!origin)
+        throw new Error("Provider pack requires the customer-specific HTTPS origin discovered during local setup.");
+    const resourcePath = resourcePathBuilder(spec.endpoint.resourcePattern);
+    const input = { ...common, allowedOrigin: origin, resourcePath, fetch: http.fetch };
+    switch (spec.template) {
+        case "CRM_RECORD_STATE": return createCrmRecordStateEvaluator(input);
+        case "TICKET_STATUS": return createTicketStatusEvaluator(input);
+        case "EMAIL_DELIVERY": return createEmailDeliveryEvaluator(input);
+        case "WEBHOOK_DELIVERY": return createWebhookDeliveryEvaluator(input);
+        case "QUEUE_JOB_COMPLETION": return createQueueJobCompletionEvaluator(input);
+        case "PAYMENT_REFUND_RESULT": return createPaymentRefundResultEvaluator(input);
+        default: throw new Error("Provider pack evaluator template is unsupported.");
+    }
+}
+export async function preflightProviderIntegration(input) {
+    const pack = getProviderIntegrationPack(input.packId);
+    if (!pack.fieldAllowlist.includes(input.criterion.field))
+        throw new Error("Preflight criterion is outside the provider field allowlist.");
+    const observation = await input.evaluator.evaluate({ resourceId: input.resourceId, criterionId: input.criterion.id, expected: { [input.criterion.field]: input.criterion.expected } });
+    const observedFieldNames = Object.keys(observation.observation.fields).sort();
+    return {
+        schemaVersion: "witnora.provider_pack_preflight.v0.1", packId: input.packId,
+        state: observedFieldNames.includes(input.criterion.field) ? "READY" : "FIELD_NOT_OBSERVED",
+        productionWrites: 0, credentialResolvedLocally: true, observedFieldNames,
+        observationDigestSha256: observation.observation.digestSha256,
+        limitations: [...observation.limitations, "Preflight validates one read-only provider observation; it does not approve a production action or establish a release decision."],
+    };
+}
+function pack(id, provider, title, template, environments, scopes, suggestedHandle, fields, resourcePattern, origin, criteria) {
+    const value = { schemaVersion: PROVIDER_INTEGRATION_PACK_SCHEMA_VERSION, id, provider, title, template, environments, credential: { access: "READ_ONLY", scopes, suggestedHandle, healthCheck: template === "DATABASE_READ_ONLY" ? "PREPARED_SELECT" : template === "BROWSER_WORKFLOW_OUTCOME" ? "OBSERVER_READ" : "RESOURCE_GET" }, fieldAllowlist: fields, commonCriteria: criteria, endpoint: { ...(origin ? { origin } : {}), configurableOrigin: !origin, resourcePattern }, boundaries: { writes: false, redirects: false, rawPayloadUpload: false, rawCredentialUpload: false } };
+    const material = { id, fields: [...fields], scopes: [...scopes], environments: [...environments], criteria: criteria.map((item) => ({ id: item.id, field: item.field, values: [...item.suggestedValues] })) };
+    return { ...value, contractDigestSha256: createHash("sha256").update(canonicalJson(material)).digest("hex") };
+}
+function criterion(id, question, field, suggestedValues) { return { id, question, field, suggestedValues }; }
+function selector(fields) {
+    return (value) => Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return selected === undefined ? [] : [[field, selected]]; }));
+}
+function resourcePathBuilder(pattern) {
+    return (resourceId) => pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", "records");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.14.0",
+  "version": "0.15.1",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -48,6 +48,10 @@
       "types": "./dist/vendor/onegent-runtime/production-evaluator-kit.d.ts",
       "import": "./dist/vendor/onegent-runtime/production-evaluator-kit.js"
     },
+    "./provider-integration-packs": {
+      "types": "./dist/vendor/onegent-runtime/provider-integration-packs.d.ts",
+      "import": "./dist/vendor/onegent-runtime/provider-integration-packs.js"
+    },
     "./change-manifest": {
       "types": "./dist/vendor/onegent-runtime/signed-change-manifest.d.ts",
       "import": "./dist/vendor/onegent-runtime/signed-change-manifest.js"