witnora 0.15.0 → 0.16.0

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
 import { validateEvidenceArtifacts } from "./artifact-validation.js";
 import { renderAgentCertBadge } from "./badge.js";
 import { buildEvidenceBundle } from "./bundle.js";
@@ -39,7 +40,8 @@ import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
+import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, superviseManagedCustomerGateway, } from "./gateway.js";
+import { installCurrentGatewayService, restartCurrentGatewayService, uninstallCurrentGatewayService } from "./gateway-service.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -224,6 +226,37 @@ else if (command === "gateway") {
         const result = await restartManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderManagedGatewayStatus(result));
     }
+    else if (action === "repair") {
+        const repository = readFlag("--repo") ?? process.cwd();
+        const dir = readFlag("--dir");
+        const service = await installCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
+        await restartCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
+        const result = await startManagedCustomerGateway({ repository, dir });
+        const doctor = await doctorCustomerGateway({ repository, dir });
+        if (!isGatewayDoctorReady(doctor))
+            throw new Error(`Connection repair did not restore a ready Gateway. ${doctor.nextAction}`);
+        process.stdout.write(`Connection repaired. ${service.plan.kind} ${service.plan.id} is installed and the Gateway is healthy.\n`);
+        process.stdout.write(renderManagedGatewayStatus(result));
+    }
+    else if (action === "service") {
+        const serviceAction = process.argv[4] ?? "install";
+        const repository = readFlag("--repo") ?? process.cwd();
+        const gatewayDirectory = readFlag("--dir");
+        const cliEntry = fileURLToPath(import.meta.url);
+        if (serviceAction === "install") {
+            const result = await installCurrentGatewayService({ repository, gatewayDirectory, cliEntry });
+            process.stdout.write(`Installed ${result.plan.kind} service ${result.plan.id}.\n`);
+        }
+        else if (serviceAction === "uninstall") {
+            const result = await uninstallCurrentGatewayService({ repository, gatewayDirectory, cliEntry });
+            process.stdout.write(`Removed Gateway service ${result.plan.id}.\n`);
+        }
+        else
+            throw new Error("Use witnora gateway service install|uninstall.");
+    }
+    else if (action === "supervise") {
+        await superviseManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), output: (message) => process.stdout.write(message) });
+    }
     else if (action === "stop") {
         const result = await stopManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderManagedGatewayStatus(result));
@@ -249,7 +282,7 @@ else if (command === "gateway") {
         process.stdout.write(`Configured the Managed Workflow Harness for ${result.config.workflowIds?.length ?? "all active"} Workflow Contract(s).\nConfig: ${result.path}\nRestart the managed Gateway to activate it.\n`);
     }
     else {
-        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|stop|run|workflow-harness.");
+        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|repair|service|stop|run|workflow-harness.");
     }
 }
 else if (command === "discover") {

package/dist/command-help.js

@@ -63,6 +63,8 @@ Options:
   witnora gateway status
   witnora gateway logs [--lines 100]
   witnora gateway restart
+  witnora gateway repair
+  witnora gateway service install|uninstall
   witnora gateway stop
   witnora gateway run
   witnora gateway workflow-harness --workflow <id> --evaluator-origin http://127.0.0.1:<port>/ \\
@@ -71,8 +73,10 @@ Options:
 Initializes and manages a customer-owned, metadata-only collector beside the Agent.
 The browser approval issues a collector-scoped credential; no API key is copied into
 the repository or exposed to the Agent. The local queue and source signing key remain
-under customer control. Onboard uses background start by default. The run command is
-the foreground debugging path.
+under customer control. The service command installs an OS-native auto-start and restart
+boundary. Repair safely reinstalls that boundary, restarts the existing generated Gateway,
+and reruns digest, credential, Probe, and health checks. The run command is the foreground
+debugging path.
 
 The reference Gateway establishes RECORDED evidence only. ENFORCED requires target
 write credentials behind a controlled execution adapter. OUTCOME VERIFIED requires a

package/dist/gateway-service.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function installGatewayService(input) {
+    const plan = createGatewayServicePlan(input);
+    await input.writeDefinition(plan.definitionPath, plan.definition);
+    if (plan.kind === "SYSTEMD_USER")
+        await input.run("systemctl", ["--user", "daemon-reload"]);
+    await input.run(plan.install.command, plan.install.args);
+    if (plan.kind !== "SYSTEMD_USER")
+        await input.run(plan.start.command, plan.start.args);
+    return { installed: true, plan };
+}
+export async function installCurrentGatewayService(options) {
+    const planInput = currentPlanInput(options);
+    return installGatewayService({ ...planInput,
+        writeDefinition: async (path, value) => { await mkdir(dirname(path), { recursive: true }); await writeFile(path, value, { encoding: "utf8", mode: 0o600 }); },
+        run: options.run ?? runCommand,
+    });
+}
+export async function uninstallCurrentGatewayService(options) {
+    const plan = createGatewayServicePlan(currentPlanInput(options));
+    const run = options.run ?? runCommand;
+    await run(plan.uninstall.command, plan.uninstall.args);
+    if (plan.kind === "SYSTEMD_USER")
+        await run("systemctl", ["--user", "daemon-reload"]);
+    await rm(plan.definitionPath, { force: true });
+    return { uninstalled: true, plan };
+}
+export async function restartCurrentGatewayService(options) {
+    const plan = createGatewayServicePlan(currentPlanInput(options));
+    const run = options.run ?? runCommand;
+    await run(plan.stop.command, plan.stop.args).catch(() => undefined);
+    await run(plan.start.command, plan.start.args);
+    return plan;
+}
+export function createGatewayServicePlan(input) {
+    const suffix = createHash("sha256").update(`${input.repository}\n${input.gatewayDirectory}`).digest("hex").slice(0, 12);
+    const id = `witnora-gateway-${suffix}`;
+    const superviseArgs = [input.cliEntry, "gateway", "supervise", "--repo", input.repository, "--dir", input.gatewayDirectory];
+    if (input.platform === "win32")
+        return windowsPlan(input, id, superviseArgs);
+    if (input.platform === "darwin")
+        return launchdPlan(input, id, superviseArgs);
+    if (input.platform === "linux")
+        return systemdPlan(input, id, superviseArgs);
+    throw new Error(`Gateway service installation is not supported on ${input.platform}.`);
+}
+function windowsPlan(input, id, args) {
+    const definitionPath = `${input.serviceHome}\\${id}.xml`;
+    const argumentsValue = args.map(windowsArgument).join(" ");
+    const definition = `<?xml version="1.0" encoding="UTF-8"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml(input.userId)}</UserId></LogonTrigger></Triggers>
+  <Principals><Principal id="Author"><UserId>${xml(input.userId)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><StartWhenAvailable>true</StartWhenAvailable><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure></Settings>
+  <Actions Context="Author"><Exec><Command>${xml(input.nodeExecutable)}</Command><Arguments>${xml(argumentsValue)}</Arguments><WorkingDirectory>${xml(input.repository)}</WorkingDirectory></Exec></Actions>
+</Task>`;
+    return { id, kind: "WINDOWS_TASK", definitionPath, definition,
+        install: { command: "schtasks.exe", args: ["/Create", "/TN", id, "/XML", definitionPath, "/F"] },
+        start: { command: "schtasks.exe", args: ["/Run", "/TN", id] },
+        stop: { command: "schtasks.exe", args: ["/End", "/TN", id] },
+        uninstall: { command: "schtasks.exe", args: ["/Delete", "/TN", id, "/F"] } };
+}
+function currentPlanInput(options) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "win32" && platform !== "linux" && platform !== "darwin")
+        throw new Error(`Gateway service installation is not supported on ${platform}.`);
+    const repository = resolve(options.repository ?? process.cwd());
+    const env = options.env ?? process.env;
+    const serviceHome = platform === "win32" ? join(env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "Witnora", "services")
+        : platform === "darwin" ? join(homedir(), "Library", "LaunchAgents") : join(homedir(), ".config", "systemd", "user");
+    return { platform, repository, gatewayDirectory: resolve(repository, options.gatewayDirectory ?? ".witnora/gateway"), cliEntry: resolve(options.cliEntry), nodeExecutable: options.nodeExecutable ?? process.execPath, serviceHome, userId: platform === "win32" ? `${env.USERDOMAIN ? `${env.USERDOMAIN}\\` : ""}${env.USERNAME ?? userInfo().username}` : userInfo().username };
+}
+async function runCommand(command, args) { await execFileAsync(command, args, { windowsHide: true }); }
+function systemdPlan(input, id, args) {
+    const unit = `${id}.service`;
+    const definitionPath = `${input.serviceHome}/${unit}`;
+    const definition = `[Unit]\nDescription=Witnora customer-owned Gateway\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nWorkingDirectory=${systemd(input.repository)}\nExecStart=${[input.nodeExecutable, ...args].map(systemd).join(" ")}\nRestart=always\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
+    return { id, kind: "SYSTEMD_USER", definitionPath, definition,
+        install: { command: "systemctl", args: ["--user", "enable", "--now", unit] },
+        start: { command: "systemctl", args: ["--user", "start", unit] },
+        stop: { command: "systemctl", args: ["--user", "stop", unit] },
+        uninstall: { command: "systemctl", args: ["--user", "disable", "--now", unit] } };
+}
+function launchdPlan(input, id, args) {
+    const label = `com.witnora.${id}`;
+    const definitionPath = `${input.serviceHome}/${label}.plist`;
+    const programArguments = [input.nodeExecutable, ...args].map((value) => `<string>${xml(value)}</string>`).join("");
+    const definition = `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array>${programArguments}</array><key>WorkingDirectory</key><string>${xml(input.repository)}</string><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>5</integer></dict></plist>`;
+    const domain = `gui/${process.getuid?.() ?? input.userId}`;
+    return { id, kind: "LAUNCHD_AGENT", definitionPath, definition,
+        install: { command: "launchctl", args: ["bootstrap", domain, definitionPath] },
+        start: { command: "launchctl", args: ["kickstart", `${domain}/${label}`] },
+        stop: { command: "launchctl", args: ["kill", "SIGTERM", `${domain}/${label}`] },
+        uninstall: { command: "launchctl", args: ["bootout", domain, definitionPath] } };
+}
+function windowsArgument(value) { return `"${value.replaceAll('"', '\\"')}"`; }
+function systemd(value) { return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`; }
+function xml(value) { return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;"); }

package/dist/gateway.js

@@ -514,6 +514,10 @@ export async function runCustomerGateway(options) {
             host: process.env.WITNORA_GATEWAY_HOST?.trim() || config.host,
             port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, config.port),
             environment: "customer-owned",
+            onRepairRequested: async ({ requestId }) => {
+                process.stderr.write(`Hosted connection repair ${requestId} requested a verified Gateway restart.\n`);
+                setTimeout(() => process.exit(75), 25).unref();
+            },
             ...(actionWorker && config.runtimeWorker ? { actionWorker: {
                     track: (input) => isConfiguredRuntimeProposal(input.proposal, config.runtimeWorker) ? actionWorker.track(input) : Promise.resolve(undefined),
                     status: async () => {
@@ -669,6 +673,7 @@ export async function createConfiguredWorkflowHarness(input) {
                 workerReady: !closing && !lastError,
                 ...(lastTickAt ? { lastTickAt } : {}),
                 ...(lastError ? { lastError } : {}),
+                ...(input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA && input.config.realPathActivations?.length ? { realPathActivations: structuredClone(input.config.realPathActivations) } : {}),
             };
         },
         tick,
@@ -1055,6 +1060,25 @@ export async function restartManagedCustomerGateway(options = {}) {
     await stopManagedCustomerGateway(options);
     return startManagedCustomerGateway(options);
 }
+export async function superviseManagedCustomerGateway(options = {}) {
+    const inspect = options.inspect ?? (() => statusManagedCustomerGateway({ repository: options.repository, dir: options.dir }));
+    const start = options.start ?? (() => startManagedCustomerGateway({ repository: options.repository, dir: options.dir }));
+    const sleep = options.sleep ?? wait;
+    const maxCycles = options.maxCycles ?? Number.POSITIVE_INFINITY;
+    let recoveries = 0;
+    for (let cycle = 0; cycle < maxCycles; cycle += 1) {
+        const status = await inspect();
+        if (status.state === "CONFLICT")
+            throw new Error(status.detail);
+        if (status.state === "STOPPED" || status.state === "STALE") {
+            await start();
+            recoveries += 1;
+            options.output?.(`Recovered customer-owned Gateway (${recoveries}).\n`);
+        }
+        if (cycle + 1 < maxCycles)
+            await sleep(options.intervalMs ?? 5_000);
+    }
+}
 export async function readManagedCustomerGatewayLogs(options = {}) {
     const repository = resolve(options.repository ?? process.cwd());
     const directory = resolve(repository, options.dir ?? ".witnora/gateway");
@@ -1116,7 +1140,8 @@ export function parseManagedWorkflowHarnessConfig(raw) {
         && Array.isArray(workflowIds);
     const managed = value.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
         && safeRelativeModulePath(value.evaluatorModulePath)
-        && validDigest(value.evaluatorModuleSha256 ?? "");
+        && validDigest(value.evaluatorModuleSha256 ?? "")
+        && validRealPathActivations(value.realPathActivations);
     if (value.enabled !== true || !validDigest(value.evaluatorContractSha256 ?? "") || !workflowIdsValid || (!external && !managed)) {
         throw new Error("workflow-harness.json requires an enabled, digest-pinned literal-loopback evaluator and a local credential handle.");
     }
@@ -1128,6 +1153,25 @@ export function parseManagedWorkflowHarnessConfig(raw) {
     }
     return value;
 }
+function validRealPathActivations(value) {
+    if (value === undefined)
+        return true;
+    if (!Array.isArray(value) || value.length < 1 || value.length > 50)
+        return false;
+    return value.every((item) => Boolean(item && typeof item === "object" && !Array.isArray(item)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.integrationId ?? ""))
+        && validDigest(item.integrationDigestSha256)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.taskContractId ?? ""))
+        && validDigest(item.taskContractDigestSha256)
+        && /^[A-Za-z0-9._:-]{1,200}$/.test(String(item.agentId ?? ""))
+        && typeof item.agentVersion === "string"
+        && ["sandbox", "staging", "production"].includes(item.environment)
+        && validDigest(item.providerContractDigestSha256)
+        && item.acceptance?.kind === "READ_ONLY_PROVIDER_PREFLIGHT"
+        && item.acceptance?.productionWrites === 0
+        && validDigest(item.acceptance?.observationDigestSha256)
+        && Number.isFinite(Date.parse(item.acceptance?.passedAt ?? ""))));
+}
 export async function activateManagedWorkflowHarness(options) {
     const repository = resolve(options.repository ?? process.cwd());
     const directory = join(repository, ".witnora", "gateway");
@@ -1163,14 +1207,19 @@ export async function activateManagedWorkflowHarness(options) {
         ...(options.workflowIds ? { workflowIds: options.workflowIds } : {}),
         ...(options.pollIntervalMs === undefined ? {} : { pollIntervalMs: options.pollIntervalMs }),
         ...(options.maxConcurrency === undefined ? {} : { maxConcurrency: options.maxConcurrency }),
+        ...(options.realPathActivations?.length ? { realPathActivations: structuredClone(options.realPathActivations) } : {}),
     }));
     const path = join(directory, "workflow-harness.json");
     const serialized = `${JSON.stringify(config, null, 2)}\n`;
     let created = false;
     if (await exists(path)) {
         const current = await readFile(path, "utf8");
-        if (current !== serialized)
-            throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+        if (current !== serialized) {
+            const parsed = parseManagedWorkflowHarnessConfig(current);
+            if (parsed.schemaVersion !== MANAGED_WORKFLOW_HARNESS_SCHEMA || canonicalHarnessConfig(parsed) !== canonicalHarnessConfig(config))
+                throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+            await writeFile(path, serialized, { encoding: "utf8", mode: 0o600 });
+        }
     }
     else {
         await writeFile(path, serialized, { encoding: "utf8", mode: 0o600, flag: "wx" });
@@ -1178,6 +1227,10 @@ export async function activateManagedWorkflowHarness(options) {
     }
     return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created };
 }
+function canonicalHarnessConfig(value) {
+    const { realPathActivations: _activations, ...stable } = value;
+    return JSON.stringify(stable);
+}
 export async function configureManagedWorkflowHarness(options) {
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
     if (!await exists(join(directory, "gateway.json")))

package/dist/internal/control-client/collector-gateway.d.ts

@@ -50,6 +50,10 @@ export interface CustomerOwnedCollectorGatewayOptions {
         status(): Promise<AssuranceHarnessHeartbeat>;
     };
     runtimeBinding?: RuntimeReadinessBinding;
+    onRepairRequested?: (request: {
+        requestId: string;
+        action: "RESTART_AND_VERIFY";
+    }) => void | Promise<void>;
 }
 export interface CustomerOwnedCollectorGateway {
     baseUrl: string;

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAqM9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA0M9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -176,7 +176,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
         try {
             await ensureSourceKeyRegistered();
             const workerStatus = options.actionWorker ? await options.actionWorker.status() : undefined;
-            await options.client.heartbeat({
+            const response = await options.client.heartbeat({
                 collectorId: activeCollector.id,
                 signer,
                 pendingRecordCount: current.pendingRecordCount,
@@ -184,6 +184,13 @@ export async function startCustomerOwnedCollectorGateway(options) {
                 runtime: runtimeBinding && workerStatus ? runtimeHeartbeat(runtimeBinding, workerStatus, options.actionWorker?.runtimeBinding?.fixtureReady) : undefined,
                 assuranceHarness: options.assuranceHarness ? await options.assuranceHarness.status() : undefined,
             });
+            const repair = response.repair;
+            if (repair && typeof repair === "object" && !Array.isArray(repair)) {
+                const requestId = repair.requestId;
+                const action = repair.action;
+                if (typeof requestId === "string" && action === "RESTART_AND_VERIFY")
+                    await options.onRepairRequested?.({ requestId, action });
+            }
             lastRemoteSuccessAt = new Date().toISOString();
             lastRemoteError = undefined;
         }

package/dist/internal/control-client/remote-collector.d.ts

@@ -63,6 +63,24 @@ export interface AssuranceHarnessHeartbeat {
     workerReady: boolean;
     lastTickAt?: string;
     lastError?: string;
+    realPathActivations?: RealPathHarnessActivation[];
+}
+export interface RealPathHarnessActivation {
+    integrationId: string;
+    integrationDigestSha256: string;
+    taskContractId: string;
+    taskContractDigestSha256: string;
+    agentId: string;
+    agentVersion: string;
+    environment: "sandbox" | "staging" | "production";
+    providerPackId: string;
+    providerContractDigestSha256: string;
+    acceptance: {
+        kind: "READ_ONLY_PROVIDER_PREFLIGHT";
+        passedAt: string;
+        productionWrites: 0;
+        observationDigestSha256: string;
+    };
 }
 export interface RemoteCollectorClientOptions {
     baseUrl: string;

package/dist/internal/control-client/remote-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAmBvR,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}
+{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IAAC,uBAAuB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAC;IACjH,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IACzF,cAAc,EAAE,MAAM,CAAC;IAAC,4BAA4B,EAAE,MAAM,CAAC;IAC7D,UAAU,EAAE;QAAE,IAAI,EAAE,8BAA8B,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,CAAC,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9H;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAmBvR,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}

package/dist/onboard.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
@@ -10,6 +11,8 @@ import { writeTryEvidence } from "./try.js";
 import { doctorCustomerGateway, activateManagedWorkflowHarness, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
+import { activateRealPathIntegrations } from "./real-path-activation.js";
+import { installCurrentGatewayService } from "./gateway-service.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -90,6 +93,7 @@ export async function runOnboard(options) {
         limitation: "No approved customer Harness module is bound to this Agent repository.",
     };
     let assuranceHarnessChanged = false;
+    let continuousService;
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -175,6 +179,10 @@ export async function runOnboard(options) {
                 }
             }
             else {
+                const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+                if (stopped.state === "STOPPED" || stopped.state === "STALE") {
+                    output(`\nStopped the managed Gateway for project ${binding.projectId} before rebinding this repository.\n`);
+                }
                 await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
                 gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
                 output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
@@ -188,8 +196,10 @@ export async function runOnboard(options) {
         }
         const runtimeConfigured = await gatewayHasRuntimeWorker(repositoryPath);
         generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name, runtimeConfigured));
+        const realPathActivation = await activateRealPathIntegrations({ repository: repositoryPath, server, projectId: token.projectId, apiKey: token.apiKey, env: options.env, fetch: requestFetch });
+        generatedFiles.push(...realPathActivation.generatedFiles);
         try {
-            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath });
+            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath, realPathActivations: realPathActivation.activations });
             if (activation.created)
                 generatedFiles.push(activation.path);
             assuranceHarnessChanged = activation.created;
@@ -206,6 +216,10 @@ export async function runOnboard(options) {
             if (stopped.state !== "STOPPED" && stopped.state !== "STALE")
                 throw new Error("The prior managed Gateway process did not stop before Assurance Harness activation.");
         }
+        if (!options.gatewayLifecycle) {
+            const installed = await installCurrentGatewayService({ repository: repositoryPath, cliEntry: fileURLToPath(new URL("./cli.js", import.meta.url)) });
+            continuousService = { state: "INSTALLED", kind: installed.plan.kind, id: installed.plan.id };
+        }
         managedGateway = await gatewayLifecycle.start({
             repository: repositoryPath,
             configHome: options.configHome,
@@ -230,17 +244,19 @@ export async function runOnboard(options) {
         output(`Private discovery: ${discovery.capabilityCount} capability group(s); ${discovery.unknownCapabilityCount} pending confirmation.\n`);
         output("Installed: customer-owned Gateway, default-deny policy, independent-probe contract, review contract, and PR/release/nightly CI.\n");
         output(`Gateway: ${managedGateway.state} at ${managedGateway.baseUrl}${managedGateway.pid ? ` (process ${managedGateway.pid})` : ""}.\n`);
+        if (continuousService)
+            output(`Continuous operation: ${continuousService.kind} ${continuousService.id} will start at login and recover the Gateway after process failure.\n`);
         output(runtimeReadiness.state === "LOCAL_SANDBOX_READY"
             ? "Runtime: LOCAL_SANDBOX_READY. This proves only the generated localhost sandbox loop is ready; it does not establish coverage, CURRENT, or a verified customer outcome.\n"
             : `Runtime: RECORDED_ONLY. ${runtimeReadiness.limitations[0]}\n`);
         output(assuranceHarnessReadiness.state === "ACTIVE"
-            ? "Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.\n"
+            ? `Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.${realPathActivation.activations.length ? ` ${realPathActivation.activations.length} exact Stripe test-mode real-path binding(s) passed read-only preflight.` : ""}\n`
             : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
         output("The self-test remains isolated. The Gateway is ready in the background; run the agent normally. The first source-signed, server-reconciled Gateway run completes onboarding.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
             gatewayDirectory: join(repositoryPath, ".witnora", "gateway"), gatewayArchiveDirectory: gatewayMigration?.archiveDirectory,
-            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness };
+            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness, continuousService };
     }
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);

package/dist/real-path-activation.js

@@ -0,0 +1,100 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+export async function activateRealPathIntegrations(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const request = options.fetch ?? fetch;
+    const base = options.server.replace(/\/$/, "");
+    const response = await request(`${base}/v1/projects/${encodeURIComponent(options.projectId)}/real-path-integrations`, { headers: { authorization: `Bearer ${options.apiKey}` } });
+    if (response.status === 404)
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+    if (!response.ok)
+        throw new Error(`Could not load approved real-path integrations (${response.status}).`);
+    const body = await boundedJson(response);
+    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
+    const plans = approved.filter((plan) => plan.generated.providerPackId === "STRIPE_REFUND" && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
+    if (!plans.length)
+        return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
+    const secret = options.env?.STRIPE_SECRET_KEY ?? process.env.STRIPE_SECRET_KEY;
+    if (!secret?.startsWith("sk_test_") || secret.length < 12)
+        throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+    const activations = [];
+    const scenarios = [];
+    for (const plan of plans) {
+        const preflight = await stripePreflight(request, secret, plan, options.now?.() ?? new Date());
+        const acceptance = preflight.acceptance;
+        activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, acceptance });
+        scenarios.push({ plan, value: [preflight.scenario] });
+    }
+    const modulePath = join(repository, "witnora.assurance-harness.mjs");
+    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
+    const source = generatedStripeHarness(plans);
+    const moduleDigestSha256 = sha(source);
+    let created = false;
+    const generatedFiles = [];
+    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const prior = await readFile(manifestPath, "utf8").then((value) => JSON.parse(value)).catch(() => undefined);
+    if (current === undefined) {
+        await writeFile(modulePath, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        created = true;
+        generatedFiles.push(modulePath);
+    }
+    else if (sha(current) !== prior?.moduleDigestSha256)
+        throw new Error("Existing Assurance Harness is customer-modified or belongs to a different integration; refusing to overwrite it.");
+    else if (current !== source) {
+        const temporary = `${modulePath}.${randomUUID()}.tmp`;
+        await writeFile(temporary, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, modulePath);
+        generatedFiles.push(modulePath);
+    }
+    const manifest = { schemaVersion: "witnora.real_path_activation_manifest.v0.1", projectId: options.projectId, moduleDigestSha256, activations };
+    await mkdir(dirname(manifestPath), { recursive: true });
+    await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    generatedFiles.push(manifestPath);
+    for (const item of scenarios) {
+        const path = join(repository, ".witnora", "scenarios", `${item.plan.taskContractId}.json`);
+        await mkdir(dirname(path), { recursive: true });
+        try {
+            await writeFile(path, `${JSON.stringify(item.value, null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+            generatedFiles.push(path);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles };
+}
+async function stripePreflight(request, secret, plan, now) {
+    const response = await request("https://api.stripe.com/v1/refunds?limit=1", { headers: { authorization: `Bearer ${secret}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Stripe test-mode read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    if (body.object !== "list" || !Array.isArray(body.data))
+        throw new Error("Stripe test-mode preflight returned an unexpected contract.");
+    const first = body.data[0] && typeof body.data[0] === "object" && !Array.isArray(body.data[0]) ? body.data[0] : undefined;
+    if (!first || typeof first.id !== "string" || !/^re_[A-Za-z0-9_]{1,200}$/.test(first.id))
+        throw new Error("Stripe test-mode activation requires one existing test refund for the no-write acceptance.");
+    const observation = Object.fromEntries(["status", "amount", "currency", "failure_reason"].flatMap((key) => scalar(first[key]) ? [[key, first[key]]] : []));
+    if (observation[plan.generated.criterion.field] !== plan.generated.criterion.expected)
+        throw new Error("The latest Stripe test refund does not satisfy the approved business success definition.");
+    const parameterDigest = sha(first.id);
+    const resultDigest = sha(canonical(observation));
+    return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `stripe:${sha(first.id).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId: first.id }, inputDigestSha256: sha(canonical({ resourceId: first.id })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: parameterDigest })) } } };
+}
+function generatedStripeHarness(plans) {
+    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
+    return `import {createHash} from "node:crypto";\nimport {readFile} from "node:fs/promises";\nimport {join} from "node:path";\nconst contracts=${JSON.stringify(contracts)};\nconst sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");\nexport function createWitnoraBusinessTaskEvaluatorOptions(context){return {\n loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},\n evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^re_[A-Za-z0-9_]{1,200}$/.test(resourceId))throw new Error("Stripe refund resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");const response=await fetch("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),{headers:{authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Stripe read-only observation failed.");const raw=await response.json();const observed={status:raw.status,amount:raw.amount,currency:raw.currency,failure_reason:raw.failure_reason};const actual=observed[contract.criterion.field];return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}\n};}\n`;
+}
+function parsePlan(value) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Real-path integration response is invalid."); const plan = value; if (plan.schemaVersion !== "witnora.real_path_integration.v0.1" || !plan.id || !plan.taskContractId || !plan.subject?.agentId || !plan.subject.agentVersion || !plan.generated || plan.generated.boundaries?.rawPayloadUpload !== false || plan.generated.boundaries.rawCredentialUpload !== false || plan.generated.boundaries.evaluatorWrites !== false || plan.generated.boundaries.firstAcceptanceProductionWrites !== 0 || !digest(plan.digestSha256) || !digest(plan.taskContractDigestSha256) || !digest(plan.generated.providerContractDigestSha256))
+    throw new Error("Real-path integration response failed its safety contract."); return plan; }
+async function boundedJson(response) { const text = await response.text(); if (text.length > 1_048_576)
+    throw new Error("Real-path response exceeded the size limit."); const value = JSON.parse(text); if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Real-path response is invalid."); return value; }
+function scalar(value) { return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean"; }
+function digest(value) { return typeof value === "string" && /^[a-f0-9]{64}$/.test(value); }
+function canonical(value) { if (value === null || typeof value !== "object")
+    return JSON.stringify(value); if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`; return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`; }
+function sha(value) { return createHash("sha256").update(value).digest("hex"); }

package/dist/runtime-bootstrap.js

@@ -49,8 +49,11 @@ export async function bootstrapLocalRuntime(input) {
         body: JSON.stringify({ ...contract, contractFingerprintSha256 }),
     });
     const body = await response.json().catch(() => ({}));
-    if (!response.ok)
-        throw new Error(`Hosted Runtime bootstrap did not complete (HTTP ${response.status}).`);
+    if (!response.ok) {
+        const detail = typeof body.error === "string" ? body.error : typeof body.message === "string" ? body.message : undefined;
+        const code = typeof body.code === "string" ? body.code : undefined;
+        throw new Error(`Hosted Runtime bootstrap did not complete (HTTP ${response.status})${code ? ` [${code}]` : ""}${detail ? `: ${detail.slice(0, 300)}` : "."}`);
+    }
     const issued = validateResponse(body, contractFingerprintSha256, attempt.deliveryPublicKeyPem);
     const probeCredentialPath = join(directory, "outcome-probe-api-key.txt");
     const probeCredentialMetadataPath = join(directory, "outcome-probe-api-key.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",