witnora 0.15.1 → 0.17.0

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
 import { validateEvidenceArtifacts } from "./artifact-validation.js";
 import { renderAgentCertBadge } from "./badge.js";
 import { buildEvidenceBundle } from "./bundle.js";
@@ -39,7 +40,8 @@ import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
+import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, superviseManagedCustomerGateway, } from "./gateway.js";
+import { installCurrentGatewayService, restartCurrentGatewayService, uninstallCurrentGatewayService } from "./gateway-service.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -224,6 +226,37 @@ else if (command === "gateway") {
         const result = await restartManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderManagedGatewayStatus(result));
     }
+    else if (action === "repair") {
+        const repository = readFlag("--repo") ?? process.cwd();
+        const dir = readFlag("--dir");
+        const service = await installCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
+        await restartCurrentGatewayService({ repository, gatewayDirectory: dir, cliEntry: fileURLToPath(import.meta.url) });
+        const result = await startManagedCustomerGateway({ repository, dir });
+        const doctor = await doctorCustomerGateway({ repository, dir });
+        if (!isGatewayDoctorReady(doctor))
+            throw new Error(`Connection repair did not restore a ready Gateway. ${doctor.nextAction}`);
+        process.stdout.write(`Connection repaired. ${service.plan.kind} ${service.plan.id} is installed and the Gateway is healthy.\n`);
+        process.stdout.write(renderManagedGatewayStatus(result));
+    }
+    else if (action === "service") {
+        const serviceAction = process.argv[4] ?? "install";
+        const repository = readFlag("--repo") ?? process.cwd();
+        const gatewayDirectory = readFlag("--dir");
+        const cliEntry = fileURLToPath(import.meta.url);
+        if (serviceAction === "install") {
+            const result = await installCurrentGatewayService({ repository, gatewayDirectory, cliEntry });
+            process.stdout.write(`Installed ${result.plan.kind} service ${result.plan.id}.\n`);
+        }
+        else if (serviceAction === "uninstall") {
+            const result = await uninstallCurrentGatewayService({ repository, gatewayDirectory, cliEntry });
+            process.stdout.write(`Removed Gateway service ${result.plan.id}.\n`);
+        }
+        else
+            throw new Error("Use witnora gateway service install|uninstall.");
+    }
+    else if (action === "supervise") {
+        await superviseManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), output: (message) => process.stdout.write(message) });
+    }
     else if (action === "stop") {
         const result = await stopManagedCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderManagedGatewayStatus(result));
@@ -249,7 +282,7 @@ else if (command === "gateway") {
         process.stdout.write(`Configured the Managed Workflow Harness for ${result.config.workflowIds?.length ?? "all active"} Workflow Contract(s).\nConfig: ${result.path}\nRestart the managed Gateway to activate it.\n`);
     }
     else {
-        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|stop|run|workflow-harness.");
+        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|repair|service|stop|run|workflow-harness.");
     }
 }
 else if (command === "discover") {

package/dist/command-help.js

@@ -63,6 +63,8 @@ Options:
   witnora gateway status
   witnora gateway logs [--lines 100]
   witnora gateway restart
+  witnora gateway repair
+  witnora gateway service install|uninstall
   witnora gateway stop
   witnora gateway run
   witnora gateway workflow-harness --workflow <id> --evaluator-origin http://127.0.0.1:<port>/ \\
@@ -71,8 +73,10 @@ Options:
 Initializes and manages a customer-owned, metadata-only collector beside the Agent.
 The browser approval issues a collector-scoped credential; no API key is copied into
 the repository or exposed to the Agent. The local queue and source signing key remain
-under customer control. Onboard uses background start by default. The run command is
-the foreground debugging path.
+under customer control. The service command installs an OS-native auto-start and restart
+boundary. Repair safely reinstalls that boundary, restarts the existing generated Gateway,
+and reruns digest, credential, Probe, and health checks. The run command is the foreground
+debugging path.
 
 The reference Gateway establishes RECORDED evidence only. ENFORCED requires target
 write credentials behind a controlled execution adapter. OUTCOME VERIFIED requires a

package/dist/gateway-service.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function installGatewayService(input) {
+    const plan = createGatewayServicePlan(input);
+    await input.writeDefinition(plan.definitionPath, plan.definition);
+    if (plan.kind === "SYSTEMD_USER")
+        await input.run("systemctl", ["--user", "daemon-reload"]);
+    await input.run(plan.install.command, plan.install.args);
+    if (plan.kind !== "SYSTEMD_USER")
+        await input.run(plan.start.command, plan.start.args);
+    return { installed: true, plan };
+}
+export async function installCurrentGatewayService(options) {
+    const planInput = currentPlanInput(options);
+    return installGatewayService({ ...planInput,
+        writeDefinition: async (path, value) => { await mkdir(dirname(path), { recursive: true }); await writeFile(path, value, { encoding: "utf8", mode: 0o600 }); },
+        run: options.run ?? runCommand,
+    });
+}
+export async function uninstallCurrentGatewayService(options) {
+    const plan = createGatewayServicePlan(currentPlanInput(options));
+    const run = options.run ?? runCommand;
+    await run(plan.uninstall.command, plan.uninstall.args);
+    if (plan.kind === "SYSTEMD_USER")
+        await run("systemctl", ["--user", "daemon-reload"]);
+    await rm(plan.definitionPath, { force: true });
+    return { uninstalled: true, plan };
+}
+export async function restartCurrentGatewayService(options) {
+    const plan = createGatewayServicePlan(currentPlanInput(options));
+    const run = options.run ?? runCommand;
+    await run(plan.stop.command, plan.stop.args).catch(() => undefined);
+    await run(plan.start.command, plan.start.args);
+    return plan;
+}
+export function createGatewayServicePlan(input) {
+    const suffix = createHash("sha256").update(`${input.repository}\n${input.gatewayDirectory}`).digest("hex").slice(0, 12);
+    const id = `witnora-gateway-${suffix}`;
+    const superviseArgs = [input.cliEntry, "gateway", "supervise", "--repo", input.repository, "--dir", input.gatewayDirectory];
+    if (input.platform === "win32")
+        return windowsPlan(input, id, superviseArgs);
+    if (input.platform === "darwin")
+        return launchdPlan(input, id, superviseArgs);
+    if (input.platform === "linux")
+        return systemdPlan(input, id, superviseArgs);
+    throw new Error(`Gateway service installation is not supported on ${input.platform}.`);
+}
+function windowsPlan(input, id, args) {
+    const definitionPath = `${input.serviceHome}\\${id}.xml`;
+    const argumentsValue = args.map(windowsArgument).join(" ");
+    const definition = `<?xml version="1.0" encoding="UTF-8"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml(input.userId)}</UserId></LogonTrigger></Triggers>
+  <Principals><Principal id="Author"><UserId>${xml(input.userId)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><StartWhenAvailable>true</StartWhenAvailable><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure></Settings>
+  <Actions Context="Author"><Exec><Command>${xml(input.nodeExecutable)}</Command><Arguments>${xml(argumentsValue)}</Arguments><WorkingDirectory>${xml(input.repository)}</WorkingDirectory></Exec></Actions>
+</Task>`;
+    return { id, kind: "WINDOWS_TASK", definitionPath, definition,
+        install: { command: "schtasks.exe", args: ["/Create", "/TN", id, "/XML", definitionPath, "/F"] },
+        start: { command: "schtasks.exe", args: ["/Run", "/TN", id] },
+        stop: { command: "schtasks.exe", args: ["/End", "/TN", id] },
+        uninstall: { command: "schtasks.exe", args: ["/Delete", "/TN", id, "/F"] } };
+}
+function currentPlanInput(options) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "win32" && platform !== "linux" && platform !== "darwin")
+        throw new Error(`Gateway service installation is not supported on ${platform}.`);
+    const repository = resolve(options.repository ?? process.cwd());
+    const env = options.env ?? process.env;
+    const serviceHome = platform === "win32" ? join(env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "Witnora", "services")
+        : platform === "darwin" ? join(homedir(), "Library", "LaunchAgents") : join(homedir(), ".config", "systemd", "user");
+    return { platform, repository, gatewayDirectory: resolve(repository, options.gatewayDirectory ?? ".witnora/gateway"), cliEntry: resolve(options.cliEntry), nodeExecutable: options.nodeExecutable ?? process.execPath, serviceHome, userId: platform === "win32" ? `${env.USERDOMAIN ? `${env.USERDOMAIN}\\` : ""}${env.USERNAME ?? userInfo().username}` : userInfo().username };
+}
+async function runCommand(command, args) { await execFileAsync(command, args, { windowsHide: true }); }
+function systemdPlan(input, id, args) {
+    const unit = `${id}.service`;
+    const definitionPath = `${input.serviceHome}/${unit}`;
+    const definition = `[Unit]\nDescription=Witnora customer-owned Gateway\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nWorkingDirectory=${systemd(input.repository)}\nExecStart=${[input.nodeExecutable, ...args].map(systemd).join(" ")}\nRestart=always\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
+    return { id, kind: "SYSTEMD_USER", definitionPath, definition,
+        install: { command: "systemctl", args: ["--user", "enable", "--now", unit] },
+        start: { command: "systemctl", args: ["--user", "start", unit] },
+        stop: { command: "systemctl", args: ["--user", "stop", unit] },
+        uninstall: { command: "systemctl", args: ["--user", "disable", "--now", unit] } };
+}
+function launchdPlan(input, id, args) {
+    const label = `com.witnora.${id}`;
+    const definitionPath = `${input.serviceHome}/${label}.plist`;
+    const programArguments = [input.nodeExecutable, ...args].map((value) => `<string>${xml(value)}</string>`).join("");
+    const definition = `<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>Label</key><string>${label}</string><key>ProgramArguments</key><array>${programArguments}</array><key>WorkingDirectory</key><string>${xml(input.repository)}</string><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>5</integer></dict></plist>`;
+    const domain = `gui/${process.getuid?.() ?? input.userId}`;
+    return { id, kind: "LAUNCHD_AGENT", definitionPath, definition,
+        install: { command: "launchctl", args: ["bootstrap", domain, definitionPath] },
+        start: { command: "launchctl", args: ["kickstart", `${domain}/${label}`] },
+        stop: { command: "launchctl", args: ["kill", "SIGTERM", `${domain}/${label}`] },
+        uninstall: { command: "launchctl", args: ["bootout", domain, definitionPath] } };
+}
+function windowsArgument(value) { return `"${value.replaceAll('"', '\\"')}"`; }
+function systemd(value) { return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`; }
+function xml(value) { return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;"); }

package/dist/gateway.js

@@ -514,6 +514,10 @@ export async function runCustomerGateway(options) {
             host: process.env.WITNORA_GATEWAY_HOST?.trim() || config.host,
             port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, config.port),
             environment: "customer-owned",
+            onRepairRequested: async ({ requestId }) => {
+                process.stderr.write(`Hosted connection repair ${requestId} requested a verified Gateway restart.\n`);
+                setTimeout(() => process.exit(75), 25).unref();
+            },
             ...(actionWorker && config.runtimeWorker ? { actionWorker: {
                     track: (input) => isConfiguredRuntimeProposal(input.proposal, config.runtimeWorker) ? actionWorker.track(input) : Promise.resolve(undefined),
                     status: async () => {
@@ -1056,6 +1060,25 @@ export async function restartManagedCustomerGateway(options = {}) {
     await stopManagedCustomerGateway(options);
     return startManagedCustomerGateway(options);
 }
+export async function superviseManagedCustomerGateway(options = {}) {
+    const inspect = options.inspect ?? (() => statusManagedCustomerGateway({ repository: options.repository, dir: options.dir }));
+    const start = options.start ?? (() => startManagedCustomerGateway({ repository: options.repository, dir: options.dir }));
+    const sleep = options.sleep ?? wait;
+    const maxCycles = options.maxCycles ?? Number.POSITIVE_INFINITY;
+    let recoveries = 0;
+    for (let cycle = 0; cycle < maxCycles; cycle += 1) {
+        const status = await inspect();
+        if (status.state === "CONFLICT")
+            throw new Error(status.detail);
+        if (status.state === "STOPPED" || status.state === "STALE") {
+            await start();
+            recoveries += 1;
+            options.output?.(`Recovered customer-owned Gateway (${recoveries}).\n`);
+        }
+        if (cycle + 1 < maxCycles)
+            await sleep(options.intervalMs ?? 5_000);
+    }
+}
 export async function readManagedCustomerGatewayLogs(options = {}) {
     const repository = resolve(options.repository ?? process.cwd());
     const directory = resolve(repository, options.dir ?? ".witnora/gateway");

package/dist/internal/control-client/collector-gateway.d.ts

@@ -50,6 +50,10 @@ export interface CustomerOwnedCollectorGatewayOptions {
         status(): Promise<AssuranceHarnessHeartbeat>;
     };
     runtimeBinding?: RuntimeReadinessBinding;
+    onRepairRequested?: (request: {
+        requestId: string;
+        action: "RESTART_AND_VERIFY";
+    }) => void | Promise<void>;
 }
 export interface CustomerOwnedCollectorGateway {
     baseUrl: string;

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAqM9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA0M9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -176,7 +176,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
         try {
             await ensureSourceKeyRegistered();
             const workerStatus = options.actionWorker ? await options.actionWorker.status() : undefined;
-            await options.client.heartbeat({
+            const response = await options.client.heartbeat({
                 collectorId: activeCollector.id,
                 signer,
                 pendingRecordCount: current.pendingRecordCount,
@@ -184,6 +184,13 @@ export async function startCustomerOwnedCollectorGateway(options) {
                 runtime: runtimeBinding && workerStatus ? runtimeHeartbeat(runtimeBinding, workerStatus, options.actionWorker?.runtimeBinding?.fixtureReady) : undefined,
                 assuranceHarness: options.assuranceHarness ? await options.assuranceHarness.status() : undefined,
             });
+            const repair = response.repair;
+            if (repair && typeof repair === "object" && !Array.isArray(repair)) {
+                const requestId = repair.requestId;
+                const action = repair.action;
+                if (typeof requestId === "string" && action === "RESTART_AND_VERIFY")
+                    await options.onRepairRequested?.({ requestId, action });
+            }
             lastRemoteSuccessAt = new Date().toISOString();
             lastRemoteError = undefined;
         }

package/dist/onboard.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
@@ -11,6 +12,7 @@ import { doctorCustomerGateway, activateManagedWorkflowHarness, initializeCustom
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
 import { activateRealPathIntegrations } from "./real-path-activation.js";
+import { installCurrentGatewayService } from "./gateway-service.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -91,6 +93,7 @@ export async function runOnboard(options) {
         limitation: "No approved customer Harness module is bound to this Agent repository.",
     };
     let assuranceHarnessChanged = false;
+    let continuousService;
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -176,6 +179,10 @@ export async function runOnboard(options) {
                 }
             }
             else {
+                const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+                if (stopped.state === "STOPPED" || stopped.state === "STALE") {
+                    output(`\nStopped the managed Gateway for project ${binding.projectId} before rebinding this repository.\n`);
+                }
                 await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
                 gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
                 output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
@@ -209,6 +216,10 @@ export async function runOnboard(options) {
             if (stopped.state !== "STOPPED" && stopped.state !== "STALE")
                 throw new Error("The prior managed Gateway process did not stop before Assurance Harness activation.");
         }
+        if (!options.gatewayLifecycle) {
+            const installed = await installCurrentGatewayService({ repository: repositoryPath, cliEntry: fileURLToPath(new URL("./cli.js", import.meta.url)) });
+            continuousService = { state: "INSTALLED", kind: installed.plan.kind, id: installed.plan.id };
+        }
         managedGateway = await gatewayLifecycle.start({
             repository: repositoryPath,
             configHome: options.configHome,
@@ -233,6 +244,8 @@ export async function runOnboard(options) {
         output(`Private discovery: ${discovery.capabilityCount} capability group(s); ${discovery.unknownCapabilityCount} pending confirmation.\n`);
         output("Installed: customer-owned Gateway, default-deny policy, independent-probe contract, review contract, and PR/release/nightly CI.\n");
         output(`Gateway: ${managedGateway.state} at ${managedGateway.baseUrl}${managedGateway.pid ? ` (process ${managedGateway.pid})` : ""}.\n`);
+        if (continuousService)
+            output(`Continuous operation: ${continuousService.kind} ${continuousService.id} will start at login and recover the Gateway after process failure.\n`);
         output(runtimeReadiness.state === "LOCAL_SANDBOX_READY"
             ? "Runtime: LOCAL_SANDBOX_READY. This proves only the generated localhost sandbox loop is ready; it does not establish coverage, CURRENT, or a verified customer outcome.\n"
             : `Runtime: RECORDED_ONLY. ${runtimeReadiness.limitations[0]}\n`);
@@ -243,7 +256,7 @@ export async function runOnboard(options) {
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
             gatewayDirectory: join(repositoryPath, ".witnora", "gateway"), gatewayArchiveDirectory: gatewayMigration?.archiveDirectory,
-            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness };
+            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness, continuousService };
     }
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);

package/dist/real-path-activation.js

@@ -12,23 +12,21 @@ export async function activateRealPathIntegrations(options) {
         throw new Error(`Could not load approved real-path integrations (${response.status}).`);
     const body = await boundedJson(response);
     const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
-    const plans = approved.filter((plan) => plan.generated.providerPackId === "STRIPE_REFUND" && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
+    const plans = approved.filter((plan) => ["STRIPE_REFUND", "ZENDESK_TICKET", "SALESFORCE_RECORD", "HUBSPOT_CRM_RECORD", "POSTGRES_RECORD"].includes(plan.generated.providerPackId) && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
     if (!plans.length)
         return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
-    const secret = options.env?.STRIPE_SECRET_KEY ?? process.env.STRIPE_SECRET_KEY;
-    if (!secret?.startsWith("sk_test_") || secret.length < 12)
-        throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+    const environment = options.env ?? process.env;
     const activations = [];
     const scenarios = [];
     for (const plan of plans) {
-        const preflight = await stripePreflight(request, secret, plan, options.now?.() ?? new Date());
+        const preflight = await providerPreflight(request, environment, plan, options.now?.() ?? new Date(), options.postgresClientFactory);
         const acceptance = preflight.acceptance;
         activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, acceptance });
         scenarios.push({ plan, value: [preflight.scenario] });
     }
     const modulePath = join(repository, "witnora.assurance-harness.mjs");
     const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
-    const source = generatedStripeHarness(plans);
+    const source = generatedProviderHarness(plans);
     const moduleDigestSha256 = sha(source);
     let created = false;
     const generatedFiles = [];
@@ -65,6 +63,23 @@ export async function activateRealPathIntegrations(options) {
     }
     return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles };
 }
+async function providerPreflight(request, env, plan, now, postgresClientFactory) {
+    if (plan.generated.providerPackId === "STRIPE_REFUND") {
+        const secret = env.STRIPE_SECRET_KEY;
+        if (!secret?.startsWith("sk_test_") || secret.length < 12)
+            throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+        return stripePreflight(request, secret, plan, now);
+    }
+    if (plan.generated.providerPackId === "ZENDESK_TICKET")
+        return zendeskPreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "SALESFORCE_RECORD")
+        return salesforcePreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "HUBSPOT_CRM_RECORD")
+        return hubspotPreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "POSTGRES_RECORD")
+        return postgresPreflight(env, plan, now, postgresClientFactory);
+    throw new Error(`${plan.generated.providerPackId} activation is not implemented by this CLI version.`);
+}
 async function stripePreflight(request, secret, plan, now) {
     const response = await request("https://api.stripe.com/v1/refunds?limit=1", { headers: { authorization: `Bearer ${secret}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
     if (!response.ok)
@@ -82,9 +97,113 @@ async function stripePreflight(request, secret, plan, now) {
     const resultDigest = sha(canonical(observation));
     return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `stripe:${sha(first.id).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId: first.id }, inputDigestSha256: sha(canonical({ resourceId: first.id })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: parameterDigest })) } } };
 }
-function generatedStripeHarness(plans) {
-    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
-    return `import {createHash} from "node:crypto";\nimport {readFile} from "node:fs/promises";\nimport {join} from "node:path";\nconst contracts=${JSON.stringify(contracts)};\nconst sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");\nexport function createWitnoraBusinessTaskEvaluatorOptions(context){return {\n loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},\n evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^re_[A-Za-z0-9_]{1,200}$/.test(resourceId))throw new Error("Stripe refund resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");const response=await fetch("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),{headers:{authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Stripe read-only observation failed.");const raw=await response.json();const observed={status:raw.status,amount:raw.amount,currency:raw.currency,failure_reason:raw.failure_reason};const actual=observed[contract.criterion.field];return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}\n};}\n`;
+async function zendeskPreflight(request, env, plan, now) {
+    const token = env.ZENDESK_API_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("Zendesk activation requires the read-only ZENDESK_API_TOKEN in the customer environment.");
+    const origin = providerOrigin(plan, "Zendesk", ".zendesk.com");
+    const response = await request(`${origin}/api/v2/tickets.json?per_page=1&sort_by=updated_at&sort_order=desc`, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Zendesk read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const tickets = Array.isArray(body.tickets) ? body.tickets : [];
+    const first = record(tickets[0], "Zendesk ticket");
+    const id = first.id;
+    if (typeof id !== "number" && typeof id !== "string")
+        throw new Error("Zendesk preflight requires one existing sandbox ticket.");
+    const observation = pick(first, ["status", "priority", "type", "via.channel"]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "zendesk", id, observation);
+}
+async function salesforcePreflight(request, env, plan, now) {
+    const token = env.SALESFORCE_ACCESS_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("Salesforce activation requires the read-only SALESFORCE_ACCESS_TOKEN in the customer environment.");
+    const origin = providerOrigin(plan, "Salesforce", ".my.salesforce.com");
+    const resourceType = providerIdentifier(plan.generated.providerConfiguration?.resourceType, "Salesforce record type");
+    const field = providerIdentifier(plan.generated.criterion.field, "Salesforce criterion field");
+    const query = `SELECT Id,${field} FROM ${resourceType} ORDER BY LastModifiedDate DESC LIMIT 1`;
+    const response = await request(`${origin}/services/data/v61.0/query?${new URLSearchParams({ q: query })}`, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Salesforce read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const records = Array.isArray(body.records) ? body.records : [];
+    const first = record(records[0], "Salesforce record");
+    const id = first.Id;
+    if (typeof id !== "string")
+        throw new Error("Salesforce preflight requires one existing sandbox record.");
+    const observation = pick(first, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "salesforce", id, observation);
+}
+async function hubspotPreflight(request, env, plan, now) {
+    const token = env.HUBSPOT_ACCESS_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("HubSpot activation requires the read-only HUBSPOT_ACCESS_TOKEN in the customer environment.");
+    const resourceType = providerIdentifier(plan.generated.providerConfiguration?.resourceType, "HubSpot record type");
+    const field = providerIdentifier(plan.generated.criterion.field, "HubSpot criterion field");
+    const url = `https://api.hubapi.com/crm/v3/objects/${encodeURIComponent(resourceType)}?${new URLSearchParams({ limit: "1", properties: field })}`;
+    const response = await request(url, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`HubSpot read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const results = Array.isArray(body.results) ? body.results : [];
+    const first = record(results[0], "HubSpot record");
+    const id = first.id;
+    if (typeof id !== "string")
+        throw new Error("HubSpot preflight requires one existing sandbox record.");
+    const properties = record(first.properties, "HubSpot properties");
+    const observation = pick(properties, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "hubspot", id, observation);
+}
+async function postgresPreflight(env, plan, now, clientFactory) {
+    const connectionString = env.WITNORA_POSTGRES_READ_URL;
+    if (!connectionString)
+        throw new Error("PostgreSQL activation requires WITNORA_POSTGRES_READ_URL in the customer environment.");
+    const view = providerIdentifier(plan.generated.providerConfiguration?.viewName, "PostgreSQL approved view");
+    const idColumn = providerIdentifier(plan.generated.providerConfiguration?.idColumn, "PostgreSQL record ID column");
+    const field = providerIdentifier(plan.generated.criterion.field, "PostgreSQL criterion field");
+    const client = clientFactory ? clientFactory(connectionString) : await defaultPostgresClient(connectionString);
+    await client.connect();
+    let first;
+    try {
+        await client.query("BEGIN READ ONLY");
+        const result = await client.query({ text: `SELECT "${idColumn}", "${field}" FROM "${view}" ORDER BY "${idColumn}" DESC LIMIT 1` });
+        first = result.rows[0];
+        await client.query("ROLLBACK");
+    }
+    catch (error) {
+        await client.query("ROLLBACK").catch(() => undefined);
+        throw error;
+    }
+    finally {
+        await client.end();
+    }
+    if (!first)
+        throw new Error("PostgreSQL preflight requires one existing record in the approved read-only view.");
+    const id = first[idColumn];
+    if (typeof id !== "string" && typeof id !== "number")
+        throw new Error("PostgreSQL preflight returned an invalid record ID.");
+    const observation = pick(first, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "postgres", id, observation);
+}
+async function defaultPostgresClient(connectionString) { const imported = await import("pg"); return new imported.Client({ connectionString, application_name: "witnora-read-only-preflight" }); }
+function generatedProviderHarness(plans) {
+    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, providerPackId: plan.generated.providerPackId, providerConfiguration: plan.generated.providerConfiguration ?? {}, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
+    return `import {createHash} from "node:crypto";
+import {readFile} from "node:fs/promises";
+import {join} from "node:path";
+const contracts=${JSON.stringify(contracts)};
+const sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");
+const request=async(url,key)=>{const response=await fetch(url,{method:"GET",headers:{accept:"application/json",authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Provider read-only observation failed ("+response.status+").");return response.json();};
+const observe=async(contract,resourceId)=>{if(contract.providerPackId==="STRIPE_REFUND"){const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");return request("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="ZENDESK_TICKET"){const key=process.env.ZENDESK_API_TOKEN;if(!key)throw new Error("Zendesk read-only credential is unavailable.");return (await request(contract.providerConfiguration.origin+"/api/v2/tickets/"+encodeURIComponent(resourceId)+".json",key)).ticket;}if(contract.providerPackId==="SALESFORCE_RECORD"){const key=process.env.SALESFORCE_ACCESS_TOKEN;if(!key)throw new Error("Salesforce read-only credential is unavailable.");return request(contract.providerConfiguration.origin+"/services/data/v61.0/sobjects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="HUBSPOT_CRM_RECORD"){const key=process.env.HUBSPOT_ACCESS_TOKEN;if(!key)throw new Error("HubSpot read-only credential is unavailable.");return (await request("https://api.hubapi.com/crm/v3/objects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId)+"?properties="+encodeURIComponent(contract.criterion.field),key)).properties;}if(contract.providerPackId==="POSTGRES_RECORD"){const url=process.env.WITNORA_POSTGRES_READ_URL;if(!url)throw new Error("PostgreSQL read-only credential is unavailable.");for(const name of [contract.providerConfiguration.viewName,contract.providerConfiguration.idColumn,contract.criterion.field])if(!/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(name))throw new Error("PostgreSQL identifier is invalid.");const {Client}=await import("pg");const client=new Client({connectionString:url,application_name:"witnora-read-only-probe"});await client.connect();try{await client.query("BEGIN READ ONLY");const result=await client.query({name:"witnora-provider-observe",text:'SELECT "'+contract.criterion.field+'" FROM "'+contract.providerConfiguration.viewName+'" WHERE "'+contract.providerConfiguration.idColumn+'" = $1 LIMIT 1',values:[resourceId]});await client.query("ROLLBACK");return result.rows[0]??{};}catch(error){await client.query("ROLLBACK").catch(()=>{});throw error;}finally{await client.end();}}throw new Error("Provider Harness contract is unsupported.");};
+export function createWitnoraBusinessTaskEvaluatorOptions(context){return {
+loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},
+evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const raw=await observe(contract,resourceId);const actual=raw?.[contract.criterion.field];const observed=actual===undefined?{}:{[contract.criterion.field]:actual};return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}
+};}
+`;
 }
 function parsePlan(value) { if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Real-path integration response is invalid."); const plan = value; if (plan.schemaVersion !== "witnora.real_path_integration.v0.1" || !plan.id || !plan.taskContractId || !plan.subject?.agentId || !plan.subject.agentVersion || !plan.generated || plan.generated.boundaries?.rawPayloadUpload !== false || plan.generated.boundaries.rawCredentialUpload !== false || plan.generated.boundaries.evaluatorWrites !== false || plan.generated.boundaries.firstAcceptanceProductionWrites !== 0 || !digest(plan.digestSha256) || !digest(plan.taskContractDigestSha256) || !digest(plan.generated.providerContractDigestSha256))
@@ -93,6 +212,23 @@ async function boundedJson(response) { const text = await response.text(); if (t
     throw new Error("Real-path response exceeded the size limit."); const value = JSON.parse(text); if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Real-path response is invalid."); return value; }
 function scalar(value) { return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean"; }
+function providerOrigin(plan, provider, suffix) { const value = plan.generated.providerConfiguration?.origin; try {
+    const url = new URL(value ?? "");
+    if (url.protocol !== "https:" || !url.hostname.endsWith(suffix) || url.origin !== (value ?? "").replace(/\/$/, ""))
+        throw new Error();
+    return url.origin;
+}
+catch {
+    throw new Error(`${provider} integration has an invalid trusted origin.`);
+} }
+function providerIdentifier(value, field) { if (!value || !/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(value))
+    throw new Error(`${field} is invalid.`); return value; }
+function record(value, field) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${field} response is invalid.`); return value; }
+function pick(value, fields) { return Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return scalar(selected) ? [[field, selected]] : []; })); }
+function assertCriterion(plan, observation) { if (observation[plan.generated.criterion.field] !== plan.generated.criterion.expected)
+    throw new Error("The provider sandbox record does not satisfy the approved business success definition."); }
+function preflightResult(plan, now, provider, resourceId, observation) { const resultDigest = sha(canonical(observation)); return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `${provider}:${sha(String(resourceId)).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId }, inputDigestSha256: sha(canonical({ resourceId })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: sha(String(resourceId)) })) } } }; }
 function digest(value) { return typeof value === "string" && /^[a-f0-9]{64}$/.test(value); }
 function canonical(value) { if (value === null || typeof value !== "object")
     return JSON.stringify(value); if (Array.isArray(value))

package/dist/runtime-bootstrap.js

@@ -49,8 +49,11 @@ export async function bootstrapLocalRuntime(input) {
         body: JSON.stringify({ ...contract, contractFingerprintSha256 }),
     });
     const body = await response.json().catch(() => ({}));
-    if (!response.ok)
-        throw new Error(`Hosted Runtime bootstrap did not complete (HTTP ${response.status}).`);
+    if (!response.ok) {
+        const detail = typeof body.error === "string" ? body.error : typeof body.message === "string" ? body.message : undefined;
+        const code = typeof body.code === "string" ? body.code : undefined;
+        throw new Error(`Hosted Runtime bootstrap did not complete (HTTP ${response.status})${code ? ` [${code}]` : ""}${detail ? `: ${detail.slice(0, 300)}` : "."}`);
+    }
     const issued = validateResponse(body, contractFingerprintSha256, attempt.deliveryPublicKeyPem);
     const probeCredentialPath = join(directory, "outcome-probe-api-key.txt");
     const probeCredentialMetadataPath = join(directory, "outcome-probe-api-key.json");

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts

@@ -40,6 +40,7 @@ type HttpPackOptions = {
     credentialHandle: string;
     resolveCredential: HttpProductionEvaluatorOptions["resolveCredential"];
     allowedOrigin?: string;
+    resourceType?: string;
     fetch?: typeof fetch;
     timeoutMs?: number;
     now?: () => Date;

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACpF,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAoBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}
+{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3G,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAsBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}

package/dist/vendor/onegent-runtime/provider-integration-packs.js

@@ -26,7 +26,8 @@ export function createProviderPackEvaluator(options) {
     const spec = getProviderIntegrationPack(options.packId);
     if (!spec.environments.includes(options.environment))
         throw new Error("Provider pack does not support this environment.");
-    const select = selector(spec.fieldAllowlist);
+    const selectFields = selector(spec.fieldAllowlist);
+    const select = (value) => selectFields(providerPayload(options.packId, value));
     const common = { provider: spec.provider, environment: options.environment, credentialHandle: options.credentialHandle, resolveCredential: options.resolveCredential, select, timeoutMs: options.timeoutMs, now: options.now };
     if (options.packId === "POSTGRES_RECORD" || options.packId === "MYSQL_RECORD")
         return createDatabaseReadOnlyEvaluator({ ...common, statementId: options.statementId, executePrepared: options.executePrepared });
@@ -36,7 +37,8 @@ export function createProviderPackEvaluator(options) {
     const origin = http.allowedOrigin ?? spec.endpoint.origin;
     if (!origin)
         throw new Error("Provider pack requires the customer-specific HTTPS origin discovered during local setup.");
-    const resourcePath = resourcePathBuilder(spec.endpoint.resourcePattern);
+    validateProviderOrigin(options.packId, origin);
+    const resourcePath = resourcePathBuilder(options.packId, spec.endpoint.resourcePattern, providerResourceType(options.packId, http.resourceType), spec.fieldAllowlist);
     const input = { ...common, allowedOrigin: origin, resourcePath, fetch: http.fetch };
     switch (spec.template) {
         case "CRM_RECORD_STATE": return createCrmRecordStateEvaluator(input);
@@ -71,6 +73,38 @@ function criterion(id, question, field, suggestedValues) { return { id, question
 function selector(fields) {
     return (value) => Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return selected === undefined ? [] : [[field, selected]]; }));
 }
-function resourcePathBuilder(pattern) {
-    return (resourceId) => pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", "records");
+function resourcePathBuilder(packId, pattern, resourceType, fields) {
+    return (resourceId) => {
+        const path = pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", encodeURIComponent(resourceType));
+        return packId === "HUBSPOT_CRM_RECORD" ? `${path}?${new URLSearchParams({ properties: fields.join(",") })}` : path;
+    };
+}
+function providerPayload(packId, value) {
+    if (packId === "ZENDESK_TICKET")
+        return nestedRecord(value, "ticket", "Zendesk ticket response");
+    if (packId === "HUBSPOT_CRM_RECORD")
+        return nestedRecord(value, "properties", "HubSpot record response");
+    return value;
+}
+function validateProviderOrigin(packId, value) {
+    const url = new URL(value);
+    if (packId === "ZENDESK_TICKET" && (url.protocol !== "https:" || !url.hostname.endsWith(".zendesk.com")))
+        throw new Error("Zendesk origin must be an HTTPS customer subdomain of zendesk.com.");
+    if (packId === "SALESFORCE_RECORD" && (url.protocol !== "https:" || !url.hostname.endsWith(".my.salesforce.com")))
+        throw new Error("Salesforce origin must be the customer's HTTPS my.salesforce.com domain.");
+    if (packId === "HUBSPOT_CRM_RECORD" && (url.protocol !== "https:" || url.hostname !== "api.hubapi.com"))
+        throw new Error("HubSpot origin must be the fixed HTTPS api.hubapi.com endpoint.");
+}
+function providerResourceType(packId, value) {
+    if (packId !== "SALESFORCE_RECORD" && packId !== "HUBSPOT_CRM_RECORD")
+        return "records";
+    if (!value || !/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(value))
+        throw new Error(`${packId === "SALESFORCE_RECORD" ? "Salesforce" : "HubSpot"} resource type is invalid.`);
+    return value;
+}
+function nestedRecord(value, key, field) {
+    const nested = value[key];
+    if (!nested || typeof nested !== "object" || Array.isArray(nested))
+        throw new Error(`${field} is missing.`);
+    return nested;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",