witnora 0.16.0 → 0.18.0

package/dist/gateway.js

@@ -635,8 +635,13 @@ export async function createConfiguredWorkflowHarness(input) {
     let closing = false;
     let lastTickAt;
     let lastError;
+    let lastProviderHealthAt = 0;
     const tick = async () => {
         try {
+            if (managedEvaluator?.healthCheck && Date.now() - lastProviderHealthAt >= 30_000) {
+                lastProviderHealthAt = Date.now();
+                await managedEvaluator.healthCheck();
+            }
             const result = await worker.tick();
             lastTickAt = new Date().toISOString();
             lastError = (result.evaluationsFailed ?? 0) > 0 ? result.limitations?.[0] ?? "One or more evaluations failed closed." : undefined;
@@ -699,10 +704,11 @@ async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
     if (typeof imported.createWitnoraBusinessTaskEvaluatorOptions !== "function") {
         throw new Error("Managed evaluator module did not export createWitnoraBusinessTaskEvaluatorOptions().");
     }
-    const customerOptions = await imported.createWitnoraBusinessTaskEvaluatorOptions({
+    const evaluatorContext = {
         repository,
         dataDirectory: join(directory, "data", "business-task-evaluator"),
-    });
+    };
+    const customerOptions = await imported.createWitnoraBusinessTaskEvaluatorOptions(evaluatorContext);
     if (!customerOptions || typeof customerOptions !== "object" || Array.isArray(customerOptions)) {
         throw new Error("Managed evaluator module returned invalid Evaluator Kit options.");
     }
@@ -715,7 +721,7 @@ async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
         port: 0,
     });
     const started = await evaluator.start();
-    return { origin: started.origin, credential, close: () => evaluator.close() };
+    return { origin: started.origin, credential, ...(imported.checkWitnoraProviderHealth ? { healthCheck: async () => { await imported.checkWitnoraProviderHealth(evaluatorContext); } } : {}), close: () => evaluator.close() };
 }
 async function runtimeSandboxFixtureReady(config) {
     try {

package/dist/real-path-activation.js

@@ -12,23 +12,22 @@ export async function activateRealPathIntegrations(options) {
         throw new Error(`Could not load approved real-path integrations (${response.status}).`);
     const body = await boundedJson(response);
     const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
-    const plans = approved.filter((plan) => plan.generated.providerPackId === "STRIPE_REFUND" && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
+    const plans = approved.filter((plan) => ["STRIPE_REFUND", "ZENDESK_TICKET", "SALESFORCE_RECORD", "HUBSPOT_CRM_RECORD", "POSTGRES_RECORD"].includes(plan.generated.providerPackId) && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
     if (!plans.length)
         return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [] };
-    const secret = options.env?.STRIPE_SECRET_KEY ?? process.env.STRIPE_SECRET_KEY;
-    if (!secret?.startsWith("sk_test_") || secret.length < 12)
-        throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+    const environment = options.env ?? process.env;
     const activations = [];
     const scenarios = [];
     for (const plan of plans) {
-        const preflight = await stripePreflight(request, secret, plan, options.now?.() ?? new Date());
+        const preflight = await providerPreflight(request, environment, plan, options.now?.() ?? new Date(), options.postgresClientFactory);
         const acceptance = preflight.acceptance;
+        await persistProviderCredential(repository, plan, environment);
         activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, acceptance });
         scenarios.push({ plan, value: [preflight.scenario] });
     }
     const modulePath = join(repository, "witnora.assurance-harness.mjs");
     const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
-    const source = generatedStripeHarness(plans);
+    const source = generatedProviderHarness(plans);
     const moduleDigestSha256 = sha(source);
     let created = false;
     const generatedFiles = [];
@@ -65,6 +64,23 @@ export async function activateRealPathIntegrations(options) {
     }
     return { state: "READY_TO_START", created, modulePath: "witnora.assurance-harness.mjs", activations, generatedFiles };
 }
+async function providerPreflight(request, env, plan, now, postgresClientFactory) {
+    if (plan.generated.providerPackId === "STRIPE_REFUND") {
+        const secret = env.STRIPE_SECRET_KEY;
+        if (!secret?.startsWith("sk_test_") || secret.length < 12)
+            throw new Error("Stripe test-mode activation requires STRIPE_SECRET_KEY to reference an sk_test_ credential in the customer environment.");
+        return stripePreflight(request, secret, plan, now);
+    }
+    if (plan.generated.providerPackId === "ZENDESK_TICKET")
+        return zendeskPreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "SALESFORCE_RECORD")
+        return salesforcePreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "HUBSPOT_CRM_RECORD")
+        return hubspotPreflight(request, env, plan, now);
+    if (plan.generated.providerPackId === "POSTGRES_RECORD")
+        return postgresPreflight(env, plan, now, postgresClientFactory);
+    throw new Error(`${plan.generated.providerPackId} activation is not implemented by this CLI version.`);
+}
 async function stripePreflight(request, secret, plan, now) {
     const response = await request("https://api.stripe.com/v1/refunds?limit=1", { headers: { authorization: `Bearer ${secret}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
     if (!response.ok)
@@ -82,9 +98,141 @@ async function stripePreflight(request, secret, plan, now) {
     const resultDigest = sha(canonical(observation));
     return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `stripe:${sha(first.id).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId: first.id }, inputDigestSha256: sha(canonical({ resourceId: first.id })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: parameterDigest })) } } };
 }
-function generatedStripeHarness(plans) {
-    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
-    return `import {createHash} from "node:crypto";\nimport {readFile} from "node:fs/promises";\nimport {join} from "node:path";\nconst contracts=${JSON.stringify(contracts)};\nconst sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");\nexport function createWitnoraBusinessTaskEvaluatorOptions(context){return {\n loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},\n evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^re_[A-Za-z0-9_]{1,200}$/.test(resourceId))throw new Error("Stripe refund resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");const response=await fetch("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),{headers:{authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Stripe read-only observation failed.");const raw=await response.json();const observed={status:raw.status,amount:raw.amount,currency:raw.currency,failure_reason:raw.failure_reason};const actual=observed[contract.criterion.field];return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}\n};}\n`;
+async function zendeskPreflight(request, env, plan, now) {
+    const token = env.ZENDESK_API_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("Zendesk activation requires the read-only ZENDESK_API_TOKEN in the customer environment.");
+    const origin = providerOrigin(plan, "Zendesk", ".zendesk.com");
+    const response = await request(`${origin}/api/v2/tickets.json?per_page=1&sort_by=updated_at&sort_order=desc`, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Zendesk read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const tickets = Array.isArray(body.tickets) ? body.tickets : [];
+    const first = record(tickets[0], "Zendesk ticket");
+    const id = first.id;
+    if (typeof id !== "number" && typeof id !== "string")
+        throw new Error("Zendesk preflight requires one existing sandbox ticket.");
+    const observation = pick(first, ["status", "priority", "type", "via.channel"]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "zendesk", id, observation);
+}
+async function salesforcePreflight(request, env, plan, now) {
+    const token = env.SALESFORCE_ACCESS_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("Salesforce activation requires the read-only SALESFORCE_ACCESS_TOKEN in the customer environment.");
+    const origin = providerOrigin(plan, "Salesforce", ".my.salesforce.com");
+    const resourceType = providerIdentifier(plan.generated.providerConfiguration?.resourceType, "Salesforce record type");
+    const field = providerIdentifier(plan.generated.criterion.field, "Salesforce criterion field");
+    const query = `SELECT Id,${field} FROM ${resourceType} ORDER BY LastModifiedDate DESC LIMIT 1`;
+    const response = await request(`${origin}/services/data/v61.0/query?${new URLSearchParams({ q: query })}`, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`Salesforce read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const records = Array.isArray(body.records) ? body.records : [];
+    const first = record(records[0], "Salesforce record");
+    const id = first.Id;
+    if (typeof id !== "string")
+        throw new Error("Salesforce preflight requires one existing sandbox record.");
+    const observation = pick(first, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "salesforce", id, observation);
+}
+async function hubspotPreflight(request, env, plan, now) {
+    const token = env.HUBSPOT_ACCESS_TOKEN;
+    if (!token || token.length < 8)
+        throw new Error("HubSpot activation requires the read-only HUBSPOT_ACCESS_TOKEN in the customer environment.");
+    const resourceType = providerIdentifier(plan.generated.providerConfiguration?.resourceType, "HubSpot record type");
+    const field = providerIdentifier(plan.generated.criterion.field, "HubSpot criterion field");
+    const url = `https://api.hubapi.com/crm/v3/objects/${encodeURIComponent(resourceType)}?${new URLSearchParams({ limit: "1", properties: field })}`;
+    const response = await request(url, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${token}` }, redirect: "error", signal: AbortSignal.timeout(5_000) });
+    if (!response.ok)
+        throw new Error(`HubSpot read-only preflight failed (${response.status}).`);
+    const body = await boundedJson(response);
+    const results = Array.isArray(body.results) ? body.results : [];
+    const first = record(results[0], "HubSpot record");
+    const id = first.id;
+    if (typeof id !== "string")
+        throw new Error("HubSpot preflight requires one existing sandbox record.");
+    const properties = record(first.properties, "HubSpot properties");
+    const observation = pick(properties, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "hubspot", id, observation);
+}
+async function postgresPreflight(env, plan, now, clientFactory) {
+    const connectionString = env.WITNORA_POSTGRES_READ_URL;
+    if (!connectionString)
+        throw new Error("PostgreSQL activation requires WITNORA_POSTGRES_READ_URL in the customer environment.");
+    const view = providerIdentifier(plan.generated.providerConfiguration?.viewName, "PostgreSQL approved view");
+    const idColumn = providerIdentifier(plan.generated.providerConfiguration?.idColumn, "PostgreSQL record ID column");
+    const field = providerIdentifier(plan.generated.criterion.field, "PostgreSQL criterion field");
+    const client = clientFactory ? clientFactory(connectionString) : await defaultPostgresClient(connectionString);
+    await client.connect();
+    let first;
+    try {
+        await client.query("BEGIN READ ONLY");
+        const result = await client.query({ text: `SELECT "${idColumn}", "${field}" FROM "${view}" ORDER BY "${idColumn}" DESC LIMIT 1` });
+        first = result.rows[0];
+        await client.query("ROLLBACK");
+    }
+    catch (error) {
+        await client.query("ROLLBACK").catch(() => undefined);
+        throw error;
+    }
+    finally {
+        await client.end();
+    }
+    if (!first)
+        throw new Error("PostgreSQL preflight requires one existing record in the approved read-only view.");
+    const id = first[idColumn];
+    if (typeof id !== "string" && typeof id !== "number")
+        throw new Error("PostgreSQL preflight returned an invalid record ID.");
+    const observation = pick(first, [field]);
+    assertCriterion(plan, observation);
+    return preflightResult(plan, now, "postgres", id, observation);
+}
+async function defaultPostgresClient(connectionString) { const imported = await import("pg"); return new imported.Client({ connectionString, application_name: "witnora-read-only-preflight" }); }
+function generatedProviderHarness(plans) {
+    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, providerPackId: plan.generated.providerPackId, providerConfiguration: plan.generated.providerConfiguration ?? {}, credentialHandle: `.witnora/provider-credentials/${plan.id}.secret`, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
+    return `import {createHash} from "node:crypto";
+import {readFile} from "node:fs/promises";
+import {join} from "node:path";
+const contracts=${JSON.stringify(contracts)};
+const sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");
+const request=async(url,key)=>{const response=await fetch(url,{method:"GET",headers:{accept:"application/json",authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Provider read-only observation failed ("+response.status+").");return response.json();};
+const observe=async(contract,resourceId,repository)=>{const key=(await readFile(join(repository,contract.credentialHandle),"utf8")).trim();if(!key)throw new Error("The local read-only Provider credential is unavailable.");if(contract.providerPackId==="STRIPE_REFUND"){if(!key.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");return request("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="ZENDESK_TICKET")return (await request(contract.providerConfiguration.origin+"/api/v2/tickets/"+encodeURIComponent(resourceId)+".json",key)).ticket;if(contract.providerPackId==="SALESFORCE_RECORD")return request(contract.providerConfiguration.origin+"/services/data/v61.0/sobjects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId),key);if(contract.providerPackId==="HUBSPOT_CRM_RECORD")return (await request("https://api.hubapi.com/crm/v3/objects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId)+"?properties="+encodeURIComponent(contract.criterion.field),key)).properties;if(contract.providerPackId==="POSTGRES_RECORD"){for(const name of [contract.providerConfiguration.viewName,contract.providerConfiguration.idColumn,contract.criterion.field])if(!/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(name))throw new Error("PostgreSQL identifier is invalid.");const {Client}=await import("pg");const client=new Client({connectionString:key,application_name:"witnora-read-only-probe"});await client.connect();try{await client.query("BEGIN READ ONLY");const result=await client.query({name:"witnora-provider-observe",text:'SELECT "'+contract.criterion.field+'" FROM "'+contract.providerConfiguration.viewName+'" WHERE "'+contract.providerConfiguration.idColumn+'" = $1 LIMIT 1',values:[resourceId]});await client.query("ROLLBACK");return result.rows[0]??{};}catch(error){await client.query("ROLLBACK").catch(()=>{});throw error;}finally{await client.end();}}throw new Error("Provider Harness contract is unsupported.");};
+export function createWitnoraBusinessTaskEvaluatorOptions(context){return {
+loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},
+evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const raw=await observe(contract,resourceId,context.repository);const actual=raw?.[contract.criterion.field];const observed=actual===undefined?{}:{[contract.criterion.field]:actual};return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}
+};}
+export async function checkWitnoraProviderHealth(context){for(const contract of contracts){const path=join(context.repository,".witnora","scenarios",contract.taskContractId+".json");const scenarios=JSON.parse(await readFile(path,"utf8"));const resourceId=String(scenarios?.[0]?.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider health scenario is unavailable.");const raw=await observe(contract,resourceId,context.repository);if(raw?.[contract.criterion.field]===undefined)throw new Error("The approved Provider result field is no longer observable.");}return {ready:true,checked:contracts.length};}
+`;
+}
+async function persistProviderCredential(repository, plan, environment) {
+    const name = providerCredentialEnvironmentName(plan.generated.providerPackId);
+    const value = environment[name];
+    if (!value)
+        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
+    const directory = join(repository, ".witnora", "provider-credentials");
+    const target = join(directory, `${plan.id}.secret`);
+    const temporary = `${target}.${randomUUID()}.tmp`;
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, ".gitignore"), "*\n!.gitignore\n", { encoding: "utf8", mode: 0o600, flag: "wx" }).catch((error) => { if (error.code !== "EEXIST")
+        throw error; });
+    await writeFile(temporary, value, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, target);
+}
+function providerCredentialEnvironmentName(packId) {
+    if (packId === "STRIPE_REFUND")
+        return "STRIPE_SECRET_KEY";
+    if (packId === "ZENDESK_TICKET")
+        return "ZENDESK_API_TOKEN";
+    if (packId === "SALESFORCE_RECORD")
+        return "SALESFORCE_ACCESS_TOKEN";
+    if (packId === "HUBSPOT_CRM_RECORD")
+        return "HUBSPOT_ACCESS_TOKEN";
+    if (packId === "POSTGRES_RECORD")
+        return "WITNORA_POSTGRES_READ_URL";
+    throw new Error(`Provider credential mapping is not supported for ${packId}.`);
 }
 function parsePlan(value) { if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Real-path integration response is invalid."); const plan = value; if (plan.schemaVersion !== "witnora.real_path_integration.v0.1" || !plan.id || !plan.taskContractId || !plan.subject?.agentId || !plan.subject.agentVersion || !plan.generated || plan.generated.boundaries?.rawPayloadUpload !== false || plan.generated.boundaries.rawCredentialUpload !== false || plan.generated.boundaries.evaluatorWrites !== false || plan.generated.boundaries.firstAcceptanceProductionWrites !== 0 || !digest(plan.digestSha256) || !digest(plan.taskContractDigestSha256) || !digest(plan.generated.providerContractDigestSha256))
@@ -93,6 +241,23 @@ async function boundedJson(response) { const text = await response.text(); if (t
     throw new Error("Real-path response exceeded the size limit."); const value = JSON.parse(text); if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Real-path response is invalid."); return value; }
 function scalar(value) { return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean"; }
+function providerOrigin(plan, provider, suffix) { const value = plan.generated.providerConfiguration?.origin; try {
+    const url = new URL(value ?? "");
+    if (url.protocol !== "https:" || !url.hostname.endsWith(suffix) || url.origin !== (value ?? "").replace(/\/$/, ""))
+        throw new Error();
+    return url.origin;
+}
+catch {
+    throw new Error(`${provider} integration has an invalid trusted origin.`);
+} }
+function providerIdentifier(value, field) { if (!value || !/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(value))
+    throw new Error(`${field} is invalid.`); return value; }
+function record(value, field) { if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${field} response is invalid.`); return value; }
+function pick(value, fields) { return Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return scalar(selected) ? [[field, selected]] : []; })); }
+function assertCriterion(plan, observation) { if (observation[plan.generated.criterion.field] !== plan.generated.criterion.expected)
+    throw new Error("The provider sandbox record does not satisfy the approved business success definition."); }
+function preflightResult(plan, now, provider, resourceId, observation) { const resultDigest = sha(canonical(observation)); return { acceptance: { kind: "READ_ONLY_PROVIDER_PREFLIGHT", passedAt: now.toISOString(), productionWrites: 0, observationDigestSha256: resultDigest }, scenario: { id: `${provider}:${sha(String(resourceId)).slice(0, 16)}`, source: "LIVE_SHADOW", sanitized: true, input: { resourceId }, inputDigestSha256: sha(canonical({ resourceId })), baseline: { resultDigestSha256: resultDigest, actionIntents: plan.generated.actionPathBindings.map((item) => ({ pathId: item.actionPathId, parametersDigestSha256: sha(String(resourceId)) })) } } }; }
 function digest(value) { return typeof value === "string" && /^[a-f0-9]{64}$/.test(value); }
 function canonical(value) { if (value === null || typeof value !== "object")
     return JSON.stringify(value); if (Array.isArray(value))

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts

@@ -40,6 +40,7 @@ type HttpPackOptions = {
     credentialHandle: string;
     resolveCredential: HttpProductionEvaluatorOptions["resolveCredential"];
     allowedOrigin?: string;
+    resourceType?: string;
     fetch?: typeof fetch;
     timeoutMs?: number;
     now?: () => Date;

package/dist/vendor/onegent-runtime/provider-integration-packs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACpF,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAoBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}
+{"version":3,"file":"provider-integration-packs.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/provider-integration-packs.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,wCAAwC,EAAG,wCAAiD,CAAC;AAE1G,MAAM,MAAM,yBAAyB,GACjC,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,iBAAiB,GACnG,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,EAAE,EAAE,yBAAyB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAAC;IAClJ,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC1H,QAAQ,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,UAAU,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,gBAAgB,EAAE,KAAK,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IACrG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,OAAO,CAAC,yBAAyB,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;IACpG,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;IACpJ,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3G,CAAC;AACF,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxH,iBAAiB,EAAE,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;IACpK,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AACF,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IACxG,iBAAiB,EAAE,sCAAsC,CAAC,mBAAmB,CAAC,CAAC;IAAC,gBAAgB,EAAE,sCAAsC,CAAC,kBAAkB,CAAC,CAAC;IAC7J,OAAO,EAAE,sCAAsC,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,sCAAsC,CAAC;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC;IACpB,yBAAyB,EAAE,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAgBD,wBAAgB,4BAA4B,IAAI,uBAAuB,EAAE,CAAsD;AAC/H,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,yBAAyB,GAAG,uBAAuB,CAEjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,0BAA0B,CAsBnH;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,SAAS,EAAE,0BAA0B,CAAC;IACtC,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACtF,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAYvC"}

package/dist/vendor/onegent-runtime/provider-integration-packs.js

@@ -26,7 +26,8 @@ export function createProviderPackEvaluator(options) {
     const spec = getProviderIntegrationPack(options.packId);
     if (!spec.environments.includes(options.environment))
         throw new Error("Provider pack does not support this environment.");
-    const select = selector(spec.fieldAllowlist);
+    const selectFields = selector(spec.fieldAllowlist);
+    const select = (value) => selectFields(providerPayload(options.packId, value));
     const common = { provider: spec.provider, environment: options.environment, credentialHandle: options.credentialHandle, resolveCredential: options.resolveCredential, select, timeoutMs: options.timeoutMs, now: options.now };
     if (options.packId === "POSTGRES_RECORD" || options.packId === "MYSQL_RECORD")
         return createDatabaseReadOnlyEvaluator({ ...common, statementId: options.statementId, executePrepared: options.executePrepared });
@@ -36,7 +37,8 @@ export function createProviderPackEvaluator(options) {
     const origin = http.allowedOrigin ?? spec.endpoint.origin;
     if (!origin)
         throw new Error("Provider pack requires the customer-specific HTTPS origin discovered during local setup.");
-    const resourcePath = resourcePathBuilder(spec.endpoint.resourcePattern);
+    validateProviderOrigin(options.packId, origin);
+    const resourcePath = resourcePathBuilder(options.packId, spec.endpoint.resourcePattern, providerResourceType(options.packId, http.resourceType), spec.fieldAllowlist);
     const input = { ...common, allowedOrigin: origin, resourcePath, fetch: http.fetch };
     switch (spec.template) {
         case "CRM_RECORD_STATE": return createCrmRecordStateEvaluator(input);
@@ -71,6 +73,38 @@ function criterion(id, question, field, suggestedValues) { return { id, question
 function selector(fields) {
     return (value) => Object.fromEntries(fields.flatMap((field) => { const selected = field.split(".").reduce((current, key) => current && typeof current === "object" ? current[key] : undefined, value); return selected === undefined ? [] : [[field, selected]]; }));
 }
-function resourcePathBuilder(pattern) {
-    return (resourceId) => pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", "records");
+function resourcePathBuilder(packId, pattern, resourceType, fields) {
+    return (resourceId) => {
+        const path = pattern.replace("{resourceId}", encodeURIComponent(resourceId)).replace("{object}", encodeURIComponent(resourceType));
+        return packId === "HUBSPOT_CRM_RECORD" ? `${path}?${new URLSearchParams({ properties: fields.join(",") })}` : path;
+    };
+}
+function providerPayload(packId, value) {
+    if (packId === "ZENDESK_TICKET")
+        return nestedRecord(value, "ticket", "Zendesk ticket response");
+    if (packId === "HUBSPOT_CRM_RECORD")
+        return nestedRecord(value, "properties", "HubSpot record response");
+    return value;
+}
+function validateProviderOrigin(packId, value) {
+    const url = new URL(value);
+    if (packId === "ZENDESK_TICKET" && (url.protocol !== "https:" || !url.hostname.endsWith(".zendesk.com")))
+        throw new Error("Zendesk origin must be an HTTPS customer subdomain of zendesk.com.");
+    if (packId === "SALESFORCE_RECORD" && (url.protocol !== "https:" || !url.hostname.endsWith(".my.salesforce.com")))
+        throw new Error("Salesforce origin must be the customer's HTTPS my.salesforce.com domain.");
+    if (packId === "HUBSPOT_CRM_RECORD" && (url.protocol !== "https:" || url.hostname !== "api.hubapi.com"))
+        throw new Error("HubSpot origin must be the fixed HTTPS api.hubapi.com endpoint.");
+}
+function providerResourceType(packId, value) {
+    if (packId !== "SALESFORCE_RECORD" && packId !== "HUBSPOT_CRM_RECORD")
+        return "records";
+    if (!value || !/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(value))
+        throw new Error(`${packId === "SALESFORCE_RECORD" ? "Salesforce" : "HubSpot"} resource type is invalid.`);
+    return value;
+}
+function nestedRecord(value, key, field) {
+    const nested = value[key];
+    if (!nested || typeof nested !== "object" || Array.isArray(nested))
+        throw new Error(`${field} is missing.`);
+    return nested;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",