witnora 0.17.0 → 0.18.0

package/dist/gateway.js

@@ -635,8 +635,13 @@ export async function createConfiguredWorkflowHarness(input) {
     let closing = false;
     let lastTickAt;
     let lastError;
+    let lastProviderHealthAt = 0;
     const tick = async () => {
         try {
+            if (managedEvaluator?.healthCheck && Date.now() - lastProviderHealthAt >= 30_000) {
+                lastProviderHealthAt = Date.now();
+                await managedEvaluator.healthCheck();
+            }
             const result = await worker.tick();
             lastTickAt = new Date().toISOString();
             lastError = (result.evaluationsFailed ?? 0) > 0 ? result.limitations?.[0] ?? "One or more evaluations failed closed." : undefined;
@@ -699,10 +704,11 @@ async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
     if (typeof imported.createWitnoraBusinessTaskEvaluatorOptions !== "function") {
         throw new Error("Managed evaluator module did not export createWitnoraBusinessTaskEvaluatorOptions().");
     }
-    const customerOptions = await imported.createWitnoraBusinessTaskEvaluatorOptions({
+    const evaluatorContext = {
         repository,
         dataDirectory: join(directory, "data", "business-task-evaluator"),
-    });
+    };
+    const customerOptions = await imported.createWitnoraBusinessTaskEvaluatorOptions(evaluatorContext);
     if (!customerOptions || typeof customerOptions !== "object" || Array.isArray(customerOptions)) {
         throw new Error("Managed evaluator module returned invalid Evaluator Kit options.");
     }
@@ -715,7 +721,7 @@ async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
         port: 0,
     });
     const started = await evaluator.start();
-    return { origin: started.origin, credential, close: () => evaluator.close() };
+    return { origin: started.origin, credential, ...(imported.checkWitnoraProviderHealth ? { healthCheck: async () => { await imported.checkWitnoraProviderHealth(evaluatorContext); } } : {}), close: () => evaluator.close() };
 }
 async function runtimeSandboxFixtureReady(config) {
     try {

package/dist/real-path-activation.js

@@ -21,6 +21,7 @@ export async function activateRealPathIntegrations(options) {
     for (const plan of plans) {
         const preflight = await providerPreflight(request, environment, plan, options.now?.() ?? new Date(), options.postgresClientFactory);
         const acceptance = preflight.acceptance;
+        await persistProviderCredential(repository, plan, environment);
         activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, acceptance });
         scenarios.push({ plan, value: [preflight.scenario] });
     }
@@ -191,20 +192,48 @@ async function postgresPreflight(env, plan, now, clientFactory) {
 }
 async function defaultPostgresClient(connectionString) { const imported = await import("pg"); return new imported.Client({ connectionString, application_name: "witnora-read-only-preflight" }); }
 function generatedProviderHarness(plans) {
-    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, providerPackId: plan.generated.providerPackId, providerConfiguration: plan.generated.providerConfiguration ?? {}, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
+    const contracts = plans.map((plan) => ({ taskContractId: plan.taskContractId, providerPackId: plan.generated.providerPackId, providerConfiguration: plan.generated.providerConfiguration ?? {}, credentialHandle: `.witnora/provider-credentials/${plan.id}.secret`, criterion: plan.generated.criterion, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId) }));
     return `import {createHash} from "node:crypto";
 import {readFile} from "node:fs/promises";
 import {join} from "node:path";
 const contracts=${JSON.stringify(contracts)};
 const sha=(value)=>createHash("sha256").update(typeof value==="string"?value:JSON.stringify(value)).digest("hex");
 const request=async(url,key)=>{const response=await fetch(url,{method:"GET",headers:{accept:"application/json",authorization:"Bearer "+key},redirect:"error",signal:AbortSignal.timeout(5000)});if(!response.ok)throw new Error("Provider read-only observation failed ("+response.status+").");return response.json();};
-const observe=async(contract,resourceId)=>{if(contract.providerPackId==="STRIPE_REFUND"){const key=process.env.STRIPE_SECRET_KEY;if(!key?.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");return request("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="ZENDESK_TICKET"){const key=process.env.ZENDESK_API_TOKEN;if(!key)throw new Error("Zendesk read-only credential is unavailable.");return (await request(contract.providerConfiguration.origin+"/api/v2/tickets/"+encodeURIComponent(resourceId)+".json",key)).ticket;}if(contract.providerPackId==="SALESFORCE_RECORD"){const key=process.env.SALESFORCE_ACCESS_TOKEN;if(!key)throw new Error("Salesforce read-only credential is unavailable.");return request(contract.providerConfiguration.origin+"/services/data/v61.0/sobjects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="HUBSPOT_CRM_RECORD"){const key=process.env.HUBSPOT_ACCESS_TOKEN;if(!key)throw new Error("HubSpot read-only credential is unavailable.");return (await request("https://api.hubapi.com/crm/v3/objects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId)+"?properties="+encodeURIComponent(contract.criterion.field),key)).properties;}if(contract.providerPackId==="POSTGRES_RECORD"){const url=process.env.WITNORA_POSTGRES_READ_URL;if(!url)throw new Error("PostgreSQL read-only credential is unavailable.");for(const name of [contract.providerConfiguration.viewName,contract.providerConfiguration.idColumn,contract.criterion.field])if(!/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(name))throw new Error("PostgreSQL identifier is invalid.");const {Client}=await import("pg");const client=new Client({connectionString:url,application_name:"witnora-read-only-probe"});await client.connect();try{await client.query("BEGIN READ ONLY");const result=await client.query({name:"witnora-provider-observe",text:'SELECT "'+contract.criterion.field+'" FROM "'+contract.providerConfiguration.viewName+'" WHERE "'+contract.providerConfiguration.idColumn+'" = $1 LIMIT 1',values:[resourceId]});await client.query("ROLLBACK");return result.rows[0]??{};}catch(error){await client.query("ROLLBACK").catch(()=>{});throw error;}finally{await client.end();}}throw new Error("Provider Harness contract is unsupported.");};
+const observe=async(contract,resourceId,repository)=>{const key=(await readFile(join(repository,contract.credentialHandle),"utf8")).trim();if(!key)throw new Error("The local read-only Provider credential is unavailable.");if(contract.providerPackId==="STRIPE_REFUND"){if(!key.startsWith("sk_test_"))throw new Error("Stripe test-mode credential is unavailable.");return request("https://api.stripe.com/v1/refunds/"+encodeURIComponent(resourceId),key);}if(contract.providerPackId==="ZENDESK_TICKET")return (await request(contract.providerConfiguration.origin+"/api/v2/tickets/"+encodeURIComponent(resourceId)+".json",key)).ticket;if(contract.providerPackId==="SALESFORCE_RECORD")return request(contract.providerConfiguration.origin+"/services/data/v61.0/sobjects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId),key);if(contract.providerPackId==="HUBSPOT_CRM_RECORD")return (await request("https://api.hubapi.com/crm/v3/objects/"+encodeURIComponent(contract.providerConfiguration.resourceType)+"/"+encodeURIComponent(resourceId)+"?properties="+encodeURIComponent(contract.criterion.field),key)).properties;if(contract.providerPackId==="POSTGRES_RECORD"){for(const name of [contract.providerConfiguration.viewName,contract.providerConfiguration.idColumn,contract.criterion.field])if(!/^[A-Za-z][A-Za-z0-9_]{0,99}$/.test(name))throw new Error("PostgreSQL identifier is invalid.");const {Client}=await import("pg");const client=new Client({connectionString:key,application_name:"witnora-read-only-probe"});await client.connect();try{await client.query("BEGIN READ ONLY");const result=await client.query({name:"witnora-provider-observe",text:'SELECT "'+contract.criterion.field+'" FROM "'+contract.providerConfiguration.viewName+'" WHERE "'+contract.providerConfiguration.idColumn+'" = $1 LIMIT 1',values:[resourceId]});await client.query("ROLLBACK");return result.rows[0]??{};}catch(error){await client.query("ROLLBACK").catch(()=>{});throw error;}finally{await client.end();}}throw new Error("Provider Harness contract is unsupported.");};
 export function createWitnoraBusinessTaskEvaluatorOptions(context){return {
 loadShadowObservations:async(task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const path=join(context.repository,".witnora","scenarios",task.id+".json");const value=JSON.parse(await readFile(path,"utf8"));if(!Array.isArray(value)||value.length>100)throw new Error("Local scenario file is invalid.");return value;},
-evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const raw=await observe(contract,resourceId);const actual=raw?.[contract.criterion.field];const observed=actual===undefined?{}:{[contract.criterion.field]:actual};return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}
+evaluateShadowCandidate:async(candidate,task)=>{const contract=contracts.find((item)=>item.taskContractId===task.id);if(!contract)throw new Error("No exact real-path contract.");const resourceId=String(candidate.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider resourceId is invalid.");for(const pathId of contract.actionPathIds)candidate.propose({pathId,parametersDigestSha256:sha(resourceId)});const raw=await observe(contract,resourceId,context.repository);const actual=raw?.[contract.criterion.field];const observed=actual===undefined?{}:{[contract.criterion.field]:actual};return {resultDigestSha256:sha(observed),criteria:[{id:contract.criterion.id,passed:actual===contract.criterion.expected}]};}
 };}
+export async function checkWitnoraProviderHealth(context){for(const contract of contracts){const path=join(context.repository,".witnora","scenarios",contract.taskContractId+".json");const scenarios=JSON.parse(await readFile(path,"utf8"));const resourceId=String(scenarios?.[0]?.input?.resourceId??"");if(!/^[A-Za-z0-9._:-]{1,200}$/.test(resourceId))throw new Error("Provider health scenario is unavailable.");const raw=await observe(contract,resourceId,context.repository);if(raw?.[contract.criterion.field]===undefined)throw new Error("The approved Provider result field is no longer observable.");}return {ready:true,checked:contracts.length};}
 `;
 }
+async function persistProviderCredential(repository, plan, environment) {
+    const name = providerCredentialEnvironmentName(plan.generated.providerPackId);
+    const value = environment[name];
+    if (!value)
+        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
+    const directory = join(repository, ".witnora", "provider-credentials");
+    const target = join(directory, `${plan.id}.secret`);
+    const temporary = `${target}.${randomUUID()}.tmp`;
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, ".gitignore"), "*\n!.gitignore\n", { encoding: "utf8", mode: 0o600, flag: "wx" }).catch((error) => { if (error.code !== "EEXIST")
+        throw error; });
+    await writeFile(temporary, value, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, target);
+}
+function providerCredentialEnvironmentName(packId) {
+    if (packId === "STRIPE_REFUND")
+        return "STRIPE_SECRET_KEY";
+    if (packId === "ZENDESK_TICKET")
+        return "ZENDESK_API_TOKEN";
+    if (packId === "SALESFORCE_RECORD")
+        return "SALESFORCE_ACCESS_TOKEN";
+    if (packId === "HUBSPOT_CRM_RECORD")
+        return "HUBSPOT_ACCESS_TOKEN";
+    if (packId === "POSTGRES_RECORD")
+        return "WITNORA_POSTGRES_READ_URL";
+    throw new Error(`Provider credential mapping is not supported for ${packId}.`);
+}
 function parsePlan(value) { if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Real-path integration response is invalid."); const plan = value; if (plan.schemaVersion !== "witnora.real_path_integration.v0.1" || !plan.id || !plan.taskContractId || !plan.subject?.agentId || !plan.subject.agentVersion || !plan.generated || plan.generated.boundaries?.rawPayloadUpload !== false || plan.generated.boundaries.rawCredentialUpload !== false || plan.generated.boundaries.evaluatorWrites !== false || plan.generated.boundaries.firstAcceptanceProductionWrites !== 0 || !digest(plan.digestSha256) || !digest(plan.taskContractDigestSha256) || !digest(plan.generated.providerContractDigestSha256))
     throw new Error("Real-path integration response failed its safety contract."); return plan; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",