witnora 0.20.14 → 0.20.16

package/dist/credentials.js

@@ -68,7 +68,8 @@ export function resolveOnboardServer(options) {
     const server = env.WITNORA_BASE_URL ?? env.AGENTCERT_BASE_URL;
     const projectId = env.WITNORA_BASE_URL !== undefined ? env.WITNORA_PROJECT_ID : env.AGENTCERT_PROJECT_ID;
     if (server && projectId && projectId !== options.projectId) {
-        throw new Error(`Onboarding project "${options.projectId}" differs from environment project "${projectId}". Pass --server <url> explicitly to choose the intended server; no authorization request was sent.`);
+        const projectVariable = env.WITNORA_BASE_URL !== undefined ? "WITNORA_PROJECT_ID" : "AGENTCERT_PROJECT_ID";
+        throw new Error(`Onboarding project "${options.projectId}" differs from environment project "${projectId}". Update or unset ${projectVariable}, or pass --server <url> explicitly to choose the intended server; no authorization request was sent.`);
     }
     return normalizeServer(server ?? DEFAULT_WITNORA_SERVER);
 }
@@ -89,7 +90,8 @@ function validateConnection(input) {
         throw new Error("Witnora project ID is required.");
     if (!apiKey.startsWith("ac_live_"))
         throw new Error("Witnora API key must start with ac_live_.");
-    return { server: normalizeServer(input.server), projectId, apiKey };
+    const approvedSetupPlanId = input.approvedSetupPlanId?.trim();
+    return { server: normalizeServer(input.server), projectId, apiKey, ...(approvedSetupPlanId ? { approvedSetupPlanId } : {}) };
 }
 function normalizeServer(value) {
     let url;

package/dist/device-authorization.js

@@ -25,6 +25,7 @@ export async function authorizeProjectConnection(options) {
         server,
         projectId: token.projectId,
         apiKey: token.apiKey,
+        approvedSetupPlanId: token.approvedSetupPlanId,
     }, { configHome: options.configHome });
     return { ...token, server, credentialsPath };
 }

package/dist/onboard.js

@@ -48,18 +48,19 @@ export async function runOnboard(options) {
         configHome: options.configHome,
     });
     if (reusableConnection)
-        output("Reusing the previously approved project-scoped setup connection; no new browser approval is required.\n");
+        output("Reusing this Agent's previously approved setup connection; verifying its exact Setup Plan.\n");
     const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
-    const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans`, {
+    const planQuery = token.approvedSetupPlanId ? `?setupPlanId=${encodeURIComponent(token.approvedSetupPlanId)}` : "";
+    const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans${planQuery}`, {
         method: "GET", headers: { authorization: `Bearer ${token.apiKey}` },
     });
     const setupPlan = planSnapshot.plan;
-    if (!setupPlan || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
+    if (!setupPlan || (token.approvedSetupPlanId && setupPlan.id !== token.approvedSetupPlanId) || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
         throw new Error("Confirm the Setup Plan and authorize installation in the Witnora Workspace before running onboard.");
     }
     let localRuntime = await discoverRuntimeReferences({
-        repository: repositoryPath, configHome: options.configHome, projectId: token.projectId, server, env: options.env ?? process.env,
+        repository: repositoryPath, configHome: options.configHome, projectId: token.projectId, setupPlanId: setupPlan.id, server, env: options.env ?? process.env,
     });
     let runtimeLimitation = localRuntime.limitation;
     let runtimeBootstrapRequired = !localRuntime.references;
@@ -205,7 +206,7 @@ export async function runOnboard(options) {
         else {
             const binding = await inspectGatewayBinding(gatewayState.directory, token.projectId, server);
             if (binding.matches) {
-                await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
+                await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey, approvedSetupPlanId: setupPlan.id }, { configHome: options.configHome });
                 if (localRuntime.references) {
                     try {
                         runtimeUpgrade = await prepareRuntime(() => upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, agentIdentity, configHome: options.configHome, fetch: requestFetch }));

package/dist/runtime-bootstrap.js

@@ -3,7 +3,7 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises"
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { credentialsPath } from "./credentials.js";
-import { saveRuntimeReferenceManifest } from "./runtime-sandbox-kit.js";
+import { runtimeReferenceManifestPath, saveRuntimeReferenceManifest } from "./runtime-sandbox-kit.js";
 const SCHEMA_VERSION = "witnora.runtime_bootstrap.v0.1";
 const ENVELOPE_ALGORITHM = "X25519-HKDF-SHA256-A256GCM";
 const PROBE_SCOPES = ["outcomes:verify"];
@@ -85,6 +85,7 @@ export async function bootstrapLocalRuntime(input) {
         await acknowledge(requestFetch, endpoint, input.apiKey, issued.bootstrapId, issued.envelope.digestSha256);
     const manifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
     await saveRuntimeReferenceManifest(manifestPath, input.projectId, server, references);
+    await saveRuntimeReferenceManifest(runtimeReferenceManifestPath({ ...input, server, setupPlanId: input.planId }), input.projectId, server, references);
     await rm(attemptPath, { force: true });
     return { references, bootstrapId: issued.bootstrapId };
 }

package/dist/runtime-sandbox-kit.js

@@ -16,15 +16,26 @@ export async function discoverRuntimeReferences(input) {
         runtimeKeyId: input.env.WITNORA_RUNTIME_KEY_ID?.trim(),
         runtimeSigningKeyHandle: input.env.WITNORA_RUNTIME_SIGNING_KEY_HANDLE?.trim(),
     };
-    const manifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
-    const manifest = await optionalJson(manifestPath);
+    const manifestPath = runtimeReferenceManifestPath(input);
+    const legacyManifestPath = join(dirname(credentialsPath({ configHome: input.configHome })), "runtime-references.json");
+    const gateway = input.setupPlanId ? await optionalJson(join(input.repository, ".witnora", "gateway", "gateway.json")) : undefined;
+    const worker = object(gateway?.runtimeWorker);
+    const gatewayReferences = gateway?.projectId === input.projectId && gateway.server === input.server && worker.runtimeSetupPlanId === input.setupPlanId
+        ? completeReferences({ ...worker, setupPlanId: worker.runtimeSetupPlanId, bootstrapId: worker.runtimeBootstrapId,
+            adapterDigestSha256: worker.adapterModuleSha256, probeDigestSha256: worker.probeModuleSha256, fixtureContractDigestSha256: worker.fixtureContractSha256 })
+        : undefined;
+    const manifest = await optionalJson(manifestPath) ?? (gatewayReferences
+        ? { schemaVersion: "witnora.runtime_references.v0.1", projectId: input.projectId, server: input.server, references: gatewayReferences }
+        : await optionalJson(legacyManifestPath));
     const manifestReferences = manifest?.schemaVersion === "witnora.runtime_references.v0.1" && manifest.projectId === input.projectId && manifest.server === input.server
         ? completeReferences(manifest.references)
         : undefined;
+    const matchingReferences = !input.setupPlanId || !manifestReferences?.probeApiKeyId || manifestReferences.setupPlanId === input.setupPlanId
+        ? manifestReferences : undefined;
     const environmentOverrides = Object.fromEntries(Object.entries(entries).filter(([, value]) => value));
-    const configuredReferences = completeReferences({ ...manifestReferences, ...environmentOverrides });
+    const configuredReferences = completeReferences({ ...matchingReferences, ...environmentOverrides });
     if (configuredReferences) {
-        if (Object.keys(environmentOverrides).length > 0)
+        if (input.setupPlanId || Object.keys(environmentOverrides).length > 0)
             await saveRuntimeReferenceManifest(manifestPath, input.projectId, input.server, configuredReferences);
         return { references: configuredReferences, manifestPath };
     }
@@ -48,6 +59,13 @@ export async function discoverRuntimeReferences(input) {
             ? `Local sandbox Runtime references are incomplete (${present.join(", ")} present). Existing Gateway setup remains RECORDED_ONLY.`
             : "No existing private Witnora Runtime reference manifest was found. Gateway setup remains RECORDED_ONLY until Hosted bootstrap can issue one-time Runtime references." };
 }
+export function runtimeReferenceManifestPath(input) {
+    const root = dirname(credentialsPath({ configHome: input.configHome }));
+    if (!input.setupPlanId)
+        return join(root, "runtime-references.json");
+    const bindingId = createHash("sha256").update(JSON.stringify([normalizeServer(input.server), input.projectId, input.setupPlanId])).digest("hex");
+    return join(root, "runtime-bootstrap", bindingId, "runtime-references.json");
+}
 function completeReferences(value) {
     const mandateId = text(value.mandateId);
     const runtimeIdentityId = text(value.runtimeIdentityId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.14",
+  "version": "0.20.16",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",