@angriff36/manifest 2.18.0

package/dist/manifest/api-diagnostics.js

@@ -0,0 +1,105 @@
+/**
+ * Normalize a CommandResult into a consistent API response shape.
+ *
+ * This function bridges the gap between the runtime's CommandResult structure
+ * and a consistent API contract that surfaces all diagnostic information.
+ *
+ * @param entityName - Name of the entity the command operates on
+ * @param commandName - Name of the command being executed
+ * @param result - CommandResult from RuntimeEngine.runCommand()
+ * @returns Normalized result with consistent diagnostic structure
+ */
+export function normalizeCommandResult(entityName, commandName, result) {
+    const diagnostics = [];
+    if (result.success) {
+        // Success case: include warnings from constraint outcomes
+        if (result.constraintOutcomes) {
+            for (const outcome of result.constraintOutcomes) {
+                if (outcome.severity === 'warn' && !outcome.passed) {
+                    diagnostics.push({
+                        kind: 'constraint_warn',
+                        entity: entityName,
+                        command: commandName,
+                        ruleName: outcome.code,
+                        message: outcome.message || outcome.formatted,
+                        resolved: outcome.resolved,
+                        details: outcome.details,
+                    });
+                }
+            }
+        }
+        return {
+            success: true,
+            data: result.result,
+            events: result.emittedEvents,
+            diagnostics: diagnostics.length > 0 ? diagnostics : undefined,
+        };
+    }
+    // Failure case: convert all failure modes to diagnostics
+    // Guard failure
+    if (result.guardFailure) {
+        diagnostics.push(convertGuardFailure(entityName, commandName, result.guardFailure));
+    }
+    // Policy denial
+    if (result.policyDenial) {
+        diagnostics.push(convertPolicyDenial(entityName, commandName, result.policyDenial));
+    }
+    // Blocked constraints
+    if (result.constraintOutcomes) {
+        for (const outcome of result.constraintOutcomes) {
+            if (outcome.severity === 'block' && !outcome.passed) {
+                diagnostics.push({
+                    kind: 'constraint_block',
+                    entity: entityName,
+                    command: commandName,
+                    ruleName: outcome.code,
+                    message: outcome.message || outcome.formatted,
+                    resolved: outcome.resolved,
+                    details: outcome.details,
+                });
+            }
+        }
+    }
+    // Generic runtime error (fallback)
+    if (diagnostics.length === 0 && result.error) {
+        diagnostics.push({
+            kind: 'runtime_error',
+            entity: entityName,
+            command: commandName,
+            message: result.error,
+        });
+    }
+    return {
+        success: false,
+        error: result.error || 'Command failed',
+        diagnostics,
+        events: result.emittedEvents,
+    };
+}
+/**
+ * Convert a GuardFailure to a RuntimeDiagnostic
+ */
+function convertGuardFailure(entityName, commandName, guardFailure) {
+    return {
+        kind: 'guard_failure',
+        entity: entityName,
+        command: commandName,
+        ruleName: `guard[${guardFailure.index}]`,
+        message: guardFailure.formatted,
+        resolved: guardFailure.resolved,
+    };
+}
+/**
+ * Convert a PolicyDenial to a RuntimeDiagnostic
+ */
+function convertPolicyDenial(entityName, commandName, policyDenial) {
+    return {
+        kind: 'policy_denial',
+        entity: entityName,
+        command: commandName,
+        ruleName: policyDenial.policyName,
+        message: policyDenial.message || policyDenial.formatted,
+        resolved: policyDenial.resolved,
+    };
+}
+//# sourceMappingURL=api-diagnostics.js.map

package/dist/manifest/api-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-diagnostics.js","sourceRoot":"","sources":["../../src/manifest/api-diagnostics.ts"],"names":[],"mappings":"AA4BA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,WAAmB,EACnB,MAAqB;IAErB,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,0DAA0D;QAC1D,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnD,WAAW,CAAC,IAAI,CAAC;wBACf,IAAI,EAAE,iBAAiB;wBACvB,MAAM,EAAE,UAAU;wBAClB,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,OAAO,CAAC,IAAI;wBACtB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;wBAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC;IACJ,CAAC;IAED,yDAAyD;IAEzD,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpD,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,UAAU;oBAClB,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,OAAO,CAAC,IAAI;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS;oBAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7C,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,MAAM,CAAC,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB;QACvC,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,aAAa;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,WAAmB,EACnB,YAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,SAAS,YAAY,CAAC,KAAK,GAAG;QACxC,OAAO,EAAE,YAAY,CAAC,SAAS;QAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,UAAkB,EAClB,WAAmB,EACnB,YAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,YAAY,CAAC,UAAU;QACjC,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,SAAS;QACvD,QAAQ,EAAE,YAAY,CAAC,QAAQ;KAChC,CAAC;AACJ,CAAC"}

package/dist/manifest/approval/approval-store.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Approval store contract.
+ *
+ * Multi-stage approvals (manager-now / finance-later chains) only work if
+ * pending approval state survives across requests. When a consumer builds a
+ * fresh `RuntimeEngine` per HTTP request — the normal serverless/stateless
+ * pattern — an in-process Map loses every pending approval between requests.
+ *
+ * The `ApprovalStore` adapter is the durable backing the runtime reads and
+ * writes approval request state through. Applications wire in a concrete
+ * store (Postgres, Redis, …) via `RuntimeOptions.approvalStore`. When no
+ * store is supplied the runtime falls back to its in-process Map (suitable
+ * for tests and single-process apps only).
+ *
+ * This module defines the contract only. Concrete stores live in
+ * `src/manifest/approval/stores/<name>.ts` (Memory + Postgres ship now,
+ * mirroring the audit/outbox adapter families).
+ *
+ * Keying: the runtime addresses requests by a stable string key
+ * (`<entity>:<instanceId>:<approvalName>`). Stores treat the key as opaque
+ * and MUST round-trip it; the full `ApprovalRequestState` is also persisted
+ * so a store can reconstruct/list requests without parsing the key.
+ */
+import type { ApprovalRequestState } from '../runtime-engine';
+export interface ApprovalStore {
+    /**
+     * Load the approval request for `key`, or undefined if none exists.
+     * Durable stores MUST return a fresh (deserialized) value — callers may
+     * mutate the returned object before calling `save`.
+     */
+    load(key: string): Promise<ApprovalRequestState | undefined>;
+    /**
+     * Persist (insert or replace) the approval request under `key`. Called
+     * after the runtime creates a pending request or records a stage grant /
+     * denial, so the latest state is durable for the next request.
+     */
+    save(key: string, state: ApprovalRequestState): Promise<void>;
+    /**
+     * List every stored approval request. Useful for operational dashboards
+     * and for sweeping expirations. Order is implementation-defined.
+     */
+    list(): Promise<ApprovalRequestState[]>;
+    /**
+     * Expire any pending requests whose `expiresAt` is at or before `now`,
+     * transitioning them to `status: 'expired'`, and return the requests that
+     * were expired. Durable stores SHOULD perform this as a single set-based
+     * operation (e.g. an `UPDATE … RETURNING`) so a cron/worker can sweep
+     * timeouts without loading the whole table.
+     */
+    expire(now: number): Promise<ApprovalRequestState[]>;
+}
+//# sourceMappingURL=approval-store.d.ts.map

package/dist/manifest/approval/approval-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.d.ts","sourceRoot":"","sources":["../../../src/manifest/approval/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAE7D;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;CACtD"}

package/dist/manifest/approval/approval-store.js

@@ -0,0 +1,25 @@
+/**
+ * Approval store contract.
+ *
+ * Multi-stage approvals (manager-now / finance-later chains) only work if
+ * pending approval state survives across requests. When a consumer builds a
+ * fresh `RuntimeEngine` per HTTP request — the normal serverless/stateless
+ * pattern — an in-process Map loses every pending approval between requests.
+ *
+ * The `ApprovalStore` adapter is the durable backing the runtime reads and
+ * writes approval request state through. Applications wire in a concrete
+ * store (Postgres, Redis, …) via `RuntimeOptions.approvalStore`. When no
+ * store is supplied the runtime falls back to its in-process Map (suitable
+ * for tests and single-process apps only).
+ *
+ * This module defines the contract only. Concrete stores live in
+ * `src/manifest/approval/stores/<name>.ts` (Memory + Postgres ship now,
+ * mirroring the audit/outbox adapter families).
+ *
+ * Keying: the runtime addresses requests by a stable string key
+ * (`<entity>:<instanceId>:<approvalName>`). Stores treat the key as opaque
+ * and MUST round-trip it; the full `ApprovalRequestState` is also persisted
+ * so a store can reconstruct/list requests without parsing the key.
+ */
+export {};
+//# sourceMappingURL=approval-store.js.map

package/dist/manifest/approval/approval-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-store.js","sourceRoot":"","sources":["../../../src/manifest/approval/approval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/manifest/approval/stores/memory.d.ts

@@ -0,0 +1,33 @@
+/**
+ * MemoryApprovalStore — first-party in-memory implementation of the
+ * ApprovalStore contract (src/manifest/approval/approval-store.ts).
+ *
+ * Intended use:
+ *   - Unit and conformance tests
+ *   - Local development and sample applications
+ *   - Reference for downstream durable implementations
+ *
+ * Durability: none. State lives in process memory only. Sharing one
+ * `MemoryApprovalStore` instance between multiple `RuntimeEngine` instances
+ * lets a request created by one engine be approved by another — the exact
+ * cross-request behavior a durable store provides in production.
+ *
+ * Defensive copying: `load` and `list` return deep clones and `save` stores
+ * a deep clone, so callers cannot mutate stored state by reference. This
+ * mirrors the serialize/deserialize boundary of a real database adapter and
+ * keeps the cross-engine semantics honest.
+ */
+import type { ApprovalRequestState } from '../../runtime-engine';
+import type { ApprovalStore } from '../approval-store';
+export declare class MemoryApprovalStore implements ApprovalStore {
+    private requests;
+    load(key: string): Promise<ApprovalRequestState | undefined>;
+    save(key: string, state: ApprovalRequestState): Promise<void>;
+    list(): Promise<ApprovalRequestState[]>;
+    expire(now: number): Promise<ApprovalRequestState[]>;
+    /** Number of requests currently stored. Not part of the contract. */
+    size(): number;
+    /** Drop all stored requests. Not part of the contract — for test cleanup. */
+    clear(): void;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/manifest/approval/stores/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/manifest/approval/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAMvD,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAA2C;IAErD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAK5D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAIvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAY1D,qEAAqE;IACrE,IAAI,IAAI,MAAM;IAId,6EAA6E;IAC7E,KAAK,IAAI,IAAI;CAGd"}

package/dist/manifest/approval/stores/memory.js

@@ -0,0 +1,56 @@
+/**
+ * MemoryApprovalStore — first-party in-memory implementation of the
+ * ApprovalStore contract (src/manifest/approval/approval-store.ts).
+ *
+ * Intended use:
+ *   - Unit and conformance tests
+ *   - Local development and sample applications
+ *   - Reference for downstream durable implementations
+ *
+ * Durability: none. State lives in process memory only. Sharing one
+ * `MemoryApprovalStore` instance between multiple `RuntimeEngine` instances
+ * lets a request created by one engine be approved by another — the exact
+ * cross-request behavior a durable store provides in production.
+ *
+ * Defensive copying: `load` and `list` return deep clones and `save` stores
+ * a deep clone, so callers cannot mutate stored state by reference. This
+ * mirrors the serialize/deserialize boundary of a real database adapter and
+ * keeps the cross-engine semantics honest.
+ */
+function clone(state) {
+    return JSON.parse(JSON.stringify(state));
+}
+export class MemoryApprovalStore {
+    requests = new Map();
+    async load(key) {
+        const found = this.requests.get(key);
+        return found ? clone(found) : undefined;
+    }
+    async save(key, state) {
+        this.requests.set(key, clone(state));
+    }
+    async list() {
+        return Array.from(this.requests.values()).map(clone);
+    }
+    async expire(now) {
+        const expired = [];
+        for (const state of this.requests.values()) {
+            if (state.status !== 'pending' || state.expiresAt === undefined)
+                continue;
+            if (now >= state.expiresAt) {
+                state.status = 'expired';
+                expired.push(clone(state));
+            }
+        }
+        return expired;
+    }
+    /** Number of requests currently stored. Not part of the contract. */
+    size() {
+        return this.requests.size;
+    }
+    /** Drop all stored requests. Not part of the contract — for test cleanup. */
+    clear() {
+        this.requests.clear();
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/manifest/approval/stores/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../../src/manifest/approval/stores/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,SAAS,KAAK,CAAC,KAA2B;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAyB,CAAC;AACnE,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAE3D,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAA2B;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YAC1E,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/manifest/approval/stores/postgres.d.ts

@@ -0,0 +1,41 @@
+/**
+ * PostgresApprovalStore — durable ApprovalStore adapter backed by PostgreSQL.
+ *
+ * Companion schema: src/manifest/approval/stores/postgres.sql.
+ *
+ * Persistence model: one row per approval request, keyed by the runtime's
+ * opaque `${entity}:${instanceId}:${approvalName}` key (PRIMARY KEY). The
+ * full request state is stored across typed columns; `required_stages` and
+ * `grants` are JSONB so they round-trip without a join table.
+ *
+ * Upsert: `save` uses `INSERT … ON CONFLICT (key) DO UPDATE` so creating a
+ * pending request and later recording grants/denials are both a single
+ * statement. The latest write wins — the runtime always saves the complete
+ * state, never a partial patch.
+ *
+ * Expiry: `expire` is a single set-based `UPDATE … WHERE status='pending'
+ * AND expires_at <= $1 RETURNING *`, so a cron/worker can sweep timeouts
+ * without loading the table. See
+ * https://www.postgresql.org/docs/current/sql-update.html § "Outputs".
+ *
+ * DO NOT import this file in browser code — it requires `pg`.
+ */
+import type { Pool } from 'pg';
+import type { ApprovalRequestState } from '../../runtime-engine';
+import type { ApprovalStore } from '../approval-store';
+export interface PostgresApprovalStoreOptions {
+    /** A pg Pool. The store does NOT own the pool's lifecycle. */
+    pool: Pool;
+    /** Table name override. Default: `manifest_approval_requests`. */
+    tableName?: string;
+}
+export declare class PostgresApprovalStore implements ApprovalStore {
+    private pool;
+    private tableName;
+    constructor(opts: PostgresApprovalStoreOptions);
+    load(key: string): Promise<ApprovalRequestState | undefined>;
+    save(key: string, state: ApprovalRequestState): Promise<void>;
+    list(): Promise<ApprovalRequestState[]>;
+    expire(now: number): Promise<ApprovalRequestState[]>;
+}
+//# sourceMappingURL=postgres.d.ts.map

package/dist/manifest/approval/stores/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../../src/manifest/approval/stores/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAiB,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,IAAI,EAAE,IAAI,CAAC;IACX,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8CD,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,IAAI,CAAO;IACnB,OAAO,CAAC,SAAS,CAAS;gBAEd,IAAI,EAAE,4BAA4B;IAKxC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAY5D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC7D,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAWvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAW3D"}

package/dist/manifest/approval/stores/postgres.js

@@ -0,0 +1,124 @@
+/**
+ * PostgresApprovalStore — durable ApprovalStore adapter backed by PostgreSQL.
+ *
+ * Companion schema: src/manifest/approval/stores/postgres.sql.
+ *
+ * Persistence model: one row per approval request, keyed by the runtime's
+ * opaque `${entity}:${instanceId}:${approvalName}` key (PRIMARY KEY). The
+ * full request state is stored across typed columns; `required_stages` and
+ * `grants` are JSONB so they round-trip without a join table.
+ *
+ * Upsert: `save` uses `INSERT … ON CONFLICT (key) DO UPDATE` so creating a
+ * pending request and later recording grants/denials are both a single
+ * statement. The latest write wins — the runtime always saves the complete
+ * state, never a partial patch.
+ *
+ * Expiry: `expire` is a single set-based `UPDATE … WHERE status='pending'
+ * AND expires_at <= $1 RETURNING *`, so a cron/worker can sweep timeouts
+ * without loading the table. See
+ * https://www.postgresql.org/docs/current/sql-update.html § "Outputs".
+ *
+ * DO NOT import this file in browser code — it requires `pg`.
+ */
+const DEFAULT_TABLE = 'manifest_approval_requests';
+function quoteIdent(identifier) {
+    return `"${identifier.replace(/"/g, '""')}"`;
+}
+function toNumber(v) {
+    return typeof v === 'string' ? Number(v) : v;
+}
+function rowToState(row) {
+    const state = {
+        entity: row.entity,
+        instanceId: row.instance_id,
+        approvalName: row.approval_name,
+        command: row.command,
+        status: row.status,
+        requiredStages: row.required_stages ?? [],
+        grants: row.grants ?? [],
+        requestedAt: toNumber(row.requested_at),
+    };
+    if (row.expires_at !== null && row.expires_at !== undefined) {
+        state.expiresAt = toNumber(row.expires_at);
+    }
+    if (row.denied_by !== null && row.denied_by !== undefined)
+        state.deniedBy = row.denied_by;
+    if (row.denied_reason !== null && row.denied_reason !== undefined)
+        state.deniedReason = row.denied_reason;
+    return state;
+}
+export class PostgresApprovalStore {
+    pool;
+    tableName;
+    constructor(opts) {
+        this.pool = opts.pool;
+        this.tableName = opts.tableName ?? DEFAULT_TABLE;
+    }
+    async load(key) {
+        const sql = `
+      SELECT request_key, entity, instance_id, approval_name, command, status,
+             required_stages, grants, requested_at, expires_at, denied_by, denied_reason
+      FROM ${quoteIdent(this.tableName)}
+      WHERE request_key = $1
+    `;
+        const result = await this.pool.query(sql, [key]);
+        const row = result.rows[0];
+        return row ? rowToState(row) : undefined;
+    }
+    async save(key, state) {
+        const sql = `
+      INSERT INTO ${quoteIdent(this.tableName)} (
+        request_key, entity, instance_id, approval_name, command, status,
+        required_stages, grants, requested_at, expires_at, denied_by, denied_reason
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, $9, $10, $11, $12)
+      ON CONFLICT (request_key) DO UPDATE SET
+        entity = EXCLUDED.entity,
+        instance_id = EXCLUDED.instance_id,
+        approval_name = EXCLUDED.approval_name,
+        command = EXCLUDED.command,
+        status = EXCLUDED.status,
+        required_stages = EXCLUDED.required_stages,
+        grants = EXCLUDED.grants,
+        requested_at = EXCLUDED.requested_at,
+        expires_at = EXCLUDED.expires_at,
+        denied_by = EXCLUDED.denied_by,
+        denied_reason = EXCLUDED.denied_reason
+    `;
+        await this.pool.query(sql, [
+            key,
+            state.entity,
+            state.instanceId,
+            state.approvalName,
+            state.command,
+            state.status,
+            JSON.stringify(state.requiredStages),
+            JSON.stringify(state.grants),
+            state.requestedAt,
+            state.expiresAt ?? null,
+            state.deniedBy ?? null,
+            state.deniedReason ?? null,
+        ]);
+    }
+    async list() {
+        const sql = `
+      SELECT request_key, entity, instance_id, approval_name, command, status,
+             required_stages, grants, requested_at, expires_at, denied_by, denied_reason
+      FROM ${quoteIdent(this.tableName)}
+      ORDER BY requested_at, request_key
+    `;
+        const result = await this.pool.query(sql);
+        return result.rows.map(rowToState);
+    }
+    async expire(now) {
+        const sql = `
+      UPDATE ${quoteIdent(this.tableName)}
+      SET status = 'expired'
+      WHERE status = 'pending' AND expires_at IS NOT NULL AND expires_at <= $1
+      RETURNING request_key, entity, instance_id, approval_name, command, status,
+                required_stages, grants, requested_at, expires_at, denied_by, denied_reason
+    `;
+        const result = await this.pool.query(sql, [now]);
+        return result.rows.map(rowToState);
+    }
+}
+//# sourceMappingURL=postgres.js.map

package/dist/manifest/approval/stores/postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../../src/manifest/approval/stores/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAaH,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAEnD,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC/C,CAAC;AAiBD,SAAS,QAAQ,CAAC,CAAkB;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,KAAK,GAAyB;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,cAAc,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE;QACzC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC;KACxC,CAAC;IACF,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC5D,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC1F,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IAC1G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,qBAAqB;IACxB,IAAI,CAAO;IACX,SAAS,CAAS;IAE1B,YAAY,IAAkC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,GAAG,GAAG;;;aAGH,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;;KAElC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAc,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAA2B;QACjD,MAAM,GAAG,GAAG;oBACI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;KAgBzC,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,GAAG;YACH,KAAK,CAAC,MAAM;YACZ,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,MAAM;YACZ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5B,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,SAAS,IAAI,IAAI;YACvB,KAAK,CAAC,QAAQ,IAAI,IAAI;YACtB,KAAK,CAAC,YAAY,IAAI,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG;;;aAGH,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;;KAElC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAc,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG;eACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;;;;;KAKpC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAc,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/manifest/audit/audit-sink.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Audit sink contract.
+ *
+ * Every governed command attempt produces or connects to an audit record
+ * covering who, what, tenant, outcome, and diagnostics. The runtime exposes
+ * this as an `AuditSink` adapter — applications wire in a concrete sink
+ * (Postgres, file, OpenTelemetry, …) via RuntimeOptions.
+ *
+ * This module defines the contract only. Concrete sinks live in
+ * `src/manifest/audit/sinks/<name>.ts` (memory + postgres land in a
+ * follow-on; the contract surface is shipped now so downstream consumers
+ * can implement against it).
+ */
+export type CommandOutcome = 'success' | 'guard_denied' | 'policy_denied' | 'rate_limit_denied' | 'constraint_failed' | 'concurrency_conflict' | 'missing_tenant_context' | 'error';
+export interface AuditRecord {
+    /** Stable record id. Caller MAY pre-generate or leave to the sink. */
+    recordId?: string;
+    /** Wall-clock timestamp (milliseconds since epoch). */
+    occurredAt: number;
+    /** Tenant the command ran against (when known). */
+    tenantId?: string;
+    /** Organization the actor belonged to (e.g. Clerk orgId). */
+    orgId?: string;
+    /** Acting user id. */
+    actorId?: string;
+    /** Caller-supplied request id, useful for trace correlation. */
+    requestId?: string;
+    /** Origin surface ('route', 'job', 'cli', ...). */
+    source?: string;
+    /** Entity name the command targeted, when entity-scoped. */
+    entity?: string;
+    /** Command name. */
+    command: string;
+    /** Canonical "<entity>.<command>" identifier, when available. */
+    commandId?: string;
+    /** Outcome classification. */
+    outcome: CommandOutcome;
+    /** Diagnostics returned by the runtime, if any. */
+    diagnostics?: unknown;
+    /** Names of semantic events emitted by the command, if any. */
+    emittedEventNames?: string[];
+    /** IR provenance hash at execution time, for drift detection. */
+    irHash?: string;
+}
+/**
+ * AuditSink: the runtime calls `emit` exactly once per command attempt,
+ * regardless of outcome. Sinks MUST be idempotent against `recordId` when
+ * provided so retries don't double-write.
+ */
+export interface AuditSink {
+    emit(record: AuditRecord): Promise<void>;
+}
+//# sourceMappingURL=audit-sink.d.ts.map

package/dist/manifest/audit/audit-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sink.d.ts","sourceRoot":"","sources":["../../../src/manifest/audit/audit-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,cAAc,GACd,eAAe,GACf,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,GACtB,wBAAwB,GACxB,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,EAAE,cAAc,CAAC;IACxB,mDAAmD;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C"}

package/dist/manifest/audit/audit-sink.js

@@ -0,0 +1,15 @@
+/**
+ * Audit sink contract.
+ *
+ * Every governed command attempt produces or connects to an audit record
+ * covering who, what, tenant, outcome, and diagnostics. The runtime exposes
+ * this as an `AuditSink` adapter — applications wire in a concrete sink
+ * (Postgres, file, OpenTelemetry, …) via RuntimeOptions.
+ *
+ * This module defines the contract only. Concrete sinks live in
+ * `src/manifest/audit/sinks/<name>.ts` (memory + postgres land in a
+ * follow-on; the contract surface is shipped now so downstream consumers
+ * can implement against it).
+ */
+export {};
+//# sourceMappingURL=audit-sink.js.map

package/dist/manifest/audit/audit-sink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sink.js","sourceRoot":"","sources":["../../../src/manifest/audit/audit-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/manifest/audit/sinks/memory.d.ts

@@ -0,0 +1,50 @@
+/**
+ * MemoryAuditSink — first-party in-memory implementation of the AuditSink
+ * contract (src/manifest/audit/audit-sink.ts).
+ *
+ * Intended use:
+ *   - Unit and conformance tests
+ *   - Local development and prototyping
+ *   - Sample applications wiring audit governance without a database
+ *
+ * Durability: none. Records live for the lifetime of the sink instance.
+ *
+ * Idempotency: when `record.recordId` is provided, repeat emissions for the
+ * same id are dropped silently (the first record wins). Records without a
+ * `recordId` are always appended.
+ */
+import type { AuditRecord, AuditSink } from '../audit-sink';
+export interface MemoryAuditSinkOptions {
+    /**
+     * Optional ID generator for records that arrive without a `recordId`.
+     * When provided, the sink stamps a synthetic id on emit so the record can
+     * be referenced by callers. Defaults to leaving `recordId` undefined.
+     */
+    generateId?: () => string;
+}
+/**
+ * In-memory audit sink. Safe for use across multiple RuntimeEngine instances
+ * in a single test run; not safe for cross-process sharing.
+ */
+export declare class MemoryAuditSink implements AuditSink {
+    private records;
+    private seenRecordIds;
+    private generateId?;
+    constructor(opts?: MemoryAuditSinkOptions);
+    emit(record: AuditRecord): Promise<void>;
+    /**
+     * Return a defensive copy of all records emitted so far. Mutating the
+     * returned array does not affect internal state.
+     */
+    list(): AuditRecord[];
+    /** Number of records currently stored. */
+    size(): number;
+    /**
+     * Look up a record by recordId. Returns a defensive copy or undefined.
+     * O(n) — acceptable for test scenarios where MemoryAuditSink is used.
+     */
+    findByRecordId(recordId: string): AuditRecord | undefined;
+    /** Clear all stored records and idempotency tracking. */
+    clear(): void;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/manifest/audit/sinks/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../../src/manifest/audit/sinks/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5D,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,SAAS;IAC/C,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,UAAU,CAAC,CAAe;gBAEtB,IAAI,GAAE,sBAA2B;IAIvC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9C;;;OAGG;IACH,IAAI,IAAI,WAAW,EAAE;IAIrB,0CAA0C;IAC1C,IAAI,IAAI,MAAM;IAId;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAKzD,yDAAyD;IACzD,KAAK,IAAI,IAAI;CAId"}