@parmana/shared 0.0.0-stage → 0.1.0

package/dist/errors/parmana-error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Base class for all Parmana domain and application errors.
+ */
+export declare abstract class ParmanaError extends Error {
+    /**
+     * Stable machine-readable error code.
+     */
+    readonly code: string;
+    /**
+     * Suggested HTTP status code.
+     */
+    readonly status: number;
+    protected constructor(code: string, message: string, status: number);
+}
+//# sourceMappingURL=parmana-error.d.ts.map

package/dist/errors/parmana-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parmana-error.d.ts","sourceRoot":"","sources":["../../src/errors/parmana-error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,8BAAsB,YAAa,SAAQ,KAAK;IAC9C;;OAEG;IACH,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,SAAS,aAAa,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAQlE;CACF"}

package/dist/errors/parmana-error.js

@@ -0,0 +1,21 @@
+/**
+ * Base class for all Parmana domain and application errors.
+ */
+export class ParmanaError extends Error {
+    /**
+     * Stable machine-readable error code.
+     */
+    code;
+    /**
+     * Suggested HTTP status code.
+     */
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = this.constructor.name;
+        this.code = code;
+        this.status = status;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+//# sourceMappingURL=parmana-error.js.map

package/dist/errors/parmana-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parmana-error.js","sourceRoot":"","sources":["../../src/errors/parmana-error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAgB,YAAa,SAAQ,KAAK;IAC9C;;OAEG;IACa,IAAI,CAAS;IAE7B;;OAEG;IACa,MAAM,CAAS;IAE/B,YAAsB,IAAY,EAAE,OAAe,EAAE,MAAc;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/errors/pending-policy-change-not-found-error.d.ts

@@ -0,0 +1,9 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a Pending Policy Change lookup (findById, resolve) is
+ * given an id that does not exist.
+ */
+export declare class PendingPolicyChangeNotFoundError extends ParmanaError {
+    constructor(pendingPolicyChangeId: string);
+}
+//# sourceMappingURL=pending-policy-change-not-found-error.d.ts.map

package/dist/errors/pending-policy-change-not-found-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-policy-change-not-found-error.d.ts","sourceRoot":"","sources":["../../src/errors/pending-policy-change-not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,qBAAa,gCAAiC,SAAQ,YAAY;IAChE,YAAY,qBAAqB,EAAE,MAAM,EAMxC;CACF"}

package/dist/errors/pending-policy-change-not-found-error.js

@@ -0,0 +1,11 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a Pending Policy Change lookup (findById, resolve) is
+ * given an id that does not exist.
+ */
+export class PendingPolicyChangeNotFoundError extends ParmanaError {
+    constructor(pendingPolicyChangeId) {
+        super("PENDING_POLICY_CHANGE_NOT_FOUND", `Pending Policy Change '${pendingPolicyChangeId}' not found.`, 404);
+    }
+}
+//# sourceMappingURL=pending-policy-change-not-found-error.js.map

package/dist/errors/pending-policy-change-not-found-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-policy-change-not-found-error.js","sourceRoot":"","sources":["../../src/errors/pending-policy-change-not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AACH,MAAM,OAAO,gCAAiC,SAAQ,YAAY;IAChE,YAAY,qBAA6B;QACvC,KAAK,CACH,iCAAiC,EACjC,0BAA0B,qBAAqB,cAAc,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/errors/policy-not-found-error.d.ts

@@ -0,0 +1,5 @@
+import { ParmanaError } from "./parmana-error.js";
+export declare class PolicyNotFoundError extends ParmanaError {
+    constructor(name: string, version: string);
+}
+//# sourceMappingURL=policy-not-found-error.d.ts.map

package/dist/errors/policy-not-found-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-not-found-error.d.ts","sourceRoot":"","sources":["../../src/errors/policy-not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,mBAAoB,SAAQ,YAAY;IACnD,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAMxC;CACF"}

package/dist/errors/policy-not-found-error.js

@@ -0,0 +1,7 @@
+import { ParmanaError } from "./parmana-error.js";
+export class PolicyNotFoundError extends ParmanaError {
+    constructor(name, version) {
+        super("POLICY_NOT_FOUND", `Policy '${name}' version '${version}' not found.`, 404);
+    }
+}
+//# sourceMappingURL=policy-not-found-error.js.map

package/dist/errors/policy-not-found-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-not-found-error.js","sourceRoot":"","sources":["../../src/errors/policy-not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CACH,kBAAkB,EAClB,WAAW,IAAI,cAAc,OAAO,cAAc,EAClD,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/errors/receipt-generation-error.d.ts

@@ -0,0 +1,5 @@
+import { ParmanaError } from "./parmana-error.js";
+export declare class ReceiptGenerationError extends ParmanaError {
+    constructor(message: string);
+}
+//# sourceMappingURL=receipt-generation-error.d.ts.map

package/dist/errors/receipt-generation-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-generation-error.d.ts","sourceRoot":"","sources":["../../src/errors/receipt-generation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF"}

package/dist/errors/receipt-generation-error.js

@@ -0,0 +1,7 @@
+import { ParmanaError } from "./parmana-error.js";
+export class ReceiptGenerationError extends ParmanaError {
+    constructor(message) {
+        super("RECEIPT_GENERATION_FAILED", message, 500);
+    }
+}
+//# sourceMappingURL=receipt-generation-error.js.map

package/dist/errors/receipt-generation-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-generation-error.js","sourceRoot":"","sources":["../../src/errors/receipt-generation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,2BAA2B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/errors/same-actor-cannot-approve-own-change-error.d.ts

@@ -0,0 +1,12 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a caller attempts to approve or reject a
+ * PendingPolicyChange it proposed itself — maker != checker,
+ * enforced at the API layer (pending-policy-changes.ts), since only
+ * the caller-auth layer knows the resolving caller's verified
+ * identity. See PendingPolicyChange.resolvedBy's own doc comment.
+ */
+export declare class SameActorCannotApproveOwnChangeError extends ParmanaError {
+    constructor(pendingPolicyChangeId: string, subject?: string);
+}
+//# sourceMappingURL=same-actor-cannot-approve-own-change-error.d.ts.map

package/dist/errors/same-actor-cannot-approve-own-change-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-actor-cannot-approve-own-change-error.d.ts","sourceRoot":"","sources":["../../src/errors/same-actor-cannot-approve-own-change-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;GAMG;AACH,qBAAa,oCAAqC,SAAQ,YAAY;IACpE,YACE,qBAAqB,EAAE,MAAM,EAC7B,OAAO,GAAE,MAAgC,EAQ1C;CACF"}

package/dist/errors/same-actor-cannot-approve-own-change-error.js

@@ -0,0 +1,15 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a caller attempts to approve or reject a
+ * PendingPolicyChange it proposed itself — maker != checker,
+ * enforced at the API layer (pending-policy-changes.ts), since only
+ * the caller-auth layer knows the resolving caller's verified
+ * identity. See PendingPolicyChange.resolvedBy's own doc comment.
+ */
+export class SameActorCannotApproveOwnChangeError extends ParmanaError {
+    constructor(pendingPolicyChangeId, subject = "Pending Policy Change") {
+        super("SAME_ACTOR_CANNOT_APPROVE_OWN_CHANGE", `${subject} '${pendingPolicyChangeId}' was proposed by this same caller — ` +
+            "the proposer (maker) may not also approve or reject it (checker).", 403);
+    }
+}
+//# sourceMappingURL=same-actor-cannot-approve-own-change-error.js.map

package/dist/errors/same-actor-cannot-approve-own-change-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"same-actor-cannot-approve-own-change-error.js","sourceRoot":"","sources":["../../src/errors/same-actor-cannot-approve-own-change-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,OAAO,oCAAqC,SAAQ,YAAY;IACpE,YACE,qBAA6B,EAC7B,OAAO,GAAW,uBAAuB;QAEzC,KAAK,CACH,sCAAsC,EACtC,GAAG,OAAO,KAAK,qBAAqB,uCAAuC;YACzE,mEAAmE,EACrE,GAAG,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/errors/step-up-authorization-invalid-error.d.ts

@@ -0,0 +1,25 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a POST /policies/pending-changes/:id/approve or .../reject
+ * request's stepUpAuthorization envelope fails verification (missing
+ * signature, expired, replayed nonce, wrong key, or bound to a
+ * different pendingPolicyChangeId/action) -- see
+ * PolicyChangeStepUpVerifier. Fail-closed: the approval/rejection
+ * never takes effect while this is thrown.
+ */
+export declare class StepUpAuthorizationInvalidError extends ParmanaError {
+    /**
+     * Per-check diagnostic detail, mirroring
+     * PolicyChangeStepUpVerificationResult.checks -- an operator/checker
+     * debugging a rejected step-up attempt should see exactly which
+     * check failed, not just that one did (same reasoning
+     * ApprovalVerificationResult/AuthorizationVerificationResult already
+     * apply). Untyped here (@parmana/shared sits below @parmana/api in
+     * the dependency graph, so this type cannot reference
+     * PolicyChangeStepUpVerificationResult directly) -- the router
+     * constructs this with the real checks object.
+     */
+    readonly checks: Readonly<Record<string, boolean>>;
+    constructor(checks: Readonly<Record<string, boolean>>);
+}
+//# sourceMappingURL=step-up-authorization-invalid-error.d.ts.map

package/dist/errors/step-up-authorization-invalid-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-authorization-invalid-error.d.ts","sourceRoot":"","sources":["../../src/errors/step-up-authorization-invalid-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;GAOG;AACH,qBAAa,+BAAgC,SAAQ,YAAY;IAC/D;;;;;;;;;;OAUG;IACH,SAAgB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1D,YAAY,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAQpD;CACF"}

package/dist/errors/step-up-authorization-invalid-error.js

@@ -0,0 +1,28 @@
+import { ParmanaError } from "./parmana-error.js";
+/**
+ * Thrown when a POST /policies/pending-changes/:id/approve or .../reject
+ * request's stepUpAuthorization envelope fails verification (missing
+ * signature, expired, replayed nonce, wrong key, or bound to a
+ * different pendingPolicyChangeId/action) -- see
+ * PolicyChangeStepUpVerifier. Fail-closed: the approval/rejection
+ * never takes effect while this is thrown.
+ */
+export class StepUpAuthorizationInvalidError extends ParmanaError {
+    /**
+     * Per-check diagnostic detail, mirroring
+     * PolicyChangeStepUpVerificationResult.checks -- an operator/checker
+     * debugging a rejected step-up attempt should see exactly which
+     * check failed, not just that one did (same reasoning
+     * ApprovalVerificationResult/AuthorizationVerificationResult already
+     * apply). Untyped here (@parmana/shared sits below @parmana/api in
+     * the dependency graph, so this type cannot reference
+     * PolicyChangeStepUpVerificationResult directly) -- the router
+     * constructs this with the real checks object.
+     */
+    checks;
+    constructor(checks) {
+        super("STEP_UP_AUTHORIZATION_INVALID", "The step-up authorization envelope is missing, invalid, expired, replayed, or does not match this request.", 403);
+        this.checks = checks;
+    }
+}
+//# sourceMappingURL=step-up-authorization-invalid-error.js.map

package/dist/errors/step-up-authorization-invalid-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-authorization-invalid-error.js","sourceRoot":"","sources":["../../src/errors/step-up-authorization-invalid-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,OAAO,+BAAgC,SAAQ,YAAY;IAC/D;;;;;;;;;;OAUG;IACa,MAAM,CAAoC;IAE1D,YAAY,MAAyC;QACnD,KAAK,CACH,+BAA+B,EAC/B,4GAA4G,EAC5G,GAAG,CACJ,CAAC;QAEF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/errors/trust-chain-validation-error.d.ts

@@ -0,0 +1,5 @@
+import { ValidationError } from "./validation-error.js";
+export declare class TrustChainValidationError extends ValidationError {
+    constructor(code: string, message: string);
+}
+//# sourceMappingURL=trust-chain-validation-error.d.ts.map

package/dist/errors/trust-chain-validation-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-chain-validation-error.d.ts","sourceRoot":"","sources":["../../src/errors/trust-chain-validation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,qBAAa,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAExC;CACF"}

package/dist/errors/trust-chain-validation-error.js

@@ -0,0 +1,7 @@
+import { ValidationError } from "./validation-error.js";
+export class TrustChainValidationError extends ValidationError {
+    constructor(code, message) {
+        super(code, message);
+    }
+}
+//# sourceMappingURL=trust-chain-validation-error.js.map

package/dist/errors/trust-chain-validation-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-chain-validation-error.js","sourceRoot":"","sources":["../../src/errors/trust-chain-validation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/errors/unauthorized-error.d.ts

@@ -0,0 +1,5 @@
+import { ParmanaError } from "./parmana-error.js";
+export declare class UnauthorizedError extends ParmanaError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=unauthorized-error.d.ts.map

package/dist/errors/unauthorized-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthorized-error.d.ts","sourceRoot":"","sources":["../../src/errors/unauthorized-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,iBAAkB,SAAQ,YAAY;IACjD,YAAY,OAAO,SAA6B,EAE/C;CACF"}

package/dist/errors/unauthorized-error.js

@@ -0,0 +1,7 @@
+import { ParmanaError } from "./parmana-error.js";
+export class UnauthorizedError extends ParmanaError {
+    constructor(message = "Authentication required.") {
+        super("UNAUTHORIZED", message, 401);
+    }
+}
+//# sourceMappingURL=unauthorized-error.js.map

package/dist/errors/unauthorized-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthorized-error.js","sourceRoot":"","sources":["../../src/errors/unauthorized-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IACjD,YAAY,OAAO,GAAG,0BAA0B;QAC9C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/errors/validation-error.d.ts

@@ -0,0 +1,5 @@
+import { ParmanaError } from "./parmana-error.js";
+export declare class ValidationError extends ParmanaError {
+    constructor(code: string, message: string);
+}
+//# sourceMappingURL=validation-error.d.ts.map

package/dist/errors/validation-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-error.d.ts","sourceRoot":"","sources":["../../src/errors/validation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAExC;CACF"}

package/dist/errors/validation-error.js

@@ -0,0 +1,7 @@
+import { ParmanaError } from "./parmana-error.js";
+export class ValidationError extends ParmanaError {
+    constructor(code, message) {
+        super(code, message, 400);
+    }
+}
+//# sourceMappingURL=validation-error.js.map

package/dist/errors/validation-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-error.js","sourceRoot":"","sources":["../../src/errors/validation-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC/C,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/errors/verification-failed-error.d.ts

@@ -0,0 +1,5 @@
+import { ParmanaError } from "./parmana-error.js";
+export declare class VerificationFailedError extends ParmanaError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=verification-failed-error.d.ts.map

package/dist/errors/verification-failed-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failed-error.d.ts","sourceRoot":"","sources":["../../src/errors/verification-failed-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,uBAAwB,SAAQ,YAAY;IACvD,YAAY,OAAO,SAAyB,EAE3C;CACF"}

package/dist/errors/verification-failed-error.js

@@ -0,0 +1,7 @@
+import { ParmanaError } from "./parmana-error.js";
+export class VerificationFailedError extends ParmanaError {
+    constructor(message = "Verification failed.") {
+        super("VERIFICATION_FAILED", message, 409);
+    }
+}
+//# sourceMappingURL=verification-failed-error.js.map

package/dist/errors/verification-failed-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failed-error.js","sourceRoot":"","sources":["../../src/errors/verification-failed-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,uBAAwB,SAAQ,YAAY;IACvD,YAAY,OAAO,GAAG,sBAAsB;QAC1C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/gateway/GatewayAuthentication.d.ts

@@ -0,0 +1,8 @@
+export interface GatewayAuthentication {
+    readonly version: number;
+    readonly gatewayId: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly nonce: string;
+}
+//# sourceMappingURL=GatewayAuthentication.d.ts.map

package/dist/gateway/GatewayAuthentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthentication.d.ts","sourceRoot":"","sources":["../../src/gateway/GatewayAuthentication.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB"}

package/dist/gateway/GatewayAuthentication.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=GatewayAuthentication.js.map

package/dist/gateway/GatewayAuthentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthentication.js","sourceRoot":"","sources":["../../src/gateway/GatewayAuthentication.ts"],"names":[],"mappings":""}

package/dist/gateway/GatewayAuthenticationClaims.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Input claims used when issuing a Gateway
+ * Authentication token.
+ */
+export interface GatewayAuthenticationClaims {
+    readonly gatewayId: string;
+    readonly sessionId: string;
+    readonly ttlSeconds: number;
+}
+//# sourceMappingURL=GatewayAuthenticationClaims.d.ts.map

package/dist/gateway/GatewayAuthenticationClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthenticationClaims.d.ts","sourceRoot":"","sources":["../../src/gateway/GatewayAuthenticationClaims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B"}

package/dist/gateway/GatewayAuthenticationClaims.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=GatewayAuthenticationClaims.js.map

package/dist/gateway/GatewayAuthenticationClaims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthenticationClaims.js","sourceRoot":"","sources":["../../src/gateway/GatewayAuthenticationClaims.ts"],"names":[],"mappings":""}

package/dist/gateway/GatewayAuthenticationPayload.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Canonical Gateway Authentication payload.
+ *
+ * Authenticates the Execution Gateway to
+ * Execution Control and Connectors.
+ */
+export interface GatewayAuthenticationPayload {
+    readonly version: 1;
+    readonly gatewayId: string;
+    readonly sessionId: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly nonce: string;
+}
+//# sourceMappingURL=GatewayAuthenticationPayload.d.ts.map

package/dist/gateway/GatewayAuthenticationPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthenticationPayload.d.ts","sourceRoot":"","sources":["../../src/gateway/GatewayAuthenticationPayload.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB"}

package/dist/gateway/GatewayAuthenticationPayload.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=GatewayAuthenticationPayload.js.map

package/dist/gateway/GatewayAuthenticationPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayAuthenticationPayload.js","sourceRoot":"","sources":["../../src/gateway/GatewayAuthenticationPayload.ts"],"names":[],"mappings":""}

package/dist/gateway/SignedGatewayAuthentication.d.ts

@@ -0,0 +1,9 @@
+import type { SignatureAlgorithm } from "../config/CryptoAlgorithms.js";
+import type { GatewayAuthentication } from "./GatewayAuthentication.js";
+export interface SignedGatewayAuthentication {
+    readonly payload: GatewayAuthentication;
+    readonly signature: string;
+    readonly keyId: string;
+    readonly algorithm: SignatureAlgorithm;
+}
+//# sourceMappingURL=SignedGatewayAuthentication.d.ts.map

package/dist/gateway/SignedGatewayAuthentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignedGatewayAuthentication.d.ts","sourceRoot":"","sources":["../../src/gateway/SignedGatewayAuthentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAExC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;CACxC"}

package/dist/gateway/SignedGatewayAuthentication.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SignedGatewayAuthentication.js.map

package/dist/gateway/SignedGatewayAuthentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignedGatewayAuthentication.js","sourceRoot":"","sources":["../../src/gateway/SignedGatewayAuthentication.ts"],"names":[],"mappings":""}

package/dist/gateway/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./GatewayAuthenticationPayload.js";
+export * from "./GatewayAuthenticationClaims.js";
+export * from "./SignedGatewayAuthentication.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/gateway/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gateway/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,kCAAkC,CAAC"}

package/dist/gateway/index.js

@@ -0,0 +1,4 @@
+export * from "./GatewayAuthenticationPayload.js";
+export * from "./GatewayAuthenticationClaims.js";
+export * from "./SignedGatewayAuthentication.js";
+//# sourceMappingURL=index.js.map

package/dist/gateway/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/gateway/index.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC;AAClD,cAAc,kCAAkC,CAAC;AACjD,cAAc,kCAAkC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared Package
+ *
+ * Canonical public API.
+ */
+export * from "./domain/index.js";
+export * from "./repositories/index.js";
+export * from "./config/index.js";
+export * from "./errors/index.js";
+export * from "./gateway/index.js";
+export * from "./types/Json.js";
+export * from "./logging/Logger.js";
+export { normalizePolicy } from "./utils/normalize-policy.js";
+/**
+ * External connector endpoint address checks (ADR-0013): used when an
+ * endpoint is registered and again at every release.
+ */
+export * from "./network/externalEndpointAddress.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D;;;GAGG;AACH,cAAc,sCAAsC,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * Shared Package
+ *
+ * Canonical public API.
+ */
+export * from "./domain/index.js";
+export * from "./repositories/index.js";
+export * from "./config/index.js";
+export * from "./errors/index.js";
+export * from "./gateway/index.js";
+export * from "./types/Json.js";
+export * from "./logging/Logger.js";
+export { normalizePolicy } from "./utils/normalize-policy.js";
+/**
+ * External connector endpoint address checks (ADR-0013): used when an
+ * endpoint is registered and again at every release.
+ */
+export * from "./network/externalEndpointAddress.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D;;;GAGG;AACH,cAAc,sCAAsC,CAAC"}

package/dist/logging/Logger.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Minimal structured logger, gating output on LOG_LEVEL
+ * (config.logging.level, read in Config.ts).
+ *
+ * Closes a gap identified in the 2026-09-10 production-readiness pass:
+ * LOG_LEVEL was already read into config, but nothing in the codebase
+ * gated any output on it -- every console.* call site fired
+ * unconditionally regardless of what LOG_LEVEL was set to, and log
+ * shape was whatever each call site happened to pass (a bare string
+ * here, a structured object there). This gives every call site a
+ * shared, level-aware, structured shape without introducing an
+ * external logging dependency.
+ *
+ * Deliberately NOT a wholesale replacement for every console.* call in
+ * the codebase in one pass -- see the migrated call sites (this
+ * package's own consumers in packages/api/src/bootstrap/) for the
+ * pattern; remaining call sites can move to this incrementally.
+ */
+declare const LEVELS: {
+    readonly debug: 10;
+    readonly info: 20;
+    readonly warn: 30;
+    readonly error: 40;
+};
+export type LogLevel = keyof typeof LEVELS;
+export interface LogFields {
+    readonly event: string;
+    readonly [key: string]: unknown;
+}
+export interface Logger {
+    debug(fields: LogFields): void;
+    info(fields: LogFields): void;
+    warn(fields: LogFields): void;
+    error(fields: LogFields): void;
+}
+/**
+ * Creates a Logger gated on the given LOG_LEVEL string (pass
+ * loadConfig().logging.level at the call site -- this function takes
+ * the resolved string, not process.env, so it stays easy to test and
+ * has no implicit dependency on when Config.ts's own env read runs).
+ *
+ * Output shape: one JSON object per line to stdout (debug/info) or
+ * stderr (warn/error) -- level and a timestamp are added automatically,
+ * `event` (required) and any additional fields come from the call
+ * site, mirroring the { event: "...", ...details } shape most existing
+ * console.warn/console.error call sites in this codebase already use
+ * by convention, just enforced and level-gated here rather than ad hoc.
+ */
+export declare function createLogger(configuredLevel: string): Logger;
+/**
+ * Lazy, process-wide singleton Logger, built from loadConfig().logging.
+ * level on first use -- the same lazy-singleton shape this codebase's
+ * other composition roots already use (KeyBootstrap.create(),
+ * CryptoBootstrap.create(), PostgresPoolFactory.create()). Exists so a
+ * call site can log without threading a Logger instance through every
+ * function signature between it and wherever the app is composed --
+ * `import { getLogger } from "@parmana/shared"; getLogger().warn(...)`.
+ *
+ * loadConfig() itself is only called the first time a call site
+ * actually logs (not merely by importing @parmana/shared), same as
+ * every other lazy singleton in this file's neighborhood.
+ */
+export declare function getLogger(): Logger;
+export {};
+//# sourceMappingURL=Logger.d.ts.map

package/dist/logging/Logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Logger.d.ts","sourceRoot":"","sources":["../../src/logging/Logger.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,QAAA,MAAM,MAAM;aACV,KAAK,EAAE,EAAE;aACT,IAAI,EAAE,EAAE;aACR,IAAI,EAAE,EAAE;aACR,KAAK,EAAE,EAAE;CACD,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,MAAM,CAAC;AAiB3C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAMlC"}