@parmana/shared 0.0.0-stage → 0.1.0

package/dist/logging/Logger.js

@@ -0,0 +1,97 @@
+import { loadConfig } from "../config/Config.js";
+/**
+ * Minimal structured logger, gating output on LOG_LEVEL
+ * (config.logging.level, read in Config.ts).
+ *
+ * Closes a gap identified in the 2026-09-10 production-readiness pass:
+ * LOG_LEVEL was already read into config, but nothing in the codebase
+ * gated any output on it -- every console.* call site fired
+ * unconditionally regardless of what LOG_LEVEL was set to, and log
+ * shape was whatever each call site happened to pass (a bare string
+ * here, a structured object there). This gives every call site a
+ * shared, level-aware, structured shape without introducing an
+ * external logging dependency.
+ *
+ * Deliberately NOT a wholesale replacement for every console.* call in
+ * the codebase in one pass -- see the migrated call sites (this
+ * package's own consumers in packages/api/src/bootstrap/) for the
+ * pattern; remaining call sites can move to this incrementally.
+ */
+const LEVELS = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+};
+function isLogLevel(value) {
+    return value in LEVELS;
+}
+/**
+ * Resolves the configured minimum level. An unrecognized LOG_LEVEL
+ * value (typo, stale config) falls back to "info" rather than
+ * throwing -- logging configuration should never be able to crash
+ * startup; getting the level wrong just means slightly wrong log
+ * verbosity, not a refused boot.
+ */
+function resolveMinLevel(configuredLevel) {
+    return isLogLevel(configuredLevel) ? configuredLevel : "info";
+}
+/**
+ * Creates a Logger gated on the given LOG_LEVEL string (pass
+ * loadConfig().logging.level at the call site -- this function takes
+ * the resolved string, not process.env, so it stays easy to test and
+ * has no implicit dependency on when Config.ts's own env read runs).
+ *
+ * Output shape: one JSON object per line to stdout (debug/info) or
+ * stderr (warn/error) -- level and a timestamp are added automatically,
+ * `event` (required) and any additional fields come from the call
+ * site, mirroring the { event: "...", ...details } shape most existing
+ * console.warn/console.error call sites in this codebase already use
+ * by convention, just enforced and level-gated here rather than ad hoc.
+ */
+export function createLogger(configuredLevel) {
+    const minLevel = LEVELS[resolveMinLevel(configuredLevel)];
+    function log(level, fields) {
+        if (LEVELS[level] < minLevel) {
+            return;
+        }
+        const line = JSON.stringify({
+            level,
+            timestamp: new Date().toISOString(),
+            ...fields,
+        });
+        if (LEVELS[level] >= LEVELS.warn) {
+            console.error(line);
+        }
+        else {
+            console.log(line);
+        }
+    }
+    return {
+        debug: (fields) => log("debug", fields),
+        info: (fields) => log("info", fields),
+        warn: (fields) => log("warn", fields),
+        error: (fields) => log("error", fields),
+    };
+}
+let sharedLogger;
+/**
+ * Lazy, process-wide singleton Logger, built from loadConfig().logging.
+ * level on first use -- the same lazy-singleton shape this codebase's
+ * other composition roots already use (KeyBootstrap.create(),
+ * CryptoBootstrap.create(), PostgresPoolFactory.create()). Exists so a
+ * call site can log without threading a Logger instance through every
+ * function signature between it and wherever the app is composed --
+ * `import { getLogger } from "@parmana/shared"; getLogger().warn(...)`.
+ *
+ * loadConfig() itself is only called the first time a call site
+ * actually logs (not merely by importing @parmana/shared), same as
+ * every other lazy singleton in this file's neighborhood.
+ */
+export function getLogger() {
+    if (!sharedLogger) {
+        sharedLogger = createLogger(loadConfig().logging.level);
+    }
+    return sharedLogger;
+}
+//# sourceMappingURL=Logger.js.map

package/dist/logging/Logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Logger.js","sourceRoot":"","sources":["../../src/logging/Logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACD,CAAC;AAIX,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,IAAI,MAAM,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,eAAuB;IAC9C,OAAO,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC;AAcD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,eAAuB;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;IAE1D,SAAS,GAAG,CAAC,KAAe,EAAE,MAAiB;QAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,MAAM;SACV,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACvC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;QACrC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;QACrC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,IAAI,YAAgC,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/network/externalEndpointAddress.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Address checks for an external connector endpoint (ADR-0013,
+ * Security: SSRF).
+ *
+ * Parmana makes an HTTPS request to a URL an operator entered, so the
+ * URL is checked when it is registered and the address it resolves to
+ * is checked again at every release: a DNS change cannot point a
+ * registered endpoint inside Parmana's network.
+ */
+export declare const MAX_ENDPOINT_URL_LENGTH = 2048;
+export interface ResolvedAddress {
+    readonly address: string;
+    readonly family: 4 | 6;
+}
+/**
+ * Resolves a host name to every address it has. The default is the
+ * system resolver; tests pass their own.
+ */
+export type EndpointAddressLookup = (hostname: string) => Promise<readonly ResolvedAddress[]>;
+export declare const systemEndpointAddressLookup: EndpointAddressLookup;
+export type EndpointUrlCheck = {
+    readonly ok: true;
+    readonly url: URL;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * The checks that need no network: an absolute https URL with a host
+ * name (not an IP literal, not localhost, at least one dot), no user
+ * name or password, no fragment. On success, url.href is the form to
+ * store: it is the audience of every release to this endpoint.
+ */
+export declare function checkEndpointUrl(value: unknown): EndpointUrlCheck;
+export declare function isPublicAddress(address: string): boolean;
+export declare class ExternalEndpointAddressError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolves the endpoint's host and returns its addresses, or throws
+ * ExternalEndpointAddressError when it does not resolve or when ANY
+ * address it resolves to is not public. Refusing on any, not only the
+ * first, is deliberate: the caller connects to one of the returned
+ * addresses, never to the name again, so a second lookup cannot answer
+ * differently.
+ */
+export declare function resolvePublicEndpointAddresses(url: URL, lookup?: EndpointAddressLookup): Promise<readonly ResolvedAddress[]>;
+//# sourceMappingURL=externalEndpointAddress.d.ts.map

package/dist/network/externalEndpointAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"externalEndpointAddress.d.ts","sourceRoot":"","sources":["../../src/network/externalEndpointAddress.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAkD5C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;AAEzC,eAAO,MAAM,2BAA2B,EAAE,qBAKvC,CAAC;AAEJ,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAuDjE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQxD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,GAAG,EACR,MAAM,GAAE,qBAAmD,GAC1D,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CA2BrC"}

package/dist/network/externalEndpointAddress.js

@@ -0,0 +1,147 @@
+import { promises as dns } from "node:dns";
+import net from "node:net";
+/**
+ * Address checks for an external connector endpoint (ADR-0013,
+ * Security: SSRF).
+ *
+ * Parmana makes an HTTPS request to a URL an operator entered, so the
+ * URL is checked when it is registered and the address it resolves to
+ * is checked again at every release: a DNS change cannot point a
+ * registered endpoint inside Parmana's network.
+ */
+export const MAX_ENDPOINT_URL_LENGTH = 2048;
+/**
+ * Addresses Parmana never sends a release to: private, loopback, link
+ * local, shared (carrier grade NAT), multicast, reserved and
+ * documentation ranges, in IPv4 and IPv6.
+ */
+const NON_PUBLIC = new net.BlockList();
+for (const [network, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.88.99.0", 24],
+    ["192.168.0.0", 16],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4],
+]) {
+    NON_PUBLIC.addSubnet(network, prefix, "ipv4");
+}
+// No rule for IPv4 mapped IPv6 (::ffff:0:0/96): BlockList already
+// checks a mapped address against the IPv4 rules above, and a rule for
+// the whole range would also match every plain IPv4 address.
+for (const [network, prefix] of [
+    ["::", 128],
+    ["::1", 128],
+    ["64:ff9b::", 96],
+    ["64:ff9b:1::", 48],
+    ["100::", 64],
+    ["2001::", 23],
+    ["2001:db8::", 32],
+    ["2002::", 16],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["fec0::", 10],
+    ["ff00::", 8],
+]) {
+    NON_PUBLIC.addSubnet(network, prefix, "ipv6");
+}
+export const systemEndpointAddressLookup = async (hostname) => (await dns.lookup(hostname, { all: true, verbatim: true })).map(({ address, family }) => ({ address, family: family === 6 ? 6 : 4 }));
+/**
+ * The checks that need no network: an absolute https URL with a host
+ * name (not an IP literal, not localhost, at least one dot), no user
+ * name or password, no fragment. On success, url.href is the form to
+ * store: it is the audience of every release to this endpoint.
+ */
+export function checkEndpointUrl(value) {
+    if (typeof value !== "string" || value.length > MAX_ENDPOINT_URL_LENGTH) {
+        return {
+            ok: false,
+            reason: `endpointUrl must be a string of at most ${MAX_ENDPOINT_URL_LENGTH} characters.`,
+        };
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return { ok: false, reason: "endpointUrl is not an absolute URL." };
+    }
+    if (url.protocol !== "https:") {
+        return { ok: false, reason: "endpointUrl must use https." };
+    }
+    if (url.username !== "" || url.password !== "") {
+        return {
+            ok: false,
+            reason: "endpointUrl must not carry a user name or password.",
+        };
+    }
+    if (url.hash !== "") {
+        return { ok: false, reason: "endpointUrl must not carry a fragment." };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (hostname.startsWith("[") || net.isIP(hostname) !== 0) {
+        return {
+            ok: false,
+            reason: "endpointUrl must name a host, not an IP address.",
+        };
+    }
+    const bare = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+    if (bare === "localhost" ||
+        bare.endsWith(".localhost") ||
+        !bare.includes(".")) {
+        return {
+            ok: false,
+            reason: "endpointUrl must name a public host with a domain, not localhost or a single label name.",
+        };
+    }
+    return { ok: true, url };
+}
+export function isPublicAddress(address) {
+    const family = net.isIP(address);
+    if (family === 0) {
+        return false;
+    }
+    return !NON_PUBLIC.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+export class ExternalEndpointAddressError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ExternalEndpointAddressError";
+    }
+}
+/**
+ * Resolves the endpoint's host and returns its addresses, or throws
+ * ExternalEndpointAddressError when it does not resolve or when ANY
+ * address it resolves to is not public. Refusing on any, not only the
+ * first, is deliberate: the caller connects to one of the returned
+ * addresses, never to the name again, so a second lookup cannot answer
+ * differently.
+ */
+export async function resolvePublicEndpointAddresses(url, lookup = systemEndpointAddressLookup) {
+    let addresses;
+    try {
+        addresses = await lookup(url.hostname);
+    }
+    catch {
+        throw new ExternalEndpointAddressError(`The endpoint host '${url.hostname}' does not resolve.`);
+    }
+    if (addresses.length === 0) {
+        throw new ExternalEndpointAddressError(`The endpoint host '${url.hostname}' does not resolve.`);
+    }
+    const refused = addresses.filter(({ address }) => !isPublicAddress(address));
+    if (refused.length > 0) {
+        throw new ExternalEndpointAddressError(`The endpoint host '${url.hostname}' resolves to an address that is not public ` +
+            `(${refused.map(({ address }) => address).join(", ")}).`);
+    }
+    return addresses;
+}
+//# sourceMappingURL=externalEndpointAddress.js.map

package/dist/network/externalEndpointAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"externalEndpointAddress.js","sourceRoot":"","sources":["../../src/network/externalEndpointAddress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;AAEvC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC;IACd,CAAC,UAAU,EAAE,CAAC,CAAC;IACf,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,cAAc,EAAE,EAAE,CAAC;IACpB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,WAAW,EAAE,CAAC,CAAC;IAChB,CAAC,WAAW,EAAE,CAAC,CAAC;CACR,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,kEAAkE;AAClE,uEAAuE;AACvE,6DAA6D;AAE7D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,WAAW,EAAE,EAAE,CAAC;IACjB,CAAC,aAAa,EAAE,EAAE,CAAC;IACnB,CAAC,OAAO,EAAE,EAAE,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,YAAY,EAAE,EAAE,CAAC;IAClB,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;IACb,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,QAAQ,EAAE,CAAC,CAAC;CACL,EAAE,CAAC;IACX,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAeD,MAAM,CAAC,MAAM,2BAA2B,GAA0B,KAAK,EACrE,QAAQ,EACR,EAAE,CACF,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC7D,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;AAMJ;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2CAA2C,uBAAuB,cAAc;SACzF,CAAC;IACJ,CAAC;IAED,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD;SAC3D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEvE,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EACnB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAQ,EACR,MAAM,GAA0B,2BAA2B;IAE3D,IAAI,SAAqC,CAAC;IAE1C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,GAAG,CAAC,QAAQ,qBAAqB,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,GAAG,CAAC,QAAQ,qBAAqB,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,4BAA4B,CACpC,sBAAsB,GAAG,CAAC,QAAQ,8CAA8C;YAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/repositories/approval-issuer-repository.d.ts

@@ -0,0 +1,31 @@
+import type { ApprovalIssuerChange, ApprovalIssuerRecord } from "../domain/approval-issuer.js";
+/**
+ * Approver keys added through maker checker, and the changes that add
+ * or revoke them.
+ */
+export interface ApprovalIssuerRepository {
+    findIssuer(approverId: string, keyId: string): Promise<ApprovalIssuerRecord | null>;
+    listIssuers(): Promise<readonly ApprovalIssuerRecord[]>;
+    /**
+     * Stores a new PENDING_APPROVAL change. Throws ConflictError when
+     * another change for the same approver and key is still pending.
+     */
+    createChange(change: ApprovalIssuerChange): Promise<ApprovalIssuerChange>;
+    findChange(changeId: string): Promise<ApprovalIssuerChange | null>;
+    listChanges(status?: ApprovalIssuerChange["status"]): Promise<readonly ApprovalIssuerChange[]>;
+    /**
+     * Resolves a pending change to APPROVED and applies it, in one step:
+     * add inserts the key, revoke marks it revoked. Throws
+     * ApprovalIssuerChangeNotFoundError for an unknown id, and
+     * ConflictError when the change is no longer pending, the key to add
+     * already exists, or the key to revoke does not exist or is already
+     * revoked. Nothing is written when it throws.
+     */
+    approveChange(changeId: string, approvedBy: string, at: Date): Promise<ApprovalIssuerChange>;
+    /**
+     * Resolves a pending change to REJECTED. Throws as approveChange does
+     * for an unknown or already resolved change.
+     */
+    rejectChange(changeId: string, rejectedBy: string, rejectionReason: string, at: Date): Promise<ApprovalIssuerChange>;
+}
+//# sourceMappingURL=approval-issuer-repository.d.ts.map

package/dist/repositories/approval-issuer-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-issuer-repository.d.ts","sourceRoot":"","sources":["../../src/repositories/approval-issuer-repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAExC,WAAW,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAExD;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAEnE,WAAW,CACT,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAE5C;;;;;;;OAOG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC"}

package/dist/repositories/approval-issuer-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=approval-issuer-repository.js.map

package/dist/repositories/approval-issuer-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-issuer-repository.js","sourceRoot":"","sources":["../../src/repositories/approval-issuer-repository.ts"],"names":[],"mappings":""}

package/dist/repositories/authority-grant-repository.d.ts

@@ -0,0 +1,22 @@
+import type { AuthorityGrant, AuthorityGrantChange } from "../domain/authority-grant.js";
+/**
+ * Authority grants and the changes that make and revoke them (RFC-0023
+ * phase 3). Only approveChange touches grants, and it applies the change
+ * and resolves it in one step. At most one active grant and one pending
+ * change exist per caller and capability.
+ */
+export interface AuthorityGrantRepository {
+    /**
+     * The active (not revoked) grant for this caller and capability, or
+     * null. It may have expired or not yet begun: the caller decides what
+     * that means.
+     */
+    findActive(callerId: string, capability: string): Promise<AuthorityGrant | null>;
+    listGrants(): Promise<readonly AuthorityGrant[]>;
+    createChange(change: AuthorityGrantChange): Promise<AuthorityGrantChange>;
+    findChange(changeId: string): Promise<AuthorityGrantChange | null>;
+    listChanges(status?: AuthorityGrantChange["status"]): Promise<readonly AuthorityGrantChange[]>;
+    approveChange(changeId: string, approvedBy: string, at: Date): Promise<AuthorityGrantChange>;
+    rejectChange(changeId: string, rejectedBy: string, rejectionReason: string, at: Date): Promise<AuthorityGrantChange>;
+}
+//# sourceMappingURL=authority-grant-repository.d.ts.map

package/dist/repositories/authority-grant-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-grant-repository.d.ts","sourceRoot":"","sources":["../../src/repositories/authority-grant-repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAElC,UAAU,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEjD,YAAY,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAEnE,WAAW,CACT,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAE5C,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC"}

package/dist/repositories/authority-grant-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authority-grant-repository.js.map

package/dist/repositories/authority-grant-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-grant-repository.js","sourceRoot":"","sources":["../../src/repositories/authority-grant-repository.ts"],"names":[],"mappings":""}

package/dist/repositories/business-signal-source-repository.d.ts

@@ -0,0 +1,17 @@
+import type { BusinessSignalSourceChange, BusinessSignalSourceRegistration } from "../domain/business-signal-source.js";
+/**
+ * Business signal sources and the changes that register and revoke them
+ * (RFC-0023 phase 2). Only approveChange touches registrations, and it
+ * applies the change and resolves it in one step. At most one active
+ * registration and one pending change exist per name.
+ */
+export interface BusinessSignalSourceRepository {
+    findActive(name: string): Promise<BusinessSignalSourceRegistration | null>;
+    listRegistrations(): Promise<readonly BusinessSignalSourceRegistration[]>;
+    createChange(change: BusinessSignalSourceChange): Promise<BusinessSignalSourceChange>;
+    findChange(changeId: string): Promise<BusinessSignalSourceChange | null>;
+    listChanges(status?: BusinessSignalSourceChange["status"]): Promise<readonly BusinessSignalSourceChange[]>;
+    approveChange(changeId: string, approvedBy: string, at: Date): Promise<BusinessSignalSourceChange>;
+    rejectChange(changeId: string, rejectedBy: string, rejectionReason: string, at: Date): Promise<BusinessSignalSourceChange>;
+}
+//# sourceMappingURL=business-signal-source-repository.d.ts.map

package/dist/repositories/business-signal-source-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-signal-source-repository.d.ts","sourceRoot":"","sources":["../../src/repositories/business-signal-source-repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,gCAAgC,EACjC,MAAM,qCAAqC,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IAE3E,iBAAiB,IAAI,OAAO,CAAC,SAAS,gCAAgC,EAAE,CAAC,CAAC;IAE1E,YAAY,CACV,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IAEzE,WAAW,CACT,MAAM,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAAC;IAElD,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEvC,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC"}

package/dist/repositories/business-signal-source-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=business-signal-source-repository.js.map

package/dist/repositories/business-signal-source-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-signal-source-repository.js","sourceRoot":"","sources":["../../src/repositories/business-signal-source-repository.ts"],"names":[],"mappings":""}

package/dist/repositories/business-transaction-repository.d.ts

@@ -0,0 +1,34 @@
+import { BusinessTransaction } from "../domain/index.js";
+/**
+ * Repository for Business Transactions.
+ *
+ * Implementations may use PostgreSQL, Supabase,
+ * DynamoDB, etc.
+ */
+export interface BusinessTransactionRepository {
+    /**
+     * Creates a new Business Transaction. Insert-if-absent: an
+     * implementation MUST atomically reject a businessTransactionId
+     * that already exists by throwing DuplicateBusinessTransactionError
+     * (@parmana/shared), rather than silently overwriting it or
+     * relying on a separate exists()-then-create() check at the call
+     * site, which cannot be atomic (see G-1,
+     * docs/VERIFICATION-GAPS.md). Every implementation must surface
+     * the same error type for a duplicate, so callers cannot behave
+     * differently depending on the backing store.
+     */
+    create(transaction: BusinessTransaction): Promise<BusinessTransaction>;
+    /**
+     * Finds a Business Transaction.
+     */
+    findById(businessTransactionId: string): Promise<BusinessTransaction | null>;
+    /**
+     * Checks whether a Business Transaction exists.
+     */
+    exists(businessTransactionId: string): Promise<boolean>;
+    /**
+     * Lists Business Transactions.
+     */
+    list(page: number, pageSize: number): Promise<readonly BusinessTransaction[]>;
+}
+//# sourceMappingURL=business-transaction-repository.d.ts.map

package/dist/repositories/business-transaction-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-transaction-repository.d.ts","sourceRoot":"","sources":["../../src/repositories/business-transaction-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;;;;OAUG;IACH,MAAM,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvE;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAE7E;;OAEG;IACH,MAAM,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExD;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;CAC/E"}

package/dist/repositories/business-transaction-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=business-transaction-repository.js.map

package/dist/repositories/business-transaction-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-transaction-repository.js","sourceRoot":"","sources":["../../src/repositories/business-transaction-repository.ts"],"names":[],"mappings":""}

package/dist/repositories/challenge-record-repository.d.ts

@@ -0,0 +1,67 @@
+import { ChallengeRecord, ChallengeRecordDisclosure, ChallengeRecordFinding, ChallengeRecordInvestigationStep, ChallengeRecordOutcome, ChallengeRecordStatus } from "../domain/index.js";
+/**
+ * One append-only operation against an existing ChallengeRecord
+ * (RFC-0022). Exactly one of these per `append()` call — never a
+ * partial-record patch — so every mutation is an explicit,
+ * individually reviewable step, matching investigationSteps' own
+ * one-entry-at-a-time shape.
+ */
+export type ChallengeRecordAppendOperation = {
+    readonly kind: "investigation-step";
+    readonly step: ChallengeRecordInvestigationStep;
+} | {
+    readonly kind: "status";
+    readonly status: ChallengeRecordStatus;
+} | {
+    readonly kind: "finding";
+    readonly finding: ChallengeRecordFinding;
+} | {
+    readonly kind: "outcome";
+    readonly outcome: ChallengeRecordOutcome;
+} | {
+    readonly kind: "disclosure";
+    readonly disclosure: ChallengeRecordDisclosure;
+};
+/**
+ * Repository for Challenge Records (RFC-0022).
+ *
+ * Unlike RefusalRecordRepository (a single terminal write per
+ * transaction), a ChallengeRecord is investigated over real time:
+ * `create` starts it, `append` extends it. `append` never accepts a
+ * full replacement record — only one of ChallengeRecordAppendOperation's
+ * variants — so implementations can enforce append-only semantics
+ * (investigationSteps only ever grows; status only ever moves
+ * forward; finding/outcome/disclosure are each immutable once set) at
+ * the repository boundary, not merely by caller convention. See
+ * `applyChallengeRecordAppend`, which every implementation should
+ * route through to keep that enforcement identical across backends.
+ */
+export interface ChallengeRecordRepository {
+    create(record: ChallengeRecord): Promise<ChallengeRecord>;
+    /**
+     * Applies one append-only operation to an existing Challenge
+     * Record and returns the updated record. Throws
+     * ChallengeRecordNotFoundError if no record exists for the given
+     * id, or ConflictError if the operation would violate append-only
+     * semantics (see `applyChallengeRecordAppend`).
+     */
+    append(challengeRecordId: string, operation: ChallengeRecordAppendOperation): Promise<ChallengeRecord>;
+    findById(challengeRecordId: string): Promise<ChallengeRecord | null>;
+    list(): Promise<readonly ChallengeRecord[]>;
+}
+/**
+ * Pure, backend-independent enforcement of ChallengeRecord's
+ * append-only rules (RFC-0022 § Proposal 1): investigationSteps only
+ * grows; status only moves strictly forward (open -> investigating ->
+ * resolved), never backward or in place; finding/outcome/disclosure
+ * are each set at most once. Every ChallengeRecordRepository
+ * implementation should call this rather than re-implementing the
+ * same checks, so the enforcement is identical across backends (the
+ * same reasoning `isUniqueViolation` gave for a shared mapping across
+ * MemoryBusinessTransactionRepository / SupabaseBusinessTransactionRepository).
+ *
+ * Throws ConflictError, never silently drops or overwrites, on any
+ * violation.
+ */
+export declare function applyChallengeRecordAppend(record: ChallengeRecord, operation: ChallengeRecordAppendOperation, appliedAt: Date): ChallengeRecord;
+//# sourceMappingURL=challenge-record-repository.d.ts.map

package/dist/repositories/challenge-record-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-record-repository.d.ts","sourceRoot":"","sources":["../../src/repositories/challenge-record-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAI5B;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GACtC;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;CACjD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CAAE,GACtE;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE1D;;;;;;OAMG;IACH,MAAM,CACJ,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,8BAA8B,GACxC,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAErE,IAAI,IAAI,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;CAC7C;AAaD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,8BAA8B,EACzC,SAAS,EAAE,IAAI,GACd,eAAe,CAkEjB"}

package/dist/repositories/challenge-record-repository.js

@@ -0,0 +1,76 @@
+import { ConflictError } from "../errors/index.js";
+/**
+ * Forward-only lifecycle order a `status` append operation must
+ * respect. Index position, not the string values, is what "forward"
+ * means here.
+ */
+const CHALLENGE_RECORD_STATUS_ORDER = [
+    "open",
+    "investigating",
+    "resolved",
+];
+/**
+ * Pure, backend-independent enforcement of ChallengeRecord's
+ * append-only rules (RFC-0022 § Proposal 1): investigationSteps only
+ * grows; status only moves strictly forward (open -> investigating ->
+ * resolved), never backward or in place; finding/outcome/disclosure
+ * are each set at most once. Every ChallengeRecordRepository
+ * implementation should call this rather than re-implementing the
+ * same checks, so the enforcement is identical across backends (the
+ * same reasoning `isUniqueViolation` gave for a shared mapping across
+ * MemoryBusinessTransactionRepository / SupabaseBusinessTransactionRepository).
+ *
+ * Throws ConflictError, never silently drops or overwrites, on any
+ * violation.
+ */
+export function applyChallengeRecordAppend(record, operation, appliedAt) {
+    switch (operation.kind) {
+        case "investigation-step":
+            return {
+                ...record,
+                investigationSteps: [...record.investigationSteps, operation.step],
+                updatedAt: appliedAt,
+            };
+        case "status": {
+            const currentIndex = CHALLENGE_RECORD_STATUS_ORDER.indexOf(record.status);
+            const nextIndex = CHALLENGE_RECORD_STATUS_ORDER.indexOf(operation.status);
+            if (nextIndex <= currentIndex) {
+                throw new ConflictError(`Challenge Record '${record.challengeRecordId}' status cannot move from ` +
+                    `'${record.status}' to '${operation.status}' -- status only ever moves forward ` +
+                    "(open -> investigating -> resolved), never backward or in place. A challenge " +
+                    "believed resolved that needs reopening should become a new ChallengeRecord " +
+                    "linked via 'supersedes', not a status change on this one.");
+            }
+            return { ...record, status: operation.status, updatedAt: appliedAt };
+        }
+        case "finding": {
+            if (record.finding !== undefined) {
+                throw new ConflictError(`Challenge Record '${record.challengeRecordId}' already has a finding recorded ` +
+                    `('${record.finding.outcome}') -- finding is immutable once set. A correction ` +
+                    "should become a new ChallengeRecord linked via 'supersedes', not an edit here.");
+            }
+            return { ...record, finding: operation.finding, updatedAt: appliedAt };
+        }
+        case "outcome": {
+            if (record.outcome !== undefined) {
+                throw new ConflictError(`Challenge Record '${record.challengeRecordId}' already has an outcome recorded ` +
+                    "-- outcome is immutable once set. A correction should become a new " +
+                    "ChallengeRecord linked via 'supersedes', not an edit here.");
+            }
+            return { ...record, outcome: operation.outcome, updatedAt: appliedAt };
+        }
+        case "disclosure": {
+            if (record.disclosure !== undefined) {
+                throw new ConflictError(`Challenge Record '${record.challengeRecordId}' already has a disclosure recorded ` +
+                    "-- disclosure is immutable once set. A correction should become a new " +
+                    "ChallengeRecord linked via 'supersedes', not an edit here.");
+            }
+            return {
+                ...record,
+                disclosure: operation.disclosure,
+                updatedAt: appliedAt,
+            };
+        }
+    }
+}
+//# sourceMappingURL=challenge-record-repository.js.map

package/dist/repositories/challenge-record-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-record-repository.js","sourceRoot":"","sources":["../../src/repositories/challenge-record-repository.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAwDnD;;;;GAIG;AACH,MAAM,6BAA6B,GAAqC;IACtE,MAAM;IACN,eAAe;IACf,UAAU;CACX,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAuB,EACvB,SAAyC,EACzC,SAAe;IAEf,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,oBAAoB;YACvB,OAAO;gBACL,GAAG,MAAM;gBACT,kBAAkB,EAAE,CAAC,GAAG,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC;gBAClE,SAAS,EAAE,SAAS;aACrB,CAAC;QAEJ,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,YAAY,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1E,MAAM,SAAS,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAE1E,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CACrB,qBAAqB,MAAM,CAAC,iBAAiB,4BAA4B;oBACvE,IAAI,MAAM,CAAC,MAAM,SAAS,SAAS,CAAC,MAAM,sCAAsC;oBAChF,+EAA+E;oBAC/E,6EAA6E;oBAC7E,2DAA2D,CAC9D,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CACrB,qBAAqB,MAAM,CAAC,iBAAiB,mCAAmC;oBAC9E,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,oDAAoD;oBAC/E,gFAAgF,CACnF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QAED,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,aAAa,CACrB,qBAAqB,MAAM,CAAC,iBAAiB,oCAAoC;oBAC/E,qEAAqE;oBACrE,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACzE,CAAC;QAED,KAAK,YAAY,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,aAAa,CACrB,qBAAqB,MAAM,CAAC,iBAAiB,sCAAsC;oBACjF,wEAAwE;oBACxE,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,GAAG,MAAM;gBACT,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,SAAS,EAAE,SAAS;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}