@parmana/shared 0.0.0-stage → 0.1.0

package/dist/config/CryptoAlgorithms.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Canonical hash algorithms supported by Parmana.
+ *
+ * New algorithms are additive.
+ */
+export declare const HashAlgorithms: {
+    readonly SHA256: "sha256";
+    readonly SHA3512: "sha3-512";
+    readonly BLAKE3: "blake3";
+};
+export type HashAlgorithm = (typeof HashAlgorithms)[keyof typeof HashAlgorithms];
+/**
+ * Canonical signature algorithms.
+ */
+export declare const SignatureAlgorithms: {
+    readonly ED25519: "ed25519";
+    readonly ECDSA_P256: "ecdsa-p256";
+    readonly DILITHIUM3: "dilithium3";
+    readonly DILITHIUM5: "dilithium5";
+    readonly SPHINCS_PLUS: "sphincs-plus";
+};
+export type SignatureAlgorithm = (typeof SignatureAlgorithms)[keyof typeof SignatureAlgorithms];
+/**
+ * Crypto signing modes.
+ *
+ * single: exactly one SignatureProvider (PRIMARY_SIGNATURE_PROVIDER)
+ * signs and verifies everything -- today's behavior, unchanged.
+ *
+ * hybrid: PRIMARY_SIGNATURE_PROVIDER and SECONDARY_SIGNATURE_PROVIDER
+ * both sign Execution Trust Records and Receipts; verification
+ * requires both to pass. See HybridSignatureProvider (@parmana/crypto).
+ *
+ * pq: reserved for a future post-quantum-only mode. Not read by any
+ * production call site today.
+ */
+export declare const CryptoModes: {
+    readonly SINGLE: "single";
+    readonly HYBRID: "hybrid";
+    readonly PQ: "pq";
+};
+export type CryptoMode = (typeof CryptoModes)[keyof typeof CryptoModes];
+//# sourceMappingURL=CryptoAlgorithms.d.ts.map

package/dist/config/CryptoAlgorithms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAlgorithms.d.ts","sourceRoot":"","sources":["../../src/config/CryptoAlgorithms.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;aACzB,MAAM,EAAE,QAAQ;aAChB,OAAO,EAAE,UAAU;aACnB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,aAAa,GACvB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD;;GAEG;AACH,eAAO,MAAM,mBAAmB;aAC9B,OAAO,EAAE,SAAS;aAClB,UAAU,EAAE,YAAY;aAKxB,UAAU,EAAE,YAAY;aACxB,UAAU,EAAE,YAAY;aACxB,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAC5B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW;aACtB,MAAM,EAAE,QAAQ;aAChB,MAAM,EAAE,QAAQ;aAChB,EAAE,EAAE,IAAI;CACA,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}

package/dist/config/CryptoAlgorithms.js

@@ -0,0 +1,42 @@
+/**
+ * Canonical hash algorithms supported by Parmana.
+ *
+ * New algorithms are additive.
+ */
+export const HashAlgorithms = {
+    SHA256: "sha256",
+    SHA3512: "sha3-512",
+    BLAKE3: "blake3",
+};
+/**
+ * Canonical signature algorithms.
+ */
+export const SignatureAlgorithms = {
+    ED25519: "ed25519",
+    ECDSA_P256: "ecdsa-p256",
+    //
+    // Post-Quantum Ready
+    //
+    DILITHIUM3: "dilithium3",
+    DILITHIUM5: "dilithium5",
+    SPHINCS_PLUS: "sphincs-plus",
+};
+/**
+ * Crypto signing modes.
+ *
+ * single: exactly one SignatureProvider (PRIMARY_SIGNATURE_PROVIDER)
+ * signs and verifies everything -- today's behavior, unchanged.
+ *
+ * hybrid: PRIMARY_SIGNATURE_PROVIDER and SECONDARY_SIGNATURE_PROVIDER
+ * both sign Execution Trust Records and Receipts; verification
+ * requires both to pass. See HybridSignatureProvider (@parmana/crypto).
+ *
+ * pq: reserved for a future post-quantum-only mode. Not read by any
+ * production call site today.
+ */
+export const CryptoModes = {
+    SINGLE: "single",
+    HYBRID: "hybrid",
+    PQ: "pq",
+};
+//# sourceMappingURL=CryptoAlgorithms.js.map

package/dist/config/CryptoAlgorithms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAlgorithms.js","sourceRoot":"","sources":["../../src/config/CryptoAlgorithms.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,QAAQ;CACR,CAAC;AAKX;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IAExB,EAAE;IACF,qBAAqB;IACrB,EAAE;IACF,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;CACA,CAAC"}

package/dist/config/KeyProviders.d.ts

@@ -0,0 +1,9 @@
+export declare const KeyProviders: {
+    readonly LOCAL: "local";
+    readonly AWS_KMS: "aws-kms";
+    readonly AZURE_KEY_VAULT: "azure-key-vault";
+    readonly GCP_KMS: "gcp-kms";
+    readonly HSM: "hsm";
+};
+export type KeyProvider = (typeof KeyProviders)[keyof typeof KeyProviders];
+//# sourceMappingURL=KeyProviders.d.ts.map

package/dist/config/KeyProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyProviders.d.ts","sourceRoot":"","sources":["../../src/config/KeyProviders.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY;aACvB,KAAK,EAAE,OAAO;aACd,OAAO,EAAE,SAAS;aAClB,eAAe,EAAE,iBAAiB;aAClC,OAAO,EAAE,SAAS;aAClB,GAAG,EAAE,KAAK;CACF,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC"}

package/dist/config/KeyProviders.js

@@ -0,0 +1,8 @@
+export const KeyProviders = {
+    LOCAL: "local",
+    AWS_KMS: "aws-kms",
+    AZURE_KEY_VAULT: "azure-key-vault",
+    GCP_KMS: "gcp-kms",
+    HSM: "hsm",
+};
+//# sourceMappingURL=KeyProviders.js.map

package/dist/config/KeyProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyProviders.js","sourceRoot":"","sources":["../../src/config/KeyProviders.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,eAAe,EAAE,iBAAiB;IAClC,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;CACF,CAAC"}

package/dist/config/SecretsProviders.d.ts

@@ -0,0 +1,6 @@
+export declare const SecretsProviders: {
+    readonly ENV: "env";
+    readonly AWS_SECRETS_MANAGER: "aws-secrets-manager";
+};
+export type SecretsProvider = (typeof SecretsProviders)[keyof typeof SecretsProviders];
+//# sourceMappingURL=SecretsProviders.d.ts.map

package/dist/config/SecretsProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsProviders.d.ts","sourceRoot":"","sources":["../../src/config/SecretsProviders.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;aAC3B,GAAG,EAAE,KAAK;aACV,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAEX,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/config/SecretsProviders.js

@@ -0,0 +1,5 @@
+export const SecretsProviders = {
+    ENV: "env",
+    AWS_SECRETS_MANAGER: "aws-secrets-manager",
+};
+//# sourceMappingURL=SecretsProviders.js.map

package/dist/config/SecretsProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsProviders.js","sourceRoot":"","sources":["../../src/config/SecretsProviders.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,GAAG,EAAE,KAAK;IACV,mBAAmB,EAAE,qBAAqB;CAClC,CAAC"}

package/dist/config/StorageProviders.d.ts

@@ -0,0 +1,18 @@
+export declare const StorageProviders: {
+    readonly MEMORY: "memory";
+    readonly POSTGRES: "postgres";
+    readonly SUPABASE: "supabase";
+};
+export type StorageProvider = (typeof StorageProviders)[keyof typeof StorageProviders];
+/**
+ * Whether a provider name selects the durable Postgres storage.
+ *
+ * `postgres` and `supabase` select the same implementation: every
+ * repository, audit sink and nonce store behind them writes through
+ * PostgresPoolFactory (DATABASE_URL), so it runs on any Postgres,
+ * Supabase hosted or self hosted. `supabase` is kept so existing
+ * deployments are unchanged; `postgres` is the name for a self hosted
+ * database (G-57).
+ */
+export declare function isPostgresStorage(provider: string | undefined): boolean;
+//# sourceMappingURL=StorageProviders.d.ts.map

package/dist/config/StorageProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageProviders.d.ts","sourceRoot":"","sources":["../../src/config/StorageProviders.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;aAC3B,MAAM,EAAE,QAAQ;aAChB,QAAQ,EAAE,UAAU;aACpB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAEX,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAE3D;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKvE"}

package/dist/config/StorageProviders.js

@@ -0,0 +1,20 @@
+export const StorageProviders = {
+    MEMORY: "memory",
+    POSTGRES: "postgres",
+    SUPABASE: "supabase",
+};
+/**
+ * Whether a provider name selects the durable Postgres storage.
+ *
+ * `postgres` and `supabase` select the same implementation: every
+ * repository, audit sink and nonce store behind them writes through
+ * PostgresPoolFactory (DATABASE_URL), so it runs on any Postgres,
+ * Supabase hosted or self hosted. `supabase` is kept so existing
+ * deployments are unchanged; `postgres` is the name for a self hosted
+ * database (G-57).
+ */
+export function isPostgresStorage(provider) {
+    return (provider === StorageProviders.POSTGRES ||
+        provider === StorageProviders.SUPABASE);
+}
+//# sourceMappingURL=StorageProviders.js.map

package/dist/config/StorageProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StorageProviders.js","sourceRoot":"","sources":["../../src/config/StorageProviders.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAKX;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B;IAC5D,OAAO,CACL,QAAQ,KAAK,gBAAgB,CAAC,QAAQ;QACtC,QAAQ,KAAK,gBAAgB,CAAC,QAAQ,CACvC,CAAC;AACJ,CAAC"}

package/dist/config/TrustProfiles.d.ts

@@ -0,0 +1,5 @@
+export declare const TrustProfiles: {
+    readonly V1: "v1";
+};
+export type TrustProfile = (typeof TrustProfiles)[keyof typeof TrustProfiles];
+//# sourceMappingURL=TrustProfiles.d.ts.map

package/dist/config/TrustProfiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustProfiles.d.ts","sourceRoot":"","sources":["../../src/config/TrustProfiles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa;aACxB,EAAE,EAAE,IAAI;CACA,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC"}

package/dist/config/TrustProfiles.js

@@ -0,0 +1,4 @@
+export const TrustProfiles = {
+    V1: "v1",
+};
+//# sourceMappingURL=TrustProfiles.js.map

package/dist/config/TrustProfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustProfiles.js","sourceRoot":"","sources":["../../src/config/TrustProfiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,EAAE,EAAE,IAAI;CACA,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,11 @@
+export * from "./Config.js";
+export * from "./ConfigLoader.js";
+export * from "./ConfigValidation.js";
+export * from "./CryptoAlgorithms.js";
+export * from "./StorageProviders.js";
+export * from "./KeyProviders.js";
+export * from "./SecretsProviders.js";
+export * from "./TrustProfiles.js";
+export * from "./ApiKeyEntry.js";
+export * from "./ConfigUtils.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AAEtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,11 @@
+export * from "./Config.js";
+export * from "./ConfigLoader.js";
+export * from "./ConfigValidation.js";
+export * from "./CryptoAlgorithms.js";
+export * from "./StorageProviders.js";
+export * from "./KeyProviders.js";
+export * from "./SecretsProviders.js";
+export * from "./TrustProfiles.js";
+export * from "./ApiKeyEntry.js";
+export * from "./ConfigUtils.js";
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AAEtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}

package/dist/domain/approval-artifact.d.ts

@@ -0,0 +1,136 @@
+import type { JsonValue } from "../types/Json.js";
+import type { Signature } from "./signature.js";
+/**
+ * Parmana Trust Core
+ *
+ * Approval Artifact (TD-23 closure, Phase 3C)
+ *
+ * A cryptographically verifiable, independently-issued attestation
+ * that a specific external business authority approved a specific,
+ * bounded fact about a specific capability and business object --
+ * replacing a caller-declared authorization assertion (e.g.
+ * `preAuthorizedForAmountChange: true`) that Parmana's own
+ * Execution Authorization cannot truthfully represent, because the
+ * Execution Authorization proves Parmana's own runtime approved a
+ * Decision, not that an independent business authority approved an
+ * exception to it.
+ *
+ * Design frozen in §7 of the Phase 3A approval artifact design (in git
+ * history). This file implements that specification's schema exactly --
+ * field names, types, and mandatory/optional status are not
+ * reinterpreted here.
+ *
+ * Trust Chain (mirrors ExecutionAuthorizationPayload's own doc
+ * comment style):
+ *
+ * Business Approval (an authority independent of the AI caller and
+ *   of Parmana's own runtime)
+ *      ↓
+ * Approval Artifact (this type)
+ *      ↓
+ * Canonical Serialization (CanonicalSerializer, reused verbatim)
+ *      ↓
+ * Signature (the issuer's own key -- never Parmana's runtime key)
+ *      ↓
+ * Verification (@parmana/approval's ApprovalVerifier)
+ *      ↓
+ * Policy (the verified fact populates a policy signal, replacing the
+ *   caller's own declared value)
+ */
+/**
+ * Restricted comparator vocabulary for Approval scope checks.
+ * Deliberately narrower than PolicyEngine's own operator set (see
+ * packages/policy/src/types/Policy.ts's PolicyOperator) -- an
+ * approval bounds one numeric or exact-match fact, not an arbitrary
+ * policy condition tree.
+ */
+export type ApprovalScopeComparator = "eq" | "lte" | "gte" | "lt" | "gt" | "between";
+/**
+ * The bound being approved. `value`'s shape depends on `comparator`:
+ * a plain number/string for eq/lte/gte/lt/gt, or a {min, max} range
+ * for `between`.
+ */
+export interface ApprovalScope {
+    /**
+     * The name of the specific policy-evaluated fact this artifact
+     * attests to -- e.g. "amountDeltaAbs". Exactly one fact per
+     * artifact; an approval is never a blanket "everything about this
+     * request is fine."
+     */
+    readonly field: string;
+    readonly comparator: ApprovalScopeComparator;
+    readonly value: number | string | {
+        readonly min: number;
+        readonly max: number;
+    };
+}
+/**
+ * Identifies the approving party and which of their registered keys
+ * signed this artifact. Never the AI caller's own callerId, and
+ * never Parmana's own runtime identity (DEFAULT_KEY_ID) -- see
+ * ApprovalIssuerRegistry (@parmana/approval) for how this is
+ * resolved to a trusted public key.
+ */
+export interface ApprovalIssuer {
+    readonly approverId: string;
+    readonly keyId: string;
+}
+export interface ApprovalPayload {
+    /**
+     * Payload format version. Verifiers MUST reject any other value
+     * (including missing) before attempting signature verification --
+     * identical discipline to ExecutionAuthorizationPayload.version.
+     */
+    readonly version: 1;
+    /**
+     * Unique identifier for this artifact.
+     */
+    readonly approvalId: string;
+    readonly issuer: ApprovalIssuer;
+    /**
+     * ISO-8601 UTC timestamp when the approval was granted.
+     */
+    readonly issuedAt: string;
+    /**
+     * ISO-8601 UTC expiry. REQUIRED. Verifiers MUST reject an artifact
+     * past this time -- identical discipline to
+     * ExecutionAuthorizationPayload.expiresAt.
+     */
+    readonly expiresAt: string;
+    /**
+     * The exact capability (Intent.action) this approval is scoped to
+     * -- e.g. "hubspot:deal-update". Prevents capability substitution.
+     */
+    readonly capability: string;
+    /**
+     * The exact business object this approval covers, in the same
+     * identifier shape the capability's own Intent.parameters carries
+     * (e.g. a HubSpot dealId) -- not a wildcard, not a pattern.
+     * Prevents authorization transfer to another business object.
+     */
+    readonly resourceId: string;
+    readonly scope: ApprovalScope;
+    /**
+     * Reserved, additive extension point for future scope dimensions.
+     * Absent by default -- no concrete field needed yet (Phase 3A §17,
+     * Open Question #3).
+     */
+    readonly constraints?: Readonly<Record<string, JsonValue>>;
+    /**
+     * Single-use. Burned on first successful verification via the
+     * existing NonceStore interface, reused verbatim.
+     */
+    readonly nonce: string;
+}
+/**
+ * The complete envelope an Approval Artifact travels as.
+ */
+export interface SignedApproval {
+    readonly payload: ApprovalPayload;
+    /**
+     * Signature over the canonical serialization of payload, produced
+     * by the issuer's own private key -- never Parmana's runtime key.
+     */
+    readonly signature: Signature;
+}
+//# sourceMappingURL=approval-artifact.d.ts.map

package/dist/domain/approval-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-artifact.d.ts","sourceRoot":"","sources":["../../src/domain/approval-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GACjC,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAE7C,QAAQ,CAAC,KAAK,EACZ,MAAM,GAAG,MAAM,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAE3D;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B"}

package/dist/domain/approval-artifact.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=approval-artifact.js.map

package/dist/domain/approval-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-artifact.js","sourceRoot":"","sources":["../../src/domain/approval-artifact.ts"],"names":[],"mappings":""}

package/dist/domain/approval-issuer.d.ts

@@ -0,0 +1,52 @@
+import type { PendingPolicyChangeStatus } from "./pending-policy-change.js";
+/**
+ * An approver key trusted to sign Approval Artifacts, added through
+ * maker checker (approval-issuers.ts) instead of a deploy. The
+ * server's code list (createApprovalIssuerRegistry.ts) is checked
+ * first; these rows add to it.
+ */
+export interface ApprovalIssuerRecord {
+    readonly approverId: string;
+    readonly keyId: string;
+    /**
+     * The approver's Ed25519 public key, PEM (SPKI).
+     */
+    readonly publicKeyPem: string;
+    /**
+     * Revoking a key refuses every approval it ever signed.
+     */
+    readonly revoked: boolean;
+    /**
+     * The approved change that added this key. Its proposedBy and
+     * resolvedBy say who asked and who approved.
+     */
+    readonly addedByChangeId: string;
+    readonly addedAt: Date;
+    readonly revokedByChangeId?: string;
+    readonly revokedAt?: Date;
+}
+export type ApprovalIssuerChangeAction = "add" | "revoke";
+/**
+ * A proposal to add or revoke an approver key, and its resolution. One
+ * person proposes; a different person approves or rejects it with a
+ * step up signature. Only an approved change touches
+ * approval_issuers.
+ */
+export interface ApprovalIssuerChange {
+    readonly changeId: string;
+    readonly action: ApprovalIssuerChangeAction;
+    readonly approverId: string;
+    readonly keyId: string;
+    /**
+     * Required to add, absent to revoke.
+     */
+    readonly publicKeyPem?: string;
+    readonly reason: string;
+    readonly proposedBy: string;
+    readonly proposedAt: Date;
+    readonly status: PendingPolicyChangeStatus;
+    readonly resolvedBy?: string;
+    readonly resolvedAt?: Date;
+    readonly rejectionReason?: string;
+}
+//# sourceMappingURL=approval-issuer.d.ts.map

package/dist/domain/approval-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-issuer.d.ts","sourceRoot":"","sources":["../../src/domain/approval-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAEvB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,0BAA0B,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/domain/approval-issuer.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=approval-issuer.js.map

package/dist/domain/approval-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-issuer.js","sourceRoot":"","sources":["../../src/domain/approval-issuer.ts"],"names":[],"mappings":""}

package/dist/domain/authority-grant.d.ts

@@ -0,0 +1,54 @@
+import type { AuthorityGrantLimit } from "./business-validation.js";
+import type { PendingPolicyChangeStatus } from "./pending-policy-change.js";
+/**
+ * Authority granted to one caller for one capability (RFC-0023 phase
+ * 3): "agent X may release goods, up to 100000, until 31 December".
+ * Created only by an approved grant change; a revoke change marks it
+ * revoked. A policy with requireAuthorityGrant decides a request only
+ * when its caller holds a current grant for the action and the request
+ * is within the grant's limits.
+ */
+export interface AuthorityGrant {
+    /** The changeId of the approved grant change that created it. */
+    readonly grantId: string;
+    /** The authenticated caller (API key's callerId) it is granted to. */
+    readonly callerId: string;
+    /** The capability, namespace:verb, such as "erp:release-goods". */
+    readonly capability: string;
+    /** Limits on the request, by Intent path ("target", "parameters.x"). */
+    readonly limits?: Readonly<Record<string, AuthorityGrantLimit>>;
+    /** From when it holds. */
+    readonly validFrom: Date;
+    /** Until when it holds. After this, AUTHORITY_EXPIRED. */
+    readonly validUntil: Date;
+    readonly status: "active" | "revoked";
+    readonly grantedAt: Date;
+    readonly revokedByChangeId?: string;
+    readonly revokedAt?: Date;
+}
+export type AuthorityGrantChangeAction = "grant" | "revoke";
+/**
+ * A proposal to grant authority to a caller for a capability, or to
+ * revoke the active grant. One person proposes, a different person
+ * approves or rejects with a step up authorization; neither may be the
+ * caller the authority is granted to.
+ */
+export interface AuthorityGrantChange {
+    readonly changeId: string;
+    readonly action: AuthorityGrantChangeAction;
+    readonly callerId: string;
+    readonly capability: string;
+    readonly limits?: Readonly<Record<string, AuthorityGrantLimit>>;
+    /** grant only. Defaults to the approval time. */
+    readonly validFrom?: Date;
+    /** grant only, required. */
+    readonly validUntil?: Date;
+    readonly reason: string;
+    readonly proposedBy: string;
+    readonly proposedAt: Date;
+    readonly status: PendingPolicyChangeStatus;
+    readonly resolvedBy?: string;
+    readonly resolvedAt?: Date;
+    readonly rejectionReason?: string;
+}
+//# sourceMappingURL=authority-grant.d.ts.map

package/dist/domain/authority-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-grant.d.ts","sourceRoot":"","sources":["../../src/domain/authority-grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAEhE,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChE,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,4BAA4B;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/domain/authority-grant.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authority-grant.js.map

package/dist/domain/authority-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-grant.js","sourceRoot":"","sources":["../../src/domain/authority-grant.ts"],"names":[],"mappings":""}

package/dist/domain/authority.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Parmana Trust Core
+ *
+ * Authority
+ *
+ * Represents the entity empowered to authorize
+ * execution within a trust domain.
+ *
+ * Authority is immutable once issued.
+ */
+export interface Authority {
+    /**
+     * Unique Authority identifier.
+     */
+    readonly authorityId: string;
+    /**
+     * Type of authority.
+     */
+    readonly authorityType: AuthorityType;
+    /**
+     * Principal identifier.
+     */
+    readonly principalId: string;
+    /**
+     * Human-readable display name.
+     */
+    readonly displayName?: string;
+    /**
+     * UTC timestamp when Authority became effective.
+     */
+    readonly issuedAt: Date;
+}
+/**
+ * Supported Authority types.
+ */
+export declare enum AuthorityType {
+    USER = "USER",
+    ROLE = "ROLE",
+    SERVICE = "SERVICE",
+    ORGANIZATION = "ORGANIZATION"
+}
+//# sourceMappingURL=authority.d.ts.map

package/dist/domain/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/domain/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,oBAAY,aAAa;IACvB,IAAI,SAAS;IAEb,IAAI,SAAS;IAEb,OAAO,YAAY;IAEnB,YAAY,iBAAiB;CAC9B"}

package/dist/domain/authority.js

@@ -0,0 +1,11 @@
+/**
+ * Supported Authority types.
+ */
+export var AuthorityType;
+(function (AuthorityType) {
+    AuthorityType["USER"] = "USER";
+    AuthorityType["ROLE"] = "ROLE";
+    AuthorityType["SERVICE"] = "SERVICE";
+    AuthorityType["ORGANIZATION"] = "ORGANIZATION";
+})(AuthorityType || (AuthorityType = {}));
+//# sourceMappingURL=authority.js.map

package/dist/domain/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/domain/authority.ts"],"names":[],"mappings":"AAqCA;;GAEG;AACH,MAAM,CAAN,IAAY,aAQX;AARD,WAAY,aAAa;IACvB,8BAAa,CAAA;IAEb,8BAAa,CAAA;IAEb,oCAAmB,CAAA;IAEnB,8CAA6B,CAAA;AAC/B,CAAC,EARW,aAAa,KAAb,aAAa,QAQxB"}

package/dist/domain/authorization.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Parmana Trust Core
+ *
+ * Authorization
+ *
+ * Immutable trust artifact proving that an Authority
+ * granted approval for an intended execution.
+ *
+ * Authorization is part of the canonical
+ * Execution Trust Chain.
+ *
+ * Authority
+ *      ↓
+ * Authorization
+ *      ↓
+ * Intent
+ *      ↓
+ * Policy
+ *      ↓
+ * Decision
+ */
+export interface Authorization {
+    /**
+     * Unique Authorization identifier.
+     */
+    readonly authorizationId: string;
+    /**
+     * Authority issuing this Authorization.
+     */
+    readonly authorityId: string;
+    /**
+     * Business purpose for which the Authorization
+     * was granted.
+     *
+     * Examples:
+     * - Approve vendor payment
+     * - Authorize production deployment
+     * - Approve account closure
+     */
+    readonly purpose: string;
+    /**
+     * UTC timestamp when the Authorization
+     * was issued.
+     */
+    readonly issuedAt: Date;
+    /**
+     * Optional expiration timestamp.
+     *
+     * After this time the Authorization
+     * is no longer valid.
+     */
+    readonly expiresAt?: Date;
+}
+//# sourceMappingURL=authorization.d.ts.map