@parmana/shared 0.0.0-stage → 2.0.0

package/dist/domain/business-signal-source.d.ts

@@ -0,0 +1,52 @@
+import type { PendingPolicyChangeStatus } from "./pending-policy-change.js";
+/**
+ * A business system registered to answer policies' sourced facts
+ * (RFC-0023 phase 2). Created only by an approved register change; a
+ * revoke change marks it revoked. Policies name it by `name` in
+ * signalSources.
+ */
+export interface BusinessSignalSourceRegistration {
+    /** The changeId of the approved register change that created it. */
+    readonly registrationId: string;
+    /** The name policies use, such as "orders-system". */
+    readonly name: string;
+    /** The HTTPS endpoint Parmana sends each signed query to. */
+    readonly endpointUrl: string;
+    /** How long Parmana waits for an answer, 1000 to 30000 ms. */
+    readonly timeoutMs: number;
+    /**
+     * The source's Ed25519 public key, PEM. When set, every answer must be
+     * signed with it, and Parmana verifies the signature before it trusts
+     * the answer. When absent, an answer proves only what Parmana observed.
+     */
+    readonly publicKeyPem?: string;
+    /** A label for that key, carried into each Trusted Signal. */
+    readonly keyId?: string;
+    readonly status: "active" | "revoked";
+    readonly registeredAt: Date;
+    readonly revokedByChangeId?: string;
+    readonly revokedAt?: Date;
+}
+export type BusinessSignalSourceChangeAction = "register" | "revoke";
+/**
+ * A proposal to register or revoke a business signal source. One person
+ * proposes, a different person approves or rejects with a step up
+ * authorization, the same rules as an external connector change.
+ */
+export interface BusinessSignalSourceChange {
+    readonly changeId: string;
+    readonly action: BusinessSignalSourceChangeAction;
+    readonly name: string;
+    readonly endpointUrl?: string;
+    readonly timeoutMs?: number;
+    readonly publicKeyPem?: string;
+    readonly keyId?: string;
+    readonly reason: string;
+    readonly proposedBy: string;
+    readonly proposedAt: Date;
+    readonly status: PendingPolicyChangeStatus;
+    readonly resolvedBy?: string;
+    readonly resolvedAt?: Date;
+    readonly rejectionReason?: string;
+}
+//# sourceMappingURL=business-signal-source.d.ts.map

package/dist/domain/business-signal-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-signal-source.d.ts","sourceRoot":"","sources":["../../src/domain/business-signal-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,gCAAgC,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/domain/business-signal-source.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=business-signal-source.js.map

package/dist/domain/business-signal-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-signal-source.js","sourceRoot":"","sources":["../../src/domain/business-signal-source.ts"],"names":[],"mappings":""}

package/dist/domain/business-transaction.d.ts

@@ -0,0 +1,99 @@
+import { Authority } from "./authority.js";
+import { Authorization } from "./authorization.js";
+import { Intent } from "./intent.js";
+import { TransactionMetadata } from "./metadata.js";
+import { PolicyReference } from "./policy-reference.js";
+/**
+ * Parmana Trust Core
+ *
+ * Business Transaction
+ *
+ * The canonical immutable business context
+ * accepted by Parmana for execution.
+ *
+ * A Business Transaction captures the complete
+ * upstream trust chain prior to policy evaluation.
+ *
+ * Authority
+ *      ↓
+ * Authorization
+ *      ↓
+ * Intent
+ *      ↓
+ * BusinessTransaction
+ *      ↓
+ * PolicyReference
+ *
+ * The Business Transaction is the immutable input
+ * to deterministic policy evaluation.
+ *
+ * Every Business Transaction produces exactly one
+ * Decision, one Execution, and one Execution Trust
+ * Record.
+ */
+export interface BusinessTransaction {
+    /**
+     * Unique Business Transaction identifier.
+     *
+     * Same value as metadata.businessTransactionId.
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Immutable transaction metadata.
+     */
+    readonly metadata: TransactionMetadata;
+    /**
+     * Authority responsible for this
+     * Business Transaction.
+     */
+    readonly authority: Authority;
+    /**
+     * Authorization granted by the Authority.
+     */
+    readonly authorization: Authorization;
+    /**
+     * Intended business action.
+     */
+    readonly intent: Intent;
+    /**
+     * Exact Policy to execute.
+     *
+     * The PolicyReference is part of the
+     * cryptographically verifiable trust chain.
+     */
+    readonly policy: PolicyReference;
+    /**
+     * Runtime signals supplied to the Policy.
+     *
+     * Signals are opaque runtime facts validated
+     * against the Policy's declared Signal Schema.
+     *
+     * Parmana does not assign business meaning to
+     * these values.
+     */
+    readonly signals: Readonly<Record<string, unknown>>;
+    /**
+     * Current Business Transaction lifecycle.
+     */
+    readonly status: BusinessTransactionStatus;
+    /**
+     * UTC timestamp when the Business Transaction
+     * was accepted by Parmana.
+     */
+    readonly createdAt: Date;
+}
+/**
+ * Business Transaction lifecycle.
+ */
+export declare enum BusinessTransactionStatus {
+    RECEIVED = "RECEIVED",
+    POLICY_EVALUATED = "POLICY_EVALUATED",
+    APPROVED = "APPROVED",
+    REJECTED = "REJECTED",
+    OVERRIDDEN = "OVERRIDDEN",
+    EXECUTING = "EXECUTING",
+    EXECUTED = "EXECUTED",
+    FAILED = "FAILED",
+    VERIFIED = "VERIFIED"
+}
+//# sourceMappingURL=business-transaction.d.ts.map

package/dist/domain/business-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-transaction.d.ts","sourceRoot":"","sources":["../../src/domain/business-transaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAEvC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAEjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAE3C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,oBAAY,yBAAyB;IACnC,QAAQ,aAAa;IAErB,gBAAgB,qBAAqB;IAErC,QAAQ,aAAa;IAErB,QAAQ,aAAa;IAErB,UAAU,eAAe;IAEzB,SAAS,cAAc;IAEvB,QAAQ,aAAa;IAErB,MAAM,WAAW;IAEjB,QAAQ,aAAa;CACtB"}

package/dist/domain/business-transaction.js

@@ -0,0 +1,16 @@
+/**
+ * Business Transaction lifecycle.
+ */
+export var BusinessTransactionStatus;
+(function (BusinessTransactionStatus) {
+    BusinessTransactionStatus["RECEIVED"] = "RECEIVED";
+    BusinessTransactionStatus["POLICY_EVALUATED"] = "POLICY_EVALUATED";
+    BusinessTransactionStatus["APPROVED"] = "APPROVED";
+    BusinessTransactionStatus["REJECTED"] = "REJECTED";
+    BusinessTransactionStatus["OVERRIDDEN"] = "OVERRIDDEN";
+    BusinessTransactionStatus["EXECUTING"] = "EXECUTING";
+    BusinessTransactionStatus["EXECUTED"] = "EXECUTED";
+    BusinessTransactionStatus["FAILED"] = "FAILED";
+    BusinessTransactionStatus["VERIFIED"] = "VERIFIED";
+})(BusinessTransactionStatus || (BusinessTransactionStatus = {}));
+//# sourceMappingURL=business-transaction.js.map

package/dist/domain/business-transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-transaction.js","sourceRoot":"","sources":["../../src/domain/business-transaction.ts"],"names":[],"mappings":"AA8FA;;GAEG;AACH,MAAM,CAAN,IAAY,yBAkBX;AAlBD,WAAY,yBAAyB;IACnC,kDAAqB,CAAA;IAErB,kEAAqC,CAAA;IAErC,kDAAqB,CAAA;IAErB,kDAAqB,CAAA;IAErB,sDAAyB,CAAA;IAEzB,oDAAuB,CAAA;IAEvB,kDAAqB,CAAA;IAErB,8CAAiB,CAAA;IAEjB,kDAAqB,CAAA;AACvB,CAAC,EAlBW,yBAAyB,KAAzB,yBAAyB,QAkBpC"}

package/dist/domain/business-validation.d.ts

@@ -0,0 +1,177 @@
+import type { JsonValue } from "../types/Json.js";
+/**
+ * Business validation (RFC-0023).
+ *
+ * An agent proposes an action and the facts it rests on. Parmana keeps
+ * two questions apart and answers each one itself:
+ *
+ * - Authority: may this caller perform this kind of action at all?
+ * - Business validity: is this exact action valid for this exact
+ *   business object, according to the system that owns the facts?
+ *
+ * A fact the agent proposed is never a business fact. For every signal
+ * a policy declares a source for, Parmana asks that source and records
+ * the answer as a TrustedSignal; the policy is evaluated on the trusted
+ * value. Every status here is final for its request: nothing converts
+ * AUTHORITY_UNCLEAR into AUTHORIZED, MISSING_DATA into VALID, or
+ * INVALID into VALID.
+ */
+/**
+ * Whether the caller may perform this kind of action. AUTHORIZED says
+ * nothing about whether this particular action is valid or was
+ * executed.
+ */
+export declare enum AuthorityStatus {
+    AUTHORIZED = "AUTHORIZED",
+    NOT_AUTHORIZED = "NOT_AUTHORIZED",
+    AUTHORITY_UNCLEAR = "AUTHORITY_UNCLEAR",
+    AUTHORITY_EXPIRED = "AUTHORITY_EXPIRED"
+}
+/**
+ * Whether the business facts the policy needs were established by
+ * their sources and support this exact action.
+ *
+ * NOT_EVALUATED means no validation ran: authority was not
+ * established, the proposal did not describe the Intent, or the policy
+ * declares no sourced facts. It is never VALID.
+ */
+export declare enum BusinessValidationStatus {
+    VALID = "VALID",
+    INVALID = "INVALID",
+    MISSING_DATA = "MISSING_DATA",
+    CONFLICTING_DATA = "CONFLICTING_DATA",
+    SOURCE_UNAVAILABLE = "SOURCE_UNAVAILABLE",
+    VALIDATION_EXPIRED = "VALIDATION_EXPIRED",
+    NOT_EVALUATED = "NOT_EVALUATED"
+}
+/**
+ * What happened to the action. EXECUTION_UNKNOWN is a release whose
+ * outcome could not be established (for example a connector timeout
+ * after the request was sent); it is never reported as failed.
+ */
+export declare enum ExecutionAssessmentStatus {
+    EXECUTED = "EXECUTED",
+    NOT_EXECUTED = "NOT_EXECUTED",
+    EXECUTION_FAILED = "EXECUTION_FAILED",
+    EXECUTION_UNKNOWN = "EXECUTION_UNKNOWN"
+}
+/**
+ * How a TrustedSignal's content is bound. `digest` is the SHA-256 of
+ * the canonical form of the signal without its integrityProof. It is
+ * signed by Parmana as part of the record that carries the signal; it
+ * proves what Parmana observed. `sourceProof` is the source's own
+ * signature over its answer, when the source is registered with a key;
+ * `sourceProofVerified` says Parmana checked it.
+ */
+export interface TrustedSignalIntegrityProof {
+    readonly algorithm: "sha256";
+    readonly digest: string;
+    readonly sourceProof?: string;
+    /**
+     * The key the source signed its answer with, as registered (RFC-0023
+     * phase 2). Present only with a sourceProof.
+     */
+    readonly sourceKeyId?: string;
+    /**
+     * True when Parmana verified sourceProof against the source's
+     * registered public key before trusting the answer. A source registered
+     * with a key cannot give an answer without one: it is refused as
+     * SOURCE_UNAVAILABLE. So a Trusted Signal from such a source proves the
+     * source said it, not only that Parmana observed it.
+     */
+    readonly sourceProofVerified?: boolean;
+}
+/**
+ * One business fact established by its source, bound to the exact
+ * business object and the exact action it supports.
+ */
+export interface TrustedSignal {
+    readonly signalId: string;
+    /** The policy signal this fact supplies, such as "refundEligible". */
+    readonly signalKey: string;
+    /** The registered source that answered, such as "orders-system". */
+    readonly source: string;
+    /** Who answered, as the source reports it (an endpoint, an account). */
+    readonly sourceIdentity: string;
+    /** What was asked, such as "refund.eligible". */
+    readonly claim: string;
+    /** The business object the fact is about, read from the Intent. */
+    readonly subject: string;
+    /** Where in the Intent the subject was read, such as "parameters.orderId". */
+    readonly subjectPath: string;
+    readonly observedValue: JsonValue;
+    readonly observedAt: Date;
+    readonly validUntil: Date;
+    /** The action and transaction this fact was established for. */
+    readonly action: string;
+    readonly businessTransactionId: string;
+    readonly integrityProof: TrustedSignalIntegrityProof;
+    readonly verificationStatus: "VERIFIED";
+}
+/**
+ * Why one declared fact could not be established, or contradicted the
+ * proposal.
+ */
+export interface BusinessValidationFailure {
+    readonly signalKey: string;
+    readonly status: BusinessValidationStatus;
+    readonly reason: string;
+}
+/**
+ * A limit an authority grant sets on one place in the Intent (RFC-0023
+ * phase 3). `min` and `max` apply to a number there, inclusive; `oneOf`
+ * lists the only values allowed there. A request whose value is missing,
+ * of another type, or outside the limit is NOT_AUTHORIZED.
+ */
+export interface AuthorityGrantLimit {
+    readonly min?: number;
+    readonly max?: number;
+    readonly oneOf?: readonly (string | number)[];
+}
+/**
+ * The grant a decision's authority rests on, as it stood when the
+ * request was decided: who it was granted to, for which capability,
+ * within which limits, and for how long.
+ */
+export interface AuthorityGrantReference {
+    readonly grantId: string;
+    /** The authenticated caller the grant was made to. */
+    readonly callerId: string;
+    readonly capability: string;
+    readonly validFrom: Date;
+    readonly validUntil: Date;
+    /** By Intent path: "target" or "parameters.<name>". */
+    readonly limits?: Readonly<Record<string, AuthorityGrantLimit>>;
+}
+export interface AuthorityAssessment {
+    readonly status: AuthorityStatus;
+    readonly reason: string;
+    /**
+     * The grant checked, when the policy requires one (phase 3): the grant
+     * that authorized the request, or the one that had expired or whose
+     * limit the request exceeded. Absent when no grant was found.
+     */
+    readonly grant?: AuthorityGrantReference;
+}
+export interface BusinessValidationAssessment {
+    readonly status: BusinessValidationStatus;
+    readonly reason: string;
+    /** Facts established for this request, including any that passed when another failed. */
+    readonly signals?: readonly TrustedSignal[];
+    readonly failures?: readonly BusinessValidationFailure[];
+}
+export interface ExecutionAssessment {
+    readonly status: ExecutionAssessmentStatus;
+    readonly reason: string;
+}
+/**
+ * The separate answers behind one Decision. `execution` is present on a
+ * refused decision (always NOT_EXECUTED). For an approved decision the
+ * Execution Trust Record's executions carry what happened.
+ */
+export interface DecisionAssessment {
+    readonly authority: AuthorityAssessment;
+    readonly businessValidation: BusinessValidationAssessment;
+    readonly execution?: ExecutionAssessment;
+}
+//# sourceMappingURL=business-validation.d.ts.map

package/dist/domain/business-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-validation.d.ts","sourceRoot":"","sources":["../../src/domain/business-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,oBAAY,eAAe;IACzB,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;CACxC;AAED;;;;;;;GAOG;AACH,oBAAY,wBAAwB;IAClC,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;CAChC;AAED;;;;GAIG;AACH,oBAAY,yBAAyB;IACnC,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,wEAAwE;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;IACrD,QAAQ,CAAC,kBAAkB,EAAE,UAAU,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;CAC1C"}

package/dist/domain/business-validation.js

@@ -0,0 +1,60 @@
+/**
+ * Business validation (RFC-0023).
+ *
+ * An agent proposes an action and the facts it rests on. Parmana keeps
+ * two questions apart and answers each one itself:
+ *
+ * - Authority: may this caller perform this kind of action at all?
+ * - Business validity: is this exact action valid for this exact
+ *   business object, according to the system that owns the facts?
+ *
+ * A fact the agent proposed is never a business fact. For every signal
+ * a policy declares a source for, Parmana asks that source and records
+ * the answer as a TrustedSignal; the policy is evaluated on the trusted
+ * value. Every status here is final for its request: nothing converts
+ * AUTHORITY_UNCLEAR into AUTHORIZED, MISSING_DATA into VALID, or
+ * INVALID into VALID.
+ */
+/**
+ * Whether the caller may perform this kind of action. AUTHORIZED says
+ * nothing about whether this particular action is valid or was
+ * executed.
+ */
+export var AuthorityStatus;
+(function (AuthorityStatus) {
+    AuthorityStatus["AUTHORIZED"] = "AUTHORIZED";
+    AuthorityStatus["NOT_AUTHORIZED"] = "NOT_AUTHORIZED";
+    AuthorityStatus["AUTHORITY_UNCLEAR"] = "AUTHORITY_UNCLEAR";
+    AuthorityStatus["AUTHORITY_EXPIRED"] = "AUTHORITY_EXPIRED";
+})(AuthorityStatus || (AuthorityStatus = {}));
+/**
+ * Whether the business facts the policy needs were established by
+ * their sources and support this exact action.
+ *
+ * NOT_EVALUATED means no validation ran: authority was not
+ * established, the proposal did not describe the Intent, or the policy
+ * declares no sourced facts. It is never VALID.
+ */
+export var BusinessValidationStatus;
+(function (BusinessValidationStatus) {
+    BusinessValidationStatus["VALID"] = "VALID";
+    BusinessValidationStatus["INVALID"] = "INVALID";
+    BusinessValidationStatus["MISSING_DATA"] = "MISSING_DATA";
+    BusinessValidationStatus["CONFLICTING_DATA"] = "CONFLICTING_DATA";
+    BusinessValidationStatus["SOURCE_UNAVAILABLE"] = "SOURCE_UNAVAILABLE";
+    BusinessValidationStatus["VALIDATION_EXPIRED"] = "VALIDATION_EXPIRED";
+    BusinessValidationStatus["NOT_EVALUATED"] = "NOT_EVALUATED";
+})(BusinessValidationStatus || (BusinessValidationStatus = {}));
+/**
+ * What happened to the action. EXECUTION_UNKNOWN is a release whose
+ * outcome could not be established (for example a connector timeout
+ * after the request was sent); it is never reported as failed.
+ */
+export var ExecutionAssessmentStatus;
+(function (ExecutionAssessmentStatus) {
+    ExecutionAssessmentStatus["EXECUTED"] = "EXECUTED";
+    ExecutionAssessmentStatus["NOT_EXECUTED"] = "NOT_EXECUTED";
+    ExecutionAssessmentStatus["EXECUTION_FAILED"] = "EXECUTION_FAILED";
+    ExecutionAssessmentStatus["EXECUTION_UNKNOWN"] = "EXECUTION_UNKNOWN";
+})(ExecutionAssessmentStatus || (ExecutionAssessmentStatus = {}));
+//# sourceMappingURL=business-validation.js.map

package/dist/domain/business-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-validation.js","sourceRoot":"","sources":["../../src/domain/business-validation.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,0DAAuC,CAAA;IACvC,0DAAuC,CAAA;AACzC,CAAC,EALW,eAAe,KAAf,eAAe,QAK1B;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,wBAQX;AARD,WAAY,wBAAwB;IAClC,2CAAe,CAAA;IACf,+CAAmB,CAAA;IACnB,yDAA6B,CAAA;IAC7B,iEAAqC,CAAA;IACrC,qEAAyC,CAAA;IACzC,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;AACjC,CAAC,EARW,wBAAwB,KAAxB,wBAAwB,QAQnC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,kDAAqB,CAAA;IACrB,0DAA6B,CAAA;IAC7B,kEAAqC,CAAA;IACrC,oEAAuC,CAAA;AACzC,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC"}

package/dist/domain/challenge-record.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Challenge Record (RFC-0022).
+ *
+ * A durable, structured trace of one specific challenge to a Parmana
+ * claim or assumption: what was challenged, who/how it surfaced, what
+ * was actually checked (the investigation method, not only the
+ * conclusion), the finding, what changed as a result (if anything),
+ * and whether/where it was disclosed.
+ *
+ * Deliberately NOT signed — see RFC-0022 § Proposal 3. A
+ * ChallengeRecord is evidence of an organizational process (a human
+ * or agent deciding what to investigate and what it means), not a
+ * runtime transaction outcome; the party who could misrepresent it is
+ * the same party who writes it, so a signature would prove
+ * tamper-evidence of bytes-on-disk while leaving the actual trust
+ * question (was the investigation honest) unaddressed. Trustworthy
+ * instead through citation discipline (every investigation step and
+ * finding should cite something independently checkable) and, where
+ * applicable, public disclosure — the same discipline docs/internal/CLAIMS.md
+ * and docs/internal/VERIFICATION-GAPS.md already rely on with no cryptography.
+ *
+ * Append-only, per ADR-0005-Evidence-Is-Append-Only.md, but unlike
+ * RefusalRecord (a single terminal event with nothing to append to),
+ * a ChallengeRecord is investigated over real time: investigationSteps
+ * accumulates, and status moves forward (open -> investigating ->
+ * resolved) without ever reopening by mutating a prior entry — a
+ * challenge believed resolved that later needs more work becomes a
+ * NEW ChallengeRecord linked via `supersedes`, not an edit to this
+ * one. See ChallengeRecordRepository.append, which enforces this.
+ */
+export interface ChallengeRecord {
+    /**
+     * Unique Challenge Record identifier.
+     */
+    readonly challengeRecordId: string;
+    /**
+     * Lifecycle status. Only ever moves forward (open ->
+     * investigating -> resolved); never reopens in place.
+     */
+    readonly status: ChallengeRecordStatus;
+    /**
+     * The specific claim or assumption being challenged, stated
+     * precisely enough that someone unfamiliar with the conversation
+     * that raised it can tell exactly what's being checked. Where
+     * possible, cites the exact claim (a CLAIMS.md line, a doc page, a
+     * piece of code, a specific public statement) — the same citation
+     * discipline docs/internal/CLAIMS.md already applies to its own claims.
+     */
+    readonly claimChallenged: string;
+    /**
+     * How the challenge surfaced. Set once, at creation; not part of
+     * the append-only lifecycle.
+     */
+    readonly source: ChallengeRecordSource;
+    /**
+     * The investigation itself, in order. Append-only: existing entries
+     * are never edited or removed, only added to.
+     */
+    readonly investigationSteps: readonly ChallengeRecordInvestigationStep[];
+    /**
+     * The finding, in a fixed, precise vocabulary. Absent while the
+     * challenge is still open/investigating. Immutable once set — a
+     * later correction is a new ChallengeRecord (see `supersedes`),
+     * never an edit here.
+     */
+    readonly finding?: ChallengeRecordFinding;
+    /**
+     * What changed as a result, including the explicit "nothing
+     * changed" case. Immutable once set, same as `finding`.
+     */
+    readonly outcome?: ChallengeRecordOutcome;
+    /**
+     * Whether and where this was disclosed publicly. A ChallengeRecord
+     * may exist and stay fully internal — disclosure is a separate,
+     * explicit fact, never implied by the record's own existence.
+     * Immutable once set, same as `finding`.
+     */
+    readonly disclosure?: ChallengeRecordDisclosure;
+    /**
+     * The prior ChallengeRecord this one supersedes or follows up on
+     * (e.g. a challenge believed resolved that needed reopening).
+     * ADR-0005's "corrections are new artifacts, not edits" discipline
+     * applied to this artifact type.
+     */
+    readonly supersedes?: string;
+    /**
+     * UTC timestamp when this Challenge Record was created.
+     */
+    readonly createdAt: Date;
+    /**
+     * UTC timestamp of the most recent append (investigation step,
+     * status change, finding, outcome, or disclosure). Equal to
+     * createdAt until the first append.
+     */
+    readonly updatedAt: Date;
+}
+/**
+ * Fixed lifecycle vocabulary. Deliberately closed (not free text) so
+ * "is this still being worked on" is always a checkable field, never
+ * inferred from prose — the same reasoning behind `finding.outcome`
+ * below.
+ */
+export type ChallengeRecordStatus = "open" | "investigating" | "resolved";
+/**
+ * Where a challenge came from. A closed, reviewable set covering
+ * every source RFC-0022's own survey of this year's informal
+ * challenge-handling found in practice.
+ */
+export interface ChallengeRecordSource {
+    readonly kind: "public-comment" | "internal-review" | "customer-question" | "adversarial-exercise" | "self-identified";
+    /**
+     * A URL, a name, or an internal identifier — whatever attribution
+     * is actually available and has been explicitly cleared for
+     * inclusion. Defaults to withheld: omit this field rather than
+     * populate it with a name/identifier that hasn't been explicitly
+     * confirmed safe to record (RFC-0022 Open Question 3 resolution —
+     * attribution never defaults toward disclosure).
+     */
+    readonly attribution?: string;
+    readonly raisedAt: Date;
+}
+/**
+ * One discrete investigative step: what was actually examined, not
+ * only what was concluded. Mirrors the "cites a file, a line, or a
+ * specific test" discipline docs/internal/VERIFICATION-GAPS.md's own Purpose
+ * section already states.
+ */
+export interface ChallengeRecordInvestigationStep {
+    readonly performedAt: Date;
+    /**
+     * What was actually examined: a file path, a test name, a command
+     * run, a specific log query, a specific data record.
+     */
+    readonly method: string;
+    readonly observation: string;
+}
+/**
+ * The finding, in a fixed, precise vocabulary — deliberately narrower
+ * than free prose so it cannot be quietly rounded up ("inconclusive"
+ * becoming "confirmed there's no issue") or down.
+ */
+export interface ChallengeRecordFinding {
+    readonly outcome: "confirmed" | "partially-confirmed" | "ruled-out" | "inconclusive";
+    /**
+     * Precise statement of what, exactly, the outcome means here. A
+     * bare enum value with no explanation is exactly the kind of
+     * unchecked assertion this record type exists to prevent.
+     */
+    readonly statement: string;
+}
+/**
+ * What changed as a result of the challenge. `changed: false` is a
+ * first-class, disclosed outcome, not an implicit absence of this
+ * field.
+ */
+export interface ChallengeRecordOutcome {
+    readonly changed: boolean;
+    /**
+     * If changed: the design decision, code change, disclosure, or new
+     * RFC/gap this produced. If not changed: the reason, stated as
+     * precisely as `finding.statement`.
+     */
+    readonly description: string;
+    /**
+     * Cross-links to whatever this produced — a commit hash, an RFC
+     * number, a VERIFICATION-GAPS.md gap id, a docs/site page path.
+     * Deliberately free-form: the set of things a challenge can produce
+     * is open-ended.
+     */
+    readonly references: readonly string[];
+}
+/**
+ * Whether and where a Challenge Record was disclosed publicly.
+ */
+export interface ChallengeRecordDisclosure {
+    readonly disclosedPublicly: boolean;
+    /** A docs/site path, a changelog entry, a public repo file. */
+    readonly location?: string;
+    readonly disclosedAt?: Date;
+}
+//# sourceMappingURL=challenge-record.d.ts.map

package/dist/domain/challenge-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-record.d.ts","sourceRoot":"","sources":["../../src/domain/challenge-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAEvC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAEvC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,SAAS,gCAAgC,EAAE,CAAC;IAEzE;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAE1C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAEhD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,eAAe,GAAG,UAAU,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EACT,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,iBAAiB,CAAC;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EACd,WAAW,GAAG,qBAAqB,GAAG,WAAW,GAAG,cAAc,CAAC;IAErE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;CAC7B"}

package/dist/domain/challenge-record.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=challenge-record.js.map

package/dist/domain/challenge-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge-record.js","sourceRoot":"","sources":["../../src/domain/challenge-record.ts"],"names":[],"mappings":""}