@parmana/shared 0.0.0-stage → 2.0.0

package/dist/domain/execution-intent.d.ts

@@ -0,0 +1,92 @@
+import { Signature } from "./signature.js";
+/**
+ * Execution Intent (ADR-0012).
+ *
+ * A signed statement, made and persisted BEFORE an action is released to a
+ * connector, of exactly what is about to be released. It exists so that an
+ * action that was released always has signed evidence behind it, even when the
+ * Execution Trust Record cannot be produced afterwards (docs/internal/VERIFICATION-GAPS.md
+ * G-52 and G-53).
+ *
+ * What is signed is deliberately limited to facts that exist before release:
+ * it never contains the execution result, and it never contains the raw
+ * intent parameters (those are bound by `businessTransactionHash`, taken from
+ * the signed authorization, so the intent can be checked against the
+ * authorization without repeating potentially sensitive values).
+ *
+ * This is a separate record from the Execution Trust Record. The Trust Record
+ * keeps its format and keeps verifying offline exactly as before.
+ */
+export interface ExecutionIntent {
+    readonly intentId: string;
+    readonly businessTransactionId: string;
+    readonly decisionId: string;
+    readonly authorizationId: string;
+    readonly policyName: string;
+    readonly policyVersion: string;
+    readonly policyContentHash?: string;
+    readonly signalsHash?: string;
+    /**
+     * Hash of the executable content, copied from the signed authorization
+     * payload. It binds this intent to the exact action, target and
+     * parameters that were authorized.
+     */
+    readonly businessTransactionHash: string;
+    readonly action: string;
+    readonly target: string;
+    readonly submittedBy?: string;
+    readonly grantedCapability?: string;
+    readonly createdAt: Date;
+    readonly intentHash: string;
+    readonly signature: Signature;
+}
+/**
+ * Lifecycle of an intent. This is operational state kept next to the signed
+ * intent, NOT part of what is signed, so it can change after signing.
+ *
+ * - PREPARED: the intent is signed and stored. The action may or may not have
+ *   been released. An intent that stays here is the "released or not, the
+ *   outcome is unrecorded" case and must be reconciled with the connector.
+ * - RELEASED: the release stage returned and the execution context was saved,
+ *   so the Trust Record can be rebuilt from it.
+ * - FINALIZED: a signed Execution Trust Record exists for this transaction.
+ * - ERRORED: the release stage raised an error. The action may still have been
+ *   executed, so the outcome is unknown and must be reconciled.
+ * - RESOLVED: a verified human reconciled a PREPARED or ERRORED intent at the
+ *   connector and closed it, recording what they found (`resolution`) and a
+ *   note. The resolution is an attributed operator statement stored in this
+ *   unsigned status. It is NOT tamper evident, and it is not a Trust Record.
+ */
+export type ExecutionIntentState = "PREPARED" | "RELEASED" | "FINALIZED" | "ERRORED" | "RESOLVED";
+/**
+ * What an operator established at the connector when closing an intent that
+ * has no Trust Record: the action did not run, or it did run.
+ */
+export type ExecutionIntentResolution = "NOT_EXECUTED" | "EXECUTED";
+export type ExecutionIntentFinalizationMode = "INLINE" | "REPAIRED";
+export interface ExecutionIntentStatus {
+    readonly state: ExecutionIntentState;
+    readonly releasedAt?: Date;
+    readonly finalizedAt?: Date;
+    readonly finalizationMode?: ExecutionIntentFinalizationMode;
+    readonly trustRecordId?: string;
+    readonly failureReason?: string;
+    readonly resolvedAt?: Date;
+    readonly resolvedBy?: string;
+    readonly resolution?: ExecutionIntentResolution;
+    readonly resolutionNote?: string;
+}
+/**
+ * An intent as stored: the signed record, its operational status, and the
+ * saved execution context used to rebuild the Trust Record when finalization
+ * failed. `releasedContext` is present only in state RELEASED. It is deleted
+ * when the intent becomes FINALIZED, because the Trust Record then holds the
+ * same information and keeping a second copy of the execution context serves
+ * no purpose.
+ */
+export interface StoredExecutionIntent {
+    readonly intent: ExecutionIntent;
+    readonly status: ExecutionIntentStatus;
+    readonly releasedContext?: unknown;
+}
+//# sourceMappingURL=execution-intent.d.ts.map

package/dist/domain/execution-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-intent.d.ts","sourceRoot":"","sources":["../../src/domain/execution-intent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,oBAAoB,GAC9B,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG,UAAU,CAAC;AAEpE,MAAM,MAAM,+BAA+B,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IAErC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAE5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,+BAA+B,CAAC;IAE5D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAEhD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAEjC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAEvC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC"}

package/dist/domain/execution-intent.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution-intent.js.map

package/dist/domain/execution-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-intent.js","sourceRoot":"","sources":["../../src/domain/execution-intent.ts"],"names":[],"mappings":""}

package/dist/domain/execution-metadata.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Execution-specific metadata.
+ *
+ * Used by execution adapters and runtime
+ * implementations.
+ */
+export type ExecutionMetadata = Readonly<Record<string, unknown>>;
+//# sourceMappingURL=execution-metadata.d.ts.map

package/dist/domain/execution-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-metadata.d.ts","sourceRoot":"","sources":["../../src/domain/execution-metadata.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/domain/execution-metadata.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution-metadata.js.map

package/dist/domain/execution-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-metadata.js","sourceRoot":"","sources":["../../src/domain/execution-metadata.ts"],"names":[],"mappings":""}

package/dist/domain/execution-outcome-store.d.ts

@@ -0,0 +1,49 @@
+import type { ExecutionResult } from "./execution-result.js";
+/**
+ * What is recorded about one authorization's execution, keyed by its nonce.
+ *
+ * - `in_flight`: the nonce was consumed and the connector was (or may have
+ *   been) called, but no result was recorded. The effect may or may not have
+ *   happened. A retry must not execute again and must not assume either way.
+ * - `completed`: the connector returned. A retry returns this result without
+ *   calling the connector again.
+ */
+export type ExecutionOutcome = {
+    readonly status: "in_flight";
+} | {
+    readonly status: "completed";
+    readonly result: ExecutionResult;
+};
+/**
+ * Records the outcome of each authorization so a retry after a lost response
+ * can recover it instead of being refused with no information.
+ *
+ * Gap G-125 (docs/internal/VERIFICATION-GAPS.md). Single use (the nonce) still decides
+ * whether an authorization may execute. This store records what happened
+ * when it did.
+ *
+ * Implementations must make `begin` atomic: the first caller for a nonce gets
+ * `true`, every later caller gets `false`, even under concurrent calls. A
+ * nonce with no row is treated as unknown by callers.
+ */
+export interface ExecutionOutcomeStore {
+    /**
+     * Creates an `in_flight` row for the nonce unless one already exists.
+     * Returns true if this call created it.
+     */
+    begin(nonce: string, expiresAt: string): Promise<boolean>;
+    /**
+     * Records the connector's result for a nonce whose row is `in_flight`.
+     * Throws if no in-flight row exists, so a missing record is never silent.
+     */
+    complete(nonce: string, result: ExecutionResult): Promise<void>;
+    /** Returns the recorded outcome, or undefined when none is recorded. */
+    get(nonce: string): Promise<ExecutionOutcome | undefined>;
+}
+/**
+ * Restores an ExecutionResult read back from storage. A stored result is JSON,
+ * so `executedAt` comes back as a string. Every store uses this so a replayed
+ * result has the same shape whichever store recorded it.
+ */
+export declare function reviveExecutionResult(raw: unknown): ExecutionResult;
+//# sourceMappingURL=execution-outcome-store.d.ts.map

package/dist/domain/execution-outcome-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-outcome-store.d.ts","sourceRoot":"","sources":["../../src/domain/execution-outcome-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,wEAAwE;IACxE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAInE"}

package/dist/domain/execution-outcome-store.js

@@ -0,0 +1,10 @@
+/**
+ * Restores an ExecutionResult read back from storage. A stored result is JSON,
+ * so `executedAt` comes back as a string. Every store uses this so a replayed
+ * result has the same shape whichever store recorded it.
+ */
+export function reviveExecutionResult(raw) {
+    const result = raw;
+    return { ...result, executedAt: new Date(result.executedAt) };
+}
+//# sourceMappingURL=execution-outcome-store.js.map

package/dist/domain/execution-outcome-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-outcome-store.js","sourceRoot":"","sources":["../../src/domain/execution-outcome-store.ts"],"names":[],"mappings":"AA4CA;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,MAAM,GAAG,GAAsB,CAAC;IAEtC,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/domain/execution-result.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Execution Result
+ *
+ * Result returned by an Enterprise Execution System
+ * after attempting to execute a Parmana-authorized
+ * Business Transaction.
+ *
+ * Parmana converts an ExecutionResult into immutable
+ * ExecutionEvidence for storage in the Execution
+ * Trust Record.
+ */
+export interface ExecutionResult {
+    /**
+     * Business Transaction that was executed.
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Action that was executed.
+     */
+    readonly action: string;
+    /**
+     * Target on which the action was executed.
+     */
+    readonly target: string;
+    /**
+     * Parameters actually supplied to the
+     * Enterprise Execution System.
+     */
+    readonly parameters: Readonly<Record<string, unknown>>;
+    /**
+     * Whether execution succeeded.
+     */
+    readonly success: boolean;
+    /**
+     * Enterprise execution timestamp.
+     */
+    readonly executedAt: Date;
+    /**
+     * Optional execution-system-specific metadata.
+     *
+     * Examples:
+     * - ERP transaction ID
+     * - Payment reference
+     * - CRM record ID
+     * - Deployment ID
+     */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+//# sourceMappingURL=execution-result.d.ts.map

package/dist/domain/execution-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-result.d.ts","sourceRoot":"","sources":["../../src/domain/execution-result.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEvD;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD"}

package/dist/domain/execution-result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution-result.js.map

package/dist/domain/execution-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-result.js","sourceRoot":"","sources":["../../src/domain/execution-result.ts"],"names":[],"mappings":""}

package/dist/domain/execution-trust-record.d.ts

@@ -0,0 +1,142 @@
+import { BusinessTransaction } from "./business-transaction.js";
+import { Execution } from "./execution.js";
+import { Override } from "./override.js";
+import { Verification } from "./verification.js";
+import { Receipt } from "./receipt.js";
+import { Signature } from "./signature.js";
+import { SignatureEntry } from "./signature-entry.js";
+import { SignedExecutionAuthorization } from "./execution-authorization.js";
+import { EvidenceAnchor } from "./evidence-anchor.js";
+/**
+ * Parmana Trust Core
+ *
+ * Execution Trust Record
+ *
+ * Canonical immutable record representing everything
+ * Parmana knows about a Business Transaction.
+ *
+ * The Execution Trust Record is the authoritative
+ * source for replay, verification, audit, and
+ * receipt generation.
+ */
+export interface ExecutionTrustRecord {
+    /**
+     * Unique Execution Trust Record identifier.
+     */
+    readonly trustRecordId: string;
+    /**
+     * Business Transaction identifier.
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Canonical Business Transaction.
+     */
+    readonly transaction: BusinessTransaction;
+    /**
+     * Optional Override history.
+     *
+     * Business rules currently allow a single accepted
+     * Override, but the history is modeled as an array
+     * to preserve append-only evolution.
+     */
+    readonly overrides: readonly Override[];
+    /**
+     * Execution history.
+     *
+     * Multiple Executions may exist for long-running
+     * workflows, retries, or future execution models.
+     */
+    readonly executions: readonly Execution[];
+    /**
+     * Verification history.
+     *
+     * Every verification produces a new immutable
+     * Verification artifact.
+     */
+    readonly verifications: readonly Verification[];
+    /**
+     * Receipt history.
+     *
+     * Receipts are immutable cryptographic attestations
+     * of Execution Trust Record state.
+     */
+    readonly receipts: readonly Receipt[];
+    /**
+     * The Signed Execution Authorization the Execution Gateway accepted
+     * for this transaction -- the exact nonce, expiry, businessTransaction/
+     * policy/signals hashes, and signature ExecutionGateway.verify()
+     * checked before dispatching to a connector.
+     *
+     * Absent for any Trust Record built before this field existed, or
+     * for a transaction that never reached execution (e.g. a policy
+     * rejection, which never produces an authorization at all). Absent
+     * is not a defect: it means "no authorization exists for this
+     * record," not "one exists but wasn't captured." A present value is
+     * included in the canonical hash/signature (see
+     * VerificationCrypto.canonicalRecord()) so a loaded record's
+     * authorization cannot be swapped or stripped without invalidating
+     * trustRecordHash/signature -- verified independently of the
+     * authorization's own embedded signature, which an auditor can also
+     * check on its own terms via AuthorizationVerifier (@parmana/crypto).
+     */
+    readonly authorization?: SignedExecutionAuthorization;
+    /**
+     * Canonical hash of the Execution Trust Record.
+     *
+     * Computed over the canonical serialized form of
+     * this aggregate.
+     */
+    readonly trustRecordHash: string;
+    /**
+     * Cryptographic signature over the canonical
+     * Execution Trust Record.
+     *
+     * This proves the Trust Record was produced by
+     * Parmana and has not been modified since signing.
+     */
+    readonly signature: Signature;
+    /**
+     * Envelope schema version (Hybrid Signature Support milestone,
+     * Phase A). Absent means schema v1: exactly today's shape,
+     * `signature` is the sole cryptographic attestation. Present and
+     * >= 2 means `signatures` (below) was populated at signing time and
+     * MUST be independently verified in full -- see
+     * HybridSignatureProvider (@parmana/crypto). Optional rather than
+     * defaulted so every pre-existing construction site (including
+     * historical records already in storage) keeps compiling and
+     * verifying unchanged; readers MUST treat an absent value as v1.
+     */
+    readonly schemaVersion?: number;
+    /**
+     * Additional signatures over this record, one per algorithm,
+     * produced only when CRYPTO_MODE=hybrid was active at signing time.
+     * `signature` above remains the authoritative single-algorithm
+     * attestation (unchanged, always present); this array is additive
+     * proof that a second, independent algorithm also signed the same
+     * content. A verifier that finds this array non-empty MUST require
+     * every entry to verify -- a missing or malformed entry is a
+     * rejection, never a silent fallback to `signature` alone.
+     */
+    readonly signatures?: readonly SignatureEntry[];
+    /**
+     * UTC timestamp when the Execution Trust Record
+     * was first created.
+     */
+    readonly createdAt: Date;
+    /**
+     * UTC timestamp when the Execution Trust Record
+     * was last extended with a new immutable artifact.
+     */
+    readonly updatedAt: Date;
+    /**
+     * Explicit binding artifact linking policy-governance provenance
+     * (transaction.policy.contentHash/governanceAnchor, G-24/G-45) to
+     * what a connector actually did (executions[].evidence.attributes.connector,
+     * G-46) -- see EvidenceAnchor's own doc comment
+     * (docs/internal/VERIFICATION-GAPS.md G-45's residual "Record 3 is outside
+     * all three [policy-governance] mechanisms" note). Absent on a
+     * Trust Record built before this field existed.
+     */
+    readonly evidenceAnchor?: EvidenceAnchor;
+}
+//# sourceMappingURL=execution-trust-record.d.ts.map

package/dist/domain/execution-trust-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-trust-record.d.ts","sourceRoot":"","sources":["../../src/domain/execution-trust-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAE1C;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAE1C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAEhD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IAEtC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAEtD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAEhD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C"}

package/dist/domain/execution-trust-record.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution-trust-record.js.map

package/dist/domain/execution-trust-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-trust-record.js","sourceRoot":"","sources":["../../src/domain/execution-trust-record.ts"],"names":[],"mappings":""}

package/dist/domain/execution.d.ts

@@ -0,0 +1,108 @@
+import { Decision } from "./decision.js";
+import { ExecutionEvidence } from "./execution-evidence.js";
+import { ExecutionMetadata } from "./execution-metadata.js";
+import type { Signature } from "./signature.js";
+/**
+ * Parmana Trust Core
+ *
+ * Execution
+ *
+ * Records what actually happened while processing a
+ * Business Transaction.
+ *
+ * Every Execution records exactly one immutable
+ * Decision produced by deterministic Policy
+ * evaluation.
+ *
+ * Executions are immutable trust artifacts and
+ * become part of the Execution Trust Record.
+ */
+export interface Execution {
+    /**
+     * Unique Execution identifier.
+     */
+    readonly executionId: string;
+    /**
+     * Business Transaction to which this Execution belongs.
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Immutable Decision produced by this Execution.
+     *
+     * The Decision is generated by evaluating the
+     * referenced Policy against the supplied runtime
+     * signals.
+     */
+    readonly decision: Decision;
+    /**
+     * Execution lifecycle state.
+     */
+    readonly status: ExecutionStatus;
+    /**
+     * Execution mode.
+     */
+    readonly mode: ExecutionMode;
+    /**
+     * UTC timestamp when execution started.
+     */
+    readonly startedAt: Date;
+    /**
+     * UTC timestamp when execution completed.
+     *
+     * Present only for terminal executions.
+     */
+    readonly completedAt?: Date;
+    /**
+     * Immutable execution evidence.
+     */
+    readonly evidence?: ExecutionEvidence;
+    /**
+     * Execution-specific metadata.
+     */
+    readonly metadata?: ExecutionMetadata;
+    /**
+     * chainHash of the chain predecessor -- the prior Execution
+     * belonging to the same businessTransactionId -- or null for the
+     * first Execution in that transaction's chain. Fixed once, at this
+     * Execution's first creation; unlike chainHash/chainSignature, it
+     * does not change across this row's own lifecycle transitions
+     * (see ExecutionChainCrypto in @parmana/crypto).
+     *
+     * Optional so every pre-existing construction site and historical
+     * row (written before this field existed) keeps compiling and
+     * verifying unchanged -- an absent value means "not chain-
+     * protected," not "broken chain."
+     */
+    readonly previousChainHash?: string | null;
+    /**
+     * Signed hash of this Execution's own canonical content plus
+     * previousChainHash. Recomputed on every legitimate mutation of
+     * this row (attachEvidence/complete/fail), since those change what
+     * this hash covers.
+     */
+    readonly chainHash?: string;
+    /**
+     * Digital signature over the same canonical content chainHash was
+     * computed from. Signed with Parmana's own signing key, so an
+     * actor with database write access but not the private key cannot
+     * forge a replacement chainHash/chainSignature pair -- see
+     * ExecutionChainCrypto.
+     */
+    readonly chainSignature?: Signature;
+}
+/**
+ * Canonical execution lifecycle.
+ */
+export declare enum ExecutionStatus {
+    PROCESSING = "PROCESSING",
+    COMPLETED = "COMPLETED",
+    FAILED = "FAILED"
+}
+/**
+ * Execution mode.
+ */
+export declare enum ExecutionMode {
+    SYNC = "SYNC",
+    ASYNC = "ASYNC"
+}
+//# sourceMappingURL=execution.d.ts.map

package/dist/domain/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/domain/execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAEzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAEtC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,UAAU,eAAe;IAEzB,SAAS,cAAc;IAEvB,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,oBAAY,aAAa;IACvB,IAAI,SAAS;IAEb,KAAK,UAAU;CAChB"}

package/dist/domain/execution.js

@@ -0,0 +1,18 @@
+/**
+ * Canonical execution lifecycle.
+ */
+export var ExecutionStatus;
+(function (ExecutionStatus) {
+    ExecutionStatus["PROCESSING"] = "PROCESSING";
+    ExecutionStatus["COMPLETED"] = "COMPLETED";
+    ExecutionStatus["FAILED"] = "FAILED";
+})(ExecutionStatus || (ExecutionStatus = {}));
+/**
+ * Execution mode.
+ */
+export var ExecutionMode;
+(function (ExecutionMode) {
+    ExecutionMode["SYNC"] = "SYNC";
+    ExecutionMode["ASYNC"] = "ASYNC";
+})(ExecutionMode || (ExecutionMode = {}));
+//# sourceMappingURL=execution.js.map

package/dist/domain/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/domain/execution.ts"],"names":[],"mappings":"AAyGA;;GAEG;AACH,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,4CAAyB,CAAA;IAEzB,0CAAuB,CAAA;IAEvB,oCAAiB,CAAA;AACnB,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,8BAAa,CAAA;IAEb,gCAAe,CAAA;AACjB,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB"}

package/dist/domain/external-connector.d.ts

@@ -0,0 +1,68 @@
+import type { PendingPolicyChangeStatus } from "./pending-policy-change.js";
+/**
+ * An external connector (ADR-0013): a capability bound to an HTTPS
+ * endpoint an operator runs, and to the policy that governs it,
+ * registered through maker checker (external-connectors.ts) instead of
+ * a deploy. When a request for the capability is approved, Parmana
+ * releases it to the endpoint as a signed release.
+ */
+export interface ExternalConnectorRegistration {
+    /**
+     * The changeId of the approved register change that created it. Its
+     * proposedBy and resolvedBy say who asked and who approved.
+     */
+    readonly registrationId: string;
+    /**
+     * namespace:verb, never in a built in connector's namespace.
+     */
+    readonly capability: string;
+    /**
+     * https only, a public host. Also the audience of every release to it.
+     */
+    readonly endpointUrl: string;
+    /**
+     * The name of the policy that governs the capability. The version in
+     * effect is decided by policy governance, as for every policy.
+     */
+    readonly policy: string;
+    /**
+     * The only parameter names Parmana forwards. A request with any other
+     * parameter is refused before release.
+     */
+    readonly allowedParameters: readonly string[];
+    readonly timeoutMs: number;
+    /**
+     * One active registration per capability. Nothing is deleted.
+     */
+    readonly status: "active" | "revoked";
+    readonly registeredAt: Date;
+    readonly revokedByChangeId?: string;
+    readonly revokedAt?: Date;
+}
+export type ExternalConnectorChangeAction = "register" | "revoke";
+/**
+ * A proposal to register or revoke an external connector, and its
+ * resolution. One person proposes; a different person approves or
+ * rejects it with a step up signature. Only an approved change touches
+ * external_connectors.
+ */
+export interface ExternalConnectorChange {
+    readonly changeId: string;
+    readonly action: ExternalConnectorChangeAction;
+    readonly capability: string;
+    /**
+     * Required to register, absent to revoke.
+     */
+    readonly endpointUrl?: string;
+    readonly policy?: string;
+    readonly allowedParameters?: readonly string[];
+    readonly timeoutMs?: number;
+    readonly reason: string;
+    readonly proposedBy: string;
+    readonly proposedAt: Date;
+    readonly status: PendingPolicyChangeStatus;
+    readonly resolvedBy?: string;
+    readonly resolvedAt?: Date;
+    readonly rejectionReason?: string;
+}
+//# sourceMappingURL=external-connector.d.ts.map

package/dist/domain/external-connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-connector.d.ts","sourceRoot":"","sources":["../../src/domain/external-connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,6BAA6B,GAAG,UAAU,GAAG,QAAQ,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/domain/external-connector.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=external-connector.js.map

package/dist/domain/external-connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-connector.js","sourceRoot":"","sources":["../../src/domain/external-connector.ts"],"names":[],"mappings":""}