@parmana/shared 0.0.0-stage → 2.0.0

package/dist/domain/index.d.ts

@@ -0,0 +1,37 @@
+export * from "./policy-reference.js";
+export * from "./signals.js";
+export * from "./decision.js";
+export * from "./business-validation.js";
+export * from "./business-transaction.js";
+export * from "./execution.js";
+export * from "./execution-outcome-store.js";
+export * from "./execution-result.js";
+export * from "./execution-evidence.js";
+export * from "./metadata.js";
+export * from "./override.js";
+export * from "./verification.js";
+export * from "./receipt.js";
+export * from "./execution-trust-record.js";
+export * from "./evidence-anchor.js";
+export * from "./execution-intent.js";
+export * from "./refusal-record.js";
+export * from "./challenge-record.js";
+export * from "./authority.js";
+export * from "./authorization.js";
+export * from "./execution-authorization.js";
+export * from "./approval-artifact.js";
+export * from "./release-approval.js";
+export * from "./executable-content.js";
+export * from "./intent.js";
+export * from "./signature.js";
+export * from "./signature-entry.js";
+export * from "./unsigned-execution-trust-record.js";
+export * from "./pending-policy-change.js";
+export * from "./approval-issuer.js";
+export * from "./external-connector.js";
+export * from "./business-signal-source.js";
+export * from "./authority-grant.js";
+export * from "./policy-change-approval-record.js";
+export * from "./policy-change-step-up-authorization.js";
+export * from "./execution-audit-event.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/domain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC"}

package/dist/domain/index.js

@@ -0,0 +1,37 @@
+export * from "./policy-reference.js";
+export * from "./signals.js";
+export * from "./decision.js";
+export * from "./business-validation.js";
+export * from "./business-transaction.js";
+export * from "./execution.js";
+export * from "./execution-outcome-store.js";
+export * from "./execution-result.js";
+export * from "./execution-evidence.js";
+export * from "./metadata.js";
+export * from "./override.js";
+export * from "./verification.js";
+export * from "./receipt.js";
+export * from "./execution-trust-record.js";
+export * from "./evidence-anchor.js";
+export * from "./execution-intent.js";
+export * from "./refusal-record.js";
+export * from "./challenge-record.js";
+export * from "./authority.js";
+export * from "./authorization.js";
+export * from "./execution-authorization.js";
+export * from "./approval-artifact.js";
+export * from "./release-approval.js";
+export * from "./executable-content.js";
+export * from "./intent.js";
+export * from "./signature.js";
+export * from "./signature-entry.js";
+export * from "./unsigned-execution-trust-record.js";
+export * from "./pending-policy-change.js";
+export * from "./approval-issuer.js";
+export * from "./external-connector.js";
+export * from "./business-signal-source.js";
+export * from "./authority-grant.js";
+export * from "./policy-change-approval-record.js";
+export * from "./policy-change-step-up-authorization.js";
+export * from "./execution-audit-event.js";
+//# sourceMappingURL=index.js.map

package/dist/domain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,4BAA4B,CAAC"}

package/dist/domain/intent.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Parmana Trust Core
+ *
+ * Intent
+ *
+ * Immutable declaration of the action that an
+ * Authority intends to be executed under an
+ * Authorization.
+ *
+ * Intent is evaluated by Policy but is never
+ * modified by Policy.
+ *
+ * Trust Chain:
+ *
+ * Authority
+ *      ↓
+ * Authorization
+ *      ↓
+ * Intent
+ *      ↓
+ * Policy
+ *      ↓
+ * Decision
+ *      ↓
+ * Execution
+ */
+export interface Intent {
+    /**
+     * Unique Intent identifier.
+     */
+    readonly intentId: string;
+    /**
+     * Authorization under which this
+     * Intent was created.
+     */
+    readonly authorizationId: string;
+    /**
+     * Business action being requested.
+     *
+     * Examples:
+     * - TransferFunds
+     * - ApproveInvoice
+     * - DeployApplication
+     */
+    readonly action: string;
+    /**
+     * Target of the intended action.
+     *
+     * Examples:
+     * - account/12345
+     * - invoice/INV-1001
+     * - service/payment-api
+     */
+    readonly target: string;
+    /**
+     * Immutable business parameters
+     * describing the intended action.
+     */
+    readonly parameters: Readonly<Record<string, unknown>>;
+    /**
+     * UTC timestamp when the Intent
+     * was created.
+     */
+    readonly createdAt: Date;
+}
+//# sourceMappingURL=intent.d.ts.map

package/dist/domain/intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.d.ts","sourceRoot":"","sources":["../../src/domain/intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAEvD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B"}

package/dist/domain/intent.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=intent.js.map

package/dist/domain/intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.js","sourceRoot":"","sources":["../../src/domain/intent.ts"],"names":[],"mappings":""}

package/dist/domain/metadata.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Parmana Trust Core
+ *
+ * Canonical Transaction Metadata
+ *
+ * Immutable metadata supplied by the calling application.
+ * Metadata identifies the Business Transaction but is never
+ * evaluated by Policy.
+ */
+export interface TransactionMetadata {
+    /**
+     * Unique Business Transaction identifier.
+     *
+     * Serves as:
+     * - Primary business identifier
+     * - Idempotency key
+     * - Root identifier for the Execution Trust Record
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Optional correlation identifier.
+     *
+     * Used to correlate requests across distributed systems.
+     */
+    readonly correlationId?: string;
+    /**
+     * Optional tenant identifier.
+     */
+    readonly tenantId?: string;
+    /**
+     * Originating application or service.
+     */
+    readonly sourceSystem?: string;
+    /**
+     * Identity of the authenticated caller.
+     */
+    readonly submittedBy?: string;
+    /**
+     * The capability (Business Transaction intent.action) that
+     * isCapabilityAllowed() confirmed submittedBy was permitted to
+     * invoke, server-set the same way submittedBy is -- never trusted
+     * from the client. Present only when caller-auth was enabled for
+     * this request; see ExecutionAuthorizationPayload.grantedCapability,
+     * which this value is signed into.
+     */
+    readonly grantedCapability?: string;
+    /**
+     * UTC timestamp when the Business Transaction
+     * was submitted.
+     */
+    readonly submittedAt?: Date;
+}
+//# sourceMappingURL=metadata.d.ts.map

package/dist/domain/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/domain/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;CAC7B"}

package/dist/domain/metadata.js

@@ -0,0 +1,11 @@
+/**
+ * Parmana Trust Core
+ *
+ * Canonical Transaction Metadata
+ *
+ * Immutable metadata supplied by the calling application.
+ * Metadata identifies the Business Transaction but is never
+ * evaluated by Policy.
+ */
+export {};
+//# sourceMappingURL=metadata.js.map

package/dist/domain/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/domain/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/domain/override.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Parmana Trust Core
+ *
+ * Override
+ *
+ * Records an authorized human override for a
+ * Business Transaction.
+ *
+ * Overrides are immutable and become part of the
+ * Execution Trust Record.
+ */
+export interface Override {
+    /**
+     * Unique Override identifier.
+     */
+    readonly overrideId: string;
+    /**
+     * Business Transaction to which this Override belongs.
+     */
+    readonly businessTransactionId: string;
+    /**
+     * Authorized user or system that approved
+     * the Override.
+     */
+    readonly approvedBy: string;
+    /**
+     * Human-readable reason for the Override.
+     */
+    readonly reason: string;
+    /**
+     * Optional business justification.
+     */
+    readonly justification?: string;
+    /**
+     * UTC timestamp when the Override was approved.
+     */
+    readonly approvedAt: Date;
+}
+//# sourceMappingURL=override.d.ts.map

package/dist/domain/override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"override.d.ts","sourceRoot":"","sources":["../../src/domain/override.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B"}

package/dist/domain/override.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=override.js.map

package/dist/domain/override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"override.js","sourceRoot":"","sources":["../../src/domain/override.ts"],"names":[],"mappings":""}

package/dist/domain/pending-policy-change.d.ts

@@ -0,0 +1,109 @@
+import type { JsonValue } from "../types/Json.js";
+/**
+ * Pending Policy Change (Policy Governance, maker-checker).
+ *
+ * Parmana previously took no position on who may author or change a
+ * policy document -- the early design documents (removed 2026-09-28)
+ * all named policy authoring as external to Parmana's scope. This
+ * type is the first artifact of that scope changing: a proposed
+ * change to an existing policy's content, held in a durable pending
+ * state until a second, distinct human explicitly approves or
+ * rejects it. Nothing in this file writes to `policies/` directly --
+ * see PendingPolicyChangeRepository and the service that resolves an
+ * approval into a filesystem write and a signed
+ * PolicyChangeApprovalRecord.
+ *
+ * `proposedContent` is deliberately typed as JsonValue, not
+ * `@parmana/policy`'s `Policy` type: `@parmana/shared` sits below
+ * `@parmana/policy` in the dependency graph (policy depends on
+ * shared, never the reverse), so this package cannot reference that
+ * type without an import cycle. Structural validation against the
+ * Policy schema (PolicyValidator) happens one layer up, before a
+ * PendingPolicyChange is ever created -- this type only guarantees
+ * "some JSON was proposed," never "the JSON is a valid policy."
+ */
+export interface PendingPolicyChange {
+    /**
+     * Unique Pending Policy Change identifier.
+     */
+    readonly pendingPolicyChangeId: string;
+    /**
+     * The policy this proposal targets -- same identifier as
+     * `Policy.policyId` / `PolicyReference.name`.
+     */
+    readonly policyName: string;
+    /**
+     * The existing version this proposal is a change against ("the
+     * version being replaced"). Not necessarily distinct from
+     * `proposedContent`'s own declared version: an in-place content
+     * patch to an existing version number, and a proposal that
+     * introduces a new version number, are both legitimate --
+     * VERIFICATION-GAPS.md's G-24 entry records an in-place patch to an
+     * existing policy version as accepted precedent elsewhere in this
+     * codebase. The resolving service derives the actual write target
+     * from `proposedContent.policyVersion`, not from this field.
+     */
+    readonly policyVersion: string;
+    /**
+     * The full proposed policy.json content, in its entirety -- not a
+     * diff or patch. Compared against the current file's content (by
+     * the resolving service, via GET .../pending-changes' diff view and
+     * PolicyChangeApprovalRecord.contentHashBefore/After) rather than
+     * modeled as an edit script here.
+     */
+    readonly proposedContent: JsonValue;
+    /**
+     * Identity of the proposer (maker). Must be a human-authenticated
+     * (AuthorityType.USER) caller -- enforced at the API layer, before
+     * a PendingPolicyChange is ever constructed; this type has no way
+     * to verify that claim on its own.
+     */
+    readonly proposedBy: string;
+    /**
+     * UTC timestamp when the change was proposed.
+     */
+    readonly proposedAt: Date;
+    /**
+     * Lifecycle status. Only ever moves from PENDING_APPROVAL to
+     * APPROVED or REJECTED, exactly once -- never back to
+     * PENDING_APPROVAL, never from one terminal state to the other. See
+     * PendingPolicyChangeRepository.resolve, which enforces this.
+     */
+    readonly status: PendingPolicyChangeStatus;
+    /**
+     * Free-text justification from the proposer. Required at creation
+     * -- a policy change with no stated reason gives a checker nothing
+     * to evaluate.
+     */
+    readonly reason: string;
+    /**
+     * Identity of the resolver (checker). Absent while PENDING_APPROVAL.
+     * MUST NOT equal `proposedBy` -- enforced at the API layer
+     * (SameActorCannotApproveOwnChangeError), not by this type or its
+     * repository, since only the caller-auth layer knows the resolving
+     * caller's verified identity.
+     */
+    readonly resolvedBy?: string;
+    /**
+     * UTC timestamp when the change was approved or rejected. Absent
+     * while PENDING_APPROVAL.
+     */
+    readonly resolvedAt?: Date;
+    /**
+     * Required free-text reason when status is REJECTED. Absent
+     * otherwise -- approval needs no rejection reason, and a rejection
+     * with no stated reason gives the proposer nothing to act on.
+     */
+    readonly rejectionReason?: string;
+}
+/**
+ * Fixed lifecycle vocabulary, matching the SCREAMING_SNAKE style
+ * already used by this codebase's other enum-like domain fields
+ * (AuthorityType, DecisionOutcome).
+ */
+export declare enum PendingPolicyChangeStatus {
+    PENDING_APPROVAL = "PENDING_APPROVAL",
+    APPROVED = "APPROVED",
+    REJECTED = "REJECTED"
+}
+//# sourceMappingURL=pending-policy-change.d.ts.map

package/dist/domain/pending-policy-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-policy-change.d.ts","sourceRoot":"","sources":["../../src/domain/pending-policy-change.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IAEpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;IAE3C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,oBAAY,yBAAyB;IACnC,gBAAgB,qBAAqB;IAErC,QAAQ,aAAa;IAErB,QAAQ,aAAa;CACtB"}

package/dist/domain/pending-policy-change.js

@@ -0,0 +1,12 @@
+/**
+ * Fixed lifecycle vocabulary, matching the SCREAMING_SNAKE style
+ * already used by this codebase's other enum-like domain fields
+ * (AuthorityType, DecisionOutcome).
+ */
+export var PendingPolicyChangeStatus;
+(function (PendingPolicyChangeStatus) {
+    PendingPolicyChangeStatus["PENDING_APPROVAL"] = "PENDING_APPROVAL";
+    PendingPolicyChangeStatus["APPROVED"] = "APPROVED";
+    PendingPolicyChangeStatus["REJECTED"] = "REJECTED";
+})(PendingPolicyChangeStatus || (PendingPolicyChangeStatus = {}));
+//# sourceMappingURL=pending-policy-change.js.map

package/dist/domain/pending-policy-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-policy-change.js","sourceRoot":"","sources":["../../src/domain/pending-policy-change.ts"],"names":[],"mappings":"AA8GA;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAMX;AAND,WAAY,yBAAyB;IACnC,kEAAqC,CAAA;IAErC,kDAAqB,CAAA;IAErB,kDAAqB,CAAA;AACvB,CAAC,EANW,yBAAyB,KAAzB,yBAAyB,QAMpC"}

package/dist/domain/policy-change-approval-record.d.ts

@@ -0,0 +1,81 @@
+import type { Signature } from "./signature.js";
+/**
+ * Policy Change Approval Record (Policy Governance, maker-checker).
+ *
+ * Durable, signed, permanent evidence that a specific human (checker)
+ * approved a specific human's (maker) proposed change to a specific
+ * policy's content -- created exactly once, at the moment a
+ * PendingPolicyChange is approved. Rejections produce no record of
+ * this type; a rejected PendingPolicyChange (with its
+ * rejectionReason) is itself the evidence a rejection leaves behind.
+ *
+ * Signed with the same signing mechanism, key, and canonicalization
+ * as ExecutionTrustRecord (see PolicyChangeCrypto in @parmana/crypto,
+ * which reuses VerificationCrypto's own CryptoBootstrap/
+ * FileKeyProvider/ArtifactSigner rather than a separate signer) --
+ * this is deliberately the same trust root, not a parallel one.
+ *
+ * `contentHashBefore`/`contentHashAfter` are sha256 hashes (via the
+ * same CanonicalSerializer + SHA256HashProvider pair every other hash
+ * in this codebase uses) of the canonicalized policy JSON immediately
+ * before and after this approval -- the G-24 remediation's content-
+ * addressed evidence, so a later audit can confirm exactly what
+ * content this approval covered, not merely which version string.
+ */
+export interface PolicyChangeApprovalRecord {
+    /**
+     * Unique Policy Change Approval Record identifier.
+     */
+    readonly policyChangeApprovalRecordId: string;
+    /**
+     * The PendingPolicyChange this record resolves.
+     */
+    readonly pendingPolicyChangeId: string;
+    readonly policyName: string;
+    /**
+     * The version this approval put into force -- the write target
+     * derived from the approved proposal's own
+     * `proposedContent.policyVersion`, which may or may not equal the
+     * PendingPolicyChange's `policyVersion` ("the version being
+     * replaced"). See PendingPolicyChange's own doc comment.
+     */
+    readonly policyVersion: string;
+    readonly proposedBy: string;
+    readonly approvedBy: string;
+    readonly proposedAt: Date;
+    readonly approvedAt: Date;
+    /**
+     * sha256 of the canonicalized content at the write target path
+     * immediately before this approval was applied. Absent (rather
+     * than a sentinel value) only for a proposal whose target path had
+     * no existing file -- a genuinely new version, not a replacement.
+     */
+    readonly contentHashBefore?: string;
+    /**
+     * sha256 of the canonicalized `proposedContent` that was written.
+     * Always present -- an approval always has content it approved.
+     */
+    readonly contentHashAfter: string;
+    /**
+     * sha256 of the canonicalized *prior* approval record for this same
+     * (policyName, policyVersion) -- i.e. of the full record returned
+     * by PolicyChangeApprovalRecordRepository.findMostRecentFor at the
+     * moment this record was created, computed the same way
+     * contentHashAfter is (PolicyChangeCrypto.hashPolicyContent).
+     * Absent only for the first approval ever recorded for this
+     * (policyName, policyVersion) pair. Included in this record's own
+     * signed payload (see PolicyChangeCrypto.canonicalRecord), so a
+     * later attempt to delete, reorder, or substitute a record in the
+     * approval-record store -- as opposed to editing the live
+     * policy.json, which contentHashAfter alone already detects -- is
+     * independently detectable by re-deriving the chain.
+     */
+    readonly previousRecordHash?: string;
+    /**
+     * Signature over the canonical serialization of this record (every
+     * field above, excluding this field itself) -- see
+     * PolicyChangeCrypto.
+     */
+    readonly signature: Signature;
+}
+//# sourceMappingURL=policy-change-approval-record.d.ts.map

package/dist/domain/policy-change-approval-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-change-approval-record.d.ts","sourceRoot":"","sources":["../../src/domain/policy-change-approval-record.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAE9C;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B"}

package/dist/domain/policy-change-approval-record.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-change-approval-record.js.map

package/dist/domain/policy-change-approval-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-change-approval-record.js","sourceRoot":"","sources":["../../src/domain/policy-change-approval-record.ts"],"names":[],"mappings":""}

package/dist/domain/policy-change-step-up-authorization.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Policy Change Step-Up Authorization (Policy Governance, maker-checker).
+ *
+ * A second, independent proof of intent a human checker presents on
+ * POST /policies/pending-changes/:id/approve and .../reject, on top of
+ * (never instead of) their bearer-token identity and isHumanCaller.ts.
+ * Signed by the checker's own Ed25519 keypair -- provisioned once by
+ * generate-api-key.ts, held only by the checker, never derived from or
+ * stored alongside their bearer token -- so a leaked bearer token alone
+ * is not sufficient to approve or reject a policy change.
+ *
+ * Deliberately shaped like SignedExecutionAuthorization (payload +
+ * flat base64 signature + keyId + algorithm), not like the Signature
+ * object type PolicyChangeApprovalRecord.signature uses: this is a
+ * caller-issued envelope crossing the wire, the same category of
+ * artifact SignedExecutionAuthorization is, not a self-issued Parmana
+ * signature over a durable record.
+ *
+ * Deliberately its own type, not a reuse of SignedApproval
+ * (@parmana/approval): SignedApproval's capability/resourceId/scope
+ * fields model a bounded business-transaction value approval (e.g. "an
+ * amount <= 5000"), evaluated as PolicySignals evidence. A policy
+ * governance approve/reject is a plain yes/no action with no bounded
+ * value to check -- forcing it through SignedApproval's scope shape
+ * would mean inventing a meaningless always-true scope just to satisfy
+ * the type. The verification *pattern* (signed payload, replay-checked
+ * nonce, checks-then-nonce-last ordering) is reused; the artifact type
+ * is not.
+ */
+export interface PolicyChangeStepUpAuthorizationPayload {
+    /**
+     * Payload format version. Verifiers MUST reject any other value
+     * (including a missing field) before attempting signature
+     * verification -- mirrors ExecutionAuthorizationPayload.version.
+     */
+    readonly version: 1;
+    /**
+     * Single-use nonce. Verifiers MUST reject a payload whose nonce has
+     * been seen before (see PolicyChangeStepUpVerifier, backed by its
+     * own dedicated NonceStore/table, a distinct trust domain from both
+     * ExecutionGateway's consumed_nonces and Approval Artifact's
+     * consumed_approval_nonces).
+     */
+    readonly nonce: string;
+    /**
+     * The specific PendingPolicyChange this envelope authorizes. A
+     * signed envelope for one pending change must never be accepted for
+     * a different one, even if otherwise valid.
+     */
+    readonly pendingPolicyChangeId: string;
+    /**
+     * The specific action this envelope authorizes. A signed "approve"
+     * envelope must never be accepted for a reject request, or vice
+     * versa, even if otherwise valid.
+     */
+    readonly action: "approve" | "reject";
+    /**
+     * ISO-8601 UTC time the envelope was signed.
+     */
+    readonly authorizedAt: string;
+    /**
+     * ISO-8601 UTC expiry. REQUIRED. Verifiers MUST reject an envelope
+     * past this time, and MUST reject a TTL (expiresAt - authorizedAt)
+     * exceeding server policy, so a compromised signer cannot mint
+     * long-lived envelopes.
+     */
+    readonly expiresAt: string;
+}
+/**
+ * The complete envelope crossing the wire in an approve/reject request
+ * body.
+ */
+export interface PolicyChangeStepUpAuthorization {
+    readonly payload: PolicyChangeStepUpAuthorizationPayload;
+    /**
+     * Base64-encoded signature over the canonical serialization of
+     * payload.
+     */
+    readonly signature: string;
+    /**
+     * Identifier of the signing key, for operator-facing diagnostics
+     * (key rotation, audit) -- not used to select a verification key:
+     * the checker's public key is resolved from their own ApiKeyEntry
+     * (req.callerStepUpPublicKey), never from a caller-supplied field.
+     */
+    readonly keyId: string;
+    /**
+     * Signature algorithm identifier. Always "ed25519" today -- step-up
+     * keys are generated exclusively as Ed25519 by generate-api-key.ts,
+     * independent of the server's own configured SIGNATURE_PROVIDER
+     * (that setting governs Parmana's own runtime signing key, never an
+     * operator-held step-up key). Carried on the envelope for forward
+     * compatibility and diagnostics, not read to select the verifier.
+     */
+    readonly algorithm: string;
+}
+//# sourceMappingURL=policy-change-step-up-authorization.d.ts.map

package/dist/domain/policy-change-step-up-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-change-step-up-authorization.d.ts","sourceRoot":"","sources":["../../src/domain/policy-change-step-up-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,sCAAsC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;IAEzD;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/domain/policy-change-step-up-authorization.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=policy-change-step-up-authorization.js.map

package/dist/domain/policy-change-step-up-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-change-step-up-authorization.js","sourceRoot":"","sources":["../../src/domain/policy-change-step-up-authorization.ts"],"names":[],"mappings":""}