Skip to main content
packages/ holds eight independently buildable TypeScript packages. Architecture → Package Architecture covers their intended dependency graph and responsibilities. This section documents each package’s actual exported surface (from its src/index.ts) and — where it matters — which parts of that surface the running application (packages/api) actually calls.

shared

Canonical domain model, repository contracts, errors.

runtime

ExecutionTrustApplication, the execution pipeline, application services.

storage

Repository implementations — in-memory and Supabase.

crypto

Canonical hashing, signing, receipt and verification crypto.

replay

A full deterministic replay engine — currently unused by the API.

verification

A full multi-stage verification pipeline — currently unused by the API.

policy

Policy loading, routing, and rule evaluation.

api

The Express server — the only package that’s actually a running application.
Two packages ship substantially more than the running server uses. Both replay and verification export real, non-trivial engines — ReplayEngine (deterministic policy re-evaluation and decision comparison) and VerificationEngine plus a six-stage VerificationPipeline (integrity, authority, authorization, intent, evidence, and signature stages). Neither is imported anywhere under packages/runtime or packages/api. What POST /replay and POST /verify actually do, at runtime, is a single hash-integrity check via @parmana/crypto’s VerificationCrypto — see REST API → Replay and REST API → Verify for the full trace.

​
What’s actually wired into the server

packages/api/src/application.ts
  → RuntimeFactory.create(...)         (@parmana/runtime)
      → ExecutionTrustApplication
          → BusinessTransactionService
          → Runtime (execution)
          → VerificationService  → VerificationCrypto      (@parmana/crypto)
          → ReceiptService       → ReceiptCrypto            (@parmana/crypto)
          → ExecutionTrustRecordRepository                  (@parmana/storage)
  → FilePolicyRepository                                    (@parmana/policy)
  → StorageFactory.createFromEnvironment()                  (@parmana/storage)
That’s the complete dependency chain a request actually travels through. @parmana/replay and @parmana/verification sit outside it entirely.

Package Architecture

The intended dependency graph.

Runtime Architecture

How the pipeline above is assembled.

REST API Overview

The HTTP surface packages/api exposes.

Security Model

Cryptographic guarantees from crypto.