> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manthan.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# Packages Overview

> The eight packages under packages/, and which of them the running server actually uses

`packages/` holds eight independently buildable TypeScript packages. [Architecture → Package Architecture](/docs/architecture/package-architecture) covers their intended dependency graph and responsibilities. This section documents each package's actual exported surface (from its `src/index.ts`) and — where it matters — which parts of that surface the running application (`packages/api`) actually calls.

<CardGroup cols={2}>
  <Card title="shared" href="/docs/packages/shared">Canonical domain model, repository contracts, errors.</Card>
  <Card title="runtime" href="/docs/packages/runtime">`ExecutionTrustApplication`, the execution pipeline, application services.</Card>
  <Card title="storage" href="/docs/packages/storage">Repository implementations — in-memory and Supabase.</Card>
  <Card title="crypto" href="/docs/packages/crypto">Canonical hashing, signing, receipt and verification crypto.</Card>
  <Card title="replay" href="/docs/packages/replay">A full deterministic replay engine — currently unused by the API.</Card>
  <Card title="verification" href="/docs/packages/verification">A full multi-stage verification pipeline — currently unused by the API.</Card>
  <Card title="policy" href="/docs/packages/policy">Policy loading, routing, and rule evaluation.</Card>
  <Card title="api" href="/docs/packages/api">The Express server — the only package that's actually a running application.</Card>
</CardGroup>

<Warning>
  **Two packages ship substantially more than the running server uses.** Both [`replay`](/docs/packages/replay) and [`verification`](/docs/packages/verification) export real, non-trivial engines — `ReplayEngine` (deterministic policy re-evaluation and decision comparison) and `VerificationEngine` plus a six-stage `VerificationPipeline` (integrity, authority, authorization, intent, evidence, and signature stages). Neither is imported anywhere under `packages/runtime` or `packages/api`. What `POST /replay` and `POST /verify` actually do, at runtime, is a single hash-integrity check via `@parmana/crypto`'s `VerificationCrypto` — see [REST API → Replay](/docs/api/replay) and [REST API → Verify](/docs/api/verify) for the full trace.
</Warning>

## What's actually wired into the server

```
packages/api/src/application.ts
  → RuntimeFactory.create(...)         (@parmana/runtime)
      → ExecutionTrustApplication
          → BusinessTransactionService
          → Runtime (execution)
          → VerificationService  → VerificationCrypto      (@parmana/crypto)
          → ReceiptService       → ReceiptCrypto            (@parmana/crypto)
          → ExecutionTrustRecordRepository                  (@parmana/storage)
  → FilePolicyRepository                                    (@parmana/policy)
  → StorageFactory.createFromEnvironment()                  (@parmana/storage)
```

That's the complete dependency chain a request actually travels through. `@parmana/replay` and `@parmana/verification` sit outside it entirely.

## Related

<CardGroup cols={2}>
  <Card title="Package Architecture" href="/docs/architecture/package-architecture">The intended dependency graph.</Card>
  <Card title="Runtime Architecture" href="/docs/architecture/runtime-architecture">How the pipeline above is assembled.</Card>
  <Card title="REST API Overview" href="/docs/api/overview">The HTTP surface `packages/api` exposes.</Card>
  <Card title="Security Model" href="/docs/architecture/security-model">Cryptographic guarantees from `crypto`.</Card>
</CardGroup>