API Reference

function executeFromSignals(
  input: {
    policyId:      string;
    policyVersion: string;
    signals:       Record<string, unknown>;
  },
  signer:              Signer,
  verifier:            Verifier,
  runtimeEnvironment?: {
    policiesRootPath:    string;
    trustPublicKeyPath:  string;
    trustRootPath:       string;
    releaseManifestPath: string;
  },
  replayStore:         ReplayStore
): Promise<ExecutionAttestation>

function confirmExecution(
  params: {
    attestation:        ExecutionAttestation;
    executedAction:     ExecutedAction;
    timeWindowSeconds?: number; // default: 300
  },
  signer:      Signer,
  verifier:    Verifier,
  publicKey:   string,
  store:       ReplayStore
): Promise<ExecutionIntegrityProof>

interface ExecutedAction {
  type:        string;
  payload:     Record<string, unknown>;
  executedAt:  string; // ISO 8601
  executedBy?: string;
}

interface ExecutionIntegrityProof {
  executionId:     string;
  authorizationId: string;
  integrityHash:   string;
  authorized: {
    action:        string;
    reason:        string;
    policyId:      string;
    policyVersion: string;
  };
  executed:     ExecutedAction;
  match:        boolean;
  matchDetails: MatchDetails;
  signature:    string;
  confirmedAt:  string;
  verified:     true;
}

interface MatchDetails {
  actionTypeMatch:   boolean;
  payloadConsistent: boolean;
  withinTimeWindow:  boolean;
  timeWindowSeconds: number;
}

function verifyAttestation(
  attestation:       ExecutionAttestation,
  verifier:          Verifier,
  runtimeManifest?:  RuntimeManifest,
  provenanceInput?:  ProvenanceVerificationInput
): OperationalVerificationResult

{
  valid:    boolean;
  checks: {
    signature_verified:    boolean;
    runtime_verified:      boolean;
    schema_compatible:     boolean;
    bundle_verified:       boolean;
    release_verified:      boolean;
    trust_root_verified:   boolean;
    evaluator_verified:    boolean;
    governed:              boolean;
  };
  warnings: string[];
  errors:   string[];
}

const signer = new LocalSigner(privateKeyPem: string);

signer.sign(payload: string): string
// Returns a base64-encoded Ed25519 signature over the UTF-8 payload.

const verifier = new LocalVerifier(publicKeyPem: string);

verifier.verify(payload: string, signature: string): boolean
// Returns true when the base64 signature is valid for the given payload.

const store = new MemoryReplayStore(options?: {
  warnInProduction?:      boolean; // default: true — logs warning when NODE_ENV=production
  maxSize?:               number;  // default: 1,000,000 — throws when exceeded
  reservationTtlSeconds?: number;  // default: 300
  failedTtlSeconds?:      number;  // default: 30
});

import { RedisReplayStore } from "@parmanasystems/core";

const store = new RedisReplayStore(
  "redis://localhost:6379",
  options?: {
    reservationTtlSeconds?: number; // default: 300
    failedTtlSeconds?:      number; // default: 30
  }
);

function getRuntimeManifest(): RuntimeManifest

// RuntimeManifest shape
{
  runtimeVersion:           string;   // e.g. "1.0.0"
  runtimeHash:              string;   // SHA-256 of the runtime definition
  supported_schemaVersions: string[]; // e.g. ["1.0.0"]
  capabilities:             string[]; // e.g. ["replay-protection", "ed25519-signing"]
}

import { compilePolicy } from "@parmanasystems/governance";

const result = compilePolicy("./policies/loan-approval/1.0.0");
// { valid: boolean, errors: PolicyCompileError[], warnings: PolicyCompileWarning[], ... }

import { generateBundle } from "@parmanasystems/governance";

const result = await generateBundle(
  "loan-approval",
  "1.0.0",
  "./policies/loan-approval/1.0.0",
  signer? // optional — omit for unsigned development bundles
);
// { success: boolean, manifest_path: string, signature_path: string | null, bundle_hash: string }

import { approveOverride } from "@parmanasystems/core";

const override = await approveOverride(
  {
    execution_fingerprint: "b3c4f8...",
    approved_by:   "user@example.com",
    approver_role: "risk-manager",
    reason:        "Manually reviewed and approved.",
  },
  signer // optional — omit for SHA-256, provide for Ed25519
);

interface Signer {
  sign(payload: string): string;
}

interface Verifier {
  verify(payload: string, signature: string): boolean;
}

interface ReplayStore {

  // Required deterministic replay authority

  markExecuted(
    execution_fingerprint: string
  ): void | Promise<void>;

  hasExecuted(
    execution_fingerprint: string
  ): boolean | Promise<boolean>;

  // Strongly recommended atomic replay lifecycle methods

  reserve?(
    execution_fingerprint: string,
    ttlSeconds?: number
  ): Promise<void>;

  startExecution?(
    execution_fingerprint: string
  ): Promise<void>;

  confirm?(
    execution_fingerprint: string
  ): Promise<void>;

  fail?(
    execution_fingerprint: string,
    ttlSeconds?: number
  ): Promise<void>;

  expire?(
    execution_fingerprint: string
  ): Promise<void>;

  override?(
    execution_fingerprint: string
  ): Promise<void>;

  getReplayState?(
    execution_fingerprint: string
  ): ReplayState | null | Promise<ReplayState | null>;
}

import {
  executeFromSignals,
  confirmExecution,
  verifyAttestation,
  LocalSigner,
  LocalVerifier,
  RedisReplayStore,
} from "@parmanasystems/core";

const signer   = new LocalSigner(process.env.PARMANA_PRIVATE_KEY);
const verifier = new LocalVerifier(process.env.PARMANA_PUBLIC_KEY);
const store    = new RedisReplayStore(process.env.REDIS_URL);

// Step 1: govern the loan decision

const attestation = await executeFromSignals(
  {
    policyId:      "personal-loan",
    policyVersion: "1.0.0",
    signals: {
      monthly_income:    82000,
      loan_amount:       500000,
      credit_score:      720,
      emi_obligations:   18000,
      employed:          true,
      employment_type:   "salaried",
      blacklisted:       false,
    },
  },
  signer,
  verifier,
  undefined,
  store
);

// Step 2: verify the attestation before acting

const check =
  verifyAttestation(
    attestation,
    verifier
  );

if (!check.valid) {
  throw new Error(
    "Attestation verification failed"
  );
}

// Step 3: disburse, then confirm

await disburse(
  attestation.executionId,
  500000
);

const proof =
  await confirmExecution(
    {
      attestation,

      executedAction: {

        type:
          "LOAN_DISBURSED",

        payload: {
          amount: 500000,
          account: "ACC-98765"
        },

        executedAt:
          new Date().toISOString(),

        executedBy:
          "disbursement-service-v3",
      },

      timeWindowSeconds:
        300,
    },

    signer,

    verifier,

    process.env.PARMANA_PUBLIC_KEY,

    store
  );

console.log(proof.match);
console.log(proof.integrityHash);

import {
  verifyAttestation,
  LocalVerifier
} from "@parmanasystems/core";

const verifier =
  new LocalVerifier(
    insurerPublicKeyPem
  );

const result =
  verifyAttestation(
    attestation,
    verifier
  );

console.log(result.valid);
console.log(result.checks.signature_verified);
console.log(result.checks.runtime_verified);
console.log(result.checks.bundle_verified);

import type {
  ReplayStore
} from "@parmanasystems/execution";

import {
  Pool
} from "pg";

class PostgresReplayStore
  implements ReplayStore {

  constructor(
    private pool: Pool
  ) {}

  async hasExecuted(
    fingerprint: string
  ): Promise<boolean> {

    const { rows } =
      await this.pool.query(
        "SELECT 1 FROM replay_store WHERE fingerprint = $1 AND status = 'CONFIRMED'",
        [fingerprint]
      );

    return rows.length > 0;
  }

  async markExecuted(
    fingerprint: string
  ): Promise<void> {

    await this.pool.query(
      "INSERT INTO replay_store (fingerprint, status) VALUES ($1, 'CONFIRMED') ON CONFLICT DO NOTHING",
      [fingerprint]
    );
  }
}