@parmana/execution-control

[AVAILABLE] for credential isolation, wired into the default server.

Purpose

Authenticates a calling gateway, issues single-use session credentials, and routes a verified release to a connector, auditing every step. See Credential isolation and Gateway attestation for the concepts.

Install

Not published to npm. This is an internal package of this repository, used from a clone of it: npm ci at the repository root links every workspace package. The packages published to npm are @parmana/sdk, @parmana/connector-sdk and @parmana/sign.

Key exports: the wired credential-isolation path

Export	Stability
`ExecutionControlService`	[AVAILABLE]. Authenticates a gateway, opens a session, routes to a connector, audits each step.
`SessionCredentialExecutionControl`	[AVAILABLE]. Wraps `ExecutionControlService` so no session can be created without a valid, request-bound gateway attestation.
`GatewayAttestationSigner` / `GatewayAttestation`	[AVAILABLE]. See Gateway attestation.
`SignedTokenConnectorAuthenticator`	[AVAILABLE]. Verifies a `GatewayAttestation`’s signature and that it’s bound to the request’s `authorizationId`.
`SessionCredentialVault`, `InMemorySessionCredentialVault`	[AVAILABLE]. Single-use, time-bounded credential leases. See Issue and verify session credentials.
`SessionCredentialSecureConnector`	[AVAILABLE]. Wraps a raw executor so it only runs after policy, attestation, and session checks all pass.
`Clock`, `SystemClock`, `IdGenerator`, `RandomIdGenerator`	[AVAILABLE]. See Determinism and clocks for their real, narrow scope.
`MemoryExecutionAuditSink`	[AVAILABLE]. In-memory only, records `session.created` / `execution.completed` / `execution.rejected` / `authorization.verified` events. Used for tests (`NODE_ENV=test`); production uses `SupabaseExecutionAuditSink` (`@parmana/storage`) instead — durable, signed, chained per `authorizationId`, and queryable. See @parmana/storage.
`ConnectorRegistry`, `ConnectorAuthenticator`, `CredentialVault`, `GatewaySessionStore`, `ConnectorPolicy`, `SecureConnector` (interfaces)	[AVAILABLE]. The seams `@parmana/connector-sdk` implements.

Signed caller-capability check. DefaultConnectorPolicy.assertAllowed() checks the connector’s own declared capabilities and three pre-verified verifiedTransaction booleans, then — when the authorization’s grantedCapability (see Execution authorization) is present — additionally requires it to equal the action actually being executed, before the connector’s credential is ever resolved. This is defense-in-depth, not a second signature re-verification: ExecutionGateway already independently re-verifies the authorization’s signature before the one production call site that reaches this check is ever invoked. Its value is against a future code path that might reach assertAllowed() without going through that already-verified route — see docs/CLAIMS.md §2.31 for the full, honestly-scoped writeup.

Minimal example

import {
  InMemorySessionCredentialVault,
  RandomIdGenerator,
  SystemClock,
} from "@parmana/execution-control";

const vault = new InMemorySessionCredentialVault({
  credentials,
  clock: new SystemClock(),
  idGenerator: new RandomIdGenerator(),
  lifetimeMs: 30_000,
});
const session = await vault.issue("hubspot", authorizationId);
const credential = await vault.consume(session.sessionCredentialId); // only once

Full runnable version: Issue and verify session credentials.

Issue and verify session credentials

Issue, consume, expire, reuse-reject, and revoke, run live.

@parmana/execution-gateway

The boundary that verifies an authorization before anything here runs.

Packages

Project

@parmana/execution-control

Purpose

Install

Key exports: the wired credential-isolation path

Minimal example

Next

Issue and verify session credentials

@parmana/execution-gateway

​Purpose

​Install

​Key exports: the wired credential-isolation path

​Minimal example

​Next

Issue and verify session credentials

@parmana/execution-gateway

Purpose

Install

Key exports: the wired credential-isolation path

Minimal example

Next