@axtary/cli 0.0.1

package/dist/index.js

@@ -0,0 +1,1275 @@
+import { generateKeyPairSync } from "node:crypto";
+import { createServer } from "node:http";
+import { readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { extname, resolve } from "node:path";
+import { AxtaryDecisionSchema, demoAction, parseNormalizedAction, } from "@axtary/actionpass";
+import { createFakeAdapterState, createFakeHandlers, createAwsRestHandlers, createGcpRestHandlers, createGitHubRestHandlers, createLinearGraphqlHandlers, createLocalDocsHandlers, createSlackWebHandlers, smokeAwsRestCredentials, smokeGcpRestCredentials, smokeGitHubRestCredentials, smokeLinearGraphqlCredentials, smokeLocalDocsRoots, smokeSlackWebCredentials, } from "@axtary/adapters";
+import { loadAxtaryConfig, CachedConfigLoader } from "@axtary/config";
+import { exportLedgerRecords, formatLedgerExport, LedgerExportFormatSchema, LocalJsonlLedger, syncLedgerExport, } from "@axtary/ledger";
+import { MCP_TOOL_CALL, createMcpAction, createMcpFixtureToolHandler, createMcpToolDefinition, } from "@axtary/mcp";
+import { evaluatePolicy } from "@axtary/policy";
+import { createProxyRuntime, } from "@axtary/proxy";
+export const DEMO_SCHEMA_VERSION = "axtary.demo.v0";
+export const POLICY_TEST_SCHEMA_VERSION = "axtary.policy_test.v0";
+export const LOCAL_PROXY_SCHEMA_VERSION = "axtary.local_proxy.v0";
+export const LEDGER_EXPORT_RUN_SCHEMA_VERSION = "axtary.ledger_export_run.v0";
+export const LEDGER_SYNC_RUN_SCHEMA_VERSION = "axtary.ledger_sync_run.v0";
+const MCP_DEMO_TOOL_DEFINITION = createMcpToolDefinition({
+    serverIdentity: "mcp:axtary-demo-fixtures",
+    serverVersion: "1.0.0",
+    schemaVersion: "2026-06-03",
+    name: "read_fixture",
+    description: "Read a deterministic demo fixture through a local MCP wrapper.",
+    inputSchema: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            fixtureKey: {
+                type: "string",
+                enum: ["repo_primer"],
+            },
+        },
+        required: ["fixtureKey"],
+    },
+});
+const MCP_DEMO_FIXTURES = {
+    repo_primer: {
+        path: "README.md",
+        mediaType: "text/markdown",
+        content: "Axtary protects agent tool calls by pinning policy to a signed action, scoped connector, and tamper-evident ledger record.",
+    },
+};
+const DEMO_ACTIONS = [
+    {
+        name: "safe_github_pr",
+        action: parseNormalizedAction({
+            ...demoAction,
+            capability: {
+                ...demoAction.capability,
+                payload: {
+                    ...demoAction.capability.payload,
+                    title: "Fix auth redirect",
+                    testsPassed: true,
+                },
+            },
+        }),
+    },
+    {
+        name: "protected_github_pr",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-419",
+                declaredGoal: "Touch production Terraform from a coding agent",
+            },
+            capability: {
+                ...demoAction.capability,
+                payload: {
+                    baseBranch: "main",
+                    filesChanged: ["infra/prod/main.tf"],
+                    testsPassed: true,
+                    touchesProduction: true,
+                },
+            },
+        }),
+    },
+    {
+        name: "safe_slack_message",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-420",
+                declaredGoal: "Post deployment note to approved engineering channel",
+            },
+            capability: {
+                tool: "slack.chat.postMessage",
+                resource: "slack:workspace/company",
+                payload: {
+                    channel: "#axtary-dev",
+                    message: "Demo PR is ready for review.",
+                },
+            },
+        }),
+    },
+    {
+        name: "wrong_slack_channel",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-421",
+                declaredGoal: "Post internal deployment details to a broad channel",
+            },
+            capability: {
+                tool: "slack.chat.postMessage",
+                resource: "slack:workspace/company",
+                payload: {
+                    channel: "#general",
+                    message: "Deploying production auth changes now.",
+                },
+            },
+        }),
+    },
+    {
+        name: "safe_linear_comment",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-418",
+                declaredGoal: "Update the source Linear issue after opening the demo PR",
+            },
+            capability: {
+                tool: "linear.comments.create",
+                resource: "linear:workspace/company",
+                payload: {
+                    issueKey: "AXT-418",
+                    projectKey: "AXT",
+                    body: "Axtary demo PR passed local policy and was recorded in the ledger.",
+                },
+            },
+        }),
+    },
+    {
+        name: "safe_jira_read",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-772",
+                declaredGoal: "Read a Jira issue inside the approved project scope",
+            },
+            capability: {
+                tool: "jira.issues.read",
+                resource: "jira:site/company",
+                payload: {
+                    issueKey: "AXT-772",
+                    projectKey: "AXT",
+                },
+            },
+        }),
+    },
+    {
+        name: "protected_linear_done_status",
+        action: parseNormalizedAction({
+            ...demoAction,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-418",
+                declaredGoal: "Mark an agent-owned issue complete",
+            },
+            capability: {
+                tool: "linear.issues.update",
+                resource: "linear:workspace/company",
+                payload: {
+                    issueKey: "AXT-418",
+                    projectKey: "AXT",
+                    status: "Done",
+                },
+            },
+        }),
+    },
+    {
+        name: "safe_mcp_fixture_read",
+        action: createMcpAction({
+            definition: MCP_DEMO_TOOL_DEFINITION,
+            actor: demoAction.actor,
+            intent: {
+                ...demoAction.intent,
+                taskId: "AXT-MCP-1",
+                declaredGoal: "Read a pinned local MCP fixture without exposing broad tool access",
+            },
+            call: {
+                toolName: MCP_DEMO_TOOL_DEFINITION.name,
+                arguments: {
+                    fixtureKey: "repo_primer",
+                },
+            },
+            constraints: {
+                demoOnly: true,
+                transport: "fixture",
+            },
+        }),
+    },
+];
+export async function startProxyServer(input = {}) {
+    const configLoader = new CachedConfigLoader({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    const loadedConfig = await configLoader.getConfig();
+    const cwd = resolve(input.cwd ?? process.cwd());
+    const ledgerPath = input.ledgerPath
+        ? resolve(cwd, input.ledgerPath)
+        : loadedConfig.ledgerPath;
+    const ledger = new LocalJsonlLedger(ledgerPath);
+    const adapterState = createFakeAdapterState();
+    const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const { handlers, adapterModes } = createProxyHandlers(loadedConfig, adapterState, {
+        issuer: loadedConfig.config.issuer,
+        verificationKey: publicKey,
+    });
+    const runtime = createProxyRuntime({
+        issuer: loadedConfig.config.issuer,
+        tenant: loadedConfig.config.tenant,
+        ledger,
+        policy: async () => (await configLoader.getConfig()).config.policy,
+        signingKey: privateKey,
+        keyId: "local-proxy-key",
+        allowUnsignedExecution: loadedConfig.config.runtime.allowUnsignedExecution,
+        handlerTimeoutMs: loadedConfig.config.runtime.handlerTimeoutMs,
+        handlers,
+    });
+    const host = input.host ?? "127.0.0.1";
+    const server = createServer(async (request, response) => {
+        try {
+            if (request.method === "GET" && request.url === "/health") {
+                writeJson(response, 200, {
+                    schemaVersion: LOCAL_PROXY_SCHEMA_VERSION,
+                    status: "ok",
+                    configPath: loadedConfig.filePath,
+                    ledgerPath,
+                    adapterModes,
+                });
+                return;
+            }
+            if (request.method === "GET" && request.url === "/state") {
+                writeJson(response, 200, {
+                    schemaVersion: LOCAL_PROXY_SCHEMA_VERSION,
+                    adapters: adapterState,
+                    adapterModes,
+                });
+                return;
+            }
+            if (request.method === "POST" && request.url === "/actions") {
+                const body = await readJsonBody(request);
+                const result = await runtime.handle(body);
+                const statusCode = result.status === "malformed" ? 400 : 200;
+                writeJson(response, statusCode, result);
+                return;
+            }
+            writeJson(response, 404, {
+                schemaVersion: LOCAL_PROXY_SCHEMA_VERSION,
+                error: "not_found",
+            });
+        }
+        catch (error) {
+            writeJson(response, 500, {
+                schemaVersion: LOCAL_PROXY_SCHEMA_VERSION,
+                error: error instanceof Error ? error.message : "proxy_request_failed",
+            });
+        }
+    });
+    await listen(server, input.port ?? 7331, host);
+    const address = server.address();
+    const port = typeof address === "object" && address !== null ? address.port : input.port ?? 7331;
+    return {
+        schemaVersion: LOCAL_PROXY_SCHEMA_VERSION,
+        url: `http://${host}:${port}`,
+        host,
+        port,
+        ledgerPath,
+        adapters: adapterState,
+        adapterModes,
+        close: () => close(server),
+    };
+}
+export async function runDemo(input = {}) {
+    const loadedConfig = await loadAxtaryConfig({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    const cwd = resolve(input.cwd ?? process.cwd());
+    const ledgerPath = input.ledgerPath
+        ? resolve(cwd, input.ledgerPath)
+        : loadedConfig.ledgerPath;
+    const ledger = new LocalJsonlLedger(ledgerPath);
+    const adapterState = createFakeAdapterState();
+    const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const demoPolicy = {
+        ...loadedConfig.config.policy,
+        mcp: {
+            ...loadedConfig.config.policy.mcp,
+            allowedTools: [
+                ...(loadedConfig.config.policy.mcp.allowedTools ?? []),
+                {
+                    serverIdentity: MCP_DEMO_TOOL_DEFINITION.serverIdentity,
+                    toolName: MCP_DEMO_TOOL_DEFINITION.name,
+                    definitionHash: MCP_DEMO_TOOL_DEFINITION.definitionHash,
+                },
+            ],
+        },
+    };
+    const fakeHandlers = createFakeHandlers(adapterState, {
+        verification: {
+            issuer: loadedConfig.config.issuer,
+            verificationKey: publicKey,
+        },
+    });
+    const runtime = createProxyRuntime({
+        issuer: loadedConfig.config.issuer,
+        tenant: loadedConfig.config.tenant,
+        ledger,
+        policy: demoPolicy,
+        signingKey: privateKey,
+        keyId: "local-demo-key",
+        allowUnsignedExecution: loadedConfig.config.runtime.allowUnsignedExecution,
+        handlerTimeoutMs: loadedConfig.config.runtime.handlerTimeoutMs,
+        handlers: {
+            ...fakeHandlers,
+            [MCP_TOOL_CALL]: createMcpFixtureToolHandler({
+                definition: MCP_DEMO_TOOL_DEFINITION,
+                fixtures: MCP_DEMO_FIXTURES,
+            }),
+        },
+    });
+    const results = [];
+    for (const demo of DEMO_ACTIONS) {
+        const result = await runtime.handle(demo.action);
+        results.push(toDemoActionResult(demo.name, result));
+    }
+    const verifiedLedger = await ledger.verify();
+    return {
+        schemaVersion: DEMO_SCHEMA_VERSION,
+        config: {
+            filePath: loadedConfig.filePath,
+            issuer: loadedConfig.config.issuer,
+            tenant: loadedConfig.config.tenant,
+        },
+        ledgerPath,
+        results,
+        adapters: adapterState,
+        adapterModes: {
+            github: "fake",
+            slack: "fake",
+            linear: "fake",
+            aws: "off",
+            gcp: "off",
+            mcp: "fixture",
+        },
+        ledger: ledgerSummary(verifiedLedger),
+    };
+}
+export async function runSmokeTest(input = {}, io = {}) {
+    const stdout = io.stdout ?? ((text) => process.stdout.write(text));
+    const env = input.env ?? process.env;
+    const fetchImpl = input.fetch ?? fetch;
+    const loadedConfig = await loadAxtaryConfig({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    let failed = false;
+    const githubConfig = loadedConfig.config.adapters.github;
+    if (githubConfig.mode === "rest") {
+        stdout("Testing GitHub REST credentials... ");
+        const token = env[githubConfig.tokenEnv];
+        if (!token) {
+            stdout(`FAIL (missing ${githubConfig.tokenEnv})\n`);
+            failed = true;
+        }
+        else {
+            try {
+                const result = await smokeGitHubRestCredentials({
+                    token,
+                    apiBaseUrl: githubConfig.apiBaseUrl,
+                    userAgent: githubConfig.userAgent,
+                    fetch: fetchImpl,
+                    maxRetries: 0,
+                });
+                stdout(`OK (${result.summary})\n`);
+            }
+            catch (e) {
+                stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+                failed = true;
+            }
+        }
+    }
+    else {
+        stdout("Skipping GitHub (not in rest mode)\n");
+    }
+    const slackConfig = loadedConfig.config.adapters.slack;
+    if (slackConfig.mode === "web") {
+        stdout("Testing Slack Web credentials... ");
+        const token = env[slackConfig.tokenEnv];
+        if (!token) {
+            stdout(`FAIL (missing ${slackConfig.tokenEnv})\n`);
+            failed = true;
+        }
+        else {
+            try {
+                const result = await smokeSlackWebCredentials({
+                    token,
+                    apiBaseUrl: slackConfig.apiBaseUrl,
+                    fetch: fetchImpl,
+                    maxRetries: 0,
+                });
+                stdout(`OK (${result.summary})\n`);
+            }
+            catch (e) {
+                stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+                failed = true;
+            }
+        }
+    }
+    else {
+        stdout("Skipping Slack (not in web mode)\n");
+    }
+    const linearConfig = loadedConfig.config.adapters.linear;
+    if (linearConfig.mode === "graphql") {
+        stdout("Testing Linear GraphQL credentials... ");
+        const token = env[linearConfig.tokenEnv];
+        if (!token) {
+            stdout(`FAIL (missing ${linearConfig.tokenEnv})\n`);
+            failed = true;
+        }
+        else {
+            try {
+                const result = await smokeLinearGraphqlCredentials({
+                    token,
+                    apiUrl: linearConfig.apiUrl,
+                    fetch: fetchImpl,
+                    maxRetries: 0,
+                });
+                stdout(`OK (${result.summary})\n`);
+            }
+            catch (e) {
+                stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+                failed = true;
+            }
+        }
+    }
+    else {
+        stdout("Skipping Linear (not in graphql mode)\n");
+    }
+    const awsConfig = loadedConfig.config.adapters.aws;
+    if (awsConfig.mode === "rest") {
+        stdout("Testing AWS REST credentials... ");
+        const accessKeyId = env[awsConfig.accessKeyIdEnv];
+        const secretAccessKey = env[awsConfig.secretAccessKeyEnv];
+        const sessionToken = env[awsConfig.sessionTokenEnv];
+        if (!accessKeyId) {
+            stdout(`FAIL (missing ${awsConfig.accessKeyIdEnv})\n`);
+            failed = true;
+        }
+        else if (!secretAccessKey) {
+            stdout(`FAIL (missing ${awsConfig.secretAccessKeyEnv})\n`);
+            failed = true;
+        }
+        else {
+            try {
+                const result = await smokeAwsRestCredentials({
+                    credentials: {
+                        accessKeyId,
+                        secretAccessKey,
+                        sessionToken,
+                    },
+                    region: awsConfig.region,
+                    stsUrl: awsConfig.stsUrl,
+                    fetch: fetchImpl,
+                    maxRetries: 0,
+                });
+                stdout(`OK (${result.summary})\n`);
+            }
+            catch (e) {
+                stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+                failed = true;
+            }
+        }
+    }
+    else {
+        stdout("Skipping AWS (not in rest mode)\n");
+    }
+    const gcpConfig = loadedConfig.config.adapters.gcp;
+    if (gcpConfig.mode === "rest") {
+        stdout("Testing GCP REST credentials... ");
+        const accessToken = env[gcpConfig.accessTokenEnv];
+        if (!accessToken) {
+            stdout(`FAIL (missing ${gcpConfig.accessTokenEnv})\n`);
+            failed = true;
+        }
+        else {
+            try {
+                const result = await smokeGcpRestCredentials({
+                    accessToken,
+                    projectId: gcpConfig.projectId,
+                    cloudResourceManagerApiBaseUrl: gcpConfig.cloudResourceManagerApiBaseUrl,
+                    storageApiBaseUrl: gcpConfig.storageApiBaseUrl,
+                    fetch: fetchImpl,
+                    maxRetries: 0,
+                });
+                stdout(`OK (${result.summary})\n`);
+            }
+            catch (e) {
+                stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+                failed = true;
+            }
+        }
+    }
+    else {
+        stdout("Skipping GCP (not in rest mode)\n");
+    }
+    const docsConfig = loadedConfig.config.adapters.docs;
+    if (docsConfig.mode === "local") {
+        stdout("Testing local docs roots... ");
+        try {
+            const result = await smokeLocalDocsRoots({
+                workspace: docsConfig.workspace,
+                roots: resolveDocsRoots(loadedConfig),
+                maxSearchResults: docsConfig.maxSearchResults,
+                maxReadBytes: docsConfig.maxReadBytes,
+                allowedExtensions: docsConfig.allowedExtensions,
+            });
+            stdout(`OK (${result.summary})\n`);
+        }
+        catch (e) {
+            stdout(`FAIL (${e instanceof Error ? e.message : String(e)})\n`);
+            failed = true;
+        }
+    }
+    else {
+        stdout("Skipping local docs (not in local mode)\n");
+    }
+    return failed ? 1 : 0;
+}
+export async function runTestPolicy(input) {
+    const loadedConfig = await loadAxtaryConfig({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    const cwd = resolve(input.cwd ?? process.cwd());
+    const fixturesPath = resolve(cwd, input.fixturesPath);
+    const fixtureFiles = await collectFixtureFiles(fixturesPath);
+    const results = [];
+    for (const filePath of fixtureFiles) {
+        const fixture = await readPolicyFixture(filePath);
+        const action = parseNormalizedAction(fixture.action);
+        const decision = evaluatePolicy(action, loadedConfig.config.policy);
+        const reasonsPassed = !fixture.expectedReasons ||
+            arraysEqual(fixture.expectedReasons, decision.reasons);
+        const passed = decision.decision === fixture.expectedDecision && reasonsPassed;
+        results.push({
+            filePath,
+            name: fixture.name ?? filePath,
+            passed,
+            expectedDecision: fixture.expectedDecision,
+            actualDecision: decision.decision,
+            expectedReasons: fixture.expectedReasons ?? null,
+            actualReasons: decision.reasons,
+        });
+    }
+    const failed = results.filter((result) => !result.passed).length;
+    return {
+        schemaVersion: POLICY_TEST_SCHEMA_VERSION,
+        config: {
+            filePath: loadedConfig.filePath,
+            policyVersion: loadedConfig.config.policy.version,
+        },
+        fixturesPath,
+        passed: failed === 0,
+        total: results.length,
+        failed,
+        results,
+    };
+}
+export async function runLedgerExport(input = {}) {
+    const loadedConfig = await loadAxtaryConfig({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    const ledgerPath = resolveConfiguredLedgerPath(input, loadedConfig);
+    const exported = await exportLedgerRecords({
+        filePath: ledgerPath,
+        from: input.from,
+        to: input.to,
+        decisions: input.decisions,
+    });
+    const format = parseExportFormat(input.format);
+    const formatted = formatLedgerExport({
+        export: exported,
+        format,
+    });
+    const outputPath = input.outputPath
+        ? resolve(input.cwd ?? process.cwd(), input.outputPath)
+        : null;
+    if (outputPath) {
+        await writeFile(outputPath, formatted, "utf8");
+    }
+    return {
+        schemaVersion: LEDGER_EXPORT_RUN_SCHEMA_VERSION,
+        config: {
+            filePath: loadedConfig.filePath,
+            tenant: loadedConfig.config.tenant,
+        },
+        ledgerPath,
+        outputPath,
+        format,
+        export: exported,
+    };
+}
+export async function runLedgerSync(input) {
+    const loadedConfig = await loadAxtaryConfig({
+        filePath: input.configPath,
+        cwd: input.cwd,
+    });
+    const ledgerPath = resolveConfiguredLedgerPath(input, loadedConfig);
+    const exported = await exportLedgerRecords({
+        filePath: ledgerPath,
+        from: input.from,
+        to: input.to,
+        decisions: input.decisions,
+    });
+    const env = input.env ?? process.env;
+    const token = input.tokenEnv ? env[input.tokenEnv] : undefined;
+    if (input.tokenEnv && !token) {
+        throw new Error(`missing_ledger_sync_token_env:${input.tokenEnv}`);
+    }
+    const sync = await syncLedgerExport({
+        endpoint: input.endpoint,
+        tenant: input.tenant ?? loadedConfig.config.tenant,
+        token,
+        export: exported,
+        fetch: input.fetch,
+    });
+    return {
+        schemaVersion: LEDGER_SYNC_RUN_SCHEMA_VERSION,
+        config: {
+            filePath: loadedConfig.filePath,
+            tenant: loadedConfig.config.tenant,
+        },
+        ledgerPath,
+        endpoint: input.endpoint,
+        sync,
+    };
+}
+export async function runAxtaryCli(argv = process.argv.slice(2), io = {}) {
+    const stdout = io.stdout ?? ((text) => process.stdout.write(text));
+    const stderr = io.stderr ?? ((text) => process.stderr.write(text));
+    const [command, ...args] = argv;
+    try {
+        if (!command || command === "--help" || command === "-h") {
+            stdout(helpText());
+            return 0;
+        }
+        if (command === "smoke") {
+            const parsed = parseSmokeArgs(args);
+            return await runSmokeTest({
+                configPath: parsed.configPath,
+                cwd: io.cwd ?? parsed.cwd,
+            }, io);
+        }
+        if (command === "demo") {
+            const parsed = parseDemoArgs(args);
+            const result = await runDemo({
+                configPath: parsed.configPath,
+                ledgerPath: parsed.ledgerPath,
+                cwd: io.cwd ?? parsed.cwd,
+            });
+            if (parsed.json) {
+                stdout(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                stdout(formatDemoResult(result));
+            }
+            return result.ledger.valid ? 0 : 1;
+        }
+        if (command === "export-ledger") {
+            const parsed = parseLedgerExportArgs(args);
+            const result = await runLedgerExport({
+                configPath: parsed.configPath,
+                ledgerPath: parsed.ledgerPath,
+                cwd: io.cwd ?? parsed.cwd,
+                from: parsed.from,
+                to: parsed.to,
+                decisions: parsed.decisions,
+                outputPath: parsed.outputPath,
+                format: parsed.format,
+            });
+            if (parsed.json || !parsed.outputPath) {
+                stdout(formatLedgerExport({ export: result.export, format: result.format }));
+            }
+            else {
+                stdout(formatLedgerExportResult(result));
+            }
+            return 0;
+        }
+        if (command === "sync-ledger") {
+            const parsed = parseLedgerSyncArgs(args);
+            const result = await runLedgerSync({
+                configPath: parsed.configPath,
+                ledgerPath: parsed.ledgerPath,
+                cwd: io.cwd ?? parsed.cwd,
+                from: parsed.from,
+                to: parsed.to,
+                decisions: parsed.decisions,
+                endpoint: parsed.endpoint,
+                tenant: parsed.tenant,
+                tokenEnv: parsed.tokenEnv,
+            });
+            if (parsed.json) {
+                stdout(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                stdout(formatLedgerSyncResult(result));
+            }
+            return 0;
+        }
+        if (command === "proxy") {
+            const parsed = parseProxyArgs(args);
+            const server = await startProxyServer({
+                configPath: parsed.configPath,
+                ledgerPath: parsed.ledgerPath,
+                cwd: io.cwd ?? parsed.cwd,
+                host: parsed.host,
+                port: parsed.port,
+            });
+            stdout(`Axtary proxy listening on ${server.url}\n`);
+            stdout(`ledger: ${server.ledgerPath}\n`);
+            await waitForShutdown(server.close);
+            return 0;
+        }
+        if (command === "test-policy") {
+            const parsed = parseTestPolicyArgs(args);
+            const result = await runTestPolicy({
+                configPath: parsed.configPath,
+                fixturesPath: parsed.fixturesPath,
+                cwd: io.cwd ?? parsed.cwd,
+            });
+            if (parsed.json) {
+                stdout(`${JSON.stringify(result, null, 2)}\n`);
+            }
+            else {
+                stdout(formatPolicyTestResult(result));
+            }
+            return result.passed ? 0 : 1;
+        }
+        stderr(`Unknown command: ${command}\n\n${helpText()}`);
+        return 1;
+    }
+    catch (error) {
+        stderr(`${error instanceof Error ? error.message : "axtary_cli_failed"}\n`);
+        return 1;
+    }
+}
+function parseProxyArgs(args) {
+    const parsed = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--ledger":
+                parsed.ledgerPath = requireValue(args, index, "--ledger");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            case "--host":
+                parsed.host = requireValue(args, index, "--host");
+                index += 1;
+                break;
+            case "--port":
+                parsed.port = Number.parseInt(requireValue(args, index, "--port"), 10);
+                if (!Number.isInteger(parsed.port) || parsed.port < 0) {
+                    throw new Error("invalid_port");
+                }
+                index += 1;
+                break;
+            default:
+                throw new Error(`unknown_proxy_flag:${arg}`);
+        }
+    }
+    return parsed;
+}
+function parseTestPolicyArgs(args) {
+    const parsed = {
+        json: false,
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--fixtures":
+                parsed.fixturesPath = requireValue(args, index, "--fixtures");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            case "--json":
+                parsed.json = true;
+                break;
+            default:
+                throw new Error(`unknown_test_policy_flag:${arg}`);
+        }
+    }
+    if (!parsed.fixturesPath) {
+        throw new Error("missing_value:--fixtures");
+    }
+    return parsed;
+}
+function parseSmokeArgs(args) {
+    const parsed = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            default:
+                throw new Error(`unknown_smoke_flag:${arg}`);
+        }
+    }
+    return parsed;
+}
+function parseLedgerExportArgs(args) {
+    const parsed = {
+        json: false,
+        decisions: [],
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--ledger":
+                parsed.ledgerPath = requireValue(args, index, "--ledger");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            case "--from":
+                parsed.from = requireValue(args, index, "--from");
+                index += 1;
+                break;
+            case "--to":
+                parsed.to = requireValue(args, index, "--to");
+                index += 1;
+                break;
+            case "--decision":
+                parsed.decisions.push(parseDecisionFlag(requireValue(args, index, "--decision")));
+                index += 1;
+                break;
+            case "--out":
+                parsed.outputPath = requireValue(args, index, "--out");
+                index += 1;
+                break;
+            case "--format":
+                parsed.format = parseExportFormat(requireValue(args, index, "--format"));
+                index += 1;
+                break;
+            case "--json":
+                parsed.format = "json";
+                parsed.json = true;
+                break;
+            default:
+                throw new Error(`unknown_export_ledger_flag:${arg}`);
+        }
+    }
+    return parsed;
+}
+function parseLedgerSyncArgs(args) {
+    const parsed = {
+        json: false,
+        decisions: [],
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--ledger":
+                parsed.ledgerPath = requireValue(args, index, "--ledger");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            case "--from":
+                parsed.from = requireValue(args, index, "--from");
+                index += 1;
+                break;
+            case "--to":
+                parsed.to = requireValue(args, index, "--to");
+                index += 1;
+                break;
+            case "--decision":
+                parsed.decisions.push(parseDecisionFlag(requireValue(args, index, "--decision")));
+                index += 1;
+                break;
+            case "--endpoint":
+                parsed.endpoint = requireValue(args, index, "--endpoint");
+                index += 1;
+                break;
+            case "--tenant":
+                parsed.tenant = requireValue(args, index, "--tenant");
+                index += 1;
+                break;
+            case "--token-env":
+                parsed.tokenEnv = requireValue(args, index, "--token-env");
+                index += 1;
+                break;
+            case "--json":
+                parsed.json = true;
+                break;
+            default:
+                throw new Error(`unknown_sync_ledger_flag:${arg}`);
+        }
+    }
+    if (!parsed.endpoint) {
+        throw new Error("missing_value:--endpoint");
+    }
+    return parsed;
+}
+function parseDemoArgs(args) {
+    const parsed = {
+        json: false,
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        switch (arg) {
+            case "--config":
+                parsed.configPath = requireValue(args, index, "--config");
+                index += 1;
+                break;
+            case "--ledger":
+                parsed.ledgerPath = requireValue(args, index, "--ledger");
+                index += 1;
+                break;
+            case "--cwd":
+                parsed.cwd = requireValue(args, index, "--cwd");
+                index += 1;
+                break;
+            case "--json":
+                parsed.json = true;
+                break;
+            default:
+                throw new Error(`unknown_demo_flag:${arg}`);
+        }
+    }
+    return parsed;
+}
+function toDemoActionResult(name, handleResult) {
+    if (handleResult.status === "malformed") {
+        return {
+            name,
+            tool: "unknown",
+            status: handleResult.status,
+            decision: null,
+            reasons: [handleResult.error.reason],
+            actionPassId: null,
+            ledgerLine: null,
+            result: null,
+        };
+    }
+    return {
+        name,
+        tool: handleResult.action.capability.tool,
+        status: handleResult.status,
+        decision: handleResult.decision.decision,
+        reasons: handleResult.decision.reasons,
+        actionPassId: handleResult.actionPass?.claims.jti ?? null,
+        ledgerLine: handleResult.ledger.lineNumber,
+        result: handleResult.status === "executed" ? handleResult.result : null,
+    };
+}
+function ledgerSummary(verifiedLedger) {
+    if (verifiedLedger.valid) {
+        return {
+            valid: true,
+            records: verifiedLedger.records.length,
+            lastLedgerHash: verifiedLedger.lastLedgerHash,
+            failure: null,
+        };
+    }
+    return {
+        valid: false,
+        records: verifiedLedger.records.length,
+        lastLedgerHash: verifiedLedger.records.at(-1)?.ledgerHash ?? null,
+        failure: `${verifiedLedger.lineNumber}:${verifiedLedger.reason}`,
+    };
+}
+function formatDemoResult(result) {
+    const lines = [
+        "Axtary demo complete",
+        `ledger: ${result.ledgerPath}`,
+        `ledger valid: ${result.ledger.valid}`,
+        "",
+    ];
+    for (const entry of result.results) {
+        lines.push(`${entry.name}: ${entry.status} ${entry.decision ?? "none"} (${entry.reasons.join(", ")})`);
+    }
+    lines.push("");
+    lines.push(`fake GitHub PRs: ${result.adapters.github.pullRequests.length}, fake Slack messages: ${result.adapters.slack.messages.length}, fake Linear comments: ${result.adapters.issueTrackers.linear.comments.length}, fake Jira comments: ${result.adapters.issueTrackers.jira.comments.length}`);
+    return `${lines.join("\n")}\n`;
+}
+function formatPolicyTestResult(result) {
+    const lines = [
+        `Axtary policy fixtures ${result.passed ? "passed" : "failed"}`,
+        `fixtures: ${result.fixturesPath}`,
+        `total: ${result.total}, failed: ${result.failed}`,
+        "",
+    ];
+    for (const entry of result.results) {
+        lines.push(`${entry.passed ? "PASS" : "FAIL"} ${entry.name}: expected ${entry.expectedDecision}, got ${entry.actualDecision} (${entry.actualReasons.join(", ")})`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatLedgerExportResult(result) {
+    const lines = [
+        "Axtary ledger export complete",
+        `ledger: ${result.ledgerPath}`,
+        `records: ${result.export.records.length} of ${result.export.source.totalRecords}`,
+        `last hash: ${result.export.source.lastLedgerHash ?? "none"}`,
+    ];
+    if (result.outputPath) {
+        lines.push(`output: ${result.outputPath}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatLedgerSyncResult(result) {
+    return [
+        "Axtary ledger sync complete",
+        `endpoint: ${result.endpoint}`,
+        `status: ${result.sync.status}`,
+        `records: ${result.sync.records}`,
+        `last hash: ${result.sync.lastLedgerHash ?? "none"}`,
+        "",
+    ].join("\n");
+}
+function resolveConfiguredLedgerPath(input, loadedConfig) {
+    const cwd = resolve(input.cwd ?? process.cwd());
+    return input.ledgerPath ? resolve(cwd, input.ledgerPath) : loadedConfig.ledgerPath;
+}
+function resolveDocsRoots(loadedConfig) {
+    return loadedConfig.config.adapters.docs.roots.map((root) => resolve(loadedConfig.baseDir, root));
+}
+function parseDecisionFlag(value) {
+    return AxtaryDecisionSchema.parse(value);
+}
+function parseExportFormat(value) {
+    return LedgerExportFormatSchema.parse(value ?? "json");
+}
+function createProxyHandlers(loadedConfig, adapterState, verification) {
+    const fakeHandlers = createFakeHandlers(adapterState, { verification });
+    const githubConfig = loadedConfig.config.adapters.github;
+    const slackConfig = loadedConfig.config.adapters.slack;
+    const linearConfig = loadedConfig.config.adapters.linear;
+    const awsConfig = loadedConfig.config.adapters.aws;
+    const gcpConfig = loadedConfig.config.adapters.gcp;
+    const docsConfig = loadedConfig.config.adapters.docs;
+    const handlers = { ...fakeHandlers };
+    const adapterModes = {
+        github: githubConfig.mode,
+        slack: slackConfig.mode,
+        linear: linearConfig.mode,
+        aws: awsConfig.mode,
+        gcp: gcpConfig.mode,
+        docs: docsConfig.mode,
+        mcp: "fixture",
+    };
+    if (githubConfig.mode === "rest") {
+        const token = process.env[githubConfig.tokenEnv];
+        if (!token) {
+            throw new Error(`missing_github_token_env:${githubConfig.tokenEnv}`);
+        }
+        Object.assign(handlers, createGitHubRestHandlers({
+            token,
+            apiBaseUrl: githubConfig.apiBaseUrl,
+            userAgent: githubConfig.userAgent,
+        }, { verification }));
+    }
+    if (slackConfig.mode === "web") {
+        const token = process.env[slackConfig.tokenEnv];
+        if (!token) {
+            throw new Error(`missing_slack_token_env:${slackConfig.tokenEnv}`);
+        }
+        Object.assign(handlers, createSlackWebHandlers({
+            token,
+            apiBaseUrl: slackConfig.apiBaseUrl,
+        }, { verification }));
+    }
+    if (linearConfig.mode === "graphql") {
+        const token = process.env[linearConfig.tokenEnv];
+        if (!token) {
+            throw new Error(`missing_linear_token_env:${linearConfig.tokenEnv}`);
+        }
+        Object.assign(handlers, createLinearGraphqlHandlers({
+            token,
+            apiUrl: linearConfig.apiUrl,
+        }, { verification }));
+    }
+    if (awsConfig.mode === "rest") {
+        const accessKeyId = process.env[awsConfig.accessKeyIdEnv];
+        const secretAccessKey = process.env[awsConfig.secretAccessKeyEnv];
+        const sessionToken = process.env[awsConfig.sessionTokenEnv];
+        if (!accessKeyId) {
+            throw new Error(`missing_aws_access_key_id_env:${awsConfig.accessKeyIdEnv}`);
+        }
+        if (!secretAccessKey) {
+            throw new Error(`missing_aws_secret_access_key_env:${awsConfig.secretAccessKeyEnv}`);
+        }
+        Object.assign(handlers, createAwsRestHandlers({
+            credentials: {
+                accessKeyId,
+                secretAccessKey,
+                sessionToken,
+            },
+            region: awsConfig.region,
+            stsUrl: awsConfig.stsUrl,
+        }, { verification }));
+    }
+    if (gcpConfig.mode === "rest") {
+        const accessToken = process.env[gcpConfig.accessTokenEnv];
+        if (!accessToken) {
+            throw new Error(`missing_gcp_access_token_env:${gcpConfig.accessTokenEnv}`);
+        }
+        Object.assign(handlers, createGcpRestHandlers({
+            accessToken,
+            projectId: gcpConfig.projectId,
+            cloudResourceManagerApiBaseUrl: gcpConfig.cloudResourceManagerApiBaseUrl,
+            storageApiBaseUrl: gcpConfig.storageApiBaseUrl,
+        }, { verification }));
+    }
+    if (docsConfig.mode === "local") {
+        Object.assign(handlers, createLocalDocsHandlers({
+            workspace: docsConfig.workspace,
+            roots: resolveDocsRoots(loadedConfig),
+            maxSearchResults: docsConfig.maxSearchResults,
+            maxReadBytes: docsConfig.maxReadBytes,
+            allowedExtensions: docsConfig.allowedExtensions,
+        }, { verification }));
+    }
+    return {
+        handlers,
+        adapterModes,
+    };
+}
+function helpText() {
+    return [
+        "Usage:",
+        "  axtary demo [--config axtary.yml] [--ledger .axtary/actions.jsonl] [--json]",
+        "  axtary export-ledger [--config axtary.yml] [--ledger .axtary/actions.jsonl] [--from ISO] [--to ISO] [--decision allow|deny|step_up] [--format json|jsonl|siem-jsonl] [--out export.json] [--json]",
+        "  axtary sync-ledger --endpoint https://app.example/api/ledger/sync [--config axtary.yml] [--ledger .axtary/actions.jsonl] [--from ISO] [--to ISO] [--decision allow|deny|step_up] [--tenant org:company] [--token-env AXTARY_LEDGER_SYNC_TOKEN] [--json]",
+        "  axtary proxy [--config axtary.yml] [--ledger .axtary/actions.jsonl] [--host 127.0.0.1] [--port 7331]",
+        "  axtary smoke [--config axtary.yml]",
+        "  axtary test-policy --fixtures ./fixtures [--config axtary.yml] [--json]",
+        "",
+    ].join("\n");
+}
+function requireValue(args, index, flag) {
+    const value = args[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`missing_value:${flag}`);
+    }
+    return value;
+}
+async function collectFixtureFiles(path) {
+    const pathStat = await stat(path);
+    if (pathStat.isFile()) {
+        return [path];
+    }
+    const entries = await readdir(path, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const entryPath = resolve(path, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...(await collectFixtureFiles(entryPath)));
+        }
+        else if (entry.isFile() && extname(entry.name) === ".json") {
+            files.push(entryPath);
+        }
+    }
+    return files.sort();
+}
+async function readPolicyFixture(filePath) {
+    const text = await readFile(filePath, "utf8");
+    const parsed = JSON.parse(text);
+    if (!parsed.action) {
+        throw new Error(`fixture_missing_action:${filePath}`);
+    }
+    if (parsed.expectedDecision !== "allow" &&
+        parsed.expectedDecision !== "deny" &&
+        parsed.expectedDecision !== "step_up") {
+        throw new Error(`fixture_invalid_expected_decision:${filePath}`);
+    }
+    if (parsed.expectedReasons &&
+        !parsed.expectedReasons.every((reason) => typeof reason === "string")) {
+        throw new Error(`fixture_invalid_expected_reasons:${filePath}`);
+    }
+    return {
+        name: typeof parsed.name === "string" ? parsed.name : undefined,
+        action: parsed.action,
+        expectedDecision: parsed.expectedDecision,
+        expectedReasons: parsed.expectedReasons,
+    };
+}
+function arraysEqual(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function listen(server, port, host) {
+    return new Promise((resolveListen, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolveListen();
+        });
+    });
+}
+function close(server) {
+    return new Promise((resolveClose, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolveClose();
+        });
+    });
+}
+function writeJson(response, statusCode, value) {
+    response.writeHead(statusCode, {
+        "content-type": "application/json; charset=utf-8",
+    });
+    response.end(`${JSON.stringify(value, null, 2)}\n`);
+}
+async function readJsonBody(request) {
+    const chunks = [];
+    for await (const chunk of request) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function waitForShutdown(closeServer) {
+    return new Promise((resolveWait) => {
+        const shutdown = () => {
+            process.off("SIGINT", shutdown);
+            process.off("SIGTERM", shutdown);
+            void closeServer().finally(resolveWait);
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    });
+}
+//# sourceMappingURL=index.js.map