@axtary/proxy 0.0.1

package/README.md

@@ -0,0 +1,29 @@
+# @axtary/proxy
+
+Local fail-closed runtime proxy for Axtary policy, ActionPass issuance, and ledger recording.
+
+This package is private workspace code while the local runtime plane is still being shaped.
+
+## What It Does
+
+- Parses a normalized Axtary action.
+- Evaluates it through `@axtary/policy`.
+- Requires ActionPass signing before execution by default.
+- Appends every executable or blocked decision to `@axtary/ledger`.
+- Executes only registered handlers for allowed tools.
+- Can resolve exact approval evidence for `step_up` decisions before issuing a pass.
+- Returns structured blocked, executed, failed, and malformed results.
+- Returns per-stage timings for parse, policy, ActionPass issuance, ledger append, handler execution, and total latency.
+- Accepts either a static policy object or an async policy getter for hot-reloaded local configs.
+
+## Design Notes
+
+The proxy is the first runtime enforcement surface. It is intentionally local and deterministic. Real adapters register handlers and let the proxy own the decision, pass issuance, and ledger write before any production tool is touched.
+
+Unsigned execution is possible only with `allowUnsignedExecution: true`, which is meant for dry-run tests and local demos.
+
+Handlers are bounded by `handlerTimeoutMs` from config. Timeout failures are recorded as failed executions after the allow decision is ledgered, which keeps the authorization trace intact without letting slow providers stall the runtime.
+
+When a dynamic policy getter fails, the proxy fails closed, records a deny decision in the ledger, and does not call the downstream handler. That preserves the audit trail while avoiding stale or partially parsed policy.
+
+`approvalResolver` is the local bridge to hosted or local approval queues. It receives the normalized action and `step_up` policy decision, and may return a payload-bound approval artifact. If resolution fails, returns nothing, or the artifact does not bind to the exact action, the proxy blocks before handler execution.

package/dist/index.d.ts

@@ -0,0 +1,94 @@
+import { type Approval, type ApprovalArtifact, type IssueActionPassResult, type JsonValue, type LedgerRecord, type NormalizedAction, type PolicyDecision, type SigningAlgorithm, type SigningKey } from "@axtary/actionpass";
+import type { LedgerAppendResult, LocalJsonlLedger } from "@axtary/ledger";
+import { type PolicyConfig } from "@axtary/policy";
+export declare const PROXY_SCHEMA_VERSION = "axtary.proxy.v0";
+export declare const PROXY_POLICY_VERSION = "2026-05-30";
+export declare const DEFAULT_HANDLER_TIMEOUT_MS = 10000;
+export type ProxyLedger = Pick<LocalJsonlLedger, "appendDecision">;
+export type ProxyTimings = {
+    totalMs: number;
+    parseMs: number;
+    policyMs: number;
+    actionPassMs: number;
+    ledgerMs: number;
+    approvalMs: number;
+    handlerMs: number;
+};
+export type ToolHandlerRequest = {
+    action: NormalizedAction;
+    decision: PolicyDecision;
+    actionPass: IssueActionPassResult | null;
+    ledgerRecord: LedgerRecord;
+};
+export type ToolHandler = (request: ToolHandlerRequest) => JsonValue | Promise<JsonValue>;
+export type ProxyApprovalRequest = {
+    action: NormalizedAction;
+    decision: PolicyDecision;
+};
+export type ProxyApprovalResult = Approval | ApprovalArtifact | {
+    approval?: Approval;
+    approvalArtifact?: ApprovalArtifact;
+} | null | undefined;
+export type ProxyApprovalResolver = (request: ProxyApprovalRequest) => ProxyApprovalResult | Promise<ProxyApprovalResult>;
+export type ProxyRuntimeConfig = {
+    issuer: string;
+    tenant: string;
+    ledger: ProxyLedger;
+    handlers?: Readonly<Record<string, ToolHandler>>;
+    policy?: Partial<PolicyConfig> | (() => Partial<PolicyConfig> | Promise<Partial<PolicyConfig>>);
+    signingKey?: SigningKey;
+    keyId?: string;
+    algorithm?: SigningAlgorithm;
+    approvalResolver?: ProxyApprovalResolver;
+    allowUnsignedExecution?: boolean;
+    handlerTimeoutMs?: number;
+    now?: () => Date;
+};
+export type ProxyMalformedResult = {
+    schemaVersion: typeof PROXY_SCHEMA_VERSION;
+    status: "malformed";
+    error: {
+        reason: string;
+    };
+};
+export type ProxyBlockedResult = {
+    schemaVersion: typeof PROXY_SCHEMA_VERSION;
+    status: "blocked";
+    action: NormalizedAction;
+    decision: PolicyDecision;
+    actionPass: null;
+    ledger: LedgerAppendResult;
+    timings: ProxyTimings;
+};
+export type ProxyExecutedResult = {
+    schemaVersion: typeof PROXY_SCHEMA_VERSION;
+    status: "executed";
+    action: NormalizedAction;
+    decision: PolicyDecision;
+    actionPass: IssueActionPassResult | null;
+    ledger: LedgerAppendResult;
+    result: JsonValue;
+    timings: ProxyTimings;
+};
+export type ProxyFailedResult = {
+    schemaVersion: typeof PROXY_SCHEMA_VERSION;
+    status: "failed";
+    action: NormalizedAction;
+    decision: PolicyDecision;
+    actionPass: IssueActionPassResult | null;
+    ledger: LedgerAppendResult;
+    error: {
+        reason: string;
+    };
+    timings: ProxyTimings;
+};
+export type ProxyHandleResult = ProxyMalformedResult | ProxyBlockedResult | ProxyExecutedResult | ProxyFailedResult;
+export declare class AxtaryProxyRuntime {
+    readonly config: ProxyRuntimeConfig;
+    constructor(config: ProxyRuntimeConfig);
+    handle(actionInput: unknown): Promise<ProxyHandleResult>;
+    private append;
+    private now;
+}
+export declare function createProxyRuntime(config: ProxyRuntimeConfig): AxtaryProxyRuntime;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnE,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,oBAAoB,eAAe,CAAC;AACjD,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAEjD,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAEnE,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,kBAAkB,KACxB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,gBAAgB,GAChB;IACE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,GACD,IAAI,GACJ,SAAS,CAAC;AAEd,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,oBAAoB,KAC1B,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,EACH,OAAO,CAAC,YAAY,CAAC,GACrB,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAExB,MAAM,EAAE,kBAAkB;IAIhC,MAAM,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6O9D,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,GAAG;CAGZ;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAEjF"}

package/dist/index.js

@@ -0,0 +1,303 @@
+import { APPROVAL_ARTIFACT_VERSION, DEFAULT_EXPIRES_IN_SECONDS, issueActionPass, parseNormalizedAction, } from "@axtary/actionpass";
+import { evaluatePolicy } from "@axtary/policy";
+import { performance } from "node:perf_hooks";
+export const PROXY_SCHEMA_VERSION = "axtary.proxy.v0";
+export const PROXY_POLICY_VERSION = "2026-05-30";
+export const DEFAULT_HANDLER_TIMEOUT_MS = 10_000;
+export class AxtaryProxyRuntime {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async handle(actionInput) {
+        const startedAt = performance.now();
+        const timings = createTimings();
+        let action;
+        try {
+            const parseStartedAt = performance.now();
+            action = parseNormalizedAction(actionInput);
+            timings.parseMs = elapsed(parseStartedAt);
+        }
+        catch (error) {
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "malformed",
+                error: {
+                    reason: errorToReason(error),
+                },
+            };
+        }
+        const policyStartedAt = performance.now();
+        let policyDecision;
+        try {
+            const resolvedPolicy = typeof this.config.policy === "function"
+                ? await this.config.policy()
+                : this.config.policy;
+            policyDecision = evaluatePolicy(action, resolvedPolicy);
+            timings.policyMs = elapsed(policyStartedAt);
+        }
+        catch (error) {
+            timings.policyMs = elapsed(policyStartedAt);
+            const decision = proxyDeny([`proxy_policy_resolution_failed:${errorToReason(error)}`]);
+            const ledgerStartedAt = performance.now();
+            const ledger = await this.append(action, decision, null);
+            timings.ledgerMs = elapsed(ledgerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "blocked",
+                action,
+                decision,
+                actionPass: null,
+                ledger,
+                timings,
+            };
+        }
+        let approvalEvidence = {};
+        if (policyDecision.decision === "step_up" && this.config.approvalResolver) {
+            const approvalStartedAt = performance.now();
+            try {
+                approvalEvidence = normalizeApprovalResult(await this.config.approvalResolver({
+                    action,
+                    decision: policyDecision,
+                }));
+                timings.approvalMs = elapsed(approvalStartedAt);
+                if (approvalEvidence.approval || approvalEvidence.approvalArtifact) {
+                    policyDecision = approveStepUp(policyDecision);
+                }
+            }
+            catch (error) {
+                timings.approvalMs = elapsed(approvalStartedAt);
+                const decision = proxyDeny([`proxy_approval_resolution_failed:${errorToReason(error)}`], policyDecision);
+                const ledgerStartedAt = performance.now();
+                const ledger = await this.append(action, decision, null);
+                timings.ledgerMs = elapsed(ledgerStartedAt);
+                timings.totalMs = elapsed(startedAt);
+                return {
+                    schemaVersion: PROXY_SCHEMA_VERSION,
+                    status: "blocked",
+                    action,
+                    decision,
+                    actionPass: null,
+                    ledger,
+                    timings,
+                };
+            }
+        }
+        if (policyDecision.decision !== "allow") {
+            const ledgerStartedAt = performance.now();
+            const ledger = await this.append(action, policyDecision, null);
+            timings.ledgerMs = elapsed(ledgerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "blocked",
+                action,
+                decision: policyDecision,
+                actionPass: null,
+                ledger,
+                timings,
+            };
+        }
+        const handler = this.config.handlers?.[action.capability.tool];
+        if (!handler) {
+            const decision = proxyDeny([`proxy_handler_missing:${action.capability.tool}`], policyDecision);
+            const ledgerStartedAt = performance.now();
+            const ledger = await this.append(action, decision, null);
+            timings.ledgerMs = elapsed(ledgerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "blocked",
+                action,
+                decision,
+                actionPass: null,
+                ledger,
+                timings,
+            };
+        }
+        if (!this.config.signingKey && this.config.allowUnsignedExecution !== true) {
+            const decision = proxyDeny(["proxy_signing_key_required"], policyDecision);
+            const ledgerStartedAt = performance.now();
+            const ledger = await this.append(action, decision, null);
+            timings.ledgerMs = elapsed(ledgerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "blocked",
+                action,
+                decision,
+                actionPass: null,
+                ledger,
+                timings,
+            };
+        }
+        let actionPass = null;
+        if (this.config.signingKey) {
+            try {
+                const actionPassStartedAt = performance.now();
+                actionPass = await issueActionPass({
+                    action,
+                    decision: policyDecision,
+                    issuer: this.config.issuer,
+                    tenant: this.config.tenant,
+                    signingKey: this.config.signingKey,
+                    keyId: this.config.keyId,
+                    algorithm: this.config.algorithm,
+                    now: this.now(),
+                    approval: approvalEvidence.approval,
+                    approvalArtifact: approvalEvidence.approvalArtifact,
+                });
+                timings.actionPassMs = elapsed(actionPassStartedAt);
+            }
+            catch {
+                const decision = proxyDeny(["proxy_actionpass_issue_failed"], policyDecision);
+                const ledgerStartedAt = performance.now();
+                const ledger = await this.append(action, decision, null);
+                timings.ledgerMs = elapsed(ledgerStartedAt);
+                timings.totalMs = elapsed(startedAt);
+                return {
+                    schemaVersion: PROXY_SCHEMA_VERSION,
+                    status: "blocked",
+                    action,
+                    decision,
+                    actionPass: null,
+                    ledger,
+                    timings,
+                };
+            }
+        }
+        const ledgerStartedAt = performance.now();
+        const ledger = await this.append(action, policyDecision, actionPass?.claims.jti ?? null);
+        timings.ledgerMs = elapsed(ledgerStartedAt);
+        const handlerStartedAt = performance.now();
+        try {
+            const result = await withTimeout(handler({
+                action,
+                decision: policyDecision,
+                actionPass,
+                ledgerRecord: ledger.record,
+            }), this.config.handlerTimeoutMs ?? DEFAULT_HANDLER_TIMEOUT_MS);
+            timings.handlerMs = elapsed(handlerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "executed",
+                action,
+                decision: policyDecision,
+                actionPass,
+                ledger,
+                result,
+                timings,
+            };
+        }
+        catch (error) {
+            timings.handlerMs = elapsed(handlerStartedAt);
+            timings.totalMs = elapsed(startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "failed",
+                action,
+                decision: policyDecision,
+                actionPass,
+                ledger,
+                error: {
+                    reason: errorToReason(error),
+                },
+                timings,
+            };
+        }
+    }
+    append(action, decision, actionPassId) {
+        return this.config.ledger.appendDecision({
+            action,
+            decision,
+            actionPassId,
+            occurredAt: this.now(),
+        });
+    }
+    now() {
+        return this.config.now?.() ?? new Date();
+    }
+}
+export function createProxyRuntime(config) {
+    return new AxtaryProxyRuntime(config);
+}
+function proxyDeny(reasons, previousDecision) {
+    return {
+        decision: "deny",
+        reasons,
+        policy: {
+            nativeRule: "axtary_proxy_v0",
+            version: PROXY_POLICY_VERSION,
+            cedarCompatible: true,
+            opaCompatible: true,
+        },
+        constraints: {
+            expiresInSeconds: previousDecision?.constraints.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS,
+            maxFilesChanged: previousDecision?.constraints.maxFilesChanged ?? 0,
+            blockedPaths: previousDecision?.constraints.blockedPaths ?? [],
+        },
+    };
+}
+function normalizeApprovalResult(result) {
+    if (!result) {
+        return {};
+    }
+    if ("schemaVersion" in result && result.schemaVersion === APPROVAL_ARTIFACT_VERSION) {
+        return {
+            approvalArtifact: result,
+        };
+    }
+    if ("mode" in result) {
+        return {
+            approval: result,
+        };
+    }
+    return {
+        approval: result.approval,
+        approvalArtifact: result.approvalArtifact,
+    };
+}
+function approveStepUp(decision) {
+    return {
+        ...decision,
+        decision: "allow",
+        reasons: [...decision.reasons, "step_up_approved"],
+    };
+}
+function errorToReason(error) {
+    return error instanceof Error ? error.message : "unknown_error";
+}
+function createTimings() {
+    return {
+        totalMs: 0,
+        parseMs: 0,
+        policyMs: 0,
+        actionPassMs: 0,
+        ledgerMs: 0,
+        approvalMs: 0,
+        handlerMs: 0,
+    };
+}
+function elapsed(startedAt) {
+    return Math.round((performance.now() - startedAt) * 1000) / 1000;
+}
+function withTimeout(value, timeoutMs) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        return Promise.resolve(value);
+    }
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            reject(new Error(`proxy_handler_timeout:${timeoutMs}ms`));
+        }, timeoutMs);
+        void Promise.resolve(value).then((result) => {
+            clearTimeout(timeout);
+            resolve(result);
+        }, (error) => {
+            clearTimeout(timeout);
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GAUtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAqB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AA6GjD,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAqB;IAEpC,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAoB;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,MAAwB,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACzC,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC7B;aACF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,cAA8B,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU;gBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC5B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACzB,cAAc,GAAG,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACxD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,kCAAkC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAC3D,CAAC;YACF,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,MAAM;gBACN,OAAO;aACR,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,GAA6B,EAAE,CAAC;QAEpD,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1E,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAE5C,IAAI,CAAC;gBACH,gBAAgB,GAAG,uBAAuB,CACxC,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACjC,MAAM;oBACN,QAAQ,EAAE,cAAc;iBACzB,CAAC,CACH,CAAC;gBACF,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAEhD,IAAI,gBAAgB,CAAC,QAAQ,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;oBACnE,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,oCAAoC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAC5D,cAAc,CACf,CAAC;gBACF,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAErC,OAAO;oBACL,aAAa,EAAE,oBAAoB;oBACnC,MAAM,EAAE,SAAS;oBACjB,MAAM;oBACN,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,MAAM;oBACN,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM;gBACN,QAAQ,EAAE,cAAc;gBACxB,UAAU,EAAE,IAAI;gBAChB,MAAM;gBACN,OAAO;aACR,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,SAAS,CACxB,CAAC,yBAAyB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EACnD,cAAc,CACf,CAAC;YACF,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,MAAM;gBACN,OAAO;aACR,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,IAAI,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,4BAA4B,CAAC,EAAE,cAAc,CAAC,CAAC;YAC3E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;YAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,SAAS;gBACjB,MAAM;gBACN,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,MAAM;gBACN,OAAO;aACR,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,GAAiC,IAAI,CAAC;QAEpD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAC9C,UAAU,GAAG,MAAM,eAAe,CAAC;oBACjC,MAAM;oBACN,QAAQ,EAAE,cAAc;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC1B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;oBAClC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;oBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAChC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;oBACf,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB;iBACpD,CAAC,CAAC;gBACH,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,+BAA+B,CAAC,EAAE,cAAc,CAAC,CAAC;gBAC9E,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACzD,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC5C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAErC,OAAO;oBACL,aAAa,EAAE,oBAAoB;oBACnC,MAAM,EAAE,SAAS;oBACjB,MAAM;oBACN,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,MAAM;oBACN,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,MAAM,EACN,cAAc,EACd,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,CAC/B,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAE5C,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC;gBACN,MAAM;gBACN,QAAQ,EAAE,cAAc;gBACxB,UAAU;gBACV,YAAY,EAAE,MAAM,CAAC,MAAM;aAC5B,CAAC,EACF,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,0BAA0B,CAC3D,CAAC;YACF,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC9C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,UAAU;gBAClB,MAAM;gBACN,QAAQ,EAAE,cAAc;gBACxB,UAAU;gBACV,MAAM;gBACN,MAAM;gBACN,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC9C,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAErC,OAAO;gBACL,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,QAAQ;gBAChB,MAAM;gBACN,QAAQ,EAAE,cAAc;gBACxB,UAAU;gBACV,MAAM;gBACN,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC7B;gBACD,OAAO;aACR,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CACZ,MAAwB,EACxB,QAAwB,EACxB,YAA2B;QAE3B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;YACvC,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAChB,OAAiB,EACjB,gBAAiC;IAEjC,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,OAAO;QACP,MAAM,EAAE;YACN,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,oBAAoB;YAC7B,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE;YACX,gBAAgB,EACd,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,IAAI,0BAA0B;YAC9E,eAAe,EAAE,gBAAgB,EAAE,WAAW,CAAC,eAAe,IAAI,CAAC;YACnE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,YAAY,IAAI,EAAE;SAC/D;KACF,CAAC;AACJ,CAAC;AAOD,SAAS,uBAAuB,CAAC,MAA2B;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,yBAAyB,EAAE,CAAC;QACpF,OAAO;YACL,gBAAgB,EAAE,MAAM;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAwB;IAC7C,OAAO;QACL,GAAG,QAAQ;QACX,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;AAClE,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC;QACX,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAClB,KAA+B,EAC/B,SAAiB;IAEjB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,SAAS,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAC9B,CAAC,MAAM,EAAE,EAAE;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@axtary/proxy",
+  "version": "0.0.1",
+  "private": false,
+  "description": "Local fail-closed runtime proxy for Axtary policy, ActionPass issuance, and ledger recording.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/axtary/axtary.git",
+    "directory": "packages/proxy"
+  },
+  "keywords": [
+    "ai-agents",
+    "authorization",
+    "runtime-security",
+    "proxy",
+    "mcp"
+  ],
+  "engines": {
+    "node": "^20.19.0 || ^22.13.0 || >=24"
+  },
+  "scripts": {
+    "prebuild": "npm run build -w @axtary/actionpass && npm run build -w @axtary/policy && npm run build -w @axtary/ledger",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "clean": "rm -rf dist",
+    "prepack": "npm run build"
+  },
+  "files": [
+    "README.md",
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@axtary/actionpass": "0.0.1",
+    "@axtary/ledger": "0.0.1",
+    "@axtary/policy": "0.0.1"
+  }
+}