@axtary/proxy 0.0.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/README.md +85 -2
- package/dist/index.d.ts +119 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +788 -20
- package/dist/index.js.map +1 -1
- package/package.json +6 -8
package/LICENSE
ADDED
|
@@ -0,0 +1,202 @@
|
|
|
1
|
+
|
|
2
|
+
Apache License
|
|
3
|
+
Version 2.0, January 2004
|
|
4
|
+
http://www.apache.org/licenses/
|
|
5
|
+
|
|
6
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
7
|
+
|
|
8
|
+
1. Definitions.
|
|
9
|
+
|
|
10
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
11
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
12
|
+
|
|
13
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
14
|
+
the copyright owner that is granting the License.
|
|
15
|
+
|
|
16
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
17
|
+
other entities that control, are controlled by, or are under common
|
|
18
|
+
control with that entity. For the purposes of this definition,
|
|
19
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
20
|
+
direction or management of such entity, whether by contract or
|
|
21
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
22
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
23
|
+
|
|
24
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
25
|
+
exercising permissions granted by this License.
|
|
26
|
+
|
|
27
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
28
|
+
including but not limited to software source code, documentation
|
|
29
|
+
source, and configuration files.
|
|
30
|
+
|
|
31
|
+
"Object" form shall mean any form resulting from mechanical
|
|
32
|
+
transformation or translation of a Source form, including but
|
|
33
|
+
not limited to compiled object code, generated documentation,
|
|
34
|
+
and conversions to other media types.
|
|
35
|
+
|
|
36
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
37
|
+
Object form, made available under the License, as indicated by a
|
|
38
|
+
copyright notice that is included in or attached to the work
|
|
39
|
+
(an example is provided in the Appendix below).
|
|
40
|
+
|
|
41
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
42
|
+
form, that is based on (or derived from) the Work and for which the
|
|
43
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
44
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
45
|
+
of this License, Derivative Works shall not include works that remain
|
|
46
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
47
|
+
the Work and Derivative Works thereof.
|
|
48
|
+
|
|
49
|
+
"Contribution" shall mean any work of authorship, including
|
|
50
|
+
the original version of the Work and any modifications or additions
|
|
51
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
52
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
53
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
54
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
55
|
+
means any form of electronic, verbal, or written communication sent
|
|
56
|
+
to the Licensor or its representatives, including but not limited to
|
|
57
|
+
communication on electronic mailing lists, source code control systems,
|
|
58
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
59
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
60
|
+
excluding communication that is conspicuously marked or otherwise
|
|
61
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
62
|
+
|
|
63
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
64
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
65
|
+
subsequently incorporated within the Work.
|
|
66
|
+
|
|
67
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
68
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
69
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
70
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
71
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
72
|
+
Work and such Derivative Works in Source or Object form.
|
|
73
|
+
|
|
74
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
75
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
76
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
77
|
+
(except as stated in this section) patent license to make, have made,
|
|
78
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
79
|
+
where such license applies only to those patent claims licensable
|
|
80
|
+
by such Contributor that are necessarily infringed by their
|
|
81
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
82
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
83
|
+
institute patent litigation against any entity (including a
|
|
84
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
85
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
86
|
+
or contributory patent infringement, then any patent licenses
|
|
87
|
+
granted to You under this License for that Work shall terminate
|
|
88
|
+
as of the date such litigation is filed.
|
|
89
|
+
|
|
90
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
91
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
92
|
+
modifications, and in Source or Object form, provided that You
|
|
93
|
+
meet the following conditions:
|
|
94
|
+
|
|
95
|
+
(a) You must give any other recipients of the Work or
|
|
96
|
+
Derivative Works a copy of this License; and
|
|
97
|
+
|
|
98
|
+
(b) You must cause any modified files to carry prominent notices
|
|
99
|
+
stating that You changed the files; and
|
|
100
|
+
|
|
101
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
102
|
+
that You distribute, all copyright, patent, trademark, and
|
|
103
|
+
attribution notices from the Source form of the Work,
|
|
104
|
+
excluding those notices that do not pertain to any part of
|
|
105
|
+
the Derivative Works; and
|
|
106
|
+
|
|
107
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
108
|
+
distribution, then any Derivative Works that You distribute must
|
|
109
|
+
include a readable copy of the attribution notices contained
|
|
110
|
+
within such NOTICE file, excluding those notices that do not
|
|
111
|
+
pertain to any part of the Derivative Works, in at least one
|
|
112
|
+
of the following places: within a NOTICE text file distributed
|
|
113
|
+
as part of the Derivative Works; within the Source form or
|
|
114
|
+
documentation, if provided along with the Derivative Works; or,
|
|
115
|
+
within a display generated by the Derivative Works, if and
|
|
116
|
+
wherever such third-party notices normally appear. The contents
|
|
117
|
+
of the NOTICE file are for informational purposes only and
|
|
118
|
+
do not modify the License. You may add Your own attribution
|
|
119
|
+
notices within Derivative Works that You distribute, alongside
|
|
120
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
121
|
+
that such additional attribution notices cannot be construed
|
|
122
|
+
as modifying the License.
|
|
123
|
+
|
|
124
|
+
You may add Your own copyright statement to Your modifications and
|
|
125
|
+
may provide additional or different license terms and conditions
|
|
126
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
127
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
128
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
129
|
+
the conditions stated in this License.
|
|
130
|
+
|
|
131
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
132
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
133
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
134
|
+
this License, without any additional terms or conditions.
|
|
135
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
136
|
+
the terms of any separate license agreement you may have executed
|
|
137
|
+
with Licensor regarding such Contributions.
|
|
138
|
+
|
|
139
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
140
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
141
|
+
except as required for reasonable and customary use in describing the
|
|
142
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
143
|
+
|
|
144
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
145
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
146
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
147
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
148
|
+
implied, including, without limitation, any warranties or conditions
|
|
149
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
150
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
151
|
+
appropriateness of using or redistributing the Work and assume any
|
|
152
|
+
risks associated with Your exercise of permissions under this License.
|
|
153
|
+
|
|
154
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
155
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
156
|
+
unless required by applicable law (such as deliberate and grossly
|
|
157
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
158
|
+
liable to You for damages, including any direct, indirect, special,
|
|
159
|
+
incidental, or consequential damages of any character arising as a
|
|
160
|
+
result of this License or out of the use or inability to use the
|
|
161
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
162
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
163
|
+
other commercial damages or losses), even if such Contributor
|
|
164
|
+
has been advised of the possibility of such damages.
|
|
165
|
+
|
|
166
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
167
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
168
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
169
|
+
or other liability obligations and/or rights consistent with this
|
|
170
|
+
License. However, in accepting such obligations, You may act only
|
|
171
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
172
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
173
|
+
defend, and hold each Contributor harmless for any liability
|
|
174
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
175
|
+
of your accepting any such warranty or additional liability.
|
|
176
|
+
|
|
177
|
+
END OF TERMS AND CONDITIONS
|
|
178
|
+
|
|
179
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
180
|
+
|
|
181
|
+
To apply the Apache License to your work, attach the following
|
|
182
|
+
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
183
|
+
replaced with your own identifying information. (Don't include
|
|
184
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
185
|
+
comment syntax for the file format. We also recommend that a
|
|
186
|
+
file or class name and description of purpose be included on the
|
|
187
|
+
same "printed page" as the copyright notice for easier
|
|
188
|
+
identification within third-party archives.
|
|
189
|
+
|
|
190
|
+
Copyright [yyyy] [name of copyright owner]
|
|
191
|
+
|
|
192
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
193
|
+
you may not use this file except in compliance with the License.
|
|
194
|
+
You may obtain a copy of the License at
|
|
195
|
+
|
|
196
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
197
|
+
|
|
198
|
+
Unless required by applicable law or agreed to in writing, software
|
|
199
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
200
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
201
|
+
See the License for the specific language governing permissions and
|
|
202
|
+
limitations under the License.
|
package/README.md
CHANGED
|
@@ -2,24 +2,80 @@
|
|
|
2
2
|
|
|
3
3
|
Local fail-closed runtime proxy for Axtary policy, ActionPass issuance, and ledger recording.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
Early `0.x` release: the runtime path is real and tested, but the API is not stable yet and may change between minor versions.
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install @axtary/proxy
|
|
9
|
+
```
|
|
6
10
|
|
|
7
11
|
## What It Does
|
|
8
12
|
|
|
9
13
|
- Parses a normalized Axtary action.
|
|
10
14
|
- Evaluates it through `@axtary/policy`.
|
|
15
|
+
- Rejects caller-supplied final provenance labels and can invoke a trusted
|
|
16
|
+
`provenanceResolver` before policy evaluation.
|
|
17
|
+
- Carries authority-stamped field/source lineage through policy, ActionPass,
|
|
18
|
+
handler input, and the hash-chained ledger.
|
|
11
19
|
- Requires ActionPass signing before execution by default.
|
|
20
|
+
- Can issue ActionPass v2 when the host supplies a stable status-reference
|
|
21
|
+
allocator; v2 remains DPoP-bound and delegation-aware.
|
|
12
22
|
- Appends every executable or blocked decision to `@axtary/ledger`.
|
|
13
23
|
- Executes only registered handlers for allowed tools.
|
|
14
24
|
- Can resolve exact approval evidence for `step_up` decisions before issuing a pass.
|
|
25
|
+
- Atomically reserves trusted per-tool budget before pass issuance, commits on
|
|
26
|
+
success, rolls back on failure, and denies `budget_exceeded`.
|
|
15
27
|
- Returns structured blocked, executed, failed, and malformed results.
|
|
16
|
-
- Returns per-stage timings for parse, policy,
|
|
28
|
+
- Returns per-stage timings for parse, policy, budget reservation, ActionPass
|
|
29
|
+
issuance, ledger append, handler execution, the completed authorization
|
|
30
|
+
decision, and total latency.
|
|
17
31
|
- Accepts either a static policy object or an async policy getter for hot-reloaded local configs.
|
|
18
32
|
|
|
33
|
+
## Quickstart
|
|
34
|
+
|
|
35
|
+
This example runs as-is with Node 20+:
|
|
36
|
+
|
|
37
|
+
```ts
|
|
38
|
+
import { createProxyRuntime } from "@axtary/proxy";
|
|
39
|
+
import { createFakeHandlers } from "@axtary/adapters";
|
|
40
|
+
import { LocalJsonlLedger } from "@axtary/ledger";
|
|
41
|
+
import { demoAction } from "@axtary/actionpass";
|
|
42
|
+
|
|
43
|
+
const proxy = createProxyRuntime({
|
|
44
|
+
issuer: "https://axtary.local",
|
|
45
|
+
tenant: "org:example",
|
|
46
|
+
ledger: new LocalJsonlLedger(".axtary/ledger.jsonl"),
|
|
47
|
+
handlers: createFakeHandlers(),
|
|
48
|
+
budget: {
|
|
49
|
+
enabled: true,
|
|
50
|
+
scope: "tenant",
|
|
51
|
+
limits: { actions: 100, externalMessages: 10 },
|
|
52
|
+
costs: {
|
|
53
|
+
"*": { actions: 1 },
|
|
54
|
+
"slack.chat.postMessage": { externalMessages: 1 },
|
|
55
|
+
},
|
|
56
|
+
},
|
|
57
|
+
allowUnsignedExecution: true, // local demo only; real runs sign every pass
|
|
58
|
+
});
|
|
59
|
+
|
|
60
|
+
// A PR inside policy with passing tests: decision, ledger write, then handler.
|
|
61
|
+
const safeAction = structuredClone(demoAction);
|
|
62
|
+
safeAction.capability.payload.testsPassed = true;
|
|
63
|
+
console.log((await proxy.handle(safeAction)).status); // executed
|
|
64
|
+
|
|
65
|
+
// The same PR without test evidence requires step-up; with no approval
|
|
66
|
+
// resolver attached, the proxy blocks before the handler is ever called.
|
|
67
|
+
console.log((await proxy.handle(demoAction)).status); // blocked
|
|
68
|
+
```
|
|
69
|
+
|
|
19
70
|
## Design Notes
|
|
20
71
|
|
|
21
72
|
The proxy is the first runtime enforcement surface. It is intentionally local and deterministic. Real adapters register handlers and let the proxy own the decision, pass issuance, and ledger write before any production tool is touched.
|
|
22
73
|
|
|
74
|
+
The runtime package does not choose key custody or status transport. The CLI
|
|
75
|
+
host provides the persisted issuer keyring, public JWKS/status endpoints, and
|
|
76
|
+
status allocator; embedders may provide equivalent infrastructure through the
|
|
77
|
+
same `signingKey`, `keyId`, and `statusReference` seams.
|
|
78
|
+
|
|
23
79
|
Unsigned execution is possible only with `allowUnsignedExecution: true`, which is meant for dry-run tests and local demos.
|
|
24
80
|
|
|
25
81
|
Handlers are bounded by `handlerTimeoutMs` from config. Timeout failures are recorded as failed executions after the allow decision is ledgered, which keeps the authorization trace intact without letting slow providers stall the runtime.
|
|
@@ -27,3 +83,30 @@ Handlers are bounded by `handlerTimeoutMs` from config. Timeout failures are rec
|
|
|
27
83
|
When a dynamic policy getter fails, the proxy fails closed, records a deny decision in the ledger, and does not call the downstream handler. That preserves the audit trail while avoiding stale or partially parsed policy.
|
|
28
84
|
|
|
29
85
|
`approvalResolver` is the local bridge to hosted or local approval queues. It receives the normalized action and `step_up` policy decision, and may return a payload-bound approval artifact. If resolution fails, returns nothing, or the artifact does not bind to the exact action, the proxy blocks before handler execution.
|
|
86
|
+
|
|
87
|
+
`provenanceResolver` is an authority boundary, like the budget meter. Agent
|
|
88
|
+
actions cannot supply final integrity labels. A trusted host may attach exact
|
|
89
|
+
`axtary.provenance.v0` field/source bindings before policy; resolver failures
|
|
90
|
+
fail closed as malformed input and produce no misleading decision record.
|
|
91
|
+
|
|
92
|
+
Budget limits and costs are trusted runtime configuration. Agent actions cannot
|
|
93
|
+
supply reservation state. Pending reservations count against limits, committed
|
|
94
|
+
usage is reconstructed from the local ledger after restart, and expired
|
|
95
|
+
crash-era pending reservations are released during reconstruction. The meter
|
|
96
|
+
records usage units only; it does not price or bill them.
|
|
97
|
+
|
|
98
|
+
## Timing contract
|
|
99
|
+
|
|
100
|
+
`ProxyTimings.decisionMs` measures from receipt of a valid action through
|
|
101
|
+
parsing, deterministic policy evaluation, local budget reservation, ActionPass
|
|
102
|
+
issuance, and the crash-durable decision-ledger append. For `authorize()`,
|
|
103
|
+
`totalMs` equals `decisionMs`. For `handle()`, `totalMs` continues through the
|
|
104
|
+
provider handler and execution-outcome append, while `decisionMs` stops before
|
|
105
|
+
the handler is invoked.
|
|
106
|
+
|
|
107
|
+
The repository regression suite asserts that the p95 signed local
|
|
108
|
+
`authorize()` decision stays below
|
|
109
|
+
`LOCAL_AUTHORIZATION_DECISION_BUDGET_MS` (200ms) while appending to a seeded
|
|
110
|
+
10,000-record local ledger. Human approval waits, remote provider execution,
|
|
111
|
+
and optional remote dashboard sync are outside that deterministic local
|
|
112
|
+
decision budget.
|
package/dist/index.d.ts
CHANGED
|
@@ -1,14 +1,82 @@
|
|
|
1
|
-
import { type Approval, type ApprovalArtifact, type IssueActionPassResult, type JsonValue, type LedgerRecord, type NormalizedAction, type PolicyDecision, type SigningAlgorithm, type SigningKey } from "@axtary/actionpass";
|
|
2
|
-
import type {
|
|
3
|
-
import {
|
|
1
|
+
import { type ActionProvenance, type Approval, type ApprovalArtifact, type BudgetAmount, type BudgetLedgerEvent, type IssueActionPassResult, type JsonValue, type LedgerRecord, type NormalizedAction, type PolicyDecision, type SigningAlgorithm, type SigningKey, type StatusListReference } from "@axtary/actionpass";
|
|
2
|
+
import type { JWK } from "jose";
|
|
3
|
+
import type { BehaviorStore, LedgerAppendResult, LocalJsonlLedger } from "@axtary/ledger";
|
|
4
|
+
import { type PolicyConfigPatch } from "@axtary/policy";
|
|
4
5
|
export declare const PROXY_SCHEMA_VERSION = "axtary.proxy.v0";
|
|
5
6
|
export declare const PROXY_POLICY_VERSION = "2026-05-30";
|
|
6
7
|
export declare const DEFAULT_HANDLER_TIMEOUT_MS = 10000;
|
|
7
|
-
export
|
|
8
|
+
export declare const LOCAL_AUTHORIZATION_DECISION_BUDGET_MS = 200;
|
|
9
|
+
export type ProxyBudgetScope = "tenant" | "actor" | "task";
|
|
10
|
+
export type ProxyBudgetConfig = {
|
|
11
|
+
enabled: boolean;
|
|
12
|
+
scope: ProxyBudgetScope;
|
|
13
|
+
limits: BudgetAmount;
|
|
14
|
+
costs: Readonly<Record<string, BudgetAmount>>;
|
|
15
|
+
};
|
|
16
|
+
export type BudgetReservation = {
|
|
17
|
+
reservationId: string;
|
|
18
|
+
scope: string;
|
|
19
|
+
cost: BudgetAmount;
|
|
20
|
+
limit: BudgetAmount;
|
|
21
|
+
};
|
|
22
|
+
export type BudgetReserveResult = {
|
|
23
|
+
accepted: true;
|
|
24
|
+
reservation: BudgetReservation;
|
|
25
|
+
event: BudgetLedgerEvent;
|
|
26
|
+
} | {
|
|
27
|
+
accepted: false;
|
|
28
|
+
event: BudgetLedgerEvent;
|
|
29
|
+
};
|
|
30
|
+
export type BudgetMeter = {
|
|
31
|
+
reserve(input: {
|
|
32
|
+
scope: string;
|
|
33
|
+
cost: BudgetAmount;
|
|
34
|
+
limit: BudgetAmount;
|
|
35
|
+
now: Date;
|
|
36
|
+
expiresAt: Date;
|
|
37
|
+
}): BudgetReserveResult | Promise<BudgetReserveResult>;
|
|
38
|
+
commit(reservationId: string): BudgetLedgerEvent | Promise<BudgetLedgerEvent>;
|
|
39
|
+
rollback(reservationId: string): BudgetLedgerEvent | Promise<BudgetLedgerEvent>;
|
|
40
|
+
};
|
|
41
|
+
export declare class InMemoryBudgetMeter implements BudgetMeter {
|
|
42
|
+
private readonly committed;
|
|
43
|
+
private readonly reservations;
|
|
44
|
+
reserve(input: {
|
|
45
|
+
scope: string;
|
|
46
|
+
cost: BudgetAmount;
|
|
47
|
+
limit: BudgetAmount;
|
|
48
|
+
now: Date;
|
|
49
|
+
expiresAt: Date;
|
|
50
|
+
}): BudgetReserveResult;
|
|
51
|
+
commit(reservationId: string): BudgetLedgerEvent;
|
|
52
|
+
rollback(reservationId: string): BudgetLedgerEvent;
|
|
53
|
+
hydrate(events: BudgetLedgerEvent[], now?: Date): void;
|
|
54
|
+
private pendingReservation;
|
|
55
|
+
private pendingForScope;
|
|
56
|
+
}
|
|
57
|
+
export declare class LedgerBackedBudgetMeter implements BudgetMeter {
|
|
58
|
+
private readonly ledger;
|
|
59
|
+
private initialization;
|
|
60
|
+
private readonly meter;
|
|
61
|
+
constructor(ledger: ProxyLedger);
|
|
62
|
+
reserve(input: {
|
|
63
|
+
scope: string;
|
|
64
|
+
cost: BudgetAmount;
|
|
65
|
+
limit: BudgetAmount;
|
|
66
|
+
now: Date;
|
|
67
|
+
expiresAt: Date;
|
|
68
|
+
}): Promise<BudgetReserveResult>;
|
|
69
|
+
commit(reservationId: string): Promise<BudgetLedgerEvent>;
|
|
70
|
+
rollback(reservationId: string): Promise<BudgetLedgerEvent>;
|
|
71
|
+
private initialize;
|
|
72
|
+
}
|
|
73
|
+
export type ProxyLedger = Pick<LocalJsonlLedger, "appendDecision" | "appendExecutionOutcome" | "readRecords">;
|
|
8
74
|
export type ProxyTimings = {
|
|
9
75
|
totalMs: number;
|
|
76
|
+
decisionMs: number;
|
|
10
77
|
parseMs: number;
|
|
11
78
|
policyMs: number;
|
|
79
|
+
budgetMs: number;
|
|
12
80
|
actionPassMs: number;
|
|
13
81
|
ledgerMs: number;
|
|
14
82
|
approvalMs: number;
|
|
@@ -18,6 +86,7 @@ export type ToolHandlerRequest = {
|
|
|
18
86
|
action: NormalizedAction;
|
|
19
87
|
decision: PolicyDecision;
|
|
20
88
|
actionPass: IssueActionPassResult | null;
|
|
89
|
+
dpopProof?: string | null;
|
|
21
90
|
ledgerRecord: LedgerRecord;
|
|
22
91
|
};
|
|
23
92
|
export type ToolHandler = (request: ToolHandlerRequest) => JsonValue | Promise<JsonValue>;
|
|
@@ -30,16 +99,31 @@ export type ProxyApprovalResult = Approval | ApprovalArtifact | {
|
|
|
30
99
|
approvalArtifact?: ApprovalArtifact;
|
|
31
100
|
} | null | undefined;
|
|
32
101
|
export type ProxyApprovalResolver = (request: ProxyApprovalRequest) => ProxyApprovalResult | Promise<ProxyApprovalResult>;
|
|
102
|
+
export type ProxyProvenanceResolver = (action: NormalizedAction) => ActionProvenance | Promise<ActionProvenance>;
|
|
33
103
|
export type ProxyRuntimeConfig = {
|
|
34
104
|
issuer: string;
|
|
35
105
|
tenant: string;
|
|
36
106
|
ledger: ProxyLedger;
|
|
37
107
|
handlers?: Readonly<Record<string, ToolHandler>>;
|
|
38
|
-
policy?:
|
|
108
|
+
policy?: PolicyConfigPatch | (() => PolicyConfigPatch | Promise<PolicyConfigPatch>);
|
|
39
109
|
signingKey?: SigningKey;
|
|
40
110
|
keyId?: string;
|
|
41
111
|
algorithm?: SigningAlgorithm;
|
|
112
|
+
holderSigningKey?: SigningKey;
|
|
113
|
+
holderPublicJwk?: JWK;
|
|
114
|
+
holderAlgorithm?: SigningAlgorithm;
|
|
115
|
+
statusReference?: (passId: string) => StatusListReference | Promise<StatusListReference>;
|
|
116
|
+
dpopNonce?: string;
|
|
117
|
+
budget?: Partial<ProxyBudgetConfig>;
|
|
118
|
+
budgetMeter?: BudgetMeter;
|
|
42
119
|
approvalResolver?: ProxyApprovalResolver;
|
|
120
|
+
provenanceResolver?: ProxyProvenanceResolver;
|
|
121
|
+
/**
|
|
122
|
+
* Durable behavioral observation store (M5.6). When set and the
|
|
123
|
+
* `policy.behavior` guard is enabled, novel/abnormal-sequence actions are
|
|
124
|
+
* escalated to `step_up`; executed actions are recorded so they become known.
|
|
125
|
+
*/
|
|
126
|
+
behaviorStore?: BehaviorStore;
|
|
43
127
|
allowUnsignedExecution?: boolean;
|
|
44
128
|
handlerTimeoutMs?: number;
|
|
45
129
|
now?: () => Date;
|
|
@@ -67,6 +151,7 @@ export type ProxyExecutedResult = {
|
|
|
67
151
|
decision: PolicyDecision;
|
|
68
152
|
actionPass: IssueActionPassResult | null;
|
|
69
153
|
ledger: LedgerAppendResult;
|
|
154
|
+
executionLedger: LedgerAppendResult;
|
|
70
155
|
result: JsonValue;
|
|
71
156
|
timings: ProxyTimings;
|
|
72
157
|
};
|
|
@@ -77,18 +162,47 @@ export type ProxyFailedResult = {
|
|
|
77
162
|
decision: PolicyDecision;
|
|
78
163
|
actionPass: IssueActionPassResult | null;
|
|
79
164
|
ledger: LedgerAppendResult;
|
|
165
|
+
executionLedger: LedgerAppendResult;
|
|
80
166
|
error: {
|
|
81
167
|
reason: string;
|
|
82
168
|
};
|
|
83
169
|
timings: ProxyTimings;
|
|
84
170
|
};
|
|
85
171
|
export type ProxyHandleResult = ProxyMalformedResult | ProxyBlockedResult | ProxyExecutedResult | ProxyFailedResult;
|
|
172
|
+
export type ProxyAuthorizeDecisionResult = {
|
|
173
|
+
schemaVersion: typeof PROXY_SCHEMA_VERSION;
|
|
174
|
+
status: "authorized" | "step_up" | "blocked";
|
|
175
|
+
action: NormalizedAction;
|
|
176
|
+
decision: PolicyDecision;
|
|
177
|
+
actionPass: IssueActionPassResult | null;
|
|
178
|
+
ledger: LedgerAppendResult;
|
|
179
|
+
timings: ProxyTimings;
|
|
180
|
+
};
|
|
181
|
+
export type ProxyAuthorizeResult = ProxyMalformedResult | ProxyAuthorizeDecisionResult;
|
|
86
182
|
export declare class AxtaryProxyRuntime {
|
|
87
183
|
readonly config: ProxyRuntimeConfig;
|
|
184
|
+
private readonly rateLimitEvents;
|
|
185
|
+
private readonly budgetMeter;
|
|
186
|
+
private readonly budgetConfig;
|
|
88
187
|
constructor(config: ProxyRuntimeConfig);
|
|
89
188
|
handle(actionInput: unknown): Promise<ProxyHandleResult>;
|
|
189
|
+
authorize(actionInput: unknown): Promise<ProxyAuthorizeResult>;
|
|
90
190
|
private append;
|
|
191
|
+
private appendExecutionOutcome;
|
|
91
192
|
private now;
|
|
193
|
+
private reserveBudget;
|
|
194
|
+
private createProof;
|
|
195
|
+
private policyEvaluationContext;
|
|
196
|
+
/**
|
|
197
|
+
* Read novelty/sequence signals from the durable store for this action. Pure
|
|
198
|
+
* read — no mutation; the action only becomes "known" after it executes (see
|
|
199
|
+
* `observeBehavior`). Returns undefined when no store is configured, leaving
|
|
200
|
+
* the behavior guard inert.
|
|
201
|
+
*/
|
|
202
|
+
private behaviorSignals;
|
|
203
|
+
/** Record an executed action so its combo/transition becomes known. */
|
|
204
|
+
private observeBehavior;
|
|
205
|
+
private consumeRateLimit;
|
|
92
206
|
}
|
|
93
207
|
export declare function createProxyRuntime(config: ProxyRuntimeConfig): AxtaryProxyRuntime;
|
|
94
208
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EAGd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AACtD,eAAO,MAAM,oBAAoB,eAAe,CAAC;AACjD,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GACD;IACE,QAAQ,EAAE,KAAK,CAAC;IAChB,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEN,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,GAAG,EAAE,IAAI,CAAC;QACV,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACjF,CAAC;AAOF,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;IAEpE,OAAO,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,GAAG,EAAE,IAAI,CAAC;QACV,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,mBAAmB;IAoEvB,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB;IAuBhD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB;IAkBlD,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,OAAa,GAAG,IAAI;IAiC5D,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,eAAe;CASxB;AAED,qBAAa,uBAAwB,YAAW,WAAW;IAI7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;gBAEtB,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,KAAK,EAAE;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,YAAY,CAAC;QACpB,GAAG,EAAE,IAAI,CAAC;QACV,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK1B,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAKzD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAKjE,OAAO,CAAC,UAAU;CASnB;AAED,MAAM,MAAM,WAAW,GAAG,IAAI,CAC5B,gBAAgB,EAChB,gBAAgB,GAAG,wBAAwB,GAAG,aAAa,CAC5D,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,kBAAkB,KACxB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,gBAAgB,GAChB;IACE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC,GACD,IAAI,GACJ,SAAS,CAAC;AAEd,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,oBAAoB,KAC1B,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExD,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,gBAAgB,KACrB,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAElD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,EACH,iBAAiB,GACjB,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAC9B,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,MAAM,KACX,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC;IAC7C;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,kBAAkB,CAAC;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,eAAe,EAAE,kBAAkB,CAAC;IACpC,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,oBAAoB,GACpB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,4BAA4B,GAAG;IACzC,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IAC7C,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG,4BAA4B,CAAC;AAEvF,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;gBAErC,MAAM,EAAE,kBAAkB;IAOhC,MAAM,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA8XxD,SAAS,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwKpE,OAAO,CAAC,MAAM;IAed,OAAO,CAAC,sBAAsB;IAqB9B,OAAO,CAAC,GAAG;YAIG,aAAa;YA6Bb,WAAW;IAsBzB,OAAO,CAAC,uBAAuB;IA0B/B;;;;;OAKG;YACW,eAAe;IAO7B,uEAAuE;YACzD,eAAe;IAK7B,OAAO,CAAC,gBAAgB;CAczB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,kBAAkB,CAEjF"}
|