@axtary/proxy 0.0.1 → 0.2.0

package/dist/index.js

@@ -1,13 +1,196 @@
-import { APPROVAL_ARTIFACT_VERSION, DEFAULT_EXPIRES_IN_SECONDS, issueActionPass, parseNormalizedAction, } from "@axtary/actionpass";
-import { evaluatePolicy } from "@axtary/policy";
+import { APPROVAL_ARTIFACT_VERSION, ActionProvenanceSchema, actionPassDpopTarget, BudgetAmountSchema, createDpopProof, DEFAULT_EXPIRES_IN_SECONDS, issueActionPass, issueActionPassV1, issueActionPassV2, parseNormalizedAction, } from "@axtary/actionpass";
+import { randomUUID } from "node:crypto";
+import { evaluatePolicy, PolicyConfigSchema, } from "@axtary/policy";
 import { performance } from "node:perf_hooks";
 export const PROXY_SCHEMA_VERSION = "axtary.proxy.v0";
 export const PROXY_POLICY_VERSION = "2026-05-30";
 export const DEFAULT_HANDLER_TIMEOUT_MS = 10_000;
+export const LOCAL_AUTHORIZATION_DECISION_BUDGET_MS = 200;
+export class InMemoryBudgetMeter {
+    committed = new Map();
+    reservations = new Map();
+    reserve(input) {
+        const cost = normalizeBudgetAmount(input.cost);
+        const limit = normalizeBudgetAmount(input.limit);
+        const committedBefore = this.committed.get(input.scope) ?? {};
+        const pendingBefore = this.pendingForScope(input.scope);
+        const dimensions = new Set([
+            ...Object.keys(cost),
+            ...Object.keys(limit),
+            ...Object.keys(committedBefore),
+            ...Object.keys(pendingBefore),
+        ]);
+        const exceeded = [...dimensions].some((dimension) => {
+            const requested = cost[dimension] ?? 0;
+            if (requested === 0)
+                return false;
+            const ceiling = limit[dimension];
+            return (ceiling === undefined ||
+                (committedBefore[dimension] ?? 0) +
+                    (pendingBefore[dimension] ?? 0) +
+                    requested >
+                    ceiling);
+        });
+        if (exceeded) {
+            return {
+                accepted: false,
+                event: {
+                    reservationId: null,
+                    scope: input.scope,
+                    status: "denied",
+                    expiresAt: null,
+                    cost,
+                    limit,
+                    committedBefore,
+                    committedAfter: committedBefore,
+                    reservedAfter: pendingBefore,
+                },
+            };
+        }
+        const reservation = {
+            reservationId: `budget_${randomUUID()}`,
+            scope: input.scope,
+            cost,
+            limit,
+            status: "pending",
+            expiresAt: input.expiresAt,
+        };
+        this.reservations.set(reservation.reservationId, reservation);
+        return {
+            accepted: true,
+            reservation,
+            event: {
+                reservationId: reservation.reservationId,
+                scope: input.scope,
+                status: "pending",
+                expiresAt: input.expiresAt.toISOString(),
+                cost,
+                limit,
+                committedBefore,
+                committedAfter: committedBefore,
+                reservedAfter: addBudgetAmounts(pendingBefore, cost),
+            },
+        };
+    }
+    commit(reservationId) {
+        const reservation = this.pendingReservation(reservationId);
+        const committedBefore = this.committed.get(reservation.scope) ?? {};
+        const committedAfter = addBudgetAmounts(committedBefore, reservation.cost);
+        reservation.status = "committed";
+        this.committed.set(reservation.scope, committedAfter);
+        return {
+            reservationId,
+            scope: reservation.scope,
+            status: "committed",
+            expiresAt: reservation.expiresAt.toISOString(),
+            cost: reservation.cost,
+            limit: reservation.limit,
+            committedBefore,
+            committedAfter,
+            reservedAfter: this.pendingForScope(reservation.scope),
+        };
+    }
+    rollback(reservationId) {
+        const reservation = this.pendingReservation(reservationId);
+        const committed = this.committed.get(reservation.scope) ?? {};
+        reservation.status = "rolled_back";
+        return {
+            reservationId,
+            scope: reservation.scope,
+            status: "rolled_back",
+            expiresAt: reservation.expiresAt.toISOString(),
+            cost: reservation.cost,
+            limit: reservation.limit,
+            committedBefore: committed,
+            committedAfter: committed,
+            reservedAfter: this.pendingForScope(reservation.scope),
+        };
+    }
+    hydrate(events, now = new Date()) {
+        for (const event of events) {
+            if (!event.reservationId || !event.expiresAt)
+                continue;
+            const existing = this.reservations.get(event.reservationId);
+            if (event.status === "pending") {
+                this.reservations.set(event.reservationId, {
+                    reservationId: event.reservationId,
+                    scope: event.scope,
+                    cost: event.cost,
+                    limit: event.limit,
+                    status: new Date(event.expiresAt).getTime() <= now.getTime()
+                        ? "rolled_back"
+                        : "pending",
+                    expiresAt: new Date(event.expiresAt),
+                });
+            }
+            else if (event.status === "committed") {
+                if (!existing || existing.status !== "committed") {
+                    this.committed.set(event.scope, addBudgetAmounts(this.committed.get(event.scope) ?? {}, event.cost));
+                }
+                if (existing)
+                    existing.status = "committed";
+            }
+            else if (event.status === "rolled_back" && existing) {
+                existing.status = "rolled_back";
+            }
+        }
+    }
+    pendingReservation(reservationId) {
+        const reservation = this.reservations.get(reservationId);
+        if (!reservation) {
+            throw new Error("budget_reservation_not_found");
+        }
+        if (reservation.status !== "pending") {
+            throw new Error("budget_reservation_already_settled");
+        }
+        return reservation;
+    }
+    pendingForScope(scope) {
+        let pending = {};
+        for (const reservation of this.reservations.values()) {
+            if (reservation.scope === scope && reservation.status === "pending") {
+                pending = addBudgetAmounts(pending, reservation.cost);
+            }
+        }
+        return pending;
+    }
+}
+export class LedgerBackedBudgetMeter {
+    ledger;
+    initialization = null;
+    meter = new InMemoryBudgetMeter();
+    constructor(ledger) {
+        this.ledger = ledger;
+    }
+    async reserve(input) {
+        await this.initialize(input.now);
+        return this.meter.reserve(input);
+    }
+    async commit(reservationId) {
+        await this.initialize(new Date());
+        return this.meter.commit(reservationId);
+    }
+    async rollback(reservationId) {
+        await this.initialize(new Date());
+        return this.meter.rollback(reservationId);
+    }
+    initialize(now) {
+        this.initialization ??= this.ledger.readRecords().then((records) => {
+            this.meter.hydrate(records.flatMap((record) => (record.budget ? [record.budget] : [])), now);
+        });
+        return this.initialization;
+    }
+}
 export class AxtaryProxyRuntime {
     config;
+    rateLimitEvents = new Map();
+    budgetMeter;
+    budgetConfig;
     constructor(config) {
         this.config = config;
+        this.budgetConfig = normalizeProxyBudgetConfig(config.budget);
+        this.budgetMeter =
+            config.budgetMeter ?? new LedgerBackedBudgetMeter(config.ledger);
     }
     async handle(actionInput) {
         const startedAt = performance.now();
@@ -16,6 +199,15 @@ export class AxtaryProxyRuntime {
         try {
             const parseStartedAt = performance.now();
             action = parseNormalizedAction(actionInput);
+            if (action.budget) {
+                throw new Error("budget_authority_fields_forbidden");
+            }
+            if (action.provenance) {
+                throw new Error("provenance_authority_fields_forbidden");
+            }
+            if (this.config.provenanceResolver) {
+                action = actionWithProvenance(action, await this.config.provenanceResolver(action));
+            }
             timings.parseMs = elapsed(parseStartedAt);
         }
         catch (error) {
@@ -33,7 +225,9 @@ export class AxtaryProxyRuntime {
             const resolvedPolicy = typeof this.config.policy === "function"
                 ? await this.config.policy()
                 : this.config.policy;
-            policyDecision = evaluatePolicy(action, resolvedPolicy);
+            const policy = PolicyConfigSchema.parse(resolvedPolicy ?? {});
+            const behaviorSignals = await this.behaviorSignals(action);
+            policyDecision = evaluatePolicy(action, policy, this.policyEvaluationContext(action, policy, behaviorSignals));
             timings.policyMs = elapsed(policyStartedAt);
         }
         catch (error) {
@@ -42,7 +236,7 @@ export class AxtaryProxyRuntime {
             const ledgerStartedAt = performance.now();
             const ledger = await this.append(action, decision, null);
             timings.ledgerMs = elapsed(ledgerStartedAt);
-            timings.totalMs = elapsed(startedAt);
+            completeDecisionTiming(timings, startedAt);
             return {
                 schemaVersion: PROXY_SCHEMA_VERSION,
                 status: "blocked",
@@ -63,7 +257,7 @@ export class AxtaryProxyRuntime {
                 }));
                 timings.approvalMs = elapsed(approvalStartedAt);
                 if (approvalEvidence.approval || approvalEvidence.approvalArtifact) {
-                    policyDecision = approveStepUp(policyDecision);
+                    policyDecision = approveStepUp(policyDecision, approvalEvidence);
                 }
             }
             catch (error) {
@@ -72,7 +266,7 @@ export class AxtaryProxyRuntime {
                 const ledgerStartedAt = performance.now();
                 const ledger = await this.append(action, decision, null);
                 timings.ledgerMs = elapsed(ledgerStartedAt);
-                timings.totalMs = elapsed(startedAt);
+                completeDecisionTiming(timings, startedAt);
                 return {
                     schemaVersion: PROXY_SCHEMA_VERSION,
                     status: "blocked",
@@ -88,7 +282,7 @@ export class AxtaryProxyRuntime {
             const ledgerStartedAt = performance.now();
             const ledger = await this.append(action, policyDecision, null);
             timings.ledgerMs = elapsed(ledgerStartedAt);
-            timings.totalMs = elapsed(startedAt);
+            completeDecisionTiming(timings, startedAt);
             return {
                 schemaVersion: PROXY_SCHEMA_VERSION,
                 status: "blocked",
@@ -99,13 +293,14 @@ export class AxtaryProxyRuntime {
                 timings,
             };
         }
+        this.consumeRateLimit(action, policyDecision);
         const handler = this.config.handlers?.[action.capability.tool];
         if (!handler) {
             const decision = proxyDeny([`proxy_handler_missing:${action.capability.tool}`], policyDecision);
             const ledgerStartedAt = performance.now();
             const ledger = await this.append(action, decision, null);
             timings.ledgerMs = elapsed(ledgerStartedAt);
-            timings.totalMs = elapsed(startedAt);
+            completeDecisionTiming(timings, startedAt);
             return {
                 schemaVersion: PROXY_SCHEMA_VERSION,
                 status: "blocked",
@@ -121,7 +316,26 @@ export class AxtaryProxyRuntime {
             const ledgerStartedAt = performance.now();
             const ledger = await this.append(action, decision, null);
             timings.ledgerMs = elapsed(ledgerStartedAt);
-            timings.totalMs = elapsed(startedAt);
+            completeDecisionTiming(timings, startedAt);
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "blocked",
+                action,
+                decision,
+                actionPass: null,
+                ledger,
+                timings,
+            };
+        }
+        const budgetStartedAt = performance.now();
+        const budgetReservation = await this.reserveBudget(action, policyDecision.constraints.expiresInSeconds);
+        timings.budgetMs = elapsed(budgetStartedAt);
+        if (budgetReservation && !budgetReservation.accepted) {
+            const decision = proxyDeny(["budget_exceeded"], policyDecision);
+            const ledgerStartedAt = performance.now();
+            const ledger = await this.append(action, decision, null, budgetReservation.event);
+            timings.ledgerMs = elapsed(ledgerStartedAt);
+            completeDecisionTiming(timings, startedAt);
             return {
                 schemaVersion: PROXY_SCHEMA_VERSION,
                 status: "blocked",
@@ -132,11 +346,14 @@ export class AxtaryProxyRuntime {
                 timings,
             };
         }
+        if (budgetReservation?.accepted) {
+            action = actionWithBudget(action, budgetReservation.reservation);
+        }
         let actionPass = null;
         if (this.config.signingKey) {
+            const actionPassStartedAt = performance.now();
             try {
-                const actionPassStartedAt = performance.now();
-                actionPass = await issueActionPass({
+                const issueInput = {
                     action,
                     decision: policyDecision,
                     issuer: this.config.issuer,
@@ -147,15 +364,42 @@ export class AxtaryProxyRuntime {
                     now: this.now(),
                     approval: approvalEvidence.approval,
                     approvalArtifact: approvalEvidence.approvalArtifact,
-                });
+                };
+                if (this.config.holderPublicJwk && this.config.statusReference) {
+                    const passId = `ap_${randomUUID()}`;
+                    actionPass = await issueActionPassV2({
+                        ...issueInput,
+                        passId,
+                        holderPublicJwk: this.config.holderPublicJwk,
+                        status: {
+                            status_list: await this.config.statusReference(passId),
+                        },
+                    });
+                }
+                else if (this.config.holderPublicJwk) {
+                    actionPass = await issueActionPassV1({
+                        ...issueInput,
+                        holderPublicJwk: this.config.holderPublicJwk,
+                    });
+                }
+                else {
+                    actionPass = await issueActionPass(issueInput);
+                }
                 timings.actionPassMs = elapsed(actionPassStartedAt);
             }
-            catch {
-                const decision = proxyDeny(["proxy_actionpass_issue_failed"], policyDecision);
+            catch (error) {
+                timings.actionPassMs = elapsed(actionPassStartedAt);
+                let budgetEvent;
+                if (budgetReservation?.accepted) {
+                    const rollbackStartedAt = performance.now();
+                    budgetEvent = await this.budgetMeter.rollback(budgetReservation.reservation.reservationId);
+                    timings.budgetMs += elapsed(rollbackStartedAt);
+                }
+                const decision = proxyDeny([`proxy_actionpass_issue_failed:${errorToReason(error)}`], policyDecision);
                 const ledgerStartedAt = performance.now();
-                const ledger = await this.append(action, decision, null);
+                const ledger = await this.append(action, decision, null, budgetEvent);
                 timings.ledgerMs = elapsed(ledgerStartedAt);
-                timings.totalMs = elapsed(startedAt);
+                completeDecisionTiming(timings, startedAt);
                 return {
                     schemaVersion: PROXY_SCHEMA_VERSION,
                     status: "blocked",
@@ -168,16 +412,50 @@ export class AxtaryProxyRuntime {
             }
         }
         const ledgerStartedAt = performance.now();
-        const ledger = await this.append(action, policyDecision, actionPass?.claims.jti ?? null);
+        let ledger;
+        try {
+            ledger = await this.append(action, policyDecision, actionPass?.claims.jti ?? null, budgetReservation?.accepted ? budgetReservation.event : undefined);
+        }
+        catch (error) {
+            if (budgetReservation?.accepted) {
+                await this.budgetMeter.rollback(budgetReservation.reservation.reservationId);
+            }
+            throw error;
+        }
         timings.ledgerMs = elapsed(ledgerStartedAt);
+        timings.decisionMs = elapsed(startedAt);
         const handlerStartedAt = performance.now();
+        let budgetSettled = false;
+        let settledBudgetEvent;
         try {
+            const dpopProof = actionPass?.claims.apv === "axtary.actionpass.v1" ||
+                actionPass?.claims.apv === "axtary.actionpass.v2"
+                ? await this.createProof(action, actionPass)
+                : null;
             const result = await withTimeout(handler({
                 action,
                 decision: policyDecision,
                 actionPass,
+                dpopProof,
                 ledgerRecord: ledger.record,
             }), this.config.handlerTimeoutMs ?? DEFAULT_HANDLER_TIMEOUT_MS);
+            const budgetEvent = budgetReservation?.accepted
+                ? await this.budgetMeter.commit(budgetReservation.reservation.reservationId)
+                : undefined;
+            budgetSettled = budgetReservation?.accepted ?? false;
+            settledBudgetEvent = budgetEvent;
+            const executionLedger = await this.appendExecutionOutcome({
+                action,
+                decision: policyDecision,
+                actionPassId: actionPass?.claims.jti ?? null,
+                correlationId: ledger.record.id,
+                traceId: ledger.record.traceId,
+                outcome: outcomeFromResult(action, result),
+                budget: budgetEvent,
+            });
+            // The action actually executed (allowed, or approved step-up), so it is
+            // now "known" — record it for future novelty/sequence evaluation.
+            await this.observeBehavior(action);
             timings.handlerMs = elapsed(handlerStartedAt);
             timings.totalMs = elapsed(startedAt);
             return {
@@ -187,11 +465,25 @@ export class AxtaryProxyRuntime {
                 decision: policyDecision,
                 actionPass,
                 ledger,
+                executionLedger,
                 result,
                 timings,
             };
         }
         catch (error) {
+            const reason = errorToReason(error);
+            const budgetEvent = budgetReservation?.accepted && !budgetSettled
+                ? await this.budgetMeter.rollback(budgetReservation.reservation.reservationId)
+                : settledBudgetEvent;
+            const executionLedger = await this.appendExecutionOutcome({
+                action,
+                decision: policyDecision,
+                actionPassId: actionPass?.claims.jti ?? null,
+                correlationId: ledger.record.id,
+                traceId: ledger.record.traceId,
+                outcome: outcomeFromError(action, reason),
+                budget: budgetEvent,
+            });
             timings.handlerMs = elapsed(handlerStartedAt);
             timings.totalMs = elapsed(startedAt);
             return {
@@ -201,24 +493,250 @@ export class AxtaryProxyRuntime {
                 decision: policyDecision,
                 actionPass,
                 ledger,
+                executionLedger,
                 error: {
-                    reason: errorToReason(error),
+                    reason,
                 },
                 timings,
             };
         }
     }
-    append(action, decision, actionPassId) {
+    async authorize(actionInput) {
+        const startedAt = performance.now();
+        const timings = createTimings();
+        let action;
+        try {
+            const parseStartedAt = performance.now();
+            action = parseNormalizedAction(actionInput);
+            if (action.budget) {
+                throw new Error("budget_authority_fields_forbidden");
+            }
+            if (action.provenance) {
+                throw new Error("provenance_authority_fields_forbidden");
+            }
+            if (this.config.provenanceResolver) {
+                action = actionWithProvenance(action, await this.config.provenanceResolver(action));
+            }
+            timings.parseMs = elapsed(parseStartedAt);
+        }
+        catch (error) {
+            return {
+                schemaVersion: PROXY_SCHEMA_VERSION,
+                status: "malformed",
+                error: {
+                    reason: errorToReason(error),
+                },
+            };
+        }
+        const policyStartedAt = performance.now();
+        let policyDecision;
+        try {
+            const resolvedPolicy = typeof this.config.policy === "function"
+                ? await this.config.policy()
+                : this.config.policy;
+            const policy = PolicyConfigSchema.parse(resolvedPolicy ?? {});
+            const behaviorSignals = await this.behaviorSignals(action);
+            policyDecision = evaluatePolicy(action, policy, this.policyEvaluationContext(action, policy, behaviorSignals));
+            timings.policyMs = elapsed(policyStartedAt);
+        }
+        catch (error) {
+            timings.policyMs = elapsed(policyStartedAt);
+            policyDecision = proxyDeny([
+                `proxy_policy_resolution_failed:${errorToReason(error)}`,
+            ]);
+        }
+        if (policyDecision.decision === "allow" &&
+            !this.config.signingKey &&
+            this.config.allowUnsignedExecution !== true) {
+            policyDecision = proxyDeny(["proxy_signing_key_required"], policyDecision);
+        }
+        const budgetStartedAt = performance.now();
+        const budgetReservation = policyDecision.decision === "allow"
+            ? await this.reserveBudget(action, policyDecision.constraints.expiresInSeconds)
+            : null;
+        timings.budgetMs = elapsed(budgetStartedAt);
+        if (budgetReservation && !budgetReservation.accepted) {
+            policyDecision = proxyDeny(["budget_exceeded"], policyDecision);
+        }
+        if (budgetReservation?.accepted) {
+            action = actionWithBudget(action, budgetReservation.reservation);
+        }
+        let actionPass = null;
+        let budgetEvent = budgetReservation?.event;
+        if (policyDecision.decision === "allow" && this.config.signingKey) {
+            const actionPassStartedAt = performance.now();
+            try {
+                const issueInput = {
+                    action,
+                    decision: policyDecision,
+                    issuer: this.config.issuer,
+                    tenant: this.config.tenant,
+                    signingKey: this.config.signingKey,
+                    keyId: this.config.keyId,
+                    algorithm: this.config.algorithm,
+                    now: this.now(),
+                };
+                if (this.config.holderPublicJwk && this.config.statusReference) {
+                    const passId = `ap_${randomUUID()}`;
+                    actionPass = await issueActionPassV2({
+                        ...issueInput,
+                        passId,
+                        holderPublicJwk: this.config.holderPublicJwk,
+                        status: {
+                            status_list: await this.config.statusReference(passId),
+                        },
+                    });
+                }
+                else if (this.config.holderPublicJwk) {
+                    actionPass = await issueActionPassV1({
+                        ...issueInput,
+                        holderPublicJwk: this.config.holderPublicJwk,
+                    });
+                }
+                else {
+                    actionPass = await issueActionPass(issueInput);
+                }
+                timings.actionPassMs = elapsed(actionPassStartedAt);
+            }
+            catch (error) {
+                timings.actionPassMs = elapsed(actionPassStartedAt);
+                if (budgetReservation?.accepted) {
+                    const rollbackStartedAt = performance.now();
+                    budgetEvent = await this.budgetMeter.rollback(budgetReservation.reservation.reservationId);
+                    timings.budgetMs += elapsed(rollbackStartedAt);
+                }
+                policyDecision = proxyDeny([`proxy_actionpass_issue_failed:${errorToReason(error)}`], policyDecision);
+            }
+        }
+        if (policyDecision.decision === "allow") {
+            this.consumeRateLimit(action, policyDecision);
+            if (budgetReservation?.accepted) {
+                const commitStartedAt = performance.now();
+                budgetEvent = await this.budgetMeter.commit(budgetReservation.reservation.reservationId);
+                timings.budgetMs += elapsed(commitStartedAt);
+            }
+        }
+        const ledgerStartedAt = performance.now();
+        const ledger = await this.append(action, policyDecision, actionPass?.claims.jti ?? null, budgetEvent);
+        timings.ledgerMs = elapsed(ledgerStartedAt);
+        completeDecisionTiming(timings, startedAt);
+        const status = policyDecision.decision === "allow"
+            ? "authorized"
+            : policyDecision.decision === "step_up"
+                ? "step_up"
+                : "blocked";
+        return {
+            schemaVersion: PROXY_SCHEMA_VERSION,
+            status,
+            action,
+            decision: policyDecision,
+            actionPass,
+            ledger,
+            timings,
+        };
+    }
+    append(action, decision, actionPassId, budget) {
         return this.config.ledger.appendDecision({
             action,
             decision,
             actionPassId,
+            budget,
             occurredAt: this.now(),
         });
     }
+    appendExecutionOutcome(input) {
+        return this.config.ledger.appendExecutionOutcome({
+            action: input.action,
+            decision: input.decision,
+            actionPassId: input.actionPassId,
+            occurredAt: this.now(),
+            traceId: input.traceId,
+            executionOutcome: input.outcome,
+            budget: input.budget,
+            correlationId: input.correlationId,
+        });
+    }
     now() {
         return this.config.now?.() ?? new Date();
     }
+    async reserveBudget(action, expiresInSeconds) {
+        const budget = this.budgetConfig;
+        if (!budget.enabled) {
+            return null;
+        }
+        const cost = addBudgetAmounts(budget.costs["*"], budget.costs[action.capability.tool] ?? {});
+        const scopeValue = budget.scope === "actor"
+            ? action.actor.agentId
+            : budget.scope === "task"
+                ? action.intent.taskId
+                : this.config.tenant;
+        const now = this.now();
+        return this.budgetMeter.reserve({
+            scope: `${budget.scope}:${scopeValue}`,
+            cost,
+            limit: budget.limits,
+            now,
+            expiresAt: new Date(now.getTime() + expiresInSeconds * 1000),
+        });
+    }
+    async createProof(action, actionPass) {
+        if (!this.config.holderSigningKey || !this.config.holderPublicJwk) {
+            throw new Error("proxy_dpop_holder_key_required");
+        }
+        const target = actionPassDpopTarget(action);
+        return (await createDpopProof({
+            actionPass: actionPass.token,
+            method: target.method,
+            uri: target.uri,
+            signingKey: this.config.holderSigningKey,
+            publicJwk: this.config.holderPublicJwk,
+            algorithm: this.config.holderAlgorithm,
+            nonce: this.config.dpopNonce,
+            now: this.now(),
+        })).proof;
+    }
+    policyEvaluationContext(action, policy, behaviorSignals) {
+        const now = this.now();
+        const rateLimitCounts = Object.fromEntries(policy.rules.flatMap((rule) => {
+            const limit = rule.obligations.rateLimit;
+            if (!limit) {
+                return [];
+            }
+            const key = rateLimitKey(rule.id, limit.scope, action);
+            const cutoff = now.getTime() - limit.windowSeconds * 1000;
+            const active = (this.rateLimitEvents.get(key) ?? []).filter((timestamp) => timestamp > cutoff);
+            this.rateLimitEvents.set(key, active);
+            return [[rule.id, active.length]];
+        }));
+        return { now, rateLimitCounts, behaviorSignals };
+    }
+    /**
+     * Read novelty/sequence signals from the durable store for this action. Pure
+     * read — no mutation; the action only becomes "known" after it executes (see
+     * `observeBehavior`). Returns undefined when no store is configured, leaving
+     * the behavior guard inert.
+     */
+    async behaviorSignals(action) {
+        if (!this.config.behaviorStore)
+            return undefined;
+        return this.config.behaviorStore.evaluate(action);
+    }
+    /** Record an executed action so its combo/transition becomes known. */
+    async observeBehavior(action) {
+        if (!this.config.behaviorStore)
+            return;
+        await this.config.behaviorStore.observe(action);
+    }
+    consumeRateLimit(action, decision) {
+        const limit = decision.obligations?.rateLimit;
+        if (!limit) {
+            return;
+        }
+        const key = rateLimitKey(limit.ruleId, limit.scope, action);
+        const events = this.rateLimitEvents.get(key) ?? [];
+        events.push(this.now().getTime());
+        this.rateLimitEvents.set(key, events);
+    }
 }
 export function createProxyRuntime(config) {
     return new AxtaryProxyRuntime(config);
@@ -238,6 +756,8 @@ function proxyDeny(reasons, previousDecision) {
             maxFilesChanged: previousDecision?.constraints.maxFilesChanged ?? 0,
             blockedPaths: previousDecision?.constraints.blockedPaths ?? [],
         },
+        rule: previousDecision?.rule,
+        obligations: previousDecision?.obligations,
     };
 }
 function normalizeApprovalResult(result) {
@@ -259,27 +779,275 @@ function normalizeApprovalResult(result) {
         approvalArtifact: result.approvalArtifact,
     };
 }
-function approveStepUp(decision) {
+function approveStepUp(decision, evidence) {
+    const requiredRoles = decision.obligations?.requiredApproverRoles ?? [];
+    const actualRoles = evidence.approval?.approverRoles ??
+        evidence.approvalArtifact?.approverRoles ??
+        [];
+    const missingRole = requiredRoles.find((role) => !actualRoles.includes(role));
+    if (missingRole) {
+        return proxyDeny([`required_approver_role_missing:${missingRole}`], decision);
+    }
     return {
         ...decision,
         decision: "allow",
         reasons: [...decision.reasons, "step_up_approved"],
     };
 }
+function rateLimitKey(ruleId, scope, action) {
+    const value = scope === "actor"
+        ? action.actor.agentId
+        : scope === "tool"
+            ? action.capability.tool
+            : scope === "resource"
+                ? action.capability.resource
+                : action.actor.tenant ?? "tenant:unknown";
+    return `${ruleId}:${scope}:${value}`;
+}
+function normalizeProxyBudgetConfig(input) {
+    const config = {
+        enabled: input?.enabled ?? false,
+        scope: input?.scope ?? "tenant",
+        limits: normalizeBudgetAmount(input?.limits ?? {}),
+        costs: Object.fromEntries(Object.entries(input?.costs ?? {}).map(([tool, cost]) => [
+            tool,
+            normalizeBudgetAmount(cost),
+        ])),
+    };
+    if (config.enabled && !config.costs["*"]) {
+        throw new Error("budget_wildcard_cost_required");
+    }
+    if (config.enabled) {
+        for (const cost of Object.values(config.costs)) {
+            for (const dimension of Object.keys(cost)) {
+                if (config.limits[dimension] === undefined) {
+                    throw new Error(`budget_limit_missing:${dimension}`);
+                }
+            }
+        }
+    }
+    return config;
+}
+function normalizeBudgetAmount(input) {
+    const amount = BudgetAmountSchema.parse(input);
+    return Object.fromEntries(Object.entries(amount).sort(([left], [right]) => left.localeCompare(right)));
+}
+function addBudgetAmounts(left, right) {
+    const dimensions = new Set([...Object.keys(left), ...Object.keys(right)]);
+    return Object.fromEntries([...dimensions]
+        .sort((a, b) => a.localeCompare(b))
+        .map((dimension) => [
+        dimension,
+        (left[dimension] ?? 0) + (right[dimension] ?? 0),
+    ])
+        .filter(([, value]) => value !== 0));
+}
+function actionWithBudget(action, reservation) {
+    const budget = {
+        reservationId: reservation.reservationId,
+        cost: reservation.cost,
+        limit: reservation.limit,
+        commitStatus: "pending",
+    };
+    return parseNormalizedAction({
+        ...action,
+        budget,
+    });
+}
+function actionWithProvenance(action, provenanceInput) {
+    return parseNormalizedAction({
+        ...action,
+        provenance: ActionProvenanceSchema.parse(provenanceInput),
+    });
+}
+function outcomeFromResult(action, result) {
+    const resultObject = isJsonObject(result) ? result : {};
+    const provider = providerFromValue(resultObject.provider) ?? providerFromTool(action);
+    const resultId = getString(resultObject.id) ??
+        getString(resultObject.commitSha) ??
+        getString(resultObject.sha) ??
+        (typeof resultObject.number === "number" ? String(resultObject.number) : undefined);
+    const resultUrl = getUrlString(resultObject.url);
+    const provenance = actionProvenanceProof(action);
+    const resourceId = getString(resultObject.path) ??
+        getString(resultObject.issueKey) ??
+        getString(resultObject.channel) ??
+        getString(resultObject.bucket) ??
+        getString(resultObject.projectId) ??
+        getString(resultObject.fileId) ??
+        getString(resultObject.branch) ??
+        getString(provenance.toolName) ??
+        getString(resultObject.workspace);
+    return {
+        schemaVersion: "axtary.ledger_execution_outcome.v0",
+        status: "succeeded",
+        provider,
+        resultId,
+        resultUrl,
+        resourceId,
+        resourceLabel: getString(resultObject.title) ?? resourceId,
+        sideEffectProof: compactJson({
+            ...provenance,
+            provider,
+            kind: getString(resultObject.kind),
+            id: resultId,
+            url: resultUrl,
+            status: getString(resultObject.status) ?? getString(resultObject.state),
+            resourceId,
+            actionPassId: getString(resultObject.actionPassId),
+            number: typeof resultObject.number === "number" ? resultObject.number : undefined,
+            branch: getString(resultObject.branch),
+            commitSha: getString(resultObject.commitSha),
+            channel: getString(resultObject.channel),
+            ts: getString(resultObject.ts),
+            issueKey: getString(resultObject.issueKey),
+            path: getString(resultObject.path),
+            acceptedPermissions: Array.isArray(resultObject.acceptedPermissions)
+                ? resultObject.acceptedPermissions
+                : undefined,
+            rateLimit: isJsonObject(resultObject.rateLimit)
+                ? resultObject.rateLimit
+                : undefined,
+            workspace: getString(resultObject.workspace),
+            fileId: getString(resultObject.fileId),
+            mimeType: getString(resultObject.mimeType),
+            scope: getString(resultObject.scope),
+            appAuthorized: typeof resultObject.appAuthorized === "boolean"
+                ? resultObject.appAuthorized
+                : undefined,
+            database: getString(resultObject.database),
+            role: getString(resultObject.role),
+            transactionReadOnly: typeof resultObject.transactionReadOnly === "boolean"
+                ? resultObject.transactionReadOnly
+                : undefined,
+            roleLeastPrivilege: typeof resultObject.roleLeastPrivilege === "boolean"
+                ? resultObject.roleLeastPrivilege
+                : undefined,
+            statementHash: getString(resultObject.statementHash),
+            predicateHash: getString(resultObject.predicateHash),
+            tables: Array.isArray(resultObject.tables)
+                ? resultObject.tables
+                : undefined,
+            rowCount: typeof resultObject.rowCount === "number"
+                ? resultObject.rowCount
+                : undefined,
+            fields: Array.isArray(resultObject.fields)
+                ? resultObject.fields
+                : undefined,
+            rls: Array.isArray(resultObject.rls) ? resultObject.rls : undefined,
+            root: getString(resultObject.root),
+            bytes: typeof resultObject.bytes === "number" ? resultObject.bytes : undefined,
+            truncated: typeof resultObject.truncated === "boolean"
+                ? resultObject.truncated
+                : undefined,
+            resultCount: Array.isArray(resultObject.results)
+                ? resultObject.results.length
+                : undefined,
+            objectCount: Array.isArray(resultObject.objects)
+                ? resultObject.objects.length
+                : undefined,
+        }),
+    };
+}
+function outcomeFromError(action, reason) {
+    return {
+        schemaVersion: "axtary.ledger_execution_outcome.v0",
+        status: "failed",
+        provider: providerFromTool(action),
+        failureReason: reason,
+        errorClass: reason.split(":", 1)[0] || "handler_failed",
+        sideEffectProof: actionProvenanceProof(action),
+    };
+}
+function actionProvenanceProof(action) {
+    const payload = action.capability.payload;
+    if (action.capability.tool === "mcp.tool.call") {
+        return compactJson({
+            serverIdentity: action.toolDefinition?.serverIdentity ?? getString(payload.serverIdentity),
+            toolName: getString(payload.toolName),
+            toolSchemaVersion: action.toolDefinition?.schemaVersion,
+            definitionHash: action.toolDefinition?.definitionHash,
+        });
+    }
+    if (action.capability.tool.startsWith("docs.")) {
+        return compactJson({
+            workspace: getString(payload.workspace),
+            query: getString(payload.query),
+            path: getString(payload.path),
+        });
+    }
+    if (action.capability.tool === "drive.files.read") {
+        return compactJson({
+            fileId: getString(payload.fileId),
+            scope: "https://www.googleapis.com/auth/drive.file",
+        });
+    }
+    return {};
+}
+function providerFromTool(action) {
+    const prefix = action.capability.tool.split(".", 1)[0];
+    return providerFromValue(prefix);
+}
+function providerFromValue(value) {
+    const provider = typeof value === "string" && value.startsWith("fake-")
+        ? value.slice("fake-".length)
+        : value;
+    switch (provider) {
+        case "github":
+        case "slack":
+        case "linear":
+        case "docs":
+        case "drive":
+        case "mcp":
+        case "aws":
+        case "gcp":
+        case "jira":
+        case "postgres":
+            return provider;
+        default:
+            return undefined;
+    }
+}
+function compactJson(input) {
+    return Object.fromEntries(Object.entries(input).filter((entry) => entry[1] !== undefined));
+}
+function getString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function getUrlString(value) {
+    const url = getString(value);
+    if (!url)
+        return undefined;
+    try {
+        return new URL(url).toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+function isJsonObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
 function errorToReason(error) {
     return error instanceof Error ? error.message : "unknown_error";
 }
 function createTimings() {
     return {
         totalMs: 0,
+        decisionMs: 0,
         parseMs: 0,
         policyMs: 0,
+        budgetMs: 0,
         actionPassMs: 0,
         ledgerMs: 0,
         approvalMs: 0,
         handlerMs: 0,
     };
 }
+function completeDecisionTiming(timings, startedAt) {
+    timings.decisionMs = elapsed(startedAt);
+    timings.totalMs = timings.decisionMs;
+}
 function elapsed(startedAt) {
     return Math.round((performance.now() - startedAt) * 1000) / 1000;
 }