axis-platform-sdk 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,97 @@
+# Changelog
+
+All notable changes to `axis-platform-sdk`. Pre-release; not yet published to npm.
+
+## [0.2.0] — 2026-06-25 (unreleased)
+
+First npm publish + public repo. Adds the stateful half (ledger, blocklist,
+reputation report-back) and reconciles it with Owyhee "The Door" (governor#27)
+so the SDK and the product share one arrival/block shape.
+
+### Added — the stateful half (ledger, blocklist, reputation report-back)
+
+- **`AccessLedger` (`src/ledger.js`)** — the platform's "who showed up" record.
+  Logs every verdict to a pluggable store (default in-memory `MemoryLedgerStore`;
+  documented adapter shape for D1 / SQLite / Postgres). `recent()` / `byOperator()`
+  query helpers. `loggedGate(gate, ledger, fields)` wraps any gate so verdicts are
+  logged as a side effect (a store failure never changes the verdict). Only the
+  trustworthy `effective_scope` is recorded.
+- **`Blocklist` (`src/blocklist.js`)** — a runtime, stateful block list over the
+  same adapter shape. Blocks by `operator_id` AND by `agent_id` (agent-level
+  blocking is the SDK's superset over The Door's operator-only `operator_blocks`).
+  `blockedOperatorIds()` feeds verifyAgent's `blockedOperators`; `checkVerdict()`
+  enforces agent-level blocks post-verify (needs the resolved agent_id).
+  `gatedWithBlocklist(gate, blocklist)` wraps a gate.
+
+### Reconciled with The Door (single source of truth, no duplication)
+
+- The ledger entry shape is now byte-compatible with The Door's `ArrivalRecord`
+  / `arrivals` columns: carries `tier`, `delegation_valid`, `gate_id`,
+  `requested_action`, `display_name`; `created_at` is epoch ms (was an ISO `ts`);
+  `decision` uses the `auto_allow | denied | held | approved | booted` vocabulary
+  (was `accepted | denied`), with the manual-review states available via a
+  `recordEntry(..., { decision })` override.
+- Blocklist meta is `{ reason, created_at }` (epoch ms), matching `operator_blocks`.
+- The SDK is positioned as the **port + in-memory default**; The Door is the
+  canonical **D1-backed adapter**. README documents the mapping table. The SDK
+  ships the genuinely-new pieces The Door lacks (agent-level blocking, reputation
+  emit); The Door keeps its own D1 state layer and, post-publish, depends on this
+  package instead of vendoring it.
+- **Reputation report-back (`src/reportback.js`)** — `reportFlag()` builds a
+  protocol-shaped negative **Trust Attestation** (AXIS Layer 3; SPEC §4.5),
+  signs it with the platform's own Ed25519 key (`getPlatformKey()`, WebCrypto,
+  generated + persisted via a pluggable key store), and POSTs `{ attestation,
+  platform_public_key, signature }` to a configurable `reputationUrl`. OFF by
+  default — unconfigured is a graceful no-op (never throws). `blockAndReport()`
+  blocks locally + reports. `buildAttestation` / `signAttestation` /
+  `verifyAttestation` exposed. Zero-dep (no Buffer; WebCrypto + inline base64url
+  + inline JCS, byte-for-byte matching axis-protocol-sdk's signing convention).
+- **`examples/bouncer-worker.js`** — reference stateful bouncer: a Worker admin
+  over the ledger + blocklist (`/admin/arrivals` enriched for display,
+  `/admin/boot` = block + report, plus a tiny HTML console). A reference, not a
+  product; in-memory stores.
+
+### Notes
+
+- The reputation index is a SEPARATE, future, commercial service — NOT the
+  canonical registry, which stays identity-only (Layer 1 + Layer 2). The
+  `axis-reputation` stub receiver accepts-and-discards until the index is built.
+- New tests for ledger / blocklist / reportback + the Door-compatible shape.
+  Full suite: 40 passing (`node --test`).
+
+## [0.1.0] — 2026-06-16 (unreleased)
+
+First cut of the platform/verifier ("bouncer") side of AXIS.
+
+### Added
+
+- **`verifyAgent(token, opts)`** — verifies an AIT against the registry
+  (signature + revocation + delegation chain, all server-side) and applies a
+  platform's policy (audience match, required scopes against the trustworthy
+  `effective_scope`, blocked/approved operators, minimum verification tier).
+  Returns one structured verdict.
+- **`aitGate(opts)` / `extractToken()` / `denialResponse()`** — a drop-in
+  request gate for Cloudflare Workers (and Request-like objects). Pulls the AIT
+  from `Authorization: Bearer`, `X-AXIS-Token`, or `?ait=`.
+- **`SwitchAuthorizer`** — the free-tier gate engine and the first implementation
+  of the Authorizer port. Config-driven on/off gates with optional minimum tier,
+  required scopes, and operator allow/block lists. Its `policy` object is what a
+  "Door policy" screen edits and saves. The port is engine-agnostic so a paid
+  `EngineAuthorizer` (Permify / OpenFGA sidecar) can drop into the same slot.
+- **`scopeCovers` / `coversAll`** — AXIS scope matcher, ported verbatim from the
+  operator-side gateway so both sides agree on scope semantics.
+- **`enrich()`**, **`loadAccessPolicy()`**, **`decodeAitPayload()`** helpers.
+- Worked example: `examples/toy-platform-worker.js` (a bouncer comments service
+  gated by a `SwitchAuthorizer`).
+
+### Tested
+
+- 15 unit tests (`node --test`) across scope matching, the verify verdict
+  matrix, and the SwitchAuthorizer gate logic. `loadAccessPolicy` additionally
+  verified live against `registry.axisprime.ai`.
+
+### Notes
+
+- Zero runtime dependencies; runs in Node 20+, Cloudflare Workers, browsers.
+- Identity verification is fixed/core; only the authorization decision is
+  pluggable. The demo and the free tier need no external policy engine.

package/LICENSE

@@ -0,0 +1,16 @@
+Copyright (c) Kipple Labs, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+NOTE (pre-release): drop the full Apache-2.0 license text into this file
+before publishing, to match the sibling axis-* repos.

package/NOTICE

@@ -0,0 +1,11 @@
+axis-platform-sdk
+Copyright 2026 Kipple Labs, Inc.
+
+This product was originally developed by Joshua Ashcroft prior
+to the formation of Kipple Labs, Inc. All intellectual property
+was assigned to Kipple Labs, Inc. at corporate formation under
+the Confidential Information and Invention Assignment Agreement
+dated April 24, 2026.
+
+The "AXIS," "AXIS Protocol," "AXIS Prime," "N7," and "Kipple Labs"
+names are trademarks of Kipple Labs, Inc.

package/README.md

@@ -0,0 +1,218 @@
+# axis-platform-sdk
+
+The **platform side** of AXIS. The bouncer at the door.
+
+The [`axis-protocol-sdk`](https://github.com/MachinesOfDesire/axis-protocol-sdk) is what an *agent* uses to prove who it is. This SDK is the other end of the wire: what a **consuming platform** uses when an AXIS agent shows up and wants to do something, so the platform can **verify** it, check its **scope**, and decide to **accept** or **boot** it.
+
+> Status: v0.2. Built for the full-loop demo and as the adoption surface for third-party platforms. Owyhee "The Door" is the first production consumer (it depends on this package rather than vendoring it).
+
+## Why this exists
+
+The registry already does the hard part. `GET /verify?token=<AIT>` checks the signature, checks revocation, and walks the delegation chain server-side, returning the trustworthy `effective_scope`. This SDK packages the verdict + your platform's policy (audience, required scopes, blocked operators, minimum tier) into one call, so you integrate in a few lines instead of hand-rolling it.
+
+## Install (once published)
+
+```
+npm install axis-platform-sdk
+```
+
+Zero dependencies. Runs in Node 20+, Cloudflare Workers, and modern browsers.
+
+## Quickstart — gate a Worker endpoint
+
+```js
+import { aitGate, denialResponse } from 'axis-platform-sdk';
+
+const gate = aitGate({
+  audience: 'comments.mysite.com',      // your platform's stable audience id
+  requireScopes: ['comments:write'],    // what the agent must be allowed to do
+  // minTier: 'domain',                 // optionally require domain-verified+
+  // blockedOperators: ['axis:spammer:operator'],
+});
+
+export default {
+  async fetch(request) {
+    const verdict = await gate(request);
+    if (!verdict.accepted) return denialResponse(verdict); // 401/403 + reason
+    // verdict.agent_id is verified. Proceed.
+    return Response.json({ ok: true, by: verdict.agent_id });
+  },
+};
+```
+
+The gate pulls the AIT from `Authorization: Bearer <ait>`, `X-AXIS-Token`, or `?ait=`.
+
+## Or call the verifier directly
+
+```js
+import { verifyAgent } from 'axis-platform-sdk';
+
+const verdict = await verifyAgent(token, {
+  audience: 'comments.mysite.com',
+  requireScopes: ['comments:write'],
+});
+// -> { accepted: true, agent_id, operator_id, effective_scope, delegation_valid, tier, expires_at }
+// or { accepted: false, code, reason, ... }
+```
+
+## API
+
+- **`verifyAgent(token, opts)`** — the core. Verifies against the registry and applies your policy. Returns a structured verdict.
+  - `audience` — your platform id. The AIT's `aud` must equal it. (Matched locally: the registry only checks that `aud` is non-empty, not that it equals you. That check is yours.)
+  - `requireScopes` — checked against the trustworthy `effective_scope`.
+  - `minTier` — `email | domain | verified | kyb_individual | kyb_organization`.
+  - `blockedOperators` / `approvedOperators` — deny/allow lists by operator id.
+  - `registryBaseUrl` — defaults to `https://registry.axisprime.ai`.
+- **`aitGate(opts)`** — returns `(request) => Promise<verdict>`; binds your policy to a request gate.
+- **`denialResponse(verdict)`** — turns a denied verdict into a 401/403 `Response`.
+- **`scopeCovers(granted, required)` / `coversAll(granted, required[])`** — the AXIS scope matcher (ported verbatim from the Governor's, so operator and platform sides agree).
+- **`enrich(agentId, token, opts)`** — fetch the agent's presentation layer (display name, tier) for a console UI.
+- **`loadAccessPolicy(platformBaseUrl)`** — read a platform's published `/.well-known/axis-access` door policy.
+- **`decodeAitPayload(token)`** — read the AIT payload (claims) without verifying. For the `aud` check; never trust it for authorization.
+- **`AccessLedger` / `MemoryLedgerStore` / `loggedGate(gate, ledger, opts)` / `recordEntry(verdict, opts)`** — the access ledger (who showed up). `loggedGate` wraps a gate so every verdict is logged.
+- **`Blocklist` / `MemoryBlocklistStore` / `gatedWithBlocklist(gate, blocklist)`** — the runtime block list (by operator and by agent). `blockOperator` / `blockAgent` / `unblock*` / `isAgentBlocked` / `blockedOperatorIds` / `checkVerdict`.
+- **`reportFlag(args, opts)` / `blockAndReport(blocklist, args, opts)`** — sign a negative Trust Attestation and send it to a reputation index (OFF by default).
+- **`getPlatformKey(opts)` / `buildAttestation` / `signAttestation` / `verifyAttestation` / `MemoryKeyStore`** — the platform's Ed25519 key + TA build/sign/verify primitives (WebCrypto, zero-dep).
+
+## Gates as policy: `SwitchAuthorizer` (the free-tier engine)
+
+Identity verification is fixed and core. The authorization *decision* is a pluggable layer — the **Authorizer port**. `SwitchAuthorizer` is the free-tier implementation: config-driven on/off gates. Its `policy` object is exactly what a console's "door policy" screen edits and saves.
+
+```js
+import { SwitchAuthorizer, denialResponse } from 'axis-platform-sdk';
+
+const door = new SwitchAuthorizer({
+  audience: 'comments.mysite.com',
+  defaultAllow: false,
+  gates: {
+    'comments:write': { enabled: true, requireScopes: ['comments:write'], minTier: 'domain' },
+  },
+});
+
+const verdict = await door.gate('comments:write')(request);
+if (!verdict.accepted) return denialResponse(verdict);
+```
+
+Flip `enabled: false` and the gate closes, no code change. The port is engine-agnostic: a paid `EngineAuthorizer` (Permify / OpenFGA sidecar) for granular relationship/attribute rules drops into the same slot with the same `authorize(token, gateId, ctx)` shape. The demo and free tier need no engine.
+
+## Stateful half: ledger, blocklist, reputation report-back
+
+`verifyAgent` / `aitGate` are stateless verdict machines. A self-hosting
+platform also needs **state it owns**: a record of who showed up, a runtime
+block list, and a way to report a bad actor onward. These three modules add that,
+all zero-infra — the platform runs the stores in its OWN store (default
+in-memory; plug in D1 / SQLite / Postgres via a documented adapter shape).
+
+### Access ledger — "who's using my platform"
+
+```js
+import { aitGate, AccessLedger, loggedGate } from 'axis-platform-sdk';
+
+const ledger = new AccessLedger();                 // default in-memory store
+const gate = loggedGate(aitGate({ audience }), ledger, { audience });
+
+const verdict = await gate(request);               // every verdict is logged
+// ...
+await ledger.recent({ limit: 25 });                // newest-first arrivals
+await ledger.byOperator('axis:acme:op');           // arrivals from one operator
+```
+
+Each entry records `{ agent_id, operator_id, created_at, tier, delegation_valid,
+effective_scope, gate_id, requested_action, display_name, decision, reason,
+audience }` — the same shape as Owyhee "The Door"'s `arrivals` record, so the
+SDK and the product share one arrival definition (see "Single source of truth"
+below). `decision` is `auto_allow | denied | held | approved | booted`;
+`created_at` is epoch ms. Only the trustworthy `effective_scope` is recorded,
+never the AIT's self-declared scope. A ledger write failure never changes the
+verdict.
+
+### Persistent block / allow list — runtime, by operator AND by agent
+
+The static `blockedOperators` / `approvedOperators` are config-time policy. The
+`Blocklist` is runtime policy the platform mutates without a redeploy, and it
+adds **agent-level** blocking (boot one agent without booting its operator).
+
+```js
+import { Blocklist, verifyAgent } from 'axis-platform-sdk';
+
+const blocklist = new Blocklist();
+await blocklist.blockAgent('axis:acme:bot', 'spammed');     // agent-level
+await blocklist.blockOperator('axis:bad:op', 'whole op');   // operator-level
+
+// Inject dynamic operator blocks into verify, then catch agent-level post-verify:
+let verdict = await verifyAgent(token, {
+  audience,
+  blockedOperators: [...staticBlocked, ...(await blocklist.blockedOperatorIds())],
+});
+verdict = await blocklist.checkVerdict(verdict);   // flips to denied if agent/op blocked
+```
+
+### Reputation report-back — sign a negative Trust Attestation and send it onward
+
+When you boot an agent, you know something the network doesn't. `reportFlag`
+builds a protocol-shaped **Trust Attestation** (AXIS Layer 3; SPEC §4.5), signs
+it with the platform's own Ed25519 key (generated + persisted on first use via
+`getPlatformKey`, WebCrypto), and POSTs `{ attestation, platform_public_key,
+signature }` to a configurable reputation index.
+
+```js
+import { reportFlag, blockAndReport, Blocklist } from 'axis-platform-sdk';
+
+// Report-back is OFF by default. Unconfigured -> graceful no-op (never throws).
+await reportFlag(
+  { platformId: 'axis:my-platform:door', agentId: 'axis:acme:bot', category: 'abuse:spam', reason: 'flooded comments' },
+  { reputationUrl: 'https://axis-reputation.example/attestations' }   // when the index exists
+);
+
+// Convenience: block locally AND report (local block is authoritative; report is best-effort).
+const blocklist = new Blocklist();
+await blockAndReport(blocklist, { platformId: 'axis:my-platform:door', agentId: 'axis:acme:bot', category: 'abuse', reason: 'spam' });
+```
+
+The reputation **index is a separate, future, commercial service** — NOT the
+canonical registry (which stays identity-only, Layer 1 + Layer 2). The
+[`axis-reputation`](https://github.com/MachinesOfDesire/axis-reputation) stub
+receiver accepts-and-discards (verifies signature, returns 202) until the real
+index is built. See `examples/bouncer-worker.js` for a reference admin surface
+over the ledger + blocklist.
+
+### Single source of truth: the SDK is the port, The Door is the adapter
+
+The ledger and blocklist are a **port + in-memory default**, not a competing
+implementation. Owyhee **"The Door"** (the inbound surface of the Owyhee
+console) is the first production **adapter**:
+
+| SDK (this package, the port)        | The Door (the D1-backed product adapter)        |
+| ----------------------------------- | ----------------------------------------------- |
+| `AccessLedger` + `recordEntry`      | `arrivals` table + `recordArrival()`            |
+| `Blocklist` (operator-level)        | `operator_blocks` table + `blockedOperators()`  |
+| `SwitchAuthorizer` `policy`         | `door_policy` table (serialized policy)         |
+| `Blocklist` agent-level *(superset)* | *(not yet — an additive `agent_blocks` table)*  |
+| `reportFlag` / reputation emit *(new)* | *(not yet — the open emit half is here)*      |
+
+The entry/meta shapes above are deliberately byte-compatible with The Door's
+columns (`created_at` epoch ms; the `auto_allow|denied|held|approved|booted`
+decision vocabulary) so there is **one** arrival/block record across the SDK and
+the product — fold in, don't duplicate. A platform that needs its own store
+implements the documented adapter shape; The Door is the worked, deployed
+example of doing exactly that over Cloudflare D1.
+
+## Trust model (read this)
+
+- **`effective_scope` is the only trustworthy scope.** It's the registry's server-side chain-walk result, returned when a valid delegation is presented. The AIT's self-declared `scope` is NOT trusted and is never used for `requireScopes`.
+- **A direct AIT with no valid delegation has no proven scope.** Any non-empty `requireScopes` will deny it. That's intentional.
+- **Audience matching is the platform's job.** The registry guarantees `aud` exists; you guarantee it's *you*.
+
+## Where it sits
+
+```
+agent (axis-protocol-sdk)  ──presents AIT──>  YOUR PLATFORM (axis-platform-sdk)
+                                                     │
+                                                     └── GET /verify ──> registry (does the crypto)
+```
+
+This is distinct from the Governor (the operator-side outbound gateway) and from generic AI gateways (TrueFoundry, Portkey, etc.), which govern an operator's *outbound* LLM calls. This SDK is the *inbound* identity gate.
+
+## License
+
+Apache-2.0. (c) Kipple Labs, Inc.

package/examples/bouncer-worker.js

@@ -0,0 +1,158 @@
+/**
+ * Reference bouncer — the STATEFUL demo.
+ *
+ * The toy-platform-worker shows the stateless verdict path (verify + door
+ * policy). THIS worker adds the stateful half: an access ledger ("who showed
+ * up") and a runtime blocklist ("boot this one"), plus a tiny admin surface
+ * over both. It's a REFERENCE — wiring you'd copy into a real platform — not a
+ * product. The stores here are in-memory, so state resets when the isolate
+ * recycles; a real deployment plugs D1 / KV / Postgres into the same adapter
+ * shape (see ledger.js / blocklist.js).
+ *
+ * Run locally: wrangler dev examples/bouncer-worker.js
+ *
+ * Endpoints:
+ *   POST /comment            the gated action (verify + ledger + blocklist)
+ *   GET  /admin/arrivals     recent agents, enriched for display
+ *   POST /admin/boot         { agent_id | operator_id, reason } -> block + report
+ *   GET  /admin              a tiny HTML page over the two above
+ */
+import {
+  SwitchAuthorizer,
+  verifyAgent,
+  extractToken,
+  denialResponse,
+  AccessLedger,
+  Blocklist,
+  enrich,
+  blockAndReport,
+} from '../src/index.js';
+
+const AUDIENCE = 'comments.demo-platform.example';
+const PLATFORM_ID = 'axis:demo-platform:door'; // this platform's AXIS id, the attestor on reports
+// const REPUTATION_URL = 'https://axis-reputation.example/attestations'; // OFF by default
+
+// Stateless verdict engine (the editable "Door policy").
+const door = new SwitchAuthorizer({
+  audience: AUDIENCE,
+  defaultAllow: false,
+  gates: { 'comments:write': { enabled: true, requireScopes: ['comments:write'] } },
+});
+
+// Stateful stores (in-memory reference; swap in D1/KV/Postgres in production).
+const ledger = new AccessLedger();
+const blocklist = new Blocklist();
+
+export default {
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    // --- the gated action ---------------------------------------------------
+    if (url.pathname === '/comment' && request.method === 'POST') {
+      // Inject runtime operator-blocks into the policy, then verify.
+      const dynBlocked = await blocklist.blockedOperatorIds();
+      const base = door.optsForGate('comments:write');
+      let verdict = await verifyAgent(extractToken(request), {
+        ...base,
+        blockedOperators: [...(base.blockedOperators || []), ...dynBlocked],
+      });
+      // Agent-level runtime block (needs the resolved agent_id from the verdict).
+      verdict = await blocklist.checkVerdict(verdict);
+
+      // Log the arrival regardless of decision.
+      await ledger.record(verdict, { audience: AUDIENCE }).catch(() => {});
+
+      if (!verdict.accepted) return denialResponse(verdict);
+      const body = await request.json().catch(() => ({}));
+      return Response.json({ ok: true, posted_by: verdict.agent_id, comment: body.text || '' });
+    }
+
+    // --- admin: recent arrivals (enriched for display) ----------------------
+    if (url.pathname === '/admin/arrivals' && request.method === 'GET') {
+      const limit = Number(url.searchParams.get('limit') || 25);
+      const rows = await ledger.recent({ limit });
+      // Enrich accepted arrivals with display name / tier for the console. We
+      // have no AIT here (presentation layer needs one), so this resolves only
+      // the public layer — display_name/tier may be null. That's expected.
+      const enriched = await Promise.all(
+        rows.map(async (r) => {
+          let display_name = null;
+          let tier = null;
+          if (r.agent_id) {
+            try {
+              const info = await enrich(r.agent_id, null);
+              display_name = info.display_name;
+              tier = info.tier;
+            } catch {
+              /* registry unreachable; show raw id */
+            }
+          }
+          return { ...r, display_name, tier };
+        })
+      );
+      return Response.json({ arrivals: enriched });
+    }
+
+    // --- admin: boot an agent or operator (block + best-effort report) ------
+    if (url.pathname === '/admin/boot' && request.method === 'POST') {
+      const body = await request.json().catch(() => ({}));
+      const reason = body.reason || 'booted by platform admin';
+      if (body.agent_id) {
+        // Block the agent locally AND report it (no-op send unless REPUTATION_URL set).
+        const out = await blockAndReport(
+          blocklist,
+          { platformId: PLATFORM_ID, agentId: body.agent_id, operatorId: body.operator_id, category: body.category || 'abuse', reason },
+          { /* reputationUrl: REPUTATION_URL */ }
+        );
+        return Response.json({ ok: true, ...out });
+      }
+      if (body.operator_id) {
+        await blocklist.blockOperator(body.operator_id, reason);
+        return Response.json({ ok: true, blocked_operator: body.operator_id });
+      }
+      return Response.json({ ok: false, error: 'provide agent_id or operator_id' }, { status: 400 });
+    }
+
+    // --- admin: tiny HTML console ------------------------------------------
+    if (url.pathname === '/admin') {
+      return new Response(ADMIN_HTML, { headers: { 'Content-Type': 'text/html; charset=utf-8' } });
+    }
+
+    return new Response('AXIS stateful bouncer reference. See /admin.\n', { status: 200 });
+  },
+};
+
+const ADMIN_HTML =`<!doctype html><meta charset=utf-8>
+<title>AXIS bouncer — admin</title>
+<style>
+ body{font:14px/1.5 system-ui,sans-serif;margin:2rem;max-width:60rem}
+ h1{font-size:1.2rem} table{border-collapse:collapse;width:100%;margin:1rem 0}
+ th,td{border:1px solid #ccc;padding:.35rem .5rem;text-align:left;font-size:13px}
+ .denied,.booted{color:#b00} .auto_allow,.approved{color:#070} .held{color:#a60}
+ button{cursor:pointer} code{background:#f3f3f3;padding:0 .25rem}
+</style>
+<h1>AXIS bouncer — arrivals</h1>
+<p>Who showed up at <code>${AUDIENCE}</code>. Click <b>boot</b> to block + report an agent.</p>
+<table id=t><thead><tr><th>when</th><th>agent</th><th>operator</th><th>scope</th><th>decision</th><th></th></tr></thead><tbody></tbody></table>
+<script>
+async function load(){
+ const r=await fetch('/admin/arrivals?limit=50');const {arrivals}=await r.json();
+ const tb=document.querySelector('#t tbody');tb.innerHTML='';
+ for(const a of arrivals){
+  const tr=document.createElement('tr');
+  const name=a.display_name?a.display_name+' ':'';
+  const when=a.created_at?new Date(a.created_at).toISOString().replace('T',' ').slice(0,19):'';
+  tr.innerHTML='<td>'+when+'</td><td>'+name+'<code>'+(a.agent_id||'?')+'</code></td>'+
+    '<td><code>'+(a.operator_id||'?')+'</code></td><td>'+(a.effective_scope||[]).join(', ')+'</td>'+
+    '<td class="'+a.decision+'">'+a.decision+'</td>'+
+    '<td>'+(a.agent_id?'<button data-a="'+a.agent_id+'">boot</button>':'')+'</td>';
+  tb.appendChild(tr);
+ }
+ tb.querySelectorAll('button').forEach(b=>b.onclick=async()=>{
+  await fetch('/admin/boot',{method:'POST',headers:{'Content-Type':'application/json'},
+   body:JSON.stringify({agent_id:b.dataset.a,reason:'booted from console',category:'abuse'})});
+  load();
+ });
+}
+load();
+</script>`;

package/examples/toy-platform-worker.js

@@ -0,0 +1,60 @@
+/**
+ * Toy "bouncer" platform — the backend for the full-loop demo.
+ *
+ * A pretend comments service that only accepts AXIS-verified agents holding
+ * `comments:write`. It gates with a SwitchAuthorizer driven by a `door` policy
+ * object — which is exactly what a "Door policy" screen in Owyhee edits and
+ * saves. Flip `enabled` to false and the gate closes with no code change.
+ *
+ * Run locally: wrangler dev examples/toy-platform-worker.js
+ */
+import { SwitchAuthorizer, denialResponse } from '../src/index.js';
+
+const AUDIENCE = 'comments.demo-platform.example';
+
+// The free-tier gate engine. This object is the editable "Door policy".
+const door = new SwitchAuthorizer({
+  audience: AUDIENCE,
+  defaultAllow: false,
+  gates: {
+    'comments:write': {
+      enabled: true,
+      requireScopes: ['comments:write'],
+      // minTier: 'domain',           // require domain-verified+ to comment
+      // blockedOperators: ['axis:spammer:operator'],
+    },
+  },
+});
+
+export default {
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    // The gated action. The bouncer verifies + applies the door policy.
+    if (url.pathname === '/comment' && request.method === 'POST') {
+      const verdict = await door.gate('comments:write')(request);
+      if (!verdict.accepted) return denialResponse(verdict); // 401/403 + reason
+
+      const body = await request.json().catch(() => ({}));
+      return Response.json({
+        ok: true,
+        posted_by: verdict.agent_id,
+        operator: verdict.operator_id,
+        scope: verdict.effective_scope,
+        comment: body.text || '',
+      });
+    }
+
+    // Publish our door policy so AIT issuers know our audience + requirements.
+    if (url.pathname === '/.well-known/axis-access') {
+      return Response.json({
+        axis_version: '0.3',
+        platform_id: AUDIENCE,
+        audience: AUDIENCE,
+        access_policy: { minimum_verification_level: 'email', required_scopes: ['comments:write'], allow_unverified: false },
+      });
+    }
+
+    return new Response('AXIS bouncer demo. POST /comment with an AIT to get in.\n', { status: 200 });
+  },
+};

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "axis-platform-sdk",
+  "version": "0.2.0",
+  "description": "Platform-side SDK for the AXIS protocol. The verifier/'bouncer' side: when an AXIS agent shows up at your platform, verify its identity + delegation + scope and decide whether to accept, scope, or boot it. Zero runtime dependencies; runs in Node 20+, Cloudflare Workers, and modern browsers.",
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./scope": "./src/scope.js",
+    "./gate": "./src/gate.js",
+    "./authorizer": "./src/authorizer.js",
+    "./ledger": "./src/ledger.js",
+    "./blocklist": "./src/blocklist.js",
+    "./reportback": "./src/reportback.js"
+  },
+  "scripts": {
+    "test": "node --test test/scope.test.js test/verify.test.js test/authorizer.test.js test/ledger.test.js test/blocklist.test.js test/reportback.test.js"
+  },
+  "keywords": [
+    "axis",
+    "axis-protocol",
+    "agent-identity",
+    "verifier",
+    "platform",
+    "authorization"
+  ],
+  "author": "Kipple Labs, Inc.",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "homepage": "https://github.com/MachinesOfDesire/axis-platform-sdk",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MachinesOfDesire/axis-platform-sdk.git"
+  },
+  "bugs": {
+    "url": "https://github.com/MachinesOfDesire/axis-platform-sdk/issues"
+  },
+  "files": [
+    "src/",
+    "examples/",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "NOTICE"
+  ]
+}