The reactive, local-first stack that treats security as architecture, not an afterthought.

A TypeScript monorepo, published as @azmr/* on npm. The reactive core — signals, queries, UI — is an independent branch you can use on its own. Every persistence, policy, and AI package builds on @azmr/security instead of bolting compliance on afterward.

Read the docs Get started

pnpm add @azmr/core

Reactive core

Signals, effects, and computed values in @azmr/core, with a chainable query builder and UI components layered on top — no dependency on the security stack, usable standalone.

Security as architecture

@azmr/security sits at the root of the persistence, policy, and AI packages — RBAC, hash-chained audit logging, and JWT are the foundation, not an add-on.

Local-first, typed end-to-end

@azmr/db persists to SQLite with parameterised queries and a tamper-evident audit log — swap in @azmr/db-supabase for hosted Postgres without changing calling code.

What ships by default

Reactivity and caching are a solved problem. Where the platform differs is what's already in the box when you also need auth, rate limiting, and an audit trail.

RBAC via createAccessControl, fail-closed by default
SHA-256 hash-chained audit logging via createAuditLogger
Rate limiting and CORS composed declaratively via createPolicyEngine
All in the same monorepo as the reactive/data layer

The honest split

Every persistence, policy, and AI package (@azmr/db, @azmr/db-supabase, @azmr/policycore, @azmr/ai, @azmr/cli) depends on @azmr/security, directly or transitively. The reactive core (@azmr/core, @azmr/query, @azmr/ui) has zero dependency on it — use it standalone if that's all you need.

Rate limits, auth, and CORS as code

@azmr/policycore composes @azmr/security's primitives — rate limit, then auth, then CORS — declared once per route.

const engine = createPolicyEngine({  policies: {    "invoices.read": {      rateLimit: { options: { maxRequests: 100, windowMs: 60_000 }, keyedBy: "subject" },      auth: { resource: "invoice", action: "read" },      cors: { allowedOrigins: ["https://app.example.com"] },    },  },  accessControl,});