@nomosprotocol/sdk 1.0.0 → 1.2.0

package/README.md

@@ -0,0 +1,98 @@
+# @nomosprotocol/sdk
+
+Official TypeScript SDK for [NOMOS](https://www.nomosprotocol.com) — ask a public authority a question from your code and get back a deterministic, cryptographically verifiable verdict.
+
+```bash
+npm install @nomosprotocol/sdk
+```
+
+## `nomos.can()` — the keyless primitive
+
+Every public authority on the [NOMOS Exchange](https://www.nomosprotocol.com/exchange) is queryable with one call. No API key, no setup — this is the front door.
+
+```ts
+import { nomos } from "@nomosprotocol/sdk";
+
+const verdict = await nomos.can({
+  authority: "eu-ai-act-full-regulation-2024-1689",
+  ai_categorises_biometric_data_for_sensitive_attributes: true,
+});
+
+if (!verdict.allowed) {
+  console.log(verdict.verdict);   // "DENIED"
+  console.log(verdict.reason);    // why
+  console.log(verdict.query_id);  // permanent transcript id
+}
+```
+
+Facts can be spread flat alongside `authority` (as above), or passed explicitly:
+
+```ts
+const verdict = await nomos.can({
+  authority: "eu-ai-act-full-regulation-2024-1689",
+  inputs: { ai_categorises_biometric_data_for_sensitive_attributes: true },
+  action: "screen a new feature before launch", // optional, recorded in the transcript
+});
+```
+
+### The verdict
+
+`nomos.can()` always returns the authority's own verdict, verbatim — nothing invented, nothing paraphrased:
+
+| Field | Type | Meaning |
+|---|---|---|
+| `allowed` | `boolean` | `true` only when `verdict === "AUTHORIZED"` |
+| `verdict` | `"AUTHORIZED" \| "DENIED" \| "ESCALATED"` | The authority's own answer |
+| `reason` | `string` | Human-readable explanation |
+| `rule` | `string \| null` | The rule id that decided it, if any |
+| `query_id` | `string` | Permanent, addressable transcript id |
+| `url` | `string` | Path to the transcript's permalink page |
+| `authority` | `{ id, title, standing }` | Which authority answered, and its standing |
+| `missing_inputs` | `string[]` | Fields the authority needed but didn't get — present on `ESCALATED` |
+
+`ESCALATED` means the authority needs more facts to decide — not a flat no. Check `missing_inputs` for what to supply.
+
+Every call mints a permanent, cryptographically sealed transcript — open `query_id` any time at `nomosprotocol.com/queries/<query_id>` to replay exactly what was asked and answered, bound to the exact authority version that responded.
+
+### Options
+
+```ts
+await nomos.can(
+  { authority: "...", ...facts },
+  {
+    baseUrl: "https://www.nomosprotocol.com", // override for local/staging use
+    signal: abortController.signal,           // cancel the request
+  },
+);
+```
+
+## `Nomos` — authenticated client
+
+For private/custom artifacts, governance generation, and webhook verification, use the authenticated client:
+
+```ts
+import { Nomos } from "@nomosprotocol/sdk";
+
+const client = new Nomos("nms_live_..."); // or "nms_test_..." for test mode
+
+const result = await client.decisions.verify({
+  artifact_id: "your_artifact_id",
+  decision_context: { /* facts */ },
+});
+
+for await (const artifact of client.artifacts.listAutoPaging()) {
+  console.log(artifact.id);
+}
+
+const event = await client.webhooks.constructEvent(payload, signatureHeader, webhookSecret);
+```
+
+See [nomosprotocol.com/docs](https://www.nomosprotocol.com/docs) for full API reference, error types, and webhook event shapes.
+
+## Requirements
+
+Node.js 18+. Ships as dual ESM/CJS with full TypeScript types.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,608 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Nomos: () => Nomos,
+  NomosAPIError: () => NomosAPIError,
+  NomosAuthenticationError: () => NomosAuthenticationError,
+  NomosAuthorizationError: () => NomosAuthorizationError,
+  NomosError: () => NomosError,
+  NomosNetworkError: () => NomosNetworkError,
+  NomosNotFoundError: () => NomosNotFoundError,
+  NomosRateLimitError: () => NomosRateLimitError,
+  NomosValidationError: () => NomosValidationError,
+  NomosWebhookSignatureError: () => NomosWebhookSignatureError,
+  can: () => can,
+  nomos: () => nomos
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var errors_exports = {};
+__export(errors_exports, {
+  NomosAPIError: () => NomosAPIError,
+  NomosAuthenticationError: () => NomosAuthenticationError,
+  NomosAuthorizationError: () => NomosAuthorizationError,
+  NomosError: () => NomosError,
+  NomosNetworkError: () => NomosNetworkError,
+  NomosNotFoundError: () => NomosNotFoundError,
+  NomosRateLimitError: () => NomosRateLimitError,
+  NomosValidationError: () => NomosValidationError,
+  NomosWebhookSignatureError: () => NomosWebhookSignatureError
+});
+var NomosError = class extends Error {
+  constructor(message, code, status, requestId) {
+    super(message);
+    this.name = "NomosError";
+    this.code = code;
+    this.status = status;
+    this.requestId = requestId;
+  }
+};
+var NomosAuthenticationError = class extends NomosError {
+  constructor(message = "Invalid API key", requestId) {
+    super(message, "authentication_error", 401, requestId);
+    this.name = "NomosAuthenticationError";
+  }
+};
+var NomosAuthorizationError = class extends NomosError {
+  constructor(message = "Access denied", requestId) {
+    super(message, "authorization_error", 403, requestId);
+    this.name = "NomosAuthorizationError";
+  }
+};
+var NomosRateLimitError = class extends NomosError {
+  constructor(message = "Rate limit exceeded", retryAfter, requestId) {
+    super(message, "rate_limit_error", 429, requestId);
+    this.name = "NomosRateLimitError";
+    this.retryAfter = retryAfter;
+  }
+};
+var NomosValidationError = class extends NomosError {
+  constructor(message, details, requestId) {
+    super(message, "validation_error", 400, requestId);
+    this.name = "NomosValidationError";
+    this.details = details;
+  }
+};
+var NomosNotFoundError = class extends NomosError {
+  constructor(message, requestId) {
+    super(message, "not_found", 404, requestId);
+    this.name = "NomosNotFoundError";
+  }
+};
+var NomosAPIError = class extends NomosError {
+  constructor(message, status, requestId) {
+    super(message, "api_error", status, requestId);
+    this.name = "NomosAPIError";
+  }
+};
+var NomosNetworkError = class extends NomosError {
+  constructor(message) {
+    super(message, "network_error");
+    this.name = "NomosNetworkError";
+  }
+};
+var NomosWebhookSignatureError = class extends NomosError {
+  constructor(message) {
+    super(message, "webhook_signature_error", 400);
+    this.name = "NomosWebhookSignatureError";
+  }
+};
+
+// src/util.ts
+async function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function jitteredBackoff(attempt, baseMs = 500) {
+  const exp = Math.min(baseMs * 2 ** attempt, 16e3);
+  return exp * (0.75 + Math.random() * 0.5);
+}
+function isRetryable(status) {
+  return status === 429 || status >= 500;
+}
+
+// src/http-client.ts
+var SDK_VERSION = "1.1.0";
+var HttpClient = class {
+  constructor(opts) {
+    this.opts = opts;
+  }
+  async get(path, reqOpts) {
+    return this.request("GET", path, void 0, reqOpts);
+  }
+  async post(path, body, reqOpts) {
+    return this.request("POST", path, body, reqOpts);
+  }
+  async request(method, path, body, reqOpts, attempt = 0) {
+    const apiKey = reqOpts?.apiKey ?? this.opts.apiKey;
+    const timeout = reqOpts?.timeout ?? this.opts.timeout;
+    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;
+    const url = `${this.opts.baseUrl}${path}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    const headers = {
+      "Content-Type": "application/json",
+      "X-Nomos-Api-Key": apiKey,
+      "User-Agent": `nomos-node/${SDK_VERSION}`,
+      "NOMOS-SDK-Version": SDK_VERSION
+    };
+    if (reqOpts?.idempotencyKey) {
+      headers["Idempotency-Key"] = reqOpts.idempotencyKey;
+    }
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        signal: controller.signal,
+        headers,
+        body: body != null ? JSON.stringify(body) : void 0
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      if (err.name === "AbortError") {
+        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);
+      }
+      throw new NomosNetworkError(err.message ?? "Network error");
+    } finally {
+      clearTimeout(timer);
+    }
+    const requestId = res.headers.get("x-request-id") ?? "";
+    const rawHeaders = {};
+    res.headers.forEach((value, key) => {
+      rawHeaders[key] = value;
+    });
+    const lastResponse = {
+      requestId,
+      statusCode: res.status,
+      headers: rawHeaders
+    };
+    if (res.ok) {
+      const data = await res.json();
+      return { data, lastResponse };
+    }
+    if (isRetryable(res.status) && attempt < maxRetries) {
+      const retryAfter = res.headers.get("retry-after");
+      const delay = retryAfter ? parseInt(retryAfter, 10) * 1e3 : jitteredBackoff(attempt);
+      await sleep(delay);
+      return this.request(method, path, body, reqOpts, attempt + 1);
+    }
+    let errBody = {};
+    try {
+      errBody = await res.json();
+    } catch {
+    }
+    const message = errBody?.error ?? errBody?.message ?? res.statusText;
+    switch (res.status) {
+      case 401:
+        throw new NomosAuthenticationError(message, requestId);
+      case 403:
+        throw new NomosAuthorizationError(message, requestId);
+      case 404:
+        throw new NomosNotFoundError(message, requestId);
+      case 422:
+      case 400:
+        throw new NomosValidationError(message, errBody?.details, requestId);
+      case 429:
+        throw new NomosRateLimitError(
+          message,
+          res.headers.get("retry-after") ? parseInt(res.headers.get("retry-after"), 10) : void 0,
+          requestId
+        );
+      default:
+        throw new NomosAPIError(message, res.status, requestId);
+    }
+  }
+};
+
+// src/resources/decisions.ts
+var Decisions = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Verify whether an AI decision is permitted under a governance artifact.
+   *
+   * Public demo artifacts (`pub_*`) work without an API key.
+   * Custom artifacts require a valid API key.
+   *
+   * @example
+   * const result = await nomos.decisions.verify({
+   *   artifact_id: 'pub_lending_v1',
+   *   decision_context: { credit_score: 720, loan_amount: 50000 },
+   * });
+   *
+   * if (!result.allowed) {
+   *   throw new Error(`Blocked: ${result.verdict_description}`);
+   * }
+   *
+   * // Debugging / tracing
+   * console.log(result.lastResponse.requestId);
+   *
+   * @example
+   * // Per-request options
+   * const result = await nomos.decisions.verify(params, {
+   *   idempotencyKey: `verify-${transactionId}`,
+   *   timeout: 5000,
+   * });
+   */
+  async verify(params, opts) {
+    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;
+    const isPublic = artifact_id.startsWith("pub_");
+    let httpResp;
+    if (isPublic) {
+      httpResp = await this.http.post("/api/v1/verify", {
+        artifact_id,
+        decision: proposed_decision ?? "evaluate",
+        inputs: decision_context
+      }, opts);
+    } else {
+      httpResp = await this.http.post("/api/v1/verify-decision", {
+        artifact_id,
+        decision: proposed_decision ?? "evaluate",
+        inputs: decision_context,
+        caller: { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() }
+      }, opts);
+    }
+    const raw = httpResp.data;
+    return {
+      id: raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,
+      object: raw.object ?? "decision",
+      artifact_id: raw.artifact_id ?? artifact_id,
+      artifact_name: raw.artifact_name ?? "",
+      allowed: raw.allowed ?? false,
+      verdict: raw.verdict ?? (raw.outcome === "auto_approved" ? "approved" : raw.outcome === "auto_rejected" ? "rejected" : "escalated"),
+      rule: raw.rule,
+      evaluation: raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },
+      confidence: raw.confidence ?? { tier: raw.artifact_confidence ?? "DECLARED", score: 1, description: "" },
+      audit: raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? "", timestamp: raw.ts ?? (/* @__PURE__ */ new Date()).toISOString() },
+      performance: raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },
+      schema_version: raw.schema_version ?? "1.0.0",
+      verdict_description: raw.verdict_description ?? "",
+      incomplete_inputs: raw.incomplete_inputs,
+      paths_to_approval: raw.paths_to_approval,
+      lastResponse: httpResp.lastResponse
+    };
+  }
+};
+
+// src/resources/artifacts.ts
+var Artifacts = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Retrieve a single artifact by ID.
+   *
+   * @example
+   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');
+   * console.log(artifact.ari_score, artifact.autonomy_band);
+   * console.log(artifact.lastResponse.requestId); // for support tickets
+   */
+  async retrieve(artifactId, opts) {
+    const { data, lastResponse } = await this.http.get(
+      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
+  /**
+   * List published artifacts on the Exchange with optional filters.
+   *
+   * @example
+   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });
+   *
+   * @example
+   * // With per-request options
+   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });
+   */
+  async list(params = {}, opts) {
+    const qs = new URLSearchParams();
+    if (params.band) qs.set("band", params.band);
+    if (params.domain) qs.set("domain", params.domain);
+    if (params.jurisdiction) qs.set("jurisdiction", params.jurisdiction);
+    if (params.sort) qs.set("sort", params.sort);
+    if (params.limit != null) qs.set("limit", String(params.limit));
+    if (params.offset != null) qs.set("offset", String(params.offset));
+    const query = qs.toString();
+    const { data: raw, lastResponse } = await this.http.get(
+      `/api/exchange/artifacts${query ? `?${query}` : ""}`,
+      opts
+    );
+    const normalized = {
+      data: Array.isArray(raw) ? raw : raw.artifacts ?? raw.data ?? [],
+      total: raw.total ?? (Array.isArray(raw) ? raw.length : 0),
+      limit: params.limit ?? 20,
+      offset: params.offset ?? 0
+    };
+    return { ...normalized, lastResponse };
+  }
+  /**
+   * Auto-paginating iterator — yields every artifact across all pages.
+   * Stops automatically when the last page is reached.
+   *
+   * @example
+   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {
+   *   console.log(artifact.title, artifact.ari_score);
+   * }
+   */
+  async *listAutoPaging(params = {}, opts) {
+    let offset = params.offset ?? 0;
+    const limit = params.limit ?? 20;
+    while (true) {
+      const page = await this.list({ ...params, offset, limit }, opts);
+      for (const item of page.data) yield item;
+      if (page.data.length < limit || offset + page.data.length >= page.total) break;
+      offset += page.data.length;
+    }
+  }
+  /**
+   * Retrieve the declared input schema for a sealed artifact.
+   *
+   * Returns every field the artifact's rules reference — name, type, whether it's
+   * required, and a ready-to-use example_inputs object. Use this to build forms,
+   * validate payloads, or generate API docs without reading the rules manually.
+   *
+   * Requires an API key (artifact schemas are not public).
+   *
+   * @example
+   * const schema = await nomos.artifacts.schema('art_abc123');
+   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+   */
+  async schema(artifactId, opts) {
+    const { data, lastResponse } = await this.http.get(
+      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
+};
+
+// src/resources/governance.ts
+var Governance = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Generate a sealed .nomos governance artifact from policy documents
+   * and optional historical decision logs.
+   *
+   * @example
+   * const artifact = await nomos.governance.generate({
+   *   policies: [policyText],
+   *   decision_logs: historicalRows,
+   *   domain: 'loan_approval',
+   * });
+   * console.log(artifact.ari_score, artifact.seal_hash);
+   */
+  async generate(params, opts) {
+    const { data, lastResponse } = await this.http.post(
+      "/api/v1/generate-governance",
+      params,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
+  /**
+   * Detect contradictions and conflicts in a rule set before sealing.
+   *
+   * @example
+   * const report = await nomos.governance.detectContradictions({ rules });
+   * if (!report.clean) {
+   *   console.log(report.contradictions);
+   * }
+   */
+  async detectContradictions(params, opts) {
+    const { data, lastResponse } = await this.http.post(
+      "/api/v1/detect-contradictions",
+      params,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
+};
+
+// src/resources/webhooks.ts
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError("Invalid hex encoding in signature");
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    const byte = parseInt(hex.slice(i, i + 2), 16);
+    if (isNaN(byte)) throw new NomosWebhookSignatureError("Invalid hex encoding in signature");
+    bytes[i / 2] = byte;
+  }
+  return bytes;
+}
+function safeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var Webhooks = class {
+  /**
+   * Verify a NOMOS webhook signature and return the parsed event.
+   *
+   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`
+   * Signed payload: `<timestamp>.<raw_body>`
+   *
+   * @example
+   * // Express
+   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {
+   *   const event = await nomos.webhooks.constructEvent(
+   *     req.body,
+   *     req.headers['nomos-signature'] as string,
+   *     process.env.NOMOS_WEBHOOK_SECRET!,
+   *   );
+   *   console.log(event.type, event.data);
+   *   res.sendStatus(200);
+   * });
+   *
+   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed
+   */
+  async constructEvent(payload, signature, secret, toleranceSeconds = 300) {
+    const body = typeof payload === "string" ? payload : new TextDecoder().decode(payload);
+    const parts = {};
+    for (const part of signature.split(",")) {
+      const eq = part.indexOf("=");
+      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();
+    }
+    if (!parts["t"] || !parts["v1"]) {
+      throw new NomosWebhookSignatureError(
+        'Invalid signature format \u2014 expected "t=<timestamp>,v1=<hmac>"'
+      );
+    }
+    const timestamp = parseInt(parts["t"], 10);
+    if (isNaN(timestamp)) {
+      throw new NomosWebhookSignatureError("Invalid timestamp in webhook signature");
+    }
+    const ageSecs = Math.abs(Date.now() / 1e3 - timestamp);
+    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {
+      throw new NomosWebhookSignatureError(
+        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). Ensure your server clock is synced and the event is not being replayed.`
+      );
+    }
+    const enc = new TextEncoder();
+    const keyMaterial = await globalThis.crypto.subtle.importKey(
+      "raw",
+      enc.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signedPayload = `${parts["t"]}.${body}`;
+    const expectedBuf = await globalThis.crypto.subtle.sign(
+      "HMAC",
+      keyMaterial,
+      enc.encode(signedPayload)
+    );
+    const expected = new Uint8Array(expectedBuf);
+    const received = hexToBytes(parts["v1"]);
+    if (!safeEqual(expected, received)) {
+      throw new NomosWebhookSignatureError(
+        "Webhook signature mismatch \u2014 verify your NOMOS_WEBHOOK_SECRET matches the one in Studio."
+      );
+    }
+    try {
+      return JSON.parse(body);
+    } catch {
+      throw new NomosWebhookSignatureError("Webhook payload is not valid JSON");
+    }
+  }
+  /**
+   * Verify a webhook signature without parsing the event.
+   * Returns `true` if valid, `false` if not (never throws).
+   *
+   * @example
+   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);
+   * if (!valid) return res.sendStatus(400);
+   */
+  async verifySignature(payload, signature, secret, toleranceSeconds = 300) {
+    try {
+      await this.constructEvent(payload, signature, secret, toleranceSeconds);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/nomos.ts
+var DEFAULT_BASE_URL = "https://nomos.ai";
+var DEFAULT_MAX_RETRIES = 3;
+var DEFAULT_TIMEOUT = 3e4;
+var Nomos = class {
+  static {
+    this.errors = errors_exports;
+  }
+  constructor(apiKey, config = {}) {
+    if (!apiKey || typeof apiKey !== "string") {
+      throw new NomosAuthenticationError(
+        'A valid API key is required. Pass it as the first argument: new Nomos("nms_live_...")'
+      );
+    }
+    this.mode = apiKey.startsWith("nms_test_") ? "test" : "live";
+    const http = new HttpClient({
+      apiKey,
+      baseUrl: (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, ""),
+      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+      timeout: config.timeout ?? DEFAULT_TIMEOUT
+    });
+    this.decisions = new Decisions(http);
+    this.artifacts = new Artifacts(http);
+    this.governance = new Governance(http);
+    this.webhooks = new Webhooks();
+  }
+};
+
+// src/can.ts
+var DEFAULT_EXCHANGE_BASE = "https://www.nomosprotocol.com";
+async function can(params, opts) {
+  const { authority, action, inputs, ...flat } = params;
+  if (!authority || typeof authority !== "string") {
+    throw new Error("can(): `authority` (an Exchange artifact id or slug) is required.");
+  }
+  const facts = inputs && typeof inputs === "object" ? inputs : flat;
+  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\/$/, "");
+  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ inputs: facts, action }),
+    signal: opts?.signal
+  });
+  const data = await res.json().catch(() => null);
+  if (!res.ok) {
+    throw new Error(data?.error ?? `NOMOS query failed (HTTP ${res.status})`);
+  }
+  return {
+    allowed: data.verdict === "AUTHORIZED",
+    verdict: data.verdict,
+    reason: data.verdict_description,
+    rule: data.matched_rule_id ?? null,
+    query_id: data.query_id,
+    url: data.url,
+    authority: {
+      id: data.artifact?.id ?? authority,
+      title: data.artifact?.title ?? "",
+      standing: data.artifact?.standing ?? ""
+    },
+    missing_inputs: data.missing_inputs ?? []
+  };
+}
+var nomos = { can };
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Nomos,
+  NomosAPIError,
+  NomosAuthenticationError,
+  NomosAuthorizationError,
+  NomosError,
+  NomosNetworkError,
+  NomosNotFoundError,
+  NomosRateLimitError,
+  NomosValidationError,
+  NomosWebhookSignatureError,
+  can,
+  nomos
+});
+//# sourceMappingURL=index.cjs.map