@nomosprotocol/sdk 1.0.0 → 1.2.0

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/util.ts","../src/http-client.ts","../src/resources/decisions.ts","../src/resources/artifacts.ts","../src/resources/governance.ts","../src/resources/webhooks.ts","../src/nomos.ts","../src/can.ts"],"sourcesContent":["export { Nomos } from './nomos.js';\n// The keyless public Exchange primitive — `import { nomos } from '@nomosprotocol/sdk'`\n// then `await nomos.can({ authority, ...facts })`. Separate from the authenticated Nomos\n// class; needs no API key and answers only public Exchange artifacts.\nexport { can, nomos } from './can.js';\nexport * from './errors.js';\nexport type {\n  CanParams,\n  CanOptions,\n  CanResult,\n  CanVerdict,\n  NomosConfig,\n  RequestOptions,\n  NomosRawResponse,\n  WithLastResponse,\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  ListArtifactsParams,\n  ArtifactList,\n  Artifact,\n  ArtifactSchema,\n  ArtifactSchemaField,\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  Contradiction,\n  Verdict,\n  NomosWebhookEvent,\n  NomosWebhookEventType,\n} from './types.js';\n","export type NomosErrorCode =\n  | 'authentication_error'\n  | 'authorization_error'\n  | 'rate_limit_error'\n  | 'validation_error'\n  | 'not_found'\n  | 'api_error'\n  | 'network_error'\n  | 'webhook_signature_error';\n\nexport class NomosError extends Error {\n  readonly code: NomosErrorCode;\n  readonly status?: number;\n  readonly requestId?: string;\n\n  constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string) {\n    super(message);\n    this.name = 'NomosError';\n    this.code = code;\n    this.status = status;\n    this.requestId = requestId;\n  }\n}\n\nexport class NomosAuthenticationError extends NomosError {\n  constructor(message = 'Invalid API key', requestId?: string) {\n    super(message, 'authentication_error', 401, requestId);\n    this.name = 'NomosAuthenticationError';\n  }\n}\n\nexport class NomosAuthorizationError extends NomosError {\n  constructor(message = 'Access denied', requestId?: string) {\n    super(message, 'authorization_error', 403, requestId);\n    this.name = 'NomosAuthorizationError';\n  }\n}\n\nexport class NomosRateLimitError extends NomosError {\n  readonly retryAfter?: number;\n\n  constructor(message = 'Rate limit exceeded', retryAfter?: number, requestId?: string) {\n    super(message, 'rate_limit_error', 429, requestId);\n    this.name = 'NomosRateLimitError';\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class NomosValidationError extends NomosError {\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown, requestId?: string) {\n    super(message, 'validation_error', 400, requestId);\n    this.name = 'NomosValidationError';\n    this.details = details;\n  }\n}\n\nexport class NomosNotFoundError extends NomosError {\n  constructor(message: string, requestId?: string) {\n    super(message, 'not_found', 404, requestId);\n    this.name = 'NomosNotFoundError';\n  }\n}\n\nexport class NomosAPIError extends NomosError {\n  constructor(message: string, status: number, requestId?: string) {\n    super(message, 'api_error', status, requestId);\n    this.name = 'NomosAPIError';\n  }\n}\n\nexport class NomosNetworkError extends NomosError {\n  constructor(message: string) {\n    super(message, 'network_error');\n    this.name = 'NomosNetworkError';\n  }\n}\n\nexport class NomosWebhookSignatureError extends NomosError {\n  constructor(message: string) {\n    super(message, 'webhook_signature_error', 400);\n    this.name = 'NomosWebhookSignatureError';\n  }\n}\n","export async function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nexport function jitteredBackoff(attempt: number, baseMs = 500): number {\n  const exp = Math.min(baseMs * 2 ** attempt, 16000);\n  return exp * (0.75 + Math.random() * 0.5); // ±25% jitter\n}\n\nexport function isRetryable(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n","import {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\nimport { sleep, jitteredBackoff, isRetryable } from './util.js';\nimport type { RequestOptions, NomosRawResponse } from './types.js';\n\nconst SDK_VERSION = '1.1.0';\n\nexport interface HttpClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  maxRetries: number;\n  timeout: number;\n}\n\nexport interface HttpResponse<T> {\n  data: T;\n  lastResponse: NomosRawResponse;\n}\n\nexport class HttpClient {\n  constructor(private readonly opts: HttpClientOptions) {}\n\n  async get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('GET', path, undefined, reqOpts);\n  }\n\n  async post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('POST', path, body, reqOpts);\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    body: unknown,\n    reqOpts?: RequestOptions,\n    attempt = 0,\n  ): Promise<HttpResponse<T>> {\n    const apiKey     = reqOpts?.apiKey     ?? this.opts.apiKey;\n    const timeout    = reqOpts?.timeout    ?? this.opts.timeout;\n    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;\n\n    const url = `${this.opts.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n\n    const headers: Record<string, string> = {\n      'Content-Type':      'application/json',\n      'X-Nomos-Api-Key':   apiKey,\n      'User-Agent':        `nomos-node/${SDK_VERSION}`,\n      'NOMOS-SDK-Version': SDK_VERSION,\n    };\n    if (reqOpts?.idempotencyKey) {\n      headers['Idempotency-Key'] = reqOpts.idempotencyKey;\n    }\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        signal: controller.signal,\n        headers,\n        body: body != null ? JSON.stringify(body) : undefined,\n      });\n    } catch (err: any) {\n      clearTimeout(timer);\n      if (err.name === 'AbortError') {\n        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);\n      }\n      throw new NomosNetworkError(err.message ?? 'Network error');\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const requestId = res.headers.get('x-request-id') ?? '';\n    const rawHeaders: Record<string, string> = {};\n    res.headers.forEach((value, key) => { rawHeaders[key] = value; });\n    const lastResponse: NomosRawResponse = {\n      requestId,\n      statusCode: res.status,\n      headers: rawHeaders,\n    };\n\n    if (res.ok) {\n      const data = await res.json() as T;\n      return { data, lastResponse };\n    }\n\n    // Retry on 429 / 5xx\n    if (isRetryable(res.status) && attempt < maxRetries) {\n      const retryAfter = res.headers.get('retry-after');\n      const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : jitteredBackoff(attempt);\n      await sleep(delay);\n      return this.request<T>(method, path, body, reqOpts, attempt + 1);\n    }\n\n    let errBody: any = {};\n    try { errBody = await res.json(); } catch {}\n    const message: string = errBody?.error ?? errBody?.message ?? res.statusText;\n\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, errBody?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Decisions {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Verify whether an AI decision is permitted under a governance artifact.\n   *\n   * Public demo artifacts (`pub_*`) work without an API key.\n   * Custom artifacts require a valid API key.\n   *\n   * @example\n   * const result = await nomos.decisions.verify({\n   *   artifact_id: 'pub_lending_v1',\n   *   decision_context: { credit_score: 720, loan_amount: 50000 },\n   * });\n   *\n   * if (!result.allowed) {\n   *   throw new Error(`Blocked: ${result.verdict_description}`);\n   * }\n   *\n   * // Debugging / tracing\n   * console.log(result.lastResponse.requestId);\n   *\n   * @example\n   * // Per-request options\n   * const result = await nomos.decisions.verify(params, {\n   *   idempotencyKey: `verify-${transactionId}`,\n   *   timeout: 5000,\n   * });\n   */\n  async verify(\n    params: VerifyDecisionParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<VerifyDecisionResult>> {\n    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;\n\n    // Public artifacts (pub_*) use the open /verify endpoint — no API key required\n    const isPublic = artifact_id.startsWith('pub_');\n    let httpResp: Awaited<ReturnType<HttpClient['post']>>;\n\n    if (isPublic) {\n      httpResp = await this.http.post<any>('/api/v1/verify', {\n        artifact_id,\n        decision:  proposed_decision ?? 'evaluate',\n        inputs:    decision_context,\n      }, opts);\n    } else {\n      // /verify-decision expects: { artifact_id, decision, inputs, caller? }\n      // NOT decision_context / proposed_decision at the top level.\n      httpResp = await this.http.post<any>('/api/v1/verify-decision', {\n        artifact_id,\n        decision: proposed_decision ?? 'evaluate',\n        inputs:   decision_context,\n        caller:   { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() },\n      }, opts);\n    }\n\n    const raw: any = httpResp.data;\n\n    return {\n      id:                  raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,\n      object:              raw.object ?? 'decision',\n      artifact_id:         raw.artifact_id ?? artifact_id,\n      artifact_name:       raw.artifact_name ?? '',\n      allowed:             raw.allowed ?? false,\n      verdict:             raw.verdict ?? (raw.outcome === 'auto_approved' ? 'approved' : raw.outcome === 'auto_rejected' ? 'rejected' : 'escalated'),\n      rule:                raw.rule,\n      evaluation:          raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },\n      confidence:          raw.confidence ?? { tier: raw.artifact_confidence ?? 'DECLARED', score: 1, description: '' },\n      audit:               raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? '', timestamp: raw.ts ?? new Date().toISOString() },\n      performance:         raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },\n      schema_version:      raw.schema_version ?? '1.0.0',\n      verdict_description: raw.verdict_description ?? '',\n      incomplete_inputs:   raw.incomplete_inputs,\n      paths_to_approval:   raw.paths_to_approval,\n      lastResponse:        httpResp.lastResponse,\n    };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  Artifact,\n  ArtifactList,\n  ArtifactSchema,\n  ListArtifactsParams,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Artifacts {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Retrieve a single artifact by ID.\n   *\n   * @example\n   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');\n   * console.log(artifact.ari_score, artifact.autonomy_band);\n   * console.log(artifact.lastResponse.requestId); // for support tickets\n   */\n  async retrieve(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<Artifact>> {\n    const { data, lastResponse } = await this.http.get<Artifact>(\n      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * List published artifacts on the Exchange with optional filters.\n   *\n   * @example\n   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });\n   *\n   * @example\n   * // With per-request options\n   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });\n   */\n  async list(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactList>> {\n    const qs = new URLSearchParams();\n    if (params.band)           qs.set('band', params.band);\n    if (params.domain)         qs.set('domain', params.domain);\n    if (params.jurisdiction)   qs.set('jurisdiction', params.jurisdiction);\n    if (params.sort)           qs.set('sort', params.sort);\n    if (params.limit != null)  qs.set('limit', String(params.limit));\n    if (params.offset != null) qs.set('offset', String(params.offset));\n    const query = qs.toString();\n\n    const { data: raw, lastResponse } = await this.http.get<any>(\n      `/api/exchange/artifacts${query ? `?${query}` : ''}`,\n      opts,\n    );\n\n    // API returns { artifacts: [], total: N } — normalise to { data: [], total: N }\n    const normalized: ArtifactList = {\n      data:   Array.isArray(raw) ? raw : (raw.artifacts ?? raw.data ?? []),\n      total:  raw.total ?? (Array.isArray(raw) ? raw.length : 0),\n      limit:  params.limit ?? 20,\n      offset: params.offset ?? 0,\n    };\n\n    return { ...normalized, lastResponse };\n  }\n\n  /**\n   * Auto-paginating iterator — yields every artifact across all pages.\n   * Stops automatically when the last page is reached.\n   *\n   * @example\n   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {\n   *   console.log(artifact.title, artifact.ari_score);\n   * }\n   */\n  async *listAutoPaging(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): AsyncGenerator<Artifact> {\n    let offset = params.offset ?? 0;\n    const limit = params.limit ?? 20;\n\n    while (true) {\n      const page = await this.list({ ...params, offset, limit }, opts);\n      for (const item of page.data) yield item;\n      if (page.data.length < limit || offset + page.data.length >= page.total) break;\n      offset += page.data.length;\n    }\n  }\n\n  /**\n   * Retrieve the declared input schema for a sealed artifact.\n   *\n   * Returns every field the artifact's rules reference — name, type, whether it's\n   * required, and a ready-to-use example_inputs object. Use this to build forms,\n   * validate payloads, or generate API docs without reading the rules manually.\n   *\n   * Requires an API key (artifact schemas are not public).\n   *\n   * @example\n   * const schema = await nomos.artifacts.schema('art_abc123');\n   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']\n   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }\n   */\n  async schema(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactSchema>> {\n    const { data, lastResponse } = await this.http.get<ArtifactSchema>(\n      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Governance {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Generate a sealed .nomos governance artifact from policy documents\n   * and optional historical decision logs.\n   *\n   * @example\n   * const artifact = await nomos.governance.generate({\n   *   policies: [policyText],\n   *   decision_logs: historicalRows,\n   *   domain: 'loan_approval',\n   * });\n   * console.log(artifact.ari_score, artifact.seal_hash);\n   */\n  async generate(\n    params: GenerateGovernanceParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<GenerateGovernanceResult>> {\n    const { data, lastResponse } = await this.http.post<GenerateGovernanceResult>(\n      '/api/v1/generate-governance',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * Detect contradictions and conflicts in a rule set before sealing.\n   *\n   * @example\n   * const report = await nomos.governance.detectContradictions({ rules });\n   * if (!report.clean) {\n   *   console.log(report.contradictions);\n   * }\n   */\n  async detectContradictions(\n    params: DetectContradictionsParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<DetectContradictionsResult>> {\n    const { data, lastResponse } = await this.http.post<DetectContradictionsResult>(\n      '/api/v1/detect-contradictions',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import { NomosWebhookSignatureError } from '../errors.js';\nimport type { NomosWebhookEvent } from '../types.js';\n\n// Hex string → Uint8Array (no Buffer dependency — works in Node and browsers)\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    const byte = parseInt(hex.slice(i, i + 2), 16);\n    if (isNaN(byte)) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n    bytes[i / 2] = byte;\n  }\n  return bytes;\n}\n\n// Constant-time comparison (prevents timing attacks)\nfunction safeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nexport class Webhooks {\n  /**\n   * Verify a NOMOS webhook signature and return the parsed event.\n   *\n   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`\n   * Signed payload: `<timestamp>.<raw_body>`\n   *\n   * @example\n   * // Express\n   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {\n   *   const event = await nomos.webhooks.constructEvent(\n   *     req.body,\n   *     req.headers['nomos-signature'] as string,\n   *     process.env.NOMOS_WEBHOOK_SECRET!,\n   *   );\n   *   console.log(event.type, event.data);\n   *   res.sendStatus(200);\n   * });\n   *\n   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed\n   */\n  async constructEvent(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<NomosWebhookEvent> {\n    const body = typeof payload === 'string'\n      ? payload\n      : new TextDecoder().decode(payload);\n\n    // Parse \"t=<ts>,v1=<hex>\" header\n    const parts: Record<string, string> = {};\n    for (const part of signature.split(',')) {\n      const eq = part.indexOf('=');\n      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();\n    }\n\n    if (!parts['t'] || !parts['v1']) {\n      throw new NomosWebhookSignatureError(\n        'Invalid signature format — expected \"t=<timestamp>,v1=<hmac>\"',\n      );\n    }\n\n    const timestamp = parseInt(parts['t'], 10);\n    if (isNaN(timestamp)) {\n      throw new NomosWebhookSignatureError('Invalid timestamp in webhook signature');\n    }\n\n    const ageSecs = Math.abs(Date.now() / 1000 - timestamp);\n    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {\n      throw new NomosWebhookSignatureError(\n        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). ` +\n        'Ensure your server clock is synced and the event is not being replayed.',\n      );\n    }\n\n    // HMAC-SHA256 via Web Crypto API (Node 18+ / modern browsers — no dependencies)\n    const enc = new TextEncoder();\n    const keyMaterial = await globalThis.crypto.subtle.importKey(\n      'raw',\n      enc.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    );\n    const signedPayload = `${parts['t']}.${body}`;\n    const expectedBuf = await globalThis.crypto.subtle.sign(\n      'HMAC',\n      keyMaterial,\n      enc.encode(signedPayload),\n    );\n    const expected = new Uint8Array(expectedBuf);\n    const received = hexToBytes(parts['v1']);\n\n    if (!safeEqual(expected, received)) {\n      throw new NomosWebhookSignatureError(\n        'Webhook signature mismatch — verify your NOMOS_WEBHOOK_SECRET matches the one in Studio.',\n      );\n    }\n\n    try {\n      return JSON.parse(body) as NomosWebhookEvent;\n    } catch {\n      throw new NomosWebhookSignatureError('Webhook payload is not valid JSON');\n    }\n  }\n\n  /**\n   * Verify a webhook signature without parsing the event.\n   * Returns `true` if valid, `false` if not (never throws).\n   *\n   * @example\n   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);\n   * if (!valid) return res.sendStatus(400);\n   */\n  async verifySignature(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<boolean> {\n    try {\n      await this.constructEvent(payload, signature, secret, toleranceSeconds);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","import { HttpClient } from './http-client.js';\nimport { Decisions } from './resources/decisions.js';\nimport { Artifacts } from './resources/artifacts.js';\nimport { Governance } from './resources/governance.js';\nimport { Webhooks } from './resources/webhooks.js';\nimport * as errors from './errors.js';\nimport type { NomosConfig } from './types.js';\n\nconst DEFAULT_BASE_URL  = 'https://nomos.ai';\nconst DEFAULT_MAX_RETRIES = 3;\nconst DEFAULT_TIMEOUT   = 30_000;\n\nexport class Nomos {\n  readonly decisions:  Decisions;\n  readonly artifacts:  Artifacts;\n  readonly governance: Governance;\n  readonly webhooks:   Webhooks;\n\n  /** Whether this instance is using a live or test API key. */\n  readonly mode: 'live' | 'test';\n\n  static readonly errors = errors;\n\n  constructor(apiKey: string, config: NomosConfig = {}) {\n    if (!apiKey || typeof apiKey !== 'string') {\n      throw new errors.NomosAuthenticationError(\n        'A valid API key is required. Pass it as the first argument: new Nomos(\"nms_live_...\")',\n      );\n    }\n\n    this.mode = apiKey.startsWith('nms_test_') ? 'test' : 'live';\n\n    const http = new HttpClient({\n      apiKey,\n      baseUrl:    (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, ''),\n      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,\n      timeout:    config.timeout    ?? DEFAULT_TIMEOUT,\n    });\n\n    this.decisions  = new Decisions(http);\n    this.artifacts  = new Artifacts(http);\n    this.governance = new Governance(http);\n    this.webhooks   = new Webhooks();\n  }\n}\n","import type { CanParams, CanResult, CanOptions } from './types.js';\n\n/**\n * The whole product in one verb: \"Can I do this?\"\n *\n * Ask a public Exchange authority a question and get back a deterministic, verifiable\n * verdict — no API key, no SDK setup, no reading a policy PDF. This is a thin, faithful\n * wrapper over the public Exchange query endpoint (the same call the exchange.nomosprotocol.com\n * \"Ask Authority\" box makes), so every answer is a real, addressable transcript you can open\n * at its `url` / `query_id`.\n *\n * Verdicts are exactly what the authority returns — AUTHORIZED / DENIED / ESCALATED — never\n * an invented shape. `allowed` is simply `verdict === 'AUTHORIZED'`; an ESCALATED result means\n * the authority needs more facts to decide (see `missing_inputs`), not a flat \"no\".\n *\n * @example\n * import { nomos } from '@nomosprotocol/sdk';\n *\n * const verdict = await nomos.can({\n *   authority: 'eu-ai-act-full-regulation-2024-1689',\n *   ai_system_circumvents_refugee_convention: true,\n * });\n * // → { allowed: false, verdict: 'DENIED', reason: 'Rule \"Prohibition…\" triggered…',\n * //     query_id: 'qry_…', url: '/queries/qry_…', … }\n */\nconst DEFAULT_EXCHANGE_BASE = 'https://www.nomosprotocol.com';\n\nexport async function can(params: CanParams, opts?: CanOptions): Promise<CanResult> {\n  const { authority, action, inputs, ...flat } = params;\n  if (!authority || typeof authority !== 'string') {\n    throw new Error('can(): `authority` (an Exchange artifact id or slug) is required.');\n  }\n  // Two equally valid shapes: an explicit `inputs` object, or the facts spread flat\n  // alongside `authority`/`action`. Explicit `inputs` wins when both are present.\n  const facts: Record<string, unknown> =\n    inputs && typeof inputs === 'object' ? inputs : (flat as Record<string, unknown>);\n\n  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\\/$/, '');\n  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;\n\n  const res = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({ inputs: facts, action }),\n    signal: opts?.signal,\n  });\n\n  const data: any = await res.json().catch(() => null);\n  if (!res.ok) {\n    throw new Error(data?.error ?? `NOMOS query failed (HTTP ${res.status})`);\n  }\n\n  return {\n    allowed: data.verdict === 'AUTHORIZED',\n    verdict: data.verdict,\n    reason: data.verdict_description,\n    rule: data.matched_rule_id ?? null,\n    query_id: data.query_id,\n    url: data.url,\n    authority: {\n      id: data.artifact?.id ?? authority,\n      title: data.artifact?.title ?? '',\n      standing: data.artifact?.standing ?? '',\n    },\n    missing_inputs: data.missing_inputs ?? [],\n  };\n}\n\n/**\n * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.\n * For authenticated, key-scoped operations use the `Nomos` class instead.\n */\nexport const nomos = { can };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,SAAiB,MAAsB,QAAiB,WAAoB;AACtF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,2BAAN,cAAuC,WAAW;AAAA,EACvD,YAAY,UAAU,mBAAmB,WAAoB;AAC3D,UAAM,SAAS,wBAAwB,KAAK,SAAS;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,WAAW;AAAA,EACtD,YAAY,UAAU,iBAAiB,WAAoB;AACzD,UAAM,SAAS,uBAAuB,KAAK,SAAS;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,WAAW;AAAA,EAGlD,YAAY,UAAU,uBAAuB,YAAqB,WAAoB;AACpF,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EAGnD,YAAY,SAAiB,SAAmB,WAAoB;AAClE,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB,WAAoB;AAC/C,UAAM,SAAS,aAAa,KAAK,SAAS;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,YAAY,SAAiB,QAAgB,WAAoB;AAC/D,UAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe;AAC9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,WAAW;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,2BAA2B,GAAG;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;;;ACpFA,eAAsB,MAAM,IAA2B;AACrD,SAAO,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AACvD;AAEO,SAAS,gBAAgB,SAAiB,SAAS,KAAa;AACrE,QAAM,MAAM,KAAK,IAAI,SAAS,KAAK,SAAS,IAAK;AACjD,SAAO,OAAO,OAAO,KAAK,OAAO,IAAI;AACvC;AAEO,SAAS,YAAY,QAAyB;AACnD,SAAO,WAAW,OAAO,UAAU;AACrC;;;ACCA,IAAM,cAAc;AAcb,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,IAAO,MAAc,SAAoD;AAC7E,WAAO,KAAK,QAAW,OAAO,MAAM,QAAW,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAAe,SAAoD;AAC7F,WAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,OAAO;AAAA,EACpD;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACA,SACA,UAAU,GACgB;AAC1B,UAAM,SAAa,SAAS,UAAc,KAAK,KAAK;AACpD,UAAM,UAAa,SAAS,WAAc,KAAK,KAAK;AACpD,UAAM,aAAa,SAAS,cAAc,KAAK,KAAK;AAEpD,UAAM,MAAM,GAAG,KAAK,KAAK,OAAO,GAAG,IAAI;AACvC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAqB;AAAA,MACrB,mBAAqB;AAAA,MACrB,cAAqB,cAAc,WAAW;AAAA,MAC9C,qBAAqB;AAAA,IACvB;AACA,QAAI,SAAS,gBAAgB;AAC3B,cAAQ,iBAAiB,IAAI,QAAQ;AAAA,IACvC;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,WAAW;AAAA,QACnB;AAAA,QACA,MAAM,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,mBAAa,KAAK;AAClB,UAAI,IAAI,SAAS,cAAc;AAC7B,cAAM,IAAI,kBAAkB,2BAA2B,OAAO,IAAI;AAAA,MACpE;AACA,YAAM,IAAI,kBAAkB,IAAI,WAAW,eAAe;AAAA,IAC5D,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAM,aAAqC,CAAC;AAC5C,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAE,iBAAW,GAAG,IAAI;AAAA,IAAO,CAAC;AAChE,UAAM,eAAiC;AAAA,MACrC;AAAA,MACA,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AAEA,QAAI,IAAI,IAAI;AACV,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B;AAGA,QAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,YAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,YAAM,QAAQ,aAAa,SAAS,YAAY,EAAE,IAAI,MAAO,gBAAgB,OAAO;AACpF,YAAM,MAAM,KAAK;AACjB,aAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,IACjE;AAEA,QAAI,UAAe,CAAC;AACpB,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC3C,UAAM,UAAkB,SAAS,SAAS,SAAS,WAAW,IAAI;AAElE,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,SAAS,SAAS,SAAS;AAAA,MAC7E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AACF;;;AChHO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BhD,MAAM,OACJ,QACA,MACiD;AACjD,UAAM,EAAE,aAAa,kBAAkB,mBAAmB,eAAe,IAAI;AAG7E,UAAM,WAAW,YAAY,WAAW,MAAM;AAC9C,QAAI;AAEJ,QAAI,UAAU;AACZ,iBAAW,MAAM,KAAK,KAAK,KAAU,kBAAkB;AAAA,QACrD;AAAA,QACA,UAAW,qBAAqB;AAAA,QAChC,QAAW;AAAA,MACb,GAAG,IAAI;AAAA,IACT,OAAO;AAGL,iBAAW,MAAM,KAAK,KAAK,KAAU,2BAA2B;AAAA,QAC9D;AAAA,QACA,UAAU,qBAAqB;AAAA,QAC/B,QAAU;AAAA,QACV,QAAU,EAAE,gBAAgB,kBAAkB,WAAW,OAAO,WAAW,EAAE;AAAA,MAC/E,GAAG,IAAI;AAAA,IACT;AAEA,UAAM,MAAW,SAAS;AAE1B,WAAO;AAAA,MACL,IAAqB,IAAI,MAAM,OAAO,IAAI,gBAAgB,WAAW,OAAO,WAAW,CAAC;AAAA,MACxF,QAAqB,IAAI,UAAU;AAAA,MACnC,aAAqB,IAAI,eAAe;AAAA,MACxC,eAAqB,IAAI,iBAAiB;AAAA,MAC1C,SAAqB,IAAI,WAAW;AAAA,MACpC,SAAqB,IAAI,YAAY,IAAI,YAAY,kBAAkB,aAAa,IAAI,YAAY,kBAAkB,aAAa;AAAA,MACnI,MAAqB,IAAI;AAAA,MACzB,YAAqB,IAAI,cAAc,EAAE,iBAAiB,IAAI,mBAAmB,GAAG,eAAe,GAAG,eAAe,GAAG,oBAAoB,EAAE;AAAA,MAC9I,YAAqB,IAAI,cAAc,EAAE,MAAM,IAAI,uBAAuB,YAAY,OAAO,GAAG,aAAa,GAAG;AAAA,MAChH,OAAqB,IAAI,SAAS,EAAE,MAAM,IAAI,cAAc,IAAI,gBAAgB,IAAI,WAAW,IAAI,OAAM,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MAClI,aAAqB,IAAI,eAAe,EAAE,YAAY,IAAI,cAAc,EAAE;AAAA,MAC1E,gBAAqB,IAAI,kBAAkB;AAAA,MAC3C,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,mBAAqB,IAAI;AAAA,MACzB,mBAAqB,IAAI;AAAA,MACzB,cAAqB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;;;AC3EO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,SACJ,YACA,MACqC;AACrC,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,2BAA2B,mBAAmB,UAAU,CAAC;AAAA,MACzD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KACJ,SAA8B,CAAC,GAC/B,MACyC;AACzC,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,OAAgB,IAAG,IAAI,UAAU,OAAO,MAAM;AACzD,QAAI,OAAO,aAAgB,IAAG,IAAI,gBAAgB,OAAO,YAAY;AACrE,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,SAAS,KAAO,IAAG,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAC/D,QAAI,OAAO,UAAU,KAAM,IAAG,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AACjE,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,EAAE,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAClD,0BAA0B,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AAGA,UAAM,aAA2B;AAAA,MAC/B,MAAQ,MAAM,QAAQ,GAAG,IAAI,MAAO,IAAI,aAAa,IAAI,QAAQ,CAAC;AAAA,MAClE,OAAQ,IAAI,UAAU,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS;AAAA,MACxD,OAAQ,OAAO,SAAS;AAAA,MACxB,QAAQ,OAAO,UAAU;AAAA,IAC3B;AAEA,WAAO,EAAE,GAAG,YAAY,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,eACL,SAA8B,CAAC,GAC/B,MAC0B;AAC1B,QAAI,SAAS,OAAO,UAAU;AAC9B,UAAM,QAAQ,OAAO,SAAS;AAE9B,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,GAAG,QAAQ,QAAQ,MAAM,GAAG,IAAI;AAC/D,iBAAW,QAAQ,KAAK,KAAM,OAAM;AACpC,UAAI,KAAK,KAAK,SAAS,SAAS,SAAS,KAAK,KAAK,UAAU,KAAK,MAAO;AACzE,gBAAU,KAAK,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OACJ,YACA,MAC2C;AAC3C,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,MACnD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;AC7GO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAchD,MAAM,SACJ,QACA,MACqD;AACrD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,qBACJ,QACA,MACuD;AACvD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;ACrDA,SAAS,WAAW,KAAyB;AAC3C,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AAClG,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AAC7C,QAAI,MAAM,IAAI,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AACzF,UAAM,IAAI,CAAC,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAe,GAAwB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAEO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBpB,MAAM,eACJ,SACA,WACA,QACA,mBAAmB,KACS;AAC5B,UAAM,OAAO,OAAO,YAAY,WAC5B,UACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAGpC,UAAM,QAAgC,CAAC;AACvC,eAAW,QAAQ,UAAU,MAAM,GAAG,GAAG;AACvC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,KAAK,GAAI,OAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,IACzE;AAEA,QAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,SAAS,MAAM,GAAG,GAAG,EAAE;AACzC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,wCAAwC;AAAA,IAC/E;AAEA,UAAM,UAAU,KAAK,IAAI,KAAK,IAAI,IAAI,MAAO,SAAS;AACtD,QAAI,mBAAmB,KAAK,UAAU,kBAAkB;AACtD,YAAM,IAAI;AAAA,QACR,8BAA8B,KAAK,MAAM,OAAO,CAAC,OAAO,gBAAgB;AAAA,MAE1E;AAAA,IACF;AAGA,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA,IAAI,OAAO,MAAM;AAAA,MACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AACA,UAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI;AAC3C,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,IAAI,OAAO,aAAa;AAAA,IAC1B;AACA,UAAM,WAAW,IAAI,WAAW,WAAW;AAC3C,UAAM,WAAW,WAAW,MAAM,IAAI,CAAC;AAEvC,QAAI,CAAC,UAAU,UAAU,QAAQ,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI,2BAA2B,mCAAmC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,SACA,WACA,QACA,mBAAmB,KACD;AAClB,QAAI;AACF,YAAM,KAAK,eAAe,SAAS,WAAW,QAAQ,gBAAgB;AACtE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC5HA,IAAM,mBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAoB;AAEnB,IAAM,QAAN,MAAY;AAAA,EASjB;AAAA,SAAgB,SAAS;AAAA;AAAA,EAEzB,YAAY,QAAgB,SAAsB,CAAC,GAAG;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,YAAM,IAAW;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,WAAW,WAAW,IAAI,SAAS;AAEtD,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B;AAAA,MACA,UAAa,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AAAA,MAClE,YAAY,OAAO,cAAc;AAAA,MACjC,SAAY,OAAO,WAAc;AAAA,IACnC,CAAC;AAED,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,aAAa,IAAI,WAAW,IAAI;AACrC,SAAK,WAAa,IAAI,SAAS;AAAA,EACjC;AACF;;;ACnBA,IAAM,wBAAwB;AAE9B,eAAsB,IAAI,QAAmB,MAAuC;AAClF,QAAM,EAAE,WAAW,QAAQ,QAAQ,GAAG,KAAK,IAAI;AAC/C,MAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAGA,QAAM,QACJ,UAAU,OAAO,WAAW,WAAW,SAAU;AAEnD,QAAM,QAAQ,MAAM,WAAW,uBAAuB,QAAQ,OAAO,EAAE;AACvE,QAAM,MAAM,GAAG,IAAI,2BAA2B,mBAAmB,SAAS,CAAC;AAE3E,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,IAC9C,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,QAAM,OAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,MAAM,MAAM,SAAS,4BAA4B,IAAI,MAAM,GAAG;AAAA,EAC1E;AAEA,SAAO;AAAA,IACL,SAAS,KAAK,YAAY;AAAA,IAC1B,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,MAAM,KAAK,mBAAmB;AAAA,IAC9B,UAAU,KAAK;AAAA,IACf,KAAK,KAAK;AAAA,IACV,WAAW;AAAA,MACT,IAAI,KAAK,UAAU,MAAM;AAAA,MACzB,OAAO,KAAK,UAAU,SAAS;AAAA,MAC/B,UAAU,KAAK,UAAU,YAAY;AAAA,IACvC;AAAA,IACA,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,EAC1C;AACF;AAMO,IAAM,QAAQ,EAAE,IAAI;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,489 @@
+interface VerifyDecisionParams {
+    /** Artifact ID from NOMOS Studio or the Exchange */
+    artifact_id: string;
+    /** The data fields this decision is based on */
+    decision_context: Record<string, unknown>;
+    /** Optional: the AI's proposed decision (for audit trail) */
+    proposed_decision?: string;
+    /** Optional: unique ID for idempotency */
+    correlation_id?: string;
+}
+interface ListArtifactsParams {
+    /** Filter by autonomy band */
+    band?: 'autonomous' | 'bounded' | 'human_governed';
+    /** Filter by domain */
+    domain?: string;
+    /** Filter by jurisdiction tag */
+    jurisdiction?: string;
+    /** Sort order */
+    sort?: 'newest' | 'top_rated' | 'most_used';
+    /** Number of results (default 20, max 100) */
+    limit?: number;
+    /** Pagination offset */
+    offset?: number;
+}
+interface GenerateGovernanceParams {
+    /** Policy documents as plain text */
+    policies: string[];
+    /** Historical decision logs (CSV rows or JSON objects) */
+    decision_logs?: Record<string, unknown>[];
+    /** Domain name (e.g. "loan_approval") */
+    domain?: string;
+    /** Organisation name */
+    organisation?: string;
+}
+interface DetectContradictionsParams {
+    /** Array of rules to check */
+    rules: Array<{
+        id: string;
+        condition: string;
+        outcome: string;
+        priority?: number;
+    }>;
+}
+type Verdict = 'approved' | 'rejected' | 'escalated';
+type CanVerdict = 'AUTHORIZED' | 'DENIED' | 'ESCALATED';
+interface CanParams {
+    /** Exchange artifact id or slug, e.g. "eu-ai-act-full-regulation-2024-1689" */
+    authority: string;
+    /** Optional human-readable label for what's being asked (recorded in the transcript) */
+    action?: string;
+    /** The facts to evaluate. Either pass this explicitly, or spread the facts flat alongside
+     *  `authority`/`action` — both shapes are accepted (explicit `inputs` wins if both given). */
+    inputs?: Record<string, unknown>;
+    /** Flat-facts convenience: any extra keys are treated as inputs when `inputs` is omitted. */
+    [key: string]: unknown;
+}
+interface CanOptions {
+    /** Override the API host (defaults to the public NOMOS Exchange). */
+    baseUrl?: string;
+    /** AbortSignal to cancel the request. */
+    signal?: AbortSignal;
+}
+interface CanResult {
+    /** True only for an AUTHORIZED verdict. DENIED and ESCALATED are both `false`. */
+    allowed: boolean;
+    /** The authority's own verdict, verbatim. */
+    verdict: CanVerdict;
+    /** Human-readable explanation of the verdict. */
+    reason: string;
+    /** The rule id that decided it, if any. */
+    rule: string | null;
+    /** Permanent, addressable transcript id — open it any time. */
+    query_id: string;
+    /** Relative URL of the transcript. */
+    url: string;
+    /** Which authority answered, and its standing. */
+    authority: {
+        id: string;
+        title: string;
+        standing: string;
+    };
+    /** On ESCALATED: the facts the authority still needs to reach a verdict. */
+    missing_inputs: string[];
+}
+interface VerifyDecisionResult {
+    /** Unique request ID — include in support tickets */
+    id: string;
+    /** Always "decision" */
+    object: 'decision';
+    /** The artifact that governed this decision */
+    artifact_id: string;
+    /** Artifact name */
+    artifact_name: string;
+    /** Whether the decision is permitted under current governance */
+    allowed: boolean;
+    /** Human-readable verdict */
+    verdict: Verdict;
+    /** The rule that triggered this verdict, if any */
+    rule?: {
+        id: string;
+        description: string | null;
+        action: 'allow' | 'deny' | 'escalate';
+    };
+    /** Evaluation metrics */
+    evaluation: {
+        rules_evaluated: number;
+        rules_matched: number;
+        rules_expired: number;
+        conflicts_resolved: number;
+    };
+    /** Confidence in the verdict */
+    confidence: {
+        /** Artifact verification tier */
+        tier: string;
+        /** 0–1 confidence score */
+        score: number;
+        /** Human-readable explanation of the tier */
+        description: string;
+    };
+    /** Audit record — store the hash for compliance */
+    audit: {
+        hash: string;
+        timestamp: string;
+    };
+    /** Performance metrics */
+    performance: {
+        latency_ms: number;
+    };
+    /** API schema version */
+    schema_version: string;
+    /** Human-readable explanation */
+    verdict_description: string;
+    /** Missing input fields, if any rule-referenced fields were absent */
+    incomplete_inputs?: {
+        fields: string[];
+        count: number;
+        warning: string;
+    };
+    /** How to satisfy an approval rule when current verdict is not approved */
+    paths_to_approval?: Array<{
+        rule_id: string | null;
+        rule_name: string | null;
+        required_changes: Array<{
+            field: string;
+            current: unknown;
+            must_satisfy: string;
+        }>;
+    }>;
+}
+interface Artifact {
+    id: string;
+    title: string;
+    description?: string;
+    domain?: string;
+    verification_tier: 'DECLARED' | 'VALIDATED' | 'CERTIFIED' | 'PROVEN' | 'SOVEREIGN';
+    autonomy_band: 'autonomous' | 'bounded' | 'human_governed';
+    ari_score?: number;
+    rule_count?: number;
+    jurisdiction_tags: string[];
+    industry_tags: string[];
+    publisher_org?: string;
+    seal_hash?: string;
+    downloads: number;
+    rating?: number;
+    price_usd: number;
+    published_at?: string;
+    created_at: string;
+}
+interface ArtifactList {
+    data: Artifact[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+interface ArtifactSchemaField {
+    name: string;
+    type: 'string' | 'number' | 'integer' | 'boolean' | 'date' | 'datetime' | 'enum' | 'array';
+    required: boolean;
+    description?: string;
+    enum?: string[];
+    min?: number;
+    max?: number;
+    format?: string;
+}
+interface ArtifactSchema {
+    artifact_id: string;
+    name: string;
+    fields: ArtifactSchemaField[];
+    required_fields: string[];
+    example_inputs: Record<string, unknown>;
+    field_count: number;
+}
+interface Contradiction {
+    type: 'threshold_conflict' | 'role_conflict' | 'ghost_term' | 'rule_collision' | 'layer_divergence';
+    severity: 'critical' | 'warning' | 'info';
+    rule_ids: string[];
+    description: string;
+    suggested_resolution?: string;
+}
+interface DetectContradictionsResult {
+    contradiction_count: number;
+    contradictions: Contradiction[];
+    clean: boolean;
+}
+interface GenerateGovernanceResult {
+    artifact_id: string;
+    seal_hash: string;
+    ari_score: number;
+    autonomy_band: 'autonomous' | 'bounded' | 'human_governed';
+    rule_count: number;
+    verification_tier: string;
+    download_url?: string;
+}
+interface NomosConfig {
+    /** Base URL override — defaults to https://nomos.ai */
+    baseUrl?: string;
+    /** Max retries on 429 / 5xx (default: 3) */
+    maxRetries?: number;
+    /** Request timeout in ms (default: 30000) */
+    timeout?: number;
+}
+interface RequestOptions {
+    /** Per-request timeout override in ms */
+    timeout?: number;
+    /** Per-request max retries override */
+    maxRetries?: number;
+    /** Idempotency key — safe to retry the same request server-side */
+    idempotencyKey?: string;
+    /** Per-request API key — useful for multi-tenant platforms */
+    apiKey?: string;
+}
+interface NomosRawResponse {
+    /** x-request-id header value — include in support tickets */
+    requestId: string;
+    statusCode: number;
+    headers: Record<string, string>;
+}
+/** Every SDK response carries `.lastResponse` for debugging and tracing. */
+type WithLastResponse<T> = T & {
+    lastResponse: NomosRawResponse;
+};
+type NomosWebhookEventType = 'artifact.sealed' | 'artifact.published' | 'decision.verified' | 'decision.escalated' | 'exchange.purchased' | 'exchange.reviewed' | 'drift.detected';
+interface NomosWebhookEvent {
+    id: string;
+    type: NomosWebhookEventType;
+    created: number;
+    artifact_id?: string;
+    data: Record<string, unknown>;
+}
+
+interface HttpClientOptions {
+    apiKey: string;
+    baseUrl: string;
+    maxRetries: number;
+    timeout: number;
+}
+interface HttpResponse<T> {
+    data: T;
+    lastResponse: NomosRawResponse;
+}
+declare class HttpClient {
+    private readonly opts;
+    constructor(opts: HttpClientOptions);
+    get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>>;
+    post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>>;
+    private request;
+}
+
+declare class Decisions {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Verify whether an AI decision is permitted under a governance artifact.
+     *
+     * Public demo artifacts (`pub_*`) work without an API key.
+     * Custom artifacts require a valid API key.
+     *
+     * @example
+     * const result = await nomos.decisions.verify({
+     *   artifact_id: 'pub_lending_v1',
+     *   decision_context: { credit_score: 720, loan_amount: 50000 },
+     * });
+     *
+     * if (!result.allowed) {
+     *   throw new Error(`Blocked: ${result.verdict_description}`);
+     * }
+     *
+     * // Debugging / tracing
+     * console.log(result.lastResponse.requestId);
+     *
+     * @example
+     * // Per-request options
+     * const result = await nomos.decisions.verify(params, {
+     *   idempotencyKey: `verify-${transactionId}`,
+     *   timeout: 5000,
+     * });
+     */
+    verify(params: VerifyDecisionParams, opts?: RequestOptions): Promise<WithLastResponse<VerifyDecisionResult>>;
+}
+
+declare class Artifacts {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Retrieve a single artifact by ID.
+     *
+     * @example
+     * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');
+     * console.log(artifact.ari_score, artifact.autonomy_band);
+     * console.log(artifact.lastResponse.requestId); // for support tickets
+     */
+    retrieve(artifactId: string, opts?: RequestOptions): Promise<WithLastResponse<Artifact>>;
+    /**
+     * List published artifacts on the Exchange with optional filters.
+     *
+     * @example
+     * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });
+     *
+     * @example
+     * // With per-request options
+     * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });
+     */
+    list(params?: ListArtifactsParams, opts?: RequestOptions): Promise<WithLastResponse<ArtifactList>>;
+    /**
+     * Auto-paginating iterator — yields every artifact across all pages.
+     * Stops automatically when the last page is reached.
+     *
+     * @example
+     * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {
+     *   console.log(artifact.title, artifact.ari_score);
+     * }
+     */
+    listAutoPaging(params?: ListArtifactsParams, opts?: RequestOptions): AsyncGenerator<Artifact>;
+    /**
+     * Retrieve the declared input schema for a sealed artifact.
+     *
+     * Returns every field the artifact's rules reference — name, type, whether it's
+     * required, and a ready-to-use example_inputs object. Use this to build forms,
+     * validate payloads, or generate API docs without reading the rules manually.
+     *
+     * Requires an API key (artifact schemas are not public).
+     *
+     * @example
+     * const schema = await nomos.artifacts.schema('art_abc123');
+     * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+     * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+     */
+    schema(artifactId: string, opts?: RequestOptions): Promise<WithLastResponse<ArtifactSchema>>;
+}
+
+declare class Governance {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Generate a sealed .nomos governance artifact from policy documents
+     * and optional historical decision logs.
+     *
+     * @example
+     * const artifact = await nomos.governance.generate({
+     *   policies: [policyText],
+     *   decision_logs: historicalRows,
+     *   domain: 'loan_approval',
+     * });
+     * console.log(artifact.ari_score, artifact.seal_hash);
+     */
+    generate(params: GenerateGovernanceParams, opts?: RequestOptions): Promise<WithLastResponse<GenerateGovernanceResult>>;
+    /**
+     * Detect contradictions and conflicts in a rule set before sealing.
+     *
+     * @example
+     * const report = await nomos.governance.detectContradictions({ rules });
+     * if (!report.clean) {
+     *   console.log(report.contradictions);
+     * }
+     */
+    detectContradictions(params: DetectContradictionsParams, opts?: RequestOptions): Promise<WithLastResponse<DetectContradictionsResult>>;
+}
+
+declare class Webhooks {
+    /**
+     * Verify a NOMOS webhook signature and return the parsed event.
+     *
+     * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`
+     * Signed payload: `<timestamp>.<raw_body>`
+     *
+     * @example
+     * // Express
+     * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {
+     *   const event = await nomos.webhooks.constructEvent(
+     *     req.body,
+     *     req.headers['nomos-signature'] as string,
+     *     process.env.NOMOS_WEBHOOK_SECRET!,
+     *   );
+     *   console.log(event.type, event.data);
+     *   res.sendStatus(200);
+     * });
+     *
+     * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed
+     */
+    constructEvent(payload: string | Uint8Array, signature: string, secret: string, toleranceSeconds?: number): Promise<NomosWebhookEvent>;
+    /**
+     * Verify a webhook signature without parsing the event.
+     * Returns `true` if valid, `false` if not (never throws).
+     *
+     * @example
+     * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);
+     * if (!valid) return res.sendStatus(400);
+     */
+    verifySignature(payload: string | Uint8Array, signature: string, secret: string, toleranceSeconds?: number): Promise<boolean>;
+}
+
+type NomosErrorCode = 'authentication_error' | 'authorization_error' | 'rate_limit_error' | 'validation_error' | 'not_found' | 'api_error' | 'network_error' | 'webhook_signature_error';
+declare class NomosError extends Error {
+    readonly code: NomosErrorCode;
+    readonly status?: number;
+    readonly requestId?: string;
+    constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string);
+}
+declare class NomosAuthenticationError extends NomosError {
+    constructor(message?: string, requestId?: string);
+}
+declare class NomosAuthorizationError extends NomosError {
+    constructor(message?: string, requestId?: string);
+}
+declare class NomosRateLimitError extends NomosError {
+    readonly retryAfter?: number;
+    constructor(message?: string, retryAfter?: number, requestId?: string);
+}
+declare class NomosValidationError extends NomosError {
+    readonly details?: unknown;
+    constructor(message: string, details?: unknown, requestId?: string);
+}
+declare class NomosNotFoundError extends NomosError {
+    constructor(message: string, requestId?: string);
+}
+declare class NomosAPIError extends NomosError {
+    constructor(message: string, status: number, requestId?: string);
+}
+declare class NomosNetworkError extends NomosError {
+    constructor(message: string);
+}
+declare class NomosWebhookSignatureError extends NomosError {
+    constructor(message: string);
+}
+
+type errors_NomosAPIError = NomosAPIError;
+declare const errors_NomosAPIError: typeof NomosAPIError;
+type errors_NomosAuthenticationError = NomosAuthenticationError;
+declare const errors_NomosAuthenticationError: typeof NomosAuthenticationError;
+type errors_NomosAuthorizationError = NomosAuthorizationError;
+declare const errors_NomosAuthorizationError: typeof NomosAuthorizationError;
+type errors_NomosError = NomosError;
+declare const errors_NomosError: typeof NomosError;
+type errors_NomosErrorCode = NomosErrorCode;
+type errors_NomosNetworkError = NomosNetworkError;
+declare const errors_NomosNetworkError: typeof NomosNetworkError;
+type errors_NomosNotFoundError = NomosNotFoundError;
+declare const errors_NomosNotFoundError: typeof NomosNotFoundError;
+type errors_NomosRateLimitError = NomosRateLimitError;
+declare const errors_NomosRateLimitError: typeof NomosRateLimitError;
+type errors_NomosValidationError = NomosValidationError;
+declare const errors_NomosValidationError: typeof NomosValidationError;
+type errors_NomosWebhookSignatureError = NomosWebhookSignatureError;
+declare const errors_NomosWebhookSignatureError: typeof NomosWebhookSignatureError;
+declare namespace errors {
+  export { errors_NomosAPIError as NomosAPIError, errors_NomosAuthenticationError as NomosAuthenticationError, errors_NomosAuthorizationError as NomosAuthorizationError, errors_NomosError as NomosError, type errors_NomosErrorCode as NomosErrorCode, errors_NomosNetworkError as NomosNetworkError, errors_NomosNotFoundError as NomosNotFoundError, errors_NomosRateLimitError as NomosRateLimitError, errors_NomosValidationError as NomosValidationError, errors_NomosWebhookSignatureError as NomosWebhookSignatureError };
+}
+
+declare class Nomos {
+    readonly decisions: Decisions;
+    readonly artifacts: Artifacts;
+    readonly governance: Governance;
+    readonly webhooks: Webhooks;
+    /** Whether this instance is using a live or test API key. */
+    readonly mode: 'live' | 'test';
+    static readonly errors: typeof errors;
+    constructor(apiKey: string, config?: NomosConfig);
+}
+
+declare function can(params: CanParams, opts?: CanOptions): Promise<CanResult>;
+/**
+ * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.
+ * For authenticated, key-scoped operations use the `Nomos` class instead.
+ */
+declare const nomos: {
+    can: typeof can;
+};
+
+export { type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type CanOptions, type CanParams, type CanResult, type CanVerdict, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type ListArtifactsParams, Nomos, NomosAPIError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosError, type NomosErrorCode, NomosNetworkError, NomosNotFoundError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type RequestOptions, type Verdict, type VerifyDecisionParams, type VerifyDecisionResult, type WithLastResponse, can, nomos };