@nomosprotocol/sdk 1.1.0 → 1.2.1

package/README.md

@@ -0,0 +1,118 @@
+# @nomosprotocol/sdk
+
+Official TypeScript SDK for [NOMOS](https://www.nomosprotocol.com) — ask a public authority a question from your code and get back a deterministic, cryptographically verifiable verdict.
+
+```bash
+npm install @nomosprotocol/sdk
+```
+
+## `nomos.can()` — the keyless primitive
+
+Every public authority on the [NOMOS Exchange](https://www.nomosprotocol.com/exchange) is queryable with one call. No API key, no setup — this is the front door.
+
+```ts
+import { nomos } from "@nomosprotocol/sdk";
+
+const verdict = await nomos.can({
+  authority: "eu-ai-act.nomos",
+  ai_categorises_biometric_data_for_sensitive_attributes: true,
+});
+
+if (!verdict.allowed) {
+  console.log(verdict.verdict);   // "DENIED"
+  console.log(verdict.reason);    // why
+  console.log(verdict.query_id);  // permanent transcript id
+}
+```
+
+Facts can be spread flat alongside `authority` (as above), or passed explicitly:
+
+```ts
+const verdict = await nomos.can({
+  authority: "eu-ai-act.nomos",
+  inputs: { ai_categorises_biometric_data_for_sensitive_attributes: true },
+  action: "screen a new feature before launch", // optional, recorded in the transcript
+});
+```
+
+### The verdict
+
+`nomos.can()` always returns the authority's own verdict, verbatim — nothing invented, nothing paraphrased:
+
+| Field | Type | Meaning |
+|---|---|---|
+| `allowed` | `boolean` | `true` only when `verdict === "AUTHORIZED"` |
+| `verdict` | `"AUTHORIZED" \| "DENIED" \| "ESCALATED"` | The authority's own answer |
+| `reason` | `string` | Human-readable explanation |
+| `rule` | `string \| null` | The rule id that decided it, if any |
+| `query_id` | `string` | Permanent, addressable transcript id |
+| `url` | `string` | Path to the transcript's permalink page |
+| `authority` | `{ id, title, standing }` | Which authority answered, and its standing |
+| `missing_inputs` | `string[]` | Fields the authority needed but didn't get — present on `ESCALATED` |
+
+`ESCALATED` means the authority needs more facts to decide — not a flat no. Check `missing_inputs` for what to supply.
+
+Every call mints a permanent, cryptographically sealed transcript — open `query_id` any time at `nomosprotocol.com/queries/<query_id>` to replay exactly what was asked and answered, bound to the exact authority version that responded.
+
+### Error handling
+
+A failed call (unknown authority, network issue, upstream error) rejects with a typed `NomosError` subclass — never a bare `Error` — so you can branch on `instanceof` or the stable `.code` string:
+
+```ts
+import { nomos, NomosNotFoundError, NomosNetworkError } from "@nomosprotocol/sdk";
+
+try {
+  const verdict = await nomos.can({ authority: "eu-ai-act.nomos", ...facts });
+} catch (err) {
+  if (err instanceof NomosNotFoundError) {
+    // authority slug/id doesn't exist — err.code === 'not_found'
+  } else if (err instanceof NomosNetworkError) {
+    // request timed out or the network failed
+  } else {
+    throw err;
+  }
+}
+```
+
+### Options
+
+```ts
+await nomos.can(
+  { authority: "...", ...facts },
+  {
+    baseUrl: "https://www.nomosprotocol.com", // override for local/staging use
+    signal: abortController.signal,           // cancel the request
+  },
+);
+```
+
+## `Nomos` — authenticated client
+
+For private/custom artifacts, governance generation, and webhook verification, use the authenticated client:
+
+```ts
+import { Nomos } from "@nomosprotocol/sdk";
+
+const client = new Nomos("nms_live_..."); // or "nms_test_..." for test mode
+
+const result = await client.decisions.verify({
+  artifact_id: "your_artifact_id",
+  decision_context: { /* facts */ },
+});
+
+for await (const artifact of client.artifacts.listAutoPaging()) {
+  console.log(artifact.id);
+}
+
+const event = await client.webhooks.constructEvent(payload, signatureHeader, webhookSecret);
+```
+
+See [nomosprotocol.com/docs](https://www.nomosprotocol.com/docs) for full API reference, error types, and webhook event shapes.
+
+## Requirements
+
+Node.js 18+. Ships as dual ESM/CJS with full TypeScript types.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -29,7 +29,9 @@ __export(index_exports, {
   NomosNotFoundError: () => NomosNotFoundError,
   NomosRateLimitError: () => NomosRateLimitError,
   NomosValidationError: () => NomosValidationError,
-  NomosWebhookSignatureError: () => NomosWebhookSignatureError
+  NomosWebhookSignatureError: () => NomosWebhookSignatureError,
+  can: () => can,
+  nomos: () => nomos
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -255,21 +257,28 @@ var Decisions = class {
     } else {
       httpResp = await this.http.post("/api/v1/verify-decision", {
         artifact_id,
-        decision_context,
-        proposed_decision,
-        correlation_id: correlation_id ?? globalThis.crypto.randomUUID()
+        decision: proposed_decision ?? "evaluate",
+        inputs: decision_context,
+        caller: { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() }
       }, opts);
     }
     const raw = httpResp.data;
     return {
+      id: raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,
+      object: raw.object ?? "decision",
+      artifact_id: raw.artifact_id ?? artifact_id,
+      artifact_name: raw.artifact_name ?? "",
       allowed: raw.allowed ?? false,
-      verdict: raw.outcome ?? raw.verdict ?? "pending_human_review",
+      verdict: raw.verdict ?? (raw.outcome === "auto_approved" ? "approved" : raw.outcome === "auto_rejected" ? "rejected" : "escalated"),
+      rule: raw.rule,
+      evaluation: raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },
+      confidence: raw.confidence ?? { tier: raw.artifact_confidence ?? "DECLARED", score: 1, description: "" },
+      audit: raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? "", timestamp: raw.ts ?? (/* @__PURE__ */ new Date()).toISOString() },
+      performance: raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },
+      schema_version: raw.schema_version ?? "1.0.0",
       verdict_description: raw.verdict_description ?? "",
-      rule_reference: raw.rule_reference ?? raw.rule_applied,
-      audit_record: raw.audit_record ?? raw.audit_hash,
-      artifact_id: raw.artifact_id ?? artifact_id,
-      execution_id: raw.execution_id,
-      decided_at: raw.decided_at ?? raw.evaluated_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+      incomplete_inputs: raw.incomplete_inputs,
+      paths_to_approval: raw.paths_to_approval,
       lastResponse: httpResp.lastResponse
     };
   }
@@ -345,6 +354,27 @@ var Artifacts = class {
       offset += page.data.length;
     }
   }
+  /**
+   * Retrieve the declared input schema for a sealed artifact.
+   *
+   * Returns every field the artifact's rules reference — name, type, whether it's
+   * required, and a ready-to-use example_inputs object. Use this to build forms,
+   * validate payloads, or generate API docs without reading the rules manually.
+   *
+   * Requires an API key (artifact schemas are not public).
+   *
+   * @example
+   * const schema = await nomos.artifacts.schema('art_abc123');
+   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+   */
+  async schema(artifactId, opts) {
+    const { data, lastResponse } = await this.http.get(
+      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
 };
 
 // src/resources/governance.ts
@@ -523,6 +553,69 @@ var Nomos = class {
     this.webhooks = new Webhooks();
   }
 };
+
+// src/can.ts
+var DEFAULT_EXCHANGE_BASE = "https://www.nomosprotocol.com";
+async function can(params, opts) {
+  const { authority, action, inputs, ...flat } = params;
+  if (!authority || typeof authority !== "string") {
+    throw new Error("can(): `authority` (an Exchange artifact id or slug) is required.");
+  }
+  const facts = inputs && typeof inputs === "object" ? inputs : flat;
+  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\/$/, "");
+  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ inputs: facts, action }),
+      signal: opts?.signal
+    });
+  } catch (err) {
+    if (err?.name === "AbortError") throw new NomosNetworkError("Request aborted");
+    throw new NomosNetworkError(err?.message ?? "Network error");
+  }
+  const requestId = res.headers.get("x-request-id") ?? "";
+  const data = await res.json().catch(() => null);
+  if (!res.ok) {
+    const message = data?.error ?? data?.message ?? `NOMOS query failed (HTTP ${res.status})`;
+    switch (res.status) {
+      case 401:
+        throw new NomosAuthenticationError(message, requestId);
+      case 403:
+        throw new NomosAuthorizationError(message, requestId);
+      case 404:
+        throw new NomosNotFoundError(message, requestId);
+      case 422:
+      case 400:
+        throw new NomosValidationError(message, data?.details, requestId);
+      case 429:
+        throw new NomosRateLimitError(
+          message,
+          res.headers.get("retry-after") ? parseInt(res.headers.get("retry-after"), 10) : void 0,
+          requestId
+        );
+      default:
+        throw new NomosAPIError(message, res.status, requestId);
+    }
+  }
+  return {
+    allowed: data.verdict === "AUTHORIZED",
+    verdict: data.verdict,
+    reason: data.verdict_description,
+    rule: data.matched_rule_id ?? null,
+    query_id: data.query_id,
+    url: data.url,
+    authority: {
+      id: data.artifact?.id ?? authority,
+      title: data.artifact?.title ?? "",
+      standing: data.artifact?.standing ?? ""
+    },
+    missing_inputs: data.missing_inputs ?? []
+  };
+}
+var nomos = { can };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Nomos,
@@ -534,6 +627,8 @@ var Nomos = class {
   NomosNotFoundError,
   NomosRateLimitError,
   NomosValidationError,
-  NomosWebhookSignatureError
+  NomosWebhookSignatureError,
+  can,
+  nomos
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/util.ts","../src/http-client.ts","../src/resources/decisions.ts","../src/resources/artifacts.ts","../src/resources/governance.ts","../src/resources/webhooks.ts","../src/nomos.ts"],"sourcesContent":["export { Nomos } from './nomos.js';\nexport * from './errors.js';\nexport type {\n  NomosConfig,\n  RequestOptions,\n  NomosRawResponse,\n  WithLastResponse,\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  ListArtifactsParams,\n  ArtifactList,\n  Artifact,\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  Contradiction,\n  Verdict,\n  NomosWebhookEvent,\n  NomosWebhookEventType,\n} from './types.js';\n","export type NomosErrorCode =\n  | 'authentication_error'\n  | 'authorization_error'\n  | 'rate_limit_error'\n  | 'validation_error'\n  | 'not_found'\n  | 'api_error'\n  | 'network_error'\n  | 'webhook_signature_error';\n\nexport class NomosError extends Error {\n  readonly code: NomosErrorCode;\n  readonly status?: number;\n  readonly requestId?: string;\n\n  constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string) {\n    super(message);\n    this.name = 'NomosError';\n    this.code = code;\n    this.status = status;\n    this.requestId = requestId;\n  }\n}\n\nexport class NomosAuthenticationError extends NomosError {\n  constructor(message = 'Invalid API key', requestId?: string) {\n    super(message, 'authentication_error', 401, requestId);\n    this.name = 'NomosAuthenticationError';\n  }\n}\n\nexport class NomosAuthorizationError extends NomosError {\n  constructor(message = 'Access denied', requestId?: string) {\n    super(message, 'authorization_error', 403, requestId);\n    this.name = 'NomosAuthorizationError';\n  }\n}\n\nexport class NomosRateLimitError extends NomosError {\n  readonly retryAfter?: number;\n\n  constructor(message = 'Rate limit exceeded', retryAfter?: number, requestId?: string) {\n    super(message, 'rate_limit_error', 429, requestId);\n    this.name = 'NomosRateLimitError';\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class NomosValidationError extends NomosError {\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown, requestId?: string) {\n    super(message, 'validation_error', 400, requestId);\n    this.name = 'NomosValidationError';\n    this.details = details;\n  }\n}\n\nexport class NomosNotFoundError extends NomosError {\n  constructor(message: string, requestId?: string) {\n    super(message, 'not_found', 404, requestId);\n    this.name = 'NomosNotFoundError';\n  }\n}\n\nexport class NomosAPIError extends NomosError {\n  constructor(message: string, status: number, requestId?: string) {\n    super(message, 'api_error', status, requestId);\n    this.name = 'NomosAPIError';\n  }\n}\n\nexport class NomosNetworkError extends NomosError {\n  constructor(message: string) {\n    super(message, 'network_error');\n    this.name = 'NomosNetworkError';\n  }\n}\n\nexport class NomosWebhookSignatureError extends NomosError {\n  constructor(message: string) {\n    super(message, 'webhook_signature_error', 400);\n    this.name = 'NomosWebhookSignatureError';\n  }\n}\n","export async function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nexport function jitteredBackoff(attempt: number, baseMs = 500): number {\n  const exp = Math.min(baseMs * 2 ** attempt, 16000);\n  return exp * (0.75 + Math.random() * 0.5); // ±25% jitter\n}\n\nexport function isRetryable(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n","import {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\nimport { sleep, jitteredBackoff, isRetryable } from './util.js';\nimport type { RequestOptions, NomosRawResponse } from './types.js';\n\nconst SDK_VERSION = '1.1.0';\n\nexport interface HttpClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  maxRetries: number;\n  timeout: number;\n}\n\nexport interface HttpResponse<T> {\n  data: T;\n  lastResponse: NomosRawResponse;\n}\n\nexport class HttpClient {\n  constructor(private readonly opts: HttpClientOptions) {}\n\n  async get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('GET', path, undefined, reqOpts);\n  }\n\n  async post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('POST', path, body, reqOpts);\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    body: unknown,\n    reqOpts?: RequestOptions,\n    attempt = 0,\n  ): Promise<HttpResponse<T>> {\n    const apiKey     = reqOpts?.apiKey     ?? this.opts.apiKey;\n    const timeout    = reqOpts?.timeout    ?? this.opts.timeout;\n    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;\n\n    const url = `${this.opts.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n\n    const headers: Record<string, string> = {\n      'Content-Type':      'application/json',\n      'X-Nomos-Api-Key':   apiKey,\n      'User-Agent':        `nomos-node/${SDK_VERSION}`,\n      'NOMOS-SDK-Version': SDK_VERSION,\n    };\n    if (reqOpts?.idempotencyKey) {\n      headers['Idempotency-Key'] = reqOpts.idempotencyKey;\n    }\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        signal: controller.signal,\n        headers,\n        body: body != null ? JSON.stringify(body) : undefined,\n      });\n    } catch (err: any) {\n      clearTimeout(timer);\n      if (err.name === 'AbortError') {\n        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);\n      }\n      throw new NomosNetworkError(err.message ?? 'Network error');\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const requestId = res.headers.get('x-request-id') ?? '';\n    const rawHeaders: Record<string, string> = {};\n    res.headers.forEach((value, key) => { rawHeaders[key] = value; });\n    const lastResponse: NomosRawResponse = {\n      requestId,\n      statusCode: res.status,\n      headers: rawHeaders,\n    };\n\n    if (res.ok) {\n      const data = await res.json() as T;\n      return { data, lastResponse };\n    }\n\n    // Retry on 429 / 5xx\n    if (isRetryable(res.status) && attempt < maxRetries) {\n      const retryAfter = res.headers.get('retry-after');\n      const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : jitteredBackoff(attempt);\n      await sleep(delay);\n      return this.request<T>(method, path, body, reqOpts, attempt + 1);\n    }\n\n    let errBody: any = {};\n    try { errBody = await res.json(); } catch {}\n    const message: string = errBody?.error ?? errBody?.message ?? res.statusText;\n\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, errBody?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Decisions {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Verify whether an AI decision is permitted under a governance artifact.\n   *\n   * Public demo artifacts (`pub_*`) work without an API key.\n   * Custom artifacts require a valid API key.\n   *\n   * @example\n   * const result = await nomos.decisions.verify({\n   *   artifact_id: 'pub_lending_v1',\n   *   decision_context: { credit_score: 720, loan_amount: 50000 },\n   * });\n   *\n   * if (!result.allowed) {\n   *   throw new Error(`Blocked: ${result.verdict_description}`);\n   * }\n   *\n   * // Debugging / tracing\n   * console.log(result.lastResponse.requestId);\n   *\n   * @example\n   * // Per-request options\n   * const result = await nomos.decisions.verify(params, {\n   *   idempotencyKey: `verify-${transactionId}`,\n   *   timeout: 5000,\n   * });\n   */\n  async verify(\n    params: VerifyDecisionParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<VerifyDecisionResult>> {\n    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;\n\n    // Public artifacts (pub_*) use the open /verify endpoint — no API key required\n    const isPublic = artifact_id.startsWith('pub_');\n    let httpResp: Awaited<ReturnType<HttpClient['post']>>;\n\n    if (isPublic) {\n      httpResp = await this.http.post<any>('/api/v1/verify', {\n        artifact_id,\n        decision:  proposed_decision ?? 'evaluate',\n        inputs:    decision_context,\n      }, opts);\n    } else {\n      httpResp = await this.http.post<any>('/api/v1/verify-decision', {\n        artifact_id,\n        decision_context,\n        proposed_decision,\n        correlation_id: correlation_id ?? globalThis.crypto.randomUUID(),\n      }, opts);\n    }\n\n    const raw: any = httpResp.data;\n\n    return {\n      allowed:             raw.allowed ?? false,\n      verdict:             raw.outcome ?? raw.verdict ?? 'pending_human_review',\n      verdict_description: raw.verdict_description ?? '',\n      rule_reference:      raw.rule_reference ?? raw.rule_applied,\n      audit_record:        raw.audit_record ?? raw.audit_hash,\n      artifact_id:         raw.artifact_id ?? artifact_id,\n      execution_id:        raw.execution_id,\n      decided_at:          raw.decided_at ?? raw.evaluated_at ?? new Date().toISOString(),\n      lastResponse:        httpResp.lastResponse,\n    };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  Artifact,\n  ArtifactList,\n  ListArtifactsParams,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Artifacts {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Retrieve a single artifact by ID.\n   *\n   * @example\n   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');\n   * console.log(artifact.ari_score, artifact.autonomy_band);\n   * console.log(artifact.lastResponse.requestId); // for support tickets\n   */\n  async retrieve(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<Artifact>> {\n    const { data, lastResponse } = await this.http.get<Artifact>(\n      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * List published artifacts on the Exchange with optional filters.\n   *\n   * @example\n   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });\n   *\n   * @example\n   * // With per-request options\n   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });\n   */\n  async list(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactList>> {\n    const qs = new URLSearchParams();\n    if (params.band)           qs.set('band', params.band);\n    if (params.domain)         qs.set('domain', params.domain);\n    if (params.jurisdiction)   qs.set('jurisdiction', params.jurisdiction);\n    if (params.sort)           qs.set('sort', params.sort);\n    if (params.limit != null)  qs.set('limit', String(params.limit));\n    if (params.offset != null) qs.set('offset', String(params.offset));\n    const query = qs.toString();\n\n    const { data: raw, lastResponse } = await this.http.get<any>(\n      `/api/exchange/artifacts${query ? `?${query}` : ''}`,\n      opts,\n    );\n\n    // API returns { artifacts: [], total: N } — normalise to { data: [], total: N }\n    const normalized: ArtifactList = {\n      data:   Array.isArray(raw) ? raw : (raw.artifacts ?? raw.data ?? []),\n      total:  raw.total ?? (Array.isArray(raw) ? raw.length : 0),\n      limit:  params.limit ?? 20,\n      offset: params.offset ?? 0,\n    };\n\n    return { ...normalized, lastResponse };\n  }\n\n  /**\n   * Auto-paginating iterator — yields every artifact across all pages.\n   * Stops automatically when the last page is reached.\n   *\n   * @example\n   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {\n   *   console.log(artifact.title, artifact.ari_score);\n   * }\n   */\n  async *listAutoPaging(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): AsyncGenerator<Artifact> {\n    let offset = params.offset ?? 0;\n    const limit = params.limit ?? 20;\n\n    while (true) {\n      const page = await this.list({ ...params, offset, limit }, opts);\n      for (const item of page.data) yield item;\n      if (page.data.length < limit || offset + page.data.length >= page.total) break;\n      offset += page.data.length;\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Governance {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Generate a sealed .nomos governance artifact from policy documents\n   * and optional historical decision logs.\n   *\n   * @example\n   * const artifact = await nomos.governance.generate({\n   *   policies: [policyText],\n   *   decision_logs: historicalRows,\n   *   domain: 'loan_approval',\n   * });\n   * console.log(artifact.ari_score, artifact.seal_hash);\n   */\n  async generate(\n    params: GenerateGovernanceParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<GenerateGovernanceResult>> {\n    const { data, lastResponse } = await this.http.post<GenerateGovernanceResult>(\n      '/api/v1/generate-governance',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * Detect contradictions and conflicts in a rule set before sealing.\n   *\n   * @example\n   * const report = await nomos.governance.detectContradictions({ rules });\n   * if (!report.clean) {\n   *   console.log(report.contradictions);\n   * }\n   */\n  async detectContradictions(\n    params: DetectContradictionsParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<DetectContradictionsResult>> {\n    const { data, lastResponse } = await this.http.post<DetectContradictionsResult>(\n      '/api/v1/detect-contradictions',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import { NomosWebhookSignatureError } from '../errors.js';\nimport type { NomosWebhookEvent } from '../types.js';\n\n// Hex string → Uint8Array (no Buffer dependency — works in Node and browsers)\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    const byte = parseInt(hex.slice(i, i + 2), 16);\n    if (isNaN(byte)) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n    bytes[i / 2] = byte;\n  }\n  return bytes;\n}\n\n// Constant-time comparison (prevents timing attacks)\nfunction safeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nexport class Webhooks {\n  /**\n   * Verify a NOMOS webhook signature and return the parsed event.\n   *\n   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`\n   * Signed payload: `<timestamp>.<raw_body>`\n   *\n   * @example\n   * // Express\n   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {\n   *   const event = await nomos.webhooks.constructEvent(\n   *     req.body,\n   *     req.headers['nomos-signature'] as string,\n   *     process.env.NOMOS_WEBHOOK_SECRET!,\n   *   );\n   *   console.log(event.type, event.data);\n   *   res.sendStatus(200);\n   * });\n   *\n   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed\n   */\n  async constructEvent(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<NomosWebhookEvent> {\n    const body = typeof payload === 'string'\n      ? payload\n      : new TextDecoder().decode(payload);\n\n    // Parse \"t=<ts>,v1=<hex>\" header\n    const parts: Record<string, string> = {};\n    for (const part of signature.split(',')) {\n      const eq = part.indexOf('=');\n      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();\n    }\n\n    if (!parts['t'] || !parts['v1']) {\n      throw new NomosWebhookSignatureError(\n        'Invalid signature format — expected \"t=<timestamp>,v1=<hmac>\"',\n      );\n    }\n\n    const timestamp = parseInt(parts['t'], 10);\n    if (isNaN(timestamp)) {\n      throw new NomosWebhookSignatureError('Invalid timestamp in webhook signature');\n    }\n\n    const ageSecs = Math.abs(Date.now() / 1000 - timestamp);\n    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {\n      throw new NomosWebhookSignatureError(\n        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). ` +\n        'Ensure your server clock is synced and the event is not being replayed.',\n      );\n    }\n\n    // HMAC-SHA256 via Web Crypto API (Node 18+ / modern browsers — no dependencies)\n    const enc = new TextEncoder();\n    const keyMaterial = await globalThis.crypto.subtle.importKey(\n      'raw',\n      enc.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    );\n    const signedPayload = `${parts['t']}.${body}`;\n    const expectedBuf = await globalThis.crypto.subtle.sign(\n      'HMAC',\n      keyMaterial,\n      enc.encode(signedPayload),\n    );\n    const expected = new Uint8Array(expectedBuf);\n    const received = hexToBytes(parts['v1']);\n\n    if (!safeEqual(expected, received)) {\n      throw new NomosWebhookSignatureError(\n        'Webhook signature mismatch — verify your NOMOS_WEBHOOK_SECRET matches the one in Studio.',\n      );\n    }\n\n    try {\n      return JSON.parse(body) as NomosWebhookEvent;\n    } catch {\n      throw new NomosWebhookSignatureError('Webhook payload is not valid JSON');\n    }\n  }\n\n  /**\n   * Verify a webhook signature without parsing the event.\n   * Returns `true` if valid, `false` if not (never throws).\n   *\n   * @example\n   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);\n   * if (!valid) return res.sendStatus(400);\n   */\n  async verifySignature(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<boolean> {\n    try {\n      await this.constructEvent(payload, signature, secret, toleranceSeconds);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","import { HttpClient } from './http-client.js';\nimport { Decisions } from './resources/decisions.js';\nimport { Artifacts } from './resources/artifacts.js';\nimport { Governance } from './resources/governance.js';\nimport { Webhooks } from './resources/webhooks.js';\nimport * as errors from './errors.js';\nimport type { NomosConfig } from './types.js';\n\nconst DEFAULT_BASE_URL  = 'https://nomos.ai';\nconst DEFAULT_MAX_RETRIES = 3;\nconst DEFAULT_TIMEOUT   = 30_000;\n\nexport class Nomos {\n  readonly decisions:  Decisions;\n  readonly artifacts:  Artifacts;\n  readonly governance: Governance;\n  readonly webhooks:   Webhooks;\n\n  /** Whether this instance is using a live or test API key. */\n  readonly mode: 'live' | 'test';\n\n  static readonly errors = errors;\n\n  constructor(apiKey: string, config: NomosConfig = {}) {\n    if (!apiKey || typeof apiKey !== 'string') {\n      throw new errors.NomosAuthenticationError(\n        'A valid API key is required. Pass it as the first argument: new Nomos(\"nms_live_...\")',\n      );\n    }\n\n    this.mode = apiKey.startsWith('nms_test_') ? 'test' : 'live';\n\n    const http = new HttpClient({\n      apiKey,\n      baseUrl:    (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, ''),\n      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,\n      timeout:    config.timeout    ?? DEFAULT_TIMEOUT,\n    });\n\n    this.decisions  = new Decisions(http);\n    this.artifacts  = new Artifacts(http);\n    this.governance = new Governance(http);\n    this.webhooks   = new Webhooks();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,SAAiB,MAAsB,QAAiB,WAAoB;AACtF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,2BAAN,cAAuC,WAAW;AAAA,EACvD,YAAY,UAAU,mBAAmB,WAAoB;AAC3D,UAAM,SAAS,wBAAwB,KAAK,SAAS;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,WAAW;AAAA,EACtD,YAAY,UAAU,iBAAiB,WAAoB;AACzD,UAAM,SAAS,uBAAuB,KAAK,SAAS;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,WAAW;AAAA,EAGlD,YAAY,UAAU,uBAAuB,YAAqB,WAAoB;AACpF,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EAGnD,YAAY,SAAiB,SAAmB,WAAoB;AAClE,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB,WAAoB;AAC/C,UAAM,SAAS,aAAa,KAAK,SAAS;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,YAAY,SAAiB,QAAgB,WAAoB;AAC/D,UAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe;AAC9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,WAAW;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,2BAA2B,GAAG;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;;;ACpFA,eAAsB,MAAM,IAA2B;AACrD,SAAO,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AACvD;AAEO,SAAS,gBAAgB,SAAiB,SAAS,KAAa;AACrE,QAAM,MAAM,KAAK,IAAI,SAAS,KAAK,SAAS,IAAK;AACjD,SAAO,OAAO,OAAO,KAAK,OAAO,IAAI;AACvC;AAEO,SAAS,YAAY,QAAyB;AACnD,SAAO,WAAW,OAAO,UAAU;AACrC;;;ACCA,IAAM,cAAc;AAcb,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,IAAO,MAAc,SAAoD;AAC7E,WAAO,KAAK,QAAW,OAAO,MAAM,QAAW,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAAe,SAAoD;AAC7F,WAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,OAAO;AAAA,EACpD;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACA,SACA,UAAU,GACgB;AAC1B,UAAM,SAAa,SAAS,UAAc,KAAK,KAAK;AACpD,UAAM,UAAa,SAAS,WAAc,KAAK,KAAK;AACpD,UAAM,aAAa,SAAS,cAAc,KAAK,KAAK;AAEpD,UAAM,MAAM,GAAG,KAAK,KAAK,OAAO,GAAG,IAAI;AACvC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAqB;AAAA,MACrB,mBAAqB;AAAA,MACrB,cAAqB,cAAc,WAAW;AAAA,MAC9C,qBAAqB;AAAA,IACvB;AACA,QAAI,SAAS,gBAAgB;AAC3B,cAAQ,iBAAiB,IAAI,QAAQ;AAAA,IACvC;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,WAAW;AAAA,QACnB;AAAA,QACA,MAAM,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,mBAAa,KAAK;AAClB,UAAI,IAAI,SAAS,cAAc;AAC7B,cAAM,IAAI,kBAAkB,2BAA2B,OAAO,IAAI;AAAA,MACpE;AACA,YAAM,IAAI,kBAAkB,IAAI,WAAW,eAAe;AAAA,IAC5D,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAM,aAAqC,CAAC;AAC5C,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAE,iBAAW,GAAG,IAAI;AAAA,IAAO,CAAC;AAChE,UAAM,eAAiC;AAAA,MACrC;AAAA,MACA,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AAEA,QAAI,IAAI,IAAI;AACV,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B;AAGA,QAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,YAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,YAAM,QAAQ,aAAa,SAAS,YAAY,EAAE,IAAI,MAAO,gBAAgB,OAAO;AACpF,YAAM,MAAM,KAAK;AACjB,aAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,IACjE;AAEA,QAAI,UAAe,CAAC;AACpB,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC3C,UAAM,UAAkB,SAAS,SAAS,SAAS,WAAW,IAAI;AAElE,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,SAAS,SAAS,SAAS;AAAA,MAC7E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AACF;;;AChHO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BhD,MAAM,OACJ,QACA,MACiD;AACjD,UAAM,EAAE,aAAa,kBAAkB,mBAAmB,eAAe,IAAI;AAG7E,UAAM,WAAW,YAAY,WAAW,MAAM;AAC9C,QAAI;AAEJ,QAAI,UAAU;AACZ,iBAAW,MAAM,KAAK,KAAK,KAAU,kBAAkB;AAAA,QACrD;AAAA,QACA,UAAW,qBAAqB;AAAA,QAChC,QAAW;AAAA,MACb,GAAG,IAAI;AAAA,IACT,OAAO;AACL,iBAAW,MAAM,KAAK,KAAK,KAAU,2BAA2B;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,kBAAkB,WAAW,OAAO,WAAW;AAAA,MACjE,GAAG,IAAI;AAAA,IACT;AAEA,UAAM,MAAW,SAAS;AAE1B,WAAO;AAAA,MACL,SAAqB,IAAI,WAAW;AAAA,MACpC,SAAqB,IAAI,WAAW,IAAI,WAAW;AAAA,MACnD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,gBAAqB,IAAI,kBAAkB,IAAI;AAAA,MAC/C,cAAqB,IAAI,gBAAgB,IAAI;AAAA,MAC7C,aAAqB,IAAI,eAAe;AAAA,MACxC,cAAqB,IAAI;AAAA,MACzB,YAAqB,IAAI,cAAc,IAAI,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClF,cAAqB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;;;ACnEO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,SACJ,YACA,MACqC;AACrC,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,2BAA2B,mBAAmB,UAAU,CAAC;AAAA,MACzD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KACJ,SAA8B,CAAC,GAC/B,MACyC;AACzC,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,OAAgB,IAAG,IAAI,UAAU,OAAO,MAAM;AACzD,QAAI,OAAO,aAAgB,IAAG,IAAI,gBAAgB,OAAO,YAAY;AACrE,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,SAAS,KAAO,IAAG,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAC/D,QAAI,OAAO,UAAU,KAAM,IAAG,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AACjE,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,EAAE,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAClD,0BAA0B,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AAGA,UAAM,aAA2B;AAAA,MAC/B,MAAQ,MAAM,QAAQ,GAAG,IAAI,MAAO,IAAI,aAAa,IAAI,QAAQ,CAAC;AAAA,MAClE,OAAQ,IAAI,UAAU,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS;AAAA,MACxD,OAAQ,OAAO,SAAS;AAAA,MACxB,QAAQ,OAAO,UAAU;AAAA,IAC3B;AAEA,WAAO,EAAE,GAAG,YAAY,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,eACL,SAA8B,CAAC,GAC/B,MAC0B;AAC1B,QAAI,SAAS,OAAO,UAAU;AAC9B,UAAM,QAAQ,OAAO,SAAS;AAE9B,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,GAAG,QAAQ,QAAQ,MAAM,GAAG,IAAI;AAC/D,iBAAW,QAAQ,KAAK,KAAM,OAAM;AACpC,UAAI,KAAK,KAAK,SAAS,SAAS,SAAS,KAAK,KAAK,UAAU,KAAK,MAAO;AACzE,gBAAU,KAAK,KAAK;AAAA,IACtB;AAAA,EACF;AACF;;;ACnFO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAchD,MAAM,SACJ,QACA,MACqD;AACrD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,qBACJ,QACA,MACuD;AACvD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;ACrDA,SAAS,WAAW,KAAyB;AAC3C,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AAClG,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AAC7C,QAAI,MAAM,IAAI,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AACzF,UAAM,IAAI,CAAC,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAe,GAAwB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAEO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBpB,MAAM,eACJ,SACA,WACA,QACA,mBAAmB,KACS;AAC5B,UAAM,OAAO,OAAO,YAAY,WAC5B,UACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAGpC,UAAM,QAAgC,CAAC;AACvC,eAAW,QAAQ,UAAU,MAAM,GAAG,GAAG;AACvC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,KAAK,GAAI,OAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,IACzE;AAEA,QAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,SAAS,MAAM,GAAG,GAAG,EAAE;AACzC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,wCAAwC;AAAA,IAC/E;AAEA,UAAM,UAAU,KAAK,IAAI,KAAK,IAAI,IAAI,MAAO,SAAS;AACtD,QAAI,mBAAmB,KAAK,UAAU,kBAAkB;AACtD,YAAM,IAAI;AAAA,QACR,8BAA8B,KAAK,MAAM,OAAO,CAAC,OAAO,gBAAgB;AAAA,MAE1E;AAAA,IACF;AAGA,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA,IAAI,OAAO,MAAM;AAAA,MACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AACA,UAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI;AAC3C,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,IAAI,OAAO,aAAa;AAAA,IAC1B;AACA,UAAM,WAAW,IAAI,WAAW,WAAW;AAC3C,UAAM,WAAW,WAAW,MAAM,IAAI,CAAC;AAEvC,QAAI,CAAC,UAAU,UAAU,QAAQ,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI,2BAA2B,mCAAmC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,SACA,WACA,QACA,mBAAmB,KACD;AAClB,QAAI;AACF,YAAM,KAAK,eAAe,SAAS,WAAW,QAAQ,gBAAgB;AACtE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC5HA,IAAM,mBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAoB;AAEnB,IAAM,QAAN,MAAY;AAAA,EASjB;AAAA,SAAgB,SAAS;AAAA;AAAA,EAEzB,YAAY,QAAgB,SAAsB,CAAC,GAAG;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,YAAM,IAAW;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,WAAW,WAAW,IAAI,SAAS;AAEtD,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B;AAAA,MACA,UAAa,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AAAA,MAClE,YAAY,OAAO,cAAc;AAAA,MACjC,SAAY,OAAO,WAAc;AAAA,IACnC,CAAC;AAED,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,aAAa,IAAI,WAAW,IAAI;AACrC,SAAK,WAAa,IAAI,SAAS;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/util.ts","../src/http-client.ts","../src/resources/decisions.ts","../src/resources/artifacts.ts","../src/resources/governance.ts","../src/resources/webhooks.ts","../src/nomos.ts","../src/can.ts"],"sourcesContent":["export { Nomos } from './nomos.js';\n// The keyless public Exchange primitive — `import { nomos } from '@nomosprotocol/sdk'`\n// then `await nomos.can({ authority, ...facts })`. Separate from the authenticated Nomos\n// class; needs no API key and answers only public Exchange artifacts.\nexport { can, nomos } from './can.js';\nexport * from './errors.js';\nexport type {\n  CanParams,\n  CanOptions,\n  CanResult,\n  CanVerdict,\n  NomosConfig,\n  RequestOptions,\n  NomosRawResponse,\n  WithLastResponse,\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  ListArtifactsParams,\n  ArtifactList,\n  Artifact,\n  ArtifactSchema,\n  ArtifactSchemaField,\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  Contradiction,\n  Verdict,\n  NomosWebhookEvent,\n  NomosWebhookEventType,\n} from './types.js';\n","export type NomosErrorCode =\n  | 'authentication_error'\n  | 'authorization_error'\n  | 'rate_limit_error'\n  | 'validation_error'\n  | 'not_found'\n  | 'api_error'\n  | 'network_error'\n  | 'webhook_signature_error';\n\nexport class NomosError extends Error {\n  readonly code: NomosErrorCode;\n  readonly status?: number;\n  readonly requestId?: string;\n\n  constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string) {\n    super(message);\n    this.name = 'NomosError';\n    this.code = code;\n    this.status = status;\n    this.requestId = requestId;\n  }\n}\n\nexport class NomosAuthenticationError extends NomosError {\n  constructor(message = 'Invalid API key', requestId?: string) {\n    super(message, 'authentication_error', 401, requestId);\n    this.name = 'NomosAuthenticationError';\n  }\n}\n\nexport class NomosAuthorizationError extends NomosError {\n  constructor(message = 'Access denied', requestId?: string) {\n    super(message, 'authorization_error', 403, requestId);\n    this.name = 'NomosAuthorizationError';\n  }\n}\n\nexport class NomosRateLimitError extends NomosError {\n  readonly retryAfter?: number;\n\n  constructor(message = 'Rate limit exceeded', retryAfter?: number, requestId?: string) {\n    super(message, 'rate_limit_error', 429, requestId);\n    this.name = 'NomosRateLimitError';\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class NomosValidationError extends NomosError {\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown, requestId?: string) {\n    super(message, 'validation_error', 400, requestId);\n    this.name = 'NomosValidationError';\n    this.details = details;\n  }\n}\n\nexport class NomosNotFoundError extends NomosError {\n  constructor(message: string, requestId?: string) {\n    super(message, 'not_found', 404, requestId);\n    this.name = 'NomosNotFoundError';\n  }\n}\n\nexport class NomosAPIError extends NomosError {\n  constructor(message: string, status: number, requestId?: string) {\n    super(message, 'api_error', status, requestId);\n    this.name = 'NomosAPIError';\n  }\n}\n\nexport class NomosNetworkError extends NomosError {\n  constructor(message: string) {\n    super(message, 'network_error');\n    this.name = 'NomosNetworkError';\n  }\n}\n\nexport class NomosWebhookSignatureError extends NomosError {\n  constructor(message: string) {\n    super(message, 'webhook_signature_error', 400);\n    this.name = 'NomosWebhookSignatureError';\n  }\n}\n","export async function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nexport function jitteredBackoff(attempt: number, baseMs = 500): number {\n  const exp = Math.min(baseMs * 2 ** attempt, 16000);\n  return exp * (0.75 + Math.random() * 0.5); // ±25% jitter\n}\n\nexport function isRetryable(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n","import {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\nimport { sleep, jitteredBackoff, isRetryable } from './util.js';\nimport type { RequestOptions, NomosRawResponse } from './types.js';\n\nconst SDK_VERSION = '1.1.0';\n\nexport interface HttpClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  maxRetries: number;\n  timeout: number;\n}\n\nexport interface HttpResponse<T> {\n  data: T;\n  lastResponse: NomosRawResponse;\n}\n\nexport class HttpClient {\n  constructor(private readonly opts: HttpClientOptions) {}\n\n  async get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('GET', path, undefined, reqOpts);\n  }\n\n  async post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('POST', path, body, reqOpts);\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    body: unknown,\n    reqOpts?: RequestOptions,\n    attempt = 0,\n  ): Promise<HttpResponse<T>> {\n    const apiKey     = reqOpts?.apiKey     ?? this.opts.apiKey;\n    const timeout    = reqOpts?.timeout    ?? this.opts.timeout;\n    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;\n\n    const url = `${this.opts.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n\n    const headers: Record<string, string> = {\n      'Content-Type':      'application/json',\n      'X-Nomos-Api-Key':   apiKey,\n      'User-Agent':        `nomos-node/${SDK_VERSION}`,\n      'NOMOS-SDK-Version': SDK_VERSION,\n    };\n    if (reqOpts?.idempotencyKey) {\n      headers['Idempotency-Key'] = reqOpts.idempotencyKey;\n    }\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        signal: controller.signal,\n        headers,\n        body: body != null ? JSON.stringify(body) : undefined,\n      });\n    } catch (err: any) {\n      clearTimeout(timer);\n      if (err.name === 'AbortError') {\n        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);\n      }\n      throw new NomosNetworkError(err.message ?? 'Network error');\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const requestId = res.headers.get('x-request-id') ?? '';\n    const rawHeaders: Record<string, string> = {};\n    res.headers.forEach((value, key) => { rawHeaders[key] = value; });\n    const lastResponse: NomosRawResponse = {\n      requestId,\n      statusCode: res.status,\n      headers: rawHeaders,\n    };\n\n    if (res.ok) {\n      const data = await res.json() as T;\n      return { data, lastResponse };\n    }\n\n    // Retry on 429 / 5xx\n    if (isRetryable(res.status) && attempt < maxRetries) {\n      const retryAfter = res.headers.get('retry-after');\n      const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : jitteredBackoff(attempt);\n      await sleep(delay);\n      return this.request<T>(method, path, body, reqOpts, attempt + 1);\n    }\n\n    let errBody: any = {};\n    try { errBody = await res.json(); } catch {}\n    const message: string = errBody?.error ?? errBody?.message ?? res.statusText;\n\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, errBody?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Decisions {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Verify whether an AI decision is permitted under a governance artifact.\n   *\n   * Public demo artifacts (`pub_*`) work without an API key.\n   * Custom artifacts require a valid API key.\n   *\n   * @example\n   * const result = await nomos.decisions.verify({\n   *   artifact_id: 'pub_lending_v1',\n   *   decision_context: { credit_score: 720, loan_amount: 50000 },\n   * });\n   *\n   * if (!result.allowed) {\n   *   throw new Error(`Blocked: ${result.verdict_description}`);\n   * }\n   *\n   * // Debugging / tracing\n   * console.log(result.lastResponse.requestId);\n   *\n   * @example\n   * // Per-request options\n   * const result = await nomos.decisions.verify(params, {\n   *   idempotencyKey: `verify-${transactionId}`,\n   *   timeout: 5000,\n   * });\n   */\n  async verify(\n    params: VerifyDecisionParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<VerifyDecisionResult>> {\n    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;\n\n    // Public artifacts (pub_*) use the open /verify endpoint — no API key required\n    const isPublic = artifact_id.startsWith('pub_');\n    let httpResp: Awaited<ReturnType<HttpClient['post']>>;\n\n    if (isPublic) {\n      httpResp = await this.http.post<any>('/api/v1/verify', {\n        artifact_id,\n        decision:  proposed_decision ?? 'evaluate',\n        inputs:    decision_context,\n      }, opts);\n    } else {\n      // /verify-decision expects: { artifact_id, decision, inputs, caller? }\n      // NOT decision_context / proposed_decision at the top level.\n      httpResp = await this.http.post<any>('/api/v1/verify-decision', {\n        artifact_id,\n        decision: proposed_decision ?? 'evaluate',\n        inputs:   decision_context,\n        caller:   { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() },\n      }, opts);\n    }\n\n    const raw: any = httpResp.data;\n\n    return {\n      id:                  raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,\n      object:              raw.object ?? 'decision',\n      artifact_id:         raw.artifact_id ?? artifact_id,\n      artifact_name:       raw.artifact_name ?? '',\n      allowed:             raw.allowed ?? false,\n      verdict:             raw.verdict ?? (raw.outcome === 'auto_approved' ? 'approved' : raw.outcome === 'auto_rejected' ? 'rejected' : 'escalated'),\n      rule:                raw.rule,\n      evaluation:          raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },\n      confidence:          raw.confidence ?? { tier: raw.artifact_confidence ?? 'DECLARED', score: 1, description: '' },\n      audit:               raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? '', timestamp: raw.ts ?? new Date().toISOString() },\n      performance:         raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },\n      schema_version:      raw.schema_version ?? '1.0.0',\n      verdict_description: raw.verdict_description ?? '',\n      incomplete_inputs:   raw.incomplete_inputs,\n      paths_to_approval:   raw.paths_to_approval,\n      lastResponse:        httpResp.lastResponse,\n    };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  Artifact,\n  ArtifactList,\n  ArtifactSchema,\n  ListArtifactsParams,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Artifacts {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Retrieve a single artifact by ID.\n   *\n   * @example\n   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');\n   * console.log(artifact.ari_score, artifact.autonomy_band);\n   * console.log(artifact.lastResponse.requestId); // for support tickets\n   */\n  async retrieve(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<Artifact>> {\n    const { data, lastResponse } = await this.http.get<Artifact>(\n      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * List published artifacts on the Exchange with optional filters.\n   *\n   * @example\n   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });\n   *\n   * @example\n   * // With per-request options\n   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });\n   */\n  async list(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactList>> {\n    const qs = new URLSearchParams();\n    if (params.band)           qs.set('band', params.band);\n    if (params.domain)         qs.set('domain', params.domain);\n    if (params.jurisdiction)   qs.set('jurisdiction', params.jurisdiction);\n    if (params.sort)           qs.set('sort', params.sort);\n    if (params.limit != null)  qs.set('limit', String(params.limit));\n    if (params.offset != null) qs.set('offset', String(params.offset));\n    const query = qs.toString();\n\n    const { data: raw, lastResponse } = await this.http.get<any>(\n      `/api/exchange/artifacts${query ? `?${query}` : ''}`,\n      opts,\n    );\n\n    // API returns { artifacts: [], total: N } — normalise to { data: [], total: N }\n    const normalized: ArtifactList = {\n      data:   Array.isArray(raw) ? raw : (raw.artifacts ?? raw.data ?? []),\n      total:  raw.total ?? (Array.isArray(raw) ? raw.length : 0),\n      limit:  params.limit ?? 20,\n      offset: params.offset ?? 0,\n    };\n\n    return { ...normalized, lastResponse };\n  }\n\n  /**\n   * Auto-paginating iterator — yields every artifact across all pages.\n   * Stops automatically when the last page is reached.\n   *\n   * @example\n   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {\n   *   console.log(artifact.title, artifact.ari_score);\n   * }\n   */\n  async *listAutoPaging(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): AsyncGenerator<Artifact> {\n    let offset = params.offset ?? 0;\n    const limit = params.limit ?? 20;\n\n    while (true) {\n      const page = await this.list({ ...params, offset, limit }, opts);\n      for (const item of page.data) yield item;\n      if (page.data.length < limit || offset + page.data.length >= page.total) break;\n      offset += page.data.length;\n    }\n  }\n\n  /**\n   * Retrieve the declared input schema for a sealed artifact.\n   *\n   * Returns every field the artifact's rules reference — name, type, whether it's\n   * required, and a ready-to-use example_inputs object. Use this to build forms,\n   * validate payloads, or generate API docs without reading the rules manually.\n   *\n   * Requires an API key (artifact schemas are not public).\n   *\n   * @example\n   * const schema = await nomos.artifacts.schema('art_abc123');\n   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']\n   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }\n   */\n  async schema(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactSchema>> {\n    const { data, lastResponse } = await this.http.get<ArtifactSchema>(\n      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Governance {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Generate a sealed .nomos governance artifact from policy documents\n   * and optional historical decision logs.\n   *\n   * @example\n   * const artifact = await nomos.governance.generate({\n   *   policies: [policyText],\n   *   decision_logs: historicalRows,\n   *   domain: 'loan_approval',\n   * });\n   * console.log(artifact.ari_score, artifact.seal_hash);\n   */\n  async generate(\n    params: GenerateGovernanceParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<GenerateGovernanceResult>> {\n    const { data, lastResponse } = await this.http.post<GenerateGovernanceResult>(\n      '/api/v1/generate-governance',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * Detect contradictions and conflicts in a rule set before sealing.\n   *\n   * @example\n   * const report = await nomos.governance.detectContradictions({ rules });\n   * if (!report.clean) {\n   *   console.log(report.contradictions);\n   * }\n   */\n  async detectContradictions(\n    params: DetectContradictionsParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<DetectContradictionsResult>> {\n    const { data, lastResponse } = await this.http.post<DetectContradictionsResult>(\n      '/api/v1/detect-contradictions',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import { NomosWebhookSignatureError } from '../errors.js';\nimport type { NomosWebhookEvent } from '../types.js';\n\n// Hex string → Uint8Array (no Buffer dependency — works in Node and browsers)\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    const byte = parseInt(hex.slice(i, i + 2), 16);\n    if (isNaN(byte)) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n    bytes[i / 2] = byte;\n  }\n  return bytes;\n}\n\n// Constant-time comparison (prevents timing attacks)\nfunction safeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nexport class Webhooks {\n  /**\n   * Verify a NOMOS webhook signature and return the parsed event.\n   *\n   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`\n   * Signed payload: `<timestamp>.<raw_body>`\n   *\n   * @example\n   * // Express\n   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {\n   *   const event = await nomos.webhooks.constructEvent(\n   *     req.body,\n   *     req.headers['nomos-signature'] as string,\n   *     process.env.NOMOS_WEBHOOK_SECRET!,\n   *   );\n   *   console.log(event.type, event.data);\n   *   res.sendStatus(200);\n   * });\n   *\n   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed\n   */\n  async constructEvent(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<NomosWebhookEvent> {\n    const body = typeof payload === 'string'\n      ? payload\n      : new TextDecoder().decode(payload);\n\n    // Parse \"t=<ts>,v1=<hex>\" header\n    const parts: Record<string, string> = {};\n    for (const part of signature.split(',')) {\n      const eq = part.indexOf('=');\n      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();\n    }\n\n    if (!parts['t'] || !parts['v1']) {\n      throw new NomosWebhookSignatureError(\n        'Invalid signature format — expected \"t=<timestamp>,v1=<hmac>\"',\n      );\n    }\n\n    const timestamp = parseInt(parts['t'], 10);\n    if (isNaN(timestamp)) {\n      throw new NomosWebhookSignatureError('Invalid timestamp in webhook signature');\n    }\n\n    const ageSecs = Math.abs(Date.now() / 1000 - timestamp);\n    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {\n      throw new NomosWebhookSignatureError(\n        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). ` +\n        'Ensure your server clock is synced and the event is not being replayed.',\n      );\n    }\n\n    // HMAC-SHA256 via Web Crypto API (Node 18+ / modern browsers — no dependencies)\n    const enc = new TextEncoder();\n    const keyMaterial = await globalThis.crypto.subtle.importKey(\n      'raw',\n      enc.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    );\n    const signedPayload = `${parts['t']}.${body}`;\n    const expectedBuf = await globalThis.crypto.subtle.sign(\n      'HMAC',\n      keyMaterial,\n      enc.encode(signedPayload),\n    );\n    const expected = new Uint8Array(expectedBuf);\n    const received = hexToBytes(parts['v1']);\n\n    if (!safeEqual(expected, received)) {\n      throw new NomosWebhookSignatureError(\n        'Webhook signature mismatch — verify your NOMOS_WEBHOOK_SECRET matches the one in Studio.',\n      );\n    }\n\n    try {\n      return JSON.parse(body) as NomosWebhookEvent;\n    } catch {\n      throw new NomosWebhookSignatureError('Webhook payload is not valid JSON');\n    }\n  }\n\n  /**\n   * Verify a webhook signature without parsing the event.\n   * Returns `true` if valid, `false` if not (never throws).\n   *\n   * @example\n   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);\n   * if (!valid) return res.sendStatus(400);\n   */\n  async verifySignature(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<boolean> {\n    try {\n      await this.constructEvent(payload, signature, secret, toleranceSeconds);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","import { HttpClient } from './http-client.js';\nimport { Decisions } from './resources/decisions.js';\nimport { Artifacts } from './resources/artifacts.js';\nimport { Governance } from './resources/governance.js';\nimport { Webhooks } from './resources/webhooks.js';\nimport * as errors from './errors.js';\nimport type { NomosConfig } from './types.js';\n\nconst DEFAULT_BASE_URL  = 'https://nomos.ai';\nconst DEFAULT_MAX_RETRIES = 3;\nconst DEFAULT_TIMEOUT   = 30_000;\n\nexport class Nomos {\n  readonly decisions:  Decisions;\n  readonly artifacts:  Artifacts;\n  readonly governance: Governance;\n  readonly webhooks:   Webhooks;\n\n  /** Whether this instance is using a live or test API key. */\n  readonly mode: 'live' | 'test';\n\n  static readonly errors = errors;\n\n  constructor(apiKey: string, config: NomosConfig = {}) {\n    if (!apiKey || typeof apiKey !== 'string') {\n      throw new errors.NomosAuthenticationError(\n        'A valid API key is required. Pass it as the first argument: new Nomos(\"nms_live_...\")',\n      );\n    }\n\n    this.mode = apiKey.startsWith('nms_test_') ? 'test' : 'live';\n\n    const http = new HttpClient({\n      apiKey,\n      baseUrl:    (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, ''),\n      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,\n      timeout:    config.timeout    ?? DEFAULT_TIMEOUT,\n    });\n\n    this.decisions  = new Decisions(http);\n    this.artifacts  = new Artifacts(http);\n    this.governance = new Governance(http);\n    this.webhooks   = new Webhooks();\n  }\n}\n","import type { CanParams, CanResult, CanOptions } from './types.js';\nimport {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\n\n/**\n * The whole product in one verb: \"Can I do this?\"\n *\n * Ask a public Exchange authority a question and get back a deterministic, verifiable\n * verdict — no API key, no SDK setup, no reading a policy PDF. This is a thin, faithful\n * wrapper over the public Exchange query endpoint (the same call the exchange.nomosprotocol.com\n * \"Ask Authority\" box makes), so every answer is a real, addressable transcript you can open\n * at its `url` / `query_id`.\n *\n * Verdicts are exactly what the authority returns — AUTHORIZED / DENIED / ESCALATED — never\n * an invented shape. `allowed` is simply `verdict === 'AUTHORIZED'`; an ESCALATED result means\n * the authority needs more facts to decide (see `missing_inputs`), not a flat \"no\".\n *\n * @example\n * import { nomos } from '@nomosprotocol/sdk';\n *\n * const verdict = await nomos.can({\n *   authority: 'eu-ai-act.nomos',\n *   ai_system_circumvents_refugee_convention: true,\n * });\n * // → { allowed: false, verdict: 'DENIED', reason: 'Rule \"Prohibition…\" triggered…',\n * //     query_id: 'qry_…', url: '/queries/qry_…', … }\n */\nconst DEFAULT_EXCHANGE_BASE = 'https://www.nomosprotocol.com';\n\nexport async function can(params: CanParams, opts?: CanOptions): Promise<CanResult> {\n  const { authority, action, inputs, ...flat } = params;\n  if (!authority || typeof authority !== 'string') {\n    throw new Error('can(): `authority` (an Exchange artifact id or slug) is required.');\n  }\n  // Two equally valid shapes: an explicit `inputs` object, or the facts spread flat\n  // alongside `authority`/`action`. Explicit `inputs` wins when both are present.\n  const facts: Record<string, unknown> =\n    inputs && typeof inputs === 'object' ? inputs : (flat as Record<string, unknown>);\n\n  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\\/$/, '');\n  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;\n\n  let res: Response;\n  try {\n    res = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ inputs: facts, action }),\n      signal: opts?.signal,\n    });\n  } catch (err: any) {\n    if (err?.name === 'AbortError') throw new NomosNetworkError('Request aborted');\n    throw new NomosNetworkError(err?.message ?? 'Network error');\n  }\n\n  const requestId = res.headers.get('x-request-id') ?? '';\n  const data: any = await res.json().catch(() => null);\n  if (!res.ok) {\n    // Same status-code -> error-class mapping HttpClient uses for every other SDK call,\n    // so `instanceof NomosNotFoundError` etc. works consistently everywhere — can() used to\n    // throw a plain Error here, bypassing the SDK's own error hierarchy entirely.\n    const message: string = data?.error ?? data?.message ?? `NOMOS query failed (HTTP ${res.status})`;\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, data?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n\n  return {\n    allowed: data.verdict === 'AUTHORIZED',\n    verdict: data.verdict,\n    reason: data.verdict_description,\n    rule: data.matched_rule_id ?? null,\n    query_id: data.query_id,\n    url: data.url,\n    authority: {\n      id: data.artifact?.id ?? authority,\n      title: data.artifact?.title ?? '',\n      standing: data.artifact?.standing ?? '',\n    },\n    missing_inputs: data.missing_inputs ?? [],\n  };\n}\n\n/**\n * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.\n * For authenticated, key-scoped operations use the `Nomos` class instead.\n */\nexport const nomos = { can };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,SAAiB,MAAsB,QAAiB,WAAoB;AACtF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,2BAAN,cAAuC,WAAW;AAAA,EACvD,YAAY,UAAU,mBAAmB,WAAoB;AAC3D,UAAM,SAAS,wBAAwB,KAAK,SAAS;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,WAAW;AAAA,EACtD,YAAY,UAAU,iBAAiB,WAAoB;AACzD,UAAM,SAAS,uBAAuB,KAAK,SAAS;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,WAAW;AAAA,EAGlD,YAAY,UAAU,uBAAuB,YAAqB,WAAoB;AACpF,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EAGnD,YAAY,SAAiB,SAAmB,WAAoB;AAClE,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB,WAAoB;AAC/C,UAAM,SAAS,aAAa,KAAK,SAAS;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,YAAY,SAAiB,QAAgB,WAAoB;AAC/D,UAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe;AAC9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,WAAW;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,2BAA2B,GAAG;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;;;ACpFA,eAAsB,MAAM,IAA2B;AACrD,SAAO,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AACvD;AAEO,SAAS,gBAAgB,SAAiB,SAAS,KAAa;AACrE,QAAM,MAAM,KAAK,IAAI,SAAS,KAAK,SAAS,IAAK;AACjD,SAAO,OAAO,OAAO,KAAK,OAAO,IAAI;AACvC;AAEO,SAAS,YAAY,QAAyB;AACnD,SAAO,WAAW,OAAO,UAAU;AACrC;;;ACCA,IAAM,cAAc;AAcb,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,IAAO,MAAc,SAAoD;AAC7E,WAAO,KAAK,QAAW,OAAO,MAAM,QAAW,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAAe,SAAoD;AAC7F,WAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,OAAO;AAAA,EACpD;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACA,SACA,UAAU,GACgB;AAC1B,UAAM,SAAa,SAAS,UAAc,KAAK,KAAK;AACpD,UAAM,UAAa,SAAS,WAAc,KAAK,KAAK;AACpD,UAAM,aAAa,SAAS,cAAc,KAAK,KAAK;AAEpD,UAAM,MAAM,GAAG,KAAK,KAAK,OAAO,GAAG,IAAI;AACvC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAqB;AAAA,MACrB,mBAAqB;AAAA,MACrB,cAAqB,cAAc,WAAW;AAAA,MAC9C,qBAAqB;AAAA,IACvB;AACA,QAAI,SAAS,gBAAgB;AAC3B,cAAQ,iBAAiB,IAAI,QAAQ;AAAA,IACvC;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,WAAW;AAAA,QACnB;AAAA,QACA,MAAM,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,mBAAa,KAAK;AAClB,UAAI,IAAI,SAAS,cAAc;AAC7B,cAAM,IAAI,kBAAkB,2BAA2B,OAAO,IAAI;AAAA,MACpE;AACA,YAAM,IAAI,kBAAkB,IAAI,WAAW,eAAe;AAAA,IAC5D,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAM,aAAqC,CAAC;AAC5C,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAE,iBAAW,GAAG,IAAI;AAAA,IAAO,CAAC;AAChE,UAAM,eAAiC;AAAA,MACrC;AAAA,MACA,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AAEA,QAAI,IAAI,IAAI;AACV,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B;AAGA,QAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,YAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,YAAM,QAAQ,aAAa,SAAS,YAAY,EAAE,IAAI,MAAO,gBAAgB,OAAO;AACpF,YAAM,MAAM,KAAK;AACjB,aAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,IACjE;AAEA,QAAI,UAAe,CAAC;AACpB,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC3C,UAAM,UAAkB,SAAS,SAAS,SAAS,WAAW,IAAI;AAElE,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,SAAS,SAAS,SAAS;AAAA,MAC7E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AACF;;;AChHO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BhD,MAAM,OACJ,QACA,MACiD;AACjD,UAAM,EAAE,aAAa,kBAAkB,mBAAmB,eAAe,IAAI;AAG7E,UAAM,WAAW,YAAY,WAAW,MAAM;AAC9C,QAAI;AAEJ,QAAI,UAAU;AACZ,iBAAW,MAAM,KAAK,KAAK,KAAU,kBAAkB;AAAA,QACrD;AAAA,QACA,UAAW,qBAAqB;AAAA,QAChC,QAAW;AAAA,MACb,GAAG,IAAI;AAAA,IACT,OAAO;AAGL,iBAAW,MAAM,KAAK,KAAK,KAAU,2BAA2B;AAAA,QAC9D;AAAA,QACA,UAAU,qBAAqB;AAAA,QAC/B,QAAU;AAAA,QACV,QAAU,EAAE,gBAAgB,kBAAkB,WAAW,OAAO,WAAW,EAAE;AAAA,MAC/E,GAAG,IAAI;AAAA,IACT;AAEA,UAAM,MAAW,SAAS;AAE1B,WAAO;AAAA,MACL,IAAqB,IAAI,MAAM,OAAO,IAAI,gBAAgB,WAAW,OAAO,WAAW,CAAC;AAAA,MACxF,QAAqB,IAAI,UAAU;AAAA,MACnC,aAAqB,IAAI,eAAe;AAAA,MACxC,eAAqB,IAAI,iBAAiB;AAAA,MAC1C,SAAqB,IAAI,WAAW;AAAA,MACpC,SAAqB,IAAI,YAAY,IAAI,YAAY,kBAAkB,aAAa,IAAI,YAAY,kBAAkB,aAAa;AAAA,MACnI,MAAqB,IAAI;AAAA,MACzB,YAAqB,IAAI,cAAc,EAAE,iBAAiB,IAAI,mBAAmB,GAAG,eAAe,GAAG,eAAe,GAAG,oBAAoB,EAAE;AAAA,MAC9I,YAAqB,IAAI,cAAc,EAAE,MAAM,IAAI,uBAAuB,YAAY,OAAO,GAAG,aAAa,GAAG;AAAA,MAChH,OAAqB,IAAI,SAAS,EAAE,MAAM,IAAI,cAAc,IAAI,gBAAgB,IAAI,WAAW,IAAI,OAAM,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MAClI,aAAqB,IAAI,eAAe,EAAE,YAAY,IAAI,cAAc,EAAE;AAAA,MAC1E,gBAAqB,IAAI,kBAAkB;AAAA,MAC3C,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,mBAAqB,IAAI;AAAA,MACzB,mBAAqB,IAAI;AAAA,MACzB,cAAqB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;;;AC3EO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,SACJ,YACA,MACqC;AACrC,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,2BAA2B,mBAAmB,UAAU,CAAC;AAAA,MACzD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KACJ,SAA8B,CAAC,GAC/B,MACyC;AACzC,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,OAAgB,IAAG,IAAI,UAAU,OAAO,MAAM;AACzD,QAAI,OAAO,aAAgB,IAAG,IAAI,gBAAgB,OAAO,YAAY;AACrE,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,SAAS,KAAO,IAAG,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAC/D,QAAI,OAAO,UAAU,KAAM,IAAG,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AACjE,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,EAAE,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAClD,0BAA0B,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AAGA,UAAM,aAA2B;AAAA,MAC/B,MAAQ,MAAM,QAAQ,GAAG,IAAI,MAAO,IAAI,aAAa,IAAI,QAAQ,CAAC;AAAA,MAClE,OAAQ,IAAI,UAAU,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS;AAAA,MACxD,OAAQ,OAAO,SAAS;AAAA,MACxB,QAAQ,OAAO,UAAU;AAAA,IAC3B;AAEA,WAAO,EAAE,GAAG,YAAY,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,eACL,SAA8B,CAAC,GAC/B,MAC0B;AAC1B,QAAI,SAAS,OAAO,UAAU;AAC9B,UAAM,QAAQ,OAAO,SAAS;AAE9B,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,GAAG,QAAQ,QAAQ,MAAM,GAAG,IAAI;AAC/D,iBAAW,QAAQ,KAAK,KAAM,OAAM;AACpC,UAAI,KAAK,KAAK,SAAS,SAAS,SAAS,KAAK,KAAK,UAAU,KAAK,MAAO;AACzE,gBAAU,KAAK,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OACJ,YACA,MAC2C;AAC3C,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,MACnD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;AC7GO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAchD,MAAM,SACJ,QACA,MACqD;AACrD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,qBACJ,QACA,MACuD;AACvD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;ACrDA,SAAS,WAAW,KAAyB;AAC3C,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AAClG,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AAC7C,QAAI,MAAM,IAAI,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AACzF,UAAM,IAAI,CAAC,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAe,GAAwB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAEO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBpB,MAAM,eACJ,SACA,WACA,QACA,mBAAmB,KACS;AAC5B,UAAM,OAAO,OAAO,YAAY,WAC5B,UACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAGpC,UAAM,QAAgC,CAAC;AACvC,eAAW,QAAQ,UAAU,MAAM,GAAG,GAAG;AACvC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,KAAK,GAAI,OAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,IACzE;AAEA,QAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,SAAS,MAAM,GAAG,GAAG,EAAE;AACzC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,wCAAwC;AAAA,IAC/E;AAEA,UAAM,UAAU,KAAK,IAAI,KAAK,IAAI,IAAI,MAAO,SAAS;AACtD,QAAI,mBAAmB,KAAK,UAAU,kBAAkB;AACtD,YAAM,IAAI;AAAA,QACR,8BAA8B,KAAK,MAAM,OAAO,CAAC,OAAO,gBAAgB;AAAA,MAE1E;AAAA,IACF;AAGA,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA,IAAI,OAAO,MAAM;AAAA,MACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AACA,UAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI;AAC3C,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,IAAI,OAAO,aAAa;AAAA,IAC1B;AACA,UAAM,WAAW,IAAI,WAAW,WAAW;AAC3C,UAAM,WAAW,WAAW,MAAM,IAAI,CAAC;AAEvC,QAAI,CAAC,UAAU,UAAU,QAAQ,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI,2BAA2B,mCAAmC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,SACA,WACA,QACA,mBAAmB,KACD;AAClB,QAAI;AACF,YAAM,KAAK,eAAe,SAAS,WAAW,QAAQ,gBAAgB;AACtE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC5HA,IAAM,mBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAoB;AAEnB,IAAM,QAAN,MAAY;AAAA,EASjB;AAAA,SAAgB,SAAS;AAAA;AAAA,EAEzB,YAAY,QAAgB,SAAsB,CAAC,GAAG;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,YAAM,IAAW;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,WAAW,WAAW,IAAI,SAAS;AAEtD,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B;AAAA,MACA,UAAa,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AAAA,MAClE,YAAY,OAAO,cAAc;AAAA,MACjC,SAAY,OAAO,WAAc;AAAA,IACnC,CAAC;AAED,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,aAAa,IAAI,WAAW,IAAI;AACrC,SAAK,WAAa,IAAI,SAAS;AAAA,EACjC;AACF;;;ACVA,IAAM,wBAAwB;AAE9B,eAAsB,IAAI,QAAmB,MAAuC;AAClF,QAAM,EAAE,WAAW,QAAQ,QAAQ,GAAG,KAAK,IAAI;AAC/C,MAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAGA,QAAM,QACJ,UAAU,OAAO,WAAW,WAAW,SAAU;AAEnD,QAAM,QAAQ,MAAM,WAAW,uBAAuB,QAAQ,OAAO,EAAE;AACvE,QAAM,MAAM,GAAG,IAAI,2BAA2B,mBAAmB,SAAS,CAAC;AAE3E,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,MAC9C,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,QAAI,KAAK,SAAS,aAAc,OAAM,IAAI,kBAAkB,iBAAiB;AAC7E,UAAM,IAAI,kBAAkB,KAAK,WAAW,eAAe;AAAA,EAC7D;AAEA,QAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,QAAM,OAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,IAAI,IAAI;AAIX,UAAM,UAAkB,MAAM,SAAS,MAAM,WAAW,4BAA4B,IAAI,MAAM;AAC9F,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,MAAM,SAAS,SAAS;AAAA,MAC1E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAK,YAAY;AAAA,IAC1B,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,MAAM,KAAK,mBAAmB;AAAA,IAC9B,UAAU,KAAK;AAAA,IACf,KAAK,KAAK;AAAA,IACV,WAAW;AAAA,MACT,IAAI,KAAK,UAAU,MAAM;AAAA,MACzB,OAAO,KAAK,UAAU,SAAS;AAAA,MAC/B,UAAU,KAAK,UAAU,YAAY;AAAA,IACvC;AAAA,IACA,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,EAC1C;AACF;AAMO,IAAM,QAAQ,EAAE,IAAI;","names":[]}

package/dist/index.d.cts

@@ -41,24 +41,111 @@ interface DetectContradictionsParams {
         priority?: number;
     }>;
 }
-type Verdict = 'auto_approved' | 'auto_rejected' | 'escalated' | 'pending_human_review';
+type Verdict = 'approved' | 'rejected' | 'escalated';
+type CanVerdict = 'AUTHORIZED' | 'DENIED' | 'ESCALATED';
+interface CanParams {
+    /** Exchange artifact's standard name — slug (optionally ".nomos"-suffixed) or raw id, e.g. "eu-ai-act.nomos" */
+    authority: string;
+    /** Optional human-readable label for what's being asked (recorded in the transcript) */
+    action?: string;
+    /** The facts to evaluate. Either pass this explicitly, or spread the facts flat alongside
+     *  `authority`/`action` — both shapes are accepted (explicit `inputs` wins if both given). */
+    inputs?: Record<string, unknown>;
+    /** Flat-facts convenience: any extra keys are treated as inputs when `inputs` is omitted. */
+    [key: string]: unknown;
+}
+interface CanOptions {
+    /** Override the API host (defaults to the public NOMOS Exchange). */
+    baseUrl?: string;
+    /** AbortSignal to cancel the request. */
+    signal?: AbortSignal;
+}
+interface CanResult {
+    /** True only for an AUTHORIZED verdict. DENIED and ESCALATED are both `false`. */
+    allowed: boolean;
+    /** The authority's own verdict, verbatim. */
+    verdict: CanVerdict;
+    /** Human-readable explanation of the verdict. */
+    reason: string;
+    /** The rule id that decided it, if any. */
+    rule: string | null;
+    /** Permanent, addressable transcript id — open it any time. */
+    query_id: string;
+    /** Relative URL of the transcript. */
+    url: string;
+    /** Which authority answered, and its standing. */
+    authority: {
+        id: string;
+        title: string;
+        standing: string;
+    };
+    /** On ESCALATED: the facts the authority still needs to reach a verdict. */
+    missing_inputs: string[];
+}
 interface VerifyDecisionResult {
+    /** Unique request ID — include in support tickets */
+    id: string;
+    /** Always "decision" */
+    object: 'decision';
+    /** The artifact that governed this decision */
+    artifact_id: string;
+    /** Artifact name */
+    artifact_name: string;
     /** Whether the decision is permitted under current governance */
     allowed: boolean;
-    /** Machine-readable verdict */
+    /** Human-readable verdict */
     verdict: Verdict;
+    /** The rule that triggered this verdict, if any */
+    rule?: {
+        id: string;
+        description: string | null;
+        action: 'allow' | 'deny' | 'escalate';
+    };
+    /** Evaluation metrics */
+    evaluation: {
+        rules_evaluated: number;
+        rules_matched: number;
+        rules_expired: number;
+        conflicts_resolved: number;
+    };
+    /** Confidence in the verdict */
+    confidence: {
+        /** Artifact verification tier */
+        tier: string;
+        /** 0–1 confidence score */
+        score: number;
+        /** Human-readable explanation of the tier */
+        description: string;
+    };
+    /** Audit record — store the hash for compliance */
+    audit: {
+        hash: string;
+        timestamp: string;
+    };
+    /** Performance metrics */
+    performance: {
+        latency_ms: number;
+    };
+    /** API schema version */
+    schema_version: string;
     /** Human-readable explanation */
     verdict_description: string;
-    /** The rule that triggered this verdict (if any) */
-    rule_reference?: string;
-    /** SHA-256 hash of the audit record — store this for compliance */
-    audit_record?: string;
-    /** Artifact that governed this decision */
-    artifact_id: string;
-    /** Execution ID for tracing */
-    execution_id?: string;
-    /** ISO timestamp */
-    decided_at: string;
+    /** Missing input fields, if any rule-referenced fields were absent */
+    incomplete_inputs?: {
+        fields: string[];
+        count: number;
+        warning: string;
+    };
+    /** How to satisfy an approval rule when current verdict is not approved */
+    paths_to_approval?: Array<{
+        rule_id: string | null;
+        rule_name: string | null;
+        required_changes: Array<{
+            field: string;
+            current: unknown;
+            must_satisfy: string;
+        }>;
+    }>;
 }
 interface Artifact {
     id: string;
@@ -85,6 +172,24 @@ interface ArtifactList {
     limit: number;
     offset: number;
 }
+interface ArtifactSchemaField {
+    name: string;
+    type: 'string' | 'number' | 'integer' | 'boolean' | 'date' | 'datetime' | 'enum' | 'array';
+    required: boolean;
+    description?: string;
+    enum?: string[];
+    min?: number;
+    max?: number;
+    format?: string;
+}
+interface ArtifactSchema {
+    artifact_id: string;
+    name: string;
+    fields: ArtifactSchemaField[];
+    required_fields: string[];
+    example_inputs: Record<string, unknown>;
+    field_count: number;
+}
 interface Contradiction {
     type: 'threshold_conflict' | 'role_conflict' | 'ghost_term' | 'rule_collision' | 'layer_divergence';
     severity: 'critical' | 'warning' | 'info';
@@ -226,6 +331,21 @@ declare class Artifacts {
      * }
      */
     listAutoPaging(params?: ListArtifactsParams, opts?: RequestOptions): AsyncGenerator<Artifact>;
+    /**
+     * Retrieve the declared input schema for a sealed artifact.
+     *
+     * Returns every field the artifact's rules reference — name, type, whether it's
+     * required, and a ready-to-use example_inputs object. Use this to build forms,
+     * validate payloads, or generate API docs without reading the rules manually.
+     *
+     * Requires an API key (artifact schemas are not public).
+     *
+     * @example
+     * const schema = await nomos.artifacts.schema('art_abc123');
+     * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+     * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+     */
+    schema(artifactId: string, opts?: RequestOptions): Promise<WithLastResponse<ArtifactSchema>>;
 }
 
 declare class Governance {
@@ -357,4 +477,13 @@ declare class Nomos {
     constructor(apiKey: string, config?: NomosConfig);
 }
 
-export { type Artifact, type ArtifactList, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type ListArtifactsParams, Nomos, NomosAPIError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosError, type NomosErrorCode, NomosNetworkError, NomosNotFoundError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type RequestOptions, type Verdict, type VerifyDecisionParams, type VerifyDecisionResult, type WithLastResponse };
+declare function can(params: CanParams, opts?: CanOptions): Promise<CanResult>;
+/**
+ * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.
+ * For authenticated, key-scoped operations use the `Nomos` class instead.
+ */
+declare const nomos: {
+    can: typeof can;
+};
+
+export { type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type CanOptions, type CanParams, type CanResult, type CanVerdict, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type ListArtifactsParams, Nomos, NomosAPIError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosError, type NomosErrorCode, NomosNetworkError, NomosNotFoundError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type RequestOptions, type Verdict, type VerifyDecisionParams, type VerifyDecisionResult, type WithLastResponse, can, nomos };

package/dist/index.d.ts

@@ -41,24 +41,111 @@ interface DetectContradictionsParams {
         priority?: number;
     }>;
 }
-type Verdict = 'auto_approved' | 'auto_rejected' | 'escalated' | 'pending_human_review';
+type Verdict = 'approved' | 'rejected' | 'escalated';
+type CanVerdict = 'AUTHORIZED' | 'DENIED' | 'ESCALATED';
+interface CanParams {
+    /** Exchange artifact's standard name — slug (optionally ".nomos"-suffixed) or raw id, e.g. "eu-ai-act.nomos" */
+    authority: string;
+    /** Optional human-readable label for what's being asked (recorded in the transcript) */
+    action?: string;
+    /** The facts to evaluate. Either pass this explicitly, or spread the facts flat alongside
+     *  `authority`/`action` — both shapes are accepted (explicit `inputs` wins if both given). */
+    inputs?: Record<string, unknown>;
+    /** Flat-facts convenience: any extra keys are treated as inputs when `inputs` is omitted. */
+    [key: string]: unknown;
+}
+interface CanOptions {
+    /** Override the API host (defaults to the public NOMOS Exchange). */
+    baseUrl?: string;
+    /** AbortSignal to cancel the request. */
+    signal?: AbortSignal;
+}
+interface CanResult {
+    /** True only for an AUTHORIZED verdict. DENIED and ESCALATED are both `false`. */
+    allowed: boolean;
+    /** The authority's own verdict, verbatim. */
+    verdict: CanVerdict;
+    /** Human-readable explanation of the verdict. */
+    reason: string;
+    /** The rule id that decided it, if any. */
+    rule: string | null;
+    /** Permanent, addressable transcript id — open it any time. */
+    query_id: string;
+    /** Relative URL of the transcript. */
+    url: string;
+    /** Which authority answered, and its standing. */
+    authority: {
+        id: string;
+        title: string;
+        standing: string;
+    };
+    /** On ESCALATED: the facts the authority still needs to reach a verdict. */
+    missing_inputs: string[];
+}
 interface VerifyDecisionResult {
+    /** Unique request ID — include in support tickets */
+    id: string;
+    /** Always "decision" */
+    object: 'decision';
+    /** The artifact that governed this decision */
+    artifact_id: string;
+    /** Artifact name */
+    artifact_name: string;
     /** Whether the decision is permitted under current governance */
     allowed: boolean;
-    /** Machine-readable verdict */
+    /** Human-readable verdict */
     verdict: Verdict;
+    /** The rule that triggered this verdict, if any */
+    rule?: {
+        id: string;
+        description: string | null;
+        action: 'allow' | 'deny' | 'escalate';
+    };
+    /** Evaluation metrics */
+    evaluation: {
+        rules_evaluated: number;
+        rules_matched: number;
+        rules_expired: number;
+        conflicts_resolved: number;
+    };
+    /** Confidence in the verdict */
+    confidence: {
+        /** Artifact verification tier */
+        tier: string;
+        /** 0–1 confidence score */
+        score: number;
+        /** Human-readable explanation of the tier */
+        description: string;
+    };
+    /** Audit record — store the hash for compliance */
+    audit: {
+        hash: string;
+        timestamp: string;
+    };
+    /** Performance metrics */
+    performance: {
+        latency_ms: number;
+    };
+    /** API schema version */
+    schema_version: string;
     /** Human-readable explanation */
     verdict_description: string;
-    /** The rule that triggered this verdict (if any) */
-    rule_reference?: string;
-    /** SHA-256 hash of the audit record — store this for compliance */
-    audit_record?: string;
-    /** Artifact that governed this decision */
-    artifact_id: string;
-    /** Execution ID for tracing */
-    execution_id?: string;
-    /** ISO timestamp */
-    decided_at: string;
+    /** Missing input fields, if any rule-referenced fields were absent */
+    incomplete_inputs?: {
+        fields: string[];
+        count: number;
+        warning: string;
+    };
+    /** How to satisfy an approval rule when current verdict is not approved */
+    paths_to_approval?: Array<{
+        rule_id: string | null;
+        rule_name: string | null;
+        required_changes: Array<{
+            field: string;
+            current: unknown;
+            must_satisfy: string;
+        }>;
+    }>;
 }
 interface Artifact {
     id: string;
@@ -85,6 +172,24 @@ interface ArtifactList {
     limit: number;
     offset: number;
 }
+interface ArtifactSchemaField {
+    name: string;
+    type: 'string' | 'number' | 'integer' | 'boolean' | 'date' | 'datetime' | 'enum' | 'array';
+    required: boolean;
+    description?: string;
+    enum?: string[];
+    min?: number;
+    max?: number;
+    format?: string;
+}
+interface ArtifactSchema {
+    artifact_id: string;
+    name: string;
+    fields: ArtifactSchemaField[];
+    required_fields: string[];
+    example_inputs: Record<string, unknown>;
+    field_count: number;
+}
 interface Contradiction {
     type: 'threshold_conflict' | 'role_conflict' | 'ghost_term' | 'rule_collision' | 'layer_divergence';
     severity: 'critical' | 'warning' | 'info';
@@ -226,6 +331,21 @@ declare class Artifacts {
      * }
      */
     listAutoPaging(params?: ListArtifactsParams, opts?: RequestOptions): AsyncGenerator<Artifact>;
+    /**
+     * Retrieve the declared input schema for a sealed artifact.
+     *
+     * Returns every field the artifact's rules reference — name, type, whether it's
+     * required, and a ready-to-use example_inputs object. Use this to build forms,
+     * validate payloads, or generate API docs without reading the rules manually.
+     *
+     * Requires an API key (artifact schemas are not public).
+     *
+     * @example
+     * const schema = await nomos.artifacts.schema('art_abc123');
+     * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+     * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+     */
+    schema(artifactId: string, opts?: RequestOptions): Promise<WithLastResponse<ArtifactSchema>>;
 }
 
 declare class Governance {
@@ -357,4 +477,13 @@ declare class Nomos {
     constructor(apiKey: string, config?: NomosConfig);
 }
 
-export { type Artifact, type ArtifactList, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type ListArtifactsParams, Nomos, NomosAPIError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosError, type NomosErrorCode, NomosNetworkError, NomosNotFoundError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type RequestOptions, type Verdict, type VerifyDecisionParams, type VerifyDecisionResult, type WithLastResponse };
+declare function can(params: CanParams, opts?: CanOptions): Promise<CanResult>;
+/**
+ * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.
+ * For authenticated, key-scoped operations use the `Nomos` class instead.
+ */
+declare const nomos: {
+    can: typeof can;
+};
+
+export { type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type CanOptions, type CanParams, type CanResult, type CanVerdict, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type ListArtifactsParams, Nomos, NomosAPIError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosError, type NomosErrorCode, NomosNetworkError, NomosNotFoundError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type RequestOptions, type Verdict, type VerifyDecisionParams, type VerifyDecisionResult, type WithLastResponse, can, nomos };

package/dist/index.js

@@ -226,21 +226,28 @@ var Decisions = class {
     } else {
       httpResp = await this.http.post("/api/v1/verify-decision", {
         artifact_id,
-        decision_context,
-        proposed_decision,
-        correlation_id: correlation_id ?? globalThis.crypto.randomUUID()
+        decision: proposed_decision ?? "evaluate",
+        inputs: decision_context,
+        caller: { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() }
       }, opts);
     }
     const raw = httpResp.data;
     return {
+      id: raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,
+      object: raw.object ?? "decision",
+      artifact_id: raw.artifact_id ?? artifact_id,
+      artifact_name: raw.artifact_name ?? "",
       allowed: raw.allowed ?? false,
-      verdict: raw.outcome ?? raw.verdict ?? "pending_human_review",
+      verdict: raw.verdict ?? (raw.outcome === "auto_approved" ? "approved" : raw.outcome === "auto_rejected" ? "rejected" : "escalated"),
+      rule: raw.rule,
+      evaluation: raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },
+      confidence: raw.confidence ?? { tier: raw.artifact_confidence ?? "DECLARED", score: 1, description: "" },
+      audit: raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? "", timestamp: raw.ts ?? (/* @__PURE__ */ new Date()).toISOString() },
+      performance: raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },
+      schema_version: raw.schema_version ?? "1.0.0",
       verdict_description: raw.verdict_description ?? "",
-      rule_reference: raw.rule_reference ?? raw.rule_applied,
-      audit_record: raw.audit_record ?? raw.audit_hash,
-      artifact_id: raw.artifact_id ?? artifact_id,
-      execution_id: raw.execution_id,
-      decided_at: raw.decided_at ?? raw.evaluated_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+      incomplete_inputs: raw.incomplete_inputs,
+      paths_to_approval: raw.paths_to_approval,
       lastResponse: httpResp.lastResponse
     };
   }
@@ -316,6 +323,27 @@ var Artifacts = class {
       offset += page.data.length;
     }
   }
+  /**
+   * Retrieve the declared input schema for a sealed artifact.
+   *
+   * Returns every field the artifact's rules reference — name, type, whether it's
+   * required, and a ready-to-use example_inputs object. Use this to build forms,
+   * validate payloads, or generate API docs without reading the rules manually.
+   *
+   * Requires an API key (artifact schemas are not public).
+   *
+   * @example
+   * const schema = await nomos.artifacts.schema('art_abc123');
+   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']
+   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }
+   */
+  async schema(artifactId, opts) {
+    const { data, lastResponse } = await this.http.get(
+      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,
+      opts
+    );
+    return { ...data, lastResponse };
+  }
 };
 
 // src/resources/governance.ts
@@ -494,6 +522,69 @@ var Nomos = class {
     this.webhooks = new Webhooks();
   }
 };
+
+// src/can.ts
+var DEFAULT_EXCHANGE_BASE = "https://www.nomosprotocol.com";
+async function can(params, opts) {
+  const { authority, action, inputs, ...flat } = params;
+  if (!authority || typeof authority !== "string") {
+    throw new Error("can(): `authority` (an Exchange artifact id or slug) is required.");
+  }
+  const facts = inputs && typeof inputs === "object" ? inputs : flat;
+  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\/$/, "");
+  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ inputs: facts, action }),
+      signal: opts?.signal
+    });
+  } catch (err) {
+    if (err?.name === "AbortError") throw new NomosNetworkError("Request aborted");
+    throw new NomosNetworkError(err?.message ?? "Network error");
+  }
+  const requestId = res.headers.get("x-request-id") ?? "";
+  const data = await res.json().catch(() => null);
+  if (!res.ok) {
+    const message = data?.error ?? data?.message ?? `NOMOS query failed (HTTP ${res.status})`;
+    switch (res.status) {
+      case 401:
+        throw new NomosAuthenticationError(message, requestId);
+      case 403:
+        throw new NomosAuthorizationError(message, requestId);
+      case 404:
+        throw new NomosNotFoundError(message, requestId);
+      case 422:
+      case 400:
+        throw new NomosValidationError(message, data?.details, requestId);
+      case 429:
+        throw new NomosRateLimitError(
+          message,
+          res.headers.get("retry-after") ? parseInt(res.headers.get("retry-after"), 10) : void 0,
+          requestId
+        );
+      default:
+        throw new NomosAPIError(message, res.status, requestId);
+    }
+  }
+  return {
+    allowed: data.verdict === "AUTHORIZED",
+    verdict: data.verdict,
+    reason: data.verdict_description,
+    rule: data.matched_rule_id ?? null,
+    query_id: data.query_id,
+    url: data.url,
+    authority: {
+      id: data.artifact?.id ?? authority,
+      title: data.artifact?.title ?? "",
+      standing: data.artifact?.standing ?? ""
+    },
+    missing_inputs: data.missing_inputs ?? []
+  };
+}
+var nomos = { can };
 export {
   Nomos,
   NomosAPIError,
@@ -504,6 +595,8 @@ export {
   NomosNotFoundError,
   NomosRateLimitError,
   NomosValidationError,
-  NomosWebhookSignatureError
+  NomosWebhookSignatureError,
+  can,
+  nomos
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/util.ts","../src/http-client.ts","../src/resources/decisions.ts","../src/resources/artifacts.ts","../src/resources/governance.ts","../src/resources/webhooks.ts","../src/nomos.ts"],"sourcesContent":["export type NomosErrorCode =\n  | 'authentication_error'\n  | 'authorization_error'\n  | 'rate_limit_error'\n  | 'validation_error'\n  | 'not_found'\n  | 'api_error'\n  | 'network_error'\n  | 'webhook_signature_error';\n\nexport class NomosError extends Error {\n  readonly code: NomosErrorCode;\n  readonly status?: number;\n  readonly requestId?: string;\n\n  constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string) {\n    super(message);\n    this.name = 'NomosError';\n    this.code = code;\n    this.status = status;\n    this.requestId = requestId;\n  }\n}\n\nexport class NomosAuthenticationError extends NomosError {\n  constructor(message = 'Invalid API key', requestId?: string) {\n    super(message, 'authentication_error', 401, requestId);\n    this.name = 'NomosAuthenticationError';\n  }\n}\n\nexport class NomosAuthorizationError extends NomosError {\n  constructor(message = 'Access denied', requestId?: string) {\n    super(message, 'authorization_error', 403, requestId);\n    this.name = 'NomosAuthorizationError';\n  }\n}\n\nexport class NomosRateLimitError extends NomosError {\n  readonly retryAfter?: number;\n\n  constructor(message = 'Rate limit exceeded', retryAfter?: number, requestId?: string) {\n    super(message, 'rate_limit_error', 429, requestId);\n    this.name = 'NomosRateLimitError';\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class NomosValidationError extends NomosError {\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown, requestId?: string) {\n    super(message, 'validation_error', 400, requestId);\n    this.name = 'NomosValidationError';\n    this.details = details;\n  }\n}\n\nexport class NomosNotFoundError extends NomosError {\n  constructor(message: string, requestId?: string) {\n    super(message, 'not_found', 404, requestId);\n    this.name = 'NomosNotFoundError';\n  }\n}\n\nexport class NomosAPIError extends NomosError {\n  constructor(message: string, status: number, requestId?: string) {\n    super(message, 'api_error', status, requestId);\n    this.name = 'NomosAPIError';\n  }\n}\n\nexport class NomosNetworkError extends NomosError {\n  constructor(message: string) {\n    super(message, 'network_error');\n    this.name = 'NomosNetworkError';\n  }\n}\n\nexport class NomosWebhookSignatureError extends NomosError {\n  constructor(message: string) {\n    super(message, 'webhook_signature_error', 400);\n    this.name = 'NomosWebhookSignatureError';\n  }\n}\n","export async function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nexport function jitteredBackoff(attempt: number, baseMs = 500): number {\n  const exp = Math.min(baseMs * 2 ** attempt, 16000);\n  return exp * (0.75 + Math.random() * 0.5); // ±25% jitter\n}\n\nexport function isRetryable(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n","import {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\nimport { sleep, jitteredBackoff, isRetryable } from './util.js';\nimport type { RequestOptions, NomosRawResponse } from './types.js';\n\nconst SDK_VERSION = '1.1.0';\n\nexport interface HttpClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  maxRetries: number;\n  timeout: number;\n}\n\nexport interface HttpResponse<T> {\n  data: T;\n  lastResponse: NomosRawResponse;\n}\n\nexport class HttpClient {\n  constructor(private readonly opts: HttpClientOptions) {}\n\n  async get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('GET', path, undefined, reqOpts);\n  }\n\n  async post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('POST', path, body, reqOpts);\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    body: unknown,\n    reqOpts?: RequestOptions,\n    attempt = 0,\n  ): Promise<HttpResponse<T>> {\n    const apiKey     = reqOpts?.apiKey     ?? this.opts.apiKey;\n    const timeout    = reqOpts?.timeout    ?? this.opts.timeout;\n    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;\n\n    const url = `${this.opts.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n\n    const headers: Record<string, string> = {\n      'Content-Type':      'application/json',\n      'X-Nomos-Api-Key':   apiKey,\n      'User-Agent':        `nomos-node/${SDK_VERSION}`,\n      'NOMOS-SDK-Version': SDK_VERSION,\n    };\n    if (reqOpts?.idempotencyKey) {\n      headers['Idempotency-Key'] = reqOpts.idempotencyKey;\n    }\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        signal: controller.signal,\n        headers,\n        body: body != null ? JSON.stringify(body) : undefined,\n      });\n    } catch (err: any) {\n      clearTimeout(timer);\n      if (err.name === 'AbortError') {\n        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);\n      }\n      throw new NomosNetworkError(err.message ?? 'Network error');\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const requestId = res.headers.get('x-request-id') ?? '';\n    const rawHeaders: Record<string, string> = {};\n    res.headers.forEach((value, key) => { rawHeaders[key] = value; });\n    const lastResponse: NomosRawResponse = {\n      requestId,\n      statusCode: res.status,\n      headers: rawHeaders,\n    };\n\n    if (res.ok) {\n      const data = await res.json() as T;\n      return { data, lastResponse };\n    }\n\n    // Retry on 429 / 5xx\n    if (isRetryable(res.status) && attempt < maxRetries) {\n      const retryAfter = res.headers.get('retry-after');\n      const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : jitteredBackoff(attempt);\n      await sleep(delay);\n      return this.request<T>(method, path, body, reqOpts, attempt + 1);\n    }\n\n    let errBody: any = {};\n    try { errBody = await res.json(); } catch {}\n    const message: string = errBody?.error ?? errBody?.message ?? res.statusText;\n\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, errBody?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Decisions {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Verify whether an AI decision is permitted under a governance artifact.\n   *\n   * Public demo artifacts (`pub_*`) work without an API key.\n   * Custom artifacts require a valid API key.\n   *\n   * @example\n   * const result = await nomos.decisions.verify({\n   *   artifact_id: 'pub_lending_v1',\n   *   decision_context: { credit_score: 720, loan_amount: 50000 },\n   * });\n   *\n   * if (!result.allowed) {\n   *   throw new Error(`Blocked: ${result.verdict_description}`);\n   * }\n   *\n   * // Debugging / tracing\n   * console.log(result.lastResponse.requestId);\n   *\n   * @example\n   * // Per-request options\n   * const result = await nomos.decisions.verify(params, {\n   *   idempotencyKey: `verify-${transactionId}`,\n   *   timeout: 5000,\n   * });\n   */\n  async verify(\n    params: VerifyDecisionParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<VerifyDecisionResult>> {\n    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;\n\n    // Public artifacts (pub_*) use the open /verify endpoint — no API key required\n    const isPublic = artifact_id.startsWith('pub_');\n    let httpResp: Awaited<ReturnType<HttpClient['post']>>;\n\n    if (isPublic) {\n      httpResp = await this.http.post<any>('/api/v1/verify', {\n        artifact_id,\n        decision:  proposed_decision ?? 'evaluate',\n        inputs:    decision_context,\n      }, opts);\n    } else {\n      httpResp = await this.http.post<any>('/api/v1/verify-decision', {\n        artifact_id,\n        decision_context,\n        proposed_decision,\n        correlation_id: correlation_id ?? globalThis.crypto.randomUUID(),\n      }, opts);\n    }\n\n    const raw: any = httpResp.data;\n\n    return {\n      allowed:             raw.allowed ?? false,\n      verdict:             raw.outcome ?? raw.verdict ?? 'pending_human_review',\n      verdict_description: raw.verdict_description ?? '',\n      rule_reference:      raw.rule_reference ?? raw.rule_applied,\n      audit_record:        raw.audit_record ?? raw.audit_hash,\n      artifact_id:         raw.artifact_id ?? artifact_id,\n      execution_id:        raw.execution_id,\n      decided_at:          raw.decided_at ?? raw.evaluated_at ?? new Date().toISOString(),\n      lastResponse:        httpResp.lastResponse,\n    };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  Artifact,\n  ArtifactList,\n  ListArtifactsParams,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Artifacts {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Retrieve a single artifact by ID.\n   *\n   * @example\n   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');\n   * console.log(artifact.ari_score, artifact.autonomy_band);\n   * console.log(artifact.lastResponse.requestId); // for support tickets\n   */\n  async retrieve(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<Artifact>> {\n    const { data, lastResponse } = await this.http.get<Artifact>(\n      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * List published artifacts on the Exchange with optional filters.\n   *\n   * @example\n   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });\n   *\n   * @example\n   * // With per-request options\n   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });\n   */\n  async list(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactList>> {\n    const qs = new URLSearchParams();\n    if (params.band)           qs.set('band', params.band);\n    if (params.domain)         qs.set('domain', params.domain);\n    if (params.jurisdiction)   qs.set('jurisdiction', params.jurisdiction);\n    if (params.sort)           qs.set('sort', params.sort);\n    if (params.limit != null)  qs.set('limit', String(params.limit));\n    if (params.offset != null) qs.set('offset', String(params.offset));\n    const query = qs.toString();\n\n    const { data: raw, lastResponse } = await this.http.get<any>(\n      `/api/exchange/artifacts${query ? `?${query}` : ''}`,\n      opts,\n    );\n\n    // API returns { artifacts: [], total: N } — normalise to { data: [], total: N }\n    const normalized: ArtifactList = {\n      data:   Array.isArray(raw) ? raw : (raw.artifacts ?? raw.data ?? []),\n      total:  raw.total ?? (Array.isArray(raw) ? raw.length : 0),\n      limit:  params.limit ?? 20,\n      offset: params.offset ?? 0,\n    };\n\n    return { ...normalized, lastResponse };\n  }\n\n  /**\n   * Auto-paginating iterator — yields every artifact across all pages.\n   * Stops automatically when the last page is reached.\n   *\n   * @example\n   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {\n   *   console.log(artifact.title, artifact.ari_score);\n   * }\n   */\n  async *listAutoPaging(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): AsyncGenerator<Artifact> {\n    let offset = params.offset ?? 0;\n    const limit = params.limit ?? 20;\n\n    while (true) {\n      const page = await this.list({ ...params, offset, limit }, opts);\n      for (const item of page.data) yield item;\n      if (page.data.length < limit || offset + page.data.length >= page.total) break;\n      offset += page.data.length;\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Governance {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Generate a sealed .nomos governance artifact from policy documents\n   * and optional historical decision logs.\n   *\n   * @example\n   * const artifact = await nomos.governance.generate({\n   *   policies: [policyText],\n   *   decision_logs: historicalRows,\n   *   domain: 'loan_approval',\n   * });\n   * console.log(artifact.ari_score, artifact.seal_hash);\n   */\n  async generate(\n    params: GenerateGovernanceParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<GenerateGovernanceResult>> {\n    const { data, lastResponse } = await this.http.post<GenerateGovernanceResult>(\n      '/api/v1/generate-governance',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * Detect contradictions and conflicts in a rule set before sealing.\n   *\n   * @example\n   * const report = await nomos.governance.detectContradictions({ rules });\n   * if (!report.clean) {\n   *   console.log(report.contradictions);\n   * }\n   */\n  async detectContradictions(\n    params: DetectContradictionsParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<DetectContradictionsResult>> {\n    const { data, lastResponse } = await this.http.post<DetectContradictionsResult>(\n      '/api/v1/detect-contradictions',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import { NomosWebhookSignatureError } from '../errors.js';\nimport type { NomosWebhookEvent } from '../types.js';\n\n// Hex string → Uint8Array (no Buffer dependency — works in Node and browsers)\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    const byte = parseInt(hex.slice(i, i + 2), 16);\n    if (isNaN(byte)) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n    bytes[i / 2] = byte;\n  }\n  return bytes;\n}\n\n// Constant-time comparison (prevents timing attacks)\nfunction safeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nexport class Webhooks {\n  /**\n   * Verify a NOMOS webhook signature and return the parsed event.\n   *\n   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`\n   * Signed payload: `<timestamp>.<raw_body>`\n   *\n   * @example\n   * // Express\n   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {\n   *   const event = await nomos.webhooks.constructEvent(\n   *     req.body,\n   *     req.headers['nomos-signature'] as string,\n   *     process.env.NOMOS_WEBHOOK_SECRET!,\n   *   );\n   *   console.log(event.type, event.data);\n   *   res.sendStatus(200);\n   * });\n   *\n   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed\n   */\n  async constructEvent(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<NomosWebhookEvent> {\n    const body = typeof payload === 'string'\n      ? payload\n      : new TextDecoder().decode(payload);\n\n    // Parse \"t=<ts>,v1=<hex>\" header\n    const parts: Record<string, string> = {};\n    for (const part of signature.split(',')) {\n      const eq = part.indexOf('=');\n      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();\n    }\n\n    if (!parts['t'] || !parts['v1']) {\n      throw new NomosWebhookSignatureError(\n        'Invalid signature format — expected \"t=<timestamp>,v1=<hmac>\"',\n      );\n    }\n\n    const timestamp = parseInt(parts['t'], 10);\n    if (isNaN(timestamp)) {\n      throw new NomosWebhookSignatureError('Invalid timestamp in webhook signature');\n    }\n\n    const ageSecs = Math.abs(Date.now() / 1000 - timestamp);\n    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {\n      throw new NomosWebhookSignatureError(\n        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). ` +\n        'Ensure your server clock is synced and the event is not being replayed.',\n      );\n    }\n\n    // HMAC-SHA256 via Web Crypto API (Node 18+ / modern browsers — no dependencies)\n    const enc = new TextEncoder();\n    const keyMaterial = await globalThis.crypto.subtle.importKey(\n      'raw',\n      enc.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    );\n    const signedPayload = `${parts['t']}.${body}`;\n    const expectedBuf = await globalThis.crypto.subtle.sign(\n      'HMAC',\n      keyMaterial,\n      enc.encode(signedPayload),\n    );\n    const expected = new Uint8Array(expectedBuf);\n    const received = hexToBytes(parts['v1']);\n\n    if (!safeEqual(expected, received)) {\n      throw new NomosWebhookSignatureError(\n        'Webhook signature mismatch — verify your NOMOS_WEBHOOK_SECRET matches the one in Studio.',\n      );\n    }\n\n    try {\n      return JSON.parse(body) as NomosWebhookEvent;\n    } catch {\n      throw new NomosWebhookSignatureError('Webhook payload is not valid JSON');\n    }\n  }\n\n  /**\n   * Verify a webhook signature without parsing the event.\n   * Returns `true` if valid, `false` if not (never throws).\n   *\n   * @example\n   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);\n   * if (!valid) return res.sendStatus(400);\n   */\n  async verifySignature(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<boolean> {\n    try {\n      await this.constructEvent(payload, signature, secret, toleranceSeconds);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","import { HttpClient } from './http-client.js';\nimport { Decisions } from './resources/decisions.js';\nimport { Artifacts } from './resources/artifacts.js';\nimport { Governance } from './resources/governance.js';\nimport { Webhooks } from './resources/webhooks.js';\nimport * as errors from './errors.js';\nimport type { NomosConfig } from './types.js';\n\nconst DEFAULT_BASE_URL  = 'https://nomos.ai';\nconst DEFAULT_MAX_RETRIES = 3;\nconst DEFAULT_TIMEOUT   = 30_000;\n\nexport class Nomos {\n  readonly decisions:  Decisions;\n  readonly artifacts:  Artifacts;\n  readonly governance: Governance;\n  readonly webhooks:   Webhooks;\n\n  /** Whether this instance is using a live or test API key. */\n  readonly mode: 'live' | 'test';\n\n  static readonly errors = errors;\n\n  constructor(apiKey: string, config: NomosConfig = {}) {\n    if (!apiKey || typeof apiKey !== 'string') {\n      throw new errors.NomosAuthenticationError(\n        'A valid API key is required. Pass it as the first argument: new Nomos(\"nms_live_...\")',\n      );\n    }\n\n    this.mode = apiKey.startsWith('nms_test_') ? 'test' : 'live';\n\n    const http = new HttpClient({\n      apiKey,\n      baseUrl:    (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, ''),\n      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,\n      timeout:    config.timeout    ?? DEFAULT_TIMEOUT,\n    });\n\n    this.decisions  = new Decisions(http);\n    this.artifacts  = new Artifacts(http);\n    this.governance = new Governance(http);\n    this.webhooks   = new Webhooks();\n  }\n}\n"],"mappings":";;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,SAAiB,MAAsB,QAAiB,WAAoB;AACtF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,2BAAN,cAAuC,WAAW;AAAA,EACvD,YAAY,UAAU,mBAAmB,WAAoB;AAC3D,UAAM,SAAS,wBAAwB,KAAK,SAAS;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,WAAW;AAAA,EACtD,YAAY,UAAU,iBAAiB,WAAoB;AACzD,UAAM,SAAS,uBAAuB,KAAK,SAAS;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,WAAW;AAAA,EAGlD,YAAY,UAAU,uBAAuB,YAAqB,WAAoB;AACpF,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EAGnD,YAAY,SAAiB,SAAmB,WAAoB;AAClE,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB,WAAoB;AAC/C,UAAM,SAAS,aAAa,KAAK,SAAS;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,YAAY,SAAiB,QAAgB,WAAoB;AAC/D,UAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe;AAC9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,WAAW;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,2BAA2B,GAAG;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;;;ACpFA,eAAsB,MAAM,IAA2B;AACrD,SAAO,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AACvD;AAEO,SAAS,gBAAgB,SAAiB,SAAS,KAAa;AACrE,QAAM,MAAM,KAAK,IAAI,SAAS,KAAK,SAAS,IAAK;AACjD,SAAO,OAAO,OAAO,KAAK,OAAO,IAAI;AACvC;AAEO,SAAS,YAAY,QAAyB;AACnD,SAAO,WAAW,OAAO,UAAU;AACrC;;;ACCA,IAAM,cAAc;AAcb,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,IAAO,MAAc,SAAoD;AAC7E,WAAO,KAAK,QAAW,OAAO,MAAM,QAAW,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAAe,SAAoD;AAC7F,WAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,OAAO;AAAA,EACpD;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACA,SACA,UAAU,GACgB;AAC1B,UAAM,SAAa,SAAS,UAAc,KAAK,KAAK;AACpD,UAAM,UAAa,SAAS,WAAc,KAAK,KAAK;AACpD,UAAM,aAAa,SAAS,cAAc,KAAK,KAAK;AAEpD,UAAM,MAAM,GAAG,KAAK,KAAK,OAAO,GAAG,IAAI;AACvC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAqB;AAAA,MACrB,mBAAqB;AAAA,MACrB,cAAqB,cAAc,WAAW;AAAA,MAC9C,qBAAqB;AAAA,IACvB;AACA,QAAI,SAAS,gBAAgB;AAC3B,cAAQ,iBAAiB,IAAI,QAAQ;AAAA,IACvC;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,WAAW;AAAA,QACnB;AAAA,QACA,MAAM,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,mBAAa,KAAK;AAClB,UAAI,IAAI,SAAS,cAAc;AAC7B,cAAM,IAAI,kBAAkB,2BAA2B,OAAO,IAAI;AAAA,MACpE;AACA,YAAM,IAAI,kBAAkB,IAAI,WAAW,eAAe;AAAA,IAC5D,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAM,aAAqC,CAAC;AAC5C,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAE,iBAAW,GAAG,IAAI;AAAA,IAAO,CAAC;AAChE,UAAM,eAAiC;AAAA,MACrC;AAAA,MACA,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AAEA,QAAI,IAAI,IAAI;AACV,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B;AAGA,QAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,YAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,YAAM,QAAQ,aAAa,SAAS,YAAY,EAAE,IAAI,MAAO,gBAAgB,OAAO;AACpF,YAAM,MAAM,KAAK;AACjB,aAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,IACjE;AAEA,QAAI,UAAe,CAAC;AACpB,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC3C,UAAM,UAAkB,SAAS,SAAS,SAAS,WAAW,IAAI;AAElE,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,SAAS,SAAS,SAAS;AAAA,MAC7E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AACF;;;AChHO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BhD,MAAM,OACJ,QACA,MACiD;AACjD,UAAM,EAAE,aAAa,kBAAkB,mBAAmB,eAAe,IAAI;AAG7E,UAAM,WAAW,YAAY,WAAW,MAAM;AAC9C,QAAI;AAEJ,QAAI,UAAU;AACZ,iBAAW,MAAM,KAAK,KAAK,KAAU,kBAAkB;AAAA,QACrD;AAAA,QACA,UAAW,qBAAqB;AAAA,QAChC,QAAW;AAAA,MACb,GAAG,IAAI;AAAA,IACT,OAAO;AACL,iBAAW,MAAM,KAAK,KAAK,KAAU,2BAA2B;AAAA,QAC9D;AAAA,QACA;AAAA,QACA;AAAA,QACA,gBAAgB,kBAAkB,WAAW,OAAO,WAAW;AAAA,MACjE,GAAG,IAAI;AAAA,IACT;AAEA,UAAM,MAAW,SAAS;AAE1B,WAAO;AAAA,MACL,SAAqB,IAAI,WAAW;AAAA,MACpC,SAAqB,IAAI,WAAW,IAAI,WAAW;AAAA,MACnD,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,gBAAqB,IAAI,kBAAkB,IAAI;AAAA,MAC/C,cAAqB,IAAI,gBAAgB,IAAI;AAAA,MAC7C,aAAqB,IAAI,eAAe;AAAA,MACxC,cAAqB,IAAI;AAAA,MACzB,YAAqB,IAAI,cAAc,IAAI,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClF,cAAqB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;;;ACnEO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,SACJ,YACA,MACqC;AACrC,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,2BAA2B,mBAAmB,UAAU,CAAC;AAAA,MACzD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KACJ,SAA8B,CAAC,GAC/B,MACyC;AACzC,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,OAAgB,IAAG,IAAI,UAAU,OAAO,MAAM;AACzD,QAAI,OAAO,aAAgB,IAAG,IAAI,gBAAgB,OAAO,YAAY;AACrE,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,SAAS,KAAO,IAAG,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAC/D,QAAI,OAAO,UAAU,KAAM,IAAG,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AACjE,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,EAAE,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAClD,0BAA0B,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AAGA,UAAM,aAA2B;AAAA,MAC/B,MAAQ,MAAM,QAAQ,GAAG,IAAI,MAAO,IAAI,aAAa,IAAI,QAAQ,CAAC;AAAA,MAClE,OAAQ,IAAI,UAAU,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS;AAAA,MACxD,OAAQ,OAAO,SAAS;AAAA,MACxB,QAAQ,OAAO,UAAU;AAAA,IAC3B;AAEA,WAAO,EAAE,GAAG,YAAY,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,eACL,SAA8B,CAAC,GAC/B,MAC0B;AAC1B,QAAI,SAAS,OAAO,UAAU;AAC9B,UAAM,QAAQ,OAAO,SAAS;AAE9B,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,GAAG,QAAQ,QAAQ,MAAM,GAAG,IAAI;AAC/D,iBAAW,QAAQ,KAAK,KAAM,OAAM;AACpC,UAAI,KAAK,KAAK,SAAS,SAAS,SAAS,KAAK,KAAK,UAAU,KAAK,MAAO;AACzE,gBAAU,KAAK,KAAK;AAAA,IACtB;AAAA,EACF;AACF;;;ACnFO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAchD,MAAM,SACJ,QACA,MACqD;AACrD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,qBACJ,QACA,MACuD;AACvD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;ACrDA,SAAS,WAAW,KAAyB;AAC3C,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AAClG,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AAC7C,QAAI,MAAM,IAAI,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AACzF,UAAM,IAAI,CAAC,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAe,GAAwB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAEO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBpB,MAAM,eACJ,SACA,WACA,QACA,mBAAmB,KACS;AAC5B,UAAM,OAAO,OAAO,YAAY,WAC5B,UACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAGpC,UAAM,QAAgC,CAAC;AACvC,eAAW,QAAQ,UAAU,MAAM,GAAG,GAAG;AACvC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,KAAK,GAAI,OAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,IACzE;AAEA,QAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,SAAS,MAAM,GAAG,GAAG,EAAE;AACzC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,wCAAwC;AAAA,IAC/E;AAEA,UAAM,UAAU,KAAK,IAAI,KAAK,IAAI,IAAI,MAAO,SAAS;AACtD,QAAI,mBAAmB,KAAK,UAAU,kBAAkB;AACtD,YAAM,IAAI;AAAA,QACR,8BAA8B,KAAK,MAAM,OAAO,CAAC,OAAO,gBAAgB;AAAA,MAE1E;AAAA,IACF;AAGA,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA,IAAI,OAAO,MAAM;AAAA,MACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AACA,UAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI;AAC3C,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,IAAI,OAAO,aAAa;AAAA,IAC1B;AACA,UAAM,WAAW,IAAI,WAAW,WAAW;AAC3C,UAAM,WAAW,WAAW,MAAM,IAAI,CAAC;AAEvC,QAAI,CAAC,UAAU,UAAU,QAAQ,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI,2BAA2B,mCAAmC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,SACA,WACA,QACA,mBAAmB,KACD;AAClB,QAAI;AACF,YAAM,KAAK,eAAe,SAAS,WAAW,QAAQ,gBAAgB;AACtE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC5HA,IAAM,mBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAoB;AAEnB,IAAM,QAAN,MAAY;AAAA,EASjB;AAAA,SAAgB,SAAS;AAAA;AAAA,EAEzB,YAAY,QAAgB,SAAsB,CAAC,GAAG;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,YAAM,IAAW;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,WAAW,WAAW,IAAI,SAAS;AAEtD,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B;AAAA,MACA,UAAa,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AAAA,MAClE,YAAY,OAAO,cAAc;AAAA,MACjC,SAAY,OAAO,WAAc;AAAA,IACnC,CAAC;AAED,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,aAAa,IAAI,WAAW,IAAI;AACrC,SAAK,WAAa,IAAI,SAAS;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../src/errors.ts","../src/util.ts","../src/http-client.ts","../src/resources/decisions.ts","../src/resources/artifacts.ts","../src/resources/governance.ts","../src/resources/webhooks.ts","../src/nomos.ts","../src/can.ts"],"sourcesContent":["export type NomosErrorCode =\n  | 'authentication_error'\n  | 'authorization_error'\n  | 'rate_limit_error'\n  | 'validation_error'\n  | 'not_found'\n  | 'api_error'\n  | 'network_error'\n  | 'webhook_signature_error';\n\nexport class NomosError extends Error {\n  readonly code: NomosErrorCode;\n  readonly status?: number;\n  readonly requestId?: string;\n\n  constructor(message: string, code: NomosErrorCode, status?: number, requestId?: string) {\n    super(message);\n    this.name = 'NomosError';\n    this.code = code;\n    this.status = status;\n    this.requestId = requestId;\n  }\n}\n\nexport class NomosAuthenticationError extends NomosError {\n  constructor(message = 'Invalid API key', requestId?: string) {\n    super(message, 'authentication_error', 401, requestId);\n    this.name = 'NomosAuthenticationError';\n  }\n}\n\nexport class NomosAuthorizationError extends NomosError {\n  constructor(message = 'Access denied', requestId?: string) {\n    super(message, 'authorization_error', 403, requestId);\n    this.name = 'NomosAuthorizationError';\n  }\n}\n\nexport class NomosRateLimitError extends NomosError {\n  readonly retryAfter?: number;\n\n  constructor(message = 'Rate limit exceeded', retryAfter?: number, requestId?: string) {\n    super(message, 'rate_limit_error', 429, requestId);\n    this.name = 'NomosRateLimitError';\n    this.retryAfter = retryAfter;\n  }\n}\n\nexport class NomosValidationError extends NomosError {\n  readonly details?: unknown;\n\n  constructor(message: string, details?: unknown, requestId?: string) {\n    super(message, 'validation_error', 400, requestId);\n    this.name = 'NomosValidationError';\n    this.details = details;\n  }\n}\n\nexport class NomosNotFoundError extends NomosError {\n  constructor(message: string, requestId?: string) {\n    super(message, 'not_found', 404, requestId);\n    this.name = 'NomosNotFoundError';\n  }\n}\n\nexport class NomosAPIError extends NomosError {\n  constructor(message: string, status: number, requestId?: string) {\n    super(message, 'api_error', status, requestId);\n    this.name = 'NomosAPIError';\n  }\n}\n\nexport class NomosNetworkError extends NomosError {\n  constructor(message: string) {\n    super(message, 'network_error');\n    this.name = 'NomosNetworkError';\n  }\n}\n\nexport class NomosWebhookSignatureError extends NomosError {\n  constructor(message: string) {\n    super(message, 'webhook_signature_error', 400);\n    this.name = 'NomosWebhookSignatureError';\n  }\n}\n","export async function sleep(ms: number): Promise<void> {\n  return new Promise(resolve => setTimeout(resolve, ms));\n}\n\nexport function jitteredBackoff(attempt: number, baseMs = 500): number {\n  const exp = Math.min(baseMs * 2 ** attempt, 16000);\n  return exp * (0.75 + Math.random() * 0.5); // ±25% jitter\n}\n\nexport function isRetryable(status: number): boolean {\n  return status === 429 || status >= 500;\n}\n","import {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\nimport { sleep, jitteredBackoff, isRetryable } from './util.js';\nimport type { RequestOptions, NomosRawResponse } from './types.js';\n\nconst SDK_VERSION = '1.1.0';\n\nexport interface HttpClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  maxRetries: number;\n  timeout: number;\n}\n\nexport interface HttpResponse<T> {\n  data: T;\n  lastResponse: NomosRawResponse;\n}\n\nexport class HttpClient {\n  constructor(private readonly opts: HttpClientOptions) {}\n\n  async get<T>(path: string, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('GET', path, undefined, reqOpts);\n  }\n\n  async post<T>(path: string, body: unknown, reqOpts?: RequestOptions): Promise<HttpResponse<T>> {\n    return this.request<T>('POST', path, body, reqOpts);\n  }\n\n  private async request<T>(\n    method: string,\n    path: string,\n    body: unknown,\n    reqOpts?: RequestOptions,\n    attempt = 0,\n  ): Promise<HttpResponse<T>> {\n    const apiKey     = reqOpts?.apiKey     ?? this.opts.apiKey;\n    const timeout    = reqOpts?.timeout    ?? this.opts.timeout;\n    const maxRetries = reqOpts?.maxRetries ?? this.opts.maxRetries;\n\n    const url = `${this.opts.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n\n    const headers: Record<string, string> = {\n      'Content-Type':      'application/json',\n      'X-Nomos-Api-Key':   apiKey,\n      'User-Agent':        `nomos-node/${SDK_VERSION}`,\n      'NOMOS-SDK-Version': SDK_VERSION,\n    };\n    if (reqOpts?.idempotencyKey) {\n      headers['Idempotency-Key'] = reqOpts.idempotencyKey;\n    }\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        signal: controller.signal,\n        headers,\n        body: body != null ? JSON.stringify(body) : undefined,\n      });\n    } catch (err: any) {\n      clearTimeout(timer);\n      if (err.name === 'AbortError') {\n        throw new NomosNetworkError(`Request timed out after ${timeout}ms`);\n      }\n      throw new NomosNetworkError(err.message ?? 'Network error');\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const requestId = res.headers.get('x-request-id') ?? '';\n    const rawHeaders: Record<string, string> = {};\n    res.headers.forEach((value, key) => { rawHeaders[key] = value; });\n    const lastResponse: NomosRawResponse = {\n      requestId,\n      statusCode: res.status,\n      headers: rawHeaders,\n    };\n\n    if (res.ok) {\n      const data = await res.json() as T;\n      return { data, lastResponse };\n    }\n\n    // Retry on 429 / 5xx\n    if (isRetryable(res.status) && attempt < maxRetries) {\n      const retryAfter = res.headers.get('retry-after');\n      const delay = retryAfter ? parseInt(retryAfter, 10) * 1000 : jitteredBackoff(attempt);\n      await sleep(delay);\n      return this.request<T>(method, path, body, reqOpts, attempt + 1);\n    }\n\n    let errBody: any = {};\n    try { errBody = await res.json(); } catch {}\n    const message: string = errBody?.error ?? errBody?.message ?? res.statusText;\n\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, errBody?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  VerifyDecisionParams,\n  VerifyDecisionResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Decisions {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Verify whether an AI decision is permitted under a governance artifact.\n   *\n   * Public demo artifacts (`pub_*`) work without an API key.\n   * Custom artifacts require a valid API key.\n   *\n   * @example\n   * const result = await nomos.decisions.verify({\n   *   artifact_id: 'pub_lending_v1',\n   *   decision_context: { credit_score: 720, loan_amount: 50000 },\n   * });\n   *\n   * if (!result.allowed) {\n   *   throw new Error(`Blocked: ${result.verdict_description}`);\n   * }\n   *\n   * // Debugging / tracing\n   * console.log(result.lastResponse.requestId);\n   *\n   * @example\n   * // Per-request options\n   * const result = await nomos.decisions.verify(params, {\n   *   idempotencyKey: `verify-${transactionId}`,\n   *   timeout: 5000,\n   * });\n   */\n  async verify(\n    params: VerifyDecisionParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<VerifyDecisionResult>> {\n    const { artifact_id, decision_context, proposed_decision, correlation_id } = params;\n\n    // Public artifacts (pub_*) use the open /verify endpoint — no API key required\n    const isPublic = artifact_id.startsWith('pub_');\n    let httpResp: Awaited<ReturnType<HttpClient['post']>>;\n\n    if (isPublic) {\n      httpResp = await this.http.post<any>('/api/v1/verify', {\n        artifact_id,\n        decision:  proposed_decision ?? 'evaluate',\n        inputs:    decision_context,\n      }, opts);\n    } else {\n      // /verify-decision expects: { artifact_id, decision, inputs, caller? }\n      // NOT decision_context / proposed_decision at the top level.\n      httpResp = await this.http.post<any>('/api/v1/verify-decision', {\n        artifact_id,\n        decision: proposed_decision ?? 'evaluate',\n        inputs:   decision_context,\n        caller:   { correlation_id: correlation_id ?? globalThis.crypto.randomUUID() },\n      }, opts);\n    }\n\n    const raw: any = httpResp.data;\n\n    return {\n      id:                  raw.id ?? `req_${raw.execution_id ?? globalThis.crypto.randomUUID()}`,\n      object:              raw.object ?? 'decision',\n      artifact_id:         raw.artifact_id ?? artifact_id,\n      artifact_name:       raw.artifact_name ?? '',\n      allowed:             raw.allowed ?? false,\n      verdict:             raw.verdict ?? (raw.outcome === 'auto_approved' ? 'approved' : raw.outcome === 'auto_rejected' ? 'rejected' : 'escalated'),\n      rule:                raw.rule,\n      evaluation:          raw.evaluation ?? { rules_evaluated: raw.rules_evaluated ?? 0, rules_matched: 0, rules_expired: 0, conflicts_resolved: 0 },\n      confidence:          raw.confidence ?? { tier: raw.artifact_confidence ?? 'DECLARED', score: 1, description: '' },\n      audit:               raw.audit ?? { hash: raw.audit_hash ?? raw.audit_record ?? '', timestamp: raw.ts ?? new Date().toISOString() },\n      performance:         raw.performance ?? { latency_ms: raw.latency_ms ?? 0 },\n      schema_version:      raw.schema_version ?? '1.0.0',\n      verdict_description: raw.verdict_description ?? '',\n      incomplete_inputs:   raw.incomplete_inputs,\n      paths_to_approval:   raw.paths_to_approval,\n      lastResponse:        httpResp.lastResponse,\n    };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  Artifact,\n  ArtifactList,\n  ArtifactSchema,\n  ListArtifactsParams,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Artifacts {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Retrieve a single artifact by ID.\n   *\n   * @example\n   * const artifact = await nomos.artifacts.retrieve('loan_approval_v1');\n   * console.log(artifact.ari_score, artifact.autonomy_band);\n   * console.log(artifact.lastResponse.requestId); // for support tickets\n   */\n  async retrieve(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<Artifact>> {\n    const { data, lastResponse } = await this.http.get<Artifact>(\n      `/api/exchange/artifacts/${encodeURIComponent(artifactId)}`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * List published artifacts on the Exchange with optional filters.\n   *\n   * @example\n   * const { data, total } = await nomos.artifacts.list({ band: 'autonomous', limit: 10 });\n   *\n   * @example\n   * // With per-request options\n   * const page = await nomos.artifacts.list({ limit: 20 }, { timeout: 5000 });\n   */\n  async list(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactList>> {\n    const qs = new URLSearchParams();\n    if (params.band)           qs.set('band', params.band);\n    if (params.domain)         qs.set('domain', params.domain);\n    if (params.jurisdiction)   qs.set('jurisdiction', params.jurisdiction);\n    if (params.sort)           qs.set('sort', params.sort);\n    if (params.limit != null)  qs.set('limit', String(params.limit));\n    if (params.offset != null) qs.set('offset', String(params.offset));\n    const query = qs.toString();\n\n    const { data: raw, lastResponse } = await this.http.get<any>(\n      `/api/exchange/artifacts${query ? `?${query}` : ''}`,\n      opts,\n    );\n\n    // API returns { artifacts: [], total: N } — normalise to { data: [], total: N }\n    const normalized: ArtifactList = {\n      data:   Array.isArray(raw) ? raw : (raw.artifacts ?? raw.data ?? []),\n      total:  raw.total ?? (Array.isArray(raw) ? raw.length : 0),\n      limit:  params.limit ?? 20,\n      offset: params.offset ?? 0,\n    };\n\n    return { ...normalized, lastResponse };\n  }\n\n  /**\n   * Auto-paginating iterator — yields every artifact across all pages.\n   * Stops automatically when the last page is reached.\n   *\n   * @example\n   * for await (const artifact of nomos.artifacts.listAutoPaging({ band: 'autonomous' })) {\n   *   console.log(artifact.title, artifact.ari_score);\n   * }\n   */\n  async *listAutoPaging(\n    params: ListArtifactsParams = {},\n    opts?: RequestOptions,\n  ): AsyncGenerator<Artifact> {\n    let offset = params.offset ?? 0;\n    const limit = params.limit ?? 20;\n\n    while (true) {\n      const page = await this.list({ ...params, offset, limit }, opts);\n      for (const item of page.data) yield item;\n      if (page.data.length < limit || offset + page.data.length >= page.total) break;\n      offset += page.data.length;\n    }\n  }\n\n  /**\n   * Retrieve the declared input schema for a sealed artifact.\n   *\n   * Returns every field the artifact's rules reference — name, type, whether it's\n   * required, and a ready-to-use example_inputs object. Use this to build forms,\n   * validate payloads, or generate API docs without reading the rules manually.\n   *\n   * Requires an API key (artifact schemas are not public).\n   *\n   * @example\n   * const schema = await nomos.artifacts.schema('art_abc123');\n   * console.log(schema.required_fields);   // ['credit_score', 'loan_amount']\n   * console.log(schema.example_inputs);    // { credit_score: 0, loan_amount: 0 }\n   */\n  async schema(\n    artifactId: string,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<ArtifactSchema>> {\n    const { data, lastResponse } = await this.http.get<ArtifactSchema>(\n      `/api/v1/artifacts/${encodeURIComponent(artifactId)}/schema`,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import type { HttpClient } from '../http-client.js';\nimport type {\n  GenerateGovernanceParams,\n  GenerateGovernanceResult,\n  DetectContradictionsParams,\n  DetectContradictionsResult,\n  RequestOptions,\n  WithLastResponse,\n} from '../types.js';\n\nexport class Governance {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Generate a sealed .nomos governance artifact from policy documents\n   * and optional historical decision logs.\n   *\n   * @example\n   * const artifact = await nomos.governance.generate({\n   *   policies: [policyText],\n   *   decision_logs: historicalRows,\n   *   domain: 'loan_approval',\n   * });\n   * console.log(artifact.ari_score, artifact.seal_hash);\n   */\n  async generate(\n    params: GenerateGovernanceParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<GenerateGovernanceResult>> {\n    const { data, lastResponse } = await this.http.post<GenerateGovernanceResult>(\n      '/api/v1/generate-governance',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n\n  /**\n   * Detect contradictions and conflicts in a rule set before sealing.\n   *\n   * @example\n   * const report = await nomos.governance.detectContradictions({ rules });\n   * if (!report.clean) {\n   *   console.log(report.contradictions);\n   * }\n   */\n  async detectContradictions(\n    params: DetectContradictionsParams,\n    opts?: RequestOptions,\n  ): Promise<WithLastResponse<DetectContradictionsResult>> {\n    const { data, lastResponse } = await this.http.post<DetectContradictionsResult>(\n      '/api/v1/detect-contradictions',\n      params,\n      opts,\n    );\n    return { ...data, lastResponse };\n  }\n}\n","import { NomosWebhookSignatureError } from '../errors.js';\nimport type { NomosWebhookEvent } from '../types.js';\n\n// Hex string → Uint8Array (no Buffer dependency — works in Node and browsers)\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    const byte = parseInt(hex.slice(i, i + 2), 16);\n    if (isNaN(byte)) throw new NomosWebhookSignatureError('Invalid hex encoding in signature');\n    bytes[i / 2] = byte;\n  }\n  return bytes;\n}\n\n// Constant-time comparison (prevents timing attacks)\nfunction safeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n  return diff === 0;\n}\n\nexport class Webhooks {\n  /**\n   * Verify a NOMOS webhook signature and return the parsed event.\n   *\n   * Signature header format: `t=<unix_ts>,v1=<hmac_sha256_hex>`\n   * Signed payload: `<timestamp>.<raw_body>`\n   *\n   * @example\n   * // Express\n   * app.post('/webhooks/nomos', express.raw({ type: 'application/json' }), async (req, res) => {\n   *   const event = await nomos.webhooks.constructEvent(\n   *     req.body,\n   *     req.headers['nomos-signature'] as string,\n   *     process.env.NOMOS_WEBHOOK_SECRET!,\n   *   );\n   *   console.log(event.type, event.data);\n   *   res.sendStatus(200);\n   * });\n   *\n   * @throws {NomosWebhookSignatureError} if signature is invalid, expired, or malformed\n   */\n  async constructEvent(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<NomosWebhookEvent> {\n    const body = typeof payload === 'string'\n      ? payload\n      : new TextDecoder().decode(payload);\n\n    // Parse \"t=<ts>,v1=<hex>\" header\n    const parts: Record<string, string> = {};\n    for (const part of signature.split(',')) {\n      const eq = part.indexOf('=');\n      if (eq > -1) parts[part.slice(0, eq).trim()] = part.slice(eq + 1).trim();\n    }\n\n    if (!parts['t'] || !parts['v1']) {\n      throw new NomosWebhookSignatureError(\n        'Invalid signature format — expected \"t=<timestamp>,v1=<hmac>\"',\n      );\n    }\n\n    const timestamp = parseInt(parts['t'], 10);\n    if (isNaN(timestamp)) {\n      throw new NomosWebhookSignatureError('Invalid timestamp in webhook signature');\n    }\n\n    const ageSecs = Math.abs(Date.now() / 1000 - timestamp);\n    if (toleranceSeconds > 0 && ageSecs > toleranceSeconds) {\n      throw new NomosWebhookSignatureError(\n        `Webhook timestamp too old (${Math.round(ageSecs)}s > ${toleranceSeconds}s tolerance). ` +\n        'Ensure your server clock is synced and the event is not being replayed.',\n      );\n    }\n\n    // HMAC-SHA256 via Web Crypto API (Node 18+ / modern browsers — no dependencies)\n    const enc = new TextEncoder();\n    const keyMaterial = await globalThis.crypto.subtle.importKey(\n      'raw',\n      enc.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign'],\n    );\n    const signedPayload = `${parts['t']}.${body}`;\n    const expectedBuf = await globalThis.crypto.subtle.sign(\n      'HMAC',\n      keyMaterial,\n      enc.encode(signedPayload),\n    );\n    const expected = new Uint8Array(expectedBuf);\n    const received = hexToBytes(parts['v1']);\n\n    if (!safeEqual(expected, received)) {\n      throw new NomosWebhookSignatureError(\n        'Webhook signature mismatch — verify your NOMOS_WEBHOOK_SECRET matches the one in Studio.',\n      );\n    }\n\n    try {\n      return JSON.parse(body) as NomosWebhookEvent;\n    } catch {\n      throw new NomosWebhookSignatureError('Webhook payload is not valid JSON');\n    }\n  }\n\n  /**\n   * Verify a webhook signature without parsing the event.\n   * Returns `true` if valid, `false` if not (never throws).\n   *\n   * @example\n   * const valid = await nomos.webhooks.verifySignature(rawBody, sig, secret);\n   * if (!valid) return res.sendStatus(400);\n   */\n  async verifySignature(\n    payload: string | Uint8Array,\n    signature: string,\n    secret: string,\n    toleranceSeconds = 300,\n  ): Promise<boolean> {\n    try {\n      await this.constructEvent(payload, signature, secret, toleranceSeconds);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n}\n","import { HttpClient } from './http-client.js';\nimport { Decisions } from './resources/decisions.js';\nimport { Artifacts } from './resources/artifacts.js';\nimport { Governance } from './resources/governance.js';\nimport { Webhooks } from './resources/webhooks.js';\nimport * as errors from './errors.js';\nimport type { NomosConfig } from './types.js';\n\nconst DEFAULT_BASE_URL  = 'https://nomos.ai';\nconst DEFAULT_MAX_RETRIES = 3;\nconst DEFAULT_TIMEOUT   = 30_000;\n\nexport class Nomos {\n  readonly decisions:  Decisions;\n  readonly artifacts:  Artifacts;\n  readonly governance: Governance;\n  readonly webhooks:   Webhooks;\n\n  /** Whether this instance is using a live or test API key. */\n  readonly mode: 'live' | 'test';\n\n  static readonly errors = errors;\n\n  constructor(apiKey: string, config: NomosConfig = {}) {\n    if (!apiKey || typeof apiKey !== 'string') {\n      throw new errors.NomosAuthenticationError(\n        'A valid API key is required. Pass it as the first argument: new Nomos(\"nms_live_...\")',\n      );\n    }\n\n    this.mode = apiKey.startsWith('nms_test_') ? 'test' : 'live';\n\n    const http = new HttpClient({\n      apiKey,\n      baseUrl:    (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, ''),\n      maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,\n      timeout:    config.timeout    ?? DEFAULT_TIMEOUT,\n    });\n\n    this.decisions  = new Decisions(http);\n    this.artifacts  = new Artifacts(http);\n    this.governance = new Governance(http);\n    this.webhooks   = new Webhooks();\n  }\n}\n","import type { CanParams, CanResult, CanOptions } from './types.js';\nimport {\n  NomosAuthenticationError,\n  NomosAuthorizationError,\n  NomosRateLimitError,\n  NomosValidationError,\n  NomosNotFoundError,\n  NomosAPIError,\n  NomosNetworkError,\n} from './errors.js';\n\n/**\n * The whole product in one verb: \"Can I do this?\"\n *\n * Ask a public Exchange authority a question and get back a deterministic, verifiable\n * verdict — no API key, no SDK setup, no reading a policy PDF. This is a thin, faithful\n * wrapper over the public Exchange query endpoint (the same call the exchange.nomosprotocol.com\n * \"Ask Authority\" box makes), so every answer is a real, addressable transcript you can open\n * at its `url` / `query_id`.\n *\n * Verdicts are exactly what the authority returns — AUTHORIZED / DENIED / ESCALATED — never\n * an invented shape. `allowed` is simply `verdict === 'AUTHORIZED'`; an ESCALATED result means\n * the authority needs more facts to decide (see `missing_inputs`), not a flat \"no\".\n *\n * @example\n * import { nomos } from '@nomosprotocol/sdk';\n *\n * const verdict = await nomos.can({\n *   authority: 'eu-ai-act.nomos',\n *   ai_system_circumvents_refugee_convention: true,\n * });\n * // → { allowed: false, verdict: 'DENIED', reason: 'Rule \"Prohibition…\" triggered…',\n * //     query_id: 'qry_…', url: '/queries/qry_…', … }\n */\nconst DEFAULT_EXCHANGE_BASE = 'https://www.nomosprotocol.com';\n\nexport async function can(params: CanParams, opts?: CanOptions): Promise<CanResult> {\n  const { authority, action, inputs, ...flat } = params;\n  if (!authority || typeof authority !== 'string') {\n    throw new Error('can(): `authority` (an Exchange artifact id or slug) is required.');\n  }\n  // Two equally valid shapes: an explicit `inputs` object, or the facts spread flat\n  // alongside `authority`/`action`. Explicit `inputs` wins when both are present.\n  const facts: Record<string, unknown> =\n    inputs && typeof inputs === 'object' ? inputs : (flat as Record<string, unknown>);\n\n  const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\\/$/, '');\n  const url = `${base}/api/exchange/artifacts/${encodeURIComponent(authority)}/query`;\n\n  let res: Response;\n  try {\n    res = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ inputs: facts, action }),\n      signal: opts?.signal,\n    });\n  } catch (err: any) {\n    if (err?.name === 'AbortError') throw new NomosNetworkError('Request aborted');\n    throw new NomosNetworkError(err?.message ?? 'Network error');\n  }\n\n  const requestId = res.headers.get('x-request-id') ?? '';\n  const data: any = await res.json().catch(() => null);\n  if (!res.ok) {\n    // Same status-code -> error-class mapping HttpClient uses for every other SDK call,\n    // so `instanceof NomosNotFoundError` etc. works consistently everywhere — can() used to\n    // throw a plain Error here, bypassing the SDK's own error hierarchy entirely.\n    const message: string = data?.error ?? data?.message ?? `NOMOS query failed (HTTP ${res.status})`;\n    switch (res.status) {\n      case 401: throw new NomosAuthenticationError(message, requestId);\n      case 403: throw new NomosAuthorizationError(message, requestId);\n      case 404: throw new NomosNotFoundError(message, requestId);\n      case 422:\n      case 400: throw new NomosValidationError(message, data?.details, requestId);\n      case 429: throw new NomosRateLimitError(\n        message,\n        res.headers.get('retry-after') ? parseInt(res.headers.get('retry-after')!, 10) : undefined,\n        requestId,\n      );\n      default: throw new NomosAPIError(message, res.status, requestId);\n    }\n  }\n\n  return {\n    allowed: data.verdict === 'AUTHORIZED',\n    verdict: data.verdict,\n    reason: data.verdict_description,\n    rule: data.matched_rule_id ?? null,\n    query_id: data.query_id,\n    url: data.url,\n    authority: {\n      id: data.artifact?.id ?? authority,\n      title: data.artifact?.title ?? '',\n      standing: data.artifact?.standing ?? '',\n    },\n    missing_inputs: data.missing_inputs ?? [],\n  };\n}\n\n/**\n * Ready-to-use, keyless entry point matching the canonical `nomos.can(...)` form.\n * For authenticated, key-scoped operations use the `Nomos` class instead.\n */\nexport const nomos = { can };\n"],"mappings":";;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUO,IAAM,aAAN,cAAyB,MAAM;AAAA,EAKpC,YAAY,SAAiB,MAAsB,QAAiB,WAAoB;AACtF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AAAA,EACnB;AACF;AAEO,IAAM,2BAAN,cAAuC,WAAW;AAAA,EACvD,YAAY,UAAU,mBAAmB,WAAoB;AAC3D,UAAM,SAAS,wBAAwB,KAAK,SAAS;AACrD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,WAAW;AAAA,EACtD,YAAY,UAAU,iBAAiB,WAAoB;AACzD,UAAM,SAAS,uBAAuB,KAAK,SAAS;AACpD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,WAAW;AAAA,EAGlD,YAAY,UAAU,uBAAuB,YAAqB,WAAoB;AACpF,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,IAAM,uBAAN,cAAmC,WAAW;AAAA,EAGnD,YAAY,SAAiB,SAAmB,WAAoB;AAClE,UAAM,SAAS,oBAAoB,KAAK,SAAS;AACjD,SAAK,OAAO;AACZ,SAAK,UAAU;AAAA,EACjB;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB,WAAoB;AAC/C,UAAM,SAAS,aAAa,KAAK,SAAS;AAC1C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,WAAW;AAAA,EAC5C,YAAY,SAAiB,QAAgB,WAAoB;AAC/D,UAAM,SAAS,aAAa,QAAQ,SAAS;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,WAAW;AAAA,EAChD,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe;AAC9B,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,6BAAN,cAAyC,WAAW;AAAA,EACzD,YAAY,SAAiB;AAC3B,UAAM,SAAS,2BAA2B,GAAG;AAC7C,SAAK,OAAO;AAAA,EACd;AACF;;;ACpFA,eAAsB,MAAM,IAA2B;AACrD,SAAO,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AACvD;AAEO,SAAS,gBAAgB,SAAiB,SAAS,KAAa;AACrE,QAAM,MAAM,KAAK,IAAI,SAAS,KAAK,SAAS,IAAK;AACjD,SAAO,OAAO,OAAO,KAAK,OAAO,IAAI;AACvC;AAEO,SAAS,YAAY,QAAyB;AACnD,SAAO,WAAW,OAAO,UAAU;AACrC;;;ACCA,IAAM,cAAc;AAcb,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,IAAO,MAAc,SAAoD;AAC7E,WAAO,KAAK,QAAW,OAAO,MAAM,QAAW,OAAO;AAAA,EACxD;AAAA,EAEA,MAAM,KAAQ,MAAc,MAAe,SAAoD;AAC7F,WAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,OAAO;AAAA,EACpD;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACA,SACA,UAAU,GACgB;AAC1B,UAAM,SAAa,SAAS,UAAc,KAAK,KAAK;AACpD,UAAM,UAAa,SAAS,WAAc,KAAK,KAAK;AACpD,UAAM,aAAa,SAAS,cAAc,KAAK,KAAK;AAEpD,UAAM,MAAM,GAAG,KAAK,KAAK,OAAO,GAAG,IAAI;AACvC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,OAAO;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAqB;AAAA,MACrB,mBAAqB;AAAA,MACrB,cAAqB,cAAc,WAAW;AAAA,MAC9C,qBAAqB;AAAA,IACvB;AACA,QAAI,SAAS,gBAAgB;AAC3B,cAAQ,iBAAiB,IAAI,QAAQ;AAAA,IACvC;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,WAAW;AAAA,QACnB;AAAA,QACA,MAAM,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,KAAU;AACjB,mBAAa,KAAK;AAClB,UAAI,IAAI,SAAS,cAAc;AAC7B,cAAM,IAAI,kBAAkB,2BAA2B,OAAO,IAAI;AAAA,MACpE;AACA,YAAM,IAAI,kBAAkB,IAAI,WAAW,eAAe;AAAA,IAC5D,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAM,aAAqC,CAAC;AAC5C,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAAE,iBAAW,GAAG,IAAI;AAAA,IAAO,CAAC;AAChE,UAAM,eAAiC;AAAA,MACrC;AAAA,MACA,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AAEA,QAAI,IAAI,IAAI;AACV,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B;AAGA,QAAI,YAAY,IAAI,MAAM,KAAK,UAAU,YAAY;AACnD,YAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;AAChD,YAAM,QAAQ,aAAa,SAAS,YAAY,EAAE,IAAI,MAAO,gBAAgB,OAAO;AACpF,YAAM,MAAM,KAAK;AACjB,aAAO,KAAK,QAAW,QAAQ,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,IACjE;AAEA,QAAI,UAAe,CAAC;AACpB,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAG,QAAQ;AAAA,IAAC;AAC3C,UAAM,UAAkB,SAAS,SAAS,SAAS,WAAW,IAAI;AAElE,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,SAAS,SAAS,SAAS;AAAA,MAC7E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AACF;;;AChHO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BhD,MAAM,OACJ,QACA,MACiD;AACjD,UAAM,EAAE,aAAa,kBAAkB,mBAAmB,eAAe,IAAI;AAG7E,UAAM,WAAW,YAAY,WAAW,MAAM;AAC9C,QAAI;AAEJ,QAAI,UAAU;AACZ,iBAAW,MAAM,KAAK,KAAK,KAAU,kBAAkB;AAAA,QACrD;AAAA,QACA,UAAW,qBAAqB;AAAA,QAChC,QAAW;AAAA,MACb,GAAG,IAAI;AAAA,IACT,OAAO;AAGL,iBAAW,MAAM,KAAK,KAAK,KAAU,2BAA2B;AAAA,QAC9D;AAAA,QACA,UAAU,qBAAqB;AAAA,QAC/B,QAAU;AAAA,QACV,QAAU,EAAE,gBAAgB,kBAAkB,WAAW,OAAO,WAAW,EAAE;AAAA,MAC/E,GAAG,IAAI;AAAA,IACT;AAEA,UAAM,MAAW,SAAS;AAE1B,WAAO;AAAA,MACL,IAAqB,IAAI,MAAM,OAAO,IAAI,gBAAgB,WAAW,OAAO,WAAW,CAAC;AAAA,MACxF,QAAqB,IAAI,UAAU;AAAA,MACnC,aAAqB,IAAI,eAAe;AAAA,MACxC,eAAqB,IAAI,iBAAiB;AAAA,MAC1C,SAAqB,IAAI,WAAW;AAAA,MACpC,SAAqB,IAAI,YAAY,IAAI,YAAY,kBAAkB,aAAa,IAAI,YAAY,kBAAkB,aAAa;AAAA,MACnI,MAAqB,IAAI;AAAA,MACzB,YAAqB,IAAI,cAAc,EAAE,iBAAiB,IAAI,mBAAmB,GAAG,eAAe,GAAG,eAAe,GAAG,oBAAoB,EAAE;AAAA,MAC9I,YAAqB,IAAI,cAAc,EAAE,MAAM,IAAI,uBAAuB,YAAY,OAAO,GAAG,aAAa,GAAG;AAAA,MAChH,OAAqB,IAAI,SAAS,EAAE,MAAM,IAAI,cAAc,IAAI,gBAAgB,IAAI,WAAW,IAAI,OAAM,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,MAClI,aAAqB,IAAI,eAAe,EAAE,YAAY,IAAI,cAAc,EAAE;AAAA,MAC1E,gBAAqB,IAAI,kBAAkB;AAAA,MAC3C,qBAAqB,IAAI,uBAAuB;AAAA,MAChD,mBAAqB,IAAI;AAAA,MACzB,mBAAqB,IAAI;AAAA,MACzB,cAAqB,SAAS;AAAA,IAChC;AAAA,EACF;AACF;;;AC3EO,IAAM,YAAN,MAAgB;AAAA,EACrB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,SACJ,YACA,MACqC;AACrC,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,2BAA2B,mBAAmB,UAAU,CAAC;AAAA,MACzD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,KACJ,SAA8B,CAAC,GAC/B,MACyC;AACzC,UAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,OAAgB,IAAG,IAAI,UAAU,OAAO,MAAM;AACzD,QAAI,OAAO,aAAgB,IAAG,IAAI,gBAAgB,OAAO,YAAY;AACrE,QAAI,OAAO,KAAgB,IAAG,IAAI,QAAQ,OAAO,IAAI;AACrD,QAAI,OAAO,SAAS,KAAO,IAAG,IAAI,SAAS,OAAO,OAAO,KAAK,CAAC;AAC/D,QAAI,OAAO,UAAU,KAAM,IAAG,IAAI,UAAU,OAAO,OAAO,MAAM,CAAC;AACjE,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,EAAE,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAClD,0BAA0B,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AAGA,UAAM,aAA2B;AAAA,MAC/B,MAAQ,MAAM,QAAQ,GAAG,IAAI,MAAO,IAAI,aAAa,IAAI,QAAQ,CAAC;AAAA,MAClE,OAAQ,IAAI,UAAU,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS;AAAA,MACxD,OAAQ,OAAO,SAAS;AAAA,MACxB,QAAQ,OAAO,UAAU;AAAA,IAC3B;AAEA,WAAO,EAAE,GAAG,YAAY,aAAa;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,eACL,SAA8B,CAAC,GAC/B,MAC0B;AAC1B,QAAI,SAAS,OAAO,UAAU;AAC9B,UAAM,QAAQ,OAAO,SAAS;AAE9B,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,GAAG,QAAQ,QAAQ,MAAM,GAAG,IAAI;AAC/D,iBAAW,QAAQ,KAAK,KAAM,OAAM;AACpC,UAAI,KAAK,KAAK,SAAS,SAAS,SAAS,KAAK,KAAK,UAAU,KAAK,MAAO;AACzE,gBAAU,KAAK,KAAK;AAAA,IACtB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OACJ,YACA,MAC2C;AAC3C,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,MACnD;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;AC7GO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAchD,MAAM,SACJ,QACA,MACqD;AACrD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,qBACJ,QACA,MACuD;AACvD,UAAM,EAAE,MAAM,aAAa,IAAI,MAAM,KAAK,KAAK;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,GAAG,MAAM,aAAa;AAAA,EACjC;AACF;;;ACrDA,SAAS,WAAW,KAAyB;AAC3C,MAAI,IAAI,SAAS,MAAM,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AAClG,QAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;AAC3C,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GAAG;AACtC,UAAM,OAAO,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AAC7C,QAAI,MAAM,IAAI,EAAG,OAAM,IAAI,2BAA2B,mCAAmC;AACzF,UAAM,IAAI,CAAC,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAAe,GAAwB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;AACrD,SAAO,SAAS;AAClB;AAEO,IAAM,WAAN,MAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBpB,MAAM,eACJ,SACA,WACA,QACA,mBAAmB,KACS;AAC5B,UAAM,OAAO,OAAO,YAAY,WAC5B,UACA,IAAI,YAAY,EAAE,OAAO,OAAO;AAGpC,UAAM,QAAgC,CAAC;AACvC,eAAW,QAAQ,UAAU,MAAM,GAAG,GAAG;AACvC,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAI,KAAK,GAAI,OAAM,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,IACzE;AAEA,QAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,SAAS,MAAM,GAAG,GAAG,EAAE;AACzC,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI,2BAA2B,wCAAwC;AAAA,IAC/E;AAEA,UAAM,UAAU,KAAK,IAAI,KAAK,IAAI,IAAI,MAAO,SAAS;AACtD,QAAI,mBAAmB,KAAK,UAAU,kBAAkB;AACtD,YAAM,IAAI;AAAA,QACR,8BAA8B,KAAK,MAAM,OAAO,CAAC,OAAO,gBAAgB;AAAA,MAE1E;AAAA,IACF;AAGA,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA,IAAI,OAAO,MAAM;AAAA,MACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AACA,UAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,IAAI,IAAI;AAC3C,UAAM,cAAc,MAAM,WAAW,OAAO,OAAO;AAAA,MACjD;AAAA,MACA;AAAA,MACA,IAAI,OAAO,aAAa;AAAA,IAC1B;AACA,UAAM,WAAW,IAAI,WAAW,WAAW;AAC3C,UAAM,WAAW,WAAW,MAAM,IAAI,CAAC;AAEvC,QAAI,CAAC,UAAU,UAAU,QAAQ,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,YAAM,IAAI,2BAA2B,mCAAmC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,gBACJ,SACA,WACA,QACA,mBAAmB,KACD;AAClB,QAAI;AACF,YAAM,KAAK,eAAe,SAAS,WAAW,QAAQ,gBAAgB;AACtE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AC5HA,IAAM,mBAAoB;AAC1B,IAAM,sBAAsB;AAC5B,IAAM,kBAAoB;AAEnB,IAAM,QAAN,MAAY;AAAA,EASjB;AAAA,SAAgB,SAAS;AAAA;AAAA,EAEzB,YAAY,QAAgB,SAAsB,CAAC,GAAG;AACpD,QAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,YAAM,IAAW;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAEA,SAAK,OAAO,OAAO,WAAW,WAAW,IAAI,SAAS;AAEtD,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B;AAAA,MACA,UAAa,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AAAA,MAClE,YAAY,OAAO,cAAc;AAAA,MACjC,SAAY,OAAO,WAAc;AAAA,IACnC,CAAC;AAED,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,YAAa,IAAI,UAAU,IAAI;AACpC,SAAK,aAAa,IAAI,WAAW,IAAI;AACrC,SAAK,WAAa,IAAI,SAAS;AAAA,EACjC;AACF;;;ACVA,IAAM,wBAAwB;AAE9B,eAAsB,IAAI,QAAmB,MAAuC;AAClF,QAAM,EAAE,WAAW,QAAQ,QAAQ,GAAG,KAAK,IAAI;AAC/C,MAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAGA,QAAM,QACJ,UAAU,OAAO,WAAW,WAAW,SAAU;AAEnD,QAAM,QAAQ,MAAM,WAAW,uBAAuB,QAAQ,OAAO,EAAE;AACvE,QAAM,MAAM,GAAG,IAAI,2BAA2B,mBAAmB,SAAS,CAAC;AAE3E,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,KAAK;AAAA,MACrB,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,MAC9C,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,KAAU;AACjB,QAAI,KAAK,SAAS,aAAc,OAAM,IAAI,kBAAkB,iBAAiB;AAC7E,UAAM,IAAI,kBAAkB,KAAK,WAAW,eAAe;AAAA,EAC7D;AAEA,QAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,QAAM,OAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,MAAI,CAAC,IAAI,IAAI;AAIX,UAAM,UAAkB,MAAM,SAAS,MAAM,WAAW,4BAA4B,IAAI,MAAM;AAC9F,YAAQ,IAAI,QAAQ;AAAA,MAClB,KAAK;AAAK,cAAM,IAAI,yBAAyB,SAAS,SAAS;AAAA,MAC/D,KAAK;AAAK,cAAM,IAAI,wBAAwB,SAAS,SAAS;AAAA,MAC9D,KAAK;AAAK,cAAM,IAAI,mBAAmB,SAAS,SAAS;AAAA,MACzD,KAAK;AAAA,MACL,KAAK;AAAK,cAAM,IAAI,qBAAqB,SAAS,MAAM,SAAS,SAAS;AAAA,MAC1E,KAAK;AAAK,cAAM,IAAI;AAAA,UAClB;AAAA,UACA,IAAI,QAAQ,IAAI,aAAa,IAAI,SAAS,IAAI,QAAQ,IAAI,aAAa,GAAI,EAAE,IAAI;AAAA,UACjF;AAAA,QACF;AAAA,MACA;AAAS,cAAM,IAAI,cAAc,SAAS,IAAI,QAAQ,SAAS;AAAA,IACjE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,KAAK,YAAY;AAAA,IAC1B,SAAS,KAAK;AAAA,IACd,QAAQ,KAAK;AAAA,IACb,MAAM,KAAK,mBAAmB;AAAA,IAC9B,UAAU,KAAK;AAAA,IACf,KAAK,KAAK;AAAA,IACV,WAAW;AAAA,MACT,IAAI,KAAK,UAAU,MAAM;AAAA,MACzB,OAAO,KAAK,UAAU,SAAS;AAAA,MAC/B,UAAU,KAAK,UAAU,YAAY;AAAA,IACvC;AAAA,IACA,gBAAgB,KAAK,kBAAkB,CAAC;AAAA,EAC1C;AACF;AAMO,IAAM,QAAQ,EAAE,IAAI;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomosprotocol/sdk",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Official TypeScript SDK for the NOMOS governance runtime",
   "publishConfig": {
     "access": "public"