@nomosprotocol/sdk 2.0.0 → 2.3.1

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: tr
 var index_exports = {};
 __export(index_exports, {
   ACT_MEDIA_TYPE: () => ACT_MEDIA_TYPE,
+  MAX_PRESENTED: () => MAX_PRESENTED,
   Nomos: () => Nomos,
   NomosAPIError: () => NomosAPIError,
   NomosActError: () => NomosActError,
@@ -35,31 +36,53 @@ __export(index_exports, {
   NomosRateLimitError: () => NomosRateLimitError,
   NomosValidationError: () => NomosValidationError,
   NomosWebhookSignatureError: () => NomosWebhookSignatureError,
+  RegistryError: () => RegistryError,
+  RevocationUnavailable: () => RevocationUnavailable,
   WELL_KNOWN: () => WELL_KNOWN,
   accept: () => accept,
   act: () => act,
+  applyToolBindings: () => applyToolBindings,
   approver: () => approver,
   bindingDigest: () => bindingDigest,
   buildAct: () => buildAct,
   can: () => can,
+  certificateRegistry: () => certificateRegistry,
   certify: () => certify,
+  describeSuggestion: () => describeSuggestion,
   fetchDocument: () => fetchDocument,
   generateSigner: () => generateSigner,
   issuer: () => issuer,
   kidOf: () => kidOf2,
   localSigner: () => localSigner,
+  memoryPasskeyStore: () => memoryPasskeyStore,
+  memoryRegistryStore: () => memoryRegistryStore,
   memoryStore: () => memoryStore,
   nomos: () => nomos,
   originOf: () => originOf,
+  parseToolBindings: () => parseToolBindings,
+  passkeyApprover: () => passkeyApprover,
+  postgresPasskeyStore: () => postgresPasskeyStore,
+  postgresRegistryStore: () => postgresRegistryStore,
+  postgresStore: () => postgresStore,
+  presentedCertificates: () => presentedCertificates,
+  readAttestation: () => readAttestation,
+  reliedKids: () => reliedKids,
+  revocationListCertificates: () => revocationListCertificates,
+  revocationSource: () => revocationSource,
   seal: () => seal,
   seededSigner: () => seededSigner,
   signConsent: () => signConsent,
+  signEnrolmentToken: () => signEnrolmentToken,
   signInForce: () => signInForce,
+  signRevocation: () => signRevocation,
+  signRevocationList: () => signRevocationList,
   signTestimony: () => signTestimony,
   statusFor: () => statusFor,
+  suggestToolBindings: () => suggestToolBindings,
   verifyAct: () => verifyAct,
   verifyArtifact: () => verifyArtifact,
   verifyChain: () => verifyChain,
+  verifyEnrolmentToken: () => verifyEnrolmentToken,
   verifySeal: () => verifySeal,
   witness: () => witness
 });
@@ -168,7 +191,7 @@ function isRetryable(status) {
 }
 
 // src/http-client.ts
-var SDK_VERSION = "1.1.0";
+var SDK_VERSION = "2.3.1";
 var HttpClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -833,7 +856,7 @@ async function canAuthenticated(http, params, opts) {
 var nomos = { can };
 
 // src/nomos.ts
-var DEFAULT_BASE_URL = "https://nomos.ai";
+var DEFAULT_BASE_URL = "https://www.nomosprotocol.com";
 var DEFAULT_MAX_RETRIES = 3;
 var DEFAULT_TIMEOUT = 3e4;
 var Nomos = class {
@@ -843,7 +866,7 @@ var Nomos = class {
   constructor(apiKey, config = {}) {
     if (!apiKey || typeof apiKey !== "string") {
       throw new NomosAuthenticationError(
-        'A valid API key is required. Pass it as the first argument: new Nomos("nms_live_...")'
+        'A valid API key is required. Pass it as the first argument: new Nomos("nmk_...")'
       );
     }
     this.mode = apiKey.startsWith("nms_test_") ? "test" : "live";
@@ -865,7 +888,7 @@ var Nomos = class {
    * return shape either way, so calling code never needs to know which rail answered.
    *
    * @example
-   * const client = new Nomos('nms_live_...');
+   * const client = new Nomos('nmk_...');
    * const verdict = await client.can({ artifact_id: 'loan_approval_v1', credit_score: 720 });
    */
   async can(params, opts) {
@@ -873,7 +896,7 @@ var Nomos = class {
   }
 };
 
-// ../../AI_Navigator-repro/node_modules/@noble/hashes/_u64.js
+// node_modules/@noble/hashes/_u64.js
 var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
@@ -916,7 +939,7 @@ var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0
 var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../../AI_Navigator-repro/node_modules/@noble/hashes/utils.js
+// node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -1081,7 +1104,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../../AI_Navigator-repro/node_modules/@noble/hashes/_md.js
+// node_modules/@noble/hashes/_md.js
 function Chi(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -1212,7 +1235,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../../AI_Navigator-repro/node_modules/@noble/hashes/sha2.js
+// node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
@@ -1609,7 +1632,7 @@ var sha512 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(3)
 );
 
-// ../packages/verify/dist/bytes.js
+// node_modules/@nomosprotocol/verify/dist/bytes.js
 var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 var REV = new Map([...B64].map((c, i) => [c, i]));
 var utf8 = (s) => new TextEncoder().encode(s);
@@ -1671,7 +1694,7 @@ function fromBase64url(s) {
   return raw && toBase64url(raw) === s ? raw : null;
 }
 
-// ../packages/verify/dist/jcs.js
+// node_modules/@nomosprotocol/verify/dist/jcs.js
 function value(v) {
   if (v === null)
     return "null";
@@ -1705,7 +1728,7 @@ function codePointCompare(a, b) {
   return A.length - B.length;
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/utils.js
+// node_modules/@noble/curves/utils.js
 function aarray(item, title, inner = () => {
 }) {
   if (!Array.isArray(item))
@@ -1887,7 +1910,7 @@ function validateObject(object, fields = {}, optFields = {}, title = "object") {
   iter(optFields, true);
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/abstract/modular.js
+// node_modules/@noble/curves/abstract/modular.js
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -2350,7 +2373,7 @@ function mapHashToField(key, fieldOrder, isLE = false) {
   return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/abstract/curve.js
+// node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
 var _4n2 = /* @__PURE__ */ BigInt(4);
@@ -2737,7 +2760,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/abstract/edwards.js
+// node_modules/@noble/curves/abstract/edwards.js
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var _1n4 = /* @__PURE__ */ BigInt(1);
 var _2n2 = /* @__PURE__ */ BigInt(2);
@@ -3188,7 +3211,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/ed25519.js
+// node_modules/@noble/curves/ed25519.js
 var _1n5 = /* @__PURE__ */ BigInt(1);
 var _2n3 = /* @__PURE__ */ BigInt(2);
 var _5n2 = /* @__PURE__ */ BigInt(5);
@@ -3263,7 +3286,7 @@ function ed(opts) {
 }
 var ed25519 = /* @__PURE__ */ ed({});
 
-// ../../AI_Navigator-repro/node_modules/@noble/hashes/hmac.js
+// node_modules/@noble/hashes/hmac.js
 var _HMAC = class {
   oHash;
   iHash;
@@ -3340,7 +3363,7 @@ var hmac = /* @__PURE__ */ (() => {
   return hmac_;
 })();
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/abstract/der.js
+// node_modules/@noble/curves/abstract/der.js
 var _0n5 = /* @__PURE__ */ BigInt(0);
 var DERErr = class extends Error {
   constructor(m = "") {
@@ -3434,18 +3457,18 @@ var _DER = {
     }
   },
   toSig(bytes, maxScalarBytes) {
-    const { Err: E, _int: int, _tlv: tlv } = _DER;
+    const { Err: E, _int: int, _tlv: tlv2 } = _DER;
     if (maxScalarBytes !== void 0) {
       asafenumber(maxScalarBytes, "maxScalarBytes");
       if (maxScalarBytes < 1)
         throw new E("invalid signature: maxScalarBytes must be positive");
     }
     const data = abytes2(bytes, void 0, "signature");
-    const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
+    const { v: seqBytes, l: seqLeftBytes } = tlv2.decode(48, data);
     if (seqLeftBytes.length)
       throw new E("invalid signature: left bytes after parsing");
-    const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
-    const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
+    const { v: rBytes, l: rLeftBytes } = tlv2.decode(2, seqBytes);
+    const { v: sBytes, l: sLeftBytes } = tlv2.decode(2, rLeftBytes);
     if (sLeftBytes.length)
       throw new E("invalid signature: left bytes after parsing");
     if (maxScalarBytes !== void 0 && (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))
@@ -3453,12 +3476,12 @@ var _DER = {
     return { r: int.decode(rBytes), s: int.decode(sBytes) };
   },
   hexFromSig(sig) {
-    const { _tlv: tlv, _int: int } = _DER;
+    const { _tlv: tlv2, _int: int } = _DER;
     validateObject(sig, { r: "bigint", s: "bigint" }, {}, "sig");
-    const rs = tlv.encode(2, int.encode(sig.r));
-    const ss = tlv.encode(2, int.encode(sig.s));
+    const rs = tlv2.encode(2, int.encode(sig.r));
+    const ss = tlv2.encode(2, int.encode(sig.s));
     const seq = rs + ss;
-    return tlv.encode(48, seq);
+    return tlv2.encode(48, seq);
   }
 };
 var DER = /* @__PURE__ */ (() => {
@@ -3467,7 +3490,7 @@ var DER = /* @__PURE__ */ (() => {
   return Object.freeze(_DER);
 })();
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/abstract/weierstrass.js
+// node_modules/@noble/curves/abstract/weierstrass.js
 var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n4) / den;
 function _splitEndoScalar(k, basis, n) {
   aInRange("scalar", k, _0n6, n);
@@ -4299,7 +4322,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
   });
 }
 
-// ../../AI_Navigator-repro/node_modules/@noble/curves/nist.js
+// node_modules/@noble/curves/nist.js
 var p256_CURVE = /* @__PURE__ */ (() => ({
   p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
   n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
@@ -4312,21 +4335,21 @@ var p256_CURVE = /* @__PURE__ */ (() => ({
 var p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
 var p256 = /* @__PURE__ */ ecdsa(p256_Point, sha256);
 
-// ../packages/verify/dist/suites.js
+// node_modules/@nomosprotocol/verify/dist/suites.js
 var SUITES = ["Ed25519", "ES256", "WebAuthn-ES256"];
 var N = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
 var ED25519_PREFIX = Uint8Array.from([48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0]);
 var P256_PREFIX = Uint8Array.from([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4]);
 var SUITES_FOR = { "Ed25519": ["Ed25519"], "P-256": ["ES256", "WebAuthn-ES256"] };
 var isSuite = (s) => typeof s === "string" && SUITES.includes(s);
-function pemDer(pem) {
-  if (typeof pem !== "string")
+function pemDer(pem2) {
+  if (typeof pem2 !== "string")
     return null;
-  const m = pem.match(/^\s*-----BEGIN PUBLIC KEY-----\s*([A-Za-z0-9+/=\s]+?)\s*-----END PUBLIC KEY-----\s*$/);
+  const m = pem2.match(/^\s*-----BEGIN PUBLIC KEY-----\s*([A-Za-z0-9+/=\s]+?)\s*-----END PUBLIC KEY-----\s*$/);
   return m ? fromBase64(m[1].replace(/\s+/g, "")) : null;
 }
-function loadKey(pem) {
-  const der = pemDer(pem);
+function loadKey(pem2) {
+  const der = pemDer(pem2);
   if (!der)
     return { reason: "invalid_key" };
   if (der.length === 44 && equal(der.subarray(0, 12), ED25519_PREFIX)) {
@@ -4350,16 +4373,16 @@ function loadKey(pem) {
   }
   return { reason: "invalid_key" };
 }
-function kidOf(pem) {
-  const k = loadKey(pem);
+function kidOf(pem2) {
+  const k = loadKey(pem2);
   return "reason" in k ? null : toBase64url(sha256(k.der)).slice(0, 16);
 }
 var toBigInt = (b) => b.reduce((n, x) => n << 8n | BigInt(x), 0n);
-function verifySuite(suite, pem, payload, proof) {
+function verifySuite(suite, pem2, payload, proof) {
   const fail2 = (reason) => ({ ok: false, reason });
   if (!isSuite(suite))
     return fail2("unknown_suite");
-  const k = loadKey(pem);
+  const k = loadKey(pem2);
   if ("reason" in k)
     return fail2("invalid_key");
   if (!SUITES_FOR[k.type].includes(suite))
@@ -4421,7 +4444,7 @@ function verifySuite(suite, pem, payload, proof) {
   return ok ? { ok: true } : fail2("bad_signature");
 }
 
-// ../packages/verify/dist/scope.js
+// node_modules/@nomosprotocol/verify/dist/scope.js
 var ARTIFACT_DIMENSIONS = ["artifact", "industry", "jurisdiction"];
 var SET_DIMENSIONS = ["claim", "consent", "suite"];
 var UNRESTRICTED = { terms: {} };
@@ -4540,7 +4563,7 @@ function formatScope(scope) {
   return Object.entries(scope.terms).map(([d, v]) => `${d}:${v}`).join(" ");
 }
 
-// ../packages/verify/dist/chain.js
+// node_modules/@nomosprotocol/verify/dist/chain.js
 var MAX_CHAIN = 20;
 var CERT_SUITES = ["Ed25519", "ES256"];
 var SEAL_SUITES = ["Ed25519", "ES256"];
@@ -4632,7 +4655,7 @@ var Memo = class {
   }
 };
 function validate(path, rootPem, now, purpose, revokedKids, revokedCerts, memo) {
-  let pem = rootPem, scope = UNRESTRICTED;
+  let pem2 = rootPem, scope = UNRESTRICTED;
   const hops = [];
   for (const cert of path) {
     const f = memo.of(cert);
@@ -4642,7 +4665,7 @@ function validate(path, rootPem, now, purpose, revokedKids, revokedCerts, memo)
       return fail("ISSUER_NOT_RECOGNIZED", { reason_code: "kid_mismatch" });
     if (!suitePermitted(scope, cert.algorithm))
       return fail("OUT_OF_SCOPE", { dimension: "suite", reason_code: "suite_not_permitted" });
-    const sig = memo.sig(cert, pem);
+    const sig = memo.sig(cert, pem2);
     if (!sig.ok)
       return fail("ISSUER_NOT_RECOGNIZED", { reason_code: sig.reason });
     const issued = parseTime(cert.issued_at), expires = parseTime(cert.expires_at);
@@ -4662,14 +4685,14 @@ function validate(path, rootPem, now, purpose, revokedKids, revokedCerts, memo)
     const narrowing = isNarrowerOrEqual(f.scope.scope, scope);
     if (!narrowing.ok)
       return fail("OUT_OF_SCOPE", { dimension: narrowing.dimension, reason_code: "widening" });
-    hops.push({ cert, parentPem: pem, parentScope: scope });
-    pem = cert.child_public_key_pem;
+    hops.push({ cert, parentPem: pem2, parentScope: scope });
+    pem2 = cert.child_public_key_pem;
     scope = mergeScopes(scope, f.scope.scope);
   }
   const admitted = purpose(scope);
   if (!admitted.ok)
     return fail("OUT_OF_SCOPE", { dimension: admitted.dimension });
-  return { decision: "RESOLVED", pem, path: [], effective: scope, hops };
+  return { decision: "RESOLVED", pem: pem2, path: [], effective: scope, hops };
 }
 function resolveKey(o) {
   const revokedKids = o.revokedKids ?? /* @__PURE__ */ new Set(), revokedCerts = o.revokedCerts ?? /* @__PURE__ */ new Set();
@@ -4755,7 +4778,7 @@ function verifyArtifact(o) {
   }
 }
 
-// ../packages/verify/dist/evaluate.js
+// node_modules/@nomosprotocol/verify/dist/evaluate.js
 var jcsString = (v) => canonicalize(v);
 var FIELD = /* @__PURE__ */ Symbol("field");
 var ABSENT = /* @__PURE__ */ Symbol("absent");
@@ -5084,7 +5107,7 @@ function evaluate(artifact, facts) {
   return ev;
 }
 
-// ../packages/verify/dist/act.js
+// node_modules/@nomosprotocol/verify/dist/act.js
 var MAX_WINDOW_SECONDS = 300;
 var MAX_IN_FORCE_SECONDS = 86400;
 var TESTIMONY_SUITES = ["Ed25519", "ES256"];
@@ -5122,7 +5145,7 @@ function hasAmbiguousEscalation(artifact) {
   return [...named.values()].some((ids) => ids.size > 1);
 }
 var proofOf = (st) => st.algorithm === "WebAuthn-ES256" ? pick(st, WEBAUTHN_FIELDS) : { signature: st.signature };
-var statementSig = (pem, st, payload) => verifySuite(st.algorithm, pem, jcs(payload), proofOf(st));
+var statementSig = (pem2, st, payload) => verifySuite(st.algorithm, pem2, jcs(payload), proofOf(st));
 var time = (s) => typeof s === "string" ? Date.parse(s) : NaN;
 var isObject = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
 function statementFailure(r, invalid, outOfScope, who) {
@@ -5287,11 +5310,11 @@ function verifyUnsafe(a, o) {
     return { decision: "AUTHORIZED", commit: true, ...base };
   if (ev.outcome === "block")
     return { decision: "DENIED", commit: false, ...base };
-  const esc2 = (art.governance?.escalations ?? []).find((e) => e?.id === ev.escalation_id);
-  if (!esc2)
+  const esc3 = (art.governance?.escalations ?? []).find((e) => e?.id === ev.escalation_id);
+  if (!esc3)
     return { decision: "ESCALATED", commit: false, escalation_id: ev.escalation_id, consents_valid: 0, consents_required: null, ...base };
-  const role = esc2.role_required;
-  const needN = Math.trunc(Number(esc2.required_consents ?? 1));
+  const role = esc3.role_required;
+  const needN = Math.trunc(Number(esc3.required_consents ?? 1));
   const approvers = /* @__PURE__ */ new Set();
   for (const c of Array.isArray(act2.consents) ? act2.consents : []) {
     if (!isObject(c) || !["binding_digest", "role", "decision", "signed_at", "kid", "signature"].every((k2) => typeof c[k2] === "string") || !CONSENT_SUITES.includes(c.algorithm) || c.algorithm === "WebAuthn-ES256" && !WEBAUTHN_FIELDS.every((k2) => typeof c[k2] === "string")) {
@@ -5317,7 +5340,7 @@ function verifyUnsafe(a, o) {
   return { decision: "ESCALATED", commit: false, ...counted };
 }
 
-// ../packages/verify/dist/seal.js
+// node_modules/@nomosprotocol/verify/dist/seal.js
 function verifySeal(artifact, publicKeyPem) {
   const bad = checkSealShape(artifact);
   if (bad)
@@ -5331,6 +5354,83 @@ function verifySeal(artifact, publicKeyPem) {
   return sealFailure(artifact, publicKeyPem) ?? { decision: "VALID", kid };
 }
 
+// node_modules/@nomosprotocol/verify/dist/revocation.js
+var MAX_LIST_CERTS = 1e3;
+var REVOCATION_SUITES = ["Ed25519", "ES256"];
+var CERT_FIELDS2 = ["parent_kid", "child_kid", "child_public_key_pem", "issued_at", "expires_at", "algorithm", "signature"];
+var FP = /^[0-9a-f]{64}$/;
+var revocationPayload = (st) => "revoked_fingerprint" in st ? { revoked_fingerprint: st.revoked_fingerprint, reason: st.reason, issued_at: st.issued_at } : { revoked_kid: st.revoked_kid, reason: st.reason, issued_at: st.issued_at };
+var revocationListPayload = (l) => ({ generated_at: l.generated_at, statements: l.statements });
+var forSigning = (suite) => (scope) => suitePermitted(scope, suite) ? { ok: true } : { ok: false, dimension: "suite" };
+var str = (v) => typeof v === "string" && v !== "";
+var time2 = (s) => typeof s === "string" ? Date.parse(s) : NaN;
+function signerPem(kid, pool, root, at, suite, revokedKids, revokedCerts) {
+  const r = resolveKey({ targetKid: kid, pool, rootPublicKeyPem: root, purpose: forSigning(suite), now: new Date(at), revokedKids, revokedCerts });
+  return r.decision === "RESOLVED" ? r.pem : null;
+}
+function evaluateStatement(st, pool, rootPublicKeyPem, now) {
+  if (st === null || typeof st !== "object" || Array.isArray(st))
+    return "bad_statement";
+  const hasKid = "revoked_kid" in st, hasFp = "revoked_fingerprint" in st;
+  if (hasKid === hasFp)
+    return "bad_statement";
+  const target = hasKid ? st.revoked_kid : st.revoked_fingerprint;
+  if (!str(target) || hasFp && !FP.test(target))
+    return "bad_statement";
+  if (typeof st.reason !== "string" || !["issued_at", "kid", "algorithm", "signature"].every((f) => str(st[f])))
+    return "bad_statement";
+  if (!REVOCATION_SUITES.includes(st.algorithm))
+    return "bad_statement";
+  const issued = time2(st.issued_at);
+  if (Number.isNaN(issued) || issued > now.getTime())
+    return "bad_statement";
+  const certs = pool.filter((c) => c.parent_kid === st.kid && (hasKid ? c.child_kid === target : fingerprint(c) === target));
+  if (certs.length === 0)
+    return "no_certificate";
+  const parent = signerPem(st.kid, pool, rootPublicKeyPem, issued, st.algorithm, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set());
+  if (!parent)
+    return "signer_not_recognized";
+  if (!certs.some((c) => verifySuite(c.algorithm, parent, jcs(certPayload(c)), { signature: c.signature }).ok))
+    return "bad_certificate_signature";
+  return verifySuite(st.algorithm, parent, jcs(revocationPayload(st)), { signature: st.signature }).ok ? null : "bad_signature";
+}
+function verifyRevocationList(list, o) {
+  const L = list;
+  if (L === null || typeof L !== "object" || !["generated_at", "kid", "algorithm", "signature"].every((f) => typeof L[f] === "string") || !Array.isArray(L.statements)) {
+    return { decision: "MALFORMED", reason_code: "bad_list" };
+  }
+  const extra = L.key_certs ?? [];
+  if (!Array.isArray(extra) || extra.length > MAX_LIST_CERTS || !extra.every((c) => c && typeof c === "object" && CERT_FIELDS2.every((f) => str(c[f])) && ["Ed25519", "ES256"].includes(c.algorithm) && (c.scope === void 0 || c.scope === null || typeof c.scope === "string"))) {
+    return { decision: "MALFORMED", reason_code: "bad_list_certs" };
+  }
+  const seen = /* @__PURE__ */ new Set(), pool = [];
+  for (const c of [...extra, ...o.ownCerts ?? []]) {
+    const fp = fingerprint(c);
+    if (!seen.has(fp)) {
+      seen.add(fp);
+      pool.push(c);
+    }
+  }
+  const kids = /* @__PURE__ */ new Set(), certs = /* @__PURE__ */ new Set(), ignored = [];
+  L.statements.forEach((st, index) => {
+    const why = evaluateStatement(st, pool, o.rootPublicKeyPem, o.now);
+    if (why)
+      ignored.push({ index, reason: why });
+    else if ("revoked_kid" in st)
+      kids.add(st.revoked_kid);
+    else
+      certs.add(st.revoked_fingerprint);
+  });
+  const out = { decision: "OK", revoked_kids: [...kids].sort(), revoked_certs: [...certs].sort(), ignored };
+  const generated = time2(L.generated_at);
+  if (Number.isNaN(generated) || generated > o.now.getTime() || !REVOCATION_SUITES.includes(L.algorithm))
+    return out;
+  const signer = signerPem(L.kid, pool, o.rootPublicKeyPem, generated, L.algorithm, kids, certs);
+  if (signer && verifySuite(L.algorithm, signer, jcs(revocationListPayload(L)), { signature: L.signature }).ok)
+    out.as_of = L.generated_at;
+  return out;
+}
+
 // src/verify-chain.ts
 var CHAIN_PROTOCOL_VERSION2 = "1";
 var DEFAULT_BASE = "https://www.nomosprotocol.com";
@@ -5377,43 +5477,371 @@ async function verifyChainRemote(params, opts) {
   throw new NomosAPIError(message, res.status, requestId);
 }
 
+// src/bindings.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var hasOwn = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
+var isScalar = (v) => typeof v === "string" || typeof v === "boolean" || typeof v === "number" && Number.isFinite(v);
+function parseToolBindings(raw) {
+  const no = (why) => {
+    throw new Error(why);
+  };
+  const obj = raw;
+  if (!obj || typeof obj !== "object" || Array.isArray(obj)) no("it is not a JSON object");
+  if (obj.version !== 1) no('"version" must be 1');
+  if (typeof obj.artifact !== "string" || !obj.artifact) no('"artifact" must name the sealed policy');
+  if (typeof obj.reviewed !== "boolean") no('"reviewed" must be true or false');
+  if (!obj.tools || typeof obj.tools !== "object" || Array.isArray(obj.tools)) no('"tools" must be an object');
+  for (const k of Object.keys(obj)) if (!["version", "artifact", "reviewed", "tools", "_review"].includes(k)) no(`unknown setting "${k}"`);
+  const tools = {};
+  for (const tool of Object.keys(obj.tools)) {
+    if (FORBIDDEN_KEYS.has(tool)) no(`"${tool}" isn't a usable tool name`);
+    const entry = obj.tools[tool];
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) no(`tool "${tool}" must be an object with "facts"`);
+    for (const k of Object.keys(entry)) if (!["facts", "_why"].includes(k)) no(`tool "${tool}": unknown setting "${k}"`);
+    const facts = entry.facts;
+    if (!facts || typeof facts !== "object" || Array.isArray(facts)) no(`tool "${tool}" needs "facts"`);
+    tools[tool] = { facts: {} };
+    for (const fact of Object.keys(facts)) {
+      const where = `${tool}.${fact}`;
+      if (fact === "tool") no(`${where}: "tool" is set by the guard to the tool's name`);
+      if (FORBIDDEN_KEYS.has(fact)) no(`${where} isn't a usable fact name`);
+      const b = facts[fact];
+      if (!b || typeof b !== "object" || Array.isArray(b)) no(`${where} must be an object with "arg"`);
+      for (const k of Object.keys(b)) if (!["arg", "scale", "map", "_why"].includes(k)) no(`${where}: "${k}" isn't allowed. A fact can only come from an argument of the call`);
+      if (typeof b.arg !== "string" || !b.arg) no(`${where} needs "arg", the argument it comes from`);
+      if (b.arg.split(".").some((s) => !s || FORBIDDEN_KEYS.has(s))) no(`${where}: "${b.arg}" isn't a usable argument path`);
+      if (b.scale !== void 0 && b.map !== void 0) no(`${where}: use "scale" or "map", not both`);
+      if (b.scale !== void 0 && (typeof b.scale !== "number" || !Number.isFinite(b.scale) || b.scale === 0)) no(`${where}: "scale" must be a non-zero number`);
+      if (b.map !== void 0) {
+        if (!b.map || typeof b.map !== "object" || Array.isArray(b.map)) no(`${where}: "map" must be an object`);
+        for (const k of Object.keys(b.map)) if (FORBIDDEN_KEYS.has(k) || !isScalar(b.map[k])) no(`${where}: "map" can only hold plain values`);
+      }
+      tools[tool].facts[fact] = { arg: b.arg, ...b.scale !== void 0 ? { scale: b.scale } : {}, ...b.map !== void 0 ? { map: b.map } : {} };
+    }
+  }
+  return { version: 1, artifact: obj.artifact, reviewed: obj.reviewed, tools };
+}
+function applyToolBindings(bindings, tool, args) {
+  const inputs = { tool };
+  const unresolved = [];
+  const facts = hasOwn(bindings.tools, tool) ? bindings.tools[tool].facts : {};
+  for (const [fact, b] of Object.entries(facts)) {
+    let v = args;
+    for (const seg of b.arg.split(".")) v = v && typeof v === "object" && !Array.isArray(v) && hasOwn(v, seg) ? v[seg] : void 0;
+    if (v === void 0 || v === null) {
+      unresolved.push({ fact, arg: b.arg, why: "missing" });
+      continue;
+    }
+    if (b.scale !== void 0) {
+      if (typeof v !== "number" || !Number.isFinite(v)) {
+        unresolved.push({ fact, arg: b.arg, why: "not_a_number" });
+        continue;
+      }
+      inputs[fact] = Number((v * b.scale).toFixed(9));
+      continue;
+    }
+    if (!isScalar(v)) {
+      unresolved.push({ fact, arg: b.arg, why: "not_a_value" });
+      continue;
+    }
+    if (b.map) {
+      if (!hasOwn(b.map, String(v))) {
+        unresolved.push({ fact, arg: b.arg, why: "not_in_map" });
+        continue;
+      }
+      inputs[fact] = b.map[String(v)];
+      continue;
+    }
+    inputs[fact] = v;
+  }
+  return { inputs, unresolved };
+}
+var WEAK = /* @__PURE__ */ new Set(["is", "has", "the", "a", "an", "of", "to", "in", "id", "name", "type", "value", "status", "code", "data", "info", "flag", "number", "num", "total", "ai", "system"]);
+var UNITS = { cents: 0.01, pence: 0.01, fils: 0.01, usd: null, dollars: null, aed: null, eur: null };
+var words = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).map((w) => w.toLowerCase()).filter(Boolean);
+var flatProperties = (props, prefix = "") => Object.entries(props ?? {}).flatMap(([k, s]) => FORBIDDEN_KEYS.has(k) ? [] : s?.type === "object" && s.properties ? flatProperties(s.properties, `${prefix}${k}.`) : [{ path: `${prefix}${k}`, schema: s }]);
+function suggestToolBindings(artifact, tools, fields) {
+  const bindings = { version: 1, artifact, reviewed: false, tools: {} };
+  const proposals = [];
+  const unbound = [];
+  for (const tool of tools) {
+    bindings.tools[tool.name] = { facts: {} };
+    const args = flatProperties(tool.inputSchema?.properties);
+    for (const field of fields) {
+      if (field.name === "tool") continue;
+      const want = words(field.name).filter((w) => !WEAK.has(w) && !(w in UNITS));
+      const scored = args.map((a) => {
+        const raw = words(a.path);
+        const have = raw.filter((w) => !WEAK.has(w) && !(w in UNITS));
+        const shared = want.filter((w) => have.includes(w));
+        const unit = raw.find((w) => w in UNITS);
+        const same = words(field.name).join("_") === raw.join("_");
+        const sameCore = want.length > 0 && want.length === have.length && shared.length === want.length;
+        return { a, shared, unit, same, sameCore, score: same ? 3 : sameCore ? 2 : shared.length ? shared.length / Math.max(want.length, have.length) : 0 };
+      }).filter((s) => s.score > 0).sort((x, y) => y.score - x.score);
+      if (!scored.length) {
+        unbound.push({ tool: tool.name, fact: field.name, candidates: [] });
+        continue;
+      }
+      const best = scored[0];
+      if (scored[1] && scored[1].score === best.score) {
+        unbound.push({ tool: tool.name, fact: field.name, candidates: scored.filter((s) => s.score === best.score).map((s) => s.a.path) });
+        continue;
+      }
+      const scale = best.unit ? UNITS[best.unit] ?? void 0 : void 0;
+      const why = best.same ? "the same name" : best.sameCore ? "the same words" : `shares "${best.shared.join(", ")}"`;
+      proposals.push({ tool: tool.name, fact: field.name, arg: best.a.path, confidence: best.same || best.sameCore ? "exact" : "likely", why: scale ? `${why}; ${best.unit} scaled by ${scale}` : why, ...scale ? { scale } : {} });
+      bindings.tools[tool.name].facts[field.name] = { arg: best.a.path, ...scale ? { scale } : {} };
+    }
+  }
+  return { bindings, proposals, unbound };
+}
+function describeSuggestion(s) {
+  const lines = [];
+  for (const tool of Object.keys(s.bindings.tools)) {
+    lines.push(`
+${tool}`);
+    for (const p of s.proposals.filter((x) => x.tool === tool)) lines.push(`  ${p.confidence === "exact" ? "matched " : "CHECK   "} ${p.fact} <- ${p.arg}${p.scale ? ` x ${p.scale}` : ""} (${p.why})`);
+    for (const u of s.unbound.filter((x) => x.tool === tool)) lines.push(`  NO MATCH ${u.fact}${u.candidates.length ? ` (could be: ${u.candidates.join(", ")})` : ""}`);
+  }
+  return lines.join("\n");
+}
+
+// src/act/bytes.ts
+var utf82 = (s) => new TextEncoder().encode(s);
+var fromUtf82 = (b) => new TextDecoder().decode(b);
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+function equal2(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+function fromHex(h) {
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(h.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function toBase642(b) {
+  let s = "";
+  for (let i = 0; i < b.length; i += 32768) s += String.fromCharCode(...b.subarray(i, i + 32768));
+  return btoa(s);
+}
+function fromBase642(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+var toBase64url2 = (b) => toBase642(b).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var fromBase64url2 = (s) => {
+  const t = s.replace(/-/g, "+").replace(/_/g, "/");
+  return fromBase642(t + "=".repeat((4 - t.length % 4) % 4));
+};
+function randomBytes3(n) {
+  return globalThis.crypto.getRandomValues(new Uint8Array(n));
+}
+var randomUUID = () => globalThis.crypto.randomUUID();
+
 // src/act/signer.ts
-var import_node_crypto = require("crypto");
-var P256_N = 0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551n;
 function kidOf2(publicKeyPem) {
-  const der = (0, import_node_crypto.createPublicKey)(publicKeyPem).export({ type: "spki", format: "der" });
-  return (0, import_node_crypto.createHash)("sha256").update(der).digest("base64url").slice(0, 16);
+  const kid = kidOf(publicKeyPem);
+  if (!kid) throw new Error("kidOf: not a canonical Ed25519 or P-256 public key (NOMOS-SPEC-010 \xA73.1)");
+  return kid;
+}
+var ED25519_SPKI = fromHex("302a300506032b6570032100");
+var P256_SPKI = fromHex("3059301306072a8648ce3d020106082a8648ce3d030107034200");
+var ED25519_PKCS8 = fromHex("302e020100300506032b657004220420");
+var P256_PKCS8_HEAD = fromHex("308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b0201010420");
+var P256_PKCS8_PUB = fromHex("a144034200");
+var OID_ED25519 = fromHex("2b6570");
+var OID_EC = fromHex("2a8648ce3d0201");
+var OID_P256 = fromHex("2a8648ce3d030107");
+function pem(label, der) {
+  const b64 = toBase642(der);
+  return `-----BEGIN ${label}-----
+${b64.match(/.{1,64}/g).join("\n")}
+-----END ${label}-----
+`;
+}
+function pemBody(text) {
+  const m = text.trim().match(/^-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----$/);
+  if (!m) throw new Error("Signer: expected a PEM private key");
+  return { label: m[1], der: fromBase642(m[2].replace(/\s+/g, "")) };
+}
+function tlv(b, at) {
+  const tag = b[at];
+  let len = b[at + 1], start = at + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n < 1 || n > 2) throw new Error("Signer: unsupported DER length");
+    len = 0;
+    for (let i = 0; i < n; i++) len = len << 8 | b[start + i];
+    start += n;
+  }
+  if (start + len > b.length) throw new Error("Signer: truncated DER");
+  return { tag, start, end: start + len };
+}
+function children(b, outer) {
+  const out = [];
+  for (let at = outer.start; at < outer.end; ) {
+    const t = tlv(b, at);
+    out.push(t);
+    at = t.end;
+  }
+  return out;
+}
+function sec1Scalar(b, seq) {
+  const [version, d, ...rest] = children(b, seq);
+  if (version.tag !== 2 || d.tag !== 4 || d.end - d.start !== 32) throw new Error("Signer: malformed EC private key");
+  for (const r of rest) {
+    if (r.tag === 160) {
+      const oid = tlv(b, r.start);
+      if (!equal2(b.subarray(oid.start, oid.end), OID_P256)) throw new Error("Signer: only P-256 EC keys are a NOMOS suite (NOMOS-SPEC-010)");
+    }
+  }
+  return b.slice(d.start, d.end);
 }
-function fromKeyObject(privateKey) {
-  const publicKeyPem = (0, import_node_crypto.createPublicKey)(privateKey).export({ type: "spki", format: "pem" }).toString();
-  const isEd = privateKey.asymmetricKeyType === "ed25519";
-  if (!isEd && !(privateKey.asymmetricKeyType === "ec" && privateKey.asymmetricKeyDetails?.namedCurve === "prime256v1")) {
-    throw new Error("Signer: only Ed25519 and P-256 keys are NOMOS signature suites (NOMOS-SPEC-010)");
+function readPrivateKey(text) {
+  const { label, der } = pemBody(text);
+  const top = tlv(der, 0);
+  if (label === "EC PRIVATE KEY") return { type: "ES256", key: sec1Scalar(der, top) };
+  if (label !== "PRIVATE KEY") throw new Error(`Signer: unsupported key type "${label}" (PKCS#8 "PRIVATE KEY" or SEC1 "EC PRIVATE KEY")`);
+  const [, alg, key] = children(der, top);
+  const [oid, params] = children(der, alg);
+  const algOid = der.subarray(oid.start, oid.end);
+  if (equal2(algOid, OID_ED25519)) {
+    const inner = tlv(der, key.start);
+    if (inner.tag !== 4 || inner.end - inner.start !== 32) throw new Error("Signer: malformed Ed25519 private key");
+    return { type: "Ed25519", key: der.slice(inner.start, inner.end) };
   }
+  if (equal2(algOid, OID_EC)) {
+    if (!params || !equal2(der.subarray(params.start, params.end), OID_P256)) throw new Error("Signer: only P-256 EC keys are a NOMOS suite (NOMOS-SPEC-010)");
+    return { type: "ES256", key: sec1Scalar(der, tlv(der, key.start)) };
+  }
+  throw new Error("Signer: only Ed25519 and P-256 keys are NOMOS signature suites (NOMOS-SPEC-010)");
+}
+function publicPem(s) {
+  return s.type === "Ed25519" ? pem("PUBLIC KEY", concat2(ED25519_SPKI, ed25519.getPublicKey(s.key))) : pem("PUBLIC KEY", concat2(P256_SPKI, p256.getPublicKey(s.key, false)));
+}
+function privatePem(s) {
+  return s.type === "Ed25519" ? pem("PRIVATE KEY", concat2(ED25519_PKCS8, s.key)) : pem("PRIVATE KEY", concat2(P256_PKCS8_HEAD, s.key, P256_PKCS8_PUB, p256.getPublicKey(s.key, false)));
+}
+function fromSecret(s) {
+  const publicKeyPem = publicPem(s);
   return {
     kid: kidOf2(publicKeyPem),
     publicKeyPem,
-    algorithm: isEd ? "Ed25519" : "ES256",
+    algorithm: s.type,
     async sign(payload) {
-      if (isEd) return (0, import_node_crypto.sign)(null, Buffer.from(payload), privateKey).toString("base64");
-      const raw = (0, import_node_crypto.sign)("sha256", Buffer.from(payload), { key: privateKey, dsaEncoding: "ieee-p1363" });
-      let s = BigInt("0x" + raw.subarray(32).toString("hex"));
-      if (s > P256_N / 2n) s = P256_N - s;
-      return Buffer.concat([raw.subarray(0, 32), Buffer.from(s.toString(16).padStart(64, "0"), "hex")]).toString("base64");
+      return toBase642(s.type === "Ed25519" ? ed25519.sign(payload, s.key) : p256.sign(payload, s.key, { prehash: true, lowS: true, format: "compact" }));
     }
   };
 }
 function localSigner(privateKeyPem) {
-  return fromKeyObject((0, import_node_crypto.createPrivateKey)(privateKeyPem));
+  return fromSecret(readPrivateKey(privateKeyPem));
 }
 function generateSigner(algorithm = "Ed25519") {
-  const { privateKey } = algorithm === "Ed25519" ? (0, import_node_crypto.generateKeyPairSync)("ed25519") : (0, import_node_crypto.generateKeyPairSync)("ec", { namedCurve: "prime256v1" });
-  return { ...fromKeyObject(privateKey), privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString() };
+  const s = algorithm === "Ed25519" ? { type: "Ed25519", key: ed25519.utils.randomSecretKey() } : { type: "ES256", key: p256.utils.randomSecretKey() };
+  return { ...fromSecret(s), privateKeyPem: privatePem(s) };
 }
 function seededSigner(seed) {
-  const raw = (0, import_node_crypto.createHash)("sha256").update(seed).digest();
-  const der = Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), raw]);
-  return fromKeyObject((0, import_node_crypto.createPrivateKey)({ key: der, format: "der", type: "pkcs8" }));
+  return fromSecret({ type: "Ed25519", key: sha2562(seed) });
+}
+var sha2562 = (s) => sha256(new TextEncoder().encode(s));
+
+// src/act/certificates.ts
+var MAX_PRESENTED = 20;
+function reliedKids(act2) {
+  const kids = [act2?.authority?.artifact?.seal?.kid, ...(act2?.testimony ?? []).map((t) => t?.kid), ...(act2?.consents ?? []).map((c) => c?.kid)];
+  return [...new Set(kids.filter((k) => typeof k === "string" && k !== ""))];
+}
+function presentedCertificates(available, act2) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const c of available) unique.set(fingerprint(c), c);
+  const kids = new Set(reliedKids(act2)), chosen = /* @__PURE__ */ new Map();
+  for (let grew = true; grew; ) {
+    grew = false;
+    for (const [fp, c] of unique) {
+      if (!chosen.has(fp) && kids.has(c.child_kid)) {
+        chosen.set(fp, c);
+        kids.add(c.parent_kid);
+        grew = true;
+      }
+    }
+  }
+  return [...chosen.values()];
+}
+async function signRevocation(parent, target, reason, issuedAt = /* @__PURE__ */ new Date()) {
+  const st = "kid" in target ? { revoked_kid: target.kid, reason, issued_at: issuedAt.toISOString() } : { revoked_fingerprint: fingerprint(target.certificate), reason, issued_at: issuedAt.toISOString() };
+  if ("certificate" in target && target.certificate.parent_kid !== parent.kid) throw new Error("signRevocation: only the parent that issued a certificate can revoke it");
+  return { ...st, kid: parent.kid, algorithm: parent.algorithm, signature: await parent.sign(jcs(revocationPayload(st))) };
+}
+async function signRevocationList(signer, statements, keyCerts = [], generatedAt = /* @__PURE__ */ new Date()) {
+  const L = { generated_at: generatedAt.toISOString(), kid: signer.kid, algorithm: signer.algorithm, statements, ...keyCerts.length ? { key_certs: keyCerts } : {} };
+  L.signature = await signer.sign(jcs(revocationListPayload(L)));
+  return L;
+}
+function revocationListCertificates(available, statements, listSignerKid) {
+  const byFp = new Map(available.map((c) => [fingerprint(c), c]));
+  const revokedCerts = statements.map((s) => s.revoked_fingerprint && byFp.get(s.revoked_fingerprint)).filter((c) => !!c);
+  const kids = [listSignerKid, ...statements.flatMap((s) => [s.kid, s.revoked_kid].filter((k) => !!k)), ...revokedCerts.map((c) => c.parent_kid)];
+  const closure = presentedCertificates(available, { authority: { artifact: { seal: {} } }, testimony: kids.map((kid) => ({ kid })) });
+  const out = new Map(closure.map((c) => [fingerprint(c), c]));
+  for (const c of revokedCerts) out.set(fingerprint(c), c);
+  return [...out.values()];
+}
+var RevocationUnavailable = class extends Error {
+  constructor(message, retryAfterSeconds) {
+    super(message);
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "RevocationUnavailable";
+  }
+};
+function revocationSource(o) {
+  const f = o.fetch ?? fetch, now = o.now ?? (() => /* @__PURE__ */ new Date());
+  const maxAge = (o.maxAgeSeconds ?? 3600) * 1e3, refresh = (o.refreshSeconds ?? 60) * 1e3;
+  const kids = /* @__PURE__ */ new Set(), certs = /* @__PURE__ */ new Set();
+  let asOf = 0, fetchedAt = 0, inFlight = null, lastError = "";
+  async function load() {
+    fetchedAt = now().getTime();
+    try {
+      const res = await f(o.url, { headers: { accept: "application/json" } });
+      if (!res.ok) {
+        lastError = `${o.url} answered ${res.status}`;
+        return;
+      }
+      const r = verifyRevocationList(await res.json(), { rootPublicKeyPem: o.root, now: now(), ownCerts: o.ownCerts });
+      if (r.decision !== "OK") {
+        lastError = `${o.url} served a malformed list (${r.reason_code})`;
+        return;
+      }
+      for (const k of r.revoked_kids) kids.add(k);
+      for (const c of r.revoked_certs) certs.add(c);
+      if (r.as_of) asOf = Math.max(asOf, Date.parse(r.as_of));
+      else lastError = `${o.url}'s list is not signed by a key your root reaches, so it does not show it is current`;
+    } catch (e) {
+      lastError = `${o.url}: ${e?.message ?? e}`;
+    }
+  }
+  return async () => {
+    const t = now().getTime();
+    if (!inFlight && t - fetchedAt >= refresh) inFlight = load().finally(() => {
+      inFlight = null;
+    });
+    if (inFlight) await inFlight;
+    if (!asOf || t - asOf > maxAge) {
+      throw new RevocationUnavailable(`No current revocation list${asOf ? `: the newest is from ${new Date(asOf).toISOString()}` : ""}${lastError ? ` (${lastError})` : ""}. Not committing until revocations can be checked.`, Math.ceil(refresh / 1e3));
+    }
+    return { kids: new Set(kids), certs: new Set(certs) };
+  };
 }
 
 // src/act/documents.ts
@@ -5518,6 +5946,11 @@ var Rollback = class extends Error {
     this.answer = answer2;
   }
 };
+var LostRace = class extends Error {
+  constructor() {
+    super("replayed");
+  }
+};
 function accept(o) {
   const kid = kidOf2(o.root);
   for (const a of o.authorities) {
@@ -5525,7 +5958,7 @@ function accept(o) {
       throw new Error(`accept(): authority ${a.artifactId} uses currencyPolicy "record" but has no inForceSealHash`);
     }
   }
-  if (!o.store) console.warn("[nomos] accept(): using the in-memory store. Nonces and receipts are lost on restart. Development only.");
+  if (!o.store) console.warn("[nomos] accept(): using the in-memory store. Nonces and receipts are lost on restart. Development only; use postgresStore() in production.");
   const store = o.store ?? memoryStore();
   const maxWindowSeconds = o.maxWindowSeconds ?? 900;
   const maxActBytes = o.maxActBytes ?? 1024 * 1024;
@@ -5551,8 +5984,7 @@ function accept(o) {
       valid_until: new Date(now().getTime() + (o.documentTtlSeconds ?? 86400) * 1e3).toISOString()
     };
   }
-  async function verifyWith(act2, authority, facts, at, seen) {
-    const rev = await o.revocations?.() ?? {};
+  function verifyWith(act2, authority, facts, at, seen, rev) {
     return verifyAct(act2, {
       relyingPartyId: o.relyingPartyId,
       rootPublicKeyPem: o.root,
@@ -5584,9 +6016,20 @@ function accept(o) {
     const authority = o.authorities.find((a) => a.artifactId === artifactId);
     if (!authority) return answer({ decision: "NOT_ACCEPTED", reason_code: "authority_not_accepted", artifact_id: artifactId ?? null });
     if (!authority.actions.includes(act2?.action?.type)) return answer({ decision: "NOT_ACCEPTED", reason_code: "action_not_accepted", action_type: act2?.action?.type ?? null });
+    let rev;
+    try {
+      rev = await o.revocations?.() ?? {};
+    } catch (e) {
+      const retry = e instanceof RevocationUnavailable ? e.retryAfterSeconds : 60;
+      return {
+        status: 503,
+        headers: { "content-type": "application/json", "retry-after": String(retry) },
+        body: { error: "Revocation status is not current, so nothing is committed. Resubmit this same Act later.", detail: String(e?.message ?? e), retry_after: retry }
+      };
+    }
     const verifiedAt = now();
     const facts = await o.localFacts?.(act2) ?? {};
-    const verdict = await verifyWith(act2, authority, facts, verifiedAt, await store.hasNonce(act2.nonce));
+    const verdict = verifyWith(act2, authority, facts, verifiedAt, await store.hasNonce(act2.nonce), rev);
     const receiptOf = (v, f, committedAt) => ({
       act_id: act2.act_id,
       act_digest: String(v.act_digest ?? ""),
@@ -5606,35 +6049,34 @@ function accept(o) {
     if (verdict.decision !== "AUTHORIZED" || o.mode === "shadow") {
       await o.onVerdict?.(verdict, receiptOf(verdict, facts));
       if (verdict.decision === "ESCALATED") {
-        const esc2 = (act2.authority.artifact.governance?.escalations ?? []).find((e) => e?.id === verdict.escalation_id);
-        return answer(verdict, { role: esc2?.role_required ?? null, retry_until: act2.expires_at });
+        const esc3 = (act2.authority.artifact.governance?.escalations ?? []).find((e) => e?.id === verdict.escalation_id);
+        return answer(verdict, { role: esc3?.role_required ?? null, retry_until: act2.expires_at });
       }
       if (o.mode === "shadow") return { ...answer(verdict), status: 200, body: { ...answer(verdict).body, shadow: true } };
       return answer(verdict);
     }
     try {
       return await store.transaction(async (t) => {
-        if (!await t.claimNonce(act2.nonce)) {
-          throw new Rollback(answer({ decision: "REPLAYED" }, { act_id: act2.act_id, receipt: await store.receiptFor(act2.nonce) }));
-        }
+        if (!await t.claimNonce(act2.nonce)) throw new LostRace();
         let final = verdict, finalFacts = facts;
         if (o.localFacts) {
           const fresh = await o.localFacts(act2, t.tx);
           if (!sameFacts(fresh, facts)) {
             finalFacts = fresh;
-            final = await verifyWith(act2, authority, fresh, verifiedAt, false);
+            final = verifyWith(act2, authority, fresh, verifiedAt, false, rev);
             if (final.decision !== "AUTHORIZED") throw new Rollback(answer(final));
           }
         }
         const action = structuredClone({ type: act2.action.type, ...act2.action.subject !== void 0 ? { subject: act2.action.subject } : {}, params: act2.action.params ?? {} });
         const result = await o.commit(action, { tx: t.tx, actId: act2.act_id });
         const receipt = receiptOf(final, finalFacts, now());
-        await t.putReceipt(act2.nonce, receipt);
+        await t.putReceipt(act2.nonce, receipt, act2);
         await o.onVerdict?.(final, receipt);
         return answer(final, { receipt, ...result !== void 0 ? { result } : {} });
       });
     } catch (e) {
       if (e instanceof Rollback) return e.answer;
+      if (e instanceof LostRace) return answer({ decision: "REPLAYED" }, { act_id: act2.act_id, receipt: await store.receiptFor(act2.nonce) });
       return { status: 500, headers: { "content-type": "application/json" }, body: { error: "The commit failed and was rolled back; nothing was applied.", detail: String(e?.message ?? e) } };
     }
   }
@@ -5673,7 +6115,7 @@ function accept(o) {
           if (size > maxActBytes) break;
           chunks.push(c);
         }
-        body = size > maxActBytes ? new Uint8Array(maxActBytes + 1) : Buffer.concat(chunks);
+        body = size > maxActBytes ? new Uint8Array(maxActBytes + 1) : concat2(...chunks);
       }
       const a = await handle({ method: req.method, headers: req.headers, body });
       send(a.status, a.headers, JSON.stringify(a.body));
@@ -5684,7 +6126,7 @@ function accept(o) {
 function consentOrigins(act2) {
   const origins = (Array.isArray(act2?.consents) ? act2.consents : []).filter((c) => c?.algorithm === "WebAuthn-ES256" && typeof c.client_data_json === "string").map((c) => {
     try {
-      return JSON.parse(Buffer.from(c.client_data_json, "base64url").toString("utf8")).origin;
+      return JSON.parse(fromUtf82(fromBase64url2(c.client_data_json))).origin;
     } catch {
       return null;
     }
@@ -5692,8 +6134,74 @@ function consentOrigins(act2) {
   return origins.length ? { consent_origins: [...new Set(origins)] } : {};
 }
 
+// src/act/postgres.ts
+var IDENT = /^[a-z_][a-z0-9_]{0,62}(\.[a-z_][a-z0-9_]{0,62})?$/;
+function postgresStore(pool, opts = {}) {
+  const table = opts.table ?? "nomos_acts";
+  if (!IDENT.test(table)) throw new Error(`postgresStore: "${table}" is not a plain lower-case table name`);
+  const schema = `CREATE TABLE IF NOT EXISTS ${table} (
+  nonce         text        PRIMARY KEY,                 -- SPEC-008 \xA75.2: the nonce ledger
+  act_id        text        NOT NULL,
+  receipt       json        NOT NULL,                    -- SPEC-008 \xA79; json, not jsonb: kept byte for byte
+  act           json        NOT NULL,                    -- the exact Act verified, for re-verification
+  committed_at  timestamptz NOT NULL DEFAULT now()
+);`;
+  return {
+    schema,
+    async migrate() {
+      await pool.query(schema);
+    },
+    async hasNonce(nonce) {
+      const r = await pool.query(`SELECT 1 FROM ${table} WHERE nonce = $1`, [nonce]);
+      return (r.rowCount ?? r.rows.length) > 0;
+    },
+    async receiptFor(nonce) {
+      const r = await pool.query(`SELECT receipt FROM ${table} WHERE nonce = $1`, [nonce]);
+      return r.rows[0]?.receipt ?? null;
+    },
+    async transaction(fn) {
+      const client = await pool.connect();
+      let claimed = null, completed = false;
+      try {
+        await client.query("BEGIN");
+        const out = await fn({
+          tx: client,
+          async claimNonce(nonce) {
+            const r = await client.query(
+              `INSERT INTO ${table} (nonce, act_id, receipt, act) VALUES ($1, '', '{}'::json, '{}'::json)
+               ON CONFLICT (nonce) DO NOTHING RETURNING nonce`,
+              [nonce]
+            );
+            const won = (r.rowCount ?? r.rows.length) === 1;
+            if (won) claimed = nonce;
+            return won;
+          },
+          async putReceipt(nonce, receipt, act2) {
+            if (nonce !== claimed) throw new Error("postgresStore: putReceipt for a nonce this transaction did not claim");
+            await client.query(
+              `UPDATE ${table} SET act_id = $2, receipt = $3::json, act = $4::json WHERE nonce = $1`,
+              [nonce, receipt.act_id, JSON.stringify(receipt), JSON.stringify(act2 ?? {})]
+            );
+            completed = true;
+          }
+        });
+        if (claimed && !completed) throw new Error("postgresStore: the transaction claimed a nonce but stored no receipt");
+        await client.query("COMMIT");
+        client.release();
+        return out;
+      } catch (e) {
+        let broken;
+        await client.query("ROLLBACK").catch((err) => {
+          broken = err;
+        });
+        client.release(broken);
+        throw e;
+      }
+    }
+  };
+}
+
 // src/act/statements.ts
-var import_node_crypto2 = require("crypto");
 async function certify(parent, child, opts) {
   const unsigned = {
     parent_kid: parent.kid,
@@ -5747,8 +6255,8 @@ function buildAct(o) {
   const window = o.windowSeconds ?? 300;
   const act2 = {
     act_version: "1",
-    act_id: `act-${(0, import_node_crypto2.randomUUID)()}`,
-    nonce: (0, import_node_crypto2.randomBytes)(16).toString("base64"),
+    act_id: `act-${randomUUID()}`,
+    nonce: toBase642(randomBytes3(16)),
     // Issued a second in the past so a relying party's clock a moment behind ours still accepts it.
     issued_at: new Date(now.getTime() - 1e3).toISOString(),
     expires_at: new Date(now.getTime() - 1e3 + window * 1e3).toISOString(),
@@ -5762,6 +6270,575 @@ function buildAct(o) {
   return act2;
 }
 
+// src/act/registry.ts
+function memoryRegistryStore() {
+  const certs = [], sts = [];
+  return {
+    async certificates() {
+      return [...certs];
+    },
+    async addCertificate(c) {
+      if (!certs.some((x) => fingerprint(x) === fingerprint(c))) certs.push(c);
+    },
+    async statements() {
+      return [...sts];
+    },
+    async addStatement(s) {
+      sts.push(s);
+    }
+  };
+}
+var RegistryError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "RegistryError";
+  }
+};
+var any = () => ({ ok: true });
+function certificateRegistry(o) {
+  const rootKid = kidOf(o.root);
+  if (!rootKid) throw new RegistryError("certificateRegistry: the root is not a canonical Ed25519 or P-256 public key", "bad_root");
+  const now = o.now ?? (() => /* @__PURE__ */ new Date());
+  async function revokedSets() {
+    const kids = /* @__PURE__ */ new Set(), certs = /* @__PURE__ */ new Set();
+    for (const s of await o.store.statements()) s.revoked_kid ? kids.add(s.revoked_kid) : s.revoked_fingerprint && certs.add(s.revoked_fingerprint);
+    return { kids, certs };
+  }
+  async function scopesOf(kid) {
+    if (kid === rootKid) return { ok: true, scopes: [{ terms: {} }] };
+    const { kids, certs } = await revokedSets();
+    const r = resolveKey({ targetKid: kid, pool: await o.store.certificates(), rootPublicKeyPem: o.root, purpose: any, now: now(), revokedKids: kids, revokedCerts: certs, allPaths: true });
+    if (r.decision !== "RESOLVED") return { ok: false, reason: `${r.decision}${r.reason_code ? ` (${r.reason_code})` : ""}` };
+    return { ok: true, scopes: r.admitted ?? [r.effective] };
+  }
+  async function pool(filter) {
+    const { kids, certs } = await revokedSets(), t = now().getTime();
+    return (await o.store.certificates()).filter((c) => !kids.has(c.child_kid) && !certs.has(fingerprint(c)) && Date.parse(c.expires_at) > t && (!filter || filter(c)));
+  }
+  return {
+    rootKid,
+    pool,
+    /** NOMOS-SPEC-007 §3: certify `child` under `parent`. Refuses anything a verifier would refuse. */
+    async issue(io) {
+      if (!kidOf(io.child.publicKeyPem)) throw new RegistryError("The child key is not a canonical Ed25519 or P-256 key (NOMOS-SPEC-010 \xA73.1)", "invalid_key");
+      const scope = parseScope(io.scope ?? null);
+      if (!scope.ok) throw new RegistryError(`Malformed scope: ${scope.detail}`, "malformed_scope");
+      const parentScopes = await scopesOf(io.parent.kid);
+      if (!parentScopes.ok) throw new RegistryError(`The parent ${io.parent.kid} is not reached from the root: ${parentScopes.reason}`, "parent_not_recognized");
+      const fits = parentScopes.scopes.filter((p) => suitePermitted(p, io.parent.algorithm) && isNarrowerOrEqual(scope.scope, p).ok);
+      if (!fits.length) {
+        const widened = parentScopes.scopes.map((p) => isNarrowerOrEqual(scope.scope, p)).find((x) => !x.ok);
+        throw new RegistryError(widened ? `The scope widens the parent's: ${widened.detail}` : `The parent may not sign under ${io.parent.algorithm}`, widened ? "widening" : "suite_not_permitted");
+      }
+      const expiresAt = io.expiresAt ?? (io.days ? new Date(now().getTime() + io.days * 864e5) : void 0);
+      if (!expiresAt) throw new RegistryError("Give expiresAt or days: a certificate always expires", "no_expiry");
+      const c = await certify(io.parent, io.child, { scope: io.scope, issuedAt: io.issuedAt ?? now(), expiresAt });
+      await o.store.addCertificate(c);
+      return c;
+    },
+    /** rev. 1.10 §5.1: `parent` revokes a key it certified. The key is dead on every path. */
+    async revokeKey(io) {
+      const certs = (await o.store.certificates()).filter((c) => c.child_kid === io.kid && c.parent_kid === io.parent.kid);
+      if (!certs.length) throw new RegistryError(`${io.parent.kid} never certified ${io.kid}: only a key's parent can revoke it`, "not_the_parent");
+      const st = await signRevocation(io.parent, { kid: io.kid }, io.reason, now());
+      await o.store.addStatement(st);
+      return st;
+    },
+    /** rev. 1.10 §5.1: withdraw one certificate; the key stays valid under any other. */
+    async revokeCertificate(io) {
+      const c = (await o.store.certificates()).find((x) => fingerprint(x) === io.fingerprint);
+      if (!c) throw new RegistryError(`No certificate ${io.fingerprint} in this registry`, "unknown_certificate");
+      const st = await signRevocation(io.parent, { certificate: c }, io.reason, now());
+      await o.store.addStatement(st);
+      return st;
+    },
+    /** The certificates that connect `kid` to the root: what a witness or approver returns with
+     *  what it signs (SPEC-009 0.2.0 §4, §5). */
+    async chainFor(kid) {
+      return presentedCertificates(await pool(), { authority: { artifact: { seal: { kid } } } });
+    },
+    /** How `kid` is reached from the root, and with which effective scopes, or why it is not. */
+    async check(kid) {
+      return scopesOf(kid);
+    },
+    certificates: () => o.store.certificates(),
+    statements: () => o.store.statements(),
+    /** rev. 1.10 §5.3: the signed list, carrying the certificates that make it checkable. The
+     *  signer should be reached from the root, or the list establishes no date (§5.3). */
+    async revocationList(signer) {
+      const statements = await o.store.statements();
+      return signRevocationList(signer, statements, revocationListCertificates(await o.store.certificates(), statements, signer.kid), now());
+    }
+  };
+}
+function postgresRegistryStore(pool, opts = {}) {
+  const p = opts.prefix ?? "nomos_registry";
+  if (!/^[a-z_][a-z0-9_]{0,40}$/.test(p)) throw new RegistryError(`"${p}" is not a plain lower-case prefix`, "bad_prefix");
+  const schema = `CREATE TABLE IF NOT EXISTS ${p}_certificates (
+  fingerprint text PRIMARY KEY, child_kid text NOT NULL, parent_kid text NOT NULL, certificate json NOT NULL, added_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE IF NOT EXISTS ${p}_statements (
+  id bigserial PRIMARY KEY, target text NOT NULL, kid text NOT NULL, statement json NOT NULL, added_at timestamptz NOT NULL DEFAULT now()
+);`;
+  return {
+    schema,
+    async migrate() {
+      await pool.query(schema);
+    },
+    async certificates() {
+      return (await pool.query(`SELECT certificate FROM ${p}_certificates ORDER BY added_at, fingerprint`)).rows.map((r) => r.certificate);
+    },
+    async addCertificate(c) {
+      await pool.query(
+        `INSERT INTO ${p}_certificates (fingerprint, child_kid, parent_kid, certificate) VALUES ($1, $2, $3, $4::json) ON CONFLICT (fingerprint) DO NOTHING`,
+        [fingerprint(c), c.child_kid, c.parent_kid, JSON.stringify(c)]
+      );
+    },
+    async statements() {
+      return (await pool.query(`SELECT statement FROM ${p}_statements ORDER BY id`)).rows.map((r) => r.statement);
+    },
+    async addStatement(s) {
+      await pool.query(`INSERT INTO ${p}_statements (target, kid, statement) VALUES ($1, $2, $3::json)`, [s.revoked_kid ?? s.revoked_fingerprint, s.kid, JSON.stringify(s)]);
+    }
+  };
+}
+
+// src/act/passkeys.ts
+function cbor(b) {
+  let i = 0;
+  const len = (info) => {
+    if (info < 24) return info;
+    const n = info === 24 ? 1 : info === 25 ? 2 : info === 26 ? 4 : -1;
+    if (n < 0) throw new Error("unsupported CBOR length");
+    let v2 = 0;
+    for (let k = 0; k < n; k++) v2 = v2 * 256 + b[i++];
+    return v2;
+  };
+  const item = (depth) => {
+    if (depth > 16 || i >= b.length) throw new Error("malformed CBOR");
+    const head = b[i++], major = head >> 5, info = head & 31;
+    switch (major) {
+      case 0:
+        return len(info);
+      case 1:
+        return -1 - len(info);
+      case 2: {
+        const n = len(info);
+        const v2 = b.slice(i, i + n);
+        i += n;
+        if (v2.length !== n) throw new Error("truncated CBOR");
+        return v2;
+      }
+      case 3: {
+        const n = len(info);
+        const v2 = fromUtf82(b.slice(i, i + n));
+        i += n;
+        return v2;
+      }
+      case 4: {
+        const n = len(info), a = [];
+        for (let k = 0; k < n; k++) a.push(item(depth + 1));
+        return a;
+      }
+      case 5: {
+        const n = len(info), m = /* @__PURE__ */ new Map();
+        for (let k = 0; k < n; k++) m.set(item(depth + 1), item(depth + 1));
+        return m;
+      }
+      case 7:
+        if (info === 20) return false;
+        if (info === 21) return true;
+        if (info === 22) return null;
+        throw new Error("unsupported CBOR simple value");
+      default:
+        throw new Error("unsupported CBOR type");
+    }
+  };
+  const v = item(0);
+  return { value: v, end: i };
+}
+function readAttestation(attestationObject) {
+  const att = cbor(attestationObject).value;
+  if (!(att instanceof Map) || !(att.get("authData") instanceof Uint8Array)) throw new Error("not an attestation object");
+  const a = att.get("authData");
+  if (a.length < 55 || !(a[32] & 64)) throw new Error("no attested credential data");
+  const idLen = a[53] << 8 | a[54];
+  const credentialId = a.slice(55, 55 + idLen);
+  const cose = cbor(a.slice(55 + idLen)).value;
+  if (!(cose instanceof Map) || cose.get(1) !== 2 || cose.get(3) !== -7 || cose.get(-1) !== 1) throw new Error("the passkey is not an ES256 P-256 key (COSE kty 2, alg -7, crv 1)");
+  const x = cose.get(-2), y = cose.get(-3);
+  if (!(x instanceof Uint8Array) || !(y instanceof Uint8Array) || x.length !== 32 || y.length !== 32) throw new Error("malformed COSE key");
+  const spki = concat2(Uint8Array.from([48, 89, 48, 19, 6, 7, 42, 134, 72, 206, 61, 2, 1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4]), x, y);
+  const publicKeyPem = pem("PUBLIC KEY", spki);
+  if (!kidOf(publicKeyPem)) throw new Error("the passkey's key is not a valid P-256 point");
+  return { authData: a, flags: a[32], credentialId, publicKeyPem };
+}
+async function signEnrolmentToken(authority, c) {
+  if (!/^[^,\s]+$/.test(c.approver)) throw new Error("An approver id has no commas or spaces (NOMOS-SPEC-007 rev. 1.9 \xA73.7)");
+  const claims = { approver: c.approver, roles: [...c.roles], origin: c.origin.replace(/\/$/, ""), expires_at: c.expiresAt.toISOString(), nonce: toBase64url2(randomBytes3(16)) };
+  const token = { ...claims, kid: authority.kid, algorithm: authority.algorithm, signature: await authority.sign(jcs(claims)) };
+  return toBase64url2(utf82(JSON.stringify(token)));
+}
+function verifyEnrolmentToken(token, authorityPem, origin, now) {
+  let t;
+  try {
+    t = JSON.parse(fromUtf82(fromBase64url2(token)));
+  } catch {
+    return { error: "not an enrolment link" };
+  }
+  const claims = { approver: t?.approver, roles: t?.roles, origin: t?.origin, expires_at: t?.expires_at, nonce: t?.nonce };
+  if (typeof claims.approver !== "string" || !Array.isArray(claims.roles) || !claims.roles.every((r) => typeof r === "string") || typeof claims.nonce !== "string") return { error: "malformed enrolment link" };
+  if (t.kid !== kidOf(authorityPem) || !verifySuite(t.algorithm, authorityPem, jcs(claims), { signature: t.signature }).ok) return { error: "this enrolment link was not signed by the enrolment authority" };
+  if (claims.origin !== origin) return { error: "this enrolment link is for another service" };
+  if (!(Date.parse(claims.expires_at) > now.getTime())) return { error: "this enrolment link has expired" };
+  return claims;
+}
+function memoryPasskeyStore() {
+  const used = /* @__PURE__ */ new Set(), challenges = /* @__PURE__ */ new Map(), creds = [], pend = /* @__PURE__ */ new Map();
+  return {
+    async claimToken(n) {
+      if (used.has(n)) return false;
+      used.add(n);
+      return true;
+    },
+    async tokenUsed(n) {
+      return used.has(n);
+    },
+    async saveEnrolmentChallenge(n, c) {
+      if (!used.has(n)) challenges.set(n, c);
+    },
+    async enrolmentChallenge(n) {
+      return used.has(n) ? null : challenges.get(n) ?? null;
+    },
+    async addCredential(c) {
+      creds.push(structuredClone(c));
+    },
+    async credentials() {
+      return structuredClone(creds);
+    },
+    async createPending(p) {
+      pend.set(p.id, structuredClone(p));
+    },
+    async pending(id) {
+      const p = pend.get(id);
+      return p ? structuredClone(p) : null;
+    },
+    async addAttempt(id, c, a) {
+      const p = pend.get(id);
+      if (!p || p.status !== "pending") return false;
+      p.attempts[c] = { ...a };
+      return true;
+    },
+    async resolvePending(id, out) {
+      const p = pend.get(id);
+      if (!p || p.status !== "pending") return false;
+      Object.assign(p, structuredClone(out));
+      return true;
+    }
+  };
+}
+function postgresPasskeyStore(pool, opts = {}) {
+  const p = opts.prefix ?? "nomos_passkeys";
+  if (!/^[a-z_][a-z0-9_]{0,40}$/.test(p)) throw new Error(`"${p}" is not a plain lower-case prefix`);
+  const schema = `CREATE TABLE IF NOT EXISTS ${p}_tokens (nonce text PRIMARY KEY, challenge text, used boolean NOT NULL DEFAULT false);
+CREATE TABLE IF NOT EXISTS ${p}_credentials (credential_id text PRIMARY KEY, credential json NOT NULL, added_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE IF NOT EXISTS ${p}_pending (id text PRIMARY KEY, approval jsonb NOT NULL, updated_at timestamptz NOT NULL DEFAULT now());`;
+  return {
+    schema,
+    async migrate() {
+      await pool.query(schema);
+    },
+    async claimToken(n) {
+      const r = await pool.query(`INSERT INTO ${p}_tokens (nonce, used) VALUES ($1, true) ON CONFLICT (nonce) DO UPDATE SET used = true WHERE ${p}_tokens.used = false RETURNING nonce`, [n]);
+      return (r.rowCount ?? r.rows.length) === 1;
+    },
+    async tokenUsed(n) {
+      return (await pool.query(`SELECT 1 FROM ${p}_tokens WHERE nonce = $1 AND used = true`, [n])).rows.length > 0;
+    },
+    async saveEnrolmentChallenge(n, c) {
+      await pool.query(`INSERT INTO ${p}_tokens (nonce, challenge) VALUES ($1, $2) ON CONFLICT (nonce) DO UPDATE SET challenge = $2 WHERE ${p}_tokens.used = false`, [n, c]);
+    },
+    async enrolmentChallenge(n) {
+      return (await pool.query(`SELECT challenge FROM ${p}_tokens WHERE nonce = $1 AND used = false`, [n])).rows[0]?.challenge ?? null;
+    },
+    async addCredential(c) {
+      await pool.query(`INSERT INTO ${p}_credentials (credential_id, credential) VALUES ($1, $2::json)`, [c.credential_id, JSON.stringify(c)]);
+    },
+    async credentials() {
+      return (await pool.query(`SELECT credential FROM ${p}_credentials ORDER BY added_at`)).rows.map((r) => r.credential);
+    },
+    async createPending(a) {
+      await pool.query(`INSERT INTO ${p}_pending (id, approval) VALUES ($1, $2::jsonb)`, [a.id, JSON.stringify(a)]);
+    },
+    async pending(id) {
+      return (await pool.query(`SELECT approval FROM ${p}_pending WHERE id = $1`, [id])).rows[0]?.approval ?? null;
+    },
+    // Each change is one conditional statement: Postgres serializes them on the row, and none
+    // rewrites the whole record, so a stale reader cannot write an old status back.
+    async addAttempt(id, c, a) {
+      const r = await pool.query(`UPDATE ${p}_pending SET approval = jsonb_set(approval, ARRAY['attempts', $2::text], $3::jsonb), updated_at = now() WHERE id = $1 AND approval->>'status' = 'pending' RETURNING id`, [id, c, JSON.stringify(a)]);
+      return (r.rowCount ?? r.rows.length) === 1;
+    },
+    async resolvePending(id, out) {
+      const r = await pool.query(`UPDATE ${p}_pending SET approval = approval || $2::jsonb, updated_at = now() WHERE id = $1 AND approval->>'status' = 'pending' RETURNING id`, [id, JSON.stringify(out)]);
+      return (r.rowCount ?? r.rows.length) === 1;
+    }
+  };
+}
+var MAX_ATTEMPTS = 50;
+var esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+function passkeyApprover(o) {
+  const base = o.origin.replace(/\/$/, "");
+  const rpId = o.rpId ?? new URL(base).hostname;
+  const store = o.store ?? memoryPasskeyStore();
+  if (!o.store) console.warn("[nomos] passkeyApprover(): using the in-memory store. Enrolled passkeys are lost on restart. Development only; use postgresPasskeyStore() in production.");
+  const now = o.now ?? (() => /* @__PURE__ */ new Date());
+  const rpIdHash = sha256(utf82(rpId));
+  const expired = (p) => p.status === "pending" && Date.parse(p.act.expires_at) <= now().getTime();
+  const statusOf = (p) => expired(p) ? "expired" : p.status;
+  function clientData(b64, type, challenge) {
+    let c;
+    try {
+      c = JSON.parse(fromUtf82(fromBase64url2(b64)));
+    } catch {
+      return "unreadable client data";
+    }
+    if (c?.type !== type) return `expected a ${type} ceremony`;
+    if (c?.challenge !== challenge) return "the challenge does not match";
+    if (c?.origin !== base) return `the ceremony ran on ${c?.origin}, not ${base}`;
+    return null;
+  }
+  async function route(method, path, json) {
+    if (method === "POST" && path === "/nomos/approvals") {
+      const { role, act: act2 } = await json();
+      if (!o.roles.includes(role)) return { status: 404, body: { error: `This service does not approve as ${role}.` } };
+      if (typeof act2?.expires_at !== "string" || !act2?.action) return { status: 400, body: { error: "The request needs the Act." } };
+      const id = randomUUID();
+      await store.createPending({ id, role, act: act2, status: "pending", created_at: now().toISOString(), attempts: {} });
+      await o.onPending?.({ id, role, act: act2, approvalUrl: `${base}/approve/${id}` });
+      return { status: 202, body: { approval_id: id, status: "pending", poll_url: `${base}/nomos/approvals/${id}`, approval_url: `${base}/approve/${id}` } };
+    }
+    let m = path.match(/^\/nomos\/approvals\/([0-9a-f-]{36})$/);
+    if (method === "GET" && m) {
+      const p = await store.pending(m[1]);
+      if (!p) return null;
+      const s = statusOf(p);
+      return { status: 200, body: { status: s, ...s === "approved" ? { consent: p.consent, ...p.key_certs?.length ? { key_certs: p.key_certs } : {} } : {} } };
+    }
+    m = path.match(/^\/approve\/([0-9a-f-]{36})(?:\/(devices|options|assertion|refuse))?$/);
+    if (m) {
+      const p = await store.pending(m[1]);
+      if (!p) return null;
+      if (method === "GET" && !m[2]) return { status: 200, type: "text/html", body: approvalPage(p, statusOf(p), o.listApprovers === true ? (await store.credentials()).filter((c) => c.roles.includes(p.role)) : null) };
+      if (method !== "POST" || !m[2]) return null;
+      if (statusOf(p) !== "pending") return { status: 409, body: { error: `This request is ${statusOf(p)}.` } };
+      if (m[2] === "refuse") return await store.resolvePending(p.id, { status: "refused" }) ? { status: 200, body: { status: "refused" } } : { status: 409, body: { error: "This request is no longer pending." } };
+      const req = await json();
+      if (m[2] === "devices") {
+        const mine = (await store.credentials()).filter((c) => c.approver === String(req?.approver ?? "") && c.roles.includes(p.role));
+        return { status: 200, body: { devices: mine.map((c) => ({ credential_id: c.credential_id, label: c.label })) } };
+      }
+      const cred = (await store.credentials()).find((c) => c.credential_id === req?.credential_id);
+      if (!cred || !cred.roles.includes(p.role)) return { status: 403, body: { error: `That passkey does not approve as ${p.role}.` } };
+      if (m[2] === "options") {
+        const signed_at = now().toISOString();
+        const payload2 = consentPayload({ binding_digest: bindingDigest(p.act), role: p.role, decision: "approve", signed_at, kid: cred.kid });
+        const challenge = toBase64url2(sha256(jcs(payload2)));
+        if (Object.keys(p.attempts).length >= MAX_ATTEMPTS) return { status: 429, body: { error: "Too many approval ceremonies for this request." } };
+        const expires_at = new Date(Math.min(Date.parse(p.act.expires_at), now().getTime() + 5 * 6e4)).toISOString();
+        if (!await store.addAttempt(p.id, challenge, { credential_id: cred.credential_id, signed_at, expires_at })) return { status: 409, body: { error: "This request is no longer pending." } };
+        return { status: 200, body: { challenge, rpId, allowCredentials: [{ type: "public-key", id: cred.credential_id }], userVerification: "required", timeout: 12e4 } };
+      }
+      let offered;
+      try {
+        offered = JSON.parse(fromUtf82(fromBase64url2(String(req.client_data_json ?? "")))).challenge;
+      } catch {
+        return { status: 400, body: { error: "unreadable client data" } };
+      }
+      const attempt = p.attempts[offered];
+      if (!attempt || attempt.credential_id !== cred.credential_id) return { status: 400, body: { error: "This ceremony was not offered for this passkey." } };
+      if (Date.parse(attempt.expires_at) <= now().getTime()) return { status: 400, body: { error: "This ceremony has expired; start again." } };
+      const consent = {
+        binding_digest: bindingDigest(p.act),
+        role: p.role,
+        decision: "approve",
+        signed_at: attempt.signed_at,
+        kid: cred.kid,
+        algorithm: "WebAuthn-ES256",
+        authenticator_data: String(req.authenticator_data ?? ""),
+        client_data_json: String(req.client_data_json ?? ""),
+        signature: String(req.signature ?? "")
+      };
+      const payload = jcs(consentPayload(consent));
+      const cd = clientData(consent.client_data_json, "webauthn.get", toBase64url2(sha256(payload)));
+      if (cd) return { status: 400, body: { error: cd } };
+      const ad = fromBase64url2(consent.authenticator_data);
+      if (ad.length < 37 || !equal2(ad.slice(0, 32), rpIdHash)) return { status: 400, body: { error: "The assertion is for another relying-party id." } };
+      const v = verifySuite("WebAuthn-ES256", cred.public_key_pem, payload, consent);
+      if (!v.ok) return { status: 400, body: { error: `The passkey's signature does not verify (${v.reason}).` } };
+      const key_certs = await o.registry.chainFor(cred.kid);
+      if (!key_certs.length) return { status: 409, body: { error: "This passkey is no longer certified (revoked or expired)." } };
+      if (!await store.resolvePending(p.id, { status: "approved", consent, key_certs })) return { status: 409, body: { error: "This request is no longer pending." } };
+      return { status: 200, body: { status: "approved" } };
+    }
+    if (method === "GET" && path === "/enroll") return { status: 200, type: "text/html", body: enrolPage(o.rpName ?? rpId) };
+    if (method === "POST" && (path === "/nomos/enrol/begin" || path === "/nomos/enrol/finish")) {
+      const req = await json();
+      const claims = verifyEnrolmentToken(String(req?.token ?? ""), o.enrolmentAuthority, base, now());
+      if ("error" in claims) return { status: 403, body: { error: claims.error } };
+      if (!claims.roles.every((r) => o.roles.includes(r))) return { status: 403, body: { error: `This service does not enrol for ${claims.roles.join(", ")}.` } };
+      if (path === "/nomos/enrol/begin") {
+        if (await store.tokenUsed(claims.nonce)) return { status: 403, body: { error: "This enrolment link has been used." } };
+        const challenge2 = toBase64url2(randomBytes3(32));
+        await store.saveEnrolmentChallenge(claims.nonce, challenge2);
+        const existing = (await store.credentials()).filter((c) => c.approver === claims.approver);
+        return { status: 200, body: {
+          challenge: challenge2,
+          rp: { id: rpId, name: o.rpName ?? rpId },
+          user: { id: toBase64url2(utf82(claims.approver)), name: claims.approver, displayName: claims.approver },
+          pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+          authenticatorSelection: { userVerification: "required", residentKey: "preferred" },
+          attestation: "none",
+          timeout: 12e4,
+          excludeCredentials: existing.map((c) => ({ type: "public-key", id: c.credential_id })),
+          approver: claims.approver,
+          roles: claims.roles
+        } };
+      }
+      const challenge = await store.enrolmentChallenge(claims.nonce);
+      if (!challenge) return { status: 403, body: { error: "Start enrolment again: this link has been used or has no ceremony in progress." } };
+      const cd = clientData(String(req.client_data_json ?? ""), "webauthn.create", challenge);
+      if (cd) return { status: 400, body: { error: cd } };
+      let att;
+      try {
+        att = readAttestation(fromBase64url2(String(req.attestation_object ?? "")));
+      } catch (e) {
+        return { status: 400, body: { error: String(e?.message ?? e) } };
+      }
+      if (!equal2(att.authData.slice(0, 32), rpIdHash)) return { status: 400, body: { error: "The passkey was created for another relying-party id." } };
+      if (!(att.flags & 1) || !(att.flags & 4)) return { status: 400, body: { error: "The device did not verify the person (Face ID, Touch ID or PIN is required)." } };
+      if (toBase64url2(att.credentialId) !== req.credential_id) return { status: 400, body: { error: "The credential id does not match the attestation." } };
+      if (!await store.claimToken(claims.nonce)) return { status: 403, body: { error: "This enrolment link has been used." } };
+      const kid = kidOf(att.publicKeyPem);
+      const certificate = await o.registry.issue({
+        parent: o.enroller,
+        child: { kid, publicKeyPem: att.publicKeyPem },
+        scope: `consent:${claims.roles.join(",")} approver:${claims.approver} suite:WebAuthn-ES256`,
+        days: o.certificateDays ?? 365
+      });
+      const label = String(req.label ?? "").slice(0, 60) || "Passkey";
+      await store.addCredential({ credential_id: req.credential_id, approver: claims.approver, roles: claims.roles, kid, public_key_pem: att.publicKeyPem, label, created_at: now().toISOString() });
+      return { status: 200, body: { enrolled: true, approver: claims.approver, roles: claims.roles, kid, certificate } };
+    }
+    return null;
+  }
+  async function fetchHandler(request) {
+    const out = await route(request.method, new URL(request.url).pathname, () => request.json()).catch((e) => ({ status: 400, body: { error: String(e?.message ?? e) } }));
+    if (!out) return new Response(JSON.stringify({ error: "Not found" }), { status: 404, headers: { "content-type": "application/json" } });
+    const html = out.type === "text/html";
+    return new Response(html ? String(out.body) : JSON.stringify(out.body), { status: out.status, headers: { "content-type": html ? "text/html; charset=utf-8" : "application/json", ...html ? { "content-security-policy": CSP() } : {} } });
+  }
+  function node() {
+    return async (req, res, next) => {
+      const path = String(req.originalUrl ?? req.url ?? "").split("?")[0];
+      const json = async () => {
+        if (req.body && typeof req.body === "object" && !(req.body instanceof Uint8Array)) return req.body;
+        const chunks = [];
+        for await (const c of req) chunks.push(c);
+        return JSON.parse(fromUtf82(concat2(...chunks)) || "{}");
+      };
+      let out;
+      try {
+        out = await route(req.method, path, json);
+      } catch (e) {
+        out = { status: 400, body: { error: String(e?.message ?? e) } };
+      }
+      if (!out) {
+        if (next) return next();
+        res.statusCode = 404;
+        return res.end(JSON.stringify({ error: "Not found" }));
+      }
+      res.statusCode = out.status;
+      const html = out.type === "text/html";
+      res.setHeader("content-type", html ? "text/html; charset=utf-8" : "application/json");
+      if (html) res.setHeader("content-security-policy", CSP());
+      res.end(html ? String(out.body) : JSON.stringify(out.body));
+    };
+  }
+  return { store, fetch: fetchHandler, express: node, node };
+}
+var STYLE = `body{font:15px/1.55 system-ui,-apple-system,sans-serif;max-width:560px;margin:40px auto;padding:0 16px;color:#111;background:#fff}
+@media (prefers-color-scheme:dark){body{color:#eee;background:#111}table td{border-color:#333}}
+h2{margin:0 0 12px}table{border-collapse:collapse;margin:12px 0}td{padding:6px 10px;border-bottom:1px solid #ddd}
+button{font:inherit;padding:10px 18px;border-radius:8px;border:1px solid #888;background:transparent;color:inherit;cursor:pointer;margin:4px 8px 4px 0}
+button.primary{background:#2563eb;border-color:#2563eb;color:#fff}.muted{color:#777;font-size:13px}#msg{margin-top:16px;font-weight:600}`;
+var B642 = `const b64u={enc:b=>btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/,''),dec:s=>Uint8Array.from(atob(s.replace(/-/g,'+').replace(/_/g,'/')+'='.repeat((4-s.length%4)%4)),c=>c.charCodeAt(0))};
+const post=(u,b)=>fetch(u,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(b)}).then(async r=>({ok:r.ok,body:await r.json().catch(()=>({}))}));
+const say=t=>{document.getElementById('msg').textContent=t};`;
+function approvalPage(p, status, devices) {
+  const a = p.act.action ?? {};
+  const params = Object.entries(a.params ?? {}).map(([k, v]) => `<tr><td>${esc(k)}</td><td><b>${esc(JSON.stringify(v))}</b></td></tr>`).join("");
+  const device = (d) => `<button class="primary" data-cred="${esc(d.credential_id)}">Approve${d.approver ? ` as ${esc(d.approver)}` : ""} \xB7 ${esc(d.label)}</button>`;
+  const choose = devices === null ? `<p><label>Your approver id <input id="who" autocomplete="username"></label> <button id="find">Continue</button></p><div id="devices"></div>` : devices.length ? `<div id="devices">${devices.map(device).join("")}</div>` : `<p class="muted">No passkey is enrolled for ${esc(p.role)} yet.</p>`;
+  const body = status === "pending" ? `${choose}<button id="refuse">Refuse</button>` : `<p><b>${esc(status)}</b></p>`;
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Approve: ${esc(a.type)}</title><style>${STYLE}</style>
+<h2>Approve as ${esc(p.role)}?</h2>
+<p><b>${esc(a.type)}</b>${a.subject ? ` for <b>${esc(a.subject)}</b>` : ""}, at <b>${esc(p.act.relying_party)}</b>, under ${esc(p.act.authority?.artifact?.meta?.artifact_id)} v${esc(p.act.authority?.artifact?.meta?.version)}.</p>
+<table>${params}</table>
+<p class="muted">Your passkey signs this exact change and nothing else. It expires at ${esc(p.act.expires_at)}.</p>
+${body}<div id="msg" data-id="${esc(p.id)}"></div>
+<script>${APPROVE_JS}</script>`;
+}
+var APPROVE_JS = `${B642}
+const id=document.getElementById('msg').dataset.id;
+async function approve(credential_id){
+  try{
+    const o=await post('/approve/'+id+'/options',{credential_id});
+    if(!o.ok) return say(o.body.error||'Not allowed.');
+    const a=await navigator.credentials.get({publicKey:{challenge:b64u.dec(o.body.challenge),rpId:o.body.rpId,allowCredentials:o.body.allowCredentials.map(c=>({type:c.type,id:b64u.dec(c.id)})),userVerification:'required',timeout:o.body.timeout}});
+    const r=await post('/approve/'+id+'/assertion',{credential_id,authenticator_data:b64u.enc(a.response.authenticatorData),client_data_json:b64u.enc(a.response.clientDataJSON),signature:b64u.enc(a.response.signature)});
+    say(r.ok?'Approved. You can close this page.':(r.body.error||'Not approved.'));
+    if(r.ok) document.querySelectorAll('button').forEach(b=>b.disabled=true);
+  }catch(e){say(e.name==='NotAllowedError'?'Cancelled.':String(e.message||e))}
+}
+async function refuse(){const r=await post('/approve/'+id+'/refuse',{});say(r.ok?'Refused.':(r.body.error||''));if(r.ok)document.querySelectorAll('button').forEach(b=>b.disabled=true)}
+function wire(root){root.querySelectorAll('[data-cred]').forEach(b=>b.addEventListener('click',()=>approve(b.dataset.cred)))}
+wire(document);
+document.getElementById('refuse')?.addEventListener('click',refuse);
+document.getElementById('find')?.addEventListener('click',async()=>{
+  const r=await post('/approve/'+id+'/devices',{approver:document.getElementById('who').value});
+  const box=document.getElementById('devices');box.textContent='';
+  if(!r.body.devices?.length) return say('No passkey of yours approves this.');
+  for(const d of r.body.devices){const b=document.createElement('button');b.className='primary';b.dataset.cred=d.credential_id;b.textContent='Approve \xB7 '+d.label;box.appendChild(b)}
+  wire(box);
+});`;
+function enrolPage(rpName) {
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Enrol a passkey</title><style>${STYLE}</style>
+<h2>Enrol a passkey for ${esc(rpName)}</h2>
+<p id="who" class="muted">Checking your enrolment link\u2026</p>
+<p><label>Name this device <input id="label" value="" placeholder="e.g. iPhone"></label></p>
+<button class="primary" id="go" disabled>Create passkey</button>
+<div id="msg"></div>
+<p class="muted">The passkey stays on your device. It can approve requests in your role and nothing else, and this link works once.</p>
+<script>${ENROL_JS}</script>`;
+}
+var ENROL_JS = `${B642}
+const token=location.hash.slice(1);let opts=null;
+(async()=>{const r=await post('/nomos/enrol/begin',{token});if(!r.ok){document.getElementById('who').textContent=r.body.error||'This link is not valid.';return}
+opts=r.body;document.getElementById('who').textContent='Enrolling '+opts.approver+' to approve as '+opts.roles.join(', ')+'.';document.getElementById('go').disabled=false})();
+async function enrol(){
+  try{
+    const c=await navigator.credentials.create({publicKey:{challenge:b64u.dec(opts.challenge),rp:opts.rp,user:{id:b64u.dec(opts.user.id),name:opts.user.name,displayName:opts.user.displayName},pubKeyCredParams:opts.pubKeyCredParams,authenticatorSelection:opts.authenticatorSelection,attestation:opts.attestation,timeout:opts.timeout,excludeCredentials:opts.excludeCredentials.map(x=>({type:x.type,id:b64u.dec(x.id)}))}});
+    const r=await post('/nomos/enrol/finish',{token,label:document.getElementById('label').value,credential_id:b64u.enc(c.rawId),client_data_json:b64u.enc(c.response.clientDataJSON),attestation_object:b64u.enc(c.response.attestationObject)});
+    say(r.ok?'Enrolled. This device can now approve as '+r.body.roles.join(', ')+'.':(r.body.error||'Not enrolled.'));
+    if(r.ok) document.getElementById('go').disabled=true;
+  }catch(e){say(e.name==='NotAllowedError'?'Cancelled.':String(e.message||e))}
+}
+document.getElementById('go').addEventListener('click',enrol);`;
+var scriptHash = (js) => `'sha256-${btoa(String.fromCharCode(...sha256(utf82(js))))}'`;
+var CSP = () => `default-src 'none'; script-src ${scriptHash(APPROVE_JS)} ${scriptHash(ENROL_JS)}; style-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'`;
+
 // src/act/carrier.ts
 var STATUS_OF = { AUTHORIZED: "committed", ESCALATED: "escalated", INCOMPLETE: "incomplete", DENIED: "denied", REPLAYED: "replayed" };
 var NomosActError = class extends Error {
@@ -5798,6 +6875,7 @@ async function act(o) {
     }
   }
   const testimony = [];
+  const available = [...issuer2.key_certs ?? []];
   const unavailable = [];
   for (const claim of witnessed) {
     const w = witnesses.find((x) => x.claims.includes(claim));
@@ -5821,8 +6899,10 @@ async function act(o) {
       continue;
     }
     testimony.push(t);
+    if (Array.isArray(body2.key_certs)) available.push(...body2.key_certs);
   }
-  const theAct = buildAct({ relyingParty: rp.relying_party_id, action: o.action, artifact, keyCerts: issuer2.key_certs, testimony, presenterFacts: o.presenterFacts, inForce, windowSeconds });
+  const theAct = buildAct({ relyingParty: rp.relying_party_id, action: o.action, artifact, keyCerts: [], testimony, presenterFacts: o.presenterFacts, inForce, windowSeconds });
+  present(theAct, available);
   let { status, body } = await submit(f, rp.act_endpoint, theAct);
   let approvalUrl;
   while (status === 202 && body.decision === "ESCALATED") {
@@ -5830,16 +6910,18 @@ async function act(o) {
     const endpoint = (issuer2.approvals ?? []).find((a) => a.role === role)?.endpoint;
     if (!endpoint) return done("escalated", body, theAct, { summary: `Needs approval from ${role}, and ${issuer2.issuer_id} publishes no approval endpoint for that role.` });
     const deadline = Math.min(Date.parse(theAct.expires_at), Date.now() + (o.approvalTimeoutMs ?? Infinity));
-    const consent = await requestConsent(f, endpoint, role, theAct, deadline, o.pollMs ?? 1e3, (url) => {
+    const answer2 = await requestConsent(f, endpoint, role, theAct, deadline, o.pollMs ?? 1e3, (url) => {
       approvalUrl = url;
       o.onApproval?.({ role, url, actDigest: body.act_digest });
     });
-    if (consent === "refused") return done("denied", body, theAct, { summary: `The ${role} refused this action.` });
-    if (!consent) {
+    if (answer2 === "refused") return done("denied", body, theAct, { summary: `The ${role} refused this action.` });
+    if (!answer2) {
       const expired = Date.now() >= Date.parse(theAct.expires_at);
       return done("escalated", body, theAct, { approvalUrl, summary: expired ? `Not approved by ${role} before the Act expired at ${theAct.expires_at}; build a new Act to ask again.` : `Waiting for approval from ${role}${approvalUrl ? ` at ${approvalUrl}` : ""}. Not approved yet; this Act stays valid until ${theAct.expires_at}.` });
     }
-    theAct.consents.push(consent);
+    theAct.consents.push(answer2.consent);
+    if (Array.isArray(answer2.keyCerts)) available.push(...answer2.keyCerts);
+    present(theAct, available);
     const before = Number(body.consents_valid ?? 0);
     ({ status, body } = await submit(f, rp.act_endpoint, theAct));
     if (status === 202 && Number(body.consents_valid ?? 0) <= before) {
@@ -5860,6 +6942,13 @@ async function act(o) {
     summary: kind === "committed" ? `Committed by ${rp.relying_party_id}${body.by_consent ? ", with approval" : ""}.` : kind === "denied" ? `Denied by rule ${body.rule ?? "(default)"}.` : kind === "replayed" ? "Already committed; this is the original receipt." : `Refused: ${body.decision}${body.reason_code ? ` (${body.reason_code})` : ""}.${body.hint ? " " + body.hint : ""}`
   });
 }
+function present(theAct, available) {
+  const set = presentedCertificates(available, theAct);
+  if (set.length > MAX_PRESENTED) {
+    throw new NomosActError(`This Act relies on ${set.length} certificates; at most ${MAX_PRESENTED} can be presented (NOMOS-SPEC-008 \xA76 step 1). The issuer's hierarchy is too deep for one Act.`);
+  }
+  theAct.authority.key_certs = set;
+}
 function done(status, verdict, theAct, extra) {
   return { status, verdict, act: theAct, ...extra };
 }
@@ -5877,13 +6966,13 @@ async function submit(f, endpoint, theAct) {
 async function requestConsent(f, endpoint, role, theAct, deadline, pollMs, onPending) {
   const res = await f(endpoint, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ role, act: { ...theAct, consents: [] } }) });
   const body = await res.json().catch(() => ({}));
-  if (res.status === 200 && body.status === "approved") return body.consent;
+  if (res.status === 200 && body.status === "approved") return { consent: body.consent, keyCerts: body.key_certs };
   if (res.status !== 202 || !body.poll_url) return null;
   onPending(body.approval_url);
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, pollMs));
     const p = await (await f(body.poll_url)).json().catch(() => ({}));
-    if (p.status === "approved") return p.consent;
+    if (p.status === "approved") return { consent: p.consent, keyCerts: p.key_certs };
     if (p.status === "refused") return "refused";
     if (p.status === "expired") return null;
   }
@@ -5891,7 +6980,6 @@ async function requestConsent(f, endpoint, role, theAct, deadline, pollMs, onPen
 }
 
 // src/act/roles.ts
-var import_node_crypto3 = require("crypto");
 function serve(route) {
   async function fetchHandler(request) {
     const out = await route({ method: request.method, path: new URL(request.url).pathname, json: () => request.json() });
@@ -5906,7 +6994,7 @@ function serve(route) {
         if (req.body && typeof req.body === "object" && !(req.body instanceof Uint8Array)) return req.body;
         const chunks = [];
         for await (const c of req) chunks.push(c);
-        return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        return JSON.parse(fromUtf82(concat2(...chunks)) || "{}");
       };
       let out;
       try {
@@ -5930,7 +7018,9 @@ var day = 864e5;
 function issuer(o) {
   const byId = new Map(o.authorities.map((a) => [a.meta.artifact_id, a]));
   const base = o.origin.replace(/\/$/, "");
-  const document = () => ({
+  const pool = async () => typeof o.keyCerts === "function" ? await o.keyCerts() : o.keyCerts;
+  const revocationsUrl = o.revocations ? `${base}/nomos/revocations` : o.revocationsUrl;
+  const build = (keyCerts) => ({
     nomos_document: "issuer",
     version: "1",
     issuer_id: o.issuerId,
@@ -5941,17 +7031,24 @@ function issuer(o) {
       artifact_url: `${base}/nomos/authorities/${encodeURIComponent(a.meta.artifact_id)}.nomos`,
       in_force_url: `${base}/nomos/authorities/${encodeURIComponent(a.meta.artifact_id)}/in-force`
     })),
-    key_certs: o.keyCerts,
+    key_certs: keyCerts,
     ...o.witnesses ? { witnesses: o.witnesses } : {},
     ...o.approvals ? { approvals: o.approvals } : {},
-    ...o.revocationsUrl ? { revocations_url: o.revocationsUrl } : {},
+    ...revocationsUrl ? { revocations_url: revocationsUrl } : {},
     valid_until: new Date(Date.now() + day).toISOString()
   });
+  const document = () => {
+    if (typeof o.keyCerts === "function") throw new Error("issuer(): keyCerts is a function, so the document must be read with `await resolveDocument()`");
+    return build(o.keyCerts);
+  };
+  const resolveDocument = async () => build(await pool());
   return {
     document,
+    resolveDocument,
     ...serve(async ({ method, path }) => {
       if (method !== "GET") return null;
-      if (path === WELL_KNOWN.issuer) return { status: 200, body: document() };
+      if (path === WELL_KNOWN.issuer) return { status: 200, body: await resolveDocument() };
+      if (path === "/nomos/revocations" && o.revocations) return { status: 200, body: await o.revocations() };
       const m = path.match(/^\/nomos\/authorities\/([^/]+?)(\.nomos|\/in-force)$/);
       const art = m && byId.get(decodeURIComponent(m[1]));
       if (!art) return null;
@@ -5986,13 +7083,14 @@ function witness(o) {
       if (value2 === void 0) return { status: 404, body: { error: `${o.witnessId} knows nothing about ${about}.` } };
       const max = o.maxValiditySeconds ?? 900;
       const seconds = Math.max(1, Math.min(max, Number(req?.valid_for_seconds) || max));
-      return { status: 200, body: { testimony: await signTestimony(o.signer, { claim, value: value2, about, validUntil: new Date(Date.now() + seconds * 1e3) }) } };
+      return { status: 200, body: { testimony: await signTestimony(o.signer, { claim, value: value2, about, validUntil: new Date(Date.now() + seconds * 1e3) }), ...o.keyCerts?.length ? { key_certs: o.keyCerts } : {} } };
     })
   };
 }
 function approver(o) {
   const base = o.origin.replace(/\/$/, "");
   const pending = /* @__PURE__ */ new Map();
+  const chain = o.keyCerts?.length ? { key_certs: o.keyCerts } : {};
   const statusOf = (p) => p.status === "pending" && Date.parse(p.act.expires_at) < Date.now() ? "expired" : p.status;
   return {
     pending,
@@ -6002,9 +7100,9 @@ function approver(o) {
         if (!o.roles.includes(role)) return { status: 404, body: { error: `This approver does not consent as ${role}.` } };
         if (o.decide === "auto" || typeof o.decide === "function") {
           const ok = o.decide === "auto" ? true : await o.decide({ role, act: act2 });
-          return ok ? { status: 200, body: { status: "approved", consent: await signConsent(o.signer, act2, role) } } : { status: 200, body: { status: "refused" } };
+          return ok ? { status: 200, body: { status: "approved", consent: await signConsent(o.signer, act2, role), ...chain } } : { status: 200, body: { status: "refused" } };
         }
-        const id = (0, import_node_crypto3.randomUUID)();
+        const id = randomUUID();
         pending.set(id, { role, act: act2, status: "pending" });
         return { status: 202, body: { approval_id: id, status: "pending", poll_url: `${base}/nomos/approvals/${id}`, approval_url: `${base}/approve/${id}` } };
       }
@@ -6013,7 +7111,7 @@ function approver(o) {
         const p = pending.get(m[1]);
         if (!p) return null;
         const s = statusOf(p);
-        return { status: 200, body: { status: s, ...s === "approved" ? { consent: p.consent } : {} } };
+        return { status: 200, body: { status: s, ...s === "approved" ? { consent: p.consent, ...chain } : {} } };
       }
       m = path.match(/^\/approve\/([0-9a-f-]+)(\/(approve|refuse))?$/);
       if (m) {
@@ -6033,23 +7131,24 @@ function approver(o) {
     })
   };
 }
-var esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+var esc2 = (s) => String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 function page(p, status, id) {
   const a = p.act.action ?? {};
-  const params = Object.entries(a.params ?? {}).map(([k, v]) => `<tr><td>${esc(k)}</td><td><b>${esc(JSON.stringify(v))}</b></td></tr>`).join("");
+  const params = Object.entries(a.params ?? {}).map(([k, v]) => `<tr><td>${esc2(k)}</td><td><b>${esc2(JSON.stringify(v))}</b></td></tr>`).join("");
   const buttons = status === "pending" ? `<form method="post" action="/approve/${id}/approve" style="display:inline"><button style="padding:10px 18px">Approve</button></form>
-       <form method="post" action="/approve/${id}/refuse" style="display:inline"><button style="padding:10px 18px">Refuse</button></form>` : `<p><b>${esc(status)}</b></p>`;
-  return `<!doctype html><meta charset="utf-8"><title>Approve: ${esc(a.type)}</title>
+       <form method="post" action="/approve/${id}/refuse" style="display:inline"><button style="padding:10px 18px">Refuse</button></form>` : `<p><b>${esc2(status)}</b></p>`;
+  return `<!doctype html><meta charset="utf-8"><title>Approve: ${esc2(a.type)}</title>
 <body style="font:15px system-ui;max-width:560px;margin:40px auto;padding:0 16px">
-<h2>Approve as ${esc(p.role)}?</h2>
-<p><b>${esc(a.type)}</b>${a.subject ? ` for <b>${esc(a.subject)}</b>` : ""}, at <b>${esc(p.act.relying_party)}</b>, under ${esc(p.act.authority?.artifact?.meta?.artifact_id)} v${esc(p.act.authority?.artifact?.meta?.version)}.</p>
+<h2>Approve as ${esc2(p.role)}?</h2>
+<p><b>${esc2(a.type)}</b>${a.subject ? ` for <b>${esc2(a.subject)}</b>` : ""}, at <b>${esc2(p.act.relying_party)}</b>, under ${esc2(p.act.authority?.artifact?.meta?.artifact_id)} v${esc2(p.act.authority?.artifact?.meta?.version)}.</p>
 <table style="border-collapse:collapse" cellpadding="4">${params}</table>
-<p style="color:#666">Your approval signs this exact change (digest ${esc(bindingDigest(p.act).slice(0, 16))}\u2026) and nothing else. It expires at ${esc(p.act.expires_at)}.</p>
+<p style="color:#666">Your approval signs this exact change (digest ${esc2(bindingDigest(p.act).slice(0, 16))}\u2026) and nothing else. It expires at ${esc2(p.act.expires_at)}.</p>
 ${buttons}</body>`;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ACT_MEDIA_TYPE,
+  MAX_PRESENTED,
   Nomos,
   NomosAPIError,
   NomosActError,
@@ -6064,31 +7163,53 @@ ${buttons}</body>`;
   NomosRateLimitError,
   NomosValidationError,
   NomosWebhookSignatureError,
+  RegistryError,
+  RevocationUnavailable,
   WELL_KNOWN,
   accept,
   act,
+  applyToolBindings,
   approver,
   bindingDigest,
   buildAct,
   can,
+  certificateRegistry,
   certify,
+  describeSuggestion,
   fetchDocument,
   generateSigner,
   issuer,
   kidOf,
   localSigner,
+  memoryPasskeyStore,
+  memoryRegistryStore,
   memoryStore,
   nomos,
   originOf,
+  parseToolBindings,
+  passkeyApprover,
+  postgresPasskeyStore,
+  postgresRegistryStore,
+  postgresStore,
+  presentedCertificates,
+  readAttestation,
+  reliedKids,
+  revocationListCertificates,
+  revocationSource,
   seal,
   seededSigner,
   signConsent,
+  signEnrolmentToken,
   signInForce,
+  signRevocation,
+  signRevocationList,
   signTestimony,
   statusFor,
+  suggestToolBindings,
   verifyAct,
   verifyArtifact,
   verifyChain,
+  verifyEnrolmentToken,
   verifySeal,
   witness
 });