@nomosprotocol/sdk 2.0.0 → 2.3.1

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { CurrencyPolicy, ActVerdict } from '@nomosprotocol/verify';
+import { CurrencyPolicy, ActVerdict, KeyCertificate as KeyCertificate$2, RevocationStatement, RevocationList, ScopeTerms } from '@nomosprotocol/verify';
 export { bindingDigest, verifyAct, verifyArtifact, verifySeal } from '@nomosprotocol/verify';
 
 interface VerifyDecisionParams {
@@ -395,7 +395,7 @@ interface GenerateGovernanceResult {
     download_url?: string;
 }
 interface NomosConfig {
-    /** Base URL override — defaults to https://nomos.ai */
+    /** Base URL override — defaults to https://www.nomosprotocol.com */
     baseUrl?: string;
     /** Max retries on 429 / 5xx (default: 3) */
     maxRetries?: number;
@@ -776,7 +776,7 @@ declare class Nomos {
      * return shape either way, so calling code never needs to know which rail answered.
      *
      * @example
-     * const client = new Nomos('nms_live_...');
+     * const client = new Nomos('nmk_...');
      * const verdict = await client.can({ artifact_id: 'loan_approval_v1', credit_score: 720 });
      */
     can(params: CanParams, opts?: CanOptions): Promise<CanResult>;
@@ -807,6 +807,86 @@ declare const nomos: {
  */
 declare function verifyChain(params: VerifyChainParams, opts?: VerifyChainOptions): Promise<VerifyChainResult>;
 
+/**
+ * Tool bindings: which of a tool's arguments is which fact a sealed policy reads. A policy reads
+ * `loan_amount`; a tool sends `amount_cents`. Without a binding the policy has nothing to decide on,
+ * and a fail-closed check holds every call.
+ *
+ * A binding decides what a policy sees, so it is built to be safe:
+ *  - It is an explicit, reviewed file. Suggestions are proposals, marked unreviewed.
+ *  - A fact only ever comes from an argument of the call. There are no constants, so nobody can
+ *    hard-code a fact to quiet a policy.
+ *  - With a binding, only bound facts reach the policy, so an agent can't state a fact the tool
+ *    wouldn't act on by adding an argument of that name.
+ *  - A missing argument or an unmapped value leaves the fact undecided. It is never guessed.
+ *
+ * Pure: no I/O, no model. Specified in NOMOS-SPEC-011 (Draft), nomos-spec/spec; see also
+ * docs/design-notes/tool-fact-binding.md.
+ */
+interface FactBinding {
+    /** The argument this fact comes from. Dots reach into objects: `customer.kyc`. */
+    arg: string;
+    /** Multiply a number: `amount_cents` into dollars is 0.01. */
+    scale?: number;
+    /** Translate a value: { "ok": "verified" }. A value not listed leaves the fact undecided. */
+    map?: Record<string, string | number | boolean>;
+}
+interface ToolBindings {
+    version: 1;
+    /** The sealed policy these facts belong to. */
+    artifact: string;
+    /** False until a person has checked it. The guard won't enforce an unreviewed file. */
+    reviewed: boolean;
+    tools: Record<string, {
+        facts: Record<string, FactBinding>;
+    }>;
+}
+/** Reads a bindings file, refusing anything it doesn't fully understand. Throws with a plain reason. */
+declare function parseToolBindings(raw: unknown): ToolBindings;
+interface UnresolvedFact {
+    fact: string;
+    arg: string;
+    why: 'missing' | 'not_a_number' | 'not_a_value' | 'not_in_map';
+}
+/** The facts a policy gets for this call, and which it couldn't get. */
+declare function applyToolBindings(bindings: ToolBindings, tool: string, args: Record<string, unknown>): {
+    inputs: Record<string, string | number | boolean>;
+    unresolved: UnresolvedFact[];
+};
+interface ToolDescription {
+    name: string;
+    inputSchema?: {
+        properties?: Record<string, any>;
+    } | null;
+}
+interface PolicyField {
+    name: string;
+    type?: string;
+    description?: string | null;
+    values?: string[];
+}
+interface BindingProposal {
+    tool: string;
+    fact: string;
+    arg: string;
+    confidence: 'exact' | 'likely';
+    why: string;
+    scale?: number;
+}
+interface BindingSuggestion {
+    bindings: ToolBindings;
+    proposals: BindingProposal[];
+    unbound: Array<{
+        tool: string;
+        fact: string;
+        candidates: string[];
+    }>;
+}
+/** Proposes bindings from names alone, for a person to check. Never guesses a value translation. */
+declare function suggestToolBindings(artifact: string, tools: ToolDescription[], fields: PolicyField[]): BindingSuggestion;
+/** A plain report of a suggestion, for the person who has to check it. */
+declare function describeSuggestion(s: BindingSuggestion): string;
+
 type SignatureSuite = 'Ed25519' | 'ES256';
 interface Signer {
     /** NOMOS-SPEC-001 §8.4 key id of the public key. */
@@ -818,9 +898,11 @@ interface Signer {
     /** Signs the exact payload bytes. Returns the signature in the suite's encoding, base64. */
     sign(payload: Uint8Array): Promise<string>;
 }
+/** The key id of a canonical Ed25519 or P-256 public key (NOMOS-SPEC-010 §3.1–§3.2). Throws for
+ *  any other key: a non-canonical key has no key id, because no verifier would accept it. */
 declare function kidOf(publicKeyPem: string): string;
-/** A signer over a private key held in this process: PKCS#8 PEM. For development and tests;
- *  in production pass a Signer backed by your KMS or HSM. */
+/** A signer over a private key held in this process: PKCS#8 PEM (or SEC1 for P-256). For
+ *  development and tests; in production pass a Signer backed by your KMS or HSM. */
 declare function localSigner(privateKeyPem: string): Signer;
 /** A fresh in-memory key. For development and tests only. */
 declare function generateSigner(algorithm?: SignatureSuite): Signer & {
@@ -1008,7 +1090,9 @@ interface Receipt {
 interface AcceptTransaction<Tx = unknown> {
     /** Records the nonce. false if it was already recorded (a concurrent duplicate). */
     claimNonce(nonce: string): Promise<boolean>;
-    putReceipt(nonce: string, receipt: Receipt): Promise<void>;
+    /** Stores the receipt, and the exact Act it verified (SPEC-008 §9: the receipt plus a retained
+     *  copy of the Act let a third party re-run the verification). */
+    putReceipt(nonce: string, receipt: Receipt, act?: unknown): Promise<void>;
     tx: Tx;
 }
 interface AcceptStore<Tx = unknown> {
@@ -1042,7 +1126,10 @@ interface AcceptOptions<Tx = unknown> {
     /** SPEC-008 §5.1 / SPEC-009 §6.3. Long enough for a person to approve. Default 900. */
     maxWindowSeconds?: number;
     maxActBytes?: number;
-    /** Current revocation state (SPEC-006, SPEC-007 §5). Read on every verification. */
+    /** Current revocation state (SPEC-006, SPEC-007 §5), read once per Act. Use revocationSource()
+     *  for an issuer's published list. If it throws, the Act is refused with 503 and nothing is
+     *  committed: revocations that cannot be checked are never treated as "nothing revoked"
+     *  (SPEC-007 rev. 1.10 §5.6). */
     revocations?: () => Promise<{
         kids?: Set<string>;
         certs?: Set<string>;
@@ -1068,7 +1155,7 @@ interface Answer {
 declare const statusFor: (decision: string) => number;
 declare const ACT_MEDIA_TYPE = "application/nomos-act+json";
 /** Nonces and receipts in memory, one transaction at a time. Lost on restart, single process:
- *  for development and tests only. Use a database-backed store in production. */
+ *  for development and tests only. In production use postgresStore() or your own AcceptStore. */
 declare function memoryStore(): AcceptStore<null>;
 declare function accept<Tx = unknown>(o: AcceptOptions<Tx>): {
     handle: (req: {
@@ -1082,6 +1169,327 @@ declare function accept<Tx = unknown>(o: AcceptOptions<Tx>): {
     node: () => (req: any, res: any, next?: () => void) => Promise<void>;
 };
 
+/**
+ * postgresStore() — the production store for accept(): nonces, receipts and the Acts themselves,
+ * in your own Postgres, in the same transaction as your own change.
+ *
+ *   import pg from 'pg';
+ *   const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });
+ *   const store = postgresStore(pool);
+ *   await store.migrate();                                  // once; or apply store.schema yourself
+ *   accept({ ..., store, commit: async (action, { tx }) => tx.query('INSERT INTO orders …', […]) });
+ *
+ * What it guarantees (NOMOS-SPEC-008 §8, NOMOS-SPEC-009 §6.3–§6.4):
+ *  - One transaction. `commit` receives `tx`, the very client the nonce is recorded on, so your
+ *    change, the nonce and the receipt commit together or not at all.
+ *  - One commit per Act, under any concurrency. The nonce is the table's primary key; a second
+ *    submission of the same Act waits for the first transaction and then finds the nonce taken,
+ *    so it is answered REPLAYED with the first receipt. If the first rolled back, the second
+ *    commits instead: a nonce is recorded only when the change is.
+ *  - An audit trail. Each row keeps the receipt and the exact Act it verified, so a third party
+ *    can re-run SPEC-008 §6 later (SPEC-008 §9). Rows are never deleted by this store: how long
+ *    to retain them is your policy. They must outlive the Acts' validity windows at least, or a
+ *    replayed Act could commit twice.
+ *
+ * It depends on no driver: pass a `pg` Pool (node-postgres) or anything with the same two
+ * methods, for example a pool adapter over postgres.js, Neon's serverless driver or PGlite.
+ */
+
+/** The part of a node-postgres client this store uses. */
+interface PgClient {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: any[];
+        rowCount: number | null;
+    }>;
+}
+/** The part of a node-postgres Pool this store uses. */
+interface PgPool extends PgClient {
+    connect(): Promise<PgClient & {
+        release(err?: unknown): void;
+    }>;
+}
+interface PostgresStoreOptions {
+    /** Table name, optionally schema-qualified. Default `nomos_acts`. */
+    table?: string;
+}
+declare function postgresStore(pool: PgPool, opts?: PostgresStoreOptions): AcceptStore<PgClient> & {
+    schema: string;
+    migrate(): Promise<void>;
+};
+
+/**
+ * Certificates and revocations, as the carrier and the relying party need them.
+ *
+ *   presentedCertificates(available, act)   NOMOS-SPEC-009 0.2.0 §6.5: exactly the certificates an Act presents
+ *   signRevocation(parent, target, reason)  NOMOS-SPEC-007 rev. 1.10 §5.1: revoke a key or one certificate
+ *   signRevocationList(signer, …)           rev. 1.10 §5.3: a list a relying party can check for itself
+ *   revocationSource({ url, root, … })      rev. 1.10 §5.3a, §5.6: current revocations for accept(), fail closed when stale
+ */
+
+declare const MAX_PRESENTED = 20;
+/** The kids an Act relies on: its seal's key, every witness's and every approver's. */
+declare function reliedKids(act: any): string[];
+/** NOMOS-SPEC-009 0.2.0 §6.5: the closure of `available` over the kids `act` relies on, each
+ *  certificate once. Deterministic, so two carriers with the same certificates present the same set. */
+declare function presentedCertificates(available: KeyCertificate$2[], act: any): KeyCertificate$2[];
+/** NOMOS-SPEC-007 rev. 1.10 §5.1: `parent` revokes a key it certified, or one certificate it issued. */
+declare function signRevocation(parent: Signer, target: {
+    kid: string;
+} | {
+    certificate: KeyCertificate$2;
+}, reason: string, issuedAt?: Date): Promise<RevocationStatement>;
+/** NOMOS-SPEC-007 rev. 1.10 §5.3: a signed, dated list. `keyCerts` should be the closure over
+ *  the signers and what they revoke (and the list signer), so any relying party can check it. */
+declare function signRevocationList(signer: Signer, statements: RevocationStatement[], keyCerts?: KeyCertificate$2[], generatedAt?: Date): Promise<RevocationList>;
+/** The certificates a revocation list should carry (rev. 1.10 §5.3): the closure over every
+ *  statement's signer and target, and the list's own signer, within the publisher's certificates. */
+declare function revocationListCertificates(available: KeyCertificate$2[], statements: RevocationStatement[], listSignerKid: string): KeyCertificate$2[];
+declare class RevocationUnavailable extends Error {
+    readonly retryAfterSeconds: number;
+    constructor(message: string, retryAfterSeconds: number);
+}
+interface RevocationSourceOptions {
+    /** The issuer's revocation list (its NOMOS-SPEC-009 `revocations_url`). */
+    url: string;
+    /** The root you pin: statements count only from parents it reaches; the list's date only from a signer it reaches. */
+    root: string;
+    /** How old the newest current list may be before accept() refuses to commit (rev. 1.10 §5.6). Policy, not protocol. Default 3600. */
+    maxAgeSeconds?: number;
+    /** Your own certificates, for statements whose certificates the list does not carry. */
+    ownCerts?: KeyCertificate$2[];
+    /** How long to reuse a fetched list before fetching again. Default 60 s, as the reference deployment publishes. */
+    refreshSeconds?: number;
+    fetch?: typeof fetch;
+    now?: () => Date;
+}
+/**
+ * Current revocations from an issuer's list, for accept({ revocations }).
+ *
+ * Every counted statement is kept for good: a later fetch that fails, or a list that omits it,
+ * never un-revokes a key (rev. 1.10 §5.6). When the newest list with an established `as_of` is
+ * older than `maxAgeSeconds`, it throws RevocationUnavailable, and accept() refuses to commit
+ * with 503 and Retry-After rather than acting as if nothing were revoked.
+ */
+declare function revocationSource(o: RevocationSourceOptions): () => Promise<{
+    kids: Set<string>;
+    certs: Set<string>;
+}>;
+
+/**
+ * certificateRegistry() — an institution's certificates and revocations, managed rather than
+ * minted in code.
+ *
+ *   const registry = certificateRegistry({ root: ROOT_PUBLIC_PEM, store: postgresRegistryStore(pool) });
+ *   await registry.issue({ parent: rootSigner, child: finance, scope: 'claim:budget_remaining', days: 365 });
+ *   await registry.revokeKey({ parent: rootSigner, kid: lostPhone.kid, reason: 'Phone lost' });
+ *   issuer({ …, keyCerts: () => registry.pool(), revocations: () => registry.revocationList(listSigner) });
+ *   witness({ …, keyCerts: await registry.chainFor(finance.kid) });
+ *
+ * Everything it writes is exactly NOMOS-SPEC-007: certificates (§3), revocation statements and
+ * lists (rev. 1.10 §5). It refuses, at issue time, what a relying party would refuse later: a
+ * parent the root does not reach, a scope wider than the parent's, a suite the parent may not
+ * sign under, a malformed scope. Nothing it publishes is trusted because the registry published
+ * it: every relying party checks it again.
+ */
+
+/** Where a registry keeps its certificates and revocation statements. Append-only. */
+interface RegistryStore {
+    certificates(): Promise<KeyCertificate$2[]>;
+    addCertificate(c: KeyCertificate$2): Promise<void>;
+    statements(): Promise<RevocationStatement[]>;
+    addStatement(s: RevocationStatement): Promise<void>;
+}
+/** In memory, for tests and development. */
+declare function memoryRegistryStore(): RegistryStore;
+declare class RegistryError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+interface IssueOptions {
+    parent: Signer;
+    child: {
+        kid: string;
+        publicKeyPem: string;
+    };
+    scope?: string;
+    /** Validity: `expiresAt`, or `days` from now. */
+    expiresAt?: Date;
+    days?: number;
+    issuedAt?: Date;
+}
+declare function certificateRegistry(o: {
+    root: string;
+    store: RegistryStore;
+    now?: () => Date;
+}): {
+    rootKid: string;
+    pool: (filter?: (c: KeyCertificate$2) => boolean) => Promise<KeyCertificate$2[]>;
+    /** NOMOS-SPEC-007 §3: certify `child` under `parent`. Refuses anything a verifier would refuse. */
+    issue(io: IssueOptions): Promise<KeyCertificate$2>;
+    /** rev. 1.10 §5.1: `parent` revokes a key it certified. The key is dead on every path. */
+    revokeKey(io: {
+        parent: Signer;
+        kid: string;
+        reason: string;
+    }): Promise<RevocationStatement>;
+    /** rev. 1.10 §5.1: withdraw one certificate; the key stays valid under any other. */
+    revokeCertificate(io: {
+        parent: Signer;
+        fingerprint: string;
+        reason: string;
+    }): Promise<RevocationStatement>;
+    /** The certificates that connect `kid` to the root: what a witness or approver returns with
+     *  what it signs (SPEC-009 0.2.0 §4, §5). */
+    chainFor(kid: string): Promise<KeyCertificate$2[]>;
+    /** How `kid` is reached from the root, and with which effective scopes, or why it is not. */
+    check(kid: string): Promise<{
+        ok: true;
+        scopes: ScopeTerms[];
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    certificates: () => Promise<KeyCertificate$2[]>;
+    statements: () => Promise<RevocationStatement[]>;
+    /** rev. 1.10 §5.3: the signed list, carrying the certificates that make it checkable. The
+     *  signer should be reached from the root, or the list establishes no date (§5.3). */
+    revocationList(signer: Signer): Promise<RevocationList>;
+};
+type CertificateRegistry = ReturnType<typeof certificateRegistry>;
+/** The registry in your own Postgres (two append-only tables), for an issuer that runs on more
+ *  than one instance. Same structural pool as postgresStore(). */
+declare function postgresRegistryStore(pool: {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: any[];
+    }>;
+}, opts?: {
+    prefix?: string;
+}): RegistryStore & {
+    schema: string;
+    migrate(): Promise<void>;
+};
+
+/** A registration's authenticator data, and the passkey's public key as canonical SPKI PEM. */
+declare function readAttestation(attestationObject: Uint8Array): {
+    authData: Uint8Array;
+    flags: number;
+    credentialId: Uint8Array;
+    publicKeyPem: string;
+};
+interface EnrolmentClaims {
+    approver: string;
+    roles: string[];
+    origin: string;
+    expires_at: string;
+    nonce: string;
+}
+/** Sign a single-use enrolment link for one person (`nomos enroll` does this). */
+declare function signEnrolmentToken(authority: Signer, c: {
+    approver: string;
+    roles: string[];
+    origin: string;
+    expiresAt: Date;
+}): Promise<string>;
+/** The claims of a valid, unexpired link for this origin, or the reason it is not one. */
+declare function verifyEnrolmentToken(token: string, authorityPem: string, origin: string, now: Date): EnrolmentClaims | {
+    error: string;
+};
+interface PasskeyCredential {
+    credential_id: string;
+    approver: string;
+    roles: string[];
+    kid: string;
+    public_key_pem: string;
+    label: string;
+    created_at: string;
+}
+interface PendingApproval {
+    id: string;
+    role: string;
+    act: any;
+    status: 'pending' | 'approved' | 'refused';
+    created_at: string;
+    /** Every ceremony offered, by its challenge: the consent fields fixed before the person was
+     *  asked (§4.5). Append-only, so asking again never invalidates a ceremony already in flight. */
+    attempts: Record<string, Attempt>;
+    consent?: any;
+    key_certs?: KeyCertificate[];
+}
+interface Attempt {
+    credential_id: string;
+    signed_at: string;
+    expires_at: string;
+}
+interface PasskeyStore {
+    /** Marks an enrolment link used. false if it already was: a link works once. */
+    claimToken(nonce: string): Promise<boolean>;
+    tokenUsed(nonce: string): Promise<boolean>;
+    saveEnrolmentChallenge(nonce: string, challenge: string): Promise<void>;
+    enrolmentChallenge(nonce: string): Promise<string | null>;
+    addCredential(c: PasskeyCredential): Promise<void>;
+    credentials(): Promise<PasskeyCredential[]>;
+    /** A new request. */
+    createPending(p: PendingApproval): Promise<void>;
+    pending(id: string): Promise<PendingApproval | null>;
+    /** Adds one ceremony, only while the request is pending. false otherwise. */
+    addAttempt(id: string, challenge: string, a: Attempt): Promise<boolean>;
+    /** pending → approved or refused, exactly once: false if the request was no longer pending.
+     *  The only transition out of pending, so no stale write can undo an approval. */
+    resolvePending(id: string, outcome: {
+        status: 'approved';
+        consent: any;
+        key_certs: KeyCertificate[];
+    } | {
+        status: 'refused';
+    }): Promise<boolean>;
+}
+declare function memoryPasskeyStore(): PasskeyStore;
+/** The same store in Postgres, for an approval service on more than one instance. */
+declare function postgresPasskeyStore(pool: {
+    query(text: string, values?: unknown[]): Promise<{
+        rows: any[];
+        rowCount: number | null;
+    }>;
+}, opts?: {
+    prefix?: string;
+}): PasskeyStore & {
+    schema: string;
+    migrate(): Promise<void>;
+};
+interface PasskeyApproverOptions {
+    origin: string;
+    roles: string[];
+    registry: CertificateRegistry;
+    /** Certifies passkeys. Certified with `consent:<the roles it may enrol>` and no `approver` term. */
+    enroller: Signer;
+    /** The public key whose signed enrolment links this service honours (an administrator's). */
+    enrolmentAuthority: string;
+    store?: PasskeyStore;
+    /** WebAuthn relying-party id. Default: the origin's hostname. */
+    rpId?: string;
+    rpName?: string;
+    /** How long a passkey's certificate is valid. Default 365 days. */
+    certificateDays?: number;
+    /** List the people who may approve, by name and device, on the approval page. Default false: the
+     *  approval link goes to the carrier, which is not trusted with your roster, so the person types
+     *  their approver id and is shown only their own devices. */
+    listApprovers?: boolean;
+    /** Called for every new request, e.g. to notify the people who can approve it (email, chat). */
+    onPending?: (request: {
+        id: string;
+        role: string;
+        act: any;
+        approvalUrl: string;
+    }) => void | Promise<void>;
+    now?: () => Date;
+}
+declare function passkeyApprover(o: PasskeyApproverOptions): {
+    store: PasskeyStore;
+    fetch: (request: Request) => Promise<Response>;
+    express: () => (req: any, res: any, next?: () => void) => Promise<any>;
+    node: () => (req: any, res: any, next?: () => void) => Promise<any>;
+};
+
 type ActStatus = 'committed' | 'escalated' | 'incomplete' | 'denied' | 'refused' | 'replayed';
 interface ActResult {
     status: ActStatus;
@@ -1139,8 +1547,13 @@ interface IssuerOptions {
     signer: Signer;
     /** Sealed artifacts, each the version currently in force. */
     authorities: any[];
-    /** The certificate pool carriers present: your sealing key, witnesses, approvers (SPEC-007). */
-    keyCerts: KeyCertificate[];
+    /** The pool carriers select from (SPEC-009 0.2.0 §3.2, §6.5): at least the certificates for your
+     *  sealing keys. May hold more than 20. A function is read on every request, so a certificate
+     *  registry can change it without a restart. */
+    keyCerts: KeyCertificate[] | (() => KeyCertificate[] | Promise<KeyCertificate[]>);
+    /** Your signed revocation list (SPEC-007 rev. 1.10 §5.3), served at /nomos/revocations and
+     *  advertised as revocations_url. */
+    revocations?: () => RevocationList | Promise<RevocationList>;
     witnesses?: string[];
     approvals?: Array<{
         role: string;
@@ -1153,6 +1566,7 @@ declare function issuer(o: IssuerOptions): {
     express: () => (req: any, res: any, next?: () => void) => Promise<any>;
     node: () => (req: any, res: any, next?: () => void) => Promise<any>;
     document: () => IssuerDocument;
+    resolveDocument: () => Promise<IssuerDocument>;
 };
 interface WitnessOptions {
     origin: string;
@@ -1169,6 +1583,9 @@ interface WitnessOptions {
         claim: string;
         about: string | null;
     }) => boolean | Promise<boolean>;
+    /** The certificates connecting your key toward the roots, returned with every statement
+     *  (SPEC-009 0.2.0 §4) so the issuer document need not list them. */
+    keyCerts?: KeyCertificate[];
     access?: string;
 }
 declare function witness(o: WitnessOptions): {
@@ -1182,6 +1599,9 @@ interface ApproverOptions {
     /** The person's key, certified with `consent:<role> approver:<their id>` (SPEC-007 rev. 1.9 §3.7). */
     signer: Signer;
     roles: string[];
+    /** The certificates connecting the person's key toward the roots, returned with every consent
+     *  (SPEC-009 0.2.0 §5) so the issuer document need not list every approver. */
+    keyCerts?: KeyCertificate[];
     /** 'page' (default): a person approves on a page this handler serves. 'auto': approve every
      *  request at once — development only. Or a function that decides. */
     decide?: 'page' | 'auto' | ((request: {
@@ -1202,4 +1622,4 @@ declare function approver(o: ApproverOptions): {
     pending: Map<string, Pending>;
 };
 
-export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BuildActOptions, type CanOptions, type CanParams, type CanResult, type CanVerdict, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type Receipt, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type SignatureSuite, type Signer, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, approver, buildAct, can, certify, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryStore, nomos, originOf, seal, seededSigner, signConsent, signInForce, signTestimony, statusFor, verifyChain, witness };
+export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BindingProposal, type BindingSuggestion, type BuildActOptions, type CanOptions, type CanParams, type CanResult, type CanVerdict, type CertificateRegistry, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type EnrolmentClaims, type FactBinding, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssueOptions, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, MAX_PRESENTED, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type PasskeyApproverOptions, type PasskeyCredential, type PasskeyStore, type PendingApproval, type PgClient, type PgPool, type PolicyField, type PostgresStoreOptions, type Receipt, RegistryError, type RegistryStore, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type RevocationSourceOptions, RevocationUnavailable, type SignatureSuite, type Signer, type ToolBindings, type ToolDescription, type UnresolvedFact, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, applyToolBindings, approver, buildAct, can, certificateRegistry, certify, describeSuggestion, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryPasskeyStore, memoryRegistryStore, memoryStore, nomos, originOf, parseToolBindings, passkeyApprover, postgresPasskeyStore, postgresRegistryStore, postgresStore, presentedCertificates, readAttestation, reliedKids, revocationListCertificates, revocationSource, seal, seededSigner, signConsent, signEnrolmentToken, signInForce, signRevocation, signRevocationList, signTestimony, statusFor, suggestToolBindings, verifyChain, verifyEnrolmentToken, witness };