@nomosprotocol/sdk 2.3.1 → 2.3.2

package/README.md

@@ -161,6 +161,17 @@ const verdict = await nomos.can({
 });
 ```
 
+Name your agent so the transcript records who asked, and mark test traffic so it stays out of the authority's public history and counts:
+
+```ts
+const verdict = await nomos.can(
+  { authority: "eu-ai-act", ai_categorises_biometric_data_for_sensitive_attributes: true },
+  { caller: { agent_id: "acme-hiring-agent", purpose: process.env.CI ? "test" : "production" } },
+);
+```
+
+The name is declared, not verified, and is shown as such. Don't know which authority applies? `GET /api/exchange/find?q=<what you're about to do>`, or the MCP tool `find_authority`.
+
 If a paid authority has not been purchased, NOMOS throws `NomosPaymentRequiredError` with the price and purchase URL attached.
 
 NOMOS never auto-charges on your behalf.

package/dist/index.cjs

@@ -191,7 +191,7 @@ function isRetryable(status) {
 }
 
 // src/http-client.ts
-var SDK_VERSION = "2.3.1";
+var SDK_VERSION = "2.3.2";
 var HttpClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -215,6 +215,7 @@ var HttpClient = class {
       "User-Agent": `nomos-node/${SDK_VERSION}`,
       "NOMOS-SDK-Version": SDK_VERSION
     };
+    if (reqOpts?.headers) Object.assign(headers, reqOpts.headers);
     if (reqOpts?.idempotencyKey) {
       headers["Idempotency-Key"] = reqOpts.idempotencyKey;
     }
@@ -723,6 +724,13 @@ function normalizeAuthorityQueryResult(data, authority) {
     ...data.revoked === true ? { revoked: true, revocation_reason: data.revocation_reason } : {}
   };
 }
+function callerHeaders(c) {
+  const h = {};
+  if (c?.agent_id) h["X-Nomos-Agent"] = c.agent_id;
+  if (c?.acts_for) h["X-Nomos-Acts-For"] = c.acts_for;
+  if (c?.purpose) h["X-Nomos-Purpose"] = c.purpose;
+  return h;
+}
 async function canViaExchange(authority, facts, action, opts) {
   const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\/$/, "");
   const url = `${base}/api/v1/can`;
@@ -730,7 +738,7 @@ async function canViaExchange(authority, facts, action, opts) {
   try {
     res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", "User-Agent": `nomos-node/${SDK_VERSION}`, ...callerHeaders(opts?.caller) },
       body: JSON.stringify({ artifact: authority, action, ...facts }),
       signal: opts?.signal
     });
@@ -743,8 +751,8 @@ async function canViaExchange(authority, facts, action, opts) {
   if (!res.ok) mapHttpError(res.status, data, requestId);
   return normalizeAuthorityQueryResult(data, authority);
 }
-async function canViaExchangeAuthenticated(http, authority, facts, action) {
-  const { data } = await http.post("/api/v1/can", { artifact: authority, action, ...facts });
+async function canViaExchangeAuthenticated(http, authority, facts, action, caller) {
+  const { data } = await http.post("/api/v1/can", { artifact: authority, action, ...facts }, { headers: callerHeaders(caller) });
   return normalizeAuthorityQueryResult(data, authority);
 }
 async function canViaArtifact(http, artifactId, facts, action) {
@@ -841,7 +849,6 @@ async function can(params, opts) {
   return canViaExchange(params.authority, facts, action, opts);
 }
 async function canAuthenticated(http, params, opts) {
-  void opts;
   const { facts, action } = splitFacts(params);
   if (params.artifact !== void 0) {
     if (!params.key_certs || !params.root_public_key_pem) {
@@ -850,7 +857,7 @@ async function canAuthenticated(http, params, opts) {
     return canViaChain(params.artifact, params.key_certs, params.root_public_key_pem, facts, action, opts);
   }
   if (params.artifact_id) return canViaArtifact(http, params.artifact_id, facts, action);
-  if (params.authority) return canViaExchangeAuthenticated(http, params.authority, facts, action);
+  if (params.authority) return canViaExchangeAuthenticated(http, params.authority, facts, action, opts?.caller);
   throw new Error("can(): `authority` (a public Exchange artifact), `artifact_id` (your own artifact), or `artifact` (chain-of-trust) is required.");
 }
 var nomos = { can };
@@ -5051,9 +5058,14 @@ var TIE_ORDERS = {
 function evaluate(artifact, facts) {
   const logic = artifact.logic;
   const res = logic.resolution ?? {};
-  const decisions = logic.decisions;
-  if (!Array.isArray(decisions))
+  if (!Array.isArray(logic.decisions))
     throw new Error("logic.decisions missing");
+  const declared = new Set(Object.keys(artifact.execution?.actions ?? {}));
+  const isObligation = (d) => {
+    const t = d?.then?.[0];
+    return t?.type === "emit" || t?.type === "action" && declared.has(t?.action_name);
+  };
+  const decisions = logic.decisions.filter((d) => !isObligation(d));
   const order = TIE_ORDERS[res.tie_breaker ?? "deny_wins"];
   if (!order)
     throw new Error("unknown tie_breaker");

package/dist/index.d.cts

@@ -88,6 +88,17 @@ interface CanOptions {
     baseUrl?: string;
     /** AbortSignal to cancel the request. */
     signal?: AbortSignal;
+    /** Who is asking, recorded on the transcript (sent as X-Nomos-Agent / -Acts-For / -Purpose).
+     *  `purpose: 'test'` queries are answered and sealed but kept out of the authority's public
+     *  history and counts — set it from tests and CI. Exchange authorities only. */
+    caller?: CanCaller;
+}
+interface CanCaller {
+    /** A stable name for your agent, e.g. "acme-credit-agent". */
+    agent_id?: string;
+    /** The organisation it acts for. Ignored when the request carries an API key (the key's account is used). */
+    acts_for?: string;
+    purpose?: 'production' | 'test';
 }
 interface CanResult {
     /** True only for an AUTHORIZED verdict. DENIED and ESCALATED are both `false`. */
@@ -411,6 +422,8 @@ interface RequestOptions {
     idempotencyKey?: string;
     /** Per-request API key — useful for multi-tenant platforms */
     apiKey?: string;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
 }
 interface NomosRawResponse {
     /** x-request-id header value — include in support tickets */
@@ -1622,4 +1635,4 @@ declare function approver(o: ApproverOptions): {
     pending: Map<string, Pending>;
 };
 
-export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BindingProposal, type BindingSuggestion, type BuildActOptions, type CanOptions, type CanParams, type CanResult, type CanVerdict, type CertificateRegistry, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type EnrolmentClaims, type FactBinding, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssueOptions, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, MAX_PRESENTED, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type PasskeyApproverOptions, type PasskeyCredential, type PasskeyStore, type PendingApproval, type PgClient, type PgPool, type PolicyField, type PostgresStoreOptions, type Receipt, RegistryError, type RegistryStore, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type RevocationSourceOptions, RevocationUnavailable, type SignatureSuite, type Signer, type ToolBindings, type ToolDescription, type UnresolvedFact, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, applyToolBindings, approver, buildAct, can, certificateRegistry, certify, describeSuggestion, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryPasskeyStore, memoryRegistryStore, memoryStore, nomos, originOf, parseToolBindings, passkeyApprover, postgresPasskeyStore, postgresRegistryStore, postgresStore, presentedCertificates, readAttestation, reliedKids, revocationListCertificates, revocationSource, seal, seededSigner, signConsent, signEnrolmentToken, signInForce, signRevocation, signRevocationList, signTestimony, statusFor, suggestToolBindings, verifyChain, verifyEnrolmentToken, witness };
+export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BindingProposal, type BindingSuggestion, type BuildActOptions, type CanCaller, type CanOptions, type CanParams, type CanResult, type CanVerdict, type CertificateRegistry, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type EnrolmentClaims, type FactBinding, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssueOptions, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, MAX_PRESENTED, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type PasskeyApproverOptions, type PasskeyCredential, type PasskeyStore, type PendingApproval, type PgClient, type PgPool, type PolicyField, type PostgresStoreOptions, type Receipt, RegistryError, type RegistryStore, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type RevocationSourceOptions, RevocationUnavailable, type SignatureSuite, type Signer, type ToolBindings, type ToolDescription, type UnresolvedFact, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, applyToolBindings, approver, buildAct, can, certificateRegistry, certify, describeSuggestion, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryPasskeyStore, memoryRegistryStore, memoryStore, nomos, originOf, parseToolBindings, passkeyApprover, postgresPasskeyStore, postgresRegistryStore, postgresStore, presentedCertificates, readAttestation, reliedKids, revocationListCertificates, revocationSource, seal, seededSigner, signConsent, signEnrolmentToken, signInForce, signRevocation, signRevocationList, signTestimony, statusFor, suggestToolBindings, verifyChain, verifyEnrolmentToken, witness };

package/dist/index.d.ts

@@ -88,6 +88,17 @@ interface CanOptions {
     baseUrl?: string;
     /** AbortSignal to cancel the request. */
     signal?: AbortSignal;
+    /** Who is asking, recorded on the transcript (sent as X-Nomos-Agent / -Acts-For / -Purpose).
+     *  `purpose: 'test'` queries are answered and sealed but kept out of the authority's public
+     *  history and counts — set it from tests and CI. Exchange authorities only. */
+    caller?: CanCaller;
+}
+interface CanCaller {
+    /** A stable name for your agent, e.g. "acme-credit-agent". */
+    agent_id?: string;
+    /** The organisation it acts for. Ignored when the request carries an API key (the key's account is used). */
+    acts_for?: string;
+    purpose?: 'production' | 'test';
 }
 interface CanResult {
     /** True only for an AUTHORIZED verdict. DENIED and ESCALATED are both `false`. */
@@ -411,6 +422,8 @@ interface RequestOptions {
     idempotencyKey?: string;
     /** Per-request API key — useful for multi-tenant platforms */
     apiKey?: string;
+    /** Extra request headers. */
+    headers?: Record<string, string>;
 }
 interface NomosRawResponse {
     /** x-request-id header value — include in support tickets */
@@ -1622,4 +1635,4 @@ declare function approver(o: ApproverOptions): {
     pending: Map<string, Pending>;
 };
 
-export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BindingProposal, type BindingSuggestion, type BuildActOptions, type CanOptions, type CanParams, type CanResult, type CanVerdict, type CertificateRegistry, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type EnrolmentClaims, type FactBinding, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssueOptions, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, MAX_PRESENTED, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type PasskeyApproverOptions, type PasskeyCredential, type PasskeyStore, type PendingApproval, type PgClient, type PgPool, type PolicyField, type PostgresStoreOptions, type Receipt, RegistryError, type RegistryStore, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type RevocationSourceOptions, RevocationUnavailable, type SignatureSuite, type Signer, type ToolBindings, type ToolDescription, type UnresolvedFact, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, applyToolBindings, approver, buildAct, can, certificateRegistry, certify, describeSuggestion, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryPasskeyStore, memoryRegistryStore, memoryStore, nomos, originOf, parseToolBindings, passkeyApprover, postgresPasskeyStore, postgresRegistryStore, postgresStore, presentedCertificates, readAttestation, reliedKids, revocationListCertificates, revocationSource, seal, seededSigner, signConsent, signEnrolmentToken, signInForce, signRevocation, signRevocationList, signTestimony, statusFor, suggestToolBindings, verifyChain, verifyEnrolmentToken, witness };
+export { ACT_MEDIA_TYPE, type AcceptOptions, type AcceptStore, type AcceptTransaction, type AcceptedAuthority, type KeyCertificate as ActKeyCertificate, type ActOptions, type ActResult, type ActStatus, type Action, type Answer, type ApproverOptions, type Artifact, type ArtifactList, type ArtifactSchema, type ArtifactSchemaField, type AttestationInfo, type BindingProposal, type BindingSuggestion, type BuildActOptions, type CanCaller, type CanOptions, type CanParams, type CanResult, type CanVerdict, type CertificateRegistry, type ChainVerdictDecision, type ConservedStateInfo, type ConservedStateReceipt, type Contradiction, type DetectContradictionsParams, type DetectContradictionsResult, type EnrolmentClaims, type FactBinding, type GenerateGovernanceParams, type GenerateGovernanceResult, type IssueOptions, type IssuerDocument, type IssuerOptions, type KeyCertificate$1 as KeyCertificate, type ListArtifactsParams, MAX_PRESENTED, Nomos, NomosAPIError, NomosActError, NomosAuthenticationError, NomosAuthorizationError, type NomosConfig, NomosDiscoveryError, NomosError, type NomosErrorCode, NomosIssuerNotTrustedError, NomosNetworkError, NomosNotFoundError, NomosPaymentRequiredError, NomosRateLimitError, type NomosRawResponse, NomosValidationError, type NomosWebhookEvent, type NomosWebhookEventType, NomosWebhookSignatureError, type PasskeyApproverOptions, type PasskeyCredential, type PasskeyStore, type PendingApproval, type PgClient, type PgPool, type PolicyField, type PostgresStoreOptions, type Receipt, RegistryError, type RegistryStore, type RelyingPartyDocument, type RequestOptions, type Reservation, type ReserveByActParams, type ReserveByQueryParams, type ReserveParams, type RevocationSourceOptions, RevocationUnavailable, type SignatureSuite, type Signer, type ToolBindings, type ToolDescription, type UnresolvedFact, type Verdict, type VerifyChainOptions, type VerifyChainParams, type VerifyChainResult, type VerifyDecisionParams, type VerifyDecisionResult, WELL_KNOWN, type WithLastResponse, type WitnessDocument, type WitnessOptions, accept, act, applyToolBindings, approver, buildAct, can, certificateRegistry, certify, describeSuggestion, fetchDocument, generateSigner, issuer, kidOf, localSigner, memoryPasskeyStore, memoryRegistryStore, memoryStore, nomos, originOf, parseToolBindings, passkeyApprover, postgresPasskeyStore, postgresRegistryStore, postgresStore, presentedCertificates, readAttestation, reliedKids, revocationListCertificates, revocationSource, seal, seededSigner, signConsent, signEnrolmentToken, signInForce, signRevocation, signRevocationList, signTestimony, statusFor, suggestToolBindings, verifyChain, verifyEnrolmentToken, witness };

package/dist/index.js

@@ -107,7 +107,7 @@ function isRetryable(status) {
 }
 
 // src/http-client.ts
-var SDK_VERSION = "2.3.1";
+var SDK_VERSION = "2.3.2";
 var HttpClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -131,6 +131,7 @@ var HttpClient = class {
       "User-Agent": `nomos-node/${SDK_VERSION}`,
       "NOMOS-SDK-Version": SDK_VERSION
     };
+    if (reqOpts?.headers) Object.assign(headers, reqOpts.headers);
     if (reqOpts?.idempotencyKey) {
       headers["Idempotency-Key"] = reqOpts.idempotencyKey;
     }
@@ -639,6 +640,13 @@ function normalizeAuthorityQueryResult(data, authority) {
     ...data.revoked === true ? { revoked: true, revocation_reason: data.revocation_reason } : {}
   };
 }
+function callerHeaders(c) {
+  const h = {};
+  if (c?.agent_id) h["X-Nomos-Agent"] = c.agent_id;
+  if (c?.acts_for) h["X-Nomos-Acts-For"] = c.acts_for;
+  if (c?.purpose) h["X-Nomos-Purpose"] = c.purpose;
+  return h;
+}
 async function canViaExchange(authority, facts, action, opts) {
   const base = (opts?.baseUrl ?? DEFAULT_EXCHANGE_BASE).replace(/\/$/, "");
   const url = `${base}/api/v1/can`;
@@ -646,7 +654,7 @@ async function canViaExchange(authority, facts, action, opts) {
   try {
     res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", "User-Agent": `nomos-node/${SDK_VERSION}`, ...callerHeaders(opts?.caller) },
       body: JSON.stringify({ artifact: authority, action, ...facts }),
       signal: opts?.signal
     });
@@ -659,8 +667,8 @@ async function canViaExchange(authority, facts, action, opts) {
   if (!res.ok) mapHttpError(res.status, data, requestId);
   return normalizeAuthorityQueryResult(data, authority);
 }
-async function canViaExchangeAuthenticated(http, authority, facts, action) {
-  const { data } = await http.post("/api/v1/can", { artifact: authority, action, ...facts });
+async function canViaExchangeAuthenticated(http, authority, facts, action, caller) {
+  const { data } = await http.post("/api/v1/can", { artifact: authority, action, ...facts }, { headers: callerHeaders(caller) });
   return normalizeAuthorityQueryResult(data, authority);
 }
 async function canViaArtifact(http, artifactId, facts, action) {
@@ -757,7 +765,6 @@ async function can(params, opts) {
   return canViaExchange(params.authority, facts, action, opts);
 }
 async function canAuthenticated(http, params, opts) {
-  void opts;
   const { facts, action } = splitFacts(params);
   if (params.artifact !== void 0) {
     if (!params.key_certs || !params.root_public_key_pem) {
@@ -766,7 +773,7 @@ async function canAuthenticated(http, params, opts) {
     return canViaChain(params.artifact, params.key_certs, params.root_public_key_pem, facts, action, opts);
   }
   if (params.artifact_id) return canViaArtifact(http, params.artifact_id, facts, action);
-  if (params.authority) return canViaExchangeAuthenticated(http, params.authority, facts, action);
+  if (params.authority) return canViaExchangeAuthenticated(http, params.authority, facts, action, opts?.caller);
   throw new Error("can(): `authority` (a public Exchange artifact), `artifact_id` (your own artifact), or `artifact` (chain-of-trust) is required.");
 }
 var nomos = { can };
@@ -4967,9 +4974,14 @@ var TIE_ORDERS = {
 function evaluate(artifact, facts) {
   const logic = artifact.logic;
   const res = logic.resolution ?? {};
-  const decisions = logic.decisions;
-  if (!Array.isArray(decisions))
+  if (!Array.isArray(logic.decisions))
     throw new Error("logic.decisions missing");
+  const declared = new Set(Object.keys(artifact.execution?.actions ?? {}));
+  const isObligation = (d) => {
+    const t = d?.then?.[0];
+    return t?.type === "emit" || t?.type === "action" && declared.has(t?.action_name);
+  };
+  const decisions = logic.decisions.filter((d) => !isObligation(d));
   const order = TIE_ORDERS[res.tie_breaker ?? "deny_wins"];
   if (!order)
     throw new Error("unknown tie_breaker");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomosprotocol/sdk",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "NOMOS for TypeScript: accept() for the system that makes a change, act() for the agent that asks, the issuer, witness and approver roles, and the Exchange client. Verification is local (@nomosprotocol/verify).",
   "publishConfig": {
     "access": "public"
@@ -64,6 +64,13 @@
   ],
   "author": "NOMOS",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nomos-spec/spec.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nomos-spec/spec/issues"
+  },
   "engines": {
     "node": ">=20"
   },
@@ -74,6 +81,6 @@
   "dependencies": {
     "@noble/curves": "^2.4.0",
     "@noble/hashes": "^2.4.0",
-    "@nomosprotocol/verify": "^1.2.0"
+    "@nomosprotocol/verify": "^1.3.0"
   }
 }