@nomosprotocol/sdk 2.6.0 → 2.7.0

package/README.md

@@ -97,6 +97,39 @@ can return their own chains with what they sign (`keyCerts`). On the relying par
 (NOMOS-SPEC-007 rev. 1.10). Revocations are never forgotten, and without a current list
 `accept()` answers 503 instead of committing.
 
+**Which laws govern the act (2.7.0).** An Act carries one authority, so on its own `accept()` checks
+the law the carrier chose. Pin registrars and `accept()` works out every law that governs the act here,
+now, and commits only if the Act carries every one (NOMOS-SPEC-014, Draft):
+
+```ts
+import { accept, registrarSource } from '@nomosprotocol/sdk';
+
+const platform = registrarSource({
+  id: 'platform',
+  url: 'https://www.nomosprotocol.com',
+  publicKeyPem: PLATFORM_KEY_PEM,   // pinned by you; heads signed by any other key are refused
+});
+
+const rp = accept({
+  // ...relyingPartyId, root, authorities (with registrarName), commit, as above
+  resolution: {
+    registrars: [platform],
+    // From YOUR knowledge and state, never from the Act: a carrier that stated its own
+    // jurisdiction would choose the law again.
+    context: (act, localFacts) => ({ jurisdiction: 'AE', established_in: 'DIFC', subjects_in: 'AE', output_used_in: 'AE' }),
+  },
+});
+```
+
+If another law also governs the act, the Act is held (`422 INCOMPLETE`, `reason_code:
+'laws_not_presented'`, the laws named) and nothing is committed. A context fact you leave out holds it
+too (`resolution_incomplete`, naming the fact). A registrar that cannot be read, a head older than
+`maxHeadAgeSeconds`, a head signed by a key you did not pin, or a log whose history was rewritten
+answers 503 with Retry-After. Receipts record the resolution (status, context, laws, log heads).
+Create each `registrarSource()` once and reuse it: the check that a registrar's history was only ever
+added to spans the source's lifetime (pass `initialHead` to carry the last head across restarts).
+Without `resolution`, `accept()` is unchanged.
+
 **The other roles** are one call each:
 - `issuer()` publishes your sealed policies and certificates;
 - `witness()` turns an existing lookup into signed statements;
@@ -168,8 +201,8 @@ No. 45 of 2021 and DIFC Law No. 5 of 2020, and lists only its own laws, so other
 apply. Only want the list of laws? `POST /api/v1/resolve { context }` returns it without asking
 them, and records nothing.
 
-`accept()` still verifies the one authority an Act carries. Resolving inside `accept()`, from
-registrars the receiving system pins, is the next step of NOMOS-SPEC-014.
+The system that commits the change can resolve too, from registrars it pins and a context it supplies
+itself: see `accept({ resolution })` above (2.7.0).
 
 ### 1. Public authority
 

package/dist/index.cjs

@@ -36,6 +36,7 @@ __export(index_exports, {
   NomosRateLimitError: () => NomosRateLimitError,
   NomosValidationError: () => NomosValidationError,
   NomosWebhookSignatureError: () => NomosWebhookSignatureError,
+  RegistrarUnavailable: () => RegistrarUnavailable,
   RegistryError: () => RegistryError,
   RevocationUnavailable: () => RevocationUnavailable,
   WELL_KNOWN: () => WELL_KNOWN,
@@ -66,6 +67,7 @@ __export(index_exports, {
   postgresStore: () => postgresStore,
   presentedCertificates: () => presentedCertificates,
   readAttestation: () => readAttestation,
+  registrarSource: () => registrarSource,
   reliedKids: () => reliedKids,
   revocationListCertificates: () => revocationListCertificates,
   revocationSource: () => revocationSource,
@@ -191,7 +193,7 @@ function isRetryable(status) {
 }
 
 // src/http-client.ts
-var SDK_VERSION = "2.6.0";
+var SDK_VERSION = "2.7.0";
 var HttpClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -5258,7 +5260,7 @@ function verifyUnsafe(a, o) {
   const now = (o.now ?? /* @__PURE__ */ new Date()).getTime();
   const nowDate = new Date(now);
   const revokedKids = o.revokedKids ?? /* @__PURE__ */ new Set(), revokedCerts = o.revokedCerts ?? /* @__PURE__ */ new Set();
-  const localFacts = o.localFacts ?? {}, inForce = o.inForce ?? {};
+  const localFacts = o.localFacts ?? {}, inForce2 = o.inForce ?? {};
   const need = ["act_version", "act_id", "nonce", "issued_at", "expires_at", "relying_party", "action", "authority"];
   if (!isObject(a) || need.some((k) => !(k in a)) || a.act_version !== "1" || !isObject(a.authority))
     return { decision: "MALFORMED", reason_code: "bad_envelope" };
@@ -5302,9 +5304,9 @@ function verifyUnsafe(a, o) {
   if (o.revokedArtifacts?.has(seal2.hash))
     return { decision: "ARTIFACT_REVOKED", artifact_id: artId };
   let inForceSource;
-  if (typeof artId === "string" && Object.prototype.hasOwnProperty.call(inForce, artId)) {
-    if (inForce[artId] !== seal2.hash)
-      return { decision: "SUPERSEDED", artifact_id: artId, in_force_seal_hash: inForce[artId] };
+  if (typeof artId === "string" && Object.prototype.hasOwnProperty.call(inForce2, artId)) {
+    if (inForce2[artId] !== seal2.hash)
+      return { decision: "SUPERSEDED", artifact_id: artId, in_force_seal_hash: inForce2[artId] };
     inForceSource = "record";
   } else if (o.currencyPolicy === "record") {
     return { decision: "VERSION_UNVERIFIED", artifact_id: artId, reason_code: "not_in_record" };
@@ -5521,6 +5523,288 @@ function verifyRevocationList(list, o) {
   return out;
 }
 
+// node_modules/@nomosprotocol/verify/dist/resolution.js
+var DEFAULT_CLOSURE_MAX_AGE_DAYS = 90;
+function evaluateScope(condition, context) {
+  if (condition === "always" || condition === "all")
+    return { value: "TRUE", openFacts: [] };
+  let out;
+  try {
+    out = evaluate({
+      logic: {
+        resolution: { conflict_policy: "highest_priority", tie_breaker: "deny_wins", default_outcome: "escalate" },
+        decisions: [
+          { id: "scope-when-true", when: condition, priority: 1, then: [{ type: "allow" }] },
+          { id: "scope", when: condition, priority: 2, then: [{ type: "block" }] }
+        ]
+      }
+    }, context);
+  } catch {
+    return { value: "UNDECIDED", openFacts: ["__scope_unparseable__"] };
+  }
+  if (out.outcome === "block")
+    return { value: "TRUE", openFacts: [] };
+  if (out.outcome === "undecided")
+    return { value: "UNDECIDED", openFacts: [...out.open_facts] };
+  return { value: "FALSE", openFacts: [] };
+}
+var inForce = (c, at) => (!c.from || c.from <= at) && (!c.until || c.until > at);
+var closureFresh = (c, at) => {
+  const ageMs = Date.parse(at) - Date.parse(c.at);
+  if (!Number.isFinite(ageMs) || ageMs < 0)
+    return false;
+  return ageMs <= (c.max_age_days ?? DEFAULT_CLOSURE_MAX_AGE_DAYS) * 864e5;
+};
+var closureReplaced = (c, all, at) => {
+  const t = Date.parse(c.at), now = Date.parse(at);
+  return all.some((d) => d !== c && Date.parse(d.at) > t && Date.parse(d.at) <= now && (d.scope === c.scope || !!c.label && d.label === c.label));
+};
+function resolveApplicableSet(world, query, opts = {}) {
+  const at = query.at;
+  const ctx = query.context ?? {};
+  const proof = { at, pins: [...world.pins].sort(), heads: {}, closures: [], conflicts: [], dropped: [] };
+  if (opts.ablate === "C5") {
+    const applicable2 = (opts.presented ?? []).map((a) => ({ authority: a, version: null, registrar: "carrier", scope: "always" })).sort((x, y) => x.authority < y.authority ? -1 : 1);
+    return { status: "RESOLVED", applicable: applicable2, proof };
+  }
+  const openFacts = /* @__PURE__ */ new Set();
+  const unreachable = [];
+  const staleClosures = [];
+  const disagreements = [];
+  const staleHeads = [];
+  const memberAt = opts.ablate === "C7" && opts.snapshot ? opts.snapshot : at;
+  const candidates2 = [];
+  const visited = /* @__PURE__ */ new Set();
+  const queue = [...world.pins].sort();
+  while (queue.length > 0) {
+    const id = queue.shift();
+    if (visited.has(id))
+      continue;
+    visited.add(id);
+    const reg = world.registrars[id];
+    if (!reg) {
+      if (opts.ablate !== "C8")
+        unreachable.push(id);
+      continue;
+    }
+    proof.heads[id] = reg.head ?? null;
+    if (opts.ablate !== "C8" && typeof world.max_head_age_seconds === "number") {
+      const age = reg.head_at ? Date.parse(at) - Date.parse(reg.head_at) : NaN;
+      if (!Number.isFinite(age) || age > world.max_head_age_seconds * 1e3)
+        staleHeads.push(id);
+    }
+    const cert = evaluateScope(reg.certified_scope, ctx);
+    for (const f of cert.openFacts)
+      openFacts.add(f);
+    for (const e of [...reg.recognitions ?? []].sort((a, b) => a.to < b.to ? -1 : 1)) {
+      const s = evaluateScope(e.scope, ctx);
+      if (s.value === "TRUE")
+        queue.push(e.to);
+      for (const f of s.openFacts)
+        openFacts.add(f);
+    }
+    const closedLists = [];
+    if (opts.ablate !== "C8") {
+      let covered = false;
+      for (const c of reg.closures) {
+        if (closureReplaced(c, reg.closures, at))
+          continue;
+        const s = evaluateScope(c.scope, ctx);
+        for (const f of s.openFacts)
+          openFacts.add(f);
+        if (s.value !== "TRUE")
+          continue;
+        const fresh = closureFresh(c, at);
+        proof.closures.push({ registrar: id, scope: c.scope, at: c.at, fresh });
+        if (fresh) {
+          covered = true;
+          closedLists.push(c.authorities);
+        }
+      }
+      if (!covered)
+        staleClosures.push(id);
+    }
+    const supersededNow = new Set((reg.supersessions ?? []).filter((s) => s.from <= memberAt).map((s) => s.superseded));
+    const revoked = new Set(reg.revoked ?? []);
+    const liveAuthorities = /* @__PURE__ */ new Set();
+    const trueAuthorities = /* @__PURE__ */ new Set();
+    for (const claim of reg.claims) {
+      if (opts.ablate !== "C7" || opts.snapshot) {
+        if (!inForce(claim, memberAt)) {
+          proof.dropped.push({ authority: claim.authority, registrar: id, reason: "not_in_force" });
+          continue;
+        }
+        if (supersededNow.has(claim.authority)) {
+          proof.dropped.push({ authority: claim.authority, registrar: id, reason: "superseded" });
+          continue;
+        }
+        if (revoked.has(claim.authority)) {
+          proof.dropped.push({ authority: claim.authority, registrar: id, reason: "revoked" });
+          continue;
+        }
+      }
+      liveAuthorities.add(claim.authority);
+      const s = evaluateScope(claim.scope, ctx);
+      for (const f of s.openFacts)
+        openFacts.add(f);
+      if (s.value === "TRUE")
+        trueAuthorities.add(claim.authority);
+      if (s.value === "FALSE")
+        continue;
+      const within = opts.ablate === "C6" ? { value: "TRUE", openFacts: [] } : cert;
+      if (s.value === "UNDECIDED" || within.value === "UNDECIDED")
+        continue;
+      if (within.value === "FALSE")
+        continue;
+      candidates2.push({ authority: claim.authority, version: claim.version ?? null, registrar: id, scope: claim.scope, exclusive: claim.exclusive === true });
+    }
+    if (opts.ablate !== "C8" && closedLists.length > 0) {
+      for (const a of new Set(closedLists.flat())) {
+        if (!liveAuthorities.has(a))
+          disagreements.push({ registrar: id, authority: a, reason: "closed_but_not_claimed" });
+      }
+      for (const a of trueAuthorities) {
+        if (!closedLists.some((l) => l.includes(a)))
+          disagreements.push({ registrar: id, authority: a, reason: "claimed_but_not_closed" });
+      }
+    }
+  }
+  proof.dropped.sort((a, b) => a.authority + a.registrar < b.authority + b.registrar ? -1 : 1);
+  proof.closures.sort((a, b) => a.registrar + a.scope + a.at < b.registrar + b.scope + b.at ? -1 : 1);
+  if (openFacts.size > 0 || unreachable.length > 0 || staleClosures.length > 0 || disagreements.length > 0 || staleHeads.length > 0) {
+    return {
+      status: "INCOMPLETE",
+      missing: {
+        context_facts: [...openFacts].sort(),
+        unreachable_registrars: unreachable.sort(),
+        stale_closures: staleClosures.sort(),
+        stale_heads: staleHeads.sort(),
+        closure_disagreements: disagreements.sort((a, b) => a.registrar + "\0" + a.authority < b.registrar + "\0" + b.authority ? -1 : 1)
+      },
+      proof
+    };
+  }
+  const exclusives = candidates2.filter((c) => c.exclusive);
+  const conflictPairs = exclusives.filter((c) => exclusives.some((o) => o.registrar !== c.registrar));
+  if (conflictPairs.length > 0) {
+    proof.conflicts.push({
+      context_covered_by: conflictPairs.map((c) => ({ registrar: c.registrar, authority: c.authority, scope: c.scope })).sort((a, b) => a.registrar + a.authority < b.registrar + b.authority ? -1 : 1)
+    });
+    return { status: "CONFLICT", conflicts: proof.conflicts, proof };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const applicable = [];
+  for (const c of [...candidates2].sort((a, b) => a.authority + "\0" + a.registrar < b.authority + "\0" + b.registrar ? -1 : 1)) {
+    const key = c.authority + "\0" + c.registrar;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    applicable.push({ authority: c.authority, version: c.version, registrar: c.registrar, scope: c.scope });
+  }
+  return { status: "RESOLVED", applicable, proof };
+}
+
+// node_modules/@nomosprotocol/verify/dist/registrar.js
+var LOG_GENESIS = "0".repeat(64);
+var registrarHeadPayload = (h, log = "nomos-exchange-log") => jcs({ log, size: h.size, hash: h.hash, at: h.at });
+function verifyLogChain(entries) {
+  let prev = LOG_GENESIS;
+  const hashAt = /* @__PURE__ */ new Map([[0, LOG_GENESIS]]);
+  for (const [i, e] of entries.entries()) {
+    if (e.seq !== i + 1)
+      return { ok: false, detail: `entry ${i + 1}: its seq is ${e.seq}` };
+    if (e.prev_hash !== prev)
+      return { ok: false, detail: `entry ${e.seq}: prev_hash does not match entry ${e.seq - 1}` };
+    const { hash, ...body } = e;
+    if (sha256Hex(jcs(body)) !== hash)
+      return { ok: false, detail: `entry ${e.seq}: its hash does not match its contents` };
+    prev = hash;
+    hashAt.set(e.seq, hash);
+  }
+  return { ok: true, hashAt };
+}
+function verifyRegistrarLog(o) {
+  const fail2 = (reason, detail) => ({ ok: false, reason, detail });
+  const chain = verifyLogChain(o.entries);
+  if (!chain.ok)
+    return fail2("chain_broken", chain.detail);
+  const h = o.head;
+  if (!h || typeof h.size !== "number" || h.size > o.entries.length || chain.hashAt.get(h.size) !== h.hash) {
+    return fail2("head_mismatch", `the head (size ${h?.size}) does not name an entry of this chain`);
+  }
+  if (!h.signature || !h.kid)
+    return fail2("head_unsigned", "the head is not signed");
+  const pinnedKid = kidOf(o.publicKeyPem);
+  if (!pinnedKid || h.kid !== pinnedKid)
+    return fail2("wrong_key", `the head is signed by ${h.kid}, not the pinned key ${pinnedKid ?? "(unreadable)"}`);
+  if (!verifySuite("Ed25519", o.publicKeyPem, registrarHeadPayload(h, o.log), { signature: h.signature }).ok)
+    return fail2("bad_signature", "the head signature does not verify under the pinned key");
+  const age = o.now.getTime() - Date.parse(h.at);
+  if (!Number.isFinite(age))
+    return fail2("head_stale", "the head carries no time");
+  if (age < -6e4)
+    return fail2("head_in_future", `the head is dated ${h.at}, after now`);
+  if (age > o.maxHeadAgeSeconds * 1e3)
+    return fail2("head_stale", `the head is ${Math.round(age / 1e3)} s old; the bound is ${o.maxHeadAgeSeconds} s`);
+  if (o.previous && chain.hashAt.get(o.previous.size) !== o.previous.hash) {
+    return fail2("history_rewritten", `the head kept earlier (${o.previous.size}:${o.previous.hash.slice(0, 12)}\u2026) is not part of this log`);
+  }
+  return { ok: true, size: o.entries.length, head: { size: h.size, hash: h.hash, at: h.at, kid: h.kid } };
+}
+function foldRegistrarLog(entries, o) {
+  const open = /* @__PURE__ */ new Map();
+  const closedClaims = [];
+  const closures = [];
+  const recognitions = [];
+  const supersessions = [];
+  const revoked = /* @__PURE__ */ new Set();
+  let head = null;
+  for (const e of entries) {
+    head = e.hash;
+    if (e.kind === "applies") {
+      const prior = open.get(e.name);
+      if (prior)
+        closedClaims.push({ ...prior, until: e.at });
+      open.set(e.name, {
+        authority: e.name,
+        version: e.version ?? null,
+        scope: typeof e.entry?.scope === "string" ? e.entry.scope : "always",
+        exclusive: e.entry?.exclusive === true,
+        from: e.at,
+        until: typeof e.entry?.until === "string" ? e.entry.until : null,
+        ...typeof e.entry?.basis === "string" ? { basis: e.entry.basis } : {}
+      });
+    } else if (e.kind === "withdrawn") {
+      const prior = open.get(e.name);
+      if (prior) {
+        closedClaims.push({ ...prior, until: e.at });
+        open.delete(e.name);
+      }
+    } else if (e.kind === "revoked") {
+      revoked.add(e.name);
+    } else if (e.kind === "closed") {
+      const scope = typeof e.entry?.scope === "string" ? e.entry.scope : "always";
+      const authorities = Array.isArray(e.entry?.authorities) ? e.entry.authorities.filter((a) => typeof a === "string") : [];
+      closures.push({ scope, authorities, at: e.at, label: e.name, ...typeof e.entry?.max_age_days === "number" ? { max_age_days: e.entry.max_age_days } : {} });
+    } else if (e.kind === "recognizes") {
+      recognitions.push({ to: e.name, scope: typeof e.entry?.scope === "string" ? e.entry.scope : "always" });
+    } else if (e.kind === "superseded") {
+      if (typeof e.entry?.by === "string")
+        supersessions.push({ superseded: e.name, by: e.entry.by, from: e.at });
+    }
+  }
+  return {
+    id: o.id,
+    certified_scope: o.certifiedScope ?? "always",
+    claims: [...closedClaims, ...open.values()],
+    closures,
+    recognitions,
+    supersessions,
+    revoked: [...revoked].sort(),
+    head
+  };
+}
+
 // src/verify-chain.ts
 var CHAIN_PROTOCOL_VERSION2 = "1";
 var DEFAULT_BASE = "https://www.nomosprotocol.com";
@@ -5697,6 +5981,68 @@ ${tool}`);
   return lines.join("\n");
 }
 
+// src/act/registrars.ts
+var RegistrarUnavailable = class extends Error {
+  constructor(message, retryAfterSeconds, registrar) {
+    super(message);
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.registrar = registrar;
+    this.name = "RegistrarUnavailable";
+  }
+};
+var PAGE = 1e3;
+function registrarSource(o) {
+  const f = o.fetch ?? fetch, now = o.now ?? (() => /* @__PURE__ */ new Date());
+  const base = o.url.replace(/\/$/, "");
+  const maxHeadAge = o.maxHeadAgeSeconds ?? 600, refresh = (o.refreshSeconds ?? 60) * 1e3;
+  let view = null, kept = o.initialHead ?? null;
+  let fetchedAt = 0, inFlight = null, lastError = "";
+  async function getJson2(path) {
+    const res = await f(`${base}${path}`, { headers: { accept: "application/json" } });
+    if (!res.ok) throw new Error(`${base}${path} answered ${res.status}`);
+    return res.json();
+  }
+  async function load() {
+    fetchedAt = now().getTime();
+    try {
+      const head = await getJson2("/.well-known/nomos-exchange-log/head");
+      const entries = [];
+      for (let after = 0; ; ) {
+        const page2 = await getJson2(`/.well-known/nomos-exchange-log?after=${after}&limit=${PAGE}`);
+        const got = Array.isArray(page2?.entries) ? page2.entries : [];
+        entries.push(...got);
+        if (got.length < PAGE || !page2.next) break;
+        after = got[got.length - 1].seq;
+      }
+      const vouched = entries.slice(0, Math.min(entries.length, Number(head?.size) || 0));
+      const check = verifyRegistrarLog({ entries: vouched, head, publicKeyPem: o.publicKeyPem, now: now(), maxHeadAgeSeconds: maxHeadAge, previous: kept });
+      if (!check.ok) {
+        lastError = `${check.reason}: ${check.detail}`;
+        if (check.reason === "history_rewritten" || check.reason === "wrong_key" || check.reason === "bad_signature" || check.reason === "chain_broken") view = null;
+        return;
+      }
+      view = { record: foldRegistrarLog(vouched, { id: o.id, certifiedScope: o.certifiedScope }), head: check.head };
+      kept = { size: check.head.size, hash: check.head.hash };
+      lastError = "";
+    } catch (e) {
+      lastError = String(e?.message ?? e);
+    }
+  }
+  const source = (async () => {
+    const t = now().getTime();
+    if (!inFlight && t - fetchedAt >= refresh) inFlight = load().finally(() => {
+      inFlight = null;
+    });
+    if (inFlight) await inFlight;
+    if (!view || t - Date.parse(view.head.at) > maxHeadAge * 1e3) {
+      throw new RegistrarUnavailable(`Registrar ${o.id} (${base}) has no current, verified log${lastError ? `: ${lastError}` : ""}. Not committing until the law that applies can be read.`, Math.max(1, Math.ceil(refresh / 1e3)), o.id);
+    }
+    return view;
+  });
+  source.id = o.id;
+  return source;
+}
+
 // src/act/bytes.ts
 var utf82 = (s) => new TextEncoder().encode(s);
 var fromUtf82 = (b) => new TextDecoder().decode(b);
@@ -5977,7 +6323,7 @@ var STATUS = { AUTHORIZED: 201, ESCALATED: 202, INCOMPLETE: 422, DENIED: 403, RE
 var statusFor = (decision) => STATUS[decision] ?? 400;
 var ACT_MEDIA_TYPE = "application/nomos-act+json";
 var HINTS = {
-  INCOMPLETE: (v) => `Missing facts that could change the outcome: ${(v.open_facts ?? []).join(", ")}. Bring them as testimony from a witness certified for each claim, or as the channel the authority declares.`,
+  INCOMPLETE: (v) => v.reason_code === "laws_not_presented" ? `Other law also governs this act here: ${(v.laws ?? []).join(", ")}. This system commits only when every governing law is carried; this Act carries one.` : v.reason_code === "resolution_incomplete" ? `This system cannot yet establish which law governs this act${v.missing?.context_facts?.length ? `: its own knowledge of the act lacks ${v.missing.context_facts.join(", ")}` : v.missing?.stale_closures?.length ? ": a registrar it honours does not cover this case" : ""}. Nothing the carrier sends can supply this; nothing is committed while the governing law is unknown.` : v.reason_code === "resolution_conflict" ? "Two registrars each claim exclusive precedence over this act. A person must settle which law governs before it can be committed." : `Missing facts that could change the outcome: ${(v.open_facts ?? []).join(", ")}. Bring them as testimony from a witness certified for each claim, or as the channel the authority declares.`,
   ESCALATED: (v) => `Needs ${v.consents_required} approval(s) from role ${v.role}. Request consent over act_digest ${v.act_digest} and resubmit this same Act before ${v.retry_until}.`,
   DENIED: (v) => `Rule ${v.rule ?? "(default)"} refuses this action. No approval can change a denial.`,
   WRONG_RELYING_PARTY: () => "The Act is addressed to another system. Build it with this relying_party_id.",
@@ -6090,6 +6436,24 @@ function accept(o) {
       maxWindowSeconds
     });
   }
+  async function resolveFor(act2, authority, facts, at, reuse) {
+    if (!o.resolution) return null;
+    const views = reuse ?? await Promise.all(o.resolution.registrars.map(async (src) => [src.id, await src()]));
+    const context = { ...await o.resolution.context(act2, facts) };
+    const r = resolveApplicableSet(
+      { pins: views.map(([id]) => id), registrars: Object.fromEntries(views.map(([id, v]) => [id, v.record])) },
+      { context, at: at.toISOString() }
+    );
+    const heads = Object.fromEntries(views.map(([id, v]) => [id, v.head.hash]));
+    const applicable = r.status === "RESOLVED" ? [...new Set(r.applicable.map((m) => m.authority))].sort() : [];
+    const info = { status: r.status, context, applicable, heads };
+    if (r.status === "INCOMPLETE") return { ok: false, info, views, verdict: { decision: "INCOMPLETE", reason_code: "resolution_incomplete", missing: r.missing } };
+    if (r.status === "CONFLICT") return { ok: false, info, views, verdict: { decision: "INCOMPLETE", reason_code: "resolution_conflict", conflicts: r.conflicts } };
+    const carried = new Set([authority.registrarName, authority.artifactId].filter((x) => !!x));
+    const notCarried = applicable.filter((a) => !carried.has(a));
+    if (notCarried.length) return { ok: false, info: { ...info, laws_not_presented: notCarried }, views, verdict: { decision: "INCOMPLETE", reason_code: "laws_not_presented", laws: notCarried } };
+    return { ok: true, info, views };
+  }
   async function handle(req) {
     const ctype = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
     if ((req.method ?? "POST").toUpperCase() !== "POST") return { status: 405, headers: { allow: "POST", "content-type": "application/json" }, body: { error: "POST an Act here." } };
@@ -6136,8 +6500,31 @@ function accept(o) {
     if (verdict.decision === "REPLAYED") {
       return answer(verdict, { act_id: act2.act_id, receipt: await store.receiptFor(act2.nonce) });
     }
+    let resolved = null;
+    if (verdict.decision === "AUTHORIZED" && o.resolution) {
+      try {
+        resolved = await resolveFor(act2, authority, facts, verifiedAt);
+      } catch (e) {
+        if (!(e instanceof RegistrarUnavailable)) throw e;
+        return {
+          status: 503,
+          headers: { "content-type": "application/json", "retry-after": String(e.retryAfterSeconds) },
+          body: { error: "The law that governs this act cannot be read right now, so nothing is committed. Resubmit this same Act later.", detail: e.message, registrar: e.registrar, retry_after: e.retryAfterSeconds }
+        };
+      }
+      if (resolved && !resolved.ok) {
+        const held = { ...resolved.verdict, act_id: act2.act_id, act_digest: verdict.act_digest, resolution: resolved.info };
+        await o.onVerdict?.(held, { ...receiptOf(held, facts), resolution: resolved.info });
+        if (o.mode === "shadow") {
+          const a = answer(held);
+          return { ...a, status: 200, body: { ...a.body, shadow: true } };
+        }
+        return answer(held);
+      }
+    }
+    const withResolution = (r) => resolved?.ok ? { ...r, resolution: resolved.info } : r;
     if (verdict.decision !== "AUTHORIZED" || o.mode === "shadow") {
-      await o.onVerdict?.(verdict, receiptOf(verdict, facts));
+      await o.onVerdict?.(verdict, withResolution(receiptOf(verdict, facts)));
       if (verdict.decision === "ESCALATED") {
         const esc3 = (act2.authority.artifact.governance?.escalations ?? []).find((e) => e?.id === verdict.escalation_id);
         return answer(verdict, { role: esc3?.role_required ?? null, retry_until: act2.expires_at });
@@ -6155,17 +6542,23 @@ function accept(o) {
             finalFacts = fresh;
             final = verifyWith(act2, authority, fresh, verifiedAt, false, rev);
             if (final.decision !== "AUTHORIZED") throw new Rollback(answer(final));
+            if (o.resolution) {
+              const again = await resolveFor(act2, authority, fresh, verifiedAt, resolved?.views);
+              if (again && !again.ok) throw new Rollback(answer({ ...again.verdict, act_id: act2.act_id, resolution: again.info }));
+              resolved = again;
+            }
           }
         }
         const action = structuredClone({ type: act2.action.type, ...act2.action.subject !== void 0 ? { subject: act2.action.subject } : {}, params: act2.action.params ?? {} });
         const result = await o.commit(action, { tx: t.tx, actId: act2.act_id });
-        const receipt = receiptOf(final, finalFacts, now());
+        const receipt = withResolution(receiptOf(final, finalFacts, now()));
         await t.putReceipt(act2.nonce, receipt, act2);
         await o.onVerdict?.(final, receipt);
         return answer(final, { receipt, ...result !== void 0 ? { result } : {} });
       });
     } catch (e) {
       if (e instanceof Rollback) return e.answer;
+      if (e instanceof RegistrarUnavailable) return { status: 503, headers: { "content-type": "application/json", "retry-after": String(e.retryAfterSeconds) }, body: { error: "The law that governs this act cannot be read right now, so nothing is committed. Resubmit this same Act later.", detail: e.message, registrar: e.registrar, retry_after: e.retryAfterSeconds } };
       if (e instanceof LostRace) return answer({ decision: "REPLAYED" }, { act_id: act2.act_id, receipt: await store.receiptFor(act2.nonce) });
       return { status: 500, headers: { "content-type": "application/json" }, body: { error: "The commit failed and was rolled back; nothing was applied.", detail: String(e?.message ?? e) } };
     }
@@ -6930,6 +7323,7 @@ var scriptHash = (js) => `'sha256-${btoa(String.fromCharCode(...sha256(utf82(js)
 var CSP = () => `default-src 'none'; script-src ${scriptHash(APPROVE_JS)} ${scriptHash(ENROL_JS)}; style-src 'unsafe-inline'; connect-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'`;
 
 // src/act/carrier.ts
+var RESOLUTION_HOLDS = /* @__PURE__ */ new Set(["laws_not_presented", "resolution_incomplete", "resolution_conflict"]);
 var STATUS_OF = { AUTHORIZED: "committed", ESCALATED: "escalated", INCOMPLETE: "incomplete", DENIED: "denied", REPLAYED: "replayed" };
 var NomosActError = class extends Error {
   constructor(message) {
@@ -6949,9 +7343,9 @@ async function act(o) {
   const entry = issuer2.authorities.find((a) => a.artifact_id === accepted.artifact_id);
   if (!entry) throw new NomosActError(`The issuer at ${accepted.issuer} does not publish ${accepted.artifact_id}.`);
   const artifact = await getJson(f, entry.artifact_url, "the authority");
-  let inForce;
+  let inForce2;
   if (accepted.currency_policy === "record_or_statement" && !accepted.in_force_seal_hash && entry.in_force_url) {
-    inForce = await getJson(f, entry.in_force_url, "the in-force statement").catch(() => void 0);
+    inForce2 = await getJson(f, entry.in_force_url, "the in-force statement").catch(() => void 0);
   }
   const inputs = artifact?.data_contract?.inputs ?? {};
   const witnessed = Object.entries(inputs).filter(([, i]) => i?.source === "testimony").map(([n]) => n);
@@ -6991,7 +7385,7 @@ async function act(o) {
     testimony.push(t);
     if (Array.isArray(body2.key_certs)) available.push(...body2.key_certs);
   }
-  const theAct = buildAct({ relyingParty: rp.relying_party_id, action: o.action, artifact, keyCerts: [], testimony, presenterFacts: o.presenterFacts, inForce, windowSeconds });
+  const theAct = buildAct({ relyingParty: rp.relying_party_id, action: o.action, artifact, keyCerts: [], testimony, presenterFacts: o.presenterFacts, inForce: inForce2, windowSeconds });
   present(theAct, available);
   let { status, body } = await submit(f, rp.act_endpoint, theAct);
   let approvalUrl;
@@ -7019,6 +7413,10 @@ async function act(o) {
     }
   }
   const kind = STATUS_OF[body.decision] ?? "refused";
+  if (kind === "incomplete" && RESOLUTION_HOLDS.has(body.reason_code)) {
+    const laws = Array.isArray(body.laws) ? body.laws : [];
+    return done("incomplete", body, theAct, { missing: [], summary: body.reason_code === "laws_not_presented" ? `Not committed: other law also governs this act at ${rp.relying_party_id} (${laws.join(", ")}), and this Act carries only ${theAct.authority?.artifact?.meta?.artifact_id ?? "one authority"}.` : `Not committed: ${body.hint ?? `${rp.relying_party_id} cannot yet settle which law governs this act (${body.reason_code}).`}` });
+  }
   if (kind === "incomplete") {
     const missing = (body.open_facts ?? []).map((fact) => {
       const why = unavailable.find((u) => u.fact === fact || fact.startsWith(u.fact + "."));
@@ -7050,6 +7448,7 @@ async function getJson(f, url, what) {
 async function submit(f, endpoint, theAct) {
   const res = await f(endpoint, { method: "POST", headers: { "content-type": ACT_MEDIA_TYPE }, body: JSON.stringify(theAct) });
   const body = await res.json().catch(() => ({ decision: "MALFORMED", reason_code: "unreadable_response" }));
+  if (res.status === 503) throw new NomosActError(`The relying party is not committing right now (503): ${body?.error ?? ""}${body?.retry_after ? ` Resubmit this same Act after ${body.retry_after} s.` : ""}`);
   if (res.status >= 500) throw new NomosActError(`The relying party failed to commit (${res.status}): ${body?.error ?? ""}`);
   return { status: res.status, body };
 }
@@ -7253,6 +7652,7 @@ ${buttons}</body>`;
   NomosRateLimitError,
   NomosValidationError,
   NomosWebhookSignatureError,
+  RegistrarUnavailable,
   RegistryError,
   RevocationUnavailable,
   WELL_KNOWN,
@@ -7283,6 +7683,7 @@ ${buttons}</body>`;
   postgresStore,
   presentedCertificates,
   readAttestation,
+  registrarSource,
   reliedKids,
   revocationListCertificates,
   revocationSource,