Gate a refund with a verified decision

curl --request POST "$NSR_API/api/v1/rules/lint" \
  --header "X-API-Key: $NSR_API_KEY" --header "Content-Type: application/json" \
  --data @refund_ok.json

curl --request POST "$NSR_API/api/v1/rules/batch" \
  --header "X-API-Key: $NSR_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: refund-policy-v1" \
  --data '{ "rules": [
    { "name": "refund_ok", "effect": "permit", "head_predicate": "may_refund", "head_args": ["?o"],
      "body": [ { "predicate": "return_received", "args": ["?o"] },
                { "predicate": "inspection_passed", "args": ["?o"] },
                { "predicate": "fraud_flagged", "args": ["?o", "?r"], "negated": true } ] },
    { "name": "fraud_blocks_refund", "effect": "deny", "head_predicate": "refund_blocked", "head_args": ["?o"],
      "body": [ { "predicate": "fraud_flagged", "args": ["?o", "?r"] } ] },
    { "name": "large_refund_review", "effect": "review", "head_predicate": "refund_requires_review", "head_args": ["?o"],
      "body": [ { "predicate": "order_amount", "args": ["?o", "?v"] },
                { "predicate": "gt", "args": ["?v", "500"] } ] }
  ] }'

curl --request POST "$NSR_API/v1/decisions" \
  --header "X-API-Key: $NSR_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: refund-order_10042-attempt-1" \
  --data '{
    "query": "Can order_10042 be refunded?",
    "action": "issue_refund",
    "mode": "safe",
    "facts": [
      { "predicate": { "name": "return_received",   "args": ["order_10042"] },     "confidence": 1.0, "source": "wms" },
      { "predicate": { "name": "inspection_passed", "args": ["order_10042"] },     "confidence": 1.0, "source": "wms" },
      { "predicate": { "name": "order_amount",      "args": ["order_10042", 84] }, "confidence": 1.0, "source": "oms" }
    ],
    "authorization_goal": { "name": "may_refund", "args": ["order_10042"] },
    "external_ref": "order_10042",
    "hydrate_org_context": true
  }'

curl --request POST "$NSR_API/v1/decisions" … | jq '.verifiable_bundle' > bundle.json

curl --request POST "$NSR_API/v1/proofs/verify" \
  --header "X-API-Key: $NSR_API_KEY" \
  --header "Content-Type: application/json" \
  --data @bundle.json

const NSR = "https://api.nsr.stateset.com";
const headers = { "X-API-Key": process.env.NSR_API_KEY!, "Content-Type": "application/json" };

async function gateRefund(orderId: string, facts: Fact[], attempt = 1): Promise<GateResult> {
  let res: Response;
  try {
    res = await fetch(`${NSR}/v1/decisions`, {
      method: "POST", headers: { ...headers, "Idempotency-Key": `refund-${orderId}-attempt-${attempt}` },
      signal: AbortSignal.timeout(8_000),
      body: JSON.stringify({ query: `Can ${orderId} be refunded?`, action: "issue_refund", mode: "safe", facts,
                             authorization_goal: { name: "may_refund", args: [orderId] }, external_ref: orderId }),
    });
  } catch { return { act: false, route: "escalate", why: "nsr_unreachable" }; }        // no engine, no refund
  if (res.status === 402) return { act: false, route: "escalate", why: "outcome_quota_exhausted" };
  if (res.status === 429 || res.status >= 500) return { act: false, route: "retry_later", why: `http_${res.status}` };
  if (!res.ok) return { act: false, route: "escalate", why: `http_${res.status}` };

  const d = await res.json();
  const id = d.decision_id;
  if (d.decision === "denied") return { act: false, route: "tell_customer", why: d.plain_explanation, id };
  if (d.decision === "refused") {
    if (d.refusal?.requires_human_review || !d.refusal?.missing_facts?.length || attempt > 1)
      return { act: false, route: "escalate", why: d.refusal?.reason, id };
    const more = await lookUpFacts(d.refusal.missing_facts);       // your systems answer each `question`
    if (!more.length) return { act: false, route: "escalate", why: "missing_facts_unresolved", id };
    return gateRefund(orderId, [...facts, ...more], attempt + 1);    // resubmit once, using `resolves_with` shapes
  }
  // approved — act only on a proof you checked yourself
  if (!d.verifiable_bundle) return { act: false, route: "escalate", why: "approved_without_bundle", id };
  const v = await fetch(`${NSR}/v1/proofs/verify`, { method: "POST", headers, body: JSON.stringify(d.verifiable_bundle) });
  const verdict = v.ok ? await v.json() : { verified: false };
  if (!verdict.verified) return { act: false, route: "escalate", why: verdict.reason ?? "proof_unverified", id };
  return { act: true, route: "refund", id, policyHash: d.proof.request_policy_hash };
}

curl --request POST "$NSR_API/v1/decisions/outcome-by-ref" \
  --header "X-API-Key: $NSR_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{ "external_ref": "order_10042", "outcome": "honored" }'