@decidio/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,163 @@
+# @decidio/sdk
+
+One line to put a human-or-policy approval gate in front of any AI-agent action — and get a signed, verifiable Authority Receipt for every outcome.
+
+## Quickstart — seven steps to your first sealed receipt
+
+Work through these in order; a competent engineer lands the whole loop in under 30 minutes.
+
+**1. Install**
+
+```bash
+npm install @decidio/sdk
+```
+
+**2. Register your agent**
+
+```bash
+npx @decidio/sdk init my-agent
+```
+
+`init` signs you into your Decidio workspace (email + password, or paste the sign-in link from
+your workspace email), generates the agent's Ed25519 keypair **locally** (only the public
+`did:key` is sent), registers the agent, mints its **floor-limited API token** (it can call the
+agent gate and nothing else — your workspace session never touches the agent's disk), and writes
+`.env`. No workspace yet? Request access at [decidioai.com](https://decidioai.com/#early-access).
+
+**3. Protect one function** — rename the raw function, wrap it under the original name:
+
+```ts
+import { guard } from "@decidio/sdk";
+
+const createOpportunityRaw = (o) => sf.create("Opportunity", o);
+
+const createOpportunity = guard.protect(
+  createOpportunityRaw,
+  (o) => ({ action: "createOpportunity", amount: o.Amount, scope: "Opportunity" }),
+);
+```
+
+**4. Trigger a request:**
+
+```ts
+await createOpportunity({ Amount: 86_000 });
+```
+
+A brand-new agent matches **no** auto-approve rule, so Decidio's deny-by-default **routes every
+request to a human** — that is the point: nothing executes without either a named policy rule or
+a person. In durable mode the call parks its arguments agent-side and throws
+`DecidioSuspendedError`; the process may exit. (To see a policy `proceed`, register the agent in
+the sandbox's pre-policied lane — `DECIDIO_SOURCE_SYSTEM=salesforce npx @decidio/sdk init` — which
+auto-approves small amounts under a named, versioned rule when the request carries the agent's
+signed identity proof.)
+
+**5. Approve it** — the request is now in your Decidio queue (web or phone), or from the terminal:
+
+```bash
+npx @decidio/sdk approvals            # list pending
+npx @decidio/sdk approvals approve <decisionId>
+```
+
+On approval Decidio signs a verdict back to your resume route (or `resume.worker()` picks it
+up), and **your own function** executes — Decidio never holds your credentials.
+
+**6. Inspect the receipt** — open the sealed record in the Decidio app → **Verify** →
+**Download receipt (.json)**, then verify it offline with the open, zero-dependency verifier:
+
+```bash
+npx @decidio/verify receipt.json
+```
+
+The signature, content binding, and chain position verify with no Decidio account and no
+network — the evidence is yours, not ours.
+
+**7. Prove a replay is rejected** — the approval you just used is single-use. Try to use it again:
+
+```bash
+npx @decidio/sdk approvals approve <the same decisionId>   # → refused: already sealed
+curl -X POST http://localhost:4100/decidio/resume \
+  -H 'content-type: application/json' -d '{"decisionId":"<id>","verdict":"approved"}'
+# → refused: the resume handler fails closed without a verified x-decidio-signature,
+#   and the parked entry was deleted on first completion — a duplicate signal can't double-write.
+```
+
+That's the whole contract: gate → human decision → your execution → owned, verifiable evidence.
+
+## What happens on a call
+
+1. The wrapper asks Decidio's gate to authorize `{action, amount, scope}` for your `agentId`.
+2. Decidio's policy engine (Cedar) returns **proceed | route | block**:
+   - **proceed** — your function runs immediately (auto-approved under a named, versioned rule).
+   - **route** — the action suspends (durable) or waits (blocking) for a human decision in Decidio's queue, then runs your function (or throws `DecidioRejectedError`).
+   - **block** — the wrapper throws `DecidioBlockedError`; your function never runs.
+3. After your function runs, the wrapper reports the **real response it captured** back to Decidio, which seals an `application_confirmed` receipt (Decidio minimizes + tokenizes before sealing — the immutable record never stores raw payloads).
+
+Your agent executes its own action. **Decidio holds no write credentials for your system** — it authorizes the decision, records it, and (optionally) independently verifies it.
+
+## Real approvals take time — durable async resume
+
+A real human approval takes minutes to days. Nobody watches a 60-second polling window, so blocking the call is only honest for short, supervised approvals. For real ones, add a **resume controller** and the *same wrap* becomes durable: a routed action **suspends** instead of blocking — it parks its call args in an **agent-side store** (Decidio stores none of your downstream payload) and throws `DecidioSuspendedError`. The requesting process can exit. When a human approves, **Decidio POSTs a signed verdict** to your agent's resume URL; the controller re-runs *your own function* and confirms the result. Decidio signals — it never executes.
+
+```ts
+import { withApproval, createDecidioResume, FilePendingStore } from "@decidio/sdk";
+import { createServer } from "node:http";
+
+const resume = createDecidioResume({
+  apiUrl: process.env.DECIDIO_API_URL!,
+  apiToken: process.env.DECIDIO_API_TOKEN,
+  webhookSecret: process.env.DECIDIO_WEBHOOK_SECRET,        // Decidio signs callbacks (HMAC); verified before re-exec
+  resumeUrl: "https://my-agent.internal/decidio/resume",    // where Decidio calls back on approval
+  store: new FilePendingStore(".decidio-pending"),          // swap for Redis/Postgres/your queue
+});
+
+const createOpportunity = withApproval(createOpportunityRaw, describe, { ...guard, resume });
+
+// mount the resume listener (production webhook transport):
+createServer((req, res) => resume.webhookHandler()(req, res)).listen(4100);
+```
+
+No inbound URL (CLI / batch worker)? Use `resume.worker()` instead — a long-lived watcher that polls `/agent/status` for parked decisions and re-executes on approval. That polling is a durable *worker*, not the request path being kept alive. This is the same shape as HumanLayer's approval webhooks, Temporal Signals, Inngest `waitForEvent`, and Decidio's own A2A `input-required` resume. Re-execution is **single-use** (the parked entry is deleted on completion, so a duplicate signal can't double-write), and the webhook handler **fails closed** without a verified signature.
+
+### Already on a durable engine? Use its native wait (Inngest adapter)
+
+If your agent runs on Inngest/Temporal/LangGraph, the engine *is* the durable store — you don't need the file store at all. `@decidio/sdk/inngest` maps the gate onto Inngest's native `step.waitForEvent`, so a routed action durably suspends on the engine (zero compute, the worker can die for days) and resumes from its checkpoint:
+
+```ts
+import { decidioGateStep, createInngestResumeBridge } from "@decidio/sdk/inngest";
+
+const fn = inngest.createFunction({ id: "create-opp", triggers: [{ event: "salesops/opportunity.requested" }] },
+  async ({ event, step }) => decidioGateStep({
+    step, config: { ...guard, resumeUrl: "https://my-agent/decidio/resume" },
+    ctx: { action: "createOpportunity", amount: event.data.Amount, scope: "Opportunity" },
+    run: () => sf.create("Opportunity", event.data),   // YOUR write, on resume
+  }));
+
+// Decidio keeps its ONE signed-webhook contract; this bridge translates it into the
+// Inngest event that wakes the suspended run:
+const bridge = createInngestResumeBridge({ inngest, webhookSecret: process.env.DECIDIO_WEBHOOK_SECRET });
+```
+
+`inngest` is an **optional peer dependency** — the core SDK never imports it, so plain users pay nothing. See `example/inngest-agent.ts` in the repo for a runnable end-to-end (Inngest dev server + the bridge).
+
+## One surface, every runtime — and Python too
+
+- **`guard.protect(fn, describe, { adapter })`** is the same call everywhere. Engine adapters map it onto each engine's native durable wait: `@decidio/sdk/langgraph` (drop-in via `interrupt()`), `@decidio/sdk/inngest` (`waitForEvent`), `@decidio/sdk/temporal` (`condition` + signal), `@decidio/sdk/openai` (RunState approvals). No engine? The core webhook/worker resume is the universal path.
+- **Python twin:** `pip install decidio` exposes the identical `guard.protect` (plus the `@guard.approve` decorator, adapters, and the offline verifier); a conformance suite asserts both languages emit an identical request + receipt.
+
+## CLI
+
+`npx @decidio/sdk <cmd>` — `init [agentId]` (sign in, register, mint the agent token, write `.env`) · `doctor` (config + connectivity + token-scope check) · `approvals [approve|reject <id> [reason]]` · `dev [--target URL]` (signal-only relay for a local agent). Commands that administer your workspace (`init`, `approvals`) use a **session** sign-in held in memory for the run; the only credential written to disk is the agent's floor-limited token.
+
+## Errors
+
+- `DecidioBlockedError` — policy blocked the action (incl. the universal deny-by-default backstop).
+- `DecidioRejectedError` — a human rejected the routed action.
+- `DecidioSuspendedError` — (resume mode) the action was routed and is now parked for async approval; the process may exit and resume later. Not a failure.
+- `DecidioTimeoutError` — (blocking mode only) no human decided within `pollTimeoutMs` (default 10 min).
+
+## Notes
+
+- **Framework-agnostic:** it wraps at the tool-call boundary, so it works with any agent runtime (LangGraph, OpenAI Agents SDK, CrewAI, a raw tool loop) and any action (Salesforce, M365, SAP, a DB write).
+- **Confirmation integrity:** the wrapper runs in your process, so it captures the genuine API response — a materially stronger signal than an agent self-report, but it trusts the host. For high-assurance, Decidio can *independently* read the source back (`source_confirmed`) where it holds a read connection.
+- **Zero-code alternative:** an agent that speaks MCP (e.g. Claude on the web) can reach the same gate via Decidio's `request_approval` MCP tool with no code at all.
+- **API surface:** the agent-gate REST contract this SDK speaks is described in [`openapi.yaml`](./openapi.yaml), shipped in the package.

package/dist/adapters/_gate.d.ts

@@ -0,0 +1,13 @@
+import { type GuardConfig, type ApprovalContext } from "../index.js";
+export interface GateAuth {
+    decision: "proceed" | "route" | "block";
+    decisionId: string;
+    receiptId?: string;
+    reason?: string;
+}
+export declare function gateAuthorize(config: GuardConfig, ctx: ApprovalContext): Promise<GateAuth>;
+export declare function gateConfirm(config: GuardConfig, decisionId: string, result: unknown): Promise<void>;
+/** Normalize a resume payload ({verdict} | "approved" | ...) to a verdict string. */
+export declare function verdictFrom(payload: any): string;
+/** Throw the right error for a non-approving verdict; return for approved/auto_approved. */
+export declare function assertVerdict(verdict: string, decisionId: string, reason?: string): void;

package/dist/adapters/_gate.js

@@ -0,0 +1,60 @@
+// Shared adapter gate logic (TS) — the thin-adapter rule in code. Every engine adapter
+// reuses these gate calls + verdict handling; only the suspend/resume translation
+// differs. Pure/testable so the offline smoke covers our logic; the engine-primitive
+// call in each adapter is a thin one-liner verified by typecheck against real types.
+import { DecidioBlockedError, DecidioRejectedError, signBoundProof, signConfirm } from "../index.js";
+export async function gateAuthorize(config, ctx) {
+    const f = config.fetchImpl ?? fetch;
+    // Fall back to the resume controller's URL (matches the core wrapper) so an adapter
+    // decision carries a callback URL even when only resume.resumeUrl was set.
+    const resumeUrl = config.resumeUrl ?? config.resume?.resumeUrl;
+    // Sign the bound identity proof like the core wrapper, so an adapter-path agent can PROVE
+    // its identity and auto-approve (not just route). No key → unsigned → server routes.
+    const requesterIdentity = (config.agentKey && config.agentDid)
+        ? signBoundProof(config.agentKey, { agentId: config.agentId, did: config.agentDid, action: ctx.action, amount: ctx.amount, scope: ctx.scope, workspaceId: config.workspaceId })
+        : undefined;
+    const res = await f(config.apiUrl.replace(/\/$/, "") + "/agent/authorize", {
+        method: "POST",
+        headers: { "content-type": "application/json", ...(config.apiToken ? { authorization: `Bearer ${config.apiToken}` } : {}) },
+        body: JSON.stringify({
+            requester: config.agentId, action: ctx.action, amount: ctx.amount, scope: ctx.scope,
+            sourceSystem: config.sourceSystem, ...(ctx.context ? { context: ctx.context } : {}),
+            ...(requesterIdentity ? { requesterIdentity } : {}), ...(resumeUrl ? { resumeUrl } : {}),
+        }),
+    });
+    if (!res.ok)
+        throw new Error(`decidio /agent/authorize ${res.status}`);
+    return res.json();
+}
+export async function gateConfirm(config, decisionId, result) {
+    const f = config.fetchImpl ?? fetch;
+    try {
+        // Sign the confirm too (bound to {action:"confirm", scope:decisionId}) so the adapter path
+        // earns application_confirmed; without a key the server caps it at agent_asserted.
+        const requesterIdentity = signConfirm(decisionId, config);
+        const res = await f(config.apiUrl.replace(/\/$/, "") + "/agent/confirm", {
+            method: "POST",
+            headers: { "content-type": "application/json", ...(config.apiToken ? { authorization: `Bearer ${config.apiToken}` } : {}) },
+            body: JSON.stringify({ decisionId, capturedResponse: result ?? null, source: "wrapper", ...(requesterIdentity ? { requesterIdentity } : {}) }),
+        });
+        // fetch only rejects on network error — surface a non-2xx (auth/500) too. Best-effort:
+        // log, don't throw (the action already happened).
+        if (!res.ok)
+            console.warn(`[decidio] confirm returned ${res.status} (action succeeded)`);
+    }
+    catch (e) {
+        console.warn(`[decidio] confirm failed (action succeeded): ${e.message}`);
+    }
+}
+/** Normalize a resume payload ({verdict} | "approved" | ...) to a verdict string. */
+export function verdictFrom(payload) {
+    return (payload && typeof payload === "object" ? payload.verdict : payload) ?? "";
+}
+/** Throw the right error for a non-approving verdict; return for approved/auto_approved. */
+export function assertVerdict(verdict, decisionId, reason) {
+    if (verdict === "approved" || verdict === "auto_approved")
+        return;
+    if (verdict === "rejected")
+        throw new DecidioRejectedError(reason ?? "rejected by approver", decisionId);
+    throw new DecidioBlockedError(reason ?? "not approved", decisionId);
+}

package/dist/adapters/langgraph.d.ts

@@ -0,0 +1,10 @@
+import { Command } from "@langchain/langgraph";
+import { type GuardConfig, type ApprovalContext } from "../index.js";
+/** Gate `run()` behind Decidio inside a LangGraph node. */
+export declare function decidioGate<R>(config: GuardConfig, ctx: ApprovalContext, run: () => Promise<R>): Promise<R>;
+/** Translate Decidio's signed resume webhook into the LangGraph resume Command. The host
+ *  maps decisionId → thread_id and passes this to graph.invoke/stream. */
+export declare function decidioResumeCommand(body: {
+    verdict?: string;
+    reason?: string;
+}): Command;

package/dist/adapters/langgraph.js

@@ -0,0 +1,28 @@
+// @decidio/sdk/langgraph — durable suspend via LangGraph's native `interrupt()`.
+// `interrupt` finds the running graph itself (no handle needed), so the gate drops into
+// a node: authorize → on route, interrupt() durably pauses (the checkpointer persists;
+// the process can die) → on resume (Command(resume={verdict})) run the agent's own
+// action + confirm. Decidio is the approval system; the host bridges its webhook to the
+// graph resume (decidioResumeCommand). Requires @langchain/langgraph (optional peer dep).
+import { interrupt, Command } from "@langchain/langgraph";
+import { DecidioBlockedError } from "../index.js";
+import { gateAuthorize, gateConfirm, verdictFrom, assertVerdict } from "./_gate.js";
+/** Gate `run()` behind Decidio inside a LangGraph node. */
+export async function decidioGate(config, ctx, run) {
+    const auth = await gateAuthorize(config, ctx);
+    if (auth.decision === "block")
+        throw new DecidioBlockedError(auth.reason ?? "blocked by policy", auth.decisionId);
+    if (auth.decision === "route") {
+        // Durable pause. On resume, interrupt() returns the Command(resume=...) payload.
+        const resumed = interrupt({ decidio: { decisionId: auth.decisionId, action: ctx.action, amount: ctx.amount, scope: ctx.scope } });
+        assertVerdict(verdictFrom(resumed), auth.decisionId, resumed?.reason);
+    }
+    const result = await run();
+    await gateConfirm(config, auth.decisionId, result);
+    return result;
+}
+/** Translate Decidio's signed resume webhook into the LangGraph resume Command. The host
+ *  maps decisionId → thread_id and passes this to graph.invoke/stream. */
+export function decidioResumeCommand(body) {
+    return new Command({ resume: { verdict: body.verdict, reason: body.reason } });
+}

package/dist/adapters/openai.d.ts

@@ -0,0 +1,26 @@
+import type { GuardConfig, ApprovalContext } from "../index.js";
+type ToolApprovalItem = any;
+interface RunStateLike {
+    getInterruptions(): ToolApprovalItem[];
+    approve(item: ToolApprovalItem): void;
+    reject(item: ToolApprovalItem): void;
+}
+export interface Resolved {
+    item: ToolApprovalItem;
+    verdict: "approved" | "blocked";
+    decisionId: string;
+}
+export interface Pending {
+    item: ToolApprovalItem;
+    decisionId: string;
+}
+/** Ask Decidio for each pending tool-approval on a RunState.
+ *  proceed → state.approve(item); block → state.reject(item); route → pending (a human
+ *  decides via Decidio; the host parks state.toString() + resumes via applyResume). */
+export declare function gateInterruptions(config: GuardConfig, state: RunStateLike, describe: (item: ToolApprovalItem) => ApprovalContext): Promise<{
+    resolved: Resolved[];
+    pending: Pending[];
+}>;
+/** Apply a Decidio verdict to a resumed RunState (after RunState.fromString). */
+export declare function applyResume(state: RunStateLike, item: ToolApprovalItem, verdict: string): void;
+export {};

package/dist/adapters/openai.js

@@ -0,0 +1,45 @@
+// @decidio/sdk/openai — gate OpenAI Agents SDK tool-approval interruptions through
+// Decidio, with durable suspend via the SDK's native RunState serialization.
+//
+// The Agents loop surfaces tool approvals on the RunState (state.getInterruptions());
+// you state.approve(item)/reject(item) then resume with run(agent, state). RunState
+// serializes (state.toString() / RunState.fromString(agent, s)) — that's the durability:
+// park the serialized state agent-side on `route`, resume on Decidio's approval.
+//
+//   const state = result.state;                       // or RunState from the run
+//   const { resolved, pending } = await gateInterruptions(config, state, describe);
+//   if (pending.length) { await store.put(decisionId, state.toString()); return; }  // suspend
+//   result = await run(agent, state);                 // all resolved → resume
+//   // on Decidio approval webhook: state = await RunState.fromString(agent, parked);
+//   //   applyResume(state, item, verdict); result = await run(agent, state);
+//
+// Duck-typed on the state/item (no hard @openai/agents import) so it stays thin.
+import { gateAuthorize } from "./_gate.js";
+/** Ask Decidio for each pending tool-approval on a RunState.
+ *  proceed → state.approve(item); block → state.reject(item); route → pending (a human
+ *  decides via Decidio; the host parks state.toString() + resumes via applyResume). */
+export async function gateInterruptions(config, state, describe) {
+    const resolved = [];
+    const pending = [];
+    for (const item of state.getInterruptions()) {
+        const auth = await gateAuthorize(config, describe(item));
+        if (auth.decision === "proceed") {
+            state.approve(item);
+            resolved.push({ item, verdict: "approved", decisionId: auth.decisionId });
+        }
+        else if (auth.decision === "block") {
+            state.reject(item);
+            resolved.push({ item, verdict: "blocked", decisionId: auth.decisionId });
+        }
+        else
+            pending.push({ item, decisionId: auth.decisionId });
+    }
+    return { resolved, pending };
+}
+/** Apply a Decidio verdict to a resumed RunState (after RunState.fromString). */
+export function applyResume(state, item, verdict) {
+    if (verdict === "approved" || verdict === "auto_approved")
+        state.approve(item);
+    else
+        state.reject(item);
+}

package/dist/adapters/temporal.d.ts

@@ -0,0 +1,16 @@
+import { type GuardConfig, type ApprovalContext } from "../index.js";
+import { type GateAuth } from "./_gate.js";
+export declare const decidioResumeSignal: import("@temporalio/workflow").SignalDefinition<[string, string, (string | undefined)?]>;
+/** Call inside the workflow to wire the resume signal; returns the verdict store. */
+export declare function installDecidioSignal(): Map<string, {
+    verdict: string;
+    reason?: string;
+}>;
+export interface DecidioGateOpts {
+    authorize?: () => Promise<GateAuth>;
+    confirm?: (decisionId: string, result: unknown) => Promise<void>;
+}
+export declare function decidioGate<R>(config: GuardConfig, ctx: ApprovalContext, run: () => Promise<R>, verdicts: Map<string, {
+    verdict: string;
+    reason?: string;
+}>, opts?: DecidioGateOpts): Promise<R>;

package/dist/adapters/temporal.js

@@ -0,0 +1,34 @@
+// @decidio/sdk/temporal — durable suspend via Temporal's native `condition()` + a
+// Decidio resume signal. Strongest durability (the workflow survives worker restarts for
+// days); the agent's action runs on resume. Requires @temporalio/workflow (optional peer).
+//
+// Inside your workflow:
+//   const verdicts = installDecidioSignal();                 // wires the resume signal
+//   const out = await decidioGate(config, ctx, () => createOpp(o), verdicts, {
+//     authorize: () => executeActivity(authorizeActivity, ...),   // HTTP belongs in activities
+//     confirm:   (id, r) => executeActivity(confirmActivity, ...),
+//   });
+// Decidio's webhook bridges to: handle.signal(decidioResumeSignal, decisionId, verdict, reason)
+import { condition, defineSignal, setHandler } from "@temporalio/workflow";
+import { DecidioBlockedError } from "../index.js";
+import { gateAuthorize, gateConfirm, verdictFrom, assertVerdict } from "./_gate.js";
+export const decidioResumeSignal = defineSignal("decidioResume");
+/** Call inside the workflow to wire the resume signal; returns the verdict store. */
+export function installDecidioSignal() {
+    const verdicts = new Map();
+    setHandler(decidioResumeSignal, (decisionId, verdict, reason) => { verdicts.set(decisionId, { verdict, reason }); });
+    return verdicts;
+}
+export async function decidioGate(config, ctx, run, verdicts, opts = {}) {
+    const auth = await (opts.authorize ?? (() => gateAuthorize(config, ctx)))();
+    if (auth.decision === "block")
+        throw new DecidioBlockedError(auth.reason ?? "blocked by policy", auth.decisionId);
+    if (auth.decision === "route") {
+        await condition(() => verdicts.has(auth.decisionId)); // durable wait on the signal
+        const v = verdicts.get(auth.decisionId);
+        assertVerdict(verdictFrom(v), auth.decisionId, v.reason);
+    }
+    const result = await run();
+    await (opts.confirm ?? ((id, r) => gateConfirm(config, id, r)))(auth.decisionId, result);
+    return result;
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};