@decidio/sdk 0.1.12 → 0.2.1

package/dist/signing.js

@@ -111,6 +111,18 @@ export function assertJsonSafe(value, path = "args") {
     walk(value, path);
 }
 export function assertSafeTransport(url, hasCredential) {
+    if (!hasCredential) {
+        let probe = null;
+        try {
+            probe = new URL(url);
+        }
+        catch {
+            probe = null;
+        }
+        if (probe && (probe.username || probe.password)) {
+            throw new Error(`[decidio] the gate URL carries credentials in the URL itself (${probe.protocol}//user:***@${probe.host}). Decidio authenticates with a bearer token, so this is either a mistake or a secret you did not mean to put on the wire — and it is sent on every request regardless of whether an api token is configured. Remove the user:password from the URL. Nothing was sent.`);
+        }
+    }
     if (!hasCredential)
         return;
     let u;
@@ -124,11 +136,17 @@ export function assertSafeTransport(url, hasCredential) {
         }
         return;
     }
+    if (u.protocol !== "http:" && u.protocol !== "https:") {
+        throw new Error(`[decidio] the gate URL uses the ${u.protocol.replace(":", "")} scheme, which is not a Decidio endpoint — use https (or http://localhost for local dev). Nothing was sent.`);
+    }
+    if (u.username || u.password) {
+        throw new Error(`[decidio] the gate URL carries credentials in the URL itself (${u.protocol}//user:***@${u.host}). Decidio authenticates with a bearer token; remove the user:password from the URL. Nothing was sent.`);
+    }
     if (u.protocol !== "http:")
         return;
     const host = u.hostname.toLowerCase();
     const local = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
-    if (local && !u.username && !u.password)
+    if (local)
         return;
     throw new Error(`[decidio] refusing to send credentials over plaintext http to ${u.origin} — use https, or localhost for local dev. Nothing was sent.`);
 }

package/openapi.yaml

@@ -147,12 +147,76 @@ components:
           properties:
             protected: { type: string, description: "base64url JWS protected header (EdDSA, kid=did, typ=decidio-execution-report+jws)" }
             signature: { type: string, description: base64url detached signature over protected.payload }
+    ResumeWebhookResponse:
+      type: object
+      description: >
+        What the agent's resume endpoint answers. Through 0.1.x this was `{ok, outcome:{status,
+        decisionId}}` — the operator learned the SDK had finished, not whether the execution was
+        recorded, which is the only part Decidio can act on. Every field below was already
+        computed and discarded at the last line of the handler.
+      required: [ok, outcome]
+      properties:
+        ok: { type: boolean }
+        outcome:
+          type: object
+          required: [status, decisionId]
+          properties:
+            status:
+              type: string
+              enum: [executed, indeterminate, rejected, blocked, no_handler, unknown]
+              description: >
+                the LOCAL run. `indeterminate` means the handler was invoked and its outcome is
+                unknown — it will NOT be retried automatically and needs reconcile().
+            decisionId: { type: string }
+            reportRecorded: { type: boolean, description: "Decidio accepted the execution report." }
+            executionConfirmed: { type: boolean, description: "the recorded tier attests a COMMITTED execution — a different question from reportRecorded." }
+            evidenceTier:
+              type: string
+              enum: [pending, execution_unconfirmed, agent_asserted, sensor_observed, application_confirmed, independently_reconciled]
+            executionReportVerified: { type: boolean }
+            executionReportReason: { type: string, description: "why the attestation did not verify — a field, so a caller can branch instead of parsing prose." }
+            confirmationRetryable: { type: boolean, description: "whether re-sending this report could succeed." }
+            reportJournalled: { type: boolean, description: "whether the reported value is durable, which decides whether reconfirm() can help." }
+            evidenceError: { type: string, description: "the evidence mapper rejected the return value, so an empty captured response was reported." }
+            diagnostic: { type: string }
+    ConfirmResponse:
+      type: object
+      description: >
+        What the gate actually recorded. The SDK treats an unrecognised `confirmation` as NOT
+        evidence (closed enum, fail-closed), so adding a tier here is a breaking change for older
+        clients by design — they refuse to interpret what they do not understand rather than
+        guess.
+      required: [ok]
+      properties:
+        ok:
+          type: boolean
+          description: false means nothing was recorded; the SDK does not treat the report as delivered.
+        confirmation:
+          type: string
+          enum: [pending, execution_unconfirmed, agent_asserted, sensor_observed, application_confirmed, independently_reconciled]
+          description: the tier the report EARNED. Absent on a 2xx means no tier was assigned — also not evidence.
+        recordId:
+          type: string
+          description: the record the evidence accrued to.
+        executionReport:
+          type: object
+          description: >
+            The server's verdict on the signed report, when one was sent. `verified: false` with a
+            reason is surfaced to the caller verbatim — an execution whose proof did not check out
+            must not read as confirmed.
+          properties:
+            verified: { type: boolean }
+            reason:
+              type: string
+              description: why verification failed (unknown did, expired proof, burnt nonce, payload mismatch).
     ResumeWebhook:
       type: object
       description: >
         OUTBOUND — Decidio → your resumeUrl when a routed decision is decided. The raw body is
         HMAC-signed; verify `x-decidio-signature: sha256=<hex>` with your DECIDIO_WEBHOOK_SECRET
-        BEFORE acting (the SDK resume controllers fail closed). Re-execution is single-use.
+        BEFORE acting (the SDK resume controllers fail closed). A duplicate delivery cannot cause a
+        second execution: the SDK writes a durable invoking marker before calling the handler,
+        so once invocation may have begun it is never invoked again automatically.
         OPERATOR DEPLOYMENTS ONLY: signing uses a shared secret configured on both the Decidio
         server and the agent, and self-hosted production allow-lists resume hosts (default-deny).
         Self-serve agents against the hosted sandbox use the SDK's poll worker (guard.worker())
@@ -201,16 +265,27 @@ paths:
   /agent/confirm:
     post:
       summary: >
-        Report the captured execution outcome — recorded as the RECORD's evidence tier
-        (application_confirmed). The credential sealed at decision time is immutable; evidence
-        accrues on the record, never inside the sealed bytes.
+        Report the captured execution outcome — recorded as the RECORD's evidence tier. The tier
+        is EARNED, not requested: `application_confirmed` when the report carries a valid signed
+        executionReport from a registered agent, `agent_asserted` when it is an unsigned
+        self-report, `execution_unconfirmed` when the captured response carries no usable
+        evidence. The caller does not choose it and this endpoint does not always grant the top
+        one. The credential sealed at decision time is immutable; evidence accrues on the record,
+        never inside the sealed bytes.
       requestBody:
         required: true
         content:
           application/json:
             schema: { $ref: "#/components/schemas/ConfirmRequest" }
       responses:
-        "200": { description: recorded }
+        "200":
+          description: >
+            The report was accepted. `ok` and the tier are what the SDK branches on — a 200 alone
+            does NOT mean the execution was confirmed, and a client that assumes it does will
+            record an assurance the server never granted.
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/ConfirmResponse" }
         "401": { description: missing/invalid agent token }
   x-webhooks:
     resume:
@@ -221,5 +296,13 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/ResumeWebhook" }
         responses:
-          "200": { description: agent accepted and (single-use) re-executed }
+          "200":
+            description: >
+              Agent accepted; executed at most once — a duplicate delivery is refused by the
+              durable execution state, not re-run. The body reports what was RECORDED, not merely
+              that the SDK finished: a 200 whose `outcome.reportRecorded` is false means the
+              action ran and Decidio does NOT have its report.
+            content:
+              application/json:
+                schema: { $ref: "#/components/schemas/ResumeWebhookResponse" }
           "401": { description: signature missing/invalid — the controller fails closed }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.1.12",
+  "version": "0.2.1",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -33,7 +33,8 @@
     "./openai": {
       "types": "./dist/adapters/openai.d.ts",
       "default": "./dist/adapters/openai.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
@@ -54,24 +55,29 @@
     "verifiable-credentials"
   ],
   "homepage": "https://decidioai.com/developers/",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OmniTwin/Decidio.git",
+    "directory": "packages/decidio-guard"
+  },
   "publishConfig": {
     "access": "public"
   },
+  "peerDependencies": {
+    "@langchain/langgraph": ">=0.2 <2",
+    "@temporalio/workflow": ">=1.9 <2"
+  },
   "peerDependenciesMeta": {
-    "inngest": {
-      "optional": true
-    },
     "@langchain/langgraph": {
       "optional": true
     },
     "@temporalio/workflow": {
       "optional": true
-    },
-    "@openai/agents": {
-      "optional": true
     }
   },
   "devDependencies": {
+    "@langchain/langgraph": "^1.4.13",
+    "@temporalio/workflow": "^1.23.0",
     "@types/node": "^22.20.1",
     "typescript": "^5.9.3"
   },
@@ -81,7 +87,7 @@
     "prepublishOnly": "npm run typecheck && npm run build"
   },
   "dependencies": {
-    "@decidio/verify": "0.1.10"
+    "@decidio/verify": "0.2.1"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {