@decidio/sdk 0.1.4 → 0.1.6

package/dist/index.js

@@ -1,32 +1,3 @@
-// @decidio/sdk — the one-line approval gate for AI-agent actions.
-//
-//   import { guard } from "@decidio/sdk";
-//   const createOpportunity = guard.protect(createOpportunityRaw, (a) => ({
-//     action: "createOpportunity", amount: a.amount, scope: "Opportunity",
-//   }));
-//
-// NOTE: `guard` is the preconfigured SINGLETON (a Guard instance, see guard.ts). It is NOT a
-// GuardConfig, so it cannot be passed as withApproval's third argument — this comment used to
-// show exactly that, and the error propagated into the product's own copy-paste snippets.
-// `withApproval(fn, describe, config)` is the lower-level export and takes a config OBJECT.
-//
-// On call, the wrapper asks Decidio's gate to authorize the action. Decidio's
-// policy engine (Cedar / computeChain) returns proceed | route | block:
-//   • proceed → the wrapped fn runs immediately (auto-approved under policy)
-//   • route   → the wrapper WAITS for a human to approve in Decidio's queue, then
-//               runs the fn (or throws if rejected)
-//   • block   → the wrapper throws; the fn never runs
-// The wrapper is a LISTENER: it captures the real source-system response the wrapped
-// fn returns and reports it to Decidio, which seals an `application_confirmed`
-// Authority Receipt (Decidio minimizes + tokenizes before sealing — the immutable
-// seal never stores raw payloads). The agent executes its own action; Decidio
-// authorizes, records, and (optionally) independently verifies it. Decidio holds NO
-// write credentials for your system — only the authority decision and the record.
-//
-// Framework-agnostic by design: it wraps at the tool-call boundary, so it works with
-// any agent runtime (LangGraph, OpenAI Agents SDK, CrewAI, a raw tool loop) and any
-// action (Salesforce, M365, SAP, a DB write) — the wrapper doesn't care what the fn
-// does, only that it returns the source response.
 import { DecidioSuspendedError } from "./resume.js";
 import { signBoundProof, signConfirm } from "./signing.js";
 export { DecidioSuspendedError, FilePendingStore, MemoryPendingStore, createDecidioResume } from "./resume.js";
@@ -61,10 +32,6 @@ export class DecidioTimeoutError extends Error {
     }
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-/** A transport failure with GUIDANCE instead of a raw undici stack (round-4 Codex catch: the CLI
- *  wrapped network errors kindly but the runtime leaked `TypeError: fetch failed`). Carries the
- *  endpoint, the operation, the underlying code, and the safety state a caller cares about most:
- *  whether anything could have executed. */
 export class DecidioNetworkError extends Error {
     endpoint;
     op;
@@ -109,13 +76,6 @@ async function get(cfg, path) {
         throw new Error(`decidio ${path} ${res.status}`);
     return res.json();
 }
-/**
- * Wrap an async action behind the Decidio gate. `describe` extracts the approval
- * context (action, amount, scope) from the call arguments. Returns a function with
- * the SAME signature as `fn` — drop-in.
- */
-/** `<appUrl>/d/<decisionId>` — the deep link that opens this decision directly, on the web app or
- *  the phone build. Null when DECIDIO_APP_URL is not configured, never a half-built URL. */
 export function decisionUrl(appUrl, decisionId) {
     if (!appUrl)
         return null;
@@ -127,10 +87,6 @@ export function withApproval(fn, describe, config) {
     const resumeUrl = config.resumeUrl ?? config.resume?.resumeUrl;
     return async (...args) => {
         const ctx = describe(...args);
-        // 1. ask the gate (carry the resume URL so a routed decision knows where to call back).
-        //    When a signing key is configured, sign a request-bound identity proof so the floor
-        //    can PROVE this agent rather than trust the `requester` label (registered agents must
-        //    sign to auto-approve). Unsigned still works for generic/non-agent callers.
         const requesterIdentity = (config.agentKey && config.agentDid)
             ? signBoundProof(config.agentKey, { agentId: config.agentId, did: config.agentDid, action: ctx.action, amount: ctx.amount, scope: ctx.scope, workspaceId: config.workspaceId })
             : undefined;
@@ -141,48 +97,28 @@ export function withApproval(fn, describe, config) {
             ...(requesterIdentity ? { requesterIdentity } : {}),
             ...(resumeUrl ? { resumeUrl } : {}),
         });
-        // Allow-list, not deny-list: an unrecognised verdict means this SDK is older than the
-        // server, and the safe reading of an answer you do not understand is NO. Without this, the
-        // day a fourth verdict ships every deployed SDK falls through and executes it.
         if (auth.decision !== "proceed" && auth.decision !== "route" && auth.decision !== "block")
             throw new DecidioBlockedError(`unrecognized gate verdict: ${String(auth.decision)}`, auth.decisionId);
         if (auth.decision === "block")
             throw new DecidioBlockedError(auth.reason ?? "blocked by policy", auth.decisionId);
-        // 2. routed → either SUSPEND for async resume (durable) or BLOCK-poll (interactive)
         if (auth.decision === "route") {
-            // ALWAYS hand back the decision id — an agent that suspends and says only "waiting" leaves
-            // the operator hunting through a queue, and an agent that says NOTHING (the pre-0.1.2 bug:
-            // the print was gated on appUrl, which init never writes) leaves them staring at a silent
-            // terminal. The Codex acceptance run failed exactly this claim; the id line is unconditional
-            // now, with the deep link when appUrl is configured and the CLI command when not.
             const approvalUrl = decisionUrl(config.appUrl, auth.decisionId);
             if (config.onPending)
                 config.onPending({ decisionId: auth.decisionId, receiptId: auth.receiptId, url: approvalUrl });
             else
                 console.log(`[decidio] ${ctx.action} is awaiting approval (decision ${auth.decisionId}) — approve it ${approvalUrl ? `at ${approvalUrl}` : `in your Decidio queue, or: npx @decidio/sdk approvals approve ${auth.decisionId}`}`);
-            // Durable transport: park the args agent-side, register the raw fn so a (cold)
-            // resume can replay it, and SUSPEND. The process may exit now; the controller's
-            // webhook handler or poll worker re-executes THIS fn when a human approves.
-            // Decidio never executes — it only signals.
             if (config.resume) {
-                // Propagate the agent's signing identity to the resume controller so the eventual
-                // (possibly cold) confirm on resume is SIGNED too — earning application_confirmed on
-                // the durable path, not just inline. (No-op if the controller already has its own.)
                 config.resume.agentId ??= config.agentId;
                 config.resume.agentKey ??= config.agentKey;
                 config.resume.agentDid ??= config.agentDid;
                 config.resume.register(ctx.action, fn);
-                await config.resume.store.put({
+                await config.resume.park({
                     decisionId: auth.decisionId, receiptId: auth.receiptId,
-                    action: ctx.action, amount: ctx.amount, scope: ctx.scope,
-                    args, createdAt: new Date().toISOString(),
+                    action: ctx.action, amount: ctx.amount, scope: ctx.scope, args,
                 });
                 throw new DecidioSuspendedError(auth.decisionId, ctx.action);
             }
-            // Interactive transport (no resume configured): block until decided. Only
-            // appropriate for short, watched approvals (demos, synchronous tools).
             const deadline = Date.now() + pollTimeout;
-            // eslint-disable-next-line no-constant-condition
             while (true) {
                 const st = await get(config, `/agent/status/${encodeURIComponent(auth.decisionId)}`);
                 if (st.state === "approved" || st.state === "auto_approved")
@@ -192,39 +128,25 @@ export function withApproval(fn, describe, config) {
                 if (st.state === "blocked")
                     throw new DecidioBlockedError(st.reason ?? "blocked", auth.decisionId);
                 if (Date.now() > deadline) {
-                    // The founder-visible failure of blocking: the wait has a ceiling, and past it the
-                    // work is LOST — the decision stays open in Decidio but nothing is parked to resume.
-                    // Say so, say the limit, and say the durable way out.
                     console.warn(`[decidio] blocking wait hit its ${Math.round(pollTimeout / 1000)}s limit — decision ${auth.decisionId} is still open in Decidio, but this process stopped waiting and nothing was executed. Re-run to request again, or use durable resume (guard.worker()) so an approval is never lost.`);
                     throw new DecidioTimeoutError(auth.decisionId);
                 }
                 await sleep(pollInterval);
             }
         }
-        // 3. authorized inline (proceed, or interactive route just approved) → run the
-        //    REAL action and capture the source response (listener)
         const result = await fn(...args);
-        // 4. report the captured outcome → Decidio seals application_confirmed
-        //    (server minimizes + tokenizes the response before sealing). Best-effort:
-        //    a confirmation failure must not undo a successful business action.
         try {
-            // Sign the confirmation too (bound to {action:"confirm", scope:decisionId}) so the gate
-            // can PROVE this is the receipt's original requester before granting the wrapper tier
-            // (application_confirmed). Without a key the report is capped at agent_asserted server-side.
             const confirmIdentity = signConfirm(auth.decisionId, config);
             await post(config, "/agent/confirm", {
                 decisionId: auth.decisionId,
                 capturedResponse: result ?? null,
-                source: "wrapper", // the SDK captured the genuine response, not an agent self-report
+                source: "wrapper",
                 ...(confirmIdentity ? { requesterIdentity: confirmIdentity } : {}),
             });
-            // An UNSIGNED confirm is server-capped at the weaker agent_asserted tier. Say so at the
-            // moment it happens — a silent evidence downgrade was round 3's acceptance FAIL.
             if (!confirmIdentity)
                 console.warn(`[decidio] execution evidence for ${auth.decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID (npx @decidio/sdk init writes them) to earn application_confirmed.`);
         }
         catch (e) {
-            // surface but don't throw — the action already happened
             console.warn(`[decidio] confirmation post failed (action succeeded): ${e.message}`);
         }
         return result;

package/dist/inngest.d.ts

@@ -1,11 +1,7 @@
 import type { RequestListener } from "node:http";
 import { verifyResumeSignature } from "./resume.js";
 import type { GuardConfig, ApprovalContext } from "./index.js";
-/** The Inngest event Decidio's verdict is translated into. The waiting function
- *  correlates on `data.decisionId`. */
 export declare const DECIDIO_RESUME_EVENT = "decidio/decision.resolved";
-/** The minimal slices of the Inngest step + client APIs we use, typed structurally so
- *  this file doesn't force an `inngest` type dependency on the core build. */
 export interface InngestStepLike {
     run<T>(id: string, fn: () => Promise<T>): Promise<T>;
     waitForEvent(id: string, opts: {
@@ -29,16 +25,6 @@ export type GateStepOutcome<R> = {
     decisionId: string;
     result?: R;
 };
-/**
- * Gate an action INSIDE an Inngest function, with durable suspend on routing.
- *   • proceed → run the action (as a step) + confirm.
- *   • route   → `step.waitForEvent` durably suspends until Decidio's resume event for
- *               THIS decision arrives; approved → run + confirm; rejected → status.
- *   • block   → return blocked (the action never runs).
- * The action runs in YOUR process with YOUR credentials — Decidio only signals.
- * `config.resumeUrl` must point at the bridge endpoint (createInngestResumeBridge),
- * so Decidio's webhook is translated into the event this step waits on.
- */
 export declare function decidioGateStep<R>(args: {
     step: InngestStepLike;
     config: GuardConfig;
@@ -46,12 +32,6 @@ export declare function decidioGateStep<R>(args: {
     run: () => Promise<R>;
     timeout?: string;
 }): Promise<GateStepOutcome<R>>;
-/**
- * Decidio → Inngest bridge. Mount as an HTTP endpoint and register it as the agent's
- * `resumeUrl`. It verifies Decidio's signed resume webhook (same HMAC as the core
- * handler) and emits `DECIDIO_RESUME_EVENT` into Inngest, waking the suspended
- * `decidioGateStep`. Fails CLOSED without a configured secret (unless allowUnsigned).
- */
 export declare function createInngestResumeBridge(opts: {
     inngest: InngestClientLike;
     webhookSecret?: string;

package/dist/inngest.js

@@ -1,26 +1,12 @@
 import { verifyResumeSignature } from "./resume.js";
 import { signBoundProof, signConfirm } from "./signing.js";
-/** The Inngest event Decidio's verdict is translated into. The waiting function
- *  correlates on `data.decisionId`. */
 export const DECIDIO_RESUME_EVENT = "decidio/decision.resolved";
-/**
- * Gate an action INSIDE an Inngest function, with durable suspend on routing.
- *   • proceed → run the action (as a step) + confirm.
- *   • route   → `step.waitForEvent` durably suspends until Decidio's resume event for
- *               THIS decision arrives; approved → run + confirm; rejected → status.
- *   • block   → return blocked (the action never runs).
- * The action runs in YOUR process with YOUR credentials — Decidio only signals.
- * `config.resumeUrl` must point at the bridge endpoint (createInngestResumeBridge),
- * so Decidio's webhook is translated into the event this step waits on.
- */
 export async function decidioGateStep(args) {
     const { step, config, ctx } = args;
     const base = config.apiUrl.replace(/\/$/, "");
     const f = config.fetchImpl ?? fetch;
     const authHeaders = { "content-type": "application/json", ...(config.apiToken ? { authorization: `Bearer ${config.apiToken}` } : {}) };
-    // 1. authorize (memoized as a step, so a replay doesn't re-ask the gate)
     const auth = await step.run("decidio-authorize", async () => {
-        // Sign the bound proof so an Inngest-path agent can prove its identity + auto-approve.
         const requesterIdentity = (config.agentKey && config.agentDid)
             ? signBoundProof(config.agentKey, { agentId: config.agentId, did: config.agentDid, action: ctx.action, amount: ctx.amount, scope: ctx.scope, workspaceId: config.workspaceId })
             : undefined;
@@ -40,9 +26,6 @@ export async function decidioGateStep(args) {
     if (auth.decision === "block")
         return { status: "blocked", decisionId: auth.decisionId };
     if (auth.decision === "route") {
-        // 2. durably SUSPEND until the resume event for THIS decision arrives. Zero
-        //    compute while waiting; the worker/process may be recycled — Inngest resumes
-        //    from this checkpoint. `if` correlates the awaited event to this decisionId.
         const ev = await step.waitForEvent("decidio-await-approval", {
             event: DECIDIO_RESUME_EVENT,
             timeout: args.timeout ?? "30d",
@@ -56,8 +39,6 @@ export async function decidioGateStep(args) {
         if (verdict !== "approved" && verdict !== "auto_approved")
             return { status: "blocked", decisionId: auth.decisionId };
     }
-    // 3. authorized → perform the agent's OWN action (a step), then confirm the captured
-    //    response so Decidio seals application_confirmed (never executes it itself).
     const result = await step.run("agent-action", args.run);
     await step.run("decidio-confirm", async () => {
         const requesterIdentity = signConfirm(auth.decisionId, config);
@@ -69,12 +50,6 @@ export async function decidioGateStep(args) {
     });
     return { status: "executed", decisionId: auth.decisionId, result };
 }
-/**
- * Decidio → Inngest bridge. Mount as an HTTP endpoint and register it as the agent's
- * `resumeUrl`. It verifies Decidio's signed resume webhook (same HMAC as the core
- * handler) and emits `DECIDIO_RESUME_EVENT` into Inngest, waking the suspended
- * `decidioGateStep`. Fails CLOSED without a configured secret (unless allowUnsigned).
- */
 export function createInngestResumeBridge(opts) {
     const secret = opts.webhookSecret ?? "";
     const eventName = opts.eventName ?? DECIDIO_RESUME_EVENT;
@@ -110,5 +85,4 @@ export function createInngestResumeBridge(opts) {
         });
     };
 }
-// Re-export the signature check so a host can verify the webhook out-of-band if needed.
 export { verifyResumeSignature };

package/dist/resume.d.ts

@@ -1,6 +1,4 @@
 import type { RequestListener } from "node:http";
-/** A routed action parked on the agent side, awaiting human approval. The `args`
- *  are the original call arguments, replayed verbatim when the action resumes. */
 export interface PendingAction {
     decisionId: string;
     receiptId?: string;
@@ -9,22 +7,17 @@ export interface PendingAction {
     scope?: string;
     args: unknown[];
     createdAt: string;
+    argsSig?: {
+        kind: "ed25519" | "hmac";
+        sig: string;
+    };
 }
-/** Where suspended actions live between request and approval. The default is a
- *  file store; swap in Redis/Postgres/your queue for production. AGENT-SIDE only —
- *  Decidio never sees this. */
 export interface PendingStore {
     put(p: PendingAction): Promise<void>;
     get(decisionId: string): Promise<PendingAction | null>;
     delete(decisionId: string): Promise<void>;
     list(): Promise<PendingAction[]>;
-    /** Atomically take ownership of a parked action for execution. Returns true if THIS
-     *  caller claimed it, false if it's already claimed/gone — the cross-process single-use
-     *  guarantee (a production store backs this with rename/SETNX/SELECT-FOR-UPDATE). A
-     *  claimed entry is excluded from list(). Optional: if absent, the controller falls
-     *  back to an in-process guard (same-process only). */
     claim?(decisionId: string): Promise<boolean>;
-    /** Undo a claim so a failed execution is retryable. */
     release?(decisionId: string): Promise<void>;
 }
 export declare class MemoryPendingStore implements PendingStore {
@@ -37,11 +30,6 @@ export declare class MemoryPendingStore implements PendingStore {
     claim(id: string): Promise<boolean>;
     release(id: string): Promise<void>;
 }
-/** File-backed store so a COLD process (the original requester long gone) can still
- *  resume — the proof that nothing is "kept alive". One JSON file per decision. A claim
- *  renames `<id>.json` → `<id>.claimed` atomically (same-volume rename), so two processes
- *  sharing the dir can't both execute. (A stale `.claimed` from a crash mid-execute needs
- *  TTL recovery — tracked in the backlog.) */
 export declare class FilePendingStore implements PendingStore {
     private dir;
     constructor(dir: string);
@@ -55,10 +43,6 @@ export declare class FilePendingStore implements PendingStore {
     claim(id: string): Promise<boolean>;
     release(id: string): Promise<void>;
 }
-/** Thrown by a `withApproval`-wrapped call when the action is routed and configured
- *  for async resume: the action is now SUSPENDED (parked in the store), not failed.
- *  The caller can stop here — the process may even exit; the resume transport will
- *  complete it later. */
 export declare class DecidioSuspendedError extends Error {
     decisionId: string;
     action: string;
@@ -72,58 +56,30 @@ export interface ResumeOutcome {
     result?: unknown;
     reason?: string;
 }
-/** Minimal config the controller needs to confirm outcomes + poll status. Shared
- *  with GuardConfig (apiUrl/apiToken). */
 export interface ResumeConfig {
     apiUrl: string;
     apiToken?: string;
-    /** Agent identity for SIGNING the confirm call on resume (so the durable path can earn the
-     *  application_confirmed tier, not just the inline path). Default from DECIDIO_AGENT_ID/
-     *  _KEY/_DID env when unset — a cold resume process that has the env signs automatically. */
     agentId?: string;
     agentKey?: string;
     agentDid?: string;
-    /** The workspace the agent acts in (DECIDIO_WORKSPACE_ID) — bound into the cold-resume confirm
-     *  proof (D-B3.6) so it's tenant-scoped too. Default from env when unset. */
     workspaceId?: string;
-    /** Shared secret Decidio signs the resume webhook with (HMAC-SHA256). Defaults to
-     *  the API token if unset. Verified before any re-execution. */
     webhookSecret?: string;
-    /** Escape hatch to accept UNSIGNED resume webhooks (no secret). Off by default:
-     *  with no secret and this unset, the webhook handler rejects every call (fail
-     *  closed) so a misconfigured agent can't be driven by forged callbacks. Only set
-     *  true behind a trusted network boundary (e.g. mTLS / private mesh). */
     allowUnsigned?: boolean;
-    /** The callback URL Decidio should POST the verdict to (webhook transport). Sent
-     *  on /agent/authorize so the decision carries it; omit when using the poll worker. */
     resumeUrl?: string;
-    /** Fired after every terminal resolution (executed / rejected / blocked / no_handler),
-     *  via either transport. Use it to log, close a listener, or exit a CLI. */
     onResolved?: (o: ResumeOutcome) => void;
     fetchImpl?: typeof fetch;
 }
-/** Re-execute the agent's own fn on approval, confirm the captured outcome to
- *  Decidio, and clear the parked entry. Bound to a store + a registry of raw fns. */
 export interface ResumeController extends ResumeConfig {
     store: PendingStore;
-    /** Register a RAW fn under its action name so a (possibly cold) resume can replay
-     *  it. `withApproval` auto-registers on the hot path; a cold worker/service should
-     *  register at startup so it can resume actions it never originated. */
     register(action: string, fn: (...args: any[]) => Promise<any>): void;
-    /** Drive a parked decision to completion once a verdict is known. Idempotent:
-     *  a second call after success finds nothing parked → "unknown" (no double-write). */
+    park(p: Omit<PendingAction, "createdAt" | "argsSig">): Promise<void>;
     resolve(input: {
         decisionId: string;
         verdict: "approved" | "rejected" | "blocked";
         reason?: string;
     }): Promise<ResumeOutcome>;
-    /** node:http listener for Decidio's signed approval webhook (Express/Fastify/node). */
     webhookHandler(): RequestListener;
-    /** Web-Fetch handler (Request → Response) for Next.js route handlers, Hono,
-     *  Cloudflare Workers, Bun, Deno. Same fail-closed signature check. */
     fetchHandler(): (req: Request) => Promise<Response>;
-    /** Poll-based resume for hosts with no inbound URL (CLI/laptop). A long-lived
-     *  watcher — this is a durable WORKER, not the request path blocking. */
     worker(opts?: {
         intervalMs?: number;
         timeoutMs?: number;
@@ -133,19 +89,7 @@ export interface ResumeController extends ResumeConfig {
     };
 }
 declare function sign(secret: string, body: string): string;
-/** Verify Decidio's `x-decidio-signature` over the raw webhook body (HMAC-SHA256).
- *  Exported so engine adapters (e.g. the Inngest bridge) reuse the exact check. */
 export declare function verifyResumeSignature(secret: string, body: string, header: string | undefined): boolean;
-/**
- * Build the resume controller. Spread it into your GuardConfig as `resume`, then
- * either mount `webhookHandler()` (production) or run `worker()` (CLI/laptop).
- *
- *   const resume = createDecidioResume({ apiUrl, apiToken, store: new FilePendingStore(".decidio-pending"), resumeUrl });
- *   const guard  = { apiUrl, agentId, apiToken, resume };
- *   const createOpportunity = withApproval(createOpportunityRaw, describe, guard);
- *   // production:  http.createServer(resume.webhookHandler()).listen(4100)
- *   // or CLI:      resume.worker()
- */
 export declare function createDecidioResume(opts: ResumeConfig & {
     store: PendingStore;
 }): ResumeController;

package/dist/resume.js

@@ -1,26 +1,42 @@
-// @decidio/sdk — durable async resume.
-//
-// The hard problem behind a "one-line" agent gate: a real human approval takes
-// minutes to days. Nobody watches a 60-second polling window. So a routed action
-// must SUSPEND (the requesting process may even exit) and RESUME later when the
-// approval arrives — and the AGENT must perform its own action on resume. Decidio
-// stays the approval layer above: it authorizes, records, and (on approval) SIGNALS
-// the agent. It never holds the agent's downstream credentials and never executes
-// the write itself. This is the same shape as HumanLayer's webhooks, Temporal
-// Signals, Inngest waitForEvent, and Decidio's own A2A `input-required` state.
-//
-// Two resume transports, same core:
-//   • webhookHandler() — production: Decidio POSTs a signed verdict to the agent's
-//     resume URL; the handler re-executes the agent's own fn and confirms.
-//   • worker()         — no inbound URL (laptop/CLI): a long-lived watcher polls
-//     /agent/status for each pending decision, then re-executes on approval.
-// Either way the args are replayed from an AGENT-SIDE store (Decidio holds none of
-// the downstream payload — only the authority decision), and execution is single-use
-// (the pending entry is deleted on completion, so a duplicate signal can't double-write).
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "node:crypto";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, renameSync } from "node:fs";
 import { join } from "node:path";
-import { signConfirm } from "./signing.js";
+import { signConfirm, canonicalize } from "./signing.js";
+const argsBindingBytes = (p) => Buffer.from(canonicalize({ decisionId: p.decisionId, action: p.action, amount: p.amount, ...(p.scope !== undefined ? { scope: p.scope } : {}), args: p.args }), "utf8");
+function signArgs(p, agentKey, webhookSecret) {
+    const bytes = argsBindingBytes(p);
+    if (agentKey) {
+        try {
+            const key = createPrivateKey({ key: Buffer.from(agentKey, "base64"), format: "der", type: "pkcs8" });
+            return { kind: "ed25519", sig: Buffer.from(edSign(null, bytes, key)).toString("base64url") };
+        }
+        catch { }
+    }
+    if (webhookSecret)
+        return { kind: "hmac", sig: createHmac("sha256", webhookSecret).update(bytes).digest("hex") };
+    return undefined;
+}
+function verifyArgs(p, agentKey, webhookSecret) {
+    if (!p.argsSig)
+        return "unbound";
+    const bytes = argsBindingBytes(p);
+    try {
+        if (p.argsSig.kind === "ed25519") {
+            if (!agentKey)
+                return "unverifiable";
+            const pub = createPublicKey(createPrivateKey({ key: Buffer.from(agentKey, "base64"), format: "der", type: "pkcs8" }));
+            return edVerify(null, bytes, pub, Buffer.from(p.argsSig.sig, "base64url")) ? "ok" : "mismatch";
+        }
+        if (!webhookSecret)
+            return "unverifiable";
+        const expected = createHmac("sha256", webhookSecret).update(bytes).digest("hex");
+        const a = Buffer.from(expected), b = Buffer.from(p.argsSig.sig);
+        return a.length === b.length && timingSafeEqual(a, b) ? "ok" : "mismatch";
+    }
+    catch {
+        return "mismatch";
+    }
+}
 export class MemoryPendingStore {
     m = new Map();
     claimed = new Set();
@@ -32,11 +48,6 @@ export class MemoryPendingStore {
         return false; this.claimed.add(id); return true; }
     async release(id) { this.claimed.delete(id); }
 }
-/** File-backed store so a COLD process (the original requester long gone) can still
- *  resume — the proof that nothing is "kept alive". One JSON file per decision. A claim
- *  renames `<id>.json` → `<id>.claimed` atomically (same-volume rename), so two processes
- *  sharing the dir can't both execute. (A stale `.claimed` from a crash mid-execute needs
- *  TTL recovery — tracked in the backlog.) */
 export class FilePendingStore {
     dir;
     constructor(dir) {
@@ -59,14 +70,14 @@ export class FilePendingStore {
     async list() {
         if (!existsSync(this.dir))
             return [];
-        return readdirSync(this.dir).filter((f) => f.endsWith(".json")) // claimed (.claimed) excluded — in flight
+        return readdirSync(this.dir).filter((f) => f.endsWith(".json"))
             .map((f) => JSON.parse(readFileSync(join(this.dir, f), "utf8")));
     }
     async claim(id) {
         try {
             renameSync(this.path(id), this.claimedPath(id));
             return true;
-        } // atomic; fails if already claimed/gone
+        }
         catch {
             return false;
         }
@@ -75,13 +86,9 @@ export class FilePendingStore {
         try {
             renameSync(this.claimedPath(id), this.path(id));
         }
-        catch { /* already released/gone */ }
+        catch { }
     }
 }
-/** Thrown by a `withApproval`-wrapped call when the action is routed and configured
- *  for async resume: the action is now SUSPENDED (parked in the store), not failed.
- *  The caller can stop here — the process may even exit; the resume transport will
- *  complete it later. */
 export class DecidioSuspendedError extends Error {
     decisionId;
     action;
@@ -96,8 +103,6 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function sign(secret, body) {
     return "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
 }
-/** Verify Decidio's `x-decidio-signature` over the raw webhook body (HMAC-SHA256).
- *  Exported so engine adapters (e.g. the Inngest bridge) reuse the exact check. */
 export function verifyResumeSignature(secret, body, header) {
     if (!header)
         return false;
@@ -107,11 +112,7 @@ export function verifyResumeSignature(secret, body, header) {
 }
 async function confirm(cfg, decisionId, capturedResponse) {
     const f = cfg.fetchImpl ?? fetch;
-    // Sign the confirm so the DURABLE/resume path can earn application_confirmed too (bound to
-    // {action:"confirm", scope:decisionId}); without a key the server caps it at agent_asserted.
     const requesterIdentity = signConfirm(decisionId, cfg);
-    // Same no-silent-downgrade rule as the inline wrap (guard equivalent-path catch): the durable
-    // path is what production agents run, so it must disclose an agent_asserted cap too.
     if (!requesterIdentity)
         console.warn(`[decidio] execution evidence for ${decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID to earn application_confirmed.`);
     await f(cfg.apiUrl.replace(/\/$/, "") + "/agent/confirm", {
@@ -130,37 +131,31 @@ async function statusOf(cfg, decisionId) {
         throw new Error(`status ${r.status}`);
     return r.json();
 }
-/**
- * Build the resume controller. Spread it into your GuardConfig as `resume`, then
- * either mount `webhookHandler()` (production) or run `worker()` (CLI/laptop).
- *
- *   const resume = createDecidioResume({ apiUrl, apiToken, store: new FilePendingStore(".decidio-pending"), resumeUrl });
- *   const guard  = { apiUrl, agentId, apiToken, resume };
- *   const createOpportunity = withApproval(createOpportunityRaw, describe, guard);
- *   // production:  http.createServer(resume.webhookHandler()).listen(4100)
- *   // or CLI:      resume.worker()
- */
 export function createDecidioResume(opts) {
     const registry = new Map();
-    const inFlight = new Set(); // concurrent-duplicate guard (same process)
+    const inFlight = new Set();
     const secret = opts.webhookSecret ?? opts.apiToken ?? "";
     const ctrl = {
         ...opts,
-        // Default the signing identity from env so a COLD resume process (a fresh worker that has
-        // the agent's env but wasn't passed config) still signs the confirm and earns the wrapper tier.
         agentId: opts.agentId ?? process.env.DECIDIO_AGENT_ID,
         agentKey: opts.agentKey ?? process.env.DECIDIO_AGENT_KEY,
         agentDid: opts.agentDid ?? process.env.DECIDIO_AGENT_DID,
-        workspaceId: opts.workspaceId ?? process.env.DECIDIO_WORKSPACE_ID, // D-B3.6: tenant-bind the cold-resume confirm proof
+        workspaceId: opts.workspaceId ?? process.env.DECIDIO_WORKSPACE_ID,
         webhookSecret: secret,
         store: opts.store,
         register(action, fn) { registry.set(action, fn); },
+        async park(p) {
+            const argsSig = signArgs(p, ctrl.agentKey, ctrl.webhookSecret);
+            if (!argsSig)
+                console.warn(`[decidio] parking ${p.decisionId} UNBOUND — no agent key or webhook secret to sign the payload with, so a modified pending file could not be detected. Run \`npx @decidio/sdk init\` to configure keys.`);
+            await ctrl.store.put({ ...p, createdAt: new Date().toISOString(), ...(argsSig ? { argsSig } : {}) });
+        },
         async resolve({ decisionId, verdict, reason }) {
             const finish = (o) => { if (o.status !== "unknown")
                 opts.onResolved?.(o); return o; };
             const pending = await ctrl.store.get(decisionId);
             if (!pending)
-                return { status: "unknown", decisionId }; // not ours / already resumed
+                return { status: "unknown", decisionId };
             if (verdict === "rejected") {
                 await ctrl.store.delete(decisionId);
                 return finish({ status: "rejected", decisionId, action: pending.action, reason });
@@ -169,21 +164,35 @@ export function createDecidioResume(opts) {
                 await ctrl.store.delete(decisionId);
                 return finish({ status: "blocked", decisionId, action: pending.action, reason });
             }
-            // Fail CLOSED on any unexpected verdict — never execute on a garbage/unknown value.
             if (verdict !== "approved" && verdict !== "auto_approved")
                 return { status: "unknown", decisionId };
+            if (pending.decisionId !== decisionId) {
+                console.error(`[decidio] REFUSING to execute ${decisionId}: the parked entry in this slot belongs to a DIFFERENT decision (${pending.decisionId}) — the pending file was moved or swapped. Delete it and re-run the action.`);
+                return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload decision-id mismatch" });
+            }
+            const strictBinding = !!ctrl.agentKey;
+            const integrity = verifyArgs(pending, ctrl.agentKey, ctrl.webhookSecret);
+            if (integrity === "mismatch") {
+                console.error(`[decidio] REFUSING to execute ${decisionId}: the parked payload FAILED its integrity check — the arguments on disk are not the arguments that were routed for approval. The pending file is untouched for inspection; delete it and re-run the action to request a fresh approval.`);
+                return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload integrity check failed" });
+            }
+            if (integrity === "unverifiable") {
+                console.error(`[decidio] REFUSING to execute ${decisionId}: the parked payload is signed but this process lacks the key material to verify it (DECIDIO_AGENT_KEY / DECIDIO_WEBHOOK_SECRET). Restore the agent's env and retry.`);
+                return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload unverifiable" });
+            }
+            if (integrity === "unbound" && strictBinding) {
+                console.error(`[decidio] REFUSING to execute ${decisionId}: the parked payload has NO integrity signature, but this agent has keys and would have signed it — a missing signature means the file was tampered with. Delete it and re-run the action.`);
+                return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload unsigned (expected a signature)" });
+            }
+            if (integrity === "unbound")
+                console.warn(`[decidio] executing ${decisionId} from an UNBOUND parked entry (this agent has no key material to bind or verify payloads) — its arguments cannot be integrity-checked. Run \`npx @decidio/sdk init\` to enable binding.`);
             const fn = registry.get(pending.action);
             if (!fn)
                 return finish({ status: "no_handler", decisionId, action: pending.action, reason: `no fn registered for action "${pending.action}" — call resume.register(...) at startup` });
-            // Atomically CLAIM before executing — the cross-process single-use guarantee. If
-            // the store has no claim primitive, fall back to an in-process guard (same-process).
             const claimed = ctrl.store.claim ? await ctrl.store.claim(decisionId) : (!inFlight.has(decisionId) && (inFlight.add(decisionId), true));
             if (!claimed)
-                return { status: "unknown", decisionId }; // another worker owns it
+                return { status: "unknown", decisionId };
             try {
-                // Approved: the AGENT performs its own action FIRST. On SUCCESS clear the parked
-                // entry (single-use) + confirm. If it throws, RELEASE the claim so the entry stays
-                // parked + retryable — an approved action is never lost.
                 const result = await fn(...pending.args);
                 await ctrl.store.delete(decisionId);
                 try {
@@ -213,9 +222,6 @@ export function createDecidioResume(opts) {
                 req.on("data", (c) => (raw += c));
                 req.on("end", async () => {
                     try {
-                        // Fail CLOSED when no secret is configured: an agent that forgot to set a
-                        // webhookSecret must NOT be drivable by forged callbacks. Opt out only with
-                        // allowUnsigned (trusted network boundary).
                         if (!secret) {
                             if (!opts.allowUnsigned) {
                                 res.statusCode = 401;
@@ -282,8 +288,6 @@ export function createDecidioResume(opts) {
                                 st.state === "blocked" ? "blocked" : null;
                         if (!verdict)
                             continue;
-                        // A throwing resolve (the agent's own fn failed) must NOT kill the watcher —
-                        // the entry stays parked and is retried on the next poll.
                         try {
                             const outcome = await ctrl.resolve({ decisionId: p.decisionId, verdict, reason: st.reason });
                             workerOpts?.onResolved?.(outcome);