@decidio/sdk 0.1.4 → 0.1.6

package/dist/signing.d.ts

@@ -1,8 +1,4 @@
-/** Sorted-key JCS — must match apps/api/src/canonical.ts byte-for-byte. */
 export declare function canonicalize(v: unknown): string;
-/** Generate a fresh Ed25519 keypair LOCALLY. Returns the public `did:key` (register this)
- *  and the PKCS8 private key base64 (keep this in the agent host's env as DECIDIO_AGENT_KEY —
- *  it never goes back to Decidio). */
 export declare function generateKeypair(): {
     did: string;
     privateKeyBase64: string;
@@ -21,20 +17,12 @@ export interface RequesterIdentity {
         signature: string;
     };
 }
-/** Sign the CONFIRM call (bound to {action:"confirm", scope:decisionId}) so the gate can
- *  prove the caller is the receipt's original requester before granting the wrapper tier
- *  (application_confirmed). Returns undefined when no signing key is configured (the server
- *  then caps the report at agent_asserted). Used by EVERY confirm path — inline, durable
- *  resume, and the engine adapters — so the production paths confirm with a proof too. Also
- *  binds `workspaceId` (D-B3.6) when configured, so the confirm proof is tenant-scoped too. */
 export declare function signConfirm(decisionId: string, cfg: {
     agentId?: string;
     agentKey?: string;
     agentDid?: string;
     workspaceId?: string;
 }): RequesterIdentity | undefined;
-/** Sign a request-bound identity proof. The returned object is sent verbatim as the
- *  `requesterIdentity` field of /agent/authorize. */
 export declare function signBoundProof(privateKeyBase64: string, fields: {
     agentId: string;
     did: string;

package/dist/signing.js

@@ -1,13 +1,4 @@
-// Client-side agent identity (§13 P0-8). The agent generates its Ed25519 keypair LOCALLY
-// (the private key never crosses the wire — `init` registers only the public did:key) and
-// signs a REQUEST-BOUND proof on each authorize: a detached Ed25519 JWS over
-// canonical({agentId,did,action,amount,scope,nonce,exp}). Decidio's floor verifies the
-// signature, binds it to the exact request, burns the single-use nonce, and checks the
-// did against the agent registry — so the gate PROVES who is calling instead of trusting a
-// label. This canonicalize + proof shape is byte-identical to apps/api (canonical.ts +
-// a2a/identity.ts), so a proof signed here verifies there.
 import { generateKeyPairSync, createPrivateKey, sign as edSign, randomUUID } from "node:crypto";
-// base58btc (Bitcoin alphabet) — for the did:key multibase 'z' prefix.
 const B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function b58encode(buf) {
     const digits = [0];
@@ -34,7 +25,6 @@ function b58encode(buf) {
         str += B58[digits[i]];
     return str;
 }
-/** Sorted-key JCS — must match apps/api/src/canonical.ts byte-for-byte. */
 export function canonicalize(v) {
     if (v === null || typeof v !== "object")
         return JSON.stringify(v);
@@ -43,9 +33,6 @@ export function canonicalize(v) {
     const o = v;
     return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`).join(",")}}`;
 }
-/** Generate a fresh Ed25519 keypair LOCALLY. Returns the public `did:key` (register this)
- *  and the PKCS8 private key base64 (keep this in the agent host's env as DECIDIO_AGENT_KEY —
- *  it never goes back to Decidio). */
 export function generateKeypair() {
     const { privateKey, publicKey } = generateKeyPairSync("ed25519");
     const jwk = publicKey.export({ format: "jwk" });
@@ -54,27 +41,15 @@ export function generateKeypair() {
     const privateKeyBase64 = privateKey.export({ format: "der", type: "pkcs8" }).toString("base64");
     return { did, privateKeyBase64 };
 }
-/** Sign the CONFIRM call (bound to {action:"confirm", scope:decisionId}) so the gate can
- *  prove the caller is the receipt's original requester before granting the wrapper tier
- *  (application_confirmed). Returns undefined when no signing key is configured (the server
- *  then caps the report at agent_asserted). Used by EVERY confirm path — inline, durable
- *  resume, and the engine adapters — so the production paths confirm with a proof too. Also
- *  binds `workspaceId` (D-B3.6) when configured, so the confirm proof is tenant-scoped too. */
 export function signConfirm(decisionId, cfg) {
     if (!cfg.agentKey || !cfg.agentDid || !cfg.agentId)
         return undefined;
     return signBoundProof(cfg.agentKey, { agentId: cfg.agentId, did: cfg.agentDid, action: "confirm", amount: 0, scope: decisionId, workspaceId: cfg.workspaceId });
 }
-/** Sign a request-bound identity proof. The returned object is sent verbatim as the
- *  `requesterIdentity` field of /agent/authorize. */
 export function signBoundProof(privateKeyBase64, fields) {
     const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
     const nonce = fields.nonce ?? randomUUID();
     const exp = (fields.now ?? Date.now()) + (fields.ttlMs ?? 120_000);
-    // OMIT scope/workspaceId when absent so the canonical bytes match the server + the Python SDK — a key
-    // with an undefined value would serialize as literal "undefined", which Python can't reproduce, and a
-    // legacy (no-workspace) proof must stay byte-identical. The server's bound-payload reconstruction
-    // omits them the same way (a2a/identity.ts).
     const payloadObj = { agentId: fields.agentId, did: fields.did, action: fields.action, amount: fields.amount, ...(fields.scope !== undefined ? { scope: fields.scope } : {}), ...(fields.workspaceId !== undefined ? { workspaceId: fields.workspaceId } : {}), nonce, exp };
     const payload = Buffer.from(canonicalize(payloadObj), "utf8").toString("base64url");
     const protectedHdr = Buffer.from(JSON.stringify({ alg: "EdDSA", kid: fields.did }), "utf8").toString("base64url");

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.1.4
+  version: 0.1.6
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -82,5 +82,9 @@
   },
   "dependencies": {
     "@decidio/verify": "^0.1.3"
+  },
+  "author": "OmniTwin Technologies Inc.",
+  "bugs": {
+    "url": "https://decidioai.com/support/"
   }
 }