@decidio/sdk 0.1.9 → 0.1.10

package/dist/resume.js

@@ -1,27 +1,9 @@
-// @decidio/sdk — durable async resume.
-//
-// The hard problem behind a "one-line" agent gate: a real human approval takes
-// minutes to days. Nobody watches a 60-second polling window. So a routed action
-// must SUSPEND (the requesting process may even exit) and RESUME later when the
-// approval arrives — and the AGENT must perform its own action on resume. Decidio
-// stays the approval layer above: it authorizes, records, and (on approval) SIGNALS
-// the agent. It never holds the agent's downstream credentials and never executes
-// the write itself. This is the same shape as HumanLayer's webhooks, Temporal
-// Signals, Inngest waitForEvent, and Decidio's own A2A `input-required` state.
-//
-// Two resume transports, same core:
-//   • webhookHandler() — production: Decidio POSTs a signed verdict to the agent's
-//     resume URL; the handler re-executes the agent's own fn and confirms.
-//   • worker()         — no inbound URL (laptop/CLI): a long-lived watcher polls
-//     /agent/status for each pending decision, then re-executes on approval.
-// Either way the args are replayed from an AGENT-SIDE store (Decidio holds none of
-// the downstream payload — only the authority decision), and execution is single-use
-// (the pending entry is deleted on completion, so a duplicate signal can't double-write).
 import { createHmac, timingSafeEqual, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify } from "node:crypto";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, renameSync } from "node:fs";
 import { join } from "node:path";
-import { signConfirm, canonicalize, assertJsonSafe } from "./signing.js";
-// ---- parked-payload integrity (round-6 acceptance catch) -------------------------------------
+import { userInfo } from "node:os";
+import { execFileSync } from "node:child_process";
+import { signConfirm, canonicalize, assertJsonSafe, assertSafeTransport, DecidioUnsafeArgumentsError } from "./signing.js";
 const argsBindingBytes = (p) => Buffer.from(canonicalize({ decisionId: p.decisionId, action: p.action, amount: p.amount, ...(p.scope !== undefined ? { scope: p.scope } : {}), args: p.args }), "utf8");
 function signArgs(p, agentKey, webhookSecret) {
     const bytes = argsBindingBytes(p);
@@ -30,7 +12,7 @@ function signArgs(p, agentKey, webhookSecret) {
             const key = createPrivateKey({ key: Buffer.from(agentKey, "base64"), format: "der", type: "pkcs8" });
             return { kind: "ed25519", sig: Buffer.from(edSign(null, bytes, key)).toString("base64url") };
         }
-        catch { /* fall through to hmac */ }
+        catch { }
     }
     if (webhookSecret)
         return { kind: "hmac", sig: createHmac("sha256", webhookSecret).update(bytes).digest("hex") };
@@ -68,16 +50,23 @@ export class MemoryPendingStore {
         return false; this.claimed.add(id); return true; }
     async release(id) { this.claimed.delete(id); }
 }
-/** File-backed store so a COLD process (the original requester long gone) can still
- *  resume — the proof that nothing is "kept alive". One JSON file per decision. A claim
- *  renames `<id>.json` → `<id>.claimed` atomically (same-volume rename), so two processes
- *  sharing the dir can't both execute. (A stale `.claimed` from a crash mid-execute needs
- *  TTL recovery — tracked in the backlog.) */
 export class FilePendingStore {
     dir;
     constructor(dir) {
         this.dir = dir;
         mkdirSync(dir, { recursive: true });
+        if (process.platform === "win32") {
+            try {
+                const user = (() => { try {
+                    return userInfo().username;
+                }
+                catch {
+                    return process.env.USERNAME ?? process.env.USER ?? "";
+                } })();
+                execFileSync("icacls", [dir, "/inheritance:r", "/grant:r", `${user}:(OI)(CI)F`], { stdio: "ignore" });
+            }
+            catch { }
+        }
     }
     key(id) { return id.replace(/[^\w.-]/g, "_"); }
     path(id) { return join(this.dir, `${this.key(id)}.json`); }
@@ -95,12 +84,8 @@ export class FilePendingStore {
     async list() {
         if (!existsSync(this.dir))
             return [];
-        // ONE BAD FILE MUST NOT STALL THE QUEUE: an unparseable entry (partial write, disk corruption,
-        // a human editing it) used to throw out of list() and take every other parked action down with
-        // it — a worker that can never poll is a worker that never resumes anything. Skip it loudly
-        // and keep the rest moving; the bad file stays on disk for inspection.
         const out = [];
-        for (const f of readdirSync(this.dir).filter((f) => f.endsWith(".json"))) { // .claimed excluded — in flight
+        for (const f of readdirSync(this.dir).filter((f) => f.endsWith(".json"))) {
             try {
                 out.push(JSON.parse(readFileSync(join(this.dir, f), "utf8")));
             }
@@ -114,7 +99,7 @@ export class FilePendingStore {
         try {
             renameSync(this.path(id), this.claimedPath(id));
             return true;
-        } // atomic; fails if already claimed/gone
+        }
         catch {
             return false;
         }
@@ -123,13 +108,9 @@ export class FilePendingStore {
         try {
             renameSync(this.claimedPath(id), this.path(id));
         }
-        catch { /* already released/gone */ }
+        catch { }
     }
 }
-/** Thrown by a `withApproval`-wrapped call when the action is routed and configured
- *  for async resume: the action is now SUSPENDED (parked in the store), not failed.
- *  The caller can stop here — the process may even exit; the resume transport will
- *  complete it later. */
 export class DecidioSuspendedError extends Error {
     decisionId;
     action;
@@ -144,8 +125,6 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function sign(secret, body) {
     return "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
 }
-/** Verify Decidio's `x-decidio-signature` over the raw webhook body (HMAC-SHA256).
- *  Exported so engine adapters (e.g. the Inngest bridge) reuse the exact check. */
 export function verifyResumeSignature(secret, body, header) {
     if (!header)
         return false;
@@ -153,11 +132,6 @@ export function verifyResumeSignature(secret, body, header) {
     const a = Buffer.from(expected), b = Buffer.from(header);
     return a.length === b.length && timingSafeEqual(a, b);
 }
-/** The ONE confirm-body rule, used by ALL THREE TS confirm doors (resume, inline withApproval,
- *  adapter gate — guard equivalent-path catch: it lived only on the resume door). Transport
- *  success is not confirmation (prodsec F-03): a 2xx whose body carries no recorded tier is a
- *  FAILED confirm; a SIGNED confirm coming back below application_confirmed is disclosed, never
- *  silent. Returns the recorded tier or throws. */
 export function assertConfirmRecorded(body, decisionId, signed) {
     if (!body || body.ok !== true || typeof body.confirmation !== "string") {
         throw new Error(`confirm answered 2xx but reported no evidence tier — treating the confirmation as NOT recorded`);
@@ -167,14 +141,10 @@ export function assertConfirmRecorded(body, decisionId, signed) {
     }
     return body.confirmation;
 }
-/** Resume-door confirm: POST + the shared body rule above. */
 async function confirm(cfg, decisionId, capturedResponse) {
     const f = cfg.fetchImpl ?? fetch;
-    // Sign the confirm so the DURABLE/resume path can earn application_confirmed too (bound to
-    // {action:"confirm", scope:decisionId}); without a key the server caps it at agent_asserted.
+    assertSafeTransport(cfg.apiUrl, !!cfg.apiToken);
     const requesterIdentity = signConfirm(decisionId, cfg);
-    // Same no-silent-downgrade rule as the inline wrap (guard equivalent-path catch): the durable
-    // path is what production agents run, so it must disclose an agent_asserted cap too.
     if (!requesterIdentity)
         console.warn(`[decidio] execution evidence for ${decisionId} recorded as agent_asserted — no signing key configured, so the report can't be proven to come from this agent. Set DECIDIO_AGENT_KEY/DID to earn application_confirmed.`);
     const r = await f(cfg.apiUrl.replace(/\/$/, "") + "/agent/confirm", {
@@ -189,6 +159,7 @@ async function confirm(cfg, decisionId, capturedResponse) {
 }
 async function statusOf(cfg, decisionId) {
     const f = cfg.fetchImpl ?? fetch;
+    assertSafeTransport(cfg.apiUrl, !!cfg.apiToken);
     const r = await f(cfg.apiUrl.replace(/\/$/, "") + "/agent/status/" + encodeURIComponent(decisionId), {
         headers: { ...(cfg.apiToken ? { authorization: `Bearer ${cfg.apiToken}` } : {}) },
     });
@@ -196,24 +167,10 @@ async function statusOf(cfg, decisionId) {
         throw new Error(`status ${r.status}`);
     return r.json();
 }
-/**
- * Build the resume controller. Spread it into your GuardConfig as `resume`, then
- * either mount `webhookHandler()` (production) or run `worker()` (CLI/laptop).
- *
- *   const resume = createDecidioResume({ apiUrl, apiToken, store: new FilePendingStore(".decidio-pending"), resumeUrl });
- *   const guard  = { apiUrl, agentId, apiToken, resume };
- *   const createOpportunity = withApproval(createOpportunityRaw, describe, guard);
- *   // production:  http.createServer(resume.webhookHandler()).listen(4100)
- *   // or CLI:      resume.worker()
- */
 export function createDecidioResume(opts) {
     const registry = new Map();
-    const inFlight = new Set(); // concurrent-duplicate guard (same process)
+    const inFlight = new Set();
     const secret = opts.webhookSecret ?? opts.apiToken ?? "";
-    // CONTROLLER-scoped, not resolve()-scoped (guard catch: declared inside resolve, this Set was
-    // reborn empty every poll — the refusal printed 3/3 times, each ending with a false "prints
-    // once"). Refusals repeat on every cycle while the file sits parked; the MESSAGE must not.
-    // The opt-out of webhook authenticity must never be silent (prodsec F-07).
     if (opts.allowUnsigned)
         console.warn("[decidio] WARNING: allowUnsigned is ON — this controller will accept UNSIGNED resume webhooks. Anyone who can reach the endpoint can signal work (parked-payload integrity still gates execution). Use this only behind a trusted network boundary, never on an internet-reachable endpoint.");
     const refusalWarned = new Set();
@@ -225,29 +182,25 @@ export function createDecidioResume(opts) {
     };
     const ctrl = {
         ...opts,
-        // Default the signing identity from env so a COLD resume process (a fresh worker that has
-        // the agent's env but wasn't passed config) still signs the confirm and earns the wrapper tier.
         agentId: opts.agentId ?? process.env.DECIDIO_AGENT_ID,
         agentKey: opts.agentKey ?? process.env.DECIDIO_AGENT_KEY,
         agentDid: opts.agentDid ?? process.env.DECIDIO_AGENT_DID,
-        workspaceId: opts.workspaceId ?? process.env.DECIDIO_WORKSPACE_ID, // D-B3.6: tenant-bind the cold-resume confirm proof
+        workspaceId: opts.workspaceId ?? process.env.DECIDIO_WORKSPACE_ID,
         webhookSecret: secret,
         store: opts.store,
         register(action, fn) {
-            // Silent last-writer-wins is the wrong default for an EXECUTION registry: two wrappers
-            // sharing an action name would let a resumed decision replay its args into the other
-            // function. Say so loudly — the parked args and the fn must be the pair that was routed.
             const prev = registry.get(action);
             if (prev && prev !== fn)
                 console.warn(`[decidio] action "${action}" is being registered again with a DIFFERENT function — the latest one wins, and a resumed decision would run IT. Give each protected function its own action name.`);
             registry.set(action, fn);
         },
         async park(p) {
-            // GATE, not serialization (prodsec F-01): a value that cannot survive JSON with its meaning
-            // intact must be REFUSED before it is signed or parked — the signature covers canonical
-            // bytes, and NaN/Map collide with null/{} in those bytes, so it would verify and execute
-            // with drifted semantics. Refusal here means no decision, no signature, no file.
-            assertJsonSafe(p.args, "args");
+            try {
+                assertJsonSafe(p.args, "args");
+            }
+            catch (e) {
+                throw new DecidioUnsafeArgumentsError(`${e?.message ?? e} NOT parked and NOT executable — but decision ${p.decisionId} may already be routed; reject it in your queue: npx @decidio/sdk approvals reject ${p.decisionId}`, p.decisionId);
+            }
             const argsSig = signArgs(p, ctrl.agentKey, ctrl.webhookSecret);
             if (!argsSig)
                 console.warn(`[decidio] parking ${p.decisionId} UNBOUND — no agent key or webhook secret to sign the payload with, so a modified pending file could not be detected. Run \`npx @decidio/sdk init\` to configure keys.`);
@@ -258,7 +211,7 @@ export function createDecidioResume(opts) {
                 opts.onResolved?.(o); return o; };
             const pending = await ctrl.store.get(decisionId);
             if (!pending)
-                return { status: "unknown", decisionId }; // not ours / already resumed
+                return { status: "unknown", decisionId };
             if (verdict === "rejected") {
                 await ctrl.store.delete(decisionId);
                 return finish({ status: "rejected", decisionId, action: pending.action, reason });
@@ -267,24 +220,12 @@ export function createDecidioResume(opts) {
                 await ctrl.store.delete(decisionId);
                 return finish({ status: "blocked", decisionId, action: pending.action, reason });
             }
-            // Fail CLOSED on any unexpected verdict — never execute on a garbage/unknown value.
             if (verdict !== "approved" && verdict !== "auto_approved")
                 return { status: "unknown", decisionId };
-            // INTEGRITY BEFORE EXECUTION (round-6 acceptance catch: a locally edited pending file
-            // executed different arguments from those routed for approval).
-            // SLOT ASSERTION FIRST (guard catch): the store keys on the FILENAME while the signature
-            // covers the CONTENT's decisionId — without this line, copying validly-signed entry A into
-            // slot B executes A's args when B is approved. No forgery needed, so it must be checked
-            // even before signature verification.
             if (pending.decisionId !== decisionId) {
                 refuseOnce(decisionId, `[decidio] REFUSING to execute ${decisionId}: the parked entry in this slot belongs to a DIFFERENT decision (${pending.decisionId}) — the pending file was moved or swapped. Delete it and re-run the action.`);
                 return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload decision-id mismatch" });
             }
-            // STRICT binding is keyed to the agent's ED25519 signing key (what `init` writes) — an
-            // init'd agent always signs via park(), so an unbound entry there is tampering (incl. a
-            // stripped signature). A bare store.put user with no agent key keeps the documented
-            // low-level behavior (execute+warn); the apiToken-derived HMAC secret does NOT trigger
-            // strict mode (it lives in .env next to the pending dir — not a local-tamper defense).
             const strictBinding = !!ctrl.agentKey;
             const integrity = verifyArgs(pending, ctrl.agentKey, ctrl.webhookSecret);
             if (integrity === "mismatch") {
@@ -296,9 +237,6 @@ export function createDecidioResume(opts) {
                 return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload unverifiable" });
             }
             if (integrity === "unbound" && strictBinding) {
-                // A controller WITH key material would have signed at park time, so a MISSING signature is
-                // itself tampering — an attacker stripping argsSig to reach the legacy path. Refuse. Only a
-                // keyless controller (genuine legacy / no-key deploy) may execute an unbound entry.
                 refuseOnce(decisionId, `[decidio] REFUSING to execute ${decisionId}: the parked payload has NO integrity signature, but this agent has keys and would have signed it — a missing signature means the file was tampered with. Delete it and re-run the action.`);
                 return finish({ status: "no_handler", decisionId, action: pending.action, reason: "parked payload unsigned (expected a signature)" });
             }
@@ -306,8 +244,6 @@ export function createDecidioResume(opts) {
                 console.warn(`[decidio] executing ${decisionId} from an UNBOUND parked entry (this agent has no key material to bind or verify payloads) — its arguments cannot be integrity-checked. Run \`npx @decidio/sdk init\` to enable binding.`);
             const fn = registry.get(pending.action);
             if (!fn) {
-                // Actionable, because this is the failure a restarted worker actually hits: the registry
-                // is per-process, and a cold process never ran the original call that would have filled it.
                 console.error(`[decidio] cannot resume ${decisionId}: no function is registered for action "${pending.action}" in THIS process.`);
                 console.error(`  A worker only re-executes actions registered where it runs. At startup, either declare the action on the wrapper:`);
                 console.error(`      const doIt = guard.protect(doItRaw, describe, { action: "${pending.action}" });`);
@@ -316,19 +252,11 @@ export function createDecidioResume(opts) {
                 console.error(`  then start the worker. The approved action stays parked until then — nothing is lost.`);
                 return finish({ status: "no_handler", decisionId, action: pending.action, reason: `no fn registered for action "${pending.action}" in this process — declare { action } on protect(), or call guard.register("${pending.action}", fn) at startup` });
             }
-            // Atomically CLAIM before executing — the cross-process single-use guarantee. If
-            // the store has no claim primitive, fall back to an in-process guard (same-process).
             const claimed = ctrl.store.claim ? await ctrl.store.claim(decisionId) : (!inFlight.has(decisionId) && (inFlight.add(decisionId), true));
             if (!claimed)
-                return { status: "unknown", decisionId }; // another worker owns it
+                return { status: "unknown", decisionId };
             try {
-                // Approved: the AGENT performs its own action FIRST. If it throws, RELEASE the claim so
-                // the entry stays parked + retryable — an approved action is never lost.
                 const result = await fn(...pending.args);
-                // CONFIRM BEFORE DELETE. Deleting first meant a failed confirm lost the only local record
-                // that this action had executed — the evidence could never be re-sent. The entry stays
-                // CLAIMED throughout (claim, not presence, is what prevents double-execution), so keeping
-                // it a moment longer cannot cause a second run.
                 let confirmed = true;
                 let tier;
                 try {
@@ -338,12 +266,6 @@ export function createDecidioResume(opts) {
                     confirmed = false;
                     console.warn(`[decidio] resume confirm failed (your action DID succeed): ${e.message}`);
                 }
-                // RETAIN-vs-DELETE on a failed confirm. Keeping the entry preserves local evidence that
-                // this action executed — but ONLY a store with claim() can guarantee a retained entry
-                // never runs again (its claim refuses it; the in-process fallback dies with the process).
-                // For a claim-LESS store the delete IS the single-use guarantee, so it must still happen:
-                // an undelivered confirmation is an evidence gap, a second execution is a double write,
-                // and we never trade the second away for the first.
                 const retainedIsSafe = typeof ctrl.store.claim === "function";
                 if (confirmed || !retainedIsSafe)
                     await ctrl.store.delete(decisionId);
@@ -374,9 +296,6 @@ export function createDecidioResume(opts) {
                 req.on("data", (c) => (raw += c));
                 req.on("end", async () => {
                     try {
-                        // Fail CLOSED when no secret is configured: an agent that forgot to set a
-                        // webhookSecret must NOT be drivable by forged callbacks. Opt out only with
-                        // allowUnsigned (trusted network boundary).
                         if (!secret) {
                             if (!opts.allowUnsigned) {
                                 res.statusCode = 401;
@@ -443,14 +362,8 @@ export function createDecidioResume(opts) {
                                 st.state === "blocked" ? "blocked" : null;
                         if (!verdict)
                             continue;
-                        // A throwing resolve (the agent's own fn failed) must NOT kill the watcher —
-                        // the entry stays parked and is retried on the next poll.
                         try {
                             const outcome = await ctrl.resolve({ decisionId: p.decisionId, verdict, reason: st.reason });
-                            // ONE line per lifecycle event, on stderr (round-3 blind catch: the
-                            // production-recommended worker executed, restart-resumed and discarded actions in
-                            // total silence — the only evidence was a file vanishing). onResolved remains the
-                            // programmatic hook; this is the human-visible floor.
                             if (outcome.status === "executed" && outcome.confirmed)
                                 console.error(`[decidio] resumed ${p.decisionId}: approved → "${p.action}" executed, evidence recorded as ${outcome.evidenceTier ?? "confirmed"}.`);
                             else if (outcome.status === "executed")

package/dist/signing.d.ts

@@ -46,11 +46,21 @@ export declare function signBoundProof(privateKeyBase64: string, fields: {
     now?: number;
     nonce?: string;
 }): RequesterIdentity;
-/** The values that do not survive `JSON.stringify → JSON.parse` with their meaning intact.
- *  Refused at the GATE, before anything is routed, signed, or parked (prodsec F-01: `NaN`
- *  canonicalized to `null` and a `Map` to `{}`, so the integrity signature matched the drifted
- *  bytes and the function EXECUTED with arguments that meant something else — the exact wrong
- *  execution the parked-payload signature exists to refuse). Throws naming the offending path;
- *  returns nothing. The supported data model is plain JSON: null, boolean, string, finite
+/** Refuse values that do not survive `JSON.stringify → JSON.parse` with their meaning intact,
+ *  BEFORE anything is routed, signed, or parked. `NaN` canonicalizes to `null` and a `Map` to
+ *  `{}` — an integrity signature over those bytes would verify while the function executed
+ *  arguments that meant something else, so the gate refuses them instead. Throws naming the
+ *  offending path. The supported data model is plain JSON: null, boolean, string, finite
  *  number, plain array, plain object. */
+/** Typed refusal for values that cannot survive JSON with their meaning intact. `decisionId`
+ *  is set only when a decision already exists (defense-in-depth refusals after routing). */
+export declare class DecidioUnsafeArgumentsError extends Error {
+    decisionId?: string | undefined;
+    constructor(message: string, decisionId?: string | undefined);
+}
 export declare function assertJsonSafe(value: unknown, path?: string): void;
+/** The wire rule: a credentialed request must never ride plaintext http to a remote host — the
+ *  rule is about the WIRE, not which credential (the interactive sign-in enforced this for
+ *  session tokens while agent-token requests sailed through). localhost/127.0.0.1/[::1] stay
+ *  allowed for local dev; https always allowed. Throws before anything is sent. */
+export declare function assertSafeTransport(url: string, hasCredential: boolean): void;

package/dist/signing.js

@@ -1,13 +1,4 @@
-// Client-side agent identity (§13 P0-8). The agent generates its Ed25519 keypair LOCALLY
-// (the private key never crosses the wire — `init` registers only the public did:key) and
-// signs a REQUEST-BOUND proof on each authorize: a detached Ed25519 JWS over
-// canonical({agentId,did,action,amount,scope,nonce,exp}). Decidio's floor verifies the
-// signature, binds it to the exact request, burns the single-use nonce, and checks the
-// did against the agent registry — so the gate PROVES who is calling instead of trusting a
-// label. This canonicalize + proof shape is byte-identical to apps/api (canonical.ts +
-// a2a/identity.ts), so a proof signed here verifies there.
 import { generateKeyPairSync, createPrivateKey, sign as edSign, randomUUID } from "node:crypto";
-// base58btc (Bitcoin alphabet) — for the did:key multibase 'z' prefix.
 const B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function b58encode(buf) {
     const digits = [0];
@@ -34,7 +25,6 @@ function b58encode(buf) {
         str += B58[digits[i]];
     return str;
 }
-/** Sorted-key JCS — must match apps/api/src/canonical.ts byte-for-byte. */
 export function canonicalize(v) {
     if (v === null || typeof v !== "object")
         return JSON.stringify(v);
@@ -43,9 +33,6 @@ export function canonicalize(v) {
     const o = v;
     return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`).join(",")}}`;
 }
-/** Generate a fresh Ed25519 keypair LOCALLY. Returns the public `did:key` (register this)
- *  and the PKCS8 private key base64 (keep this in the agent host's env as DECIDIO_AGENT_KEY —
- *  it never goes back to Decidio). */
 export function generateKeypair() {
     const { privateKey, publicKey } = generateKeyPairSync("ed25519");
     const jwk = publicKey.export({ format: "jwk" });
@@ -54,40 +41,29 @@ export function generateKeypair() {
     const privateKeyBase64 = privateKey.export({ format: "der", type: "pkcs8" }).toString("base64");
     return { did, privateKeyBase64 };
 }
-/** Sign the CONFIRM call (bound to {action:"confirm", scope:decisionId}) so the gate can
- *  prove the caller is the receipt's original requester before granting the wrapper tier
- *  (application_confirmed). Returns undefined when no signing key is configured (the server
- *  then caps the report at agent_asserted). Used by EVERY confirm path — inline, durable
- *  resume, and the engine adapters — so the production paths confirm with a proof too. Also
- *  binds `workspaceId` (D-B3.6) when configured, so the confirm proof is tenant-scoped too. */
 export function signConfirm(decisionId, cfg) {
     if (!cfg.agentKey || !cfg.agentDid || !cfg.agentId)
         return undefined;
     return signBoundProof(cfg.agentKey, { agentId: cfg.agentId, did: cfg.agentDid, action: "confirm", amount: 0, scope: decisionId, workspaceId: cfg.workspaceId });
 }
-/** Sign a request-bound identity proof. The returned object is sent verbatim as the
- *  `requesterIdentity` field of /agent/authorize. */
 export function signBoundProof(privateKeyBase64, fields) {
     const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
     const nonce = fields.nonce ?? randomUUID();
     const exp = (fields.now ?? Date.now()) + (fields.ttlMs ?? 120_000);
-    // OMIT scope/workspaceId when absent so the canonical bytes match the server + the Python SDK — a key
-    // with an undefined value would serialize as literal "undefined", which Python can't reproduce, and a
-    // legacy (no-workspace) proof must stay byte-identical. The server's bound-payload reconstruction
-    // omits them the same way (a2a/identity.ts).
     const payloadObj = { agentId: fields.agentId, did: fields.did, action: fields.action, amount: fields.amount, ...(fields.scope !== undefined ? { scope: fields.scope } : {}), ...(fields.workspaceId !== undefined ? { workspaceId: fields.workspaceId } : {}), nonce, exp };
     const payload = Buffer.from(canonicalize(payloadObj), "utf8").toString("base64url");
     const protectedHdr = Buffer.from(JSON.stringify({ alg: "EdDSA", kid: fields.did }), "utf8").toString("base64url");
     const signature = Buffer.from(edSign(null, Buffer.from(`${protectedHdr}.${payload}`, "utf8"), key)).toString("base64url");
     return { agentId: fields.agentId, did: fields.did, action: fields.action, amount: fields.amount, scope: fields.scope, workspaceId: fields.workspaceId, nonce, exp, proof: { protected: protectedHdr, signature } };
 }
-/** The values that do not survive `JSON.stringify → JSON.parse` with their meaning intact.
- *  Refused at the GATE, before anything is routed, signed, or parked (prodsec F-01: `NaN`
- *  canonicalized to `null` and a `Map` to `{}`, so the integrity signature matched the drifted
- *  bytes and the function EXECUTED with arguments that meant something else — the exact wrong
- *  execution the parked-payload signature exists to refuse). Throws naming the offending path;
- *  returns nothing. The supported data model is plain JSON: null, boolean, string, finite
- *  number, plain array, plain object. */
+export class DecidioUnsafeArgumentsError extends Error {
+    decisionId;
+    constructor(message, decisionId) {
+        super(message);
+        this.decisionId = decisionId;
+        this.name = "DecidioUnsafeArgumentsError";
+    }
+}
 export function assertJsonSafe(value, path = "args") {
     const seen = new Set();
     const walk = (v, p) => {
@@ -95,18 +71,18 @@ export function assertJsonSafe(value, path = "args") {
             return;
         if (typeof v === "number") {
             if (!Number.isFinite(v))
-                throw new Error(`[decidio] ${p} is ${String(v)} — a non-finite number does not survive JSON (it becomes null), so what a human approves would not be what executes. The decision was NOT routed; pass a finite number or a string.`);
+                throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is ${String(v)} — a non-finite number does not survive JSON (it becomes null), so what a human approves would not be what executes. pass a finite number or a string.`);
             return;
         }
         if (typeof v === "undefined")
-            throw new Error(`[decidio] ${p} is undefined — JSON drops or nullifies it, so what a human approves would not be what executes. The decision was NOT routed; use null explicitly or omit the field.`);
+            throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is undefined — JSON drops or nullifies it, so what a human approves would not be what executes. use null explicitly or omit the field.`);
         if (typeof v === "bigint")
-            throw new Error(`[decidio] ${p} is a BigInt — JSON cannot represent it. The decision was NOT routed; pass it as a string.`);
+            throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is a BigInt — JSON cannot represent it. pass it as a string.`);
         if (typeof v === "function" || typeof v === "symbol")
-            throw new Error(`[decidio] ${p} is a ${typeof v} — it cannot be serialized for approval. The decision was NOT routed.`);
+            throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is a ${typeof v} — it cannot be serialized for approval.`);
         if (typeof v === "object") {
             if (seen.has(v))
-                throw new Error(`[decidio] ${p} is part of a circular structure — it cannot be serialized for approval. The decision was NOT routed.`);
+                throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is part of a circular structure — it cannot be serialized for approval.`);
             seen.add(v);
             if (Array.isArray(v)) {
                 v.forEach((x, i) => walk(x, `${p}[${i}]`));
@@ -116,16 +92,23 @@ export function assertJsonSafe(value, path = "args") {
             const proto = Object.getPrototypeOf(v);
             if (proto !== Object.prototype && proto !== null) {
                 const name = v?.constructor?.name ?? "a class instance";
-                throw new Error(`[decidio] ${p} is ${name === "Object" ? "an exotic object" : `a ${name}`} — only plain JSON objects survive serialization with their meaning intact (a Map, for example, becomes {}). The decision was NOT routed; convert it to plain JSON first.`);
+                throw new DecidioUnsafeArgumentsError(`[decidio] ${p} is ${name === "Object" ? "an exotic object" : `a ${name}`} — only plain JSON objects survive serialization with their meaning intact (a Map, for example, becomes {}); convert it to plain JSON first.`);
             }
             if (typeof v.toJSON === "function")
-                throw new Error(`[decidio] ${p} defines toJSON() — its serialized form would differ from the value the signature covers. The decision was NOT routed; pass the plain serialized form instead.`);
+                throw new DecidioUnsafeArgumentsError(`[decidio] ${p} defines toJSON() — its serialized form would differ from the value the signature covers. pass the plain serialized form instead.`);
             for (const [k, x] of Object.entries(v))
                 walk(x, `${p}.${k}`);
             seen.delete(v);
             return;
         }
-        throw new Error(`[decidio] ${p} has unsupported type ${typeof v}. The decision was NOT routed.`);
+        throw new DecidioUnsafeArgumentsError(`[decidio] ${p} has unsupported type ${typeof v}.`);
     };
     walk(value, path);
 }
+export function assertSafeTransport(url, hasCredential) {
+    if (!hasCredential)
+        return;
+    if (/^http:\/\//i.test(url) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])([:/]|$)/i.test(url)) {
+        throw new Error(`[decidio] refusing to send credentials over plaintext http to ${url.replace(/^(https?:\/\/[^/]+).*$/i, "$1")} — use https, or localhost for local dev. Nothing was sent.`);
+    }
+}

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.1.9
+  version: 0.1.10
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -77,20 +77,14 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
+    "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsc -p tsconfig.types.json",
     "prepublishOnly": "npm run typecheck && npm run build"
   },
   "dependencies": {
-    "@decidio/verify": "0.1.8"
+    "@decidio/verify": "0.1.9"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {
     "url": "https://decidioai.com/support/"
-  },
-  "peerDependencies": {
-    "inngest": ">=3 <4",
-    "@langchain/langgraph": ">=0.2 <2",
-    "@temporalio/workflow": ">=1 <2",
-    "@openai/agents": ">=0.0.1 <2"
   }
 }