@decidio/sdk 0.2.1 → 0.3.0

package/openapi.yaml

@@ -260,6 +260,13 @@ paths:
           content:
             application/json:
               schema: { $ref: "#/components/schemas/StatusResponse" }
+        "400":
+          description: >
+            `INVALID_DECISION_ID` - the id is not a usable decision id (empty, whitespace-padded,
+            control characters, a path, or over 128 characters). Deliberately NOT the 404 below: a
+            malformed id is not a decision that might exist somewhere else, and answering "unknown
+            decision" would send you looking for something that could never have been issued. The
+            check runs BEFORE any lookup, so this response reveals nothing about existence.
         "401": { description: missing/invalid agent token }
         "404": { description: unknown decision }
   /agent/confirm:
@@ -272,6 +279,14 @@ paths:
         evidence. The caller does not choose it and this endpoint does not always grant the top
         one. The credential sealed at decision time is immutable; evidence accrues on the record,
         never inside the sealed bytes.
+
+
+        A SUPPLIED-BUT-REFUSED executionReport CAPS THE TIER at `execution_unconfirmed`, whatever
+        else the report would have earned — and deliberately BELOW `agent_asserted`. A failed
+        attestation is weaker evidence than never claiming one; the opposite ordering would reward
+        sending a forged report over sending none. The server verifies the report and derives the
+        tier on the SAME path, so a refused attestation can no longer land on a receipt beside
+        `application_confirmed`.
       requestBody:
         required: true
         content:
@@ -287,6 +302,29 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/ConfirmResponse" }
         "401": { description: missing/invalid agent token }
+        "404": { description: unknown decision, or one this agent is not bound to }
+        "409":
+          description: >
+            The gate refuses to attach execution evidence to this decision AT ALL. This is not a
+            report failure, and a client must not treat it as one — handle it separately from a
+            5xx. `code` is either:
+
+            `TERMINALLY_DENIED` — a human or a policy DENIED this decision. If your action ran, it
+            ran against a refusal: do NOT re-run it, and investigate how it executed without an
+            approval. A denial is terminal and cannot be reconciled or retried.
+
+            `NOT_AUTHORIZED` — this is not an approved, sealed decision, so there is nothing for
+            evidence to attach to yet. If you are confirming early, wait for the approval. If your
+            action already ran, it ran WITHOUT authority.
+
+            Not retryable in either case: the same request will be refused the same way.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string, enum: [TERMINALLY_DENIED, NOT_AUTHORIZED] }
+                  message: { type: string }
   x-webhooks:
     resume:
       post:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -55,11 +55,6 @@
     "verifiable-credentials"
   ],
   "homepage": "https://decidioai.com/developers/",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/OmniTwin/Decidio.git",
-    "directory": "packages/decidio-guard"
-  },
   "publishConfig": {
     "access": "public"
   },
@@ -87,7 +82,7 @@
     "prepublishOnly": "npm run typecheck && npm run build"
   },
   "dependencies": {
-    "@decidio/verify": "0.2.1"
+    "@decidio/verify": "0.3.0"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {