@decidio/sdk 0.2.2 → 0.3.3

package/dist/signing.d.ts

@@ -1,4 +1,11 @@
-/** Sorted-key JCS — must match apps/api/src/canonical.ts byte-for-byte. */
+/** Sorted-key JCS — must match apps/api/src/canonical.ts byte-for-byte.
+ *
+ *  ONE IMPLEMENTATION (F-006). This was a module-local copy that reached `JSON.stringify` for every
+ *  primitive, so it applied NONE of the strict rules the exported canonicalizer enforces — most
+ *  sharply, it emitted an escaped lone surrogate instead of refusing it. The bytes a bound proof
+ *  SIGNS and the bytes the digest BINDS are the two places that must never disagree with the value
+ *  model, and they were the two places that did. Python already delegated (`signing.canonicalize` →
+ *  `canonical_json`); this is the twin-parity repair on the TypeScript side. */
 export declare function canonicalize(v: unknown): string;
 /** Generate a fresh Ed25519 keypair LOCALLY. Returns the public `did:key` (register this)
  *  and the PKCS8 private key base64 (keep this in the agent host's env as DECIDIO_AGENT_KEY —

package/dist/signing.js

@@ -1,4 +1,5 @@
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign as edSign, verify as edVerify, createHash, randomUUID } from "node:crypto";
+import { canonicalJson } from "./canonical.js";
 const B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function b58encode(buf) {
     const digits = [0];
@@ -26,12 +27,7 @@ function b58encode(buf) {
     return str;
 }
 export function canonicalize(v) {
-    if (v === null || typeof v !== "object")
-        return JSON.stringify(v);
-    if (Array.isArray(v))
-        return `[${v.map(canonicalize).join(",")}]`;
-    const o = v;
-    return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(o[k])}`).join(",")}}`;
+    return canonicalJson(v, "canonicalize(...)");
 }
 export function didFromPrivateKey(privateKeyBase64) {
     const priv = createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
@@ -111,20 +107,6 @@ export function assertJsonSafe(value, path = "args") {
     walk(value, path);
 }
 export function assertSafeTransport(url, hasCredential) {
-    if (!hasCredential) {
-        let probe = null;
-        try {
-            probe = new URL(url);
-        }
-        catch {
-            probe = null;
-        }
-        if (probe && (probe.username || probe.password)) {
-            throw new Error(`[decidio] the gate URL carries credentials in the URL itself (${probe.protocol}//user:***@${probe.host}). Decidio authenticates with a bearer token, so this is either a mistake or a secret you did not mean to put on the wire — and it is sent on every request regardless of whether an api token is configured. Remove the user:password from the URL. Nothing was sent.`);
-        }
-    }
-    if (!hasCredential)
-        return;
     let u;
     try {
         u = new URL(url);
@@ -132,9 +114,9 @@ export function assertSafeTransport(url, hasCredential) {
     catch {
         const spelled = url.replace(/[\t\r\n]/g, "").replace(/^[\s\u0000-\u001f\u0085\ufeff]+/, "");
         if (/^http:/i.test(spelled)) {
-            throw new Error(`[decidio] refusing to send credentials over plaintext http to ${JSON.stringify(url)} — that is not a complete absolute URL, so where the request would actually connect is undefined (the path is appended to it, which can turn it into a remote host). Set a full https URL, or http://localhost for local dev. Nothing was sent.`);
+            throw new Error(`[decidio] refusing to ${hasCredential ? "send credentials" : "send a request"} over plaintext http to ${JSON.stringify(url)} — that is not a complete absolute URL, so where the request would actually connect is undefined (the path is appended to it, which can turn it into a remote host). Set a full https URL, or http://localhost for local dev. Nothing was sent.`);
         }
-        return;
+        throw new Error(`[decidio] the gate URL ${JSON.stringify(url)} is not an absolute URL, so there is no host to send to — where a request would actually connect depends entirely on whichever transport resolves it. Decidio needs a full https URL (or http://localhost for local dev). Nothing was sent.`);
     }
     if (u.protocol !== "http:" && u.protocol !== "https:") {
         throw new Error(`[decidio] the gate URL uses the ${u.protocol.replace(":", "")} scheme, which is not a Decidio endpoint — use https (or http://localhost for local dev). Nothing was sent.`);
@@ -142,13 +124,26 @@ export function assertSafeTransport(url, hasCredential) {
     if (u.username || u.password) {
         throw new Error(`[decidio] the gate URL carries credentials in the URL itself (${u.protocol}//user:***@${u.host}). Decidio authenticates with a bearer token; remove the user:password from the URL. Nothing was sent.`);
     }
+    if (u.hostname === "") {
+        throw new Error(`[decidio] the gate URL ${JSON.stringify(url)} has no host — there is nowhere for the request to go. Decidio needs a full https URL (or http://localhost for local dev). Nothing was sent.`);
+    }
+    {
+        const spelled = url.replace(/[\t\r\n]/g, "").replace(/^[\s\u0000-\u001f\u0085\ufeff]+/, "").toLowerCase();
+        const origin = `${u.protocol}//${u.host}`.toLowerCase();
+        const next = spelled.charAt(origin.length);
+        if (!spelled.startsWith(origin) || (next !== "" && next !== "/" && next !== "?" && next !== "#" && next !== ":")) {
+            throw new Error(`[decidio] the gate URL ${JSON.stringify(url)} is not written in canonical form — this parser reads it as ${origin}, but the raw spelling is what a transport receives, and a parser that normalizes differently can read it as another host entirely. Write it as ${origin}. Nothing was sent.`);
+        }
+    }
     if (u.protocol !== "http:")
         return;
     const host = u.hostname.toLowerCase();
     const local = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
     if (local)
         return;
-    throw new Error(`[decidio] refusing to send credentials over plaintext http to ${u.origin} — use https, or localhost for local dev. Nothing was sent.`);
+    throw new Error(hasCredential
+        ? `[decidio] refusing to send credentials over plaintext http to ${u.origin} — use https, or localhost for local dev. Nothing was sent.`
+        : `[decidio] refusing to talk to ${u.origin} over plaintext http — Decidio is https, and an unauthenticated plaintext reply cannot be trusted to carry an authority decision. Use https, or localhost for local dev. Nothing was sent.`);
 }
 export const carriesCredential = (c) => !!c.apiToken || !!(c.agentKey && c.agentDid);
 export function signExecutionReport(privateKeyBase64, fields) {

package/openapi.yaml

@@ -260,6 +260,13 @@ paths:
           content:
             application/json:
               schema: { $ref: "#/components/schemas/StatusResponse" }
+        "400":
+          description: >
+            `INVALID_DECISION_ID` - the id is not a usable decision id (empty, whitespace-padded,
+            control characters, a path, or over 128 characters). Deliberately NOT the 404 below: a
+            malformed id is not a decision that might exist somewhere else, and answering "unknown
+            decision" would send you looking for something that could never have been issued. The
+            check runs BEFORE any lookup, so this response reveals nothing about existence.
         "401": { description: missing/invalid agent token }
         "404": { description: unknown decision }
   /agent/confirm:
@@ -272,6 +279,14 @@ paths:
         evidence. The caller does not choose it and this endpoint does not always grant the top
         one. The credential sealed at decision time is immutable; evidence accrues on the record,
         never inside the sealed bytes.
+
+
+        A SUPPLIED-BUT-REFUSED executionReport CAPS THE TIER at `execution_unconfirmed`, whatever
+        else the report would have earned — and deliberately BELOW `agent_asserted`. A failed
+        attestation is weaker evidence than never claiming one; the opposite ordering would reward
+        sending a forged report over sending none. The server verifies the report and derives the
+        tier on the SAME path, so a refused attestation can no longer land on a receipt beside
+        `application_confirmed`.
       requestBody:
         required: true
         content:
@@ -287,6 +302,29 @@ paths:
             application/json:
               schema: { $ref: "#/components/schemas/ConfirmResponse" }
         "401": { description: missing/invalid agent token }
+        "404": { description: unknown decision, or one this agent is not bound to }
+        "409":
+          description: >
+            The gate refuses to attach execution evidence to this decision AT ALL. This is not a
+            report failure, and a client must not treat it as one — handle it separately from a
+            5xx. `code` is either:
+
+            `TERMINALLY_DENIED` — a human or a policy DENIED this decision. If your action ran, it
+            ran against a refusal: do NOT re-run it, and investigate how it executed without an
+            approval. A denial is terminal and cannot be reconciled or retried.
+
+            `NOT_AUTHORIZED` — this is not an approved, sealed decision, so there is nothing for
+            evidence to attach to yet. If you are confirming early, wait for the approval. If your
+            action already ran, it ran WITHOUT authority.
+
+            Not retryable in either case: the same request will be refused the same way.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string, enum: [TERMINALLY_DENIED, NOT_AUTHORIZED] }
+                  message: { type: string }
   x-webhooks:
     resume:
       post:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.2.2",
+  "version": "0.3.3",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -55,11 +55,6 @@
     "verifiable-credentials"
   ],
   "homepage": "https://decidioai.com/developers/",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/OmniTwin/Decidio.git",
-    "directory": "packages/decidio-guard"
-  },
   "publishConfig": {
     "access": "public"
   },
@@ -84,10 +79,10 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsc -p tsconfig.types.json",
-    "prepublishOnly": "npm run typecheck && npm run build"
+    "prepublishOnly": "npm run typecheck && npm run build && node ../publish-boundary/check.mjs --only @decidio/sdk"
   },
   "dependencies": {
-    "@decidio/verify": "0.2.2"
+    "@decidio/verify": "0.3.3"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {