@decidio/sdk 0.6.2 → 0.6.3

package/CHANGELOG.md

@@ -1,8 +1,19 @@
 # Changelog — @decidio/sdk
 
-Release notes for the client SDK. The Python package `decidio` ships the same changes under the same
-version (the two are conformance-locked twins). Each entry names what changed, what a reader must do
-on upgrade, and what proved it.
+Release notes for the client SDK. The Python package `decidio` ships under the same version; the core -
+the gate, signing, receipts and the verifier - is conformance-locked between the two, while the command line's
+first-run surfaces (the fork, `--demo`, the code sign-in) are TypeScript-first and named as such in the parity
+allowlist. Each entry names what changed, what a reader must do on upgrade, and what proved it.
+
+## 0.6.3 — the two 0.6.2 reviews' small items
+
+- **`DECIDIO_DEBUG_INPUT=1` no longer prints what you type** (review: Medium). The 0.6.2 trace hex-dumped every stdin
+  byte - passwords, codes and links, muted prompt or not. It now prints the SHAPE only: control bytes named (`\r`, `\n`,
+  ESC), every printable byte as `x`. A newline problem is visible in the shape alone.
+- Four strings still described the sign-in as an emailed link to paste; they say the code now. The CHANGELOG's "twins"
+  line overstated CLI parity and now says exactly what is locked and what is TypeScript-first. Two README headings
+  still said "0.4". The offline local demo no longer prints "the terminal follows the web app or your phone" when it
+  has just said there are no such doors. `receipt --json` help says it prints a summary; the credential is the file.
 
 ## 0.6.2 — the fork after its first real run
 

package/README.md

@@ -23,7 +23,7 @@ you approve right there (or from your Decidio app), executes on approval, then d
 sealed Authority Receipt and verifies it offline in front of you, pinned to your workspace's
 issuer. It mints a **7-day** tour token (`init` mints 90-day tokens — different jobs, different
 lifetimes) and ends by offering to clean itself up (`quickstart cleanup` works later too).
-Sign in once — `npx @decidio/sdk login`, or when the tour asks: the CLI emails you a link, you paste it, and
+Sign in once — `npx @decidio/sdk login`, or when the tour asks: the CLI emails you an 8-character code, you type it, and
 the sign-in is kept in your profile (owner-only) for 30 days, or until this terminal closes, `logout`, or
 `quickstart cleanup`. At the human step the tour offers three doors: answer here, open the decision in
 the web app (a one-time link, signed in for you), or scan the QR with your phone — whichever answers
@@ -660,7 +660,7 @@ that fits every other confirm error.
 - **The token recovery journal** (`.decidio-token-journal`, owner-only, gitignored; ids and timestamps, never a token value; append-only by the CLI's behaviour — not OS-enforced or tamper-evident). One JSON row per event: `minted` (a token was issued, written BEFORE its credential file), `retired how=persisted` (the credential file now holds it - the token is live and that file is its handle; not revoked), `retired how=revoked` (revoked server-side), `probe` (a durability check). `doctor` names rows still outstanding; `quickstart cleanup` sweeps them.
 - `quickstart --demo` — the same tour with no account: an in-process stand-in of the API on 127.0.0.1 (shipped in this package) answers every door, a key generated for the run signs a real receipt (its content says `local-demo`; pinning it to the hosted issuer fails), and the web/phone door is a hosted demo decision page reached through a one-word relay (no account, no record, ten minutes). Your folder gains exactly one file, the receipt. Offline, the tour is terminal-only and says so.
 - `quickstart --phone web` — the QR at the human step opens the phone web rendering even when the Decidio app is installed (by default it opens the app when there is one).
-- `login [email]` / `logout` — sign in ONCE (the CLI emails you a link; you paste it) and forget that sign-in on this computer (the session token itself stays valid until it expires (up to 30 days) — there is no server-side revocation yet). The session is stored in your user profile, owner-only, bound to the terminal window that created it, for 30 days; `DECIDIO_SESSION_TOKEN` in the environment outranks it (headless shells).
+- `login [email]` / `logout` — sign in ONCE (the CLI emails you an 8-character code; you type it) and forget that sign-in on this computer (the session token itself stays valid until it expires (up to 30 days) — there is no server-side revocation yet). The session is stored in your user profile, owner-only, bound to the terminal window that created it, for 30 days; `DECIDIO_SESSION_TOKEN` in the environment outranks it (headless shells).
 - `dev [--target URL] [--port N]` — local relay for the resume webhook (operator setups)
 
 The CLI's stream contract: **stdout carries results only** (safe to pipe — `--json` output is
@@ -703,7 +703,7 @@ Every error raised after a decision exists carries the `decisionId`, so a suspen
 timed-out action is always findable in
 your queue.
 
-## What 0.4 does not yet claim
+## What the SDK does not yet claim
 
 The retest that graded 0.3.3 *A- for the core and the shipped stores* and the first-run reviews of
 0.3.3 and 0.3.5 agree on what is left, and none of it is a defect a patch release closes. Stated here so
@@ -729,7 +729,7 @@ the next reader grades a promise, not a moving target:
 
 ## Compatibility and support
 
-- **Stable in 0.4:** `guard.protect` / `withApproval` and their options; the durable resume
+- **Stable surface:** `guard.protect` / `withApproval` and their options; the durable resume
   controller (`createDecidioResume`: `park`, `resolve`, `reconcile`, `reconfirm`, `recover`, the worker
   and both webhook handlers); the `PendingStore` contract and both shipped stores, including the on-disk
   revision-chain layout; `EvidenceOutcome` (a root export) and `ResumeStatus` / `RecoveryState` (on the

package/dist/cli.js

@@ -501,7 +501,11 @@ function ask(question, mute = false) {
     });
 }
 if (process.env.DECIDIO_DEBUG_INPUT && process.stdin.isTTY) {
-    process.stdin.on("data", (c) => { process.stderr.write(`[stdin ${Buffer.from(c).toString("hex")}]\n`); });
+    process.stdin.on("data", (c) => {
+        const b = Buffer.from(c);
+        const shape = [...b].map((x) => x === 0x0d ? "\\r" : x === 0x0a ? "\\n" : x === 0x1b ? "ESC" : x < 0x20 ? `^${String.fromCharCode(x + 64)}` : x === 0x7f ? "DEL" : "x").join("");
+        process.stderr.write(`[stdin ${b.length}B ${shape}]\n`);
+    });
 }
 function terminalId() {
     for (const k of ["WT_SESSION", "VSCODE_IPC_HOOK_CLI", "TERM_SESSION_ID", "ITERM_SESSION_ID", "TMUX_PANE", "KONSOLE_DBUS_SESSION", "GNOME_TERMINAL_SCREEN", "WINDOWID"]) {
@@ -575,7 +579,7 @@ async function loginFlow(purpose, emailArg) {
         log("  ✘ no email given - re-run when you have it.");
         return null;
     }
-    const password = await ask("  password (Enter = emailed sign-in link): ", true);
+    const password = await ask("  password (Enter = emailed sign-in code): ", true);
     if (password) {
         const r = await api("/demo/login", { method: "POST", body: JSON.stringify({ email, password }) }, "");
         if (r.status >= 200 && r.status < 300 && r.body?.token) {
@@ -1554,7 +1558,8 @@ async function cmdQuickstartInner(opts = {}) {
         }
         else if (doorLink)
             rows.push(`${bold("your phone")}   ${dim("the link above works on a phone too (no QR came back this time)")}`);
-        rows.push(dim("whichever answers first wins — the terminal follows the web app or your phone."));
+        if (!DEMO || doorLink)
+            rows.push(dim("whichever answers first wins — the terminal follows the web app or your phone."));
         block("③", "Your call", rows, "choice");
         let settledState = null;
         const settledP = running.then(() => { settledState = "approved"; }, (e) => { settledState = e instanceof DecidioRejectedError ? "rejected" : "other"; });
@@ -2186,7 +2191,9 @@ APPROVALS AND RECEIPTS
                                        If it starts with a dash, put it after -- or use --reason:
                                          ... approve <id> -- "-50% cut, per the board"
                                          ... approve <id> --reason "-50% cut, per the board"
-  npx @decidio/sdk receipt <id> [--json]   download a sealed decision's Authority Receipt (.json)
+  npx @decidio/sdk receipt <id> [--json]   download a sealed decision's Authority Receipt to a .json FILE; --json prints
+                                       a summary to stdout (file name, evidence, issuer, the identities you may see) -
+                                       the credential itself is the file
   npx @decidio/sdk verify --issuer <did> <receipt.json> [more...]   verify receipts OFFLINE, pinned to your
                                        workspace's issuer (--allow-unpinned: structural check only)
 

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.6.2   # tracks the SDK release - checked by packages/conformance/manifests.mjs
+  version: 0.6.3   # tracks the SDK release - checked by packages/conformance/manifests.mjs
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run typecheck && npm run build && node ../publish-boundary/check.mjs --only @decidio/sdk"
   },
   "dependencies": {
-    "@decidio/verify": "0.6.2"
+    "@decidio/verify": "0.6.3"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {