@decidio/sdk 0.7.0 → 0.8.0

package/README.md

@@ -247,7 +247,7 @@ That's the whole contract: gate → human decision → your execution → owned,
 ## What happens on a call
 
 1. The wrapper asks Decidio's gate to authorize `{action, amount, scope}` for your `agentId`.
-2. Decidio's policy engine (Cedar) returns **proceed | route | block**:
+2. Decidio's policy engine — your workspace's active policy, whose versioned rules decide every request (Cedar is compiled from them for validation and export) — returns **proceed | route | block**:
    - **proceed** — your function runs immediately (auto-approved under a named, versioned rule).
    - **route** — the action suspends (durable) or waits (blocking) for a human decision in Decidio's queue, then runs your function (or throws `DecidioRejectedError`).
    - **block** — the wrapper throws `DecidioBlockedError`; your function never runs.

package/dist/adapters/_gate.d.ts

@@ -37,6 +37,26 @@ export declare function gateCheckApproval(config: GuardConfig, decisionId: strin
  *  Inngest step memo). Anything that is not a well-formed check is refused as unverifiable - the same
  *  "an answer you do not understand is never permission" rule the verdict allow-list applies. */
 export declare function assertApprovalCheckShape(raw: unknown, decisionId: string): ApprovalCheck;
+/** REFUSAL TWINS (chat approvals 2026-10-15 round 2): the one answer outside the allow-list, and only for a caller that ASKED for
+ *  the check (`twinCheck`). It is not permission - nothing was created; the caller tells the user and re-asks with their
+ *  justification. gateAuthorize (every adapter and the core path) never asks, so it can never receive one. */
+export interface GateDuplicate {
+    decision: "duplicate";
+    duplicateOf: {
+        decisionId: string;
+        displayNumber?: string | null;
+        refusedAt?: string | null;
+        reason?: string | null;
+    };
+}
+export declare const isGateDuplicate: (a: unknown) => a is GateDuplicate;
+/** The hook's door: asks for the refusal-twin check and may carry the re-ask's justification. A `duplicate` answer is returned as
+ *  such (never permission); every other answer passes the same allow-list as gateAuthorize. */
+export declare function gateAuthorizeTwinAware(config: GuardConfig, ctx: ApprovalContext, opts?: {
+    idempotencyKey?: string;
+    request?: CommittedRequest;
+    justification?: string;
+}): Promise<GateAuth | GateDuplicate>;
 export declare function gateAuthorize(config: GuardConfig, ctx: ApprovalContext, opts?: {
     idempotencyKey?: string;
     request?: CommittedRequest;

package/dist/adapters/_gate.js

@@ -40,7 +40,20 @@ export function assertApprovalCheckShape(raw, decisionId) {
         return { ok: false, decisionId, state: c.state, code: "unverifiable", reason: "the approval check came back contradictory (ok with a refusal code)" };
     return c;
 }
+export const isGateDuplicate = (a) => {
+    const d = a?.duplicateOf;
+    return a?.decision === "duplicate" && !!d && typeof d === "object" && typeof d.decisionId === "string" && decisionIdProblem(d.decisionId) === null;
+};
+export async function gateAuthorizeTwinAware(config, ctx, opts = {}) {
+    const a = await postAuthorize(config, ctx, { ...opts, twinCheck: true });
+    if (isGateDuplicate(a))
+        return a;
+    return assertAuthorizeVerdict(a, "unknown");
+}
 export async function gateAuthorize(config, ctx, opts = {}) {
+    return assertAuthorizeVerdict(await postAuthorize(config, ctx, opts), "unknown");
+}
+async function postAuthorize(config, ctx, opts = {}) {
     ctx = canonicalize(ctx, "describe(...)");
     assertDescribed(ctx);
     assertSafeTransport(config.apiUrl, carriesCredential(config));
@@ -60,6 +73,8 @@ export async function gateAuthorize(config, ctx, opts = {}) {
             ...(requesterIdentity ? { requesterIdentity } : {}), ...(resumeUrl ? { resumeUrl } : {}),
             ...(commitment ? { requestCommitment: commitment } : {}),
             ...(opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}),
+            ...(opts.twinCheck ? { twinCheck: true } : {}),
+            ...(opts.justification ? { justification: opts.justification } : {}),
         }),
     });
     if (!res.ok) {
@@ -71,7 +86,7 @@ export async function gateAuthorize(config, ctx, opts = {}) {
         catch { }
         throw new DecidioHttpError(res.status, "/agent/authorize", parsed);
     }
-    return assertAuthorizeVerdict(await res.json(), "unknown");
+    return res.json();
 }
 export async function gateConfirm(config, decisionId, result, evidence) {
     const f = config.fetchImpl ?? fetch;

package/dist/cli.d.ts

@@ -17,3 +17,53 @@ export declare function defaultAgentId(dir?: string): string;
  *  distinct decision ids can never share a file (first-run review of 0.4.1: dots were STRIPPED, `a.b` and `ab`
  *  collided). `~` is outside the allowed set, so the escape is unambiguous. Exported for the smokes. */
 export declare function receiptFileName(id: string): string;
+/** Scoped packs (GitHub App design §2): a pack's scope in words - the organisation's, a unit's (its type, and its name when
+ *  the server sent one: names that fail its person check are withheld there), or the reader's own. Null for an older server. */
+export declare function packScopeLabel(scope: any): string | null;
+/** Where `context pull --here` is: a folder's .decidio.json names a unit; else the checkout's GitHub remote names the repository
+ *  (its binding's unit decides); else nowhere in particular (the organisation's packs and your own). */
+export declare function hereQuery(cwd?: string): {
+    unit?: string;
+    repo?: string;
+    error?: string;
+};
+/** PROJECT FILES ARE TOUCHED ONLY THROUGH PLAIN PATHS (invariant-guard 2026-10-16): a repository can commit `.claude/skills/x`
+ *  or `.claude/rules` as a SYMLINK to anywhere, so every component from the project's `.claude` down is lstat'ed and a symlink
+ *  refuses the whole path - nothing is written through it and nothing is removed through it. A missing component is fine. */
+export declare function plainProjectPath(parts: string[]): boolean;
+/** Is this file one `context pull` wrote? A skill file's frontmatter names `decidio-<slug>` and its heading says it is a
+ *  Decidio context pack; a rules file's heading says it is one to read first. A person's own file with our prefix is not. */
+export declare function isPackFileOf(text: string, slug: string, kind: "skill" | "rules"): boolean;
+/** The skill file for one pack: the trigger IS the description (the host reads it every turn), the rows are the body. */
+export declare function packSkillMarkdown(idx: any): string;
+/** An ALWAYS-pack (stackable packs, 2026-10-15): a Claude Code rules file, loaded whole at launch with the project's own
+ *  rules - no frontmatter, no trigger; the foundation every other pack can assume was read. */
+export declare function packRulesMarkdown(idx: any): string;
+export type ParsedAdr = {
+    title: string;
+    status: string | null;
+    decided: string;
+    rationale: string;
+    alternatives: string[];
+};
+/** PURE: one ADR's title, status, decision, context (with its consequences) and the options it considered; null when it has no title. */
+export declare function parseAdr(text: string): ParsedAdr | null;
+export declare const AGENTS_MD_START = "<!-- decidio:start -->";
+export declare const AGENTS_MD_END = "<!-- decidio:end -->";
+/** Decidio's public GitHub Action (github.com/OmniTwin/decidio-actions): one action, step request or verify. It fetches the job's own
+ *  OIDC token (audience "decidio") - no repository secret - and fails the job in plain words when Decidio refuses. Pinned to the
+ *  v1.0.0 COMMIT, never a tag (invariant-guard 2026-10-20): the verify step enforces the approval in a production job with
+ *  id-token: write, so a moved tag must not change it. Bump both pins together, with the release. */
+export declare const DECIDIO_ACTION = "OmniTwin/decidio-actions@e40ba8e75a223f2475038d38a16df5a5885afde4 # v1.0.0";
+export declare const CHECKOUT_ACTION = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0";
+export declare function githubRequestWorkflow(api: string, environment: string, branch?: string): string;
+/** The verify step and the checkout of the approved commit: the first steps of any deploy job Decidio starts. */
+export declare function githubVerifySteps(api: string): string;
+export declare function githubDeployWorkflow(api: string, environment: string): string;
+/** The AGENTS.md section: a link to where the decisions live and how an agent checks a plan - never a decision's text (founder
+ *  2026-10-17: decisions embedded in a repository leak and go stale). */
+export declare function agentsMdSection(appUrl: string): string;
+/** PURE: AGENTS.md with our section added, or replaced where it already is (idempotent). Ours is recognised only whole - the start
+ *  marker straight followed by our heading, then the end marker after it - so a stray marker in a person's own text is never
+ *  read as ours and nothing of theirs is ever removed (invariant-guard 2026-10-17). */
+export declare function withAgentsMdSection(text: string, section: string): string;