@decidio/sdk 0.7.0 → 0.8.1

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export type { PendingAction, PendingStore, ResumeController, ResumeOutcome, Appr
 export { guard, Guard } from "./guard.js";
 export type { GuardFacadeConfig, ProtectOptions } from "./guard.js";
 export { DecidioHttpError, decisionIdProblem } from "./errors.js";
-export { generateKeypair, didFromPrivateKey, signBoundProof, signConfirm, signExecutionReport, verifyExecutionReport, resultDigest, assertSafeTransport, carriesCredential, bindingMaterial, requestCommitment, idempotencyKey, committedRequestJson } from "./signing.js";
+export { generateKeypair, didFromPrivateKey, signBoundProof, signConfirm, signExecutionReport, verifyExecutionReport, resultDigest, assertSafeTransport, carriesCredential, bindingMaterial, boundScope, requestCommitment, idempotencyKey, committedRequestJson } from "./signing.js";
 export type { BindingMaterial, CommittedRequest } from "./signing.js";
 export { canonicalize, canonicalizeArgs, canonicalJson, DecidioUnsafeArgumentsError } from "./canonical.js";
 export type { JsonValue, JsonPrimitive } from "./canonical.js";

package/dist/index.js

@@ -6,7 +6,7 @@ export { DecidioSuspendedError, DecidioDeniedError, DecidioRecoveryUnavailableEr
 export { guard, Guard } from "./guard.js";
 export { DecidioHttpError, decisionIdProblem } from "./errors.js";
 import { DecidioHttpError, decisionIdProblem } from "./errors.js";
-export { generateKeypair, didFromPrivateKey, signBoundProof, signConfirm, signExecutionReport, verifyExecutionReport, resultDigest, assertSafeTransport, carriesCredential, bindingMaterial, requestCommitment, idempotencyKey, committedRequestJson } from "./signing.js";
+export { generateKeypair, didFromPrivateKey, signBoundProof, signConfirm, signExecutionReport, verifyExecutionReport, resultDigest, assertSafeTransport, carriesCredential, bindingMaterial, boundScope, requestCommitment, idempotencyKey, committedRequestJson } from "./signing.js";
 export { canonicalize, canonicalizeArgs, canonicalJson, DecidioUnsafeArgumentsError } from "./canonical.js";
 export { readConfirmResponse, buildConfirmBody, describeTierGap, EVIDENCE_TIERS } from "./evidence.js";
 export class DecidioBlockedError extends Error {
@@ -55,6 +55,8 @@ export function approvalRefusal(check) {
         case "commitment_missing": return new DecidioApprovalUnverifiedError(id, "commitment_missing", check.reason ?? "Decidio answered without the request commitment this SDK sent");
         case "unverifiable": return new DecidioApprovalUnverifiedError(id, "unverifiable", check.reason ?? "the approval could not be tied to this request");
         case "pending": return new DecidioBlockedError(`not approved - ${check.reason ?? `Decidio records ${id} as pending`}`, id);
+        case "spent": return new DecidioBlockedError(`not executed - ${check.reason ?? `the approval for ${id} is already spent`}`, id);
+        case "expired": return new DecidioBlockedError(`not executed - ${check.reason ?? `the approval for ${id} has expired`}`, id);
         default: return new DecidioBlockedError(check.reason ?? `not approved (Decidio answered ${JSON.stringify(check.state)})`, id);
     }
 }

package/dist/resume.d.ts

@@ -701,11 +701,18 @@ export declare function verifyResumeSignature(secret: string, body: string, head
  *  called it: the claim was what kept anyone from noticing the disagreement. */
 export declare function assertConfirmRecorded(body: any, decisionId: string, signed: boolean): string;
 /** What GET /agent/status answers. `requestCommitment` (0.7.0) is the commitment the decision was
- *  authorized with, or null for a decision whose request was never bound. */
+ *  authorized with, or null for a decision whose request was never bound. `spent` and `grantExpiresAt` (0.8.0,
+ *  mini-approvals): the grant is ONE-TIME - `spent` once an execution was recorded on it, `grantExpiresAt` when
+ *  it lapses (the seal's time plus the gate's TTL) for a granted decision, null otherwise. A gate that predates
+ *  them answers neither. */
 export interface DecisionStatus {
     state: string;
+    decisionId?: string;
+    receiptId?: string | null;
     reason?: string | null;
     requestCommitment?: string | null;
+    spent?: boolean;
+    grantExpiresAt?: string | null;
 }
 type StatusConfig = {
     apiUrl: string;
@@ -717,11 +724,14 @@ type StatusConfig = {
 /** Why an approval check did not pass.
  *  pending / unrecognized_state — Decidio records no approval (yet): nothing may run.
  *  rejected / blocked           — Decidio's final answer is no.
+ *  spent                        — the approval was already used: an execution is recorded on it (one approval
+ *                                 covers one action, once) - ask again.
+ *  expired                      — the approval lapsed (its grant's time passed) before anything ran - ask again.
  *  request_changed              — the approval is for a DIFFERENT request than the one about to run.
  *  commitment_missing           — this SDK bound the request, the gate answered without a commitment.
  *  unverifiable                 — Decidio holds a commitment this process cannot recompute (no or
  *                                 unreadable key material), or answered a malformed one. */
-export type ApprovalCheckCode = "pending" | "unrecognized_state" | "rejected" | "blocked" | "request_changed" | "commitment_missing" | "unverifiable";
+export type ApprovalCheckCode = "pending" | "unrecognized_state" | "rejected" | "blocked" | "spent" | "expired" | "request_changed" | "commitment_missing" | "unverifiable";
 /** The outcome of the one check. Plain JSON on purpose: an engine that runs it as an activity or a
  *  step (Temporal, Inngest) memoizes it across its serialization boundary. */
 export interface ApprovalCheck {

package/dist/resume.js

@@ -839,6 +839,18 @@ export async function checkApproval(cfg, decisionId, request, opts = {}) {
         return no("pending", `Decidio records decision ${decisionId} as pending - no human has approved it`);
     if (state !== "approved" && state !== "auto_approved")
         return no("unrecognized_state", `Decidio answered state ${JSON.stringify(st?.state ?? null)} for decision ${decisionId}, which is not an approval this SDK recognises (an answer it does not understand is never permission)`);
+    if (st?.spent === true)
+        return no("spent", `decision ${decisionId} was approved once and that approval is already spent (an execution is recorded on it) - ask again for a fresh approval; nothing was executed`);
+    if (typeof st?.grantExpiresAt === "string") {
+        const until = Date.parse(st.grantExpiresAt);
+        if (!Number.isFinite(until))
+            return no("unverifiable", `Decidio answered a malformed grant expiry for decision ${decisionId} (${JSON.stringify(st.grantExpiresAt)}), so the approval cannot be known to be in force`);
+        if (until <= Date.now())
+            return no("expired", `decision ${decisionId}'s approval expired at ${st.grantExpiresAt} before anything ran - ask again for a fresh approval; nothing was executed`);
+    }
+    else if (typeof st?.spent === "boolean" && st?.grantExpiresAt === null) {
+        return no("expired", `decision ${decisionId} is approved but Decidio names no expiry for its grant (its age is unknown) - ask again for a fresh approval; nothing was executed`);
+    }
     const server = st?.requestCommitment;
     if (server !== undefined && server !== null) {
         if (typeof server !== "string" || !/^[0-9a-f]{64}$/.test(server))

package/dist/signing.d.ts

@@ -126,6 +126,11 @@ export declare function requestCommitment(material: BindingMaterial, request: Co
 /** lowercase-hex idempotency key over an execution identity (e.g. LangGraph's thread + task +
  *  commitment), keyed so the host's thread ids never reach Decidio in the clear. */
 export declare function idempotencyKey(material: BindingMaterial, identity: Record<string, JsonValue>): string;
+/** The Claude Code hook's request scope: `cmd-` + 16 hex of a KEYED digest over the command text and its subject
+ *  (chat approvals follow-up, invariant-guard 2026-10-15). The text may carry a credential the display redacts; an
+ *  unkeyed digest sealed beside the redacted text would be an offline oracle for a weak password. Keyed under its own
+ *  domain, so it is deterministic for this agent and nothing to anyone without the key material. */
+export declare function boundScope(material: BindingMaterial, text: string): string;
 /** A signed, DOMAIN-SEPARATED, versioned attestation that THIS agent reported THIS captured
  *  response for THIS decision. Distinct from the identity proof (`signConfirm`) in every field
  *  that matters, so a report can never be lifted from one decision onto another: the decision id,

package/dist/signing.js

@@ -198,6 +198,9 @@ export function requestCommitment(material, request) {
 export function idempotencyKey(material, identity) {
     return createHmac("sha256", bindingSubkey(material, "decidio.idempotency-key.v1")).update(canonicalJson(identity, "idempotency identity"), "utf8").digest("hex");
 }
+export function boundScope(material, text) {
+    return "cmd-" + createHmac("sha256", bindingSubkey(material, "decidio.hook-scope.v1")).update(text, "utf8").digest("hex").slice(0, 16);
+}
 export function signExecutionReport(privateKeyBase64, fields) {
     const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
     const nonce = fields.nonce ?? randomUUID();

package/openapi.yaml

@@ -5,7 +5,7 @@
 openapi: 3.1.0
 info:
   title: Decidio Agent Gate
-  version: 0.7.0   # tracks the SDK release - checked by packages/conformance/manifests.mjs
+  version: 0.8.1   # tracks the SDK release - checked by packages/conformance/manifests.mjs
   description: >
     Authorize an AI-agent action (proceed | route | block), confirm the captured outcome, and
     receive the signed resume webhook when a routed action is decided. Every outcome seals a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decidio/sdk",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "One-line approval gate for AI-agent actions. Wrap a risky tool call with guard.protect(); Decidio's policy engine decides proceed | route | block, a human approves routed actions, and every outcome is sealed as a verifiable Authority Receipt.",
   "license": "Apache-2.0",
   "type": "module",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run typecheck && npm run build && node ../publish-boundary/check.mjs --only @decidio/sdk"
   },
   "dependencies": {
-    "@decidio/verify": "0.7.0"
+    "@decidio/verify": "0.8.1"
   },
   "author": "OmniTwin Technologies Inc.",
   "bugs": {