@humbleaf/trigger-verify

Wrap any Trigger.dev v4 task with policy-gated settlement in one line.

The missing middleware for risky workflows. Before a task sends money, refunds a customer, or deploys to prod, AgentChain evaluates policy and returns a receipt that is safe to settle against.

Quick Start (5 minutes to first blocked action)

1. Install

pnpm add @humbleaf/trigger-verify @humbleaf/agentchain-sdk

2. Register middleware

// trigger/init.ts
import { tasks } from '@trigger.dev/sdk';
import { agentchainMiddleware } from '@humbleaf/trigger-verify';

tasks.middleware('agentchain', agentchainMiddleware({
  apiKey: process.env.AGENTCHAIN_API_KEY!,
  agentId: process.env.AGENTCHAIN_AGENT_ID!,
  approvalMode: 'soft-fail',
}));

3. Add invoiceSafe() to a task

import { task } from '@trigger.dev/sdk';
import { invoiceSafe, agentchain } from '@humbleaf/trigger-verify';

export const payInvoice = task({
  id: 'pay-invoice',

  ...invoiceSafe({
    vendor: (p) => p.vendorWallet,
    amount: (p) => p.amount,
    evidence: (p) => ({ invoiceHash: p.hash, vendorId: p.vendorId }),
  }),

  run: async (payload) => {
    const receipt = agentchain.getReceipt();
    if (receipt?.policyVerdict !== 'released') {
      return { paid: false, approvalUrl: receipt?.approvalUrl };
    }
    const tx = await transferUSDC(payload.vendorWallet, payload.amount);
    return { paid: true, tx, receiptId: receipt.receiptId };
  },
});

4. Happy path → Released ✓

Trigger run: pay-invoice
  Payload: { vendorWallet: "0xAcme", amount: 480, hash: "0xabc..." }
  AgentChain: ✓ Policy passed (5 checks)
  Result: { paid: true, tx: "0x...", receiptId: "rcpt_abc123" }

5. Blocked path → Denied ✗

Trigger run: pay-invoice
  Payload: { vendorWallet: "0xUnknown", amount: 480, hash: "0xdef..." }
  AgentChain: ✗ Denied — COUNTERPARTY_NOT_APPROVED
  Result: { paid: false, reason: "Vendor not on allowlist" }

6. Open dashboard → See receipts

Both results appear as receipts in your AgentChain dashboard with full policy evaluation details.

Presets

| Preset | Use Case | Policies Activated | |---|---|---| | invoiceSafe() | Pay invoices, rewards, refunds | Max value, counterparty allowlist, duplicate prevention, approval threshold | | deploySafe() | Deploy to production | Evidence required, time window, restricted action escalation |

deploySafe() example

import { deploySafe } from '@humbleaf/trigger-verify';

export const deployService = task({
  id: 'deploy-to-prod',
  ...deploySafe({
    service: 'payments-api',
    environment: 'production',
    evidence: (p) => ({
      gitSha: p.commitHash,
      testsPassed: p.ciGreen,
      rollbackArtifact: p.rollbackDigest,
    }),
  }),
  run: async (payload) => { /* ... */ },
});

Approval Mode

Controls what happens when policy returns pending_approval:

| Mode | Behavior | Best For | |---|---|---| | 'throw' | Task fails with AgentChainApprovalRequired | Simple workflows | | 'soft-fail' | Receipt stored, task continues | Queue handoff, Slack alerts | | 'wait' | Polls until approved or timeout | Human-in-the-loop |

agentchainMiddleware({
  apiKey: '...',
  agentId: '...',
  approvalMode: 'soft-fail',  // ← your choice
});

Approval Queue Handoff

When approvalMode: 'soft-fail', use the approval URL for dashboard handoff:

if (receipt?.policyVerdict === 'pending_approval') {
  await slack.send({
    text: `⏳ Invoice $${payload.amount} needs approval`,
    url: receipt.approvalUrl,
  });
}

License

MIT