@trigguard/execution-sdk

Node.js client for the execution gateway (POST /execute, GET /.well-known/trigguard/keys.json) with local Ed25519 receipt verification.

API

Authorize (decide) only:

import { authorize, verifyReceiptOffline, createExecutionClient } from "@trigguard/execution-sdk";

await authorize({
  gatewayUrl: process.env.TRIGGUARD_GATEWAY_URL!,
  surface: "deploy.release",
  actorId: "my-agent",
  getBearerToken: async () => process.env.TRIGGUARD_BEARER,
});

Gate a side effect — withExecute calls /execute and runs your function only on PERMIT:

import { withExecute } from "@trigguard/execution-sdk";

await withExecute(
  "deploy.release",
  async () => {
    await doDeploy();
  },
  {
    gatewayUrl: process.env.TRIGGUARD_GATEWAY_URL!,
    apiKey: process.env.TRIGGUARD_API_KEY, // optional tg_live_…
    actorId: "ci",
    context: { repository: "org/repo" },
  }
);

On DENY / SILENCE, it throws ExecutionNotPermittedError (see error.trigguardResult). Also re-exported from @trigguard/runtime.

Build & test

npm ci && npm run build
npm test

Relationship to other packages

• trigguard (sdk/trigguard-js) — hosted site verification API (/protocol/verify-receipt, etc.).
• @trigguard/execution-sdk — Cloud Run execution gateway (authorize → receipt).

Protocol semantics remain in trigguard-protocol; this package is a thin HTTP + crypto wrapper.