@trustpipelines/js

The Trust Pipelines browser SDK — programmatic verification for signup, account creation, vote, review, transaction, and other on-entry touchpoints.

This is the typed, npm-installable wrapper around the same engine that powers the CDN snippet (cdn.trustpipelines.com/v1/snippet.js). The snippet auto-detects forms with a single <script> tag; the SDK gives you programmatic control over where and how verification fires. Pick whichever fits your integration — they share an engine, so behavior is identical.

Install

npm install @trustpipelines/js

Also works with pnpm add, yarn add, and bun add.

Quickstart

import { createTrustPipelines } from '@trustpipelines/js';

const tp = createTrustPipelines({
  checkpointKey: 'cp_live_...', // your Checkpoint's publishable key
});

// Intercept a form on submit.
tp.protect(document.querySelector('form#signup')!);

// Or fire a programmatic check at any moment.
const result = await tp.check();
if (result.outcome === 'high_risk') {
  // your call.
}

The Checkpoint's publishable key (cp_live_*) is safe to ship in client code — the Edge Worker treats cp_* keys as browser-mode credentials. The secret tp_* keys never go near this SDK.

Configuration

createTrustPipelines({
  checkpointKey: string;   // required — your Checkpoint's cp_live_* key
  endpoint?: string;       // override the Edge base URL (defaults to production)
  debug?: boolean;         // attach per-Layer phase timings to results
});

endpoint is for staging or local dev — leave unset to hit the production Edge Worker at https://edge.trustpipelines.com.

API

| Method | What it does | |---|---| | protect(form) | Intercept submits on a <form>. On low_risk, the form re-dispatches; on medium_risk / high_risk, the registered handler decides. | | check(options?) | Fire a programmatic check. Returns the full ExecutionResult — outcome, per-Layer breakdown, requestId. | | onResult(fn) | Fires on every check — Glass-Box. Receives the full result. | | onHighRisk(fn) | Fires only on high_risk outcomes. Receives { form } if the check was triggered by a protected form. | | onMediumRisk(fn) | Fires only on medium_risk outcomes. Same shape as onHighRisk. | | version | The npm package version of @trustpipelines/js — the number you installed. |

Types TrustPipelinesAPI, ExecutionResult, LayerResult, Outcome, and PhaseTiming are re-exported for TypeScript users.

Versioning

The version export (and tp.version on a constructed instance) is auto-generated from package.json at build time — to bump it, edit package.json only and the runtime constant follows. It can never drift from the release you installed. The engine wire-contract version (bumped only when the SDK ↔ Edge Worker protocol changes) is available separately as the engineVersion export. VERSION is a deprecated alias of version, kept for one release cycle.

Full example

import { createTrustPipelines } from '@trustpipelines/js';

const tp = createTrustPipelines({
  checkpointKey: 'cp_live_AbCdEf1234567890',
});

tp.protect(document.querySelector<HTMLFormElement>('#signup')!);

tp.onHighRisk(({ form }) => {
  // Show a friendly blocked-state in your UI — the form did not submit.
  showInlineError(form, 'We couldn’t verify this submission.');
});

tp.onResult(({ result }) => {
  // Glass-Box: log to your own analytics if you want.
  analytics.track('trust_check', {
    outcome: result.outcome,
    requestId: result.requestId,
    layers: result.layers.map((l) => ({ key: l.key, outcome: l.outcome })),
  });
});

Docs

Full integration guide: https://trustpipelines.com/docs/sdk

Quickstart, API reference, ExecutionResult shape, framework recipes (Next.js, React, Svelte, vanilla ESM/CJS), error model, and a snippet→SDK migration guide all live there.

License

Released under the MIT License — see LICENSE.