DEVELOPER GUIDE
TypeScript SDK
The existing thin client shares the REST wire contract and typed errors. Source availability and registry publication are separate states.
Integration steps
- The source client is src/sdk/index.ts in the public repository. The deterministic offline sandbox is explicitly synthetic and makes no Qloo call.
- Construct TastePolicyClient with an explicit HTTPS origin and server-only developer credential. Never import that credential into client-side React.
- Use passport(), evaluate(), receipt(), lease() and the related lifecycle methods. Inspect TastePolicyError.code, status and retryable rather than parsing a human message.
- The separate attestation kit verifies proofs without a TastePolicy account credential; configure trusted issuers explicitly. Automatic issuer discovery does not grant trust.
- Build the package with npm run sdk:build, pack packages/sdk, and install the resulting tarball. The proposed npm package is not published yet; do not install an unrelated package.
import { TastePolicyClient } from '@victorcyberdev/tastepolicy-sdk';
const client = new TastePolicyClient(
'https://tastepolicy.vercel.app',
process.env.TASTEPOLICY_API_KEY!
);
const passport = await client.passport({ passportRef });
const decision = await client.evaluate({
passportRef, idempotencyKey: crypto.randomUUID(),
requestedAction: 'SHORTLIST', proposal
});
// Switch on all four decisions. Never infer execution permission.