@tekcapitol/tc-protect-sdk

@tekcapitol/tc-protect-sdk

Lightweight adapter for customer orchestrators. Hard requirement on the mutate path: use guardedWrite. Raw SoR updates in agent code are not supported.

Status: 0.3.0 release package (npm publish when authenticated).
Version: 0.3.0
Canonical Check Write: https://api.tekcapitol.com/v1/check-write
Legacy apex (compatible): https://tekcapitol.com/api/v1/check-write
AgentOps (gate / Trace / appliance): https://tekcapitol.com/agentops-api.php
Docs: https://tekcapitol.com/docs/check-write/ · https://tekcapitol.com/docs/write-intent/

Developer quick start

One call before the action. Allow, Pause, or Block.

import { createTcProtect, WritePausedError, WriteBlockedError } from "@tekcapitol/tc-protect-sdk";

const protect = createTcProtect({
  apiKey: process.env.TEKCAPITOL_API_KEY || process.env.TC_PROTECT_API_KEY,
  // default: https://api.tekcapitol.com/v1/check-write
});

// Approval missing → PAUSE (write never runs)
try {
  await protect.guardedWrite({
    intent: {
      system: "CoreBanking",
      objectType: "PaymentBeneficiary",
      objectRef: "ben_123",
      field: "accountNumber",
      newValue: "****9999",
      requiredControls: ["identity", "authority", "approval"],
      controlEvidence: [
        { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
        { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
        // approval missing → PAUSE
      ],
    },
    write: async () => {
      throw new Error("should not run");
    },
  });
} catch (e) {
  if (e instanceof WritePausedError) {
    console.log("PAUSE", e.code || e.message);
  }
}

// All PASS → ALLOW → customer-owned write
await protect.guardedWrite({
  intent: {
    system: "CoreBanking",
    objectType: "PaymentBeneficiary",
    objectRef: "ben_123",
    field: "accountNumber",
    newValue: "****9999",
    requiredControls: ["identity", "authority", "approval"],
    controlEvidence: [
      { controlId: "identity", source: "okta", result: "PASS", checkedAt: new Date().toISOString() },
      { controlId: "authority", source: "iam", result: "PASS", checkedAt: new Date().toISOString() },
      { controlId: "approval", source: "grc", result: "PASS", checkedAt: new Date().toISOString() },
    ],
  },
  write: async () => {
    /* your Salesforce / ERP mutate */
    return { id: "tx_1" };
  },
});

Fail-closed (v1)

If Check Write cannot return a valid decision, the SDK throws WritePausedError with codes such as CHECK_WRITE_TIMEOUT, CHECK_WRITE_UNAVAILABLE, CHECK_WRITE_TLS_ERROR, CHECK_WRITE_INVALID_RESPONSE, CHECK_WRITE_SERVER_ERROR. The write callback is never invoked. See outputs/product/2026-08-21-fail-closed-check-write.md.

Phase 1 rule

guardedWrite({ intent, write })
  → POST Check Write™
  → allow  → await write() then reportExecution(SUCCEEDED)
  → block  → WriteBlockedError; never write()
  → pause  → WritePausedError; never write()
  → network/invalid → WritePausedError (fail-closed); never write()

Install

npm install @tekcapitol/tc-protect-sdk
# or offline / SOW drop-in:
npm install file:./vendor/tc-protect-sdk

Appliance (Production VPC)

createTcProtect({
  apiUrl: "https://protect.internal.example/agentops-api.php",
  apiKey: process.env.TC_PROTECT_API_KEY,
});

What it does not do

• MITM Salesforce / Jira / ERP
• Stop writes if the orchestrator skips guardedWrite
• Independently re-query evidence source systems (v1 is caller-asserted evidence)

Publish

cd sdk/tc-protect
npm test && npm pack
npm login   # must have access to @tekcapitol on npmjs
npm publish --access restricted

Scoped package uses publishConfig.access: restricted (npm org). For a public scoped package instead, use npm publish --access public.