The four things
you came here to do.

import {
  VeridProcurementClient,
  VeridGrantVerifier,
  executeWithAuthorization
} from "@verid/agent-sdk";

const client = new VeridProcurementClient({
  baseUrl, tenantId, accessToken
});

const proposal = {
  intentId: signedIntentId,
  agentId,
  tool: "datadog-billing",
  action: "renew",
  amount: "13800.00",
  currency: "USD",
  counterparty: "datadog"
};

const envelope = client.envelopeFor(proposal);
const decision = await client.evaluate(proposal);
if (decision.decision !== "ALLOW") {
  throw new Error(`Refused: ${decision.decision}`);
}

const grant = await client.authorizationById(decision.authorizationId);
const verifier = new VeridGrantVerifier({baseUrl});

const result = await executeWithAuthorization({
  client, verifier, grant, envelope, agentId,
  execute: () => renewSubscription(proposal),
  externalReference: "invoice-2026-0031"
});

const decision = await client.evaluate({
  ...proposal,
  amount: "7500.00"   // above the 5,000 approval threshold
});

if (decision.decision === "REQUIRE_APPROVAL") {
  // Polls /v1/runtime/approvals/{id} until a named human decides,
  // or the timeout elapses. A timeout throws - it never approves.
  const approval = await client.waitForApproval(decision.approvalId, {
    timeoutMs: 300000,
    intervalMs: 1000
  });

  if (approval.status !== "Approved") {
    throw new Error(`Not approved: ${approval.status}`);
  }

  // The approval is an evidence artifact, not a flag. It records who
  // decided, what exact envelope they decided on, when, and under which
  // decision - and it joins the same audit chain as the receipt.
  console.log({
    approvedBy: approval.decidedBy,      // the named human
    evaluationId: approval.evaluationId, // the decision it answers
    actionHash: approval.actionHash,     // exactly what was approved
    decidedAt: approval.updatedAt,
    expiresAt: approval.expiresAt
  });
}

// The approval is bound to this exact action. Re-evaluate or fetch the
// grant it unlocked; a different amount would need its own decision.
const grant = await client.authorizationById(decision.authorizationId);

// Automatic: executeWithAuthorization submits the receipt for you,
// with status recorded on success and on failure.

// Manual, when your execution happens elsewhere:
await client.submitReceipt({
  authorizationId: grant.id,
  status: "Succeeded",
  externalReference: "invoice-2026-0031",
  evidence: {
    invoiceTotal: "13800.00",
    confirmedBy: "billing-api"
  },
  executed: {
    tool: "datadog-billing",
    action: "renew",
    amount: "13800.00",
    currency: "USD"
  }
});

import {VeridGrantVerifier} from "@verid/agent-sdk";

// Inside the deploy service - the protected resource.
const verifier = new VeridGrantVerifier({baseUrl});

export async function deploy({grant, envelope, agentId, release}) {
  // 1. Independent verification: ES256 signature against the
  //    published keys, and the exact envelope this grant covers.
  await verifier.verify(grant, {tenantId, agentId, envelope});

  // 2. Single-use redemption, here, immediately before acting.
  //    A replayed or already-consumed grant fails this call.
  await client.consume({
    authorizationId: grant.id,
    agentId,
    envelope
  });

  // 3. Only now does the consequential action run.
  const outcome = await rollOut(release);

  await client.submitReceipt({
    authorizationId: grant.id,
    status: "Succeeded",
    externalReference: release.id,
    executed: {tool: "deploy", action: "release", environment: "production"}
  });
  return outcome;
}