Install & connect

Your account provides the package for your contract at /account/install. Install it and keep it in your own dependency tree — it is ordinary application code you control.

npm install ./vendor/gripen-guard
# or, if you vendored the folder directly:
# packages/gripen-guard/

The core keeps its own state (decisions, counters, incidents) in your database, not ours. Run the bundled SQL migrations against your PostgreSQL instance once, in order.

psql "$DATABASE_URL" -f sql/001_schema.sql
psql "$DATABASE_URL" -f sql/002_policies.sql
psql "$DATABASE_URL" -f sql/003_indexes.sql
psql "$DATABASE_URL" -f sql/004_retention.sql

Nothing in these migrations touches your existing tables. Everything is created in the core's own schema.

Create the installation once at application start and reuse it. The composition root wires the ports — storage, notification, clock — to your environment.

import { createInstallation } from "gripen-guard";

export const guard = createInstallation({
  productId: process.env.GUARD_PRODUCT_ID!,
  ingestKeyId: process.env.GUARD_INGEST_KEY_ID!,
  ingestSecret: process.env.GUARD_INGEST_SECRET!,
  databaseUrl: process.env.DATABASE_URL!,
});

Keep the ingest secret server-side. It is never needed in a browser. Rotate it from your account panel if it is ever exposed; the old key stops being accepted immediately.

Send some traffic through your application, then open /account/security. Your system should appear with a signal count for the last 24 hours. The onboarding checklist on your account overview ticks off "system connected", "core installed" and "first signals" as they happen.

No signals after a few minutes? The usual causes are outbound HTTPS being blocked, a wrong ingest key id, or an install still holding an expired release. See Updates & releases.

Nothing in this setup makes us a dependency of your uptime. When the core cannot reach us it keeps enforcing the last policy it holds, keeps deciding locally, and queues its reports. When we come back, the queue drains. You do not need to do anything.