Use the Markdown version of any page as context for a coding assistant. Start with /llms.txt for the documentation index or /llms-full.txt for the complete text.
SDK access remains private early access. Public package availability is coming soon. Arrange package access and your app origin before asking an assistant to run an integration.
Copy this integration brief
Build a browser integration with TrustGraph using the current TypeScript SDK.
Read /quickstart.md, /api/attestations.md, /concepts/identity.md,
/concepts/what-a-proof-tells-you.md, and /security.md first.
Use https://trust-staging.rebellion.systems for development.
Obtain SDK access and exact app-origin allowlisting through early access.
Use the private package installation instructions supplied for this project.
Keep graphNodeId (persona) separate from graphKeyId (signing device).
Persist the non-extractable browser key and pending bind before navigating.
Use the SDK's durable beginBind/parseBindCallback/finalizeBind APIs.
Implement the application's storage and verified-device-state adapters.
Do not infer device approval from a completed bind.
Sign the exact query with a fresh nonce; query only from the user's own node.
Use scope: 'identity', minTrust: 0..100 and maxHops: 1..3.
Verify the returned attestation locally with the SDK /zk entry and bundled VK.
Supply attestation JWKS from independently trusted application configuration.
Use only the verified verdict; distinguish a positive path proof from a
negative signed report. Destroy the verifier when finished.
Do not invent SDK methods, public email/phone lookup, public package access,
a live-call identity guarantee, or an in-browser verifier hosted by these docs.
Typecheck each sample against the SDK version supplied to this project.Keep the application boundary explicit
Ask the assistant to declare your storage, navigation, and cryptography adapters by type. A function named savePendingBind is application code, not a hidden SDK API. Browser keys require structured-clone storage such as IndexedDB; JSON serialization cannot preserve a CryptoKey.
For native integration, use an injected signer and the platform key store. Keep the exact canonical payload and signature format consistent with the API signing rules. Browser-specific helpers are not native key-store adapters.
Review the generated result
Check the source node in every query, the local source of all verification pins, and the handling of recovery and quarantine. Follow a bind through a real callback and reload. Exercise a reachable answer, a negative answer, and a verification failure before presenting a connected badge.