# Build with AI

Give your coding assistant the current protocol, exact question, and integration boundaries.


Use the Markdown version of any page as context for a coding assistant. Start with [/llms.txt](/llms.txt) for the documentation index or [/llms-full.txt](/llms-full.txt) for the complete text.

SDK access remains private early access. Public package availability is coming soon. Arrange [package access and your app origin](/early-access) before asking an assistant to run an integration.

## Copy this integration brief

```text
Build a browser integration with TrustGraph using the current TypeScript SDK.
Read /quickstart.md, /api/attestations.md, /concepts/identity.md,
/concepts/what-a-proof-tells-you.md, and /security.md first.

Use https://trust-staging.rebellion.systems for development.
Obtain SDK access and exact app-origin allowlisting through early access.
Use the private package installation instructions supplied for this project.

Keep graphNodeId (persona) separate from graphKeyId (signing device).
Persist the non-extractable browser key and pending bind before navigating.
Use the SDK's durable beginBind/parseBindCallback/finalizeBind APIs.
Implement the application's storage and verified-device-state adapters.
Do not infer device approval from a completed bind.

Sign the exact query with a fresh nonce; query only from the user's own node.
Use scope: 'identity', minTrust: 0..100 and maxHops: 1..3.
Verify the returned attestation locally with the SDK /zk entry and bundled VK.
Supply attestation JWKS from independently trusted application configuration.
Use only the verified verdict; distinguish a positive path proof from a
negative signed report. Destroy the verifier when finished.

Do not invent SDK methods, public email/phone lookup, public package access,
a live-call identity guarantee, or an in-browser verifier hosted by these docs.
Typecheck each sample against the SDK version supplied to this project.
```

## Keep the application boundary explicit

Ask the assistant to declare your storage, navigation, and cryptography adapters by type. A function named `savePendingBind` is application code, not a hidden SDK API. Browser keys require structured-clone storage such as IndexedDB; JSON serialization cannot preserve a `CryptoKey`.

For native integration, use an injected signer and the platform key store. Keep the exact canonical payload and signature format consistent with the [API signing rules](/api). Browser-specific helpers are not native key-store adapters.

## Review the generated result

Check the source node in every query, the local source of all verification pins, and the handling of recovery and quarantine. Follow a bind through a real callback and reload. Exercise a reachable answer, a negative answer, and a verification failure before presenting a connected badge.


**Never**
Never give an assistant real private keys, live bind proofs, provider credentials, or account recovery material as example data. Use test accounts and synthetic values for prompts and fixtures.


**Does not establish**
Generated code and a successful typecheck do not demonstrate a completed AuthenSee ceremony or a valid proof. Verify the complete flow in your configured staging application.