Getting Started

Install

pnpm config set @rebellion-systems:registry https://npm.pkg.github.com
pnpm add @rebellion-systems/trust-graph-sdk

Create a client

import { createTrustGraphSdk } from "@rebellion-systems/trust-graph-sdk";
 
const trustGraph = createTrustGraphSdk({
  serverUrl: "https://trust.rebellion.systems",
  authToken: async () => getAuthenSeeJwtForCurrentUser(),
});

Use staging while integrating:

const stagingTrustGraph = createTrustGraphSdk({
  serverUrl: "https://trust-staging.rebellion.systems",
  authToken: stagingJwt,
});

Register a graph key

const graphKey = await trustGraph.registerGraphKey({
  publicKeyJwk,
  label: "primary device",
  nodeKind: "human",
  authenseePersonaId: "per_123",
  providerPersonaIdDerivative: "ppid_derivative_123",
});

The trust graph service binds the public graph key to the AuthenSee subject from the bearer token. Re-registering the same public key for the same subject is idempotent. Registering the same public key for a different subject is rejected.

For agent nodes, register the key with nodeKind: "agent":

await trustGraph.registerGraphKey({
  publicKeyJwk: agentPublicKeyJwk,
  label: "Release bot",
  nodeKind: "agent",
  authenseePersonaId: "per_agent_123",
  metadata: {
    displayName: "Release Bot",
    capabilities: ["repo-maintenance", "deploy"],
  },
});

Request an edge

import {
  signEdgeCertificatePayload,
  type EdgeCertificatePayload,
} from "@rebellion-systems/trust-graph-sdk";
 
const payload: EdgeCertificatePayload = {
  signerGraphKeyId: aliceKey.graphKeyId,
  subjectGraphKeyId: bobKey.graphKeyId,
  trust: 75,
  scope: "identity",
  createdAt: new Date().toISOString(),
  nonce: crypto.randomUUID(),
};
 
const requested = await trustGraph.requestEdge({
  ...payload,
  signature: signEdgeCertificatePayload(alicePrivateKey, payload),
});

Confirm an edge

The subject persona confirms pending edges:

await trustGraph
  .withAuthToken(bobAuthenSeeJwt)
  .confirmEdge(requested.edge.edgeId);

Query reachability

const result = await trustGraph.queryReachability({
  sourceGraphKeyId: aliceKey.graphKeyId,
  targetGraphKeyId: carolKey.graphKeyId,
  policy: {
    scope: "identity",
    minTrust: 50,
    maxHops: 3,
  },
});

If result.reachable is true, result.proof contains the current development proof envelope.

Getting Started

Getting Started

Install

Create a client

Register a graph key

Request an edge

Confirm an edge

Query reachability

On this page