Install the TypeScript SDKs
The TridentGold TypeScript SDK is a bundle of six packages at version
0.1.0-mvp.5, signed and published as a private GitHub prerelease.
There is no public npm package and no public GitHub release. Ask the
TridentGold team for access before you start.
0.1.0-mvp.5 is the first version with the issuer SDK. Its verifier SDK also
adds request(), which asks for a credential other than the police
certificate, and reads the verifier's per-schema policy. If you installed
0.1.0-mvp.4, repeat the steps below with the new version; nothing was
removed.
| Package | Purpose |
|---|---|
@human.tech/tridentgold-zknc-mvp-verifier | Verifier SDK: request a zero-knowledge proof with DCQL and read the result. Needs no other package from the bundle. |
@human.tech/tridentgold-zknc-mvp-issuer | Issuer SDK: submit a synthetic schema to the Tenant Gateway and create invitations. Needs the client package below. |
@human.tech/tridentgold-zknc-mvp-client | Low-level issuance and status clients, and the schema rules the issuer SDK checks drafts with. Its verifier export, ./verifier-server, is deprecated. |
@human.tech/tridentgold-siop-rp | Server-side Sign in with TridentGold request and callback handling. |
@human.tech/tridentgold-siop | Shared sign-in contracts, used by the RP package. |
@human.tech/tridentgold-account-crypto | Shared cryptographic functions, required transitively by the sign-in packages. |
Install only the packages your integration uses. These are provisional
sandbox interfaces: the version 0.1.0-mvp.5 does not mean an API contract is
stable.
You need Node.js 22 and npm. A GitHub release contains downloadable package
files; it is not an npm registry. So the procedure is: download the .tgz
files into your project, verify them, commit them, and install from those
files.
1. Get access and download
Accept the repository invitation from the TridentGold team and sign in to GitHub. The team also supplies the release tag, the approved usage terms and the signing identity.
Download the package assets you need, SDK-MANIFEST.json, and SHA256SUMS
from the Releases page of the private repository you were invited to, into
vendor/tridentgold/ in your project. Use the .tgz assets rather than
GitHub's automatically generated "Source code" archives.
Or run this from your project root with the
GitHub CLI. Replace
<repository-you-were-invited-to> with the repository the team named.
gh auth login
gh release download tridentgold-mvp-sdk-v0.1.0-mvp.5 \
--repo <repository-you-were-invited-to> \
--pattern '*.tgz' \
--pattern SDK-MANIFEST.json \
--pattern SHA256SUMS \
--dir vendor/tridentgold
2. Verify what you downloaded
Follow the release's signature-verification instructions before installation.
Verify the signed tag against the approved signing identity and the manifest's
commit and digest, then check each tarball against the authenticated manifest.
SHA256SUMS alone does not establish who published the files.
3. Install the packages
From the same project root, install the archives you need.
A verifier needs only the verifier SDK:
npm install --ignore-scripts \
./vendor/tridentgold/human.tech-tridentgold-zknc-mvp-verifier-0.1.0-mvp.5.tgz
An issuer needs the issuer SDK and the client package:
npm install --ignore-scripts \
./vendor/tridentgold/human.tech-tridentgold-zknc-mvp-client-0.1.0-mvp.5.tgz \
./vendor/tridentgold/human.tech-tridentgold-zknc-mvp-issuer-0.1.0-mvp.5.tgz
For sign-in and status, install these four together, so npm resolves their dependencies on each other from the local files:
npm install --ignore-scripts \
./vendor/tridentgold/human.tech-tridentgold-account-crypto-0.1.0-mvp.5.tgz \
./vendor/tridentgold/human.tech-tridentgold-siop-0.1.0-mvp.5.tgz \
./vendor/tridentgold/human.tech-tridentgold-siop-rp-0.1.0-mvp.5.tgz \
./vendor/tridentgold/human.tech-tridentgold-zknc-mvp-client-0.1.0-mvp.5.tgz
Public dependencies are still downloaded from npm. The command adds
file:vendor/tridentgold/... dependencies to package.json and records them
in package-lock.json.
npm supports installing local package tarballs.
4. Commit the tarballs
Commit the tarballs you installed, at those paths, together with
package.json and package-lock.json. Every later install, including a
deploy on Vercel or another host, then installs the SDK from your repository,
with no GitHub token or private registry. Keep the repository private: the
tarballs are private release assets.
5. Import the SDK
Use normal package imports in TypeScript or an ESM Node project:
import { createZkncMvpVerifier } from "@human.tech/tridentgold-zknc-mvp-verifier";
import { createTridentGoldSiopRpClient } from "@human.tech/tridentgold-siop-rp";
import { createZkncTenantIssuer } from "@human.tech/tridentgold-zknc-mvp-issuer";
Call the verifier and issuer SDKs from server code only; do not bundle them into your frontend. You do not need to build TridentGold from source.
The sandbox verifier needs no key. The issuer SDK needs a tenant API key, which the TridentGold team gives you separately from package access; see Get an API key. Installing the packages does not install the native proof runtime or an independently operating issuer or verifier service.
Start from the packaged examples
The installed packages include TypeScript examples, which you can copy into your backend and adapt to your session store:
| Installed file | What the example gives you |
|---|---|
node_modules/@human.tech/tridentgold-zknc-mvp-verifier/examples/proof-request.ts | startScreening(), checkScreening() and describeResult() request a proof, keep the result token server-side, poll, and describe the result. |
node_modules/@human.tech/tridentgold-siop-rp/examples/sign-in.ts | signInHandlers() wraps initiation, callback processing and terminal-result lookup. |
node_modules/@human.tech/tridentgold-zknc-mvp-issuer/examples/tenant-issuance.ts | registerTrainingRecord() submits a synthetic schema once, and invitationRoute() returns a route handler that creates an invitation and returns the code, QR code and expiry. Creating invitations builds on it. |
Those helper names belong to the example files; they are not additional SDK exports. The examples are compiled and executed from the installed tarballs during the release check, against local test services. That check does not establish a live-service or real-proof acceptance result.