Build trust applications on the P2P Trust Stack. v0.1.0 is released and open source:
the stack is published to npm as @p2p-trust-stack/core and
@p2p-trust-stack/app-api, and the API Reference
documents every method, grouped by the four Trust over IP layers.
The trust stack is published to npm as two packages: @p2p-trust-stack/core — the
protocol engine (cryptographic primitives, DID infrastructure, the Trust Spanning Protocol,
relationships, the encrypted keystore, and the VTC/VRC governance framework) — and
@p2p-trust-stack/app-api — the application-facing agent API, which depends on
core.
Both are dual-licensed: GPL-3.0 for open use, or a commercial license where GPL-3.0 obligations are not acceptable. Requires Node.js ≥ 22.5, and is Node-only (no browser build).
# application developers — core comes with it
npm install @p2p-trust-stack/app-api
# protocol-only embedders
npm install @p2p-trust-stack/corecore on npm ↗ · app-api on npm ↗ · GitHub repository ↗ · CHANGELOG ↗ · Commercial license ↗
The API Reference documents every method — grouped by the four Trust over IP layers, with a module-by-module reference for the core protocol layer.
The following flows are operational in the P2P Trust Stack testbed. Each is built on open W3C and IETF standards (DIDs, Verifiable Credentials, HPKE) and was demonstrated at the August 2026 trust stack demo.
Create a self-certifying did:scid:vh identity with Ed25519/X25519 key pairs and hash-chained verifiable history. No ledger dependency.
Register a human-readable name cryptographically bound to a did:scid:vh identity via two-phase commit over the Trust Spanning Protocol.
Authenticate as a VTA using Ed25519-signed challenge-response with single-use nonces and SHA-256 expiry verification.
Look up an agent name to retrieve the associated DID Document with service endpoints for messaging and discovery.
Fetch a VTA's public profile card as a W3C Verifiable Credential with per-claim disclosure control (always, discretionary, never, or zkp-only).
End-to-end encrypted messaging between VTAs using HPKE-Auth (RFC 9180) with DHKEM(X25519) + HKDF-SHA256 + ChaCha20/Poly1305.
Two-way mutual acknowledgment ceremony producing a bilaterally-signed Verified Relationship Credential (VRC). A VRC is only issued after both parties confirm.
The Layer 2 Trust Spanning Protocol implementation is functionally complete, with a full two-node direct-mode demo and comprehensive test coverage across all subsystems. As of v0.1.0 the implemented surface spans all four layers: DID infrastructure and rotation (Layer 1), TSP, relationships, and confidential messaging (Layer 2), the Credential Factory, Governance Guard, Policy Engine, and trust-task ceremonies (Layer 3), plus the reference applications (Layer 4).
did:scid:vh and did:peer:4 VID creation, resolution, and cryptographic verification. Self-certifying identifiers with hash-chained verifiable history and no registry dependency.
Trust Spanning Protocol message sealing and opening. Supports plain (TSP_GEN) and confidential (TSP_GEN_CONFIDENTIAL via HPKE-Auth) message types.
Full RFI/RFA handshake for peer-to-peer relationship establishment. OOBI-based out-of-band introduction. Persistent relationship store.
libp2p-based transport layer with noise protocol encryption, yamux multiplexing, and the /tsp/1.0.0 protocol handler.
SQLite-backed keystore with AES-256-GCM encryption and Argon2id key derivation. Secure local storage for VID key pairs.
Ed25519 signing, X25519 key agreement, HPKE-Auth (RFC 9180), and CESR encoding — all implemented to open standards.
New to the trust stack? The glossary defines all key terms: VTA, VTC, VRC, VID, DID, TSP, OOBI, HPKE-Auth, RFI/RFA, CESR, did:scid:vh, did:peer:4, did:scid:vh, did:peer:4, R-Card, VidMethod, Witness VTC, and more.
View Glossary →