@did-btcr2/method 0.33.0 → 0.35.0

package/src/core/aggregation/cohort.ts

@@ -1,3 +1,4 @@
+import { getNetwork } from '@did-btcr2/bitcoin';
 import { canonicalHash, canonicalize, hash } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
 import type { SerializedSMTProof, TreeEntry } from '@did-btcr2/smt';
@@ -118,7 +119,10 @@ export class AggregationCohort {
     }
     const keyAggContext = keyAggregate(this.#cohortKeys);
     const aggPubkey = keyAggExport(keyAggContext);
-    const payment = p2tr(aggPubkey);
+    // Derive the address for the cohort's network. Without the network arg
+    // p2tr defaults to mainnet, so a mutinynet/signet/regtest cohort would
+    // otherwise advertise a `bc1p...` address that no participant can fund.
+    const payment = p2tr(aggPubkey, undefined, getNetwork(this.network));
 
     // BIP-341: key-path-only P2TR has no script tree. Compute the tweak:
     // taggedHash("TapTweak", internalPubkey).

package/src/core/aggregation/participant.ts

@@ -1,6 +1,5 @@
 import { canonicalHash } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
-import type { SchnorrKeyPair } from '@did-btcr2/keypair';
 import type { SerializedSMTProof} from '@did-btcr2/smt';
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
 import { Transaction } from '@scure/btc-signer';
@@ -26,6 +25,7 @@ import {
 } from './messages/factories.js';
 import type { ParticipantCohortPhaseType } from './phases.js';
 import { ParticipantCohortPhase } from './phases.js';
+import type { AggregationSigner } from './signer.js';
 import { BeaconSigningSession } from './signing-session.js';
 
 /** Cohort advert as discovered by the participant (UI: list of joinable cohorts). */
@@ -82,7 +82,12 @@ interface ParticipantCohortState {
 
 export interface AggregationParticipantParams {
   did: string;
-  keys: SchnorrKeyPair;
+  /**
+   * The participant's MuSig2 signing capability. The raw secret is materialized
+   * only for the duration of a single nonce/partial-sign operation (see ADR 038);
+   * pass a {@link KeyPairAggregationSigner} to back it with an in-memory keypair.
+   */
+  signer: AggregationSigner;
 }
 
 /**
@@ -97,14 +102,21 @@ export interface AggregationParticipantParams {
  */
 export class AggregationParticipant {
   public readonly did: string;
-  public readonly keys: SchnorrKeyPair;
+
+  /** MuSig2 signing capability. The raw secret never lives as a field here. */
+  readonly #signer: AggregationSigner;
 
   /** Per-cohort state, keyed by cohortId. */
   #cohortStates: Map<string, ParticipantCohortState> = new Map();
 
-  constructor({ did, keys }: AggregationParticipantParams) {
+  constructor({ did, signer }: AggregationParticipantParams) {
     this.did = did;
-    this.keys = keys;
+    this.#signer = signer;
+  }
+
+  /** The participant's compressed (33-byte) MuSig2 public key. Not secret. */
+  public get publicKey(): Uint8Array {
+    return this.#signer.publicKey;
   }
 
 
@@ -205,8 +217,8 @@ export class AggregationParticipant {
       from            : this.did,
       to              : state.serviceDid,
       cohortId,
-      participantPk   : this.keys.publicKey.compressed,
-      communicationPk : this.keys.publicKey.compressed,
+      participantPk   : this.publicKey,
+      communicationPk : this.publicKey,
     });
 
     return [optInMessage];
@@ -245,7 +257,7 @@ export class AggregationParticipant {
     const cohortKeys = message.body?.cohortKeys;
     if(!beaconAddress || !cohortKeys) return;
 
-    const participantPkHex = bytesToHex(this.keys.publicKey.compressed);
+    const participantPkHex = bytesToHex(this.publicKey);
     const cohortKeysHex = cohortKeys.map(k => bytesToHex(new Uint8Array(k)));
 
     state.cohort.validateMembership(participantPkHex, cohortKeysHex, beaconAddress);
@@ -435,9 +447,8 @@ export class AggregationParticipant {
     });
     state.signingSession = session;
 
-    const nonceContribution = session.generateNonceContribution(
-      this.keys.publicKey.compressed,
-      this.keys.secretKey.bytes
+    const nonceContribution = this.#signer.withSecret(
+      secretKey => session.generateNonceContribution(this.publicKey, secretKey)
     );
 
     state.phase = ParticipantCohortPhase.NonceSent;
@@ -485,7 +496,10 @@ export class AggregationParticipant {
       );
     }
 
-    const partialSig = state.signingSession.generatePartialSignature(this.keys.secretKey.bytes);
+    const signingSession = state.signingSession;
+    const partialSig = this.#signer.withSecret(
+      secretKey => signingSession.generatePartialSignature(secretKey)
+    );
     state.phase = ParticipantCohortPhase.Complete;
 
     return [createSignatureAuthorizationMessage({
@@ -501,4 +515,16 @@ export class AggregationParticipant {
   public getCohortPhase(cohortId: string): ParticipantCohortPhaseType | undefined {
     return this.#cohortStates.get(cohortId)?.phase;
   }
+
+  /**
+   * Zeroize any retained MuSig2 secret nonces across all cohorts. The raw
+   * signing key is never held here (it lives behind the {@link AggregationSigner}
+   * and is wiped per-operation), but an abandoned signing session can still hold
+   * a secret nonce; call this on teardown to clear it deterministically.
+   */
+  public clearSecrets(): void {
+    for(const state of this.#cohortStates.values()) {
+      state.signingSession?.clearSecrets();
+    }
+  }
 }

package/src/core/aggregation/runner/aggregation-runner.ts

@@ -0,0 +1,96 @@
+import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import type { AggregationResult } from '../service.js';
+import { InMemoryBus, InMemoryTransport } from '../transport/in-memory.js';
+import { AggregationParticipantRunner } from './participant-runner.js';
+import type { OnProvideUpdate } from './participant-runner.js';
+import { AggregationServiceRunner } from './service-runner.js';
+import type { OnProvideTxData } from './service-runner.js';
+
+/** Identity (DID + keys) for one actor in an {@link AggregationRunner.solo} run. */
+export interface SoloActor {
+  did: string;
+  keys: SchnorrKeyPair;
+}
+
+/** Options for {@link AggregationRunner.solo}. */
+export interface SoloCohortOptions {
+  /** The coordinating service identity. */
+  service: SoloActor;
+  /** The single participant identity (the lone signer of the cohort). */
+  participant: SoloActor;
+  /** Bitcoin network and beacon type (`'CASBeacon'` | `'SMTBeacon'`) for the cohort. */
+  config: { network: string; beaconType: string };
+  /** Provide the participant's signed BTCR2 update for the cohort. */
+  onProvideUpdate: OnProvideUpdate;
+  /** Provide the Bitcoin transaction data the cohort signs. */
+  onProvideTxData: OnProvideTxData;
+  /** Optional overall wall-clock budget for the run (ms). */
+  cohortTtlMs?: number;
+  /** Optional per-phase stall timeout (ms). */
+  phaseTimeoutMs?: number;
+}
+
+/**
+ * High-level facades for driving an aggregation cohort to completion.
+ *
+ * @class AggregationRunner
+ */
+export class AggregationRunner {
+  /**
+   * Run a cohort of ONE participant entirely in-process and return the
+   * aggregated MuSig2 result.
+   *
+   * One party plays both the coordinating service and the lone participant,
+   * connected over an {@link InMemoryTransport} (no relay or HTTP server). This
+   * makes the single-participant aggregate-beacon path — the N=1 corner of the
+   * two-axis beacon matrix (see ADR 037) — first-class, useful for generating
+   * and reproducing single-participant aggregate test vectors.
+   *
+   * The service advertises a cohort with `minParticipants: 1`; the participant
+   * joins, submits its update, and the two complete keygen, data distribution,
+   * validation, and a one-signer MuSig2 P2TR key-path signing round.
+   *
+   * @param options Service + participant identities, cohort config, and the
+   *   update / tx-data callbacks.
+   * @returns The {@link AggregationResult} (cohort id, aggregated signature, signed tx).
+   */
+  static async solo(options: SoloCohortOptions): Promise<AggregationResult> {
+    const transport = new InMemoryTransport(new InMemoryBus());
+    transport.registerActor(options.service.did, options.service.keys);
+    transport.registerActor(options.participant.did, options.participant.keys);
+    // Pre-register communication keys both ways. Production exchanges these via
+    // the protocol handshake; in-process we wire them directly.
+    transport.registerPeer(options.participant.did, options.participant.keys.publicKey.compressed);
+    transport.registerPeer(options.service.did, options.service.keys.publicKey.compressed);
+    transport.start();
+
+    const service = new AggregationServiceRunner({
+      transport,
+      did                    : options.service.did,
+      keys                   : options.service.keys,
+      config                 : { minParticipants: 1, network: options.config.network, beaconType: options.config.beaconType },
+      onProvideTxData        : options.onProvideTxData,
+      cohortTtlMs            : options.cohortTtlMs,
+      phaseTimeoutMs         : options.phaseTimeoutMs,
+      // In-process bus with the participant already listening: a single advert
+      // suffices, so disable the republish loop (no dangling interval).
+      advertRepeatIntervalMs : 0,
+    });
+
+    const participant = new AggregationParticipantRunner({
+      transport,
+      did             : options.participant.did,
+      keys            : options.participant.keys,
+      shouldJoin      : async () => true,
+      onProvideUpdate : options.onProvideUpdate,
+    });
+
+    await participant.start();
+    try {
+      return await service.run();
+    } finally {
+      participant.stop();
+      service.stop();
+    }
+  }
+}

package/src/core/aggregation/runner/index.ts

@@ -2,3 +2,4 @@ export * from './typed-emitter.js';
 export * from './events.js';
 export * from './service-runner.js';
 export * from './participant-runner.js';
+export * from './aggregation-runner.js';

package/src/core/aggregation/runner/participant-runner.ts

@@ -18,6 +18,7 @@ import {
   AggregationParticipant
 } from '../participant.js';
 import { ParticipantCohortPhase } from '../phases.js';
+import { KeyPairAggregationSigner } from '../signer.js';
 import type { Transport } from '../transport/transport.js';
 import type { AggregationParticipantEvents } from './events.js';
 import { TypedEventEmitter } from './typed-emitter.js';
@@ -129,7 +130,10 @@ export class AggregationParticipantRunner extends TypedEventEmitter<AggregationP
     this.#onValidateData = options.onValidateData ?? (async (info) => ({ approved: info.matches }));
     this.#onApproveSigning = options.onApproveSigning ?? (async () => ({ approved: true }));
 
-    this.session = new AggregationParticipant({ did: options.did, keys: options.keys });
+    this.session = new AggregationParticipant({
+      did    : options.did,
+      signer : new KeyPairAggregationSigner(options.keys),
+    });
   }
 
   /**
@@ -144,6 +148,10 @@ export class AggregationParticipantRunner extends TypedEventEmitter<AggregationP
   stop(): void {
     this.#stopped = true;
     this.#unregisterHandlers();
+    // Deterministically wipe any secret nonce left on an abandoned signing
+    // session. The signing key itself lives behind the AggregationSigner and is
+    // never retained here.
+    this.session.clearSecrets();
   }
 
   /** Message types this runner listens for on the transport. */

package/src/core/aggregation/runner/service-runner.ts

@@ -184,8 +184,11 @@ export class AggregationServiceRunner extends TypedEventEmitter<AggregationServi
     this.#advertRepeatIntervalMs = options.advertRepeatIntervalMs ?? DEFAULT_ADVERT_REPEAT_INTERVAL_MS;
 
     this.session = new AggregationService({
+      // The coordinator never signs, so the state machine receives only the
+      // public half of the operator's keypair (see ADR 038). The full keypair
+      // remains the operator's transport/communication identity.
       did                : options.did,
-      keys               : options.keys,
+      publicKey          : options.keys.publicKey,
       maxUpdateSizeBytes : options.maxUpdateSizeBytes,
     });
   }

package/src/core/aggregation/service.ts

@@ -1,7 +1,7 @@
 import { canonicalize } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
 import { BIP340Cryptosuite, SchnorrMultikey } from '@did-btcr2/cryptosuite';
-import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import type { CompressedSecp256k1PublicKey } from '@did-btcr2/keypair';
 import { bytesToHex } from '@noble/hashes/utils';
 import type { Transaction } from '@scure/btc-signer';
 import { getBeaconStrategy } from './beacon-strategy.js';
@@ -100,7 +100,13 @@ export const DEFAULT_MAX_UPDATE_SIZE_BYTES = 256 * 1024;
 
 export interface AggregationServiceParams {
   did: string;
-  keys: SchnorrKeyPair;
+  /**
+   * The service's compressed communication public key (placed in cohort adverts).
+   * The coordinator never signs - it aggregates public nonces and partial
+   * signatures - so it is given a public key only, never a secret-bearing
+   * keypair (see ADR 038).
+   */
+  publicKey: CompressedSecp256k1PublicKey;
   /**
    * Maximum canonicalized byte-length of a signed update body accepted by the
    * service. Submissions above this cap are silently dropped and surfaced as
@@ -122,15 +128,15 @@ export interface AggregationServiceParams {
  */
 export class AggregationService {
   readonly did: string;
-  readonly keys: SchnorrKeyPair;
+  readonly publicKey: CompressedSecp256k1PublicKey;
   readonly maxUpdateSizeBytes: number;
 
   /** Per-cohort state, keyed by cohortId. */
   #cohortStates: Map<string, ServiceCohortState> = new Map();
 
-  constructor({ did, keys, maxUpdateSizeBytes }: AggregationServiceParams) {
+  constructor({ did, publicKey, maxUpdateSizeBytes }: AggregationServiceParams) {
     this.did = did;
-    this.keys = keys;
+    this.publicKey = publicKey;
     this.maxUpdateSizeBytes = maxUpdateSizeBytes ?? DEFAULT_MAX_UPDATE_SIZE_BYTES;
   }
 
@@ -234,7 +240,7 @@ export class AggregationService {
       cohortSize      : state.config.minParticipants,
       beaconType      : state.config.beaconType,
       network         : state.config.network,
-      communicationPk : this.keys.publicKey.compressed,
+      communicationPk : this.publicKey.compressed,
     });
 
     state.phase = ServiceCohortPhase.Advertised;

package/src/core/aggregation/signer.ts

@@ -0,0 +1,67 @@
+import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import { wipe } from '@did-btcr2/keypair';
+
+/**
+ * A signing capability for MuSig2 aggregation.
+ *
+ * MuSig2 (BIP-327) cannot be driven through a generic `sign(message)` primitive:
+ * both nonce generation and partial signing need the raw 32-byte secret scalar
+ * (see ADR 038). Rather than hand that scalar around as a long-lived field, the
+ * participant holds an `AggregationSigner` and materializes the secret only for
+ * the duration of a single operation via {@link AggregationSigner.withSecret},
+ * which is responsible for wiping its working copy afterward.
+ *
+ * This is the seam a non-extractable / KMS-backed signer (or a session-scoped
+ * signer that destroys its key after the cohort completes) plugs into without
+ * changing the participant state machine.
+ *
+ * @interface AggregationSigner
+ */
+export interface AggregationSigner {
+  /** Compressed 33-byte public key. Not secret; always available. */
+  readonly publicKey: Uint8Array;
+
+  /**
+   * Materialize the raw 32-byte secret key, pass it to `fn`, and zeroize the
+   * working copy before returning - even if `fn` throws. The secret must not
+   * escape the callback.
+   *
+   * @typeParam T The callback's return type (e.g. a nonce contribution or partial signature).
+   * @param {(secretKey: Uint8Array) => T} fn Operation that needs the raw secret for its duration.
+   * @returns {T} Whatever `fn` returns.
+   */
+  withSecret<T>(fn: (secretKey: Uint8Array) => T): T;
+}
+
+/**
+ * {@link AggregationSigner} backed by an in-memory {@link SchnorrKeyPair}.
+ *
+ * The keypair is held privately (never exposed as a public field) and each
+ * `withSecret` call pulls a fresh copy of the secret bytes, hands it to the
+ * callback, and wipes that copy on return. The underlying keypair is the
+ * caller's to own and destroy; this signer never mutates or destroys it.
+ *
+ * @class KeyPairAggregationSigner
+ * @implements {AggregationSigner}
+ */
+export class KeyPairAggregationSigner implements AggregationSigner {
+  readonly publicKey: Uint8Array;
+  readonly #keys: SchnorrKeyPair;
+
+  /** @param {SchnorrKeyPair} keys The keypair whose secret backs this signer. */
+  constructor(keys: SchnorrKeyPair) {
+    this.#keys = keys;
+    this.publicKey = keys.publicKey.compressed;
+  }
+
+  withSecret<T>(fn: (secretKey: Uint8Array) => T): T {
+    // `.bytes` returns a fresh copy; wipe it once the operation completes so the
+    // raw scalar does not linger on the heap beyond a single MuSig2 step.
+    const secretKey = this.#keys.secretKey.bytes;
+    try {
+      return fn(secretKey);
+    } finally {
+      wipe(secretKey);
+    }
+  }
+}

package/src/core/aggregation/signing-session.ts

@@ -1,3 +1,4 @@
+import { wipe } from '@did-btcr2/keypair';
 import type { Transaction } from '@scure/btc-signer';
 import { SigHash } from '@scure/btc-signer';
 import * as musig2 from '@scure/btc-signer/musig2';
@@ -58,8 +59,14 @@ export class BeaconSigningSession {
   /** Current signing session phase. */
   public phase: SigningSessionPhaseType;
 
-  /** Participant's secret nonce (held only by the participant during signing). */
-  public secretNonce?: Uint8Array;
+  /**
+   * Participant's MuSig2 secret nonce, held only on the participant side
+   * between {@link generateNonceContribution} and {@link generatePartialSignature}.
+   * Private and cleared on every terminal path (success, failure, or teardown
+   * via {@link clearSecrets}) so a spent or abandoned nonce cannot be reused or
+   * serialized.
+   */
+  #secretNonce?: Uint8Array;
 
   constructor({ id, cohort, pendingTx, prevOutScripts, prevOutValues }: SigningSessionParams) {
     this.id = id || crypto.randomUUID();
@@ -225,7 +232,7 @@ export class BeaconSigningSession {
   public generateNonceContribution(participantPublicKey: Uint8Array, participantSecretKey: Uint8Array): Uint8Array {
     const aggPublicKey = musig2.keyAggExport(musig2.keyAggregate(this.cohort.cohortKeys));
     const nonces = musig2.nonceGen(participantPublicKey, participantSecretKey, aggPublicKey);
-    this.secretNonce = nonces.secret;
+    this.#secretNonce = nonces.secret;
     return nonces.public;
   }
 
@@ -233,15 +240,17 @@ export class BeaconSigningSession {
    * Generates a partial signature using the participant's secret key + secret nonce.
    * Requires the aggregated nonce to have been set first (via the service).
    *
-   * Zeros the stored `secretNonce` after use. JS cannot truly erase memory (GC
-   * and immutable strings), but overwriting the bytes shortens the exposure
-   * window and prevents accidental reuse or serialization of a spent nonce.
+   * Clears the stored secret nonce after use on every path (success or throw)
+   * via {@link clearSecrets}. JS cannot truly erase memory (GC may relocate
+   * buffers), but overwriting the bytes shortens the exposure window and
+   * prevents accidental reuse or serialization of a spent nonce - reuse of a
+   * MuSig2 nonce leaks the secret key.
    */
   public generatePartialSignature(participantSecretKey: Uint8Array): Uint8Array {
     if(!this.aggregatedNonce) {
       throw new SigningSessionError('Aggregated nonce not available.', 'MISSING_AGGREGATED_NONCE');
     }
-    if(!this.secretNonce) {
+    if(!this.#secretNonce) {
       throw new SigningSessionError('Secret nonce not available — generateNonceContribution() must be called first.', 'MISSING_SECRET_NONCE');
     }
     const session = new musig2.Session(
@@ -251,10 +260,24 @@ export class BeaconSigningSession {
       [this.cohort.tapTweak],
       [true]
     );
-    const partialSig = session.sign(this.secretNonce, participantSecretKey);
-    this.secretNonce.fill(0);
-    this.secretNonce = undefined;
-    return partialSig;
+    try {
+      return session.sign(this.#secretNonce, participantSecretKey);
+    } finally {
+      this.clearSecrets();
+    }
+  }
+
+  /**
+   * Zeroize any retained secret nonce. Safe to call repeatedly and on any path
+   * (completion, failure, or teardown of an abandoned session). Callers that
+   * drop a session before it reaches a partial signature should invoke this so
+   * the secret nonce does not linger on the live object.
+   */
+  public clearSecrets(): void {
+    if(this.#secretNonce) {
+      wipe(this.#secretNonce);
+      this.#secretNonce = undefined;
+    }
   }
 
   public isComplete(): boolean {

package/src/core/aggregation/transport/in-memory.ts

@@ -0,0 +1,178 @@
+import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import type { BaseMessage } from '../messages/base.js';
+import type { MessageHandler, Transport } from './transport.js';
+
+/** Internal registration for a single actor sharing an {@link InMemoryTransport}. */
+interface ActorEntry {
+  /** Compressed communication public key. The in-process bus does no encryption, so no secret is retained. */
+  publicKey: Uint8Array;
+  handlers: Map<string, MessageHandler>;
+}
+
+/**
+ * In-process message bus connecting one or more {@link InMemoryTransport}
+ * instances. Routes broadcasts to every registered actor and directed messages
+ * to the actor that owns the recipient DID — with no relay, server, or network.
+ *
+ * Each delivery does a JSON round-trip (Uint8Array preserved as `__bytes` hex)
+ * so handlers receive an isolated, serialization-faithful copy, exactly as a
+ * real transport would. The message `body` is merged to the top level to match
+ * the shape the {@link NostrTransport} dispatch produces.
+ *
+ * @class InMemoryBus
+ */
+export class InMemoryBus {
+  #transports: Set<InMemoryTransport> = new Set();
+
+  /** Attach a transport to this bus. Called by the transport's constructor. */
+  register(transport: InMemoryTransport): void {
+    this.#transports.add(transport);
+  }
+
+  /** Detach a transport from this bus. */
+  unregister(transport: InMemoryTransport): void {
+    this.#transports.delete(transport);
+  }
+
+  /**
+   * Deliver a message. With no `recipient` the message is broadcast to every
+   * actor on the bus; otherwise it is routed to the single transport that owns
+   * the recipient DID.
+   */
+  async deliver(message: BaseMessage, _sender: string, recipient?: string): Promise<void> {
+    const type = (message as { type?: string }).type;
+    if(!type) return;
+
+    // JSON round-trip to mimic transport serialization, preserving Uint8Array.
+    const replacer = (_k: string, v: unknown): unknown => v instanceof Uint8Array ? { __bytes: bytesToHex(v) } : v;
+    const reviver = (_k: string, v: unknown): unknown =>
+      v && typeof v === 'object' && '__bytes' in (v as Record<string, unknown>)
+        ? hexToBytes((v as { __bytes: string }).__bytes)
+        : v;
+    const raw = JSON.parse(JSON.stringify(message, replacer), reviver) as Record<string, unknown>;
+    const serialized = { ...raw, ...((raw.body as Record<string, unknown> | undefined) ?? {}) };
+
+    if(!recipient) {
+      for(const t of this.#transports) {
+        await t.dispatchBroadcast(type, serialized);
+      }
+      return;
+    }
+    for(const t of this.#transports) {
+      if(t.hasActor(recipient)) {
+        await t.dispatchDirected(recipient, type, serialized);
+        return;
+      }
+    }
+  }
+}
+
+/**
+ * In-process {@link Transport} that routes aggregation messages through an
+ * {@link InMemoryBus} instead of a relay or HTTP server. Supports multiple
+ * actors per instance, so a single transport can host both a service and its
+ * participants (e.g. a cohort-of-one via {@link AggregationRunner.solo}).
+ *
+ * Encryption is a no-op (in-process, same trust domain); `registerPeer` /
+ * `getPeerPk` keep a registry so the contract matches the wire transports.
+ *
+ * @class InMemoryTransport
+ * @implements {Transport}
+ */
+export class InMemoryTransport implements Transport {
+  name: string = 'in-memory';
+  readonly bus: InMemoryBus;
+
+  #actors: Map<string, ActorEntry> = new Map();
+  #peers: Map<string, Uint8Array> = new Map();
+
+  /** @param bus Shared bus. Pass the same bus to connect multiple transports. */
+  constructor(bus: InMemoryBus = new InMemoryBus()) {
+    this.bus = bus;
+    this.bus.register(this);
+  }
+
+  start(): void {
+    // No-op: there is no underlying connection to open.
+  }
+
+  registerActor(did: string, keys: SchnorrKeyPair): void {
+    // In-process delivery does no signing or encryption (same trust domain), so
+    // retain only the public key - the secret-bearing keypair is never stored in
+    // the transport registry (see ADR 038).
+    this.#actors.set(did, { publicKey: keys.publicKey.compressed, handlers: new Map() });
+  }
+
+  getActorPk(did: string): Uint8Array | undefined {
+    return this.#actors.get(did)?.publicKey;
+  }
+
+  /** True if `did` is registered on this transport. Used by the bus for routing. */
+  hasActor(did: string): boolean {
+    return this.#actors.has(did);
+  }
+
+  registerPeer(did: string, communicationPk: Uint8Array): void {
+    this.#peers.set(did, communicationPk);
+  }
+
+  getPeerPk(did: string): Uint8Array | undefined {
+    return this.#peers.get(did);
+  }
+
+  registerMessageHandler(actorDid: string, messageType: string, handler: MessageHandler): void {
+    const actor = this.#actors.get(actorDid);
+    if(actor) actor.handlers.set(messageType, handler);
+  }
+
+  unregisterMessageHandler(actorDid: string, messageType: string): void {
+    const actor = this.#actors.get(actorDid);
+    if(actor) actor.handlers.delete(messageType);
+  }
+
+  unregisterActor(did: string): void {
+    const actor = this.#actors.get(did);
+    if(!actor) return;
+    actor.handlers.clear();
+    this.#actors.delete(did);
+    this.#peers.delete(did);
+  }
+
+  async sendMessage(message: BaseMessage, sender: string, recipient?: string): Promise<void> {
+    await this.bus.deliver(message, sender, recipient);
+  }
+
+  publishRepeating(
+    message: BaseMessage,
+    sender: string,
+    intervalMs: number,
+    recipient?: string,
+  ): () => void {
+    let stopped = false;
+    void this.sendMessage(message, sender, recipient).catch(() => { /* in-process: no relay to reject */ });
+    const timer = setInterval(() => {
+      if(stopped) return;
+      void this.sendMessage(message, sender, recipient).catch(() => { /* ignore */ });
+    }, intervalMs);
+    return () => {
+      if(stopped) return;
+      stopped = true;
+      clearInterval(timer);
+    };
+  }
+
+  /** Deliver a broadcast message to every actor on this transport that handles `type`. */
+  async dispatchBroadcast(type: string, message: unknown): Promise<void> {
+    for(const actor of this.#actors.values()) {
+      const handler = actor.handlers.get(type);
+      if(handler) await handler(message);
+    }
+  }
+
+  /** Deliver a directed message to the recipient actor's handler for `type`. */
+  async dispatchDirected(recipientDid: string, type: string, message: unknown): Promise<void> {
+    const handler = this.#actors.get(recipientDid)?.handlers.get(type);
+    if(handler) await handler(message);
+  }
+}

package/src/core/aggregation/transport/index.ts

@@ -1,6 +1,7 @@
 export * from './transport.js';
 export * from './error.js';
 export * from './factory.js';
+export * from './in-memory.js';
 export * from './nostr.js';
 export * from './didcomm.js';
 export * from './http/index.js';