@supercuts-walrus/backend 0.1.1 → 0.1.3

package/dist/embedding-adapter.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * OpenAI-compatible embedding adapter for local models (`supercuts-embedding-adapter`).
+ *
+ * Walrus Mainnet Memory indexes 1536-dimensional embeddings. This loopback proxy forwards requests to a
+ * local OpenAI-compatible endpoint (Ollama by default) and zero-pads shorter vectors to 1536 dimensions.
+ * Zero-padding preserves cosine similarity and Euclidean distance as long as every write and recall uses
+ * this same adapter and upstream model. Memory plaintext only reaches the configured upstream.
+ */
+import { createServer } from "node:http";
+import { isMainModule } from "./main-module.js";
+export const TARGET_DIMENSIONS = 1536;
+const MAX_REQUEST_BYTES = 1024 * 1024;
+export function padEmbedding(embedding) {
+    if (!Array.isArray(embedding) ||
+        embedding.length < 1 ||
+        embedding.length > TARGET_DIMENSIONS) {
+        throw new Error(`expected an embedding with 1 to ${TARGET_DIMENSIONS} dimensions, received ${Array.isArray(embedding) ? embedding.length : "a non-array value"}`);
+    }
+    if (!embedding.every((value) => typeof value === "number" && Number.isFinite(value)))
+        throw new Error("upstream embedding contains a non-finite value");
+    return [
+        ...embedding,
+        ...Array(TARGET_DIMENSIONS - embedding.length).fill(0),
+    ];
+}
+export function transformEmbeddingResponse(payload) {
+    const value = payload;
+    if (!value || !Array.isArray(value.data) || !value.data.length)
+        throw new Error("upstream response has no embeddings");
+    const dimension = value.data[0]?.embedding?.length;
+    if (value.data.some((item) => item?.embedding?.length !== dimension))
+        throw new Error("upstream embeddings have inconsistent dimensions");
+    return {
+        ...value,
+        data: value.data.map((item) => ({
+            ...item,
+            embedding: padEmbedding(item?.embedding),
+        })),
+    };
+}
+export function createEmbeddingAdapter({ fetchImpl = fetch, upstreamBaseUrl, upstreamApiKey, upstreamModel, }) {
+    if (!upstreamBaseUrl)
+        throw new Error("EMBEDDING_UPSTREAM_BASE_URL is required");
+    if (!upstreamModel)
+        throw new Error("EMBEDDING_UPSTREAM_MODEL is required");
+    const endpoint = `${upstreamBaseUrl.replace(/\/$/, "")}/embeddings`;
+    let sourceDimensions;
+    const send = (response, status, body) => {
+        response.writeHead(status, { "content-type": "application/json" });
+        response.end(typeof body === "string" ? body : JSON.stringify(body));
+    };
+    return createServer(async (request, response) => {
+        // Loopback only: reject other Host headers so a DNS-rebinding page cannot drive the local embedding model.
+        const host = (request.headers.host ?? "").replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+        if (!["127.0.0.1", "localhost", "::1"].includes(host))
+            return send(response, 403, { error: { message: "loopback host required" } });
+        if (request.method === "GET" && request.url === "/health")
+            return send(response, 200, {
+                status: "ok",
+                targetDimensions: TARGET_DIMENSIONS,
+                upstreamModel,
+            });
+        if (request.method !== "POST" || request.url !== "/v1/embeddings")
+            return send(response, 404, { error: { message: "not found" } });
+        try {
+            let body = "";
+            for await (const chunk of request) {
+                body += chunk;
+                if (body.length > MAX_REQUEST_BYTES)
+                    throw new Error("embedding request is too large");
+            }
+            const requested = JSON.parse(body);
+            const upstream = await fetchImpl(endpoint, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    ...(upstreamApiKey
+                        ? { authorization: `Bearer ${upstreamApiKey}` }
+                        : {}),
+                },
+                body: JSON.stringify({ ...requested, model: upstreamModel }),
+                signal: AbortSignal.timeout(60_000),
+            });
+            const upstreamBody = await upstream.text();
+            if (!upstream.ok)
+                return send(response, upstream.status, upstreamBody);
+            const payload = JSON.parse(upstreamBody), result = transformEmbeddingResponse(payload);
+            const dimension = payload.data[0].embedding.length;
+            if (sourceDimensions !== undefined && sourceDimensions !== dimension)
+                throw new Error("upstream embedding dimensions changed");
+            sourceDimensions = dimension;
+            send(response, 200, result);
+        }
+        catch (error) {
+            send(response, 502, {
+                error: {
+                    message: error instanceof Error ? error.message : "embedding adapter failed",
+                },
+            });
+        }
+    });
+}
+if (isMainModule(import.meta.url)) {
+    const port = Number(process.env.EMBEDDING_ADAPTER_PORT ?? 8787);
+    const upstreamBaseUrl = process.env.EMBEDDING_UPSTREAM_BASE_URL ?? "http://127.0.0.1:11434/v1";
+    const upstreamModel = process.env.EMBEDDING_UPSTREAM_MODEL ?? "embeddinggemma";
+    const server = createEmbeddingAdapter({
+        upstreamBaseUrl,
+        upstreamModel,
+        ...(process.env.EMBEDDING_UPSTREAM_API_KEY
+            ? { upstreamApiKey: process.env.EMBEDDING_UPSTREAM_API_KEY }
+            : {}),
+    });
+    server.listen(port, "127.0.0.1", () => process.stdout.write(`${JSON.stringify({ ok: true, listening: `http://127.0.0.1:${port}/v1`, upstream: upstreamBaseUrl, upstreamModel, targetDimensions: TARGET_DIMENSIONS, memoryConfig: { embeddingApiBase: `http://127.0.0.1:${port}/v1`, embeddingModel: `${upstreamModel}-1536` } })}\n`));
+}

package/dist/facilitator.js

@@ -3,6 +3,7 @@ import { timingSafeEqual } from "node:crypto";
 import { SuiGrpcClient } from "@mysten/sui/grpc";
 import { Transaction } from "@mysten/sui/transactions";
 import { isValidTransactionSignature } from "@mysten/sui/verify";
+import { isMainModule } from "./main-module.js";
 const NETWORK = "sui:testnet";
 const SUI = "0x2::sui::SUI";
 /** Sui RPC may expand a type's address to 32 bytes; policy identifiers use its canonical short form. */
@@ -164,7 +165,7 @@ export class SuiTestnetFacilitator {
     }
     send(response, status, body) { const encoded = Buffer.from(JSON.stringify(body)); response.writeHead(status, { "content-type": "application/json", "content-length": String(encoded.length) }); response.end(encoded); }
 }
-if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {
+if (isMainModule(import.meta.url)) {
     const key = process.env.FACILITATOR_SHARED_KEY ?? "";
     const grpc = process.env.SUI_TESTNET_GRPC ?? "https://fullnode.testnet.sui.io:443";
     const port = Number(process.env.PORT ?? "3000");

package/dist/funding.js

@@ -27,6 +27,8 @@ export async function prepareFunding(home, values) {
         if (app.profile.role !== "buyer" || app.profile.mock)
             fail("LIVE_PROFILE_REQUIRED", "funding requires a live buyer role home");
         const doctor = await app.execute("doctor", {}), address = String(doctor.data.signer ?? "");
+        if (shieldedPayment > 0n && doctor.data.shieldedProofs !== "ready")
+            fail("SHIELDED_PROOFS_UNAVAILABLE", String(doctor.data.shieldedFixes?.[0] ?? "shielded proving artifacts are not installed"));
         const endpoint = app.profile.live?.writeGrpcEndpoint ?? fail("LIVE_PROFILE_INVALID", "buyer write RPC is missing");
         const [{ balance }, shielded] = await Promise.all([writeClient(endpoint).getBalance({ owner: address, coinType: "0x2::sui::SUI" }), app.execute("wallet.balance", {})]);
         return calculateFundingPlan({ address, publicBalance: BigInt(balance.balance), shieldedBalance: BigInt(String(shielded.data.available ?? "0")), publicPayment, shieldedPayment, gasReserve, changeReserve });
@@ -42,7 +44,14 @@ export async function executeFunding(home, values) {
     if (plan.faucetRequired) {
         if (!values.requestFaucet)
             fail("BUYER_FUNDING_REQUIRED", `buyer needs ${plan.publicShortfallMist} additional MIST; rerun with --request-faucet --confirm or fund ${plan.address} manually`);
-        execFileSync("sui", ["client", "faucet", "--url", "https://faucet.testnet.sui.io", "--address", plan.address], { stdio: "inherit" });
+        try {
+            execFileSync("sui", ["client", "faucet", "--url", "https://faucet.testnet.sui.io", "--address", plan.address], { stdio: "inherit" });
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                fail("SUI_CLI_MISSING", `the Sui CLI is not installed; request Testnet SUI for ${plan.address} at https://faucet.sui.io, then rerun funding execute without --request-faucet`);
+            throw error;
+        }
         for (let attempt = 0; attempt < 15; attempt++) {
             await new Promise((resolve) => setTimeout(resolve, 2_000));
             plan = await prepareFunding(home, values);

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from "./indexer.js";
 export * from "./memory.js";
 export * from "./settlement.js";
 export * from "./seller-runtime.js";
+export * from "./seller-research.js";
 export * from "./seller-stdio.js";
 export * from "./live-index.js";
 export * from "./live-runtime.js";

package/dist/index.js

@@ -15,6 +15,7 @@ export * from "./indexer.js";
 export * from "./memory.js";
 export * from "./settlement.js";
 export * from "./seller-runtime.js";
+export * from "./seller-research.js";
 export * from "./seller-stdio.js";
 export * from "./live-index.js";
 export * from "./live-runtime.js";

package/dist/live-deal-ports.d.ts

@@ -1,5 +1,5 @@
 import { type SignedCapabilityRegistration } from "./capability.js";
-import type { DealArtifact, DealNegotiation, DealPayment, DealPorts } from "./deal-engine.js";
+import type { DealArtifact, DealNegotiation, DealPayment, DealPorts, SellerFault } from "./deal-engine.js";
 import type { ExecuteDealInput } from "./deal.js";
 import { type AgentMandate } from "./mandate.js";
 import type { Phase3App } from "./phase3.js";
@@ -32,6 +32,7 @@ export declare class LiveDealPorts implements DealPorts {
     negotiate(input: ExecuteDealInput, registration: SignedCapabilityRegistration, plan: SettlementPlanV1, agreementOperationId: string): Promise<LiveNegotiation>;
     pay(input: ExecuteDealInput, plan: SettlementPlanV1, negotiation: DealNegotiation, paymentOperationId: string): Promise<DealPayment>;
     deliver(input: ExecuteDealInput, plan: SettlementPlanV1, negotiation: DealNegotiation, payment: DealPayment, _deliveryOperationId: string): Promise<DealArtifact>;
+    rememberFailure(input: ExecuteDealInput, plan: SettlementPlanV1, fault: SellerFault): Promise<void>;
     rememberOutcome(input: ExecuteDealInput, plan: SettlementPlanV1, payment: DealPayment, artifact: DealArtifact, _outcomeOperationId: string): Promise<{
         queued: true;
         payloadHash: string;

package/dist/live-deal-ports.js

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
 import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
-import { verifySignedCapability } from "./capability.js";
+import { verifySignedCapability, validateCapabilityPayload } from "./capability.js";
 import { WalrusDealBlobs, wireDecrypt, wireEncrypt, wireHash, wireJsonHash, wireKey } from "./deal-wire.js";
 import { fail } from "./errors.js";
 import { LiveRuntime } from "./live-runtime.js";
@@ -64,7 +64,14 @@ export class LiveDealPorts {
         return Ed25519Keypair.fromSecretKey(decoded.secretKey);
     }
     async request(origin, path, body) {
-        const response = await this.http(new URL(path, origin), { ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}), redirect: "error", signal: AbortSignal.timeout(90_000) });
+        const url = new URL(path, origin);
+        let response;
+        try {
+            response = await this.http(url, { ...(body ? { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) } : {}), redirect: "error", signal: AbortSignal.timeout(90_000) });
+        }
+        catch (error) {
+            return fail("DEAL_SELLER_UNAVAILABLE", `seller ${url.origin} is unreachable; check its health endpoint and network route`, error);
+        }
         let value;
         try {
             value = await response.json();
@@ -120,8 +127,21 @@ export class LiveDealPorts {
         const candidates = (await this.catalog()).map(({ registration }) => registration).filter((registration) => (input.capabilityId && registration.manifest.capabilityId === input.capabilityId || input.capabilityClass && registration.manifest.capability === input.capabilityClass) && registration.manifest.asset === input.budget.asset);
         if (!candidates.length)
             fail("DEAL_CAPABILITY_NOT_FOUND", "configured sellers have no matching signed capability");
-        candidates.sort((a, b) => BigInt(a.manifest.priceBand.minimum) < BigInt(b.manifest.priceBand.minimum) ? -1 : BigInt(a.manifest.priceBand.minimum) > BigInt(b.manifest.priceBand.minimum) ? 1 : a.manifest.capabilityId.localeCompare(b.manifest.capabilityId));
-        return candidates[0];
+        // Same capability class can carry different signed input schemas; only rank sellers that accept this task.
+        const accepting = candidates.filter((registration) => { try {
+            validateCapabilityPayload(registration.manifest, "input", input.input);
+            return true;
+        }
+        catch {
+            return false;
+        } });
+        if (!accepting.length)
+            fail("DEAL_INPUT_UNSUPPORTED", "no matching seller's signed input schema accepts this task input; check deal.catalog for the expected fields");
+        candidates.splice(0, candidates.length, ...accepting);
+        // Walrus Memory decides which seller gets paid: verified outcomes outrank a lower list price.
+        const ranking = await this.app.rankDealCandidates(input.operationId, candidates.map((item) => item.manifest), this.mandate, { budgetMaximum: input.budget.maximum, ...(input.requestedRail ? { requestedRail: input.requestedRail } : {}), ...(input.privacyHint ? { privacyHint: input.privacyHint } : {}) });
+        const chosen = ranking.ordered[0];
+        return candidates.find((item) => item.manifest.manifestHash === chosen.manifestHash);
     }
     async plan(input, registration, paymentOperationId) {
         const existing = this.app.store.db.prepare("SELECT plan_json FROM settlement_plans WHERE operation_id=?").get(paymentOperationId);
@@ -130,10 +150,13 @@ export class LiveDealPorts {
             validateSettlementPlan(saved);
             if (saved.mandateHash !== settlementMandateHash(this.mandate) || saved.manifestHash !== registration.manifest.manifestHash || saved.operationId !== paymentOperationId)
                 fail("DEAL_PLAN_MISMATCH", "persisted plan differs from the owner mandate or seller capability");
+            this.app.recordDealMemoryInfluence(input.operationId, saved, this.mandate, { ...(input.requestedRail ? { requestedRail: input.requestedRail } : {}), ...(input.privacyHint ? { privacyHint: input.privacyHint } : {}) });
             return saved;
         }
         const result = await executeMandated(this.app, this.mandate, "settlement.plan", { "operation-id": paymentOperationId, manifest: registration.manifest, "requested-amount": registration.manifest.priceBand.minimum, ...(input.privacyHint ? { "privacy-hint": input.privacyHint } : {}), ...(input.requestedRail ? { "requested-rail": input.requestedRail } : {}) });
-        return result;
+        const plan = result;
+        this.app.recordDealMemoryInfluence(input.operationId, plan, this.mandate, { ...(input.requestedRail ? { requestedRail: input.requestedRail } : {}), ...(input.privacyHint ? { privacyHint: input.privacyHint } : {}) });
+        return plan;
     }
     async negotiate(input, registration, plan, agreementOperationId) {
         const sessionId = agreementOperationId, capabilityId = registration.manifest.capabilityId, buyerPublicKey = this.app.store.getSecret("identity:x25519-public")?.toString("base64url") ?? fail("IDENTITY_MISSING", "buyer transport key is missing");
@@ -202,6 +225,9 @@ export class LiveDealPorts {
             fail("DEAL_DELIVERY_UNVERIFIED", "seller delivery bytes or metadata differ from the receipt");
         return { blobId: receipt.blobId, ciphertextHash: receipt.ciphertextHash, artifactSha256: receipt.artifactSha256, contentType: receipt.contentType, metadata: receipt.metadata, artifactBase64: artifact.artifactBase64 };
     }
+    async rememberFailure(input, plan, fault) {
+        this.app.recordVerifiedDealFailure(input.operationId, plan.planHash, fault);
+    }
     async rememberOutcome(input, plan, payment, artifact, _outcomeOperationId) {
         return this.app.recordVerifiedDealOutcome(input.operationId, plan.planHash, payment.transactionDigest, artifact.artifactSha256);
     }

package/dist/live-runtime.d.ts

@@ -47,7 +47,7 @@ export declare class LiveRuntime {
     readonly prover: Groth16Prover;
     private constructor();
     static create(profile: LiveRuntimeProfile, store: RoleStore): Promise<LiveRuntime>;
-    doctor(): Promise<Record<string, unknown>>;
+    doctor(proofsRequired?: boolean): Promise<Record<string, unknown>>;
     balance(): Promise<Record<string, unknown>>;
     private signed;
     private operationContext;

package/dist/live-runtime.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
 import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
-import { fail } from "./errors.js";
+import { fail, SupercutsError } from "./errors.js";
 import { assertSuiFinality, assertTatumFinality } from "./finality.js";
 import { LivePoolIndex } from "./live-index.js";
 import { ProtocolEngine } from "./protocol-engine.js";
@@ -89,8 +89,18 @@ export class LiveRuntime {
         const engine = await ProtocolEngine.create({ deploymentDomain: profile.live.deploymentDomain, poolId: profile.poolId, coinTypeHash: profile.live.coinTypeHash, verifierVersion: profile.verifierVersion, initialRoot: profile.live.initialRoot });
         return new LiveRuntime(profile, store, new TatumLedger(profile.live.tatumGrpcEndpoint, tatumKey), Ed25519Keypair.fromSecretKey(decoded.secretKey), engine);
     }
-    async doctor() {
-        const artifacts = this.prover.doctor();
+    async doctor(proofsRequired = true) {
+        // Shielded proofs need separately installed artifacts; a public x402 buyer or seller stays usable without them.
+        let artifacts = { rapidSnark: false, artifacts: {} }, shieldedProofs = "ready", shieldedProofsReason;
+        try {
+            artifacts = this.prover.doctor();
+        }
+        catch (error) {
+            if (!(error instanceof SupercutsError) || !["PROVING_ARTIFACT_MISSING", "ARTIFACT_HASH_MISMATCH", "PROVER_TOOL_MISSING"].includes(error.code))
+                throw error;
+            shieldedProofs = "unavailable";
+            shieldedProofsReason = error.code;
+        }
         const [service, suiObject] = await Promise.all([this.tatum.getServiceInfo(), this.client.getObject({ objectId: this.profile.poolId, include: { json: true } })]);
         if (!suiObject.object)
             fail("POOL_OBJECT_MISSING", "pinned Testnet pool object is unavailable; check the Sui write RPC and deployment config");
@@ -98,9 +108,11 @@ export class LiveRuntime {
             fail("TATUM_UNAVAILABLE", "Tatum read RPC did not return service information; check its endpoint and owner-only API key");
         const babySeed = this.store.getSecret("identity:babyjub-seed") ?? fail("IDENTITY_MISSING", "BabyJub identity is missing");
         const identity = this.engine.identity(babySeed);
-        const fixes = [];
-        if (!artifacts.rapidSnark)
-            fixes.push("Set an executable RapidSnark path in the role profile for v2 proofs.");
+        const fixes = [], shieldedFixes = [];
+        if (shieldedProofs === "unavailable")
+            shieldedFixes.push(`Shielded payments are unavailable (${shieldedProofsReason}): install the hash-pinned v2 proving artifacts, SnarkJS, and the converter. Public x402 payments do not need them.`);
+        else if (!artifacts.rapidSnark)
+            shieldedFixes.push("Set an executable RapidSnark path in the role profile for v2 proofs.");
         if (!this.profile.live.walrusPublisherUrl)
             fixes.push("Configure the Walrus publisher URL for capability and transcript writes.");
         if (!this.profile.live.walrusAggregatorUrl)
@@ -117,9 +129,7 @@ export class LiveRuntime {
                 fixes.push(`Walrus ${name} is unreachable; check the configured URL and network access.`);
             }
         }
-        if (this.profile.role === "buyer" && !this.store.getSecret("live:memory-config"))
-            fixes.push("Configure an owner-only Walrus Memory file using the local 1536-dimensional embedding adapter.");
-        return { role: this.profile.role, network: "testnet", packageId: this.profile.packageId, poolId: this.profile.poolId, asset: this.profile.coinType, verifierVersion: this.profile.verifierVersion, keyPermissions: "owner-only", rpc: this.profile.live.writeGrpcEndpoint, healthy: true, readyForDemo: fixes.length === 0, fixes, runtime: "testnet-live", signer: this.signer.toSuiAddress(), babyJubPublicKey: identity.publicKey.map(String), x25519PublicKey: this.store.getSecret("identity:x25519-public")?.toString("base64"), rapidSnark: artifacts.rapidSnark, artifacts: artifacts.artifacts, poolObjectVerified: true, tatumServiceVerified: true };
+        return { role: this.profile.role, network: "testnet", packageId: this.profile.packageId, poolId: this.profile.poolId, asset: this.profile.coinType, verifierVersion: this.profile.verifierVersion, keyPermissions: "owner-only", rpc: this.profile.live.writeGrpcEndpoint, healthy: true, readyForDemo: fixes.length === 0 && (!proofsRequired || shieldedFixes.length === 0), fixes: [...fixes, ...(proofsRequired ? shieldedFixes : [])], publicFixes: fixes, shieldedProofs, shieldedFixes, readyForPublicRail: fixes.length === 0, runtime: "testnet-live", signer: this.signer.toSuiAddress(), babyJubPublicKey: identity.publicKey.map(String), x25519PublicKey: this.store.getSecret("identity:x25519-public")?.toString("base64"), memoryConfigured: Boolean(this.store.getSecret("live:memory-config")), proofsRequired, rapidSnark: artifacts.rapidSnark, artifacts: artifacts.artifacts, poolObjectVerified: true, tatumServiceVerified: true };
     }
     async balance() {
         const state = await this.index.sync();
@@ -621,8 +631,14 @@ export class LiveRuntime {
         const paymentPayload = { x402Version: 2, resource, accepted: requirements, payload: { signature: signed.signature, transaction: Buffer.from(signed.transaction).toString("base64") } };
         const paid = await fetch(paymentUrl, { redirect: "error", headers: { "payment-signature": Buffer.from(JSON.stringify(paymentPayload)).toString("base64"), "x-supercuts-binding": Buffer.from(JSON.stringify({ ...unsignedBinding, payerSignature })).toString("base64") }, signal: AbortSignal.timeout(60_000) });
         const response = Buffer.from(await paid.arrayBuffer());
-        if (!paid.ok)
-            fail("X402_DELIVERY_FAILED", x402ResourceFailure(paid.status, response));
+        if (!paid.ok) {
+            const detail = x402ResourceFailure(paid.status, response);
+            // Settlement status is unknown: the facilitator may have broadcast before failing. Resume reuses the journaled signed
+            // transaction for this operation ID, and Sui executes one digest at most once, so retrying cannot pay twice.
+            if (paid.status >= 502 && paid.status <= 504 || /X402_FACILITATOR_UNAVAILABLE/.test(detail))
+                fail("X402_FACILITATOR_UNAVAILABLE", `${detail}; settlement status is unknown and the payment may already be on chain. Resume with the same operation ID: the same signed transaction is reused and cannot be paid twice`);
+            fail("X402_DELIVERY_FAILED", detail);
+        }
         const settlementHeader = paid.headers.get("payment-response") ?? fail("X402_SETTLEMENT_INVALID", "payment-response header is missing");
         let settlement;
         try {

package/dist/live-seller-transport.js

@@ -97,6 +97,8 @@ export class LiveSellerTransport {
     async handle(request, response) {
         try {
             const url = new URL(request.url ?? "/", this.config.origin);
+            if (request.method === "GET" && url.pathname === "/health")
+                return this.respond(response, 200, { ok: true, service: "supercuts-seller", capabilities: this.runtime.catalog().length });
             if (request.method === "GET" && url.pathname === "/v2/catalog")
                 return this.respond(response, 200, { capabilities: this.runtime.catalog() });
             if (request.method === "POST" && url.pathname === "/v2/prepare")
@@ -108,7 +110,9 @@ export class LiveSellerTransport {
                     if (url.pathname.startsWith(`${(resource.config.pathPrefix ?? "/capability").replace(/\/$/, "")}/`))
                         return resource.handle(request, response);
             }
-            return this.respond(response, 404, { error: "NOT_FOUND" });
+            if (request.method === "GET" && [...this.#registrations.values()].some((item) => url.pathname === new URL(item.manifest.endpoint).pathname))
+                return this.respond(response, 404, { error: "NEGOTIATION_REQUIRED", message: "Protected resource URLs are issued for a negotiated session." });
+            return this.respond(response, 404, { error: "NOT_FOUND", message: "Seller route was not found." });
         }
         catch (error) {
             const known = error instanceof SupercutsError ? error : new SupercutsError("SELLER_REQUEST_FAILED", "seller request failed");

package/dist/main-module.d.ts

@@ -0,0 +1,5 @@
+/**
+ * True when this module is the process entry point. Package managers (pnpm in particular) launch bins
+ * through symlinks, so compare resolved real paths rather than raw `argv[1]` strings.
+ */
+export declare function isMainModule(importMetaUrl: string, entry?: string | undefined): boolean;

package/dist/main-module.js

@@ -0,0 +1,16 @@
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+/**
+ * True when this module is the process entry point. Package managers (pnpm in particular) launch bins
+ * through symlinks, so compare resolved real paths rather than raw `argv[1]` strings.
+ */
+export function isMainModule(importMetaUrl, entry = process.argv[1]) {
+    if (!entry)
+        return false;
+    try {
+        return realpathSync(entry) === realpathSync(fileURLToPath(importMetaUrl));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/mandate.js

@@ -125,7 +125,7 @@ export async function executeMandated(app, mandate, command, raw) {
         fail("MANDATE_COMMAND_FORBIDDEN", `mandate does not allow ${command}`);
     const args = {};
     for (const [key, value] of Object.entries(raw))
-        args[key] = typeof value === "boolean" ? value : typeof value === "string" ? value : Buffer.from(JSON.stringify(value)).toString("base64url");
+        args[key] = typeof value === "boolean" ? value : typeof value === "string" ? value : Buffer.from(canonical(value)).toString("base64url");
     if (!spec.mutating)
         return (await app.execute(command, args)).data;
     const operationId = String(raw["operation-id"]), journalOperationId = command === "settlement.plan" ? `settlement.plan:${operationId}` : operationId;

package/dist/mcp-bootstrap.js

@@ -37,17 +37,17 @@ else {
             return;
         if (request.method === "tools/list")
             return send({ jsonrpc: "2.0", id: request.id, result: { tools: [
-                        { name: "setup.status", description: "Explain how the owner completes one-time buyer setup locally. Do not request secrets in chat.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+                        { name: "setup.status", description: "Explain how the owner completes one-time buyer or seller setup locally. Do not request secrets in chat.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
                         { name: "setup.refresh", description: "Reload this MCP connection after the owner completes local setup.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
                     ] } });
         if (request.method === "tools/call" && request.params?.name === "setup.status") {
             const configured = existsSync(join(home, "profile.json"));
-            const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured, home, nextStep: configured ? "Call setup.refresh to load the configured buyer tools without restarting the connector." : `Run supercuts onboard buyer --home ${JSON.stringify(home)} in a terminal, then call setup.refresh. The command asks for policy limits, seller origins and local credential file paths. Do not paste keys or tokens into Codex.` };
+            const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured, home, nextStep: configured ? "Call setup.refresh to load the configured role tools without restarting the connector." : `Run supercuts onboard buyer --home ${JSON.stringify(home)} or supercuts onboard seller --home ${JSON.stringify(home)} in a terminal, then call setup.refresh. Use a separate owner-only home for every role and identity. Do not paste keys or tokens into Codex.` };
             return send({ jsonrpc: "2.0", id: request.id, result: { content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result } });
         }
         if (request.method === "tools/call" && request.params?.name === "setup.refresh") {
             if (!existsSync(join(home, "profile.json"))) {
-                const result = { schemaVersion: "supercuts.setup.v1", ok: false, error: { code: "SETUP_REQUIRED", message: "buyer setup is not complete", recovery: `Run supercuts onboard buyer --home ${JSON.stringify(home)} locally, then retry setup.refresh.` } };
+                const result = { schemaVersion: "supercuts.setup.v1", ok: false, error: { code: "SETUP_REQUIRED", message: "role setup is not complete", recovery: `Run supercuts onboard buyer --home ${JSON.stringify(home)} or supercuts onboard seller --home ${JSON.stringify(home)} locally, then retry setup.refresh.` } };
                 return send({ jsonrpc: "2.0", id: request.id, result: { isError: true, content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: result } });
             }
             const result = { schemaVersion: "supercuts.setup.v1", ok: true, configured: true, reloading: true };

package/dist/mcp.js

@@ -98,6 +98,8 @@ function logTool(name, data) {
         const plan = journal.step(String(data.operationId), "planning");
         if (plan)
             append("supercuts", "settlement-plan", { phase: "after-memory", planHash: plan.planHash, capabilityId: plan.capabilityId, rail: plan.rail, openingAmount: plan.openingAmount, maximumAmount: plan.maximumAmount, riskLevel: plan.riskLevel, reasonCodes: plan.reasonCodes, blobIds: plan.citations.map((item) => item.blobId) });
+        if (plan && evidence.memoryInfluence)
+            append("supercuts", "memory-influence", { planHash: plan.planHash, changedSeller: evidence.memoryInfluence.changedSeller, changedRail: evidence.memoryInfluence.changedRail, changedRisk: evidence.memoryInfluence.changedRisk, changedMaximum: evidence.memoryInfluence.changedMaximum, withoutMemory: evidence.memoryInfluence.withoutMemory, withMemory: evidence.memoryInfluence.withMemory, scorecards: evidence.memoryRanking, blobIds: evidence.memoryInfluence.citedBlobIds });
         append("supercuts", "deal-lifecycle", { dealId: data.dealId, state: data.state, rail: data.rail, agreement: data.evidence?.agreement, payment: data.evidence?.payment, delivery: data.evidence?.delivery, outcomeMemory: data.evidence?.outcomeMemory, agreementBlobId: evidence.agreementBlobId, deliveryBlobId: evidence.deliveryBlobId, outcomeMemoryBlobId: evidence.outcomeMemoryBlobId, paymentDigest: evidence.paymentDigest });
     }
 }

package/dist/memory-scorecard.d.ts

@@ -0,0 +1,32 @@
+import type { RecalledSettlementMemory, SettlementMemoryScope, SettlementMemoryV1 } from "./settlement.js";
+/** Learned view of one counterparty, derived only from trusted Walrus Memory outcomes. */
+export interface SellerScorecard {
+    counterparty: string;
+    observations: number;
+    successes: number;
+    failures: number;
+    unresolved: number;
+    /** Recency-weighted Beta(1,1) posterior mean; 0.5 when nothing has been learned. */
+    reliability: number;
+    lastOutcome?: "succeeded" | "failed" | "unresolved";
+    lastOutcomeAt?: number;
+    medianLatencyMs?: number;
+    citedBlobIds: string[];
+}
+export declare const DEFAULT_HALF_LIFE_MS: number;
+/** True when every field the filter names matches the memory scope. */
+export declare function scopeWithin(scope: SettlementMemoryScope, filter: SettlementMemoryScope): boolean;
+/**
+ * Trusted deal-level outcome memories for the filter, deduplicated by evidence (one deal may be recalled twice).
+ * Only completed deals and verified seller faults carry `signal.rail`; stage events (agreement, settlement,
+ * delivery) stay as evidence but are not counted as additional deals.
+ */
+export declare function trustedOutcomes(recalled: readonly RecalledSettlementMemory[], filter: SettlementMemoryScope): Array<{
+    blobId: string;
+    memory: SettlementMemoryV1;
+}>;
+export declare function buildScorecard(recalled: readonly RecalledSettlementMemory[], filter: SettlementMemoryScope & {
+    counterparty: string;
+}, now: number, halfLifeMs?: number): SellerScorecard;
+/** Sum of verified paid amounts since `since` within the filter scope; a paid-but-failed deal still spent money. */
+export declare function spentSince(recalled: readonly RecalledSettlementMemory[], filter: SettlementMemoryScope, since: number): bigint;

package/dist/memory-scorecard.js

@@ -0,0 +1,76 @@
+export const DEFAULT_HALF_LIFE_MS = 7 * 86_400_000;
+const TRUSTED = new Set(["owner_policy", "verified_outcome"]);
+/** True when every field the filter names matches the memory scope. */
+export function scopeWithin(scope, filter) {
+    return Object.entries(filter).every(([key, value]) => value === undefined || scope[key] === value);
+}
+/**
+ * Trusted deal-level outcome memories for the filter, deduplicated by evidence (one deal may be recalled twice).
+ * Only completed deals and verified seller faults carry `signal.rail`; stage events (agreement, settlement,
+ * delivery) stay as evidence but are not counted as additional deals.
+ */
+export function trustedOutcomes(recalled, filter) {
+    const seen = new Set(), result = [];
+    for (const item of recalled) {
+        const memory = item.memory;
+        if (!memory ||
+            memory.kind !== "outcome" ||
+            memory.signal.rail === undefined ||
+            !TRUSTED.has(memory.provenance) ||
+            !memory.signal.outcome ||
+            !scopeWithin(memory.scope, filter))
+            continue;
+        const key = memory.evidenceHash ?? item.blobId;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push({ blobId: item.blobId, memory });
+    }
+    return result.sort((a, b) => a.memory.createdAt - b.memory.createdAt ||
+        a.blobId.localeCompare(b.blobId));
+}
+export function buildScorecard(recalled, filter, now, halfLifeMs = DEFAULT_HALF_LIFE_MS) {
+    const outcomes = trustedOutcomes(recalled, filter);
+    let alpha = 1, beta = 1, successes = 0, failures = 0, unresolved = 0;
+    const latencies = [];
+    for (const { memory } of outcomes) {
+        const weight = Math.pow(0.5, Math.max(0, now - memory.createdAt) / halfLifeMs);
+        if (memory.signal.outcome === "succeeded") {
+            successes++;
+            alpha += weight;
+        }
+        else if (memory.signal.outcome === "failed") {
+            failures++;
+            beta += weight;
+        }
+        else {
+            unresolved++;
+            beta += weight / 2;
+        }
+        if (memory.signal.latencyMs !== undefined)
+            latencies.push(memory.signal.latencyMs);
+    }
+    latencies.sort((a, b) => a - b);
+    const last = outcomes.at(-1)?.memory;
+    return {
+        counterparty: filter.counterparty,
+        observations: outcomes.length,
+        successes,
+        failures,
+        unresolved,
+        reliability: alpha / (alpha + beta),
+        ...(last
+            ? { lastOutcome: last.signal.outcome, lastOutcomeAt: last.createdAt }
+            : {}),
+        ...(latencies.length
+            ? { medianLatencyMs: latencies[Math.floor((latencies.length - 1) / 2)] }
+            : {}),
+        citedBlobIds: outcomes.map((item) => item.blobId),
+    };
+}
+/** Sum of verified paid amounts since `since` within the filter scope; a paid-but-failed deal still spent money. */
+export function spentSince(recalled, filter, since) {
+    return trustedOutcomes(recalled, filter)
+        .filter(({ memory }) => memory.signal.amount !== undefined && memory.createdAt >= since)
+        .reduce((total, { memory }) => total + BigInt(memory.signal.amount), 0n);
+}

package/dist/memwal.d.ts

@@ -1,5 +1,17 @@
 import { MemoryFact } from "./memory.js";
 import { type SettlementMemoryV1 } from "./settlement.js";
+export declare const SIGNED_MEMORY_FORMAT: "supercuts.signed-memory.v1";
+/** Sui address that signs this owner's trusted memories; derived from the owner-only memory key. */
+export declare function memorySignerAddress(secret: string): string;
+/** Plain-language line placed before the JSON so embeddings rank the record near scope queries. Not signed. */
+export declare function describeMemory(memory: SettlementMemoryV1): string;
+/** Wraps a trusted memory in a signed envelope so its authority survives a move to another machine. */
+export declare function sealMemoryText(memory: SettlementMemoryV1, secret: string): string;
+/** Opens recalled memory text. `signedBy` is set only when the envelope signature verifies. */
+export declare function openMemoryText(text: string): {
+    memory: unknown;
+    signedBy?: string;
+};
 import { RoleStore } from "./store.js";
 export interface ManualMemoryConfig {
     key: string;
@@ -15,10 +27,26 @@ export interface ManualMemoryConfig {
     walrusAggregatorUrl: string;
     walrusPublisherUrl: string;
 }
+/** Public Walrus Mainnet Memory and local-adapter values; owners only need to supply their own account secrets. */
+export declare const MEMORY_MAINNET_DEFAULTS: {
+    readonly serverUrl: "https://relayer.memory.walrus.xyz";
+    readonly packageId: "0xe7c16fbea0560e7057e2bf7422feaa4fb313749fc69c9e9092fac7a33b81d7f5";
+    readonly registryId: "0x8bf82c9e09e36b8d1c38298f68b7cb68e7b8762887e7592add9986d5e9cf199f";
+    readonly embeddingApiKey: "local-adapter";
+    readonly embeddingApiBase: "http://127.0.0.1:8787/v1";
+    readonly embeddingModel: "embeddinggemma-1536";
+    readonly walrusAggregatorUrl: "https://aggregator.walrus-mainnet.walrus.space";
+    readonly walrusPublisherUrl: "https://publisher.walrus-testnet.walrus.space";
+};
+/** Completes an owner memory config: `key`, `accountId`, and `suiPrivateKey` are required; the rest default. */
+export declare function withMemoryDefaults(raw: Partial<ManualMemoryConfig>, role: string): ManualMemoryConfig;
 /** Client-managed memory facade; plaintext never crosses the relayer boundary. */
 export declare class ManualMemory {
     private readonly store;
     private readonly client;
+    private readonly signingKey;
+    /** Address whose signature marks a recalled memory as this owner's own trusted record. */
+    readonly signerAddress: string | undefined;
     constructor(store: RoleStore, config: ManualMemoryConfig);
     remember(fact: MemoryFact | SettlementMemoryV1): Promise<string>;
     recall(query: string, limit?: number): Promise<Array<{