twin3-sdk 0.2.14-pre-alpha → 0.2.15-pre-alpha

package/README.md

@@ -66,7 +66,8 @@ L1 also exposes a candidate discovery evidence API for xAgent ID and xHuman ID.
 
 Python and Node support [explicit Matrix comparison profiles](docs/matrix-runtime-profiles.md),
 including weighted/masked cosine and structured coverage results. Node constructor
-coercions still differ; Node Inbox payment admission remains Python-only. Evidence
+coercions still differ. Node TaskInbox admits owner-policy receipts with
+applyPayment and injected-verifier receipts with applyX402Payment. Evidence
 trail is experimental until an actual consumer supplies durable integration evidence.
 
 `(experimental)` marks a capability whose row in [`tests/capability-inventory.json`](tests/capability-inventory.json) is not yet `available`: it is importable today and its surface may still change. Everything unmarked is `available`. A name written `Class.method` is a method, not a module export. Every name in this table is checked against a real public export by [`tests/test_readme_capability_claims.py`](tests/test_readme_capability_claims.py).
@@ -115,22 +116,22 @@ pip install -e /path/to/twin3-sdk
 * Any protocol or algorithm improvement in `twin3-sdk` is reflected in both applications in **0 milliseconds**.
 
 #### 2. Production Distribution
-`v0.2.14-pre-alpha` is the current release candidate: `0.2.14-pre-alpha` for npm and `0.2.14a0` for PyPI. Publication is pending. Consumers must pin the exact released version and lock its registry integrity; never use a mutable range for a cryptographic protocol dependency. This release stays pre-alpha. Marketplace or sales copy may offer it for evaluation; it is not a stable release, and the npm dist-tag is `next`, not `latest`.
+`v0.2.15-pre-alpha` is the current release candidate: `0.2.15-pre-alpha` for npm and `0.2.15a0` for PyPI. Publication is pending. Consumers must pin the exact released version and lock its registry integrity; never use a mutable range for a cryptographic protocol dependency. This release stays pre-alpha. Marketplace or sales copy may offer it for evaluation; it is not a stable release, and the npm dist-tag is `next`, not `latest`.
 
 `package.json` `engines` sets Node.js to `>=18` and does not set an npm engine. Any npm that can install a tarball can consume the package. Packing this repository was checked with npm 10 or newer; the stricter npm version in the release runbook applies only to Trusted Publishing.
 
 After publication, install the exact released version from the registry:
 
 ```bash
-npm install twin3-sdk@0.2.14-pre-alpha
-pip install twin3-sdk==0.2.14a0
+npm install twin3-sdk@0.2.15-pre-alpha
+pip install twin3-sdk==0.2.15a0
 ```
 
 For local evaluation, you can also use the packed npm tarball. Do not install from a git URL or a version range:
 
 ```bash
 npm pack --ignore-scripts
-npm install ./twin3-sdk-0.2.14-pre-alpha.tgz
+npm install ./twin3-sdk-0.2.15-pre-alpha.tgz
 ```
 
 ---

package/index.d.ts

@@ -848,6 +848,12 @@ export interface KyaBinding {
   receipt: string;
 }
 
+export declare class DidResolutionError extends Error { readonly code: string; }
+export declare function didWebForHost(host: string): string;
+export declare function didWebUrl(did: string): string;
+export declare function resolveDidWeb(did: string, fetch: (method: string, url: string, headers: Record<string, string>, body: null) => [number, string | Uint8Array | null], maxBytes?: number): { did: string; url: string; method_id: string; key_id: string; public_key: string; };
+export declare function multibaseEd25519(raw: Uint8Array, multicodec?: boolean): string;
+export declare const AuthorityAnchor: { readonly SUPPORTED_KINDS: readonly string[]; isValidKind(kind: string): boolean; };
 export declare function createKyaChallenge(params: {
   owner: string;
   identity: KyaIdentity;
@@ -1032,6 +1038,54 @@ export declare function verifyEnvelopeSignature(envelope: Envelope, publicKey: C
 
 export declare function scanText(text: string, options?: { source?: string; now?: number }): ShieldVerdict;
 
+export declare const MEMORY_SCHEMA: string;
+export declare const REVOCATION_SCHEMA: string;
+
+export declare class MemoryRejected extends Error {
+  readonly code: string;
+}
+
+export interface MemoryShieldStamp {
+  verdict: string;
+  reason_codes: string[];
+  receipt: unknown;
+}
+
+export interface MemoryEntry {
+  schema: string;
+  id: string;
+  text: string;
+  origin: string;
+  kind: "data" | "instruction";
+  treat_as: "data" | "instruction";
+  actor: string;
+  source: string;
+  source_epoch: number;
+  at: number;
+  shield: MemoryShieldStamp | null;
+  flagged: boolean;
+}
+
+export interface MemoryRevocation {
+  schema: string;
+  source: string;
+  epoch: number;
+  actor: string;
+  reason: string;
+  at: number;
+  removed: number;
+}
+
+export declare class MemoryGuard {
+  constructor(store: { entries?: MemoryEntry[]; revocations?: Record<string, MemoryRevocation>; purges?: unknown[] }, ensemble?: unknown, intel?: unknown);
+  revokedEpoch(source: string): number | null;
+  purgeSource(source: string, actor: string, reason: string, now?: number, epoch?: number): MemoryRevocation;
+  write(text: string, origin: string, actor: string, kind?: "data" | "instruction", source?: string, sourceEpoch?: number, now?: number): MemoryEntry;
+  recall(kinds?: Array<"data" | "instruction">, origins?: string[] | null, includeFlagged?: boolean): MemoryEntry[];
+  instructions(): MemoryEntry[];
+  purgeOrigin(origin: string, actor: string, reason: string): number;
+}
+
 export declare const TASK_EXPORT_SCHEMA: string;
 
 export declare function taskTrustLine(task: Record<string, unknown>, row: Record<string, unknown> | null): string;
@@ -1552,8 +1606,8 @@ export interface TaskInboxOptions {
   ensemble?: null | undefined;
   intel?: null | undefined;
   requirePlanDiff?: true;
-  replayStore?: null | undefined;
-  replay_store?: null | undefined;
+  replayStore?: { consume(key: string, expiresAt: number, now?: number): boolean | Promise<boolean> } | null;
+  replay_store?: { consume(key: string, expiresAt: number, now?: number): boolean | Promise<boolean> } | null;
 }
 
 export declare class IntakeRejected extends Error {
@@ -1614,6 +1668,10 @@ export declare class TaskInbox {
   }): TaskInboxTask;
   clearReview(taskId: string, actor: string, reason: string, now?: number): TaskInboxTask;
   clearReview(input: { taskId: string; actor: string; reason: string; now?: number }): TaskInboxTask;
+  getPolicy(): Record<string, any> | null;
+  setPolicy(policy: Record<string, any>): Record<string, any>;
+  quoteFor(identity: { kind: string; value: string }, now?: number): Record<string, any> | null;
+  applyPayment(identity: { kind: string; value: string }, receipt: Record<string, any>, ownerPublicKey: CryptoKeyInput, quoteBody?: Record<string, any> | null, actor?: string, now?: number): Promise<Record<string, any>>;
   recordPlanDiff(taskId: string, before: any[], after: any[], actor: string,
     authorized?: string[], now?: number): Record<string, any>;
   recordPlanDiff(input: {
@@ -1624,6 +1682,19 @@ export declare class TaskInbox {
     authorized?: string[];
     now?: number;
   }): Record<string, any>;
+  getPolicy(): Record<string, any> | null;
+  setPolicy(policy: Record<string, any>): Record<string, any>;
+  applyX402Payment(
+    identity: { kind: string; value: string },
+    demand: Record<string, any>,
+    receipt: Record<string, any>,
+    publicKey: CryptoKeyInput,
+    chainVerifier: { verifyPayment?: (demand: Record<string, any>, receipt: Record<string, any>) => Promise<Record<string, any>> | Record<string, any>; verify_payment?: (demand: Record<string, any>, receipt: Record<string, any>) => Promise<Record<string, any>> | Record<string, any> } | ((demand: Record<string, any>, receipt: Record<string, any>) => Promise<Record<string, any>> | Record<string, any>),
+    replayStore?: { reserve: Function; commit: Function; release: Function } | null,
+    minimumConfirmations?: number,
+    actor?: string,
+    now?: number,
+  ): Promise<Record<string, any>>;
   expireStale(now?: number): string[];
   verifyAuditChain(taskId: string): boolean;
 }

package/js/index.js

@@ -86,6 +86,12 @@ module.exports = {
   X402_FETCH_BOUNDS: discovery.X402_FETCH_BOUNDS,
   keyId: trust.keyId,
   createKyaChallenge: trust.createKyaChallenge,
+  AuthorityAnchor: trust.AuthorityAnchor,
+  DidResolutionError: trust.DidResolutionError,
+  didWebForHost: trust.didWebForHost,
+  didWebUrl: trust.didWebUrl,
+  resolveDidWeb: trust.resolveDidWeb,
+  multibaseEd25519: trust.multibaseEd25519,
   verifyKyaChallenge: trust.verifyKyaChallenge,
   completeKyaChallenge: trust.completeKyaChallenge,
   verifyKyaBinding: trust.verifyKyaBinding,
@@ -154,6 +160,10 @@ module.exports = {
   exportTask: comm.exportTask,
   taskTrustLine: comm.taskTrustLine,
   scanText: shield.scanText,
+  MEMORY_SCHEMA: shield.MEMORY_SCHEMA,
+  REVOCATION_SCHEMA: shield.REVOCATION_SCHEMA,
+  MemoryGuard: shield.MemoryGuard,
+  MemoryRejected: shield.MemoryRejected,
   PLANDIFF_SCHEMA: shield.PLANDIFF_SCHEMA,
   PLANDIFF_AUTHORITIES: shield.PLANDIFF_AUTHORITIES,
   PLANDIFF_CONSEQUENTIAL: shield.PLANDIFF_CONSEQUENTIAL,

package/js/index.mjs

@@ -15,6 +15,7 @@ export const AGENT_CARD_SCHEMA = api.AGENT_CARD_SCHEMA;
 export const AI_EXPOSURE_SCHEMA = api.AI_EXPOSURE_SCHEMA;
 export const APPEAL_SCHEMA = api.APPEAL_SCHEMA;
 export const AUTHORITY_AMBIGUOUS = api.AUTHORITY_AMBIGUOUS;
+export const AuthorityAnchor = api.AuthorityAnchor;
 export const AuthorizationLeaseError = api.AuthorizationLeaseError;
 export const BUNDLE_MAX_AGE_SECONDS = api.BUNDLE_MAX_AGE_SECONDS;
 export const CARD_CANONICALIZATION = api.CARD_CANONICALIZATION;
@@ -43,6 +44,7 @@ export const DISCLOSURE_STATES = api.DISCLOSURE_STATES;
 export const DISCOVERY_SUMMARY_SCHEMA = api.DISCOVERY_SUMMARY_SCHEMA;
 export const DISCOVERY_VIEW_SCHEMA = api.DISCOVERY_VIEW_SCHEMA;
 export const DenseVector256 = api.DenseVector256;
+export const DidResolutionError = api.DidResolutionError;
 export const DisclosureError = api.DisclosureError;
 export const DiscoveryEvidenceError = api.DiscoveryEvidenceError;
 export const ENTERPRISE_MATRIX_SCHEMA = api.ENTERPRISE_MATRIX_SCHEMA;
@@ -63,6 +65,9 @@ export const InMemoryNonceStore = api.InMemoryNonceStore;
 export const InMemorySignCountStore = api.InMemorySignCountStore;
 export const IntakeRejected = api.IntakeRejected;
 export const MAX_FEDERATED_PENALTY_PER_PEER = api.MAX_FEDERATED_PENALTY_PER_PEER;
+export const MEMORY_SCHEMA = api.MEMORY_SCHEMA;
+export const MemoryGuard = api.MemoryGuard;
+export const MemoryRejected = api.MemoryRejected;
 export const NONCE_RETENTION = api.NONCE_RETENTION;
 export const PLANDIFF_AUTHORITIES = api.PLANDIFF_AUTHORITIES;
 export const PLANDIFF_AUTHORIZED_BY_KIND = api.PLANDIFF_AUTHORIZED_BY_KIND;
@@ -79,6 +84,7 @@ export const REPLAY_FINAL_EXPIRY = api.REPLAY_FINAL_EXPIRY;
 export const REPLAY_RESERVATION_SECONDS = api.REPLAY_RESERVATION_SECONDS;
 export const REPUTATION_BUNDLE_SCHEMA = api.REPUTATION_BUNDLE_SCHEMA;
 export const REPUTATION_HALF_LIFE_SECONDS = api.REPUTATION_HALF_LIFE_SECONDS;
+export const REVOCATION_SCHEMA = api.REVOCATION_SCHEMA;
 export const SETTLEMENT_RECEIPT_SCHEMA = api.SETTLEMENT_RECEIPT_SCHEMA;
 export const SOVEREIGN_CARD_SCHEMA = api.SOVEREIGN_CARD_SCHEMA;
 export const STALE_AFTER = api.STALE_AFTER;
@@ -153,6 +159,8 @@ export const descriptorBody = api.descriptorBody;
 export const descriptorBytes = api.descriptorBytes;
 export const descriptorDigest = api.descriptorDigest;
 export const descriptorEtag = api.descriptorEtag;
+export const didWebForHost = api.didWebForHost;
+export const didWebUrl = api.didWebUrl;
 export const diffPlans = api.diffPlans;
 export const disclose = api.disclose;
 export const disclosureStateOf = api.disclosureStateOf;
@@ -188,6 +196,7 @@ export const maxTierFor = api.maxTierFor;
 export const mayClaim = api.mayClaim;
 export const mayDeny = api.mayDeny;
 export const migrateCardToEmit = api.migrateCardToEmit;
+export const multibaseEd25519 = api.multibaseEd25519;
 export const normalizeAction = api.normalizeAction;
 export const normalizeAiExposure = api.normalizeAiExposure;
 export const normalizeCounterpartyStore = api.normalizeCounterpartyStore;
@@ -207,6 +216,7 @@ export const receiptForRecord = api.receiptForRecord;
 export const recordExecutionOutcome = api.recordExecutionOutcome;
 export const resolveAppeal = api.resolveAppeal;
 export const resolveDeclarationEndpoints = api.resolveDeclarationEndpoints;
+export const resolveDidWeb = api.resolveDidWeb;
 export const resolveDocumentPath = api.resolveDocumentPath;
 export const scanText = api.scanText;
 export const signA2AAgentCard = api.signA2AAgentCard;

package/js/internal/comm.js

@@ -2,6 +2,7 @@
 const core = require("./core.js");
 const shield = require("./shield.js");
 const trust = require("./trust.js");
+const settlement = require("./settlement.js");
 
 const commCounterparty = require("../comm/counterparty.js");
 function envelopeBuilderNumber(value, code) {
@@ -684,7 +685,7 @@ function taskAudit(task, state, actor, reason, at, receipt = null) {
     task.history.push(entry);
     task.audit_head = entry.digest;
 }
-const TASK_INBOX_UNSUPPORTED_OPTIONS = Object.freeze(["ensemble", "intel", "replayStore", "replay_store"]);
+const TASK_INBOX_UNSUPPORTED_OPTIONS = Object.freeze(["ensemble", "intel"]);
 const TASK_INBOX_UNSUPPORTED_OPTION_SET = new Set(TASK_INBOX_UNSUPPORTED_OPTIONS);
 function taskInboxUnsupportedOption(name) {
     const error = new core.ProtocolError("inbox_option_not_supported");
@@ -715,6 +716,90 @@ function taskInboxCopyOwnEnumerableOptions(target, source) {
         }
     }
 }
+function x402Demand(value) {
+    const source = core.isPlainObject(value) ? value : {};
+    return {
+        schema: source.schema || "twin3-settlement-demand-v1",
+        demand_id: String(source.demand_id || ""),
+        recipient: String(source.recipient || ""),
+        amount: source.amount,
+        currency: source.currency || "USD",
+        network: source.network || "base",
+        token_address: source.token_address == null ? null : source.token_address,
+        expires_at: source.expires_at,
+        memo: source.memo || "",
+    };
+}
+function x402Receipt(value) {
+    const source = core.isPlainObject(value) ? value : {};
+    return {
+        schema: source.schema || "twin3-settlement-receipt-v1",
+        demand_id: String(source.demand_id || ""),
+        tx_hash: String(source.tx_hash || ""),
+        payer: String(source.payer || ""),
+        amount: source.amount,
+        currency: String(source.currency || ""),
+        settled_at: source.settled_at,
+        recipient: String(source.recipient || ""),
+        signature: String(source.signature || ""),
+        public_key: source.public_key == null ? null : source.public_key,
+        network: source.network || "base",
+    };
+}
+function x402JournalDigest(journal) {
+    return core.crypto.createHash("sha256")
+        .update(core.legacySortedBytes({ binding: journal.binding, context: journal.context, credit: journal.credit }, "payment_journal_unserializable"))
+        .digest("hex");
+}
+function x402SameCanonical(left, right) {
+    return core.legacySortedBytes(left, "payment_journal_unserializable")
+        .equals(core.legacySortedBytes(right, "payment_journal_unserializable"));
+}
+function x402Context(policy, row) {
+    const source = row || {};
+    return {
+        policy,
+        kya_binding: source.kya_binding == null ? null : source.kya_binding,
+        key_possession_verified: Boolean(source.key_possession_verified),
+        bound_key_id: source.bound_key_id == null ? null : source.bound_key_id,
+        bound_public_key: source.bound_public_key == null ? null : source.bound_public_key,
+        handshake_receipt: source.handshake_receipt == null ? null : source.handshake_receipt,
+        bound_wallet: source.bound_wallet == null ? null : source.bound_wallet,
+    };
+}
+function x402BindingError(row) {
+    const binding = row && row.kya_binding;
+    if (!core.pythonTruthy(row && row.key_possession_verified) || !core.isPlainObject(binding))
+        return "payment_current_binding_required";
+    if (binding.key_id !== row.bound_key_id || binding.public_key !== row.bound_public_key || binding.receipt !== row.handshake_receipt)
+        return "payment_current_binding_mismatch";
+    return null;
+}
+function x402ChainAdapter(chainVerifier, demand, receipt) {
+    return {
+        async verifyPayment() {
+            const method = typeof chainVerifier === "function"
+                ? chainVerifier
+                : (chainVerifier && (chainVerifier.verifyPayment || chainVerifier.verify_payment));
+            if (typeof method !== "function")
+                core.fail("chain_verifier_invalid");
+            const evidence = await method.call(chainVerifier, demand, receipt);
+            if (!evidence || typeof evidence !== "object")
+                return evidence;
+            return {
+                txHash: evidence.txHash || evidence.tx_hash,
+                network: evidence.network,
+                payer: evidence.payer,
+                recipient: evidence.recipient,
+                amount: evidence.amount,
+                currency: evidence.currency,
+                confirmations: evidence.confirmations,
+                finalized: evidence.finalized,
+                tokenAddress: evidence.tokenAddress || evidence.token_address,
+            };
+        },
+    };
+}
 class TaskInbox {
     constructor(...args) {
         if (args.length > 4) {
@@ -770,6 +855,10 @@ class TaskInbox {
         if (!Number.isFinite(this._rateWindow))
             throw new core.ProtocolError("rate_window_invalid");
         this._requirePlanDiff = true;
+        const replay = options.replay_store !== undefined && options.replay_store !== null
+            ? options.replay_store
+            : (options.replayStore !== undefined && options.replayStore !== null ? options.replayStore : null);
+        this._nonceStore = replay;
     }
     _now(override) { return taskNow(this._clock, override); }
     _partition() {
@@ -803,6 +892,254 @@ class TaskInbox {
         part.rate[senderKey].push(at);
         return true;
     }
+    getPolicy() {
+        const policy = this._partition().policy;
+        if (!policy)
+            return null;
+        return structuredClone(policy);
+    }
+    setPolicy(policy) {
+        const normalized = settlement.normalizePolicy(policy);
+        this._partition().policy = normalized;
+        return structuredClone(normalized);
+    }
+    async applyX402Payment(identity, demand, receipt, publicKey, chainVerifier, replayStore = undefined, minimumConfirmations = 1, actor = "x402", now = undefined) {
+        const at = this._now(now);
+        if (typeof at !== "number" || !Number.isFinite(at))
+            core.fail("verification_time_invalid");
+        identity = structuredClone(identity);
+        this._parties.ensure(identity, { now: at });
+        if (this._parties.isFrozen(identity))
+            core.fail("counterparty_frozen");
+        this._parties.assertAccessReady(identity, { now: at });
+        const store = replayStore != null ? replayStore : this._nonceStore;
+        if (store == null)
+            core.fail("payment_replay_store_required");
+        const policy = this.getPolicy();
+        if (!policy)
+            core.fail("payment_policy_not_configured");
+        demand = x402Demand(demand);
+        receipt = x402Receipt(receipt);
+        const payout = String(policy.payout_address || "").trim();
+        if (!payout)
+            core.fail("payment_payout_address_required");
+        if (demand.recipient.trim().toLowerCase() !== payout.toLowerCase())
+            core.fail("payment_demand_recipient_mismatch");
+        const price = core.isPlainObject(policy.price) ? policy.price : {};
+        if (Number(demand.amount) < Number(price.amount || 0))
+            core.fail("payment_demand_amount_insufficient");
+        const policyCurrency = String(price.currency || "").trim().toUpperCase();
+        if (!policyCurrency || demand.currency.toUpperCase() !== policyCurrency)
+            core.fail("payment_demand_currency_mismatch");
+        const partyRow = this._parties.get(identity, { now: at }) || {};
+        const boundWallet = String(partyRow.bound_wallet || "").trim().toLowerCase();
+        const payer = receipt.payer.trim().toLowerCase();
+        const senderValue = String(identity.value || "").trim().toLowerCase();
+        const senderKey = counterpartyKey(identity).toLowerCase();
+        if (boundWallet) {
+            if (payer !== boundWallet)
+                core.fail("payment_payer_mismatch");
+        }
+        else if (payer !== senderValue && payer !== senderKey) {
+            core.fail("payment_payer_mismatch");
+        }
+        const part = this._partition();
+        if (!core.isPlainObject(part.payment_journal))
+            part.payment_journal = {};
+        const journalBook = part.payment_journal;
+        const txHash = receipt.tx_hash.toLowerCase();
+        if (!publicKey)
+            core.fail("trusted_receipt_public_key_required");
+        let issuerKey;
+        try {
+            issuerKey = core.exportEd25519PublicKey(publicKey);
+        }
+        catch (error) {
+            core.fail("receipt_signature_invalid", error);
+        }
+        const binding = {
+            owner: this._owner,
+            identity_key: counterpartyKey(identity),
+            demand,
+            receipt,
+            issuer_public_key: issuerKey,
+            minimum_confirmations: minimumConfirmations,
+        };
+        const existingKey = Object.prototype.hasOwnProperty.call(journalBook, receipt.tx_hash) ? receipt.tx_hash : txHash;
+        if (Object.prototype.hasOwnProperty.call(journalBook, existingKey)) {
+            const journal = journalBook[existingKey];
+            let valid = false;
+            try {
+                valid = journal.schema === "twin3-x402-credit-journal-v1"
+                    && journal.binding_digest === x402JournalDigest(journal)
+                    && (journal.status === "pending_credit" || journal.status === "credited");
+            }
+            catch {
+                valid = false;
+            }
+            if (!valid)
+                core.fail("payment_journal_incomplete");
+            if (!x402SameCanonical(journal.binding, binding))
+                core.fail("payment_journal_binding_mismatch");
+            if (journal.status === "credited")
+                core.fail("payment_receipt_replayed");
+            return this._creditX402Journal(journal, at);
+        }
+        const bindingError = x402BindingError(partyRow);
+        if (bindingError)
+            throw new TierTransitionError(bindingError);
+        const splitAt = binding.identity_key.indexOf(":");
+        const journal = {
+            schema: "twin3-x402-credit-journal-v1",
+            binding,
+            context: x402Context(policy, partyRow),
+            credit: {
+                identity: { kind: binding.identity_key.slice(0, splitAt), value: binding.identity_key.slice(splitAt + 1) },
+                receipt: {
+                    payment_id: `x402:${demand.network.toLowerCase()}:${txHash}`,
+                    quote_id: demand.demand_id,
+                    amount: String(receipt.amount),
+                    currency: receipt.currency,
+                    reference: receipt.tx_hash,
+                    paid_at: receipt.settled_at,
+                },
+                tier_seconds: core.pythonInt(policy.paid_tier_seconds, "paid_tier_seconds_invalid"),
+                actor: String(actor),
+                at,
+            },
+            status: "pending_credit",
+        };
+        journal.binding_digest = x402JournalDigest(journal);
+        await settlement.verifyX402Payment({
+            demandAmount: demand.amount,
+            receiptAmount: receipt.amount,
+            demandRecipient: demand.recipient,
+            receiptRecipient: receipt.recipient,
+            demandCurrency: demand.currency,
+            receiptCurrency: receipt.currency,
+            demandNetwork: demand.network,
+            receiptNetwork: receipt.network,
+            txHash: receipt.tx_hash,
+            payer: receipt.payer,
+            signature: receipt.signature,
+            demandId: demand.demand_id,
+            receiptDemandId: receipt.demand_id,
+            settledAt: receipt.settled_at,
+            trustedPublicKey: issuerKey,
+            demandExpiresAt: demand.expires_at,
+            demandSchema: demand.schema,
+            receiptSchema: receipt.schema,
+            tokenAddress: demand.token_address || undefined,
+            now: at,
+            chainVerifier: x402ChainAdapter(chainVerifier, demand, receipt),
+            replayStore: store,
+            minimumConfirmations,
+        });
+        journalBook[txHash] = journal;
+        return this._creditX402Journal(journal, at);
+    }
+    _creditX402Journal(journal, at) {
+        const credit = journal.credit;
+        const identity = credit.identity;
+        const current = this._parties.get(identity, { now: at }) || {};
+        if (current.frozen)
+            core.fail("counterparty_frozen");
+        this._parties.assertAccessReady(identity, { now: at });
+        if (!x402SameCanonical(journal.context, x402Context(this.getPolicy(), current)))
+            core.fail("payment_recovery_pending");
+        const originalEnd = credit.at + credit.tier_seconds;
+        for (const entry of this._parties.ledger(identity)) {
+            if (entry.kind === "payment" && entry.payment_id === credit.receipt.payment_id) {
+                const drifted = ["quote_id", "amount", "currency", "reference"].some((key) => entry[key] !== credit.receipt[key]);
+                if (drifted || typeof entry.paid_until !== "number" || !Number.isFinite(entry.paid_until) || entry.paid_until > originalEnd)
+                    core.fail("payment_recovery_pending");
+                journal.status = "credited";
+                journal.credited_at = entry.at;
+                return current;
+            }
+        }
+        const remaining = Math.floor(originalEnd - at);
+        if (at < credit.at || remaining <= 0)
+            core.fail("payment_recovery_pending");
+        const row = this._parties.recordPayment(identity, structuredClone(credit.receipt), remaining, credit.actor, { now: at });
+        journal.status = "credited";
+        journal.credited_at = at;
+        return row;
+    }
+    quoteFor(identity, now = undefined) {
+        const at = this._now(now);
+        this._parties.ensure(identity, { now: at });
+        if (this._parties.isFrozen(identity))
+            core.fail("counterparty_frozen");
+        this._parties.assertAccessReady(identity, { now: at });
+        const policy = this._partition().policy;
+        if (!policy)
+            return null;
+        const offer = settlement.quoteForCounterparty(policy, this._parties.get(identity, { now: at }), { now: at });
+        if (offer && core.isPlainObject(offer) && offer.quote_id) {
+            const part = this._partition();
+            if (!core.isPlainObject(part.quotes))
+                part.quotes = {};
+            part.quotes[offer.quote_id] = structuredClone(offer);
+        }
+        return offer;
+    }
+    async applyPayment(identity, receipt, ownerPublicKey, quoteBody = undefined, actor = "billing", now = undefined) {
+        void quoteBody;
+        const at = this._now(now);
+        this._parties.ensure(identity, { now: at });
+        if (this._parties.isFrozen(identity))
+            core.fail("counterparty_is_frozen");
+        this._parties.assertAccessReady(identity, { now: at });
+        const policy = this.getPolicy();
+        const partyRow = this._parties.get(identity, { now: at });
+        if (partyRow && !partyRow.verified)
+            core.fail("unverified_identity_cannot_pay");
+        if (partyRow && core.isPlainObject(receipt)) {
+            for (const entry of Array.isArray(partyRow.ledger) ? partyRow.ledger : []) {
+                if (entry.kind !== "payment")
+                    continue;
+                const match = (core.pythonTruthy(receipt.receipt_id) && entry.receipt_id === receipt.receipt_id)
+                    || (core.pythonTruthy(receipt.signature) && core.secureEquals(entry.signature, receipt.signature))
+                    || (core.pythonTruthy(receipt.quote_id) && core.pythonTruthy(receipt.reference)
+                        && entry.quote_id === receipt.quote_id && entry.reference === receipt.reference);
+                if (match)
+                    return this._parties.recordPayment(identity, receipt, 0, actor, { now: at });
+            }
+        }
+        if (!policy)
+            core.fail("payment_policy_not_configured");
+        const quoteId = core.isPlainObject(receipt) ? receipt.quote_id : null;
+        let canonical = null;
+        if (core.pythonTruthy(quoteId)) {
+            const quotes = this._partition().quotes;
+            canonical = core.isPlainObject(quotes) ? quotes[quoteId] : null;
+            if (canonical == null)
+                core.fail("quote_not_found");
+        }
+        const verified = settlement.verifyReceipt({
+            receipt,
+            ownerPublicKey,
+            owner: this._owner,
+            identity,
+            quote: canonical,
+            now: at,
+        });
+        const grantsSeconds = canonical && canonical.grants_seconds != null
+            ? core.pythonInt(canonical.grants_seconds, "grants_seconds_invalid")
+            : core.pythonInt(policy.paid_tier_seconds, "paid_tier_seconds_invalid");
+        const receiptId = core.pythonTruthy(verified.receipt_id)
+            ? verified.receipt_id
+            : (core.pythonTruthy(verified.quote_id) && core.pythonTruthy(verified.reference)
+                ? `${verified.quote_id}:${verified.reference}`
+                : verified.signature);
+        if (this._nonceStore != null && core.pythonTruthy(receiptId)) {
+            const consumed = await this._nonceStore.consume(`offchain:${this._owner}:${receiptId}`, at + grantsSeconds, at);
+            if (!consumed)
+                return this._parties.recordPayment(identity, verified, 0, actor, { now: at });
+        }
+        return this._parties.recordPayment(identity, verified, grantsSeconds, actor, { now: at });
+    }
     _nonceCheck(part, senderKey, nonce, deadline, at) {
         const seen = part.nonces;
         for (const key of Object.keys(seen)) {
@@ -879,7 +1216,30 @@ class TaskInbox {
             throw new IntakeRejected("sender_unverified_pinned_to_G0");
         }
         if ((TASK_TIER_ORDER[tier] ?? 0) < TASK_TIER_ORDER[requestedTier]) {
-            throw new IntakeRejected(`sender_tier_${tier}_below_${requestedTier}`);
+            const policy = part.policy;
+            if (policy && tier === "G0") {
+                let offer;
+                try {
+                    offer = settlement.quoteForCounterparty(policy, this._parties.get(sender, { now: at }), { now: at });
+                }
+                catch (error) {
+                    throw new IntakeRejected(taskErrorCode(error, "payment_required"), null, null, error);
+                }
+                if (offer && offer.free_allowance) {
+                    this._parties.noteFreeAllowanceUse(sender, { now: at });
+                    tier = "G1";
+                }
+                else if (offer) {
+                    if (core.isPlainObject(offer) && offer.quote_id) {
+                        if (!core.isPlainObject(part.quotes))
+                            part.quotes = {};
+                        part.quotes[offer.quote_id] = structuredClone(offer);
+                    }
+                    throw new IntakeRejected("payment_required", null, offer);
+                }
+            }
+            if ((TASK_TIER_ORDER[tier] ?? 0) < TASK_TIER_ORDER[requestedTier])
+                throw new IntakeRejected(`sender_tier_${tier}_below_${requestedTier}`);
         }
         let signatureVerified = false;
         let bound;

package/js/memory-guard.js

@@ -0,0 +1,173 @@
+"use strict";
+
+const crypto = require("crypto");
+const shield = require("./internal/shield.js");
+
+const MEMORY_SCHEMA = "twin3-shield-memory-entry-v1";
+const REVOCATION_SCHEMA = "twin3-shield-memory-revocation-v1";
+const ORIGINS = new Set(["owner", "system", "counterparty", "tool", "web", "file", "subagent"]);
+const INSTRUCTION_ORIGINS = new Set(["owner", "system"]);
+
+class MemoryRejected extends Error {
+  constructor(code) {
+    super(code);
+    this.name = "MemoryRejected";
+    this.code = code;
+  }
+}
+
+function reject(code) {
+  throw new MemoryRejected(code);
+}
+
+function requireStore(store) {
+  if (store == null || typeof store !== "object" || Array.isArray(store)) reject("memory_store_required");
+  if (!Object.prototype.hasOwnProperty.call(store, "entries")) store.entries = [];
+  return store;
+}
+
+function isNonnegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+
+function legacySortedJson(value) {
+  const ordered = {};
+  for (const key of Object.keys(value).sort()) ordered[key] = value[key];
+  return Buffer.from(JSON.stringify(ordered));
+}
+
+function clone(value) {
+  return structuredClone(value);
+}
+
+class MemoryGuard {
+  constructor(store, ensemble = null, intel = null) {
+    if (ensemble != null || intel != null) reject("memory_scanner_unsupported");
+    this._store = requireStore(store);
+  }
+
+  _revocations() {
+    if (!Object.prototype.hasOwnProperty.call(this._store, "revocations") || this._store.revocations == null)
+      this._store.revocations = {};
+    return this._store.revocations;
+  }
+
+  revokedEpoch(source) {
+    const entry = this._revocations()[source == null ? "" : String(source)];
+    return entry ? entry.epoch : null;
+  }
+
+  _isRevoked(source, sourceEpoch) {
+    const revoked = this.revokedEpoch(source);
+    if (revoked == null) return false;
+    const epoch = sourceEpoch == null || sourceEpoch === false ? 0 : sourceEpoch;
+    return Number(epoch) <= Number(revoked);
+  }
+
+  purgeSource(source, actor, reason, now = undefined, epoch = undefined) {
+    const at = now == null ? Math.floor(Date.now() / 1000) : Math.trunc(Number(now));
+    source = source == null ? "" : String(source);
+    if (!source.trim()) reject("memory_source_required");
+    if (epoch !== undefined && !isNonnegativeInteger(epoch)) reject("memory_revocation_epoch_invalid");
+    const current = this.revokedEpoch(source);
+    if (epoch === undefined) epoch = current == null ? 1 : current + 1;
+    if (current != null && epoch <= current) reject("memory_revocation_not_monotonic");
+    const revocations = this._revocations();
+    revocations[source] = {
+      schema: REVOCATION_SCHEMA,
+      source,
+      epoch,
+      actor: actor == null ? "" : String(actor),
+      reason: reason == null ? "" : String(reason),
+      at,
+    };
+    const before = this._store.entries.length;
+    this._store.entries = this._store.entries.filter(
+      (entry) => !(String(entry.source || "") === source && this._isRevoked(source, entry.source_epoch)),
+    );
+    revocations[source].removed = before - this._store.entries.length;
+    return clone(revocations[source]);
+  }
+
+  write(text, origin, actor, kind = "data", source = "", sourceEpoch = 0, now = undefined) {
+    const at = now == null ? Math.floor(Date.now() / 1000) : Math.trunc(Number(now));
+    if (!ORIGINS.has(origin)) reject("memory_origin_unknown");
+    if (kind !== "data" && kind !== "instruction") reject("memory_kind_unknown");
+    if (kind === "instruction" && !INSTRUCTION_ORIGINS.has(origin)) reject("external_origin_cannot_write_instruction");
+    if (typeof text !== "string" || !text.trim()) reject("memory_text_required");
+    if (!isNonnegativeInteger(sourceEpoch)) reject("memory_source_epoch_invalid");
+    if (this._isRevoked(source, sourceEpoch)) reject("memory_source_revoked");
+    let verdict = null;
+    if (!INSTRUCTION_ORIGINS.has(origin)) {
+      const scanned = shield.scanText(text, { source: `memory:${origin}`, now: at });
+      verdict = scanned;
+      if (scanned.verdict === "block") reject("memory_blocked:" + scanned.reason_codes.join(","));
+    }
+    const storedSource = source == null ? "" : String(source);
+    const entry = {
+      schema: MEMORY_SCHEMA,
+      id: "mem_" + crypto.createHash("sha256").update(legacySortedJson({
+        t: text,
+        o: origin,
+        at,
+        n: this._store.entries.length,
+      })).digest("hex").slice(0, 20),
+      text,
+      origin,
+      kind,
+      treat_as: kind === "instruction" ? "instruction" : "data",
+      actor: actor == null ? "" : String(actor),
+      source: storedSource,
+      source_epoch: sourceEpoch,
+      at,
+      shield: verdict
+        ? { verdict: verdict.verdict, reason_codes: verdict.reason_codes, receipt: verdict.receipt }
+        : null,
+      flagged: Boolean(verdict && verdict.verdict === "flag"),
+    };
+    this._store.entries.push(entry);
+    return clone(entry);
+  }
+
+  recall(kinds = ["data", "instruction"], origins = null, includeFlagged = false) {
+    const allowed = new Set(kinds);
+    const originFilter = origins == null ? null : new Set(origins);
+    const out = [];
+    for (const entry of this._store.entries) {
+      if (!allowed.has(entry.kind)) continue;
+      if (this._isRevoked(entry.source, entry.source_epoch)) continue;
+      if (originFilter && !originFilter.has(entry.origin)) continue;
+      if (entry.flagged && !includeFlagged) continue;
+      const item = clone(entry);
+      if (!INSTRUCTION_ORIGINS.has(item.origin)) item.treat_as = "data";
+      out.push(item);
+    }
+    return out;
+  }
+
+  instructions() {
+    return this.recall(["instruction"]).filter((entry) => INSTRUCTION_ORIGINS.has(entry.origin));
+  }
+
+  purgeOrigin(origin, actor, reason) {
+    const before = this._store.entries.length;
+    this._store.entries = this._store.entries.filter((entry) => entry.origin !== origin);
+    const removed = before - this._store.entries.length;
+    if (!Object.prototype.hasOwnProperty.call(this._store, "purges")) this._store.purges = [];
+    this._store.purges.push({
+      origin,
+      actor: String(actor),
+      reason: String(reason),
+      removed,
+      at: Math.floor(Date.now() / 1000),
+    });
+    return removed;
+  }
+}
+
+module.exports = {
+  MEMORY_SCHEMA,
+  REVOCATION_SCHEMA,
+  MemoryGuard,
+  MemoryRejected,
+};

package/js/shield.d.ts

@@ -51,6 +51,10 @@ export {
   planDigest,
   recordExecutionOutcome,
   scanText,
+  MEMORY_SCHEMA,
+  REVOCATION_SCHEMA,
+  MemoryGuard,
+  MemoryRejected,
   toolAuthorityMatches,
   validateToolCatalog,
   verifyAuthorizationLease,

package/js/shield.js

@@ -1,5 +1,6 @@
 "use strict";
 const impl = require("./internal/shield.js");
+const memory = require("./memory-guard.js");
 
 module.exports = {
   AuthorizationLeaseError: impl.authorizationLeaseApi.AuthorizationLeaseError,
@@ -16,6 +17,10 @@ module.exports = {
   createInMemoryExecutionClaimStore: impl.authorizationLeaseApi.createInMemoryExecutionClaimStore,
   recordExecutionOutcome: impl.authorizationLeaseApi.recordExecutionOutcome,
   scanText: impl.scanText,
+  MEMORY_SCHEMA: memory.MEMORY_SCHEMA,
+  REVOCATION_SCHEMA: memory.REVOCATION_SCHEMA,
+  MemoryGuard: memory.MemoryGuard,
+  MemoryRejected: memory.MemoryRejected,
   PLANDIFF_SCHEMA: impl.PLANDIFF_SCHEMA,
   PLANDIFF_AUTHORITIES: impl.AUTHORITIES,
   PLANDIFF_CONSEQUENTIAL: impl.CONSEQUENTIAL,

package/js/shield.mjs

@@ -13,6 +13,10 @@ export const claimExecution = api.claimExecution;
 export const createInMemoryExecutionClaimStore = api.createInMemoryExecutionClaimStore;
 export const recordExecutionOutcome = api.recordExecutionOutcome;
 export const scanText = api.scanText;
+export const MEMORY_SCHEMA = api.MEMORY_SCHEMA;
+export const REVOCATION_SCHEMA = api.REVOCATION_SCHEMA;
+export const MemoryGuard = api.MemoryGuard;
+export const MemoryRejected = api.MemoryRejected;
 export const PLANDIFF_SCHEMA = api.PLANDIFF_SCHEMA;
 export const PLANDIFF_AUTHORITIES = api.PLANDIFF_AUTHORITIES;
 export const PLANDIFF_CONSEQUENTIAL = api.PLANDIFF_CONSEQUENTIAL;

package/js/trust/didweb.js

@@ -0,0 +1,262 @@
+"use strict";
+
+const core = require("../internal/core.js");
+
+const DID_WEB_RE = /^did:web:([A-Za-z0-9.\-]+(?:%3A\d{2,5})?)((?::[A-Za-z0-9._\-%]+)*)$/;
+const NUMERIC_LABEL_RE = /^(?:\d+|0x[0-9a-f]*)$/i;
+const B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+const ANCHOR_KINDS = new Set(["duns", "lei", "human_id", "passkey"]);
+
+class DidResolutionError extends Error {
+  constructor(code) {
+    super(code);
+    this.name = "DidResolutionError";
+    this.code = code;
+  }
+}
+
+function b58decode(text) {
+  let num = 0n;
+  for (const char of String(text)) {
+    const index = B58_ALPHABET.indexOf(char);
+    if (index < 0)
+      throw new DidResolutionError("did_key_invalid:invalid_multibase_key");
+    num = num * 58n + BigInt(index);
+  }
+  let hex = num.toString(16);
+  if (hex.length % 2)
+    hex = "0" + hex;
+  const body = num === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex");
+  const pad = text.length - text.replace(/^1+/, "").length;
+  return Buffer.concat([Buffer.alloc(pad), body]);
+}
+
+function b58encode(raw) {
+  let num = BigInt("0x" + Buffer.from(raw).toString("hex"));
+  let out = "";
+  while (num > 0n) {
+    const rem = num % 58n;
+    num /= 58n;
+    out = B58_ALPHABET[Number(rem)] + out;
+  }
+  let pad = 0;
+  for (const byte of raw) {
+    if (byte !== 0)
+      break;
+    pad += 1;
+  }
+  return "1".repeat(pad) + (out || (raw.length ? "" : ""));
+}
+
+function expandIpv6(text) {
+  const halves = text.toLowerCase().split("::");
+  if (halves.length > 2)
+    return null;
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves.length === 2 ? (halves[1] ? halves[1].split(":") : []) : [];
+  if (halves.length === 1 && left.length !== 8)
+    return null;
+  const missing = 8 - left.length - right.length;
+  if (missing < 0)
+    return null;
+  const parts = [...left, ...Array(missing).fill("0"), ...right];
+  if (parts.length !== 8)
+    return null;
+  const values = [];
+  for (const part of parts) {
+    if (!/^[0-9a-f]{0,4}$/i.test(part))
+      return null;
+    values.push(parseInt(part || "0", 16));
+  }
+  return values;
+}
+
+function forbiddenAddress(text) {
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(text)) {
+    const parts = text.split(".").map((part) => Number(part));
+    if (parts.some((part) => part > 255))
+      return false;
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127 || a >= 224)
+      return true;
+    if (a === 169 && b === 254)
+      return true;
+    if (a === 172 && b >= 16 && b <= 31)
+      return true;
+    if (a === 192 && b === 168)
+      return true;
+    return false;
+  }
+  const hextets = expandIpv6(text);
+  if (!hextets)
+    return false;
+  const first = hextets[0];
+  if (hextets.every((part) => part === 0))
+    return true;
+  if (hextets.slice(0, 7).every((part) => part === 0) && hextets[7] === 1)
+    return true;
+  if ((first & 0xffc0) === 0xfe80)
+    return true;
+  if ((first & 0xfe00) === 0xfc00)
+    return true;
+  if ((first & 0xff00) === 0xff00)
+    return true;
+  return false;
+}
+
+function hostnameOf(host) {
+  if (host.startsWith("[")) {
+    const end = host.indexOf("]");
+    if (end < 1)
+      throw new DidResolutionError("did_host_invalid");
+    return host.slice(1, end);
+  }
+  const colon = host.lastIndexOf(":");
+  if (colon > 0 && host.indexOf(":") === colon && /^\d+$/.test(host.slice(colon + 1)))
+    return host.slice(0, colon);
+  return host;
+}
+
+function refuseNonpublicHost(host) {
+  let name = String(host || "");
+  name = hostnameOf(name);
+  const lowered = name.toLowerCase().replace(/\.+$/, "");
+  if (lowered === "localhost" || lowered.endsWith(".localhost"))
+    throw new DidResolutionError("did_host_forbidden");
+  if (forbiddenAddress(lowered))
+    throw new DidResolutionError("did_host_forbidden");
+  const labels = lowered.split(".");
+  if (NUMERIC_LABEL_RE.test(labels[labels.length - 1] || ""))
+    throw new DidResolutionError("did_host_forbidden");
+}
+
+function didWebForHost(host) {
+  host = String(host || "").trim().toLowerCase().replace(/\/+$/, "");
+  if (!host || host.includes("/") || host.includes(" "))
+    throw new DidResolutionError("did_host_invalid");
+  refuseNonpublicHost(host);
+  return "did:web:" + host;
+}
+
+function didWebUrl(did) {
+  const match = DID_WEB_RE.exec(String(did || "").trim());
+  if (!match)
+    throw new DidResolutionError("did_not_web");
+  const host = decodeURIComponent(match[1]).toLowerCase();
+  const path = match[2].split(":").filter(Boolean).map((part) => decodeURIComponent(part));
+  if (path.some((part) => part === "" || part === "." || part === ".."))
+    throw new DidResolutionError("did_path_invalid");
+  refuseNonpublicHost(host);
+  if (path.length)
+    return "https://" + host + "/" + path.map((part) => encodeURIComponent(part)).join("/") + "/did.json";
+  return "https://" + host + "/.well-known/did.json";
+}
+
+function rawEd25519(multibase) {
+  const text = String(multibase || "");
+  if (!text.startsWith("z"))
+    throw new DidResolutionError("did_key_invalid:public_key_format_unknown");
+  let raw = b58decode(text.slice(1));
+  if (raw.length === 34 && raw[0] === 0xed && raw[1] === 0x01)
+    raw = raw.subarray(2);
+  if (raw.length !== 32)
+    throw new DidResolutionError("did_key_invalid:invalid_ed25519_public_key_length");
+  return raw;
+}
+
+function keyFromMethod(method) {
+  const kind = String(method.type || "");
+  try {
+    if (kind === "Ed25519VerificationKey2020" && method.publicKeyMultibase)
+      return core.loadEd25519PublicKey("ed25519:" + core.b64url(rawEd25519(method.publicKeyMultibase)));
+    if ((kind === "JsonWebKey2020" || kind === "JsonWebKey") && core.isPlainObject(method.publicKeyJwk)) {
+      const jwk = method.publicKeyJwk;
+      if (jwk.kty === "OKP" && jwk.crv === "Ed25519" && jwk.x) {
+        const raw = core.b64urlDecode(String(jwk.x));
+        if (raw.length !== 32)
+          throw new DidResolutionError("did_jwk_invalid");
+        return core.loadEd25519PublicKey("ed25519:" + core.b64url(raw));
+      }
+    }
+  }
+  catch (error) {
+    if (error instanceof DidResolutionError)
+      throw error;
+    throw new DidResolutionError("did_key_invalid:" + (error.code || error.name || "Error"));
+  }
+  return null;
+}
+
+function resolveDidWeb(did, fetch, maxBytes = 64 * 1024) {
+  did = String(did || "").trim();
+  const url = didWebUrl(did);
+  if (typeof fetch !== "function")
+    throw new DidResolutionError("did_resolver_not_configured");
+  let status;
+  let body;
+  try {
+    [status, body] = fetch("GET", url, { Accept: "application/did+json, application/json" }, null);
+  }
+  catch (error) {
+    throw new DidResolutionError("did_fetch_failed:" + (error && error.name ? error.name : "Error"));
+  }
+  if (status !== 200)
+    throw new DidResolutionError("did_http_" + status);
+  const encoded = body == null ? null : Buffer.from(typeof body === "string" ? body : body);
+  if (encoded == null || encoded.length > maxBytes)
+    throw new DidResolutionError("did_document_too_large");
+  let doc;
+  try {
+    doc = JSON.parse(encoded.toString("utf8"));
+  }
+  catch {
+    throw new DidResolutionError("did_document_invalid_json");
+  }
+  if (!core.isPlainObject(doc) || String(doc.id || "") !== did)
+    throw new DidResolutionError("did_document_id_mismatch");
+  const methods = doc.verificationMethod;
+  if (!Array.isArray(methods) || methods.length === 0)
+    throw new DidResolutionError("did_no_verification_method");
+  for (const method of methods) {
+    if (!core.isPlainObject(method))
+      continue;
+    const controller = String(method.controller || did);
+    if (controller !== did)
+      continue;
+    const key = keyFromMethod(method);
+    if (key) {
+      return {
+        did,
+        url,
+        method_id: String(method.id || ""),
+        key_id: core.keyId(key),
+        public_key: core.exportEd25519PublicKey(key),
+      };
+    }
+  }
+  throw new DidResolutionError("did_no_ed25519_key");
+}
+
+function multibaseEd25519(raw, multicodec = true) {
+  const bytes = Buffer.from(raw);
+  if (bytes.length !== 32)
+    throw new DidResolutionError("invalid_ed25519_public_key_length");
+  const prefixed = multicodec ? Buffer.concat([Buffer.from([0xed, 0x01]), bytes]) : bytes;
+  return "z" + b58encode(prefixed);
+}
+
+const AuthorityAnchor = Object.freeze({
+  SUPPORTED_KINDS: Object.freeze(["duns", "lei", "human_id", "passkey"]),
+  isValidKind(kind) {
+    return ANCHOR_KINDS.has(String(kind || "").trim().toLowerCase());
+  },
+});
+
+module.exports = {
+  DidResolutionError,
+  didWebForHost,
+  didWebUrl,
+  resolveDidWeb,
+  multibaseEd25519,
+  AuthorityAnchor,
+};

package/js/trust.d.ts

@@ -9,6 +9,12 @@ export {
   ExternalSignerErrorCode,
   ExternalSignerError,
   createKyaChallengeWithSigner,
+  AuthorityAnchor,
+  DidResolutionError,
+  didWebForHost,
+  didWebUrl,
+  resolveDidWeb,
+  multibaseEd25519,
   signDelegationWithSigner,
   signEnvelopeWithSigner,
   ChallengeStore,

package/js/trust.js

@@ -3,6 +3,7 @@ const core = require("./internal/core.js");
 const impl = require("./internal/trust.js");
 const comm = require("./internal/comm.js");
 const registration = require("./trust/passkey-registration.js");
+const didweb = require("./trust/didweb.js");
 const externalSigner = require("./trust/external-signer.js")({
   canonicalJsonBuffer: core.canonicalJsonBuffer,
   loadEd25519PublicKey: core.loadEd25519PublicKey,
@@ -23,6 +24,12 @@ module.exports = {
   ...externalSigner,
   keyId: core.keyId,
   createKyaChallenge: impl.createKyaChallenge,
+  AuthorityAnchor: didweb.AuthorityAnchor,
+  DidResolutionError: didweb.DidResolutionError,
+  didWebForHost: didweb.didWebForHost,
+  didWebUrl: didweb.didWebUrl,
+  resolveDidWeb: didweb.resolveDidWeb,
+  multibaseEd25519: didweb.multibaseEd25519,
   verifyKyaChallenge: impl.verifyKyaChallenge,
   completeKyaChallenge: impl.completeKyaChallenge,
   verifyKyaBinding: impl.verifyKyaBinding,

package/js/trust.mjs

@@ -7,6 +7,12 @@ export const signDelegationWithSigner = api.signDelegationWithSigner;
 export const signEnvelopeWithSigner = api.signEnvelopeWithSigner;
 export const keyId = api.keyId;
 export const createKyaChallenge = api.createKyaChallenge;
+export const AuthorityAnchor = api.AuthorityAnchor;
+export const DidResolutionError = api.DidResolutionError;
+export const didWebForHost = api.didWebForHost;
+export const didWebUrl = api.didWebUrl;
+export const resolveDidWeb = api.resolveDidWeb;
+export const multibaseEd25519 = api.multibaseEd25519;
 export const verifyKyaChallenge = api.verifyKyaChallenge;
 export const completeKyaChallenge = api.completeKyaChallenge;
 export const verifyKyaBinding = api.verifyKyaBinding;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twin3-sdk",
-  "version": "0.2.14-pre-alpha",
+  "version": "0.2.15-pre-alpha",
   "description": "Universal Capability Motherboard for Autonomous AI Agents and Self-Sovereign Humans (JS/Node runtime)",
   "type": "commonjs",
   "main": "./js/index.js",
@@ -104,6 +104,7 @@
     "js/matrix.d.ts",
     "js/matrix.js",
     "js/matrix.mjs",
+    "js/memory-guard.js",
     "js/settlement.d.ts",
     "js/settlement.js",
     "js/settlement.mjs",
@@ -112,7 +113,8 @@
     "js/shield.mjs",
     "js/trust.d.ts",
     "js/trust.js",
-    "js/trust.mjs"
+    "js/trust.mjs",
+    "js/trust/didweb.js"
   ],
   "engines": {
     "node": ">=18"