Add typed trust signals client (#142)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 48de598..2cde3c5 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,12 @@
  # Changelog
  
++## 0.102.0 (2026-11-08)
++
++- Add `openvibe-sdk/trust`: `createTrustClient({ networkUrl, getToken })` with `.me()` (the caller's own signals, a
++  person's or a guest's token) and `.of(subject)` (a service token with `identity.trust.read`), the typed
++  `identity.trust@1` result for accounts and guests, and pure helpers (`isNew`, `atLeast`, the age-band order) for Node
++  and the browser bundle. Signals are age bands and aggregate counts only: never an IP, email or last-seen time.
++
  ## 0.101.0 (2026-11-08)
  
  - Add bounded `locker/server.inspectEnvelopePrefix` validation against an actual stored ciphertext byte count.
ddiff --git a/README.md b/README.md
iindex 1effacb..96234a3 100644
---- a/README.md
++++ b/README.md
@@@ -2,7 +2,7 @@
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.101.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.102.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -11,7 +11,7 @@
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.101.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.102.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
@@@ -167,6 +167,7 @@ Until OpenVibe.Tools serves the gateway facade (Tools S6), point the jobs client
  | `openvibe-sdk/auth` | server (browser build: PKCE only) | `createServiceTokenClient()` (+ `getTokenInfo()`), `createNetworkKeys()`, `verifyUserToken()`, `verifyAppToken()`, `verifyServiceToken()`, `exchangeCode()`, `refreshUserToken()`; `startAuthorization()`, `buildAuthorizeUrl()`, `createPkcePair()`, `readCallback()`, `decodeUnverified()`, `unverifiedClaims()` |
  | `openvibe-sdk/registry` | both | `createRegistryClient(client)`: `services({status})`, `service(id)`, `capabilities({owner})`, `capability(id)`, `namespaces()`, `contracts()`, `topics()`, `domain(host)`, `descriptor()` |
  | `openvibe-sdk/identity` | server | `createIdentityClient(client)`: `resolve({subjectId} \| {system,type,id})`, `resolveBatch({subjectIds} \| {system,type,ids})` |
++| `openvibe-sdk/trust` | both | `createTrustClient({networkUrl, getToken})`: `me()` reads the caller's own account or guest signals; `of(subject)` reads an account or guest with `identity.trust.read`; `isNew(signals, {hours})`, `atLeast(signals, band)`, `AGE_BANDS` |
  | `openvibe-sdk/notifications` | server | `createNotificationsClient(client)`: `push({subjectId \| userId, type, title, message, url, category, priority, …})` through Network (`network.notifications.push`); `{ sent, skipped }` or `{ sent: false, reason: 'unknown_subject' }`; attempted once, the caller retries |
  | `openvibe-sdk/modules` | both | `createModulesClient(client)`: `get`, `put(ns, data, {revision})`, `delete`, `list`, `update(ns, fn)`, `publicGet`; `forSubject.get/put/update` for services |
  | `openvibe-sdk/events` | server | `createEventsClient(client, {source})`: `publish`, `prepare`, `pull`, `iterate`, `get`, `get/setCheckpoint`, `subscriptions.create/list/get/disable/enable` (`subscribe`), `deliveries`, `replay`; `parseDelivery` (v1 and v2, `requireV2`), `verifyDeliveryV2`, `signDeliveryV2`, `signDeliveryHeaders`, `verifyDelivery`, `signDelivery`; developer apps: `createAppEvents(client, {projectId, appId, onBehalfOf?})` (same calls, scoped to `app.<project_key>.*`), `projectKey`, `appSource`; `createOutbox`, `createInbox`, `createPgOutbox`, `createPgInbox`; `createServiceOutbox({db, source, eventsUrl, clientId, clientSecret, eventTypes?, validate?})` (a service's outbox in one call: `emit`/`emitIn` inside the change's transaction, `moderationAction`, `start`/`stop`/`kick`/`status`) |
ddiff --git a/STATUS.json b/STATUS.json
iindex ee7eb5b..6956089 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.101.0",
++  "version": "0.102.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser.js b/browser.js
iindex 66af843..50ba74a 100644
---- a/browser.js
++++ b/browser.js
@@@ -10,6 +10,7 @@ module.exports = {
      auth: require('./src/auth/browser'),
      locker: require('./src/locker'),
      registry: require('./src/registry'),
++    trust: require('./src/trust'),
      modules: require('./src/modules'),
      realtime: require('./src/realtime'),
      media: require('./src/media'),
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 53264bd..6815f56 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,6 +1,6 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.101.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.102.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
--// (auth, locker, registry, modules, realtime, media, community, bot, search, bench, meme, vision, themes, redact, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
++// (auth, locker, registry, trust, modules, realtime, media, community, bot, search, bench, meme, vision, themes, redact, chat, ai, jobs, tools, projects, geo). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
  const __defs = [
  // ── 0: browser.js ──────────────────────────────────────────────────
@@@ -17,23 +17,24 @@ module.exports = {
      auth: __load(8),
      locker: __load(9),
      registry: __load(20),
--    modules: __load(21),
--    realtime: __load(22),
--    media: __load(23),
--    community: __load(25),
--    bot: __load(26),
--    search: __load(27),
--    bench: __load(28),
--    meme: __load(29),
--    vision: __load(30),
--    themes: __load(31),
--    redact: __load(32),
--    chat: __load(33),
--    ai: __load(34),
--    jobs: __load(35),
--    tools: __load(37),
--    projects: __load(38),
--    geo: __load(39),
++    trust: __load(21),
++    modules: __load(22),
++    realtime: __load(23),
++    media: __load(24),
++    community: __load(26),
++    bot: __load(27),
++    search: __load(28),
++    bench: __load(29),
++    meme: __load(30),
++    vision: __load(31),
++    themes: __load(32),
++    redact: __load(33),
++    chat: __load(34),
++    ai: __load(35),
++    jobs: __load(36),
++    tools: __load(38),
++    projects: __load(39),
++    geo: __load(40),
  };
  },
  // ── 1: src/core/index.js ───────────────────────────────────────────
@@@ -48,7 +49,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.101.0';
++const SDK_VERSION = '0.102.0';
  
  module.exports = {
      createClient,
@@@ -2397,7 +2398,65 @@ function createRegistryClient(client, { baseUrl } = {}) {
  
  module.exports = { createRegistryClient };
  },
--// ── 21: src/modules.js ──────────────────────────────────────────────
++// ── 21: src/trust.js ────────────────────────────────────────────────
++function (module, exports) {
++'use strict';
++
++const AGE_BANDS = Object.freeze(['under_1h', 'under_1d', 'under_7d', 'under_30d', '30d_plus']);
++const BAND_INDEX = new Map(AGE_BANDS.map((band, index) => [band, index]));
++
++/** Create a direct OpenVibe.Network trust API client. `.of()` requires identity.trust.read. */
++function createTrustClient({ networkUrl = 'https://openvibe.network', getToken, fetchImpl = globalThis.fetch } = {}) {
++    if (typeof getToken !== 'function') throw new TypeError('createTrustClient: getToken must be a function');
++    if (typeof fetchImpl !== 'function') throw new TypeError('createTrustClient: fetch is not available');
++    const base = String(networkUrl || '').replace(/\/+$/, '');
++    if (!base) throw new TypeError('createTrustClient: networkUrl is required');
++
++    async function read(path) {
++        const token = await getToken();
++        if (!token) throw new TypeError('createTrustClient: getToken returned no token');
++        const response = await fetchImpl(`${base}${path}`, {
++            headers: { Accept: 'application/json', Authorization: `Bearer ${token}` },
++        });
++        const body = await response.json().catch(() => null);
++        if (!response.ok) {
++            const error = new Error(body && (body.detail || body.error) || `Network trust request failed (${response.status})`);
++            error.status = response.status;
++            error.code = body && (body.code || body.error);
++            throw error;
++        }
++        return body;
++    }
++
++    return {
++        me() { return read('/api/v1/me/trust'); },
++        of(subject) {
++            if (typeof subject !== 'string' || !/^(?:usr|gst)_[0-9A-HJKMNP-TV-Z]{26}$/.test(subject)) {
++                throw new TypeError('of: subject must be a usr_… or gst_… id');
++            }
++            return read(`/api/v1/trust/${encodeURIComponent(subject)}`);
++        },
++    };
++}
++
++/** True when the known whole-hour age is below the supplied threshold. */
++function isNew(signals, { hours } = {}) {
++    const limit = Number(hours);
++    if (!Number.isFinite(limit) || limit < 0) throw new TypeError('isNew: hours must be a non-negative number');
++    const age = signals && (signals.kind === 'guest' ? signals.age_hours : signals.account_age_hours);
++    return Number.isFinite(Number(age)) && Number(age) < limit;
++}
++
++/** Compare an age band against the documented youngest-to-oldest order. */
++function atLeast(signals, band) {
++    const target = BAND_INDEX.get(band);
++    const actual = BAND_INDEX.get(signals && signals.age_band);
++    return target !== undefined && actual !== undefined && actual >= target;
++}
++
++module.exports = { createTrustClient, isNew, atLeast, AGE_BANDS };
++},
++// ── 22: src/modules.js ──────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -2476,7 +2535,7 @@ function createModulesClient(client, { baseUrl, maxAttempts = 5 } = {}) {
  
  module.exports = { createModulesClient };
  },
--// ── 22: src/realtime.js ─────────────────────────────────────────────
++// ── 23: src/realtime.js ─────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -2729,7 +2788,7 @@ function createRealtimeClient(client, defaults = {}) {
  
  module.exports = { subscribe, createRealtimeClient, parseSSE, DEFAULT_ORIGIN };
  },
--// ── 23: src/media.js ────────────────────────────────────────────────
++// ── 24: src/media.js ────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -2751,7 +2810,7 @@ function (module, exports) {
   */
  const { isOpenVibeError } = __load(3);
  const { paginate, offsetPager } = __load(7);
--const { createObjectsClient } = __load(24);
++const { createObjectsClient } = __load(25);
  
  const DEFAULT_PUBLIC_ORIGIN = 'https://openvibe.media';
  const enc = encodeURIComponent;
@@@ -2843,7 +2902,7 @@ function createMediaClient(client, { app, apiKey, actingUserId, baseUrl, publicO
  
  module.exports = { createMediaClient, createObjectsClient, mediaUrls, DEFAULT_PUBLIC_ORIGIN };
  },
--// ── 24: src/objects.js ──────────────────────────────────────────────
++// ── 25: src/objects.js ──────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3162,7 +3221,7 @@ function createObjectsClient({
  
  module.exports = { createObjectsClient };
  },
--// ── 25: src/community.js ────────────────────────────────────────────
++// ── 26: src/community.js ────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3281,7 +3340,7 @@ function createCommunityClient(client, defaults = {}) {
  
  module.exports = { createCommunityClient, actingHeaders };
  },
--// ── 26: src/bot.js ──────────────────────────────────────────────────
++// ── 27: src/bot.js ──────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3503,7 +3562,7 @@ function createBotClient(client, defaults = {}) {
  
  module.exports = { createBotClient, actingHeaders };
  },
--// ── 27: src/search.js ───────────────────────────────────────────────
++// ── 28: src/search.js ───────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3616,7 +3675,7 @@ function createSearchClient(client, defaults = {}) {
  
  module.exports = { createSearchClient, queryOf, fabricOf };
  },
--// ── 28: src/bench.js ────────────────────────────────────────────────
++// ── 29: src/bench.js ────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /** openvibe-sdk/bench: OpenVibe.Bench's JSON API and streamed open dataset. Browser-safe. */
@@@ -3717,7 +3776,7 @@ function createBenchClient(client, defaults = {}) {
  
  module.exports = { createBenchClient };
  },
--// ── 29: src/meme.js ─────────────────────────────────────────────────
++// ── 30: src/meme.js ─────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3785,7 +3844,7 @@ function createMemeClient(client, defaults = {}) {
  
  module.exports = { createMemeClient };
  },
--// ── 30: src/vision.js ───────────────────────────────────────────────
++// ── 31: src/vision.js ───────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -3943,7 +4002,7 @@ function pick(o, keys) {
  
  module.exports = { createVisionClient, DEFAULT_AUDIENCE };
  },
--// ── 31: src/themes.js ───────────────────────────────────────────────
++// ── 32: src/themes.js ───────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4093,7 +4152,7 @@ function followTheme(fn, opts = {}) {
  
  module.exports = { createThemesClient, followTheme, readTheme, applyTheme, seasonOn, onColor, DISPLAY_OPTIONS, TOKENS };
  },
--// ── 32: src/redact.js ───────────────────────────────────────────────
++// ── 33: src/redact.js ───────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4340,7 +4399,7 @@ function onlySecret(text) {
  
  module.exports = { redact, onlySecret };
  },
--// ── 33: src/chat.js ─────────────────────────────────────────────────
++// ── 34: src/chat.js ─────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4582,7 +4641,7 @@ function createFeedPublisher(client, { feed, key, baseUrl } = {}) {
  
  module.exports = { createChatClient, createInboxVisitor, createFeedPublisher };
  },
--// ── 34: src/ai.js ───────────────────────────────────────────────────
++// ── 35: src/ai.js ───────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4714,7 +4773,7 @@ function createAiClient(client, defaults = {}) {
  
  module.exports = { createAiClient, TERMINAL, OPS, CLASSES };
  },
--// ── 35: src/jobs.js ─────────────────────────────────────────────────
++// ── 36: src/jobs.js ─────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4752,8 +4811,8 @@ function (module, exports) {
   */
  const { OpenVibeError, isOpenVibeError } = __load(3);
  const { newIdempotencyKey } = __load(5);
--const { appendFiles } = __load(36);
--const { parseSSE } = __load(22);
++const { appendFiles } = __load(37);
++const { parseSSE } = __load(23);
  
  const TERMINAL = new Set(['succeeded', 'failed', 'cancelled']);
  const TERMINAL_EVENTS = new Set(['job.succeeded', 'job.failed', 'job.cancelled']);
@@@ -4916,7 +4975,7 @@ function createJobsClient(client, { baseUrl, service = 'tools', audience = 'open
  
  module.exports = { createJobsClient, isTerminal, TERMINAL_STATES: [...TERMINAL] };
  },
--// ── 36: src/core/form.js ────────────────────────────────────────────
++// ── 37: src/core/form.js ────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4950,7 +5009,7 @@ function appendFiles(form, list, where) {
  
  module.exports = { isBlob, isUpload, appendFiles };
  },
--// ── 37: src/tools.js ────────────────────────────────────────────────
++// ── 38: src/tools.js ────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -4984,8 +5043,8 @@ function (module, exports) {
   */
  const { OpenVibeError, isOpenVibeError } = __load(3);
  const { newIdempotencyKey } = __load(5);
--const { isUpload, appendFiles } = __load(36);
--const { createJobsClient } = __load(35);
++const { isUpload, appendFiles } = __load(37);
++const { createJobsClient } = __load(36);
  
  const enc = encodeURIComponent;
  const ID_RE = /^[a-z][a-z0-9-]{0,39}$/;
@@@ -5235,7 +5294,7 @@ function createToolsClient(client, { baseUrl, service = 'tools', audience = 'ope
  
  module.exports = { createToolsClient, ToolRunError, isToolRunError };
  },
--// ── 38: src/projects.js ─────────────────────────────────────────────
++// ── 39: src/projects.js ─────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -5351,7 +5410,7 @@ function createProjectsClient(client, { baseUrl } = {}) {
  
  module.exports = { createProjectsClient };
  },
--// ── 39: src/geo.js ──────────────────────────────────────────────────
++// ── 40: src/geo.js ──────────────────────────────────────────────────
  function (module, exports) {
  'use strict';
  /**
@@@ -5430,9 +5489,9 @@ export const {
      createClient, OpenVibeError, isOpenVibeError, paginate, offsetPager, parseTraceparent,
      startSpan, contextFromHeaders, ulid, newEventId, newIdempotencyKey, isActingSubjectId,
      satisfiesRange, compareVersions, CONTRACTS_RANGE, DEFAULT_NETWORK, SDK_VERSION, auth,
--    locker, registry, modules, realtime, media, community,
--    bot, search, bench, meme, vision, themes,
--    redact, chat, ai, jobs, tools, projects,
--    geo,
++    locker, registry, trust, modules, realtime, media,
++    community, bot, search, bench, meme, vision,
++    themes, redact, chat, ai, jobs, tools,
++    projects, geo,
  } = sdk;
  export default sdk;
ddiff --git a/docs/api-surface.json b/docs/api-surface.json
iindex 3c8b6d5..9c1ee32 100644
---- a/docs/api-surface.json
++++ b/docs/api-surface.json
@@@ -360,6 +360,14 @@
          "createTradeClient"
        ]
      },
++    "trust": {
++      "object": [
++        "AGE_BANDS",
++        "atLeast",
++        "createTrustClient",
++        "isNew"
++      ]
++    },
      "ulid": "function",
      "usage": {
        "object": [
@@@ -1087,6 +1095,12 @@
    "openvibe-sdk/trade": {
      "createTradeClient": "function"
    },
++  "openvibe-sdk/trust": {
++    "AGE_BANDS": "array",
++    "atLeast": "function",
++    "createTrustClient": "function",
++    "isNew": "function"
++  },
    "openvibe-sdk/usage": {
      "createUsageReporter": "function",
      "usageKey": "function",
ddiff --git a/docs/trust.md b/docs/trust.md
nnew file mode 100644
iindex 0000000..ce999b4
---- /dev/null
++++ b/docs/trust.md
@@@ -0,0 +1,19 @@
++# Trust signals
++
++`openvibe-sdk/trust` reads the privacy-limited trust signals served by OpenVibe.Network. Pass a `getToken` callback so
++tokens can be refreshed without storing credentials in the client:
++
++```js
++import { createTrustClient, isNew, atLeast } from 'openvibe-sdk/trust';
++
++const trust = createTrustClient({ networkUrl: 'https://openvibe.network', getToken });
++const mine = await trust.me(); // account or guest's own token
++const other = await trust.of('gst_01JAB2C3D4E5F6G7H8J9K0MNP1'); // requires identity.trust.read
++
++if (isNew(other, { hours: 24 })) { /* apply a stricter abuse policy */ }
++if (atLeast(mine, 'under_7d')) { /* account or guest is at least one day old */ }
++```
++
++`AGE_BANDS` orders bands from youngest (`under_1h`) to oldest (`30d_plus`). `isNew` uses whole age hours and `atLeast`
++compares the coarse band. Trust payloads never contain IPs, emails, last-seen timestamps, service user ids, or linked
++account identities; same-network activity is only an aggregate count. These signals do not replace authorization.
ddiff --git a/esm/index.mjs b/esm/index.mjs
iindex 9fb8b38..c45cbb5 100644
---- a/esm/index.mjs
++++ b/esm/index.mjs
@@@ -5,14 +5,14 @@ export const {
      createClient, OpenVibeError, isOpenVibeError, paginate, offsetPager, parseTraceparent,
      startSpan, contextFromHeaders, ulid, newEventId, newIdempotencyKey, isActingSubjectId,
      satisfiesRange, compareVersions, CONTRACTS_RANGE, DEFAULT_NETWORK, SDK_VERSION, share,
--    locker, auth, registry, identity, modules, events,
--    realtime, media, community, bot, search, bench,
--    meme, vision, themes, redact, chat, chatApps,
--    ai, jobs, tools, projects, resources, vip,
--    quest, live, inventory, tips, blog, reviews,
--    wiki, coupons, deals, trade, space, host,
--    news, food, actor, run, video, work,
--    zone, play, download, openre, geo, usage,
--    commerce, telemetry,
++    locker, auth, registry, identity, trust, modules,
++    events, realtime, media, community, bot, search,
++    bench, meme, vision, themes, redact, chat,
++    chatApps, ai, jobs, tools, projects, resources,
++    vip, quest, live, inventory, tips, blog,
++    reviews, wiki, coupons, deals, trade, space,
++    host, news, food, actor, run, video,
++    work, zone, play, download, openre, geo,
++    usage, commerce, telemetry,
  } = cjs;
  export default cjs;
ddiff --git a/esm/trust.mjs b/esm/trust.mjs
nnew file mode 100644
iindex 0000000..a08a961
---- /dev/null
++++ b/esm/trust.mjs
@@@ -0,0 +1,7 @@
++// Generated by scripts/esm.js from src/trust.js. Do not edit.
++import cjs from '../src/trust.js';
++
++export const {
++    createTrustClient, isNew, atLeast, AGE_BANDS,
++} = cjs;
++export default cjs;
ddiff --git a/index.js b/index.js
iindex b676439..aa23ab2 100644
---- a/index.js
++++ b/index.js
@@@ -13,6 +13,7 @@ module.exports = {
      auth: require('./src/auth'),
      registry: require('./src/registry'),
      identity: require('./src/identity'),
++    trust: require('./src/trust'),
      modules: require('./src/modules'),
      events: require('./src/events'),
      realtime: require('./src/realtime'),
ddiff --git a/package-lock.json b/package-lock.json
iindex 23c0d01..ef5d089 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.101.0",
++  "version": "0.102.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.101.0",
++      "version": "0.102.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex c2cec02..07eb9bc 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.101.0",
++  "version": "0.102.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
@@@ -45,6 +45,12 @@
        "import": "./esm/identity.mjs",
        "default": "./src/identity.js"
      },
++    "./trust": {
++      "types": "./types/trust.d.ts",
++      "browser": "./src/trust.js",
++      "import": "./esm/trust.mjs",
++      "default": "./src/trust.js"
++    },
      "./notifications": {
        "types": "./types/notifications.d.ts",
        "browser": null,
ddiff --git a/scripts/esm.js b/scripts/esm.js
iindex 7cee8eb..e22a094 100644
---- a/scripts/esm.js
++++ b/scripts/esm.js
@@@ -24,6 +24,7 @@ const ENTRIES = {
      'assertions.mjs': '../src/assertions.js',
      'registry.mjs': '../src/registry.js',
      'identity.mjs': '../src/identity.js',
++    'trust.mjs': '../src/trust.js',
      'notifications.mjs': '../src/notifications.js',
      'modules.mjs': '../src/modules.js',
      'events.mjs': '../src/events.js',
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 3059e94..9b4f75e 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.101.0';
++const SDK_VERSION = '0.102.0';
  
  module.exports = {
      createClient,
ddiff --git a/src/trust.js b/src/trust.js
nnew file mode 100644
iindex 0000000..088bab3
---- /dev/null
++++ b/src/trust.js
@@@ -0,0 +1,55 @@
++'use strict';
++
++const AGE_BANDS = Object.freeze(['under_1h', 'under_1d', 'under_7d', 'under_30d', '30d_plus']);
++const BAND_INDEX = new Map(AGE_BANDS.map((band, index) => [band, index]));
++
++/** Create a direct OpenVibe.Network trust API client. `.of()` requires identity.trust.read. */
++function createTrustClient({ networkUrl = 'https://openvibe.network', getToken, fetchImpl = globalThis.fetch } = {}) {
++    if (typeof getToken !== 'function') throw new TypeError('createTrustClient: getToken must be a function');
++    if (typeof fetchImpl !== 'function') throw new TypeError('createTrustClient: fetch is not available');
++    const base = String(networkUrl || '').replace(/\/+$/, '');
++    if (!base) throw new TypeError('createTrustClient: networkUrl is required');
++
++    async function read(path) {
++        const token = await getToken();
++        if (!token) throw new TypeError('createTrustClient: getToken returned no token');
++        const response = await fetchImpl(`${base}${path}`, {
++            headers: { Accept: 'application/json', Authorization: `Bearer ${token}` },
++        });
++        const body = await response.json().catch(() => null);
++        if (!response.ok) {
++            const error = new Error(body && (body.detail || body.error) || `Network trust request failed (${response.status})`);
++            error.status = response.status;
++            error.code = body && (body.code || body.error);
++            throw error;
++        }
++        return body;
++    }
++
++    return {
++        me() { return read('/api/v1/me/trust'); },
++        of(subject) {
++            if (typeof subject !== 'string' || !/^(?:usr|gst)_[0-9A-HJKMNP-TV-Z]{26}$/.test(subject)) {
++                throw new TypeError('of: subject must be a usr_… or gst_… id');
++            }
++            return read(`/api/v1/trust/${encodeURIComponent(subject)}`);
++        },
++    };
++}
++
++/** True when the known whole-hour age is below the supplied threshold. */
++function isNew(signals, { hours } = {}) {
++    const limit = Number(hours);
++    if (!Number.isFinite(limit) || limit < 0) throw new TypeError('isNew: hours must be a non-negative number');
++    const age = signals && (signals.kind === 'guest' ? signals.age_hours : signals.account_age_hours);
++    return Number.isFinite(Number(age)) && Number(age) < limit;
++}
++
++/** Compare an age band against the documented youngest-to-oldest order. */
++function atLeast(signals, band) {
++    const target = BAND_INDEX.get(band);
++    const actual = BAND_INDEX.get(signals && signals.age_band);
++    return target !== undefined && actual !== undefined && actual >= target;
++}
++
++module.exports = { createTrustClient, isNew, atLeast, AGE_BANDS };
ddiff --git a/test/pack.test.js b/test/pack.test.js
iindex 6ab58f2..c15aa37 100644
---- a/test/pack.test.js
++++ b/test/pack.test.js
@@@ -72,7 +72,7 @@ run([
                  })().catch((err) => { console.error(err); process.exit(1); });`;
              const res = execFileSync(process.execPath, ['-e', script], { cwd: app, encoding: 'utf8' });
              assert.match(res, new RegExp(`consumer ok: ${subpaths.length} subpaths \\+ the browser bundle`));
--            assert.equal(subpaths.length, 89);   // 0.90.0 assertions, 0.91.0 streams, 0.92.0 chat-apps, 0.94.0 reports, 0.95.0 cam, 0.97.0 menu
++            assert.equal(subpaths.length, 90);   // Adds the browser-safe trust client.
              assert.ok(!fs.existsSync(path.join(app, 'node_modules/openvibe-contracts')), 'the optional peer is not installed');
          } finally {
              fs.rmSync(tmp, { recursive: true, force: true });
ddiff --git a/test/trust.test.js b/test/trust.test.js
nnew file mode 100644
iindex 0000000..f3a7cb7
---- /dev/null
++++ b/test/trust.test.js
@@@ -0,0 +1,34 @@
++'use strict';
++
++const assert = require('assert');
++const { AGE_BANDS, atLeast, createTrustClient, isNew } = require('../src/trust');
++
++const guest = { kind: 'guest', age_band: 'under_1d', age_hours: 8, age_days: 0, networks_seen: 1, guests_from_same_networks_24h: 0, converted: false };
++const account = { kind: 'account', age_band: '30d_plus', account_age_hours: 960, account_age_days: 40, passkey: false, linked_accounts: 0, active_30d: true, email_verified: false, verified: true, verified_by: ['30_days_active'] };
++
++assert.deepStrictEqual(AGE_BANDS, ['under_1h', 'under_1d', 'under_7d', 'under_30d', '30d_plus']);
++assert.strictEqual(isNew(guest, { hours: 24 }), true);
++assert.strictEqual(isNew(account, { hours: 24 }), false);
++assert.strictEqual(atLeast(guest, 'under_7d'), false);
++assert.strictEqual(atLeast(account, 'under_7d'), true);
++assert.strictEqual(atLeast(guest, 'unknown'), false);
++assert.throws(() => isNew(guest, { hours: -1 }), TypeError);
++
++(async () => {
++    const calls = [];
++    const client = createTrustClient({
++        networkUrl: 'https://network.example/',
++        getToken: async () => 'personal-token',
++        fetchImpl: async (url, options) => {
++            calls.push({ url, options });
++            return { ok: true, status: 200, json: async () => guest };
++        },
++    });
++    assert.deepStrictEqual(await client.me(), guest);
++    assert.deepStrictEqual(await client.of('gst_01JAB2C3D4E5F6G7H8J9K0MNP1'), guest);
++    assert.strictEqual(calls[0].url, 'https://network.example/api/v1/me/trust');
++    assert.strictEqual(calls[1].url, 'https://network.example/api/v1/trust/gst_01JAB2C3D4E5F6G7H8J9K0MNP1');
++    assert.strictEqual(calls[0].options.headers.Authorization, 'Bearer personal-token');
++    assert.throws(() => client.of('invalid'), TypeError);
++    console.log('trust: helper and client checks passed');
++})().catch((err) => { console.error(err); process.exitCode = 1; });
ddiff --git a/types/bundle.d.ts b/types/bundle.d.ts
iindex 15d7283..251388b 100644
---- a/types/bundle.d.ts
++++ b/types/bundle.d.ts
@@@ -19,6 +19,7 @@ import * as tools from './tools';
  import * as projects from './projects';
  import * as geo from './geo';
  import * as locker from './locker';
++import * as trust from './trust';
  import * as core from './core';
  
  export * from './core';
@@@ -42,9 +43,10 @@ export * as tools from './tools';
  export * as projects from './projects';
  export * as geo from './geo';
  export * as locker from './locker';
++export * as trust from './trust';
  
  declare const sdk: typeof core & {
      auth: typeof auth; registry: typeof registry; modules: typeof modules; realtime: typeof realtime;
--    media: typeof media; community: typeof community; bot: typeof bot; search: typeof search; bench: typeof bench; meme: typeof meme; vision: typeof vision; themes: typeof themes; redact: typeof redact; chat: typeof chat; ai: typeof ai; jobs: typeof jobs; tools: typeof tools; projects: typeof projects; geo: typeof geo; locker: typeof locker;
++    media: typeof media; community: typeof community; bot: typeof bot; search: typeof search; bench: typeof bench; meme: typeof meme; vision: typeof vision; themes: typeof themes; redact: typeof redact; chat: typeof chat; ai: typeof ai; jobs: typeof jobs; tools: typeof tools; projects: typeof projects; geo: typeof geo; locker: typeof locker; trust: typeof trust;
  };
  export default sdk;
ddiff --git a/types/index.d.ts b/types/index.d.ts
iindex 5cd68ee..fd5004a 100644
---- a/types/index.d.ts
++++ b/types/index.d.ts
@@@ -2,6 +2,7 @@ export * from './core';
  export * as auth from './auth';
  export * as registry from './registry';
  export * as identity from './identity';
++export * as trust from './trust';
  export * as modules from './modules';
  export * as events from './events';
  export * as realtime from './realtime';
ddiff --git a/types/trust.d.ts b/types/trust.d.ts
nnew file mode 100644
iindex 0000000..bc0f709
---- /dev/null
++++ b/types/trust.d.ts
@@@ -0,0 +1,43 @@
++export type TrustAgeBand = 'under_1h' | 'under_1d' | 'under_7d' | 'under_30d' | '30d_plus';
++
++export interface AccountTrustSignals {
++    kind: 'account';
++    age_band: TrustAgeBand;
++    account_age_hours: number;
++    account_age_days: number;
++    passkey: boolean;
++    linked_accounts: number;
++    active_30d: boolean;
++    email_verified: boolean;
++    verified: boolean;
++    verified_by: Array<'passkey' | 'linked_account' | '30_days_active'>;
++}
++
++export interface GuestTrustSignals {
++    kind: 'guest';
++    age_band: TrustAgeBand;
++    age_hours: number;
++    age_days: number;
++    sessions?: number;
++    networks_seen: number;
++    guests_from_same_networks_24h: number;
++    banned?: boolean;
++    restricted?: boolean;
++    converted: boolean;
++}
++
++export type TrustSignals = AccountTrustSignals | GuestTrustSignals;
++export declare const AGE_BANDS: readonly TrustAgeBand[];
++
++export interface TrustClient {
++    me(): Promise<TrustSignals>;
++    of(subject: string): Promise<TrustSignals>;
++}
++
++export declare function createTrustClient(options: {
++    networkUrl?: string;
++    getToken: () => string | Promise<string>;
++    fetchImpl?: (input: string, init?: { headers?: Record<string, string> }) => Promise<{ ok: boolean; status: number; json(): Promise<unknown> }>;
++}): TrustClient;
++export declare function isNew(signals: TrustSignals, options: { hours: number }): boolean;
++export declare function atLeast(signals: TrustSignals, band: TrustAgeBand): boolean;