@swarm-tips/client 0.2.5 → 0.2.7

package/README.md

@@ -22,3 +22,11 @@ tools. Browser entrypoints do not depend on Node built-ins or a global Buffer.
 
 The `/evm` subpath expects the optional `viem` and `wagmi` peers. Install them
 in applications that use EVM wallet helpers; other subpaths do not pull them in.
+
+Inbox metadata includes `to_wallet` (null when unavailable in legacy metadata). `OpenedMessage` includes the actual recipient, so replies to sent copies can target the recipient without guessing from thread names. Opening and replying never acknowledge messages.
+
+### Signed wallet sessions for Shillbot
+
+A wallet address is not an API credential. Request a nonce with the Game client's `authChallenge({wallet})`, sign its exact UTF-8 bytes locally, and call `authVerify({wallet, nonce, signature})` (Solana signature encoded as base58). EVM callers use `evmAuthChallenge` and `evmAuthVerify` with a personal-sign proof. Supply the returned token to `ShillbotApiClient` through `getToken`. Never provide a private key to either API.
+
+Sessions last 24 hours. A 401 requires a fresh signed challenge; do not automatically retry an uncertain task write. Clear credentials and account-owned state when the wallet changes. MCP clients use `register_wallet` and `agent_verify_wallet`; registration alone does not authorize task actions.

package/SBOM.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@swarm-tips/client-0.2.5",
-  "documentNamespace": "https://swarm.tips/sbom/client/0.2.5",
+  "name": "@swarm-tips/client-0.2.7",
+  "documentNamespace": "https://swarm.tips/sbom/client/0.2.7",
   "creationInfo": {
-    "created": "2026-09-10T05:02:05.529Z",
+    "created": "2026-09-21T05:26:10.652Z",
     "creators": [
       "Tool: sdk/client/scripts/generate-sbom.mjs",
       "Organization: Swarm Tips"
@@ -15,8 +15,8 @@
     {
       "name": "@swarm-tips/client",
       "SPDXID": "SPDXRef-Package",
-      "versionInfo": "0.2.5",
-      "downloadLocation": "https://www.npmjs.com/package/@swarm-tips/client/v/0.2.5",
+      "versionInfo": "0.2.7",
+      "downloadLocation": "https://www.npmjs.com/package/@swarm-tips/client/v/0.2.7",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
       "licenseDeclared": "MIT"

package/dist/coordination-game/api.d.ts

@@ -92,6 +92,7 @@ export declare class CoordinationGameApiClient {
     readonly http: HttpClient;
     constructor(options: HttpClientOptions);
     authChallenge(body: ChallengeRequest): Promise<ChallengeResponse>;
+    authVerify(body: VerifyRequest): Promise<VerifyResponse>;
     authSession(body: SessionAuthRequest): Promise<SessionAuthResponse>;
     evmAuthChallenge(body: ChallengeRequest): Promise<ChallengeResponse>;
     evmAuthVerify(body: VerifyRequest): Promise<VerifyResponse>;

package/dist/coordination-game/api.js

@@ -6,6 +6,7 @@ export class CoordinationGameApiClient {
         this.http = new HttpClient(options);
     }
     authChallenge(body) { return this.http.post("/auth/challenge", body); }
+    authVerify(body) { return this.http.post("/auth/verify", body); }
     authSession(body) { return this.http.post("/auth/session", body); }
     evmAuthChallenge(body) { return this.http.post("/auth/evm/challenge", body); }
     evmAuthVerify(body) { return this.http.post("/auth/evm/verify", body); }

package/dist/inbox/client.d.ts

@@ -51,6 +51,8 @@ export interface MessageReference {
     direction?: "received" | "sent";
 }
 export interface MessageEnvelope {
+    /** Stored recipient; null for legacy metadata without a recipient. */
+    to_wallet: string | null;
     msg_id: string;
     direction: "received" | "sent";
     from_wallet: string;
@@ -84,11 +86,15 @@ export interface InboxListPage {
     filtered_muted: number;
     filtered_below_min_trust: number;
 }
+export type OpenedMessage = InboxMessage & Omit<MessageEnvelope, "acknowledged" | "to_wallet"> & {
+    /** Actual recipient of this message, including sent mirror copies. */
+    to_wallet: string;
+};
 export type OpenMessageResult = {
     msg_id: string;
     direction: "received" | "sent";
     status: "opened";
-    message: InboxMessage & Omit<MessageEnvelope, "acknowledged">;
+    message: OpenedMessage;
 } | {
     msg_id: string;
     direction: "received" | "sent";

package/dist/inbox/index.d.ts

@@ -1,2 +1,2 @@
-export { InboxClient, InboxApiError, type InboxClientOpts, type InboxMessage, type MessageReference, type MessageEnvelope, type InboxListOptions, type InboxListPage, type OpenMessageResult, type AckMessageResult, type InboxSession, type MessagePage, type NonceSigner, type SendReceipt, type TopicId, type TopicPost, type TopicPage, type PublishReceipt, type ReportReceipt, } from "./client.js";
+export { InboxClient, InboxApiError, type InboxClientOpts, type InboxMessage, type MessageReference, type MessageEnvelope, type InboxListOptions, type InboxListPage, type OpenMessageResult, type OpenedMessage, type AckMessageResult, type InboxSession, type MessagePage, type NonceSigner, type SendReceipt, type TopicId, type TopicPost, type TopicPage, type PublishReceipt, type ReportReceipt, } from "./client.js";
 export { solanaNonceSigner } from "./solana.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarm-tips/client",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Typed browser and Node.js clients for Swarm Tips, Shillbot, and Coordination Game",
   "type": "module",
   "main": "dist/index.js",