@xyo-network/wallet-xl1-cli 0.1.21 → 0.1.22

package/README.md

@@ -17,7 +17,7 @@ The Aries CLI uses this same package for `aries wallet ...`, so the standalone a
 
 ### Prerequisites
 
-- Node.js `>=18.17.1`
+- Node.js `>=22.19.0`
 - A package manager such as `npm`, `pnpm`, or `yarn`
 
 ### Global Install
@@ -59,6 +59,58 @@ aries wallet balance 0
 aries wallet send 0x0000000000000000000000000000000000000000 1.25 --milli --json
 ```
 
+## Requester-scoped Node signing
+
+The supported `@xyo-network/wallet-xl1-cli/signing` entry exposes public wallet
+summaries and short-lived, account-bound signing sessions. Install the package
+locally with its `@xyo-network/xl1-sdk` peer. Consumers select the requester ID,
+exact wallet ID, derivation offset, expected account, chain ID, and independently
+verified genesis hash. The wallet itself confirms that selection and prompts on
+the trusted terminal for its password; this API does not accept a password,
+mnemonic, root wallet, or caller-provided signer.
+
+```ts
+import { listSigningWallets, openWalletSigningSession } from '@xyo-network/wallet-xl1-cli/signing'
+
+const wallets = listSigningWallets()
+const session = await openWalletSigningSession(selection)
+try {
+  const snapshot = await session.snapshot()
+  const signed = await session.signTransaction({ requestId, transaction })
+  // Persist signed bytes in the participant publication journal before broadcasting.
+} finally {
+  await session.close()
+}
+```
+
+Here `selection` is the complete explicit binding and `transaction` is an SDK
+unsigned hydrated transaction. The session signs without publishing bodies or
+broadcasting. It supports secp256k1 wallets; post-quantum transaction signing is
+not qualified. Sessions expire within five minutes. Lock, close, password
+replacement, and wallet replacement revoke authority for new signing.
+
+The wallet persists request intent and encrypted signed results in `signing.json`
+under its existing guarded store lease. Retrying the same request returns the
+same bytes. `signingOutcome(requestId)` recovers a retained result through a fresh
+authorized session with the same complete binding. An uncertain intent blocks
+new same-account signing; an error, timeout, or `4001` is never proof that no
+signature exists. Existing CLI `tx sign` and `send` use this same signing ledger,
+with publication remaining a separate command step. Legacy offline signing has
+an explicitly unasserted genesis scope; it cannot authorize public requester
+sessions. This does not reconstruct pre-upgrade or external-key signing history.
+
+Run the isolated packed public import, type, real terminal prompt, and process
+recovery fixture from the repository root after both wallet package builds:
+
+```sh
+node packages/wallet-cli/scripts/verifySigningPacked.mjs /absolute/fresh/evidence-directory
+```
+
+The terminal fixture currently qualifies macOS. It creates only a temporary
+public deterministic wallet. Its strict consumer type check uses `skipLibCheck`;
+the full dependency declaration check is retained separately because upstream SDK
+declarations currently fail that broader check.
+
 ## Wallet Storage
 
 Wallet CLI data is stored under `~/.xl1/wallet/cli` by default.