sigelo-mcp 0.1.7 → 0.1.8

package/contact.mjs

@@ -70,6 +70,8 @@ const TOOLS = [
 // one, a syntax error) throws: a broken install must not pass for an absent one.
 export async function load({ installed, id, env = process.env, clock, debug = () => {} }) {
   const held = await import(installed ? 'sigelo-agent/dist/sigelo-agent-contact.js' : '../../adapters/moadim/sigelo-agent-contact.ts');
+  // The carrier signs through the identity's key provider, never with a key read here.
+  const keys = await import(installed ? 'sigelo-agent/dist/sigelo-agent-keys.js' : '../../adapters/moadim/sigelo-agent-keys.ts');
   let lib, kdf;
   try { ({ lib, kdf } = await held.contactLib()); } catch (e) {
     if (!held.absent(e)) throw e;
@@ -82,7 +84,7 @@ export async function load({ installed, id, env = process.env, clock, debug = ()
   const carrier = (path) => {
     if (!carriers.has(path)) {
       carriers.set(path, new lib.Carrier({
-        identity: () => { const s = id.load(path); return { secret: id.secretOf(s), bundle: id.bundleOf(s) }; },
+        identity: () => { const s = id.load(path); return { sign: keys.signer(path, s, env).sign, bundle: id.bundleOf(s) }; },
         ...lib.pathsFor(path), ...options, ...(clock && { clock }),
       }));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigelo-mcp",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "mcpName": "io.github.csigelo/sigelo",
   "description": "MCP server: portable, offline-verifiable identity for AI agents (DID, challenges, attestations, bundles), optional Monero wallet",
   "keywords": [
@@ -40,11 +40,11 @@
     "test": "node test.mjs",
     "prepack": "node ../../release/prepack.mjs pre",
     "postpack": "node ../../release/prepack.mjs post",
-    "prepublishOnly": "node -e \"if(process.env.SIGELO_PUBLISH!=='1'){console.error('refusing: the npm account and names are an Owner decision (ROADMAP D1); publish the release/build.sh tarballs with SIGELO_PUBLISH=1');process.exit(1)}\""
+    "prepublishOnly": "node -e \"if(process.env.SIGELO_PUBLISH!=='1'){console.error('refusing: publishing is a release step (release/RELEASE.md); publish the release/build.sh tarballs with SIGELO_PUBLISH=1');process.exit(1)}\""
   },
   "dependencies": {
-    "sigelo": "^0.1.7",
-    "sigelo-agent": "^0.1.7",
-    "sigelo-spend": "^0.1.7"
+    "sigelo": "^0.1.8",
+    "sigelo-agent": "^0.1.8",
+    "sigelo-spend": "^0.1.8"
   }
 }

package/server.mjs

@@ -17,6 +17,8 @@ const INSTALLED = fileURLToPath(import.meta.url).split(sep).includes('node_modul
 const lib = (pkg, repo) => import(INSTALLED ? pkg : repo);
 const { did, parse, parseBytes, verify, SigeloError } = await lib('sigelo', '../../ts/dist/sigelo.js');
 const id = await lib('sigelo-agent/dist/sigelo-agent.js', '../../adapters/moadim/sigelo-agent.ts');
+// Every signature goes through the identity's key provider (design/key-providers.md): no handler reads a key.
+const keys = await lib('sigelo-agent/dist/sigelo-agent-keys.js', '../../adapters/moadim/sigelo-agent-keys.ts');
 const { withLock } = await lib('sigelo-agent/dist/sigelo-agent-monero.js', '../../adapters/moadim/sigelo-agent-monero.ts');
 const { forgetIssuer } = await lib('sigelo-agent/dist/sigelo-agent-adopt.js', '../../adapters/moadim/sigelo-agent-adopt.ts');
 
@@ -26,7 +28,7 @@ console.log = console.info = console.debug = console.error;
 
 const MODERN = ['2026-07-28'];                                            // per-request _meta era
 const LEGACY = ['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05'];  // initialize era
-const SERVER_INFO = { name: 'sigelo', version: '0.1.7' };
+const SERVER_INFO = { name: 'sigelo', version: '0.1.8' };
 const PV = 'io.modelcontextprotocol/protocolVersion';
 const env = process.env;
 const WALLET = Boolean(env.SIGELO_WALLET_URL && env.SIGELO_WALLET_TOKEN);
@@ -119,11 +121,11 @@ const HANDLERS = {
   sigelo_whoami: (_, path) => { const s = loadStore(path); return { did: did(id.head(s)), genesis: id.head(s), chain: id.chainOf(s), attestations: s.attestations.length, identity_file: path }; },
   sigelo_init: ({ recovery }, path) => {
     if (typeof recovery !== 'string' || !recovery) throw refusal('usage', 'recovery is required: a "z…" public key or "none"');
-    const s = id.init(path, recovery === 'none' ? null : recovery);
+    const s = keys.init(path, recovery === 'none' ? null : recovery, env.SIGELO_KEY_PROVIDER);
     return { did: did(s.genesis), genesis: s.genesis, identity_file: path,
       ...(recovery === 'none' && { warning: 'NO recovery key: if this key is stolen the identity is lost permanently.' }) };
   },
-  sigelo_sign_challenge: ({ challenge }, path) => id.signChallenge(loadStore(path), input(challenge, 'challenge')),
+  sigelo_sign_challenge: ({ challenge }, path) => keys.signChallenge(path, loadStore(path), input(challenge, 'challenge')),
   sigelo_add_issuer: ({ genesis }, path) => { const g = input(genesis, 'genesis'); loadStore(path); return update(path, (s) => { const store = id.addIssuer(s, g); return { store, result: { issuers: store.issuers.map(did) } }; }); },
   sigelo_add_attestation: ({ attestation, issuer }, path) => {
     const a = input(attestation, 'attestation'), g = issuer === undefined ? undefined : input(issuer, 'issuer');
@@ -139,7 +141,7 @@ const HANDLERS = {
     return { bundle, did: result.did, ...(notes.length && { notes }) };
   },
   sigelo_verify: ({ bundle, now }) => verify(input(bundle, 'bundle'), Number.isSafeInteger(now) ? now : nowS()),
-  sigelo_rotate: (_, path) => { loadStore(path); const s = update(path, (st) => { const r = id.rotateKey(st, nowS()); return { store: r, result: r }; }); return { did: did(id.head(s)), chain: id.chainOf(s), next: 'ask each world to reissue its attestation to the new DID' }; },
+  sigelo_rotate: (_, path) => { loadStore(path); const s = update(path, (st) => { const r = keys.rotate(path, st, nowS()); return { store: r, result: r }; }); keys.commit(s); return { did: did(id.head(s)), chain: id.chainOf(s), next: 'ask each world to reissue its attestation to the new DID' }; },
   sigelo_wallet_balance: () => wallet(['balance']),
   sigelo_wallet_receive: ({ note }) => wallet(['receive', ...(note ? [String(note)] : [])]),
   sigelo_wallet_pay: ({ to, amount, purpose, ref }) => wallet(['pay', String(to ?? ''), String(amount ?? ''), String(purpose ?? ''), ...(ref ? ['--ref', String(ref)] : [])]),