tersign 0.1.11 → 0.2.0

package/README.md

@@ -33,6 +33,16 @@ ledger: counter-signed OK (seller tersign-first, seq 1 …) VALID
 curl https://tersign.ai/v1/receipts/0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4/verify
 ```
 
+## One-Call Disclosure Evidence
+
+Counter-signed evidence that your agent presented a disclosure — one command, no account:
+
+```sh
+npx tersign disclose "You are chatting with an AI assistant." --medium chat --agent-id my-agent
+```
+
+The text is digested **locally** (only the digest travels — data-minimization by construction). Your key signs the record; the ledger counter-signs it into a per-signer hash chain whose head is submitted for Bitcoin anchoring on a six-hourly cron. First call self-provisions a free signer-keyed account bound set-once to your key (key resolution: `TERSIGN_SELLER_KEY` env → macOS keychain `tersign-signer` → `~/.tersign/signer.key`, created on first use). Free tier is quota- and rate-limited — [limits](https://tersign.ai/pricing). What this is: independently verifiable evidence the disclosure was attested at that time. What it is not: a compliance certification.
+
 ## Chain of Custody
 
 Every entry takes the same path: the seller **signs** the receipt (EIP-712, x402 offer-receipt extension) → Tersign computes the **keccak256 canonical digest** → the digest joins that **seller's hash chain**, each `seq n` bound to `seq n−1` → the neutral ledger **counter-signs** (secp256k1) → **anyone verifies**, and any venue gets a serialized envelope.
@@ -86,7 +96,7 @@ npm i tersign
 }
 ```
 
-**Tools** — `issue_receipt` · `verify_receipt` · `verify_compliance_record` · `record_refund` · `open_dispute` · `submit_dispute_evidence` · `adjudicate_dispute` · `get_dispute`
+**Tools** — `issue_receipt` · `verify_receipt` · `verify_compliance_record` · `record_disclosure` · `record_refund` · `open_dispute` · `submit_dispute_evidence` · `adjudicate_dispute` · `get_dispute`
 
 | Env var | Required | Purpose |
 |---|---|---|
@@ -105,8 +115,8 @@ The agent skill `tersign-evidence` ships at [tersignhq/skills](https://github.co
 
 - **Ledger + dashboard** — public verify page: https://tersign.ai/verify
 - **Census** — hash-chained observations across the live x402 seller catalog, probed autonomously; the numbers are served live, never quoted stale: https://prober.tersign.ai/v1/prober/stats
-- **Conformance** — RFC 8785 (JCS) canonical serialization, keccak256 digests, and the public two-sided vector suite (independence, completeness, existence, phase): [tersignhq/evidence-record-conformance](https://github.com/tersignhq/evidence-record-conformance). Reproduce the bytes and your implementation is conformant — in any language.
-- **Standards** — the `compliance-fields` extension (optional tax/audit records composing with offer-receipt) is proposed upstream: [x402-foundation/x402#2853](https://github.com/x402-foundation/x402/pull/2853)
+- **Conformance** — RFC 8785 (JCS) canonical serialization, keccak256 digests, and the public two-sided vector suite (canonical bytes, number domain, content address, chain continuity, completeness, anchored existence, phase separation, offer binding, independence — every criterion carrying both an accepting and an adversarial vector): [tersignhq/evidence-record-conformance](https://github.com/tersignhq/evidence-record-conformance). Reproduce the bytes and your implementation is conformant — in any language.
+- **Standards** — the `compliance-fields` extension — a typed compliance-record schema plus four evaluator-side disqualifications (independence, completeness/existence, economic-phase separation, and commitment scope — an independence claim reaches exactly as far as the record's own commitments), each executable as a two-sided conformance vector — is under review upstream ([x402-foundation/x402#2853](https://github.com/x402-foundation/x402/pull/2853)) and referenced in the x402 TSC's evidence-record charter agenda ([tsc#4](https://github.com/x402-foundation/tsc/issues/4)). The merged offer-receipt spec already carries the completeness criterion at SHOULD strength (§4.5.1, [#2811](https://github.com/x402-foundation/x402/pull/2811)).
 
 ## Machine Surfaces
 

package/dist/cli.js

@@ -19,12 +19,19 @@ else if (sub === 'verify') {
     process.argv.splice(2, 1);
     await import('./verify-bin.js');
 }
+else if (sub === 'disclose') {
+    process.argv.splice(2, 1);
+    await import('./disclose-bin.js');
+}
 else if (sub === 'help' || sub === '--help' || sub === '-h') {
     console.log('tersign — evidence layer for the agent economy\n\n' +
         '  tersign                 start the MCP server (stdio)\n' +
         '  tersign mcp             same, explicit\n' +
         '  tersign verify <receipt.json | 0xdigest> [--signer 0xaddr] [--ledger url]\n' +
-        '                          verify a receipt: local signature recovery + public chain check\n');
+        '                          verify a receipt: local signature recovery + public chain check\n' +
+        '  tersign disclose "<text>" [--medium chat] [--agent-id id] [--url resourceUrl]\n' +
+        '                          counter-signed disclosure evidence — text digested locally,\n' +
+        '                          only the digest travels; key created on first use\n');
 }
 else {
     console.error(`unknown subcommand '${sub}' — did you mean: tersign verify ${sub}\nrun 'tersign help' for usage`);

package/dist/disclose-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/disclose-bin.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/** tersign disclose — one-call counter-signed disclosure evidence.
+ *
+ *   tersign disclose "<text>" [--medium chat] [--agent-id my-agent] [--kind ai-interaction]
+ *                    [--url <resourceUrl>] [--ledger https://tersign.ai]
+ *
+ * The text is digested LOCALLY (keccak256 over its canonical JSON form) — only the digest
+ * travels. Key resolution: TERSIGN_SELLER_KEY env → macOS keychain (tersign-signer) →
+ * ~/.tersign/signer.key; a key is created on first use. */
+import { privateKeyToAccount } from 'viem/accounts';
+import { recordDisclosure } from './evidence/disclose.js';
+import { resolveSignerKey } from './keystore.js';
+function arg(flag) {
+    const i = process.argv.indexOf(flag);
+    return i > 0 ? process.argv[i + 1] : undefined;
+}
+const text = process.argv[2];
+if (text === undefined || text.startsWith('--')) {
+    console.error('usage: tersign disclose "<disclosure text>" [--medium chat] [--agent-id id] ' +
+        '[--kind ai-interaction|synthetic-content] [--url resourceUrl] [--ledger url]');
+    process.exit(2);
+}
+const kind = arg('--kind') ?? 'ai-interaction';
+if (kind !== 'ai-interaction' && kind !== 'synthetic-content') {
+    console.error(`--kind must be ai-interaction or synthetic-content (got '${kind}')`);
+    process.exit(2);
+}
+try {
+    const { key, source } = resolveSignerKey({ create: true });
+    const account = privateKeyToAccount(key);
+    console.error(`signing key: ${account.address} (${source})`);
+    const result = await recordDisclosure({
+        text,
+        kind,
+        agentId: arg('--agent-id') ?? 'cli',
+        ...(arg('--medium') !== undefined ? { medium: arg('--medium') } : {}),
+        ...(arg('--url') !== undefined ? { resourceUrl: arg('--url') } : {}),
+        ...(arg('--ledger') !== undefined ? { ledger: arg('--ledger') } : {}),
+        account,
+    });
+    console.log(`digest           ${result.digest}`);
+    console.log(`seq              ${result.seq}`);
+    console.log(`countersignature ${result.countersignature.slice(0, 24)}…`);
+    console.log(`tier             ${result.tier}`);
+    console.log(`verify           ${result.verifyUrl}`);
+}
+catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+}

package/dist/evidence/disclose.d.ts

@@ -0,0 +1,42 @@
+import type { Account } from 'viem/accounts';
+import { type DisclosureKind, type SignedActionRecord } from './action.js';
+/** One-call counter-signed disclosure — the wedge flow.
+ *
+ * Data-minimization by construction: the disclosure TEXT never leaves this machine. Only
+ * `digestOf(text)` travels (or a caller-supplied digest); the ledger counter-signs the
+ * digest-bearing record into the signer's per-seller hash chain and the raw content stays
+ * under the deployer's own retention. The route is public and signer-keyed: first call
+ * self-provisions a free wedge account bound set-once to the signing key. */
+export interface RecordDisclosureOptions {
+    /** the disclosure text as shown — digested locally, never transmitted */
+    text?: string;
+    /** pre-computed digest; wins over `text` when both are given */
+    textDigest?: `0x${string}`;
+    /** channel the disclosure was presented on: 'chat' | 'api' | 'voice' | 'ui' … */
+    medium?: string;
+    kind?: DisclosureKind;
+    /** stable identifier for the agent (deployer-scoped) */
+    agentId: string;
+    resourceUrl?: string;
+    /** ledger base URL */
+    ledger?: string;
+    /** signing account; callers on Node can resolve one via the keystore helper */
+    account: Account;
+    fetchImpl?: typeof fetch;
+    clock?: () => number;
+}
+export interface RecordDisclosureResult {
+    id: string;
+    digest: `0x${string}`;
+    seq: number;
+    prevDigest: `0x${string}` | null;
+    countersignature: string;
+    ledgerSigner: string;
+    signer: string;
+    verifyUrl: string;
+    tier: string;
+    note: string;
+    /** the exact signed record submitted — keep it; it is your half of the evidence */
+    record: SignedActionRecord;
+}
+export declare function recordDisclosure(opts: RecordDisclosureOptions): Promise<RecordDisclosureResult>;

package/dist/evidence/disclose.js

@@ -0,0 +1,33 @@
+import { digestOf } from '../canonical.js';
+import { signActionRecord } from './action.js';
+export async function recordDisclosure(opts) {
+    if (opts.text === undefined && opts.textDigest === undefined) {
+        throw new Error('recordDisclosure needs `text` (digested locally) or a pre-computed `textDigest`');
+    }
+    const now = (opts.clock ?? (() => Math.floor(Date.now() / 1000)))();
+    const record = {
+        version: 1,
+        agent: { id: opts.agentId },
+        action: { kind: 'disclosure' },
+        disclosure: {
+            kind: opts.kind ?? 'ai-interaction',
+            presentedAt: now,
+            ...(opts.medium !== undefined ? { medium: opts.medium } : {}),
+            textDigest: opts.textDigest ?? digestOf(opts.text),
+        },
+        ...(opts.resourceUrl !== undefined ? { resourceUrl: opts.resourceUrl } : {}),
+        occurredAt: now,
+    };
+    const signed = await signActionRecord(record, opts.account);
+    const base = (opts.ledger ?? 'https://tersign.ai').replace(/\/$/, '');
+    const f = opts.fetchImpl ?? fetch;
+    const res = await f(`${base}/v1/disclose`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ artifact: signed }),
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok)
+        throw new Error(`disclose failed: ${res.status} ${JSON.stringify(body)}`);
+    return { ...body, record: signed };
+}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { D1IdempotencyStore, D1_IDEMPOTENCY_DDL, type D1Like } from './idempoten
 export type { DisputeReason, DisputeVerdict, DisputeStatus, DisputePayloadV1, CriterionV1, AcceptanceCriteriaV1, EvidenceArtifactRef, EvidencePayloadV1, DisputeAttestationPayload, EvidenceAttestationPayload, CriteriaAttestationPayload, SignedDispute, SignedEvidence, SignedCriteria, } from './dispute/types.js';
 export { DISPUTE_DOMAIN, EVIDENCE_DOMAIN, CRITERIA_DOMAIN, DISPUTE_TYPES, EVIDENCE_TYPES, CRITERIA_TYPES, DISPUTE_WIRE_VECTOR, disputeDigest, evidenceDigest, criteriaDigest, signDispute, verifyDispute, signEvidence, verifyEvidence, signCriteria, verifyCriteria, } from './dispute/sign.js';
 export { ACTION_DOMAIN, ACTION_TYPES, ACTION_WIRE_VECTOR, actionDigest, signActionRecord, verifyActionRecord, type ActionKind, type DisclosureKind, type GovernanceOutcome, type ActionRecordV1, type ActionAttestationPayload, type SignedActionRecord, } from './evidence/action.js';
+export { recordDisclosure, type RecordDisclosureOptions, type RecordDisclosureResult } from './evidence/disclose.js';
 export { LedgerClient, type LedgerConfig, type CountersignResult } from './ledgerClient.js';
 export { Assure, attachToExtensions, type AssureConfig, type SettlementContext, type IssuedReceipt } from './assure.js';
 export { withAssure, extractSettlement, extractPaymentPayload, type WithAssureConfig, type SettlementInfo } from './adapter/x402.js';

package/dist/index.js

@@ -6,6 +6,7 @@ export { MemoryIdempotencyStore, checkIdempotency, extractPaymentId, fingerprint
 export { D1IdempotencyStore, D1_IDEMPOTENCY_DDL } from './idempotency/d1.js';
 export { DISPUTE_DOMAIN, EVIDENCE_DOMAIN, CRITERIA_DOMAIN, DISPUTE_TYPES, EVIDENCE_TYPES, CRITERIA_TYPES, DISPUTE_WIRE_VECTOR, disputeDigest, evidenceDigest, criteriaDigest, signDispute, verifyDispute, signEvidence, verifyEvidence, signCriteria, verifyCriteria, } from './dispute/sign.js';
 export { ACTION_DOMAIN, ACTION_TYPES, ACTION_WIRE_VECTOR, actionDigest, signActionRecord, verifyActionRecord, } from './evidence/action.js';
+export { recordDisclosure } from './evidence/disclose.js';
 export { LedgerClient } from './ledgerClient.js';
 export { Assure, attachToExtensions } from './assure.js';
 export { withAssure, extractSettlement, extractPaymentPayload } from './adapter/x402.js';

package/dist/keystore.d.ts

@@ -0,0 +1,23 @@
+/** Signer-key resolution for the CLI/MCP surfaces (Node-only — never imported by the
+ * runtime-agnostic evidence modules). The key is the DEPLOYER's key: it signs records the
+ * ledger only counter-signs, so it never leaves this machine — custody stays with the
+ * deployer by construction.
+ *
+ * Priority (first hit wins):
+ *   1. TERSIGN_SELLER_KEY env — explicit override; headless/CI/agent contract.
+ *   2. macOS keychain, service `tersign-signer` — the at-rest default on darwin.
+ *   3. keyfile ~/.tersign/signer.key (0600) — portable fallback; created with a warning
+ *      recommending the env/keychain paths.
+ *
+ * All keychain access is execFileSync with an argv array — never shell-interpolated. */
+export type SignerKeySource = 'env' | 'keychain' | 'keyfile';
+export interface ResolvedSignerKey {
+    key: `0x${string}`;
+    source: SignerKeySource;
+}
+/** Resolve the deployer signing key. With `create: true`, a missing key is generated and
+ * persisted (keychain on darwin, else a 0600 keyfile); without it, resolution failure throws
+ * with the wiring instructions. */
+export declare function resolveSignerKey(opts?: {
+    create?: boolean;
+}): ResolvedSignerKey;

package/dist/keystore.js

@@ -0,0 +1,69 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { join } from 'node:path';
+import { generatePrivateKey } from 'viem/accounts';
+const KEY_PATTERN = /^0x[0-9a-fA-F]{64}$/;
+const KEYCHAIN_SERVICE = 'tersign-signer';
+function keyfilePath() {
+    return join(homedir(), '.tersign', 'signer.key');
+}
+function readKeychain() {
+    if (process.platform !== 'darwin')
+        return null;
+    try {
+        const out = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return KEY_PATTERN.test(out) ? out : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeKeychain(key) {
+    if (process.platform !== 'darwin')
+        return false;
+    try {
+        execFileSync('security', ['add-generic-password', '-s', KEYCHAIN_SERVICE, '-a', userInfo().username, '-w', key, '-U'], { stdio: ['ignore', 'ignore', 'ignore'] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve the deployer signing key. With `create: true`, a missing key is generated and
+ * persisted (keychain on darwin, else a 0600 keyfile); without it, resolution failure throws
+ * with the wiring instructions. */
+export function resolveSignerKey(opts = {}) {
+    const env = process.env.TERSIGN_SELLER_KEY;
+    if (env !== undefined && env !== '') {
+        if (!KEY_PATTERN.test(env))
+            throw new Error('TERSIGN_SELLER_KEY must be a 0x-prefixed 32-byte hex key');
+        return { key: env, source: 'env' };
+    }
+    const fromKeychain = readKeychain();
+    if (fromKeychain)
+        return { key: fromKeychain, source: 'keychain' };
+    const file = keyfilePath();
+    if (existsSync(file)) {
+        const raw = readFileSync(file, 'utf8').trim();
+        if (!KEY_PATTERN.test(raw))
+            throw new Error(`${file} does not contain a 0x-prefixed 32-byte hex key`);
+        return { key: raw, source: 'keyfile' };
+    }
+    if (!opts.create) {
+        throw new Error('no signing key found — set TERSIGN_SELLER_KEY, store one in the macOS keychain ' +
+            `(security add-generic-password -s ${KEYCHAIN_SERVICE} -a $USER -w 0x…), or rerun with key creation enabled`);
+    }
+    const key = generatePrivateKey();
+    if (writeKeychain(key))
+        return { key, source: 'keychain' };
+    mkdirSync(join(homedir(), '.tersign'), { recursive: true, mode: 0o700 });
+    writeFileSync(file, `${key}\n`, { mode: 0o600 });
+    chmodSync(file, 0o600);
+    console.error(`tersign: generated a new signing key at ${file} (0600). This key IS your evidence identity — ` +
+        'back it up, and prefer TERSIGN_SELLER_KEY or the OS keychain on shared machines.');
+    return { key, source: 'keyfile' };
+}

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.1.11";
+    readonly version: "0.2.0";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -3,7 +3,7 @@ import { z } from 'zod';
 import { privateKeyToAccount } from 'viem/accounts';
 import { Assure } from '../assure.js';
 import { LedgerClient } from '../ledgerClient.js';
-import { adjudicateDisputeTool, getDisputeTool, issueReceiptTool, openDisputeTool, recordRefundTool, submitEvidenceTool, verifyReceiptTool, verifyRecordTool, } from './tools.js';
+import { adjudicateDisputeTool, getDisputeTool, issueReceiptTool, openDisputeTool, recordDisclosureTool, recordRefundTool, submitEvidenceTool, verifyReceiptTool, verifyRecordTool, } from './tools.js';
 /** MCP packaging: exposes assure as tools any MCP-speaking agent can call, so an agent
  * (or its framework) can issue, verify, and chain receipts without importing the SDK.
  * Config via env — see envDeps(). */
@@ -45,7 +45,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.1.11' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.2.0' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {
@@ -71,6 +71,18 @@ export function buildServer(deps) {
             expectedSigner: z.string().optional(),
         },
     }, async ({ artifact, expectedSigner }) => json(await verifyReceiptTool(artifact, expectedSigner)));
+    server.registerTool('record_disclosure', {
+        title: 'Record counter-signed disclosure',
+        description: 'One-call disclosure evidence (EU AI Act Art 50 dialect): digests the disclosure text LOCALLY, signs an action record with your key, and the public ledger counter-signs it into your per-signer hash chain. No API key needed — first call self-provisions a free signer-keyed account.',
+        inputSchema: {
+            text: z.string().optional().describe('the disclosure text as presented — digested locally, never transmitted'),
+            textDigest: z.string().regex(/^0x[0-9a-fA-F]{64}$/).optional().describe('pre-computed digest (wins over text)'),
+            medium: z.string().optional().describe("channel: 'chat' | 'api' | 'voice' | 'ui' …"),
+            kind: z.enum(['ai-interaction', 'synthetic-content']).optional(),
+            agentId: z.string().describe('stable identifier for the disclosing agent'),
+            resourceUrl: z.string().url().optional(),
+        },
+    }, async (args) => json(await recordDisclosureTool(deps, args)));
     server.registerTool('verify_compliance_record', {
         title: 'Verify compliance record',
         description: 'Verify an Tersign compliance record + attestation (digest binding and signature).',

package/dist/mcp/tools.d.ts

@@ -55,3 +55,14 @@ export declare function submitEvidenceTool(deps: McpDeps, args: SubmitEvidenceAr
  * may pull the trigger once the route guard allows it). */
 export declare function adjudicateDisputeTool(deps: McpDeps, disputeDigest: `0x${string}`): Promise<unknown>;
 export declare function getDisputeTool(deps: McpDeps, disputeDigest: `0x${string}`): Promise<unknown>;
+export interface RecordDisclosureArgs {
+    text?: string | undefined;
+    textDigest?: `0x${string}` | undefined;
+    medium?: string | undefined;
+    kind?: 'ai-interaction' | 'synthetic-content' | undefined;
+    agentId: string;
+    resourceUrl?: string | undefined;
+}
+/** One-call counter-signed disclosure (public wedge route — no API key needed; the ledger
+ * defaults to the hosted instance). The text is digested locally; only the digest travels. */
+export declare function recordDisclosureTool(deps: McpDeps, args: RecordDisclosureArgs): Promise<import("../index.js").RecordDisclosureResult>;

package/dist/mcp/tools.js

@@ -83,3 +83,21 @@ export async function getDisputeTool(deps, disputeDigest) {
         throw new Error('ledger URL not configured — set TERSIGN_LEDGER_URL');
     return ledgerFetch(deps.ledgerHttp.url, `/v1/disputes/${disputeDigest}`);
 }
+/** One-call counter-signed disclosure (public wedge route — no API key needed; the ledger
+ * defaults to the hosted instance). The text is digested locally; only the digest travels. */
+export async function recordDisclosureTool(deps, args) {
+    if (!deps.signer)
+        throw new Error('no signing key configured');
+    const { recordDisclosure } = await import('../evidence/disclose.js');
+    return recordDisclosure({
+        ...(args.text !== undefined ? { text: args.text } : {}),
+        ...(args.textDigest !== undefined ? { textDigest: args.textDigest } : {}),
+        ...(args.medium !== undefined ? { medium: args.medium } : {}),
+        ...(args.kind !== undefined ? { kind: args.kind } : {}),
+        agentId: args.agentId,
+        ...(args.resourceUrl !== undefined ? { resourceUrl: args.resourceUrl } : {}),
+        ledger: deps.ledgerHttp?.url ?? 'https://tersign.ai',
+        account: deps.signer,
+        ...(deps.clock ? { clock: deps.clock } : {}),
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.1.11",
+  "version": "0.2.0",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",