tersign 0.3.0 → 0.4.2

package/README.md

@@ -20,14 +20,14 @@
 No account. No API key. This is the genesis receipt, `seq 1` on the production chain:
 
 ```sh
-npx tersign verify 0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4 --ledger https://tersign.ai
+npx tersign verify 0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4
 ```
 
 ```text
 ledger: counter-signed OK (seller tersign-first, seq 1 …) VALID
 ```
 
-`npx tersign verify <receipt.json | 0xdigest> [--ledger url]` recovers the EIP-712 signature **locally**, then checks the entry against the public chain — yours or anyone's. Prefer raw HTTP? The same proof, no CLI:
+`npx tersign verify <receipt.json | 0xdigest> [--ledger url]` recovers the EIP-712 signature **locally**. A bare digest is then checked against the Tersign ledger unless `--ledger` names another; a receipt file verifies offline and touches no chain at all. The ledger consulted is always printed. Prefer raw HTTP? The same proof, no CLI:
 
 ```sh
 curl https://tersign.ai/v1/receipts/0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4/verify
@@ -155,7 +155,7 @@ Full URLs, readable without auth. If you are an agent, start here.
 | llms.txt | https://raw.githubusercontent.com/tersignhq/tersign-js/main/llms.txt |
 | Conformance vectors (RFC 8785 + keccak256) | https://github.com/tersignhq/tersign-js/blob/main/test/fixtures/canonical-vectors.json |
 | Sample compliance record + digests | https://github.com/tersignhq/tersign-js/blob/main/test/fixtures/compliance-record.json |
-| Genesis verify | `npx tersign verify 0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4 --ledger https://tersign.ai` |
+| Genesis verify | `npx tersign verify 0xe5874f1ffe87f0a6dd9eb157730f67b86ee4538b125fe30fcc4e165213dd3fc4` |
 
 ---
 

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.3.0";
+    readonly version: "0.4.2";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -45,7 +45,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.3.0' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.2' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/dist/verify-bin.d.ts

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
-export {};
+/** Where a bare digest is checked when the caller names no ledger. */
+export declare const DEFAULT_LEDGER = "https://tersign.ai";

package/dist/verify-bin.js

@@ -4,7 +4,14 @@
  * the counter-signed hash-chain holds.
  *
  *   tersign-verify <receipt.json> [--signer 0xseller] [--ledger https://…]
- *   tersign-verify <0xdigest> --ledger https://…
+ *   tersign-verify <0xdigest> [--ledger https://…]
+ *
+ * A bare digest needs a ledger to check against, and with none named it uses the public
+ * Tersign ledger — the one the published digests live on — rather than refusing. The
+ * ledger actually used is always printed, so a reader can see which chain answered and
+ * that the choice was theirs to change. `--ledger` still wins whenever it is given; a
+ * receipt FILE with no `--ledger` verifies its signature locally and checks no chain,
+ * which is unchanged.
  */
 import { readFileSync } from 'node:fs';
 import { digestOf } from './canonical.js';
@@ -18,28 +25,32 @@ function fail(msg) {
     console.error(`INVALID: ${msg}`);
     process.exit(1);
 }
+/** Where a bare digest is checked when the caller names no ledger. */
+export const DEFAULT_LEDGER = 'https://tersign.ai';
 const target = process.argv[2];
 if (!target || target.startsWith('--')) {
     console.error('usage: tersign-verify <receipt.json | 0xdigest> [--signer 0xaddr] [--ledger url]');
+    console.error(`       a bare digest checks against ${DEFAULT_LEDGER} unless --ledger names another`);
     process.exit(2);
 }
 const ledger = arg('--ledger');
 const expectedSigner = arg('--signer');
-async function checkLedger(digest) {
-    if (!ledger)
-        return;
-    const res = await fetch(`${ledger.replace(/\/$/, '')}/v1/receipts/${digest}/verify`);
+async function checkLedger(digest, url) {
+    const res = await fetch(`${url.replace(/\/$/, '')}/v1/receipts/${digest}/verify`);
     const body = (await res.json());
+    // Name the ledger that answered, always — a verifier that hides which chain it consulted is
+    // making the reader take its word for the one fact the check exists to establish. Nothing
+    // beyond that: `--ledger` is documented in usage and the README, and the failure path is not
+    // the place to advertise the alternative to the thing that just failed.
     if (!body.found)
-        fail(`ledger has no record of ${digest}`);
+        fail(`no record of ${digest} on the Tersign ledger (${url})`);
     if (!body.chainOk)
         fail('ledger record found but the counter-signed hash-chain does NOT verify');
-    console.log(`ledger:    counter-signed OK (seller ${body.sellerId}, seq ${body.seq}, ledger key ${body.ledgerSigner})`);
+    console.log(`ledger:    ${url}`);
+    console.log(`           counter-signed OK (seller ${body.sellerId}, seq ${body.seq}, ledger key ${body.ledgerSigner})`);
 }
 if (/^0x[0-9a-f]{64}$/i.test(target)) {
-    if (!ledger)
-        fail('a bare digest can only be checked against a ledger — pass --ledger');
-    await checkLedger(target);
+    await checkLedger(target, ledger ?? DEFAULT_LEDGER);
     console.log('VALID');
     process.exit(0);
 }
@@ -73,5 +84,9 @@ if (record) {
         fail('compliance record is bound to a DIFFERENT receipt');
     console.log(`record:    OK (bound to receipt, signer ${rec.signer})`);
 }
-await checkLedger(digest);
+// A receipt FILE carries its own signature, so it verifies with no network at all. Only
+// check a chain when the caller asked for one — defaulting here would turn an offline
+// verification into a silent network call, which is the opposite of the point.
+if (ledger)
+    await checkLedger(digest, ledger);
 console.log('VALID');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.3.0",
+  "version": "0.4.2",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",