tersign 0.4.2 → 0.4.3

package/README.md

@@ -159,6 +159,29 @@ Full URLs, readable without auth. If you are an agent, start here.
 
 ---
 
+## Contributing — read this before opening a pull request
+
+**`tersignhq/tersign-js` is a publish snapshot, not the development repository.** Each release
+overwrites `src/`, `test/` and the packaged manifests wholesale from an upstream working tree, so
+a pull request opened here cannot be merged in any durable way — the next release would silently
+erase it. That is a property of the pipeline, not a judgement on the change.
+
+Contributions are wanted; the mechanics just have to route around that:
+
+- **Bugs, questions, spec disagreements** — open an issue here. Issues are read, and they are the
+  right surface for anything that does not need to touch this tree.
+- **Code changes** — open the issue first with the diff or a description. The change is applied
+  upstream **preserving your authorship**, released, and the issue closed with a link to the
+  version that carries your work. Credit follows commit authorship, not a merge badge.
+- **Conformance disagreements** — the two-sided vector suite at
+  [tersignhq/evidence-record-conformance](https://github.com/tersignhq/evidence-record-conformance)
+  takes pull requests normally, and is the better venue for "this criterion is wrong" or "here is
+  the case it misses." External vectors have been merged there.
+
+If a maintainer ever asks you to reopen work elsewhere because of this, that is why.
+
+---
+
 <p align="center">
   <img src="https://raw.githubusercontent.com/tersignhq/.github/main/assets/seal.svg" alt="Tersign seal" width="72">
 </p>

package/dist/envelope/serialize.js

@@ -29,7 +29,7 @@ export function toInternetCourtSubmission(env) {
                 : ''),
         envelope: env,
         howToVerify: `GET ${env.verifyUrl} (no account) recomputes the hash-chain link and returns chainOk; ` +
-            `or recompute locally: linkDigest = keccak256(canonical({artifactDigest, prevDigest, seq})) ` +
+            `or recompute locally: linkDigest = keccak256(artifactDigestBytes || prevDigestBytes || uint64be(seq)) ` +
             `and recover the counter-signature to ${env.chain.ledgerSigner}.`,
     });
     if (out.length > VENUE_SUBMISSION_MAX_CHARS) {

package/dist/envelope/types.d.ts

@@ -22,7 +22,8 @@ export interface EvidenceEnvelopeV1 {
     };
     chain: {
         prevDigest: `0x${string}` | null;
-        /** digestOf({artifactDigest, prevDigest, seq}) — what the ledger counter-signs */
+        /** keccak256(artifactDigest ‖ prevDigest ‖ uint64be(seq)) — byte concat, NOT canonical-JSON
+         * (fixed 2026-08-27: the old comment described a different, wrong recipe) — what the ledger counter-signs */
         linkDigest: `0x${string}`;
         countersignature: `0x${string}`;
         ledgerSigner: `0x${string}`;

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.4.2";
+    readonly version: "0.4.3";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -45,7 +45,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.2' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.3' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",