tersign 0.4.3 → 0.4.4

package/README.md

@@ -47,6 +47,8 @@ The text is digested **locally** (only the digest travels — data-minimization
 
 Every entry takes the same path: the seller **signs** the receipt (EIP-712, x402 offer-receipt extension) → Tersign computes the **keccak256 canonical digest** → the digest joins that **seller's hash chain**, each `seq n` bound to `seq n−1` → the neutral ledger **counter-signs** (secp256k1) → **anyone verifies**, and any venue gets a serialized envelope.
 
+Since 2026-08-28 each anchor stamps a chain commitment — an accumulator over every counter-signed link — so one anchored digest covers the whole prefix; rows anchored earlier bind the head record only and say so (`subjectSchema`).
+
 ```mermaid
 graph LR
     A["agent transaction<br/>x402"] --> B["seller-signed receipt<br/>EIP-712"]
@@ -137,7 +139,7 @@ The agent skill `tersign-evidence` ships at [tersignhq/skills](https://github.co
 - **Ledger + dashboard** — public verify page: https://tersign.ai/verify
 - **Census** — hash-chained observations across the live x402 seller catalog, probed autonomously; the numbers are served live, never quoted stale: https://prober.tersign.ai/v1/prober/stats
 - **Conformance** — RFC 8785 (JCS) canonical serialization, keccak256 digests, and the public two-sided vector suite (canonical bytes, number domain, content address, chain continuity, completeness, anchored existence, phase separation, offer binding, independence — every criterion carrying both an accepting and an adversarial vector): [tersignhq/evidence-record-conformance](https://github.com/tersignhq/evidence-record-conformance). Reproduce the bytes and your implementation is conformant — in any language.
-- **Standards** — the `compliance-fields` extension — a typed compliance-record schema plus four evaluator-side disqualifications (independence, completeness/existence, economic-phase separation, and commitment scope — an independence claim reaches exactly as far as the record's own commitments), each executable as a two-sided conformance vector — is under review upstream ([x402-foundation/x402#2853](https://github.com/x402-foundation/x402/pull/2853)) and referenced in the x402 TSC's evidence-record charter agenda ([tsc#4](https://github.com/x402-foundation/tsc/issues/4)). The merged offer-receipt spec already carries the completeness criterion at SHOULD strength (§4.5.1, [#2811](https://github.com/x402-foundation/x402/pull/2811)).
+- **Standards** — the `compliance-fields` extension — a typed compliance-record schema plus four evaluator-side disqualifications (independence, completeness/existence, economic-phase separation, and commitment scope — an independence claim reaches exactly as far as the record's own commitments), each executable as a two-sided conformance vector — is under review upstream ([x402-foundation/x402#2853](https://github.com/x402-foundation/x402/pull/2853)) and referenced in the x402 TSC's evidence-record charter agenda ([tsc#4](https://github.com/x402-foundation/tsc/issues/4)). The merged offer-receipt spec already carries post-session verification guidance — signer authorization evaluated as of `issuedAt`, with mutable-source rotation handled explicitly ([#2811](https://github.com/x402-foundation/x402/pull/2811), merged); the completeness, independence, existence and phase disqualifications are the open extension's normative core.
 
 ## Machine Surfaces
 

package/dist/canonical.d.ts

@@ -1,3 +1,4 @@
+import { type Hex } from 'viem';
 /** Deterministic JSON — RFC 8785 (JCS) conformant for JSON-domain inputs: keys sorted by
  * UTF-16 code units, no whitespace, JSON.stringify scalar/escape semantics. Arrays keep
  * order; undefined properties are dropped (matches JSON.stringify semantics).
@@ -9,3 +10,57 @@
  * digest and all pinned wire vectors are unchanged. */
 export declare function canonicalStringify(value: unknown): string;
 export declare function digestOf(value: unknown): `0x${string}`;
+/** Hash-chain link, byte-identical to the hosted ledger's recompute: the ledger
+ * counter-signs `keccak256(artifactDigest || prevDigest-or-32-zero-bytes || uint64be(seq))`.
+ * `prevDigest` is the PREVIOUS record's artifactDigest (null at seq 1). */
+export declare const GENESIS_DIGEST: Hex;
+export declare function chainLinkDigest(artifactDigest: Hex, prevDigest: Hex | null, seq: number): Hex;
+/** Chain commitment accumulator (anchored since 2026-08-28). DERIVED, never signed, never
+ * stored per row: acc_0 = keccak256(utf8("tersign-chain-commitment-v1")); acc_k =
+ * keccak256(acc_{k-1} || link_k). A pure function of (a_1..a_k, 1..k) — any omission,
+ * insertion, reordering or rewrite below k changes acc_k, so ONE anchored digest over acc_N
+ * commits to the whole prefix. The anchor stamps digestOf({acc, head, schema, seq}).
+ * Pinned cross-implementation (this SDK, the hosted ledger, the Python SDK and the evidence-bundle
+ * verifier share the same test vectors): edit all or none. */
+export declare const CHAIN_COMMITMENT_SCHEMA = "tersign-chain-commitment-v1";
+export declare const ACC_GENESIS: Hex;
+export declare function chainAccumulatorStep(acc: Hex, link: Hex): Hex;
+export type ChainCommitment = {
+    acc: Hex;
+    head: Hex;
+    schema: typeof CHAIN_COMMITMENT_SCHEMA;
+    seq: number;
+};
+export declare function chainCommitment(seq: number, head: Hex, acc: Hex): ChainCommitment;
+/** keccak256 over the JCS bytes of the commitment object — the anchored subject digest. */
+export declare function commitmentDigest(seq: number, head: Hex, acc: Hex): Hex;
+/** A set of records that does not re-walk (gap, prev ≠ previous artifact, wrong seq): no
+ * accumulator is derived over it — a value no independent recompute would reproduce. */
+export declare class ChainIntegrityError extends Error {
+}
+export type ChainRecordLike = {
+    artifactDigest: Hex;
+    prevDigest: Hex | null;
+    seq: number;
+};
+/** Fold records 1..N (in seq order, dense, prev-continuous). Returns acc_N and the head
+ * artifact digest a_N. Throws ChainIntegrityError on any discontinuity or on an empty set. */
+export declare function foldAccumulator(records: ChainRecordLike[]): {
+    acc: Hex;
+    head: Hex;
+};
+export type CommitmentVerifyResult = {
+    ok: boolean;
+    acc: Hex;
+    digest: Hex;
+    reason?: string;
+};
+/** Recompute the accumulator over `records` (seq 1..N as served by the ledger) and compare it
+ * to an anchored commitment (the `commitment` object from `/v1/receipts/{digest}/verify`, or
+ * any `{seq, acc, head?}`). `acc`/`digest` are the RECOMPUTED values — compare `digest` to the
+ * anchor's subjectDigest. A truncated, substituted, reordered or renumbered prefix fails. */
+export declare function verifyCommitment(records: ChainRecordLike[], commitment: {
+    seq: number;
+    acc: Hex | string;
+    head?: Hex | string;
+}): CommitmentVerifyResult;

package/dist/canonical.js

@@ -1,4 +1,4 @@
-import { keccak256, toBytes } from 'viem';
+import { concatHex, keccak256, numberToHex, stringToHex, toBytes } from 'viem';
 /** Deterministic JSON — RFC 8785 (JCS) conformant for JSON-domain inputs: keys sorted by
  * UTF-16 code units, no whitespace, JSON.stringify scalar/escape semantics. Arrays keep
  * order; undefined properties are dropped (matches JSON.stringify semantics).
@@ -33,3 +33,76 @@ function serialize(value) {
 export function digestOf(value) {
     return keccak256(toBytes(canonicalStringify(value)));
 }
+/** Hash-chain link, byte-identical to the hosted ledger's recompute: the ledger
+ * counter-signs `keccak256(artifactDigest || prevDigest-or-32-zero-bytes || uint64be(seq))`.
+ * `prevDigest` is the PREVIOUS record's artifactDigest (null at seq 1). */
+export const GENESIS_DIGEST = `0x${'0'.repeat(64)}`;
+export function chainLinkDigest(artifactDigest, prevDigest, seq) {
+    return keccak256(concatHex([artifactDigest, prevDigest ?? GENESIS_DIGEST, numberToHex(seq, { size: 8 })]));
+}
+/** Chain commitment accumulator (anchored since 2026-08-28). DERIVED, never signed, never
+ * stored per row: acc_0 = keccak256(utf8("tersign-chain-commitment-v1")); acc_k =
+ * keccak256(acc_{k-1} || link_k). A pure function of (a_1..a_k, 1..k) — any omission,
+ * insertion, reordering or rewrite below k changes acc_k, so ONE anchored digest over acc_N
+ * commits to the whole prefix. The anchor stamps digestOf({acc, head, schema, seq}).
+ * Pinned cross-implementation (this SDK, the hosted ledger, the Python SDK and the evidence-bundle
+ * verifier share the same test vectors): edit all or none. */
+export const CHAIN_COMMITMENT_SCHEMA = 'tersign-chain-commitment-v1';
+export const ACC_GENESIS = keccak256(stringToHex(CHAIN_COMMITMENT_SCHEMA));
+export function chainAccumulatorStep(acc, link) {
+    return keccak256(concatHex([acc, link]));
+}
+export function chainCommitment(seq, head, acc) {
+    return { acc, head, schema: CHAIN_COMMITMENT_SCHEMA, seq };
+}
+/** keccak256 over the JCS bytes of the commitment object — the anchored subject digest. */
+export function commitmentDigest(seq, head, acc) {
+    return digestOf(chainCommitment(seq, head, acc));
+}
+/** A set of records that does not re-walk (gap, prev ≠ previous artifact, wrong seq): no
+ * accumulator is derived over it — a value no independent recompute would reproduce. */
+export class ChainIntegrityError extends Error {
+}
+/** Fold records 1..N (in seq order, dense, prev-continuous). Returns acc_N and the head
+ * artifact digest a_N. Throws ChainIntegrityError on any discontinuity or on an empty set. */
+export function foldAccumulator(records) {
+    if (records.length < 1)
+        throw new ChainIntegrityError('no records to fold');
+    let acc = ACC_GENESIS;
+    let prev = null;
+    for (let i = 0; i < records.length; i++) {
+        const r = records[i];
+        if (r.seq !== i + 1)
+            throw new ChainIntegrityError(`seq ${r.seq} at position ${i + 1}`);
+        if ((r.prevDigest ?? null) !== prev)
+            throw new ChainIntegrityError(`prev mismatch at seq ${r.seq}`);
+        acc = chainAccumulatorStep(acc, chainLinkDigest(r.artifactDigest, prev, r.seq));
+        prev = r.artifactDigest;
+    }
+    return { acc, head: prev };
+}
+/** Recompute the accumulator over `records` (seq 1..N as served by the ledger) and compare it
+ * to an anchored commitment (the `commitment` object from `/v1/receipts/{digest}/verify`, or
+ * any `{seq, acc, head?}`). `acc`/`digest` are the RECOMPUTED values — compare `digest` to the
+ * anchor's subjectDigest. A truncated, substituted, reordered or renumbered prefix fails. */
+export function verifyCommitment(records, commitment) {
+    let folded;
+    try {
+        folded = foldAccumulator(records);
+    }
+    catch (err) {
+        const reason = err instanceof ChainIntegrityError ? err.message : String(err);
+        return { ok: false, acc: ACC_GENESIS, digest: GENESIS_DIGEST, reason: `records do not re-walk: ${reason}` };
+    }
+    const digest = commitmentDigest(records.length, folded.head, folded.acc);
+    if (records.length !== commitment.seq) {
+        return { ok: false, acc: folded.acc, digest, reason: `records cover seq ≤ ${records.length}, commitment covers seq ≤ ${commitment.seq}` };
+    }
+    if (folded.acc.toLowerCase() !== String(commitment.acc).toLowerCase()) {
+        return { ok: false, acc: folded.acc, digest, reason: 'accumulator mismatch: the commitment was not built over this prefix' };
+    }
+    if (commitment.head !== undefined && folded.head.toLowerCase() !== String(commitment.head).toLowerCase()) {
+        return { ok: false, acc: folded.acc, digest, reason: 'head mismatch: the commitment names a different head record' };
+    }
+    return { ok: true, acc: folded.acc, digest };
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export * from './types.js';
-export { canonicalStringify, digestOf } from './canonical.js';
+export { canonicalStringify, digestOf, GENESIS_DIGEST, chainLinkDigest, CHAIN_COMMITMENT_SCHEMA, ACC_GENESIS, chainAccumulatorStep, chainCommitment, commitmentDigest, foldAccumulator, verifyCommitment, ChainIntegrityError, type ChainCommitment, type ChainRecordLike, type CommitmentVerifyResult, } from './canonical.js';
 export { RECEIPT_DOMAIN, RECEIPT_TYPES, OFFER_DOMAIN, OFFER_TYPES, signReceipt, signOffer, verifyReceipt, type VerifyResult, } from './receipt/eip712.js';
 export { COMPLIANCE_DOMAIN, COMPLIANCE_TYPES, COMPLIANCE_WIRE_VECTOR, buildMinimalRecord, recordDigest, signComplianceRecord, verifyComplianceRecord, type IssuerConfig, type MinimalRecordInput, } from './compliance/record.js';
 export { MemoryIdempotencyStore, checkIdempotency, extractPaymentId, fingerprint, REPLAY_HEADER, type IdempotencyStore, type IdempotencyOutcome, type IdempotencyOptions, type CachedResponse, type FingerprintParts, } from './idempotency/middleware.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 export * from './types.js';
-export { canonicalStringify, digestOf } from './canonical.js';
+export { canonicalStringify, digestOf, GENESIS_DIGEST, chainLinkDigest, CHAIN_COMMITMENT_SCHEMA, ACC_GENESIS, chainAccumulatorStep, chainCommitment, commitmentDigest, foldAccumulator, verifyCommitment, ChainIntegrityError, } from './canonical.js';
 export { RECEIPT_DOMAIN, RECEIPT_TYPES, OFFER_DOMAIN, OFFER_TYPES, signReceipt, signOffer, verifyReceipt, } from './receipt/eip712.js';
 export { COMPLIANCE_DOMAIN, COMPLIANCE_TYPES, COMPLIANCE_WIRE_VECTOR, buildMinimalRecord, recordDigest, signComplianceRecord, verifyComplianceRecord, } from './compliance/record.js';
 export { MemoryIdempotencyStore, checkIdempotency, extractPaymentId, fingerprint, REPLAY_HEADER, } from './idempotency/middleware.js';

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.4.3";
+    readonly version: "0.4.4";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -45,7 +45,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.3' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.4' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/dist/verify-bin.js

@@ -48,6 +48,13 @@ async function checkLedger(digest, url) {
         fail('ledger record found but the counter-signed hash-chain does NOT verify');
     console.log(`ledger:    ${url}`);
     console.log(`           counter-signed OK (seller ${body.sellerId}, seq ${body.seq}, ledger key ${body.ledgerSigner})`);
+    // Present once the record sits under an anchored chain commitment (anchors since 2026-08-28):
+    // the accumulator covers every seq ≤ commitment.seq, so the anchor binds this record too.
+    const c = body.commitment;
+    if (c) {
+        const block = c.bitcoinBlockHeight ? ` block ${c.bitcoinBlockHeight}` : '';
+        console.log(`           commitment: seq ≤ ${c.seq} committed (acc ${c.acc.slice(0, 10)}…) — ${c.status}${block}`);
+    }
 }
 if (/^0x[0-9a-f]{64}$/i.test(target)) {
     await checkLedger(target, ledger ?? DEFAULT_LEDGER);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",