tersign 0.4.5 → 0.4.6

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.4.5";
+    readonly version: "0.4.6";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -3,14 +3,18 @@ import { z } from 'zod';
 import { privateKeyToAccount } from 'viem/accounts';
 import { Assure } from '../assure.js';
 import { LedgerClient } from '../ledgerClient.js';
+import { resolveSignerKey } from '../keystore.js';
 import { adjudicateDisputeTool, getDisputeTool, issueReceiptTool, openDisputeTool, recordDisclosureTool, recordRefundTool, submitEvidenceTool, verifyReceiptTool, verifyRecordTool, } from './tools.js';
 /** MCP packaging: exposes assure as tools any MCP-speaking agent can call, so an agent
  * (or its framework) can issue, verify, and chain receipts without importing the SDK.
  * Config via env — see envDeps(). */
 export function envDeps(env = process.env) {
-    const key = env.TERSIGN_SELLER_KEY;
-    if (!key)
-        throw new Error('TERSIGN_SELLER_KEY (0x-prefixed private key) is required');
+    // Same key resolution as the CLI surfaces: TERSIGN_SELLER_KEY, else the OS keychain, else a
+    // 0600 keyfile, else generate one and persist it. record_disclosure's own description promises
+    // that first call self-provisions a signer-keyed account; before this the MCP entry point threw
+    // instead, so `npx tersign` died on first run for anyone who had not already exported a key —
+    // and no directory or sandbox could introspect the server at all.
+    const key = env.TERSIGN_SELLER_KEY ?? resolveSignerKey({ create: true }).key;
     const account = privateKeyToAccount(key);
     const assure = new Assure({
         signer: account,
@@ -45,7 +49,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.5' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.6' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",