tersign 0.4.5 → 0.4.7

package/dist/cli.js

@@ -3,13 +3,21 @@ const sub = process.argv[2];
 if (sub === undefined || sub === 'mcp') {
     if (sub === 'mcp')
         process.argv.splice(2, 1);
-    // Bare `npx tersign` with no config is almost always a curious human, not an MCP client —
-    // greet them with the wiring instructions instead of a stack trace.
-    if (!process.env.TERSIGN_SELLER_KEY) {
-        console.error('tersign: this command starts the MCP server, which needs TERSIGN_SELLER_KEY set.\n\n' +
-            'Wire it into your MCP client config:\n' +
-            '  { "mcpServers": { "tersign": { "command": "npx", "args": ["tersign"],\n' +
-            '      "env": { "TERSIGN_SELLER_KEY": "0x<your-seller-key>" } } } }\n\n' +
+    // Bare `npx tersign` at a prompt is almost always a curious human, not an MCP client — greet
+    // them rather than sitting mute on a stdio transport they are not speaking. The discriminator
+    // is the TTY, NOT the presence of a key: an MCP client, a directory's sandbox and a CI probe
+    // all arrive with stdin piped, and until 2026-08-29 every one of them hit a hard exit here.
+    // That made `npx tersign` fail on first run for anyone who had not already exported a key,
+    // left the server impossible to introspect or demonstrate anywhere, and contradicted
+    // record_disclosure's own published promise that the first call self-provisions. The key is
+    // no longer required — envDeps resolves through the shared keystore — so the greeting is now
+    // a courtesy for humans instead of a gate on everyone.
+    if (process.stdin.isTTY && !process.env.TERSIGN_SELLER_KEY) {
+        console.error('tersign: this starts the MCP server, which speaks JSON-RPC over stdin — nothing to see\n' +
+            'at a prompt. Wire it into your MCP client config:\n\n' +
+            '  { "mcpServers": { "tersign": { "command": "npx", "args": ["tersign"] } } }\n\n' +
+            'No key needed: the first call self-provisions a signer-keyed account (OS keychain,\n' +
+            'else ~/.tersign/signer.key). Set TERSIGN_SELLER_KEY to use your own.\n\n' +
             "Just exploring? Try:  tersign help   ·   tersign verify <receipt.json | 0xdigest> [--ledger url]");
         process.exit(1);
     }

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.4.5";
+    readonly version: "0.4.7";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -3,14 +3,18 @@ import { z } from 'zod';
 import { privateKeyToAccount } from 'viem/accounts';
 import { Assure } from '../assure.js';
 import { LedgerClient } from '../ledgerClient.js';
+import { resolveSignerKey } from '../keystore.js';
 import { adjudicateDisputeTool, getDisputeTool, issueReceiptTool, openDisputeTool, recordDisclosureTool, recordRefundTool, submitEvidenceTool, verifyReceiptTool, verifyRecordTool, } from './tools.js';
 /** MCP packaging: exposes assure as tools any MCP-speaking agent can call, so an agent
  * (or its framework) can issue, verify, and chain receipts without importing the SDK.
  * Config via env — see envDeps(). */
 export function envDeps(env = process.env) {
-    const key = env.TERSIGN_SELLER_KEY;
-    if (!key)
-        throw new Error('TERSIGN_SELLER_KEY (0x-prefixed private key) is required');
+    // Same key resolution as the CLI surfaces: TERSIGN_SELLER_KEY, else the OS keychain, else a
+    // 0600 keyfile, else generate one and persist it. record_disclosure's own description promises
+    // that first call self-provisions a signer-keyed account; before this the MCP entry point threw
+    // instead, so `npx tersign` died on first run for anyone who had not already exported a key —
+    // and no directory or sandbox could introspect the server at all.
+    const key = env.TERSIGN_SELLER_KEY ?? resolveSignerKey({ create: true }).key;
     const account = privateKeyToAccount(key);
     const assure = new Assure({
         signer: account,
@@ -45,7 +49,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.5' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.7' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",