tersign 0.4.9 → 0.4.11

package/README.md

@@ -74,7 +74,7 @@ npm i tersign
 |---|---|
 | Receipts | Seller-signed EIP-712 (x402 offer-receipt extension), keccak256 canonical digests |
 | `withAssure()` | x402 fetch-handler adapter — a receipt per paid call |
-| Compliance records | EU Art-226b minimal tier · EN 16931 full tier · HK IRO s.51C retention |
+| Compliance exports | EU Art-226b minimal tier · EN 16931 full tier · HK IRO s.51C retention |
 | Action records | `ActionRecordV1` — GDPR-minimized; captures the content of an Art-50 disclosure so the disclosure itself is independently attested, not self-reported |
 | Refunds | Chained to the original receipt via `refundOf` |
 | Disputes v0 | Objective reason codes, evidence submission, adjudication |

package/dist/keystore.js

@@ -25,6 +25,19 @@ function readKeychain() {
 function writeKeychain(key) {
     if (process.platform !== 'darwin')
         return false;
+    // Preflight, added 2026-08-30. `security add-generic-password` does not merely FAIL when no
+    // login keychain is reachable — it raises a MODAL macOS dialog ("A keychain cannot be found
+    // to store …"), which blocks a headless run and ambushes anyone whose first command is
+    // `npx tersign`. Seen for real while probing first-run behaviour with a sandboxed HOME; the
+    // same shape hits a Mac CI runner, an ssh session with a locked keychain, and any sandbox.
+    // `security default-keychain` answers the question silently, so ask it before writing and
+    // fall through to the 0600 keyfile when the answer is no.
+    try {
+        execFileSync('security', ['default-keychain'], { stdio: ['ignore', 'ignore', 'ignore'] });
+    }
+    catch {
+        return false;
+    }
     try {
         execFileSync('security', ['add-generic-password', '-s', KEYCHAIN_SERVICE, '-a', userInfo().username, '-w', key, '-U'], { stdio: ['ignore', 'ignore', 'ignore'] });
         return true;

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.4.9";
+    readonly version: "0.4.11";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -49,7 +49,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.9' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.4.11' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",