@ainra/mcp 0.5.0 → 0.6.0

package/README.md

@@ -41,8 +41,9 @@ freshness class and audience. Nothing a presenter put in the bundle is believed.
 
 > **In 0.4.1 this tool did not do that.** It replayed the bundle through the fixture-semantics verifier with the
 > bundle's own clock, freshness class and status list, so a revoked or expired presenter could be reported `valid`
-> (D-074). Upgrade. Replaying a conformance vector is still possible and is now a separate, labelled mode:
-> `anchors` plus `fixture: true`, which returns `decision: null`.
+> (D-074). Upgrade. In 0.5.0 replay was a separate, labelled mode (`anchors` plus `fixture: true`); since 0.6.0 the
+> tool has no replay mode at all and every answer is a decision. To replay a conformance vector, use
+> `@ainra/sdk/conformance`.
 
 `ainra_lookup` resolves a name to its public record; `ainra_status` reports the target's head — network, root label,
 registrar count, freshness window.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainra/mcp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AINRA as native agent tools — a zero-dependency MCP server wrapping the published verifier, the public record, and the registrar you control.",
   "license": "Apache-2.0 OR MIT",
   "type": "module",
@@ -17,10 +17,7 @@
     "src/"
   ],
   "dependencies": {
-    "@ainra/sdk": "*"
-  },
-  "peerDependencies": {
-    "@ainra/sdk": "*"
+    "@ainra/sdk": "^0.6.0"
   },
   "homepage": "https://ainra.org/",
   "repository": {

package/src/tools.mjs

@@ -9,7 +9,7 @@
 import { readFileSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
-import { runVector, Verifier, verdictEvent, serializeVerdictEvent, linkFromIndex, jwkThumbprintEd25519, strictB64u } from "@ainra/sdk";  // file:../sdk-ts in a checkout; ^x.y.z when published
+import { Verifier, verdictEvent, serializeVerdictEvent, linkFromIndex, presentedKeyThumbprint, strictB64u } from "@ainra/sdk";  // file:../sdk-ts in a checkout; ^x.y.z when published
 export { verdictEvent, serializeVerdictEvent }; // one event shape across CLI, middleware, MCP (docs/PRESENTATION.md)
 
 const ROOT = fileURLToPath(new URL("../../../", import.meta.url));
@@ -100,7 +100,7 @@ export const TOOLS = [
   {
     name: "ainra_verify",
     title: "Verify an AINRA passport",
-    description: "Decide whether a presentation someone handed you verifies. Pass the `presentation` with the signed `directory` and the two `roots` you trust (omit them and a URL target's own are fetched): the directory is checked against both roots, the status list against the registrar's status key, and the clock, the freshness class and the audience are YOURS — nothing a presenter put in the bundle is believed. Returns `decision` (accept or refuse), the verdict, and the named reason in plain words. Read-only. If the bundle carries an ADR-019 instance credential (a RUNNING COPY of an agent), pass your own `audience`; an empty audience refuses every instance credential. To replay a conformance VECTOR instead — which carries its own anchors, clock and status on purpose — pass `anchors` with `fixture: true`; that mode believes the bundle and decides nothing.",
+    description: "Decide whether a presentation someone handed you verifies. Pass the `presentation` with the signed `directory` and the two `roots` you trust (omit them and a URL target's own are fetched): the directory is checked against both roots, the status list against the registrar's status key, and the clock, the freshness class and the audience are YOURS — nothing a presenter put in the bundle is believed. Returns `decision` (accept or refuse), the verdict, and the named reason in plain words. Read-only. If the bundle carries an ADR-019 instance credential (a RUNNING COPY of an agent), pass your own `audience`; an empty audience refuses every instance credential. (Replaying a conformance vector is not this tool's job: use `@ainra/sdk/conformance`.)",
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     inputSchema: {
       type: "object",
@@ -111,8 +111,6 @@ export const TOOLS = [
         audience: { type: "string", description: "YOUR audience (ADR-019), e.g. https://api.example. Required to accept an instance credential; a presenter can never supply it. Omit for plain passport bundles." },
         freshness: { type: "string", enum: ["F1", "F2", "F3"], description: "How old a status publication you accept: F1 30 s, F2 5 min (default), F3 24 h. Yours, never the bundle's." },
         now: { type: "integer", description: "Your clock, unix seconds. Defaults to this server's clock. Never read from the bundle." },
-        anchors: { type: "object", description: "FIXTURE MODE ONLY: a conformance vector's own trust anchors (issuer_key + log_root_key per registrar). Requires `fixture: true`." },
-        fixture: { type: "boolean", description: "Replay a conformance vector with fixture semantics: the bundle's own clock, freshness class and status list are believed. Decides nothing about a real presenter." },
       },
       required: ["presentation"],
     },
@@ -138,28 +136,11 @@ export const TOOLS = [
         };
       };
 
-      // ── fixture mode: a conformance vector, replayed. Explicit, labelled, and never a decision (D-074). ──────
-      if (input.anchors !== undefined && input.directory === undefined && input.roots === undefined) {
-        if (input.fixture !== true)
-          throw new Error(
-            "ainra_verify with `anchors` replays a conformance vector: it believes the bundle's own clock, freshness " +
-            "class and status list, so a revoked or expired presenter could make it say valid. To decide whether to " +
-            "trust a presentation, pass the signed `directory` and the `roots` instead. To replay a vector on " +
-            "purpose, add `fixture: true`. Nothing was verified.");
-        // The audience is the CALLER's even here; everything else is the vector's, which is what a vector is for.
-        const presentation = { ...input.presentation, audience: input.audience ?? "" };
-        const v = runVector({ name: "mcp", expect: {}, anchors: input.anchors, presentation });
-        return {
-          mode: "fixture",
-          decision: null,
-          warning: "FIXTURE SEMANTICS: the bundle's own clock, freshness class and status list were believed. This replays a conformance vector; it does not decide whether to trust a presenter.",
-          verdict: v.verdict,
-          reason: v.reason ?? null,
-          explanation: gloss(v),
-          event: verdictEvent(presentation, v, presentation?.now ?? 0),
-          instance: instanceReport(presentation, v, presentation.audience),
-        };
-      }
+      // Fixture mode was removed in 0.6.0 (PLAN-M48 step 7). It replayed a vector by believing the bundle's own clock,
+      // class and status list; an agent that reached for it to decide trust would have been told a revoked presenter
+      // was valid (D-074). Conformance replay lives in `@ainra/sdk/conformance`, where the import says what it is.
+      if (input.anchors !== undefined || input.fixture !== undefined)
+        throw new Error("ainra_verify no longer replays conformance vectors (fixture mode was removed in 0.6.0): it only decides, against a signed `directory` and its `roots`. To replay a vector, use `@ainra/sdk/conformance` or `ainra verify`. Nothing was verified.");
 
       // ── gate mode: what a verifier decides. The directory against both roots; the status against the registrar's
       // status key; the clock, the class and the audience from the CALLER. ─────────────────────────────────────────
@@ -196,12 +177,12 @@ export const TOOLS = [
   {
     name: "ainra_verify_link",
     title: "Who stands behind this agent key?",
-    description: "AINRA Link (D-078): after you have verified a request's signature with an agent's Ed25519 key, ask which accountable operator stands behind that key and whether the link is still good. Pass the key (`key`, base64url), and either the `link` as a gate receives it, or the registrar's link `index` (GET /links) and its signed `status` publication (GET /status-list), from which the link for your key is found. Trust is YOURS: the signed `directory` and the two `roots` (omit both to use AINRA_TARGET's). The status list is authenticated before it is read; the clock, freshness class and capability are yours. Returns `decision` (accept or refuse), the operator and passport on accept, or the named reason. Read-only. A key with no link at all is refused as not_linked.",
+    description: "AINRA Link (D-078): after you have verified a signature with an agent's key — Ed25519, or secp256k1 as ES256K (D-082) — ask which accountable operator stands behind that key and whether the link is still good. Pass the key (`key`, base64url), and either the `link` as a gate receives it, or the registrar's link `index` (GET /links) and its signed `status` publication (GET /status-list), from which the link for your key is found. Trust is YOURS: the signed `directory` and the two `roots` (omit both to use AINRA_TARGET's). The status list is authenticated before it is read; the clock, freshness class and capability are yours. Returns `decision` (accept or refuse), the operator and passport on accept, or the named reason. Read-only. A key with no link at all is refused as not_linked.",
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     inputSchema: {
       type: "object",
       properties: {
-        key: { type: "string", description: "The Ed25519 public key (base64url, 32 bytes) you ALREADY verified the request's signature with." },
+        key: { type: "string", description: "The public key (base64url) you ALREADY verified the signature with: 32 bytes for Ed25519, the 33-byte compressed point for ES256K (secp256k1)." },
         link: { type: "object", description: "The link as a gate receives it (an index entry with the checkpoint and the signed status publication)." },
         index: { type: "object", description: "Instead of `link`: the registrar's whole link index (GET /links)." },
         status: { type: "object", description: "With `index`: the registrar's signed status publication (GET /status-list)." },
@@ -215,11 +196,16 @@ export const TOOLS = [
     },
     async handler(input) {
       const keyBytes = typeof input.key === "string" ? strictB64u(input.key) : null;
-      if (!keyBytes || keyBytes.length !== 32) throw new Error("`key` must be a base64url Ed25519 public key (32 bytes). Nothing was verified.");
+      if (!keyBytes) throw new Error("`key` must be base64url. Nothing was verified.");
+      // By length, as every verifier: 32 bytes Ed25519, 33 a compressed secp256k1 point (D-082). Any other key is
+      // refused by name, as the core refuses it — not an input error, a decision.
+      if (keyBytes.length !== 32 && keyBytes.length !== 33)
+        return { decision: "refuse", verdict: "invalid", reason: "schema_violation" };
       let link = input.link;
       if (link === undefined) {
         if (!input.index || !input.status) throw new Error("pass either `link`, or both `index` (GET /links) and `status` (GET /status-list). Nothing was verified.");
-        link = linkFromIndex(input.index, input.status, jwkThumbprintEd25519(keyBytes));
+        const tp = presentedKeyThumbprint(keyBytes);
+        link = tp === null ? null : linkFromIndex(input.index, input.status, tp);
         if (!link)
           return { decision: "refuse", verdict: "invalid", reason: "not_linked",
                    explanation: "This key has no link at this registrar: a valid signature from it is not, by itself, an accountable operator." };