@ainra/mcp 0.7.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainra/mcp",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "AINRA as native agent tools — a zero-dependency MCP server wrapping the published verifier, the public record, and the registrar you control.",
   "license": "Apache-2.0 OR MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "src/"
   ],
   "dependencies": {
-    "@ainra/sdk": "^0.7.0"
+    "@ainra/sdk": "^0.8.0"
   },
   "homepage": "https://ainra.org/",
   "repository": {

package/src/reasons.json

@@ -1,5 +1,5 @@
 {
-  "_note": "The 20 frozen INVALID reasons, in verify order, each in plain words. Single source for the CLI/SDK/MCP/console legends and docs. The strings themselves are frozen (they match crates/ainra-core/src/verify.rs and packages/sdk-ts Reason); only these glosses are editorial. tools/reasons-check.mjs fails the build if this list and ainra-core's Reason::ALL ever diverge.",
+  "_note": "The 21 frozen INVALID reasons: the 20 the nine-step verify returns, in verify order, then denied_by_policy, which only a gate with its own policy returns (D-100) — each in plain words. Single source for the CLI/SDK/MCP/console legends and docs. The strings themselves are frozen (they match crates/ainra-core/src/verify.rs and packages/sdk-ts Reason); only these glosses are editorial. tools/reasons-check.mjs fails the build if this list and ainra-core's Reason::ALL ever diverge.",
   "valid": "All nine checks passed — genuine, in-window, in-scope, logged, and not revoked.",
   "schema_violation": "Not a well-formed passport, or it carries a forbidden (identity/score/money) field.",
   "name_malformed": "The subject or issuer name doesn't fit the AINRA name grammar.",
@@ -20,5 +20,6 @@
   "instance_expired": "The running copy's instance credential is outside its window, or its lifetime exceeds the one-hour ADR-019 ceiling. The passport is fine — the copy needs a fresh credential.",
   "instance_scope_exceeds": "The instance credential asks for a capability its passport does not hold. A running copy may only narrow, never widen (ADR-019).",
   "instance_sig_invalid": "The instance credential was not minted by this passport's control key, or is not bound to this passport (wrong subject or wrong logged leaf).",
-  "instance_pop_invalid": "The presenter did not prove it holds the instance key: wrong audience, a timestamp outside tolerance, or a bad proof-of-possession signature."
+  "instance_pop_invalid": "The presenter did not prove it holds the instance key: wrong audience, a timestamp outside tolerance, or a bad proof-of-possession signature.",
+  "denied_by_policy": "Genuine, but this gate's own policy refuses it: a local deny entry names its registrar, lineage or name, or the signed directory is older than the gate allows."
 }

package/src/tools.mjs

@@ -110,6 +110,11 @@ export const TOOLS = [
         roots: { type: "object", description: "The two ceremony root keys, { root_ed25519, root_slh } (roots.json). Obtain them out of band — never from the presenter." },
         audience: { type: "string", description: "YOUR audience (ADR-019), e.g. https://api.example. Required to accept an instance credential; a presenter can never supply it. Omit for plain passport bundles." },
         freshness: { type: "string", enum: ["F1", "F2", "F3"], description: "How old a status publication you accept: F1 30 s, F2 5 min (default), F3 24 h. Yours, never the bundle's." },
+        policy: {
+          type: "object", additionalProperties: false,
+          description: "YOUR own policy (D-100), optional. `deny`: registrar ids, lineages or exact names you refuse even when genuine. `max_directory_age_s`: refuse when the signed directory is older than this (off unless set, so offline use keeps working). It only ever turns accept into refuse, with the reason denied_by_policy.",
+          properties: { deny: { type: "array", items: { type: "string" } }, max_directory_age_s: { type: "integer", minimum: 0 } },
+        },
         now: { type: "integer", description: "Your clock, unix seconds. Defaults to this server's clock. Never read from the bundle." },
       },
       required: ["presentation"],
@@ -157,7 +162,10 @@ export const TOOLS = [
       const freshness = input.freshness ?? "F2";
       if (!["F1", "F2", "F3"].includes(freshness)) throw new Error("freshness must be F1, F2 or F3. Nothing was verified.");
       const audience = input.audience ?? "";
-      const verifier = Verifier.fromDirectoryB64(directory, roots.root_ed25519, roots.root_slh, freshness, false, audience);
+      const pol = input.policy ?? {};
+      if (pol.deny !== undefined && !(Array.isArray(pol.deny) && pol.deny.every((e) => typeof e === "string"))) throw new Error("policy.deny must be a list of registrar ids, lineages or names. Nothing was verified.");
+      if (pol.max_directory_age_s !== undefined && !(Number.isInteger(pol.max_directory_age_s) && pol.max_directory_age_s >= 0)) throw new Error("policy.max_directory_age_s must be a whole number of seconds. Nothing was verified.");
+      const verifier = Verifier.fromDirectoryB64(directory, roots.root_ed25519, roots.root_slh, freshness, false, audience, { deny: pol.deny, maxDirectoryAgeS: pol.max_directory_age_s });
       if (!verifier)
         throw new Error("the directory does not verify against the roots — nothing in it can be trusted, so nothing was verified.");
       const now = Number.isInteger(input.now) ? input.now : Math.floor(Date.now() / 1000);