@ainra/middleware 0.4.0 → 0.5.0

package/README.md

@@ -2,7 +2,7 @@
 # @ainra/middleware
 
 A fail-closed gate for requests made by AI agents. Five lines in front of your handler, and a request gets through
-only if it carried a valid [AINRA](https://ainra.vercel.app/) passport.
+only if it carried a valid [AINRA](https://ainra.org/) passport.
 
 **Offline. Fail-closed. Zero telemetry.** The check is local — no account with us, no per-request call, nothing that
 can be down. A request with no passport, a revoked one, or one whose status cannot be freshly confirmed is refused
@@ -10,6 +10,7 @@ with a machine-readable reason.
 
 ```sh
 npm install @ainra/middleware
+npm audit signatures    # optional: check the Sigstore provenance before you trust it
 ```
 
 ## Connect / Express
@@ -29,6 +30,20 @@ app.post("/agent/order", (req, res) => {
 ```
 
 The passport arrives in the `x-ainra-passport` header (raw JSON or base64url of it), or in `body.ainra_passport`.
+
+**In production, send the bundle once** (M36, D-065). A full bundle is ~60 KB — over every common header limit —
+so a running copy posts it once and names it by digest after that:
+
+```ts
+import { ainraGate, ainraPrime, createPresentationStore, PRIME_PATH, Verifier } from "@ainra/middleware";
+const store = createPresentationStore();                         // bounded, in memory; share one behind a pool
+app.post(PRIME_PATH, express.json({ limit: "256kb" }), ainraPrime(verifier, { store }));   // 201 {ref}
+app.use("/agent", ainraGate(verifier, { store, requireSignature: true, seenNonce }));      // requests name the ref
+```
+
+Each request then carries `x-ainra-passport: <ref>`, `x-ainra-pop` and the RFC 9421 signature — ~11 KB in total,
+no line over 8 KB. A gate that does not hold the named bundle answers **428** `presentation_unknown`: send it again.
+Only bundles that verify VALID are stored, and every request re-verifies what it names.
 On refusal the gate answers **403** with `{ error, reason }`. Every response — allowed or refused — carries
 `x-ainra-verdict`, the canonical verdict event.
 

package/dist/index.d.ts

@@ -1,4 +1,17 @@
-import { Verifier, type Verdict, type VerdictEvent } from "@ainra/sdk";
+import { Verifier, type LinkIndex, type StatusPublication, type LinkVerdict, type Verdict, type VerdictEvent, type DecisionLog } from "@ainra/sdk";
+/** Where the gate keeps bundles a running copy has sent once. Only bundles that verified VALID when they arrived
+ *  are ever stored, the key is the SHA-256 of the content, and every request re-verifies what it names — so the
+ *  store can lose entries (the client just sends again) but cannot make anything pass that would not. */
+export interface PresentationStore {
+    get(ref: string, now: number): Record<string, unknown> | undefined;
+    put(ref: string, stable: Record<string, unknown>, expiresAt: number): void;
+}
+/** The default store: in memory, bounded, oldest-first eviction, and nothing outlives the credential it holds.
+ *  Bounded because whoever can mint valid bundles can otherwise fill it; eviction costs them nothing but costs an
+ *  honest client one re-send, which is the right way round. One process only — behind several, share a store. */
+export declare function createPresentationStore(opts?: {
+    max?: number;
+}): PresentationStore;
 export interface GateOptions {
     /** Verifier's clock, unix seconds. Default: `Date.now()/1000`. Pass a fixed value for a demo/test window. */
     now?: () => number;
@@ -6,6 +19,43 @@ export interface GateOptions {
     header?: string;
     /** Called on deny (before the 403 is sent) — for logging. Never receives secrets. */
     onDeny?: (reason: string) => void;
+    /** Require the REQUEST itself to be signed by the running copy's instance key (RFC 9421, D-062).
+     *
+     *  Off by default, and that default is a compatibility choice rather than a security opinion: turning it on
+     *  silently would reject every integrator who upgraded this package without changing a line of their agent.
+     *  Leave it off and a captured presentation replays against any route on this host until the credential
+     *  expires — which is what `docs/PLAN-M34.md` probed and found. Turn it on and the presentation is bound to one
+     *  method, one authority, one path and, when there is a body, that body.
+     *
+     *  Requires the bundle to carry an instance credential: there is no key to check a signature against without
+     *  one, so a passport-only presentation is refused rather than waved through. */
+    requireSignature?: boolean;
+    /** Close the replay window completely. Return true if this nonce has been seen before.
+     *
+     *  Without it, a captured signature stays usable against that exact target for five minutes. The cache cannot
+     *  live in the SDK (`ainra-core` is N7 — no state), so it lives with the caller who has somewhere to put it. */
+    seenNonce?: (nonce: string) => boolean;
+    /** M36 (D-065): where bundles sent to PRIME_PATH are kept, so requests can name them by digest. Pass the SAME
+     *  store to `ainraPrime`. Without one, a request that names a bundle by digest is refused `presentation_unknown`. */
+    store?: PresentationStore;
+    /** Header the per-request proof of possession arrives in when the bundle is named by digest. Default `x-ainra-pop`. */
+    popHeader?: string;
+    /** D-079: record every decision this gate can attribute to a named passport in a signed, chained log
+     *  (`createDecisionLog` from `@ainra/sdk`). A request that names no parseable passport has no subject and is not
+     *  recorded. The operator is recorded only on a valid decision: on an invalid one, the name in the claims is
+     *  the presenter's word. Never receives the request body. */
+    decisions?: DecisionLog;
+}
+/** What `requireSignature` needs from the request, beyond the bundle. A framework-agnostic shape so an edge
+ *  worker, a Node server and a test can all produce it. */
+export interface RequestBinding {
+    method: string;
+    /** host or host:port — no scheme, no path. */
+    authority: string;
+    /** path, including any query string, exactly as sent */
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    body?: Uint8Array;
 }
 export interface GateResult {
     allow: boolean;
@@ -16,10 +66,21 @@ export interface GateResult {
 }
 /** Verify one presentation bundle. FAIL CLOSED: anything that isn't a bundle that verifies VALID → `allow:false`.
  * Never throws. `bundle` may be a decoded object or a base64url-of-JSON string (what a header carries). */
-export declare function checkRequest(verifier: Verifier, bundle: unknown, opts?: GateOptions): GateResult;
+export declare function checkRequest(verifier: Verifier, bundle: unknown, opts?: GateOptions & {
+    binding?: RequestBinding;
+    pop?: string;
+}): GateResult;
 interface ReqLike {
     headers: Record<string, string | string[] | undefined>;
     body?: unknown;
+    /** Present on any Node/Express request; needed only when `requireSignature` is on. */
+    method?: string;
+    url?: string;
+    originalUrl?: string;
+    /** The RAW request body. A parsed body cannot be re-serialised back to the bytes that were signed, so when a
+     *  signer covered `content-digest` and this is absent, the gate refuses rather than guessing — capture it with
+     *  body-parser's `verify` hook (`(req, _res, buf) => { req.rawBody = buf; }`). */
+    rawBody?: Uint8Array;
     ainra?: GateResult;
 }
 interface ResLike {
@@ -38,4 +99,49 @@ type Next = () => void;
  * ```
  */
 export declare function ainraGate(verifier: Verifier, opts?: GateOptions): (req: ReqLike, res: ResLike, next: Next) => void;
+/**
+ * M36 (D-065): the handler a running copy sends its bundle to, once. Mount it at `PRIME_PATH` with the same store
+ * as the gate. It verifies the bundle IN FULL — proof of possession included — and keeps only bundles that verify
+ * VALID, keyed by the digest of their stable part; it answers 201 with that digest. Sending a bundle grants nothing
+ * by itself: every request that names it must still verify, and, with `requireSignature`, be signed.
+ *
+ * ```ts
+ * const store = createPresentationStore();
+ * app.post(PRIME_PATH, express.json({ limit: "256kb" }), ainraPrime(verifier, { store }));
+ * app.use("/agent", ainraGate(verifier, { store, requireSignature: true, seenNonce }));
+ * ```
+ */
+export declare function ainraPrime(verifier: Verifier, opts: {
+    store: PresentationStore;
+    now?: () => number;
+    onDeny?: (reason: string) => void;
+}): (req: ReqLike, res: ResLike) => void;
+export interface LinkGateOptions {
+    /** The Ed25519 key that verified THIS request's signature (your signature-agent, WIMSE or other verifier), or null
+     *  if it did not verify. AINRA never treats a key as verified on its own say-so. */
+    verifiedKey: (req: ReqLike) => Uint8Array | null | Promise<Uint8Array | null>;
+    /** The registrar's link index and signed status publication, as `GET /links` and `GET /status-list` serve them.
+     *  Cache them as you like; the status must stay inside the gate's freshness class or links read `stale_status`. */
+    source: () => Promise<{
+        index: LinkIndex;
+        status: StatusPublication;
+    }> | {
+        index: LinkIndex;
+        status: StatusPublication;
+    };
+    /** The capability this request exercises, if links may be narrowed. */
+    capability?: (req: ReqLike) => string | undefined;
+    now?: () => number;
+    decisions?: DecisionLog;
+    onDeny?: (reason: string) => void;
+}
+/**
+ * Connect/Express middleware in link mode: requests whose signing key is linked to an accountable operator, and not
+ * revoked, pass (with `req.ainraLink` attached); everything else gets 403 and a named reason, `not_linked` included.
+ * The Verifier carries the trust (directory, roots, freshness class), exactly as for passports.
+ */
+export declare function ainraLinkGate(verifier: Verifier, opts: LinkGateOptions): (req: ReqLike & {
+    ainraLink?: LinkVerdict;
+}, res: ResLike, next: Next) => Promise<void>;
 export { Verifier, verdictEvent, serializeVerdictEvent, type VerdictEvent } from "@ainra/sdk";
+export { PRIME_PATH, POP_HEADER, presentationRef, isPresentationRef } from "@ainra/sdk";

package/dist/index.js

@@ -7,13 +7,88 @@
 //! Two surfaces:
 //!   * `ainraGate(verifier, opts)` → Connect/Express `(req, res, next)` middleware.
 //!   * `checkRequest(verifier, bundle, opts)` → framework-agnostic `{ allow, reason?, verdict }` (edge/fetch).
-import { verdictEvent, serializeVerdictEvent } from "@ainra/sdk";
+import { verdictEvent, serializeVerdictEvent, decodeInstance, verifyPresentation, isPresentationRef, splitPresentation, joinPresentation, presentationRef, POP_HEADER, PRIME_PATH, decisionRequestDigest, linkFromIndex, jwkThumbprintEd25519, } from "@ainra/sdk";
+import { createHash } from "node:crypto";
+/** The default store: in memory, bounded, oldest-first eviction, and nothing outlives the credential it holds.
+ *  Bounded because whoever can mint valid bundles can otherwise fill it; eviction costs them nothing but costs an
+ *  honest client one re-send, which is the right way round. One process only — behind several, share a store. */
+export function createPresentationStore(opts = {}) {
+    const max = Math.max(1, opts.max ?? 1024);
+    const m = new Map();
+    return {
+        get(ref, now) {
+            const e = m.get(ref);
+            if (!e)
+                return undefined;
+            if (now >= e.exp) {
+                m.delete(ref);
+                return undefined;
+            }
+            m.delete(ref);
+            m.set(ref, e); // most recently used last, so eviction takes the idlest
+            return e.stable;
+        },
+        put(ref, stable, exp) {
+            m.delete(ref);
+            m.set(ref, { stable, exp });
+            while (m.size > max)
+                m.delete(m.keys().next().value);
+        },
+    };
+}
+/** How long a stored bundle may be named. A running copy's credential expires on its own (ADR-019, ≤ 1 h); a
+ *  passport presented directly carries a status list whose freshness is what matters, so it is kept briefly and
+ *  re-sent. Every use re-verifies at the current time regardless — this bounds memory, not trust. */
+const DIRECT_PASSPORT_TTL_SECS = 300;
 const DENY_SCHEMA = { verdict: "invalid", reason: "schema_violation" };
+/** Returns null when the request is bound to this presentation, or the reason it is not.
+ *
+ *  Presentation reasons are a SEPARATE vocabulary from the frozen credential reasons, on purpose: `sig_invalid`
+ *  means the registrar's signature is broken and sends an integrator to the wrong half of the system, when what
+ *  actually happened is that a perfectly good credential arrived on a request it was not signed for. */
+function checkBinding(parsed, opts, now) {
+    const req = opts.binding;
+    if (!req)
+        return "schema_violation"; // asked to require a signature with nothing to check it over
+    if (!parsed.instance)
+        return "presentation_unsigned"; // no instance key to verify against
+    let ic;
+    try {
+        ({ ic } = decodeInstance(parsed.instance));
+    }
+    catch {
+        return "schema_violation";
+    }
+    const r = verifyPresentation({
+        req: { method: req.method, authority: req.authority, path: req.path, headers: req.headers, body: req.body },
+        instance: { iid: ic.iid, ikey: ic.ikey },
+        now,
+        seenNonce: opts.seenNonce,
+    });
+    return r.ok ? null : r.reason;
+}
 /** Verify one presentation bundle. FAIL CLOSED: anything that isn't a bundle that verifies VALID → `allow:false`.
  * Never throws. `bundle` may be a decoded object or a base64url-of-JSON string (what a header carries). */
 export function checkRequest(verifier, bundle, opts = {}) {
     const now = (opts.now ?? (() => Math.floor(Date.now() / 1000)))();
     let parsed;
+    // M36 (D-065): the request names a bundle it sent earlier. Look it up and put the per-request proof of possession
+    // back where the verifier expects it — from here on it is the same bundle, checked the same way.
+    if (typeof bundle === "string" && isPresentationRef(bundle)) {
+        const stable = opts.store?.get(bundle.trim(), now);
+        if (!stable)
+            return { allow: false, reason: "presentation_unknown", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, now) };
+        let pop = null;
+        if (opts.pop !== undefined) {
+            try {
+                pop = JSON.parse(Buffer.from(opts.pop.trim(), "base64url").toString("utf8"));
+            }
+            catch {
+                return { allow: false, reason: "schema_violation", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, now) };
+            }
+        }
+        bundle = joinPresentation(stable, pop);
+    }
     try {
         if (typeof bundle === "string") {
             // Accept raw JSON or base64url(JSON) — a header is easiest as the latter.
@@ -31,8 +106,72 @@ export function checkRequest(verifier, bundle, opts = {}) {
         return { allow: false, reason: "schema_violation", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, now) };
     }
     const verdict = verifier.verify(parsed, now); // never throws; invalid on any failure
-    const allow = verdict.verdict === "valid";
-    return { allow, reason: allow ? undefined : verdict.reason, verdict, event: verdictEvent(parsed, verdict, now) };
+    let allow = verdict.verdict === "valid";
+    let reason = verdict.verdict === "valid" ? undefined : verdict.reason;
+    // The credential is good. That says an agent exists and is entitled — it says nothing about THIS request, which
+    // is the gap PLAN-M34 probed: the same bundle verified three times over with nothing naming a method, a host or
+    // a path. When the caller asks for it, bind the two together before allowing anything.
+    if (allow && opts.requireSignature) {
+        const bound = checkBinding(parsed, opts, now);
+        if (bound !== null) {
+            allow = false;
+            reason = bound;
+        }
+    }
+    return { allow, reason, verdict, event: verdictEvent(parsed, verdict, now) };
+}
+/** Build the signed-over view of an Express/Node request. `authority` comes from the Host header, which is what
+ *  the client addressed and therefore what it signed. */
+function bindingFromReq(req) {
+    const host = Array.isArray(req.headers.host) ? req.headers.host[0] : req.headers.host;
+    return {
+        method: req.method ?? "GET",
+        authority: host ?? "",
+        path: req.originalUrl ?? req.url ?? "/",
+        headers: req.headers,
+        body: req.rawBody,
+    };
+}
+/** D-079: write one decision to the gate's log, when the request named a passport. Nothing here can fail the
+ *  request: a decision log that cannot be written is the operator's alarm, not the agent's refusal. */
+function recordDecision(log, raw, result, req, opts) {
+    try {
+        const sub = result.event.name;
+        if (typeof sub !== "string" || sub === "")
+            return; // nothing parseable named: no subject to record
+        let b = {};
+        const v = Array.isArray(raw) ? raw[0] : raw;
+        if (typeof v === "string" && !isPresentationRef(v)) {
+            try {
+                b = JSON.parse(v.trim().startsWith("{") ? v : Buffer.from(v, "base64url").toString("utf8"));
+            }
+            catch { /* digests only */ }
+        }
+        else if (v && typeof v === "object")
+            b = v;
+        const binding = bindingFromReq(req);
+        const cd = binding.headers["content-digest"];
+        const valid = result.allow;
+        const digest = (text) => createHash("sha256").update(text).digest("base64url");
+        log.record({
+            at: (opts.now ?? (() => Math.floor(Date.now() / 1000)))(),
+            kind: "passport",
+            subject: sub,
+            ...(valid ? { operator: sub.split(":")[2] } : {}),
+            verdict: valid ? "valid" : "invalid",
+            ...(valid ? {} : { reason: result.reason ?? "schema_violation" }),
+            request: decisionRequestDigest({ method: binding.method, authority: binding.authority, path: binding.path, contentDigest: Array.isArray(cd) ? cd[0] : cd }),
+            ...(typeof b.status_uri === "string" && Number.isSafeInteger(b.status_issued_at) && typeof b.status_list === "string"
+                ? { status: { uri: b.status_uri, issued_at: b.status_issued_at, list: digest(b.status_list) } } : {}),
+            ...(b.checkpoint && typeof b.checkpoint.origin === "string" && Number.isSafeInteger(b.checkpoint.size) && typeof b.checkpoint.root === "string"
+                ? { checkpoint: { origin: b.checkpoint.origin, size: b.checkpoint.size, root: b.checkpoint.root } } : {}),
+        });
+    }
+    catch (e) {
+        // A presentation reason (e.g. presentation_unsigned) is not a credential reason and has no place in the closed
+        // record; and any other failure to record must surface without changing the decision.
+        console.error(`ainra: decision not recorded: ${e.message}`);
+    }
 }
 /**
  * Connect/Express middleware. Reads the presentation from the configured header (or `req.body.ainra_passport`),
@@ -45,12 +184,20 @@ export function checkRequest(verifier, bundle, opts = {}) {
  */
 export function ainraGate(verifier, opts = {}) {
     const header = (opts.header ?? "x-ainra-passport").toLowerCase();
+    const popHeader = (opts.popHeader ?? POP_HEADER).toLowerCase();
     return (req, res, next) => {
         const raw = req.headers[header] ?? req.body?.ainra_passport;
+        const popRaw = req.headers[popHeader];
         const result = raw === undefined
             ? { allow: false, reason: "schema_violation", verdict: DENY_SCHEMA, event: verdictEvent({}, DENY_SCHEMA, (opts.now ?? (() => Math.floor(Date.now() / 1000)))()) }
-            : checkRequest(verifier, Array.isArray(raw) ? raw[0] : raw, opts);
+            : checkRequest(verifier, Array.isArray(raw) ? raw[0] : raw, {
+                ...opts,
+                binding: opts.requireSignature ? bindingFromReq(req) : undefined,
+                pop: Array.isArray(popRaw) ? popRaw[0] : popRaw,
+            });
         req.ainra = result;
+        if (opts.decisions)
+            recordDecision(opts.decisions, raw, result, req, opts);
         // Emit the canonical verdict event on every request (allow or deny) — one event shape everywhere (PRESENTATION.md).
         res.setHeader("x-ainra-verdict", serializeVerdictEvent(result.event));
         if (result.allow) {
@@ -60,7 +207,121 @@ export function ainraGate(verifier, opts = {}) {
         if (opts.onDeny)
             opts.onDeny(result.reason ?? "schema_violation");
         res.setHeader("x-ainra-reason", result.reason ?? "schema_violation");
+        if (result.reason === "presentation_unknown") {
+            // Not a refusal of the agent: this gate simply does not hold the bundle the request names. 428 tells a client
+            // to send it (again) and retry, rather than to give up.
+            res.setHeader("link", `<${PRIME_PATH}>; rel="ainra-prime"`);
+            res.status(428).json({ error: "ainra: send the presentation first", reason: result.reason, prime: PRIME_PATH });
+            return;
+        }
         res.status(403).json({ error: "ainra: passport not valid", reason: result.reason });
     };
 }
+/**
+ * M36 (D-065): the handler a running copy sends its bundle to, once. Mount it at `PRIME_PATH` with the same store
+ * as the gate. It verifies the bundle IN FULL — proof of possession included — and keeps only bundles that verify
+ * VALID, keyed by the digest of their stable part; it answers 201 with that digest. Sending a bundle grants nothing
+ * by itself: every request that names it must still verify, and, with `requireSignature`, be signed.
+ *
+ * ```ts
+ * const store = createPresentationStore();
+ * app.post(PRIME_PATH, express.json({ limit: "256kb" }), ainraPrime(verifier, { store }));
+ * app.use("/agent", ainraGate(verifier, { store, requireSignature: true, seenNonce }));
+ * ```
+ */
+export function ainraPrime(verifier, opts) {
+    return (req, res) => {
+        const now = (opts.now ?? (() => Math.floor(Date.now() / 1000)))();
+        let body = req.body;
+        if ((body === undefined || typeof body !== "object") && req.rawBody) {
+            try {
+                body = JSON.parse(Buffer.from(req.rawBody).toString("utf8"));
+            }
+            catch {
+                body = undefined;
+            }
+        }
+        const deny = (reason) => {
+            if (opts.onDeny)
+                opts.onDeny(reason);
+            res.setHeader("x-ainra-reason", reason);
+            res.status(403).json({ error: "ainra: presentation not stored", reason });
+        };
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            return deny("schema_violation");
+        if ((req.method ?? "POST").toUpperCase() !== "POST")
+            return deny("schema_violation");
+        const result = checkRequest(verifier, body, { now: () => now });
+        res.setHeader("x-ainra-verdict", serializeVerdictEvent(result.event));
+        if (!result.allow)
+            return deny(result.reason ?? "schema_violation");
+        const bundle = body;
+        const { stable } = splitPresentation(bundle);
+        const iexp = typeof bundle.instance?.exp === "number" ? bundle.instance.exp : undefined;
+        const expiresAt = iexp ?? now + DIRECT_PASSPORT_TTL_SECS;
+        const ref = presentationRef(bundle);
+        opts.store.put(ref, stable, expiresAt);
+        res.status(201).json({ ref, expires: expiresAt });
+    };
+}
+/**
+ * Connect/Express middleware in link mode: requests whose signing key is linked to an accountable operator, and not
+ * revoked, pass (with `req.ainraLink` attached); everything else gets 403 and a named reason, `not_linked` included.
+ * The Verifier carries the trust (directory, roots, freshness class), exactly as for passports.
+ */
+export function ainraLinkGate(verifier, opts) {
+    const clock = opts.now ?? (() => Math.floor(Date.now() / 1000));
+    return async (req, res, next) => {
+        const t = clock();
+        let key = null;
+        try {
+            key = await opts.verifiedKey(req);
+        }
+        catch {
+            key = null;
+        }
+        let r;
+        let tp = null;
+        if (!key || key.length !== 32) {
+            r = { verdict: "invalid", reason: "sig_invalid" };
+        }
+        else {
+            tp = jwkThumbprintEd25519(key);
+            let link = null;
+            try {
+                const { index, status } = await opts.source();
+                link = linkFromIndex(index, status, tp);
+            }
+            catch {
+                link = null;
+            }
+            r = link ? verifier.verifyLink(link, key, t, opts.capability?.(req)) : { verdict: "invalid", reason: "not_linked" };
+        }
+        if (opts.decisions && tp) {
+            try {
+                const binding = bindingFromReq(req);
+                const cd = binding.headers["content-digest"];
+                opts.decisions.record({
+                    at: t, kind: "link", subject: tp,
+                    ...(r.verdict === "valid" ? { passport: r.passport, operator: r.operator } : {}),
+                    verdict: r.verdict,
+                    ...(r.verdict === "valid" ? {} : { reason: r.reason }),
+                    request: decisionRequestDigest({ method: binding.method, authority: binding.authority, path: binding.path, contentDigest: Array.isArray(cd) ? cd[0] : cd }),
+                });
+            }
+            catch (e) {
+                console.error(`ainra: decision not recorded: ${e.message}`);
+            }
+        }
+        if (r.verdict === "valid") {
+            req.ainraLink = r;
+            next();
+            return;
+        }
+        opts.onDeny?.(r.reason);
+        res.setHeader("x-ainra-reason", r.reason);
+        res.status(403).json({ error: "ainra: key not attributable", reason: r.reason });
+    };
+}
 export { Verifier, verdictEvent, serializeVerdictEvent } from "@ainra/sdk";
+export { PRIME_PATH, POP_HEADER, presentationRef, isPresentationRef } from "@ainra/sdk";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainra/middleware",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "AINRA verifier middleware — a fail-closed gate (Connect/Express + framework-agnostic) that verifies an AINRA passport on a request, over @ainra/sdk. The verification wedge: local, offline, ~5-line integration.",
   "license": "Apache-2.0 OR MIT",
   "type": "module",
@@ -14,13 +14,13 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@ainra/sdk": "^0.4.0"
+    "@ainra/sdk": "^0.5.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
     "typescript": "^5.6.0"
   },
-  "homepage": "https://ainra.vercel.app/",
+  "homepage": "https://ainra.org/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/JacobJandon/ainra.git"