@peac/mcp-server 0.11.3 → 0.12.0-preview.2

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { ERRORS } from '@peac/kernel';
-import { verifyLocal, issue, IssueError } from '@peac/protocol';
+import { verifyLocal, issueWire02, IssueError } from '@peac/protocol';
 import { base64urlDecode, decode, sha256Hex, sign, validateKeypair, derivePublicKey, base64urlEncode } from '@peac/crypto';
 import { readFile, mkdir, rename, rm, mkdtemp, writeFile, stat, lstat } from 'fs/promises';
 import { parseReceiptClaims } from '@peac/schema';
@@ -395,16 +395,15 @@ async function handleVerify(params) {
     const claims = result.claims;
     const claimsSummary = {
       iss: claims.iss,
-      aud: claims.aud,
-      rid: claims.rid,
-      variant: result.variant
+      kind: claims.kind,
+      type: claims.type,
+      jti: claims.jti,
+      ...claims.sub !== void 0 && { sub: claims.sub },
+      variant: result.variant,
+      wireVersion: result.wireVersion
     };
-    if (result.variant === "commerce") {
-      claimsSummary.amt = claims.amt;
-      claimsSummary.cur = claims.cur;
-    }
     const tr = truncateResponse(
-      `Verification PASSED (${result.variant} receipt, kid=${result.kid})`,
+      `Verification PASSED (${result.variant} receipt, kind=${claims.kind ?? "unknown"}, kid=${result.kid})`,
       policy
     );
     return {
@@ -637,49 +636,44 @@ async function handleIssue(params) {
       isError: true
     };
   }
-  if (input.ttl_seconds !== void 0 && input.ttl_seconds > policy.limits.max_ttl_seconds) {
-    return {
-      text: `Input rejected: ttl_seconds ${input.ttl_seconds} exceeds max_ttl_seconds ${policy.limits.max_ttl_seconds}`,
-      structured: {
-        ok: false,
-        code: "E_MCP_INVALID_INPUT",
-        message: `ttl_seconds ${input.ttl_seconds} exceeds policy max of ${policy.limits.max_ttl_seconds}`
-      },
-      isError: true
-    };
-  }
   const keyPatterns = buildKeyPatterns(context.issuerKey.privateKey, context.issuerKey.publicKey);
-  const now = Math.floor(Date.now() / 1e3);
-  const exp = input.ttl_seconds !== void 0 ? now + input.ttl_seconds : void 0;
   try {
-    const result = await issue({
+    if (input.policy && !input.policy.digest) {
+      return {
+        text: "Issue failed: policy.digest is required when policy block is provided",
+        structured: {
+          ok: false,
+          code: "E_MCP_ISSUE_FAILED",
+          message: "policy.digest is required when policy block is provided (uri/version alone is insufficient for binding)"
+        },
+        isError: true
+      };
+    }
+    const policyBlock = input.policy?.digest ? { digest: input.policy.digest, uri: input.policy.uri, version: input.policy.version } : void 0;
+    const result = await issueWire02({
       iss: context.issuerId,
-      aud: input.aud,
-      amt: input.amt,
-      cur: input.cur,
-      rail: input.rail,
-      reference: input.reference,
-      asset: input.asset,
-      env: input.env,
-      network: input.network,
-      evidence: input.evidence,
-      subject: input.subject,
-      exp,
+      kind: input.kind,
+      type: input.type,
+      sub: input.sub,
+      pillars: input.pillars,
+      occurred_at: input.occurred_at,
+      extensions: input.extensions,
+      policy: policyBlock,
       privateKey: context.issuerKey.privateKey,
       kid: context.issuerKey.kid
     });
     const { payload } = decode(result.jws);
     const claimsSummary = {
       iss: payload.iss,
-      aud: payload.aud,
+      kind: payload.kind,
+      type: payload.type,
       iat: payload.iat,
-      ...payload.exp !== void 0 ? { exp: payload.exp } : {},
-      rid: payload.rid,
-      amt: payload.amt,
-      cur: payload.cur
+      jti: payload.jti,
+      ...payload.sub !== void 0 ? { sub: payload.sub } : {},
+      ...payload.pillars !== void 0 ? { pillars: payload.pillars } : {}
     };
     const tr = truncateResponse(
-      `Receipt issued: rid=${claimsSummary.rid}, ${claimsSummary.amt} ${claimsSummary.cur}`,
+      `Receipt issued: jti=${claimsSummary.jti}, kind=${claimsSummary.kind}, type=${claimsSummary.type}`,
       policy
     );
     const safeText = sanitizeOutput(tr.text, keyPatterns);
@@ -1119,18 +1113,41 @@ var DecodeOutputSchema = z.object({
   verified: z.literal(false)
 });
 var IssueInputSchema = z.object({
-  aud: z.string().url().describe("Audience / resource URI (https://)"),
-  amt: z.number().int().nonnegative().describe("Amount in smallest currency unit"),
-  cur: z.string().regex(/^[A-Z]{3}$/).describe("ISO 4217 currency code (uppercase, e.g. USD)"),
-  rail: z.string().describe("Payment rail identifier"),
-  reference: z.string().describe("Unique payment reference"),
-  asset: z.string().optional().describe("Asset transferred (e.g. USDC) -- defaults to currency"),
-  env: z.enum(["live", "test"]).default("test").describe("Environment"),
-  network: z.string().optional().describe("Network/chain identifier"),
-  evidence: z.unknown().optional().describe("Rail-specific evidence (JSON-safe)"),
-  subject: z.string().url().optional().describe("Subject URI (https://)"),
-  ttl_seconds: z.number().int().positive().optional().describe("Time-to-live in seconds (computes exp = iat + ttl)"),
-  kind: z.string().optional().describe("Receipt kind for policy filtering")
+  kind: z.enum(["evidence", "challenge"]).describe("Structural kind: evidence (records interaction) or challenge (requests action)"),
+  type: z.string().min(1).max(256).refine(
+    (v) => /^https?:\/\//.test(v) || /^[a-zA-Z0-9][a-zA-Z0-9._-]*\.[a-zA-Z0-9._-]+\/[a-zA-Z0-9]/.test(v),
+    {
+      message: "type must be reverse-DNS (e.g. org.peacprotocol/payment) or absolute URI (https://...)"
+    }
+  ).describe("Semantic type in reverse-DNS or absolute URI form (e.g. org.peacprotocol/payment)"),
+  sub: z.string().max(2048).optional().describe("Subject identifier (resource or interaction target)"),
+  pillars: z.array(
+    z.enum([
+      "access",
+      "attribution",
+      "commerce",
+      "compliance",
+      "consent",
+      "identity",
+      "privacy",
+      "provenance",
+      "purpose",
+      "safety"
+    ])
+  ).optional().refine(
+    (arr) => !arr || new Set(arr).size === arr.length && [...arr].sort().every((v, i) => v === arr[i]),
+    { message: "pillars must be unique and sorted ascending" }
+  ).describe("Evidence pillars from closed 10-value taxonomy (sorted ascending)"),
+  occurred_at: z.string().optional().refine((v) => !v || !isNaN(Date.parse(v)), {
+    message: "occurred_at must be a valid ISO 8601 timestamp"
+  }).describe("ISO 8601 timestamp when interaction occurred (evidence kind only)"),
+  extensions: z.record(z.string(), z.unknown()).optional().describe("Extension groups keyed by reverse-DNS identifier"),
+  policy: z.object({
+    uri: z.string().url().max(2048).refine((v) => v.startsWith("https://"), { message: "policy.uri must use HTTPS" }).describe("Policy document URI (HTTPS only)"),
+    version: z.string().max(256).optional().describe("Policy version"),
+    digest: z.string().regex(/^sha256:[0-9a-f]{64}$/).optional().describe("Policy digest in sha256:<64 hex> format")
+  }).optional().describe("Policy binding block"),
+  ttl_seconds: z.number().int().positive().optional().describe("Reserved for future use (Wire 0.2 receipts do not expire)")
 });
 var MetaSchema4 = z.object({
   serverVersion: z.string(),
@@ -1139,12 +1156,12 @@ var MetaSchema4 = z.object({
 });
 var ClaimsSummarySchema = z.object({
   iss: z.string(),
-  aud: z.string(),
+  kind: z.string(),
+  type: z.string(),
   iat: z.number(),
-  exp: z.number().optional(),
-  rid: z.string(),
-  amt: z.number(),
-  cur: z.string()
+  jti: z.string(),
+  sub: z.string().optional(),
+  pillars: z.array(z.string()).optional()
 });
 var IssueOutputSchema = z.object({
   _meta: MetaSchema4,
@@ -1180,7 +1197,8 @@ function makeMeta(ctx, serverName) {
     serverName,
     serverVersion: ctx.version,
     policyHash: ctx.policyHash,
-    protocolVersion: ctx.protocolVersion
+    protocolVersion: ctx.protocolVersion,
+    wireFormatVersion: "0.2"
   };
 }
 function handlerResultToCallToolResult(result, meta) {
@@ -1372,8 +1390,8 @@ function createPeacMcpServer(options) {
     register(
       "peac_issue",
       {
-        title: "Issue PEAC Receipt",
-        description: "Sign and return a new PEAC receipt JWS. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).",
+        title: "Issue Wire 0.2 PEAC Receipt",
+        description: "Sign and return a Wire 0.2 PEAC receipt JWS. Accepts kind, type, pillars, extensions, and policy fields. Wire 0.2 only: Wire 0.1 fields are not accepted. Requires server configured with an Ed25519 issuer key (--issuer-key and --issuer-id).",
         inputSchema: IssueInputSchema,
         outputSchema: IssueOutputSchema,
         annotations: ISSUE_TOOL_ANNOTATIONS