@ainyc/canonry 4.190.0 → 4.191.0

package/dist/{chunk-4NIQ3GMO.js → chunk-XI6FN52S.js}

@@ -14,7 +14,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-32QBVRMN.js";
+} from "./chunk-2A7E5TDU.js";
 import {
   CC_CACHE_DIR,
   DUCKDB_SPEC,
@@ -162,7 +162,7 @@ import {
   siteCrawlSnapshots,
   toAlertView,
   usageCounters
-} from "./chunk-6POEZ7GT.js";
+} from "./chunk-ZK4FJDCH.js";
 import {
   AGENT_MEMORY_VALUE_MAX_BYTES,
   AGENT_PROVIDER_IDS,
@@ -305,7 +305,7 @@ import {
   validationError,
   winnabilityClassLabel,
   withRetry
-} from "./chunk-ROPJUNQN.js";
+} from "./chunk-KBUV3HGS.js";
 
 // src/telemetry.ts
 import crypto from "crypto";
@@ -12041,7 +12041,7 @@ function readStoredGroundingSources(rawResponse) {
   return result;
 }
 async function backfillInsightsCommand(project, opts) {
-  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-WNASQFN4.js");
+  const { IntelligenceService: IntelligenceService2 } = await import("./intelligence-service-EVRWZHDG.js");
   const config = loadConfig();
   const db = createClient(config.database);
   migrate(db);
@@ -12623,7 +12623,7 @@ var RETRY_MS = 60 * 1e3;
 var TIMEOUT_MS2 = 3e3;
 function createProviderModelCatalog(registry) {
   const cache = /* @__PURE__ */ new Map();
-  return async (name) => {
+  const read = async (name) => {
     const provider = registry.get(name);
     if (!provider) {
       cache.delete(name);
@@ -12666,6 +12666,14 @@ function createProviderModelCatalog(registry) {
     });
     return current.pending;
   };
+  const cached = (name) => {
+    const provider = registry.get(name);
+    if (!provider) return [];
+    const entry = cache.get(name);
+    const identity = createHash("sha256").update(JSON.stringify(provider.config)).digest("hex");
+    return (entry?.identity === identity ? entry.models : void 0) ?? provider.adapter.modelRegistry.knownModels;
+  };
+  return Object.assign(read, { cached });
 }
 
 // src/scheduler.ts
@@ -15714,6 +15722,7 @@ function mintSessionKey(db, scopes, userId) {
     keyHash: hashApiKey(raw),
     keyPrefix: raw.slice(0, 9),
     scopes: [...scopes],
+    delegatedUserId: userId,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   }).run();
   return { id, raw };
@@ -15777,7 +15786,7 @@ function registerMcpHttpRoutes(scope, opts) {
     if (trimmed.slice(0, prefix.length).toLowerCase() !== prefix) return null;
     return trimmed.slice(prefix.length).trim() || null;
   }
-  async function openSession(request, keyId, segment) {
+  async function openSession(request, authorizationId, segment) {
     const bearer = callerBearer(request);
     if (!bearer) return null;
     const scopes = request.principal?.scopes ?? request.apiKey?.scopes ?? [];
@@ -15788,13 +15797,14 @@ function registerMcpHttpRoutes(scope, opts) {
     const client = new ApiClient(opts.selfApiUrl, sessionKey?.raw ?? bearer, { skipProbe: true });
     const server = createCanonryMcpServer({
       scope: segment.readOnly || isReadOnlyKey(scopes) ? "read-only" : "all",
+      credentialScopes: scopes,
       tiers: segment.tiers,
       clientFactory: () => client
     });
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: () => crypto26.randomUUID(),
       onsessioninitialized: (id) => {
-        sessions.set(id, { transport, close, keyId, segmentId: segment.id, lastSeenAt: now() });
+        sessions.set(id, { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() });
       }
     });
     async function close() {
@@ -15808,18 +15818,26 @@ function registerMcpHttpRoutes(scope, opts) {
       if (sessionKey) revokeSessionKey(opts.db, sessionKey.id);
     };
     await server.connect(transport);
-    return { transport, close, keyId, segmentId: segment.id, lastSeenAt: now() };
+    return { transport, close, authorizationId, segmentId: segment.id, lastSeenAt: now() };
   }
   async function handle(request, reply, segment) {
-    const keyId = request.principal?.id ?? request.apiKey?.id;
-    if (!keyId) {
+    const principal = request.principal ?? request.apiKey;
+    const bearer = callerBearer(request);
+    if (!principal || !bearer) {
       await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
       return;
     }
+    const authorizationId = hashApiKey(JSON.stringify({
+      bearerHash: hashApiKey(bearer),
+      kind: request.principal?.kind ?? "api-key",
+      id: principal.id,
+      scopes: [...new Set(principal.scopes)].sort(),
+      projectId: principal.projectId ?? null
+    }));
     const sessionId = request.headers["mcp-session-id"];
     const existing = typeof sessionId === "string" ? sessions.get(sessionId) : void 0;
     if (existing) {
-      if (existing.keyId !== keyId || existing.segmentId !== segment.id) {
+      if (existing.authorizationId !== authorizationId || existing.segmentId !== segment.id) {
         await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
         return;
       }
@@ -15831,7 +15849,7 @@ function registerMcpHttpRoutes(scope, opts) {
       await reply.status(404).send({ error: { code: "NOT_FOUND", message: "Unknown MCP session." } });
       return;
     }
-    const opened = await openSession(request, keyId, segment);
+    const opened = await openSession(request, authorizationId, segment);
     if (!opened) {
       await reply.status(401).send({ error: { code: "AUTH_REQUIRED", message: "Authentication required." } });
       return;
@@ -18657,6 +18675,7 @@ async function createServer(opts) {
       app.log.error({ runId, err }, "Research run failed");
     });
   };
+  const providerModelCatalog = createProviderModelCatalog(registry);
   await app.register(apiRoutes, {
     db: opts.db,
     routePrefix: apiPrefix,
@@ -18974,7 +18993,8 @@ async function createServer(opts) {
       includeCanonryLocal: true
     },
     providerSummary,
-    getProviderModels: createProviderModelCatalog(registry),
+    getProviderModels: providerModelCatalog,
+    getCachedProviderModels: providerModelCatalog.cached,
     providerAdapters: [...API_ADAPTERS, ...BROWSER_ADAPTERS].map((a) => ({
       name: a.name,
       displayName: a.displayName,