@konneal/engine 0.2.130 → 0.2.132

package/dist/{ask-5D2TYRXH.js → ask-XAJDCNFU.js}

@@ -1,11 +1,11 @@
 import {
   handleAsk
-} from "./chunk-AIL7MJS3.js";
+} from "./chunk-DNDQQYDT.js";
 import "./chunk-J6LBR6GI.js";
 import "./chunk-7AXXR7GD.js";
 import "./chunk-TH5XGPD5.js";
 import "./chunk-W7J5SFXJ.js";
-import "./chunk-A4A26BCV.js";
+import "./chunk-26VW4ZXU.js";
 import "./chunk-4NXH5ZI6.js";
 import "./chunk-VT7DR6NQ.js";
 import "./chunk-GBGRHXRU.js";

package/dist/{chunk-A4A26BCV.js → chunk-26VW4ZXU.js}

@@ -24,7 +24,16 @@ function refusalPatterns(publisher) {
       // verb is the guard, a scope DISCUSSION inside a real answer
       // ("this exemption is outside the scope of R 60") never matches
       /\bI don[’']?t have (?:any )?information on [^.]{0,80}(?:that[’']?s|—)?\s*(?:general|common) knowledge\b/i,
-      /\b(?:that[’']?s|this is) (?:just )?(?:general|common) knowledge[^.]{0,80}(?:outside|beyond|not covered)\b/i
+      /\b(?:that[’']?s|this is) (?:just )?(?:general|common) knowledge[^.]{0,80}(?:outside|beyond|not covered)\b/i,
+      // the redirect-only openers (2026-10-11 smoke): the model swaps the
+      // pinned sentence for a scope OFFER — "I'm happy to help with
+      // questions about OIML … instead." / "I can answer questions about
+      // OIML … — such as OIML B 20:2024 …". Anchored at the answer's
+      // start (a real answer never OPENS with the redirect — the
+      // redirect TAIL after content survives untouched), the publisher
+      // token profile-driven.
+      new RegExp(`^\\s*I(?:['\u2019]m| am) happy to help with questions about ${publisher}\\b[^\\n]{0,220}?\\binstead\\b`, "i"),
+      new RegExp(`^\\s*I can (?:answer|help with) questions about ${publisher}\\b[^\\n]{0,220}?\\bpublications\\b`, "i")
     ],
     // the misplaced-pin wall's subset: every pattern here carries a
     // first-person refusal verb ("I don't have information", "I can't

package/dist/{chunk-AIL7MJS3.js → chunk-DNDQQYDT.js}

@@ -83,7 +83,7 @@ import {
   canonicalRefusal,
   exciseMisplacedPin,
   refusalAnswer
-} from "./chunk-A4A26BCV.js";
+} from "./chunk-26VW4ZXU.js";
 import {
   entitlementScope,
   requestSalt,

package/dist/openapi-surface.gen.d.ts

@@ -3,7 +3,7 @@ export interface OpenApiRoute {
     pattern: string;
     operationId: string;
 }
-export type OpenApiOperationId = "askAnonymous" | "askKeyed" | "search" | "searchKeyed" | "verify" | "verifyKeyed" | "research" | "researchKeyed" | "mcp" | "datasets" | "keyUsage" | "health" | "listConversations" | "createConversation" | "getConversation" | "renameConversation" | "deleteConversation" | "appendMessage" | "shareConversation" | "getShared" | "uploadAttachment" | "listAttachments" | "getAttachment" | "deleteAttachment" | "listMemories" | "createMemory" | "deleteMemory" | "listProjects" | "createProject" | "deleteProject" | "listProjectFiles" | "attachProjectFile" | "detachProjectFile" | "laneQuery" | "laneKeyed" | "feedback" | "adminEnrich" | "adminEnrichAlias" | "adminSection" | "adminFamilySummary" | "adminSectionAlias" | "adminFamilySummaryAlias" | "adminVectors" | "adminCaption" | "adminJudge" | "adminJudgeAlias" | "adminRevokeKey" | "authMe" | "authLogin" | "authCallback" | "authLogout" | "authLogoutLink" | "adminStats" | "adminListKeys" | "adminCreateKey";
+export type OpenApiOperationId = "credits" | "creditsAlias" | "askAnonymous" | "askKeyed" | "search" | "searchKeyed" | "verify" | "verifyKeyed" | "research" | "researchKeyed" | "mcp" | "datasets" | "keyUsage" | "health" | "listConversations" | "createConversation" | "getConversation" | "renameConversation" | "deleteConversation" | "appendMessage" | "shareConversation" | "getShared" | "uploadAttachment" | "listAttachments" | "getAttachment" | "deleteAttachment" | "listMemories" | "createMemory" | "deleteMemory" | "listProjects" | "createProject" | "deleteProject" | "listProjectFiles" | "attachProjectFile" | "detachProjectFile" | "laneQuery" | "laneKeyed" | "feedback" | "adminEnrich" | "adminEnrichAlias" | "adminSection" | "adminFamilySummary" | "adminSectionAlias" | "adminFamilySummaryAlias" | "adminVectors" | "adminCaption" | "adminJudge" | "adminJudgeAlias" | "adminRevokeKey" | "authMe" | "authLogin" | "authCallback" | "authLogout" | "authLogoutLink" | "adminStats" | "adminListKeys" | "adminCreateKey";
 export declare const OPENAPI_SURFACE: readonly (Omit<OpenApiRoute, "operationId"> & {
     operationId: OpenApiOperationId;
 })[];

package/dist/openapi-types.d.ts

@@ -6,6 +6,46 @@
  */
 
 export interface paths {
+    "/api/credits": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The caller's daily credit balance
+         * @description Returns the credits the caller has left today — resolved by the same tiering as ask (anonymous by IP, member by session, key by its owner member's shared cap). 1 credit ≈ 1000 tokens of consumption; the UI's meter reads this.
+         */
+        get: operations["credits"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/credits": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * The caller's daily credit balance (the authenticated path)
+         * @description The same balance, authenticated by session or key.
+         */
+        get: operations["creditsAlias"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/ask": {
         parameters: {
             query?: never;
@@ -998,6 +1038,42 @@ export interface components {
 }
 export type $defs = Record<string, never>;
 export interface operations {
+    credits: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The balance. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    creditsAlias: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The balance. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     askAnonymous: {
         parameters: {
             query?: never;

package/dist/{search-6LP755Q7.js → search-544LVPGG.js}

@@ -4,7 +4,7 @@ import {
 import "./chunk-7AXXR7GD.js";
 import "./chunk-TH5XGPD5.js";
 import "./chunk-W7J5SFXJ.js";
-import "./chunk-A4A26BCV.js";
+import "./chunk-26VW4ZXU.js";
 import "./chunk-4NXH5ZI6.js";
 import "./chunk-VT7DR6NQ.js";
 import "./chunk-3FYJM7LH.js";

package/dist/worker_public/src/index.js

@@ -4,7 +4,7 @@ import {
   handleMemories,
   scoreFaithfulness,
   scoreJudge
-} from "../../chunk-AIL7MJS3.js";
+} from "../../chunk-DNDQQYDT.js";
 import {
   TOOLS_REGISTRY,
   bindModelNode,
@@ -16,6 +16,8 @@ import {
 import {
   buildMessages,
   citations,
+  clientIp,
+  creditBudget,
   editionNote,
   fill,
   ftsMatchQuery,
@@ -52,7 +54,7 @@ import {
 } from "../../chunk-W7J5SFXJ.js";
 import {
   canonicalRefusal
-} from "../../chunk-A4A26BCV.js";
+} from "../../chunk-26VW4ZXU.js";
 import {
   entitlementScope,
   standardKeysFrom
@@ -1050,7 +1052,7 @@ async function callToolOnce(env, ctx, _req, tier, key, name, args, t0) {
       const r = await runTool({ ...env, DB: env.DB }, { name, args }, "mcp");
       payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
     } else {
-      const res = name === "ask" ? await (await import("../../ask-5D2TYRXH.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-6LP755Q7.js")).handleSearch(env, ctx, inner, tier, key);
+      const res = name === "ask" ? await (await import("../../ask-XAJDCNFU.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-544LVPGG.js")).handleSearch(env, ctx, inner, tier, key);
       payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), void 0, void 0, { durationMs: Date.now() - t0 });
@@ -1087,6 +1089,16 @@ function matchRoute(routes, method, path) {
 
 // workers/worker_public/src/openapi-surface.gen.ts
 var OPENAPI_SURFACE = [
+  {
+    "method": "GET",
+    "pattern": "/api/credits",
+    "operationId": "credits"
+  },
+  {
+    "method": "GET",
+    "pattern": "/v1/credits",
+    "operationId": "creditsAlias"
+  },
   {
     "method": "POST",
     "pattern": "/api/ask",
@@ -1496,6 +1508,15 @@ async function mcpRoute(c) {
   if (t instanceof Response) return t;
   return withCors(await handleMcp(c.env, c.ctx, c.req, t.tier, t.key), corsHeaders(c.req));
 }
+async function creditsRoute(c) {
+  const t = await tierFor(c);
+  if (t instanceof Response) return t;
+  const key = t.key;
+  const memberKey = t.tier === "key" ? key?.owner_sub ?? null : null;
+  const bucketId = memberKey ? `sub:${memberKey}` : t.tier === "key" ? `key:${key.id}` : clientIp(c.req);
+  const cb = await creditBudget(c.env, bucketId);
+  return withCors(json({ credits: cb }), corsHeaders(c.req));
+}
 async function askRoute(c) {
   const t = await tierFor(c);
   if (t instanceof Response) return t;
@@ -1785,6 +1806,8 @@ var INFRA_ROUTES = [
 ];
 var OPENAPI_HANDLERS = {
   askAnonymous: askRoute,
+  credits: creditsRoute,
+  creditsAlias: creditsRoute,
   askKeyed: askRoute,
   search: searchRoute,
   searchKeyed: searchRoute,

package/dist/worker_public/src/refusal.js

@@ -2,7 +2,7 @@ import {
   canonicalRefusal,
   exciseMisplacedPin,
   refusalAnswer
-} from "../../chunk-A4A26BCV.js";
+} from "../../chunk-26VW4ZXU.js";
 import "../../chunk-3FYJM7LH.js";
 export {
   canonicalRefusal,

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.130",
+  "version": "0.2.132",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/openapi.yaml

@@ -58,6 +58,29 @@ tags:
       the index-maintenance battery (enrichment, section units, vectors
       and figure captions).
 paths:
+  /api/credits:
+    get:
+      tags: [Service]
+      summary: The caller's daily credit balance
+      description: >-
+        Returns the credits the caller has left today — resolved by the
+        same tiering as ask (anonymous by IP, member by session, key by
+        its owner member's shared cap). 1 credit ≈ 1000 tokens of
+        consumption; the UI's meter reads this.
+      operationId: credits
+      responses:
+        '200':
+          description: The balance.
+  /v1/credits:
+    get:
+      tags: [Service]
+      summary: The caller's daily credit balance (the authenticated path)
+      description: The same balance, authenticated by session or key.
+      operationId: creditsAlias
+      security: [{ bearerAuth: [] }]
+      responses:
+        '200':
+          description: The balance.
   /api/ask:
     post:
       tags: [Ask]

package/workers/worker_public/src/index.ts

@@ -20,6 +20,7 @@ import type { Env } from "./env";
 import { portModelRunner } from "./env.ts";
 export type { Env };
 import { json, err, corsHeaders, withCors, readJson, authenticate, type ApiKey } from "./lib/http";
+import { creditBudget, clientIp } from "./quota";
 
 import { handleSearch } from "./search";
 import { handleEnrich, handleSectionUnit, handleCaption, handleVectors, handleJudge, handleCreateKey, handleListKeys, handleRevokeKey, handleKeyUsage, handleFamilySummary } from "./admin";
@@ -215,6 +216,19 @@ async function mcpRoute(c: RouteContext): Promise<Response> {
   return withCors(await handleMcp(c.env, c.ctx, c.req, t.tier, t.key), corsHeaders(c.req));
 }
 
+/** The caller's daily credit balance (2026-10-11): the meter the UI
+ *  shows — resolved by the same tiering as ask (anon by IP, member by
+ *  session, key by its owner member's shared cap). */
+async function creditsRoute(c: RouteContext): Promise<Response> {
+  const t = await tierFor(c);
+  if (t instanceof Response) return t;
+  const key = t.key;
+  const memberKey = t.tier === "key" ? key?.owner_sub ?? null : null;
+  const bucketId = memberKey ? `sub:${memberKey}` : t.tier === "key" ? `key:${key!.id}` : clientIp(c.req);
+  const cb = await creditBudget(c.env, bucketId);
+  return withCors(json({ credits: cb }), corsHeaders(c.req));
+}
+
 async function askRoute(c: RouteContext): Promise<Response> {
   const t = await tierFor(c);
   if (t instanceof Response) return t;
@@ -571,6 +585,8 @@ const INFRA_ROUTES: Route[] = [
 
 const OPENAPI_HANDLERS: Record<OpenApiOperationId, RouteHandler> = {
   askAnonymous: askRoute,
+  credits: creditsRoute,
+  creditsAlias: creditsRoute,
   askKeyed: askRoute,
   search: searchRoute,
   searchKeyed: searchRoute,

package/workers/worker_public/src/openapi-surface.gen.ts

@@ -7,6 +7,8 @@ export interface OpenApiRoute {
 }
 
 export type OpenApiOperationId =
+  | "credits"
+  | "creditsAlias"
   | "askAnonymous"
   | "askKeyed"
   | "search"
@@ -64,6 +66,16 @@ export type OpenApiOperationId =
   | "adminCreateKey"
 
 export const OPENAPI_SURFACE: readonly (Omit<OpenApiRoute, "operationId"> & { operationId: OpenApiOperationId })[] = [
+  {
+    "method": "GET",
+    "pattern": "/api/credits",
+    "operationId": "credits"
+  },
+  {
+    "method": "GET",
+    "pattern": "/v1/credits",
+    "operationId": "creditsAlias"
+  },
   {
     "method": "POST",
     "pattern": "/api/ask",

package/workers/worker_public/src/refusal.ts

@@ -29,6 +29,15 @@ function refusalPatterns(publisher: string): { variant: RegExp; drift: RegExp[];
       // ("this exemption is outside the scope of R 60") never matches
       /\bI don[’']?t have (?:any )?information on [^.]{0,80}(?:that[’']?s|—)?\s*(?:general|common) knowledge\b/i,
       /\b(?:that[’']?s|this is) (?:just )?(?:general|common) knowledge[^.]{0,80}(?:outside|beyond|not covered)\b/i,
+      // the redirect-only openers (2026-10-11 smoke): the model swaps the
+      // pinned sentence for a scope OFFER — "I'm happy to help with
+      // questions about OIML … instead." / "I can answer questions about
+      // OIML … — such as OIML B 20:2024 …". Anchored at the answer's
+      // start (a real answer never OPENS with the redirect — the
+      // redirect TAIL after content survives untouched), the publisher
+      // token profile-driven.
+      new RegExp(`^\\s*I(?:['’]m| am) happy to help with questions about ${publisher}\\b[^\\n]{0,220}?\\binstead\\b`, "i"),
+      new RegExp(`^\\s*I can (?:answer|help with) questions about ${publisher}\\b[^\\n]{0,220}?\\bpublications\\b`, "i"),
     ],
     // the misplaced-pin wall's subset: every pattern here carries a
     // first-person refusal verb ("I don't have information", "I can't