@konneal/engine 0.2.38 → 0.2.39

package/dist/{ask-VXV2BFNC.js → ask-UGTXNPPY.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-CNFQNCWA.js";
-import "./chunk-6GAYBMUM.js";
+} from "./chunk-OHYAHQQV.js";
+import "./chunk-NBE7BCQ7.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/{chunk-GDQOFP6B.js → chunk-EVCERBIH.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-6GAYBMUM.js";
+} from "./chunk-NBE7BCQ7.js";
 import {
   corsHeaders,
   err,

package/dist/{chunk-6GAYBMUM.js → chunk-NBE7BCQ7.js}

@@ -23836,13 +23836,23 @@ function opMemberCanWrite(member) {
   if (member.via !== "op-token") return true;
   return /\bwrite\b/.test(member.scope ?? "");
 }
-function opMemberFromIntrospection(answer, ids) {
+function opMemberFromIntrospection(answer, ids, patServices = []) {
   if (!answer?.active) return null;
-  const clientId = String(answer.client_id ?? "");
-  if (!ids.includes(clientId)) return null;
   const sub = String(answer.sub ?? "");
   if (!sub) return null;
-  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+  const clientId = String(answer.client_id ?? "");
+  if (clientId) {
+    if (!ids.includes(clientId)) return null;
+    return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+  }
+  if (!patServices.length) return null;
+  const scope = String(answer.scope ?? "");
+  const services = scope.split(/\s+/).filter(Boolean).map((s8) => s8.split(":")[0]);
+  if (!services.some((s8) => patServices.includes(s8))) return null;
+  return { sub, scope, via: "op-token" };
+}
+function patServiceIds(env) {
+  return String(env.OIDC_PAT_SERVICES ?? "").split(/[\s,]+/).filter(Boolean);
 }
 async function opTokenMember(env, cfg, req) {
   const m = /^Bearer\s+(.+)$/i.exec((req.headers.get("Authorization") ?? "").trim());
@@ -23872,7 +23882,7 @@ async function opTokenMember(env, cfg, req) {
     } catch {
     }
   }
-  return opMemberFromIntrospection(answer, ids);
+  return opMemberFromIntrospection(answer, ids, patServiceIds(env));
 }
 
 // workers/worker_public/src/oidc.ts

package/dist/{chunk-CNFQNCWA.js → chunk-OHYAHQQV.js}

@@ -34,7 +34,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-6GAYBMUM.js";
+} from "./chunk-NBE7BCQ7.js";
 import {
   corsHeaders,
   err,

package/dist/env.d.ts

@@ -36,6 +36,10 @@ export interface Env {
      *  deployment admits as member-read credentials via introspection.
      *  Empty/absent = the tier is off. */
     OIDC_DEVICE_CLIENT_IDS?: string;
+    /** the services whose OP-minted personal access tokens (the PAT form
+     *  of introspection — no client_id on the wire) this deployment admits
+     *  as member-read credentials. Empty/absent = PATs stay anonymous. */
+    OIDC_PAT_SERVICES?: string;
     SESSION_SECRET?: string;
     /** TODO.ai-platform/03 — the "my account" live-data delegation: the
      *  platform instance's API base + its client id at the OP (the

package/dist/livedata.d.ts

@@ -111,9 +111,17 @@ export declare function opMemberCanWrite(member: {
     scope?: string;
 } | null): boolean;
 /** The introspection answer → the member credential, judged against the
- *  deployment's allowlist. Inactive, foreign-client or subject-less
- *  answers all resolve to null — never to a widened guess. */
-export declare function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null;
+ *  deployment's two allowlists. The OP answers client-bearing tokens
+ *  WITH client_id (the access-token table, the machine JWTs) and its
+ *  PAT form WITHOUT one — a PAT's identity on the wire is its granted
+ *  SERVICES (the PAT grammar's whole vocabulary). So the deployment
+ *  names device-grant clients (OIDC_DEVICE_CLIENT_IDS) and, separately,
+ *  the services whose personal access tokens it admits
+ *  (OIDC_PAT_SERVICES). Both lists empty = the tier stays off; a token
+ *  matching neither list resolves to null — never a widened guess. */
+export declare function opMemberFromIntrospection(answer: any, ids: string[], patServices?: string[]): OpMember | null;
+/** The PAT-services allowlist (see opMemberFromIntrospection). */
+export declare function patServiceIds(env: any): string[];
 /** The Bearer read + introspection, KV-cached 45s keyed by the token's
  *  hash (an ask burst costs one introspection; a deactivation lands
  *  within a minute). The cached object is the OP's RAW answer — the

package/dist/{search-HBE47CK6.js → search-G23CY5I6.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-GDQOFP6B.js";
-import "./chunk-6GAYBMUM.js";
+} from "./chunk-EVCERBIH.js";
+import "./chunk-NBE7BCQ7.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/worker_public/src/index.js

@@ -1,6 +1,6 @@
 import {
   handleSearch
-} from "../../chunk-GDQOFP6B.js";
+} from "../../chunk-EVCERBIH.js";
 import {
   bindModelNode,
   checkQuoteAnchors,
@@ -9,7 +9,7 @@ import {
   modelGroundingBlock,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-CNFQNCWA.js";
+} from "../../chunk-OHYAHQQV.js";
 import {
   buildMessages,
   citations,
@@ -35,7 +35,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-6GAYBMUM.js";
+} from "../../chunk-NBE7BCQ7.js";
 import {
   authenticate,
   corsHeaders,
@@ -999,7 +999,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-VXV2BFNC.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-HBE47CK6.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-UGTXNPPY.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-G23CY5I6.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.38",
+  "version": "0.2.39",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/env.ts

@@ -38,6 +38,10 @@ export interface Env {
    *  deployment admits as member-read credentials via introspection.
    *  Empty/absent = the tier is off. */
   OIDC_DEVICE_CLIENT_IDS?: string;
+  /** the services whose OP-minted personal access tokens (the PAT form
+   *  of introspection — no client_id on the wire) this deployment admits
+   *  as member-read credentials. Empty/absent = PATs stay anonymous. */
+  OIDC_PAT_SERVICES?: string;
   SESSION_SECRET?: string;
   /** TODO.ai-platform/03 — the "my account" live-data delegation: the
    *  platform instance's API base + its client id at the OP (the

package/workers/worker_public/src/livedata.ts

@@ -431,15 +431,35 @@ export function opMemberCanWrite(member: { via?: string; scope?: string } | null
 }
 
 /** The introspection answer → the member credential, judged against the
- *  deployment's allowlist. Inactive, foreign-client or subject-less
- *  answers all resolve to null — never to a widened guess. */
-export function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null {
+ *  deployment's two allowlists. The OP answers client-bearing tokens
+ *  WITH client_id (the access-token table, the machine JWTs) and its
+ *  PAT form WITHOUT one — a PAT's identity on the wire is its granted
+ *  SERVICES (the PAT grammar's whole vocabulary). So the deployment
+ *  names device-grant clients (OIDC_DEVICE_CLIENT_IDS) and, separately,
+ *  the services whose personal access tokens it admits
+ *  (OIDC_PAT_SERVICES). Both lists empty = the tier stays off; a token
+ *  matching neither list resolves to null — never a widened guess. */
+export function opMemberFromIntrospection(answer: any, ids: string[], patServices: string[] = []): OpMember | null {
   if (!answer?.active) return null;
-  const clientId = String(answer.client_id ?? "");
-  if (!ids.includes(clientId)) return null;
   const sub = String(answer.sub ?? "");
   if (!sub) return null;
-  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+  const clientId = String(answer.client_id ?? "");
+  if (clientId) {
+    if (!ids.includes(clientId)) return null;
+    return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+  }
+  if (!patServices.length) return null;
+  const scope = String(answer.scope ?? "");
+  const services = scope.split(/\s+/).filter(Boolean).map((s) => s.split(":")[0]);
+  if (!services.some((s) => patServices.includes(s))) return null;
+  return { sub, scope, via: "op-token" };
+}
+
+/** The PAT-services allowlist (see opMemberFromIntrospection). */
+export function patServiceIds(env: any): string[] {
+  return String(env.OIDC_PAT_SERVICES ?? "")
+    .split(/[\s,]+/)
+    .filter(Boolean);
 }
 
 /** The Bearer read + introspection, KV-cached 45s keyed by the token's
@@ -482,5 +502,5 @@ export async function opTokenMember(
       /* cacheless = introspect per ask */
     }
   }
-  return opMemberFromIntrospection(answer, ids);
+  return opMemberFromIntrospection(answer, ids, patServiceIds(env));
 }