@konneal/engine 0.2.95 → 0.2.97

package/dist/worker_public/src/index.js

@@ -991,12 +991,14 @@ async function callToolOnce(env, ctx, _req, tier, key, name, args, t0) {
       body: JSON.stringify({ ...args, stream: false })
     });
     const { runTool, TOOLS_REGISTRY: TOOLS_REGISTRY2 } = await import("../../tools-Z4HQH3QU.js");
+    let payload;
     if (TOOLS_REGISTRY2.some((t) => t.name === name && t.audiences.includes("mcp"))) {
       const r = await runTool({ ...env, DB: env.DB }, { name, args }, "mcp");
-      return r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
+      payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
+    } else {
+      const res = name === "ask" ? await (await import("../../ask-KKOQH7HK.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-CGQFGYTR.js")).handleSearch(env, ctx, inner, tier, key);
+      payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
-    const res = name === "ask" ? await (await import("../../ask-KKOQH7HK.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-CGQFGYTR.js")).handleSearch(env, ctx, inner, tier, key);
-    const payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), void 0, void 0, { durationMs: Date.now() - t0 });
     return payload;
   }
@@ -1413,12 +1415,14 @@ async function healthRoute(c) {
 }
 async function tierFor(c) {
   const isApi = c.path.startsWith("/v1/");
+  const isMcp = c.path === "/mcp";
+  const bearer = c.req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
   let key = null;
-  if (isApi) {
+  if (isApi || isMcp && bearer) {
     key = await authenticate(c.env, c.req);
     if (!key) return err(401, "unauthorized", `Provide a valid API key: Authorization: Bearer ${P().publisher.id}_...`);
   }
-  let tier = isApi ? "key" : "anon";
+  let tier = key ? "key" : "anon";
   if (!isApi && await sessionFrom(c.req, c.env)) tier = "member";
   else if (!isApi && await opTokenMember(c.env, opCfg(c.env), c.req)) tier = "member";
   return { tier, key };

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.95",
+  "version": "0.2.97",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/index.ts

@@ -186,12 +186,18 @@ async function healthRoute(c: RouteContext): Promise<Response> {
  *  key. */
 async function tierFor(c: RouteContext): Promise<{ tier: "anon" | "key" | "member"; key: ApiKey | null } | Response> {
   const isApi = c.path.startsWith("/v1/");
+  // /mcp rides the same key tiering: a bearer presented to the JSON-RPC
+  // endpoint authenticates like /v1 (key tier, the caller's quota and
+  // telemetry) — but the endpoint stays open to anonymous agents, so an
+  // ABSENT bearer is not an error, only a PRESENT-but-invalid one is.
+  const isMcp = c.path === "/mcp";
+  const bearer = c.req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
   let key: ApiKey | null = null;
-  if (isApi) {
+  if (isApi || (isMcp && bearer)) {
     key = await authenticate(c.env, c.req);
     if (!key) return err(401, "unauthorized", `Provide a valid API key: Authorization: Bearer ${P().publisher.id}_...`);
   }
-  let tier: "anon" | "key" | "member" = isApi ? "key" : "anon";
+  let tier: "anon" | "key" | "member" = key ? "key" : "anon";
   // No SESSION_SECRET precondition: the delegated bearer (the platform
   // bubble's OP-minted JWT, delegated.ts) admits the member lane on its
   // own — sessionFrom returns null honestly when neither lane applies.

package/workers/worker_public/src/mcp.ts

@@ -68,14 +68,16 @@ async function callToolOnce(
     // registry tools (certificates.search, units.get, …) dispatch through
     // the SAME handlers the API would — the no-drift rule, now structural
     const { runTool, TOOLS_REGISTRY } = await import("./tools.ts");
+    let payload: any;
     if (TOOLS_REGISTRY.some((t) => t.name === name && t.audiences.includes("mcp"))) {
       const r = await runTool({ ...env, DB: (env as any).DB }, { name, args }, "mcp");
-      return r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
+      payload = r ? { tool: r.name, query: r.query, result: r.output } : { error: { message: `tool ${name} returned nothing for the given arguments` } };
+    } else {
+      const res = name === "ask"
+        ? await (await import("./ask")).handleAsk(env, ctx as any, inner, tier, key)
+        : await (await import("./search")).handleSearch(env, ctx as any, inner, tier, key);
+      payload = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     }
-    const res = name === "ask"
-      ? await (await import("./ask")).handleAsk(env, ctx as any, inner, tier, key)
-      : await (await import("./search")).handleSearch(env, ctx as any, inner, tier, key);
-    const payload: any = await res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
     telemetry(env, ctx, tier, `mcp:${name}`, null, !payload?.error, JSON.stringify(payload).length, await sha256Hex(`${name}:${JSON.stringify(args ?? {})}`), undefined, undefined, { durationMs: Date.now() - t0 });
     return payload;
   }