cito-mcp 0.4.2 → 0.4.3

package/README.md

@@ -213,9 +213,27 @@ When a key is `null` the image does not exist for that entity; when the whole
 never partially shaped — if any image exists, all four keys are present.
 
 Tennis is the exception on purpose: the feed supplies a single `portrait_url`
-(Wikimedia) and no square crop, so that one URL fills both `headshotUrl` and
-`imageUrl`, and `proxiedImageUrl` stays `null` because only `ufc.com` URLs have
-a proxy. A card with the real photo slightly cropped beats a faceless card.
+(Wikimedia Commons) and no square crop, so that one URL fills both `headshotUrl`
+and `imageUrl`, and `proxiedImageUrl` stays `null` because only `ufc.com` URLs have
+a proxy.
+
+**Tennis images carry their licence and credit** — and a UI is expected to render
+them:
+
+```jsonc
+"images": {
+  "headshotUrl": "https://commons.wikimedia.org/wiki/Special:FilePath/Hoang_WMQ18_%2833%29_%2842647295495%29.jpg?width=400",
+  "license":     "CC BY-SA 2.0",
+  "attribution": "si.robi",
+  "sourceUrl":   "https://commons.wikimedia.org/wiki/File:Hoang_WMQ18_(33)_(42647295495).jpg"
+}
+```
+
+Commons portraits are mostly CC BY / CC BY-SA, which for commercial display
+generally requires naming the author and stating the licence. `attribution` is
+`null` for public-domain and CC0 images, which need no credit — that is a fact,
+not missing data. Anything without a defensible licence has its URL removed
+upstream, so a non-null `headshotUrl` always has a `license` beside it.
 
 ### Games
 

package/dist/tools/player.js

@@ -54,16 +54,29 @@ function identityFrom(game, raw, idHint, slugHint) {
          */
         images: {
             // Tennis supplies exactly one likeness, `portrait_url` (a Wikimedia
-            // portrait), and no separate square headshot crop. Before this, the shaper
-            // read only headshotUrl/bodyImageUrl/imageUrl/photoUrl — none of which the
-            // tennis route emits — so every tennis profile shipped four explicit nulls
-            // while a perfectly good photo sat one key away, and builders concluded
-            // tennis had no images at all. The portrait fills the headshot slot too:
-            // a card with the real photo slightly cropped beats a faceless card.
+            // Commons portrait), and no separate square headshot crop. Before this,
+            // the shaper read only headshotUrl/bodyImageUrl/imageUrl/photoUrl — none of
+            // which the tennis route emits — so every tennis profile shipped four
+            // explicit nulls while a perfectly good photo sat one key away.
             headshotUrl: pickString(r.headshotUrl, r.headshot, r.portrait_url) ?? null,
             bodyImageUrl: pickString(r.bodyImageUrl, r.fullBodyImageUrl) ?? null,
             imageUrl: pickString(r.imageUrl, r.image, r.photoUrl, r.portrait_url) ?? null,
             proxiedImageUrl: pickString(r.proxiedImageUrl, r.proxiedHeadshotUrl) ?? null,
+            /**
+             * The licence and the credit, carried with the URL.
+             *
+             * Commons portraits are mostly CC BY / CC BY-SA, which for commercial
+             * display generally obliges you to name the author and state the licence.
+             * Handing back a bare URL and letting a builder render it silently is what
+             * gets a product a takedown letter, so the fields a UI must show travel in
+             * the same object as the image. `attribution` is null for public-domain
+             * and CC0 images, which need no credit — that is a fact, not missing data.
+             * Anything without a defensible licence has its URL removed upstream, so a
+             * non-null headshotUrl here always has a licence beside it.
+             */
+            license: pickString(r.portrait_license) ?? null,
+            attribution: pickString(r.portrait_attribution) ?? null,
+            sourceUrl: pickString(r.portrait_source_url) ?? null,
         },
     };
 }

package/dist/tools/resolve.js

@@ -892,15 +892,25 @@ Example: { "game": "ufc", "q": "Jon Jones", "type": "fighter", "limit": 10 }`,
         const upstreamTotal = total;
         let droppedBelowFloor = [];
         /**
-         * The first row the upstream returned is exempt from the floor.
+         * The upstream's own top ENTITY row is exempt from the floor.
          *
          * The upstream's dedicated search knows aliases the payload does not carry:
          * `q=Nole` returns Novak Djokovic first, and rankScore cannot see why, so a
          * pure floor would delete the correct answer and keep substring collisions
-         * instead. Exactly one row is protected, and only when a query was given, so
-         * the floor still removes all the padding it was added for.
+         * instead.
+         *
+         * This used to be the global items[0], which was wrong: search_entities
+         * merges several sources CONCURRENTLY (for tennis, /players/search and
+         * /competitions), so whichever promise settled first decided which row got
+         * protected. The live gate caught it as a flaky "first result is Jannik
+         * Sinner" — a competition could land at index 0 and the alias protection
+         * would guard the wrong thing. Only entity rows (player/team/fighter) are
+         * alias-matched at all; tournaments are matched by name and have no
+         * nicknames, so taking the first entity row is both deterministic and the
+         * row the rule was written for.
          */
-        const protectedRow = q && items.length > 0 ? items[0] : null;
+        const ENTITY_TYPES = new Set(['player', 'team', 'fighter']);
+        const protectedRow = q ? items.find((it) => ENTITY_TYPES.has(it.type)) ?? null : null;
         const protectedKey = protectedRow ? `${protectedRow.game}:${protectedRow.type}:${protectedRow.id}` : null;
         if (q) {
             // Publish the score on every row, not just the ones the scored branch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cito-mcp",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Standalone MCP server for the Cito esports and sports API — 42 curated outcome tools for agents (live scoreboards, round economy, opening duels, clutches, vetoes, rosters, tennis, mma).",
   "type": "module",
   "bin": {