wikimedia-commons-mcp 1.0.1 → 1.0.2

package/README.md

@@ -25,18 +25,18 @@ Public free APIs only. See `src/api.ts` for exact endpoints.
 <!-- paywall -->
 ## Premium tools
 
-These tools need a license key:
+These tools need a licence key:
 
 * `file_categories`
 * `file_thumbnail`
 
-Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-wikimedia-commons-mcp and set it in your MCP client config:
+The tool bodies run on our gateway, not inside this package, so the key is what buys access. Buy one at https://buy.polar.sh/polar_cl_mrO7rS5LZxpqM7oAFFEA10i9121J240U40IIj4JRZO4 and set it in your MCP client config:
 
 ```json
-"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+"env": { "MCP_LICENSE_KEY": "polar_..." }
 ```
 
-The key is checked against MCP Marketplace, cached for 24 hours, and keeps
-working offline once one check has succeeded. Every other tool on this server
+The gateway checks the key against Polar and gives every key 1,000 free premium
+calls a month before per-call billing starts. Every other tool on this server
 stays free.
 <!-- /paywall -->

package/dist/api.js

@@ -116,42 +116,6 @@ async function commonsGet(url) {
         throw new CommonsLookupError(`Wikimedia Commons returned HTTP ${res.status}`);
     return res.json();
 }
-function commonsTitle(args) {
-    const title = (args.title ?? "").trim();
-    if (!title)
-        throw new CommonsLookupError("Provide a file title like File:Example.jpg");
-    return title.startsWith("File:") ? title : `File:${title}`;
-}
-/** The categories a file sits in, which is how Commons files are browsed. */
-export async function fileCategories(args) {
-    const title = commonsTitle(args);
-    const limit = Math.max(1, Math.min(args.limit ?? 15, 50));
-    const d = await commonsGet(`${COMMONS_BASE}?action=query&titles=${encodeURIComponent(title)}&prop=categories&cllimit=${limit}&format=json&origin=*`);
-    const pages = Object.values(d?.query?.pages ?? {});
-    const page = pages[0];
-    if (!page || page.missing !== undefined)
-        throw new CommonsLookupError(`File not found: ${title}`);
-    const cats = page.categories ?? [];
-    if (!cats.length)
-        return `${page.title} is in no categories.`;
-    return `Categories for ${page.title} (${cats.length}${cats.length >= limit ? "+, capped by limit" : ""}):\n` +
-        cats.map((c, i) => `${i + 1}. ${c.title}${c.hidden === true ? " (hidden)" : ""}`).join("\n");
-}
-/** A thumbnail URL at a chosen width, so a client can fetch a sized copy. */
-export async function fileThumbnail(args) {
-    const title = commonsTitle(args);
-    const width = Math.max(20, Math.min(args.width ?? 320, 2000));
-    const d = await commonsGet(`${COMMONS_BASE}?action=query&titles=${encodeURIComponent(title)}&prop=imageinfo&iiprop=url|size|mime&iiurlwidth=${width}&format=json&origin=*`);
-    const pages = Object.values(d?.query?.pages ?? {});
-    const info = pages[0]?.imageinfo?.[0];
-    if (!info)
-        throw new CommonsLookupError(`No image info for ${title}`);
-    return [
-        `File: ${pages[0]?.title ?? title}`,
-        `Original: ${info.url ?? "not reported"} (${info.width ?? "?"}x${info.height ?? "?"}, ${info.mime ?? "?"})`,
-        `Thumbnail at ${width}px: ${info.thumburl ?? "not offered by Commons for this file"}`,
-    ].join("\n");
-}
 /** Browse a Commons category and list the media files inside it. */
 export async function categoryFiles(args) {
     const raw = (args.category ?? "").trim();

package/dist/gateway.js

@@ -0,0 +1,85 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+const DEFAULT_GATEWAY_URL = 'https://mcp-gateway.contactae2000.workers.dev/mcp';
+const DEFAULT_TIMEOUT_MS = 25000;
+const USER_AGENT = 'mrfentmen-mcp/1.0';
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export class GatewayError extends Error {
+    refused;
+    constructor(message, refused) {
+        super(message);
+        this.refused = refused;
+        this.name = 'GatewayError';
+    }
+}
+export async function premiumTool(tool, args) {
+    const key = (process.env.MCP_LICENSE_KEY ?? '').trim();
+    if (!key) {
+        throw new GatewayError(`"${tool}" is a premium tool and no licence key is set. Set MCP_LICENSE_KEY in your MCP client config.`, true);
+    }
+    const url = (process.env.MCP_GATEWAY_URL ?? DEFAULT_GATEWAY_URL).trim();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+                authorization: `Bearer ${key}`,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/call',
+                params: { name: tool, arguments: args },
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway. Check your connection and try again.`, false);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway (HTTP ${response.status}).`, false);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new GatewayError(`"${tool}" got an unreadable answer from the licence gateway.`, false);
+    }
+    if (body.error) {
+        throw new GatewayError(`"${tool}" was refused by the licence gateway: ${body.error.message ?? 'unknown error'}`, false);
+    }
+    const result = body.result ?? {};
+    const text = (result.content ?? [])
+        .map((part) => part.text ?? '')
+        .join('\n')
+        .trim();
+    if (result.isError) {
+        // The gateway marks a licence refusal structurally, so a missing or rejected
+        // key is told apart from a tool that failed after the gate let it through.
+        if (result.structuredContent?.licenceRefusal) {
+            throw new GatewayError(text || `"${tool}" needs a valid licence key.`, true);
+        }
+        throw new GatewayError(text || `"${tool}" failed on the licence gateway.`, false);
+    }
+    if (!text)
+        throw new GatewayError(`"${tool}" returned no data.`, false);
+    return text;
+}

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { z } from 'zod';
-import { m0_file, m0_search, m1_random, fileCategories, fileThumbnail, categoryFiles } from './api.js';
-import { premiumRequired } from "./license.js";
+import { m0_file, m0_search, m1_random, categoryFiles } from "./api.js";
+import { premiumTool } from "./gateway.js";
 const text = (value) => ({ content: [{ type: 'text', text: value }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
@@ -55,12 +55,10 @@ export function createServer() {
         annotations: READ_ONLY,
     }, async (args) => {
         // ---- paywall: file_categories ----
-        const paywallMessage = await premiumRequired("file_categories");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // The body runs on the gateway, behind the licence gate.
         // ---- paywall: end ----
         try {
-            return text(await fileCategories(args));
+            return text(await premiumTool("mcp_wikimedia_commons_file_categories", args));
         }
         catch (e) {
             return textError(error(e));
@@ -73,12 +71,10 @@ export function createServer() {
         annotations: READ_ONLY,
     }, async (args) => {
         // ---- paywall: file_thumbnail ----
-        const paywallMessage = await premiumRequired("file_thumbnail");
-        if (paywallMessage)
-            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // The body runs on the gateway, behind the licence gate.
         // ---- paywall: end ----
         try {
-            return text(await fileThumbnail(args));
+            return text(await premiumTool("mcp_wikimedia_commons_file_thumbnail", args));
         }
         catch (e) {
             return textError(error(e));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wikimedia-commons-mcp",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Wikimedia Commons file search.",
   "type": "module",
   "main": "dist/index.js",

package/src/api.ts

@@ -67,7 +67,6 @@ return { CommonsError, file, search };
 const m1 = (() => {
 const BASE = 'https://commons.wikimedia.org/w/api.php';
 
-
 async function random(args: m1_RandomArgs): Promise<string> {
   const limit = Math.max(1, Math.min(args.limit ?? 5, 15));
   const params = new URLSearchParams({
@@ -128,45 +127,6 @@ async function commonsGet(url: string): Promise<any> {
   return res.json()
 }
 
-function commonsTitle(args: { title?: string }): string {
-  const title = (args.title ?? "").trim()
-  if (!title) throw new CommonsLookupError("Provide a file title like File:Example.jpg")
-  return title.startsWith("File:") ? title : `File:${title}`
-}
-
-/** The categories a file sits in, which is how Commons files are browsed. */
-export async function fileCategories(args: { title?: string; limit?: number }): Promise<string> {
-  const title = commonsTitle(args)
-  const limit = Math.max(1, Math.min(args.limit ?? 15, 50))
-  const d = await commonsGet(
-    `${COMMONS_BASE}?action=query&titles=${encodeURIComponent(title)}&prop=categories&cllimit=${limit}&format=json&origin=*`,
-  )
-  const pages = Object.values(d?.query?.pages ?? {}) as any[]
-  const page = pages[0]
-  if (!page || page.missing !== undefined) throw new CommonsLookupError(`File not found: ${title}`)
-  const cats = page.categories ?? []
-  if (!cats.length) return `${page.title} is in no categories.`
-  return `Categories for ${page.title} (${cats.length}${cats.length >= limit ? "+, capped by limit" : ""}):\n` +
-    cats.map((c: any, i: number) => `${i + 1}. ${c.title}${c.hidden === true ? " (hidden)" : ""}`).join("\n")
-}
-
-/** A thumbnail URL at a chosen width, so a client can fetch a sized copy. */
-export async function fileThumbnail(args: { title?: string; width?: number }): Promise<string> {
-  const title = commonsTitle(args)
-  const width = Math.max(20, Math.min(args.width ?? 320, 2000))
-  const d = await commonsGet(
-    `${COMMONS_BASE}?action=query&titles=${encodeURIComponent(title)}&prop=imageinfo&iiprop=url|size|mime&iiurlwidth=${width}&format=json&origin=*`,
-  )
-  const pages = Object.values(d?.query?.pages ?? {}) as any[]
-  const info = pages[0]?.imageinfo?.[0]
-  if (!info) throw new CommonsLookupError(`No image info for ${title}`)
-  return [
-    `File: ${pages[0]?.title ?? title}`,
-    `Original: ${info.url ?? "not reported"} (${info.width ?? "?"}x${info.height ?? "?"}, ${info.mime ?? "?"})`,
-    `Thumbnail at ${width}px: ${info.thumburl ?? "not offered by Commons for this file"}`,
-  ].join("\n")
-}
-
 /** Browse a Commons category and list the media files inside it. */
 export async function categoryFiles(args: { category?: string; limit?: number }): Promise<string> {
   const raw = (args.category ?? "").trim()

package/src/gateway.ts

@@ -0,0 +1,106 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+
+const DEFAULT_GATEWAY_URL = 'https://mcp-gateway.contactae2000.workers.dev/mcp'
+const DEFAULT_TIMEOUT_MS = 25000
+const USER_AGENT = 'mrfentmen-mcp/1.0'
+
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export class GatewayError extends Error {
+  constructor(message: string, readonly refused: boolean) {
+    super(message)
+    this.name = 'GatewayError'
+  }
+}
+
+interface ContentPart {
+  text?: string
+}
+
+interface CallResult {
+  content?: ContentPart[]
+  isError?: boolean
+  structuredContent?: { licenceRefusal?: boolean }
+}
+
+interface JsonRpcResponse {
+  result?: CallResult
+  error?: { message?: string }
+}
+
+export async function premiumTool(tool: string, args: Record<string, unknown>): Promise<string> {
+  const key = (process.env.MCP_LICENSE_KEY ?? '').trim()
+  if (!key) {
+    throw new GatewayError(
+      `"${tool}" is a premium tool and no licence key is set. Set MCP_LICENSE_KEY in your MCP client config.`,
+      true,
+    )
+  }
+
+  const url = (process.env.MCP_GATEWAY_URL ?? DEFAULT_GATEWAY_URL).trim()
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS)
+  let response: Response
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        accept: 'application/json',
+        'user-agent': USER_AGENT,
+        authorization: `Bearer ${key}`,
+      },
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: { name: tool, arguments: args },
+      }),
+      signal: controller.signal,
+    })
+  } catch {
+    throw new GatewayError(`"${tool}" could not reach the licence gateway. Check your connection and try again.`, false)
+  } finally {
+    clearTimeout(timer)
+  }
+
+  if (!response.ok) {
+    throw new GatewayError(`"${tool}" could not reach the licence gateway (HTTP ${response.status}).`, false)
+  }
+
+  let body: JsonRpcResponse
+  try {
+    body = (await response.json()) as JsonRpcResponse
+  } catch {
+    throw new GatewayError(`"${tool}" got an unreadable answer from the licence gateway.`, false)
+  }
+
+  if (body.error) {
+    throw new GatewayError(`"${tool}" was refused by the licence gateway: ${body.error.message ?? 'unknown error'}`, false)
+  }
+
+  const result = body.result ?? {}
+  const text = (result.content ?? [])
+    .map((part) => part.text ?? '')
+    .join('\n')
+    .trim()
+
+  if (result.isError) {
+    // The gateway marks a licence refusal structurally, so a missing or rejected
+    // key is told apart from a tool that failed after the gate let it through.
+    if (result.structuredContent?.licenceRefusal) {
+      throw new GatewayError(text || `"${tool}" needs a valid licence key.`, true)
+    }
+    throw new GatewayError(text || `"${tool}" failed on the licence gateway.`, false)
+  }
+  if (!text) throw new GatewayError(`"${tool}" returned no data.`, false)
+  return text
+}

package/src/server.ts

@@ -1,8 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
 import { z } from 'zod'
-import { m0_file, m0_search, m1_random, fileCategories, fileThumbnail, categoryFiles } from './api.js'
-import { premiumRequired } from "./license.js"
 
+import { m0_file, m0_search, m1_random, categoryFiles } from "./api.js"
+import { premiumTool } from "./gateway.js"
 const text = (value: string) => ({ content: [{ type: 'text' as const, text: value }] })
 const textError = (t: string) => ({ content: [{ type: "text" as const, text: t }], isError: true as const })
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true } as const
@@ -57,10 +57,9 @@ server.registerTool(
     },
     async (args) => {
     // ---- paywall: file_categories ----
-    const paywallMessage = await premiumRequired("file_categories")
-    if (paywallMessage) return { content: [{ type: "text" as const, text: paywallMessage }], isError: true }
+        // The body runs on the gateway, behind the licence gate.
     // ---- paywall: end ----
-    try { return text(await fileCategories(args)) } catch (e) { return textError(error(e)) }
+    try { return text(await premiumTool("mcp_wikimedia_commons_file_categories", args)) } catch (e) { return textError(error(e)) }
   }
   )
 
@@ -74,10 +73,9 @@ server.registerTool(
     },
     async (args) => {
     // ---- paywall: file_thumbnail ----
-    const paywallMessage = await premiumRequired("file_thumbnail")
-    if (paywallMessage) return { content: [{ type: "text" as const, text: paywallMessage }], isError: true }
+        // The body runs on the gateway, behind the licence gate.
     // ---- paywall: end ----
-    try { return text(await fileThumbnail(args)) } catch (e) { return textError(error(e)) }
+    try { return text(await premiumTool("mcp_wikimedia_commons_file_thumbnail", args)) } catch (e) { return textError(error(e)) }
   }
   )
 

package/dist/license.js

@@ -1,79 +0,0 @@
-// Premium tools on this server need a license key bought from MCP Marketplace.
-// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
-// that is not listed in PREMIUM keeps working without a key.
-const SLUG = "wikimedia-commons-mcp";
-// Tools that need a key. Everything else is free.
-const PREMIUM = new Set([
-    "file_categories",
-    "file_thumbnail",
-]);
-const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
-// The license check calls the marketplace's verify endpoint directly instead of
-// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
-// check it makes is rejected by Supabase before it reaches the function. The
-// publishable key below is public by design - it ships in mcp-marketplace.io's
-// own JavaScript and only ever reaches their licence check.
-const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
-const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
-const OK_CACHE_MS = 60 * 60 * 1000;
-const BAD_CACHE_MS = 60 * 1000;
-const seen = new Map();
-const REASONS = {
-    missing_key: "no key is set",
-    invalid_format: "that key is not a valid MCP Marketplace key",
-    not_found: "that key was not found",
-    revoked: "that key has been revoked",
-    rotated: "that key was rotated, use your new one",
-    expired: "that key has expired, renew it",
-    rate_limited: "there were too many checks just now, try again shortly",
-    network_error: "the license server could not be reached",
-};
-function blocked(tool, reason) {
-    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
-    return `"${tool}" needs a license key, but ${why}. ` +
-        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
-}
-async function verify(key) {
-    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
-        method: "POST",
-        headers: {
-            apikey: PUBLISHABLE_KEY,
-            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({ key, slug: SLUG }),
-        // an unusable key answers 400 with a JSON body, so read the body either way
-        signal: AbortSignal.timeout(15000),
-    });
-    const data = (await res.json());
-    if (typeof data?.valid !== "boolean")
-        return { valid: false, reason: "unexpected_response" };
-    return data;
-}
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export async function premiumRequired(tool) {
-    if (!PREMIUM.has(tool))
-        return null;
-    const key = process.env.MCP_LICENSE_KEY;
-    if (!key)
-        return blocked(tool, "missing_key");
-    const hit = seen.get(key);
-    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
-        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
-    }
-    let result;
-    try {
-        result = await verify(key);
-    }
-    catch {
-        result = { valid: false, reason: "network_error" };
-    }
-    seen.set(key, { ...result, at: Date.now() });
-    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
-}

package/src/license.ts

@@ -1,89 +0,0 @@
-// Premium tools on this server need a license key bought from MCP Marketplace.
-// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
-// that is not listed in PREMIUM keeps working without a key.
-const SLUG = "wikimedia-commons-mcp"
-
-// Tools that need a key. Everything else is free.
-const PREMIUM = new Set<string>([
-  "file_categories",
-  "file_thumbnail",
-])
-
-const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`
-
-// The license check calls the marketplace's verify endpoint directly instead of
-// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
-// check it makes is rejected by Supabase before it reaches the function. The
-// publishable key below is public by design - it ships in mcp-marketplace.io's
-// own JavaScript and only ever reaches their licence check.
-const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key"
-const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h"
-
-const OK_CACHE_MS = 60 * 60 * 1000
-const BAD_CACHE_MS = 60 * 1000
-
-type Check = { valid: boolean; reason?: string }
-
-const seen = new Map<string, Check & { at: number }>()
-
-const REASONS: Record<string, string> = {
-  missing_key: "no key is set",
-  invalid_format: "that key is not a valid MCP Marketplace key",
-  not_found: "that key was not found",
-  revoked: "that key has been revoked",
-  rotated: "that key was rotated, use your new one",
-  expired: "that key has expired, renew it",
-  rate_limited: "there were too many checks just now, try again shortly",
-  network_error: "the license server could not be reached",
-}
-
-function blocked(tool: string, reason: string): string {
-  const why = REASONS[reason] ?? `the license server answered "${reason}"`
-  return `"${tool}" needs a license key, but ${why}. ` +
-    `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`
-}
-
-async function verify(key: string): Promise<Check> {
-  const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
-    method: "POST",
-    headers: {
-      apikey: PUBLISHABLE_KEY,
-      Authorization: `Bearer ${PUBLISHABLE_KEY}`,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify({ key, slug: SLUG }),
-    // an unusable key answers 400 with a JSON body, so read the body either way
-    signal: AbortSignal.timeout(15000),
-  })
-  const data = (await res.json()) as Check
-  if (typeof data?.valid !== "boolean") return { valid: false, reason: "unexpected_response" }
-  return data
-}
-
-/**
- * Returns null when the caller may run the tool, or a short message telling
- * them how to get a key.
- *
- * A good key is remembered for an hour, so a busy session does not hit the
- * license server on every call and keeps working through a brief outage.
- */
-export async function premiumRequired(tool: string): Promise<string | null> {
-  if (!PREMIUM.has(tool)) return null
-
-  const key = process.env.MCP_LICENSE_KEY
-  if (!key) return blocked(tool, "missing_key")
-
-  const hit = seen.get(key)
-  if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
-    return hit.valid ? null : blocked(tool, hit.reason ?? "invalid")
-  }
-
-  let result: Check
-  try {
-    result = await verify(key)
-  } catch {
-    result = { valid: false, reason: "network_error" }
-  }
-  seen.set(key, { ...result, at: Date.now() })
-  return result.valid ? null : blocked(tool, result.reason ?? "invalid")
-}