MyPrototypeWhat · MyPrototypeWhat · Jul 6, 2026 · Jul 6, 2026
diff --git a/.changeset/cc-nc-nd-families.md b/.changeset/cc-nc-nd-families.md
diff --git a/.changeset/evaluate-permissions.md b/.changeset/evaluate-permissions.md
diff --git a/.changeset/mcp-verdict-tools.md b/.changeset/mcp-verdict-tools.md
diff --git a/.changeset/orchestrator-hardening.md b/.changeset/orchestrator-hardening.md
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,37 @@
 # @refkit/core
 
+## 0.6.0
+
+### Minor Changes
+
+- 991d467: Add first-class CC NC/ND license families: `CC-BY-NC`, `CC-BY-NC-SA`, `CC-BY-NC-ND`, `CC-BY-ND`.
+
+  NC/ND-licensed results no longer collapse to `proprietary`: they keep their real
+  family id (+ CC version), generate the attribution the license requires, and
+  verdicts name the actual license in their reasons. Gating stays strict-deny —
+  commercial/AI use of NC content is still denied; NC × `redistribution` intent now
+  returns `needs-review` (was `denied`) because the intent cannot distinguish
+  commercial from non-commercial redistribution. `CC-BY-ND` now correctly allows
+  verbatim commercial reuse (`allowed-with-attribution`) while AI/derivative use
+  stays denied.
+
+  Note for TypeScript consumers: exhaustive `switch` statements over `LicenseId`
+  need arms for the four new ids.
+
+- 8300c18: Export evaluatePermissions/PermissionKey/EvaluateOptions — programmable strict-deny gate; evaluateUse intents are now presets over it (behavior unchanged).
+- c6b6061: Harden the search orchestrator: per-provider soft timeout (default 10s) and
+  bounded retry on 429/5xx/network errors (default 1, exponential backoff) — on by
+  default, tunable or disabled via `createRefkit({ resilience })`. Provider
+  statuses in `searchWithMeta` now carry `latencyMs`, and supplying a `cache`
+  (`KeyValueCache`) now memoizes per-provider results (key
+  `refkit:v1:<provider>:<queryHash>`, TTL via the new `cacheTtlMs` option, default
+  5 min) with hits flagged `cached: true`. Merge, rerank, and the license gate
+  always run fresh. New exports: `withTimeout`, `retryingFetch`, and the
+  `ResilienceOptions`, `TimeoutHandle`, `RetryOptions` types.
+
+  The MCP `search_references` structured output (`explain: true`) now surfaces
+  `latencyMs` per provider and `cached` on cache hits.
+
 ## 0.5.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/core",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "refkit core — neutral reference-retrieval brain: Reference/RightsRecord contract, license normalization, strict-deny use-gate, RRF merge/dedup, ReferenceProvider interfaces. Zero-network, zero-provider, only zod.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @refkit/mcp
 
+## 0.5.0
+
+### Minor Changes
+
+- 6a9b7e9: New stateless `evaluate_use` and `build_attribution` MCP tools — evaluate a
+  license against an intended use, or build an attribution credit line, without a
+  search round-trip. Zero-config `defaultProviders` now reads unified
+  `REFKIT_<PROVIDER>_KEY` env names first (`REFKIT_UNSPLASH_KEY`,
+  `REFKIT_PEXELS_KEY`, `REFKIT_PIXABAY_KEY`, `REFKIT_FLICKR_KEY`,
+  `REFKIT_SMITHSONIAN_KEY`, `REFKIT_BRAVE_KEY`, `REFKIT_FREESOUND_KEY`,
+  `REFKIT_JAMENDO_CLIENT_ID`, `REFKIT_EUROPEANA_KEY`), falling back to the legacy
+  names (`UNSPLASH_KEY`, `PEXELS_KEY`, `PIXABAY_KEY`, `FLICKR_KEY`, `SI_KEY`,
+  `BRAVE_TOKEN`, `FREESOUND_TOKEN`, `JAMENDO_CLIENT_ID`, `EUROPEANA_KEY`), which
+  are still honored.
+- c6b6061: Harden the search orchestrator: per-provider soft timeout (default 10s) and
+  bounded retry on 429/5xx/network errors (default 1, exponential backoff) — on by
+  default, tunable or disabled via `createRefkit({ resilience })`. Provider
+  statuses in `searchWithMeta` now carry `latencyMs`, and supplying a `cache`
+  (`KeyValueCache`) now memoizes per-provider results (key
+  `refkit:v1:<provider>:<queryHash>`, TTL via the new `cacheTtlMs` option, default
+  5 min) with hits flagged `cached: true`. Merge, rerank, and the license gate
+  always run fresh. New exports: `withTimeout`, `retryingFetch`, and the
+  `ResilienceOptions`, `TimeoutHandle`, `RetryOptions` types.
+
+  The MCP `search_references` structured output (`explain: true`) now surfaces
+  `latencyMs` per provider and `cached` on cache hits.
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+  - @refkit/provider-openverse@0.3.0
+  - @refkit/provider-flickr@0.3.0
+  - @refkit/provider-wikimedia-commons@0.3.0
+  - @refkit/provider-freesound@0.3.0
+  - @refkit/provider-jamendo@0.3.0
+  - @refkit/provider-europeana@0.3.0
+  - @refkit/provider-internet-archive@0.3.0
+  - @refkit/provider-artic@0.2.2
+  - @refkit/provider-brave@0.2.2
+  - @refkit/provider-gutendex@0.2.2
+  - @refkit/provider-met@0.2.2
+  - @refkit/provider-pexels@0.2.2
+  - @refkit/provider-pixabay@0.2.2
+  - @refkit/provider-poetrydb@0.2.2
+  - @refkit/provider-polyhaven@0.2.1
+  - @refkit/provider-rijksmuseum@0.2.1
+  - @refkit/provider-smithsonian@0.2.2
+  - @refkit/provider-unsplash@0.2.2
+
 ## 0.4.0
 
 ### Minor Changes

diff --git a/packages/mcp/package.json b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/mcp",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "MCP server for refkit — exposes license-normalized reference search as an agent tool.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-artic/CHANGELOG.md b/packages/provider-artic/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @refkit/provider-artic
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/provider-artic/package.json b/packages/provider-artic/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-artic",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Art Institute of Chicago provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-brave/CHANGELOG.md b/packages/provider-brave/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @refkit/provider-brave
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/provider-brave/package.json b/packages/provider-brave/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-brave",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Brave Search web-discovery provider satellite for refkit — open-web image breadth, license:unknown (use-gated to needs-review).",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-europeana/CHANGELOG.md b/packages/provider-europeana/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @refkit/provider-europeana
 
+## 0.3.0
+
+### Minor Changes
+
+- 991d467: Add first-class CC NC/ND license families: `CC-BY-NC`, `CC-BY-NC-SA`, `CC-BY-NC-ND`, `CC-BY-ND`.
+
+  NC/ND-licensed results no longer collapse to `proprietary`: they keep their real
+  family id (+ CC version), generate the attribution the license requires, and
+  verdicts name the actual license in their reasons. Gating stays strict-deny —
+  commercial/AI use of NC content is still denied; NC × `redistribution` intent now
+  returns `needs-review` (was `denied`) because the intent cannot distinguish
+  commercial from non-commercial redistribution. `CC-BY-ND` now correctly allows
+  verbatim commercial reuse (`allowed-with-attribution`) while AI/derivative use
+  stays denied.
+
+  Note for TypeScript consumers: exhaustive `switch` statements over `LicenseId`
+  need arms for the four new ids.
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.0
 
 ### Minor Changes

diff --git a/packages/provider-europeana/package.json b/packages/provider-europeana/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-europeana",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Europeana provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-flickr/CHANGELOG.md b/packages/provider-flickr/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @refkit/provider-flickr
 
+## 0.3.0
+
+### Minor Changes
+
+- 991d467: Add first-class CC NC/ND license families: `CC-BY-NC`, `CC-BY-NC-SA`, `CC-BY-NC-ND`, `CC-BY-ND`.
+
+  NC/ND-licensed results no longer collapse to `proprietary`: they keep their real
+  family id (+ CC version), generate the attribution the license requires, and
+  verdicts name the actual license in their reasons. Gating stays strict-deny —
+  commercial/AI use of NC content is still denied; NC × `redistribution` intent now
+  returns `needs-review` (was `denied`) because the intent cannot distinguish
+  commercial from non-commercial redistribution. `CC-BY-ND` now correctly allows
+  verbatim commercial reuse (`allowed-with-attribution`) while AI/derivative use
+  stays denied.
+
+  Note for TypeScript consumers: exhaustive `switch` statements over `LicenseId`
+  need arms for the four new ids.
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/provider-flickr/package.json b/packages/provider-flickr/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-flickr",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Flickr provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-freesound/CHANGELOG.md b/packages/provider-freesound/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @refkit/provider-freesound
 
+## 0.3.0
+
+### Minor Changes
+
+- 991d467: Add first-class CC NC/ND license families: `CC-BY-NC`, `CC-BY-NC-SA`, `CC-BY-NC-ND`, `CC-BY-ND`.
+
+  NC/ND-licensed results no longer collapse to `proprietary`: they keep their real
+  family id (+ CC version), generate the attribution the license requires, and
+  verdicts name the actual license in their reasons. Gating stays strict-deny —
+  commercial/AI use of NC content is still denied; NC × `redistribution` intent now
+  returns `needs-review` (was `denied`) because the intent cannot distinguish
+  commercial from non-commercial redistribution. `CC-BY-ND` now correctly allows
+  verbatim commercial reuse (`allowed-with-attribution`) while AI/derivative use
+  stays denied.
+
+  Note for TypeScript consumers: exhaustive `switch` statements over `LicenseId`
+  need arms for the four new ids.
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.0
 
 ### Minor Changes

diff --git a/packages/provider-freesound/package.json b/packages/provider-freesound/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-freesound",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Freesound provider satellite for refkit.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-gutendex/CHANGELOG.md b/packages/provider-gutendex/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @refkit/provider-gutendex
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.1
 
 ### Patch Changes

diff --git a/packages/provider-gutendex/package.json b/packages/provider-gutendex/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@refkit/provider-gutendex",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Gutendex (Project Gutenberg) provider satellite for refkit — public-domain book references, per-item copyright→license.",
   "type": "module",
   "license": "Apache-2.0",

diff --git a/packages/provider-internet-archive/CHANGELOG.md b/packages/provider-internet-archive/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @refkit/provider-internet-archive
 
+## 0.3.0
+
+### Minor Changes
+
+- 991d467: Add first-class CC NC/ND license families: `CC-BY-NC`, `CC-BY-NC-SA`, `CC-BY-NC-ND`, `CC-BY-ND`.
+
+  NC/ND-licensed results no longer collapse to `proprietary`: they keep their real
+  family id (+ CC version), generate the attribution the license requires, and
+  verdicts name the actual license in their reasons. Gating stays strict-deny —
+  commercial/AI use of NC content is still denied; NC × `redistribution` intent now
+  returns `needs-review` (was `denied`) because the intent cannot distinguish
+  commercial from non-commercial redistribution. `CC-BY-ND` now correctly allows
+  verbatim commercial reuse (`allowed-with-attribution`) while AI/derivative use
+  stays denied.
+
+  Note for TypeScript consumers: exhaustive `switch` statements over `LicenseId`
+  need arms for the four new ids.
+
+### Patch Changes
+
+- Updated dependencies [991d467]
+- Updated dependencies [8300c18]
+- Updated dependencies [c6b6061]
+  - @refkit/core@0.6.0
+
 ## 0.2.0
 
 ### Minor Changes