@konneal/engine 0.2.5 → 0.2.7

package/README.md

@@ -1,5 +1,7 @@
 # Konneal Engine
 
+**New here?** Read [docs/ADOPTION.md](docs/ADOPTION.md) — adopt Konneal for your own standards and your own identity service.
+
 The publisher-agnostic serving layer for standards intelligence: hybrid
 retrieval over clause-structured corpora, citation-grounded answers,
 typed tables/formulas/figures, conformance checking by execution, and

package/dist/{ask-RX3W5JJW.js → ask-6V6AJG2V.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-7K5XP4PB.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-LWEVSMH6.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/{chunk-GCL73ZLT.js → chunk-7UT76RQO.js}

@@ -2294,6 +2294,7 @@ function buildAuthorizationUrl(metadata, params) {
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }
 async function exchangeCode(metadata, params) {
@@ -2473,13 +2474,19 @@ async function handleLogin(env, req) {
         expirationTtl: 600
       }
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
       scopes: "openid profile email roles",
       state,
       nonce,
-      codeChallenge: pkce.challenge
+      codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...silent ? { prompt: "none" } : {}
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -2491,6 +2498,9 @@ async function handleCallback(env, req) {
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     const msg = opError === "access_denied" ? "Sign-in was cancelled." : opError === "temporarily_unavailable" ? "The sign-in service is busy. Please try again in a moment." : "The sign-in service reported a problem. Please try again.";
     return new Response(null, {

package/dist/{chunk-7K5XP4PB.js → chunk-LWEVSMH6.js}

@@ -27,7 +27,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,

package/dist/{chunk-NRC4FBDQ.js → chunk-YFDWKXEB.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,

package/dist/oidc.d.ts

@@ -30,6 +30,9 @@ export declare function buildAuthorizationUrl(metadata: OidcMetadata, params: {
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
 }): string;
 export interface OidcTokenResponse {
     id_token: string;

package/dist/{search-OXHXXT5S.js → search-RFKT7ZZY.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-NRC4FBDQ.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-YFDWKXEB.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/worker_public/src/index.js

@@ -1,13 +1,13 @@
 import {
   handleSearch
-} from "../../chunk-NRC4FBDQ.js";
+} from "../../chunk-YFDWKXEB.js";
 import {
   checkQuoteAnchors,
   handleAsk,
   handleMemories,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-7K5XP4PB.js";
+} from "../../chunk-LWEVSMH6.js";
 import {
   buildMessages,
   citations,
@@ -29,7 +29,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-GCL73ZLT.js";
+} from "../../chunk-7UT76RQO.js";
 import {
   authenticate,
   corsHeaders,
@@ -979,7 +979,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-RX3W5JJW.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-OXHXXT5S.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-6V6AJG2V.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-RFKT7ZZY.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1585,9 +1585,46 @@ async function researchRoute(c) {
   const session = c.env.SESSION_SECRET ? await sessionFrom(c.req, c.env) : null;
   return handleResearch(c.env, c.ctx, c.req, session);
 }
+function permissionsCatalog() {
+  const groups = [];
+  const perms = [];
+  for (const d of P().datasets ?? []) {
+    if (d.session && d.permission) {
+      perms.push({
+        id: "ai.dataset.externally-licensed",
+        description: `Access the ${d.label} dataset (federated, externally licensed content)`
+      });
+    }
+  }
+  if (P().publisher.features?.drafts) {
+    perms.push({ id: "ai.drafts", description: "Ask the assistant to prepare draft acts" });
+  }
+  perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
+  perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
+  perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
+  return {
+    version: 1,
+    verbs: ["read", "write", "admin"],
+    groups
+  };
+}
+async function openapiCatalogRoute(c) {
+  return json(
+    {
+      openapi: "3.1.0",
+      info: { title: `${P().publisher.product_name} API`, version: c.env.INDEX_VERSION ?? "0" },
+      paths: {},
+      "x-oiml-permissions-catalog": permissionsCatalog()
+    },
+    200,
+    corsHeaders(c.req)
+  );
+}
 var INFRA_ROUTES = [
   { method: "GET", pattern: "/", handler: serveIndexPage },
   { method: "GET", pattern: "/api/", handler: serveIndexPage },
+  { method: "GET", pattern: "/api/openapi.json", handler: openapiCatalogRoute },
   { method: "GET", pattern: "/index.html", handler: serveIndexPage },
   { method: "GET", pattern: "/assets/*", handler: unitAssetRoute },
   { method: "GET", pattern: "/docs/*", handler: docsRoute }

package/docs/ADOPTION.md

@@ -0,0 +1,61 @@
+# Adopting Konneal: your own standards-intelligence site
+
+Konneal is a publisher-agnostic engine: clause-cited, verifiable answers
+over your own Metanorma documents and Primmel models — deployed on your
+own infrastructure, with licensed third-party content (IEC, ISO and
+peers) gated behind your identity service.
+
+## Start
+
+    npm create @konneal/publisher my-sdo
+
+The scaffolder interviews you for your publisher's facts — id, name,
+domains, identity issuer, first dataset — and writes the whole
+deployment skeleton: the worker, the site, the profile, the ingest
+pipeline, CI. Every generated file is ordinary reviewable code.
+
+Then the four declarations:
+
+1. **Your profile** (`profile/*.yaml`): publisher identity, domains,
+   datasets, the corpora registry, the licensed-standards catalog,
+   prompt variables, smoke probes. Everything the serving surface knows
+   about you is this data, never engine code.
+2. **Your corpus** (`sources/`): your Metanorma documents. The ingest
+   pipeline chunks along the documents' own clause boundaries, embeds,
+   and upserts into your indexes.
+3. **Your models** (Primmel packages): the machine-readable layer —
+   requirements, constraints with threshold expressions, severity
+   condition sets — so answers can carry server-computed verdicts, not
+   paraphrases.
+4. **Your identity**: any discovery-compliant OIDC provider. Register
+   the site (authorization code + PKCE), map roles to datasets and
+   groups to licensed keys in the provider's configuration — revoking a
+   role removes access on the next request, no deploy.
+
+## Licensed content, gated
+
+Licensed standards are fail-closed by construction: each licensed
+package carries a license key; the deployment's profile declares the
+whitelist; a request without an entitled scope never sees the licensed
+text — it is filtered before the model reads anything. An anonymous
+request cannot reach internal indexes at all: the public surface holds
+no binding to them, and the internal worker re-verifies every session
+itself.
+
+## The proof
+
+Your golden suite gates every promotion: content witnesses, refusal
+legs, licensed pairs in both directions (entitled content serves;
+unentitled never appears), context-utilization and verdict legs. The
+nightly runs unattended against production and fails loudly on drift.
+
+## Ask it from your terminal
+
+The konneal CLI ships with the client package: npm i -g @konneal/client, then KONNEAL_BASE and KONNEAL_KEY in the environment give you konneal ask, konneal search and konneal keys list — streaming answers with citations and verdict blocks, the same API the site uses behind the same tiering.
+
+## The path
+
+`npm create @konneal/publisher` → declare the profile → ingest your
+corpus → author one model package and one golden leg → map identity →
+promote through the gate. Adoption is done when your team runs the
+nightly and reads the gate without help.

package/package.json

@@ -34,7 +34,7 @@
     "@oimlsmart/oiml-pubid": "^1.2.1"
   },
   "dependencies": {},
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/auth.ts

@@ -85,6 +85,7 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
         expirationTtl: 600,
       },
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
@@ -92,6 +93,11 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
       state,
       nonce,
       codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...(silent ? { prompt: "none" } : {}),
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -104,6 +110,11 @@ export async function handleCallback(env: any, req: Request): Promise<Response>
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    // the silent probe found no OP session — anonymous is the honest
+    // state, never an error
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     // the OP redirected back with its own failure (user denied consent,
     // session expired at the OP, …) — fail closed, in plain language

package/workers/worker_public/src/index.ts

@@ -398,9 +398,54 @@ async function researchRoute(c: RouteContext): Promise<Response> {
 // The non-API routes: the HTML pages, the unit-keyed figure assets and
 // the rendered publication documents. Everything else is generated from
 // the OpenAPI document.
+
+// The service's own permission catalog (TODO.openapi/03): the identity
+// service FETCHES this endpoint to verify every permission grant for
+// this client — it never holds a copy. The catalog derives from the
+// profile's own declarations (gated datasets, feature flags), so a
+// deployment's catalog cannot drift from what it enforces.
+function permissionsCatalog(): Record<string, unknown> {
+  const groups: Record<string, unknown>[] = [];
+  const perms: Record<string, unknown>[] = [];
+  for (const d of P().datasets ?? []) {
+    if (d.session && d.permission) {
+      perms.push({
+        id: "ai.dataset.externally-licensed",
+        description: `Access the ${d.label} dataset (federated, externally licensed content)`,
+      });
+    }
+  }
+  if (P().publisher.features?.drafts) {
+    perms.push({ id: "ai.drafts", description: "Ask the assistant to prepare draft acts" });
+  }
+  perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
+  perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
+  perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
+  return {
+    version: 1,
+    verbs: ["read", "write", "admin"],
+    groups,
+  };
+}
+
+async function openapiCatalogRoute(c: RouteContext): Promise<Response> {
+  return json(
+    {
+      openapi: "3.1.0",
+      info: { title: `${P().publisher.product_name} API`, version: c.env.INDEX_VERSION ?? "0" },
+      paths: {},
+      "x-oiml-permissions-catalog": permissionsCatalog(),
+    },
+    200,
+    corsHeaders(c.req),
+  );
+}
+
 const INFRA_ROUTES: Route[] = [
   { method: "GET", pattern: "/", handler: serveIndexPage },
   { method: "GET", pattern: "/api/", handler: serveIndexPage },
+  { method: "GET", pattern: "/api/openapi.json", handler: openapiCatalogRoute },
   { method: "GET", pattern: "/index.html", handler: serveIndexPage },
   { method: "GET", pattern: "/assets/*", handler: unitAssetRoute },
   { method: "GET", pattern: "/docs/*", handler: docsRoute },

package/workers/worker_public/src/oidc.ts

@@ -131,6 +131,9 @@ export function buildAuthorizationUrl(
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
   },
 ): string {
   const url = new URL(metadata.authorization_endpoint);
@@ -142,6 +145,7 @@ export function buildAuthorizationUrl(
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }