@konneal/engine 0.2.6 → 0.2.7

package/dist/{ask-RX3W5JJW.js → ask-6V6AJG2V.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-7K5XP4PB.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-LWEVSMH6.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/{chunk-GCL73ZLT.js → chunk-7UT76RQO.js}

@@ -2294,6 +2294,7 @@ function buildAuthorizationUrl(metadata, params) {
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }
 async function exchangeCode(metadata, params) {
@@ -2473,13 +2474,19 @@ async function handleLogin(env, req) {
         expirationTtl: 600
       }
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
       scopes: "openid profile email roles",
       state,
       nonce,
-      codeChallenge: pkce.challenge
+      codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...silent ? { prompt: "none" } : {}
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -2491,6 +2498,9 @@ async function handleCallback(env, req) {
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     const msg = opError === "access_denied" ? "Sign-in was cancelled." : opError === "temporarily_unavailable" ? "The sign-in service is busy. Please try again in a moment." : "The sign-in service reported a problem. Please try again.";
     return new Response(null, {

package/dist/{chunk-7K5XP4PB.js → chunk-LWEVSMH6.js}

@@ -27,7 +27,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,

package/dist/{chunk-NRC4FBDQ.js → chunk-YFDWKXEB.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,

package/dist/oidc.d.ts

@@ -30,6 +30,9 @@ export declare function buildAuthorizationUrl(metadata: OidcMetadata, params: {
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
 }): string;
 export interface OidcTokenResponse {
     id_token: string;

package/dist/{search-OXHXXT5S.js → search-RFKT7ZZY.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-NRC4FBDQ.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-YFDWKXEB.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/worker_public/src/index.js

@@ -1,13 +1,13 @@
 import {
   handleSearch
-} from "../../chunk-NRC4FBDQ.js";
+} from "../../chunk-YFDWKXEB.js";
 import {
   checkQuoteAnchors,
   handleAsk,
   handleMemories,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-7K5XP4PB.js";
+} from "../../chunk-LWEVSMH6.js";
 import {
   buildMessages,
   citations,
@@ -29,7 +29,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-GCL73ZLT.js";
+} from "../../chunk-7UT76RQO.js";
 import {
   authenticate,
   corsHeaders,
@@ -979,7 +979,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-RX3W5JJW.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-OXHXXT5S.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-6V6AJG2V.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-RFKT7ZZY.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1602,7 +1602,7 @@ function permissionsCatalog() {
   perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
   perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
   perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
-  groups.push({ id: "ai", description: "The publications assistant's gated capabilities", permissions: perms });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
   return {
     version: 1,
     verbs: ["read", "write", "admin"],

package/package.json

@@ -34,7 +34,7 @@
     "@oimlsmart/oiml-pubid": "^1.2.1"
   },
   "dependencies": {},
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/auth.ts

@@ -85,6 +85,7 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
         expirationTtl: 600,
       },
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
@@ -92,6 +93,11 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
       state,
       nonce,
       codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...(silent ? { prompt: "none" } : {}),
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -104,6 +110,11 @@ export async function handleCallback(env: any, req: Request): Promise<Response>
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    // the silent probe found no OP session — anonymous is the honest
+    // state, never an error
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     // the OP redirected back with its own failure (user denied consent,
     // session expired at the OP, …) — fail closed, in plain language

package/workers/worker_public/src/index.ts

@@ -421,7 +421,7 @@ function permissionsCatalog(): Record<string, unknown> {
   perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
   perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
   perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
-  groups.push({ id: "ai", description: "The publications assistant's gated capabilities", permissions: perms });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
   return {
     version: 1,
     verbs: ["read", "write", "admin"],

package/workers/worker_public/src/oidc.ts

@@ -131,6 +131,9 @@ export function buildAuthorizationUrl(
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
   },
 ): string {
   const url = new URL(metadata.authorization_endpoint);
@@ -142,6 +145,7 @@ export function buildAuthorizationUrl(
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }