@kanonak-protocol/sdk 3.14.0 → 3.17.0

package/dist/index.js

@@ -1,11 +1,11 @@
-import{a as Me,b as Ge,c as ze,d as We,e as Je,f as qe,g as Ye,h as Xe,i as Ze,j as Qe}from"./chunk-YENGFI2R.js";import{a as _e,b as Ve,c as Ue,d as C,e as S,f as a}from"./chunk-AFF2TQ7Y.js";import{a as He,b as jt,c as At,d as Ht,e as _t,f as Vt,g as Ut,h as Mt,i as Gt,j as zt,k as Wt}from"./chunk-USLG7UIM.js";import{a as Nt}from"./chunk-GKQVJITL.js";import{a as fe,b as ye,c as ge,d as he,e as ke}from"./chunk-3JRHG2JH.js";import{a as ue,b as Ce,c as Se,d as Pe}from"./chunk-CNM3SY5S.js";import{a as tt,b as rt,c as nt}from"./chunk-7M7XXZOV.js";import{a as xe,b as Ee,c as Ae}from"./chunk-CRR4BQKR.js";import{a as Re,b as be,c as we,d as ve,e as Te,f as Ie,g as Ke,h as Be,i as De,j as Le,k as Fe,l as Oe}from"./chunk-W6T7MOKY.js";import{a as ot,b as it,c as at,d as st}from"./chunk-QJ66UBDY.js";import{a as oe,b as ie,c as ae,d as se,e as ce,f as le,g as de,h as pe}from"./chunk-FQHALFRR.js";import{A as Lt,B as Ft,C as Ot,a as ct,b as lt,c as dt,d as pt,e as ut,f as mt,g as ft,h as yt,i as gt,j as ht,k as kt,l as Ct,m as St,n as Pt,o as Rt,p as bt,q as wt,r as xt,s as $t,t as vt,u as Et,v as Tt,w as It,x as Kt,y as Bt,z as Dt}from"./chunk-C54LRL2A.js";import{a as me}from"./chunk-MYITGTGJ.js";import{b as Ne,c as je}from"./chunk-RGMZAKJV.js";import{a as $e}from"./chunk-FUUTGGJS.js";import{a as et}from"./chunk-ODIECDN7.js";import{VersionOperator as _n}from"@kanonak-protocol/types/document/models/enums";import{existsSync as pr,readFileSync as ur}from"fs";import{homedir as mr}from"os";import{join as fr}from"path";import{execFile as Jt}from"child_process";import{promisify as qt}from"util";var P=qt(Jt),R="kanonak",b="/usr/bin/security",u=class{async get(e){let t=a(e);try{let{stdout:r}=await P(b,["find-generic-password","-s",R,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(r.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
+import{a as Ge,b as ze,c as We,d as Je,e as qe,f as Ye,g as Xe,h as Ze,i as Qe,j as et}from"./chunk-2SSUPRX3.js";import{a as Me,b as Ue,c as Ve,d as S,e as C,f as a}from"./chunk-BQIWYLBU.js";import{a as At}from"./chunk-C2WWLKWE.js";import{a as fe,b as ye,c as ge,d as he,e as ke}from"./chunk-3JRHG2JH.js";import{a as ue,b as Se,c as Ce,d as Pe}from"./chunk-CNM3SY5S.js";import{a as rt,b as nt,c as ot}from"./chunk-CQLO62JP.js";import{a as _e,b as it,c as at,d as st,e as ct}from"./chunk-VRZUCZEF.js";import{a as oe,b as ie,c as ae,d as se,e as ce,f as le,g as de,h as pe}from"./chunk-FQHALFRR.js";import{A as Ft,B as Ot,C as Nt,D as jt,a as lt,b as dt,c as pt,d as ut,e as mt,f as ft,g as yt,h as gt,i as ht,j as kt,k as St,l as Ct,m as Pt,n as bt,o as Rt,p as wt,q as xt,r as $t,s as vt,t as Et,u as Tt,v as It,w as Kt,x as Bt,y as Dt,z as Lt}from"./chunk-L4HXBHJ4.js";import"./chunk-FJ35VIV6.js";import{a as xe,b as Ee,c as Ne,d as He}from"./chunk-Z72IKY6C.js";import{a as be,b as Re,c as we,d as ve,e as Te,f as Ie,g as Ke,h as Be,i as De,j as Le,k as Fe,l as Oe}from"./chunk-W6T7MOKY.js";import{a as me}from"./chunk-MYITGTGJ.js";import{b as je,c as Ae}from"./chunk-IXE5THUW.js";import{a as $e}from"./chunk-FUUTGGJS.js";import{a as tt}from"./chunk-ODIECDN7.js";import{VersionOperator as Dn}from"@kanonak-protocol/types/document/models/enums";import{existsSync as nr,readFileSync as or}from"fs";import{homedir as ir}from"os";import{join as ar}from"path";import{execFile as Ht}from"child_process";import{promisify as _t}from"util";var P=_t(Ht),b="kanonak",R="/usr/bin/security",u=class{async get(e){let t=a(e);try{let{stdout:r}=await P(R,["find-generic-password","-s",b,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(r.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
   Run 'kanonak logout ${t}' then 'kanonak login ${t}' to fix.`)}}catch(r){if(j(r,44))return null;throw new Error(`macOS Keychain read failed for '${t}': ${w(r)}
   The Keychain may be locked or inaccessible.
-  Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,t){let r=a(e),o=JSON.stringify(t);try{await P(b,["add-generic-password","-s",R,"-a",r,"-U","-w",o],{timeout:1e4})}catch(i){throw new Error(`macOS Keychain write failed for '${r}': ${w(i)}
+  Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,t){let r=a(e),o=JSON.stringify(t);try{await P(R,["add-generic-password","-s",b,"-a",r,"-U","-w",o],{timeout:1e4})}catch(i){throw new Error(`macOS Keychain write failed for '${r}': ${w(i)}
   Ensure the Keychain is unlocked and the CLI has write permission.
-  On managed devices, your IT policy may block credential storage.`)}}async remove(e){let t=a(e);try{await P(b,["delete-generic-password","-s",R,"-a",t],{timeout:1e4})}catch(r){if(j(r,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${t}': ${w(r)}
-  The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await P(b,["dump-keychain"],{timeout:1e4}),t=[],r=!1;for(let o of e.split(`
-`))if(o.includes(`"svce"<blob>="${R}"`)&&(r=!0),r&&o.includes('"acct"<blob>=')){let i=o.match(/"acct"<blob>="([^"]+)"/);i&&t.push(i[1]),r=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${w(e)}`),[]}}};function j(n,e){return typeof n=="object"&&n!==null&&"code"in n&&n.code===e}function w(n){return n instanceof Error?n.message:String(n)}import{execFile as Yt}from"child_process";import{promisify as Xt}from"util";var Zt=Xt(Yt),x="kanonak:",m=class{async get(e){let t=x+a(e),r=`
+  On managed devices, your IT policy may block credential storage.`)}}async remove(e){let t=a(e);try{await P(R,["delete-generic-password","-s",b,"-a",t],{timeout:1e4})}catch(r){if(j(r,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${t}': ${w(r)}
+  The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await P(R,["dump-keychain"],{timeout:1e4}),t=[],r=!1;for(let o of e.split(`
+`))if(o.includes(`"svce"<blob>="${b}"`)&&(r=!0),r&&o.includes('"acct"<blob>=')){let i=o.match(/"acct"<blob>="([^"]+)"/);i&&t.push(i[1]),r=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${w(e)}`),[]}}};function j(n,e){return typeof n=="object"&&n!==null&&"code"in n&&n.code===e}function w(n){return n instanceof Error?n.message:String(n)}import{execFile as Mt}from"child_process";import{promisify as Ut}from"util";var Vt=Ut(Mt),x="kanonak:",m=class{async get(e){let t=x+a(e),r=`
 ${v}
 $target = [Console]::In.ReadLine()
 $ptr = [IntPtr]::Zero
@@ -41,7 +41,7 @@ ${v}
 $target = [Console]::In.ReadLine()
 [CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await $(r,t)}catch{}}async list(){let e=`
 ${v}
-${Qt}
+${Gt}
 $prefix = [Console]::In.ReadLine()
 $count = 0
 $pCreds = [IntPtr]::Zero
@@ -56,7 +56,7 @@ if ([CredMan]::CredEnumerate($null, 0, [ref]$count, [ref]$pCreds)) {
   }
   [CredMan]::CredFree($pCreds)
 }`;try{let{stdout:t}=await $(e,x);return t.trim().split(`
-`).map(r=>r.trim()).filter(Boolean)}catch{return[]}}};async function $(n,e){for(let t of["pwsh","powershell"])try{return await Zt(t,["-NoProfile","-NonInteractive","-Command",n],{timeout:15e3,...e!==void 0&&{input:e}})}catch(r){if(t==="powershell")throw r}throw new Error("Neither pwsh nor powershell found")}var v=`
+`).map(r=>r.trim()).filter(Boolean)}catch{return[]}}};async function $(n,e){for(let t of["pwsh","powershell"])try{return await Vt(t,["-NoProfile","-NonInteractive","-Command",n],{timeout:15e3,...e!==void 0&&{input:e}})}catch(r){if(t==="powershell")throw r}throw new Error("Neither pwsh nor powershell found")}var v=`
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -87,13 +87,13 @@ public class CredMan {
   [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
   public static extern bool CredEnumerate(string filter, int flags, out int count, out IntPtr credentials);
 }
-"@`,Qt="";import{execFile as er,spawn as tr}from"child_process";import{promisify as rr}from"util";var T=rr(er),E="kanonak",f=class{async get(e){let t=a(e);try{let{stdout:r}=await T("secret-tool",["lookup","service",E,"publisher",t],{timeout:1e4}),o=r.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let r=a(e),o=JSON.stringify(t);await new Promise((i,s)=>{let c=tr("secret-tool",["store","--label",`Kanonak: ${r}`,"service",E,"publisher",r],{stdio:["pipe","ignore","ignore"],timeout:1e4});c.stdin.write(o),c.stdin.end(),c.on("close",l=>{l===0?i():s(new Error(`secret-tool store exited with code ${l}`))}),c.on("error",s)})}async remove(e){let t=a(e);try{await T("secret-tool",["clear","service",E,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await T("secret-tool",["search","service",E],{timeout:1e4}),t=[];for(let r of e.split(`
-`)){let o=r.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function D(){try{return await T("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as A,mkdirSync as H,readFileSync as _,writeFileSync as V}from"fs";import{createCipheriv as nr,createDecipheriv as or,randomBytes as U}from"crypto";import{homedir as ir}from"os";import{join as O,dirname as M}from"path";var z=O(ir(),".config","kanonak"),y=O(z,"keyring.key"),I=O(z,"credentials.enc"),G="aes-256-gcm",L=32,p=12,F=16,g=class{async get(e){let t=this.loadStore(),r=a(e);return t[r]??null}async store(e,t){let r=this.loadStore(),o=a(e);r[o]=t,this.saveStore(r)}async remove(e){let t=this.loadStore(),r=a(e);delete t[r],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!A(I))return{};try{let e=this.getOrCreateKey(),t=_(I);if(t.length<p+F)return{};let r=t.subarray(0,p),o=t.subarray(p,p+F),i=t.subarray(p+F),s=or(G,e,r);s.setAuthTag(o);let c=Buffer.concat([s.update(i),s.final()]);return JSON.parse(c.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),r=U(p),o=nr(G,t,r),i=Buffer.from(JSON.stringify(e),"utf-8"),s=Buffer.concat([o.update(i),o.final()]),c=o.getAuthTag(),l=Buffer.concat([r,c,s]);H(M(I),{recursive:!0}),V(I,l,{mode:384})}getOrCreateKey(){if(A(y)){let t=_(y);if(t.length!==L)throw new Error(`Credential keyring key is corrupted (expected ${L} bytes, got ${t.length}). Delete ${y} and re-authenticate.`);return t}let e=U(L);return H(M(y),{recursive:!0}),V(y,e,{mode:384}),e}};import{execFile as ar}from"child_process";import{promisify as sr}from"util";var cr=sr(ar),W=3e4,h=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=a(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(r){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${K(r)}
+"@`,Gt="";import{execFile as zt,spawn as Wt}from"child_process";import{promisify as Jt}from"util";var T=Jt(zt),E="kanonak",f=class{async get(e){let t=a(e);try{let{stdout:r}=await T("secret-tool",["lookup","service",E,"publisher",t],{timeout:1e4}),o=r.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let r=a(e),o=JSON.stringify(t);await new Promise((i,s)=>{let c=Wt("secret-tool",["store","--label",`Kanonak: ${r}`,"service",E,"publisher",r],{stdio:["pipe","ignore","ignore"],timeout:1e4});c.stdin.write(o),c.stdin.end(),c.on("close",l=>{l===0?i():s(new Error(`secret-tool store exited with code ${l}`))}),c.on("error",s)})}async remove(e){let t=a(e);try{await T("secret-tool",["clear","service",E,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await T("secret-tool",["search","service",E],{timeout:1e4}),t=[];for(let r of e.split(`
+`)){let o=r.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function D(){try{return await T("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as A,mkdirSync as H,readFileSync as _,writeFileSync as M}from"fs";import{createCipheriv as qt,createDecipheriv as Yt,randomBytes as U}from"crypto";import{homedir as Xt}from"os";import{join as O,dirname as V}from"path";var z=O(Xt(),".config","kanonak"),y=O(z,"keyring.key"),I=O(z,"credentials.enc"),G="aes-256-gcm",L=32,p=12,F=16,g=class{async get(e){let t=this.loadStore(),r=a(e);return t[r]??null}async store(e,t){let r=this.loadStore(),o=a(e);r[o]=t,this.saveStore(r)}async remove(e){let t=this.loadStore(),r=a(e);delete t[r],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!A(I))return{};try{let e=this.getOrCreateKey(),t=_(I);if(t.length<p+F)return{};let r=t.subarray(0,p),o=t.subarray(p,p+F),i=t.subarray(p+F),s=Yt(G,e,r);s.setAuthTag(o);let c=Buffer.concat([s.update(i),s.final()]);return JSON.parse(c.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),r=U(p),o=qt(G,t,r),i=Buffer.from(JSON.stringify(e),"utf-8"),s=Buffer.concat([o.update(i),o.final()]),c=o.getAuthTag(),l=Buffer.concat([r,c,s]);H(V(I),{recursive:!0}),M(I,l,{mode:384})}getOrCreateKey(){if(A(y)){let t=_(y);if(t.length!==L)throw new Error(`Credential keyring key is corrupted (expected ${L} bytes, got ${t.length}). Delete ${y} and re-authenticate.`);return t}let e=U(L);return H(V(y),{recursive:!0}),M(y,e,{mode:384}),e}};import{execFile as Zt}from"child_process";import{promisify as Qt}from"util";var er=Qt(Zt),W=3e4,h=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=a(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(r){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${K(r)}
   Verify the helper binary exists, is executable, and implements the Kanonak credential helper protocol.
   Check the 'credentialHelper' path in ~/.kanonak/config.json.`)}}async store(e,t){let r=a(e);try{await this.runHelper("store",{publisher:r,credential:t})}catch(o){throw new Error(`Credential helper '${this.helperPath}' failed to store credential for '${r}': ${K(o)}
-  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=a(e);try{await this.runHelper("erase",{publisher:t})}catch(r){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${K(r)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${K(e)}`),[]}}async runHelper(e,t){try{let{stdout:r}=await cr(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:W});return r}catch(r){throw lr(r)?new Error(`Credential helper not found at '${this.helperPath}'.
-  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):dr(r)?new Error(`Credential helper '${this.helperPath}' timed out after ${W/1e3}s on '${e}'.
-  The helper may be waiting for authentication to an external vault.`):r}}};function K(n){return n instanceof Error?n.message:String(n)}function lr(n){return n instanceof Error&&"code"in n&&n.code==="ENOENT"}function dr(n){return n instanceof Error&&"killed"in n&&n.killed}var N=fr(mr(),".kanonak","config.json"),B=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=yr(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!S(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=gr();return e.credentialHelper?new h(e.credentialHelper):process.platform==="darwin"?new u:process.platform==="win32"?new m:await D()?new f:new g}};function yr(n){let t="KANONAK_TOKEN_"+a(n).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function gr(){if(!pr(N))return{};try{return JSON.parse(ur(N,"utf-8"))}catch(n){let e=n instanceof Error?n.message:String(n);return console.warn(`  Warning: Failed to parse ${N}: ${e}
-  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as hr,createPrivateKey as kr,generateKeyPairSync as Cr,randomUUID as Sr,sign as Pr}from"crypto";function q(){let{publicKey:n,privateKey:e}=Cr("ec",{namedCurve:"P-256"});return{publicKey:n.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function k(n,e,t,r,o,i){let s={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},c={jti:Sr(),htm:t.toUpperCase(),htu:r,iat:Math.floor(Date.now()/1e3)};return o&&(c.ath=hr("sha256").update(o).digest("base64url")),i&&(c.nonce=i),Rr(s,c,n)}function Y(n){return!n||n.length===0?!1:n.some(e=>e.toUpperCase()==="ES256")}function Rr(n,e,t){let r=J(JSON.stringify(n)),o=J(JSON.stringify(e)),i=`${r}.${o}`,s=kr({key:t,format:"jwk"}),l=Pr("SHA256",Buffer.from(i),{key:s,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${i}.${l}`}function J(n){return Buffer.from(n,"utf-8").toString("base64url")}function X(n){let e=new Map;return async(t,r,o="GET")=>{if(!n)return fetch(t,{method:o});let i=await n.getCredential(r);if(!i?.accessToken)return fetch(t,{method:o});C(i)&&console.warn(`  Warning: Access token for '${r}' is expired. Run 'kanonak login ${r}' to re-authenticate.`);let s={};if(i.dpopKeyPair){let l=e.get(r);try{let d=k(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,l);s.Authorization=`DPoP ${i.accessToken}`,s.DPoP=d}catch(d){let ne=d instanceof Error?d.message:String(d);console.error(`  Error: Failed to create DPoP proof for '${r}': ${ne}
-  The stored key pair may be corrupted. Run 'kanonak login ${r}' to re-authenticate.`),s.Authorization=`Bearer ${i.accessToken}`}}else s.Authorization=`Bearer ${i.accessToken}`;let c=await fetch(t,{method:o,headers:s});if(c.status===401&&i.dpopKeyPair){let l=c.headers.get("DPoP-Nonce");if(l){e.set(r,l);try{let d=k(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,l);s.DPoP=d,c=await fetch(t,{method:o,headers:s})}catch{}}}return c}}import{readFileSync as br,writeFileSync as wr,existsSync as xr}from"fs";import{createHash as $r}from"crypto";import Z from"js-yaml";var Q="kanonak.lock",vr=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function ee(n=Q){if(!xr(n))return null;let e=br(n,"utf-8"),t=Z.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function te(n,e=Q){n.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(n.packages).sort())t[o]=n.packages[o];n.packages=t;let r=Z.dump(n,{lineWidth:-1,sortKeys:!1,quotingType:'"'});wr(e,vr+r,"utf-8")}function re(n){return`sha256:${$r("sha256").update(n).digest("hex")}`}export{Tt as AmbiguousReferenceRule,De as BooleanStatement,Ft as ClassDefinitionRule,St as ClassHierarchyCycleRule,ge as CompositeKanonakDocumentRepository,B as CredentialStore,_t as CtlGraphResolver,jt as CtlKanonakUri,Gt as CtlKanonakUriType,Vt as CtlMarkdownRenderer,At as CtlParser,Ut as CtlValidationErrorType,Mt as CtlValidationSeverity,Ht as CtlValidator,be as DefinedKanonak,vt as DefinitionPropertyReferenceRule,ye as DocumentLocation,Ve as EdgeType,xe as EmbeddedKanonak,gt as EmbeddedKanonakTypeRule,Fe as EmbeddedStatement,fe as FileSystemKanonakDocumentRepository,et as GitIgnoreFilter,Ue as GraphBuilder,Pe as HttpKanonakDocumentRepository,ht as ImportExistenceRule,ue as InMemoryKanonakDocumentRepository,$t as InstancePropertyReferenceRule,Re as Kanonak,rt as KanonakDocumentPositions,Ae as KanonakObjectParser,Ot as KanonakObjectValidator,me as KanonakParser,$e as KanonakUri,ot as KanonakUriBuilder,qe as KanonakVocabulary,Oe as ListStatement,Ee as LiteralKanonak,xt as NamespaceImportCycleRule,ut as NamespacePrefixRule,_e as NodeType,Be as NumberStatement,Xe as OWL_RL_CLASSIFICATION_RULES,Kt as ObjectPropertyImportRule,Bt as ObjectPropertyValueValidationRule,dt as OntologyValidationError,ct as OntologyValidationResult,zt as PathSegmentType,Dt as PropertyDomainRule,Pt as PropertyHierarchyCycleRule,tt as PropertyMetadata,It as PropertyRangeReferenceRule,Rt as PropertyRangeRequiredRule,ft as PropertyTypeSpecificityRule,Lt as PropertyValueTypeRule,Ce as PublisherConfigResolver,Se as PublisherIndex,Ye as RDFS_RULES,Qe as Reasoner,Ze as ReasoningResult,ve as ReferenceKanonak,Le as ReferenceStatement,ke as RepositoryFactory,Wt as ResolvedResourceType,mt as ResourceNamingRule,Ne as ResourceResolver,He as ResourceTypeClassifier,Ie as ScalarStatement,Te as Statement,Ke as StringStatement,bt as SubClassOfReferenceRule,wt as SubPropertyOfReferenceRule,we as SubjectKanonak,yt as SubjectKanonakTypeRequiredRule,Je as TripleStore,Ct as TypeAmbiguityRule,je as TypeResolver,kt as UnresolvedReferenceRule,pt as ValidationContext,lt as ValidationSeverity,_n as VersionOperator,Et as XsdImportRule,oe as compareVersions,re as computeIntegrity,X as createAuthenticatedFetch,k as createDPoPProof,se as createVersion,Nt as findDerivation,st as findInstancesByType,at as formatKanonakAddress,ae as formatVersion,q as generateDPoPKeyPair,he as getGlobalCachePath,S as hasValidToken,le as isCompatibleVersion,C as isExpired,de as isMajorCompatible,ee as loadLockFile,Ge as makeUriKey,a as normalizeHost,it as parseKanonakAddress,ce as parseVersionString,nt as parseWithPositions,pe as pickHighestDocument,te as saveLockFile,Y as serverSupportsDPoP,ze as tripleKey,Me as uriKey,We as uriTriple,ie as versionsEqual};
+  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=a(e);try{await this.runHelper("erase",{publisher:t})}catch(r){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${K(r)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${K(e)}`),[]}}async runHelper(e,t){try{let{stdout:r}=await er(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:W});return r}catch(r){throw tr(r)?new Error(`Credential helper not found at '${this.helperPath}'.
+  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):rr(r)?new Error(`Credential helper '${this.helperPath}' timed out after ${W/1e3}s on '${e}'.
+  The helper may be waiting for authentication to an external vault.`):r}}};function K(n){return n instanceof Error?n.message:String(n)}function tr(n){return n instanceof Error&&"code"in n&&n.code==="ENOENT"}function rr(n){return n instanceof Error&&"killed"in n&&n.killed}var N=ar(ir(),".kanonak","config.json"),B=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=sr(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!C(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=cr();return e.credentialHelper?new h(e.credentialHelper):process.platform==="darwin"?new u:process.platform==="win32"?new m:await D()?new f:new g}};function sr(n){let t="KANONAK_TOKEN_"+a(n).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function cr(){if(!nr(N))return{};try{return JSON.parse(or(N,"utf-8"))}catch(n){let e=n instanceof Error?n.message:String(n);return console.warn(`  Warning: Failed to parse ${N}: ${e}
+  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as lr,createPrivateKey as dr,generateKeyPairSync as pr,randomUUID as ur,sign as mr}from"crypto";function q(){let{publicKey:n,privateKey:e}=pr("ec",{namedCurve:"P-256"});return{publicKey:n.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function k(n,e,t,r,o,i){let s={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},c={jti:ur(),htm:t.toUpperCase(),htu:r,iat:Math.floor(Date.now()/1e3)};return o&&(c.ath=lr("sha256").update(o).digest("base64url")),i&&(c.nonce=i),fr(s,c,n)}function Y(n){return!n||n.length===0?!1:n.some(e=>e.toUpperCase()==="ES256")}function fr(n,e,t){let r=J(JSON.stringify(n)),o=J(JSON.stringify(e)),i=`${r}.${o}`,s=dr({key:t,format:"jwk"}),l=mr("SHA256",Buffer.from(i),{key:s,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${i}.${l}`}function J(n){return Buffer.from(n,"utf-8").toString("base64url")}function X(n){let e=new Map;return async(t,r,o="GET")=>{if(!n)return fetch(t,{method:o});let i=await n.getCredential(r);if(!i?.accessToken)return fetch(t,{method:o});S(i)&&console.warn(`  Warning: Access token for '${r}' is expired. Run 'kanonak login ${r}' to re-authenticate.`);let s={};if(i.dpopKeyPair){let l=e.get(r);try{let d=k(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,l);s.Authorization=`DPoP ${i.accessToken}`,s.DPoP=d}catch(d){let ne=d instanceof Error?d.message:String(d);console.error(`  Error: Failed to create DPoP proof for '${r}': ${ne}
+  The stored key pair may be corrupted. Run 'kanonak login ${r}' to re-authenticate.`),s.Authorization=`Bearer ${i.accessToken}`}}else s.Authorization=`Bearer ${i.accessToken}`;let c=await fetch(t,{method:o,headers:s});if(c.status===401&&i.dpopKeyPair){let l=c.headers.get("DPoP-Nonce");if(l){e.set(r,l);try{let d=k(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,l);s.DPoP=d,c=await fetch(t,{method:o,headers:s})}catch{}}}return c}}import{readFileSync as yr,writeFileSync as gr,existsSync as hr}from"fs";import{createHash as kr}from"crypto";import Z from"js-yaml";var Q="kanonak.lock",Sr=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function ee(n=Q){if(!hr(n))return null;let e=yr(n,"utf-8"),t=Z.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function te(n,e=Q){n.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(n.packages).sort())t[o]=n.packages[o];n.packages=t;let r=Z.dump(n,{lineWidth:-1,sortKeys:!1,quotingType:'"'});gr(e,Sr+r,"utf-8")}function re(n){return`sha256:${kr("sha256").update(n).digest("hex")}`}export{It as AmbiguousReferenceRule,De as BooleanStatement,Ot as ClassDefinitionRule,Pt as ClassHierarchyCycleRule,ge as CompositeKanonakDocumentRepository,B as CredentialStore,Re as DefinedKanonak,Et as DefinitionPropertyReferenceRule,ye as DocumentLocation,Ue as EdgeType,xe as EmbeddedKanonak,ht as EmbeddedKanonakTypeRule,Fe as EmbeddedStatement,fe as FileSystemKanonakDocumentRepository,tt as GitIgnoreFilter,Ve as GraphBuilder,Pe as HttpKanonakDocumentRepository,kt as ImportExistenceRule,ue as InMemoryKanonakDocumentRepository,vt as InstancePropertyReferenceRule,be as Kanonak,nt as KanonakDocumentPositions,He as KanonakObjectParser,jt as KanonakObjectValidator,me as KanonakParser,$e as KanonakUri,it as KanonakUriBuilder,Ye as KanonakVocabulary,Oe as ListStatement,Ee as LiteralKanonak,Nt as MarkdownLinkRule,Ne as MarkdownStatement,$t as NamespaceImportCycleRule,mt as NamespacePrefixRule,Me as NodeType,Be as NumberStatement,Ze as OWL_RL_CLASSIFICATION_RULES,Bt as ObjectPropertyImportRule,Dt as ObjectPropertyValueValidationRule,pt as OntologyValidationError,lt as OntologyValidationResult,Lt as PropertyDomainRule,bt as PropertyHierarchyCycleRule,rt as PropertyMetadata,Kt as PropertyRangeReferenceRule,Rt as PropertyRangeRequiredRule,yt as PropertyTypeSpecificityRule,Ft as PropertyValueTypeRule,Se as PublisherConfigResolver,Ce as PublisherIndex,Xe as RDFS_RULES,et as Reasoner,Qe as ReasoningResult,ve as ReferenceKanonak,Le as ReferenceStatement,ke as RepositoryFactory,ft as ResourceNamingRule,je as ResourceResolver,_e as ResourceTypeClassifier,Ie as ScalarStatement,Te as Statement,Ke as StringStatement,wt as SubClassOfReferenceRule,xt as SubPropertyOfReferenceRule,we as SubjectKanonak,gt as SubjectKanonakTypeRequiredRule,qe as TripleStore,Ct as TypeAmbiguityRule,Ae as TypeResolver,St as UnresolvedReferenceRule,ut as ValidationContext,dt as ValidationSeverity,Dn as VersionOperator,Tt as XsdImportRule,oe as compareVersions,re as computeIntegrity,X as createAuthenticatedFetch,k as createDPoPProof,se as createVersion,At as findDerivation,ct as findInstancesByType,st as formatKanonakAddress,ae as formatVersion,q as generateDPoPKeyPair,he as getGlobalCachePath,C as hasValidToken,le as isCompatibleVersion,S as isExpired,de as isMajorCompatible,ee as loadLockFile,ze as makeUriKey,a as normalizeHost,at as parseKanonakAddress,ce as parseVersionString,ot as parseWithPositions,pe as pickHighestDocument,te as saveLockFile,Y as serverSupportsDPoP,We as tripleKey,Ge as uriKey,Je as uriTriple,ie as versionsEqual};

package/dist/parsing/KanonakObjectParser.d.ts

@@ -31,6 +31,17 @@ export declare class KanonakObjectParser implements IKanonakObjectParser {
     private getPropertyMetadata;
     private parsePropertyValue;
     private parseDatatypeValue;
+    /**
+     * Build a MarkdownStatement for a core-prose datatype value: the raw
+     * string becomes the statement `object`, and every `[[reference]]`
+     * placeholder is resolved through the document's import closure into
+     * a `MarkdownLink`. The captured reference string is handed verbatim
+     * to the resolver — bare, alias-qualified, and local references all
+     * resolve through the same path, with no `.`-splitting here. A
+     * placeholder that does not resolve is still recorded, with `target`
+     * left undefined, so MarkdownLinkRule can report it.
+     */
+    private parseSubstitutableValue;
     private parseObjectValue;
     private parseListValue;
     /**

package/dist/parsing/PropertyMetadata.d.ts

@@ -1,7 +1,16 @@
+import type { KanonakUri } from '../resolution/KanonakUri.js';
 export declare class PropertyMetadata {
     propertyUri: string;
     propertyType: 'DatatypeProperty' | 'ObjectProperty';
     range?: string;
+    /**
+     * The property's `range` resolved to a canonical URI through the
+     * defining document's import closure. Undefined when the property
+     * declares no range, or the range fails to resolve. Lets consumers
+     * detect special datatypes (e.g. core-prose Markdown) by URI identity
+     * rather than by the author's alias spelling.
+     */
+    rangeUri?: KanonakUri;
     isImported: boolean;
     definedInNamespace: string;
 }

package/dist/parsing/extractMarkdownLinks.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Extracts `[[reference]]` placeholders from a core-prose datatype
+ * value (`Markdown` / `SubstitutableString`).
+ *
+ * This module does ONE thing: locate the placeholder spans. It does
+ * no alias interpretation and no resolution — the captured `reference`
+ * string is handed verbatim to the ResourceResolver, which resolves
+ * bare, alias-qualified, and local references uniformly. Splitting the
+ * reference on `.` here would be the exact anti-pattern CLAUDE.md
+ * forbids.
+ */
+/**
+ * A `[[reference]]` placeholder found in a value, before resolution.
+ * `reference` and `displayText` are raw author text.
+ */
+export interface RawMarkdownLink {
+    /** Text inside the brackets before the optional `|` — e.g. `city.seattle`. */
+    reference: string;
+    /** Text after the `|` in `[[ref|display]]`, if present. */
+    displayText?: string;
+    /** Character offset of `[[` within the value string. */
+    startOffset: number;
+    /** Character offset just past `]]` within the value string. */
+    endOffset: number;
+}
+/**
+ * Scan `value` for `[[reference]]` / `[[reference|display]]`
+ * placeholders, skipping any that fall inside fenced or inline code.
+ * Offsets are relative to the start of `value`.
+ */
+export declare function extractMarkdownLinks(value: string): RawMarkdownLink[];

package/dist/parsing/index.js

@@ -1 +1 @@
-import{a as c,b as d,c as e}from"../chunk-7M7XXZOV.js";import{c as b}from"../chunk-CRR4BQKR.js";import"../chunk-W6T7MOKY.js";import{a}from"../chunk-MYITGTGJ.js";import"../chunk-RGMZAKJV.js";import"../chunk-FUUTGGJS.js";export{d as KanonakDocumentPositions,b as KanonakObjectParser,a as KanonakParser,c as PropertyMetadata,e as parseWithPositions};
+import{a as c,b as d,c as e}from"../chunk-CQLO62JP.js";import{d as b}from"../chunk-Z72IKY6C.js";import"../chunk-W6T7MOKY.js";import{a}from"../chunk-MYITGTGJ.js";import"../chunk-IXE5THUW.js";import"../chunk-FUUTGGJS.js";export{d as KanonakDocumentPositions,b as KanonakObjectParser,a as KanonakParser,c as PropertyMetadata,e as parseWithPositions};

package/dist/reasoning/index.js

@@ -1 +1 @@
-import{a,b,c,d,e,f,g,h,i,j}from"../chunk-YENGFI2R.js";import"../chunk-CRR4BQKR.js";import"../chunk-W6T7MOKY.js";import"../chunk-MYITGTGJ.js";import"../chunk-RGMZAKJV.js";import"../chunk-FUUTGGJS.js";export{f as KanonakVocabulary,h as OWL_RL_CLASSIFICATION_RULES,g as RDFS_RULES,j as Reasoner,i as ReasoningResult,e as TripleStore,b as makeUriKey,c as tripleKey,a as uriKey,d as uriTriple};
+import{a,b,c,d,e,f,g,h,i,j}from"../chunk-2SSUPRX3.js";import"../chunk-Z72IKY6C.js";import"../chunk-W6T7MOKY.js";import"../chunk-MYITGTGJ.js";import"../chunk-IXE5THUW.js";import"../chunk-FUUTGGJS.js";export{f as KanonakVocabulary,h as OWL_RL_CLASSIFICATION_RULES,g as RDFS_RULES,j as Reasoner,i as ReasoningResult,e as TripleStore,b as makeUriKey,c as tripleKey,a as uriKey,d as uriTriple};

package/dist/resolution/TypeResolver.d.ts

@@ -7,6 +7,18 @@ export declare class TypeResolver {
     constructor(resourceResolver: ResourceResolver);
     isXsdDatatype(uri: KanonakUri | null | undefined): boolean;
     isLiteralType(uri: KanonakUri | null | undefined): boolean;
+    /**
+     * True when `uri` is `kanonak.org/core-prose/Markdown` — the datatype
+     * for CommonMark text that may embed `[[reference]]` placeholders.
+     */
+    isMarkdownDatatype(uri: KanonakUri | null | undefined): boolean;
+    /**
+     * True when `uri` is any core-prose substitutable-string datatype —
+     * `SubstitutableString` or its `Markdown` subtype. Both carry
+     * `[[reference]]` placeholders the SDK extracts and resolves; they
+     * differ only in how derivations render the surrounding text.
+     */
+    isSubstitutableDatatype(uri: KanonakUri | null | undefined): boolean;
     isKnownXsdDatatypeName(typeName: string): boolean;
     isClassTypeAsync(typeName: string, currentDocument: KanonakDocument): Promise<boolean>;
     getPropertyTypeClassification(propertyType: string | null | undefined): string;

package/dist/resolution/index.d.ts

@@ -6,6 +6,7 @@ export { parseKanonakAddress, formatKanonakAddress, } from './KanonakAddress.js'
 export type { KanonakAddress } from './KanonakAddress.js';
 export type { ResourceResolutionResult } from './ResourceResolutionResult.js';
 export { TypeResolver } from './TypeResolver.js';
+export { ResourceTypeClassifier } from './ResourceTypeClassifier.js';
 export { findInstancesByType } from './InstanceSearch.js';
 export type { InstanceSearchResult } from './InstanceSearch.js';
 export { compareVersions, versionsEqual, formatVersion, parseVersionString, createVersion, isCompatibleVersion, isMajorCompatible, pickHighestDocument, } from './VersionUtils.js';

package/dist/resolution/index.js

@@ -1 +1 @@
-import{a as l,b as m,c as n,d as o}from"../chunk-QJ66UBDY.js";import{a,b,c,d,e,f,g,h}from"../chunk-FQHALFRR.js";import{b as j,c as k}from"../chunk-RGMZAKJV.js";import{a as i}from"../chunk-FUUTGGJS.js";export{i as KanonakUri,l as KanonakUriBuilder,j as ResourceResolver,k as TypeResolver,a as compareVersions,d as createVersion,o as findInstancesByType,n as formatKanonakAddress,c as formatVersion,f as isCompatibleVersion,g as isMajorCompatible,m as parseKanonakAddress,e as parseVersionString,h as pickHighestDocument,b as versionsEqual};
+import{a as l,b as m,c as n,d as o,e as p}from"../chunk-VRZUCZEF.js";import{a,b,c,d,e,f,g,h}from"../chunk-FQHALFRR.js";import{b as j,c as k}from"../chunk-IXE5THUW.js";import{a as i}from"../chunk-FUUTGGJS.js";export{i as KanonakUri,m as KanonakUriBuilder,j as ResourceResolver,l as ResourceTypeClassifier,k as TypeResolver,a as compareVersions,d as createVersion,p as findInstancesByType,o as formatKanonakAddress,c as formatVersion,f as isCompatibleVersion,g as isMajorCompatible,n as parseKanonakAddress,e as parseVersionString,h as pickHighestDocument,b as versionsEqual};

package/dist/statements/MarkdownStatement.d.ts

@@ -0,0 +1,38 @@
+import { StringStatement } from './StringStatement.js';
+import type { ReferenceKanonak } from '../kanonaks/ReferenceKanonak.js';
+/**
+ * A single `[[reference]]` placeholder discovered in a core-prose
+ * datatype value, with its raw spelling, optional display label,
+ * resolved target, and character span within the value string.
+ */
+export interface MarkdownLink {
+    /** Raw reference text inside the brackets, before any `|` — e.g. `city.seattle`. */
+    reference: string;
+    /** Display label — the text after `|` in `[[ref|label]]`, if the author gave one. */
+    displayText?: string;
+    /**
+     * The resolved target. Undefined when `reference` does not resolve
+     * through the document's import closure; `MarkdownLinkRule` reports
+     * those as validation errors.
+     */
+    target?: ReferenceKanonak;
+    /** Character offset of `[[` within the value string. */
+    startOffset: number;
+    /** Character offset just past `]]` within the value string. */
+    endOffset: number;
+}
+/**
+ * The statement produced for a property whose range is a core-prose
+ * datatype — `kanonak.org/core-prose/Markdown` or its
+ * `SubstitutableString` supertype.
+ *
+ * The literal value is carried as the ordinary `StringStatement`
+ * `object`, so consumers that only want the text treat it like any
+ * other string statement. `links` additionally exposes every
+ * `[[reference]]` placeholder found in the value, each resolved to a
+ * `ReferenceKanonak` through the document's import closure.
+ * Placeholders inside fenced or inline code are not included.
+ */
+export declare class MarkdownStatement extends StringStatement {
+    links: MarkdownLink[];
+}

package/dist/statements/index.d.ts

@@ -7,3 +7,5 @@ export { BooleanStatement } from './BooleanStatement.js';
 export { ReferenceStatement } from './ReferenceStatement.js';
 export { EmbeddedStatement } from './EmbeddedStatement.js';
 export { ListStatement } from './ListStatement.js';
+export { MarkdownStatement } from './MarkdownStatement.js';
+export type { MarkdownLink } from './MarkdownStatement.js';