@kanonak-protocol/sdk 3.22.0 → 3.24.0

package/dist/index.d.ts

@@ -8,13 +8,13 @@ export { GitIgnoreFilter } from './filtering/index.js';
 export type { IGitIgnoreFilter } from './filtering/index.js';
 export { KanonakParser, KanonakObjectParser, PropertyMetadata, KanonakDocumentPositions, parseWithPositions, findMarkdownLinkAt, } from './parsing/index.js';
 export type { IKanonakObjectParser, SourcePosition, ImportPackageEntry, ParsedDocumentWithPositions, } from './parsing/index.js';
-export { ResourceResolver, KanonakUri, KanonakUriBuilder, parseKanonakAddress, formatKanonakAddress, TypeResolver, ResourceTypeClassifier, findInstancesByType, compareVersions, versionsEqual, formatVersion, parseVersionString, createVersion, isCompatibleVersion, isMajorCompatible, pickHighestDocument, } from './resolution/index.js';
-export type { ResourceResolutionResult, ILogger, InstanceSearchResult, DocumentVersionPick, KanonakAddress, } from './resolution/index.js';
+export { ResourceResolver, KanonakUri, KanonakUriBuilder, parseKanonakAddress, formatKanonakAddress, KanonakUrlResolver, TypeResolver, ResourceTypeClassifier, findInstancesByType, compareVersions, versionsEqual, formatVersion, parseVersionString, createVersion, isCompatibleVersion, isMajorCompatible, pickHighestDocument, } from './resolution/index.js';
+export type { ResourceResolutionResult, ILogger, InstanceSearchResult, DocumentVersionPick, KanonakAddress, UrlAddress, PublisherUrlAddress, PackageUrlAddress, ResourceUrlAddress, VersionSpec, UrlForm, } from './resolution/index.js';
 export { Kanonak, DefinedKanonak, SubjectKanonak, EmbeddedKanonak, ReferenceKanonak, LiteralKanonak } from './kanonaks/index.js';
 export type { IStatement } from './statements/index.js';
 export type { MarkdownLink } from './statements/index.js';
 export { Statement, ScalarStatement, StringStatement, NumberStatement, BooleanStatement, ReferenceStatement, EmbeddedStatement, ListStatement, MarkdownStatement } from './statements/index.js';
-export { OntologyValidationResult, OntologyValidationError, ValidationSeverity, ValidationContext, KanonakObjectValidator, NamespacePrefixRule, ResourceNamingRule, PropertyTypeSpecificityRule, SubjectKanonakTypeRequiredRule, EmbeddedKanonakTypeRule, ImportExistenceRule, UnresolvedReferenceRule, TypeAmbiguityRule, ClassHierarchyCycleRule, PropertyHierarchyCycleRule, PropertyRangeRequiredRule, SubClassOfReferenceRule, SubPropertyOfReferenceRule, NamespaceImportCycleRule, InstancePropertyReferenceRule, DefinitionPropertyReferenceRule, XsdImportRule, AmbiguousReferenceRule, PropertyRangeReferenceRule, ObjectPropertyImportRule, ObjectPropertyValueValidationRule, PropertyDomainRule, PropertyValueTypeRule, ClassDefinitionRule, MarkdownLinkRule } from './validation/index.js';
+export { OntologyValidationResult, OntologyValidationError, ValidationSeverity, ValidationContext, ValidationCache, KanonakObjectValidator, NamespacePrefixRule, ResourceNamingRule, PropertyTypeSpecificityRule, SubjectKanonakTypeRequiredRule, EmbeddedKanonakTypeRule, ImportExistenceRule, UnresolvedReferenceRule, TypeAmbiguityRule, ClassHierarchyCycleRule, PropertyHierarchyCycleRule, PropertyRangeRequiredRule, SubClassOfReferenceRule, SubPropertyOfReferenceRule, NamespaceImportCycleRule, InstancePropertyReferenceRule, DefinitionPropertyReferenceRule, XsdImportRule, AmbiguousReferenceRule, PropertyRangeReferenceRule, ObjectPropertyImportRule, ObjectPropertyValueValidationRule, PropertyDomainRule, PropertyValueTypeRule, ClassDefinitionRule, MarkdownLinkRule } from './validation/index.js';
 export type { IKanonakObjectValidator, IDocumentValidationRule, IRepositoryValidationRule } from './validation/index.js';
 export type { IKanonakDocumentRepository } from '@kanonak-protocol/types/document/models';
 export type { IKanonakParser } from '@kanonak-protocol/types/document/parsing';
@@ -26,4 +26,6 @@ export { loadLockFile, saveLockFile, computeIntegrity, } from './lock/index.js';
 export type { LockFile, LockEntry } from './lock/index.js';
 export { findDerivation } from './derivation/index.js';
 export type { DerivationEntityUri, TransformationReferenceTuple, DerivationLookupResult, } from './derivation/index.js';
+export { LookRenderer } from './look/index.js';
+export type { ResolvedLook } from './look/index.js';
 export { canonicalForm, canonicalHash } from './canonical/index.js';

package/dist/index.js

@@ -1,11 +1,11 @@
-import{a as Ze,b as Qe,c as et,d as tt,e as rt,f as nt,g as ot,h as at,i as it,j as st}from"./chunk-NYXIGTTH.js";import{a as qe,b as Ye,c as Xe,d as b,e as S,f as i}from"./chunk-GD4SYMXW.js";import{a as Wt}from"./chunk-ROCCA4BY.js";import{a as Te,b as je,c as Le,d as Ne,e as Fe}from"./chunk-3JRHG2JH.js";import{a as Be,b as De,c as Oe,d as Ae}from"./chunk-CNM3SY5S.js";import{a as lt,b as dt,c as ut,d as pt}from"./chunk-63NJ25ZX.js";import{a as Je,b as mt,c as ft,d as yt,e as gt}from"./chunk-VRZUCZEF.js";import{a as Pe,b as Re,c as we,d as $e,e as xe,f as ve,g as Ee,h as Ke}from"./chunk-FQHALFRR.js";import{A as _t,B as Mt,C as zt,D as Gt,a as ht,b as kt,c as bt,d as St,e as Ct,f as Pt,g as Rt,h as wt,i as $t,j as xt,k as vt,l as Et,m as Kt,n as Bt,o as It,p as Tt,q as jt,r as Lt,s as Nt,t as Ft,u as Dt,v as Ot,w as At,x as Ht,y as Vt,z as Ut}from"./chunk-3JV5IPKZ.js";import"./chunk-FJ35VIV6.js";import{a as N,b as D,c as Me,e as We}from"./chunk-R2V7IXWN.js";import{a as He,b as j,c as L,d as F,e as Ue,f as _e,g as O,h as A,i as H,j as V,k as U,l as _}from"./chunk-W6T7MOKY.js";import{a as Ie}from"./chunk-MYITGTGJ.js";import{b as ze,c as Ge}from"./chunk-IXE5THUW.js";import{a as Ve}from"./chunk-FUUTGGJS.js";import{a as ct}from"./chunk-ODIECDN7.js";import{VersionOperator as to}from"@kanonak-protocol/types/document/models/enums";import{existsSync as ur,readFileSync as pr}from"fs";import{homedir as mr}from"os";import{join as fr}from"path";import{execFile as Jt}from"child_process";import{promisify as qt}from"util";var C=qt(Jt),P="kanonak",R="/usr/bin/security",p=class{async get(e){let r=i(e);try{let{stdout:n}=await C(R,["find-generic-password","-s",P,"-a",r,"-w"],{timeout:1e4});try{return JSON.parse(n.trim())}catch{throw new Error(`Stored credential for '${r}' is corrupted (not valid JSON).
+import{a as Ze,b as Qe,c as et,d as tt,e as rt,f as nt,g as ot,h as at,i as it,j as st}from"./chunk-NYXIGTTH.js";import{a as Yt}from"./chunk-7U6IOH7G.js";import{a as qe,b as Ye,c as Xe,d as b,e as S,f as i}from"./chunk-VLBP5CHO.js";import{a as qt}from"./chunk-ROCCA4BY.js";import{a as Te,b as je,c as Le,d as Fe,e as Ne}from"./chunk-AZSZXLEH.js";import{a as Be,b as De,c as Oe,d as Ae}from"./chunk-AV4AVTI6.js";import{a as lt,b as dt,c as ut,d as pt}from"./chunk-63NJ25ZX.js";import{a as Je,b as mt,c as ft,d as yt,e as ht}from"./chunk-4TJZIM7A.js";import{a as gt}from"./chunk-NIGFQYVA.js";import{A as Mt,B as zt,C as Gt,D as Wt,E as Jt,a as kt,b as bt,c as St,d as Ct,e as Pt,f as Rt,g as wt,h as xt,i as $t,j as vt,k as Et,l as Kt,m as Bt,n as It,o as Tt,p as jt,q as Lt,r as Ft,s as Nt,t as Dt,u as Ot,v as At,w as Ut,x as Vt,y as Ht,z as _t}from"./chunk-PB2RWBJN.js";import"./chunk-FJ35VIV6.js";import{a as F,b as D,c as Me,e as We}from"./chunk-R2V7IXWN.js";import{a as Ue,b as j,c as L,d as N,e as He,f as _e,g as O,h as A,i as U,j as V,k as H,l as _}from"./chunk-W6T7MOKY.js";import{a as Ie}from"./chunk-MYITGTGJ.js";import{a as Pe,b as Re,c as we,d as xe,e as $e,f as ve,g as Ee,h as Ke}from"./chunk-FQHALFRR.js";import{b as ze,c as Ge}from"./chunk-IXE5THUW.js";import{a as Ve}from"./chunk-FUUTGGJS.js";import{a as ct}from"./chunk-ODIECDN7.js";import{VersionOperator as oo}from"@kanonak-protocol/types/document/models/enums";import{existsSync as fr,readFileSync as yr}from"fs";import{homedir as gr}from"os";import{join as hr}from"path";import{execFile as Xt}from"child_process";import{promisify as Zt}from"util";var C=Zt(Xt),P="kanonak",R="/usr/bin/security",p=class{async get(e){let r=i(e);try{let{stdout:n}=await C(R,["find-generic-password","-s",P,"-a",r,"-w"],{timeout:1e4});try{return JSON.parse(n.trim())}catch{throw new Error(`Stored credential for '${r}' is corrupted (not valid JSON).
   Run 'kanonak logout ${r}' then 'kanonak login ${r}' to fix.`)}}catch(n){if(X(n,44))return null;throw new Error(`macOS Keychain read failed for '${r}': ${w(n)}
   The Keychain may be locked or inaccessible.
   Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,r){let n=i(e),o=JSON.stringify(r);try{await C(R,["add-generic-password","-s",P,"-a",n,"-U","-w",o],{timeout:1e4})}catch(a){throw new Error(`macOS Keychain write failed for '${n}': ${w(a)}
   Ensure the Keychain is unlocked and the CLI has write permission.
   On managed devices, your IT policy may block credential storage.`)}}async remove(e){let r=i(e);try{await C(R,["delete-generic-password","-s",P,"-a",r],{timeout:1e4})}catch(n){if(X(n,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${r}': ${w(n)}
   The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await C(R,["dump-keychain"],{timeout:1e4}),r=[],n=!1;for(let o of e.split(`
-`))if(o.includes(`"svce"<blob>="${P}"`)&&(n=!0),n&&o.includes('"acct"<blob>=')){let a=o.match(/"acct"<blob>="([^"]+)"/);a&&r.push(a[1]),n=!1}return r}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${w(e)}`),[]}}};function X(t,e){return typeof t=="object"&&t!==null&&"code"in t&&t.code===e}function w(t){return t instanceof Error?t.message:String(t)}import{execFile as Yt}from"child_process";import{promisify as Xt}from"util";var Zt=Xt(Yt),$="kanonak:",m=class{async get(e){let r=$+i(e),n=`
+`))if(o.includes(`"svce"<blob>="${P}"`)&&(n=!0),n&&o.includes('"acct"<blob>=')){let a=o.match(/"acct"<blob>="([^"]+)"/);a&&r.push(a[1]),n=!1}return r}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${w(e)}`),[]}}};function X(t,e){return typeof t=="object"&&t!==null&&"code"in t&&t.code===e}function w(t){return t instanceof Error?t.message:String(t)}import{execFile as Qt}from"child_process";import{promisify as er}from"util";var tr=er(Qt),x="kanonak:",m=class{async get(e){let r=x+i(e),n=`
 ${v}
 $target = [Console]::In.ReadLine()
 $ptr = [IntPtr]::Zero
@@ -18,7 +18,7 @@ try {
   [System.Text.Encoding]::Unicode.GetString($bytes)
 } finally {
   [CredMan]::CredFree($ptr)
-}`;try{let{stdout:o}=await x(n,r),a=o.trim();return a?JSON.parse(a):null}catch{return null}}async store(e,r){let n=$+i(e),o=JSON.stringify(r),a=`
+}`;try{let{stdout:o}=await $(n,r),a=o.trim();return a?JSON.parse(a):null}catch{return null}}async store(e,r){let n=x+i(e),o=JSON.stringify(r),a=`
 ${v}
 $target = [Console]::In.ReadLine()
 $json = [Console]::In.ReadLine()
@@ -35,13 +35,13 @@ try {
   if (-not $result) { throw "CredWrite failed" }
 } finally {
   [System.Runtime.InteropServices.Marshal]::FreeHGlobal($cred.CredentialBlob)
-}`;try{await x(a,`${n}
-${o}`)}catch(s){throw new Error(`Windows Credential Manager write failed: ${String(s)}`)}}async remove(e){let r=$+i(e),n=`
+}`;try{await $(a,`${n}
+${o}`)}catch(s){throw new Error(`Windows Credential Manager write failed: ${String(s)}`)}}async remove(e){let r=x+i(e),n=`
 ${v}
 $target = [Console]::In.ReadLine()
-[CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await x(n,r)}catch{}}async list(){let e=`
+[CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await $(n,r)}catch{}}async list(){let e=`
 ${v}
-${Qt}
+${rr}
 $prefix = [Console]::In.ReadLine()
 $count = 0
 $pCreds = [IntPtr]::Zero
@@ -55,8 +55,8 @@ if ([CredMan]::CredEnumerate($null, 0, [ref]$count, [ref]$pCreds)) {
     }
   }
   [CredMan]::CredFree($pCreds)
-}`;try{let{stdout:r}=await x(e,$);return r.trim().split(`
-`).map(n=>n.trim()).filter(Boolean)}catch{return[]}}};async function x(t,e){for(let r of["pwsh","powershell"])try{return await Zt(r,["-NoProfile","-NonInteractive","-Command",t],{timeout:15e3,...e!==void 0&&{input:e}})}catch(n){if(r==="powershell")throw n}throw new Error("Neither pwsh nor powershell found")}var v=`
+}`;try{let{stdout:r}=await $(e,x);return r.trim().split(`
+`).map(n=>n.trim()).filter(Boolean)}catch{return[]}}};async function $(t,e){for(let r of["pwsh","powershell"])try{return await tr(r,["-NoProfile","-NonInteractive","-Command",t],{timeout:15e3,...e!==void 0&&{input:e}})}catch(n){if(r==="powershell")throw n}throw new Error("Neither pwsh nor powershell found")}var v=`
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -87,13 +87,13 @@ public class CredMan {
   [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
   public static extern bool CredEnumerate(string filter, int flags, out int count, out IntPtr credentials);
 }
-"@`,Qt="";import{execFile as er,spawn as tr}from"child_process";import{promisify as rr}from"util";var K=rr(er),E="kanonak",f=class{async get(e){let r=i(e);try{let{stdout:n}=await K("secret-tool",["lookup","service",E,"publisher",r],{timeout:1e4}),o=n.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,r){let n=i(e),o=JSON.stringify(r);await new Promise((a,s)=>{let c=tr("secret-tool",["store","--label",`Kanonak: ${n}`,"service",E,"publisher",n],{stdio:["pipe","ignore","ignore"],timeout:1e4});c.stdin.write(o),c.stdin.end(),c.on("close",l=>{l===0?a():s(new Error(`secret-tool store exited with code ${l}`))}),c.on("error",s)})}async remove(e){let r=i(e);try{await K("secret-tool",["clear","service",E,"publisher",r],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await K("secret-tool",["search","service",E],{timeout:1e4}),r=[];for(let n of e.split(`
-`)){let o=n.match(/attribute\.publisher\s*=\s*(.+)/);o&&r.push(o[1].trim())}return r}catch{return[]}}};async function M(){try{return await K("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as Z,mkdirSync as Q,readFileSync as ee,writeFileSync as te}from"fs";import{createCipheriv as nr,createDecipheriv as or,randomBytes as re}from"crypto";import{homedir as ar}from"os";import{join as W,dirname as ne}from"path";var ae=W(ar(),".config","kanonak"),y=W(ae,"keyring.key"),B=W(ae,"credentials.enc"),oe="aes-256-gcm",z=32,u=12,G=16,g=class{async get(e){let r=this.loadStore(),n=i(e);return r[n]??null}async store(e,r){let n=this.loadStore(),o=i(e);n[o]=r,this.saveStore(n)}async remove(e){let r=this.loadStore(),n=i(e);delete r[n],this.saveStore(r)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!Z(B))return{};try{let e=this.getOrCreateKey(),r=ee(B);if(r.length<u+G)return{};let n=r.subarray(0,u),o=r.subarray(u,u+G),a=r.subarray(u+G),s=or(oe,e,n);s.setAuthTag(o);let c=Buffer.concat([s.update(a),s.final()]);return JSON.parse(c.toString("utf-8"))}catch{return{}}}saveStore(e){let r=this.getOrCreateKey(),n=re(u),o=nr(oe,r,n),a=Buffer.from(JSON.stringify(e),"utf-8"),s=Buffer.concat([o.update(a),o.final()]),c=o.getAuthTag(),l=Buffer.concat([n,c,s]);Q(ne(B),{recursive:!0}),te(B,l,{mode:384})}getOrCreateKey(){if(Z(y)){let r=ee(y);if(r.length!==z)throw new Error(`Credential keyring key is corrupted (expected ${z} bytes, got ${r.length}). Delete ${y} and re-authenticate.`);return r}let e=re(z);return Q(ne(y),{recursive:!0}),te(y,e,{mode:384}),e}};import{execFile as ir}from"child_process";import{promisify as sr}from"util";var cr=sr(ir),ie=3e4,h=class{constructor(e){this.helperPath=e}helperPath;async get(e){let r=i(e);try{let o=(await this.runHelper("get",{publisher:r})).trim();return o?JSON.parse(o):null}catch(n){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${r}': ${I(n)}
+"@`,rr="";import{execFile as nr,spawn as or}from"child_process";import{promisify as ar}from"util";var K=ar(nr),E="kanonak",f=class{async get(e){let r=i(e);try{let{stdout:n}=await K("secret-tool",["lookup","service",E,"publisher",r],{timeout:1e4}),o=n.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,r){let n=i(e),o=JSON.stringify(r);await new Promise((a,s)=>{let c=or("secret-tool",["store","--label",`Kanonak: ${n}`,"service",E,"publisher",n],{stdio:["pipe","ignore","ignore"],timeout:1e4});c.stdin.write(o),c.stdin.end(),c.on("close",l=>{l===0?a():s(new Error(`secret-tool store exited with code ${l}`))}),c.on("error",s)})}async remove(e){let r=i(e);try{await K("secret-tool",["clear","service",E,"publisher",r],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await K("secret-tool",["search","service",E],{timeout:1e4}),r=[];for(let n of e.split(`
+`)){let o=n.match(/attribute\.publisher\s*=\s*(.+)/);o&&r.push(o[1].trim())}return r}catch{return[]}}};async function M(){try{return await K("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as Z,mkdirSync as Q,readFileSync as ee,writeFileSync as te}from"fs";import{createCipheriv as ir,createDecipheriv as sr,randomBytes as re}from"crypto";import{homedir as cr}from"os";import{join as W,dirname as ne}from"path";var ae=W(cr(),".config","kanonak"),y=W(ae,"keyring.key"),B=W(ae,"credentials.enc"),oe="aes-256-gcm",z=32,u=12,G=16,g=class{async get(e){let r=this.loadStore(),n=i(e);return r[n]??null}async store(e,r){let n=this.loadStore(),o=i(e);n[o]=r,this.saveStore(n)}async remove(e){let r=this.loadStore(),n=i(e);delete r[n],this.saveStore(r)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!Z(B))return{};try{let e=this.getOrCreateKey(),r=ee(B);if(r.length<u+G)return{};let n=r.subarray(0,u),o=r.subarray(u,u+G),a=r.subarray(u+G),s=sr(oe,e,n);s.setAuthTag(o);let c=Buffer.concat([s.update(a),s.final()]);return JSON.parse(c.toString("utf-8"))}catch{return{}}}saveStore(e){let r=this.getOrCreateKey(),n=re(u),o=ir(oe,r,n),a=Buffer.from(JSON.stringify(e),"utf-8"),s=Buffer.concat([o.update(a),o.final()]),c=o.getAuthTag(),l=Buffer.concat([n,c,s]);Q(ne(B),{recursive:!0}),te(B,l,{mode:384})}getOrCreateKey(){if(Z(y)){let r=ee(y);if(r.length!==z)throw new Error(`Credential keyring key is corrupted (expected ${z} bytes, got ${r.length}). Delete ${y} and re-authenticate.`);return r}let e=re(z);return Q(ne(y),{recursive:!0}),te(y,e,{mode:384}),e}};import{execFile as lr}from"child_process";import{promisify as dr}from"util";var ur=dr(lr),ie=3e4,h=class{constructor(e){this.helperPath=e}helperPath;async get(e){let r=i(e);try{let o=(await this.runHelper("get",{publisher:r})).trim();return o?JSON.parse(o):null}catch(n){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${r}': ${I(n)}
   Verify the helper binary exists, is executable, and implements the Kanonak credential helper protocol.
   Check the 'credentialHelper' path in ~/.kanonak/config.json.`)}}async store(e,r){let n=i(e);try{await this.runHelper("store",{publisher:n,credential:r})}catch(o){throw new Error(`Credential helper '${this.helperPath}' failed to store credential for '${n}': ${I(o)}
-  Verify the helper binary supports the 'store' action.`)}}async remove(e){let r=i(e);try{await this.runHelper("erase",{publisher:r})}catch(n){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${r}': ${I(n)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${I(e)}`),[]}}async runHelper(e,r){try{let{stdout:n}=await cr(this.helperPath,[e],{...r&&{input:JSON.stringify(r)},timeout:ie});return n}catch(n){throw lr(n)?new Error(`Credential helper not found at '${this.helperPath}'.
-  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):dr(n)?new Error(`Credential helper '${this.helperPath}' timed out after ${ie/1e3}s on '${e}'.
-  The helper may be waiting for authentication to an external vault.`):n}}};function I(t){return t instanceof Error?t.message:String(t)}function lr(t){return t instanceof Error&&"code"in t&&t.code==="ENOENT"}function dr(t){return t instanceof Error&&"killed"in t&&t.killed}var J=fr(mr(),".kanonak","config.json"),T=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let r=yr(e);if(r)return r;let o=await(await this.getBackend()).get(e);return!o||!S(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,r){return(await this.getBackend()).store(e,r)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=gr();return e.credentialHelper?new h(e.credentialHelper):process.platform==="darwin"?new p:process.platform==="win32"?new m:await M()?new f:new g}};function yr(t){let r="KANONAK_TOKEN_"+i(t).replace(/[.\-]/g,"_").toUpperCase();return process.env[r]??null}function gr(){if(!ur(J))return{};try{return JSON.parse(pr(J,"utf-8"))}catch(t){let e=t instanceof Error?t.message:String(t);return console.warn(`  Warning: Failed to parse ${J}: ${e}
-  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as hr,createPrivateKey as kr,generateKeyPairSync as br,randomUUID as Sr,sign as Cr}from"crypto";function ce(){let{publicKey:t,privateKey:e}=br("ec",{namedCurve:"P-256"});return{publicKey:t.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function k(t,e,r,n,o,a){let s={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},c={jti:Sr(),htm:r.toUpperCase(),htu:n,iat:Math.floor(Date.now()/1e3)};return o&&(c.ath=hr("sha256").update(o).digest("base64url")),a&&(c.nonce=a),Pr(s,c,t)}function le(t){return!t||t.length===0?!1:t.some(e=>e.toUpperCase()==="ES256")}function Pr(t,e,r){let n=se(JSON.stringify(t)),o=se(JSON.stringify(e)),a=`${n}.${o}`,s=kr({key:r,format:"jwk"}),l=Cr("SHA256",Buffer.from(a),{key:s,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${a}.${l}`}function se(t){return Buffer.from(t,"utf-8").toString("base64url")}function de(t){let e=new Map;return async(r,n,o="GET")=>{if(!t)return fetch(r,{method:o});let a=await t.getCredential(n);if(!a?.accessToken)return fetch(r,{method:o});b(a)&&console.warn(`  Warning: Access token for '${n}' is expired. Run 'kanonak login ${n}' to re-authenticate.`);let s={};if(a.dpopKeyPair){let l=e.get(n);try{let d=k(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,r,a.accessToken,l);s.Authorization=`DPoP ${a.accessToken}`,s.DPoP=d}catch(d){let Ce=d instanceof Error?d.message:String(d);console.error(`  Error: Failed to create DPoP proof for '${n}': ${Ce}
-  The stored key pair may be corrupted. Run 'kanonak login ${n}' to re-authenticate.`),s.Authorization=`Bearer ${a.accessToken}`}}else s.Authorization=`Bearer ${a.accessToken}`;let c=await fetch(r,{method:o,headers:s});if(c.status===401&&a.dpopKeyPair){let l=c.headers.get("DPoP-Nonce");if(l){e.set(n,l);try{let d=k(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,r,a.accessToken,l);s.DPoP=d,c=await fetch(r,{method:o,headers:s})}catch{}}}return c}}import{readFileSync as Rr,writeFileSync as wr,existsSync as $r}from"fs";import{createHash as xr}from"crypto";import ue from"js-yaml";var pe="kanonak.lock",vr=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function me(t=pe){if(!$r(t))return null;let e=Rr(t,"utf-8"),r=ue.load(e);return!r||typeof r!="object"||r.version!=="1"?null:{version:"1",lastUpdated:r.lastUpdated??new Date().toISOString(),packages:r.packages??{}}}function fe(t,e=pe){t.lastUpdated=new Date().toISOString();let r={};for(let o of Object.keys(t.packages).sort())r[o]=t.packages[o];t.packages=r;let n=ue.dump(t,{lineWidth:-1,sortKeys:!1,quotingType:'"'});wr(e,vr+n,"utf-8")}function ye(t){return`sha256:${xr("sha256").update(t).digest("hex")}`}import{createHash as Er}from"crypto";function q(t){let e=[];for(let n of t)n instanceof L&&e.push(Kr(n));return e.sort((n,o)=>n.uri<o.uri?-1:n.uri>o.uri?1:0),JSON.stringify({subjects:e})}function ge(t){let e=q(t);return`sha256:${Er("sha256").update(e,"utf8").digest("hex")}`}function Kr(t){let e=Nr(t),r=Y(t.statement);return{uri:e,statements:r}}function Y(t){let e=[];for(let r of t){let n=Br(r);n&&e.push(n)}return e.sort((r,n)=>r.predicate<n.predicate?-1:r.predicate>n.predicate?1:0),e}function Br(t){let e=Lr(t);if(!e)return;let r=Ir(t);if(r)return jr(e,r)}function Ir(t){if(t instanceof O)return{type:"string",value:t.object};if(t instanceof A)return{type:"number",value:Se(t.object)};if(t instanceof H)return{type:"boolean",value:t.object};if(t instanceof V)return{type:"ref",value:ke(t.object)};if(t instanceof U){let e=t.object;return he(e)}if(t instanceof _)return{type:"list",items:t.object.map(Tr)}}function he(t){let e=Y(t.statement);return t.name&&t.name.length>0?{type:"embedded",name:t.name,statements:e}:{type:"embedded",statements:e}}function Tr(t){if(t instanceof F)return{type:"ref",value:ke(t)};if(t instanceof N)return he(t);if(t instanceof D){let e=t.value;if(typeof e=="string")return{type:"string",value:e};if(typeof e=="number")return{type:"number",value:Se(e)};if(typeof e=="boolean")return{type:"boolean",value:e}}if(t instanceof j)return{type:"embedded",statements:Y(t.statement)};throw new Error(`canonicalForm: list item of unrecognized kind (${t.constructor?.name??typeof t}); add canonicalization support before hashing data that contains it`)}function jr(t,e){switch(e.type){case"string":return{predicate:t,type:"string",value:e.value};case"number":return{predicate:t,type:"number",value:e.value};case"boolean":return{predicate:t,type:"boolean",value:e.value};case"ref":return{predicate:t,type:"ref",value:e.value};case"embedded":return e.name!==void 0?{predicate:t,type:"embedded",name:e.name,statements:e.statements}:{predicate:t,type:"embedded",statements:e.statements};case"list":return{predicate:t,type:"list",items:e.items}}}function Lr(t){let e=t.predicate;if(e)return be(e.subject)}function Nr(t){let e=t.namespace??"",r=t.name??"";return`${e}/${r}`}function ke(t){return be(t.subject)}function be(t){let e=t.version;return e&&typeof e.major=="number"?`${t.publisher}/${t.package_}@${e.major}.${e.minor}.${e.patch}/${t.name}`:`${t.publisher}/${t.package_}/${t.name}`}function Se(t){if(Number.isNaN(t))throw new Error("canonicalForm: NaN cannot be canonicalized");if(!Number.isFinite(t))throw new Error("canonicalForm: \xB1Infinity cannot be canonicalized");return Object.is(t,-0)?"0":String(t)}export{Ot as AmbiguousReferenceRule,H as BooleanStatement,Mt as ClassDefinitionRule,Kt as ClassHierarchyCycleRule,Le as CompositeKanonakDocumentRepository,T as CredentialStore,j as DefinedKanonak,Ft as DefinitionPropertyReferenceRule,je as DocumentLocation,Ye as EdgeType,N as EmbeddedKanonak,$t as EmbeddedKanonakTypeRule,U as EmbeddedStatement,Te as FileSystemKanonakDocumentRepository,ct as GitIgnoreFilter,Xe as GraphBuilder,Ae as HttpKanonakDocumentRepository,xt as ImportExistenceRule,Be as InMemoryKanonakDocumentRepository,Nt as InstancePropertyReferenceRule,He as Kanonak,dt as KanonakDocumentPositions,We as KanonakObjectParser,Gt as KanonakObjectValidator,Ie as KanonakParser,Ve as KanonakUri,mt as KanonakUriBuilder,nt as KanonakVocabulary,_ as ListStatement,D as LiteralKanonak,zt as MarkdownLinkRule,Me as MarkdownStatement,Lt as NamespaceImportCycleRule,Ct as NamespacePrefixRule,qe as NodeType,A as NumberStatement,at as OWL_RL_CLASSIFICATION_RULES,Ht as ObjectPropertyImportRule,Vt as ObjectPropertyValueValidationRule,bt as OntologyValidationError,ht as OntologyValidationResult,Ut as PropertyDomainRule,Bt as PropertyHierarchyCycleRule,lt as PropertyMetadata,At as PropertyRangeReferenceRule,It as PropertyRangeRequiredRule,Rt as PropertyTypeSpecificityRule,_t as PropertyValueTypeRule,De as PublisherConfigResolver,Oe as PublisherIndex,ot as RDFS_RULES,st as Reasoner,it as ReasoningResult,F as ReferenceKanonak,V as ReferenceStatement,Fe as RepositoryFactory,Pt as ResourceNamingRule,ze as ResourceResolver,Je as ResourceTypeClassifier,_e as ScalarStatement,Ue as Statement,O as StringStatement,Tt as SubClassOfReferenceRule,jt as SubPropertyOfReferenceRule,L as SubjectKanonak,wt as SubjectKanonakTypeRequiredRule,rt as TripleStore,Et as TypeAmbiguityRule,Ge as TypeResolver,vt as UnresolvedReferenceRule,St as ValidationContext,kt as ValidationSeverity,to as VersionOperator,Dt as XsdImportRule,q as canonicalForm,ge as canonicalHash,Pe as compareVersions,ye as computeIntegrity,de as createAuthenticatedFetch,k as createDPoPProof,$e as createVersion,Wt as findDerivation,gt as findInstancesByType,pt as findMarkdownLinkAt,yt as formatKanonakAddress,we as formatVersion,ce as generateDPoPKeyPair,Ne as getGlobalCachePath,S as hasValidToken,ve as isCompatibleVersion,b as isExpired,Ee as isMajorCompatible,me as loadLockFile,Qe as makeUriKey,i as normalizeHost,ft as parseKanonakAddress,xe as parseVersionString,ut as parseWithPositions,Ke as pickHighestDocument,fe as saveLockFile,le as serverSupportsDPoP,et as tripleKey,Ze as uriKey,tt as uriTriple,Re as versionsEqual};
+  Verify the helper binary supports the 'store' action.`)}}async remove(e){let r=i(e);try{await this.runHelper("erase",{publisher:r})}catch(n){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${r}': ${I(n)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${I(e)}`),[]}}async runHelper(e,r){try{let{stdout:n}=await ur(this.helperPath,[e],{...r&&{input:JSON.stringify(r)},timeout:ie});return n}catch(n){throw pr(n)?new Error(`Credential helper not found at '${this.helperPath}'.
+  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):mr(n)?new Error(`Credential helper '${this.helperPath}' timed out after ${ie/1e3}s on '${e}'.
+  The helper may be waiting for authentication to an external vault.`):n}}};function I(t){return t instanceof Error?t.message:String(t)}function pr(t){return t instanceof Error&&"code"in t&&t.code==="ENOENT"}function mr(t){return t instanceof Error&&"killed"in t&&t.killed}var J=hr(gr(),".kanonak","config.json"),T=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let r=kr(e);if(r)return r;let o=await(await this.getBackend()).get(e);return!o||!S(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,r){return(await this.getBackend()).store(e,r)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=br();return e.credentialHelper?new h(e.credentialHelper):process.platform==="darwin"?new p:process.platform==="win32"?new m:await M()?new f:new g}};function kr(t){let r="KANONAK_TOKEN_"+i(t).replace(/[.\-]/g,"_").toUpperCase();return process.env[r]??null}function br(){if(!fr(J))return{};try{return JSON.parse(yr(J,"utf-8"))}catch(t){let e=t instanceof Error?t.message:String(t);return console.warn(`  Warning: Failed to parse ${J}: ${e}
+  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as Sr,createPrivateKey as Cr,generateKeyPairSync as Pr,randomUUID as Rr,sign as wr}from"crypto";function ce(){let{publicKey:t,privateKey:e}=Pr("ec",{namedCurve:"P-256"});return{publicKey:t.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function k(t,e,r,n,o,a){let s={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},c={jti:Rr(),htm:r.toUpperCase(),htu:n,iat:Math.floor(Date.now()/1e3)};return o&&(c.ath=Sr("sha256").update(o).digest("base64url")),a&&(c.nonce=a),xr(s,c,t)}function le(t){return!t||t.length===0?!1:t.some(e=>e.toUpperCase()==="ES256")}function xr(t,e,r){let n=se(JSON.stringify(t)),o=se(JSON.stringify(e)),a=`${n}.${o}`,s=Cr({key:r,format:"jwk"}),l=wr("SHA256",Buffer.from(a),{key:s,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${a}.${l}`}function se(t){return Buffer.from(t,"utf-8").toString("base64url")}function de(t){let e=new Map;return async(r,n,o="GET")=>{if(!t)return fetch(r,{method:o});let a=await t.getCredential(n);if(!a?.accessToken)return fetch(r,{method:o});b(a)&&console.warn(`  Warning: Access token for '${n}' is expired. Run 'kanonak login ${n}' to re-authenticate.`);let s={};if(a.dpopKeyPair){let l=e.get(n);try{let d=k(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,r,a.accessToken,l);s.Authorization=`DPoP ${a.accessToken}`,s.DPoP=d}catch(d){let Ce=d instanceof Error?d.message:String(d);console.error(`  Error: Failed to create DPoP proof for '${n}': ${Ce}
+  The stored key pair may be corrupted. Run 'kanonak login ${n}' to re-authenticate.`),s.Authorization=`Bearer ${a.accessToken}`}}else s.Authorization=`Bearer ${a.accessToken}`;let c=await fetch(r,{method:o,headers:s});if(c.status===401&&a.dpopKeyPair){let l=c.headers.get("DPoP-Nonce");if(l){e.set(n,l);try{let d=k(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,r,a.accessToken,l);s.DPoP=d,c=await fetch(r,{method:o,headers:s})}catch{}}}return c}}import{readFileSync as $r,writeFileSync as vr,existsSync as Er}from"fs";import{createHash as Kr}from"crypto";import ue from"js-yaml";var pe="kanonak.lock",Br=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function me(t=pe){if(!Er(t))return null;let e=$r(t,"utf-8"),r=ue.load(e);return!r||typeof r!="object"||r.version!=="1"?null:{version:"1",lastUpdated:r.lastUpdated??new Date().toISOString(),packages:r.packages??{}}}function fe(t,e=pe){t.lastUpdated=new Date().toISOString();let r={};for(let o of Object.keys(t.packages).sort())r[o]=t.packages[o];t.packages=r;let n=ue.dump(t,{lineWidth:-1,sortKeys:!1,quotingType:'"'});vr(e,Br+n,"utf-8")}function ye(t){return`sha256:${Kr("sha256").update(t).digest("hex")}`}import{createHash as Ir}from"crypto";function q(t){let e=[];for(let n of t)n instanceof L&&e.push(Tr(n));return e.sort((n,o)=>n.uri<o.uri?-1:n.uri>o.uri?1:0),JSON.stringify({subjects:e})}function ge(t){let e=q(t);return`sha256:${Ir("sha256").update(e,"utf8").digest("hex")}`}function Tr(t){let e=Or(t),r=Y(t.statement);return{uri:e,statements:r}}function Y(t){let e=[];for(let r of t){let n=jr(r);n&&e.push(n)}return e.sort((r,n)=>r.predicate<n.predicate?-1:r.predicate>n.predicate?1:0),e}function jr(t){let e=Dr(t);if(!e)return;let r=Lr(t);if(r)return Nr(e,r)}function Lr(t){if(t instanceof O)return{type:"string",value:t.object};if(t instanceof A)return{type:"number",value:Se(t.object)};if(t instanceof U)return{type:"boolean",value:t.object};if(t instanceof V)return{type:"ref",value:ke(t.object)};if(t instanceof H){let e=t.object;return he(e)}if(t instanceof _)return{type:"list",items:t.object.map(Fr)}}function he(t){let e=Y(t.statement);return t.name&&t.name.length>0?{type:"embedded",name:t.name,statements:e}:{type:"embedded",statements:e}}function Fr(t){if(t instanceof N)return{type:"ref",value:ke(t)};if(t instanceof F)return he(t);if(t instanceof D){let e=t.value;if(typeof e=="string")return{type:"string",value:e};if(typeof e=="number")return{type:"number",value:Se(e)};if(typeof e=="boolean")return{type:"boolean",value:e}}if(t instanceof j)return{type:"embedded",statements:Y(t.statement)};throw new Error(`canonicalForm: list item of unrecognized kind (${t.constructor?.name??typeof t}); add canonicalization support before hashing data that contains it`)}function Nr(t,e){switch(e.type){case"string":return{predicate:t,type:"string",value:e.value};case"number":return{predicate:t,type:"number",value:e.value};case"boolean":return{predicate:t,type:"boolean",value:e.value};case"ref":return{predicate:t,type:"ref",value:e.value};case"embedded":return e.name!==void 0?{predicate:t,type:"embedded",name:e.name,statements:e.statements}:{predicate:t,type:"embedded",statements:e.statements};case"list":return{predicate:t,type:"list",items:e.items}}}function Dr(t){let e=t.predicate;if(e)return be(e.subject)}function Or(t){let e=t.namespace??"",r=t.name??"";return`${e}/${r}`}function ke(t){return be(t.subject)}function be(t){let e=t.version;return e&&typeof e.major=="number"?`${t.publisher}/${t.package_}@${e.major}.${e.minor}.${e.patch}/${t.name}`:`${t.publisher}/${t.package_}/${t.name}`}function Se(t){if(Number.isNaN(t))throw new Error("canonicalForm: NaN cannot be canonicalized");if(!Number.isFinite(t))throw new Error("canonicalForm: \xB1Infinity cannot be canonicalized");return Object.is(t,-0)?"0":String(t)}export{Ut as AmbiguousReferenceRule,U as BooleanStatement,Gt as ClassDefinitionRule,It as ClassHierarchyCycleRule,Le as CompositeKanonakDocumentRepository,T as CredentialStore,j as DefinedKanonak,Ot as DefinitionPropertyReferenceRule,je as DocumentLocation,Ye as EdgeType,F as EmbeddedKanonak,vt as EmbeddedKanonakTypeRule,H as EmbeddedStatement,Te as FileSystemKanonakDocumentRepository,ct as GitIgnoreFilter,Xe as GraphBuilder,Ae as HttpKanonakDocumentRepository,Et as ImportExistenceRule,Be as InMemoryKanonakDocumentRepository,Dt as InstancePropertyReferenceRule,Ue as Kanonak,dt as KanonakDocumentPositions,We as KanonakObjectParser,Jt as KanonakObjectValidator,Ie as KanonakParser,Ve as KanonakUri,mt as KanonakUriBuilder,gt as KanonakUrlResolver,nt as KanonakVocabulary,_ as ListStatement,D as LiteralKanonak,Yt as LookRenderer,Wt as MarkdownLinkRule,Me as MarkdownStatement,Nt as NamespaceImportCycleRule,Rt as NamespacePrefixRule,qe as NodeType,A as NumberStatement,at as OWL_RL_CLASSIFICATION_RULES,Ht as ObjectPropertyImportRule,_t as ObjectPropertyValueValidationRule,St as OntologyValidationError,kt as OntologyValidationResult,Mt as PropertyDomainRule,Tt as PropertyHierarchyCycleRule,lt as PropertyMetadata,Vt as PropertyRangeReferenceRule,jt as PropertyRangeRequiredRule,xt as PropertyTypeSpecificityRule,zt as PropertyValueTypeRule,De as PublisherConfigResolver,Oe as PublisherIndex,ot as RDFS_RULES,st as Reasoner,it as ReasoningResult,N as ReferenceKanonak,V as ReferenceStatement,Ne as RepositoryFactory,wt as ResourceNamingRule,ze as ResourceResolver,Je as ResourceTypeClassifier,_e as ScalarStatement,He as Statement,O as StringStatement,Lt as SubClassOfReferenceRule,Ft as SubPropertyOfReferenceRule,L as SubjectKanonak,$t as SubjectKanonakTypeRequiredRule,rt as TripleStore,Bt as TypeAmbiguityRule,Ge as TypeResolver,Kt as UnresolvedReferenceRule,Pt as ValidationCache,Ct as ValidationContext,bt as ValidationSeverity,oo as VersionOperator,At as XsdImportRule,q as canonicalForm,ge as canonicalHash,Pe as compareVersions,ye as computeIntegrity,de as createAuthenticatedFetch,k as createDPoPProof,xe as createVersion,qt as findDerivation,ht as findInstancesByType,pt as findMarkdownLinkAt,yt as formatKanonakAddress,we as formatVersion,ce as generateDPoPKeyPair,Fe as getGlobalCachePath,S as hasValidToken,ve as isCompatibleVersion,b as isExpired,Ee as isMajorCompatible,me as loadLockFile,Qe as makeUriKey,i as normalizeHost,ft as parseKanonakAddress,$e as parseVersionString,ut as parseWithPositions,Ke as pickHighestDocument,fe as saveLockFile,le as serverSupportsDPoP,et as tripleKey,Ze as uriKey,tt as uriTriple,Re as versionsEqual};

package/dist/look/LookRenderer.d.ts

@@ -0,0 +1,141 @@
+/**
+ * LookRenderer — declarative visual rendering for Kanonak resources.
+ *
+ * Consumes `derivation.look` declarations on classes/packages/publishers
+ * and produces HTML without requiring publishers to author per-class
+ * `tx.InstanceTransformation` packages.
+ *
+ * Walks the instance's type chain to find the closest class declaring
+ * `derivation.look`, falls through to `rdfs.Resource` at the root, then
+ * walks the declaration's bands and emits HTML.
+ *
+ * v0.1 band coverage:
+ *   - look.Hero          : page header with title, eyebrow, subtitle, badges
+ *   - look.PropertyList  : labeled section listing one property's values
+ *   - look.BadgeRow      : clickable type badges from a property holding refs
+ *   - look.ChipRow       : inline labeled chips from a list of properties
+ *   - look.ReferenceList : labeled definition list of cross-reference groups
+ *
+ * Still ahead: PropertyTable, Markdown, ResourceGrid, ResourceCount,
+ * FeaturedResource bands; token cascade resolution; CSS output via the
+ * stylesheet format; TransformationEngine integration.
+ */
+import { SubjectKanonak, EmbeddedKanonak, type Kanonak } from '../kanonaks/index.js';
+type Uri = {
+    publisher: string;
+    package_: string;
+    name: string;
+};
+/**
+ * The result of walking the cascade to find the look declaration that
+ * applies to a given instance. Carries the declaration plus provenance
+ * (the class the declaration was sourced from).
+ */
+export interface ResolvedLook {
+    /** The look declaration — an EmbeddedKanonak with bands and metadata. */
+    declaration: EmbeddedKanonak;
+    /** The class in the hierarchy where the declaration was found. */
+    sourceClass: Uri;
+}
+export declare class LookRenderer {
+    private readonly catalog;
+    constructor(catalog: Kanonak[]);
+    /**
+     * Walk the instance's type chain (BFS) looking for the first class
+     * that declares `derivation.look`. Falls through to `rdfs.Resource`
+     * at the root.
+     */
+    findCascadedLook(instance: SubjectKanonak): ResolvedLook | undefined;
+    /**
+     * Walk the instance's type chain merging token declarations by key.
+     * Closer-to-instance wins; tokens from different keys merge cleanly.
+     *
+     * Resolution order:
+     *   1. Instance direct (`derivation.tokens` on the instance itself)
+     *   2. First-declared type's chain (BFS through subClassOf)
+     *   3. Subsequent declared types' chains (already-visited classes skipped)
+     *   4. Universal floor (`rdfs.Resource` defaults from look-tokens)
+     *
+     * Tokens are keyed by their local name (e.g. `"accent"`, not the
+     * full URI), assumed globally unique by convention.
+     */
+    findCascadedTokens(instance: SubjectKanonak): Map<string, string>;
+    /**
+     * Render the stylesheet for an instance — a CSS string with the
+     * cascaded tokens as `--kan-*` custom properties on `:root`, plus
+     * the base CSS rules that style the look vocabulary's HTML output
+     * (`.kan-hero`, `.kan-property-list`, `.kan-badge`, etc.).
+     *
+     * The :root variables are derived per-resource (different classes
+     * may resolve different accent colors etc.); the base rules are
+     * shared across the universal-look layer.
+     */
+    renderStylesheet(instance: SubjectKanonak): string;
+    /**
+     * Render the instance as body-only HTML using its cascaded look.
+     */
+    renderHtml(instance: SubjectKanonak): string;
+    private renderBand;
+    private renderHero;
+    private renderPropertyList;
+    private renderBadgeRow;
+    private renderChipRow;
+    private renderReferenceList;
+    /**
+     * Read a property's value off an instance and return it as a single
+     * piece of text. Strings render verbatim. References resolve to the
+     * target's rdfs.label or local name. Lists render as comma-joined.
+     * Embeddeds render as their UriName.
+     */
+    private readPropertyValueText;
+    /**
+     * Read a property's value off an instance and return any references
+     * within. Used by Hero badges, BadgeRow source, ReferenceList entries.
+     */
+    private readPropertyValueReferences;
+    /**
+     * Gather the items from a statement value for list-style rendering.
+     * Returns the raw IStatement objects (callers dispatch per item).
+     */
+    private gatherValueItems;
+    /**
+     * Render one item (from gatherValueItems) as inline HTML — anchor
+     * for references, escaped text for strings, UriName for embeddeds.
+     * slotUri is the look slot the item came from (used for urlForm).
+     */
+    private renderInlineValue;
+    /**
+     * Render a Statement's value as inline HTML — single-line, suitable
+     * for a chip's `chip-val` slot. Strings/refs render as expected;
+     * lists render as comma-joined items.
+     */
+    private renderStatementInlineValue;
+    /**
+     * Render a Kanonak resource reference as a clickable anchor. Label
+     * is the target's rdfs.label (fall back to local name). URL form
+     * comes from the slot property's `look.urlForm` annotation (defaults
+     * to `=` for unannotated properties). Same-publisher refs render as
+     * path-only URLs; cross-publisher refs render as full `https://...`.
+     */
+    private renderReferenceLink;
+    /**
+     * Render a Kanonak resource reference as a styled type badge with a
+     * tooltip from the target's rdfs.comment. Same URL-form rules as
+     * renderReferenceLink.
+     */
+    private renderBadge;
+    /**
+     * Build a URL string for a reference, applying the slot property's
+     * urlForm annotation. The slot property is the look property that
+     * "owns" the reference (e.g., look.target on NavLink, look.badges
+     * on Hero). Unannotated properties default to `=` (exact pin).
+     */
+    private urlForReference;
+    /** Look up the `look.urlForm` annotation on a property, defaulting to `=`. */
+    private getUrlFormForProperty;
+    /** Look up rdfs.label of a resource by URI. */
+    private readLabelForUri;
+    /** Look up rdfs.comment of a resource by URI. */
+    private readCommentForUri;
+}
+export {};

package/dist/look/index.d.ts

@@ -0,0 +1 @@
+export { LookRenderer, type ResolvedLook } from './LookRenderer.js';

package/dist/repositories/browser.js

@@ -1 +1 @@
-import{a as o,b as e,c as r,d as n}from"../chunk-CNM3SY5S.js";import"../chunk-FQHALFRR.js";import"../chunk-MYITGTGJ.js";export{n as HttpKanonakDocumentRepository,o as InMemoryKanonakDocumentRepository,e as PublisherConfigResolver,r as PublisherIndex};
+import{a as o,b as e,c as r,d as n}from"../chunk-AV4AVTI6.js";import"../chunk-MYITGTGJ.js";import"../chunk-FQHALFRR.js";export{n as HttpKanonakDocumentRepository,o as InMemoryKanonakDocumentRepository,e as PublisherConfigResolver,r as PublisherIndex};

package/dist/repositories/index.js

@@ -1 +1 @@
-import{a as b,b as c,c as d,d as e,e as f}from"../chunk-3JRHG2JH.js";import{a,b as g,c as h,d as i}from"../chunk-CNM3SY5S.js";import"../chunk-FQHALFRR.js";import"../chunk-MYITGTGJ.js";export{d as CompositeKanonakDocumentRepository,c as DocumentLocation,b as FileSystemKanonakDocumentRepository,i as HttpKanonakDocumentRepository,a as InMemoryKanonakDocumentRepository,g as PublisherConfigResolver,h as PublisherIndex,f as RepositoryFactory,e as getGlobalCachePath};
+import{a as b,b as c,c as d,d as e,e as f}from"../chunk-AZSZXLEH.js";import{a,b as g,c as h,d as i}from"../chunk-AV4AVTI6.js";import"../chunk-MYITGTGJ.js";import"../chunk-FQHALFRR.js";export{d as CompositeKanonakDocumentRepository,c as DocumentLocation,b as FileSystemKanonakDocumentRepository,i as HttpKanonakDocumentRepository,a as InMemoryKanonakDocumentRepository,g as PublisherConfigResolver,h as PublisherIndex,f as RepositoryFactory,e as getGlobalCachePath};

package/dist/resolution/KanonakUrlResolver.d.ts

@@ -0,0 +1,114 @@
+/**
+ * KanonakUrlResolver — parse and format Kanonak's HTTP URL hierarchy.
+ *
+ * The five URL forms:
+ *
+ *   /                              → publisher view
+ *   /{package}                     → package, any version (operator *)
+ *   /{package}/{version-or-range}  → package, version-pinned by operator
+ *   /{package}/{name}              → resource, any version (operator *)
+ *   /{package}/{version-or-range}/{name} → resource, version-pinned
+ *
+ * The second path segment encodes the version-compatibility operator
+ * via its shape — same operators as Kanonak's `imports.match`:
+ *
+ *   shape `2`         → operator `^` (major-pinned: latest 2.x.y)
+ *   shape `2.4`       → operator `~` (minor-pinned: latest 2.4.x)
+ *   shape `2.4.6`     → operator `=` (exact pin)
+ *   absent            → operator `*` (any version, resolve to latest)
+ *
+ * Disambiguation between `/snapshot/2` (package major-pin) and
+ * `/snapshot/view` (resource at latest): the second segment is a
+ * version iff it matches `^\d+(\.\d+){0,2}$`. Resource names cannot
+ * contain periods (existing rule) nor be purely numeric (new v1 rule),
+ * so collisions are impossible.
+ *
+ * The resolver is stateless — it does NOT consult a repository to
+ * resolve `*` / `^` / `~` to a concrete version. That's a separate
+ * concern handled by the caller against its catalog. The resolver's
+ * job is parsing and formatting.
+ */
+import type { Version } from '@kanonak-protocol/types/document/models/types';
+export type VersionSpec = {
+    readonly kind: 'any';
+} | {
+    readonly kind: 'major-pin';
+    readonly major: number;
+} | {
+    readonly kind: 'minor-pin';
+    readonly major: number;
+    readonly minor: number;
+} | {
+    readonly kind: 'exact';
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
+};
+/** The operator character corresponding to a VersionSpec. */
+export type UrlForm = '*' | '^' | '~' | '=';
+export type UrlAddress = PublisherUrlAddress | PackageUrlAddress | ResourceUrlAddress;
+export interface PublisherUrlAddress {
+    readonly kind: 'publisher';
+    readonly publisher: string;
+}
+export interface PackageUrlAddress {
+    readonly kind: 'package';
+    readonly publisher: string;
+    readonly package_: string;
+    readonly versionSpec: VersionSpec;
+}
+export interface ResourceUrlAddress {
+    readonly kind: 'resource';
+    readonly publisher: string;
+    readonly package_: string;
+    readonly versionSpec: VersionSpec;
+    readonly name: string;
+}
+export declare class KanonakUrlResolver {
+    /**
+     * Parse an HTTP URL or path into a UrlAddress.
+     *
+     * Accepts:
+     *   - Full URLs: `https://worldview.genval.ai/snapshot/2.1/view`
+     *   - Path-only: `/snapshot/2.1/view` — requires `contextPublisher`
+     *
+     * Returns `null` for unrecognized shapes (4+ path segments, missing
+     * publisher when path-only, etc.). The caller treats null as "not a
+     * Kanonak URL".
+     */
+    static parse(urlOrPath: string, contextPublisher?: string): UrlAddress | null;
+    /**
+     * Format a UrlAddress back into a URL string.
+     *
+     * Default: full URL with `https://` scheme. Pass `pathOnly: true` to
+     * get the path component only — useful for same-publisher links.
+     */
+    static format(address: UrlAddress, opts?: {
+        scheme?: 'https' | 'http';
+        pathOnly?: boolean;
+    }): string;
+    /**
+     * Format a pinned resource reference as a URL with a specific
+     * version-form operator. This is the rendering-time helper used by
+     * the look renderer when emitting `<a href="...">` for cross-resource
+     * references — given the pinned target and the property's
+     * `look.urlForm` annotation, produce the appropriately-shaped URL.
+     *
+     * If `target.version` is absent and operator requires a version
+     * (`^`, `~`, `=`), the resolver falls back to `*` (any).
+     *
+     * When `opts.contextPublisher` matches `target.publisher`, the
+     * result is a path-only URL (e.g. `/snapshot/2/view`) — natural for
+     * same-publisher links. Otherwise the full `https://...` form is
+     * emitted.
+     */
+    static formatResourceUrl(target: {
+        publisher: string;
+        package_: string;
+        version?: Version;
+        name: string;
+    }, urlForm: UrlForm, opts?: {
+        scheme?: 'https' | 'http';
+        contextPublisher?: string;
+    }): string;
+}

package/dist/resolution/index.d.ts

@@ -4,6 +4,8 @@ export { KanonakUri } from './KanonakUri.js';
 export { KanonakUriBuilder } from './KanonakUriBuilder.js';
 export { parseKanonakAddress, formatKanonakAddress, } from './KanonakAddress.js';
 export type { KanonakAddress } from './KanonakAddress.js';
+export { KanonakUrlResolver } from './KanonakUrlResolver.js';
+export type { UrlAddress, PublisherUrlAddress, PackageUrlAddress, ResourceUrlAddress, VersionSpec, UrlForm, } from './KanonakUrlResolver.js';
 export type { ResourceResolutionResult } from './ResourceResolutionResult.js';
 export { TypeResolver } from './TypeResolver.js';
 export { ResourceTypeClassifier } from './ResourceTypeClassifier.js';

package/dist/resolution/index.js

@@ -1 +1 @@
-import{a as l,b as m,c as n,d as o,e as p}from"../chunk-VRZUCZEF.js";import{a,b,c,d,e,f,g,h}from"../chunk-FQHALFRR.js";import{b as j,c as k}from"../chunk-IXE5THUW.js";import{a as i}from"../chunk-FUUTGGJS.js";export{i as KanonakUri,m as KanonakUriBuilder,j as ResourceResolver,l as ResourceTypeClassifier,k as TypeResolver,a as compareVersions,d as createVersion,p as findInstancesByType,o as formatKanonakAddress,c as formatVersion,f as isCompatibleVersion,g as isMajorCompatible,n as parseKanonakAddress,e as parseVersionString,h as pickHighestDocument,b as versionsEqual};
+import{a as l,b as m,c as n,d as o,e as q}from"../chunk-4TJZIM7A.js";import{a as p}from"../chunk-NIGFQYVA.js";import{a,b,c,d,e,f,g,h}from"../chunk-FQHALFRR.js";import{b as j,c as k}from"../chunk-IXE5THUW.js";import{a as i}from"../chunk-FUUTGGJS.js";export{i as KanonakUri,m as KanonakUriBuilder,p as KanonakUrlResolver,j as ResourceResolver,l as ResourceTypeClassifier,k as TypeResolver,a as compareVersions,d as createVersion,q as findInstancesByType,o as formatKanonakAddress,c as formatVersion,f as isCompatibleVersion,g as isMajorCompatible,n as parseKanonakAddress,e as parseVersionString,h as pickHighestDocument,b as versionsEqual};

package/dist/transformations/TransformationEngine.d.ts

@@ -39,6 +39,25 @@ export declare class TransformationEngine {
     constructor(repository: IKanonakDocumentRepository, parser?: KanonakParser, objectParser?: KanonakObjectParser);
     /** Discard the cached catalog; the next call will re-parse the repository. */
     invalidate(): void;
+    /**
+     * Render the given resource through the declarative look layer
+     * (`derivation.look` cascade). Returns body-only HTML or a CSS
+     * stylesheet depending on the requested format.
+     *
+     * This is the integration point for the look vocabulary
+     * (`kanonak.org/look@1.0.0`): publishers declaring `derivation.look`
+     * on their classes get rendered output via this path without
+     * needing to author a `tx.InstanceTransformation`.
+     *
+     * Supported formats: `formats.html`, `formats.stylesheet`. Other
+     * formats throw RenderError. Callers select this path explicitly
+     * (vs `render()` which routes through `findDerivation` for the
+     * legacy transformation-based path).
+     */
+    renderViaLook(opts: {
+        resource: EntityUri;
+        format: EntityUri;
+    }): Promise<RenderedArtifact>;
     /**
      * Walk derivation discovery to find the transformation that should
      * render the given resource as the given format/variant. Returns
@@ -52,6 +71,20 @@ export declare class TransformationEngine {
     /**
      * Discover + run: render the given resource as the given format.
      * Throws RenderError if no derivation is found or the run fails.
+     *
+     * Dispatch order:
+     *   1. If the resource's class hierarchy declares a custom
+     *      `derivation.derivations` binding for this (format, variant),
+     *      run that transformation. Publishers' explicit overrides win.
+     *   2. Otherwise, if the resource has a cascaded `derivation.look`
+     *      AND the format is supported by the look layer (html,
+     *      stylesheet), route through LookRenderer.
+     *   3. Otherwise, fall back to the universal-derivations baseline
+     *      transformation (also found via findDerivation).
+     *
+     * This auto-dispatch means callers (Kanonak Browser, CLI, dynamic
+     * servers) only need to call `render` — the engine picks the right
+     * path based on what the resource's class declares.
      */
     render(opts: {
         resource: EntityUri;