@kanonak-protocol/sdk 3.75.0 → 3.76.0

package/dist/browser.d.ts

@@ -27,6 +27,8 @@ export { PublisherConfigResolver } from './repositories/PublisherConfig.js';
 export type { PublisherConfig } from './repositories/PublisherConfig.js';
 export { findDerivation } from './derivation/index.js';
 export type { DerivationEntityUri, TransformationReferenceTuple, DerivationLookupResult, } from './derivation/index.js';
+export { buildOntologyModel } from './introspection/index.js';
+export type { OntologyModel, ClassDef, PropertyDef, ClassRef, TypeRef, BuildOntologyModelOptions, } from './introspection/index.js';
 export { BrowserCredentialBackend, BrowserOAuthFlow, generateBrowserDPoPKeys, generateBrowserDPoPKeyPair, importDPoPKeys, createBrowserDPoPProof, browserServerSupportsDPoP, isExpired, hasValidToken, normalizeHost, } from './auth/browser.js';
 export type { BrowserDPoPKeys, BrowserOAuthResult, CredentialBackend, StoredCredential, DPoPKeyPair, } from './auth/browser.js';
 export type { IKanonakDocumentRepository } from '@kanonak-protocol/types/document/models';

package/dist/browser.js

@@ -1,2 +1,2 @@
-import{a as ge,b as fe,c as me,d as C,e as E,f as d}from"./chunk-Y7TGQ7UF.js";import{a as Qe}from"./chunk-F5ANO7MJ.js";import"./chunk-QHABFCRC.js";import{b as L,c as W,d as F}from"./chunk-LKBG2MK6.js";import{a as H}from"./chunk-4NO7MHS7.js";import{a as Pe,b as we,c as he}from"./chunk-GN2XODVC.js";import{a as ke,b as be}from"./chunk-PEUTCG3B.js";import"./chunk-PEJALHXK.js";import"./chunk-SC5M74NM.js";import{A as We,B as Fe,C as Ge,G as Xe,a as Ke,b as xe,c as Se,d as Re,f as De,g as Be,h as Ce,i as Ee,j as je,k as ve,l as _e,m as Ie,n as Ae,o as Te,p as Oe,q as Ve,r as $e,s as Ue,t as ze,u as Me,v as Ne,w as Je,x as He,y as qe,z as Le}from"./chunk-C7RZIMEH.js";import"./chunk-SHDHMKMJ.js";import{a as Y,c as le,f as pe}from"./chunk-G2DKKSZ4.js";import{a as q}from"./chunk-TJPQETHV.js";import{a as ye}from"./chunk-BGQKZBNE.js";import"./chunk-CRKSKIAL.js";import{b as ue,c as de}from"./chunk-IOMNZBK4.js";import{a as G,b as X,c as Q,d as ee,e as re,f as te,g as ne,h as oe,i as se,j as ie,k as ae,l as ce}from"./chunk-W6T7MOKY.js";import{a as Z}from"./chunk-FUUTGGJS.js";import{c as O,d as V,e as $,f as U,g as z,h as M,i as N,j as J}from"./chunk-2ACBWC7K.js";var j="kanonak-credentials",u="credentials",Ye=1,f=class{async get(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readonly"),i=s.objectStore(u).get(e);i.onsuccess=()=>o(i.result??null),i.onerror=()=>a(new Error(`IndexedDB read failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async store(r,e){let t=d(r),o=await h();return new Promise((a,s)=>{let l=o.transaction(u,"readwrite"),c=l.objectStore(u).put(e,t);c.onsuccess=()=>a(),c.onerror=()=>s(new Error(`IndexedDB write failed for '${t}': ${c.error?.message}`)),l.oncomplete=()=>o.close()})}async remove(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readwrite"),i=s.objectStore(u).delete(e);i.onsuccess=()=>o(),i.onerror=()=>a(new Error(`IndexedDB delete failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async list(){let r=await h();return new Promise((e,t)=>{let o=r.transaction(u,"readonly"),s=o.objectStore(u).getAllKeys();s.onsuccess=()=>e(s.result??[]),s.onerror=()=>t(new Error(`IndexedDB list failed: ${s.error?.message}`)),o.oncomplete=()=>r.close()})}};function h(){return new Promise((n,r)=>{let e=indexedDB.open(j,Ye);e.onupgradeneeded=()=>{let t=e.result;t.objectStoreNames.contains(u)||t.createObjectStore(u)},e.onsuccess=()=>n(e.result),e.onerror=()=>r(new Error(`Failed to open IndexedDB '${j}': ${e.error?.message}
-Credential storage requires IndexedDB support in your browser.`))})}async function _(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey);return{signingKey:n.privateKey,publicKeyJwk:r}}async function k(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey),e=await crypto.subtle.exportKey("jwk",n.privateKey);return{keys:{signingKey:n.privateKey,publicKeyJwk:r},dpopKeyPair:{publicKey:r,privateKey:e}}}async function b(n){return{signingKey:await crypto.subtle.importKey("jwk",n.privateKey,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),publicKeyJwk:n.publicKey}}async function K(n,r,e,t,o){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:n.publicKeyJwk.kty,crv:n.publicKeyJwk.crv,x:n.publicKeyJwk.x,y:n.publicKeyJwk.y}},s={jti:crypto.randomUUID(),htm:r.toUpperCase(),htu:e,iat:Math.floor(Date.now()/1e3)};return t&&(s.ath=await er(t)),o&&(s.nonce=o),await Ze(a,s,n.signingKey)}function x(n){return!n||n.length===0?!1:n.some(r=>r.toUpperCase()==="ES256")}async function Ze(n,r,e){let t=v(JSON.stringify(n)),o=v(JSON.stringify(r)),a=new TextEncoder().encode(`${t}.${o}`),s=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e,a),l=D(s);return`${t}.${o}.${l}`}async function er(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return D(e)}function v(n){let r=new TextEncoder().encode(n);return D(r.buffer)}function D(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var rr=300*1e3,S=class{credentialBackend;callbackUrl;constructor(r){this.credentialBackend=new f,this.callbackUrl=r??`${window.location.origin}/browser/callback.html`}async authorize(r){let e=d(r),t=await this.discover(e);if(!t)return{success:!1,error:`No OAuth discovery endpoint found for '${e}'.`};if(!t.authorizationEndpoint||!t.tokenEndpoint)return{success:!1,error:`OAuth metadata incomplete for '${e}'.`};let o=x(t.dpopSigningAlgValuesSupported),a=null,s=null;if(o){let g=await k();a=g.keys,s=g.dpopKeyPair}let l=await this.credentialBackend.get(e),i=l?.clientId??null,c=l?.clientSecret??null;if(!i&&t.registrationEndpoint){let g=await this.registerClient(t.registrationEndpoint);if(!g)return{success:!1,error:`Dynamic client registration failed for '${e}'.`};i=g.clientId,c=g.clientSecret??null}if(!i)return{success:!1,error:`No OAuth client credentials for '${e}'.`};let m=tr(),p=await nr(m),R=or(),A=sr(t.authorizationEndpoint,i,this.callbackUrl,R,p),y=await this.openAuthPopup(A,R);if(!y)return{success:!1,error:"Authorization timed out or was cancelled."};if(y.error)return{success:!1,error:`Authorization failed: ${y.error}`};if(!y.code)return{success:!1,error:"No authorization code received."};if(y.state!==R)return{success:!1,error:"State mismatch \u2014 possible CSRF attack."};let P=await this.exchangeCode(t.tokenEndpoint,i,c,y.code,this.callbackUrl,m,a);if(!P)return{success:!1,error:"Token exchange failed."};let T={clientId:i,clientSecret:c,accessToken:P.accessToken??null,refreshToken:P.refreshToken??null,expiresAt:P.expiresIn?new Date(Date.now()+P.expiresIn*1e3).toISOString():null,tokenEndpoint:t.tokenEndpoint,dpopKeyPair:s};return await this.credentialBackend.store(e,T),{success:!0,host:e}}async getCredentialWithKeys(r){let e=await this.credentialBackend.get(r);if(!e)return null;let t=null;return e.dpopKeyPair&&(t=await b(e.dpopKeyPair)),{credential:e,dpopKeys:t}}async logout(r){let e=d(r);return await this.credentialBackend.remove(e),{success:!0,host:e}}async listAuthenticated(){return this.credentialBackend.list()}async discover(r){for(let e of[`https://${r}/.well-known/oauth-authorization-server`,`https://${r}/.well-known/openid-configuration`])try{let t=await fetch(e);if(!t.ok)continue;let o=await t.json();return{issuer:w(o.issuer),authorizationEndpoint:w(o.authorization_endpoint),tokenEndpoint:w(o.token_endpoint),registrationEndpoint:w(o.registration_endpoint),revocationEndpoint:w(o.revocation_endpoint),dpopSigningAlgValuesSupported:I(o.dpop_signing_alg_values_supported),codeChallengeMethodsSupported:I(o.code_challenge_methods_supported)}}catch{continue}return null}async registerClient(r){try{let e=await fetch(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak Browser",redirect_uris:[this.callbackUrl],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})});if(!e.ok)return null;let t=await e.json(),o=t.client_id;return o?{clientId:o,clientSecret:t.client_secret}:null}catch{return null}}openAuthPopup(r,e){return new Promise(t=>{let o=window.open(r,"kanonak-auth","width=500,height=700,menubar=no,toolbar=no,location=yes,status=no");if(!o){t(null);return}let a=setTimeout(()=>{i(),t(null)},rr),s=c=>{c.origin===window.location.origin&&(!c.data||c.data.type!=="kanonak-auth-callback"||(i(),t({code:c.data.code??void 0,state:c.data.state??void 0,error:c.data.error??void 0})))},l=setInterval(()=>{o.closed&&(i(),t(null))},500),i=()=>{clearTimeout(a),clearInterval(l),window.removeEventListener("message",s);try{o.close()}catch{}};window.addEventListener("message",s)})}async exchangeCode(r,e,t,o,a,s,l){let i=new URLSearchParams({grant_type:"authorization_code",client_id:e,code:o,redirect_uri:a,code_verifier:s});t&&i.set("client_secret",t);let c={"Content-Type":"application/x-www-form-urlencoded"};l&&(c.DPoP=await K(l,"POST",r));try{let m=await fetch(r,{method:"POST",headers:c,body:i.toString()});if(!m.ok)return null;let p=await m.json();return{accessToken:p.access_token,refreshToken:p.refresh_token,expiresIn:typeof p.expires_in=="number"?p.expires_in:void 0}}catch{return null}}};function tr(){let n=new Uint8Array(32);return crypto.getRandomValues(n),B(n.buffer)}async function nr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return B(e)}function or(){let n=new Uint8Array(16);return crypto.getRandomValues(n),B(n.buffer)}function sr(n,r,e,t,o){let a=new URLSearchParams({client_id:r,response_type:"code",redirect_uri:e,state:t,code_challenge:o,code_challenge_method:"S256"});return`${n}?${a}`}function B(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function w(n){return typeof n=="string"?n:null}function I(n){return Array.isArray(n)?n.filter(r=>typeof r=="string"):null}export{Ne as AmbiguousReferenceRule,se as BooleanStatement,f as BrowserCredentialBackend,S as BrowserOAuthFlow,Fe as ClassDefinitionRule,Ie as ClassHierarchyCycleRule,X as DefinedKanonak,ze as DefinitionPropertyReferenceRule,fe as EdgeType,Y as EmbeddedKanonak,je as EmbeddedKanonakTypeRule,ae as EmbeddedStatement,me as GraphBuilder,F as HttpKanonakDocumentRepository,ve as ImportExistenceRule,H as InMemoryKanonakDocumentRepository,Ue as InstancePropertyReferenceRule,G as Kanonak,we as KanonakDocumentPositions,pe as KanonakObjectParser,Xe as KanonakObjectValidator,q as KanonakParser,Z as KanonakUri,ke as KanonakUriBuilder,ce as ListStatement,Ge as MarkdownLinkRule,le as MarkdownStatement,$e as NamespaceImportCycleRule,De as NamespacePrefixRule,ge as NodeType,oe as NumberStatement,He as ObjectPropertyImportRule,qe as ObjectPropertyValueValidationRule,Se as OntologyValidationError,Ke as OntologyValidationResult,Le as PropertyDomainRule,Ae as PropertyHierarchyCycleRule,Pe as PropertyMetadata,Je as PropertyRangeReferenceRule,Te as PropertyRangeRequiredRule,Ce as PropertyTypeSpecificityRule,We as PropertyValueTypeRule,L as PublisherConfigResolver,W as PublisherIndex,ee as ReferenceKanonak,ie as ReferenceStatement,Be as ResourceNamingRule,ue as ResourceResolver,ye as ResourceTypeClassifier,te as ScalarStatement,re as Statement,ne as StringStatement,Oe as SubClassOfReferenceRule,Ve as SubPropertyOfReferenceRule,Q as SubjectKanonak,Ee as SubjectKanonakTypeRequiredRule,de as TypeResolver,_e as UnresolvedReferenceRule,Re as ValidationContext,xe as ValidationSeverity,Me as XsdImportRule,x as browserServerSupportsDPoP,O as compareVersions,K as createBrowserDPoPProof,U as createVersion,Qe as findDerivation,be as findInstancesByType,$ as formatVersion,k as generateBrowserDPoPKeyPair,_ as generateBrowserDPoPKeys,E as hasValidToken,b as importDPoPKeys,M as isCompatibleVersion,C as isExpired,N as isMajorCompatible,d as normalizeHost,z as parseVersionString,he as parseWithPositions,J as pickHighestDocument,V as versionsEqual};
+import{a as fe,b as ge,c as me,d as C,e as E,f as d,g as Ye}from"./chunk-VIM6XICU.js";import{a as Qe}from"./chunk-F5ANO7MJ.js";import"./chunk-QHABFCRC.js";import{b as L,c as W,d as F}from"./chunk-LKBG2MK6.js";import{a as H}from"./chunk-4NO7MHS7.js";import{a as Pe,b as we,c as he}from"./chunk-GN2XODVC.js";import{a as ke,b as be}from"./chunk-PEUTCG3B.js";import"./chunk-PEJALHXK.js";import"./chunk-SC5M74NM.js";import{A as We,B as Fe,C as Ge,G as Xe,a as Ke,b as xe,c as Se,d as Re,f as De,g as Be,h as Ce,i as Ee,j as je,k as ve,l as _e,m as Ie,n as Ae,o as Te,p as Oe,q as Ve,r as $e,s as Ue,t as Me,u as ze,v as Ne,w as Je,x as He,y as qe,z as Le}from"./chunk-C7RZIMEH.js";import"./chunk-SHDHMKMJ.js";import{a as Y,c as le,f as pe}from"./chunk-G2DKKSZ4.js";import{a as q}from"./chunk-TJPQETHV.js";import{a as ye}from"./chunk-BGQKZBNE.js";import"./chunk-CRKSKIAL.js";import{b as ue,c as de}from"./chunk-IOMNZBK4.js";import{a as G,b as X,c as Q,d as ee,e as re,f as te,g as ne,h as oe,i as se,j as ie,k as ae,l as ce}from"./chunk-W6T7MOKY.js";import{a as Z}from"./chunk-FUUTGGJS.js";import{c as O,d as V,e as $,f as U,g as M,h as z,i as N,j as J}from"./chunk-2ACBWC7K.js";var j="kanonak-credentials",u="credentials",Ze=1,g=class{async get(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readonly"),i=s.objectStore(u).get(e);i.onsuccess=()=>o(i.result??null),i.onerror=()=>a(new Error(`IndexedDB read failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async store(r,e){let t=d(r),o=await h();return new Promise((a,s)=>{let l=o.transaction(u,"readwrite"),c=l.objectStore(u).put(e,t);c.onsuccess=()=>a(),c.onerror=()=>s(new Error(`IndexedDB write failed for '${t}': ${c.error?.message}`)),l.oncomplete=()=>o.close()})}async remove(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readwrite"),i=s.objectStore(u).delete(e);i.onsuccess=()=>o(),i.onerror=()=>a(new Error(`IndexedDB delete failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async list(){let r=await h();return new Promise((e,t)=>{let o=r.transaction(u,"readonly"),s=o.objectStore(u).getAllKeys();s.onsuccess=()=>e(s.result??[]),s.onerror=()=>t(new Error(`IndexedDB list failed: ${s.error?.message}`)),o.oncomplete=()=>r.close()})}};function h(){return new Promise((n,r)=>{let e=indexedDB.open(j,Ze);e.onupgradeneeded=()=>{let t=e.result;t.objectStoreNames.contains(u)||t.createObjectStore(u)},e.onsuccess=()=>n(e.result),e.onerror=()=>r(new Error(`Failed to open IndexedDB '${j}': ${e.error?.message}
+Credential storage requires IndexedDB support in your browser.`))})}async function _(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey);return{signingKey:n.privateKey,publicKeyJwk:r}}async function k(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey),e=await crypto.subtle.exportKey("jwk",n.privateKey);return{keys:{signingKey:n.privateKey,publicKeyJwk:r},dpopKeyPair:{publicKey:r,privateKey:e}}}async function b(n){return{signingKey:await crypto.subtle.importKey("jwk",n.privateKey,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),publicKeyJwk:n.publicKey}}async function K(n,r,e,t,o){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:n.publicKeyJwk.kty,crv:n.publicKeyJwk.crv,x:n.publicKeyJwk.x,y:n.publicKeyJwk.y}},s={jti:crypto.randomUUID(),htm:r.toUpperCase(),htu:e,iat:Math.floor(Date.now()/1e3)};return t&&(s.ath=await rr(t)),o&&(s.nonce=o),await er(a,s,n.signingKey)}function x(n){return!n||n.length===0?!1:n.some(r=>r.toUpperCase()==="ES256")}async function er(n,r,e){let t=v(JSON.stringify(n)),o=v(JSON.stringify(r)),a=new TextEncoder().encode(`${t}.${o}`),s=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e,a),l=D(s);return`${t}.${o}.${l}`}async function rr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return D(e)}function v(n){let r=new TextEncoder().encode(n);return D(r.buffer)}function D(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var tr=300*1e3,S=class{credentialBackend;callbackUrl;constructor(r){this.credentialBackend=new g,this.callbackUrl=r??`${window.location.origin}/browser/callback.html`}async authorize(r){let e=d(r),t=await this.discover(e);if(!t)return{success:!1,error:`No OAuth discovery endpoint found for '${e}'.`};if(!t.authorizationEndpoint||!t.tokenEndpoint)return{success:!1,error:`OAuth metadata incomplete for '${e}'.`};let o=x(t.dpopSigningAlgValuesSupported),a=null,s=null;if(o){let f=await k();a=f.keys,s=f.dpopKeyPair}let l=await this.credentialBackend.get(e),i=l?.clientId??null,c=l?.clientSecret??null;if(!i&&t.registrationEndpoint){let f=await this.registerClient(t.registrationEndpoint);if(!f)return{success:!1,error:`Dynamic client registration failed for '${e}'.`};i=f.clientId,c=f.clientSecret??null}if(!i)return{success:!1,error:`No OAuth client credentials for '${e}'.`};let m=nr(),p=await or(m),R=sr(),A=ir(t.authorizationEndpoint,i,this.callbackUrl,R,p),y=await this.openAuthPopup(A,R);if(!y)return{success:!1,error:"Authorization timed out or was cancelled."};if(y.error)return{success:!1,error:`Authorization failed: ${y.error}`};if(!y.code)return{success:!1,error:"No authorization code received."};if(y.state!==R)return{success:!1,error:"State mismatch \u2014 possible CSRF attack."};let P=await this.exchangeCode(t.tokenEndpoint,i,c,y.code,this.callbackUrl,m,a);if(!P)return{success:!1,error:"Token exchange failed."};let T={clientId:i,clientSecret:c,accessToken:P.accessToken??null,refreshToken:P.refreshToken??null,expiresAt:P.expiresIn?new Date(Date.now()+P.expiresIn*1e3).toISOString():null,tokenEndpoint:t.tokenEndpoint,dpopKeyPair:s};return await this.credentialBackend.store(e,T),{success:!0,host:e}}async getCredentialWithKeys(r){let e=await this.credentialBackend.get(r);if(!e)return null;let t=null;return e.dpopKeyPair&&(t=await b(e.dpopKeyPair)),{credential:e,dpopKeys:t}}async logout(r){let e=d(r);return await this.credentialBackend.remove(e),{success:!0,host:e}}async listAuthenticated(){return this.credentialBackend.list()}async discover(r){for(let e of[`https://${r}/.well-known/oauth-authorization-server`,`https://${r}/.well-known/openid-configuration`])try{let t=await fetch(e);if(!t.ok)continue;let o=await t.json();return{issuer:w(o.issuer),authorizationEndpoint:w(o.authorization_endpoint),tokenEndpoint:w(o.token_endpoint),registrationEndpoint:w(o.registration_endpoint),revocationEndpoint:w(o.revocation_endpoint),dpopSigningAlgValuesSupported:I(o.dpop_signing_alg_values_supported),codeChallengeMethodsSupported:I(o.code_challenge_methods_supported)}}catch{continue}return null}async registerClient(r){try{let e=await fetch(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak Browser",redirect_uris:[this.callbackUrl],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})});if(!e.ok)return null;let t=await e.json(),o=t.client_id;return o?{clientId:o,clientSecret:t.client_secret}:null}catch{return null}}openAuthPopup(r,e){return new Promise(t=>{let o=window.open(r,"kanonak-auth","width=500,height=700,menubar=no,toolbar=no,location=yes,status=no");if(!o){t(null);return}let a=setTimeout(()=>{i(),t(null)},tr),s=c=>{c.origin===window.location.origin&&(!c.data||c.data.type!=="kanonak-auth-callback"||(i(),t({code:c.data.code??void 0,state:c.data.state??void 0,error:c.data.error??void 0})))},l=setInterval(()=>{o.closed&&(i(),t(null))},500),i=()=>{clearTimeout(a),clearInterval(l),window.removeEventListener("message",s);try{o.close()}catch{}};window.addEventListener("message",s)})}async exchangeCode(r,e,t,o,a,s,l){let i=new URLSearchParams({grant_type:"authorization_code",client_id:e,code:o,redirect_uri:a,code_verifier:s});t&&i.set("client_secret",t);let c={"Content-Type":"application/x-www-form-urlencoded"};l&&(c.DPoP=await K(l,"POST",r));try{let m=await fetch(r,{method:"POST",headers:c,body:i.toString()});if(!m.ok)return null;let p=await m.json();return{accessToken:p.access_token,refreshToken:p.refresh_token,expiresIn:typeof p.expires_in=="number"?p.expires_in:void 0}}catch{return null}}};function nr(){let n=new Uint8Array(32);return crypto.getRandomValues(n),B(n.buffer)}async function or(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return B(e)}function sr(){let n=new Uint8Array(16);return crypto.getRandomValues(n),B(n.buffer)}function ir(n,r,e,t,o){let a=new URLSearchParams({client_id:r,response_type:"code",redirect_uri:e,state:t,code_challenge:o,code_challenge_method:"S256"});return`${n}?${a}`}function B(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function w(n){return typeof n=="string"?n:null}function I(n){return Array.isArray(n)?n.filter(r=>typeof r=="string"):null}export{Ne as AmbiguousReferenceRule,se as BooleanStatement,g as BrowserCredentialBackend,S as BrowserOAuthFlow,Fe as ClassDefinitionRule,Ie as ClassHierarchyCycleRule,X as DefinedKanonak,Me as DefinitionPropertyReferenceRule,ge as EdgeType,Y as EmbeddedKanonak,je as EmbeddedKanonakTypeRule,ae as EmbeddedStatement,me as GraphBuilder,F as HttpKanonakDocumentRepository,ve as ImportExistenceRule,H as InMemoryKanonakDocumentRepository,Ue as InstancePropertyReferenceRule,G as Kanonak,we as KanonakDocumentPositions,pe as KanonakObjectParser,Xe as KanonakObjectValidator,q as KanonakParser,Z as KanonakUri,ke as KanonakUriBuilder,ce as ListStatement,Ge as MarkdownLinkRule,le as MarkdownStatement,$e as NamespaceImportCycleRule,De as NamespacePrefixRule,fe as NodeType,oe as NumberStatement,He as ObjectPropertyImportRule,qe as ObjectPropertyValueValidationRule,Se as OntologyValidationError,Ke as OntologyValidationResult,Le as PropertyDomainRule,Ae as PropertyHierarchyCycleRule,Pe as PropertyMetadata,Je as PropertyRangeReferenceRule,Te as PropertyRangeRequiredRule,Ce as PropertyTypeSpecificityRule,We as PropertyValueTypeRule,L as PublisherConfigResolver,W as PublisherIndex,ee as ReferenceKanonak,ie as ReferenceStatement,Be as ResourceNamingRule,ue as ResourceResolver,ye as ResourceTypeClassifier,te as ScalarStatement,re as Statement,ne as StringStatement,Oe as SubClassOfReferenceRule,Ve as SubPropertyOfReferenceRule,Q as SubjectKanonak,Ee as SubjectKanonakTypeRequiredRule,de as TypeResolver,_e as UnresolvedReferenceRule,Re as ValidationContext,xe as ValidationSeverity,ze as XsdImportRule,x as browserServerSupportsDPoP,Ye as buildOntologyModel,O as compareVersions,K as createBrowserDPoPProof,U as createVersion,Qe as findDerivation,be as findInstancesByType,$ as formatVersion,k as generateBrowserDPoPKeyPair,_ as generateBrowserDPoPKeys,E as hasValidToken,b as importDPoPKeys,z as isCompatibleVersion,C as isExpired,N as isMajorCompatible,d as normalizeHost,M as parseVersionString,he as parseWithPositions,J as pickHighestDocument,V as versionsEqual};

package/dist/chunk-VIM6XICU.js

@@ -0,0 +1,2 @@
+import{c as V,f as N}from"./chunk-G2DKKSZ4.js";import{a as b,d as S}from"./chunk-BGQKZBNE.js";import{a as w,f as _,i as D,j as x,l as F}from"./chunk-CRKSKIAL.js";import{c as E,d as B}from"./chunk-W6T7MOKY.js";import{a as L}from"./chunk-FUUTGGJS.js";import{d as G}from"./chunk-2ACBWC7K.js";var z=(n=>(n.Class="Class",n.DatatypeProperty="DatatypeProperty",n.ObjectProperty="ObjectProperty",n.AnnotationProperty="AnnotationProperty",n.Instance="Instance",n.Datatype="Datatype",n.Unknown="Unknown",n))(z||{}),W=(s=>(s.InstanceOf="instanceOf",s.SubClassOf="subClassOf",s.Domain="domain",s.Range="range",s.ObjectRelationship="objectRelationship",s.SubPropertyOf="subPropertyOf",s.PropertyValue="propertyValue",s.EmbeddedLink="embeddedLink",s))(W||{}),v=class{static async buildFromRepository(t){let i=await new N().parseKanonaks(t),a=await t.getAllDocumentsAsync(),p=[],o=[],n=new Set,s=new Set,l=new Map;for(let y of i){let f=y;f.name&&(b.isClassType(f)&&n.add(f.name),(b.isObjectPropertyType(f)||b.isGenericPropertyType(f))&&s.add(f.name))}for(let y of a)for(let[f,u]of Object.entries(y.body))s.has(f)&&u?.range&&typeof u.range=="string"&&l.set(f,u.range);let g=new Map;for(let y of i){let f=y;f.name&&g.set(f.name,f)}for(let y of a){let f=y.metadata.namespace_,u=f?`${f.publisher}/${f.package_}`:"",c=f?.version?`${f.version.major}.${f.version.minor}.${f.version.patch}`:"",d=Y(y);for(let[m,k]of Object.entries(y.body)){if(!k||typeof k!="object")continue;let P=g.get(m),h="Unknown";if(P){let T=P;b.isClassType(T)?h="Class":b.isObjectPropertyType(T)?h="ObjectProperty":b.isDatatypePropertyType(T)?h="DatatypeProperty":b.isAnnotationPropertyType(T)?h="AnnotationProperty":b.isDatatypeType(T)?h="Datatype":b.isGenericPropertyType(T)?h="ObjectProperty":b.isInstanceOfKnownClass(T,n)&&(h="Instance")}let j=u&&c?`${u}/${m}@${c}`:m,M={};for(let[T,$]of Object.entries(k))T!=="type"&&(typeof $!="object"||$===null)&&(M[T]=$);p.push({id:j,label:k.label??m,type:h,namespace:u,properties:M}),q(j,k,h,n,s,o,u,c,d),U(j,k,s,l,p,o,u,c,d),re(j,P,o)}}return{nodes:p,edges:o}}static buildFromDocument(t){let r=[],i=[],a=t.metadata.namespace_,p=a?.version?`${a.version.major}.${a.version.minor}.${a.version.patch}`:"",o=a?`${a.publisher}/${a.package_}`:"",n=new Set,s=new Set,l=new Map,g=Y(t);for(let[u,c]of Object.entries(t.body)){let d=c?.type;d&&(te(d,g)&&n.add(u),ne(d,g)&&(s.add(u),c.range&&typeof c.range=="string"&&l.set(u,c.range)))}for(let[u,c]of Object.entries(t.body)){if(!c||typeof c!="object")continue;let d=c.type,m=oe(d,u,n,g),k=o&&p?`${o}/${u}@${p}`:u,P={};for(let[h,j]of Object.entries(c))h!=="type"&&(typeof j!="object"||j===null)&&(P[h]=j);r.push({id:k,label:c.label??u,type:m,namespace:o,properties:P}),q(k,c,m,n,s,i,o,p,g),U(k,c,s,l,r,i,o,p,g)}let y=new Set(r.map(u=>u.id)),f=i.filter(u=>y.has(u.source)&&y.has(u.target));return{nodes:r,edges:f}}};function Y(e,t){let r=new Map;if(e.metadata?.imports)for(let[i,a]of Object.entries(e.metadata.imports))for(let p of a){let o=p.alias??p.packageName,n=p.version,s=`${n.major}.${n.minor}.${n.patch}`;r.set(o,{publisher:i,package_:p.packageName,version:s})}return r}var H={"kanonak.org/core-rdf/Class":"Class","kanonak.org/core-owl/Class":"Class","kanonak.org/core-rdfs/Class":"Class","kanonak.org/core-owl/ObjectProperty":"ObjectProperty","kanonak.org/core-owl/DatatypeProperty":"DatatypeProperty","kanonak.org/core-owl/AnnotationProperty":"AnnotationProperty","kanonak.org/core-rdf/Property":"ObjectProperty","kanonak.org/core-rdfs/Datatype":"Datatype"},ee=new Set(["kanonak.org/core-owl/ObjectProperty","kanonak.org/core-owl/DatatypeProperty","kanonak.org/core-owl/AnnotationProperty","kanonak.org/core-rdf/Property"]);function I(e,t){if(e.includes(".")){let r=e.indexOf("."),i=e.substring(0,r),a=e.substring(r+1),p=t.get(i);if(p)return`${p.publisher}/${p.package_}/${a}`}return null}function te(e,t){let r=I(e,t);return r?H[r]==="Class":!1}function ne(e,t){let r=I(e,t);return r?ee.has(r):!1}function oe(e,t,r,i){if(!e||e==="Package")return"Unknown";let a=I(e,i);if(a){let o=H[a];if(o)return o;let n=a.split("/").pop()?.split("@")[0]??"";return r.has(n)?"Instance":"Unknown"}let p=e.split(".").pop()??e;return r.has(p)?"Instance":"Unknown"}var X=new Set(["type","label","comment","version","publisher","imports","license","match","alias","package"]);function q(e,t,r,i,a,p,o,n,s){let l=t.type,g=t.subClassOf;if(g){let c=Array.isArray(g)?g:[g];for(let d of c)typeof d=="string"&&p.push({source:e,target:O(d,o,n,s),type:"subClassOf",label:"subClassOf"})}let y=t.subPropertyOf;if(y){let c=Array.isArray(y)?y:[y];for(let d of c)typeof d=="string"&&p.push({source:e,target:O(d,o,n,s),type:"subPropertyOf",label:"subPropertyOf"})}if(r==="Instance"&&l){let c=l.split(".").pop()??l;p.push({source:e,target:O(c,o,n,s),type:"instanceOf",label:"type"})}if(r==="Instance")for(let[c,d]of Object.entries(t)){if(X.has(c)||!a.has(c))continue;let m=Array.isArray(d)?d:[d];for(let k of m)typeof k=="string"&&se(k)&&p.push({source:e,target:O(k,o,n,s),type:"propertyValue",label:c,propertyId:O(c,o,n,s)})}let f=r==="ObjectProperty"||r==="DatatypeProperty",u=t.domain&&t.range;if((f||u)&&t.domain&&t.range){let c=typeof t.domain=="string"?t.domain:null,d=typeof t.range=="string"?t.range:null;c&&d&&p.push({source:O(c,o,n,s),target:O(d,o,n,s),type:"objectRelationship",label:t.label??e.split("/").pop()??"",propertyId:e})}}function U(e,t,r,i,a,p,o,n,s){for(let[l,g]of Object.entries(t)){if(X.has(l)||typeof g!="object"||g===null||Array.isArray(g))continue;let y=g,f=`${e}/${l}`,u=i.get(l),c=u?u.split(".").pop()??u:"Unknown",d={};for(let[k,P]of Object.entries(y))(typeof P!="object"||P===null)&&(d[k]=P);a.push({id:f,label:`${c} (embedded)`,type:"Instance",namespace:o,properties:d});let m=o&&n?`${o}/${l}@${n}`:l;p.push({source:e,target:f,type:"propertyValue",label:l,propertyId:r.has(l)?m:void 0}),u&&p.push({source:f,target:O(c,o,n,s),type:"instanceOf",label:"type (inferred)"}),U(f,y,r,i,a,p,o,n,s)}}function re(e,t,r){let i=t?.statement;if(Array.isArray(i))for(let a of i){if(!(a instanceof V))continue;let p=a.predicate?.subject?.name??"";for(let o of a.links){let n=o.target?.subject;if(!n)continue;let s=n.version,l=s&&typeof s.major=="number"?`@${s.major}.${s.minor}.${s.patch}`:"";r.push({source:e,target:`${n.publisher}/${n.package_}/${n.name}${l}`,type:"embeddedLink",label:p})}}}function se(e){return!(!e||e.includes(" ")||e.includes(`
+`)||e.startsWith("http://")||e.startsWith("https://")||/^\d{4}-\d{2}/.test(e)||/^\d+(\.\d+)?$/.test(e))}function O(e,t,r,i){if(e.includes("@")&&e.includes("/"))return e;if(e.includes(".")){let a=e.indexOf("."),p=e.substring(0,a),o=e.substring(a+1);if(i){let n=i.get(p);if(n)return`${n.publisher}/${n.package_}/${o}@${n.version}`}return t&&r?`${t}/${o}@${r}`:o}return t&&r?`${t}/${e}@${r}`:e}function ae(e){if(!e.expiresAt)return!1;let t=new Date(e.expiresAt),r=300*1e3;return t.getTime()<=Date.now()+r}function Oe(e){return!!e.accessToken&&!ae(e)}function we(e){let t=e.replace(/^https?:\/\//,"").replace(/^git:\/\//,"").replace(/\/+$/,"").trim();if(!t)throw new Error("Publisher host cannot be empty");return t}var R="kanonak.org",C="core-rdf",ie="core-xsd",pe={publisher:R,package_:C,name:"domain"},ce={publisher:R,package_:C,name:"range"},J={publisher:R,package_:C,name:"subClassOf"},Q={publisher:R,package_:C,name:"label"},Z={publisher:R,package_:C,name:"comment"},le=new L(R,C,"Resource"),K=e=>e;function A(e,t){let r=x(e,t);if(r)return[r];let i=[];for(let a of F(e,t))a instanceof B&&i.push(a.subject);return i}function fe(e,t,r){let i=new Set([w(t)]);if(!r)return i;i.add(w(le));let a=new Set,p=[t];for(;p.length>0;){let o=p.shift(),n=w(o);if(a.has(n))continue;a.add(n),i.add(n);let s=_(e,o);s&&p.push(...A(s,J))}return i}function ue(e,t,r){let i=_(e,t);if(i){let a=K(i);if(b.isClassType(a))return{kind:"class",uri:S(i)??t,localName:i.name};if(b.isDatatypeType(a))return{kind:"datatype",uri:t}}return t.publisher===R&&t.package_===ie?{kind:"datatype",uri:t}:r==="datatype"?{kind:"datatype",uri:t}:{kind:"class",uri:t,localName:t.name}}function de(e){let t=K(e);return b.isObjectPropertyType(t)?"object":b.isDatatypePropertyType(t)?"datatype":"other"}function ye(e,t,r){let i=fe(e,t,r),a=[],p=new Set;for(let o of e){if(!(o instanceof E))continue;let n=K(o);if(!b.isAnyPropertyType(n)||!A(o,pe).some(k=>i.has(w(k))))continue;let l=S(o);if(!l)continue;let g=w(l);if(p.has(g))continue;p.add(g);let y=x(o,ce);if(!y)throw new Error(`Property ${l.publisher}/${l.package_}/${l.name} has no rdfs.range; every property must declare a range. Validate the ontology before introspecting it.`);let f=de(o),u=ue(e,y,f),c=f==="object"?"object":f==="datatype"?"datatype":u.kind==="class"?"object":"datatype",d=D(o,Q),m=D(o,Z);a.push({uri:l,localName:l.name,kind:c,range:u,...d!==void 0?{label:d}:{},...m!==void 0?{comment:m}:{}})}return a}async function ge(e,t,r){let i=e.metadata?.namespace_;if(!i)throw new Error("buildOntologyModel: document has no namespace (publisher/package/version).");let a=r?.includeInherited??!1,p=await new N().parseKanonaks(t),o=[],n=new Set;for(let s of p){if(!(s instanceof E)||!b.isClassType(K(s)))continue;let l=S(s);if(!l||l.publisher!==i.publisher||l.package_!==i.package_||l.version&&i.version&&!G(l.version,i.version))continue;let g=w(l);if(n.has(g))continue;n.add(g);let y=A(s,J).map(c=>({uri:c,localName:c.name})),f=D(s,Q),u=D(s,Z);o.push({uri:l,localName:l.name,superClasses:y,properties:ye(p,l,a),...f!==void 0?{label:f}:{},...u!==void 0?{comment:u}:{}})}return{classes:o}}export{z as a,W as b,v as c,ae as d,Oe as e,we as f,ge as g};

package/dist/index.js

@@ -1,12 +1,12 @@
-import{a as hn,b as bn,c as Pn,d as wn,e as $e}from"./chunk-FX7JDGL6.js";import{a as pr,c as De,e as Ye,h as Ze,i as Qe,j as dr}from"./chunk-X5TYWQRA.js";import{a as yn,b as gn,c as kn,d as Y,e as Z,f as u}from"./chunk-Y7TGQ7UF.js";import{a as ur}from"./chunk-F5ANO7MJ.js";import"./chunk-QHABFCRC.js";import{a as Ht,b as zt,c as Wt,d as Gt,e as Jt,f as Qt,g as en,h as tn}from"./chunk-ATH6636H.js";import{b as qt,c as Xt,d as Zt}from"./chunk-LKBG2MK6.js";import{a as Ft}from"./chunk-4NO7MHS7.js";import{a as Rn,b as Cn,c as En,d as vn}from"./chunk-GN2XODVC.js";import{a as Kn,b as Dn}from"./chunk-PEUTCG3B.js";import{a as In}from"./chunk-PEJALHXK.js";import{a as Yt}from"./chunk-SC5M74NM.js";import{A as ir,B as sr,C as cr,G as lr,a as An,b as On,c as Tn,d as Vn,e as Un,f as Nn,g as _n,h as Ln,i as Mn,j as Fn,k as Hn,l as zn,m as Wn,n as Gn,o as Jn,p as qn,q as Xn,r as Yn,s as Zn,t as Qn,u as er,v as tr,w as nr,x as rr,y as or,z as ar}from"./chunk-C7RZIMEH.js";import"./chunk-SHDHMKMJ.js";import{a as b,b as Re,c as an,d as mn,e as fn,f as C}from"./chunk-G2DKKSZ4.js";import{a as A}from"./chunk-TJPQETHV.js";import{a as P,b as je,c as xn,d,e as $n,f as jn,g as Bn}from"./chunk-BGQKZBNE.js";import{a as E,f as v,i as T,j as w,k as Be,l as V,m as Xe}from"./chunk-CRKSKIAL.js";import{b as sn,c as cn,d as O,e as ln,f as un,h as pn,j as dn}from"./chunk-IOMNZBK4.js";import{a as nn,b as we,c as m,d as y,e as rn,f as on,g as Ce,h as Ee,i as ve,j as Ke,k as xe,l as Ie}from"./chunk-W6T7MOKY.js";import{a as Se}from"./chunk-FUUTGGJS.js";import{a as Vt,b as be,c as X,d as Pe,e as R,f as Ut,g as Nt,h as _t,i as Lt,j as Mt}from"./chunk-2ACBWC7K.js";import{a as Sn}from"./chunk-ODIECDN7.js";import{VersionOperator as Oi}from"@kanonak-protocol/types/document/models/enums";import{existsSync as $r,readFileSync as jr}from"fs";import{homedir as Br}from"os";import{join as Dr}from"path";import{execFile as mr}from"child_process";import{promisify as fr}from"util";var Q=fr(mr),ee="kanonak",te="/usr/bin/security",U=class{async get(e){let t=u(e);try{let{stdout:r}=await Q(te,["find-generic-password","-s",ee,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(r.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
-  Run 'kanonak logout ${t}' then 'kanonak login ${t}' to fix.`)}}catch(r){if(et(r,44))return null;throw new Error(`macOS Keychain read failed for '${t}': ${ne(r)}
+import{a as sr,b as cr,c as lr,d as ur,e as ye}from"./chunk-FX7JDGL6.js";import{a as en,c as be,e as Oe,h as Ne,i as Ue,j as tn}from"./chunk-X5TYWQRA.js";import{a as or,b as ir,c as ar,d as U,e as _,f as l,g as rn}from"./chunk-VIM6XICU.js";import{a as Qr}from"./chunk-F5ANO7MJ.js";import"./chunk-QHABFCRC.js";import{a as Bt,b as At,c as Vt,d as Dt,e as Tt,f as Lt,g as Ft,h as Mt}from"./chunk-ATH6636H.js";import{b as Ot,c as Nt,d as _t}from"./chunk-LKBG2MK6.js";import{a as jt}from"./chunk-4NO7MHS7.js";import{a as pr,b as mr,c as fr,d as yr}from"./chunk-GN2XODVC.js";import{a as gr,b as Sr}from"./chunk-PEUTCG3B.js";import{a as kr}from"./chunk-PEJALHXK.js";import{a as Ut}from"./chunk-SC5M74NM.js";import{A as qr,B as Yr,C as Zr,G as Xr,a as Rr,b as Er,c as vr,d as Cr,e as xr,f as Kr,g as $r,h as Ir,i as jr,j as Br,k as Ar,l as Vr,m as Dr,n as Tr,o as Or,p as Nr,q as Ur,r as _r,s as Lr,t as Fr,u as Mr,v as Hr,w as zr,x as Wr,y as Gr,z as Jr}from"./chunk-C7RZIMEH.js";import"./chunk-SHDHMKMJ.js";import{a as y,b as ce,c as Jt,d as tr,e as rr,f as E}from"./chunk-G2DKKSZ4.js";import{a as S}from"./chunk-TJPQETHV.js";import{a as nr,b as ge,c as hr,d as g,e as br,f as Pr,g as wr}from"./chunk-BGQKZBNE.js";import{f as N,j as v,k as he,l as ke,m as Te}from"./chunk-CRKSKIAL.js";import{b as qt,c as Yt,d as R,e as Zt,f as Xt,h as Qt,j as er}from"./chunk-IOMNZBK4.js";import{a as Ht,b as se,c as f,d as k,e as Wt,f as Gt,g as le,h as ue,i as de,j as pe,k as me,l as fe}from"./chunk-W6T7MOKY.js";import{a as zt}from"./chunk-FUUTGGJS.js";import{a as Et,b as ae,c as O,d as vt,e as h,f as Ct,g as xt,h as Kt,i as $t,j as It}from"./chunk-2ACBWC7K.js";import{a as dr}from"./chunk-ODIECDN7.js";import{VersionOperator as sa}from"@kanonak-protocol/types/document/models/enums";import{existsSync as wn,readFileSync as Sn}from"fs";import{homedir as Rn}from"os";import{join as En}from"path";import{execFile as nn}from"child_process";import{promisify as on}from"util";var L=on(nn),F="kanonak",M="/usr/bin/security",C=class{async get(e){let t=l(e);try{let{stdout:n}=await L(M,["find-generic-password","-s",F,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(n.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
+  Run 'kanonak logout ${t}' then 'kanonak login ${t}' to fix.`)}}catch(n){if(_e(n,44))return null;throw new Error(`macOS Keychain read failed for '${t}': ${H(n)}
   The Keychain may be locked or inaccessible.
-  Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,t){let r=u(e),o=JSON.stringify(t);try{await Q(te,["add-generic-password","-s",ee,"-a",r,"-U","-w",o],{timeout:1e4})}catch(a){throw new Error(`macOS Keychain write failed for '${r}': ${ne(a)}
+  Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,t){let n=l(e),o=JSON.stringify(t);try{await L(M,["add-generic-password","-s",F,"-a",n,"-U","-w",o],{timeout:1e4})}catch(i){throw new Error(`macOS Keychain write failed for '${n}': ${H(i)}
   Ensure the Keychain is unlocked and the CLI has write permission.
-  On managed devices, your IT policy may block credential storage.`)}}async remove(e){let t=u(e);try{await Q(te,["delete-generic-password","-s",ee,"-a",t],{timeout:1e4})}catch(r){if(et(r,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${t}': ${ne(r)}
-  The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await Q(te,["dump-keychain"],{timeout:1e4}),t=[],r=!1;for(let o of e.split(`
-`))if(o.includes(`"svce"<blob>="${ee}"`)&&(r=!0),r&&o.includes('"acct"<blob>=')){let a=o.match(/"acct"<blob>="([^"]+)"/);a&&t.push(a[1]),r=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${ne(e)}`),[]}}};function et(n,e){return typeof n=="object"&&n!==null&&"code"in n&&n.code===e}function ne(n){return n instanceof Error?n.message:String(n)}import{execFile as yr}from"child_process";import{promisify as gr}from"util";var kr=gr(yr),re="kanonak:",N=class{async get(e){let t=re+u(e),r=`
-${ae}
+  On managed devices, your IT policy may block credential storage.`)}}async remove(e){let t=l(e);try{await L(M,["delete-generic-password","-s",F,"-a",t],{timeout:1e4})}catch(n){if(_e(n,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${t}': ${H(n)}
+  The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await L(M,["dump-keychain"],{timeout:1e4}),t=[],n=!1;for(let o of e.split(`
+`))if(o.includes(`"svce"<blob>="${F}"`)&&(n=!0),n&&o.includes('"acct"<blob>=')){let i=o.match(/"acct"<blob>="([^"]+)"/);i&&t.push(i[1]),n=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${H(e)}`),[]}}};function _e(r,e){return typeof r=="object"&&r!==null&&"code"in r&&r.code===e}function H(r){return r instanceof Error?r.message:String(r)}import{execFile as an}from"child_process";import{promisify as sn}from"util";var cn=sn(an),z="kanonak:",x=class{async get(e){let t=z+l(e),n=`
+${G}
 $target = [Console]::In.ReadLine()
 $ptr = [IntPtr]::Zero
 $result = [CredMan]::CredRead($target, 1, 0, [ref]$ptr)
@@ -18,8 +18,8 @@ try {
   [System.Text.Encoding]::Unicode.GetString($bytes)
 } finally {
   [CredMan]::CredFree($ptr)
-}`;try{let{stdout:o}=await oe(r,t),a=o.trim();return a?JSON.parse(a):null}catch{return null}}async store(e,t){let r=re+u(e),o=JSON.stringify(t),a=`
-${ae}
+}`;try{let{stdout:o}=await W(n,t),i=o.trim();return i?JSON.parse(i):null}catch{return null}}async store(e,t){let n=z+l(e),o=JSON.stringify(t),i=`
+${G}
 $target = [Console]::In.ReadLine()
 $json = [Console]::In.ReadLine()
 $bytes = [System.Text.Encoding]::Unicode.GetBytes($json)
@@ -35,13 +35,13 @@ try {
   if (-not $result) { throw "CredWrite failed" }
 } finally {
   [System.Runtime.InteropServices.Marshal]::FreeHGlobal($cred.CredentialBlob)
-}`;try{await oe(a,`${r}
-${o}`)}catch(i){throw new Error(`Windows Credential Manager write failed: ${String(i)}`)}}async remove(e){let t=re+u(e),r=`
-${ae}
+}`;try{await W(i,`${n}
+${o}`)}catch(a){throw new Error(`Windows Credential Manager write failed: ${String(a)}`)}}async remove(e){let t=z+l(e),n=`
+${G}
 $target = [Console]::In.ReadLine()
-[CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await oe(r,t)}catch{}}async list(){let e=`
-${ae}
-${hr}
+[CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await W(n,t)}catch{}}async list(){let e=`
+${G}
+${ln}
 $prefix = [Console]::In.ReadLine()
 $count = 0
 $pCreds = [IntPtr]::Zero
@@ -55,8 +55,8 @@ if ([CredMan]::CredEnumerate($null, 0, [ref]$count, [ref]$pCreds)) {
     }
   }
   [CredMan]::CredFree($pCreds)
-}`;try{let{stdout:t}=await oe(e,re);return t.trim().split(`
-`).map(r=>r.trim()).filter(Boolean)}catch{return[]}}};async function oe(n,e){for(let t of["pwsh","powershell"])try{return await kr(t,["-NoProfile","-NonInteractive","-Command",n],{timeout:15e3,...e!==void 0&&{input:e}})}catch(r){if(t==="powershell")throw r}throw new Error("Neither pwsh nor powershell found")}var ae=`
+}`;try{let{stdout:t}=await W(e,z);return t.trim().split(`
+`).map(n=>n.trim()).filter(Boolean)}catch{return[]}}};async function W(r,e){for(let t of["pwsh","powershell"])try{return await cn(t,["-NoProfile","-NonInteractive","-Command",r],{timeout:15e3,...e!==void 0&&{input:e}})}catch(n){if(t==="powershell")throw n}throw new Error("Neither pwsh nor powershell found")}var G=`
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -87,13 +87,13 @@ public class CredMan {
   [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
   public static extern bool CredEnumerate(string filter, int flags, out int count, out IntPtr credentials);
 }
-"@`,hr="";import{execFile as br,spawn as Pr}from"child_process";import{promisify as wr}from"util";var se=wr(br),ie="kanonak",_=class{async get(e){let t=u(e);try{let{stdout:r}=await se("secret-tool",["lookup","service",ie,"publisher",t],{timeout:1e4}),o=r.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let r=u(e),o=JSON.stringify(t);await new Promise((a,i)=>{let s=Pr("secret-tool",["store","--label",`Kanonak: ${r}`,"service",ie,"publisher",r],{stdio:["pipe","ignore","ignore"],timeout:1e4});s.stdin.write(o),s.stdin.end(),s.on("close",c=>{c===0?a():i(new Error(`secret-tool store exited with code ${c}`))}),s.on("error",i)})}async remove(e){let t=u(e);try{await se("secret-tool",["clear","service",ie,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await se("secret-tool",["search","service",ie],{timeout:1e4}),t=[];for(let r of e.split(`
-`)){let o=r.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function Ae(){try{return await se("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as tt,mkdirSync as nt,readFileSync as rt,writeFileSync as ot}from"fs";import{createCipheriv as Sr,createDecipheriv as Rr,randomBytes as at}from"crypto";import{homedir as Cr}from"os";import{join as Ve,dirname as it}from"path";var ct=Ve(Cr(),".config","kanonak"),L=Ve(ct,"keyring.key"),ce=Ve(ct,"credentials.enc"),st="aes-256-gcm",Oe=32,I=12,Te=16,M=class{async get(e){let t=this.loadStore(),r=u(e);return t[r]??null}async store(e,t){let r=this.loadStore(),o=u(e);r[o]=t,this.saveStore(r)}async remove(e){let t=this.loadStore(),r=u(e);delete t[r],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!tt(ce))return{};try{let e=this.getOrCreateKey(),t=rt(ce);if(t.length<I+Te)return{};let r=t.subarray(0,I),o=t.subarray(I,I+Te),a=t.subarray(I+Te),i=Rr(st,e,r);i.setAuthTag(o);let s=Buffer.concat([i.update(a),i.final()]);return JSON.parse(s.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),r=at(I),o=Sr(st,t,r),a=Buffer.from(JSON.stringify(e),"utf-8"),i=Buffer.concat([o.update(a),o.final()]),s=o.getAuthTag(),c=Buffer.concat([r,s,i]);nt(it(ce),{recursive:!0}),ot(ce,c,{mode:384})}getOrCreateKey(){if(tt(L)){let t=rt(L);if(t.length!==Oe)throw new Error(`Credential keyring key is corrupted (expected ${Oe} bytes, got ${t.length}). Delete ${L} and re-authenticate.`);return t}let e=at(Oe);return nt(it(L),{recursive:!0}),ot(L,e,{mode:384}),e}};import{execFile as Er}from"child_process";import{promisify as vr}from"util";var Kr=vr(Er),lt=3e4,F=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=u(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(r){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${le(r)}
+"@`,ln="";import{execFile as un,spawn as dn}from"child_process";import{promisify as pn}from"util";var q=pn(un),J="kanonak",K=class{async get(e){let t=l(e);try{let{stdout:n}=await q("secret-tool",["lookup","service",J,"publisher",t],{timeout:1e4}),o=n.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let n=l(e),o=JSON.stringify(t);await new Promise((i,a)=>{let s=dn("secret-tool",["store","--label",`Kanonak: ${n}`,"service",J,"publisher",n],{stdio:["pipe","ignore","ignore"],timeout:1e4});s.stdin.write(o),s.stdin.end(),s.on("close",c=>{c===0?i():a(new Error(`secret-tool store exited with code ${c}`))}),s.on("error",a)})}async remove(e){let t=l(e);try{await q("secret-tool",["clear","service",J,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await q("secret-tool",["search","service",J],{timeout:1e4}),t=[];for(let n of e.split(`
+`)){let o=n.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function Pe(){try{return await q("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as Le,mkdirSync as Fe,readFileSync as Me,writeFileSync as He}from"fs";import{createCipheriv as mn,createDecipheriv as fn,randomBytes as ze}from"crypto";import{homedir as yn}from"os";import{join as Re,dirname as We}from"path";var Je=Re(yn(),".config","kanonak"),$=Re(Je,"keyring.key"),Y=Re(Je,"credentials.enc"),Ge="aes-256-gcm",we=32,b=12,Se=16,I=class{async get(e){let t=this.loadStore(),n=l(e);return t[n]??null}async store(e,t){let n=this.loadStore(),o=l(e);n[o]=t,this.saveStore(n)}async remove(e){let t=this.loadStore(),n=l(e);delete t[n],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!Le(Y))return{};try{let e=this.getOrCreateKey(),t=Me(Y);if(t.length<b+Se)return{};let n=t.subarray(0,b),o=t.subarray(b,b+Se),i=t.subarray(b+Se),a=fn(Ge,e,n);a.setAuthTag(o);let s=Buffer.concat([a.update(i),a.final()]);return JSON.parse(s.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),n=ze(b),o=mn(Ge,t,n),i=Buffer.from(JSON.stringify(e),"utf-8"),a=Buffer.concat([o.update(i),o.final()]),s=o.getAuthTag(),c=Buffer.concat([n,s,a]);Fe(We(Y),{recursive:!0}),He(Y,c,{mode:384})}getOrCreateKey(){if(Le($)){let t=Me($);if(t.length!==we)throw new Error(`Credential keyring key is corrupted (expected ${we} bytes, got ${t.length}). Delete ${$} and re-authenticate.`);return t}let e=ze(we);return Fe(We($),{recursive:!0}),He($,e,{mode:384}),e}};import{execFile as gn}from"child_process";import{promisify as hn}from"util";var kn=hn(gn),qe=3e4,j=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=l(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(n){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${Z(n)}
   Verify the helper binary exists, is executable, and implements the Kanonak credential helper protocol.
-  Check the 'credentialHelper' path in ~/.kanonak/config.json.`)}}async store(e,t){let r=u(e);try{await this.runHelper("store",{publisher:r,credential:t})}catch(o){throw new Error(`Credential helper '${this.helperPath}' failed to store credential for '${r}': ${le(o)}
-  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=u(e);try{await this.runHelper("erase",{publisher:t})}catch(r){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${le(r)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${le(e)}`),[]}}async runHelper(e,t){try{let{stdout:r}=await Kr(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:lt});return r}catch(r){throw xr(r)?new Error(`Credential helper not found at '${this.helperPath}'.
-  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):Ir(r)?new Error(`Credential helper '${this.helperPath}' timed out after ${lt/1e3}s on '${e}'.
-  The helper may be waiting for authentication to an external vault.`):r}}};function le(n){return n instanceof Error?n.message:String(n)}function xr(n){return n instanceof Error&&"code"in n&&n.code==="ENOENT"}function Ir(n){return n instanceof Error&&"killed"in n&&n.killed}var Ue=Dr(Br(),".kanonak","config.json"),ue=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=Ar(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!Z(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=Or();return e.credentialHelper?new F(e.credentialHelper):process.platform==="darwin"?new U:process.platform==="win32"?new N:await Ae()?new _:new M}};function Ar(n){let t="KANONAK_TOKEN_"+u(n).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function Or(){if(!$r(Ue))return{};try{return JSON.parse(jr(Ue,"utf-8"))}catch(n){let e=n instanceof Error?n.message:String(n);return console.warn(`  Warning: Failed to parse ${Ue}: ${e}
-  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as Tr,createPrivateKey as Vr,generateKeyPairSync as Ur,randomUUID as Nr,sign as _r}from"crypto";function pt(){let{publicKey:n,privateKey:e}=Ur("ec",{namedCurve:"P-256"});return{publicKey:n.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function H(n,e,t,r,o,a){let i={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},s={jti:Nr(),htm:t.toUpperCase(),htu:r,iat:Math.floor(Date.now()/1e3)};return o&&(s.ath=Tr("sha256").update(o).digest("base64url")),a&&(s.nonce=a),Lr(i,s,n)}function dt(n){return!n||n.length===0?!1:n.some(e=>e.toUpperCase()==="ES256")}function Lr(n,e,t){let r=ut(JSON.stringify(n)),o=ut(JSON.stringify(e)),a=`${r}.${o}`,i=Vr({key:t,format:"jwk"}),c=_r("SHA256",Buffer.from(a),{key:i,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${a}.${c}`}function ut(n){return Buffer.from(n,"utf-8").toString("base64url")}function mt(n){let e=new Map;return async(t,r,o="GET")=>{if(!n)return fetch(t,{method:o});let a=await n.getCredential(r);if(!a?.accessToken)return fetch(t,{method:o});Y(a)&&console.warn(`  Warning: Access token for '${r}' is expired. Run 'kanonak login ${r}' to re-authenticate.`);let i={};if(a.dpopKeyPair){let c=e.get(r);try{let l=H(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,t,a.accessToken,c);i.Authorization=`DPoP ${a.accessToken}`,i.DPoP=l}catch(l){let p=l instanceof Error?l.message:String(l);console.error(`  Error: Failed to create DPoP proof for '${r}': ${p}
-  The stored key pair may be corrupted. Run 'kanonak login ${r}' to re-authenticate.`),i.Authorization=`Bearer ${a.accessToken}`}}else i.Authorization=`Bearer ${a.accessToken}`;let s=await fetch(t,{method:o,headers:i});if(s.status===401&&a.dpopKeyPair){let c=s.headers.get("DPoP-Nonce");if(c){e.set(r,c);try{let l=H(a.dpopKeyPair.privateKey,a.dpopKeyPair.publicKey,o,t,a.accessToken,c);i.DPoP=l,s=await fetch(t,{method:o,headers:i})}catch{}}}return s}}import{readFileSync as Mr,writeFileSync as Fr,existsSync as Hr}from"fs";import{createHash as zr}from"crypto";import ft from"js-yaml";var yt="kanonak.lock",Wr=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function gt(n=yt){if(!Hr(n))return null;let e=Mr(n,"utf-8"),t=ft.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function kt(n,e=yt){n.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(n.packages).sort())t[o]=n.packages[o];n.packages=t;let r=ft.dump(n,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Fr(e,Wr+r,"utf-8")}function ht(n){return`sha256:${zr("sha256").update(n).digest("hex")}`}import*as Le from"js-yaml";import{createHash as Gr}from"crypto";function Ne(n){let e=[];for(let r of n)r instanceof m&&e.push(Jr(r));return e.sort((r,o)=>r.uri<o.uri?-1:r.uri>o.uri?1:0),JSON.stringify({subjects:e})}function pe(n){let e=Ne(n);return`sha256:${Gr("sha256").update(e,"utf8").digest("hex")}`}function Jr(n){let e=eo(n),t=_e(n.statement);return{uri:e,statements:t}}function _e(n){let e=[];for(let t of n){let r=qr(t);r&&e.push(r)}return e.sort((t,r)=>t.predicate<r.predicate?-1:t.predicate>r.predicate?1:0),e}function qr(n){let e=Qr(n);if(!e)return;let t=Xr(n);if(t)return Zr(e,t)}function Xr(n){if(n instanceof Ce)return{type:"string",value:n.object};if(n instanceof Ee)return{type:"number",value:St(n.object)};if(n instanceof ve)return{type:"boolean",value:n.object};if(n instanceof Ke)return{type:"ref",value:Pt(n.object)};if(n instanceof xe){let e=n.object;return bt(e)}if(n instanceof Ie)return{type:"list",items:n.object.map(Yr)}}function bt(n){let e=_e(n.statement);return n.name&&n.name.length>0?{type:"embedded",name:n.name,statements:e}:{type:"embedded",statements:e}}function Yr(n){if(n instanceof y)return{type:"ref",value:Pt(n)};if(n instanceof b)return bt(n);if(n instanceof Re){let e=n.value;if(typeof e=="string")return{type:"string",value:e};if(typeof e=="number")return{type:"number",value:St(e)};if(typeof e=="boolean")return{type:"boolean",value:e}}if(n instanceof we)return{type:"embedded",statements:_e(n.statement)};throw new Error(`canonicalForm: list item of unrecognized kind (${n.constructor?.name??typeof n}); add canonicalization support before hashing data that contains it`)}function Zr(n,e){switch(e.type){case"string":return{predicate:n,type:"string",value:e.value};case"number":return{predicate:n,type:"number",value:e.value};case"boolean":return{predicate:n,type:"boolean",value:e.value};case"ref":return{predicate:n,type:"ref",value:e.value};case"embedded":return e.name!==void 0?{predicate:n,type:"embedded",name:e.name,statements:e.statements}:{predicate:n,type:"embedded",statements:e.statements};case"list":return{predicate:n,type:"list",items:e.items}}}function Qr(n){let e=n.predicate;if(e)return wt(e.subject)}function eo(n){let e=n.namespace??"",t=n.name??"";return`${e}/${t}`}function Pt(n){return wt(n.subject)}function wt(n){let e=n.version;return e&&typeof e.major=="number"?`${n.publisher}/${n.package_}@${e.major}.${e.minor}.${e.patch}/${n.name}`:`${n.publisher}/${n.package_}/${n.name}`}function St(n){if(Number.isNaN(n))throw new Error("canonicalForm: NaN cannot be canonicalized");if(!Number.isFinite(n))throw new Error("canonicalForm: \xB1Infinity cannot be canonicalized");return Object.is(n,-0)?"0":String(n)}import{VersionOperator as Rt}from"@kanonak-protocol/types/document/models/enums";var to="0.0.0",$=class{constructor(e,t=new A,r){this.repository=e;this.parser=t;this.objectParser=r??new C(this.parser)}repository;parser;objectParser;imports(){return new z}serializeValue(e,t){return vt(e,t)}async buildContentAddressed(e){let t=e.book.toImports(),r=await this.hashBody(e.publisher,t,e.body),o=Me(r),a={type:"EphemeralPackage",publisher:e.publisher,imports:t};e.contentHashProperty&&(a[e.contentHashProperty]=r),Object.assign(a,e.header??{}),a.imports=t;let i={[o]:a,...e.body},s=this.dump(i);return{yaml:s,byteCount:Et(s),contentHash:r,packageName:o,publisher:e.publisher,resourceCount:Object.keys(e.body).length}}async buildNamed(e){let t=e.book.toImports(),r={type:e.type??"Package",publisher:e.publisher,version:e.version,imports:t},o;e.contentHashProperty&&(o=await this.hashBody(e.publisher,t,e.body),r[e.contentHashProperty]=o),Object.assign(r,e.header??{}),r.imports=t;let a={[e.name]:r,...e.body},i=this.dump(a),s={yaml:i,byteCount:Et(i),packageName:e.name,publisher:e.publisher,resourceCount:Object.keys(e.body).length};return o!==void 0&&(s.contentHash=o),s}dump(e){return Le.dump(e,{lineWidth:-1})}async hashBody(e,t,r){let o={[Ct]:{type:"EphemeralPackage",publisher:e,imports:t},...r},a=this.parser.parse(Le.dump(o,{lineWidth:-1})),i=a.metadata.namespace_?.toString(),c=(await this.objectParser.parseKanonaks(new Xe(a,this.repository))).filter(l=>l instanceof m&&l.namespace===i&&l.name!==Ct);for(let l of c)l.namespace="ephemeral";return pe(c)}},Ct="__pkgbuilder_probe__";function Et(n){return new TextEncoder().encode(n).length}function Me(n){let e="sha256:",t=n.startsWith(e)?e.length:0;return`q-${n.slice(t,t+16)}`}var z=class{byKey=new Map;aliases=new Set;ensure(e,t,r,o,a=Rt.Major){let i=`${e}/${t}@${r}`,s=this.byKey.get(i);if(s)return s.alias;let c=this.uniqueAlias(o);return this.byKey.set(i,{publisher:e,package_:t,version:r,alias:c,match:a}),c}ref(e){if(!e.version||typeof e.version.major!="number")throw new Error(`Cannot serialize a reference to ${e.publisher}/${e.package_}/${e.name} without a version.`);return`${this.ensure(e.publisher,e.package_,R(e.version),e.package_)}.${e.name}`}refLatest(e,t,r,o){return`${this.ensure(e,t,to,o??t,Rt.Any)}.${r}`}toImports(){let e=new Map;for(let r of this.byKey.values()){let o=e.get(r.publisher)??[];o.push(r),e.set(r.publisher,o)}return[...e.keys()].sort().map(r=>({publisher:r,packages:e.get(r).sort((o,a)=>o.package_<a.package_?-1:1).map(o=>({package:o.package_,match:be(o.match),version:o.version,alias:o.alias}))}))}uniqueAlias(e){let t=W(e)||"pkg",r=t,o=2;for(;this.aliases.has(r);)r=`${t}${o++}`;return this.aliases.add(r),r}};function vt(n,e){if(n!=null){if(typeof n=="string"||typeof n=="number"||typeof n=="boolean")return n;if(n instanceof y)return e.ref(n.subject);if(Array.isArray(n)){let t=n.map(r=>vt(r,e)).filter(r=>r!==void 0);return t.length>0?t:void 0}if(n instanceof b)throw new Error("Embedded values are not yet supported by PackageBuilder. Produce a literal or a reference, or compose the embedded shape into the output class.");if(no(n))throw new Error(`Value produced a bare URI without a version (${n.publisher}/${n.package_}/${n.name}); cannot serialize it as a reference.`)}}function W(n){return n.replace(/[^A-Za-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}function no(n){return typeof n=="object"&&n!==null&&typeof n.publisher=="string"&&typeof n.package_=="string"&&typeof n.name=="string"}var de=class{constructor(e){this.producers=e}producers;produced=new Map;producerFor(e,t){return this.producers.find(r=>r.canProduce(e,t))}async produceCached(e,t,r,o){let a=`${t}/${r}@${R(o)}`,i=this.produced.get(a);if(i)return i;let{document:s}=await e.produce(t,r,o);return this.produced.set(a,s),s}async getHighestCompatibleVersionAsync(e,t){let r=this.producerFor(e,t.packageName);if(!r)return null;let o={operator:t.versionOperator,version:t.version},a=await r.resolveVersion(e,t.packageName,o);return a?this.produceCached(r,e,t.packageName,a):null}async getDocumentAsync(e){let t;try{t=je(e)}catch{return null}if(t.kind!=="package"||!t.version)return null;let r=this.producerFor(t.publisher,t.package_);return r?this.produceCached(r,t.publisher,t.package_,t.version):null}async getDocumentsByNamespaceAsync(e,t){return Array.from(this.produced.values()).filter(r=>{let o=r.metadata.namespace_;return o!=null&&o.publisher===e&&o.package_===t})}async getAllDocumentsAsync(){return Array.from(this.produced.values())}async saveDocumentAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async deleteDocumentAsync(e){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async clearNamespaceAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return null}async getDocumentUriAsync(e){return null}};var Fe={async authorize(){return{allowed:!0}}},He={async record(){}},G=class extends Error{constructor(t,r){let o=`${t.publisher}/${t.package_}${t.version?`@${t.version.major}.${t.version.minor}.${t.version.patch}`:""}`;super(`Not entitled to produce ${o}${r?`: ${r}`:""}`);this.address=t;this.reason=r;this.name="EntitlementDeniedError"}address;reason},me=class{inner;ctx;policy;meter;constructor(e,t,r=Fe,o=He){this.inner=e,this.ctx=t,this.policy=r,this.meter=o}canProduce(e,t){return this.inner.canProduce(e,t)}async resolveVersion(e,t,r){return await this.assertAllowed({publisher:e,package_:t,version:r.version}),this.inner.resolveVersion(e,t,r)}async produce(e,t,r){let o={publisher:e,package_:t,version:r};await this.assertAllowed(o);let a=await this.inner.produce(e,t,r);return await this.meter.record(this.ctx,o,a),a}async assertAllowed(e){let t=await this.policy.authorize(this.ctx,e);if(!t.allowed)throw new G(e,t.reason)}};var f="kanonak.org",g="view",Kt="core-kanonak",ro={publisher:f,package_:g,name:"rootView"},oo={publisher:f,package_:g,name:"bind"},ao={publisher:f,package_:g,name:"produces"},io={publisher:f,package_:g,name:"projections"},so={publisher:f,package_:g,name:"where"},co={publisher:f,package_:g,name:"value"},lo={publisher:f,package_:g,name:"as"},fe=class{constructor(e,t=new A){this.repository=e;this.parser=t;this.objectParser=new C(this.parser),this.builder=new $(this.repository,this.parser,this.objectParser)}repository;parser;objectParser;builder;async materialize(e,t={}){let r=await this.objectParser.parseKanonaks(this.repository),o=this.resolveView(r,e),a=w(o,oo);if(!a)throw new Error(`View ${o.namespace}/${o.name} declares no view.bind; cannot materialize.`);let i=w(o,ao);if(!i)throw new Error(`View ${o.namespace}/${o.name} is a selection view (no view.produces). In-graph materialization of selection views is not yet supported \u2014 declare a view.produces output class to reshape the result.`);let s=uo(o),c=xt(r,f,Kt),l=xt(r,f,g),p=this.builder.imports(),k=p.ensure(f,Kt,c,"ck"),h=p.ensure(f,g,l,"v"),S=p.ref(i),x=new Qe(this.repository,this.parser,this.objectParser),B=new Ye(x,r),J=this.readProjections(r,o),ge=fo(o,so),At=this.findInstances(r,a,await this.reason(t)),We={},Ot=new Set;for(let q of At){if(!await this.passesWhere(B,r,ge,q))continue;let he={type:S};for(let Je of J){let Tt=await this.evaluateValue(B,r,Je.value,q),qe=this.builder.serializeValue(It(Tt),p);qe!==void 0&&(he[p.ref(Je.as)]=qe)}let Ge=d(q);Ge&&(he[`${h}.derivedFrom`]=p.ref(Ge)),We[this.rowName(q,Ot)]=he}let ke={};t.resolvedAt&&(ke[`${k}.resolvedAt`]=t.resolvedAt),t.invocationId&&(ke[`${k}.id`]=t.invocationId);let D=await this.builder.buildContentAddressed({publisher:s,book:p,body:We,contentHashProperty:`${k}.contentHash`,header:ke});return{yaml:D.yaml,contentHash:D.contentHash,packageName:D.packageName,publisher:D.publisher,rowCount:D.resourceCount}}resolveView(e,t){let r=v(e,t);if(!r)throw new Error(`View ${t.publisher}/${t.package_}/${t.name} not found in the catalog.`);let o=w(r,ro);if(o){let a=v(e,o);if(!a)throw new Error(`ViewPackage ${t.name} names rootView ${o.name}, which is not in the catalog.`);return a}return r}readProjections(e,t){let r=[];for(let o of V(t,io)){let a=o instanceof b?o:o instanceof y?v(e,o.subject):void 0;if(!a)continue;let i=Be(a,co),s=w(a,lo);i&&s&&r.push({value:i,as:s})}return r}async reason(e){return new $e({profile:e.reasoningProfile??"owl-rl-classification"}).reason(this.repository)}findInstances(e,t,r){let o=mo(e),a=[],i=new Set;for(let s of r.getInstancesOfClass(t)){if(i.has(s))continue;i.add(s);let c=o.get(s);c&&a.push(c)}return a.sort((s,c)=>{let l=O(d(s)),p=O(d(c));return l<p?-1:l>p?1:0}),a}async passesWhere(e,t,r,o){for(let a of r){let i=await this.evaluateValue(e,t,a,o);if(!yo(i))return!1}return!0}async evaluateValue(e,t,r,o){let a=Ze(r,"view-projection",{catalog:t,depth:0}),i=new Map([["input",o]]);return e.evaluate(a,i)}rowName(e,t){let r=W(e.name)||"row",o=r,a=2;for(;t.has(o);)o=`${r}-${a++}`;return t.add(o),o}};function It(n){return De(n)?n.value:Array.isArray(n)?n.map(It):n}function uo(n){let e=d(n);if(!e)throw new Error(`Could not derive a publisher from view ${n.namespace}/${n.name}.`);return e.publisher}function xt(n,e,t){let r=po(n,e,t);if(!r)throw new Error(`Package ${e}/${t} is not in the catalog; it must be importable to materialize a view.`);return r}function po(n,e,t){let r;for(let o of n){if(!(o instanceof m))continue;let a=d(o);!a||a.publisher!==e||a.package_!==t||!a.version||(!r||X(a.version,r)>0)&&(r=a.version)}return r?R(r):void 0}function mo(n){let e=new Map,t=new Map;for(let r of n){if(!(r instanceof m))continue;let o=d(r);if(!o||!o.version)continue;let a=O(o),i=t.get(a);(!i||X(o.version,i)>0)&&(t.set(a,o.version),e.set(a,r))}return e}function fo(n,e){let t=Be(n,e);return t?[t]:V(n,e).filter(r=>r instanceof b)}function yo(n){return n===!0?!0:n===!1||n===void 0||n===null?!1:typeof n=="string"?n.length>0:typeof n=="number"?n!==0:De(n)?n.value.length>0:Array.isArray(n)?n.length>0:!!n}var K="kanonak.org",j="core-rdf",go="core-xsd",ko={publisher:K,package_:j,name:"domain"},ho={publisher:K,package_:j,name:"range"},$t={publisher:K,package_:j,name:"subClassOf"},jt={publisher:K,package_:j,name:"label"},Bt={publisher:K,package_:j,name:"comment"},bo=new Se(K,j,"Resource"),ye=n=>n;function ze(n,e){let t=w(n,e);if(t)return[t];let r=[];for(let o of V(n,e))o instanceof y&&r.push(o.subject);return r}function Po(n,e,t){let r=new Set([E(e)]);if(!t)return r;r.add(E(bo));let o=new Set,a=[e];for(;a.length>0;){let i=a.shift(),s=E(i);if(o.has(s))continue;o.add(s),r.add(s);let c=v(n,i);c&&a.push(...ze(c,$t))}return r}function wo(n,e,t){let r=v(n,e);if(r){let o=ye(r);if(P.isClassType(o))return{kind:"class",uri:d(r)??e,localName:r.name};if(P.isDatatypeType(o))return{kind:"datatype",uri:e}}return e.publisher===K&&e.package_===go?{kind:"datatype",uri:e}:t==="datatype"?{kind:"datatype",uri:e}:{kind:"class",uri:e,localName:e.name}}function So(n){let e=ye(n);return P.isObjectPropertyType(e)?"object":P.isDatatypePropertyType(e)?"datatype":"other"}function Ro(n,e,t){let r=Po(n,e,t),o=[],a=new Set;for(let i of n){if(!(i instanceof m))continue;let s=ye(i);if(!P.isAnyPropertyType(s)||!ze(i,ko).some(ge=>r.has(E(ge))))continue;let l=d(i);if(!l)continue;let p=E(l);if(a.has(p))continue;a.add(p);let k=w(i,ho);if(!k)throw new Error(`Property ${l.publisher}/${l.package_}/${l.name} has no rdfs.range; every property must declare a range. Validate the ontology before introspecting it.`);let h=So(i),S=wo(n,k,h),x=h==="object"?"object":h==="datatype"?"datatype":S.kind==="class"?"object":"datatype",B=T(i,jt),J=T(i,Bt);o.push({uri:l,localName:l.name,kind:x,range:S,...B!==void 0?{label:B}:{},...J!==void 0?{comment:J}:{}})}return o}async function Dt(n,e,t){let r=n.metadata?.namespace_;if(!r)throw new Error("buildOntologyModel: document has no namespace (publisher/package/version).");let o=t?.includeInherited??!1,a=await new C().parseKanonaks(e),i=[],s=new Set;for(let c of a){if(!(c instanceof m)||!P.isClassType(ye(c)))continue;let l=d(c);if(!l||l.publisher!==r.publisher||l.package_!==r.package_||l.version&&r.version&&!Pe(l.version,r.version))continue;let p=E(l);if(s.has(p))continue;s.add(p);let k=ze(c,$t).map(x=>({uri:x,localName:x.name})),h=T(c,jt),S=T(c,Bt);i.push({uri:l,localName:l.name,superClasses:k,properties:Ro(a,l,o),...h!==void 0?{label:h}:{},...S!==void 0?{comment:S}:{}})}return{classes:i}}export{tr as AmbiguousReferenceRule,ve as BooleanStatement,sr as ClassDefinitionRule,Wn as ClassHierarchyCycleRule,Wt as CompositeKanonakDocumentRepository,ue as CredentialStore,we as DefinedKanonak,Qn as DefinitionPropertyReferenceRule,zt as DocumentLocation,gn as EdgeType,b as EmbeddedKanonak,Fn as EmbeddedKanonakTypeRule,xe as EmbeddedStatement,G as EntitlementDeniedError,me as EntitlementProducer,Ht as FileSystemKanonakDocumentRepository,Sn as GitIgnoreFilter,kn as GraphBuilder,Zt as HttpKanonakDocumentRepository,z as ImportBook,Hn as ImportExistenceRule,Ft as InMemoryKanonakDocumentRepository,Zn as InstancePropertyReferenceRule,nn as Kanonak,Cn as KanonakDocumentPositions,C as KanonakObjectParser,lr as KanonakObjectValidator,A as KanonakParser,Se as KanonakUri,Kn as KanonakUriBuilder,In as KanonakUrlResolver,dn as KanonakVocabulary,Ie as ListStatement,Re as LiteralKanonak,Qt as LocalFirstRepository,dr as LookRenderer,cr as MarkdownLinkRule,an as MarkdownStatement,Yn as NamespaceImportCycleRule,Nn as NamespacePrefixRule,yn as NodeType,Ee as NumberStatement,Pn as OWL_RL_CLASSIFICATION_RULES,rr as ObjectPropertyImportRule,or as ObjectPropertyValueValidationRule,Tn as OntologyValidationError,An as OntologyValidationResult,$ as PackageBuilder,de as ProducerRepository,ar as PropertyDomainRule,Gn as PropertyHierarchyCycleRule,Rn as PropertyMetadata,nr as PropertyRangeReferenceRule,Jn as PropertyRangeRequiredRule,Ln as PropertyTypeSpecificityRule,ir as PropertyValueTypeRule,qt as PublisherConfigResolver,Xt as PublisherIndex,bn as RDFS_RULES,$e as Reasoner,wn as ReasoningResult,y as ReferenceKanonak,Ke as ReferenceStatement,Jt as RepositoryFactory,_n as ResourceNamingRule,sn as ResourceResolver,P as ResourceTypeClassifier,on as ScalarStatement,rn as Statement,Ce as StringStatement,qn as SubClassOfReferenceRule,Xn as SubPropertyOfReferenceRule,m as SubjectKanonak,Mn as SubjectKanonakTypeRequiredRule,hn as TripleStore,cn as TypeResolver,zn as UnresolvedReferenceRule,Un as ValidationCache,Vn as ValidationContext,On as ValidationSeverity,Oi as VersionOperator,fe as ViewMaterializer,er as XsdImportRule,Fe as allowAllPolicy,Yt as assertPackageIdentity,tn as buildLocalFirstRepository,Dt as buildOntologyModel,Ne as canonicalForm,pe as canonicalHash,en as collectKanonakFiles,X as compareVersions,ht as computeIntegrity,Me as contentAddressedName,Bn as contextTypesOf,mt as createAuthenticatedFetch,H as createDPoPProof,Ut as createVersion,fn as extractMarkdownLinks,ur as findDerivation,Dn as findInstancesByType,mn as findMalformedReferences,vn as findMarkdownLinkAt,xn as formatKanonakAddress,R as formatVersion,pt as generateDPoPKeyPair,Gt as getGlobalCachePath,Z as hasValidToken,_t as isCompatibleVersion,Y as isExpired,Lt as isMajorCompatible,gt as loadLockFile,ln as makeUriKey,He as noopMeter,u as normalizeHost,je as parseKanonakAddress,Nt as parseVersionString,En as parseWithPositions,Mt as pickHighestDocument,$n as propertiesInScope,pr as resolveDisplayValue,jn as resolvePropertyStep,W as sanitizeName,kt as saveLockFile,dt as serverSupportsDPoP,d as subjectUri,un as tripleKey,O as uriKey,pn as uriTriple,Vt as versionOperatorFromChar,be as versionOperatorToChar,Pe as versionsEqual};
+  Check the 'credentialHelper' path in ~/.kanonak/config.json.`)}}async store(e,t){let n=l(e);try{await this.runHelper("store",{publisher:n,credential:t})}catch(o){throw new Error(`Credential helper '${this.helperPath}' failed to store credential for '${n}': ${Z(o)}
+  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=l(e);try{await this.runHelper("erase",{publisher:t})}catch(n){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${Z(n)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${Z(e)}`),[]}}async runHelper(e,t){try{let{stdout:n}=await kn(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:qe});return n}catch(n){throw bn(n)?new Error(`Credential helper not found at '${this.helperPath}'.
+  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):Pn(n)?new Error(`Credential helper '${this.helperPath}' timed out after ${qe/1e3}s on '${e}'.
+  The helper may be waiting for authentication to an external vault.`):n}}};function Z(r){return r instanceof Error?r.message:String(r)}function bn(r){return r instanceof Error&&"code"in r&&r.code==="ENOENT"}function Pn(r){return r instanceof Error&&"killed"in r&&r.killed}var Ee=En(Rn(),".kanonak","config.json"),X=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=vn(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!_(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=Cn();return e.credentialHelper?new j(e.credentialHelper):process.platform==="darwin"?new C:process.platform==="win32"?new x:await Pe()?new K:new I}};function vn(r){let t="KANONAK_TOKEN_"+l(r).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function Cn(){if(!wn(Ee))return{};try{return JSON.parse(Sn(Ee,"utf-8"))}catch(r){let e=r instanceof Error?r.message:String(r);return console.warn(`  Warning: Failed to parse ${Ee}: ${e}
+  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{createHash as xn,createPrivateKey as Kn,generateKeyPairSync as $n,randomUUID as In,sign as jn}from"crypto";function Ze(){let{publicKey:r,privateKey:e}=$n("ec",{namedCurve:"P-256"});return{publicKey:r.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function B(r,e,t,n,o,i){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},s={jti:In(),htm:t.toUpperCase(),htu:n,iat:Math.floor(Date.now()/1e3)};return o&&(s.ath=xn("sha256").update(o).digest("base64url")),i&&(s.nonce=i),Bn(a,s,r)}function Xe(r){return!r||r.length===0?!1:r.some(e=>e.toUpperCase()==="ES256")}function Bn(r,e,t){let n=Ye(JSON.stringify(r)),o=Ye(JSON.stringify(e)),i=`${n}.${o}`,a=Kn({key:t,format:"jwk"}),c=jn("SHA256",Buffer.from(i),{key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${i}.${c}`}function Ye(r){return Buffer.from(r,"utf-8").toString("base64url")}function Qe(r){let e=new Map;return async(t,n,o="GET")=>{if(!r)return fetch(t,{method:o});let i=await r.getCredential(n);if(!i?.accessToken)return fetch(t,{method:o});U(i)&&console.warn(`  Warning: Access token for '${n}' is expired. Run 'kanonak login ${n}' to re-authenticate.`);let a={};if(i.dpopKeyPair){let c=e.get(n);try{let u=B(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.Authorization=`DPoP ${i.accessToken}`,a.DPoP=u}catch(u){let d=u instanceof Error?u.message:String(u);console.error(`  Error: Failed to create DPoP proof for '${n}': ${d}
+  The stored key pair may be corrupted. Run 'kanonak login ${n}' to re-authenticate.`),a.Authorization=`Bearer ${i.accessToken}`}}else a.Authorization=`Bearer ${i.accessToken}`;let s=await fetch(t,{method:o,headers:a});if(s.status===401&&i.dpopKeyPair){let c=s.headers.get("DPoP-Nonce");if(c){e.set(n,c);try{let u=B(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.DPoP=u,s=await fetch(t,{method:o,headers:a})}catch{}}}return s}}import{readFileSync as An,writeFileSync as Vn,existsSync as Dn}from"fs";import{createHash as Tn}from"crypto";import et from"js-yaml";var tt="kanonak.lock",On=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function rt(r=tt){if(!Dn(r))return null;let e=An(r,"utf-8"),t=et.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function nt(r,e=tt){r.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(r.packages).sort())t[o]=r.packages[o];r.packages=t;let n=et.dump(r,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Vn(e,On+n,"utf-8")}function ot(r){return`sha256:${Tn("sha256").update(r).digest("hex")}`}import*as xe from"js-yaml";import{createHash as Nn}from"crypto";function ve(r){let e=[];for(let n of r)n instanceof f&&e.push(Un(n));return e.sort((n,o)=>n.uri<o.uri?-1:n.uri>o.uri?1:0),JSON.stringify({subjects:e})}function Q(r){let e=ve(r);return`sha256:${Nn("sha256").update(e,"utf8").digest("hex")}`}function Un(r){let e=zn(r),t=Ce(r.statement);return{uri:e,statements:t}}function Ce(r){let e=[];for(let t of r){let n=_n(t);n&&e.push(n)}return e.sort((t,n)=>t.predicate<n.predicate?-1:t.predicate>n.predicate?1:0),e}function _n(r){let e=Hn(r);if(!e)return;let t=Ln(r);if(t)return Mn(e,t)}function Ln(r){if(r instanceof le)return{type:"string",value:r.object};if(r instanceof ue)return{type:"number",value:ct(r.object)};if(r instanceof de)return{type:"boolean",value:r.object};if(r instanceof pe)return{type:"ref",value:at(r.object)};if(r instanceof me){let e=r.object;return it(e)}if(r instanceof fe)return{type:"list",items:r.object.map(Fn)}}function it(r){let e=Ce(r.statement);return r.name&&r.name.length>0?{type:"embedded",name:r.name,statements:e}:{type:"embedded",statements:e}}function Fn(r){if(r instanceof k)return{type:"ref",value:at(r)};if(r instanceof y)return it(r);if(r instanceof ce){let e=r.value;if(typeof e=="string")return{type:"string",value:e};if(typeof e=="number")return{type:"number",value:ct(e)};if(typeof e=="boolean")return{type:"boolean",value:e}}if(r instanceof se)return{type:"embedded",statements:Ce(r.statement)};throw new Error(`canonicalForm: list item of unrecognized kind (${r.constructor?.name??typeof r}); add canonicalization support before hashing data that contains it`)}function Mn(r,e){switch(e.type){case"string":return{predicate:r,type:"string",value:e.value};case"number":return{predicate:r,type:"number",value:e.value};case"boolean":return{predicate:r,type:"boolean",value:e.value};case"ref":return{predicate:r,type:"ref",value:e.value};case"embedded":return e.name!==void 0?{predicate:r,type:"embedded",name:e.name,statements:e.statements}:{predicate:r,type:"embedded",statements:e.statements};case"list":return{predicate:r,type:"list",items:e.items}}}function Hn(r){let e=r.predicate;if(e)return st(e.subject)}function zn(r){let e=r.namespace??"",t=r.name??"";return`${e}/${t}`}function at(r){return st(r.subject)}function st(r){let e=r.version;return e&&typeof e.major=="number"?`${r.publisher}/${r.package_}@${e.major}.${e.minor}.${e.patch}/${r.name}`:`${r.publisher}/${r.package_}/${r.name}`}function ct(r){if(Number.isNaN(r))throw new Error("canonicalForm: NaN cannot be canonicalized");if(!Number.isFinite(r))throw new Error("canonicalForm: \xB1Infinity cannot be canonicalized");return Object.is(r,-0)?"0":String(r)}import{VersionOperator as lt}from"@kanonak-protocol/types/document/models/enums";var Wn="0.0.0",P=class{constructor(e,t=new S,n){this.repository=e;this.parser=t;this.objectParser=n??new E(this.parser)}repository;parser;objectParser;imports(){return new A}serializeValue(e,t){return pt(e,t)}async buildContentAddressed(e){let t=e.book.toImports(),n=await this.hashBody(e.publisher,t,e.body),o=Ke(n),i={type:"EphemeralPackage",publisher:e.publisher,imports:t};e.contentHashProperty&&(i[e.contentHashProperty]=n),Object.assign(i,e.header??{}),i.imports=t;let a={[o]:i,...e.body},s=this.dump(a);return{yaml:s,byteCount:dt(s),contentHash:n,packageName:o,publisher:e.publisher,resourceCount:Object.keys(e.body).length}}async buildNamed(e){let t=e.book.toImports(),n={type:e.type??"Package",publisher:e.publisher,version:e.version,imports:t},o;e.contentHashProperty&&(o=await this.hashBody(e.publisher,t,e.body),n[e.contentHashProperty]=o),Object.assign(n,e.header??{}),n.imports=t;let i={[e.name]:n,...e.body},a=this.dump(i),s={yaml:a,byteCount:dt(a),packageName:e.name,publisher:e.publisher,resourceCount:Object.keys(e.body).length};return o!==void 0&&(s.contentHash=o),s}dump(e){return xe.dump(e,{lineWidth:-1})}async hashBody(e,t,n){let o={[ut]:{type:"EphemeralPackage",publisher:e,imports:t},...n},i=this.parser.parse(xe.dump(o,{lineWidth:-1})),a=i.metadata.namespace_?.toString(),c=(await this.objectParser.parseKanonaks(new Te(i,this.repository))).filter(u=>u instanceof f&&u.namespace===a&&u.name!==ut);for(let u of c)u.namespace="ephemeral";return Q(c)}},ut="__pkgbuilder_probe__";function dt(r){return new TextEncoder().encode(r).length}function Ke(r){let e="sha256:",t=r.startsWith(e)?e.length:0;return`q-${r.slice(t,t+16)}`}var A=class{byKey=new Map;aliases=new Set;ensure(e,t,n,o,i=lt.Major){let a=`${e}/${t}@${n}`,s=this.byKey.get(a);if(s)return s.alias;let c=this.uniqueAlias(o);return this.byKey.set(a,{publisher:e,package_:t,version:n,alias:c,match:i}),c}ref(e){if(!e.version||typeof e.version.major!="number")throw new Error(`Cannot serialize a reference to ${e.publisher}/${e.package_}/${e.name} without a version.`);return`${this.ensure(e.publisher,e.package_,h(e.version),e.package_)}.${e.name}`}refLatest(e,t,n,o){return`${this.ensure(e,t,Wn,o??t,lt.Any)}.${n}`}toImports(){let e=new Map;for(let n of this.byKey.values()){let o=e.get(n.publisher)??[];o.push(n),e.set(n.publisher,o)}return[...e.keys()].sort().map(n=>({publisher:n,packages:e.get(n).sort((o,i)=>o.package_<i.package_?-1:1).map(o=>({package:o.package_,match:ae(o.match),version:o.version,alias:o.alias}))}))}uniqueAlias(e){let t=V(e)||"pkg",n=t,o=2;for(;this.aliases.has(n);)n=`${t}${o++}`;return this.aliases.add(n),n}};function pt(r,e){if(r!=null){if(typeof r=="string"||typeof r=="number"||typeof r=="boolean")return r;if(r instanceof k)return e.ref(r.subject);if(Array.isArray(r)){let t=r.map(n=>pt(n,e)).filter(n=>n!==void 0);return t.length>0?t:void 0}if(r instanceof y)throw new Error("Embedded values are not yet supported by PackageBuilder. Produce a literal or a reference, or compose the embedded shape into the output class.");if(Gn(r))throw new Error(`Value produced a bare URI without a version (${r.publisher}/${r.package_}/${r.name}); cannot serialize it as a reference.`)}}function V(r){return r.replace(/[^A-Za-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}function Gn(r){return typeof r=="object"&&r!==null&&typeof r.publisher=="string"&&typeof r.package_=="string"&&typeof r.name=="string"}var ee=class{constructor(e){this.producers=e}producers;produced=new Map;producerFor(e,t){return this.producers.find(n=>n.canProduce(e,t))}async produceCached(e,t,n,o){let i=`${t}/${n}@${h(o)}`,a=this.produced.get(i);if(a)return a;let{document:s}=await e.produce(t,n,o);return this.produced.set(i,s),s}async getHighestCompatibleVersionAsync(e,t){let n=this.producerFor(e,t.packageName);if(!n)return null;let o={operator:t.versionOperator,version:t.version},i=await n.resolveVersion(e,t.packageName,o);return i?this.produceCached(n,e,t.packageName,i):null}async getDocumentAsync(e){let t;try{t=ge(e)}catch{return null}if(t.kind!=="package"||!t.version)return null;let n=this.producerFor(t.publisher,t.package_);return n?this.produceCached(n,t.publisher,t.package_,t.version):null}async getDocumentsByNamespaceAsync(e,t){return Array.from(this.produced.values()).filter(n=>{let o=n.metadata.namespace_;return o!=null&&o.publisher===e&&o.package_===t})}async getAllDocumentsAsync(){return Array.from(this.produced.values())}async saveDocumentAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async deleteDocumentAsync(e){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async clearNamespaceAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return null}async getDocumentUriAsync(e){return null}};var $e={async authorize(){return{allowed:!0}}},Ie={async record(){}},D=class extends Error{constructor(t,n){let o=`${t.publisher}/${t.package_}${t.version?`@${t.version.major}.${t.version.minor}.${t.version.patch}`:""}`;super(`Not entitled to produce ${o}${n?`: ${n}`:""}`);this.address=t;this.reason=n;this.name="EntitlementDeniedError"}address;reason},te=class{inner;ctx;policy;meter;constructor(e,t,n=$e,o=Ie){this.inner=e,this.ctx=t,this.policy=n,this.meter=o}canProduce(e,t){return this.inner.canProduce(e,t)}async resolveVersion(e,t,n){return await this.assertAllowed({publisher:e,package_:t,version:n.version}),this.inner.resolveVersion(e,t,n)}async produce(e,t,n){let o={publisher:e,package_:t,version:n};await this.assertAllowed(o);let i=await this.inner.produce(e,t,n);return await this.meter.record(this.ctx,o,i),i}async assertAllowed(e){let t=await this.policy.authorize(this.ctx,e);if(!t.allowed)throw new D(e,t.reason)}};var p="kanonak.org",m="view",mt="core-kanonak",Jn={publisher:p,package_:m,name:"rootView"},qn={publisher:p,package_:m,name:"bind"},Yn={publisher:p,package_:m,name:"produces"},Zn={publisher:p,package_:m,name:"projections"},Xn={publisher:p,package_:m,name:"where"},Qn={publisher:p,package_:m,name:"value"},eo={publisher:p,package_:m,name:"as"},re=class{constructor(e,t=new S){this.repository=e;this.parser=t;this.objectParser=new E(this.parser),this.builder=new P(this.repository,this.parser,this.objectParser)}repository;parser;objectParser;builder;async materialize(e,t={}){let n=await this.objectParser.parseKanonaks(this.repository),o=this.resolveView(n,e),i=v(o,qn);if(!i)throw new Error(`View ${o.namespace}/${o.name} declares no view.bind; cannot materialize.`);let a=v(o,Yn);if(!a)throw new Error(`View ${o.namespace}/${o.name} is a selection view (no view.produces). In-graph materialization of selection views is not yet supported \u2014 declare a view.produces output class to reshape the result.`);let s=to(o),c=ft(n,p,mt),u=ft(n,p,m),d=this.builder.imports(),ne=d.ensure(p,mt,c,"ck"),gt=d.ensure(p,m,u,"v"),ht=d.ref(a),kt=new Ue(this.repository,this.parser,this.objectParser),je=new Oe(kt,n),bt=this.readProjections(n,o),Pt=oo(o,Xn),wt=this.findInstances(n,i,await this.reason(t)),Be={},St=new Set;for(let T of wt){if(!await this.passesWhere(je,n,Pt,T))continue;let ie={type:ht};for(let Ve of bt){let Rt=await this.evaluateValue(je,n,Ve.value,T),De=this.builder.serializeValue(yt(Rt),d);De!==void 0&&(ie[d.ref(Ve.as)]=De)}let Ae=g(T);Ae&&(ie[`${gt}.derivedFrom`]=d.ref(Ae)),Be[this.rowName(T,St)]=ie}let oe={};t.resolvedAt&&(oe[`${ne}.resolvedAt`]=t.resolvedAt),t.invocationId&&(oe[`${ne}.id`]=t.invocationId);let w=await this.builder.buildContentAddressed({publisher:s,book:d,body:Be,contentHashProperty:`${ne}.contentHash`,header:oe});return{yaml:w.yaml,contentHash:w.contentHash,packageName:w.packageName,publisher:w.publisher,rowCount:w.resourceCount}}resolveView(e,t){let n=N(e,t);if(!n)throw new Error(`View ${t.publisher}/${t.package_}/${t.name} not found in the catalog.`);let o=v(n,Jn);if(o){let i=N(e,o);if(!i)throw new Error(`ViewPackage ${t.name} names rootView ${o.name}, which is not in the catalog.`);return i}return n}readProjections(e,t){let n=[];for(let o of ke(t,Zn)){let i=o instanceof y?o:o instanceof k?N(e,o.subject):void 0;if(!i)continue;let a=he(i,Qn),s=v(i,eo);a&&s&&n.push({value:a,as:s})}return n}async reason(e){return new ye({profile:e.reasoningProfile??"owl-rl-classification"}).reason(this.repository)}findInstances(e,t,n){let o=no(e),i=[],a=new Set;for(let s of n.getInstancesOfClass(t)){if(a.has(s))continue;a.add(s);let c=o.get(s);c&&i.push(c)}return i.sort((s,c)=>{let u=R(g(s)),d=R(g(c));return u<d?-1:u>d?1:0}),i}async passesWhere(e,t,n,o){for(let i of n){let a=await this.evaluateValue(e,t,i,o);if(!io(a))return!1}return!0}async evaluateValue(e,t,n,o){let i=Ne(n,"view-projection",{catalog:t,depth:0}),a=new Map([["input",o]]);return e.evaluate(i,a)}rowName(e,t){let n=V(e.name)||"row",o=n,i=2;for(;t.has(o);)o=`${n}-${i++}`;return t.add(o),o}};function yt(r){return be(r)?r.value:Array.isArray(r)?r.map(yt):r}function to(r){let e=g(r);if(!e)throw new Error(`Could not derive a publisher from view ${r.namespace}/${r.name}.`);return e.publisher}function ft(r,e,t){let n=ro(r,e,t);if(!n)throw new Error(`Package ${e}/${t} is not in the catalog; it must be importable to materialize a view.`);return n}function ro(r,e,t){let n;for(let o of r){if(!(o instanceof f))continue;let i=g(o);!i||i.publisher!==e||i.package_!==t||!i.version||(!n||O(i.version,n)>0)&&(n=i.version)}return n?h(n):void 0}function no(r){let e=new Map,t=new Map;for(let n of r){if(!(n instanceof f))continue;let o=g(n);if(!o||!o.version)continue;let i=R(o),a=t.get(i);(!a||O(o.version,a)>0)&&(t.set(i,o.version),e.set(i,n))}return e}function oo(r,e){let t=he(r,e);return t?[t]:ke(r,e).filter(n=>n instanceof y)}function io(r){return r===!0?!0:r===!1||r===void 0||r===null?!1:typeof r=="string"?r.length>0:typeof r=="number"?r!==0:be(r)?r.value.length>0:Array.isArray(r)?r.length>0:!!r}export{Hr as AmbiguousReferenceRule,de as BooleanStatement,Yr as ClassDefinitionRule,Dr as ClassHierarchyCycleRule,Vt as CompositeKanonakDocumentRepository,X as CredentialStore,se as DefinedKanonak,Fr as DefinitionPropertyReferenceRule,At as DocumentLocation,ir as EdgeType,y as EmbeddedKanonak,Br as EmbeddedKanonakTypeRule,me as EmbeddedStatement,D as EntitlementDeniedError,te as EntitlementProducer,Bt as FileSystemKanonakDocumentRepository,dr as GitIgnoreFilter,ar as GraphBuilder,_t as HttpKanonakDocumentRepository,A as ImportBook,Ar as ImportExistenceRule,jt as InMemoryKanonakDocumentRepository,Lr as InstancePropertyReferenceRule,Ht as Kanonak,mr as KanonakDocumentPositions,E as KanonakObjectParser,Xr as KanonakObjectValidator,S as KanonakParser,zt as KanonakUri,gr as KanonakUriBuilder,kr as KanonakUrlResolver,er as KanonakVocabulary,fe as ListStatement,ce as LiteralKanonak,Lt as LocalFirstRepository,tn as LookRenderer,Zr as MarkdownLinkRule,Jt as MarkdownStatement,_r as NamespaceImportCycleRule,Kr as NamespacePrefixRule,or as NodeType,ue as NumberStatement,lr as OWL_RL_CLASSIFICATION_RULES,Wr as ObjectPropertyImportRule,Gr as ObjectPropertyValueValidationRule,vr as OntologyValidationError,Rr as OntologyValidationResult,P as PackageBuilder,ee as ProducerRepository,Jr as PropertyDomainRule,Tr as PropertyHierarchyCycleRule,pr as PropertyMetadata,zr as PropertyRangeReferenceRule,Or as PropertyRangeRequiredRule,Ir as PropertyTypeSpecificityRule,qr as PropertyValueTypeRule,Ot as PublisherConfigResolver,Nt as PublisherIndex,cr as RDFS_RULES,ye as Reasoner,ur as ReasoningResult,k as ReferenceKanonak,pe as ReferenceStatement,Tt as RepositoryFactory,$r as ResourceNamingRule,qt as ResourceResolver,nr as ResourceTypeClassifier,Gt as ScalarStatement,Wt as Statement,le as StringStatement,Nr as SubClassOfReferenceRule,Ur as SubPropertyOfReferenceRule,f as SubjectKanonak,jr as SubjectKanonakTypeRequiredRule,sr as TripleStore,Yt as TypeResolver,Vr as UnresolvedReferenceRule,xr as ValidationCache,Cr as ValidationContext,Er as ValidationSeverity,sa as VersionOperator,re as ViewMaterializer,Mr as XsdImportRule,$e as allowAllPolicy,Ut as assertPackageIdentity,Mt as buildLocalFirstRepository,rn as buildOntologyModel,ve as canonicalForm,Q as canonicalHash,Ft as collectKanonakFiles,O as compareVersions,ot as computeIntegrity,Ke as contentAddressedName,wr as contextTypesOf,Qe as createAuthenticatedFetch,B as createDPoPProof,Ct as createVersion,rr as extractMarkdownLinks,Qr as findDerivation,Sr as findInstancesByType,tr as findMalformedReferences,yr as findMarkdownLinkAt,hr as formatKanonakAddress,h as formatVersion,Ze as generateDPoPKeyPair,Dt as getGlobalCachePath,_ as hasValidToken,Kt as isCompatibleVersion,U as isExpired,$t as isMajorCompatible,rt as loadLockFile,Zt as makeUriKey,Ie as noopMeter,l as normalizeHost,ge as parseKanonakAddress,xt as parseVersionString,fr as parseWithPositions,It as pickHighestDocument,br as propertiesInScope,en as resolveDisplayValue,Pr as resolvePropertyStep,V as sanitizeName,nt as saveLockFile,Xe as serverSupportsDPoP,g as subjectUri,Xt as tripleKey,R as uriKey,Qt as uriTriple,Et as versionOperatorFromChar,ae as versionOperatorToChar,vt as versionsEqual};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kanonak-protocol/sdk",
-  "version": "3.75.0",
+  "version": "3.76.0",
   "description": "TypeScript SDK for the Kanonak Protocol — parse, resolve, validate, reason over, and render .kan.yml packages.",
   "type": "module",
   "main": "./dist/index.js",
@@ -122,7 +122,7 @@
     "yaml-parser"
   ],
   "dependencies": {
-    "@kanonak-protocol/types": "^3.75.0",
+    "@kanonak-protocol/types": "^3.76.0",
     "ignore": "^7.0.5",
     "js-yaml": "^4.1.0",
     "yaml": "^2.7.0"

package/dist/chunk-Y7TGQ7UF.js

@@ -1,2 +0,0 @@
-import{c as S,f as R}from"./chunk-G2DKKSZ4.js";import{a as h}from"./chunk-BGQKZBNE.js";var E=(t=>(t.Class="Class",t.DatatypeProperty="DatatypeProperty",t.ObjectProperty="ObjectProperty",t.AnnotationProperty="AnnotationProperty",t.Instance="Instance",t.Datatype="Datatype",t.Unknown="Unknown",t))(E||{}),A=(o=>(o.InstanceOf="instanceOf",o.SubClassOf="subClassOf",o.Domain="domain",o.Range="range",o.ObjectRelationship="objectRelationship",o.SubPropertyOf="subPropertyOf",o.PropertyValue="propertyValue",o.EmbeddedLink="embeddedLink",o))(A||{}),$=class{static async buildFromRepository(n){let l=await new R().parseKanonaks(n),p=await n.getAllDocumentsAsync(),a=[],s=[],t=new Set,o=new Set,d=new Map;for(let y of l){let c=y;c.name&&(h.isClassType(c)&&t.add(c.name),(h.isObjectPropertyType(c)||h.isGenericPropertyType(c))&&o.add(c.name))}for(let y of p)for(let[c,g]of Object.entries(y.body))o.has(c)&&g?.range&&typeof g.range=="string"&&d.set(c,g.range);let u=new Map;for(let y of l){let c=y;c.name&&u.set(c.name,c)}for(let y of p){let c=y.metadata.namespace_,g=c?`${c.publisher}/${c.package_}`:"",i=c?.version?`${c.version.major}.${c.version.minor}.${c.version.patch}`:"",f=x(y);for(let[m,b]of Object.entries(y.body)){if(!b||typeof b!="object")continue;let P=u.get(m),k="Unknown";if(P){let T=P;h.isClassType(T)?k="Class":h.isObjectPropertyType(T)?k="ObjectProperty":h.isDatatypePropertyType(T)?k="DatatypeProperty":h.isAnnotationPropertyType(T)?k="AnnotationProperty":h.isDatatypeType(T)?k="Datatype":h.isGenericPropertyType(T)?k="ObjectProperty":h.isInstanceOfKnownClass(T,t)&&(k="Instance")}let j=g&&i?`${g}/${m}@${i}`:m,C={};for(let[T,O]of Object.entries(b))T!=="type"&&(typeof O!="object"||O===null)&&(C[T]=O);a.push({id:j,label:b.label??m,type:k,namespace:g,properties:C}),v(j,b,k,t,o,s,g,i,f),N(j,b,o,d,a,s,g,i,f),L(j,P,s)}}return{nodes:a,edges:s}}static buildFromDocument(n){let r=[],l=[],p=n.metadata.namespace_,a=p?.version?`${p.version.major}.${p.version.minor}.${p.version.patch}`:"",s=p?`${p.publisher}/${p.package_}`:"",t=new Set,o=new Set,d=new Map,u=x(n);for(let[g,i]of Object.entries(n.body)){let f=i?.type;f&&(K(f,u)&&t.add(g),M(f,u)&&(o.add(g),i.range&&typeof i.range=="string"&&d.set(g,i.range)))}for(let[g,i]of Object.entries(n.body)){if(!i||typeof i!="object")continue;let f=i.type,m=U(f,g,t,u),b=s&&a?`${s}/${g}@${a}`:g,P={};for(let[k,j]of Object.entries(i))k!=="type"&&(typeof j!="object"||j===null)&&(P[k]=j);r.push({id:b,label:i.label??g,type:m,namespace:s,properties:P}),v(b,i,m,t,o,l,s,a,u),N(b,i,o,d,r,l,s,a,u)}let y=new Set(r.map(g=>g.id)),c=l.filter(g=>y.has(g.source)&&y.has(g.target));return{nodes:r,edges:c}}};function x(e,n){let r=new Map;if(e.metadata?.imports)for(let[l,p]of Object.entries(e.metadata.imports))for(let a of p){let s=a.alias??a.packageName,t=a.version,o=`${t.major}.${t.minor}.${t.patch}`;r.set(s,{publisher:l,package_:a.packageName,version:o})}return r}var _={"kanonak.org/core-rdf/Class":"Class","kanonak.org/core-owl/Class":"Class","kanonak.org/core-rdfs/Class":"Class","kanonak.org/core-owl/ObjectProperty":"ObjectProperty","kanonak.org/core-owl/DatatypeProperty":"DatatypeProperty","kanonak.org/core-owl/AnnotationProperty":"AnnotationProperty","kanonak.org/core-rdf/Property":"ObjectProperty","kanonak.org/core-rdfs/Datatype":"Datatype"},G=new Set(["kanonak.org/core-owl/ObjectProperty","kanonak.org/core-owl/DatatypeProperty","kanonak.org/core-owl/AnnotationProperty","kanonak.org/core-rdf/Property"]);function D(e,n){if(e.includes(".")){let r=e.indexOf("."),l=e.substring(0,r),p=e.substring(r+1),a=n.get(l);if(a)return`${a.publisher}/${a.package_}/${p}`}return null}function K(e,n){let r=D(e,n);return r?_[r]==="Class":!1}function M(e,n){let r=D(e,n);return r?G.has(r):!1}function U(e,n,r,l){if(!e||e==="Package")return"Unknown";let p=D(e,l);if(p){let s=_[p];if(s)return s;let t=p.split("/").pop()?.split("@")[0]??"";return r.has(t)?"Instance":"Unknown"}let a=e.split(".").pop()??e;return r.has(a)?"Instance":"Unknown"}var I=new Set(["type","label","comment","version","publisher","imports","license","match","alias","package"]);function v(e,n,r,l,p,a,s,t,o){let d=n.type,u=n.subClassOf;if(u){let i=Array.isArray(u)?u:[u];for(let f of i)typeof f=="string"&&a.push({source:e,target:w(f,s,t,o),type:"subClassOf",label:"subClassOf"})}let y=n.subPropertyOf;if(y){let i=Array.isArray(y)?y:[y];for(let f of i)typeof f=="string"&&a.push({source:e,target:w(f,s,t,o),type:"subPropertyOf",label:"subPropertyOf"})}if(r==="Instance"&&d){let i=d.split(".").pop()??d;a.push({source:e,target:w(i,s,t,o),type:"instanceOf",label:"type"})}if(r==="Instance")for(let[i,f]of Object.entries(n)){if(I.has(i)||!p.has(i))continue;let m=Array.isArray(f)?f:[f];for(let b of m)typeof b=="string"&&V(b)&&a.push({source:e,target:w(b,s,t,o),type:"propertyValue",label:i,propertyId:w(i,s,t,o)})}let c=r==="ObjectProperty"||r==="DatatypeProperty",g=n.domain&&n.range;if((c||g)&&n.domain&&n.range){let i=typeof n.domain=="string"?n.domain:null,f=typeof n.range=="string"?n.range:null;i&&f&&a.push({source:w(i,s,t,o),target:w(f,s,t,o),type:"objectRelationship",label:n.label??e.split("/").pop()??"",propertyId:e})}}function N(e,n,r,l,p,a,s,t,o){for(let[d,u]of Object.entries(n)){if(I.has(d)||typeof u!="object"||u===null||Array.isArray(u))continue;let y=u,c=`${e}/${d}`,g=l.get(d),i=g?g.split(".").pop()??g:"Unknown",f={};for(let[b,P]of Object.entries(y))(typeof P!="object"||P===null)&&(f[b]=P);p.push({id:c,label:`${i} (embedded)`,type:"Instance",namespace:s,properties:f});let m=s&&t?`${s}/${d}@${t}`:d;a.push({source:e,target:c,type:"propertyValue",label:d,propertyId:r.has(d)?m:void 0}),g&&a.push({source:c,target:w(i,s,t,o),type:"instanceOf",label:"type (inferred)"}),N(c,y,r,l,p,a,s,t,o)}}function L(e,n,r){let l=n?.statement;if(Array.isArray(l))for(let p of l){if(!(p instanceof S))continue;let a=p.predicate?.subject?.name??"";for(let s of p.links){let t=s.target?.subject;if(!t)continue;let o=t.version,d=o&&typeof o.major=="number"?`@${o.major}.${o.minor}.${o.patch}`:"";r.push({source:e,target:`${t.publisher}/${t.package_}/${t.name}${d}`,type:"embeddedLink",label:a})}}}function V(e){return!(!e||e.includes(" ")||e.includes(`
-`)||e.startsWith("http://")||e.startsWith("https://")||/^\d{4}-\d{2}/.test(e)||/^\d+(\.\d+)?$/.test(e))}function w(e,n,r,l){if(e.includes("@")&&e.includes("/"))return e;if(e.includes(".")){let p=e.indexOf("."),a=e.substring(0,p),s=e.substring(p+1);if(l){let t=l.get(a);if(t)return`${t.publisher}/${t.package_}/${s}@${t.version}`}return n&&r?`${n}/${s}@${r}`:s}return n&&r?`${n}/${e}@${r}`:e}function Y(e){if(!e.expiresAt)return!1;let n=new Date(e.expiresAt),r=300*1e3;return n.getTime()<=Date.now()+r}function Q(e){return!!e.accessToken&&!Y(e)}function X(e){let n=e.replace(/^https?:\/\//,"").replace(/^git:\/\//,"").replace(/\/+$/,"").trim();if(!n)throw new Error("Publisher host cannot be empty");return n}export{E as a,A as b,$ as c,Y as d,Q as e,X as f};