@kanonak-protocol/sdk 4.12.0 → 4.14.0

package/dist/auth/CredentialBackend.d.ts

@@ -1,14 +1,23 @@
 /**
- * Pluggable credential storage backend interface.
- * Implementations store OAuth credentials per publisher domain
- * in platform-specific secure stores.
+ * Pluggable secure-storage backend: JSON values of type `T` keyed by a
+ * normalized host, in a platform-specific secure store (OS keychain, encrypted
+ * file, enterprise vault). The same backend implementations serve different
+ * record types under different namespaces — OAuth credentials
+ * ({@link StoredCredential}) and device enrollments — so the storage mechanism
+ * is written once and reused.
  */
-export interface CredentialBackend {
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+export interface SecretBackend<T> {
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
 }
+/**
+ * The OAuth credential storage backend — a {@link SecretBackend} whose records
+ * are {@link StoredCredential}. Kept as a named alias so existing consumers and
+ * the `CredentialStore` are unchanged.
+ */
+export type CredentialBackend = SecretBackend<StoredCredential>;
 /**
  * OAuth credential stored per publisher host.
  * Matches the OAuthCredentialStore types from @kanonak-protocol/types.

package/dist/auth/CredentialHelperBackend.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialBackend, StoredCredential } from './CredentialBackend.js';
+import type { SecretBackend, StoredCredential } from './CredentialBackend.js';
 /**
  * External credential helper backend.
  * Delegates to an enterprise-configured binary using a stdin/stdout JSON protocol.
@@ -6,11 +6,11 @@ import type { CredentialBackend, StoredCredential } from './CredentialBackend.js
  * Configure in ~/.kanonak/config.json:
  *   { "credentialHelper": "/usr/local/bin/kanonak-credential-vault" }
  */
-export declare class CredentialHelperBackend implements CredentialBackend {
+export declare class CredentialHelperBackend<T = StoredCredential> implements SecretBackend<T> {
     private readonly helperPath;
     constructor(helperPath: string);
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
     private runHelper;

package/dist/auth/DeviceCertificateStore.d.ts

@@ -0,0 +1,52 @@
+import type { SecretBackend } from './CredentialBackend.js';
+import { normalizeHost } from './CredentialBackend.js';
+/**
+ * A device certificate enrollment, persisted per registry host (issue #67).
+ *
+ * The record holds the device-held key material, the CA-signed certificate, and
+ * the consent context. In v1 the key is a software key (its private JWK lives in
+ * `keyMaterial`); a future hardware {@link KeyProvider} stores an opaque handle
+ * here instead, so the secure store never holds an exportable key. Either way the
+ * record is opaque JSON to the storage backend.
+ */
+export interface DeviceEnrollmentRecord {
+    /** Software provider: the private key JWK. Hardware provider: an opaque key handle. */
+    keyMaterial: Record<string, unknown>;
+    /** RFC 7638 JWK SHA-256 thumbprint of the device public key — the consent-bound identity. */
+    thumbprint: string;
+    /** The CA-signed leaf certificate (PEM). */
+    certificatePem: string;
+    /** The issuing chain (PEM, possibly empty). */
+    chainPem: string;
+    /** ISO timestamp the certificate was issued/installed. */
+    issuedAt: string;
+    /** ISO timestamp the certificate expires, or null if unknown. */
+    expiresAt: string | null;
+    /** The scopes consented at enrollment. */
+    scopes: string[];
+    /** A human-facing device label shown on the consent screen. */
+    deviceName?: string;
+}
+/**
+ * Persists {@link DeviceEnrollmentRecord}s in the same platform-secure stores as
+ * OAuth credentials, but under a separate `kanonak-device` namespace so the two
+ * never collide (separate Keychain service / Credential Manager target prefix /
+ * Secret Service attribute / encrypted file). Mirrors {@link CredentialStore}'s
+ * backend selection; the external credential-helper backend is intentionally not
+ * used for device certs in v1 (device enrollment is a first-party flow).
+ *
+ * This is a Node-only module (it reaches OS keystores) and is deliberately not
+ * exported from the SDK browser entry.
+ */
+export declare class DeviceCertificateStore {
+    private backend;
+    private backendReady;
+    getBackend(): Promise<SecretBackend<DeviceEnrollmentRecord>>;
+    get(host: string): Promise<DeviceEnrollmentRecord | null>;
+    store(host: string, record: DeviceEnrollmentRecord): Promise<void>;
+    remove(host: string): Promise<void>;
+    list(): Promise<string[]>;
+    private resolveBackend;
+}
+/** Re-exported for callers that namespace device records themselves. */
+export { normalizeHost };

package/dist/auth/EncryptedFileBackend.d.ts

@@ -1,15 +1,19 @@
-import type { CredentialBackend, StoredCredential } from './CredentialBackend.js';
+import type { SecretBackend, StoredCredential } from './CredentialBackend.js';
 /**
- * Encrypted file credential backend.
+ * Encrypted file secret backend.
  * Fallback for headless Linux, containers, and CI environments
- * where no OS keyring is available.
+ * where no OS keyring is available. The secrets file is namespaced (OAuth
+ * credentials in `credentials.enc`, device enrollments in `device-credentials.enc`)
+ * so the two stores never collide; both are sealed with the same per-user key.
  *
  * - Key: ~/.config/kanonak/keyring.key (random 32 bytes, mode 0600)
- * - Secrets: ~/.config/kanonak/credentials.enc (AES-256-GCM encrypted JSON)
+ * - Secrets: a per-namespace AES-256-GCM encrypted JSON file
  */
-export declare class EncryptedFileBackend implements CredentialBackend {
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+export declare class EncryptedFileBackend<T = StoredCredential> implements SecretBackend<T> {
+    private readonly secretsFile;
+    constructor(secretsFile?: string);
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
     private loadStore;

package/dist/auth/KeychainBackend.d.ts

@@ -1,11 +1,15 @@
-import type { CredentialBackend, StoredCredential } from './CredentialBackend.js';
+import type { SecretBackend, StoredCredential } from './CredentialBackend.js';
 /**
- * macOS Keychain credential backend.
- * Stores credentials via the `security` CLI tool (no native modules).
+ * macOS Keychain secret backend.
+ * Stores records via the `security` CLI tool (no native modules). The Keychain
+ * `service` namespaces the store, so OAuth credentials (`kanonak`) and device
+ * enrollments (`kanonak-device`) live side by side without colliding.
  */
-export declare class KeychainBackend implements CredentialBackend {
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+export declare class KeychainBackend<T = StoredCredential> implements SecretBackend<T> {
+    private readonly service;
+    constructor(service?: string);
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
 }

package/dist/auth/SecretServiceBackend.d.ts

@@ -1,19 +1,21 @@
-import type { CredentialBackend, StoredCredential } from './CredentialBackend.js';
+import type { SecretBackend, StoredCredential } from './CredentialBackend.js';
 /**
  * Linux Secret Service backend (GNOME Keyring / KDE Wallet).
  * Uses the `secret-tool` CLI from libsecret-tools.
  *
- * Each publisher's credential is stored with attributes:
- *   service = "kanonak"
+ * Each record is stored with attributes:
+ *   service = the namespace ("kanonak" for OAuth, "kanonak-device" for device certs)
  *   publisher = normalized publisher host
  *
  * All interactions use execFile (no shell) to prevent command injection.
  * The store() method uses spawn with stdin piping since secret-tool
  * reads the secret value from stdin.
  */
-export declare class SecretServiceBackend implements CredentialBackend {
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+export declare class SecretServiceBackend<T = StoredCredential> implements SecretBackend<T> {
+    private readonly service;
+    constructor(service?: string);
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
 }

package/dist/auth/WinCredBackend.d.ts

@@ -1,19 +1,23 @@
-import type { CredentialBackend, StoredCredential } from './CredentialBackend.js';
+import type { SecretBackend, StoredCredential } from './CredentialBackend.js';
 /**
  * Windows Credential Manager backend.
  * Uses PowerShell P/Invoke to Advapi32.dll for CredRead/CredWrite/CredDelete.
  * cmdkey cannot read passwords back, so P/Invoke is required.
  *
- * Each publisher's credential is stored as a generic credential with:
- *   target = "kanonak:{normalized_publisher}"
- *   credential blob = JSON-serialized StoredCredential (UTF-16)
+ * Each record is stored as a generic credential with:
+ *   target = "{prefix}{normalized_publisher}"
+ *   credential blob = JSON-serialized record (UTF-16)
  *
- * Data is passed to PowerShell via stdin to prevent injection attacks.
- * No user-supplied values are interpolated into PowerShell code.
+ * The `target` prefix namespaces the store, so OAuth credentials (`kanonak:`)
+ * and device enrollments (`kanonak-device:`) do not collide. Data is passed to
+ * PowerShell via stdin to prevent injection attacks; no user-supplied values
+ * are interpolated into PowerShell code.
  */
-export declare class WinCredBackend implements CredentialBackend {
-    get(publisher: string): Promise<StoredCredential | null>;
-    store(publisher: string, credential: StoredCredential): Promise<void>;
+export declare class WinCredBackend<T = StoredCredential> implements SecretBackend<T> {
+    private readonly targetPrefix;
+    constructor(targetPrefix?: string);
+    get(publisher: string): Promise<T | null>;
+    store(publisher: string, value: T): Promise<void>;
     remove(publisher: string): Promise<void>;
     list(): Promise<string[]>;
 }

package/dist/auth/index.d.ts

@@ -1,6 +1,8 @@
-export type { CredentialBackend, StoredCredential, DPoPKeyPair } from './CredentialBackend.js';
+export type { SecretBackend, CredentialBackend, StoredCredential, DPoPKeyPair } from './CredentialBackend.js';
 export { isExpired, hasValidToken, normalizeHost } from './CredentialBackend.js';
 export { CredentialStore } from './CredentialStore.js';
+export { DeviceCertificateStore } from './DeviceCertificateStore.js';
+export type { DeviceEnrollmentRecord } from './DeviceCertificateStore.js';
 export type { AuthenticatedFetchFn } from './AuthenticatedFetch.js';
 export { createAuthenticatedFetch } from './AuthenticatedFetch.js';
 export { generateDPoPKeyPair, createDPoPProof, serverSupportsDPoP } from './DPoP.js';

package/dist/browser.d.ts

@@ -12,7 +12,7 @@ export { KanonakParser, KanonakObjectParser, PropertyMetadata, KanonakDocumentPo
 export type { IKanonakObjectParser, SourcePosition, ImportPackageEntry, ParsedDocumentWithPositions, } from './parsing/index.js';
 export { GraphBuilder, NodeType, EdgeType } from './graph/index.js';
 export type { GraphNode, GraphEdge, GraphData } from './graph/index.js';
-export { OntologyValidationResult, OntologyValidationError, ValidationSeverity, ValidationContext, KanonakObjectValidator, NamespacePrefixRule, ResourceNamingRule, PropertyTypeSpecificityRule, SubjectKanonakTypeRequiredRule, EmbeddedKanonakTypeRule, ImportExistenceRule, UnresolvedReferenceRule, ClassHierarchyCycleRule, PropertyHierarchyCycleRule, PropertyRangeRequiredRule, SubClassOfReferenceRule, SubPropertyOfReferenceRule, NamespaceImportCycleRule, UnresolvedPredicateRule, DefinitionPropertyReferenceRule, XsdImportRule, AmbiguousReferenceRule, PropertyRangeReferenceRule, ObjectPropertyImportRule, ObjectPropertyValueValidationRule, PropertyDomainRule, PropertyValueTypeRule, ClassDefinitionRule, MarkdownLinkRule } from './validation/index.js';
+export { OntologyValidationResult, OntologyValidationError, ValidationSeverity, ValidationContext, KanonakObjectValidator, NamespacePrefixRule, ResourceNamingRule, PropertyTypeSpecificityRule, SubjectKanonakTypeRequiredRule, EmbeddedKanonakTypeRule, ImportExistenceRule, UnresolvedReferenceRule, ClassHierarchyCycleRule, PropertyHierarchyCycleRule, PropertyRangeRequiredRule, SubClassOfReferenceRule, SubPropertyOfReferenceRule, NamespaceImportCycleRule, UnresolvedPredicateRule, AmbiguousReferenceRule, PropertyRangeReferenceRule, ObjectPropertyValueValidationRule, PropertyDomainRule, PropertyKindRangeConsistencyRule, ClassDefinitionRule, MarkdownLinkRule } from './validation/index.js';
 export type { IKanonakObjectValidator, IDocumentValidationRule, IRepositoryValidationRule } from './validation/index.js';
 export { Kanonak, DefinedKanonak, SubjectKanonak, EmbeddedKanonak, ReferenceKanonak } from './kanonaks/index.js';
 export type { IStatement } from './statements/index.js';

package/dist/browser.js

@@ -1,2 +1,2 @@
-import{a as we,b as ke,c as he,d as E,e as _,f as d,g as tr}from"./chunk-U7LVFPEO.js";import{a as rr}from"./chunk-VWS25JH4.js";import"./chunk-QHABFCRC.js";import{a as F,b as W,c as G,d as w,f as X,g as Q,h as Y}from"./chunk-JYBKSBB5.js";import{a as q}from"./chunk-4NO7MHS7.js";import{a as Ke,b as be,c as xe}from"./chunk-RGOBWOBB.js";import{a as Se,b as Re}from"./chunk-PEUTCG3B.js";import"./chunk-PEJALHXK.js";import"./chunk-SC5M74NM.js";import{A as Xe,B as Qe,C as Ye,D as Ze,M as er,a as De,b as Be,c as Ce,d as Ee,f as _e,g as je,h as ve,i as Ae,k as Te,l as Ie,m as Oe,n as Ue,o as Ve,p as $e,q as Me,r as Ne,s as ze,t as Je,u as He,v as qe,w as Le,x as Fe,y as We,z as Ge}from"./chunk-UBBZWWRB.js";import"./chunk-SHDHMKMJ.js";import{a as te,c as ye,h as me}from"./chunk-BKVPSPG4.js";import{a as L}from"./chunk-NJ3AZYQD.js";import{a as Pe}from"./chunk-IEOSSSB5.js";import"./chunk-7TKJHKC2.js";import{b as ge,c as fe}from"./chunk-7HRKWTBB.js";import{a as Z,b as ee,c as re,d as oe,e as se,f as ie,g as ae,h as ce,i as le,j as ue,k as de,l as pe}from"./chunk-4UT2CLAT.js";import{a as ne}from"./chunk-FUUTGGJS.js";import{c as U,d as V,e as $,f as M,g as N,h as z,i as J,j as H}from"./chunk-2ACBWC7K.js";var j="kanonak-credentials",u="credentials",nr=1,f=class{async get(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readonly"),i=s.objectStore(u).get(e);i.onsuccess=()=>o(i.result??null),i.onerror=()=>a(new Error(`IndexedDB read failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async store(r,e){let t=d(r),o=await h();return new Promise((a,s)=>{let l=o.transaction(u,"readwrite"),c=l.objectStore(u).put(e,t);c.onsuccess=()=>a(),c.onerror=()=>s(new Error(`IndexedDB write failed for '${t}': ${c.error?.message}`)),l.oncomplete=()=>o.close()})}async remove(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readwrite"),i=s.objectStore(u).delete(e);i.onsuccess=()=>o(),i.onerror=()=>a(new Error(`IndexedDB delete failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async list(){let r=await h();return new Promise((e,t)=>{let o=r.transaction(u,"readonly"),s=o.objectStore(u).getAllKeys();s.onsuccess=()=>e(s.result??[]),s.onerror=()=>t(new Error(`IndexedDB list failed: ${s.error?.message}`)),o.oncomplete=()=>r.close()})}};function h(){return new Promise((n,r)=>{let e=indexedDB.open(j,nr);e.onupgradeneeded=()=>{let t=e.result;t.objectStoreNames.contains(u)||t.createObjectStore(u)},e.onsuccess=()=>n(e.result),e.onerror=()=>r(new Error(`Failed to open IndexedDB '${j}': ${e.error?.message}
-Credential storage requires IndexedDB support in your browser.`))})}async function A(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey);return{signingKey:n.privateKey,publicKeyJwk:r}}async function K(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey),e=await crypto.subtle.exportKey("jwk",n.privateKey);return{keys:{signingKey:n.privateKey,publicKeyJwk:r},dpopKeyPair:{publicKey:r,privateKey:e}}}async function b(n){return{signingKey:await crypto.subtle.importKey("jwk",n.privateKey,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),publicKeyJwk:n.publicKey}}async function x(n,r,e,t,o){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:n.publicKeyJwk.kty,crv:n.publicKeyJwk.crv,x:n.publicKeyJwk.x,y:n.publicKeyJwk.y}},s={jti:crypto.randomUUID(),htm:r.toUpperCase(),htu:e,iat:Math.floor(Date.now()/1e3)};return t&&(s.ath=await sr(t)),o&&(s.nonce=o),await or(a,s,n.signingKey)}function S(n){return!n||n.length===0?!1:n.some(r=>r.toUpperCase()==="ES256")}async function or(n,r,e){let t=v(JSON.stringify(n)),o=v(JSON.stringify(r)),a=new TextEncoder().encode(`${t}.${o}`),s=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e,a),l=B(s);return`${t}.${o}.${l}`}async function sr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return B(e)}function v(n){let r=new TextEncoder().encode(n);return B(r.buffer)}function B(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var ir=300*1e3,R=class{credentialBackend;callbackUrl;constructor(r){this.credentialBackend=new f,this.callbackUrl=r??`${window.location.origin}/browser/callback.html`}async authorize(r){let e=d(r),t=await this.discover(e);if(!t)return{success:!1,error:`No OAuth discovery endpoint found for '${e}'.`};if(!t.authorizationEndpoint||!t.tokenEndpoint)return{success:!1,error:`OAuth metadata incomplete for '${e}'.`};let o=S(t.dpopSigningAlgValuesSupported),a=null,s=null;if(o){let g=await K();a=g.keys,s=g.dpopKeyPair}let l=await this.credentialBackend.get(e),i=l?.clientId??null,c=l?.clientSecret??null;if(!i&&t.registrationEndpoint){let g=await this.registerClient(t.registrationEndpoint);if(!g)return{success:!1,error:`Dynamic client registration failed for '${e}'.`};i=g.clientId,c=g.clientSecret??null}if(!i)return{success:!1,error:`No OAuth client credentials for '${e}'.`};let m=ar(),p=await cr(m),D=lr(),I=ur(t.authorizationEndpoint,i,this.callbackUrl,D,p),y=await this.openAuthPopup(I,D);if(!y)return{success:!1,error:"Authorization timed out or was cancelled."};if(y.error)return{success:!1,error:`Authorization failed: ${y.error}`};if(!y.code)return{success:!1,error:"No authorization code received."};if(y.state!==D)return{success:!1,error:"State mismatch \u2014 possible CSRF attack."};let P=await this.exchangeCode(t.tokenEndpoint,i,c,y.code,this.callbackUrl,m,a);if(!P)return{success:!1,error:"Token exchange failed."};let O={clientId:i,clientSecret:c,accessToken:P.accessToken??null,refreshToken:P.refreshToken??null,expiresAt:P.expiresIn?new Date(Date.now()+P.expiresIn*1e3).toISOString():null,tokenEndpoint:t.tokenEndpoint,dpopKeyPair:s};return await this.credentialBackend.store(e,O),{success:!0,host:e}}async getCredentialWithKeys(r){let e=await this.credentialBackend.get(r);if(!e)return null;let t=null;return e.dpopKeyPair&&(t=await b(e.dpopKeyPair)),{credential:e,dpopKeys:t}}async logout(r){let e=d(r);return await this.credentialBackend.remove(e),{success:!0,host:e}}async listAuthenticated(){return this.credentialBackend.list()}async discover(r){for(let e of[`https://${r}/.well-known/oauth-authorization-server`,`https://${r}/.well-known/openid-configuration`])try{let t=await w(e);if(!t.ok)continue;let o=await t.json();return{issuer:k(o.issuer),authorizationEndpoint:k(o.authorization_endpoint),tokenEndpoint:k(o.token_endpoint),registrationEndpoint:k(o.registration_endpoint),revocationEndpoint:k(o.revocation_endpoint),dpopSigningAlgValuesSupported:T(o.dpop_signing_alg_values_supported),codeChallengeMethodsSupported:T(o.code_challenge_methods_supported)}}catch{continue}return null}async registerClient(r){try{let e=await w(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak Browser",redirect_uris:[this.callbackUrl],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})});if(!e.ok)return null;let t=await e.json(),o=t.client_id;return o?{clientId:o,clientSecret:t.client_secret}:null}catch{return null}}openAuthPopup(r,e){return new Promise(t=>{let o=window.open(r,"kanonak-auth","width=500,height=700,menubar=no,toolbar=no,location=yes,status=no");if(!o){t(null);return}let a=setTimeout(()=>{i(),t(null)},ir),s=c=>{c.origin===window.location.origin&&(!c.data||c.data.type!=="kanonak-auth-callback"||(i(),t({code:c.data.code??void 0,state:c.data.state??void 0,error:c.data.error??void 0})))},l=setInterval(()=>{o.closed&&(i(),t(null))},500),i=()=>{clearTimeout(a),clearInterval(l),window.removeEventListener("message",s);try{o.close()}catch{}};window.addEventListener("message",s)})}async exchangeCode(r,e,t,o,a,s,l){let i=new URLSearchParams({grant_type:"authorization_code",client_id:e,code:o,redirect_uri:a,code_verifier:s});t&&i.set("client_secret",t);let c={"Content-Type":"application/x-www-form-urlencoded"};l&&(c.DPoP=await x(l,"POST",r));try{let m=await w(r,{method:"POST",headers:c,body:i.toString()});if(!m.ok)return null;let p=await m.json();return{accessToken:p.access_token,refreshToken:p.refresh_token,expiresIn:typeof p.expires_in=="number"?p.expires_in:void 0}}catch{return null}}};function ar(){let n=new Uint8Array(32);return crypto.getRandomValues(n),C(n.buffer)}async function cr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return C(e)}function lr(){let n=new Uint8Array(16);return crypto.getRandomValues(n),C(n.buffer)}function ur(n,r,e,t,o){let a=new URLSearchParams({client_id:r,response_type:"code",redirect_uri:e,state:t,code_challenge:o,code_challenge_method:"S256"});return`${n}?${a}`}function C(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function k(n){return typeof n=="string"?n:null}function T(n){return Array.isArray(n)?n.filter(r=>typeof r=="string"):null}export{Le as AmbiguousReferenceRule,le as BooleanStatement,f as BrowserCredentialBackend,R as BrowserOAuthFlow,Ye as ClassDefinitionRule,Ue as ClassHierarchyCycleRule,ee as DefinedKanonak,He as DefinitionPropertyReferenceRule,ke as EdgeType,te as EmbeddedKanonak,Te as EmbeddedKanonakTypeRule,de as EmbeddedStatement,he as GraphBuilder,Y as HttpKanonakDocumentRepository,Ie as ImportExistenceRule,q as InMemoryKanonakDocumentRepository,F as KANONAK_USER_AGENT,Z as Kanonak,be as KanonakDocumentPositions,me as KanonakObjectParser,er as KanonakObjectValidator,L as KanonakParser,ne as KanonakUri,Se as KanonakUriBuilder,pe as ListStatement,Ze as MarkdownLinkRule,ye as MarkdownStatement,ze as NamespaceImportCycleRule,_e as NamespacePrefixRule,we as NodeType,ce as NumberStatement,We as ObjectPropertyImportRule,Ge as ObjectPropertyValueValidationRule,Ce as OntologyValidationError,De as OntologyValidationResult,Xe as PropertyDomainRule,Ve as PropertyHierarchyCycleRule,Ke as PropertyMetadata,Fe as PropertyRangeReferenceRule,$e as PropertyRangeRequiredRule,ve as PropertyTypeSpecificityRule,Qe as PropertyValueTypeRule,X as PublisherConfigResolver,Q as PublisherIndex,oe as ReferenceKanonak,ue as ReferenceStatement,je as ResourceNamingRule,ge as ResourceResolver,Pe as ResourceTypeClassifier,ie as ScalarStatement,se as Statement,ae as StringStatement,Me as SubClassOfReferenceRule,Ne as SubPropertyOfReferenceRule,re as SubjectKanonak,Ae as SubjectKanonakTypeRequiredRule,fe as TypeResolver,Je as UnresolvedPredicateRule,Oe as UnresolvedReferenceRule,Ee as ValidationContext,Be as ValidationSeverity,qe as XsdImportRule,S as browserServerSupportsDPoP,tr as buildOntologyModel,U as compareVersions,x as createBrowserDPoPProof,M as createVersion,rr as findDerivation,Re as findInstancesByType,$ as formatVersion,K as generateBrowserDPoPKeyPair,A as generateBrowserDPoPKeys,G as getKanonakUserAgent,_ as hasValidToken,b as importDPoPKeys,z as isCompatibleVersion,E as isExpired,J as isMajorCompatible,w as kanonakFetch,d as normalizeHost,N as parseVersionString,xe as parseWithPositions,H as pickHighestDocument,W as setKanonakUserAgent,V as versionsEqual};
+import{a as we,b as ke,c as he,d as E,e as _,f as d,g as Ze}from"./chunk-QDSN5VM3.js";import{a as Ye}from"./chunk-HQQ4OAZ2.js";import"./chunk-QHABFCRC.js";import{a as F,b as W,c as G,d as w,f as Q,g as X,h as Y}from"./chunk-JYBKSBB5.js";import{a as q}from"./chunk-4NO7MHS7.js";import{a as Ke,b as be,c as xe}from"./chunk-OR3F4WIF.js";import{a as Se,b as De}from"./chunk-PEUTCG3B.js";import"./chunk-PEJALHXK.js";import"./chunk-SC5M74NM.js";import{A as Qe,J as Xe,a as Re,b as Be,c as Ce,d as Ee,f as _e,g as ve,h as Ae,i as je,k as Te,l as Ie,m as Oe,n as Ue,o as Ve,p as $e,q as Me,r as Ne,s as ze,t as Je,u as He,v as qe,w as Le,x as Fe,y as We,z as Ge}from"./chunk-MRNELSJF.js";import{a as te,c as ye,l as me}from"./chunk-R73T4RUO.js";import{a as L}from"./chunk-NJ3AZYQD.js";import{a as Pe}from"./chunk-2HNPPYSK.js";import"./chunk-6U26UASC.js";import{a as ge,b as fe}from"./chunk-WGKIRLMA.js";import{a as Z,b as ee,c as re,d as oe,e as se,f as ie,g as ae,h as ce,i as le,j as ue,k as de,l as pe}from"./chunk-7BHDZHJY.js";import{a as ne}from"./chunk-FUUTGGJS.js";import{c as U,d as V,e as $,f as M,g as N,h as z,i as J,j as H}from"./chunk-2ACBWC7K.js";var v="kanonak-credentials",u="credentials",er=1,f=class{async get(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readonly"),i=s.objectStore(u).get(e);i.onsuccess=()=>o(i.result??null),i.onerror=()=>a(new Error(`IndexedDB read failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async store(r,e){let t=d(r),o=await h();return new Promise((a,s)=>{let l=o.transaction(u,"readwrite"),c=l.objectStore(u).put(e,t);c.onsuccess=()=>a(),c.onerror=()=>s(new Error(`IndexedDB write failed for '${t}': ${c.error?.message}`)),l.oncomplete=()=>o.close()})}async remove(r){let e=d(r),t=await h();return new Promise((o,a)=>{let s=t.transaction(u,"readwrite"),i=s.objectStore(u).delete(e);i.onsuccess=()=>o(),i.onerror=()=>a(new Error(`IndexedDB delete failed for '${e}': ${i.error?.message}`)),s.oncomplete=()=>t.close()})}async list(){let r=await h();return new Promise((e,t)=>{let o=r.transaction(u,"readonly"),s=o.objectStore(u).getAllKeys();s.onsuccess=()=>e(s.result??[]),s.onerror=()=>t(new Error(`IndexedDB list failed: ${s.error?.message}`)),o.oncomplete=()=>r.close()})}};function h(){return new Promise((n,r)=>{let e=indexedDB.open(v,er);e.onupgradeneeded=()=>{let t=e.result;t.objectStoreNames.contains(u)||t.createObjectStore(u)},e.onsuccess=()=>n(e.result),e.onerror=()=>r(new Error(`Failed to open IndexedDB '${v}': ${e.error?.message}
+Credential storage requires IndexedDB support in your browser.`))})}async function j(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey);return{signingKey:n.privateKey,publicKeyJwk:r}}async function K(){let n=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign"]),r=await crypto.subtle.exportKey("jwk",n.publicKey),e=await crypto.subtle.exportKey("jwk",n.privateKey);return{keys:{signingKey:n.privateKey,publicKeyJwk:r},dpopKeyPair:{publicKey:r,privateKey:e}}}async function b(n){return{signingKey:await crypto.subtle.importKey("jwk",n.privateKey,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),publicKeyJwk:n.publicKey}}async function x(n,r,e,t,o){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:n.publicKeyJwk.kty,crv:n.publicKeyJwk.crv,x:n.publicKeyJwk.x,y:n.publicKeyJwk.y}},s={jti:crypto.randomUUID(),htm:r.toUpperCase(),htu:e,iat:Math.floor(Date.now()/1e3)};return t&&(s.ath=await tr(t)),o&&(s.nonce=o),await rr(a,s,n.signingKey)}function S(n){return!n||n.length===0?!1:n.some(r=>r.toUpperCase()==="ES256")}async function rr(n,r,e){let t=A(JSON.stringify(n)),o=A(JSON.stringify(r)),a=new TextEncoder().encode(`${t}.${o}`),s=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e,a),l=B(s);return`${t}.${o}.${l}`}async function tr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return B(e)}function A(n){let r=new TextEncoder().encode(n);return B(r.buffer)}function B(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}var nr=300*1e3,D=class{credentialBackend;callbackUrl;constructor(r){this.credentialBackend=new f,this.callbackUrl=r??`${window.location.origin}/browser/callback.html`}async authorize(r){let e=d(r),t=await this.discover(e);if(!t)return{success:!1,error:`No OAuth discovery endpoint found for '${e}'.`};if(!t.authorizationEndpoint||!t.tokenEndpoint)return{success:!1,error:`OAuth metadata incomplete for '${e}'.`};let o=S(t.dpopSigningAlgValuesSupported),a=null,s=null;if(o){let g=await K();a=g.keys,s=g.dpopKeyPair}let l=await this.credentialBackend.get(e),i=l?.clientId??null,c=l?.clientSecret??null;if(!i&&t.registrationEndpoint){let g=await this.registerClient(t.registrationEndpoint);if(!g)return{success:!1,error:`Dynamic client registration failed for '${e}'.`};i=g.clientId,c=g.clientSecret??null}if(!i)return{success:!1,error:`No OAuth client credentials for '${e}'.`};let m=or(),p=await sr(m),R=ir(),I=ar(t.authorizationEndpoint,i,this.callbackUrl,R,p),y=await this.openAuthPopup(I,R);if(!y)return{success:!1,error:"Authorization timed out or was cancelled."};if(y.error)return{success:!1,error:`Authorization failed: ${y.error}`};if(!y.code)return{success:!1,error:"No authorization code received."};if(y.state!==R)return{success:!1,error:"State mismatch \u2014 possible CSRF attack."};let P=await this.exchangeCode(t.tokenEndpoint,i,c,y.code,this.callbackUrl,m,a);if(!P)return{success:!1,error:"Token exchange failed."};let O={clientId:i,clientSecret:c,accessToken:P.accessToken??null,refreshToken:P.refreshToken??null,expiresAt:P.expiresIn?new Date(Date.now()+P.expiresIn*1e3).toISOString():null,tokenEndpoint:t.tokenEndpoint,dpopKeyPair:s};return await this.credentialBackend.store(e,O),{success:!0,host:e}}async getCredentialWithKeys(r){let e=await this.credentialBackend.get(r);if(!e)return null;let t=null;return e.dpopKeyPair&&(t=await b(e.dpopKeyPair)),{credential:e,dpopKeys:t}}async logout(r){let e=d(r);return await this.credentialBackend.remove(e),{success:!0,host:e}}async listAuthenticated(){return this.credentialBackend.list()}async discover(r){for(let e of[`https://${r}/.well-known/oauth-authorization-server`,`https://${r}/.well-known/openid-configuration`])try{let t=await w(e);if(!t.ok)continue;let o=await t.json();return{issuer:k(o.issuer),authorizationEndpoint:k(o.authorization_endpoint),tokenEndpoint:k(o.token_endpoint),registrationEndpoint:k(o.registration_endpoint),revocationEndpoint:k(o.revocation_endpoint),dpopSigningAlgValuesSupported:T(o.dpop_signing_alg_values_supported),codeChallengeMethodsSupported:T(o.code_challenge_methods_supported)}}catch{continue}return null}async registerClient(r){try{let e=await w(r,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({client_name:"Kanonak Browser",redirect_uris:[this.callbackUrl],grant_types:["authorization_code","refresh_token"],response_types:["code"],token_endpoint_auth_method:"none"})});if(!e.ok)return null;let t=await e.json(),o=t.client_id;return o?{clientId:o,clientSecret:t.client_secret}:null}catch{return null}}openAuthPopup(r,e){return new Promise(t=>{let o=window.open(r,"kanonak-auth","width=500,height=700,menubar=no,toolbar=no,location=yes,status=no");if(!o){t(null);return}let a=setTimeout(()=>{i(),t(null)},nr),s=c=>{c.origin===window.location.origin&&(!c.data||c.data.type!=="kanonak-auth-callback"||(i(),t({code:c.data.code??void 0,state:c.data.state??void 0,error:c.data.error??void 0})))},l=setInterval(()=>{o.closed&&(i(),t(null))},500),i=()=>{clearTimeout(a),clearInterval(l),window.removeEventListener("message",s);try{o.close()}catch{}};window.addEventListener("message",s)})}async exchangeCode(r,e,t,o,a,s,l){let i=new URLSearchParams({grant_type:"authorization_code",client_id:e,code:o,redirect_uri:a,code_verifier:s});t&&i.set("client_secret",t);let c={"Content-Type":"application/x-www-form-urlencoded"};l&&(c.DPoP=await x(l,"POST",r));try{let m=await w(r,{method:"POST",headers:c,body:i.toString()});if(!m.ok)return null;let p=await m.json();return{accessToken:p.access_token,refreshToken:p.refresh_token,expiresIn:typeof p.expires_in=="number"?p.expires_in:void 0}}catch{return null}}};function or(){let n=new Uint8Array(32);return crypto.getRandomValues(n),C(n.buffer)}async function sr(n){let r=new TextEncoder().encode(n),e=await crypto.subtle.digest("SHA-256",r);return C(e)}function ir(){let n=new Uint8Array(16);return crypto.getRandomValues(n),C(n.buffer)}function ar(n,r,e,t,o){let a=new URLSearchParams({client_id:r,response_type:"code",redirect_uri:e,state:t,code_challenge:o,code_challenge_method:"S256"});return`${n}?${a}`}function C(n){let r=new Uint8Array(n),e="";for(let t=0;t<r.length;t++)e+=String.fromCharCode(r[t]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function k(n){return typeof n=="string"?n:null}function T(n){return Array.isArray(n)?n.filter(r=>typeof r=="string"):null}export{He as AmbiguousReferenceRule,le as BooleanStatement,f as BrowserCredentialBackend,D as BrowserOAuthFlow,Ge as ClassDefinitionRule,Ue as ClassHierarchyCycleRule,ee as DefinedKanonak,ke as EdgeType,te as EmbeddedKanonak,Te as EmbeddedKanonakTypeRule,de as EmbeddedStatement,he as GraphBuilder,Y as HttpKanonakDocumentRepository,Ie as ImportExistenceRule,q as InMemoryKanonakDocumentRepository,F as KANONAK_USER_AGENT,Z as Kanonak,be as KanonakDocumentPositions,me as KanonakObjectParser,Xe as KanonakObjectValidator,L as KanonakParser,ne as KanonakUri,Se as KanonakUriBuilder,pe as ListStatement,Qe as MarkdownLinkRule,ye as MarkdownStatement,ze as NamespaceImportCycleRule,_e as NamespacePrefixRule,we as NodeType,ce as NumberStatement,Le as ObjectPropertyValueValidationRule,Ce as OntologyValidationError,Re as OntologyValidationResult,Fe as PropertyDomainRule,Ve as PropertyHierarchyCycleRule,We as PropertyKindRangeConsistencyRule,Ke as PropertyMetadata,qe as PropertyRangeReferenceRule,$e as PropertyRangeRequiredRule,Ae as PropertyTypeSpecificityRule,Q as PublisherConfigResolver,X as PublisherIndex,oe as ReferenceKanonak,ue as ReferenceStatement,ve as ResourceNamingRule,ge as ResourceResolver,Pe as ResourceTypeClassifier,ie as ScalarStatement,se as Statement,ae as StringStatement,Me as SubClassOfReferenceRule,Ne as SubPropertyOfReferenceRule,re as SubjectKanonak,je as SubjectKanonakTypeRequiredRule,fe as TypeResolver,Je as UnresolvedPredicateRule,Oe as UnresolvedReferenceRule,Ee as ValidationContext,Be as ValidationSeverity,S as browserServerSupportsDPoP,Ze as buildOntologyModel,U as compareVersions,x as createBrowserDPoPProof,M as createVersion,Ye as findDerivation,De as findInstancesByType,$ as formatVersion,K as generateBrowserDPoPKeyPair,j as generateBrowserDPoPKeys,G as getKanonakUserAgent,_ as hasValidToken,b as importDPoPKeys,z as isCompatibleVersion,E as isExpired,J as isMajorCompatible,w as kanonakFetch,d as normalizeHost,N as parseVersionString,xe as parseWithPositions,H as pickHighestDocument,W as setKanonakUserAgent,V as versionsEqual};

package/dist/chunk-2HNPPYSK.js

@@ -0,0 +1 @@
+import{i as d}from"./chunk-WGKIRLMA.js";import{c as U,d as S,m as u,r as _,v as m,w as g,y as j}from"./chunk-7BHDZHJY.js";import{a as b}from"./chunk-FUUTGGJS.js";var $=new Set(["kanonak.org/core-rdf","kanonak.org/core-owl","kanonak.org/core-xsd","kanonak.org/core-kanonak"]);function i(r){let n=r;if(n.entity&&typeof n.entity=="object"){let e=n.entity.type;if(typeof e=="string"){let a={publisher:"",package_:"",name:e.includes(".")?e.substring(e.lastIndexOf(".")+1):e};return d(a),{publisher:a.publisher,package_:a.package_,name:a.name}}}if(n.statement&&Array.isArray(n.statement)){for(let e of n.statement)if(e.predicate?.subject?.name==="type"&&e.object?.subject){let t=e.object.subject,a={publisher:t.publisher??"",package_:t.package_??"",name:t.name};return d(a),{publisher:a.publisher,package_:a.package_,name:a.name}}}return null}function c(r,n){return $.has(`${r}/${n}`)}var y=class r{static getTypeUri(n){return i(n)}static isCoreOntologyType(n){return c(n.publisher,n.package_)}static isClassType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="Class":!1}static isDatatypeType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="Datatype":!1}static isDatatypePropertyType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="DatatypeProperty":!1}static isObjectPropertyType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="ObjectProperty":!1}static isAnnotationPropertyType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="AnnotationProperty":!1}static isGenericPropertyType(n){let e=i(n);return e?c(e.publisher,e.package_)&&e.name==="Property":!1}static isAnyPropertyType(n){let e=i(n);return!e||!c(e.publisher,e.package_)?!1:e.name==="Property"||e.name==="DatatypeProperty"||e.name==="ObjectProperty"||e.name==="AnnotationProperty"}static isSchemaDefinitionType(n){let e=i(n);return!e||!c(e.publisher,e.package_)?!1:e.name==="Class"||e.name==="Property"||e.name==="DatatypeProperty"||e.name==="ObjectProperty"||e.name==="AnnotationProperty"||e.name==="Datatype"}static isInstanceOfKnownClass(n,e){if(r.isSchemaDefinitionType(n))return!1;let t=i(n);return t?e.has(t.name):!1}};function P(r){if(!r||r.trim().length===0)throw new Error("Kanonak address string cannot be null or empty");let n=r.trim(),e=n.split("/");if(e.length===1){let t=e[0];if(!t)throw new Error(`Invalid Kanonak address: "${r}". Expected publisher, publisher/package[@version], or publisher/package[@version]/name.`);if(t.includes("@"))throw new Error(`Invalid Kanonak address: "${r}". A bare publisher cannot carry an @version qualifier \u2014 versions belong to packages.`);return{kind:"publisher",publisher:t}}if(e.length===2){let[t,a]=e;if(!t||!a)throw new Error(`Invalid Kanonak address: "${r}". Expected publisher/package[@version].`);let o=a.indexOf("@");if(o===-1)return{kind:"package",publisher:t,package_:a};let s=a.substring(0,o),p=a.substring(o+1);if(!s||!p)throw new Error(`Invalid Kanonak address: "${r}". Expected publisher/package[@version].`);let f=A(p);return{kind:"package",publisher:t,package_:s,version:f}}return{kind:"resource",uri:b.parse(n)}}function G(r){switch(r.kind){case"publisher":return r.publisher;case"package":return r.version?`${r.publisher}/${r.package_}@${r.version.major}.${r.version.minor}.${r.version.patch}`:`${r.publisher}/${r.package_}`;case"resource":return r.uri.toString()}}function A(r){let n=r.split(".").map(Number);return w(n[0]||0,n[1]||0,n[2]||0)}function w(r,n,e){return{major:r,minor:n,patch:e,toString:()=>`${r}.${n}.${e}`,equals:t=>!t||typeof t!="object"?!1:t.major===r&&t.minor===n&&t.patch===e,getHashCode:()=>r<<20|n<<10|e,compareTo:t=>r!==t.major?r-t.major:n!==t.minor?n-t.minor:e-t.patch}}var k="kanonak.org",l="core-rdf",T={publisher:k,package_:l,name:"domain"},C={publisher:k,package_:l,name:"range"},R={publisher:k,package_:l,name:"subClassOf"},v={publisher:k,package_:l,name:"type"},x={publisher:k,package_:l,name:"label"},D={publisher:k,package_:l,name:"comment"},O=new b(k,l,"Resource"),I=r=>r;function V(r){try{let n=P(`${r.namespace}/${r.name}`);return n.kind==="resource"?n.uri:void 0}catch{return}}function h(r,n){let e=g(r,n);if(e)return[e];let t=[];for(let a of j(r,n))a instanceof S&&t.push(a.subject);return t}function N(r,n){let e=[],t=new Set,a=[new b(n.publisher,n.package_,n.name)];for(;a.length>0;){let o=a.shift(),s=u(o);if(t.has(s))continue;t.add(s),e.push(o);let p=_(r,o);p&&a.push(...h(p,R))}return e}function B(r,n){let e=new Set([u(O)]);for(let t of N(r,n))e.add(u(t));return e}function F(r,n){let e=B(r,n),t=[],a=new Set;for(let o of r){if(!(o instanceof U))continue;let s=I(o);if(!y.isAnyPropertyType(s))continue;let p=h(o,T);if(!p.some(E=>e.has(u(E))))continue;let f=V(o);if(!f)continue;let K=u(f);a.has(K)||(a.add(K),t.push({uri:f,label:m(o,x),comment:m(o,D),kind:y.isObjectPropertyType(s)?"object":y.isDatatypePropertyType(s)?"datatype":"other",range:g(o,C),domains:p}))}return t}function Z(r,n,e){let t=F(r,n).find(a=>u(a.uri)===u(e));return t?{ok:!0,descriptor:t}:{ok:!1,message:`Property ${e.publisher}/${e.package_}/${e.name} is not in scope for ${n.publisher}/${n.package_}/${n.name}.`}}function ee(r){return h(r,v)}export{y as a,P as b,G as c,V as d,N as e,F as f,Z as g,ee as h};

package/dist/chunk-6U26UASC.js

@@ -0,0 +1 @@
+var o=class{constructor(e,n){this.doc=e;this.broader=n}doc;broader;async getAllDocumentsAsync(){return[this.doc]}async getDocumentAsync(e){return this.broader.getDocumentAsync(e)}async getDocumentsByNamespaceAsync(e,n){return this.broader.getDocumentsByNamespaceAsync(e,n)}async getHighestCompatibleVersionAsync(e,n){return this.broader.getHighestCompatibleVersionAsync(e,n)}async saveDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async deleteDocumentAsync(){throw new Error("SingleDocumentRepository is read-only")}async clearNamespaceAsync(){throw new Error("SingleDocumentRepository is read-only")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return this.broader.getDocumentContentAsync(e)}async getDocumentUriAsync(e){return this.broader.getDocumentUriAsync(e)}};export{o as a};

package/dist/chunk-7BHDZHJY.js

@@ -0,0 +1 @@
+import{a as y}from"./chunk-FUUTGGJS.js";import{c as x,g as j}from"./chunk-2ACBWC7K.js";var c=class{};var m=class extends c{statement=[];unresolvedPredicates=[];sourceDoc=""};var f=class extends m{namespace;name;icon};var i=class e extends c{subject;static parse(t){let n=new e;return n.subject=y.parse(t),n}};var o=class{predicate;object};var s=class extends o{carrier;lexical};var k=class e extends s{static parse(t,n){let r=new e;return r.predicate=i.parse(t),r.object=n,r}};var b=class e extends s{static parse(t,n){let r=new e;return r.predicate=i.parse(t),r.object=n,r}};var l=class extends s{};var u=class e extends o{static parse(t,n){let r=new e;return r.predicate=i.parse(t),r.object=i.parse(n),r}};var g=class extends o{};var K=class extends o{};function se(e){return`${e.publisher}/${e.package_}/${e.name}`}function U(e,t){return e.publisher===t.publisher&&e.package_===t.package_&&e.name===t.name}function ce(e){let t=e.version;return t&&typeof t.major=="number"?`https://${e.publisher}/${e.package_}/${t.major}.${t.minor}.${t.patch}/${e.name}`:`https://${e.publisher}/${e.package_}/${e.name}`}function h(e,t){if(!(e instanceof m))return!1;for(let n of e.statement)if(n.predicate?.subject?.name==="type"&&n instanceof u){let a=n.object;if(U(a.subject,t))return!0}return!1}function me(e,t){let n=[];for(let r of e)r instanceof f&&h(r,t)&&n.push(r);return n}function fe(e,t){let n=t.version,r=n&&typeof n.major=="number"?`${t.publisher}/${t.package_}@${n.major}.${n.minor}.${n.patch}`:void 0;for(let a of e){if(!(a instanceof f)||a.name!==t.name)continue;let p=a.namespace||"";if(r!==void 0){if(p===r)return a}else if(p.startsWith(`${t.publisher}/${t.package_}@`))return a}}function pe(e,t){let n=[];for(let r of e){if(!(r instanceof f)||r.name!==t.name)continue;(r.namespace||"").startsWith(`${t.publisher}/${t.package_}@`)&&n.push(r)}return n.sort((r,a)=>{let p=j((r.namespace||"").split("@")[1]??""),S=j((a.namespace||"").split("@")[1]??"");return p?S?x(S,p):-1:S?1:0}),n}function d(e,t){for(let n of e.statement){let r=n.predicate;if(r?.subject&&U(r.subject,t))return n}}function ue(e,t){return d(e,t)!==void 0}function $(e,t){let n=d(e,t);if(n&&(n instanceof k||n instanceof b||n instanceof l))return n.object}function de(e,t){let n=$(e,t);return typeof n=="string"?n:void 0}function ke(e,t){let n=d(e,t);if(n instanceof u)return n.object.subject}function be(e,t){let n=d(e,t);if(n instanceof g)return n.object}function le(e,t){let n=d(e,t);return n instanceof K?n.object??[]:[]}export{c as a,m as b,f as c,i as d,o as e,s as f,k as g,b as h,l as i,u as j,g as k,K as l,se as m,U as n,ce as o,h as p,me as q,fe as r,pe as s,ue as t,$ as u,de as v,ke as w,be as x,le as y};