@kanonak-protocol/sdk 4.13.0 → 4.14.0

package/dist/index.js

@@ -1,11 +1,11 @@
-import{a as yr,b as gr,c as kr,d as hr,e as ge}from"./chunk-CR55WXIN.js";import{a as pn,c as Pe,e as _e,h as Ue,i as Fe,j as dn}from"./chunk-V72IVYR4.js";import{a as dr,b as mr,c as fr,d as L,e as M,f as l,g as mn}from"./chunk-NUXUITUC.js";import{a as un}from"./chunk-VWS25JH4.js";import"./chunk-QHABFCRC.js";import{a as Ot,b as Nt,c as _t,d as Ut,e as Ft,f as qt,g as Yt,h as Zt,i as Xt}from"./chunk-GMEPM2QQ.js";import{a as Lt,b as Mt,c as Ht,d as R,f as zt,g as Wt,h as Jt}from"./chunk-JYBKSBB5.js";import{a as Bt}from"./chunk-4NO7MHS7.js";import{a as Pr,b as wr,c as Sr,d as Rr}from"./chunk-RGOBWOBB.js";import{a as Er,b as jr}from"./chunk-PEUTCG3B.js";import{a as Cr}from"./chunk-PEJALHXK.js";import{a as Gt}from"./chunk-SC5M74NM.js";import{A as on,B as an,C as sn,D as cn,M as ln,a as Tr,b as Ar,c as Dr,d as Vr,e as Br,f as Or,g as Nr,h as _r,i as Ur,j as Fr,k as Lr,l as Mr,m as Hr,n as zr,o as Wr,p as Gr,q as Jr,r as qr,s as Yr,t as Zr,u as Xr,v as Qr,w as en,x as tn,y as rn,z as nn}from"./chunk-UBBZWWRB.js";import"./chunk-SHDHMKMJ.js";import{a as y,b as ce,c as rr,d as U,e as Oe,f as lr,g as ur,h as K}from"./chunk-BKVPSPG4.js";import{a as x}from"./chunk-NJ3AZYQD.js";import{a as pr,b as ke,c as vr,d as g,e as xr,f as Ir,g as Kr,h as $r}from"./chunk-IEOSSSB5.js";import{f as F,k as $,l as he,m as be,n as Ne}from"./chunk-7TKJHKC2.js";import{b as nr,c as or,d as I,e as ir,f as ar,h as sr,k as cr}from"./chunk-7HRKWTBB.js";import{a as Qt,b as se,c as f,d as h,e as tr,f as le,g as ue,h as pe,i as de,j as me,k as fe,l as ye}from"./chunk-4UT2CLAT.js";import{a as er}from"./chunk-FUUTGGJS.js";import{a as Kt,b as ae,c as _,d as $t,e as k,f as jt,g as Tt,h as At,i as Dt,j as Vt}from"./chunk-2ACBWC7K.js";import{a as br}from"./chunk-ODIECDN7.js";import{VersionOperator as Oa}from"@kanonak-protocol/types/document/models/enums";import{existsSync as Vn,readFileSync as Bn}from"fs";import{homedir as On}from"os";import{join as Nn}from"path";import{execFile as fn}from"child_process";import{promisify as yn}from"util";var H=yn(fn),gn="kanonak",z="/usr/bin/security",b=class{constructor(e=gn){this.service=e}service;async get(e){let t=l(e);try{let{stdout:n}=await H(z,["find-generic-password","-s",this.service,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(n.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
+import{a as yr,b as gr,c as kr,d as hr,e as he}from"./chunk-VDVJJ62W.js";import{a as cn,c as Pe,e as _e,h as Ue,i as Fe,j as ln}from"./chunk-H37TY5AQ.js";import{a as dr,b as mr,c as fr,d as L,e as M,f as l,g as un}from"./chunk-QDSN5VM3.js";import{a as sn}from"./chunk-HQQ4OAZ2.js";import"./chunk-QHABFCRC.js";import{a as Ot,b as Nt,c as _t,d as Ut,e as Ft,f as qt,g as Yt,h as Zt,i as Xt}from"./chunk-GMEPM2QQ.js";import{a as Lt,b as Mt,c as Ht,d as R,f as zt,g as Wt,h as Jt}from"./chunk-JYBKSBB5.js";import{a as Vt}from"./chunk-4NO7MHS7.js";import{a as Pr,b as wr,c as Sr,d as Rr}from"./chunk-OR3F4WIF.js";import{a as Er,b as jr}from"./chunk-PEUTCG3B.js";import{a as Cr}from"./chunk-PEJALHXK.js";import{a as Gt}from"./chunk-SC5M74NM.js";import{A as on,J as an,a as Ar,b as Tr,c as Dr,d as Br,e as Vr,f as Or,g as Nr,h as _r,i as Ur,j as Fr,k as Lr,l as Mr,m as Hr,n as zr,o as Wr,p as Gr,q as Jr,r as qr,s as Yr,t as Zr,u as Xr,v as Qr,w as en,x as tn,y as rn,z as nn}from"./chunk-MRNELSJF.js";import{a as y,b as ce,c as rr,h as F,i as Oe,j as lr,k as ur,l as $}from"./chunk-R73T4RUO.js";import{a as x}from"./chunk-NJ3AZYQD.js";import{a as pr,b as be,c as vr,d as g,e as xr,f as Ir,g as Kr,h as $r}from"./chunk-2HNPPYSK.js";import{a as Ne}from"./chunk-6U26UASC.js";import{a as nr,b as or,c as K,d as ir,e as ar,g as sr,j as cr}from"./chunk-WGKIRLMA.js";import{a as Qt,b as se,c as f,d as h,e as tr,f as le,g as ue,h as pe,i as de,j as me,k as fe,l as ye,r as U,w as I,x as ge,y as ke}from"./chunk-7BHDZHJY.js";import{a as er}from"./chunk-FUUTGGJS.js";import{a as Kt,b as ae,c as _,d as $t,e as k,f as jt,g as At,h as Tt,i as Dt,j as Bt}from"./chunk-2ACBWC7K.js";import{a as br}from"./chunk-ODIECDN7.js";import{VersionOperator as Da}from"@kanonak-protocol/types/document/models/enums";import{existsSync as An,readFileSync as Tn}from"fs";import{homedir as Dn}from"os";import{join as Bn}from"path";import{execFile as pn}from"child_process";import{promisify as dn}from"util";var H=dn(pn),mn="kanonak",z="/usr/bin/security",b=class{constructor(e=mn){this.service=e}service;async get(e){let t=l(e);try{let{stdout:n}=await H(z,["find-generic-password","-s",this.service,"-a",t,"-w"],{timeout:1e4});try{return JSON.parse(n.trim())}catch{throw new Error(`Stored credential for '${t}' is corrupted (not valid JSON).
   Run 'kanonak logout ${t}' then 'kanonak login ${t}' to fix.`)}}catch(n){if(Le(n,44))return null;throw new Error(`macOS Keychain read failed for '${t}': ${W(n)}
   The Keychain may be locked or inaccessible.
   Try unlocking it via Keychain Access.app or running 'security unlock-keychain'.`)}}async store(e,t){let n=l(e),o=JSON.stringify(t);try{await H(z,["add-generic-password","-s",this.service,"-a",n,"-U","-w",o],{timeout:1e4})}catch(i){throw new Error(`macOS Keychain write failed for '${n}': ${W(i)}
   Ensure the Keychain is unlocked and the CLI has write permission.
   On managed devices, your IT policy may block credential storage.`)}}async remove(e){let t=l(e);try{await H(z,["delete-generic-password","-s",this.service,"-a",t],{timeout:1e4})}catch(n){if(Le(n,44))return;console.warn(`  Warning: macOS Keychain delete failed for '${t}': ${W(n)}
   The credential may not have been fully removed.`)}}async list(){try{let{stdout:e}=await H(z,["dump-keychain"],{timeout:1e4}),t=[],n=!1;for(let o of e.split(`
-`))if(o.includes(`"svce"<blob>="${this.service}"`)&&(n=!0),n&&o.includes('"acct"<blob>=')){let i=o.match(/"acct"<blob>="([^"]+)"/);i&&t.push(i[1]),n=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${W(e)}`),[]}}};function Le(r,e){return typeof r=="object"&&r!==null&&"code"in r&&r.code===e}function W(r){return r instanceof Error?r.message:String(r)}import{execFile as kn}from"child_process";import{promisify as hn}from"util";var bn=hn(kn),Pn="kanonak:",P=class{constructor(e=Pn){this.targetPrefix=e}targetPrefix;async get(e){let t=this.targetPrefix+l(e),n=`
+`))if(o.includes(`"svce"<blob>="${this.service}"`)&&(n=!0),n&&o.includes('"acct"<blob>=')){let i=o.match(/"acct"<blob>="([^"]+)"/);i&&t.push(i[1]),n=!1}return t}catch(e){return console.warn(`  Warning: Could not enumerate Keychain entries: ${W(e)}`),[]}}};function Le(r,e){return typeof r=="object"&&r!==null&&"code"in r&&r.code===e}function W(r){return r instanceof Error?r.message:String(r)}import{execFile as fn}from"child_process";import{promisify as yn}from"util";var gn=yn(fn),kn="kanonak:",P=class{constructor(e=kn){this.targetPrefix=e}targetPrefix;async get(e){let t=this.targetPrefix+l(e),n=`
 ${J}
 $target = [Console]::In.ReadLine()
 $ptr = [IntPtr]::Zero
@@ -41,7 +41,7 @@ ${J}
 $target = [Console]::In.ReadLine()
 [CredMan]::CredDelete($target, 1, 0) | Out-Null`;try{await G(n,t)}catch{}}async list(){let e=`
 ${J}
-${wn}
+${hn}
 $prefix = [Console]::In.ReadLine()
 $count = 0
 $pCreds = [IntPtr]::Zero
@@ -56,7 +56,7 @@ if ([CredMan]::CredEnumerate($null, 0, [ref]$count, [ref]$pCreds)) {
   }
   [CredMan]::CredFree($pCreds)
 }`;try{let{stdout:t}=await G(e,this.targetPrefix);return t.trim().split(`
-`).map(n=>n.trim()).filter(Boolean)}catch{return[]}}};async function G(r,e){for(let t of["pwsh","powershell"])try{return await bn(t,["-NoProfile","-NonInteractive","-Command",r],{timeout:15e3,...e!==void 0&&{input:e}})}catch(n){if(t==="powershell")throw n}throw new Error("Neither pwsh nor powershell found")}var J=`
+`).map(n=>n.trim()).filter(Boolean)}catch{return[]}}};async function G(r,e){for(let t of["pwsh","powershell"])try{return await gn(t,["-NoProfile","-NonInteractive","-Command",r],{timeout:15e3,...e!==void 0&&{input:e}})}catch(n){if(t==="powershell")throw n}throw new Error("Neither pwsh nor powershell found")}var J=`
 Add-Type -TypeDefinition @"
 using System;
 using System.Runtime.InteropServices;
@@ -87,13 +87,13 @@ public class CredMan {
   [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
   public static extern bool CredEnumerate(string filter, int flags, out int count, out IntPtr credentials);
 }
-"@`,wn="";import{execFile as Sn,spawn as Rn}from"child_process";import{promisify as En}from"util";var q=En(Sn),vn="kanonak",w=class{constructor(e=vn){this.service=e}service;async get(e){let t=l(e);try{let{stdout:n}=await q("secret-tool",["lookup","service",this.service,"publisher",t],{timeout:1e4}),o=n.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let n=l(e),o=JSON.stringify(t);await new Promise((i,a)=>{let s=Rn("secret-tool",["store","--label",`Kanonak: ${n}`,"service",this.service,"publisher",n],{stdio:["pipe","ignore","ignore"],timeout:1e4});s.stdin.write(o),s.stdin.end(),s.on("close",c=>{c===0?i():a(new Error(`secret-tool store exited with code ${c}`))}),s.on("error",a)})}async remove(e){let t=l(e);try{await q("secret-tool",["clear","service",this.service,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await q("secret-tool",["search","service",this.service],{timeout:1e4}),t=[];for(let n of e.split(`
-`)){let o=n.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function j(){try{return await q("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as Me,mkdirSync as He,readFileSync as ze,writeFileSync as We}from"fs";import{createCipheriv as Cn,createDecipheriv as xn,randomBytes as Ge}from"crypto";import{homedir as In}from"os";import{join as Re,dirname as Je}from"path";var Ye=Re(In(),".config","kanonak"),T=Re(Ye,"keyring.key"),Kn=Re(Ye,"credentials.enc"),qe="aes-256-gcm",we=32,E=12,Se=16,S=class{constructor(e=Kn){this.secretsFile=e}secretsFile;async get(e){let t=this.loadStore(),n=l(e);return t[n]??null}async store(e,t){let n=this.loadStore(),o=l(e);n[o]=t,this.saveStore(n)}async remove(e){let t=this.loadStore(),n=l(e);delete t[n],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!Me(this.secretsFile))return{};try{let e=this.getOrCreateKey(),t=ze(this.secretsFile);if(t.length<E+Se)return{};let n=t.subarray(0,E),o=t.subarray(E,E+Se),i=t.subarray(E+Se),a=xn(qe,e,n);a.setAuthTag(o);let s=Buffer.concat([a.update(i),a.final()]);return JSON.parse(s.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),n=Ge(E),o=Cn(qe,t,n),i=Buffer.from(JSON.stringify(e),"utf-8"),a=Buffer.concat([o.update(i),o.final()]),s=o.getAuthTag(),c=Buffer.concat([n,s,a]);He(Je(this.secretsFile),{recursive:!0}),We(this.secretsFile,c,{mode:384})}getOrCreateKey(){if(Me(T)){let t=ze(T);if(t.length!==we)throw new Error(`Credential keyring key is corrupted (expected ${we} bytes, got ${t.length}). Delete ${T} and re-authenticate.`);return t}let e=Ge(we);return He(Je(T),{recursive:!0}),We(T,e,{mode:384}),e}};import{execFile as $n}from"child_process";import{promisify as jn}from"util";var Tn=jn($n),Ze=3e4,A=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=l(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(n){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${Y(n)}
+"@`,hn="";import{execFile as bn,spawn as Pn}from"child_process";import{promisify as wn}from"util";var q=wn(bn),Sn="kanonak",w=class{constructor(e=Sn){this.service=e}service;async get(e){let t=l(e);try{let{stdout:n}=await q("secret-tool",["lookup","service",this.service,"publisher",t],{timeout:1e4}),o=n.trim();return o?JSON.parse(o):null}catch{return null}}async store(e,t){let n=l(e),o=JSON.stringify(t);await new Promise((i,a)=>{let s=Pn("secret-tool",["store","--label",`Kanonak: ${n}`,"service",this.service,"publisher",n],{stdio:["pipe","ignore","ignore"],timeout:1e4});s.stdin.write(o),s.stdin.end(),s.on("close",c=>{c===0?i():a(new Error(`secret-tool store exited with code ${c}`))}),s.on("error",a)})}async remove(e){let t=l(e);try{await q("secret-tool",["clear","service",this.service,"publisher",t],{timeout:1e4})}catch{}}async list(){try{let{stdout:e}=await q("secret-tool",["search","service",this.service],{timeout:1e4}),t=[];for(let n of e.split(`
+`)){let o=n.match(/attribute\.publisher\s*=\s*(.+)/);o&&t.push(o[1].trim())}return t}catch{return[]}}};async function j(){try{return await q("sh",["-c","command -v secret-tool"],{timeout:5e3}),!0}catch{return!1}}import{existsSync as Me,mkdirSync as He,readFileSync as ze,writeFileSync as We}from"fs";import{createCipheriv as Rn,createDecipheriv as En,randomBytes as Ge}from"crypto";import{homedir as vn}from"os";import{join as Re,dirname as Je}from"path";var Ye=Re(vn(),".config","kanonak"),A=Re(Ye,"keyring.key"),Cn=Re(Ye,"credentials.enc"),qe="aes-256-gcm",we=32,E=12,Se=16,S=class{constructor(e=Cn){this.secretsFile=e}secretsFile;async get(e){let t=this.loadStore(),n=l(e);return t[n]??null}async store(e,t){let n=this.loadStore(),o=l(e);n[o]=t,this.saveStore(n)}async remove(e){let t=this.loadStore(),n=l(e);delete t[n],this.saveStore(t)}async list(){let e=this.loadStore();return Object.keys(e)}loadStore(){if(!Me(this.secretsFile))return{};try{let e=this.getOrCreateKey(),t=ze(this.secretsFile);if(t.length<E+Se)return{};let n=t.subarray(0,E),o=t.subarray(E,E+Se),i=t.subarray(E+Se),a=En(qe,e,n);a.setAuthTag(o);let s=Buffer.concat([a.update(i),a.final()]);return JSON.parse(s.toString("utf-8"))}catch{return{}}}saveStore(e){let t=this.getOrCreateKey(),n=Ge(E),o=Rn(qe,t,n),i=Buffer.from(JSON.stringify(e),"utf-8"),a=Buffer.concat([o.update(i),o.final()]),s=o.getAuthTag(),c=Buffer.concat([n,s,a]);He(Je(this.secretsFile),{recursive:!0}),We(this.secretsFile,c,{mode:384})}getOrCreateKey(){if(Me(A)){let t=ze(A);if(t.length!==we)throw new Error(`Credential keyring key is corrupted (expected ${we} bytes, got ${t.length}). Delete ${A} and re-authenticate.`);return t}let e=Ge(we);return He(Je(A),{recursive:!0}),We(A,e,{mode:384}),e}};import{execFile as xn}from"child_process";import{promisify as In}from"util";var Kn=In(xn),Ze=3e4,T=class{constructor(e){this.helperPath=e}helperPath;async get(e){let t=l(e);try{let o=(await this.runHelper("get",{publisher:t})).trim();return o?JSON.parse(o):null}catch(n){throw new Error(`Credential helper '${this.helperPath}' failed to read credential for '${t}': ${Y(n)}
   Verify the helper binary exists, is executable, and implements the Kanonak credential helper protocol.
   Check the 'credentialHelper' path in ~/.kanonak/config.json.`)}}async store(e,t){let n=l(e);try{await this.runHelper("store",{publisher:n,credential:t})}catch(o){throw new Error(`Credential helper '${this.helperPath}' failed to store credential for '${n}': ${Y(o)}
-  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=l(e);try{await this.runHelper("erase",{publisher:t})}catch(n){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${Y(n)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${Y(e)}`),[]}}async runHelper(e,t){try{let{stdout:n}=await Tn(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:Ze});return n}catch(n){throw An(n)?new Error(`Credential helper not found at '${this.helperPath}'.
-  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):Dn(n)?new Error(`Credential helper '${this.helperPath}' timed out after ${Ze/1e3}s on '${e}'.
-  The helper may be waiting for authentication to an external vault.`):n}}};function Y(r){return r instanceof Error?r.message:String(r)}function An(r){return r instanceof Error&&"code"in r&&r.code==="ENOENT"}function Dn(r){return r instanceof Error&&"killed"in r&&r.killed}var Ee=Nn(On(),".kanonak","config.json"),Z=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=_n(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!M(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=Un();return e.credentialHelper?new A(e.credentialHelper):process.platform==="darwin"?new b:process.platform==="win32"?new P:await j()?new w:new S}};function _n(r){let t="KANONAK_TOKEN_"+l(r).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function Un(){if(!Vn(Ee))return{};try{return JSON.parse(Bn(Ee,"utf-8"))}catch(r){let e=r instanceof Error?r.message:String(r);return console.warn(`  Warning: Failed to parse ${Ee}: ${e}
-  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{homedir as Fn}from"os";import{join as Ln}from"path";var ve="kanonak-device",Mn=Ln(Fn(),".config","kanonak","device-credentials.enc"),X=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async get(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){return process.platform==="darwin"?new b(ve):process.platform==="win32"?new P(`${ve}:`):await j()?new w(ve):new S(Mn)}};import{createHash as Hn,createPrivateKey as zn,generateKeyPairSync as Wn,randomUUID as Gn,sign as Jn}from"crypto";function Qe(){let{publicKey:r,privateKey:e}=Wn("ec",{namedCurve:"P-256"});return{publicKey:r.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function D(r,e,t,n,o,i){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},s={jti:Gn(),htm:t.toUpperCase(),htu:n,iat:Math.floor(Date.now()/1e3)};return o&&(s.ath=Hn("sha256").update(o).digest("base64url")),i&&(s.nonce=i),qn(a,s,r)}function et(r){return!r||r.length===0?!1:r.some(e=>e.toUpperCase()==="ES256")}function qn(r,e,t){let n=Xe(JSON.stringify(r)),o=Xe(JSON.stringify(e)),i=`${n}.${o}`,a=zn({key:t,format:"jwk"}),c=Jn("SHA256",Buffer.from(i),{key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${i}.${c}`}function Xe(r){return Buffer.from(r,"utf-8").toString("base64url")}function tt(r){let e=new Map;return async(t,n,o="GET")=>{if(!r)return R(t,{method:o});let i=await r.getCredential(n);if(!i?.accessToken)return R(t,{method:o});L(i)&&console.warn(`  Warning: Access token for '${n}' is expired. Run 'kanonak login ${n}' to re-authenticate.`);let a={};if(i.dpopKeyPair){let c=e.get(n);try{let u=D(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.Authorization=`DPoP ${i.accessToken}`,a.DPoP=u}catch(u){let p=u instanceof Error?u.message:String(u);console.error(`  Error: Failed to create DPoP proof for '${n}': ${p}
-  The stored key pair may be corrupted. Run 'kanonak login ${n}' to re-authenticate.`),a.Authorization=`Bearer ${i.accessToken}`}}else a.Authorization=`Bearer ${i.accessToken}`;let s=await R(t,{method:o,headers:a});if(s.status===401&&i.dpopKeyPair){let c=s.headers.get("DPoP-Nonce");if(c){e.set(n,c);try{let u=D(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.DPoP=u,s=await R(t,{method:o,headers:a})}catch{}}}return s}}import{readFileSync as Yn,writeFileSync as Zn,existsSync as Xn}from"fs";import{createHash as Qn}from"crypto";import rt from"js-yaml";var nt="kanonak.lock",eo=`# This file is generated by Kanonak CLI. Do not edit manually.
-`;function ot(r=nt){if(!Xn(r))return null;let e=Yn(r,"utf-8"),t=rt.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function it(r,e=nt){r.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(r.packages).sort())t[o]=r.packages[o];r.packages=t;let n=rt.dump(r,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Zn(e,eo+n,"utf-8")}function at(r){return`sha256:${Qn("sha256").update(r).digest("hex")}`}import*as Ie from"js-yaml";import{canonicalForm as to,canonicalHash as ro}from"@kanonak-protocol/canonical";function Ce(r){return typeof r=="object"&&r!==null&&Array.isArray(r.subjects)}import{CANONICAL_FORM_VERSION as mt}from"@kanonak-protocol/canonical";function st(r){return to(Ce(r)?r:ct(r))}function Q(r){return ro(Ce(r)?r:ct(r))}function ct(r){let e=[];for(let t of r)t instanceof f&&e.push({uri:ao(t),statements:xe(t.statement)});return{subjects:e}}function xe(r){let e=[];for(let t of r){let n=io(t);if(!n)continue;let o=no(t);o&&e.push({predicate:n,value:o})}return e}function no(r){if(r instanceof le&&r.carrier)return{lit:r.lexical??String(r.object),datatype:ut(r.carrier)};if(r instanceof ue)return{raw:r.object};if(r instanceof pe)return{raw:r.lexical??String(r.object)};if(r instanceof de)return{raw:r.lexical??String(r.object)};if(r instanceof me)return{ref:pt(r.object)};if(r instanceof fe)return lt(r.object);if(r instanceof ye)return{list:r.object.map(oo)}}function lt(r){let e=xe(r.statement);return r.name&&r.name.length>0?{embed:{name:r.name,statements:e}}:{embed:{statements:e}}}function oo(r){if(r instanceof h)return{ref:pt(r)};if(r instanceof y)return lt(r);if(r instanceof ce){if(r.carrier)return{lit:r.lexical??String(r.value),datatype:ut(r.carrier)};let e=r.value;if(typeof e=="string")return{raw:e};if(typeof e=="number")return{raw:String(e)};if(typeof e=="boolean")return{raw:String(e)}}if(r instanceof se)return{embed:{statements:xe(r.statement)}};throw new Error(`canonicalForm: list item of unrecognized kind (${r.constructor?.name??typeof r}); add canonicalization support before hashing data that contains it`)}function ut(r){return r===U.LangString?"kanonak.org/core-rdf/langString":`kanonak.org/core-xsd/${r}`}function io(r){let e=r.predicate;if(e)return dt(e.subject)}function ao(r){let e=r.namespace??"",t=r.name??"";return`${e}/${t}`}function pt(r){return dt(r.subject)}function dt(r){let e=r.version;return e&&typeof e.major=="number"?`${r.publisher}/${r.package_}@${e.major}.${e.minor}.${e.patch}/${r.name}`:`${r.publisher}/${r.package_}/${r.name}`}import{VersionOperator as ft}from"@kanonak-protocol/types/document/models/enums";var so="0.0.0",v=class{constructor(e,t=new x,n){this.repository=e;this.parser=t;this.objectParser=n??new K(this.parser)}repository;parser;objectParser;imports(){return new V}serializeValue(e,t){return kt(e,t)}async buildContentAddressed(e){let t=e.book.toImports(),n=await this.hashBody(e.publisher,t,e.body),o=Ke(n),i={type:"EphemeralPackage",publisher:e.publisher,imports:t};e.contentHashProperty&&(i[e.contentHashProperty]=n),Object.assign(i,e.header??{}),i.imports=t;let a={[o]:i,...e.body},s=this.dump(a);return{yaml:s,byteCount:gt(s),contentHash:n,packageName:o,publisher:e.publisher,resourceCount:Object.keys(e.body).length}}async buildNamed(e){let t=e.book.toImports(),n={type:e.type??"Package",publisher:e.publisher,version:e.version,imports:t},o;e.contentHashProperty&&(o=await this.hashBody(e.publisher,t,e.body),n[e.contentHashProperty]=o),Object.assign(n,e.header??{}),n.imports=t;let i={[e.name]:n,...e.body},a=this.dump(i),s={yaml:a,byteCount:gt(a),packageName:e.name,publisher:e.publisher,resourceCount:Object.keys(e.body).length};return o!==void 0&&(s.contentHash=o),s}dump(e){return Ie.dump(e,{lineWidth:-1})}async hashBody(e,t,n){let o={[yt]:{type:"EphemeralPackage",publisher:e,imports:t},...n},i=this.parser.parse(Ie.dump(o,{lineWidth:-1})),a=i.metadata.namespace_?.toString(),c=(await this.objectParser.parseKanonaks(new Ne(i,this.repository))).filter(u=>u instanceof f&&u.namespace===a&&u.name!==yt);for(let u of c)u.namespace="ephemeral";return Q(c)}},yt="__pkgbuilder_probe__";function gt(r){return new TextEncoder().encode(r).length}function Ke(r){let e="sha256:",t=r.startsWith(e)?e.length:0;return`q-${r.slice(t,t+16)}`}var V=class{byKey=new Map;aliases=new Set;ensure(e,t,n,o,i=ft.Major){let a=`${e}/${t}@${n}`,s=this.byKey.get(a);if(s)return s.alias;let c=this.uniqueAlias(o);return this.byKey.set(a,{publisher:e,package_:t,version:n,alias:c,match:i}),c}ref(e){if(!e.version||typeof e.version.major!="number")throw new Error(`Cannot serialize a reference to ${e.publisher}/${e.package_}/${e.name} without a version.`);return`${this.ensure(e.publisher,e.package_,k(e.version),e.package_)}.${e.name}`}refLatest(e,t,n,o){return`${this.ensure(e,t,so,o??t,ft.Any)}.${n}`}toImports(){let e=new Map;for(let n of this.byKey.values()){let o=e.get(n.publisher)??[];o.push(n),e.set(n.publisher,o)}return[...e.keys()].sort().map(n=>({publisher:n,packages:e.get(n).sort((o,i)=>o.package_<i.package_?-1:1).map(o=>({package:o.package_,match:ae(o.match),version:o.version,alias:o.alias}))}))}uniqueAlias(e){let t=B(e)||"pkg",n=t,o=2;for(;this.aliases.has(n);)n=`${t}${o++}`;return this.aliases.add(n),n}};function kt(r,e){if(r!=null){if(typeof r=="string"||typeof r=="number"||typeof r=="boolean")return r;if(r instanceof h)return e.ref(r.subject);if(Array.isArray(r)){let t=r.map(n=>kt(n,e)).filter(n=>n!==void 0);return t.length>0?t:void 0}if(r instanceof y)throw new Error("Embedded values are not yet supported by PackageBuilder. Produce a literal or a reference, or compose the embedded shape into the output class.");if(co(r))throw new Error(`Value produced a bare URI without a version (${r.publisher}/${r.package_}/${r.name}); cannot serialize it as a reference.`)}}function B(r){return r.replace(/[^A-Za-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}function co(r){return typeof r=="object"&&r!==null&&typeof r.publisher=="string"&&typeof r.package_=="string"&&typeof r.name=="string"}var ee=class{constructor(e){this.producers=e}producers;produced=new Map;producerFor(e,t){return this.producers.find(n=>n.canProduce(e,t))}async produceCached(e,t,n,o){let i=`${t}/${n}@${k(o)}`,a=this.produced.get(i);if(a)return a;let{document:s}=await e.produce(t,n,o);return this.produced.set(i,s),s}async getHighestCompatibleVersionAsync(e,t){let n=this.producerFor(e,t.packageName);if(!n)return null;let o={operator:t.versionOperator,version:t.version},i=await n.resolveVersion(e,t.packageName,o);return i?this.produceCached(n,e,t.packageName,i):null}async getDocumentAsync(e){let t;try{t=ke(e)}catch{return null}if(t.kind!=="package"||!t.version)return null;let n=this.producerFor(t.publisher,t.package_);return n?this.produceCached(n,t.publisher,t.package_,t.version):null}async getDocumentsByNamespaceAsync(e,t){return Array.from(this.produced.values()).filter(n=>{let o=n.metadata.namespace_;return o!=null&&o.publisher===e&&o.package_===t})}async getAllDocumentsAsync(){return Array.from(this.produced.values())}async saveDocumentAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async deleteDocumentAsync(e){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async clearNamespaceAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return null}async getDocumentUriAsync(e){return null}};var $e={async authorize(){return{allowed:!0}}},je={async record(){}},O=class extends Error{constructor(t,n){let o=`${t.publisher}/${t.package_}${t.version?`@${t.version.major}.${t.version.minor}.${t.version.patch}`:""}`;super(`Not entitled to produce ${o}${n?`: ${n}`:""}`);this.address=t;this.reason=n;this.name="EntitlementDeniedError"}address;reason},te=class{inner;ctx;policy;meter;constructor(e,t,n=$e,o=je){this.inner=e,this.ctx=t,this.policy=n,this.meter=o}canProduce(e,t){return this.inner.canProduce(e,t)}async resolveVersion(e,t,n){return await this.assertAllowed({publisher:e,package_:t,version:n.version}),this.inner.resolveVersion(e,t,n)}async produce(e,t,n){let o={publisher:e,package_:t,version:n};await this.assertAllowed(o);let i=await this.inner.produce(e,t,n);return await this.meter.record(this.ctx,o,i),i}async assertAllowed(e){let t=await this.policy.authorize(this.ctx,e);if(!t.allowed)throw new O(e,t.reason)}};var d="kanonak.org",m="view",ht="core-kanonak",lo={publisher:d,package_:m,name:"rootView"},uo={publisher:d,package_:m,name:"bind"},po={publisher:d,package_:m,name:"produces"},mo={publisher:d,package_:m,name:"projections"},fo={publisher:d,package_:m,name:"where"},yo={publisher:d,package_:m,name:"value"},go={publisher:d,package_:m,name:"as"},re=class{constructor(e,t=new x){this.repository=e;this.parser=t;this.objectParser=new K(this.parser),this.builder=new v(this.repository,this.parser,this.objectParser)}repository;parser;objectParser;builder;async materialize(e,t={}){let n=await this.objectParser.parseKanonaks(this.repository),o=this.resolveView(n,e),i=$(o,uo);if(!i)throw new Error(`View ${o.namespace}/${o.name} declares no view.bind; cannot materialize.`);let a=$(o,po);if(!a)throw new Error(`View ${o.namespace}/${o.name} is a selection view (no view.produces). In-graph materialization of selection views is not yet supported \u2014 declare a view.produces output class to reshape the result.`);let s=ko(o),c=bt(n,d,ht),u=bt(n,d,m),p=this.builder.imports(),ne=p.ensure(d,ht,c,"ck"),wt=p.ensure(d,m,u,"v"),St=p.ref(a),Rt=new Fe(this.repository,this.parser,this.objectParser),Te=new _e(Rt,n),Et=this.readProjections(n,o),vt=Po(o,fo),Ct=this.findInstances(n,i,await this.reason(t)),Ae={},xt=new Set;for(let N of Ct){if(!await this.passesWhere(Te,n,vt,N))continue;let ie={type:St};for(let Ve of Et){let It=await this.evaluateValue(Te,n,Ve.value,N),Be=this.builder.serializeValue(Pt(It),p);Be!==void 0&&(ie[p.ref(Ve.as)]=Be)}let De=g(N);De&&(ie[`${wt}.derivedFrom`]=p.ref(De)),Ae[this.rowName(N,xt)]=ie}let oe={};t.resolvedAt&&(oe[`${ne}.resolvedAt`]=t.resolvedAt),t.invocationId&&(oe[`${ne}.id`]=t.invocationId);let C=await this.builder.buildContentAddressed({publisher:s,book:p,body:Ae,contentHashProperty:`${ne}.contentHash`,header:oe});return{yaml:C.yaml,contentHash:C.contentHash,packageName:C.packageName,publisher:C.publisher,rowCount:C.resourceCount}}resolveView(e,t){let n=F(e,t);if(!n)throw new Error(`View ${t.publisher}/${t.package_}/${t.name} not found in the catalog.`);let o=$(n,lo);if(o){let i=F(e,o);if(!i)throw new Error(`ViewPackage ${t.name} names rootView ${o.name}, which is not in the catalog.`);return i}return n}readProjections(e,t){let n=[];for(let o of be(t,mo)){let i=o instanceof y?o:o instanceof h?F(e,o.subject):void 0;if(!i)continue;let a=he(i,yo),s=$(i,go);a&&s&&n.push({value:a,as:s})}return n}async reason(e){return new ge({profile:e.reasoningProfile??"owl-rl-classification"}).reason(this.repository)}findInstances(e,t,n){let o=bo(e),i=[],a=new Set;for(let s of n.getInstancesOfClass(t)){if(a.has(s))continue;a.add(s);let c=o.get(s);c&&i.push(c)}return i.sort((s,c)=>{let u=I(g(s)),p=I(g(c));return u<p?-1:u>p?1:0}),i}async passesWhere(e,t,n,o){for(let i of n){let a=await this.evaluateValue(e,t,i,o);if(!wo(a))return!1}return!0}async evaluateValue(e,t,n,o){let i=Ue(n,"view-projection",{catalog:t,depth:0}),a=new Map([["input",o]]);return e.evaluate(i,a)}rowName(e,t){let n=B(e.name)||"row",o=n,i=2;for(;t.has(o);)o=`${n}-${i++}`;return t.add(o),o}};function Pt(r){return Pe(r)?r.value:Array.isArray(r)?r.map(Pt):r}function ko(r){let e=g(r);if(!e)throw new Error(`Could not derive a publisher from view ${r.namespace}/${r.name}.`);return e.publisher}function bt(r,e,t){let n=ho(r,e,t);if(!n)throw new Error(`Package ${e}/${t} is not in the catalog; it must be importable to materialize a view.`);return n}function ho(r,e,t){let n;for(let o of r){if(!(o instanceof f))continue;let i=g(o);!i||i.publisher!==e||i.package_!==t||!i.version||(!n||_(i.version,n)>0)&&(n=i.version)}return n?k(n):void 0}function bo(r){let e=new Map,t=new Map;for(let n of r){if(!(n instanceof f))continue;let o=g(n);if(!o||!o.version)continue;let i=I(o),a=t.get(i);(!a||_(o.version,a)>0)&&(t.set(i,o.version),e.set(i,n))}return e}function Po(r,e){let t=he(r,e);return t?[t]:be(r,e).filter(n=>n instanceof y)}function wo(r){return r===!0?!0:r===!1||r===void 0||r===null?!1:typeof r=="string"?r.length>0:typeof r=="number"?r!==0:Pe(r)?r.value.length>0:Array.isArray(r)?r.length>0:!!r}export{en as AmbiguousReferenceRule,de as BooleanStatement,mt as CANONICAL_FORM_VERSION,U as Carrier,sn as ClassDefinitionRule,zr as ClassHierarchyCycleRule,_t as CompositeKanonakDocumentRepository,Z as CredentialStore,se as DefinedKanonak,Xr as DefinitionPropertyReferenceRule,X as DeviceCertificateStore,Nt as DocumentLocation,mr as EdgeType,y as EmbeddedKanonak,Lr as EmbeddedKanonakTypeRule,fe as EmbeddedStatement,O as EntitlementDeniedError,te as EntitlementProducer,Ot as FileSystemKanonakDocumentRepository,br as GitIgnoreFilter,fr as GraphBuilder,Jt as HttpKanonakDocumentRepository,V as ImportBook,Mr as ImportExistenceRule,Bt as InMemoryKanonakDocumentRepository,Lt as KANONAK_USER_AGENT,Qt as Kanonak,wr as KanonakDocumentPositions,K as KanonakObjectParser,ln as KanonakObjectValidator,x as KanonakParser,er as KanonakUri,Er as KanonakUriBuilder,Cr as KanonakUrlResolver,cr as KanonakVocabulary,ye as ListStatement,ce as LiteralKanonak,qt as LocalFirstRepository,Yt as LockAwareRepository,dn as LookRenderer,cn as MarkdownLinkRule,rr as MarkdownStatement,Yr as NamespaceImportCycleRule,Or as NamespacePrefixRule,dr as NodeType,pe as NumberStatement,kr as OWL_RL_CLASSIFICATION_RULES,rn as ObjectPropertyImportRule,nn as ObjectPropertyValueValidationRule,Dr as OntologyValidationError,Tr as OntologyValidationResult,v as PackageBuilder,Fr as PackageHeaderRule,ee as ProducerRepository,on as PropertyDomainRule,Wr as PropertyHierarchyCycleRule,Pr as PropertyMetadata,tn as PropertyRangeReferenceRule,Gr as PropertyRangeRequiredRule,_r as PropertyTypeSpecificityRule,an as PropertyValueTypeRule,zt as PublisherConfigResolver,Wt as PublisherIndex,gr as RDFS_RULES,ge as Reasoner,hr as ReasoningResult,h as ReferenceKanonak,me as ReferenceStatement,Ft as RepositoryFactory,Nr as ResourceNamingRule,nr as ResourceResolver,pr as ResourceTypeClassifier,le as ScalarStatement,tr as Statement,ue as StringStatement,Jr as SubClassOfReferenceRule,qr as SubPropertyOfReferenceRule,f as SubjectKanonak,Ur as SubjectKanonakTypeRequiredRule,yr as TripleStore,or as TypeResolver,Zr as UnresolvedPredicateRule,Hr as UnresolvedReferenceRule,Br as ValidationCache,Vr as ValidationContext,Ar as ValidationSeverity,Oa as VersionOperator,re as ViewMaterializer,Qr as XsdImportRule,$e as allowAllPolicy,Gt as assertPackageIdentity,Xt as buildLocalFirstRepository,mn as buildOntologyModel,st as canonicalForm,Q as canonicalHash,Oe as carrierOf,Zt as collectKanonakFiles,_ as compareVersions,at as computeIntegrity,Ke as contentAddressedName,$r as contextTypesOf,tt as createAuthenticatedFetch,D as createDPoPProof,jt as createVersion,ur as extractMarkdownLinks,un as findDerivation,jr as findInstancesByType,lr as findMalformedReferences,Rr as findMarkdownLinkAt,vr as formatKanonakAddress,k as formatVersion,Qe as generateDPoPKeyPair,Ut as getGlobalCachePath,Ht as getKanonakUserAgent,M as hasValidToken,At as isCompatibleVersion,L as isExpired,Dt as isMajorCompatible,R as kanonakFetch,ot as loadLockFile,ir as makeUriKey,je as noopMeter,l as normalizeHost,ke as parseKanonakAddress,Tt as parseVersionString,Sr as parseWithPositions,Vt as pickHighestDocument,Ir as propertiesInScope,pn as resolveDisplayValue,Kr as resolvePropertyStep,B as sanitizeName,it as saveLockFile,et as serverSupportsDPoP,Mt as setKanonakUserAgent,g as subjectUri,xr as superClassChain,ar as tripleKey,I as uriKey,sr as uriTriple,Kt as versionOperatorFromChar,ae as versionOperatorToChar,$t as versionsEqual};
+  Verify the helper binary supports the 'store' action.`)}}async remove(e){let t=l(e);try{await this.runHelper("erase",{publisher:t})}catch(n){console.warn(`  Warning: Credential helper '${this.helperPath}' failed to erase credential for '${t}': ${Y(n)}`)}}async list(){try{let e=await this.runHelper("list",void 0);return JSON.parse(e.trim())}catch(e){return console.warn(`  Warning: Credential helper '${this.helperPath}' failed to list credentials: ${Y(e)}`),[]}}async runHelper(e,t){try{let{stdout:n}=await Kn(this.helperPath,[e],{...t&&{input:JSON.stringify(t)},timeout:Ze});return n}catch(n){throw $n(n)?new Error(`Credential helper not found at '${this.helperPath}'.
+  Check the 'credentialHelper' path in ~/.kanonak/config.json.`):jn(n)?new Error(`Credential helper '${this.helperPath}' timed out after ${Ze/1e3}s on '${e}'.
+  The helper may be waiting for authentication to an external vault.`):n}}};function Y(r){return r instanceof Error?r.message:String(r)}function $n(r){return r instanceof Error&&"code"in r&&r.code==="ENOENT"}function jn(r){return r instanceof Error&&"killed"in r&&r.killed}var Ee=Bn(Dn(),".kanonak","config.json"),Z=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async getToken(e){let t=Vn(e);if(t)return t;let o=await(await this.getBackend()).get(e);return!o||!M(o)?null:o.accessToken??null}async getCredential(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){let e=On();return e.credentialHelper?new T(e.credentialHelper):process.platform==="darwin"?new b:process.platform==="win32"?new P:await j()?new w:new S}};function Vn(r){let t="KANONAK_TOKEN_"+l(r).replace(/[.\-]/g,"_").toUpperCase();return process.env[t]??null}function On(){if(!An(Ee))return{};try{return JSON.parse(Tn(Ee,"utf-8"))}catch(r){let e=r instanceof Error?r.message:String(r);return console.warn(`  Warning: Failed to parse ${Ee}: ${e}
+  Using default credential backend. Fix the JSON syntax or delete the file.`),{}}}import{homedir as Nn}from"os";import{join as _n}from"path";var ve="kanonak-device",Un=_n(Nn(),".config","kanonak","device-credentials.enc"),X=class{backend=null;backendReady=null;async getBackend(){if(this.backend)return this.backend;if(this.backendReady)return this.backendReady;this.backendReady=this.resolveBackend();try{return this.backend=await this.backendReady,this.backend}catch(e){throw this.backendReady=null,e}}async get(e){return(await this.getBackend()).get(e)}async store(e,t){return(await this.getBackend()).store(e,t)}async remove(e){return(await this.getBackend()).remove(e)}async list(){return(await this.getBackend()).list()}async resolveBackend(){return process.platform==="darwin"?new b(ve):process.platform==="win32"?new P(`${ve}:`):await j()?new w(ve):new S(Un)}};import{createHash as Fn,createPrivateKey as Ln,generateKeyPairSync as Mn,randomUUID as Hn,sign as zn}from"crypto";function Qe(){let{publicKey:r,privateKey:e}=Mn("ec",{namedCurve:"P-256"});return{publicKey:r.export({format:"jwk"}),privateKey:e.export({format:"jwk"})}}function D(r,e,t,n,o,i){let a={alg:"ES256",typ:"dpop+jwt",jwk:{kty:e.kty,crv:e.crv,x:e.x,y:e.y}},s={jti:Hn(),htm:t.toUpperCase(),htu:n,iat:Math.floor(Date.now()/1e3)};return o&&(s.ath=Fn("sha256").update(o).digest("base64url")),i&&(s.nonce=i),Wn(a,s,r)}function et(r){return!r||r.length===0?!1:r.some(e=>e.toUpperCase()==="ES256")}function Wn(r,e,t){let n=Xe(JSON.stringify(r)),o=Xe(JSON.stringify(e)),i=`${n}.${o}`,a=Ln({key:t,format:"jwk"}),c=zn("SHA256",Buffer.from(i),{key:a,dsaEncoding:"ieee-p1363"}).toString("base64url");return`${i}.${c}`}function Xe(r){return Buffer.from(r,"utf-8").toString("base64url")}function tt(r){let e=new Map;return async(t,n,o="GET")=>{if(!r)return R(t,{method:o});let i=await r.getCredential(n);if(!i?.accessToken)return R(t,{method:o});L(i)&&console.warn(`  Warning: Access token for '${n}' is expired. Run 'kanonak login ${n}' to re-authenticate.`);let a={};if(i.dpopKeyPair){let c=e.get(n);try{let u=D(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.Authorization=`DPoP ${i.accessToken}`,a.DPoP=u}catch(u){let p=u instanceof Error?u.message:String(u);console.error(`  Error: Failed to create DPoP proof for '${n}': ${p}
+  The stored key pair may be corrupted. Run 'kanonak login ${n}' to re-authenticate.`),a.Authorization=`Bearer ${i.accessToken}`}}else a.Authorization=`Bearer ${i.accessToken}`;let s=await R(t,{method:o,headers:a});if(s.status===401&&i.dpopKeyPair){let c=s.headers.get("DPoP-Nonce");if(c){e.set(n,c);try{let u=D(i.dpopKeyPair.privateKey,i.dpopKeyPair.publicKey,o,t,i.accessToken,c);a.DPoP=u,s=await R(t,{method:o,headers:a})}catch{}}}return s}}import{readFileSync as Gn,writeFileSync as Jn,existsSync as qn}from"fs";import{createHash as Yn}from"crypto";import rt from"js-yaml";var nt="kanonak.lock",Zn=`# This file is generated by Kanonak CLI. Do not edit manually.
+`;function ot(r=nt){if(!qn(r))return null;let e=Gn(r,"utf-8"),t=rt.load(e);return!t||typeof t!="object"||t.version!=="1"?null:{version:"1",lastUpdated:t.lastUpdated??new Date().toISOString(),packages:t.packages??{}}}function it(r,e=nt){r.lastUpdated=new Date().toISOString();let t={};for(let o of Object.keys(r.packages).sort())t[o]=r.packages[o];r.packages=t;let n=rt.dump(r,{lineWidth:-1,sortKeys:!1,quotingType:'"'});Jn(e,Zn+n,"utf-8")}function at(r){return`sha256:${Yn("sha256").update(r).digest("hex")}`}import*as Ie from"js-yaml";import{canonicalForm as Xn,canonicalHash as Qn}from"@kanonak-protocol/canonical";function Ce(r){return typeof r=="object"&&r!==null&&Array.isArray(r.subjects)}import{CANONICAL_FORM_VERSION as mt}from"@kanonak-protocol/canonical";function st(r){return Xn(Ce(r)?r:ct(r))}function Q(r){return Qn(Ce(r)?r:ct(r))}function ct(r){let e=[];for(let t of r)t instanceof f&&e.push({uri:no(t),statements:xe(t.statement)});return{subjects:e}}function xe(r){let e=[];for(let t of r){let n=ro(t);if(!n)continue;let o=eo(t);o&&e.push({predicate:n,value:o})}return e}function eo(r){if(r instanceof le&&r.carrier)return{lit:r.lexical??String(r.object),datatype:ut(r.carrier)};if(r instanceof ue)return{raw:r.object};if(r instanceof pe)return{raw:r.lexical??String(r.object)};if(r instanceof de)return{raw:r.lexical??String(r.object)};if(r instanceof me)return{ref:pt(r.object)};if(r instanceof fe)return lt(r.object);if(r instanceof ye)return{list:r.object.map(to)}}function lt(r){let e=xe(r.statement);return r.name&&r.name.length>0?{embed:{name:r.name,statements:e}}:{embed:{statements:e}}}function to(r){if(r instanceof h)return{ref:pt(r)};if(r instanceof y)return lt(r);if(r instanceof ce){if(r.carrier)return{lit:r.lexical??String(r.value),datatype:ut(r.carrier)};let e=r.value;if(typeof e=="string")return{raw:e};if(typeof e=="number")return{raw:String(e)};if(typeof e=="boolean")return{raw:String(e)}}if(r instanceof se)return{embed:{statements:xe(r.statement)}};throw new Error(`canonicalForm: list item of unrecognized kind (${r.constructor?.name??typeof r}); add canonicalization support before hashing data that contains it`)}function ut(r){return r===F.LangString?"kanonak.org/core-rdf/langString":`kanonak.org/core-xsd/${r}`}function ro(r){let e=r.predicate;if(e)return dt(e.subject)}function no(r){let e=r.namespace??"",t=r.name??"";return`${e}/${t}`}function pt(r){return dt(r.subject)}function dt(r){let e=r.version;return e&&typeof e.major=="number"?`${r.publisher}/${r.package_}@${e.major}.${e.minor}.${e.patch}/${r.name}`:`${r.publisher}/${r.package_}/${r.name}`}import{VersionOperator as ft}from"@kanonak-protocol/types/document/models/enums";var oo="0.0.0",v=class{constructor(e,t=new x,n){this.repository=e;this.parser=t;this.objectParser=n??new $(this.parser)}repository;parser;objectParser;imports(){return new B}serializeValue(e,t){return kt(e,t)}async buildContentAddressed(e){let t=e.book.toImports(),n=await this.hashBody(e.publisher,t,e.body),o=Ke(n),i={type:"EphemeralPackage",publisher:e.publisher,imports:t};e.contentHashProperty&&(i[e.contentHashProperty]=n),Object.assign(i,e.header??{}),i.imports=t;let a={[o]:i,...e.body},s=this.dump(a);return{yaml:s,byteCount:gt(s),contentHash:n,packageName:o,publisher:e.publisher,resourceCount:Object.keys(e.body).length}}async buildNamed(e){let t=e.book.toImports(),n={type:e.type??"Package",publisher:e.publisher,version:e.version,imports:t},o;e.contentHashProperty&&(o=await this.hashBody(e.publisher,t,e.body),n[e.contentHashProperty]=o),Object.assign(n,e.header??{}),n.imports=t;let i={[e.name]:n,...e.body},a=this.dump(i),s={yaml:a,byteCount:gt(a),packageName:e.name,publisher:e.publisher,resourceCount:Object.keys(e.body).length};return o!==void 0&&(s.contentHash=o),s}dump(e){return Ie.dump(e,{lineWidth:-1})}async hashBody(e,t,n){let o={[yt]:{type:"EphemeralPackage",publisher:e,imports:t},...n},i=this.parser.parse(Ie.dump(o,{lineWidth:-1})),a=i.metadata.namespace_?.toString(),c=(await this.objectParser.parseKanonaks(new Ne(i,this.repository))).filter(u=>u instanceof f&&u.namespace===a&&u.name!==yt);for(let u of c)u.namespace="ephemeral";return Q(c)}},yt="__pkgbuilder_probe__";function gt(r){return new TextEncoder().encode(r).length}function Ke(r){let e="sha256:",t=r.startsWith(e)?e.length:0;return`q-${r.slice(t,t+16)}`}var B=class{byKey=new Map;aliases=new Set;ensure(e,t,n,o,i=ft.Major){let a=`${e}/${t}@${n}`,s=this.byKey.get(a);if(s)return s.alias;let c=this.uniqueAlias(o);return this.byKey.set(a,{publisher:e,package_:t,version:n,alias:c,match:i}),c}ref(e){if(!e.version||typeof e.version.major!="number")throw new Error(`Cannot serialize a reference to ${e.publisher}/${e.package_}/${e.name} without a version.`);return`${this.ensure(e.publisher,e.package_,k(e.version),e.package_)}.${e.name}`}refLatest(e,t,n,o){return`${this.ensure(e,t,oo,o??t,ft.Any)}.${n}`}toImports(){let e=new Map;for(let n of this.byKey.values()){let o=e.get(n.publisher)??[];o.push(n),e.set(n.publisher,o)}return[...e.keys()].sort().map(n=>({publisher:n,packages:e.get(n).sort((o,i)=>o.package_<i.package_?-1:1).map(o=>({package:o.package_,match:ae(o.match),version:o.version,alias:o.alias}))}))}uniqueAlias(e){let t=V(e)||"pkg",n=t,o=2;for(;this.aliases.has(n);)n=`${t}${o++}`;return this.aliases.add(n),n}};function kt(r,e){if(r!=null){if(typeof r=="string"||typeof r=="number"||typeof r=="boolean")return r;if(r instanceof h)return e.ref(r.subject);if(Array.isArray(r)){let t=r.map(n=>kt(n,e)).filter(n=>n!==void 0);return t.length>0?t:void 0}if(r instanceof y)throw new Error("Embedded values are not yet supported by PackageBuilder. Produce a literal or a reference, or compose the embedded shape into the output class.");if(io(r))throw new Error(`Value produced a bare URI without a version (${r.publisher}/${r.package_}/${r.name}); cannot serialize it as a reference.`)}}function V(r){return r.replace(/[^A-Za-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}function io(r){return typeof r=="object"&&r!==null&&typeof r.publisher=="string"&&typeof r.package_=="string"&&typeof r.name=="string"}var ee=class{constructor(e){this.producers=e}producers;produced=new Map;producerFor(e,t){return this.producers.find(n=>n.canProduce(e,t))}async produceCached(e,t,n,o){let i=`${t}/${n}@${k(o)}`,a=this.produced.get(i);if(a)return a;let{document:s}=await e.produce(t,n,o);return this.produced.set(i,s),s}async getHighestCompatibleVersionAsync(e,t){let n=this.producerFor(e,t.packageName);if(!n)return null;let o={operator:t.versionOperator,version:t.version},i=await n.resolveVersion(e,t.packageName,o);return i?this.produceCached(n,e,t.packageName,i):null}async getDocumentAsync(e){let t;try{t=be(e)}catch{return null}if(t.kind!=="package"||!t.version)return null;let n=this.producerFor(t.publisher,t.package_);return n?this.produceCached(n,t.publisher,t.package_,t.version):null}async getDocumentsByNamespaceAsync(e,t){return Array.from(this.produced.values()).filter(n=>{let o=n.metadata.namespace_;return o!=null&&o.publisher===e&&o.package_===t})}async getAllDocumentsAsync(){return Array.from(this.produced.values())}async saveDocumentAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async deleteDocumentAsync(e){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async clearNamespaceAsync(e,t){throw new Error("ProducerRepository is read-only: a producer is a source, not a store.")}async getAllDocumentReferencesAsync(){return[]}async getDocumentContentAsync(e){return null}async getDocumentUriAsync(e){return null}};var $e={async authorize(){return{allowed:!0}}},je={async record(){}},O=class extends Error{constructor(t,n){let o=`${t.publisher}/${t.package_}${t.version?`@${t.version.major}.${t.version.minor}.${t.version.patch}`:""}`;super(`Not entitled to produce ${o}${n?`: ${n}`:""}`);this.address=t;this.reason=n;this.name="EntitlementDeniedError"}address;reason},te=class{inner;ctx;policy;meter;constructor(e,t,n=$e,o=je){this.inner=e,this.ctx=t,this.policy=n,this.meter=o}canProduce(e,t){return this.inner.canProduce(e,t)}async resolveVersion(e,t,n){return await this.assertAllowed({publisher:e,package_:t,version:n.version}),this.inner.resolveVersion(e,t,n)}async produce(e,t,n){let o={publisher:e,package_:t,version:n};await this.assertAllowed(o);let i=await this.inner.produce(e,t,n);return await this.meter.record(this.ctx,o,i),i}async assertAllowed(e){let t=await this.policy.authorize(this.ctx,e);if(!t.allowed)throw new O(e,t.reason)}};var d="kanonak.org",m="view",ht="core-kanonak",ao={publisher:d,package_:m,name:"rootView"},so={publisher:d,package_:m,name:"bind"},co={publisher:d,package_:m,name:"produces"},lo={publisher:d,package_:m,name:"projections"},uo={publisher:d,package_:m,name:"where"},po={publisher:d,package_:m,name:"value"},mo={publisher:d,package_:m,name:"as"},re=class{constructor(e,t=new x){this.repository=e;this.parser=t;this.objectParser=new $(this.parser),this.builder=new v(this.repository,this.parser,this.objectParser)}repository;parser;objectParser;builder;async materialize(e,t={}){let n=await this.objectParser.parseKanonaks(this.repository),o=this.resolveView(n,e),i=I(o,so);if(!i)throw new Error(`View ${o.namespace}/${o.name} declares no view.bind; cannot materialize.`);let a=I(o,co);if(!a)throw new Error(`View ${o.namespace}/${o.name} is a selection view (no view.produces). In-graph materialization of selection views is not yet supported \u2014 declare a view.produces output class to reshape the result.`);let s=fo(o),c=bt(n,d,ht),u=bt(n,d,m),p=this.builder.imports(),ne=p.ensure(d,ht,c,"ck"),wt=p.ensure(d,m,u,"v"),St=p.ref(a),Rt=new Fe(this.repository,this.parser,this.objectParser),Ae=new _e(Rt,n),Et=this.readProjections(n,o),vt=ko(o,uo),Ct=this.findInstances(n,i,await this.reason(t)),Te={},xt=new Set;for(let N of Ct){if(!await this.passesWhere(Ae,n,vt,N))continue;let ie={type:St};for(let Be of Et){let It=await this.evaluateValue(Ae,n,Be.value,N),Ve=this.builder.serializeValue(Pt(It),p);Ve!==void 0&&(ie[p.ref(Be.as)]=Ve)}let De=g(N);De&&(ie[`${wt}.derivedFrom`]=p.ref(De)),Te[this.rowName(N,xt)]=ie}let oe={};t.resolvedAt&&(oe[`${ne}.resolvedAt`]=t.resolvedAt),t.invocationId&&(oe[`${ne}.id`]=t.invocationId);let C=await this.builder.buildContentAddressed({publisher:s,book:p,body:Te,contentHashProperty:`${ne}.contentHash`,header:oe});return{yaml:C.yaml,contentHash:C.contentHash,packageName:C.packageName,publisher:C.publisher,rowCount:C.resourceCount}}resolveView(e,t){let n=U(e,t);if(!n)throw new Error(`View ${t.publisher}/${t.package_}/${t.name} not found in the catalog.`);let o=I(n,ao);if(o){let i=U(e,o);if(!i)throw new Error(`ViewPackage ${t.name} names rootView ${o.name}, which is not in the catalog.`);return i}return n}readProjections(e,t){let n=[];for(let o of ke(t,lo)){let i=o instanceof y?o:o instanceof h?U(e,o.subject):void 0;if(!i)continue;let a=ge(i,po),s=I(i,mo);a&&s&&n.push({value:a,as:s})}return n}async reason(e){return new he({profile:e.reasoningProfile??"owl-rl-classification"}).reason(this.repository)}findInstances(e,t,n){let o=go(e),i=[],a=new Set;for(let s of n.getInstancesOfClass(t)){if(a.has(s))continue;a.add(s);let c=o.get(s);c&&i.push(c)}return i.sort((s,c)=>{let u=K(g(s)),p=K(g(c));return u<p?-1:u>p?1:0}),i}async passesWhere(e,t,n,o){for(let i of n){let a=await this.evaluateValue(e,t,i,o);if(!ho(a))return!1}return!0}async evaluateValue(e,t,n,o){let i=Ue(n,"view-projection",{catalog:t,depth:0}),a=new Map([["input",o]]);return e.evaluate(i,a)}rowName(e,t){let n=V(e.name)||"row",o=n,i=2;for(;t.has(o);)o=`${n}-${i++}`;return t.add(o),o}};function Pt(r){return Pe(r)?r.value:Array.isArray(r)?r.map(Pt):r}function fo(r){let e=g(r);if(!e)throw new Error(`Could not derive a publisher from view ${r.namespace}/${r.name}.`);return e.publisher}function bt(r,e,t){let n=yo(r,e,t);if(!n)throw new Error(`Package ${e}/${t} is not in the catalog; it must be importable to materialize a view.`);return n}function yo(r,e,t){let n;for(let o of r){if(!(o instanceof f))continue;let i=g(o);!i||i.publisher!==e||i.package_!==t||!i.version||(!n||_(i.version,n)>0)&&(n=i.version)}return n?k(n):void 0}function go(r){let e=new Map,t=new Map;for(let n of r){if(!(n instanceof f))continue;let o=g(n);if(!o||!o.version)continue;let i=K(o),a=t.get(i);(!a||_(o.version,a)>0)&&(t.set(i,o.version),e.set(i,n))}return e}function ko(r,e){let t=ge(r,e);return t?[t]:ke(r,e).filter(n=>n instanceof y)}function ho(r){return r===!0?!0:r===!1||r===void 0||r===null?!1:typeof r=="string"?r.length>0:typeof r=="number"?r!==0:Pe(r)?r.value.length>0:Array.isArray(r)?r.length>0:!!r}export{Xr as AmbiguousReferenceRule,de as BooleanStatement,mt as CANONICAL_FORM_VERSION,F as Carrier,nn as ClassDefinitionRule,zr as ClassHierarchyCycleRule,_t as CompositeKanonakDocumentRepository,Z as CredentialStore,se as DefinedKanonak,X as DeviceCertificateStore,Nt as DocumentLocation,mr as EdgeType,y as EmbeddedKanonak,Lr as EmbeddedKanonakTypeRule,fe as EmbeddedStatement,O as EntitlementDeniedError,te as EntitlementProducer,Ot as FileSystemKanonakDocumentRepository,br as GitIgnoreFilter,fr as GraphBuilder,Jt as HttpKanonakDocumentRepository,B as ImportBook,Mr as ImportExistenceRule,Vt as InMemoryKanonakDocumentRepository,Lt as KANONAK_USER_AGENT,Qt as Kanonak,wr as KanonakDocumentPositions,$ as KanonakObjectParser,an as KanonakObjectValidator,x as KanonakParser,er as KanonakUri,Er as KanonakUriBuilder,Cr as KanonakUrlResolver,cr as KanonakVocabulary,ye as ListStatement,ce as LiteralKanonak,qt as LocalFirstRepository,Yt as LockAwareRepository,ln as LookRenderer,on as MarkdownLinkRule,rr as MarkdownStatement,Yr as NamespaceImportCycleRule,Or as NamespacePrefixRule,dr as NodeType,pe as NumberStatement,kr as OWL_RL_CLASSIFICATION_RULES,en as ObjectPropertyValueValidationRule,Dr as OntologyValidationError,Ar as OntologyValidationResult,v as PackageBuilder,Fr as PackageHeaderRule,ee as ProducerRepository,tn as PropertyDomainRule,Wr as PropertyHierarchyCycleRule,rn as PropertyKindRangeConsistencyRule,Pr as PropertyMetadata,Qr as PropertyRangeReferenceRule,Gr as PropertyRangeRequiredRule,_r as PropertyTypeSpecificityRule,zt as PublisherConfigResolver,Wt as PublisherIndex,gr as RDFS_RULES,he as Reasoner,hr as ReasoningResult,h as ReferenceKanonak,me as ReferenceStatement,Ft as RepositoryFactory,Nr as ResourceNamingRule,nr as ResourceResolver,pr as ResourceTypeClassifier,le as ScalarStatement,tr as Statement,ue as StringStatement,Jr as SubClassOfReferenceRule,qr as SubPropertyOfReferenceRule,f as SubjectKanonak,Ur as SubjectKanonakTypeRequiredRule,yr as TripleStore,or as TypeResolver,Zr as UnresolvedPredicateRule,Hr as UnresolvedReferenceRule,Vr as ValidationCache,Br as ValidationContext,Tr as ValidationSeverity,Da as VersionOperator,re as ViewMaterializer,$e as allowAllPolicy,Gt as assertPackageIdentity,Xt as buildLocalFirstRepository,un as buildOntologyModel,st as canonicalForm,Q as canonicalHash,Oe as carrierOf,Zt as collectKanonakFiles,_ as compareVersions,at as computeIntegrity,Ke as contentAddressedName,$r as contextTypesOf,tt as createAuthenticatedFetch,D as createDPoPProof,jt as createVersion,ur as extractMarkdownLinks,sn as findDerivation,jr as findInstancesByType,lr as findMalformedReferences,Rr as findMarkdownLinkAt,vr as formatKanonakAddress,k as formatVersion,Qe as generateDPoPKeyPair,Ut as getGlobalCachePath,Ht as getKanonakUserAgent,M as hasValidToken,Tt as isCompatibleVersion,L as isExpired,Dt as isMajorCompatible,R as kanonakFetch,ot as loadLockFile,ir as makeUriKey,je as noopMeter,l as normalizeHost,be as parseKanonakAddress,At as parseVersionString,Sr as parseWithPositions,Bt as pickHighestDocument,Ir as propertiesInScope,cn as resolveDisplayValue,Kr as resolvePropertyStep,V as sanitizeName,it as saveLockFile,et as serverSupportsDPoP,Mt as setKanonakUserAgent,g as subjectUri,xr as superClassChain,ar as tripleKey,K as uriKey,sr as uriTriple,Kt as versionOperatorFromChar,ae as versionOperatorToChar,$t as versionsEqual};

package/dist/kanonaks/DefinedKanonak.d.ts

@@ -27,4 +27,16 @@ export declare abstract class DefinedKanonak extends Kanonak {
      * parser populates this where it would otherwise silently drop the property.
      */
     unresolvedPredicates: UnresolvedPredicate[];
+    /**
+     * Identifier (`publisher/package@version`) of the document that AUTHORED this
+     * kanonak. Set by the parser on every subject and (recursively) every embedded
+     * it builds. After the open-world merge folds several documents' assertions
+     * onto one subject URI, a subject's own `sourceDoc` is whichever loaded first,
+     * but each EMBEDDED retains the document that authored it — so a per-document
+     * rule can walk the single shared catalog and attribute an embedded back to its
+     * author (the same role {@link UnresolvedPredicate.sourceDoc} plays for
+     * predicates), instead of re-parsing the document on its own. Empty for a
+     * hand-built kanonak the parser never stamped.
+     */
+    sourceDoc: string;
 }

package/dist/parsing/KanonakObjectParser.d.ts

@@ -4,7 +4,9 @@ import { Kanonak } from '../kanonaks/Kanonak.js';
 import type { IKanonakParser } from '@kanonak-protocol/types/document/parsing';
 export declare class KanonakObjectParser implements IKanonakObjectParser {
     constructor(_kanonakParser?: IKanonakParser);
-    parseKanonaks(documentRepository: IKanonakDocumentRepository): Promise<Kanonak[]>;
+    parseKanonaks(documentRepository: IKanonakDocumentRepository, out?: {
+        authored?: Kanonak[];
+    }): Promise<Kanonak[]>;
     /**
      * Walk a statement list, canonicalizing built-in URIs on every
      * predicate and reference target (recursing into embeddeds and list
@@ -62,6 +64,17 @@ export declare class KanonakObjectParser implements IKanonakObjectParser {
      */
     private parseSubstitutableValue;
     private parseObjectValue;
+    /**
+     * Build the embedded `tx.StringLiteral` that a `tx.Expression`-ranged object
+     * property's string value coerces to: `{ type: tx.StringLiteral,
+     * tx.stringLiteral: <value> }`. The `tx` URIs are stamped from the resolved
+     * range's coordinates (publisher/package/version) so they match the
+     * transformations version the property's range resolved to; the `type`
+     * predicate is the canonical `core-rdf/type`, re-canonicalized post-parse like
+     * every other built-in. Downstream (`TransformationLoaderV3`, `LookRenderer`)
+     * already reads this exact shape via `hasType(emb, TX_V3.StringLiteral)`.
+     */
+    private coerceExpressionLiteral;
     private parseListValue;
     /**
        * Resolve a bare name or aliased reference to a full ReferenceKanonak.

package/dist/parsing/index.js

@@ -1 +1 @@
-import{a as c,b as d,c as e,d as f}from"../chunk-RGOBWOBB.js";import{h as b}from"../chunk-BKVPSPG4.js";import{a}from"../chunk-NJ3AZYQD.js";import"../chunk-7HRKWTBB.js";import"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{d as KanonakDocumentPositions,b as KanonakObjectParser,a as KanonakParser,c as PropertyMetadata,f as findMarkdownLinkAt,e as parseWithPositions};
+import{a as c,b as d,c as e,d as f}from"../chunk-OR3F4WIF.js";import{l as b}from"../chunk-R73T4RUO.js";import{a}from"../chunk-NJ3AZYQD.js";import"../chunk-WGKIRLMA.js";import"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{d as KanonakDocumentPositions,b as KanonakObjectParser,a as KanonakParser,c as PropertyMetadata,f as findMarkdownLinkAt,e as parseWithPositions};

package/dist/reasoning/index.js

@@ -1 +1 @@
-import{a as g,b as h,c as i,d as j,e as k}from"../chunk-CR55WXIN.js";import"../chunk-BKVPSPG4.js";import"../chunk-NJ3AZYQD.js";import{d as a,e as b,f as c,h as d,j as e,k as f}from"../chunk-7HRKWTBB.js";import"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{f as KanonakVocabulary,i as OWL_RL_CLASSIFICATION_RULES,h as RDFS_RULES,k as Reasoner,j as ReasoningResult,g as TripleStore,e as canonicalizeBuiltinUri,b as makeUriKey,c as tripleKey,a as uriKey,d as uriTriple};
+import{a as g,b as h,c as i,d as j,e as k}from"../chunk-VDVJJ62W.js";import"../chunk-R73T4RUO.js";import"../chunk-NJ3AZYQD.js";import{c as a,d as b,e as c,g as d,i as e,j as f}from"../chunk-WGKIRLMA.js";import"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{f as KanonakVocabulary,i as OWL_RL_CLASSIFICATION_RULES,h as RDFS_RULES,k as Reasoner,j as ReasoningResult,g as TripleStore,e as canonicalizeBuiltinUri,b as makeUriKey,c as tripleKey,a as uriKey,d as uriTriple};

package/dist/resolution/ResourceResolver.d.ts

@@ -20,8 +20,4 @@ export declare class ResourceResolver {
     private findDocumentForAlias;
     clearCache(): void;
     clearCacheForDocument(documentKey: string): void;
-    isSubclassOfAsync(className: string, parentClassName: string, document: KanonakDocument): Promise<boolean>;
-    private isSubclassOfRecursiveAsync;
-    isSubpropertyOfAsync(propertyName: string, parentPropertyName: string, document: KanonakDocument): Promise<boolean>;
-    private isSubpropertyOfRecursiveAsync;
 }

package/dist/resolution/index.js

@@ -1 +1 @@
-import{a as p,b as y}from"../chunk-PEUTCG3B.js";import{a as s}from"../chunk-PEJALHXK.js";import{a as k}from"../chunk-SC5M74NM.js";import{a as o,b as q,c as r,d as t,e as u,f as v,g as w,h as x}from"../chunk-IEOSSSB5.js";import"../chunk-7TKJHKC2.js";import{b as m,c as n}from"../chunk-7HRKWTBB.js";import"../chunk-4UT2CLAT.js";import{a as l}from"../chunk-FUUTGGJS.js";import{a,b,c,d,e,f,g,h,i,j}from"../chunk-2ACBWC7K.js";export{l as KanonakUri,p as KanonakUriBuilder,s as KanonakUrlResolver,m as ResourceResolver,o as ResourceTypeClassifier,n as TypeResolver,k as assertPackageIdentity,c as compareVersions,x as contextTypesOf,f as createVersion,y as findInstancesByType,r as formatKanonakAddress,e as formatVersion,h as isCompatibleVersion,i as isMajorCompatible,q as parseKanonakAddress,g as parseVersionString,j as pickHighestDocument,v as propertiesInScope,w as resolvePropertyStep,t as subjectUri,u as superClassChain,a as versionOperatorFromChar,b as versionOperatorToChar,d as versionsEqual};
+import{a as p,b as y}from"../chunk-PEUTCG3B.js";import{a as s}from"../chunk-PEJALHXK.js";import{a as k}from"../chunk-SC5M74NM.js";import{a as o,b as q,c as r,d as t,e as u,f as v,g as w,h as x}from"../chunk-2HNPPYSK.js";import"../chunk-6U26UASC.js";import{a as m,b as n}from"../chunk-WGKIRLMA.js";import"../chunk-7BHDZHJY.js";import{a as l}from"../chunk-FUUTGGJS.js";import{a,b,c,d,e,f,g,h,i,j}from"../chunk-2ACBWC7K.js";export{l as KanonakUri,p as KanonakUriBuilder,s as KanonakUrlResolver,m as ResourceResolver,o as ResourceTypeClassifier,n as TypeResolver,k as assertPackageIdentity,c as compareVersions,x as contextTypesOf,f as createVersion,y as findInstancesByType,r as formatKanonakAddress,e as formatVersion,h as isCompatibleVersion,i as isMajorCompatible,q as parseKanonakAddress,g as parseVersionString,j as pickHighestDocument,v as propertiesInScope,w as resolvePropertyStep,t as subjectUri,u as superClassChain,a as versionOperatorFromChar,b as versionOperatorToChar,d as versionsEqual};

package/dist/search/index.js

@@ -1,4 +1,4 @@
-import{a as g}from"../chunk-V72IVYR4.js";import"../chunk-QHABFCRC.js";import"../chunk-4NO7MHS7.js";import"../chunk-PEUTCG3B.js";import"../chunk-PEJALHXK.js";import"../chunk-SC5M74NM.js";import"../chunk-SHDHMKMJ.js";import"../chunk-BKVPSPG4.js";import"../chunk-NJ3AZYQD.js";import{d as m,h as S}from"../chunk-IEOSSSB5.js";import{a as p,f as E}from"../chunk-7TKJHKC2.js";import"../chunk-7HRKWTBB.js";import{c as v}from"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import{c as x}from"../chunk-2ACBWC7K.js";import{homedir as P}from"os";import{join as d}from"path";import{existsSync as M,mkdirSync as D,readFileSync as j,writeFileSync as O}from"fs";import{createHash as C}from"crypto";import{pathToFileURL as B}from"url";var h="Xenova/all-MiniLM-L6-v2",w="q8",b=32;async function F(r){let{pipeline:e,env:t}=r.transformers;t.cacheDir=r.modelCacheDir??d(P(),".kanonak","models");let n=await e("feature-extraction",h,{dtype:w});return async s=>(await n(s,{pooling:"mean",normalize:!0})).tolist()}async function z(r){let e=d(r,"node_modules","@huggingface","transformers"),t=JSON.parse(j(d(e,"package.json"),"utf-8")),n=I(t);if(!n)throw new Error(`@huggingface/transformers at ${e} exposes no resolvable ESM entry.`);let s=await import(B(d(e,n)).href);return typeof s.pipeline=="function"?s:s.default}function I(r){let e=r.exports,t=n=>typeof n=="string"?n:n?.default;return typeof e=="string"?e:t(e?.node?.import)??t(e?.import)??t(e?.default)??r.module??r.main}var y=null;async function U(){return y||(y=(async()=>{let r;try{r=await import("@huggingface/transformers")}catch(e){throw new Error(`Semantic search requires the embedding runtime, which is an optional dependency.
+import{a as g}from"../chunk-H37TY5AQ.js";import"../chunk-QHABFCRC.js";import"../chunk-4NO7MHS7.js";import"../chunk-PEUTCG3B.js";import"../chunk-PEJALHXK.js";import"../chunk-SC5M74NM.js";import"../chunk-R73T4RUO.js";import"../chunk-NJ3AZYQD.js";import{d as m,h as S}from"../chunk-2HNPPYSK.js";import"../chunk-6U26UASC.js";import"../chunk-WGKIRLMA.js";import{c as v,m as p,r as E}from"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import{c as x}from"../chunk-2ACBWC7K.js";import{homedir as P}from"os";import{join as d}from"path";import{existsSync as M,mkdirSync as D,readFileSync as j,writeFileSync as O}from"fs";import{createHash as C}from"crypto";import{pathToFileURL as B}from"url";var h="Xenova/all-MiniLM-L6-v2",w="q8",b=32;async function F(r){let{pipeline:e,env:t}=r.transformers;t.cacheDir=r.modelCacheDir??d(P(),".kanonak","models");let n=await e("feature-extraction",h,{dtype:w});return async s=>(await n(s,{pooling:"mean",normalize:!0})).tolist()}async function z(r){let e=d(r,"node_modules","@huggingface","transformers"),t=JSON.parse(j(d(e,"package.json"),"utf-8")),n=I(t);if(!n)throw new Error(`@huggingface/transformers at ${e} exposes no resolvable ESM entry.`);let s=await import(B(d(e,n)).href);return typeof s.pipeline=="function"?s:s.default}function I(r){let e=r.exports,t=n=>typeof n=="string"?n:n?.default;return typeof e=="string"?e:t(e?.node?.import)??t(e?.import)??t(e?.default)??r.module??r.main}var y=null;async function U(){return y||(y=(async()=>{let r;try{r=await import("@huggingface/transformers")}catch(e){throw new Error(`Semantic search requires the embedding runtime, which is an optional dependency.
 Install it with:
   npm install @huggingface/transformers
 (underlying import error: ${e.message})`)}return F({transformers:r})})()),y}function H(r,e){let t=0;for(let n=0;n<r.length;n++)t+=r[n]*e[n];return t}function R(r,e){return e?r.version?e.version?x(r.version,e.version)>0:!0:!1:!0}function K(r,e){let t=g(r,e),n=[t.label],s=S(e);if(s.length>0){let i=E(r,s[0]),a=i?g(r,i).label:s[0].name;a&&n.push(`\u2014 a ${a}.`)}return t.summary&&n.push(t.summary),n.join(" ")}function q(r){let e=new Map;for(let t of r){if(!(t instanceof v))continue;let n=m(t);if(!n)continue;let s=p(n),i=e.get(s);(!i||R(n,m(i)))&&e.set(s,t)}return[...e.values()].sort((t,n)=>{let s=m(t)?p(m(t)):t.name,i=m(n)?p(m(n)):n.name;return s.localeCompare(i)})}var k=class{entries=[];embedder;constructor(e={}){this.embedder=e.embedder}resolveEmbedder(){return this.embedder?Promise.resolve(this.embedder):U()}get size(){return this.entries.length}async build(e,t={}){let n=q(e);if(t.include&&(n=n.filter(t.include)),n.length===0)return this.entries=[],{size:0,cached:!1};let s=n.map(o=>K(e,o)),i=t.cacheDir,a;if(i){let o=C("sha256").update(h+"|"+w+`

package/dist/server/index.js

@@ -1,4 +1,4 @@
-import{j as ee}from"../chunk-V72IVYR4.js";import"../chunk-QHABFCRC.js";import{a as he,d as z,f as ye,h as J}from"../chunk-GMEPM2QQ.js";import{d as me,e as fe,f as ke,g as O,h as Y}from"../chunk-JYBKSBB5.js";import{a as ge}from"../chunk-4NO7MHS7.js";import"../chunk-PEUTCG3B.js";import{a as ve}from"../chunk-PEJALHXK.js";import"../chunk-SC5M74NM.js";import"../chunk-SHDHMKMJ.js";import{h as Q}from"../chunk-BKVPSPG4.js";import{a as E}from"../chunk-NJ3AZYQD.js";import{b as X}from"../chunk-IEOSSSB5.js";import{g as Z}from"../chunk-7TKJHKC2.js";import"../chunk-7HRKWTBB.js";import{c as be}from"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import{c as M,e as F,f as L,g as ue}from"../chunk-2ACBWC7K.js";import{readFileSync as De,writeFileSync as _e,mkdirSync as je}from"fs";import{join as $e}from"path";function Se(t){let e=t.metadata?.namespace_;return e?`${e.publisher}/${e.package_}`:void 0}async function H(t,e){let n=new Set,r=[...t];for(;r.length>0;){let s=r.shift(),a=Se(s);if(!a||n.has(a))continue;n.add(a);let m=s.metadata?.imports;if(m)for(let[p,k]of Object.entries(m))for(let d of k)try{let u=await e.getHighestCompatibleVersionAsync(p,d);u&&r.push(u)}catch{}}return n}var V=class{constructor(e,n){this.inner=e;this.scope=n}inner;scope;async getAllDocumentsAsync(){return(await this.inner.getAllDocumentsAsync()).filter(n=>{let r=Se(n);return r!==void 0&&this.scope.has(r)})}getDocumentAsync(e){return this.inner.getDocumentAsync(e)}getDocumentsByNamespaceAsync(e,n){return this.inner.getDocumentsByNamespaceAsync(e,n)}getHighestCompatibleVersionAsync(e,n){return this.inner.getHighestCompatibleVersionAsync(e,n)}saveDocumentAsync(e,n){return this.inner.saveDocumentAsync(e,n)}deleteDocumentAsync(e){return this.inner.deleteDocumentAsync(e)}clearNamespaceAsync(e,n){return this.inner.clearNamespaceAsync(e,n)}getAllDocumentReferencesAsync(){return this.inner.getAllDocumentReferencesAsync()}getDocumentContentAsync(e){return this.inner.getDocumentContentAsync(e)}getDocumentUriAsync(e){return this.inner.getDocumentUriAsync(e)}};var we=[{publisher:"kanonak.org",package_:"core-kanonak"},{publisher:"kanonak.org",package_:"site"},{publisher:"kanonak.org",package_:"link"},{publisher:"kanonak.org",package_:"look-tokens"},{publisher:"kanonak.org",package_:"look-styles"},{publisher:"kanonak.org",package_:"look"},{publisher:"kanonak.org",package_:"universal-look"}];function T(t){let e=t?.render;if(e&&e.length>0){let n=[];for(let r of e)try{let s=X(r);s.kind==="package"?n.push({publisher:s.publisher,package_:s.package_}):s.kind==="resource"&&n.push({publisher:s.uri.publisher,package_:s.uri.package_})}catch{}if(n.length>0)return n}return we}function C(t){return`${t.publisher}/${t.package_}`}function W(t){let e={"kanonak.org/look-styles":"pages render UNSTYLED \u2014 generated CSS stops at the :root token block","kanonak.org/look-tokens":"the :root block loses the universal design-token floor (colors, fonts, spacing)","kanonak.org/universal-look":"resources without their own look render as an empty HTML comment","kanonak.org/look":"band vocabulary (Hero, PropertyList, \u2026) is unresolvable \u2014 declared looks cannot render","kanonak.org/site":"the site vocabulary (content, navigation) is unresolvable \u2014 the base stylesheet cannot bind","kanonak.org/core-kanonak":"the Package/Publisher classes are unresolvable \u2014 package and publisher pages degrade","kanonak.org/link":"link vocabulary is unresolvable \u2014 cross-reference styling degrades"},n=[];for(let r of t)if(r.origin==="missing"){let s=C(r),a=e[s]??"whatever this package contributes to rendering is lost";n.push(`Render-stack package ${s} is MISSING (${r.reason??"unknown reason"}) \u2014 ${a}. Fix: kanonak install ${s} (as the user running the render), or restore network access to ${r.publisher}.`)}else r.resolvedButNotInCatalog&&n.push(`Render-stack package ${C(r)} resolved (${r.origin}) but is NOT in the parsed catalog \u2014 this is a closure-scoping bug; please report it.`);return n}function re(t){let{publisher:e,availablePublishers:n,catalog:r,lookRenderer:s,localNamespaces:a,rawByNsKey:m,renderStack:p,producers:k}=t,d=new Map,u=new Map,o=new Map,h=new Set;for(let y of r){if(!(y instanceof be))continue;let b=y.namespace||"";if(!a.has(b))continue;d.set(`${b}/${y.name}`,y);let $=b.split("/")[1]??"",[w,_]=$.split("@");if(!w||!_)continue;let I=ue(_);I&&(h.has($)||(h.add($),u.has(w)||u.set(w,[]),u.get(w).push({verStr:_,version:I})),y.name===w&&o.set($,y))}for(let y of u.values())y.sort((b,$)=>M($.version,b.version));return{publisher:e,availablePublishers:n,catalog:r,lookRenderer:s,localNamespaces:a,rawByNsKey:m,bySubject:d,pkgVersions:u,pkgSelfByVer:o,renderStack:p,...k?{producers:k}:{}}}async function se(t,e={}){let n=new E,r=new ge(n),s=[],a=[];for(let c of J(t)){let l;try{l=De(c,"utf-8")}catch{continue}let v;try{v=n.parse(l).metadata?.namespace_}catch{continue}if(!v?.version)continue;let N=v.version;a.push({publisher:v.publisher,package_:v.package_,verStr:F(N),version:N,source:l})}a.sort((c,l)=>M(l.version,c.version));for(let c of a)await r.saveDocumentAsync(n.parse(c.source),`${c.publisher}/${c.package_}@${c.verStr}`),s.push({publisher:c.publisher,package_:c.package_,verStr:c.verStr,source:c.source});let m=[...new Set(s.map(c=>c.publisher))].sort(),p=e.publisher;if(p){if(!m.includes(p))throw new Error(`Publisher "${p}" not found in workspace. Available: ${m.join(", ")||"(none)"}`)}else if(m.length===1)p=m[0];else throw m.length===0?new Error(`No Kanonak packages found under ${t}`):new Error(`Workspace has multiple publishers (${m.join(", ")}). Pass --publisher <domain> to choose which one to serve.`);let k=new Set,d=new Map;for(let c of s)c.publisher===p&&(k.add(`${c.publisher}/${c.package_}@${c.verStr}`),d.set(`${c.package_}@${c.verStr}`,c.source));let u=z(),o=new he(u,!0,n),h={};e.httpCache&&(h.getFromCache=e.httpCache.getFromCache,h.onFetch=e.httpCache.onFetch),e.fetchFn&&(h.fetchFn=e.fetchFn);let y=e.repository??new ye(r,o,new Y(h)),b=e.log??(()=>{}),$=T(void 0),w=[],_=c=>c.map(l=>l.metadata.namespace_?.version).filter(l=>l!==void 0).sort((l,v)=>M(v,l)).map(F);if(!e.repository){b(`[render-stack] resolving ${$.length} ambient look-stack package(s); cache: ${u}`);let c=e.fetchFn?new O({fetchFn:e.fetchFn}):new O;for(let l of $){let v=C(l),N=await r.getDocumentsByNamespaceAsync(l.publisher,l.package_);if(N.length>0){let S=_(N);w.push({...l,origin:"workspace",versions:S}),b(`[render-stack]   ${v} \u2014 workspace (${S.join(", ")})`);continue}let U=await o.getDocumentsByNamespaceAsync(l.publisher,l.package_);if(U.length>0){let S=_(U);w.push({...l,origin:"cache",versions:S}),b(`[render-stack]   ${v} \u2014 cache (${S.join(", ")})`);continue}try{let S=await c.getHighestVersion(l.publisher,l.package_);if(!S){let f=`publisher ${l.publisher} reachable but its index does not list ${l.package_}`;w.push({...l,origin:"missing",reason:f}),b(`[render-stack]   ${v} \u2014 MISSING: ${f}`);continue}let j=await c.getPackageUrl(l.publisher,l.package_,S),i=await(e.fetchFn?e.fetchFn(j,l.publisher):me(j));if(!i.ok){let f=`fetch ${j} failed: HTTP ${i.status} ${i.statusText}`;w.push({...l,origin:"missing",reason:f}),b(`[render-stack]   ${v} \u2014 MISSING: ${f}`);continue}let g=await i.text();await r.saveDocumentAsync(n.parse(g),`${l.publisher}/${l.package_}@${S}`);try{let f=$e(u,l.publisher);je(f,{recursive:!0}),_e($e(f,`${l.package_}@${S}.kan.yml`),g,"utf-8"),w.push({...l,origin:"fetched",versions:[S]}),b(`[render-stack]   ${v}@${S} \u2014 fetched from ${j}, installed to cache`)}catch(f){w.push({...l,origin:"fetched",versions:[S]}),b(`[render-stack]   ${v}@${S} \u2014 fetched from ${j}, but cache ${u} is NOT WRITABLE (${f.message}); usable for this load only \u2014 every load will re-fetch it`)}}catch(S){let j=`fetch failed: ${S.message}`;w.push({...l,origin:"missing",reason:j}),b(`[render-stack]   ${v} \u2014 MISSING: ${j}`)}}}let I=y;if(!e.repository){let c=(await r.getAllDocumentsAsync()).filter(v=>v.metadata.namespace_?.publisher===p),l=await H(c,y);for(let v of $)l.add(C(v));I=new V(y,l)}let B=await new Q(n).parseKanonaks(I),oe=new ee(B),G=(c,l)=>Z(B,{publisher:c,package_:l,name:l}).length>0,A;if(e.repository){A=[];for(let c of $){let l=await y.getDocumentsByNamespaceAsync(c.publisher,c.package_);A.push(l.length>0?{...c,origin:"repository",versions:_(l)}:{...c,origin:"missing",reason:"not present in the caller-supplied repository"})}}else A=w.map(c=>c.origin==="missing"||G(c.publisher,c.package_)?c:{...c,resolvedButNotInCatalog:!0});let q=W(A);for(let c of q)b(`[render-stack] WARNING: ${c}`);return re({publisher:p,availablePublishers:m,catalog:B,lookRenderer:oe,localNamespaces:k,rawByNsKey:d,renderStack:{contractSource:"universal-default",cachePath:u,packages:A,warnings:q}})}import{existsSync as Ce,readFileSync as Ae,writeFileSync as Ie,mkdirSync as Ne}from"fs";import{join as Re}from"path";async function ae(t,e={}){let n=new E,r=X(t),s=r.kind==="resource"?r.uri.publisher:r.publisher,a=e.log??(()=>{}),m=e.cacheRoot??z(),p=(i,g,f)=>Re(m,i,`${g}@${f}.kan.yml`),k=new Set,d=new Set,u=new Map,o=new Y({getFromCache:(i,g,f)=>{let D=p(i,g,f),R=Ce(D)?Ae(D,"utf-8"):null;return R!==null&&k.add(`${i}/${g}`),R},onFetch:(i,g,f,D)=>{d.add(`${i}/${g}`);try{let R=Re(m,i);Ne(R,{recursive:!0}),Ie(p(i,g,f),D,"utf-8")}catch(R){u.set(`${i}/${g}`,R.message),a(`[render] fetched ${i}/${g}@${f} but cache ${m} is NOT WRITABLE (${R.message}); usable for this load only \u2014 every load will re-fetch it`)}},...e.fetchFn?{fetchFn:e.fetchFn}:{}}),h=new O(e.fetchFn?{fetchFn:e.fetchFn}:void 0),y;if(r.kind==="resource"){let i=r.uri.version;y=[i?{package_:r.uri.package_,version:`${i.major}.${i.minor}.${i.patch}`}:{package_:r.uri.package_}]}else if(r.kind==="package"){let i=r.version;y=[i?{package_:r.package_,version:`${i.major}.${i.minor}.${i.patch}`}:{package_:r.package_}]}else y=(await h.listLatestPackages(s)).map(g=>({package_:g.packageName}));let b=async(i,g,f)=>{try{let D=f?n.buildImport(g,"=",f,i):n.buildImport(g,"*","0.0.0",i),R=await o.getHighestCompatibleVersionAsync(i,D);return R?{doc:R}:{doc:null,error:`${i} did not resolve ${g}${f?`@${f}`:""} (not in its index, or unreachable)`}}catch(D){return{doc:null,error:D.message}}},$=[],w=[];for(let i of y){let{doc:g,error:f}=await b(s,i.package_,i.version);g?$.push(g):f&&w.push(f)}if($.length===0)throw new Error(`Could not fetch any package for address "${t}" from publisher "${s}".`+(w.length>0?` Reasons: ${w.join("; ")}`:""));let _=await new ke(e.fetchFn).getConfig(s).catch(()=>{}),I=T(_),B=_?.render&&_.render.length>0?"publisher-well-known":"universal-default",oe=i=>i.map(g=>g.metadata.namespace_?.version).filter(g=>g!==void 0).sort((g,f)=>M(f,g)).map(F);a(`[render-stack] resolving ${I.length} ambient look-stack package(s) (contract: ${B}); cache: ${m}`);let G=[],A=[];for(let i of I){let g=C(i),{doc:f,error:D}=await b(i.publisher,i.package_,void 0);if(f){G.push(f);let R=oe([f]),pe=d.has(g)?"fetched":k.has(g)?"cache":"fetched";A.push({...i,origin:pe,versions:R}),a(`[render-stack]   ${g} \u2014 ${pe} (${R.join(", ")})`+(u.has(g)?" [cache write FAILED \u2014 will re-fetch next load]":""))}else A.push({...i,origin:"missing",reason:D??"unresolved"}),a(`[render-stack]   ${g} \u2014 MISSING: ${D??"unresolved"}`)}let q=await H([...$,...G],o),de=new V(o,q),c=await new Q(n).parseKanonaks(de),l=new ee(c),v=A.map(i=>i.origin==="missing"||Z(c,{publisher:i.publisher,package_:i.package_,name:i.package_}).length>0?i:{...i,resolvedButNotInCatalog:!0}),N=W(v);for(let i of N)a(`[render-stack] WARNING: ${i}`);let U={contractSource:B,cachePath:m,packages:v,warnings:N},S=new Set,j=new Map;for(let i of await o.getAllDocumentsAsync()){let g=i.metadata.namespace_;if(!g?.version||g.publisher!==s)continue;let f=F(g.version),D=`${g.publisher}/${g.package_}@${f}`;S.add(D);let R=await o.getDocumentContentAsync(D);R!==null&&j.set(`${g.package_}@${f}`,R)}return re({publisher:s,availablePublishers:[s],catalog:c,lookRenderer:l,localNamespaces:S,rawByNsKey:j,renderStack:U})}import{VersionOperator as ne}from"@kanonak-protocol/types/document/models/enums";function te(t){let{lookRenderer:e,publisher:n,renderStack:r,catalog:s}=t,a=e.explainStylesheet(e.publisherSubject(n)),m=[...a.tokens.entries()].map(([o,h])=>({name:o,value:h.value,source:`${h.sourceNamespace}/${h.sourceName}`,level:h.level})),p=a.baseStylesheet,k={present:p.css!==void 0,...p.sourceNamespace!==void 0?{source:p.sourceNamespace}:{},...p.scope!==void 0?{scope:p.scope}:{},...p.css!==void 0?{bytes:p.css.length}:{},...p.problem!==void 0?{problem:p.problem}:{},candidates:p.candidates},d=new Map;for(let o of s){let h=o.namespace;h&&d.set(h,(d.get(h)??0)+1)}let u=[...d.entries()].map(([o,h])=>({namespace:o,resources:h})).sort((o,h)=>o.namespace.localeCompare(h.namespace));return{publisher:n,renderStack:{contractSource:r.contractSource,cachePath:r.cachePath,packages:r.packages.map(o=>({package_:C(o),origin:o.origin,...o.versions!==void 0?{versions:o.versions}:{},...o.reason!==void 0?{reason:o.reason}:{},...o.resolvedButNotInCatalog!==void 0?{resolvedButNotInCatalog:o.resolvedButNotInCatalog}:{}}))},stylesheet:{tokens:m,baseStylesheet:k,...a.look?{look:{sourceClass:`${a.look.sourceClass.publisher}/${a.look.sourceClass.package_}/${a.look.sourceClass.name}`}}:{}},catalog:u,warnings:[...r.warnings,...a.warnings.filter(o=>!r.warnings.includes(o))]}}function Fe(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function ie(t){let e=Fe,n=t.warnings.length===0,r=t.warnings.length===0?'<p class="ok">\u2713 No problems detected \u2014 the render stack is fully resolved and pages should be styled.</p>':t.warnings.map(d=>`<div class="warn">\u26A0 ${e(d)}</div>`).join(`
+import{j as ee}from"../chunk-H37TY5AQ.js";import"../chunk-QHABFCRC.js";import{a as he,d as z,f as ye,h as J}from"../chunk-GMEPM2QQ.js";import{d as me,e as fe,f as ke,g as O,h as Y}from"../chunk-JYBKSBB5.js";import{a as ge}from"../chunk-4NO7MHS7.js";import"../chunk-PEUTCG3B.js";import{a as ve}from"../chunk-PEJALHXK.js";import"../chunk-SC5M74NM.js";import{l as X}from"../chunk-R73T4RUO.js";import{a as E}from"../chunk-NJ3AZYQD.js";import{b as Z}from"../chunk-2HNPPYSK.js";import"../chunk-6U26UASC.js";import"../chunk-WGKIRLMA.js";import{c as be,s as Q}from"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import{c as M,e as F,f as L,g as ue}from"../chunk-2ACBWC7K.js";import{readFileSync as De,writeFileSync as _e,mkdirSync as je}from"fs";import{join as $e}from"path";function Se(t){let e=t.metadata?.namespace_;return e?`${e.publisher}/${e.package_}`:void 0}async function H(t,e){let n=new Set,r=[...t];for(;r.length>0;){let s=r.shift(),a=Se(s);if(!a||n.has(a))continue;n.add(a);let m=s.metadata?.imports;if(m)for(let[p,k]of Object.entries(m))for(let d of k)try{let u=await e.getHighestCompatibleVersionAsync(p,d);u&&r.push(u)}catch{}}return n}var V=class{constructor(e,n){this.inner=e;this.scope=n}inner;scope;async getAllDocumentsAsync(){return(await this.inner.getAllDocumentsAsync()).filter(n=>{let r=Se(n);return r!==void 0&&this.scope.has(r)})}getDocumentAsync(e){return this.inner.getDocumentAsync(e)}getDocumentsByNamespaceAsync(e,n){return this.inner.getDocumentsByNamespaceAsync(e,n)}getHighestCompatibleVersionAsync(e,n){return this.inner.getHighestCompatibleVersionAsync(e,n)}saveDocumentAsync(e,n){return this.inner.saveDocumentAsync(e,n)}deleteDocumentAsync(e){return this.inner.deleteDocumentAsync(e)}clearNamespaceAsync(e,n){return this.inner.clearNamespaceAsync(e,n)}getAllDocumentReferencesAsync(){return this.inner.getAllDocumentReferencesAsync()}getDocumentContentAsync(e){return this.inner.getDocumentContentAsync(e)}getDocumentUriAsync(e){return this.inner.getDocumentUriAsync(e)}};var we=[{publisher:"kanonak.org",package_:"core-kanonak"},{publisher:"kanonak.org",package_:"site"},{publisher:"kanonak.org",package_:"link"},{publisher:"kanonak.org",package_:"look-tokens"},{publisher:"kanonak.org",package_:"look-styles"},{publisher:"kanonak.org",package_:"look"},{publisher:"kanonak.org",package_:"universal-look"}];function T(t){let e=t?.render;if(e&&e.length>0){let n=[];for(let r of e)try{let s=Z(r);s.kind==="package"?n.push({publisher:s.publisher,package_:s.package_}):s.kind==="resource"&&n.push({publisher:s.uri.publisher,package_:s.uri.package_})}catch{}if(n.length>0)return n}return we}function C(t){return`${t.publisher}/${t.package_}`}function W(t){let e={"kanonak.org/look-styles":"pages render UNSTYLED \u2014 generated CSS stops at the :root token block","kanonak.org/look-tokens":"the :root block loses the universal design-token floor (colors, fonts, spacing)","kanonak.org/universal-look":"resources without their own look render as an empty HTML comment","kanonak.org/look":"band vocabulary (Hero, PropertyList, \u2026) is unresolvable \u2014 declared looks cannot render","kanonak.org/site":"the site vocabulary (content, navigation) is unresolvable \u2014 the base stylesheet cannot bind","kanonak.org/core-kanonak":"the Package/Publisher classes are unresolvable \u2014 package and publisher pages degrade","kanonak.org/link":"link vocabulary is unresolvable \u2014 cross-reference styling degrades"},n=[];for(let r of t)if(r.origin==="missing"){let s=C(r),a=e[s]??"whatever this package contributes to rendering is lost";n.push(`Render-stack package ${s} is MISSING (${r.reason??"unknown reason"}) \u2014 ${a}. Fix: kanonak install ${s} (as the user running the render), or restore network access to ${r.publisher}.`)}else r.resolvedButNotInCatalog&&n.push(`Render-stack package ${C(r)} resolved (${r.origin}) but is NOT in the parsed catalog \u2014 this is a closure-scoping bug; please report it.`);return n}function re(t){let{publisher:e,availablePublishers:n,catalog:r,lookRenderer:s,localNamespaces:a,rawByNsKey:m,renderStack:p,producers:k}=t,d=new Map,u=new Map,o=new Map,h=new Set;for(let y of r){if(!(y instanceof be))continue;let b=y.namespace||"";if(!a.has(b))continue;d.set(`${b}/${y.name}`,y);let $=b.split("/")[1]??"",[w,_]=$.split("@");if(!w||!_)continue;let I=ue(_);I&&(h.has($)||(h.add($),u.has(w)||u.set(w,[]),u.get(w).push({verStr:_,version:I})),y.name===w&&o.set($,y))}for(let y of u.values())y.sort((b,$)=>M($.version,b.version));return{publisher:e,availablePublishers:n,catalog:r,lookRenderer:s,localNamespaces:a,rawByNsKey:m,bySubject:d,pkgVersions:u,pkgSelfByVer:o,renderStack:p,...k?{producers:k}:{}}}async function se(t,e={}){let n=new E,r=new ge(n),s=[],a=[];for(let c of J(t)){let l;try{l=De(c,"utf-8")}catch{continue}let v;try{v=n.parse(l).metadata?.namespace_}catch{continue}if(!v?.version)continue;let N=v.version;a.push({publisher:v.publisher,package_:v.package_,verStr:F(N),version:N,source:l})}a.sort((c,l)=>M(l.version,c.version));for(let c of a)await r.saveDocumentAsync(n.parse(c.source),`${c.publisher}/${c.package_}@${c.verStr}`),s.push({publisher:c.publisher,package_:c.package_,verStr:c.verStr,source:c.source});let m=[...new Set(s.map(c=>c.publisher))].sort(),p=e.publisher;if(p){if(!m.includes(p))throw new Error(`Publisher "${p}" not found in workspace. Available: ${m.join(", ")||"(none)"}`)}else if(m.length===1)p=m[0];else throw m.length===0?new Error(`No Kanonak packages found under ${t}`):new Error(`Workspace has multiple publishers (${m.join(", ")}). Pass --publisher <domain> to choose which one to serve.`);let k=new Set,d=new Map;for(let c of s)c.publisher===p&&(k.add(`${c.publisher}/${c.package_}@${c.verStr}`),d.set(`${c.package_}@${c.verStr}`,c.source));let u=z(),o=new he(u,!0,n),h={};e.httpCache&&(h.getFromCache=e.httpCache.getFromCache,h.onFetch=e.httpCache.onFetch),e.fetchFn&&(h.fetchFn=e.fetchFn);let y=e.repository??new ye(r,o,new Y(h)),b=e.log??(()=>{}),$=T(void 0),w=[],_=c=>c.map(l=>l.metadata.namespace_?.version).filter(l=>l!==void 0).sort((l,v)=>M(v,l)).map(F);if(!e.repository){b(`[render-stack] resolving ${$.length} ambient look-stack package(s); cache: ${u}`);let c=e.fetchFn?new O({fetchFn:e.fetchFn}):new O;for(let l of $){let v=C(l),N=await r.getDocumentsByNamespaceAsync(l.publisher,l.package_);if(N.length>0){let S=_(N);w.push({...l,origin:"workspace",versions:S}),b(`[render-stack]   ${v} \u2014 workspace (${S.join(", ")})`);continue}let U=await o.getDocumentsByNamespaceAsync(l.publisher,l.package_);if(U.length>0){let S=_(U);w.push({...l,origin:"cache",versions:S}),b(`[render-stack]   ${v} \u2014 cache (${S.join(", ")})`);continue}try{let S=await c.getHighestVersion(l.publisher,l.package_);if(!S){let f=`publisher ${l.publisher} reachable but its index does not list ${l.package_}`;w.push({...l,origin:"missing",reason:f}),b(`[render-stack]   ${v} \u2014 MISSING: ${f}`);continue}let j=await c.getPackageUrl(l.publisher,l.package_,S),i=await(e.fetchFn?e.fetchFn(j,l.publisher):me(j));if(!i.ok){let f=`fetch ${j} failed: HTTP ${i.status} ${i.statusText}`;w.push({...l,origin:"missing",reason:f}),b(`[render-stack]   ${v} \u2014 MISSING: ${f}`);continue}let g=await i.text();await r.saveDocumentAsync(n.parse(g),`${l.publisher}/${l.package_}@${S}`);try{let f=$e(u,l.publisher);je(f,{recursive:!0}),_e($e(f,`${l.package_}@${S}.kan.yml`),g,"utf-8"),w.push({...l,origin:"fetched",versions:[S]}),b(`[render-stack]   ${v}@${S} \u2014 fetched from ${j}, installed to cache`)}catch(f){w.push({...l,origin:"fetched",versions:[S]}),b(`[render-stack]   ${v}@${S} \u2014 fetched from ${j}, but cache ${u} is NOT WRITABLE (${f.message}); usable for this load only \u2014 every load will re-fetch it`)}}catch(S){let j=`fetch failed: ${S.message}`;w.push({...l,origin:"missing",reason:j}),b(`[render-stack]   ${v} \u2014 MISSING: ${j}`)}}}let I=y;if(!e.repository){let c=(await r.getAllDocumentsAsync()).filter(v=>v.metadata.namespace_?.publisher===p),l=await H(c,y);for(let v of $)l.add(C(v));I=new V(y,l)}let B=await new X(n).parseKanonaks(I),oe=new ee(B),G=(c,l)=>Q(B,{publisher:c,package_:l,name:l}).length>0,A;if(e.repository){A=[];for(let c of $){let l=await y.getDocumentsByNamespaceAsync(c.publisher,c.package_);A.push(l.length>0?{...c,origin:"repository",versions:_(l)}:{...c,origin:"missing",reason:"not present in the caller-supplied repository"})}}else A=w.map(c=>c.origin==="missing"||G(c.publisher,c.package_)?c:{...c,resolvedButNotInCatalog:!0});let q=W(A);for(let c of q)b(`[render-stack] WARNING: ${c}`);return re({publisher:p,availablePublishers:m,catalog:B,lookRenderer:oe,localNamespaces:k,rawByNsKey:d,renderStack:{contractSource:"universal-default",cachePath:u,packages:A,warnings:q}})}import{existsSync as Ce,readFileSync as Ae,writeFileSync as Ie,mkdirSync as Ne}from"fs";import{join as Re}from"path";async function ae(t,e={}){let n=new E,r=Z(t),s=r.kind==="resource"?r.uri.publisher:r.publisher,a=e.log??(()=>{}),m=e.cacheRoot??z(),p=(i,g,f)=>Re(m,i,`${g}@${f}.kan.yml`),k=new Set,d=new Set,u=new Map,o=new Y({getFromCache:(i,g,f)=>{let D=p(i,g,f),R=Ce(D)?Ae(D,"utf-8"):null;return R!==null&&k.add(`${i}/${g}`),R},onFetch:(i,g,f,D)=>{d.add(`${i}/${g}`);try{let R=Re(m,i);Ne(R,{recursive:!0}),Ie(p(i,g,f),D,"utf-8")}catch(R){u.set(`${i}/${g}`,R.message),a(`[render] fetched ${i}/${g}@${f} but cache ${m} is NOT WRITABLE (${R.message}); usable for this load only \u2014 every load will re-fetch it`)}},...e.fetchFn?{fetchFn:e.fetchFn}:{}}),h=new O(e.fetchFn?{fetchFn:e.fetchFn}:void 0),y;if(r.kind==="resource"){let i=r.uri.version;y=[i?{package_:r.uri.package_,version:`${i.major}.${i.minor}.${i.patch}`}:{package_:r.uri.package_}]}else if(r.kind==="package"){let i=r.version;y=[i?{package_:r.package_,version:`${i.major}.${i.minor}.${i.patch}`}:{package_:r.package_}]}else y=(await h.listLatestPackages(s)).map(g=>({package_:g.packageName}));let b=async(i,g,f)=>{try{let D=f?n.buildImport(g,"=",f,i):n.buildImport(g,"*","0.0.0",i),R=await o.getHighestCompatibleVersionAsync(i,D);return R?{doc:R}:{doc:null,error:`${i} did not resolve ${g}${f?`@${f}`:""} (not in its index, or unreachable)`}}catch(D){return{doc:null,error:D.message}}},$=[],w=[];for(let i of y){let{doc:g,error:f}=await b(s,i.package_,i.version);g?$.push(g):f&&w.push(f)}if($.length===0)throw new Error(`Could not fetch any package for address "${t}" from publisher "${s}".`+(w.length>0?` Reasons: ${w.join("; ")}`:""));let _=await new ke(e.fetchFn).getConfig(s).catch(()=>{}),I=T(_),B=_?.render&&_.render.length>0?"publisher-well-known":"universal-default",oe=i=>i.map(g=>g.metadata.namespace_?.version).filter(g=>g!==void 0).sort((g,f)=>M(f,g)).map(F);a(`[render-stack] resolving ${I.length} ambient look-stack package(s) (contract: ${B}); cache: ${m}`);let G=[],A=[];for(let i of I){let g=C(i),{doc:f,error:D}=await b(i.publisher,i.package_,void 0);if(f){G.push(f);let R=oe([f]),pe=d.has(g)?"fetched":k.has(g)?"cache":"fetched";A.push({...i,origin:pe,versions:R}),a(`[render-stack]   ${g} \u2014 ${pe} (${R.join(", ")})`+(u.has(g)?" [cache write FAILED \u2014 will re-fetch next load]":""))}else A.push({...i,origin:"missing",reason:D??"unresolved"}),a(`[render-stack]   ${g} \u2014 MISSING: ${D??"unresolved"}`)}let q=await H([...$,...G],o),de=new V(o,q),c=await new X(n).parseKanonaks(de),l=new ee(c),v=A.map(i=>i.origin==="missing"||Q(c,{publisher:i.publisher,package_:i.package_,name:i.package_}).length>0?i:{...i,resolvedButNotInCatalog:!0}),N=W(v);for(let i of N)a(`[render-stack] WARNING: ${i}`);let U={contractSource:B,cachePath:m,packages:v,warnings:N},S=new Set,j=new Map;for(let i of await o.getAllDocumentsAsync()){let g=i.metadata.namespace_;if(!g?.version||g.publisher!==s)continue;let f=F(g.version),D=`${g.publisher}/${g.package_}@${f}`;S.add(D);let R=await o.getDocumentContentAsync(D);R!==null&&j.set(`${g.package_}@${f}`,R)}return re({publisher:s,availablePublishers:[s],catalog:c,lookRenderer:l,localNamespaces:S,rawByNsKey:j,renderStack:U})}import{VersionOperator as ne}from"@kanonak-protocol/types/document/models/enums";function te(t){let{lookRenderer:e,publisher:n,renderStack:r,catalog:s}=t,a=e.explainStylesheet(e.publisherSubject(n)),m=[...a.tokens.entries()].map(([o,h])=>({name:o,value:h.value,source:`${h.sourceNamespace}/${h.sourceName}`,level:h.level})),p=a.baseStylesheet,k={present:p.css!==void 0,...p.sourceNamespace!==void 0?{source:p.sourceNamespace}:{},...p.scope!==void 0?{scope:p.scope}:{},...p.css!==void 0?{bytes:p.css.length}:{},...p.problem!==void 0?{problem:p.problem}:{},candidates:p.candidates},d=new Map;for(let o of s){let h=o.namespace;h&&d.set(h,(d.get(h)??0)+1)}let u=[...d.entries()].map(([o,h])=>({namespace:o,resources:h})).sort((o,h)=>o.namespace.localeCompare(h.namespace));return{publisher:n,renderStack:{contractSource:r.contractSource,cachePath:r.cachePath,packages:r.packages.map(o=>({package_:C(o),origin:o.origin,...o.versions!==void 0?{versions:o.versions}:{},...o.reason!==void 0?{reason:o.reason}:{},...o.resolvedButNotInCatalog!==void 0?{resolvedButNotInCatalog:o.resolvedButNotInCatalog}:{}}))},stylesheet:{tokens:m,baseStylesheet:k,...a.look?{look:{sourceClass:`${a.look.sourceClass.publisher}/${a.look.sourceClass.package_}/${a.look.sourceClass.name}`}}:{}},catalog:u,warnings:[...r.warnings,...a.warnings.filter(o=>!r.warnings.includes(o))]}}function Fe(t){return t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function ie(t){let e=Fe,n=t.warnings.length===0,r=t.warnings.length===0?'<p class="ok">\u2713 No problems detected \u2014 the render stack is fully resolved and pages should be styled.</p>':t.warnings.map(d=>`<div class="warn">\u26A0 ${e(d)}</div>`).join(`
 `),s=t.renderStack.packages.map(d=>{let u=d.origin!=="missing"&&!d.resolvedButNotInCatalog,o=d.origin==="missing"?'<span class="bad">MISSING</span>':d.resolvedButNotInCatalog?`<span class="bad">${e(d.origin)} (not in catalog)</span>`:`<span class="good">${e(d.origin)}</span>`,h=d.reason?e(d.reason):e((d.versions??[]).join(", "));return`<tr class="${u?"":"row-bad"}"><td><code>${e(d.package_)}</code></td><td>${o}</td><td>${h}</td></tr>`}).join(`
 `),a=t.stylesheet.baseStylesheet,m=a.present?`<p><span class="good">\u2713 present</span> \u2014 <code>${e(a.source??"")}</code> (${a.bytes} bytes, ${e(a.scope??"")})</p>`:`<p><span class="bad">\u2717 MISSING</span>${a.problem?` \u2014 ${e(a.problem)}`:""}${a.candidates.length>0?`<br>candidates considered: ${a.candidates.map(d=>`<code>${e(d)}</code>`).join(", ")}`:""}</p><p>Without the base stylesheet, generated CSS stops at the <code>:root</code> token block and pages appear unstyled.</p>`,p=t.stylesheet.tokens.map(d=>`<tr><td><code>--kan-${e(d.name)}</code></td><td><code>${e(d.value)}</code></td><td><code>${e(d.source)}</code></td><td>${e(d.level)}</td></tr>`).join(`
 `),k=t.catalog.map(d=>`<tr><td><code>${e(d.namespace)}</code></td><td>${d.resources}</td></tr>`).join(`

package/dist/transformations/index.js

@@ -1,4 +1,4 @@
-import{b as Y,c as An,d as Sn,e as ce,f as Te,g as O,h as wn,i as X,j as q}from"../chunk-V72IVYR4.js";import{a as se}from"../chunk-VWS25JH4.js";import"../chunk-QHABFCRC.js";import"../chunk-4NO7MHS7.js";import"../chunk-RGOBWOBB.js";import"../chunk-PEJALHXK.js";import{a as kn,b as bn,c as hn,d as Dn}from"../chunk-SHDHMKMJ.js";import{h as ie}from"../chunk-BKVPSPG4.js";import{a as ae}from"../chunk-NJ3AZYQD.js";import{b as L,c as A,f as S}from"../chunk-7TKJHKC2.js";import"../chunk-7HRKWTBB.js";import{b as N,c as D,d as K,g as M,h as P,i as F,j as W,l as H}from"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import{g as oe}from"../chunk-2ACBWC7K.js";var $e="kanonak.org",Ue="document-ast",i=e=>({publisher:$e,package_:Ue,name:e}),m={Document:i("Document"),Block:i("Block"),Inline:i("Inline"),StructuredValue:i("StructuredValue"),Heading:i("Heading"),Paragraph:i("Paragraph"),RawBlock:i("RawBlock"),Text:i("Text"),StructuredMap:i("StructuredMap"),StructuredEntry:i("StructuredEntry"),StructuredList:i("StructuredList"),StringScalar:i("StringScalar"),IntegerScalar:i("IntegerScalar"),EscapeHint:i("EscapeHint"),MediaType:i("MediaType"),metadata:i("metadata"),children:i("children"),level:i("level"),inlines:i("inlines"),text:i("text"),entries:i("entries"),key:i("key"),value:i("value"),escapeHint:i("escapeHint"),items:i("items"),stringValue:i("stringValue"),integerValue:i("integerValue"),rawContent:i("rawContent"),mediaType:i("mediaType"),mimeType:i("mimeType"),ESC_RAW:i("esc-raw"),ESC_YAML_SAFE:i("esc-yaml-safe"),ESC_TOML_STRING:i("esc-toml-string"),ESC_TOML_MULTILINE:i("esc-toml-multiline"),ESC_JSON:i("esc-json"),ESC_DYNAMODB_BOOL:i("esc-dynamodb-bool"),ESC_DYNAMODB_NUMBER:i("esc-dynamodb-number"),ESC_DYNAMODB_NULL:i("esc-dynamodb-null"),TEXT_PLAIN:i("text-plain"),TEXT_MARKDOWN:i("text-markdown"),TEXT_HTML:i("text-html"),TEXT_CSS:i("text-css"),APPLICATION_JSON:i("application-json"),TEXT_YAML:i("text-yaml"),IMAGE_SVG_XML:i("image-svg-xml"),ResourceLink:i("ResourceLink"),target:i("target"),linkLabel:i("linkLabel"),PropertyList:i("PropertyList"),propertyEntries:i("propertyEntries"),PropertyEntry:i("PropertyEntry"),propertyKey:i("propertyKey"),propertyValue:i("propertyValue"),Table:i("Table"),tableColumnLabels:i("tableColumnLabels"),tableRows:i("tableRows"),TableRow:i("TableRow"),tableCells:i("tableCells")};function ue(e,n){return e.publisher===n.publisher&&e.package_===n.package_&&e.name===n.name}var j=class{backendUri="kanonak.org/transformations/markdown-with-frontmatter";render(n,t){let r=xe(n.metadata,t),o=Le(n.children),s=["---",...r,"---","",o].join(`
+import{b as Y,c as An,d as Sn,e as ce,f as Te,g as O,h as wn,i as X,j as q}from"../chunk-H37TY5AQ.js";import{a as se}from"../chunk-HQQ4OAZ2.js";import"../chunk-QHABFCRC.js";import"../chunk-4NO7MHS7.js";import"../chunk-OR3F4WIF.js";import"../chunk-PEJALHXK.js";import{d as kn,e as bn,f as hn,g as Dn,l as ie}from"../chunk-R73T4RUO.js";import{a as ae}from"../chunk-NJ3AZYQD.js";import"../chunk-6U26UASC.js";import"../chunk-WGKIRLMA.js";import{b as N,c as D,d as K,g as M,h as P,i as F,j as W,l as H,n as L,o as A,r as S}from"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import{g as oe}from"../chunk-2ACBWC7K.js";var $e="kanonak.org",Ue="document-ast",i=e=>({publisher:$e,package_:Ue,name:e}),m={Document:i("Document"),Block:i("Block"),Inline:i("Inline"),StructuredValue:i("StructuredValue"),Heading:i("Heading"),Paragraph:i("Paragraph"),RawBlock:i("RawBlock"),Text:i("Text"),StructuredMap:i("StructuredMap"),StructuredEntry:i("StructuredEntry"),StructuredList:i("StructuredList"),StringScalar:i("StringScalar"),IntegerScalar:i("IntegerScalar"),EscapeHint:i("EscapeHint"),MediaType:i("MediaType"),metadata:i("metadata"),children:i("children"),level:i("level"),inlines:i("inlines"),text:i("text"),entries:i("entries"),key:i("key"),value:i("value"),escapeHint:i("escapeHint"),items:i("items"),stringValue:i("stringValue"),integerValue:i("integerValue"),rawContent:i("rawContent"),mediaType:i("mediaType"),mimeType:i("mimeType"),ESC_RAW:i("esc-raw"),ESC_YAML_SAFE:i("esc-yaml-safe"),ESC_TOML_STRING:i("esc-toml-string"),ESC_TOML_MULTILINE:i("esc-toml-multiline"),ESC_JSON:i("esc-json"),ESC_DYNAMODB_BOOL:i("esc-dynamodb-bool"),ESC_DYNAMODB_NUMBER:i("esc-dynamodb-number"),ESC_DYNAMODB_NULL:i("esc-dynamodb-null"),TEXT_PLAIN:i("text-plain"),TEXT_MARKDOWN:i("text-markdown"),TEXT_HTML:i("text-html"),TEXT_CSS:i("text-css"),APPLICATION_JSON:i("application-json"),TEXT_YAML:i("text-yaml"),IMAGE_SVG_XML:i("image-svg-xml"),ResourceLink:i("ResourceLink"),target:i("target"),linkLabel:i("linkLabel"),PropertyList:i("PropertyList"),propertyEntries:i("propertyEntries"),PropertyEntry:i("PropertyEntry"),propertyKey:i("propertyKey"),propertyValue:i("propertyValue"),Table:i("Table"),tableColumnLabels:i("tableColumnLabels"),tableRows:i("tableRows"),TableRow:i("TableRow"),tableCells:i("tableCells")};function ue(e,n){return e.publisher===n.publisher&&e.package_===n.package_&&e.name===n.name}var j=class{backendUri="kanonak.org/transformations/markdown-with-frontmatter";render(n,t){let r=xe(n.metadata,t),o=Le(n.children),s=["---",...r,"---","",o].join(`
 `);return t?.trailingNewline&&(s.endsWith(`
 `)||(s+=`
 `)),s}};function xe(e,n){if(!e)return[];let t=new Map;for(let c of e.entries)t.set(I(c.key),c);let r=new Map;if(n?.metadataRenames)for(let[c,u]of n.metadataRenames)r.set(I(c),u);let a=(n?.metadataKeys??e.entries.map(c=>c.key)).map(I),s=[];for(let c of a){let u=t.get(c);if(!u)continue;let f=r.get(c),l=I(f??c),d=me(u.value,u.escapeHint);d!==void 0&&s.push(`${l}: ${d}`)}return s}function I(e){let n=e.lastIndexOf(".");return n===-1?e:e.substring(n+1)||e}function me(e,n){switch(e.kind){case"StringScalar":return Ve(e.stringValue,n);case"IntegerScalar":return String(e.integerValue);case"StructuredList":{let t=[];for(let r of e.items){let o=me(r,n);o!==void 0&&t.push(o)}return t.join(", ")}case"StructuredMap":return;default:return}}function Ve(e,n){return!n||ue(n,m.ESC_RAW)?e:ue(n,m.ESC_YAML_SAFE)?ve(e):e}function ve(e){return e.includes(`

package/dist/uri-helpers/index.js

@@ -1 +1 @@
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n}from"../chunk-7TKJHKC2.js";import"../chunk-4UT2CLAT.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{n as SingleDocumentRepository,g as findAllResourcesByCanonicalUri,f as findSubjectByUri,e as findSubjectsByType,i as getDatatypeValue,l as getEmbeddedValue,m as getListValues,k as getReferenceUri,j as getStringValue,h as hasProperty,d as hasType,c as toCanonicalUrl,a as uriKey,b as uriMatches};
+import{a as n}from"../chunk-6U26UASC.js";import{m as a,n as b,o as c,p as d,q as e,r as f,s as g,t as h,u as i,v as j,w as k,x as l,y as m}from"../chunk-7BHDZHJY.js";import"../chunk-FUUTGGJS.js";import"../chunk-2ACBWC7K.js";export{n as SingleDocumentRepository,g as findAllResourcesByCanonicalUri,f as findSubjectByUri,e as findSubjectsByType,i as getDatatypeValue,l as getEmbeddedValue,m as getListValues,k as getReferenceUri,j as getStringValue,h as hasProperty,d as hasType,c as toCanonicalUrl,a as uriKey,b as uriMatches};

package/dist/validation/ValidationCache.d.ts

@@ -1,94 +1,52 @@
 import type { IKanonakDocumentRepository } from '@kanonak-protocol/types/document/models';
 import type { Kanonak } from '../kanonaks/Kanonak.js';
 /**
- * Per-validation-pass memoization shared across every repository rule
- * applied to documents in the same repository.
+ * Per-validation-pass memoization shared across every repository rule applied to
+ * documents in the same repository.
  *
- * Today the validator's caller (CLI single-file validation, or the
- * VS Code diagnostics provider validating every workspace document)
- * runs `KanonakObjectValidator.validateAsync(doc, repo)` once per
- * document. Each call re-executes 21 repository rules from scratch
- * against the same repository, and several of those rules redo
- * identical work for every document — walking the import closure
- * to collect class declarations, looking up the same package via
- * `getHighestCompatibleVersionAsync` over and over, or re-parsing
- * the entire repo through `KanonakObjectParser`.
+ * The expensive shared work is the full-repository `parseKanonaks`. Every
+ * repository rule reads the resolved object model (the merged catalog via
+ * {@link getKanonaks}, or the pre-merge per-document authored view via
+ * {@link getAuthoredKanonaks}); the cache parses the repo at most ONCE per pass
+ * and serves both views from that single parse. A batch caller
+ * (`KanonakObjectValidator.validateDocumentsAsync`) constructs one cache and
+ * threads it through every per-document `validateAsync`, so validating a whole
+ * directory is one parse, not O(documents x catalog).
  *
- * `ValidationCache` is the seam that lets a multi-document caller
- * share that work across calls. The cache's lifetime is one
- * validation pass over one repository; the diagnostics provider
- * constructs a fresh cache at the top of each refresh and passes
- * it to every per-document `validateAsync`. Rules opt in by
- * reading from the cache when present; without it they fall back
- * to their original logic (used by single-document callers like
- * the CLI's `kanonak validate <path>`).
- *
- * The cache also exposes a wrapped `repository` that memoizes
- * `getHighestCompatibleVersionAsync` and
- * `getDocumentsByNamespaceAsync` — both linear scans over the
- * in-memory repo. Rules that don't know about the cache still
- * benefit, because the validator passes `cache.repository` as the
- * repo argument so their existing lookup calls hit the cache
- * transparently.
+ * The cache also exposes a wrapped {@link repository} that memoizes the two
+ * linear-scan repository lookups (`getHighestCompatibleVersionAsync`,
+ * `getDocumentsByNamespaceAsync`); rules that call the repository directly hit
+ * the cache transparently because the validator passes `cache.repository` as the
+ * repo argument.
  */
 export declare class ValidationCache {
     private readonly underlying;
     /**
-     * Repository wrapper that memoizes read-only lookups for the
-     * lifetime of this cache. Pass this to every rule (instead of
-     * the bare repository) so existing rule code that calls
-     * `repository.getHighestCompatibleVersionAsync(...)` benefits
-     * automatically without needing to know about the cache.
+     * Repository wrapper that memoizes read-only lookups for the lifetime of this
+     * cache. Pass this to every rule (instead of the bare repository) so existing
+     * rule code that calls `repository.getHighestCompatibleVersionAsync(...)`
+     * benefits automatically without needing to know about the cache.
      */
     readonly repository: IKanonakDocumentRepository;
-    private kanonaksPromise;
-    private importClosureCache;
-    private classDeclarationsCache;
-    private propertyNamesCache;
-    private allDocumentsPromise;
+    private parsePromise;
     constructor(underlying: IKanonakDocumentRepository);
     /**
-     * Full-repository `parseKanonaks` result, memoized for the cache's
-     * lifetime. Used by rules that want the resolved-URI object model
-     * (e.g. `MarkdownLinkRule`) instead of walking raw `document.body`.
-     * Filter by `subject.namespace` to scope to a specific document.
+     * Full-repository `parseKanonaks` result (the open-world-merged catalog),
+     * memoized for the cache's lifetime. Filter by `subject.namespace` to scope to
+     * a specific document.
      */
     getKanonaks(): Promise<Kanonak[]>;
     /**
-     * Identifier-keyed transitive-import closure for the given document.
-     * Returns the set of `publisher/package@version` strings reachable
-     * via `imports:` starting from `docId`, including `docId` itself.
-     *
-     * Rules that need to know "what does this document import,
-     * recursively?" should call this once instead of walking the
-     * imports graph themselves on every reference lookup. Per-doc
-     * memoized; same doc validated multiple times in the pass
-     * traverses the graph once.
-     */
-    getImportClosure(docId: string): Promise<Set<string>>;
-    /**
-     * subClassOf relationships declared inside the given document's
-     * body (NOT in its imports). Map<className, parentClassName[]>.
-     * Composed across an import closure to build the effective class
-     * hierarchy a rule needs.
-     *
-     * Cached per-doc so two rules consulting the same document's
-     * declarations (or the same document validated multiple times)
-     * walk its body once.
-     */
-    getClassDeclarations(docId: string): Promise<Map<string, string[]>>;
-    /**
-     * Names of property-typed entities (`ObjectProperty`,
-     * `DatatypeProperty`, `AnnotationProperty`, plain `Property`)
-     * declared inside the given document's body. Used by reference-
-     * resolution rules to answer "is property P defined here?" in O(1)
-     * after a one-time scan.
+     * The PRE-MERGE, per-document parse from the SAME single full-repo parse as
+     * {@link getKanonaks}: each document's authored subjects (and embeddeds),
+     * stamped with their `sourceDoc`, before the open-world merge folds them onto
+     * shared URIs and dedups cross-document duplicates. A per-document rule that
+     * must validate exactly what a document authored — including augmentations it
+     * asserts about imported entities, which the merge files under the imported
+     * namespace — filters this by `sourceDoc`, instead of re-parsing the document
+     * (which would break the ≤1-parse contract). Resolution targets still come
+     * from the merged {@link getKanonaks}.
      */
-    getPropertyNames(docId: string): Promise<Set<string>>;
-    private getAllDocuments;
-    private computeImportClosure;
-    private buildDocsByIdIndex;
-    private computeClassDeclarations;
-    private computePropertyNames;
-    private findDocById;
+    getAuthoredKanonaks(): Promise<Kanonak[]>;
+    private parseOnce;
 }

package/dist/validation/documentModel.d.ts

@@ -1,5 +1,5 @@
 import type { IKanonakDocumentRepository } from '@kanonak-protocol/types/document/models';
-import type { KanonakDocument } from '@kanonak-protocol/types/document/models/types';
+import type { KanonakDocument, Import, DocumentReference } from '@kanonak-protocol/types/document/models/types';
 import type { ValidationCache } from './ValidationCache.js';
 import type { Kanonak } from '../kanonaks/Kanonak.js';
 import { DefinedKanonak } from '../kanonaks/DefinedKanonak.js';
@@ -29,6 +29,24 @@ export declare function getCatalogKanonaks(document: KanonakDocument, repository
  * captured data.)
  */
 export declare function getDocumentKanonaks(document: KanonakDocument, repository: IKanonakDocumentRepository, cache?: ValidationCache): Promise<Kanonak[]>;
+/**
+ * The subjects THIS document authored — INCLUDING the open-world augmentations
+ * it asserts about imported entities. An augmentation (e.g. a look package
+ * adding `semanticSvg` to `rdfs.Resource`) is filed under the IMPORTED package's
+ * namespace by the open-world merge, so {@link getDocumentKanonaks} — which
+ * scopes by the document's own namespace — does not return it. This reads the
+ * parser's PRE-MERGE view (each subject + embedded stamped with its authoring
+ * `sourceDoc`) from the SAME single parse as {@link getCatalogKanonaks}, then
+ * keeps the subjects this document authored. Unlike a re-parse it preserves the
+ * ≤1-parse batch contract; unlike the merged catalog it does not lose a
+ * document's authored statements to cross-document de-duplication.
+ *
+ * Use this when a rule must validate what a document authored regardless of
+ * which namespace the merge files it under (e.g. an embedded `type:` on an
+ * augmentation). Resolution targets are still looked up against
+ * {@link getCatalogKanonaks}.
+ */
+export declare function getAuthoredKanonaks(document: KanonakDocument, repository: IKanonakDocumentRepository, cache?: ValidationCache): Promise<Kanonak[]>;
 /** A DefinedKanonak visited during a walk, with a human-facing locator path. */
 export interface WalkNode {
     readonly kanonak: DefinedKanonak;
@@ -46,3 +64,31 @@ export declare function walkDefinedKanonaks(roots: Kanonak[], visit: (node: Walk
 /** `publisher/package@major.minor.patch` — matches `SubjectKanonak.namespace`
  * and the parser's `sourceDoc`. Undefined for a document without a namespace. */
 export declare function namespaceOf(document: KanonakDocument): string | undefined;
+/**
+ * Cacheless catalog source: exposes the target document PLUS every other
+ * document in the backing repository through `getAllDocumentsAsync` (and
+ * delegates all resolution lookups to the backing repository). This lets the
+ * single-document parse see the whole import closure — so cross-package
+ * references resolve to real imported subjects, matching the cached (batch)
+ * path. The target document is listed first and any same-namespace copy in the
+ * repository is excluded, so the in-hand document stays authoritative for its
+ * own namespace even when an older copy was saved. Unlike
+ * `SingleDocumentRepository` (which exposes ONLY the target document, by
+ * design, for parsing one entity in isolation), this includes the closure
+ * precisely because validation existence checks need it.
+ */
+export declare class DocumentWithRepositoryCatalog implements IKanonakDocumentRepository {
+    private readonly document;
+    private readonly broader;
+    constructor(document: KanonakDocument, broader: IKanonakDocumentRepository);
+    getAllDocumentsAsync(): Promise<KanonakDocument[]>;
+    getDocumentAsync(identifier: string): Promise<KanonakDocument | null>;
+    getDocumentsByNamespaceAsync(publisher: string, package_: string): Promise<KanonakDocument[]>;
+    getHighestCompatibleVersionAsync(publisher: string, import_: Import): Promise<KanonakDocument | null>;
+    getAllDocumentReferencesAsync(): Promise<DocumentReference[]>;
+    getDocumentContentAsync(identifier: string): Promise<string | null>;
+    getDocumentUriAsync(identifier: string): Promise<string | null>;
+    saveDocumentAsync(): Promise<void>;
+    deleteDocumentAsync(): Promise<void>;
+    clearNamespaceAsync(): Promise<void>;
+}