@semiont/graph 0.5.24 → 0.5.26

package/dist/{dist-es-63RSTSM2.js → dist-es-BUTLC2YS.js}

@@ -1,31 +1,31 @@
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError,
   chain,
   getProfileName,
   parseKnownFiles
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
 var resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
-      const { fromHttp } = await import("./dist-es-5CNHCO76.js");
-      const { fromContainerMetadata } = await import("./dist-es-QDQUKRHU.js");
+      const { fromHttp } = await import("./dist-es-M72B762W.js");
+      const { fromContainerMetadata } = await import("./dist-es-LN4LZWKV.js");
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
       return async () => chain(fromHttp(options ?? {}), fromContainerMetadata(options))().then(setNamedProvider);
     },
     Ec2InstanceMetadata: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
-      const { fromInstanceMetadata } = await import("./dist-es-QDQUKRHU.js");
+      const { fromInstanceMetadata } = await import("./dist-es-LN4LZWKV.js");
       return async () => fromInstanceMetadata(options)().then(setNamedProvider);
     },
     Environment: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");
-      const { fromEnv } = await import("./dist-es-R36PCSLH.js");
+      const { fromEnv } = await import("./dist-es-ILOZ33QI.js");
       return async () => fromEnv(options)().then(setNamedProvider);
     }
   };
@@ -60,7 +60,7 @@ var resolveAssumeRoleCredentials = async (profileName, profiles, options, caller
   const profileData = profiles[profileName];
   const { source_profile, region } = profileData;
   if (!options.roleAssumer) {
-    const { getDefaultRoleAssumer } = await import("./sts-4YKAIUZO.js");
+    const { getDefaultRoleAssumer } = await import("./sts-ZKQ7LNEG.js");
     options.roleAssumer = getDefaultRoleAssumer({
       ...options.clientConfig,
       credentialProviderLogger: options.logger,
@@ -109,7 +109,7 @@ var isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 };
 var resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
-  const { fromLoginCredentials } = await import("./dist-es-C3XGVVKR.js");
+  const { fromLoginCredentials } = await import("./dist-es-WLYFLMD3.js");
   const credentials = await fromLoginCredentials({
     ...options,
     profile: profileName
@@ -120,7 +120,7 @@ var resolveLoginCredentials = async (profileName, options, callerClientConfig) =
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
 var isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string";
 var resolveProcessCredentials = async (options, profile) => {
-  const { fromProcess } = await import("./dist-es-BTCEI257.js");
+  const { fromProcess } = await import("./dist-es-NGG7JHEH.js");
   const credentials = await fromProcess({
     ...options,
     profile
@@ -130,7 +130,7 @@ var resolveProcessCredentials = async (options, profile) => {
 
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
 var resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
-  const { fromSSO } = await import("./dist-es-OHWBFB6Z.js");
+  const { fromSSO } = await import("./dist-es-TLOL2VHU.js");
   return fromSSO({
     profile,
     logger: options.logger,
@@ -165,7 +165,7 @@ var resolveStaticCredentials = async (profile, options) => {
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
 var isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
 var resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
-  const { fromTokenFile } = await import("./dist-es-ZOQMUI6H.js");
+  const { fromTokenFile } = await import("./dist-es-WS6NDSQ5.js");
   const credentials = await fromTokenFile({
     webIdentityTokenFile: profile.web_identity_token_file,
     roleArn: profile.role_arn,
@@ -217,4 +217,4 @@ var fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
 export {
   fromIni
 };
-//# sourceMappingURL=dist-es-63RSTSM2.js.map
+//# sourceMappingURL=dist-es-BUTLC2YS.js.map

package/dist/{dist-es-R36PCSLH.js → dist-es-ILOZ33QI.js}

@@ -6,9 +6,9 @@ import {
   ENV_SECRET,
   ENV_SESSION,
   fromEnv
-} from "./chunk-FR442V6O.js";
-import "./chunk-ZPTG6NGD.js";
-import "./chunk-7WLIHNPO.js";
+} from "./chunk-UKT6IXAM.js";
+import "./chunk-RBRHTAJN.js";
+import "./chunk-YYVVWLB2.js";
 import "./chunk-GPJBZ6EG.js";
 export {
   ENV_ACCOUNT_ID,
@@ -19,4 +19,4 @@ export {
   ENV_SESSION,
   fromEnv
 };
-//# sourceMappingURL=dist-es-R36PCSLH.js.map
+//# sourceMappingURL=dist-es-ILOZ33QI.js.map

package/dist/{dist-es-QDQUKRHU.js → dist-es-LN4LZWKV.js}

@@ -2,7 +2,7 @@ import {
   CredentialsProviderError,
   ProviderError,
   loadConfig
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import {
   parseUrl
 } from "./chunk-GPJBZ6EG.js";
@@ -374,4 +374,4 @@ export {
   httpRequest,
   providerConfigFromInit
 };
-//# sourceMappingURL=dist-es-QDQUKRHU.js.map
+//# sourceMappingURL=dist-es-LN4LZWKV.js.map

package/dist/{dist-es-5CNHCO76.js → dist-es-M72B762W.js}

@@ -1,12 +1,12 @@
 import {
   NodeHttpHandler
-} from "./chunk-AJ4W3DS7.js";
+} from "./chunk-Y62BMZ25.js";
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import {
   HttpRequest,
   parseRfc3339DateTime,
@@ -172,4 +172,4 @@ var validateToken = (token) => {
 export {
   fromHttp
 };
-//# sourceMappingURL=dist-es-5CNHCO76.js.map
+//# sourceMappingURL=dist-es-M72B762W.js.map

package/dist/{dist-es-BTCEI257.js → dist-es-NGG7JHEH.js}

@@ -1,12 +1,12 @@
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor,
   getProfileName,
   parseKnownFiles
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
@@ -84,4 +84,4 @@ var fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
 export {
   fromProcess
 };
-//# sourceMappingURL=dist-es-BTCEI257.js.map
+//# sourceMappingURL=dist-es-NGG7JHEH.js.map

package/dist/{dist-es-OHWBFB6Z.js → dist-es-TLOL2VHU.js}

@@ -1,6 +1,6 @@
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError,
   TokenProviderError,
@@ -9,7 +9,7 @@ import {
   getSSOTokenFromFile,
   loadSsoSessionData,
   parseKnownFiles
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
@@ -21,7 +21,7 @@ var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the
 
 // ../../node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
 var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
-  const { SSOOIDCClient } = await import("./sso-oidc-K2XXESPI.js");
+  const { SSOOIDCClient } = await import("./sso-oidc-QHNBBLAM.js");
   const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
   const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
     region: ssoRegion ?? init.clientConfig?.region,
@@ -33,7 +33,7 @@ var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
 
 // ../../node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
 var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
-  const { CreateTokenCommand } = await import("./sso-oidc-K2XXESPI.js");
+  const { CreateTokenCommand } = await import("./sso-oidc-QHNBBLAM.js");
   const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
   return ssoOidcClient.send(new CreateTokenCommand({
     clientId: ssoToken.clientId,
@@ -181,7 +181,7 @@ var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoR
     });
   }
   const { accessToken } = token;
-  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-OMYS2YH5.js");
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-GOLDOL76.js");
   const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
     logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
     region: clientConfig?.region ?? ssoRegion,
@@ -314,4 +314,4 @@ export {
   isSsoProfile,
   validateSsoProfile
 };
-//# sourceMappingURL=dist-es-OHWBFB6Z.js.map
+//# sourceMappingURL=dist-es-TLOL2VHU.js.map

package/dist/{dist-es-C3XGVVKR.js → dist-es-WLYFLMD3.js}

@@ -1,12 +1,11 @@
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError,
   getProfileName,
-  parseKnownFiles,
-  readFile
-} from "./chunk-7WLIHNPO.js";
+  parseKnownFiles
+} from "./chunk-YYVVWLB2.js";
 import {
   HttpRequest
 } from "./chunk-GPJBZ6EG.js";
@@ -38,13 +37,7 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
     if (timeUntilExpiry <= _LoginCredentialsFetcher.REFRESH_THRESHOLD) {
       return this.refresh(token);
     }
-    return {
-      accessKeyId: accessToken.accessKeyId,
-      secretAccessKey: accessToken.secretAccessKey,
-      sessionToken: accessToken.sessionToken,
-      accountId: accessToken.accountId,
-      expiration: new Date(accessToken.expiresAt)
-    };
+    return this.toCredentials(token.accessToken);
   }
   get logger() {
     return this.init?.logger;
@@ -52,8 +45,26 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
   get loginSession() {
     return this.profileData.login_session;
   }
+  toCredentials(token) {
+    return {
+      accessKeyId: token.accessKeyId,
+      secretAccessKey: token.secretAccessKey,
+      sessionToken: token.sessionToken,
+      accountId: token.accountId,
+      expiration: new Date(token.expiresAt)
+    };
+  }
   async refresh(token) {
-    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-OZ4KQMKS.js");
+    const diskToken = await this.loadToken().catch(() => token);
+    const now = Date.now();
+    const diskExpiry = new Date(diskToken.accessToken.expiresAt).getTime();
+    const tokenExpiry = new Date(token.accessToken.expiresAt).getTime();
+    const freshToken = diskExpiry <= now && tokenExpiry > now ? token : diskToken;
+    const freshExpiry = new Date(freshToken.accessToken.expiresAt).getTime();
+    if (freshExpiry - Date.now() > _LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+      return this.toCredentials(freshToken.accessToken);
+    }
+    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-TS4P2IEW.js");
     const { logger, userAgentAppId } = this.callerClientConfig ?? {};
     const isH2 = (requestHandler2) => {
       return requestHandler2?.metadata?.handlerProtocol === "h2";
@@ -74,8 +85,8 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
     this.createDPoPInterceptor(client.middlewareStack);
     const commandInput = {
       tokenInput: {
-        clientId: token.clientId,
-        refreshToken: token.refreshToken,
+        clientId: freshToken.clientId,
+        refreshToken: freshToken.refreshToken,
         grantType: "refresh_token"
       }
     };
@@ -92,9 +103,9 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
       const expiresInMs = (expiresIn ?? 900) * 1e3;
       const expiration = new Date(Date.now() + expiresInMs);
       const updatedToken = {
-        ...token,
+        ...freshToken,
         accessToken: {
-          ...token.accessToken,
+          ...freshToken.accessToken,
           accessKeyId,
           secretAccessKey,
           sessionToken,
@@ -103,14 +114,7 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
         refreshToken
       };
       await this.saveToken(updatedToken);
-      const newAccessToken = updatedToken.accessToken;
-      return {
-        accessKeyId: newAccessToken.accessKeyId,
-        secretAccessKey: newAccessToken.secretAccessKey,
-        sessionToken: newAccessToken.sessionToken,
-        accountId: newAccessToken.accountId,
-        expiration
-      };
+      return this.toCredentials(updatedToken.accessToken);
     } catch (error) {
       if (error.name === "AccessDeniedException") {
         const errorType = error.error;
@@ -128,7 +132,15 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
           default:
             message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
         }
-        throw new CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });
+        throw new CredentialsProviderError(message, {
+          logger: this.logger,
+          tryNextLink: false
+        });
+      }
+      const tokenExpiry2 = new Date(freshToken.accessToken.expiresAt).getTime();
+      if (tokenExpiry2 > Date.now()) {
+        this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
+        return this.toCredentials(freshToken.accessToken);
       }
       throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
     }
@@ -136,12 +148,7 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
   async loadToken() {
     const tokenFilePath = this.getTokenFilePath();
     try {
-      let tokenData;
-      try {
-        tokenData = await readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });
-      } catch {
-        tokenData = await fs.readFile(tokenFilePath, "utf8");
-      }
+      const tokenData = await fs.readFile(tokenFilePath, "utf8");
       const token = JSON.parse(tokenData);
       const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
       if (!token.accessToken?.accountId) {
@@ -284,4 +291,4 @@ var fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
 export {
   fromLoginCredentials
 };
-//# sourceMappingURL=dist-es-C3XGVVKR.js.map
+//# sourceMappingURL=dist-es-WLYFLMD3.js.map

package/dist/dist-es-WLYFLMD3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js","../../../node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js"],"sourcesContent":["import { CredentialsProviderError } from \"@smithy/core/config\";\nimport { HttpRequest } from \"@smithy/core/protocols\";\nimport { createHash, createPrivateKey, createPublicKey, sign } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nexport class LoginCredentialsFetcher {\n    profileData;\n    init;\n    callerClientConfig;\n    static REFRESH_THRESHOLD = 5 * 60 * 1000;\n    constructor(profileData, init, callerClientConfig) {\n        this.profileData = profileData;\n        this.init = init;\n        this.callerClientConfig = callerClientConfig;\n    }\n    async loadCredentials() {\n        const token = await this.loadToken();\n        if (!token) {\n            throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });\n        }\n        const accessToken = token.accessToken;\n        const now = Date.now();\n        const expiryTime = new Date(accessToken.expiresAt).getTime();\n        const timeUntilExpiry = expiryTime - now;\n        if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {\n            return this.refresh(token);\n        }\n        return this.toCredentials(token.accessToken);\n    }\n    get logger() {\n        return this.init?.logger;\n    }\n    get loginSession() {\n        return this.profileData.login_session;\n    }\n    toCredentials(token) {\n        return {\n            accessKeyId: token.accessKeyId,\n            secretAccessKey: token.secretAccessKey,\n            sessionToken: token.sessionToken,\n            accountId: token.accountId,\n            expiration: new Date(token.expiresAt),\n        };\n    }\n    async refresh(token) {\n        const diskToken = await this.loadToken().catch(() => token);\n        const now = Date.now();\n        const diskExpiry = new Date(diskToken.accessToken.expiresAt).getTime();\n        const tokenExpiry = new Date(token.accessToken.expiresAt).getTime();\n        const freshToken = diskExpiry <= now && tokenExpiry > now ? token : diskToken;\n        const freshExpiry = new Date(freshToken.accessToken.expiresAt).getTime();\n        if (freshExpiry - Date.now() > LoginCredentialsFetcher.REFRESH_THRESHOLD) {\n            return this.toCredentials(freshToken.accessToken);\n        }\n        const { SigninClient, CreateOAuth2TokenCommand } = await import(\"@aws-sdk/nested-clients/signin\");\n        const { logger, userAgentAppId } = this.callerClientConfig ?? {};\n        const isH2 = (requestHandler) => {\n            return requestHandler?.metadata?.handlerProtocol === \"h2\";\n        };\n        const requestHandler = isH2(this.callerClientConfig?.requestHandler)\n            ? undefined\n            : this.callerClientConfig?.requestHandler;\n        const region = this.profileData.region ?? (await this.callerClientConfig?.region?.()) ?? process.env.AWS_REGION;\n        const client = new SigninClient({\n            credentials: {\n                accessKeyId: \"\",\n                secretAccessKey: \"\",\n            },\n            region,\n            requestHandler,\n            logger,\n            userAgentAppId,\n            ...this.init?.clientConfig,\n        });\n        this.createDPoPInterceptor(client.middlewareStack);\n        const commandInput = {\n            tokenInput: {\n                clientId: freshToken.clientId,\n                refreshToken: freshToken.refreshToken,\n                grantType: \"refresh_token\",\n            },\n        };\n        try {\n            const response = await client.send(new CreateOAuth2TokenCommand(commandInput));\n            const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};\n            const { refreshToken, expiresIn } = response.tokenOutput ?? {};\n            if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {\n                throw new CredentialsProviderError(\"Token refresh response missing required fields\", {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            const expiresInMs = (expiresIn ?? 900) * 1000;\n            const expiration = new Date(Date.now() + expiresInMs);\n            const updatedToken = {\n                ...freshToken,\n                accessToken: {\n                    ...freshToken.accessToken,\n                    accessKeyId,\n                    secretAccessKey,\n                    sessionToken,\n                    expiresAt: expiration.toISOString(),\n                },\n                refreshToken,\n            };\n            await this.saveToken(updatedToken);\n            return this.toCredentials(updatedToken.accessToken);\n        }\n        catch (error) {\n            if (error.name === \"AccessDeniedException\") {\n                const errorType = error.error;\n                let message;\n                switch (errorType) {\n                    case \"TOKEN_EXPIRED\":\n                        message = \"Your session has expired. Please reauthenticate.\";\n                        break;\n                    case \"USER_CREDENTIALS_CHANGED\":\n                        message =\n                            \"Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.\";\n                        break;\n                    case \"INSUFFICIENT_PERMISSIONS\":\n                        message =\n                            \"Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.\";\n                        break;\n                    default:\n                        message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \\`aws login\\``;\n                }\n                throw new CredentialsProviderError(message, {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            const tokenExpiry = new Date(freshToken.accessToken.expiresAt).getTime();\n            if (tokenExpiry > Date.now()) {\n                this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);\n                return this.toCredentials(freshToken.accessToken);\n            }\n            throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });\n        }\n    }\n    async loadToken() {\n        const tokenFilePath = this.getTokenFilePath();\n        try {\n            const tokenData = await fs.readFile(tokenFilePath, \"utf8\");\n            const token = JSON.parse(tokenData);\n            const missingFields = [\"accessToken\", \"clientId\", \"refreshToken\", \"dpopKey\"].filter((k) => !token[k]);\n            if (!token.accessToken?.accountId) {\n                missingFields.push(\"accountId\");\n            }\n            if (missingFields.length > 0) {\n                throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(\", \")}`, {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            return token;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {\n                logger: this.logger,\n                tryNextLink: false,\n            });\n        }\n    }\n    async saveToken(token) {\n        const tokenFilePath = this.getTokenFilePath();\n        const directory = dirname(tokenFilePath);\n        try {\n            await fs.mkdir(directory, { recursive: true });\n        }\n        catch (error) {\n        }\n        await fs.writeFile(tokenFilePath, JSON.stringify(token, null, 2), \"utf8\");\n    }\n    getTokenFilePath() {\n        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), \".aws\", \"login\", \"cache\");\n        const loginSessionBytes = Buffer.from(this.loginSession, \"utf8\");\n        const loginSessionSha256 = createHash(\"sha256\").update(loginSessionBytes).digest(\"hex\");\n        return join(directory, `${loginSessionSha256}.json`);\n    }\n    derToRawSignature(derSignature) {\n        let offset = 2;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const rLength = derSignature[offset++];\n        let r = derSignature.subarray(offset, offset + rLength);\n        offset += rLength;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const sLength = derSignature[offset++];\n        let s = derSignature.subarray(offset, offset + sLength);\n        r = r[0] === 0x00 ? r.subarray(1) : r;\n        s = s[0] === 0x00 ? s.subarray(1) : s;\n        const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);\n        const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);\n        return Buffer.concat([rPadded, sPadded]);\n    }\n    createDPoPInterceptor(middlewareStack) {\n        middlewareStack.add((next) => async (args) => {\n            if (HttpRequest.isInstance(args.request)) {\n                const request = args.request;\n                const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : \"\"}${request.path}`;\n                const dpop = await this.generateDpop(request.method, actualEndpoint);\n                request.headers = {\n                    ...request.headers,\n                    DPoP: dpop,\n                };\n            }\n            return next(args);\n        }, {\n            step: \"finalizeRequest\",\n            name: \"dpopInterceptor\",\n            override: true,\n        });\n    }\n    async generateDpop(method = \"POST\", endpoint) {\n        const token = await this.loadToken();\n        try {\n            const privateKey = createPrivateKey({\n                key: token.dpopKey,\n                format: \"pem\",\n                type: \"sec1\",\n            });\n            const publicKey = createPublicKey(privateKey);\n            const publicDer = publicKey.export({ format: \"der\", type: \"spki\" });\n            let pointStart = -1;\n            for (let i = 0; i < publicDer.length; i++) {\n                if (publicDer[i] === 0x04) {\n                    pointStart = i;\n                    break;\n                }\n            }\n            const x = publicDer.slice(pointStart + 1, pointStart + 33);\n            const y = publicDer.slice(pointStart + 33, pointStart + 65);\n            const header = {\n                alg: \"ES256\",\n                typ: \"dpop+jwt\",\n                jwk: {\n                    kty: \"EC\",\n                    crv: \"P-256\",\n                    x: x.toString(\"base64url\"),\n                    y: y.toString(\"base64url\"),\n                },\n            };\n            const payload = {\n                jti: crypto.randomUUID(),\n                htm: method,\n                htu: endpoint,\n                iat: Math.floor(Date.now() / 1000),\n            };\n            const headerB64 = Buffer.from(JSON.stringify(header)).toString(\"base64url\");\n            const payloadB64 = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n            const message = `${headerB64}.${payloadB64}`;\n            const asn1Signature = sign(\"sha256\", Buffer.from(message), privateKey);\n            const rawSignature = this.derToRawSignature(asn1Signature);\n            const signatureB64 = rawSignature.toString(\"base64url\");\n            return `${message}.${signatureB64}`;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });\n        }\n    }\n}\n","import { setCredentialFeature } from \"@aws-sdk/core/client\";\nimport { CredentialsProviderError, getProfileName, parseKnownFiles } from \"@smithy/core/config\";\nimport { LoginCredentialsFetcher } from \"./LoginCredentialsFetcher\";\nexport const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {\n    init?.logger?.debug?.(\"@aws-sdk/credential-providers - fromLoginCredentials\");\n    const profiles = await parseKnownFiles(init || {});\n    const profileName = getProfileName({\n        profile: init?.profile ?? callerClientConfig?.profile,\n    });\n    const profile = profiles[profileName];\n    if (!profile?.login_session) {\n        throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {\n            tryNextLink: true,\n            logger: init?.logger,\n        });\n    }\n    const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);\n    const credentials = await fetcher.loadCredentials();\n    return setCredentialFeature(credentials, \"CREDENTIALS_LOGIN\", \"AD\");\n};\n"],"mappings":";;;;;;;;;;;;;AAEA,SAAS,YAAY,kBAAkB,iBAAiB,YAAY;AACpE,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AACvB,IAAM,0BAAN,MAAM,yBAAwB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO,oBAAoB,IAAI,KAAK;AAAA,EACpC,YAAY,aAAa,MAAM,oBAAoB;AAC/C,SAAK,cAAc;AACnB,SAAK,OAAO;AACZ,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EACA,MAAM,kBAAkB;AACpB,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI,CAAC,OAAO;AACR,YAAM,IAAI,yBAAyB,sCAAsC,KAAK,YAAY,4CAA4C,EAAE,aAAa,OAAO,QAAQ,KAAK,OAAO,CAAC;AAAA,IACrL;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,IAAI,KAAK,YAAY,SAAS,EAAE,QAAQ;AAC3D,UAAM,kBAAkB,aAAa;AACrC,QAAI,mBAAmB,yBAAwB,mBAAmB;AAC9D,aAAO,KAAK,QAAQ,KAAK;AAAA,IAC7B;AACA,WAAO,KAAK,cAAc,MAAM,WAAW;AAAA,EAC/C;AAAA,EACA,IAAI,SAAS;AACT,WAAO,KAAK,MAAM;AAAA,EACtB;AAAA,EACA,IAAI,eAAe;AACf,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA,EACA,cAAc,OAAO;AACjB,WAAO;AAAA,MACH,aAAa,MAAM;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,YAAY,IAAI,KAAK,MAAM,SAAS;AAAA,IACxC;AAAA,EACJ;AAAA,EACA,MAAM,QAAQ,OAAO;AACjB,UAAM,YAAY,MAAM,KAAK,UAAU,EAAE,MAAM,MAAM,KAAK;AAC1D,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,IAAI,KAAK,UAAU,YAAY,SAAS,EAAE,QAAQ;AACrE,UAAM,cAAc,IAAI,KAAK,MAAM,YAAY,SAAS,EAAE,QAAQ;AAClE,UAAM,aAAa,cAAc,OAAO,cAAc,MAAM,QAAQ;AACpE,UAAM,cAAc,IAAI,KAAK,WAAW,YAAY,SAAS,EAAE,QAAQ;AACvE,QAAI,cAAc,KAAK,IAAI,IAAI,yBAAwB,mBAAmB;AACtE,aAAO,KAAK,cAAc,WAAW,WAAW;AAAA,IACpD;AACA,UAAM,EAAE,cAAc,yBAAyB,IAAI,MAAM,OAAO,sBAAgC;AAChG,UAAM,EAAE,QAAQ,eAAe,IAAI,KAAK,sBAAsB,CAAC;AAC/D,UAAM,OAAO,CAACA,oBAAmB;AAC7B,aAAOA,iBAAgB,UAAU,oBAAoB;AAAA,IACzD;AACA,UAAM,iBAAiB,KAAK,KAAK,oBAAoB,cAAc,IAC7D,SACA,KAAK,oBAAoB;AAC/B,UAAM,SAAS,KAAK,YAAY,UAAW,MAAM,KAAK,oBAAoB,SAAS,KAAM,QAAQ,IAAI;AACrG,UAAM,SAAS,IAAI,aAAa;AAAA,MAC5B,aAAa;AAAA,QACT,aAAa;AAAA,QACb,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,KAAK,MAAM;AAAA,IAClB,CAAC;AACD,SAAK,sBAAsB,OAAO,eAAe;AACjD,UAAM,eAAe;AAAA,MACjB,YAAY;AAAA,QACR,UAAU,WAAW;AAAA,QACrB,cAAc,WAAW;AAAA,QACzB,WAAW;AAAA,MACf;AAAA,IACJ;AACA,QAAI;AACA,YAAM,WAAW,MAAM,OAAO,KAAK,IAAI,yBAAyB,YAAY,CAAC;AAC7E,YAAM,EAAE,aAAa,iBAAiB,aAAa,IAAI,SAAS,aAAa,eAAe,CAAC;AAC7F,YAAM,EAAE,cAAc,UAAU,IAAI,SAAS,eAAe,CAAC;AAC7D,UAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,cAAc;AACpE,cAAM,IAAI,yBAAyB,kDAAkD;AAAA,UACjF,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,YAAM,eAAe,aAAa,OAAO;AACzC,YAAM,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,eAAe;AAAA,QACjB,GAAG;AAAA,QACH,aAAa;AAAA,UACT,GAAG,WAAW;AAAA,UACd;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,WAAW,YAAY;AAAA,QACtC;AAAA,QACA;AAAA,MACJ;AACA,YAAM,KAAK,UAAU,YAAY;AACjC,aAAO,KAAK,cAAc,aAAa,WAAW;AAAA,IACtD,SACO,OAAO;AACV,UAAI,MAAM,SAAS,yBAAyB;AACxC,cAAM,YAAY,MAAM;AACxB,YAAI;AACJ,gBAAQ,WAAW;AAAA,UACf,KAAK;AACD,sBAAU;AACV;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ;AACI,sBAAU,4BAA4B,OAAO,KAAK,CAAC;AAAA,QAC3D;AACA,cAAM,IAAI,yBAAyB,SAAS;AAAA,UACxC,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,YAAMC,eAAc,IAAI,KAAK,WAAW,YAAY,SAAS,EAAE,QAAQ;AACvE,UAAIA,eAAc,KAAK,IAAI,GAAG;AAC1B,aAAK,QAAQ,OAAO,4BAA4B,OAAO,KAAK,CAAC,sCAAsC;AACnG,eAAO,KAAK,cAAc,WAAW,WAAW;AAAA,MACpD;AACA,YAAM,IAAI,yBAAyB,4BAA4B,OAAO,KAAK,CAAC,4CAA4C,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,IACnJ;AAAA,EACJ;AAAA,EACA,MAAM,YAAY;AACd,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAI;AACA,YAAM,YAAY,MAAM,GAAG,SAAS,eAAe,MAAM;AACzD,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,YAAM,gBAAgB,CAAC,eAAe,YAAY,gBAAgB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpG,UAAI,CAAC,MAAM,aAAa,WAAW;AAC/B,sBAAc,KAAK,WAAW;AAAA,MAClC;AACA,UAAI,cAAc,SAAS,GAAG;AAC1B,cAAM,IAAI,yBAAyB,4CAA4C,cAAc,KAAK,IAAI,CAAC,IAAI;AAAA,UACvG,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,aAAO;AAAA,IACX,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,6BAA6B,aAAa,KAAK,OAAO,KAAK,CAAC,IAAI;AAAA,QAC/F,QAAQ,KAAK;AAAA,QACb,aAAa;AAAA,MACjB,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EACA,MAAM,UAAU,OAAO;AACnB,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,UAAM,YAAY,QAAQ,aAAa;AACvC,QAAI;AACA,YAAM,GAAG,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,IACjD,SACO,OAAO;AAAA,IACd;AACA,UAAM,GAAG,UAAU,eAAe,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAAA,EAC5E;AAAA,EACA,mBAAmB;AACf,UAAM,YAAY,QAAQ,IAAI,6BAA6B,KAAK,QAAQ,GAAG,QAAQ,SAAS,OAAO;AACnG,UAAM,oBAAoB,OAAO,KAAK,KAAK,cAAc,MAAM;AAC/D,UAAM,qBAAqB,WAAW,QAAQ,EAAE,OAAO,iBAAiB,EAAE,OAAO,KAAK;AACtF,WAAO,KAAK,WAAW,GAAG,kBAAkB,OAAO;AAAA,EACvD;AAAA,EACA,kBAAkB,cAAc;AAC5B,QAAI,SAAS;AACb,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,cAAU;AACV,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,WAAO,OAAO,OAAO,CAAC,SAAS,OAAO,CAAC;AAAA,EAC3C;AAAA,EACA,sBAAsB,iBAAiB;AACnC,oBAAgB,IAAI,CAAC,SAAS,OAAO,SAAS;AAC1C,UAAI,YAAY,WAAW,KAAK,OAAO,GAAG;AACtC,cAAM,UAAU,KAAK;AACrB,cAAM,iBAAiB,GAAG,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK,EAAE,GAAG,QAAQ,IAAI;AACvH,cAAM,OAAO,MAAM,KAAK,aAAa,QAAQ,QAAQ,cAAc;AACnE,gBAAQ,UAAU;AAAA,UACd,GAAG,QAAQ;AAAA,UACX,MAAM;AAAA,QACV;AAAA,MACJ;AACA,aAAO,KAAK,IAAI;AAAA,IACpB,GAAG;AAAA,MACC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,IACd,CAAC;AAAA,EACL;AAAA,EACA,MAAM,aAAa,SAAS,QAAQ,UAAU;AAC1C,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI;AACA,YAAM,aAAa,iBAAiB;AAAA,QAChC,KAAK,MAAM;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,MACV,CAAC;AACD,YAAM,YAAY,gBAAgB,UAAU;AAC5C,YAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC;AAClE,UAAI,aAAa;AACjB,eAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACvC,YAAI,UAAU,CAAC,MAAM,GAAM;AACvB,uBAAa;AACb;AAAA,QACJ;AAAA,MACJ;AACA,YAAM,IAAI,UAAU,MAAM,aAAa,GAAG,aAAa,EAAE;AACzD,YAAM,IAAI,UAAU,MAAM,aAAa,IAAI,aAAa,EAAE;AAC1D,YAAM,SAAS;AAAA,QACX,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,UACD,KAAK;AAAA,UACL,KAAK;AAAA,UACL,GAAG,EAAE,SAAS,WAAW;AAAA,UACzB,GAAG,EAAE,SAAS,WAAW;AAAA,QAC7B;AAAA,MACJ;AACA,YAAM,UAAU;AAAA,QACZ,KAAK,OAAO,WAAW;AAAA,QACvB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACrC;AACA,YAAM,YAAY,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,WAAW;AAC1E,YAAM,aAAa,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAC5E,YAAM,UAAU,GAAG,SAAS,IAAI,UAAU;AAC1C,YAAM,gBAAgB,KAAK,UAAU,OAAO,KAAK,OAAO,GAAG,UAAU;AACrE,YAAM,eAAe,KAAK,kBAAkB,aAAa;AACzD,YAAM,eAAe,aAAa,SAAS,WAAW;AACtD,aAAO,GAAG,OAAO,IAAI,YAAY;AAAA,IACrC,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,aAAa,MAAM,CAAC;AAAA,IAC9K;AAAA,EACJ;AACJ;;;ACxQO,IAAM,uBAAuB,CAAC,SAAS,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM;AACjF,QAAM,QAAQ,QAAQ,sDAAsD;AAC5E,QAAM,WAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AACjD,QAAM,cAAc,eAAe;AAAA,IAC/B,SAAS,MAAM,WAAW,oBAAoB;AAAA,EAClD,CAAC;AACD,QAAM,UAAU,SAAS,WAAW;AACpC,MAAI,CAAC,SAAS,eAAe;AACzB,UAAM,IAAI,yBAAyB,WAAW,WAAW,oCAAoC;AAAA,MACzF,aAAa;AAAA,MACb,QAAQ,MAAM;AAAA,IAClB,CAAC;AAAA,EACL;AACA,QAAM,UAAU,IAAI,wBAAwB,SAAS,MAAM,kBAAkB;AAC7E,QAAM,cAAc,MAAM,QAAQ,gBAAgB;AAClD,SAAO,qBAAqB,aAAa,qBAAqB,IAAI;AACtE;","names":["requestHandler","tokenExpiry"]}

package/dist/{dist-es-ZOQMUI6H.js → dist-es-WS6NDSQ5.js}

@@ -1,10 +1,10 @@
 import {
   setCredentialFeature
-} from "./chunk-ZPTG6NGD.js";
+} from "./chunk-RBRHTAJN.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor
-} from "./chunk-7WLIHNPO.js";
+} from "./chunk-YYVVWLB2.js";
 import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
@@ -16,7 +16,7 @@ var fromWebToken = (init) => async (awsIdentityProperties) => {
   const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
   let { roleAssumerWithWebIdentity } = init;
   if (!roleAssumerWithWebIdentity) {
-    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-4YKAIUZO.js");
+    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-ZKQ7LNEG.js");
     roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity({
       ...init.clientConfig,
       credentialProviderLogger: init.logger,
@@ -66,4 +66,4 @@ export {
   fromTokenFile,
   fromWebToken
 };
-//# sourceMappingURL=dist-es-ZOQMUI6H.js.map
+//# sourceMappingURL=dist-es-WS6NDSQ5.js.map

package/dist/index.d.ts

@@ -1,5 +1,15 @@
 import { ResourceDescriptor, ResourceId, UpdateResourceInput, ResourceFilter, CreateAnnotationInternal, Annotation, AnnotationId, AnnotationCategory, GraphConnection, GraphPath, EntityTypeStats, GraphServiceConfig, Logger } from '@semiont/core';
 
+/**
+ * Newest first, ties broken by id — the ordering every `listResources` result
+ * must carry.
+ *
+ * The tiebreak is not cosmetic: browse pages these results with offset/limit,
+ * and a partial order lets two pages repeat or drop rows. Ids compare by code
+ * point rather than locale so the JS backends agree with the engines, whose
+ * `ORDER BY` is codepoint-ordered.
+ */
+declare function compareByRecencyThenId(a: ResourceDescriptor, b: ResourceDescriptor): number;
 interface GraphDatabase {
     connect(): Promise<void>;
     disconnect(): Promise<void>;
@@ -12,7 +22,6 @@ interface GraphDatabase {
         resources: ResourceDescriptor[];
         total: number;
     }>;
-    searchResources(query: string, limit?: number): Promise<ResourceDescriptor[]>;
     createAnnotation(input: CreateAnnotationInternal): Promise<Annotation>;
     getAnnotation(id: AnnotationId): Promise<Annotation | null>;
     updateAnnotation(id: AnnotationId, updates: Partial<Annotation>): Promise<Annotation>;
@@ -102,7 +111,6 @@ declare class Neo4jGraphDatabase implements GraphDatabase {
         resources: ResourceDescriptor[];
         total: number;
     }>;
-    searchResources(query: string, limit?: number): Promise<ResourceDescriptor[]>;
     createAnnotation(input: CreateAnnotationInternal): Promise<Annotation>;
     getAnnotation(id: AnnotationId): Promise<Annotation | null>;
     updateAnnotation(id: AnnotationId, updates: Partial<Annotation>): Promise<Annotation>;
@@ -173,11 +181,28 @@ declare class NeptuneGraphDatabase implements GraphDatabase {
     getResource(id: ResourceId): Promise<ResourceDescriptor | null>;
     updateResource(id: ResourceId, input: UpdateResourceInput): Promise<ResourceDescriptor>;
     deleteResource(id: ResourceId): Promise<void>;
+    /**
+     * Filtering, ranking and pagination happen in JS rather than in Gremlin.
+     *
+     * The ranking ladder (exact name over prefix over substring over path- or
+     * tag-assisted) has no natural Gremlin expression, and a rank applied after
+     * `range()` would order one page instead of the match set. JanusGraph
+     * post-filters for the same reason. Both share `queryResources` with the
+     * memory backend so search cannot mean three different things across three
+     * backends.
+     *
+     * The cost is explicit and accepted: this materializes every `Resource`
+     * vertex per call, so it is O(N) in the size of the KB rather than in the
+     * size of the result. Neo4j is the production path and pushes the whole
+     * query — filter, rank, page — into Cypher; Neptune and JanusGraph are not
+     * deployment targets today. If either becomes one at scale, the fix is a
+     * Gremlin rank expression (`choose` over `toLower`, engine-version
+     * permitting), not a return to per-backend search semantics.
+     */
     listResources(filter: ResourceFilter): Promise<{
         resources: ResourceDescriptor[];
         total: number;
     }>;
-    searchResources(query: string, limit?: number): Promise<ResourceDescriptor[]>;
     createAnnotation(input: CreateAnnotationInternal): Promise<Annotation>;
     getAnnotation(id: AnnotationId): Promise<Annotation | null>;
     updateAnnotation(id: AnnotationId, updates: Partial<Annotation>): Promise<Annotation>;
@@ -253,7 +278,6 @@ declare class JanusGraphDatabase implements GraphDatabase {
         resources: ResourceDescriptor[];
         total: number;
     }>;
-    searchResources(query: string, limit?: number): Promise<ResourceDescriptor[]>;
     createAnnotation(input: CreateAnnotationInternal): Promise<Annotation>;
     getAnnotation(id: AnnotationId): Promise<Annotation | null>;
     updateAnnotation(id: AnnotationId, updates: Partial<Annotation>): Promise<Annotation>;
@@ -309,7 +333,6 @@ declare class MemoryGraphDatabase implements GraphDatabase {
         resources: ResourceDescriptor[];
         total: number;
     }>;
-    searchResources(query: string, limit?: number): Promise<ResourceDescriptor[]>;
     createAnnotation(input: CreateAnnotationInternal): Promise<Annotation>;
     getAnnotation(id: AnnotationId): Promise<Annotation | null>;
     updateAnnotation(id: AnnotationId, updates: Partial<Annotation>): Promise<Annotation>;
@@ -355,5 +378,5 @@ declare class MemoryGraphDatabase implements GraphDatabase {
     clearDatabase(): Promise<void>;
 }
 
-export { JanusGraphDatabase, MemoryGraphDatabase, Neo4jGraphDatabase, NeptuneGraphDatabase, closeGraphDatabase, createGraphDatabase, getGraphDatabase };
+export { JanusGraphDatabase, MemoryGraphDatabase, Neo4jGraphDatabase, NeptuneGraphDatabase, closeGraphDatabase, compareByRecencyThenId, createGraphDatabase, getGraphDatabase };
 export type { GraphDatabase };