@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/storage/sparql/CompatibilitySparqlEngine.js

@@ -39,23 +39,23 @@ class QuadstoreSparqlEngine {
         this.delegate = loadCompatibilityModule()
             .then(({ QuadstoreSparqlEngine }) => new QuadstoreSparqlEngine(endpoint));
     }
-    async queryBindings(query, basePath) {
-        return (await this.delegate).queryBindings(query, basePath);
+    async queryBindings(query, basePath, accessScope) {
+        return (await this.delegate).queryBindings(query, basePath, accessScope);
     }
-    async queryQuads(query, basePath) {
-        return (await this.delegate).queryQuads(query, basePath);
+    async queryQuads(query, basePath, accessScope) {
+        return (await this.delegate).queryQuads(query, basePath, accessScope);
     }
-    async queryBoolean(query, basePath) {
-        return (await this.delegate).queryBoolean(query, basePath);
+    async queryBoolean(query, basePath, accessScope) {
+        return (await this.delegate).queryBoolean(query, basePath, accessScope);
     }
-    async queryVoid(query, basePath) {
-        await (await this.delegate).queryVoid(query, basePath);
+    async queryVoid(query, basePath, accessScope, options) {
+        await (await this.delegate).queryVoid(query, basePath, accessScope, options);
     }
-    async constructGraph(graph, basePath) {
-        return (await this.delegate).constructGraph(graph, basePath);
+    async constructGraph(graph, basePath, accessScope) {
+        return (await this.delegate).constructGraph(graph, basePath, accessScope);
     }
-    async listGraphs(basePath) {
-        return (await this.delegate).listGraphs(basePath);
+    async listGraphs(basePath, accessScope) {
+        return (await this.delegate).listGraphs(basePath, accessScope);
     }
     async close() {
         await (await this.delegate).close();
@@ -70,23 +70,23 @@ class QuintstoreSparqlEngine {
         this.delegate = loadCompatibilityModule()
             .then(({ QuintstoreSparqlEngine }) => new QuintstoreSparqlEngine(store));
     }
-    async queryBindings(query, basePath) {
-        return (await this.delegate).queryBindings(query, basePath);
+    async queryBindings(query, basePath, accessScope) {
+        return (await this.delegate).queryBindings(query, basePath, accessScope);
     }
-    async queryQuads(query, basePath) {
-        return (await this.delegate).queryQuads(query, basePath);
+    async queryQuads(query, basePath, accessScope) {
+        return (await this.delegate).queryQuads(query, basePath, accessScope);
     }
-    async queryBoolean(query, basePath) {
-        return (await this.delegate).queryBoolean(query, basePath);
+    async queryBoolean(query, basePath, accessScope) {
+        return (await this.delegate).queryBoolean(query, basePath, accessScope);
     }
-    async queryVoid(query, basePath) {
-        await (await this.delegate).queryVoid(query, basePath);
+    async queryVoid(query, basePath, accessScope, options) {
+        await (await this.delegate).queryVoid(query, basePath, accessScope);
     }
-    async constructGraph(graph, basePath) {
-        return (await this.delegate).constructGraph(graph, basePath);
+    async constructGraph(graph, basePath, accessScope) {
+        return (await this.delegate).constructGraph(graph, basePath, accessScope);
     }
-    async listGraphs(basePath) {
-        return (await this.delegate).listGraphs(basePath);
+    async listGraphs(basePath, accessScope) {
+        return (await this.delegate).listGraphs(basePath, accessScope);
     }
     async close() {
         await (await this.delegate).close();

package/dist/storage/sparql/CompatibilitySparqlEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"CompatibilitySparqlEngine.js","sourceRoot":"","sources":["../../../src/storage/sparql/CompatibilitySparqlEngine.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,KAAK,UAAU,uBAAuB;IACpC,yDAAc,iCAAiC,IAAE;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAa,qBAAqB;IAGhC,YAAmB,QAAgB;QACjC,IAAI,CAAC,QAAQ,GAAG,uBAAuB,EAAE;aACtC,IAAI,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB;QACxD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACrD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACvD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB;QACpD,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QACzD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAnCD,sDAmCC;AAED;;GAEG;AACH,MAAa,sBAAsB;IAGjC,YAAmB,KAAiB;QAClC,IAAI,CAAC,QAAQ,GAAG,uBAAuB,EAAE;aACtC,IAAI,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB;QACxD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACrD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACvD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB;QACpD,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QACzD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAnCD,wDAmCC","sourcesContent":["import type { Quad } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport type { SparqlEngine } from './SubgraphQueryEngine';\nimport type { QuintStore } from '../quint/types';\n\ntype CompatibilityModule = typeof import('./CompatibilitySparqlEngineImpl');\n\nasync function loadCompatibilityModule(): Promise<CompatibilityModule> {\n  return import('./CompatibilitySparqlEngineImpl');\n}\n\n/**\n * @deprecated Compatibility wrapper preserved for older call sites.\n * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.\n *\n * This file intentionally avoids static Comunica imports so exposing the\n * component type does not load the compatibility implementation.\n */\nexport class QuadstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: Promise<SparqlEngine>;\n\n  public constructor(endpoint: string) {\n    this.delegate = loadCompatibilityModule()\n      .then(({ QuadstoreSparqlEngine }) => new QuadstoreSparqlEngine(endpoint));\n  }\n\n  public async queryBindings(query: string, basePath: string): Promise<any> {\n    return (await this.delegate).queryBindings(query, basePath);\n  }\n\n  public async queryQuads(query: string, basePath: string): Promise<any> {\n    return (await this.delegate).queryQuads(query, basePath);\n  }\n\n  public async queryBoolean(query: string, basePath: string): Promise<boolean> {\n    return (await this.delegate).queryBoolean(query, basePath);\n  }\n\n  public async queryVoid(query: string, basePath: string): Promise<void> {\n    await (await this.delegate).queryVoid(query, basePath);\n  }\n\n  public async constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>> {\n    return (await this.delegate).constructGraph(graph, basePath);\n  }\n\n  public async listGraphs(basePath: string): Promise<Set<string>> {\n    return (await this.delegate).listGraphs(basePath);\n  }\n\n  public async close(): Promise<void> {\n    await (await this.delegate).close();\n  }\n}\n\n/**\n * Comunica-backed compatibility engine component.\n */\nexport class QuintstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: Promise<SparqlEngine>;\n\n  public constructor(store: QuintStore) {\n    this.delegate = loadCompatibilityModule()\n      .then(({ QuintstoreSparqlEngine }) => new QuintstoreSparqlEngine(store));\n  }\n\n  public async queryBindings(query: string, basePath: string): Promise<any> {\n    return (await this.delegate).queryBindings(query, basePath);\n  }\n\n  public async queryQuads(query: string, basePath: string): Promise<any> {\n    return (await this.delegate).queryQuads(query, basePath);\n  }\n\n  public async queryBoolean(query: string, basePath: string): Promise<boolean> {\n    return (await this.delegate).queryBoolean(query, basePath);\n  }\n\n  public async queryVoid(query: string, basePath: string): Promise<void> {\n    await (await this.delegate).queryVoid(query, basePath);\n  }\n\n  public async constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>> {\n    return (await this.delegate).constructGraph(graph, basePath);\n  }\n\n  public async listGraphs(basePath: string): Promise<Set<string>> {\n    return (await this.delegate).listGraphs(basePath);\n  }\n\n  public async close(): Promise<void> {\n    await (await this.delegate).close();\n  }\n}\n"]}
+{"version":3,"file":"CompatibilitySparqlEngine.js","sourceRoot":"","sources":["../../../src/storage/sparql/CompatibilitySparqlEngine.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,KAAK,UAAU,uBAAuB;IACpC,yDAAc,iCAAiC,IAAE;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAa,qBAAqB;IAGhC,YAAmB,QAAgB;QACjC,IAAI,CAAC,QAAQ,GAAG,uBAAuB,EAAE;aACtC,IAAI,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACtF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACnF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACrF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B,EAAE,OAA2B;QAC/G,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACvF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,WAA4B;QACpE,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAnCD,sDAmCC;AAED;;GAEG;AACH,MAAa,sBAAsB;IAGjC,YAAmB,KAAiB;QAClC,IAAI,CAAC,QAAQ,GAAG,uBAAuB,EAAE;aACtC,IAAI,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,EAAE,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACtF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACnF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACrF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B,EAAE,OAA2B;QAC/G,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACvF,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,WAA4B;QACpE,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAnCD,wDAmCC","sourcesContent":["import type { Quad } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport type { SparqlEngine, SparqlVoidOptions } from './SubgraphQueryEngine';\nimport type { QuintStore } from '../quint/types';\nimport type { RdfAccessScope } from '../rdf/RdfAccessScope';\n\ntype CompatibilityModule = typeof import('./CompatibilitySparqlEngineImpl');\n\nasync function loadCompatibilityModule(): Promise<CompatibilityModule> {\n  return import('./CompatibilitySparqlEngineImpl');\n}\n\n/**\n * @deprecated Compatibility wrapper preserved for older call sites.\n * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.\n *\n * This file intentionally avoids static Comunica imports so exposing the\n * component type does not load the compatibility implementation.\n */\nexport class QuadstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: Promise<SparqlEngine>;\n\n  public constructor(endpoint: string) {\n    this.delegate = loadCompatibilityModule()\n      .then(({ QuadstoreSparqlEngine }) => new QuadstoreSparqlEngine(endpoint));\n  }\n\n  public async queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return (await this.delegate).queryBindings(query, basePath, accessScope);\n  }\n\n  public async queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return (await this.delegate).queryQuads(query, basePath, accessScope);\n  }\n\n  public async queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean> {\n    return (await this.delegate).queryBoolean(query, basePath, accessScope);\n  }\n\n  public async queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void> {\n    await (await this.delegate).queryVoid(query, basePath, accessScope, options);\n  }\n\n  public async constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>> {\n    return (await this.delegate).constructGraph(graph, basePath, accessScope);\n  }\n\n  public async listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>> {\n    return (await this.delegate).listGraphs(basePath, accessScope);\n  }\n\n  public async close(): Promise<void> {\n    await (await this.delegate).close();\n  }\n}\n\n/**\n * Comunica-backed compatibility engine component.\n */\nexport class QuintstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: Promise<SparqlEngine>;\n\n  public constructor(store: QuintStore) {\n    this.delegate = loadCompatibilityModule()\n      .then(({ QuintstoreSparqlEngine }) => new QuintstoreSparqlEngine(store));\n  }\n\n  public async queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return (await this.delegate).queryBindings(query, basePath, accessScope);\n  }\n\n  public async queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return (await this.delegate).queryQuads(query, basePath, accessScope);\n  }\n\n  public async queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean> {\n    return (await this.delegate).queryBoolean(query, basePath, accessScope);\n  }\n\n  public async queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void> {\n    await (await this.delegate).queryVoid(query, basePath, accessScope);\n  }\n\n  public async constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>> {\n    return (await this.delegate).constructGraph(graph, basePath, accessScope);\n  }\n\n  public async listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>> {\n    return (await this.delegate).listGraphs(basePath, accessScope);\n  }\n\n  public async close(): Promise<void> {\n    await (await this.delegate).close();\n  }\n}\n"]}

package/dist/storage/sparql/CompatibilitySparqlEngineImpl.d.ts

@@ -1,7 +1,8 @@
 import type { Quad } from '@rdfjs/types';
 import type { AsyncIterator } from 'asynciterator';
-import type { SparqlEngine } from './SubgraphQueryEngine';
+import type { SparqlEngine, SparqlVoidOptions } from './SubgraphQueryEngine';
 import type { QuintStore } from '../quint/types';
+import { type RdfAccessScope } from '../rdf/RdfAccessScope';
 /**
  * @deprecated Compatibility wrapper preserved for older call sites.
  * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.
@@ -9,12 +10,12 @@ import type { QuintStore } from '../quint/types';
 export declare class QuadstoreSparqlEngine implements SparqlEngine {
     private readonly delegate;
     constructor(endpoint: string);
-    queryBindings(query: string, basePath: string): Promise<any>;
-    queryQuads(query: string, basePath: string): Promise<any>;
-    queryBoolean(query: string, basePath: string): Promise<boolean>;
-    queryVoid(query: string, basePath: string): Promise<void>;
-    constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>>;
-    listGraphs(basePath: string): Promise<Set<string>>;
+    queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean>;
+    queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void>;
+    constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>>;
+    listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>>;
     close(): Promise<void>;
 }
 /**
@@ -25,11 +26,11 @@ export declare class QuintstoreSparqlEngine implements SparqlEngine {
     private readonly engine;
     private readonly ready;
     constructor(store: QuintStore);
-    queryBindings(query: string, basePath: string): Promise<any>;
-    queryQuads(query: string, basePath: string): Promise<any>;
-    queryBoolean(query: string, basePath: string): Promise<boolean>;
-    queryVoid(query: string, basePath: string): Promise<void>;
-    constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>>;
-    listGraphs(basePath: string): Promise<Set<string>>;
+    queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean>;
+    queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void>;
+    constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>>;
+    listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>>;
     close(): Promise<void>;
 }

package/dist/storage/sparql/CompatibilitySparqlEngineImpl.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.QuintstoreSparqlEngine = exports.QuadstoreSparqlEngine = void 0;
 const ComunicaQuintEngine_1 = require("./ComunicaQuintEngine");
 const QuintEngine_1 = require("./QuintEngine");
+const RdfAccessScope_1 = require("../rdf/RdfAccessScope");
 /**
  * @deprecated Compatibility wrapper preserved for older call sites.
  * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.
@@ -12,23 +13,23 @@ class QuadstoreSparqlEngine {
         const store = new QuintEngine_1.QuintEngine({ endpoint }).getStore();
         this.delegate = new QuintstoreSparqlEngine(store);
     }
-    async queryBindings(query, basePath) {
-        return this.delegate.queryBindings(query, basePath);
+    async queryBindings(query, basePath, accessScope) {
+        return this.delegate.queryBindings(query, basePath, accessScope);
     }
-    async queryQuads(query, basePath) {
-        return this.delegate.queryQuads(query, basePath);
+    async queryQuads(query, basePath, accessScope) {
+        return this.delegate.queryQuads(query, basePath, accessScope);
     }
-    async queryBoolean(query, basePath) {
-        return this.delegate.queryBoolean(query, basePath);
+    async queryBoolean(query, basePath, accessScope) {
+        return this.delegate.queryBoolean(query, basePath, accessScope);
     }
-    async queryVoid(query, basePath) {
-        await this.delegate.queryVoid(query, basePath);
+    async queryVoid(query, basePath, accessScope, options) {
+        await this.delegate.queryVoid(query, basePath, accessScope, options);
     }
-    async constructGraph(graph, basePath) {
-        return this.delegate.constructGraph(graph, basePath);
+    async constructGraph(graph, basePath, accessScope) {
+        return this.delegate.constructGraph(graph, basePath, accessScope);
     }
-    async listGraphs(basePath) {
-        return this.delegate.listGraphs(basePath);
+    async listGraphs(basePath, accessScope) {
+        return this.delegate.listGraphs(basePath, accessScope);
     }
     async close() {
         await this.delegate.close();
@@ -44,35 +45,40 @@ class QuintstoreSparqlEngine {
         this.engine = new ComunicaQuintEngine_1.ComunicaQuintEngine(this.store);
         this.ready = this.store.open();
     }
-    async queryBindings(query, basePath) {
+    async queryBindings(query, basePath, accessScope) {
+        assertCompatibilityAccessScope(accessScope, 'queryBindings');
         await this.ready;
         return this.engine.queryBindings(query, {
             baseIRI: basePath,
             filters: { graph: { $startsWith: basePath } },
         });
     }
-    async queryQuads(query, basePath) {
+    async queryQuads(query, basePath, accessScope) {
+        assertCompatibilityAccessScope(accessScope, 'queryQuads');
         await this.ready;
         return this.engine.queryQuads(query, {
             baseIRI: basePath,
             filters: { graph: { $startsWith: basePath } },
         });
     }
-    async queryBoolean(query, basePath) {
+    async queryBoolean(query, basePath, accessScope) {
+        assertCompatibilityAccessScope(accessScope, 'queryBoolean');
         await this.ready;
         return this.engine.queryBoolean(query, {
             baseIRI: basePath,
             filters: { graph: { $startsWith: basePath } },
         });
     }
-    async queryVoid(query, basePath) {
+    async queryVoid(query, basePath, accessScope, options) {
+        assertCompatibilityAccessScope(accessScope, 'queryVoid');
         await this.ready;
         return this.engine.queryVoid(query, {
             baseIRI: basePath,
             filters: { graph: { $startsWith: basePath } },
         });
     }
-    async constructGraph(graph, basePath) {
+    async constructGraph(graph, basePath, accessScope) {
+        assertCompatibilityAccessScope(accessScope, 'constructGraph');
         await this.ready;
         const constructQuery = `CONSTRUCT { ?s ?p ?o } WHERE { GRAPH <${graph}> { ?s ?p ?o } }`;
         return this.engine.queryQuads(constructQuery, {
@@ -80,7 +86,8 @@ class QuintstoreSparqlEngine {
             filters: { graph: { $startsWith: basePath } },
         });
     }
-    async listGraphs(basePath) {
+    async listGraphs(basePath, accessScope) {
+        assertCompatibilityAccessScope(accessScope, 'listGraphs');
         await this.ready;
         const graphs = new Set();
         const query = 'SELECT DISTINCT ?g WHERE { GRAPH ?g { ?s ?p ?o } }';
@@ -109,4 +116,9 @@ class QuintstoreSparqlEngine {
     }
 }
 exports.QuintstoreSparqlEngine = QuintstoreSparqlEngine;
+function assertCompatibilityAccessScope(accessScope, operation) {
+    if ((0, RdfAccessScope_1.isRestrictiveRdfAccessScope)(accessScope)) {
+        throw new Error(`Compatibility SPARQL engine cannot safely execute ${operation} with ACL/ACR graph restrictions`);
+    }
+}
 //# sourceMappingURL=CompatibilitySparqlEngineImpl.js.map

package/dist/storage/sparql/CompatibilitySparqlEngineImpl.js.map

@@ -1 +1 @@
-{"version":3,"file":"CompatibilitySparqlEngineImpl.js","sourceRoot":"","sources":["../../../src/storage/sparql/CompatibilitySparqlEngineImpl.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAC5D,+CAA4C;AAI5C;;;GAGG;AACH,MAAa,qBAAqB;IAGhC,YAAmB,QAAgB;QACjC,MAAM,KAAK,GAAG,IAAI,yBAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB;QACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB;QACpD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF;AAnCD,sDAmCC;AAED;;GAEG;AACH,MAAa,sBAAsB;IAKjC,YAAmB,KAAiB;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,yCAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB;QACxD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;YACtC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE;YACnC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB;QACpD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;YAClC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,cAAc,GAAG,yCAAyC,KAAK,kBAAkB,CAAC;QACxF,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE;YAC5C,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAmC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,KAAK,GAAG,oDAAoD,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;YACpD,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,MAAgG,EAAE,CAAC;gBAC7H,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,EAAE,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,GAAI,MAA4C,CAAC,KAAK,CAAC;YAClE,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAjFD,wDAiFC","sourcesContent":["import type { Quad, Variable } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport { ComunicaQuintEngine } from './ComunicaQuintEngine';\nimport { QuintEngine } from './QuintEngine';\nimport type { SparqlEngine } from './SubgraphQueryEngine';\nimport type { QuintStore } from '../quint/types';\n\n/**\n * @deprecated Compatibility wrapper preserved for older call sites.\n * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.\n */\nexport class QuadstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: QuintstoreSparqlEngine;\n\n  public constructor(endpoint: string) {\n    const store = new QuintEngine({ endpoint }).getStore();\n    this.delegate = new QuintstoreSparqlEngine(store);\n  }\n\n  public async queryBindings(query: string, basePath: string): Promise<any> {\n    return this.delegate.queryBindings(query, basePath);\n  }\n\n  public async queryQuads(query: string, basePath: string): Promise<any> {\n    return this.delegate.queryQuads(query, basePath);\n  }\n\n  public async queryBoolean(query: string, basePath: string): Promise<boolean> {\n    return this.delegate.queryBoolean(query, basePath);\n  }\n\n  public async queryVoid(query: string, basePath: string): Promise<void> {\n    await this.delegate.queryVoid(query, basePath);\n  }\n\n  public async constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>> {\n    return this.delegate.constructGraph(graph, basePath);\n  }\n\n  public async listGraphs(basePath: string): Promise<Set<string>> {\n    return this.delegate.listGraphs(basePath);\n  }\n\n  public async close(): Promise<void> {\n    await this.delegate.close();\n  }\n}\n\n/**\n * Comunica-backed compatibility engine.\n */\nexport class QuintstoreSparqlEngine implements SparqlEngine {\n  private readonly store: QuintStore;\n  private readonly engine: ComunicaQuintEngine;\n  private readonly ready: Promise<void>;\n\n  public constructor(store: QuintStore) {\n    this.store = store;\n    this.engine = new ComunicaQuintEngine(this.store);\n    this.ready = this.store.open();\n  }\n\n  public async queryBindings(query: string, basePath: string): Promise<any> {\n    await this.ready;\n    return this.engine.queryBindings(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryQuads(query: string, basePath: string): Promise<any> {\n    await this.ready;\n    return this.engine.queryQuads(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryBoolean(query: string, basePath: string): Promise<boolean> {\n    await this.ready;\n    return this.engine.queryBoolean(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryVoid(query: string, basePath: string): Promise<void> {\n    await this.ready;\n    return this.engine.queryVoid(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>> {\n    await this.ready;\n    const constructQuery = `CONSTRUCT { ?s ?p ?o } WHERE { GRAPH <${graph}> { ?s ?p ?o } }`;\n    return this.engine.queryQuads(constructQuery, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    }) as unknown as AsyncIterator<Quad>;\n  }\n\n  public async listGraphs(basePath: string): Promise<Set<string>> {\n    await this.ready;\n    const graphs = new Set<string>();\n    const query = 'SELECT DISTINCT ?g WHERE { GRAPH ?g { ?s ?p ?o } }';\n    const stream = await this.engine.queryBindings(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n\n    try {\n      for await (const binding of stream as unknown as AsyncIterator<Map<string | Variable, { termType?: string; value: string }>>) {\n        const value = binding.get('g');\n        if (value?.termType === 'NamedNode') {\n          graphs.add(value.value);\n        }\n      }\n    } finally {\n      const close = (stream as unknown as { close?: () => void }).close;\n      if (typeof close === 'function') {\n        close();\n      }\n    }\n\n    return graphs;\n  }\n\n  public async close(): Promise<void> {\n    await this.store.close();\n  }\n}\n"]}
+{"version":3,"file":"CompatibilitySparqlEngineImpl.js","sourceRoot":"","sources":["../../../src/storage/sparql/CompatibilitySparqlEngineImpl.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAC5D,+CAA4C;AAG5C,0DAAyF;AAEzF;;;GAGG;AACH,MAAa,qBAAqB;IAGhC,YAAmB,QAAgB;QACjC,MAAM,KAAK,GAAG,IAAI,yBAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACtF,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACnF,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACrF,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B,EAAE,OAA2B;QAC/G,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACvF,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,WAA4B;QACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF;AAnCD,sDAmCC;AAED;;GAEG;AACH,MAAa,sBAAsB;IAKjC,YAAmB,KAAiB;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,yCAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACtF,8BAA8B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;YACtC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACnF,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE;YACnC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACrF,8BAA8B,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B,EAAE,OAA2B;QAC/G,8BAA8B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE;YAClC,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACvF,8BAA8B,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,cAAc,GAAG,yCAAyC,KAAK,kBAAkB,CAAC;QACxF,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE;YAC5C,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAmC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,WAA4B;QACpE,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,KAAK,GAAG,oDAAoD,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;YACpD,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,MAAgG,EAAE,CAAC;gBAC7H,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,KAAK,EAAE,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,GAAI,MAA4C,CAAC,KAAK,CAAC;YAClE,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAvFD,wDAuFC;AAED,SAAS,8BAA8B,CAAC,WAAuC,EAAE,SAAiB;IAChG,IAAI,IAAA,4CAA2B,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,qDAAqD,SAAS,kCAAkC,CAAC,CAAC;IACpH,CAAC;AACH,CAAC","sourcesContent":["import type { Quad, Variable } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport { ComunicaQuintEngine } from './ComunicaQuintEngine';\nimport { QuintEngine } from './QuintEngine';\nimport type { SparqlEngine, SparqlVoidOptions } from './SubgraphQueryEngine';\nimport type { QuintStore } from '../quint/types';\nimport { isRestrictiveRdfAccessScope, type RdfAccessScope } from '../rdf/RdfAccessScope';\n\n/**\n * @deprecated Compatibility wrapper preserved for older call sites.\n * Mainline xpod uses SolidRdfEngine for server-owned Pod queries.\n */\nexport class QuadstoreSparqlEngine implements SparqlEngine {\n  private readonly delegate: QuintstoreSparqlEngine;\n\n  public constructor(endpoint: string) {\n    const store = new QuintEngine({ endpoint }).getStore();\n    this.delegate = new QuintstoreSparqlEngine(store);\n  }\n\n  public async queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return this.delegate.queryBindings(query, basePath, accessScope);\n  }\n\n  public async queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return this.delegate.queryQuads(query, basePath, accessScope);\n  }\n\n  public async queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean> {\n    return this.delegate.queryBoolean(query, basePath, accessScope);\n  }\n\n  public async queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void> {\n    await this.delegate.queryVoid(query, basePath, accessScope, options);\n  }\n\n  public async constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>> {\n    return this.delegate.constructGraph(graph, basePath, accessScope);\n  }\n\n  public async listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>> {\n    return this.delegate.listGraphs(basePath, accessScope);\n  }\n\n  public async close(): Promise<void> {\n    await this.delegate.close();\n  }\n}\n\n/**\n * Comunica-backed compatibility engine.\n */\nexport class QuintstoreSparqlEngine implements SparqlEngine {\n  private readonly store: QuintStore;\n  private readonly engine: ComunicaQuintEngine;\n  private readonly ready: Promise<void>;\n\n  public constructor(store: QuintStore) {\n    this.store = store;\n    this.engine = new ComunicaQuintEngine(this.store);\n    this.ready = this.store.open();\n  }\n\n  public async queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    assertCompatibilityAccessScope(accessScope, 'queryBindings');\n    await this.ready;\n    return this.engine.queryBindings(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    assertCompatibilityAccessScope(accessScope, 'queryQuads');\n    await this.ready;\n    return this.engine.queryQuads(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean> {\n    assertCompatibilityAccessScope(accessScope, 'queryBoolean');\n    await this.ready;\n    return this.engine.queryBoolean(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void> {\n    assertCompatibilityAccessScope(accessScope, 'queryVoid');\n    await this.ready;\n    return this.engine.queryVoid(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n  }\n\n  public async constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>> {\n    assertCompatibilityAccessScope(accessScope, 'constructGraph');\n    await this.ready;\n    const constructQuery = `CONSTRUCT { ?s ?p ?o } WHERE { GRAPH <${graph}> { ?s ?p ?o } }`;\n    return this.engine.queryQuads(constructQuery, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    }) as unknown as AsyncIterator<Quad>;\n  }\n\n  public async listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>> {\n    assertCompatibilityAccessScope(accessScope, 'listGraphs');\n    await this.ready;\n    const graphs = new Set<string>();\n    const query = 'SELECT DISTINCT ?g WHERE { GRAPH ?g { ?s ?p ?o } }';\n    const stream = await this.engine.queryBindings(query, {\n      baseIRI: basePath,\n      filters: { graph: { $startsWith: basePath } },\n    });\n\n    try {\n      for await (const binding of stream as unknown as AsyncIterator<Map<string | Variable, { termType?: string; value: string }>>) {\n        const value = binding.get('g');\n        if (value?.termType === 'NamedNode') {\n          graphs.add(value.value);\n        }\n      }\n    } finally {\n      const close = (stream as unknown as { close?: () => void }).close;\n      if (typeof close === 'function') {\n        close();\n      }\n    }\n\n    return graphs;\n  }\n\n  public async close(): Promise<void> {\n    await this.store.close();\n  }\n}\n\nfunction assertCompatibilityAccessScope(accessScope: RdfAccessScope | undefined, operation: string): void {\n  if (isRestrictiveRdfAccessScope(accessScope)) {\n    throw new Error(`Compatibility SPARQL engine cannot safely execute ${operation} with ACL/ACR graph restrictions`);\n  }\n}\n"]}

package/dist/storage/sparql/SubgraphQueryEngine.d.ts

@@ -1,15 +1,24 @@
 import type { Quad } from '@rdfjs/types';
 import type { AsyncIterator } from 'asynciterator';
+import type { RdfAccessScope } from '../rdf/RdfAccessScope';
+export interface SparqlLoadDocumentOptions {
+    sourceUri: string;
+    body: string;
+    mediaType?: string;
+}
+export interface SparqlVoidOptions {
+    loadDocument?: SparqlLoadDocumentOptions;
+}
 /**
  * SPARQL Engine interface - common abstraction for SPARQL query engines
  */
 export interface SparqlEngine {
-    queryBindings(query: string, basePath: string): Promise<any>;
-    queryQuads(query: string, basePath: string): Promise<any>;
-    queryBoolean(query: string, basePath: string): Promise<boolean>;
-    queryVoid(query: string, basePath: string): Promise<void>;
-    constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>>;
-    listGraphs(basePath: string): Promise<Set<string>>;
+    queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean>;
+    queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void>;
+    constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>>;
+    listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>>;
     close(): Promise<void>;
 }
 /**
@@ -25,11 +34,11 @@ export declare class SubgraphQueryEngine {
      * @param engine - A SparqlEngine implementation
      */
     constructor(engine: SparqlEngine);
-    queryBindings(query: string, basePath: string): Promise<any>;
-    queryQuads(query: string, basePath: string): Promise<any>;
-    queryBoolean(query: string, basePath: string): Promise<boolean>;
-    queryVoid(query: string, basePath: string): Promise<void>;
-    constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>>;
-    listGraphs(basePath: string): Promise<Set<string>>;
+    queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;
+    queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean>;
+    queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void>;
+    constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>>;
+    listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>>;
     close(): Promise<void>;
 }

package/dist/storage/sparql/SubgraphQueryEngine.js

@@ -16,23 +16,23 @@ class SubgraphQueryEngine {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.impl = engine;
     }
-    async queryBindings(query, basePath) {
-        return this.impl.queryBindings(query, basePath);
+    async queryBindings(query, basePath, accessScope) {
+        return this.impl.queryBindings(query, basePath, accessScope);
     }
-    async queryQuads(query, basePath) {
-        return this.impl.queryQuads(query, basePath);
+    async queryQuads(query, basePath, accessScope) {
+        return this.impl.queryQuads(query, basePath, accessScope);
     }
-    async queryBoolean(query, basePath) {
-        return this.impl.queryBoolean(query, basePath);
+    async queryBoolean(query, basePath, accessScope) {
+        return this.impl.queryBoolean(query, basePath, accessScope);
     }
-    async queryVoid(query, basePath) {
-        return this.impl.queryVoid(query, basePath);
+    async queryVoid(query, basePath, accessScope, options) {
+        return this.impl.queryVoid(query, basePath, accessScope, options);
     }
-    async constructGraph(graph, basePath) {
-        return this.impl.constructGraph(graph, basePath);
+    async constructGraph(graph, basePath, accessScope) {
+        return this.impl.constructGraph(graph, basePath, accessScope);
     }
-    async listGraphs(basePath) {
-        return this.impl.listGraphs(basePath);
+    async listGraphs(basePath, accessScope) {
+        return this.impl.listGraphs(basePath, accessScope);
     }
     async close() {
         return this.impl.close();

package/dist/storage/sparql/SubgraphQueryEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"SubgraphQueryEngine.js","sourceRoot":"","sources":["../../../src/storage/sparql/SubgraphQueryEngine.ts"],"names":[],"mappings":";;;AAEA,iEAAqD;AAerD;;;;GAIG;AACH,MAAa,mBAAmB;IAI9B;;;OAGG;IACH,YAAmB,MAAoB;QAPtB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAQ3C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAvCD,kDAuCC","sourcesContent":["import type { Quad } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport { getLoggerFor } from 'global-logger-factory';\n\n/**\n * SPARQL Engine interface - common abstraction for SPARQL query engines\n */\nexport interface SparqlEngine {\n  queryBindings(query: string, basePath: string): Promise<any>;\n  queryQuads(query: string, basePath: string): Promise<any>;\n  queryBoolean(query: string, basePath: string): Promise<boolean>;\n  queryVoid(query: string, basePath: string): Promise<void>;\n  constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>>;\n  listGraphs(basePath: string): Promise<Set<string>>;\n  close(): Promise<void>;\n}\n\n/**\n * SubgraphQueryEngine - SPARQL engine with subgraph (tenant) isolation\n * \n * Wraps a SparqlEngine implementation for use in the system.\n */\nexport class SubgraphQueryEngine {\n  private readonly logger = getLoggerFor(this);\n  private readonly impl: SparqlEngine;\n\n  /**\n   * Create a SubgraphQueryEngine\n   * @param engine - A SparqlEngine implementation\n   */\n  public constructor(engine: SparqlEngine) {\n    this.impl = engine;\n  }\n\n  public async queryBindings(query: string, basePath: string): Promise<any> {\n    return this.impl.queryBindings(query, basePath);\n  }\n\n  public async queryQuads(query: string, basePath: string): Promise<any> {\n    return this.impl.queryQuads(query, basePath);\n  }\n\n  public async queryBoolean(query: string, basePath: string): Promise<boolean> {\n    return this.impl.queryBoolean(query, basePath);\n  }\n\n  public async queryVoid(query: string, basePath: string): Promise<void> {\n    return this.impl.queryVoid(query, basePath);\n  }\n\n  public async constructGraph(graph: string, basePath: string): Promise<AsyncIterator<Quad>> {\n    return this.impl.constructGraph(graph, basePath);\n  }\n\n  public async listGraphs(basePath: string): Promise<Set<string>> {\n    return this.impl.listGraphs(basePath);\n  }\n\n  public async close(): Promise<void> {\n    return this.impl.close();\n  }\n}\n"]}
+{"version":3,"file":"SubgraphQueryEngine.js","sourceRoot":"","sources":["../../../src/storage/sparql/SubgraphQueryEngine.ts"],"names":[],"mappings":";;;AAEA,iEAAqD;AA0BrD;;;;GAIG;AACH,MAAa,mBAAmB;IAI9B;;;OAGG;IACH,YAAmB,MAAoB;QAPtB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAQ3C,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACtF,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACnF,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACrF,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B,EAAE,OAA2B;QAC/G,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAAgB,EAAE,WAA4B;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,WAA4B;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAvCD,kDAuCC","sourcesContent":["import type { Quad } from '@rdfjs/types';\nimport type { AsyncIterator } from 'asynciterator';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { RdfAccessScope } from '../rdf/RdfAccessScope';\n\nexport interface SparqlLoadDocumentOptions {\n  sourceUri: string;\n  body: string;\n  mediaType?: string;\n}\n\nexport interface SparqlVoidOptions {\n  loadDocument?: SparqlLoadDocumentOptions;\n}\n\n/**\n * SPARQL Engine interface - common abstraction for SPARQL query engines\n */\nexport interface SparqlEngine {\n  queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;\n  queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any>;\n  queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean>;\n  queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void>;\n  constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>>;\n  listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>>;\n  close(): Promise<void>;\n}\n\n/**\n * SubgraphQueryEngine - SPARQL engine with subgraph (tenant) isolation\n * \n * Wraps a SparqlEngine implementation for use in the system.\n */\nexport class SubgraphQueryEngine {\n  private readonly logger = getLoggerFor(this);\n  private readonly impl: SparqlEngine;\n\n  /**\n   * Create a SubgraphQueryEngine\n   * @param engine - A SparqlEngine implementation\n   */\n  public constructor(engine: SparqlEngine) {\n    this.impl = engine;\n  }\n\n  public async queryBindings(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return this.impl.queryBindings(query, basePath, accessScope);\n  }\n\n  public async queryQuads(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<any> {\n    return this.impl.queryQuads(query, basePath, accessScope);\n  }\n\n  public async queryBoolean(query: string, basePath: string, accessScope?: RdfAccessScope): Promise<boolean> {\n    return this.impl.queryBoolean(query, basePath, accessScope);\n  }\n\n  public async queryVoid(query: string, basePath: string, accessScope?: RdfAccessScope, options?: SparqlVoidOptions): Promise<void> {\n    return this.impl.queryVoid(query, basePath, accessScope, options);\n  }\n\n  public async constructGraph(graph: string, basePath: string, accessScope?: RdfAccessScope): Promise<AsyncIterator<Quad>> {\n    return this.impl.constructGraph(graph, basePath, accessScope);\n  }\n\n  public async listGraphs(basePath: string, accessScope?: RdfAccessScope): Promise<Set<string>> {\n    return this.impl.listGraphs(basePath, accessScope);\n  }\n\n  public async close(): Promise<void> {\n    return this.impl.close();\n  }\n}\n"]}

package/dist/terminal/sandbox/MacOSSandbox.js

@@ -12,6 +12,7 @@ const os_1 = require("os");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
 const global_logger_factory_1 = require("global-logger-factory");
+const safe_env_1 = require("../../runtime/safe-env");
 let sandboxExecAvailable;
 class MacOSSandbox {
     constructor() {
@@ -41,7 +42,7 @@ class MacOSSandbox {
         const childProcess = (0, child_process_1.spawn)('sandbox-exec', ['-f', profilePath, config.command, ...config.args], {
             cwd: config.workdir,
             env: {
-                ...process.env,
+                ...(0, safe_env_1.sanitizeRuntimeEnv)(process.env),
                 ...config.env,
                 TERM: 'xterm-256color',
             },

package/dist/terminal/sandbox/MacOSSandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"MacOSSandbox.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/MacOSSandbox.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAAgD;AAChD,2BAA+C;AAC/C,2BAA4B;AAC5B,+BAA4B;AAC5B,mCAAoC;AACpC,iEAAqD;AAGrD,IAAI,oBAAyC,CAAC;AAE9C,MAAa,YAAY;IAAzB;QACqB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;IA4GjD,CAAC;IA1GQ,WAAW;QAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,kDAAkD;gBAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAClC,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpD,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,cAAc,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE;YAC9F,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,WAAW,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,aAAa,CAAC,MAAqB;QACzC,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,gBAAgB,SAAS,KAAK,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAa;YACtB,aAAa;YACb,EAAE;YACF,kEAAkE;YAClE,iBAAiB;YACjB,EAAE;YACF,mDAAmD;YACnD,kCAAkC;YAClC,EAAE;YACF,2BAA2B;YAC3B,gCAAgC,MAAM,CAAC,OAAO,KAAK;YACnD,EAAE;YACF,oCAAoC;YACpC,8CAA8C;YAC9C,sCAAsC;YACtC,gCAAgC,IAAA,WAAM,GAAE,KAAK;YAC7C,8CAA8C;YAC9C,sDAAsD;SACvD,CAAC;QAEF,oBAAoB;QACpB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,CAAC;QAED,2DAA2D;QAC3D,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAA,kBAAa,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA7GD,oCA6GC","sourcesContent":["/**\n * macOS Sandbox (sandbox-exec / Seatbelt)\n *\n * Uses macOS sandbox-exec with Seatbelt profiles for process isolation.\n */\nimport { spawn, execSync } from 'child_process';\nimport { writeFileSync, unlinkSync } from 'fs';\nimport { tmpdir } from 'os';\nimport { join } from 'path';\nimport { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\n\nlet sandboxExecAvailable: boolean | undefined;\n\nexport class MacOSSandbox implements Sandbox {\n  protected readonly logger = getLoggerFor(this);\n\n  public isAvailable(): boolean {\n    if (sandboxExecAvailable === undefined) {\n      try {\n        // Check if we're on macOS and sandbox-exec exists\n        if (process.platform !== 'darwin') {\n          sandboxExecAvailable = false;\n        } else {\n          execSync('which sandbox-exec', { stdio: 'ignore' });\n          sandboxExecAvailable = true;\n        }\n      } catch {\n        sandboxExecAvailable = false;\n      }\n    }\n    return sandboxExecAvailable;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const profilePath = this.createProfile(config);\n\n    this.logger.info(`Launching macOS sandbox: ${config.command}`);\n\n    const childProcess = spawn('sandbox-exec', ['-f', profilePath, config.command, ...config.args], {\n      cwd: config.workdir,\n      env: {\n        ...process.env,\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    // Clean up profile after process exits\n    childProcess.on('exit', () => {\n      try {\n        unlinkSync(profilePath);\n      } catch {\n        // Ignore cleanup errors\n      }\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: true,\n      technology: 'sandbox-exec',\n    };\n  }\n\n  /**\n   * Create a Seatbelt profile for the sandbox.\n   *\n   * Strategy: Allow most operations by default, then deny writes outside workdir.\n   * This is more robust than deny-by-default which breaks many macOS subsystems.\n   *\n   * Profile:\n   * - Allow default (reading, processes, etc.)\n   * - Deny writes to root filesystem\n   * - Allow writes only to: workdir, temp dirs, var/folders\n   * - Optionally deny network\n   */\n  private createProfile(config: SandboxConfig): string {\n    const profileId = randomUUID().replace(/-/g, '').slice(0, 8);\n    const profilePath = join(tmpdir(), `xpod-sandbox-${profileId}.sb`);\n\n    const rules: string[] = [\n      '(version 1)',\n      '',\n      '; Allow most operations by default (macOS needs many subsystems)',\n      '(allow default)',\n      '',\n      '; Deny writes to the entire filesystem by default',\n      '(deny file-write* (subpath \"/\"))',\n      '',\n      '; Allow writes to workdir',\n      `(allow file-write* (subpath \"${config.workdir}\"))`,\n      '',\n      '; Allow writes to temp directories',\n      '(allow file-write* (subpath \"/private/tmp\"))',\n      '(allow file-write* (subpath \"/tmp\"))',\n      `(allow file-write* (subpath \"${tmpdir()}\"))`,\n      '(allow file-write* (subpath \"/var/folders\"))',\n      '(allow file-write* (subpath \"/private/var/folders\"))',\n    ];\n\n    // Network isolation\n    if (config.isolateNetwork) {\n      rules.push('');\n      rules.push('; Deny network access');\n      rules.push('(deny network*)');\n    }\n\n    // Additional read-only paths (already readable by default)\n    if (config.readonlyPaths) {\n      rules.push('');\n      rules.push('; Additional read-only paths (already allowed by default)');\n      for (const p of config.readonlyPaths) {\n        rules.push(`; readonly: ${p}`);\n      }\n    }\n\n    const profile = rules.join('\\n');\n    writeFileSync(profilePath, profile);\n\n    this.logger.debug(`Created sandbox profile: ${profilePath}`);\n    return profilePath;\n  }\n}\n"]}
+{"version":3,"file":"MacOSSandbox.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/MacOSSandbox.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAAgD;AAChD,2BAA+C;AAC/C,2BAA4B;AAC5B,+BAA4B;AAC5B,mCAAoC;AACpC,iEAAqD;AAErD,qDAA4D;AAE5D,IAAI,oBAAyC,CAAC;AAE9C,MAAa,YAAY;IAAzB;QACqB,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;IA4GjD,CAAC;IA1GQ,WAAW;QAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,kDAAkD;gBAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAClC,oBAAoB,GAAG,KAAK,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACN,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpD,oBAAoB,GAAG,IAAI,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAE/D,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,cAAc,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE;YAC9F,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,GAAG,CAAC;gBAClC,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC;gBACH,IAAA,eAAU,EAAC,WAAW,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,cAAc;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,aAAa,CAAC,MAAqB;QACzC,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,gBAAgB,SAAS,KAAK,CAAC,CAAC;QAEnE,MAAM,KAAK,GAAa;YACtB,aAAa;YACb,EAAE;YACF,kEAAkE;YAClE,iBAAiB;YACjB,EAAE;YACF,mDAAmD;YACnD,kCAAkC;YAClC,EAAE;YACF,2BAA2B;YAC3B,gCAAgC,MAAM,CAAC,OAAO,KAAK;YACnD,EAAE;YACF,oCAAoC;YACpC,8CAA8C;YAC9C,sCAAsC;YACtC,gCAAgC,IAAA,WAAM,GAAE,KAAK;YAC7C,8CAA8C;YAC9C,sDAAsD;SACvD,CAAC;QAEF,oBAAoB;QACpB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,CAAC;QAED,2DAA2D;QAC3D,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAA,kBAAa,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA7GD,oCA6GC","sourcesContent":["/**\n * macOS Sandbox (sandbox-exec / Seatbelt)\n *\n * Uses macOS sandbox-exec with Seatbelt profiles for process isolation.\n */\nimport { spawn, execSync } from 'child_process';\nimport { writeFileSync, unlinkSync } from 'fs';\nimport { tmpdir } from 'os';\nimport { join } from 'path';\nimport { randomUUID } from 'crypto';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\nimport { sanitizeRuntimeEnv } from '../../runtime/safe-env';\n\nlet sandboxExecAvailable: boolean | undefined;\n\nexport class MacOSSandbox implements Sandbox {\n  protected readonly logger = getLoggerFor(this);\n\n  public isAvailable(): boolean {\n    if (sandboxExecAvailable === undefined) {\n      try {\n        // Check if we're on macOS and sandbox-exec exists\n        if (process.platform !== 'darwin') {\n          sandboxExecAvailable = false;\n        } else {\n          execSync('which sandbox-exec', { stdio: 'ignore' });\n          sandboxExecAvailable = true;\n        }\n      } catch {\n        sandboxExecAvailable = false;\n      }\n    }\n    return sandboxExecAvailable;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const profilePath = this.createProfile(config);\n\n    this.logger.info(`Launching macOS sandbox: ${config.command}`);\n\n    const childProcess = spawn('sandbox-exec', ['-f', profilePath, config.command, ...config.args], {\n      cwd: config.workdir,\n      env: {\n        ...sanitizeRuntimeEnv(process.env),\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    // Clean up profile after process exits\n    childProcess.on('exit', () => {\n      try {\n        unlinkSync(profilePath);\n      } catch {\n        // Ignore cleanup errors\n      }\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: true,\n      technology: 'sandbox-exec',\n    };\n  }\n\n  /**\n   * Create a Seatbelt profile for the sandbox.\n   *\n   * Strategy: Allow most operations by default, then deny writes outside workdir.\n   * This is more robust than deny-by-default which breaks many macOS subsystems.\n   *\n   * Profile:\n   * - Allow default (reading, processes, etc.)\n   * - Deny writes to root filesystem\n   * - Allow writes only to: workdir, temp dirs, var/folders\n   * - Optionally deny network\n   */\n  private createProfile(config: SandboxConfig): string {\n    const profileId = randomUUID().replace(/-/g, '').slice(0, 8);\n    const profilePath = join(tmpdir(), `xpod-sandbox-${profileId}.sb`);\n\n    const rules: string[] = [\n      '(version 1)',\n      '',\n      '; Allow most operations by default (macOS needs many subsystems)',\n      '(allow default)',\n      '',\n      '; Deny writes to the entire filesystem by default',\n      '(deny file-write* (subpath \"/\"))',\n      '',\n      '; Allow writes to workdir',\n      `(allow file-write* (subpath \"${config.workdir}\"))`,\n      '',\n      '; Allow writes to temp directories',\n      '(allow file-write* (subpath \"/private/tmp\"))',\n      '(allow file-write* (subpath \"/tmp\"))',\n      `(allow file-write* (subpath \"${tmpdir()}\"))`,\n      '(allow file-write* (subpath \"/var/folders\"))',\n      '(allow file-write* (subpath \"/private/var/folders\"))',\n    ];\n\n    // Network isolation\n    if (config.isolateNetwork) {\n      rules.push('');\n      rules.push('; Deny network access');\n      rules.push('(deny network*)');\n    }\n\n    // Additional read-only paths (already readable by default)\n    if (config.readonlyPaths) {\n      rules.push('');\n      rules.push('; Additional read-only paths (already allowed by default)');\n      for (const p of config.readonlyPaths) {\n        rules.push(`; readonly: ${p}`);\n      }\n    }\n\n    const profile = rules.join('\\n');\n    writeFileSync(profilePath, profile);\n\n    this.logger.debug(`Created sandbox profile: ${profilePath}`);\n    return profilePath;\n  }\n}\n"]}

package/dist/terminal/sandbox/index.js

@@ -27,6 +27,7 @@ const child_process_1 = require("child_process");
 const global_logger_factory_1 = require("global-logger-factory");
 const BubblewrapSandbox_1 = require("./BubblewrapSandbox");
 const MacOSSandbox_1 = require("./MacOSSandbox");
+const safe_env_1 = require("../../runtime/safe-env");
 __exportStar(require("./types"), exports);
 var BubblewrapSandbox_2 = require("./BubblewrapSandbox");
 Object.defineProperty(exports, "BubblewrapSandbox", { enumerable: true, get: function () { return BubblewrapSandbox_2.BubblewrapSandbox; } });
@@ -44,7 +45,7 @@ class NoSandbox {
         const childProcess = (0, child_process_1.spawn)(config.command, config.args, {
             cwd: config.workdir,
             env: {
-                ...process.env,
+                ...(0, safe_env_1.sanitizeRuntimeEnv)(process.env),
                 ...config.env,
                 TERM: 'xterm-256color',
             },

package/dist/terminal/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;;GAOG;AACH,iDAAsC;AACtC,iEAAqD;AAErD,2DAAwD;AACxD,iDAA8C;AAE9C,0CAAwB;AACxB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB;;;GAGG;AACH,MAAM,SAAS;IACN,WAAW;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YACtD,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAa,cAAc;IAOzB;;OAEG;IACI,MAAM,CAAC,UAAU;QACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,MAAqB;QACxC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,aAAa;QACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAtDH,wCAuDC;AAtD2B,qBAAM,GAAG,IAAA,oCAAY,EAAC,gBAAgB,CAAC,CAAC;AAEnD,yBAAU,GAAG,IAAI,qCAAiB,EAAE,CAAC;AACrC,oBAAK,GAAG,IAAI,2BAAY,EAAE,CAAC;AAC3B,wBAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["/**\n * Cross-platform Sandbox Factory\n *\n * Automatically selects the appropriate sandbox technology for the current platform:\n * - Linux: bubblewrap (namespace isolation)\n * - macOS: sandbox-exec (Seatbelt)\n * - Windows: none (fallback)\n */\nimport { spawn } from 'child_process';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\nimport { BubblewrapSandbox } from './BubblewrapSandbox';\nimport { MacOSSandbox } from './MacOSSandbox';\n\nexport * from './types';\nexport { BubblewrapSandbox } from './BubblewrapSandbox';\nexport { MacOSSandbox } from './MacOSSandbox';\n\n/**\n * No-op sandbox that runs processes without isolation.\n * Used as fallback when no sandbox technology is available.\n */\nclass NoSandbox implements Sandbox {\n  public isAvailable(): boolean {\n    return true;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const childProcess = spawn(config.command, config.args, {\n      cwd: config.workdir,\n      env: {\n        ...process.env,\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: false,\n      technology: 'none',\n    };\n  }\n}\n\n/**\n * Sandbox Factory\n */\nexport class SandboxFactory {\n  protected static readonly logger = getLoggerFor('SandboxFactory');\n\n  private static bubblewrap = new BubblewrapSandbox();\n  private static macos = new MacOSSandbox();\n  private static noSandbox = new NoSandbox();\n\n  /**\n   * Get the best available sandbox for the current platform.\n   */\n  public static getSandbox(): Sandbox {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return this.bubblewrap;\n    }\n\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return this.macos;\n    }\n\n    this.logger.warn(`No sandbox available for platform ${process.platform}`);\n    return this.noSandbox;\n  }\n\n  /**\n   * Launch a sandboxed process.\n   */\n  public static launch(config: SandboxConfig): SandboxResult {\n    return this.getSandbox().launch(config);\n  }\n\n  /**\n   * Check if sandbox is available.\n   */\n  public static isAvailable(): boolean {\n    if (process.platform === 'linux') {\n      return this.bubblewrap.isAvailable();\n    }\n    if (process.platform === 'darwin') {\n      return this.macos.isAvailable();\n    }\n    return false;\n  }\n\n  /**\n   * Get the sandbox technology name.\n   */\n  public static getTechnology(): 'bubblewrap' | 'sandbox-exec' | 'none' {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return 'bubblewrap';\n    }\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return 'sandbox-exec';\n    }\n    return 'none';\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/terminal/sandbox/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;;;;;GAOG;AACH,iDAAsC;AACtC,iEAAqD;AAErD,2DAAwD;AACxD,iDAA8C;AAC9C,qDAA4D;AAE5D,0CAAwB;AACxB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAC1B,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB;;;GAGG;AACH,MAAM,SAAS;IACN,WAAW;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,MAAqB;QACjC,MAAM,YAAY,GAAG,IAAA,qBAAK,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YACtD,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,GAAG,EAAE;gBACH,GAAG,IAAA,6BAAkB,EAAC,OAAO,CAAC,GAAG,CAAC;gBAClC,GAAG,MAAM,CAAC,GAAG;gBACb,IAAI,EAAE,gBAAgB;aACvB;YACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAa,cAAc;IAOzB;;OAEG;IACI,MAAM,CAAC,UAAU;QACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,MAAqB;QACxC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,aAAa;QACzB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;;AAtDH,wCAuDC;AAtD2B,qBAAM,GAAG,IAAA,oCAAY,EAAC,gBAAgB,CAAC,CAAC;AAEnD,yBAAU,GAAG,IAAI,qCAAiB,EAAE,CAAC;AACrC,oBAAK,GAAG,IAAI,2BAAY,EAAE,CAAC;AAC3B,wBAAS,GAAG,IAAI,SAAS,EAAE,CAAC","sourcesContent":["/**\n * Cross-platform Sandbox Factory\n *\n * Automatically selects the appropriate sandbox technology for the current platform:\n * - Linux: bubblewrap (namespace isolation)\n * - macOS: sandbox-exec (Seatbelt)\n * - Windows: none (fallback)\n */\nimport { spawn } from 'child_process';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Sandbox, SandboxConfig, SandboxResult } from './types';\nimport { BubblewrapSandbox } from './BubblewrapSandbox';\nimport { MacOSSandbox } from './MacOSSandbox';\nimport { sanitizeRuntimeEnv } from '../../runtime/safe-env';\n\nexport * from './types';\nexport { BubblewrapSandbox } from './BubblewrapSandbox';\nexport { MacOSSandbox } from './MacOSSandbox';\n\n/**\n * No-op sandbox that runs processes without isolation.\n * Used as fallback when no sandbox technology is available.\n */\nclass NoSandbox implements Sandbox {\n  public isAvailable(): boolean {\n    return true;\n  }\n\n  public launch(config: SandboxConfig): SandboxResult {\n    const childProcess = spawn(config.command, config.args, {\n      cwd: config.workdir,\n      env: {\n        ...sanitizeRuntimeEnv(process.env),\n        ...config.env,\n        TERM: 'xterm-256color',\n      },\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n\n    return {\n      process: childProcess,\n      sandboxed: false,\n      technology: 'none',\n    };\n  }\n}\n\n/**\n * Sandbox Factory\n */\nexport class SandboxFactory {\n  protected static readonly logger = getLoggerFor('SandboxFactory');\n\n  private static bubblewrap = new BubblewrapSandbox();\n  private static macos = new MacOSSandbox();\n  private static noSandbox = new NoSandbox();\n\n  /**\n   * Get the best available sandbox for the current platform.\n   */\n  public static getSandbox(): Sandbox {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return this.bubblewrap;\n    }\n\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return this.macos;\n    }\n\n    this.logger.warn(`No sandbox available for platform ${process.platform}`);\n    return this.noSandbox;\n  }\n\n  /**\n   * Launch a sandboxed process.\n   */\n  public static launch(config: SandboxConfig): SandboxResult {\n    return this.getSandbox().launch(config);\n  }\n\n  /**\n   * Check if sandbox is available.\n   */\n  public static isAvailable(): boolean {\n    if (process.platform === 'linux') {\n      return this.bubblewrap.isAvailable();\n    }\n    if (process.platform === 'darwin') {\n      return this.macos.isAvailable();\n    }\n    return false;\n  }\n\n  /**\n   * Get the sandbox technology name.\n   */\n  public static getTechnology(): 'bubblewrap' | 'sandbox-exec' | 'none' {\n    if (process.platform === 'linux' && this.bubblewrap.isAvailable()) {\n      return 'bubblewrap';\n    }\n    if (process.platform === 'darwin' && this.macos.isAvailable()) {\n      return 'sandbox-exec';\n    }\n    return 'none';\n  }\n}\n"]}

package/dist/test-utils/no-auth-xpod.js

@@ -16,6 +16,9 @@ async function startNoAuthXpod(options = {}) {
         rootFilePath: options.rootFilePath,
         sparqlEndpoint: options.sparqlEndpoint,
         logLevel: options.logLevel,
+        env: {
+            XPOD_LOCAL_AUTO_PROVISION: 'false',
+        },
     });
     return {
         baseUrl: runtime.baseUrl,

package/dist/test-utils/no-auth-xpod.js.map

@@ -1 +1 @@
-{"version":3,"file":"no-auth-xpod.js","sourceRoot":"","sources":["../../src/test-utils/no-auth-xpod.ts"],"names":[],"mappings":";;AAcA,0CAmBC;AAjCD;;;GAGG;AACH,wDAA0D;AAUnD,KAAK,UAAU,eAAe,CAAC,UAA6B,EAAE;IAInE,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAgB,EAAC;QACrC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzC,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * 无鉴权版本的 xpod 启动器\n * 使用进程内 lib 方式启动完整 Xpod（CSS + API + Gateway）\n */\nimport { startXpodRuntime } from '../runtime/XpodRuntime';\n\nexport interface NoAuthXpodOptions {\n  port?: number;\n  baseUrl?: string;\n  rootFilePath?: string;\n  sparqlEndpoint?: string;\n  logLevel?: string;\n}\n\nexport async function startNoAuthXpod(options: NoAuthXpodOptions = {}): Promise<{\n  baseUrl: string;\n  stop: () => Promise<void>;\n}> {\n  const runtime = await startXpodRuntime({\n    mode: 'local',\n    open: true,\n    transport: options.port ? 'port' : 'auto',\n    gatewayPort: options.port,\n    baseUrl: options.baseUrl,\n    rootFilePath: options.rootFilePath,\n    sparqlEndpoint: options.sparqlEndpoint,\n    logLevel: options.logLevel,\n  });\n\n  return {\n    baseUrl: runtime.baseUrl,\n    stop: runtime.stop,\n  };\n}\n"]}
+{"version":3,"file":"no-auth-xpod.js","sourceRoot":"","sources":["../../src/test-utils/no-auth-xpod.ts"],"names":[],"mappings":";;AAcA,0CAsBC;AApCD;;;GAGG;AACH,wDAA0D;AAUnD,KAAK,UAAU,eAAe,CAAC,UAA6B,EAAE;IAInE,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAgB,EAAC;QACrC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACzC,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,EAAE;YACH,yBAAyB,EAAE,OAAO;SACnC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * 无鉴权版本的 xpod 启动器\n * 使用进程内 lib 方式启动完整 Xpod（CSS + API + Gateway）\n */\nimport { startXpodRuntime } from '../runtime/XpodRuntime';\n\nexport interface NoAuthXpodOptions {\n  port?: number;\n  baseUrl?: string;\n  rootFilePath?: string;\n  sparqlEndpoint?: string;\n  logLevel?: string;\n}\n\nexport async function startNoAuthXpod(options: NoAuthXpodOptions = {}): Promise<{\n  baseUrl: string;\n  stop: () => Promise<void>;\n}> {\n  const runtime = await startXpodRuntime({\n    mode: 'local',\n    open: true,\n    transport: options.port ? 'port' : 'auto',\n    gatewayPort: options.port,\n    baseUrl: options.baseUrl,\n    rootFilePath: options.rootFilePath,\n    sparqlEndpoint: options.sparqlEndpoint,\n    logLevel: options.logLevel,\n    env: {\n      XPOD_LOCAL_AUTO_PROVISION: 'false',\n    },\n  });\n\n  return {\n    baseUrl: runtime.baseUrl,\n    stop: runtime.stop,\n  };\n}\n"]}

package/dist/tunnel/LocalTunnelProvider.d.ts

@@ -6,6 +6,8 @@ import type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus } f
 export interface LocalTunnelProviderOptions {
     /** Cloudflare Tunnel Token (从环境变量 CLOUDFLARE_TUNNEL_TOKEN 获取) */
     tunnelToken: string;
+    /** Active profile public endpoint, shown in status and DDNS diagnostics. */
+    publicUrl?: string;
     /** cloudflared 可执行文件路径 (默认 'cloudflared') */
     cloudflaredPath?: string;
 }
@@ -24,6 +26,7 @@ export declare class LocalTunnelProvider implements TunnelProvider {
     readonly name = "cloudflare-local";
     private readonly logger;
     private readonly tunnelToken;
+    private readonly publicUrl?;
     private readonly cloudflaredPath;
     private process;
     private status;

package/dist/tunnel/LocalTunnelProvider.js

@@ -29,6 +29,7 @@ class LocalTunnelProvider {
         /** 标记隧道进程是否由我们启动和管理 */
         this.managedByUs = false;
         this.tunnelToken = options.tunnelToken;
+        this.publicUrl = normalizePublicEndpoint(options.publicUrl);
         this.cloudflaredPath = options.cloudflaredPath ?? 'cloudflared';
     }
     /**
@@ -41,7 +42,7 @@ class LocalTunnelProvider {
         const config = {
             subdomain: 'local', // 占位符，实际域名由 Cloudflare Tunnel 配置决定
             provider: 'cloudflare',
-            endpoint: '', // 实际 endpoint 由 Cloudflare Tunnel 配置决定
+            endpoint: this.publicUrl ?? '', // 实际 endpoint 由 Cloudflare Tunnel 配置决定
             originUrl: `${localProtocol}://127.0.0.1:${options.localPort}`,
             tunnelToken: this.tunnelToken,
         };
@@ -290,4 +291,19 @@ class LocalTunnelProvider {
     }
 }
 exports.LocalTunnelProvider = LocalTunnelProvider;
+function normalizePublicEndpoint(value) {
+    if (!value?.trim()) {
+        return undefined;
+    }
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return undefined;
+        }
+        return url.toString().replace(/\/+$/u, '') + '/';
+    }
+    catch {
+        return value.trim();
+    }
+}
 //# sourceMappingURL=LocalTunnelProvider.js.map