glossarist 0.4.14 → 0.4.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glossarist",
-  "version": "0.4.14",
+  "version": "0.4.15",
   "description": "JavaScript SDK for Glossarist GCR packages — read, write, validate, and manage terminology concepts",
   "type": "module",
   "main": "src/index.js",
@@ -42,6 +42,11 @@
       "import": "./src/rdf/index.js",
       "default": "./src/rdf/index.js"
     },
+    "./rdf/shacl": {
+      "types": "./src/rdf/shacl-entry.d.ts",
+      "import": "./src/rdf/shacl-entry.js",
+      "default": "./src/rdf/shacl-entry.js"
+    },
     "./rdf/prefixes": {
       "types": "./src/rdf/predicates.d.ts",
       "import": "./src/rdf/predicates.js",

package/src/rdf/bnode-id.js

@@ -6,11 +6,30 @@
 // strategy: MD5 (via node:crypto) when available, FNV-1a fallback for
 // browser bundles.
 //
-// Cross-process stability matches glossarist-ruby's deterministic-id
-// when node:crypto is available. Within a single process, FNV-1a is
-// also stable.
+// Browser safety: node:crypto is loaded lazily via runtime check so
+// bundlers don't tree-shake the import into the browser bundle.
 
-import { createHash } from 'node:crypto';
+let nodeCreateHash = null;
+let nodeCryptoChecked = false;
+
+function getNodeCreateHash() {
+  if (nodeCryptoChecked) return nodeCreateHash;
+  nodeCryptoChecked = true;
+  try {
+    let requireFn;
+    try {
+      const mod = (Function('m', 'return require(m)'))('node:module');
+      requireFn = mod.createRequire(import.meta.url);
+    } catch {
+      requireFn = (m) => (Function('m', 'return require(m)'))(m);
+    }
+    const crypto = requireFn('node:crypto');
+    nodeCreateHash = crypto.createHash.bind(crypto);
+  } catch {
+    nodeCreateHash = null;
+  }
+  return nodeCreateHash;
+}
 
 function fnv1a(seed) {
   let h = 0x811c9dc5;
@@ -24,12 +43,13 @@ function fnv1a(seed) {
 export function deterministicBnodeId(...parts) {
   const seed = parts.filter(p => p != null && p !== '').join('|');
   if (!seed) return `b${fnv1a('empty')}`;
-  // MD5 matches glossarist-ruby's deterministic-id for cross-process
-  // stability. Truncated to 12 hex chars — enough collision resistance
-  // for bnode IDs within a single document.
-  try {
-    return createHash('md5').update(seed).digest('hex').slice(0, 12);
-  } catch {
-    return `b${fnv1a(seed)}`;
+  const createHash = getNodeCreateHash();
+  if (createHash) {
+    try {
+      return createHash('md5').update(seed).digest('hex').slice(0, 12);
+    } catch {
+      // fall through to FNV
+    }
   }
+  return `b${fnv1a(seed)}`;
 }

package/src/rdf/deterministic-id.js

@@ -1,17 +1,71 @@
-import { createHash } from 'node:crypto';
+// Stable ID helpers for RDF emission. Mirrors glossarist-ruby's
+// Digest::MD5.hexdigest(content)[0..11] for cross-runtime stability.
+//
+// Browser safety: node:crypto is loaded lazily so bundlers don't
+// tree-shake the import into browser bundles. The runtime check uses
+// `createRequire` from `node:module` (also lazy) which is the
+// documented way to use CommonJS `require` from ESM.
+
+let nodeCreateHash = null;
+let nodeCryptoChecked = false;
+
+function getNodeCreateHash() {
+  if (nodeCryptoChecked) return nodeCreateHash;
+  nodeCryptoChecked = true;
+  try {
+    // Lazy require — works in both CJS and ESM (Node ≥ 12).
+    // Wrapped in Function() so bundlers don't statically resolve it.
+    let requireFn;
+    try {
+      // ESM: use createRequire from node:module
+      const mod = (Function('m', 'return require(m)'))('node:module');
+      requireFn = mod.createRequire(import.meta.url);
+    } catch {
+      // CJS or already-require-available environment
+      requireFn = (m) => (Function('m', 'return require(m)'))(m);
+    }
+    const crypto = requireFn('node:crypto');
+    nodeCreateHash = crypto.createHash.bind(crypto);
+  } catch {
+    nodeCreateHash = null;
+  }
+  return nodeCreateHash;
+}
 
 // 12-char hex prefix, mirroring glossarist-ruby's
 // `Digest::MD5.hexdigest(content)[0..11]`. Same content → same ID across
-// processes, machines, and language runtimes (Ruby vs JS).
+// processes, machines, and language runtimes (Ruby vs JS) when MD5 is
+// available. Falls back to a 12-char FNV-1a hash in the browser.
 export function deterministicId(...parts) {
   const seed = parts.filter(p => p !== null && p !== undefined).join('|');
-  return createHash('md5').update(seed).digest('hex').slice(0, 12);
+  const createHash = getNodeCreateHash();
+  if (createHash) {
+    return createHash('md5').update(seed).digest('hex').slice(0, 12);
+  }
+  return fnv1a12(seed);
 }
 
 // Stable blank-node label for an RDF fragment identified by its parent
-// subject + role + index. Useful for reified resources like DetailedDefinition,
-// Designation, ConceptSource where the bnode ID must be deterministic to
-// produce byte-equivalent Turtle across runs.
+// subject + role + index.
 export function deterministicBnode(subject, role, index) {
   return `_:b${deterministicId(subject, role, index)}`;
 }
+
+// 12-char FNV-1a hash. Two 32-bit passes concatenated and truncated.
+// Not as collision-resistant as MD5 but adequate for bnode IDs in a
+// single document. Used only when node:crypto is unavailable.
+function fnv1a12(seed) {
+  let h1 = 0x811c9dc5;
+  for (let i = 0; i < seed.length; i++) {
+    h1 ^= seed.charCodeAt(i);
+    h1 = Math.imul(h1, 0x01000193);
+  }
+  const seed2 = `${seed}|fnv2`;
+  let h2 = 0x811c9dc5;
+  for (let i = 0; i < seed2.length; i++) {
+    h2 ^= seed2.charCodeAt(i);
+    h2 = Math.imul(h2, 0x01000193);
+  }
+  return ((h1 >>> 0).toString(16).padStart(8, '0')
+    + (h2 >>> 0).toString(16).padStart(8, '0')).slice(0, 12);
+}

package/src/rdf/index.d.ts

@@ -315,7 +315,5 @@ export interface ValidationReport {
   }>;
 }
 
-export declare function loadShapes(options?: { shapesPath?: string }): Promise<Dataset>;
-export declare function validateShacl(dataDataset: Dataset, options?: { shapes?: Dataset; shapesPath?: string }): Promise<ValidationReport>;
-export declare function clearShapesCache(): void;
-export declare function quadsToDataset(quads: Iterable<Quad>): Dataset;
+// SHACL validator moved to ./shacl-entry subpath. Importing from
+// 'glossarist/rdf/shacl' in Node-only; 'glossarist/rdf' is browser-safe.

package/src/rdf/index.js

@@ -50,6 +50,8 @@ export {
   sortQuads,
 } from './document-writer.js';
 export { writeTurtleSync } from './write-turtle-sync.js';
-export { validateShacl, loadShapes, clearShapesCache, quadsToDataset } from './shacl.js';
+// SHACL validator moved to glossarist/rdf/shacl subpath — it depends on
+// node:fs/promises, node:path, node:url at module top-level, which would
+// break browser bundles. Importing 'glossarist/rdf' alone is browser-safe.
 export { quadSectionsToClassInstances } from './sections-builder.js';
 export { provenanceToQuads } from './provenance-emitter.js';

package/src/rdf/shacl-entry.d.ts

@@ -0,0 +1,6 @@
+// Type declarations for the Node-only SHACL validator subpath.
+//
+// Mirrors src/rdf/shacl-entry.js. Separated from ./rdf so that browser
+// bundles don't pull in node:fs/promises, node:path, node:url.
+
+export { validateShacl, loadShapes, clearShapesCache, quadsToDataset } from './shacl';

package/src/rdf/shacl-entry.js

@@ -0,0 +1,9 @@
+// Node-only SHACL validator entry. Separated from glossarist/rdf so that
+// browser bundles can import RDF emitters/writers without pulling in
+// node:fs/promises, node:path, node:url.
+//
+// Usage (Node only):
+//   import { validateShacl, loadShapes, clearShapesCache, quadsToDataset }
+//     from 'glossarist/rdf/shacl';
+
+export { validateShacl, loadShapes, clearShapesCache, quadsToDataset } from './shacl.js';