@_linked/server 2.17.0 → 2.19.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @\_linked/server
 
+## 2.19.0
+
+### Minor Changes
+
+- [#130](https://github.com/linked-fw/server/pull/130) [`e554786`](https://github.com/linked-fw/server/commit/e554786ed4b43738d820290c8ece89d0788c8fd8) Thanks [@flyon](https://github.com/flyon)! - A provider can refuse to let the server start. An error with an own `fatal: true` property thrown at boot — from a provider constructor, a backend module's top level, or a boot hook — is no longer isolated: it is logged as `[linked] <pkg> <hook>: fatal error, refusing to start: …`, `start()` / `initOnly()` reject with it, and the process exits with code 1. After boot (per-request hooks, lazy loads, HMR) it is logged as fatal and contained. Non-fatal errors are isolated as before. Adds `FatalStartupError` and `isFatalError` (`@_linked/server/utils/fatalError`, also exported from the package root).
+
+## 2.18.0
+
+### Minor Changes
+
+- [#128](https://github.com/linked-fw/server/pull/128) [`2b8e8ac`](https://github.com/linked-fw/server/commit/2b8e8acde912d91d8b706f09ca0a6e2663155c0c) Thanks [@flyon](https://github.com/flyon)! - The server ontology moves from `http://lincd.org/ont/lincd-server/` to `https://linked.cm/ont/server/`, the first-party scheme every public package uses (`https://linked.cm/ont/{publicSlug}/`, next to its shapes at `https://linked.cm/shape/server/`).
+
+  No data migration is needed. No stored data is typed with these terms (`LincdServer`, `LincdAPI`, `LincdWebApp`, `hasAPI`, …). The only store triples that carried them are the synced shape descriptions of `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`); boot sync deletes and recreates each registered shape's description, so they move to the new IRIs the next time the server starts. With `syncShapesOnBoot: false` they keep the old IRIs until the next sync. The prefix key (`lincd-server`) and the `ontologies/lincd-server` module are unchanged; code that hard-codes `http://lincd.org/ont/lincd-server/` must be updated.
+
 ## 2.17.0
 
 ### Minor Changes

package/lib/esm/data/lincd-server.json

@@ -4,7 +4,7 @@
     "owl": "http://www.w3.org/2002/07/owl#",
     "rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
     "rdfs": "http://www.w3.org/2000/01/rdf-schema#",
-    "lincd-server": "http://lincd.org/ont/lincd-server/"
+    "lincd-server": "https://linked.cm/ont/server/"
   },
   "@graph": [
     {

package/lib/esm/index.d.ts

@@ -4,4 +4,6 @@ import './shapes/index.js';
 import './shapes/quadstores/BackendAPIStore.js';
 import './shapes/filestores/LocalFileStore.js';
 import './utils/accessUrl.js';
+export { FatalStartupError, isFatalError } from './utils/fatalError.js';
+export type { FatalError } from './utils/fatalError.js';
 export type { RouteConfig, RoutesConfig, RoutesModule, } from '@_linked/server-utils/types/RouteConfig';

package/lib/esm/index.js

@@ -7,4 +7,6 @@ import './shapes/quadstores/BackendAPIStore.js';
 import './shapes/filestores/LocalFileStore.js';
 //THEN COMPONENTS
 import './utils/accessUrl.js';
+// The fatal-error contract a provider uses to refuse to let the server start.
+export { FatalStartupError, isFatalError } from './utils/fatalError.js';
 //# sourceMappingURL=index.js.map

package/lib/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,uCAAuC,CAAC;AAE/C,cAAc;AACd,OAAO,mBAAmB,CAAC;AAC3B,mFAAmF;AACnF,OAAO,wCAAwC,CAAC;AAChD,OAAO,uCAAuC,CAAC;AAE/C,iBAAiB;AACjB,OAAO,sBAAsB,CAAC","sourcesContent":["import './types.js';\nimport './ontologies/lincd-server.register.js';\n\n//SHAPES FIRST\nimport './shapes/index.js';\n// Not shapes (plain store classes); kept so the entry's module graph is unchanged.\nimport './shapes/quadstores/BackendAPIStore.js';\nimport './shapes/filestores/LocalFileStore.js';\n\n//THEN COMPONENTS\nimport './utils/accessUrl.js';\n\n//TYPES — re-exported from @_linked/server-utils (canonical location)\nexport type {\n  RouteConfig,\n  RoutesConfig,\n  RoutesModule,\n} from '@_linked/server-utils/types/RouteConfig';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,CAAC;AACpB,OAAO,uCAAuC,CAAC;AAE/C,cAAc;AACd,OAAO,mBAAmB,CAAC;AAC3B,mFAAmF;AACnF,OAAO,wCAAwC,CAAC;AAChD,OAAO,uCAAuC,CAAC;AAE/C,iBAAiB;AACjB,OAAO,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC","sourcesContent":["import './types.js';\nimport './ontologies/lincd-server.register.js';\n\n//SHAPES FIRST\nimport './shapes/index.js';\n// Not shapes (plain store classes); kept so the entry's module graph is unchanged.\nimport './shapes/quadstores/BackendAPIStore.js';\nimport './shapes/filestores/LocalFileStore.js';\n\n//THEN COMPONENTS\nimport './utils/accessUrl.js';\n\n// The fatal-error contract a provider uses to refuse to let the server start.\nexport { FatalStartupError, isFatalError } from './utils/fatalError.js';\nexport type { FatalError } from './utils/fatalError.js';\n\n//TYPES — re-exported from @_linked/server-utils (canonical location)\nexport type {\n  RouteConfig,\n  RoutesConfig,\n  RoutesModule,\n} from '@_linked/server-utils/types/RouteConfig';\n"]}

package/lib/esm/ontologies/lincd-server.d.ts

@@ -20,6 +20,18 @@ export declare var loadData: () => Promise<{
         "rdfs:label": string;
     }[];
 }>;
+/**
+ * The namespace of this ontology.
+ *
+ * First-party ontologies live on linked.cm: `https://linked.cm/ont/{ontologySlug}/`, and a
+ * package's own ontology takes the package's publicSlug (`@_linked/server` → `server`), the same
+ * slug its shapes use under `https://linked.cm/shape/server/`.
+ *
+ * Until this release it was `http://lincd.org/ont/lincd-server/`. No stored data is typed with
+ * these terms; the only store triples that carried them were the synced shape descriptions of
+ * `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`), which boot sync
+ * rewrites (delete, then recreate) the next time the server starts.
+ */
 export declare var ns: (term: string) => import("@_linked/core/utils/NodeReference").NodeReferenceValue;
 export declare var _self: import("@_linked/core/utils/NodeReference").NodeReferenceValue;
 export declare const lincdServer: {

package/lib/esm/ontologies/lincd-server.js

@@ -10,7 +10,19 @@ export var loadData = async () => {
     });
     return data.default || data;
 };
-export var ns = createNameSpace('http://lincd.org/ont/lincd-server/');
+/**
+ * The namespace of this ontology.
+ *
+ * First-party ontologies live on linked.cm: `https://linked.cm/ont/{ontologySlug}/`, and a
+ * package's own ontology takes the package's publicSlug (`@_linked/server` → `server`), the same
+ * slug its shapes use under `https://linked.cm/shape/server/`.
+ *
+ * Until this release it was `http://lincd.org/ont/lincd-server/`. No stored data is typed with
+ * these terms; the only store triples that carried them were the synced shape descriptions of
+ * `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`), which boot sync
+ * rewrites (delete, then recreate) the next time the server starts.
+ */
+export var ns = createNameSpace('https://linked.cm/ont/server/');
 export var _self = ns('');
 // Terms are properties of the namespace object below, not module-scope
 // exports. Most of these names are also SHAPE CLASS names in this package

package/lib/esm/ontologies/lincd-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"lincd-server.js","sourceRoot":"","sources":["../../../src/ontologies/lincd-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,IAAI,QAAQ,GAAG,KAAK,IAAI,EAAE;IAC/B,YAAY;IACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,2BAA2B,EAAE;QACrD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,oCAAoC,CAAC,CAAC;AAEtE,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE1B,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,eAAe;IACf,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,QAAQ;IACR,MAAM;CACP,CAAC","sourcesContent":["import { createNameSpace } from '@_linked/core/utils/NameSpace';\n\n/**\n * Load the data of this ontology.\n * In @_linked/core, loadData returns the raw JSON import — no JSONLD.parse() needed.\n */\nexport var loadData = async () => {\n  //@ts-ignore\n  const data = await import('../data/lincd-server.json', {\n    with: { type: 'json' },\n  });\n  return data.default || data;\n};\n\nexport var ns = createNameSpace('http://lincd.org/ont/lincd-server/');\n\nexport var _self = ns('');\n\n// Terms are properties of the namespace object below, not module-scope\n// exports. Most of these names are also SHAPE CLASS names in this package\n// (BackendAPIStore, LincdWebApp, LincdAPI, ...). Two bindings of the same name\n// in one bundle scope make the bundler rename one of them, and when the loser\n// is the class, `constructor.name` becomes `BackendAPIStore2` -- which is the\n// shape's IRI and the name `Server.call` routes on. The client then asks a\n// backend that has no such shape, and every store round-trip answers 501.\nconst LincdServer = ns('LincdServer');\nconst BackendFileStore = ns('BackendFileStore');\nconst NodeFileStore = ns('NodeFileStore');\nconst BackendStore = ns('BackendStore');\nconst BackendAPIStore = ns('BackendAPIStore');\nconst LincdWebApp = ns('LincdWebApp');\nconst ownPackage = ns('ownPackage');\nconst maintainsPackage = ns('maintainsPackage');\nconst N3FileStore = ns('N3FileStore');\nconst LincdAPI = ns('LincdAPI');\nconst hasAPI = ns('hasAPI');\n\nexport const lincdServer = {\n  LincdServer,\n  BackendFileStore,\n  NodeFileStore,\n  BackendStore,\n  N3FileStore,\n  BackendAPIStore,\n  LincdWebApp,\n  ownPackage,\n  maintainsPackage,\n  LincdAPI,\n  hasAPI,\n};\n\n"]}
+{"version":3,"file":"lincd-server.js","sourceRoot":"","sources":["../../../src/ontologies/lincd-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,IAAI,QAAQ,GAAG,KAAK,IAAI,EAAE;IAC/B,YAAY;IACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,2BAA2B,EAAE;QACrD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEjE,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE1B,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,eAAe;IACf,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,QAAQ;IACR,MAAM;CACP,CAAC","sourcesContent":["import { createNameSpace } from '@_linked/core/utils/NameSpace';\n\n/**\n * Load the data of this ontology.\n * In @_linked/core, loadData returns the raw JSON import — no JSONLD.parse() needed.\n */\nexport var loadData = async () => {\n  //@ts-ignore\n  const data = await import('../data/lincd-server.json', {\n    with: { type: 'json' },\n  });\n  return data.default || data;\n};\n\n/**\n * The namespace of this ontology.\n *\n * First-party ontologies live on linked.cm: `https://linked.cm/ont/{ontologySlug}/`, and a\n * package's own ontology takes the package's publicSlug (`@_linked/server` → `server`), the same\n * slug its shapes use under `https://linked.cm/shape/server/`.\n *\n * Until this release it was `http://lincd.org/ont/lincd-server/`. No stored data is typed with\n * these terms; the only store triples that carried them were the synced shape descriptions of\n * `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`), which boot sync\n * rewrites (delete, then recreate) the next time the server starts.\n */\nexport var ns = createNameSpace('https://linked.cm/ont/server/');\n\nexport var _self = ns('');\n\n// Terms are properties of the namespace object below, not module-scope\n// exports. Most of these names are also SHAPE CLASS names in this package\n// (BackendAPIStore, LincdWebApp, LincdAPI, ...). Two bindings of the same name\n// in one bundle scope make the bundler rename one of them, and when the loser\n// is the class, `constructor.name` becomes `BackendAPIStore2` -- which is the\n// shape's IRI and the name `Server.call` routes on. The client then asks a\n// backend that has no such shape, and every store round-trip answers 501.\nconst LincdServer = ns('LincdServer');\nconst BackendFileStore = ns('BackendFileStore');\nconst NodeFileStore = ns('NodeFileStore');\nconst BackendStore = ns('BackendStore');\nconst BackendAPIStore = ns('BackendAPIStore');\nconst LincdWebApp = ns('LincdWebApp');\nconst ownPackage = ns('ownPackage');\nconst maintainsPackage = ns('maintainsPackage');\nconst N3FileStore = ns('N3FileStore');\nconst LincdAPI = ns('LincdAPI');\nconst hasAPI = ns('hasAPI');\n\nexport const lincdServer = {\n  LincdServer,\n  BackendFileStore,\n  NodeFileStore,\n  BackendStore,\n  N3FileStore,\n  BackendAPIStore,\n  LincdWebApp,\n  ownPackage,\n  maintainsPackage,\n  LincdAPI,\n  hasAPI,\n};\n\n"]}

package/lib/esm/shapes/LinkedServer.d.ts

@@ -51,6 +51,12 @@ export declare class LinkedServer extends Shape {
     private warnedDuplicateInstalls;
     private resizePathsMap;
     private api;
+    /**
+     * True while start() / initOnly() runs. A fatal provider error (see
+     * utils/fatalError) thrown while booting stops the boot; after it, the same
+     * error is logged and contained.
+     */
+    protected booting: boolean;
     /**
      * yarn linked start sends the contents of linked.config.js as an object to this constructor
      * @param n
@@ -61,6 +67,7 @@ export declare class LinkedServer extends Shape {
     get app(): ExpressServer;
     initPackage(): void;
     initOnly(): Promise<this>;
+    private initOnlyBoot;
     /**
      * Materialize this server's registered shapes into the RDF store as SHACL
      * (core `syncShapes` → pure `sh:NodeShape` + property shapes), so a running
@@ -79,7 +86,32 @@ export declare class LinkedServer extends Shape {
      * config.
      */
     private materializeShapesIntoStore;
+    /**
+     * Boot the server and listen. Rejects — and makes the process exit non-zero —
+     * when a provider throws a fatal error while booting (see utils/fatalError).
+     */
     start(): Promise<this>;
+    /**
+     * Run a boot with `booting` set. A fatal provider error rejects it and hands
+     * the error to exitAfterFatalStartupError; any other boot error rejects as it
+     * always did.
+     */
+    private bootOrRefuse;
+    /**
+     * Make sure a server that refused to start does not stay up as a process.
+     *
+     * start() rejects either way, so the caller can report the error. But a
+     * rejected start() does not end the process on its own: the CLI's `linked
+     * start` turns an unhandled rejection into a log line, and the Vite dev
+     * server, a store connection or a provider's timer keeps the event loop
+     * alive. So the exit code is set now — a process with nothing left running
+     * exits 1 — and, as a backstop, the process is exited after a moment, on an
+     * unref'd timer that never itself keeps the process alive.
+     *
+     * Override to embed the server somewhere that must not exit (tests).
+     */
+    protected exitAfterFatalStartupError(_err: unknown): void;
+    private startBoot;
     initOntologies(): Promise<void>;
     /**
      *

package/lib/esm/shapes/LinkedServer.js

@@ -37,6 +37,7 @@ import { autoLoadOntologyData } from '@_linked/core/utils/Package';
 import { getShapeClass, getSuperShapesClasses, } from '@_linked/core/utils/ShapeClass';
 import path from 'path';
 import { pathToFileURL } from 'node:url';
+import { isFatalError } from '../utils/fatalError.js';
 import { discoverLinkedDependencies, isBundledBySsr, NODE_IMPORT_CONDITIONS, readInstalledPackage, resolveBackendEntry, ssrNoExternalOf, } from '../utils/linkedDependencies.js';
 /**
  * `instanceof ShapeProvider`, tolerating a second copy of server-utils.
@@ -63,16 +64,38 @@ function isShapeProvider(provider) {
  * for hooks that run for every provider (boot lifecycle hooks and per-request
  * hooks), where one provider's bug must not take down boot or every request
  * without saying which provider it was.
+ *
+ * The exception is a fatal error (see utils/fatalError): with `atBoot` it is
+ * logged and re-thrown, so the server refuses to start. Without it — the
+ * server is already serving — it is logged as fatal and contained like any
+ * other error: one provider must not take a running server down.
  */
-async function runProviderHook(pkg, hook, call) {
+async function runProviderHook(pkg, hook, call, atBoot = false) {
     var _a;
     try {
         await call();
     }
     catch (err) {
+        if (isFatalError(err)) {
+            logFatalError(pkg, hook, err, atBoot);
+            if (atBoot)
+                throw err;
+            return;
+        }
         console.error(paint('red', `[linked] ${pkg} ${hook} failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`), (err === null || err === void 0 ? void 0 : err.stack) ? `\n${err.stack}` : '');
     }
 }
+/** Log a fatal error once, at the point it was thrown (see runProviderHook). */
+function logFatalError(pkg, hook, err, atBoot) {
+    var _a, _b;
+    if (loggedFatalErrors.has(err))
+        return;
+    loggedFatalErrors.add(err);
+    console.error(paint('red', atBoot
+        ? `[linked] ${pkg} ${hook}: fatal error, refusing to start: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`
+        : `[linked] ${pkg} ${hook}: fatal error after start, server keeps running: ${(_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : err}`), (err === null || err === void 0 ? void 0 : err.stack) ? `\n${err.stack}` : '');
+}
+const loggedFatalErrors = new WeakSet();
 import process from 'process';
 import * as React from 'react';
 import { renderToPipeableStream, renderToStaticMarkup } from 'react-dom/server';
@@ -178,6 +201,12 @@ let LinkedServer = class LinkedServer extends Shape {
         this.warnedDuplicateInstalls = new Set();
         //from resizedFileName to full resized path (CDN or similar)
         this.resizePathsMap = new Map();
+        /**
+         * True while start() / initOnly() runs. A fatal provider error (see
+         * utils/fatalError) thrown while booting stops the boot; after it, the same
+         * error is logged and contained.
+         */
+        this.booting = false;
         if (config && typeof config !== 'string' && !('id' in config)) {
             // The absence of `id` is the runtime discriminator for a LinkedConfig;
             // the widened `{id?: string}` member of the union keeps TS from narrowing
@@ -232,6 +261,9 @@ let LinkedServer = class LinkedServer extends Shape {
         this.package = JSON.parse(fsNative.readFileSync(path.resolve(process.cwd(), 'package.json'), 'utf-8'));
     }
     async initOnly() {
+        return this.bootOrRefuse(() => this.initOnlyBoot());
+    }
+    async initOnlyBoot() {
         await this.initOntologies();
         await this.initStores();
         this.initPackage();
@@ -290,7 +322,50 @@ let LinkedServer = class LinkedServer extends Shape {
     //     return nodeURI.includes(store.namedNode.uri)
     //   })
     // }
+    /**
+     * Boot the server and listen. Rejects — and makes the process exit non-zero —
+     * when a provider throws a fatal error while booting (see utils/fatalError).
+     */
     async start() {
+        return this.bootOrRefuse(() => this.startBoot());
+    }
+    /**
+     * Run a boot with `booting` set. A fatal provider error rejects it and hands
+     * the error to exitAfterFatalStartupError; any other boot error rejects as it
+     * always did.
+     */
+    async bootOrRefuse(boot) {
+        this.booting = true;
+        try {
+            return await boot();
+        }
+        catch (err) {
+            if (isFatalError(err))
+                this.exitAfterFatalStartupError(err);
+            throw err;
+        }
+        finally {
+            this.booting = false;
+        }
+    }
+    /**
+     * Make sure a server that refused to start does not stay up as a process.
+     *
+     * start() rejects either way, so the caller can report the error. But a
+     * rejected start() does not end the process on its own: the CLI's `linked
+     * start` turns an unhandled rejection into a log line, and the Vite dev
+     * server, a store connection or a provider's timer keeps the event loop
+     * alive. So the exit code is set now — a process with nothing left running
+     * exits 1 — and, as a backstop, the process is exited after a moment, on an
+     * unref'd timer that never itself keeps the process alive.
+     *
+     * Override to embed the server somewhere that must not exit (tests).
+     */
+    exitAfterFatalStartupError(_err) {
+        process.exitCode = 1;
+        setTimeout(() => process.exit(1), 1000).unref();
+    }
+    async startBoot() {
         var _a, _b, _c, _d;
         this.initPackage();
         // Static assets should come from the static store URL (versioned path),
@@ -563,7 +638,7 @@ let LinkedServer = class LinkedServer extends Shape {
             if (!genericProvider || typeof genericProvider[method] !== 'function') {
                 continue;
             }
-            await runProviderHook(pkg, method, () => genericProvider[method](...args));
+            await runProviderHook(pkg, method, () => genericProvider[method](...args), this.booting);
         }
     }
     /**
@@ -627,6 +702,9 @@ let LinkedServer = class LinkedServer extends Shape {
             });
         }
         catch (err) {
+            // Already logged where it was thrown; it must reach start().
+            if (isFatalError(err))
+                throw err;
             console.warn(err);
         }
     }
@@ -1053,6 +1131,12 @@ let LinkedServer = class LinkedServer extends Shape {
             // console.log(`✅ Successfully loaded: ${pkg}`);
         }
         catch (e) {
+            if (isFatalError(e)) {
+                logFatalError(pkg, 'module load', e, this.booting);
+                if (this.booting)
+                    throw e;
+                return;
+            }
             let providerNotFound = e.code === 'MODULE_NOT_FOUND' &&
                 e.message.indexOf(`Cannot find package '${pkg}'`) !== -1;
             if (providerNotFound) {
@@ -1168,7 +1252,7 @@ let LinkedServer = class LinkedServer extends Shape {
             await runProviderHook(pkg, `backend ${entry}`, async () => {
                 backendProviderExports = await load();
                 loaded = true;
-            });
+            }, this.booting);
             if (loaded) {
                 for (const key of Object.keys(backendProviderExports)) {
                     const providerClass = backendProviderExports[key];
@@ -1177,7 +1261,7 @@ let LinkedServer = class LinkedServer extends Shape {
                     //TODO: do not create an instance, just save the class and instantiate it when needed
                     await runProviderHook(pkg, `${key} constructor`, () => {
                         provider = new providerClass(this.server, this);
-                    });
+                    }, this.booting);
                     if (!provider)
                         continue;
                     if (isShapeProvider(provider)) {