@_linked/server 2.19.0 → 2.21.0

package/lib/esm/shapes/LincdAPI.js

@@ -6,12 +6,22 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { Shape } from '@_linked/core/shapes/Shape';
 import { linkedShape } from '../package.js';
-import { lincdServer } from '../ontologies/lincd-server.js';
+import { server } from '../ontologies/server.js';
 import { JSONParser } from '@_linked/server-utils/utils/JSONParser';
 import { LinkedStorage } from '@_linked/core/utils/LinkedStorage';
 import { JSONWriter } from '@_linked/server-utils/utils/JSONWriter';
 import { cached } from '@_linked/core/utils/cached';
 import { getShapeIndex } from '../utils/Shapes.js';
+import { authorizeGenericQuery, authorizeRawQuery, toQueryBuilder, } from '../utils/queryPlane.js';
+import { getRpcExposureMode } from '../utils/rpcExposure.js';
+/** An error carrying an HTTP status, such as a `ServerCallError` (401/403). */
+function isStatusError(error) {
+    return (!!error &&
+        typeof error.status === 'number' &&
+        error.status >= 400 &&
+        error.status < 600 &&
+        error.name === 'ServerCallError');
+}
 const cacheTime = process.env.NODE_ENV === 'development' ? 0 : Infinity;
 // Named explicitly: tsc emits `let X = class X`, and any later esbuild pass over that JS (Vite's
 // SSR `define` replacement runs one on every file mentioning a defined `process.env.*`) renames
@@ -19,13 +29,17 @@ const cacheTime = process.env.NODE_ENV === 'development' ? 0 : Infinity;
 let LincdAPI = class LincdAPI extends Shape {
     async process(request, response, httpMethod) {
         let { method, action } = request.params;
-        const body = JSONParser.parseObject(request.body);
+        const body = JSONParser.parseObject(request.body, {
+            shapeClasses: getRpcExposureMode() === 'enforce' ? 'reject' : 'warn',
+        });
         //replace - with _ in action names
         let localMethod = httpMethod + '_' + method.replace(/-/g, '_');
         if (typeof this[localMethod] !== 'function') {
             throw new Error('Unknown method: ' + localMethod);
         }
-        //TODO: access rights, check if the current user is allowed to execute this method
+        // The query routes (`post_*`) check access themselves, through
+        // utils/queryPlane. The `get_*` routes describe shapes and stay reachable:
+        // apps read each other's `/api/all-shapes` server to server.
         try {
             const result = await this[localMethod](body, request, response);
             if (typeof result !== 'undefined' || !response.headersSent) {
@@ -34,6 +48,10 @@ let LincdAPI = class LincdAPI extends Shape {
             }
         }
         catch (error) {
+            if (!response.headersSent && isStatusError(error)) {
+                response.status(error.status).json({ error: error.message });
+                return;
+            }
             console.error(`Error while processing ${localMethod}:`, error);
             if (!response.headersSent) {
                 const message = error instanceof Error ? error.message : 'Unknown server error';
@@ -86,19 +104,30 @@ let LincdAPI = class LincdAPI extends Shape {
             };
         }, [], cacheTime);
     }
-    post_select({ query }) {
-        return LinkedStorage.selectQuery(query);
+    async post_select({ query }) {
+        const builder = toQueryBuilder(query);
+        await authorizeGenericQuery('select', query, builder, 'api/select');
+        return LinkedStorage.selectQuery(builder);
     }
-    post_create({ query }) {
-        return LinkedStorage.createQuery(query);
+    async post_create({ query }) {
+        const builder = toQueryBuilder(query);
+        await authorizeGenericQuery('create', query, builder, 'api/create');
+        return LinkedStorage.createQuery(builder);
     }
-    post_update({ query }) {
-        return LinkedStorage.updateQuery(query);
+    async post_update({ query }) {
+        const builder = toQueryBuilder(query);
+        await authorizeGenericQuery('update', query, builder, 'api/update');
+        return LinkedStorage.updateQuery(builder);
     }
-    post_delete({ query }) {
-        return LinkedStorage.deleteQuery(query);
+    async post_delete({ query }) {
+        const builder = toQueryBuilder(query);
+        await authorizeGenericQuery('delete', query, builder, 'api/delete');
+        return LinkedStorage.deleteQuery(builder);
     }
-    post_select_raw({ query }) {
+    async post_select_raw({ query }) {
+        // A raw SPARQL string cannot be analysed for the shapes it touches: it is
+        // refused unless the app registers a raw query authorizer.
+        await authorizeRawQuery(query, 'api/select-raw');
         this.checkRawQuerySupport();
         return LinkedStorage.getDefaultDataset().rawQuery(query);
     }
@@ -109,7 +138,7 @@ let LincdAPI = class LincdAPI extends Shape {
         }
     }
 };
-LincdAPI.targetClass = lincdServer.LincdAPI;
+LincdAPI.targetClass = server.LincdAPI;
 LincdAPI = __decorate([
     linkedShape({ name: 'LincdAPI' })
 ], LincdAPI);

package/lib/esm/shapes/LincdAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"LincdAPI.js","sourceRoot":"","sources":["../../../src/shapes/LincdAPI.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,aAAa,EAAgB,MAAM,oBAAoB,CAAC;AAGjE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AASxE,iGAAiG;AACjG,gGAAgG;AAChG,4EAA4E;AAErE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,KAAK;IAGjC,KAAK,CAAC,OAAO,CACX,OAAO,EACP,QAAQ,EACR,UAA6C;QAE7C,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvD,kCAAkC;QAClC,IAAI,WAAW,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0BAA0B,WAAW,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;gBAClE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,EAChB,MAAM,GAGP;QACC,OAAO,MAAM,CACX,GAAG,EAAE;YACH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,kBAAkB,GAAG,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;gBAC7B,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxB,kBAAkB,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC5B,CAAC,EACD,CAAC,MAAM,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;QAIZ,OAAO,MAAM,CACX,KAAK,IAAI,EAAE;;YACT,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;YAEnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;YACrD,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,MAAO,aAAa,CAAC,iBAAiB,EAA6B;iBAChE,QAAQ,CACP,wEAAwE,CACzE;iBACA,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,0EAA0E;gBAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC;oBAAE,OAAO;gBAChD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC3C,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACvC,kBAAkB,CAAC,GAAG,CACpB,OAAO,CAAC,IAAI,CAAC,KAAK,EAClB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAC9B,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAExB,MAAM,mBAAmB,GAAiC,EAAE,CAAC;YAC7D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAClC,mBAAmB,CAAC,OAAO,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAA,KAAK,CAAC,WAAW,0CAAE,EAAE,CAAC,IAAI,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;aACpC,CAAC;QACJ,CAAC,EACD,EAAE,EACF,SAAS,CACV,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,EAAE,KAAK,EAAE;QACnB,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,WAAW,CAAC,EAAE,KAAK,EAAE;QACnB,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,WAAW,CAAC,EAAE,KAAK,EAAE;QACnB,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,WAAW,CAAC,EAAE,KAAK,EAAE;QACnB,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED,eAAe,CAAC,EAAE,KAAK,EAAE;QACvB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,OAAQ,aAAa,CAAC,iBAAiB,EAA6B,CAAC,QAAQ,CAC3E,KAAK,CACN,CAAC;IACJ,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAE,aAAa,CAAC,iBAAiB,EAA6B,CAAC,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,kBACE,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,WAAW;iBACjE,IACL,uCAAuC,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;;AAjIM,oBAAW,GAAG,WAAW,CAAC,QAAQ,AAAvB,CAAwB;AAD/B,QAAQ;IADpB,WAAW,CAAC,EAAC,IAAI,EAAE,UAAU,EAAC,CAAC;GACnB,QAAQ,CAmIpB","sourcesContent":["import { Shape } from '@_linked/core/shapes/Shape';\nimport { linkedShape } from '../package.js';\nimport { lincdServer } from '../ontologies/lincd-server.js';\nimport { JSONParser } from '@_linked/server-utils/utils/JSONParser';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { JSONWriter } from '@_linked/server-utils/utils/JSONWriter';\nimport { cached } from '@_linked/core/utils/cached';\nimport { getShapeIndex, ShapeDetails } from '../utils/Shapes.js';\nimport { SparqlDataset as SPARQLStore } from '@_linked/core/sparql/SparqlDataset';\n\nconst cacheTime = process.env.NODE_ENV === 'development' ? 0 : Infinity;\nexport type ShapeSummary = {\n  id: string;\n  label: string;\n  description: string;\n  target: { id: string };\n  extends?: { id: string };\n  numInstances: number;\n};\n// Named explicitly: tsc emits `let X = class X`, and any later esbuild pass over that JS (Vite's\n// SSR `define` replacement runs one on every file mentioning a defined `process.env.*`) renames\n// the inner binding to `X2`, which would otherwise become this shape's IRI.\n@linkedShape({name: 'LincdAPI'})\nexport class LincdAPI extends Shape {\n  static targetClass = lincdServer.LincdAPI;\n\n  async process(\n    request,\n    response,\n    httpMethod: 'get' | 'post' | 'put' | 'delete'\n  ) {\n    let { method, action } = request.params;\n    const body = JSONParser.parseObject<any>(request.body);\n\n    //replace - with _ in action names\n    let localMethod = httpMethod + '_' + method.replace(/-/g, '_');\n    if (typeof this[localMethod] !== 'function') {\n      throw new Error('Unknown method: ' + localMethod);\n    }\n\n    //TODO: access rights, check if the current user is allowed to execute this method\n    try {\n      const result = await this[localMethod](body, request, response);\n      if (typeof result !== 'undefined' || !response.headersSent) {\n        const jsonObject = JSONWriter.toJsObject(result);\n        response.json(jsonObject);\n      }\n    } catch (error) {\n      console.error(`Error while processing ${localMethod}:`, error);\n      if (!response.headersSent) {\n        const message =\n          error instanceof Error ? error.message : 'Unknown server error';\n        response.status(500).json({ error: message });\n      }\n    }\n  }\n\n  get_shape_details({\n    shapes,\n  }: {\n    shapes: string[];\n  }): Record<string, ShapeDetails> {\n    return cached(\n      () => {\n        const shapeIndex = getShapeIndex();\n        const filteredShapeIndex = {};\n        for (const shapeId of shapes) {\n          if (shapeIndex[shapeId]) {\n            filteredShapeIndex[shapeId] = shapeIndex[shapeId];\n          }\n        }\n        return filteredShapeIndex;\n      },\n      [shapes],\n      cacheTime\n    );\n  }\n\n  get_all_shapes(): Promise<{\n    shapes: Record<string, ShapeDetails>;\n    defaultGraph: string;\n  }> {\n    return cached(\n      async () => {\n        const shapeIndex = getShapeIndex();\n\n        const typesWithInstances = new Map<string, number>();\n        this.checkRawQuerySupport();\n        await (LinkedStorage.getDefaultDataset() as unknown as SPARQLStore)\n          .rawQuery(\n            `SELECT (COUNT(?s) AS ?count) ?type WHERE { ?s a ?type } GROUP BY ?type`\n          )\n          .then((results) => {\n            // rawQuery also types ASK results (a boolean envelope); this is a SELECT.\n            if (!results || !('results' in results)) return;\n            results.results.bindings.forEach((binding) => {\n              if (binding.type && binding.type.value) {\n                typesWithInstances.set(\n                  binding.type.value,\n                  parseInt(binding.count.value)\n                );\n              }\n            });\n          })\n          .catch(console.error);\n\n        const shapesWithInstances: Record<string, ShapeDetails> = {};\n        for (const shapeId in shapeIndex) {\n          const shape = shapeIndex[shapeId];\n          shapesWithInstances[shapeId] = {\n            ...shape,\n            numInstances: typesWithInstances.get(shape.targetClass?.id) || 0,\n          };\n        }\n        return {\n          shapes: shapesWithInstances,\n          defaultGraph: process.env.DATA_ROOT,\n        };\n      },\n      [],\n      cacheTime\n    );\n  }\n\n  post_select({ query }) {\n    return LinkedStorage.selectQuery(query);\n  }\n  post_create({ query }) {\n    return LinkedStorage.createQuery(query);\n  }\n  post_update({ query }) {\n    return LinkedStorage.updateQuery(query);\n  }\n  post_delete({ query }) {\n    return LinkedStorage.deleteQuery(query);\n  }\n\n  post_select_raw({ query }) {\n    this.checkRawQuerySupport();\n    return (LinkedStorage.getDefaultDataset() as unknown as SPARQLStore).rawQuery(\n      query\n    );\n  }\n\n  private checkRawQuerySupport() {\n    if (!(LinkedStorage.getDefaultDataset() as unknown as SPARQLStore).rawQuery) {\n      throw new Error(\n        `Default store (${\n          Object.getPrototypeOf(LinkedStorage.getDefaultDataset()).constructor\n            .name\n        }) does not support raw SPARQL queries`\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"LincdAPI.js","sourceRoot":"","sources":["../../../src/shapes/LincdAPI.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,aAAa,EAAgB,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,+EAA+E;AAC/E,SAAS,aAAa,CAAC,KAAU;IAC/B,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,IAAI,KAAK,iBAAiB,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AASxE,iGAAiG;AACjG,gGAAgG;AAChG,4EAA4E;AAErE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,KAAK;IAGjC,KAAK,CAAC,OAAO,CACX,OAAO,EACP,QAAQ,EACR,UAA6C;QAE7C,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAM,OAAO,CAAC,IAAI,EAAE;YACrD,YAAY,EAAE,kBAAkB,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;SACrE,CAAC,CAAC;QAEH,kCAAkC;QAClC,IAAI,WAAW,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,+DAA+D;QAC/D,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACjD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,0BAA0B,WAAW,GAAG,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC;gBAClE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,EAChB,MAAM,GAGP;QACC,OAAO,MAAM,CACX,GAAG,EAAE;YACH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,kBAAkB,GAAG,EAAE,CAAC;YAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;gBAC7B,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxB,kBAAkB,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC5B,CAAC,EACD,CAAC,MAAM,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;QAIZ,OAAO,MAAM,CACX,KAAK,IAAI,EAAE;;YACT,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;YAEnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;YACrD,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,MAAO,aAAa,CAAC,iBAAiB,EAA6B;iBAChE,QAAQ,CACP,wEAAwE,CACzE;iBACA,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,0EAA0E;gBAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC;oBAAE,OAAO;gBAChD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;oBAC3C,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACvC,kBAAkB,CAAC,GAAG,CACpB,OAAO,CAAC,IAAI,CAAC,KAAK,EAClB,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAC9B,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAExB,MAAM,mBAAmB,GAAiC,EAAE,CAAC;YAC7D,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;gBAClC,mBAAmB,CAAC,OAAO,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAA,KAAK,CAAC,WAAW,0CAAE,EAAE,CAAC,IAAI,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;aACpC,CAAC;QACJ,CAAC,EACD,EAAE,EACF,SAAS,CACV,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACpE,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACpE,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACpE,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACpE,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE;QAC7B,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,OAAQ,aAAa,CAAC,iBAAiB,EAA6B,CAAC,QAAQ,CAC3E,KAAK,CACN,CAAC;IACJ,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAE,aAAa,CAAC,iBAAiB,EAA6B,CAAC,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,kBACE,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,WAAW;iBACjE,IACL,uCAAuC,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;;AApJM,oBAAW,GAAG,MAAM,CAAC,QAAQ,AAAlB,CAAmB;AAD1B,QAAQ;IADpB,WAAW,CAAC,EAAC,IAAI,EAAE,UAAU,EAAC,CAAC;GACnB,QAAQ,CAsJpB","sourcesContent":["import { Shape } from '@_linked/core/shapes/Shape';\nimport { linkedShape } from '../package.js';\nimport { server } from '../ontologies/server.js';\nimport { JSONParser } from '@_linked/server-utils/utils/JSONParser';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { JSONWriter } from '@_linked/server-utils/utils/JSONWriter';\nimport { cached } from '@_linked/core/utils/cached';\nimport { getShapeIndex, ShapeDetails } from '../utils/Shapes.js';\nimport { SparqlDataset as SPARQLStore } from '@_linked/core/sparql/SparqlDataset';\nimport {\n  authorizeGenericQuery,\n  authorizeRawQuery,\n  toQueryBuilder,\n} from '../utils/queryPlane.js';\nimport { getRpcExposureMode } from '../utils/rpcExposure.js';\n\n/** An error carrying an HTTP status, such as a `ServerCallError` (401/403). */\nfunction isStatusError(error: any): error is { status: number; message: string } {\n  return (\n    !!error &&\n    typeof error.status === 'number' &&\n    error.status >= 400 &&\n    error.status < 600 &&\n    error.name === 'ServerCallError'\n  );\n}\n\nconst cacheTime = process.env.NODE_ENV === 'development' ? 0 : Infinity;\nexport type ShapeSummary = {\n  id: string;\n  label: string;\n  description: string;\n  target: { id: string };\n  extends?: { id: string };\n  numInstances: number;\n};\n// Named explicitly: tsc emits `let X = class X`, and any later esbuild pass over that JS (Vite's\n// SSR `define` replacement runs one on every file mentioning a defined `process.env.*`) renames\n// the inner binding to `X2`, which would otherwise become this shape's IRI.\n@linkedShape({name: 'LincdAPI'})\nexport class LincdAPI extends Shape {\n  static targetClass = server.LincdAPI;\n\n  async process(\n    request,\n    response,\n    httpMethod: 'get' | 'post' | 'put' | 'delete'\n  ) {\n    let { method, action } = request.params;\n    const body = JSONParser.parseObject<any>(request.body, {\n      shapeClasses: getRpcExposureMode() === 'enforce' ? 'reject' : 'warn',\n    });\n\n    //replace - with _ in action names\n    let localMethod = httpMethod + '_' + method.replace(/-/g, '_');\n    if (typeof this[localMethod] !== 'function') {\n      throw new Error('Unknown method: ' + localMethod);\n    }\n\n    // The query routes (`post_*`) check access themselves, through\n    // utils/queryPlane. The `get_*` routes describe shapes and stay reachable:\n    // apps read each other's `/api/all-shapes` server to server.\n    try {\n      const result = await this[localMethod](body, request, response);\n      if (typeof result !== 'undefined' || !response.headersSent) {\n        const jsonObject = JSONWriter.toJsObject(result);\n        response.json(jsonObject);\n      }\n    } catch (error) {\n      if (!response.headersSent && isStatusError(error)) {\n        response.status(error.status).json({ error: error.message });\n        return;\n      }\n      console.error(`Error while processing ${localMethod}:`, error);\n      if (!response.headersSent) {\n        const message =\n          error instanceof Error ? error.message : 'Unknown server error';\n        response.status(500).json({ error: message });\n      }\n    }\n  }\n\n  get_shape_details({\n    shapes,\n  }: {\n    shapes: string[];\n  }): Record<string, ShapeDetails> {\n    return cached(\n      () => {\n        const shapeIndex = getShapeIndex();\n        const filteredShapeIndex = {};\n        for (const shapeId of shapes) {\n          if (shapeIndex[shapeId]) {\n            filteredShapeIndex[shapeId] = shapeIndex[shapeId];\n          }\n        }\n        return filteredShapeIndex;\n      },\n      [shapes],\n      cacheTime\n    );\n  }\n\n  get_all_shapes(): Promise<{\n    shapes: Record<string, ShapeDetails>;\n    defaultGraph: string;\n  }> {\n    return cached(\n      async () => {\n        const shapeIndex = getShapeIndex();\n\n        const typesWithInstances = new Map<string, number>();\n        this.checkRawQuerySupport();\n        await (LinkedStorage.getDefaultDataset() as unknown as SPARQLStore)\n          .rawQuery(\n            `SELECT (COUNT(?s) AS ?count) ?type WHERE { ?s a ?type } GROUP BY ?type`\n          )\n          .then((results) => {\n            // rawQuery also types ASK results (a boolean envelope); this is a SELECT.\n            if (!results || !('results' in results)) return;\n            results.results.bindings.forEach((binding) => {\n              if (binding.type && binding.type.value) {\n                typesWithInstances.set(\n                  binding.type.value,\n                  parseInt(binding.count.value)\n                );\n              }\n            });\n          })\n          .catch(console.error);\n\n        const shapesWithInstances: Record<string, ShapeDetails> = {};\n        for (const shapeId in shapeIndex) {\n          const shape = shapeIndex[shapeId];\n          shapesWithInstances[shapeId] = {\n            ...shape,\n            numInstances: typesWithInstances.get(shape.targetClass?.id) || 0,\n          };\n        }\n        return {\n          shapes: shapesWithInstances,\n          defaultGraph: process.env.DATA_ROOT,\n        };\n      },\n      [],\n      cacheTime\n    );\n  }\n\n  async post_select({ query }) {\n    const builder = toQueryBuilder(query);\n    await authorizeGenericQuery('select', query, builder, 'api/select');\n    return LinkedStorage.selectQuery(builder);\n  }\n  async post_create({ query }) {\n    const builder = toQueryBuilder(query);\n    await authorizeGenericQuery('create', query, builder, 'api/create');\n    return LinkedStorage.createQuery(builder);\n  }\n  async post_update({ query }) {\n    const builder = toQueryBuilder(query);\n    await authorizeGenericQuery('update', query, builder, 'api/update');\n    return LinkedStorage.updateQuery(builder);\n  }\n  async post_delete({ query }) {\n    const builder = toQueryBuilder(query);\n    await authorizeGenericQuery('delete', query, builder, 'api/delete');\n    return LinkedStorage.deleteQuery(builder);\n  }\n\n  async post_select_raw({ query }) {\n    // A raw SPARQL string cannot be analysed for the shapes it touches: it is\n    // refused unless the app registers a raw query authorizer.\n    await authorizeRawQuery(query, 'api/select-raw');\n    this.checkRawQuerySupport();\n    return (LinkedStorage.getDefaultDataset() as unknown as SPARQLStore).rawQuery(\n      query\n    );\n  }\n\n  private checkRawQuerySupport() {\n    if (!(LinkedStorage.getDefaultDataset() as unknown as SPARQLStore).rawQuery) {\n      throw new Error(\n        `Default store (${\n          Object.getPrototypeOf(LinkedStorage.getDefaultDataset()).constructor\n            .name\n        }) does not support raw SPARQL queries`\n      );\n    }\n  }\n}\n"]}

package/lib/esm/shapes/LincdWebApp.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 var LincdWebApp_1;
 import { linkedShape } from '../package.js';
-import { lincdServer } from '../ontologies/lincd-server.js';
+import { server } from '../ontologies/server.js';
 import { Shape } from '@_linked/core/shapes/Shape';
 import { objectProperty } from '@_linked/core/shapes/SHACL';
 import { Lincd_API_Client } from '@_linked/server-utils/shapes/Lincd_API_Client';
@@ -26,10 +26,10 @@ let LincdWebApp = LincdWebApp_1 = class LincdWebApp extends Shape {
         return undefined;
     }
 };
-LincdWebApp.targetClass = lincdServer.LincdWebApp;
+LincdWebApp.targetClass = server.LincdWebApp;
 __decorate([
     objectProperty({
-        path: lincdServer.hasAPI,
+        path: server.hasAPI,
         shape: Lincd_API_Client,
         maxCount: 1,
     }),

package/lib/esm/shapes/LincdWebApp.js.map

@@ -1 +1 @@
-{"version":3,"file":"LincdWebApp.js","sourceRoot":"","sources":["../../../src/shapes/LincdWebApp.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEjF,iGAAiG;AACjG,gGAAgG;AAChG,4EAA4E;AAErE,IAAM,WAAW,mBAAjB,MAAM,WAAY,SAAQ,KAAK;IAGpC,MAAM,KAAK,QAAQ;QACjB,OAAO,IAAI,aAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,8FAA8F;IAE9F,IAKI,GAAG;QACL,OAAO,SAAgB,CAAC;IAC1B,CAAC;;AAhBM,uBAAW,GAAG,WAAW,CAAC,WAAW,AAA1B,CAA2B;AAS7C;IAAC,cAAc,CAAC;QACd,IAAI,EAAE,WAAW,CAAC,MAAM;QACxB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,CAAC;KACZ,CAAC;8BACS,gBAAgB;;sCAE1B;AAjBU,WAAW;IADvB,WAAW,CAAC,EAAC,IAAI,EAAE,aAAa,EAAC,CAAC;GACtB,WAAW,CAkBvB","sourcesContent":["import { linkedShape } from '../package.js';\nimport { lincdServer } from '../ontologies/lincd-server.js';\nimport { Shape } from '@_linked/core/shapes/Shape';\nimport { objectProperty } from '@_linked/core/shapes/SHACL';\nimport { Lincd_API_Client } from '@_linked/server-utils/shapes/Lincd_API_Client';\n\n// Named explicitly: tsc emits `let X = class X`, and any later esbuild pass over that JS (Vite's\n// SSR `define` replacement runs one on every file mentioning a defined `process.env.*`) renames\n// the inner binding to `X2`, which would otherwise become this shape's IRI.\n@linkedShape({name: 'LincdWebApp'})\nexport class LincdWebApp extends Shape {\n  static targetClass = lincdServer.LincdWebApp;\n\n  static get localApp() {\n    return new LincdWebApp({ id: process.env.SITE_ROOT });\n  }\n\n  // Module and packages properties removed — lincd-modules is in modules_old.\n  // These will be re-added when the shape is properly migrated to @_linked/core query patterns.\n\n  @objectProperty({\n    path: lincdServer.hasAPI,\n    shape: Lincd_API_Client,\n    maxCount: 1,\n  })\n  get api(): Lincd_API_Client {\n    return undefined as any;\n  }\n}\n"]}
+{"version":3,"file":"LincdWebApp.js","sourceRoot":"","sources":["../../../src/shapes/LincdWebApp.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAEjF,iGAAiG;AACjG,gGAAgG;AAChG,4EAA4E;AAErE,IAAM,WAAW,mBAAjB,MAAM,WAAY,SAAQ,KAAK;IAGpC,MAAM,KAAK,QAAQ;QACjB,OAAO,IAAI,aAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,8FAA8F;IAE9F,IAKI,GAAG;QACL,OAAO,SAAgB,CAAC;IAC1B,CAAC;;AAhBM,uBAAW,GAAG,MAAM,CAAC,WAAW,AAArB,CAAsB;AASxC;IAAC,cAAc,CAAC;QACd,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,CAAC;KACZ,CAAC;8BACS,gBAAgB;;sCAE1B;AAjBU,WAAW;IADvB,WAAW,CAAC,EAAC,IAAI,EAAE,aAAa,EAAC,CAAC;GACtB,WAAW,CAkBvB","sourcesContent":["import { linkedShape } from '../package.js';\nimport { server } from '../ontologies/server.js';\nimport { Shape } from '@_linked/core/shapes/Shape';\nimport { objectProperty } from '@_linked/core/shapes/SHACL';\nimport { Lincd_API_Client } from '@_linked/server-utils/shapes/Lincd_API_Client';\n\n// Named explicitly: tsc emits `let X = class X`, and any later esbuild pass over that JS (Vite's\n// SSR `define` replacement runs one on every file mentioning a defined `process.env.*`) renames\n// the inner binding to `X2`, which would otherwise become this shape's IRI.\n@linkedShape({name: 'LincdWebApp'})\nexport class LincdWebApp extends Shape {\n  static targetClass = server.LincdWebApp;\n\n  static get localApp() {\n    return new LincdWebApp({ id: process.env.SITE_ROOT });\n  }\n\n  // Module and packages properties removed — lincd-modules is in modules_old.\n  // These will be re-added when the shape is properly migrated to @_linked/core query patterns.\n\n  @objectProperty({\n    path: server.hasAPI,\n    shape: Lincd_API_Client,\n    maxCount: 1,\n  })\n  get api(): Lincd_API_Client {\n    return undefined as any;\n  }\n}\n"]}

package/lib/esm/shapes/LinkedServer.d.ts

@@ -2,6 +2,26 @@ import { Express as ExpressServer } from 'express';
 import { Server as HttpServer } from 'http';
 import type { LinkedConfig } from '@_linked/cli/interfaces';
 import { Shape } from '@_linked/core/shapes/Shape';
+/**
+ * Serve the local upload folder at `/uploads` (where `LocalFileStore` files are
+ * reachable), with the headers for untrusted files.
+ */
+export declare function mountUploads(app: {
+    use: Function;
+}, folder?: string, maxAge?: number): void;
+/**
+ * Express middleware: run the rest of the chain in the request's http context.
+ * `LinkedServer.start` installs it first, and again right after the JSON body
+ * parser (whose stream callbacks do not carry the context).
+ */
+export declare function enterRequestContext(req: any, res: any, next: any): void;
+/**
+ * Headers for files users uploaded (`/uploads`, resized copies): the browser
+ * must not guess a type from the bytes, and a document served from them runs
+ * sandboxed (no scripts, an opaque origin), so an uploaded HTML or SVG file
+ * cannot act on the app's origin.
+ */
+export declare function setUntrustedFileHeaders(res: any): void;
 export declare class LinkedServer extends Shape {
     /**
      * indicates that instances of this shape need to have this rdf.type
@@ -197,13 +217,25 @@ export declare class LinkedServer extends Shape {
      */
     private installSpaFallback;
     onSourceChange(pkg: string): Promise<void>;
-    processBackendMethodCall(request: any, response: any): Promise<void>;
+    processBackendMethodCall(request: any, response: any): Promise<any>;
     noCache(response: any): void;
     processAPICall(request: any, response: any, method: 'get' | 'post' | 'put' | 'delete'): Promise<void>;
-    processShapeMethodCall(request: any, response: any): Promise<void>;
+    processShapeMethodCall(request: any, response: any): Promise<any>;
     callShapeMethod(pkg: string, method: string, shapeURI: string, instanceNode: {
         id: string;
-    } | null, args: any[], request: any, response: any): Promise<any>;
+    } | null, args: any[], request?: any, response?: any): any;
+    /**
+     * Refuse a dispatch the exposure rules do not allow (see utils/rpcExposure).
+     * Throws a 501 `ServerCallError`, the same answer as for a missing method.
+     *
+     * - reserved names: always, for HTTP and backend-to-backend calls alike;
+     * - HTTP only: an internal method (in every mode), a generic call to a provider whose class sets
+     *   `static rpc = false`, and an undeclared method in 'enforce' mode
+     *   (in 'warn' mode it is logged once and runs).
+     */
+    private assertDispatchAllowed;
+    /** A declared `'user'` method needs a session: 401 without one, in every mode. */
+    private assertSessionForLevel;
     handleErrors(fn: any): (req: any, res: any, next: any) => Promise<any>;
     handleErrorsJson(fn: any): (req: any, res: any, next: any) => Promise<any>;
     sendError(res: any, statusCode: number, message: any, logMessage?: string): void;
@@ -224,11 +256,23 @@ export declare class LinkedServer extends Shape {
      */
     private collectViteSsrCss;
     render(req: any, res: any): Promise<void>;
+    private renderPage;
     sendJson(res: any, obj: any): void;
     initRequest(request: any, response: any): Promise<void>;
     getRequestData(request: any, response: any): Promise<{
         requestLD: string;
         requestObject: string;
     }>;
-    callBackendMethod(pkg: string, method: string, args: any[], request: any, response: any): Promise<any>;
+    callBackendMethod(pkg: string, method: string, args: any[], request?: any, response?: any): any;
 }
+/**
+ * Register the RPC routes (`/call/...`) and the `LincdAPI` routes (`/api/...`)
+ * of `linkedServer` on an express app.
+ *
+ * `LinkedServer.start()` calls this; tests call it on a bare express app so they
+ * drive exactly the routes a running server has.
+ */
+export declare function registerCallRoutes(app: {
+    post: Function;
+    get: Function;
+}, linkedServer: LinkedServer): void;