@_linked/server 3.12.0 → 3.13.0

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @\_linked/server
 
+## 3.13.0
+
+### Minor Changes
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`bc51824`](https://github.com/linked-fw/server/commit/bc51824cd00843498e46d1267b34369e1eea9d5f) Thanks [@flyon](https://github.com/flyon)! - Boot loading decides which installed packages are linked from their `linked.kind` (any kind but `app`), through `linkedKind(json)` in `@_linked/server/utils/linkedDependencies` (the twin of `@_linked/cli`'s). `linkedPackage: true` is no longer read. `discoverLinkedDependencies` takes an optional third argument, the test for a linked package (default `isLinkedPackageJson`). This package's own `package.json` says `"kind": "library"`, merged into its `linked.serverOnly`.
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`865740c`](https://github.com/linked-fw/server/commit/865740c5ba110acede9941c208556cbe516dc09b) Thanks [@flyon](https://github.com/flyon)! - Quieter boot log:
+
+  - The ontology and shape graph sync lines list the packages written and count the unchanged ones (`shape graph sync: written dep; 3 unchanged; app graph unchanged`), instead of listing every skipped package.
+  - `shape check: …` is logged only when the check has findings.
+  - The routing-pin warning is logged only for a boot sync that runs: `syncPinWarning` takes `{shapeSync, ontologySync}` and watches only the shapes those syncs write, so a boot with `syncShapesOnBoot: false` does not warn. A store without an `id` is named by its endpoint's dataset (`FusekiStore "cn-main"`).
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`4580aa7`](https://github.com/linked-fw/server/commit/4580aa76c72e980a902c897a5df9e891cf498556) Thanks [@flyon](https://github.com/flyon)! - The packages an app lists in `linked.unpublishedPackages` (and, transitively, the lists of those packages) are its direct dependencies: boot loading finds them by npm name (npm's workspace link into `packages-local/`, else the checkout there), the shape sync's reload check accepts them, and the shape check reads each list as dependencies. Lists are read with `@_linked/cli/installed-packages`' `unpublishedPackages`, so a malformed list is an error.
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`47dc659`](https://github.com/linked-fw/server/commit/47dc6590562fd064b12a9c43b2573912593b9f4d) Thanks [@flyon](https://github.com/flyon)! - `RemoteDataset`'s url form sends the signed-in user's own Solid-OIDC access token instead of their
+  WebID: for a query made in a user's HTTP request it asks `@_linked/auth`'s hook
+  (`globalThis[Symbol.for('@_linked/auth:userTokenHeaders')]`, exported as `USER_TOKEN_HEADERS_HOOK`)
+  and sends `x-linked-user-token` (`USER_TOKEN_HEADER`) with a fresh `DPoP` proof for that request.
+  `forwardUserToken: false` turns it off.
+
+  **Breaking:** `x-linked-end-user` is no longer sent; `forwardEndUser`, `END_USER_HEADER` and
+  `currentEndUserWebId` are removed. A data server that read the WebID header verifies the token
+  with `@_linked/auth`'s `verifySolidAccessToken` instead.
+
+### Patch Changes
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`3d946b4`](https://github.com/linked-fw/server/commit/3d946b41fffdcd2189bdfb1592ed132a95b9ae10) Thanks [@flyon](https://github.com/flyon)! - The boot ontology sync log no longer has a "(default graph: the store has no graph queries)"
+  case: core's ontology sync refuses such a store instead of falling back (core report 080), which
+  the server reports as a failed ontology sync. The unused `fallback` field is gone from the
+  `OntologyCore` type.
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`b39cddb`](https://github.com/linked-fw/server/commit/b39cddb14cc904b268edcebcba6a10b2b959b033) Thanks [@flyon](https://github.com/flyon)! - `RemoteDataset`'s url form never follows a redirect: a 3xx answer is a `RemoteDatasetError` with
+  its status, so the bearer, the user's token and its proof are sent to the configured data server
+  only.
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`757655e`](https://github.com/linked-fw/server/commit/757655e5a548eb2129742c7eedbee6b46908b6b8) Thanks [@flyon](https://github.com/flyon)! - Boot loading reads a `package.json` without `linked.kind` by the retired flags (`linkedPackage: true` is a `library`, `linkedApp: true` an `app`), so packages published before `linked.kind` still load until they are republished.
+
+- [#219](https://github.com/linked-fw/server/pull/219) [`c457627`](https://github.com/linked-fw/server/commit/c45762703c589d91b52661c820b19f33c711548f) Thanks [@flyon](https://github.com/flyon)! - `POST /admin/sync-shapes` answers 200 with `shapeCheck.failed` when the shape check throws and both syncs succeeded (it answered 500). The sync-pin warning counts a sub-shape under the target class it declares, so a sub-shape with its own class is no longer reported as its parent's; `owl:Restriction` is watched with the ontology term classes.
+
+## 3.12.1
+
+### Patch Changes
+
+- [#214](https://github.com/linked-fw/server/pull/214) [`654a3c2`](https://github.com/linked-fw/server/commit/654a3c2941ef49e317dd2ba58324f0221e894ca3) Thanks [@flyon](https://github.com/flyon)! - License: MIT (data under its original license)
+
 ## 3.12.0
 
 ### Minor Changes

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Semantu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/esm/shapes/LinkedServer.d.ts

@@ -82,7 +82,7 @@ export declare class LinkedServer extends Shape {
      * could not be loaded at all.
      */
     private linkedPackageDirs;
-    /** The app's own workspace packages (`linkedPackage: true`), by real path. */
+    /** The app's own workspace packages (`linked.kind` of a package), by real path. */
     private workspacePackageDirs;
     /** The names of the app's own workspace packages. */
     private workspacePackageNames;
@@ -136,7 +136,7 @@ export declare class LinkedServer extends Shape {
     /**
      * Boot: one warning when routing pins the shape shapes or the ontology term shapes to a dataset
      * other than the default one, since the syncs write into the default dataset only (see
-     * {@link syncPinWarning}).
+     * {@link syncPinWarning}). Only for the syncs this boot runs.
      */
     private warnOfSyncPins;
     /**
@@ -161,12 +161,13 @@ export declare class LinkedServer extends Shape {
      * Re-sync the registered ontologies and shapes into app data, as the boot does,
      * and report what was written: the ontology sync (every registered package,
      * hash-skipped), the shape check's counts, then the shape sync. A failed ontology
-     * sync does not stop the shape sync; the run then fails with the ontology error. The host calls it (`POST /admin/sync-shapes`) after it
+     * sync does not stop the shape sync; the run then fails with the ontology error. A shape
+     * check that throws fails nothing: the answer reports it (`shapeCheck.failed`). The host calls it (`POST /admin/sync-shapes`) after it
      * changed the app's shape code, so the app — the only process that loads that
      * code — writes its own shapes and their hashes.
      *
      * `packages` names the packages whose source changed: the app itself or its
-     * direct dependencies, never `@_linked/*` ({@link assertReloadablePackages}). In
+     * direct dependencies (its `linked.unpublishedPackages` among them), never `@_linked/*` ({@link assertReloadablePackages}). In
      * dev (Vite) their modules are invalidated and their backends reloaded first
      * ({@link onSourceChange}), so a shape added since the boot is registered before
      * the sync; without Vite (a built app) nothing is reloaded. The answer names the
@@ -178,7 +179,12 @@ export declare class LinkedServer extends Shape {
     resyncShapes({ packages }?: {
         packages?: string[];
     }): Promise<ShapeSyncResult>;
-    /** The packages a host may ask to reload: the app itself and its direct dependencies. */
+    /**
+     * The packages a host may ask to reload: the app itself and its direct dependencies, which
+     * include every package in its `linked.unpublishedPackages`, transitively
+     * ({@link listedPackageNames}). Read from disk on each call: a list written after the boot
+     * counts. A malformed list throws.
+     */
     private reloadablePackages;
     /**
      * Re-read one package's source from disk (dev only); see {@link resyncShapes}.
@@ -270,7 +276,8 @@ export declare class LinkedServer extends Shape {
     protected importModule(specifier: string): Promise<any>;
     /**
      * Filters local workspace packages to only those reachable from the app's
-     * dependency tree. Mirrors the logic used by `buildAll` in lincd-cli.
+     * dependency tree: `dependencies` and `linked.unpublishedPackages`, of the app
+     * and of each package reached. Mirrors the logic used by `buildAll` in the cli.
      */
     private filterPackagesByDependencyTree;
     resizeImage(req: any, res: any): Promise<void>;

package/lib/esm/shapes/LinkedServer.js

@@ -40,7 +40,7 @@ import { getAllShapeClasses, getShapeClass, getSuperShapesClasses, } from '@_lin
 import path from 'path';
 import { pathToFileURL } from 'node:url';
 import { FatalStartupError, isFatalError } from '../utils/fatalError.js';
-import { discoverLinkedDependencies, hasModuleEntry, isBundledBySsr, NODE_IMPORT_CONDITIONS, readDependencyLists, readInstalledPackage, resolveBackendEntry, resolveDevBackendEntry, ssrNoExternalOf, } from '../utils/linkedDependencies.js';
+import { discoverLinkedDependencies, listedPackageNames, unpublishedNames, hasModuleEntry, isBundledBySsr, NODE_IMPORT_CONDITIONS, readDependencyLists, readInstalledPackage, resolveBackendEntry, resolveDevBackendEntry, ssrNoExternalOf, } from '../utils/linkedDependencies.js';
 /**
  * `instanceof ShapeProvider`, tolerating a second copy of server-utils.
  *
@@ -285,7 +285,7 @@ let LinkedServer = class LinkedServer extends Shape {
          * could not be loaded at all.
          */
         this.linkedPackageDirs = new Map();
-        /** The app's own workspace packages (`linkedPackage: true`), by real path. */
+        /** The app's own workspace packages (`linked.kind` of a package), by real path. */
         this.workspacePackageDirs = [];
         /** The names of the app's own workspace packages. */
         this.workspacePackageNames = new Set();
@@ -441,10 +441,15 @@ let LinkedServer = class LinkedServer extends Shape {
     /**
      * Boot: one warning when routing pins the shape shapes or the ontology term shapes to a dataset
      * other than the default one, since the syncs write into the default dataset only (see
-     * {@link syncPinWarning}).
+     * {@link syncPinWarning}). Only for the syncs this boot runs.
      */
     warnOfSyncPins() {
-        const warning = syncPinWarning();
+        var _a;
+        const flag = (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot;
+        const warning = syncPinWarning({
+            shapeSync: shapeSyncOn(process.env, flag),
+            ontologySync: bootSyncsOntologies(process.env, flag),
+        });
         if (warning)
             console.warn(warning);
     }
@@ -485,12 +490,13 @@ let LinkedServer = class LinkedServer extends Shape {
      * Re-sync the registered ontologies and shapes into app data, as the boot does,
      * and report what was written: the ontology sync (every registered package,
      * hash-skipped), the shape check's counts, then the shape sync. A failed ontology
-     * sync does not stop the shape sync; the run then fails with the ontology error. The host calls it (`POST /admin/sync-shapes`) after it
+     * sync does not stop the shape sync; the run then fails with the ontology error. A shape
+     * check that throws fails nothing: the answer reports it (`shapeCheck.failed`). The host calls it (`POST /admin/sync-shapes`) after it
      * changed the app's shape code, so the app — the only process that loads that
      * code — writes its own shapes and their hashes.
      *
      * `packages` names the packages whose source changed: the app itself or its
-     * direct dependencies, never `@_linked/*` ({@link assertReloadablePackages}). In
+     * direct dependencies (its `linked.unpublishedPackages` among them), never `@_linked/*` ({@link assertReloadablePackages}). In
      * dev (Vite) their modules are invalidated and their backends reloaded first
      * ({@link onSourceChange}), so a shape added since the boot is registered before
      * the sync; without Vite (a built app) nothing is reloaded. The answer names the
@@ -514,22 +520,32 @@ let LinkedServer = class LinkedServer extends Shape {
         this.shapeSyncQueue = run.catch(() => undefined);
         return run;
     }
-    /** The packages a host may ask to reload: the app itself and its direct dependencies. */
+    /**
+     * The packages a host may ask to reload: the app itself and its direct dependencies, which
+     * include every package in its `linked.unpublishedPackages`, transitively
+     * ({@link listedPackageNames}). Read from disk on each call: a list written after the boot
+     * counts. A malformed list throws.
+     */
     reloadablePackages() {
         var _a, _b;
         const names = new Set();
         if ((_a = this.package) === null || _a === void 0 ? void 0 : _a.name)
             names.add(this.package.name);
+        let json;
         try {
-            const json = JSON.parse(fsNative.readFileSync(path.join(process.cwd(), 'package.json'), 'utf-8'));
-            if (json.name)
-                names.add(json.name);
-            for (const field of ['dependencies', 'devDependencies']) {
-                for (const name of Object.keys((_b = json[field]) !== null && _b !== void 0 ? _b : {}))
-                    names.add(name);
-            }
+            json = JSON.parse(fsNative.readFileSync(path.join(process.cwd(), 'package.json'), 'utf-8'));
         }
-        catch (_c) { }
+        catch (_c) {
+            return names;
+        }
+        if (json.name)
+            names.add(json.name);
+        for (const field of ['dependencies', 'devDependencies']) {
+            for (const name of Object.keys((_b = json[field]) !== null && _b !== void 0 ? _b : {}))
+                names.add(name);
+        }
+        for (const name of listedPackageNames(process.cwd(), json))
+            names.add(name);
         return names;
     }
     /**
@@ -1047,18 +1063,21 @@ let LinkedServer = class LinkedServer extends Shape {
     }
     /**
      * Filters local workspace packages to only those reachable from the app's
-     * dependency tree. Mirrors the logic used by `buildAll` in lincd-cli.
+     * dependency tree: `dependencies` and `linked.unpublishedPackages`, of the app
+     * and of each package reached. Mirrors the logic used by `buildAll` in the cli.
      */
     filterPackagesByDependencyTree(allPackages, appPackageJson) {
+        var _a, _b;
         const relevantPackages = new Map();
         const packagesToCheck = new Set();
         const processedPackages = new Set();
-        // Start with direct dependencies from the app
-        if (appPackageJson.dependencies) {
-            for (const dep of Object.keys(appPackageJson.dependencies)) {
-                if (allPackages.has(dep)) {
-                    packagesToCheck.add(dep);
-                }
+        // Start with direct dependencies from the app, its linked.unpublishedPackages among them
+        for (const dep of [
+            ...Object.keys((_a = appPackageJson.dependencies) !== null && _a !== void 0 ? _a : {}),
+            ...unpublishedNames(appPackageJson),
+        ]) {
+            if (allPackages.has(dep)) {
+                packagesToCheck.add(dep);
             }
         }
         // Recursively follow each package's dependencies
@@ -1073,11 +1092,12 @@ let LinkedServer = class LinkedServer extends Shape {
             if (packageDetails) {
                 relevantPackages.set(packageName, packageDetails);
                 const pkg = getPackageJSON(packageDetails.path);
-                if (pkg === null || pkg === void 0 ? void 0 : pkg.dependencies) {
-                    for (const dep of Object.keys(pkg.dependencies)) {
-                        if (allPackages.has(dep) && !processedPackages.has(dep)) {
-                            packagesToCheck.add(dep);
-                        }
+                for (const dep of [
+                    ...Object.keys((_b = pkg === null || pkg === void 0 ? void 0 : pkg.dependencies) !== null && _b !== void 0 ? _b : {}),
+                    ...unpublishedNames(pkg),
+                ]) {
+                    if (allPackages.has(dep) && !processedPackages.has(dep)) {
+                        packagesToCheck.add(dep);
                     }
                 }
             }