@_linked/server 3.6.0 → 3.7.0

package/lib/esm/utils/adminChannel.d.ts

@@ -7,7 +7,35 @@ export interface ShapeSyncResult {
     orphanScope?: 'all' | 'none';
     /** Set when no sync ran: shape sync is turned off, or there is no default dataset. */
     skipped?: 'disabled' | 'no-default-dataset';
+    /**
+     * The requested packages whose source was reloaded before the sync (dev only: a built
+     * app reloads nothing). Set by `POST /admin/sync-shapes`.
+     */
+    reloaded?: string[];
+    /** The node shape IRIs registered in the process after the reload. Set by `POST /admin/sync-shapes`. */
+    shapes?: string[];
+    /**
+     * The ontology sync: packages whose class hierarchy was written, and packages left as
+     * they were (unchanged, or their data could not be read). Set by `POST /admin/sync-shapes`.
+     */
+    ontologies?: {
+        written: string[];
+        skipped: string[];
+    };
+    /** The shape check's findings, counted by severity (each is logged). Set by `POST /admin/sync-shapes`. */
+    shapeCheck?: {
+        errors: number;
+        warnings: number;
+    };
 }
+/** Whether `name` is a valid npm package name (and so can never be a path like `..`). */
+export declare function isValidPackageName(name: string): boolean;
+/**
+ * Refuse a package a host may not ask to reload: not a valid npm name, a framework
+ * (`@_linked/*`) package, or not in `allowed` (the app's own name and its direct
+ * dependencies). Throws {@link AdminRequestError}.
+ */
+export declare function assertReloadablePackages(packages: string[], allowed: ReadonlySet<string>): void;
 /** Thrown by a handler for a request the channel refuses with 400. */
 export declare class AdminRequestError extends Error {
 }

package/lib/esm/utils/adminChannel.js

@@ -8,13 +8,40 @@
  * - `GET /admin/health` → 200 `{status: 'ok'}` once the server listens (the boot
  *   shape sync has finished by then).
  * - `POST /admin/restart` → 202, then the process exits; the host starts it again.
- * - `POST /admin/sync-shapes` → re-syncs the app's shapes into its app data, as
- *   the boot does, and answers 200 with {@link ShapeSyncResult}. Body (optional):
+ * - `POST /admin/sync-shapes` → re-syncs the app's ontologies (the class hierarchy
+ *   of every registered package, skipped when unchanged), runs the shape check and
+ *   re-syncs its shapes into its app data, as the boot does, and answers 200 with
+ *   {@link ShapeSyncResult}. Body (optional):
  *   `{packages: string[]}`, packages whose source changed on disk: in dev they are
- *   reloaded first, so the sync sees shapes added or changed since the boot. A
- *   failed sync answers 500 `{error}`; an unknown package 400 `{error}`.
+ *   reloaded first, so the sync sees shapes added or changed since the boot. Each
+ *   name must be a valid npm package name and the app itself or one of its direct
+ *   dependencies, never an `@_linked/*` framework package; anything else answers
+ *   400 `{error}`. The list never filters the syncs. A failed or timed-out sync
+ *   answers 500 `{error}` (a failed ontology sync too, after the shape sync ran).
  */
 import { timingSafeEqual } from 'crypto';
+/** npm's package-name rule: optional `@scope/`, lower case, URL-safe, no leading `.` or `_` (a scope may start with `_`, as `@_linked` does). */
+const NPM_NAME = /^(?:@[a-z0-9-~_][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+/** Whether `name` is a valid npm package name (and so can never be a path like `..`). */
+export function isValidPackageName(name) {
+    return name.length <= 214 && NPM_NAME.test(name) && !name.split('/').some((part) => part === '.' || part === '..');
+}
+/**
+ * Refuse a package a host may not ask to reload: not a valid npm name, a framework
+ * (`@_linked/*`) package, or not in `allowed` (the app's own name and its direct
+ * dependencies). Throws {@link AdminRequestError}.
+ */
+export function assertReloadablePackages(packages, allowed) {
+    for (const pkg of packages) {
+        if (!isValidPackageName(pkg))
+            throw new AdminRequestError(`not a package name: ${JSON.stringify(pkg)}`);
+        if (pkg.startsWith('@_linked/'))
+            throw new AdminRequestError(`framework packages are not reloaded: ${pkg}`);
+        if (!allowed.has(pkg)) {
+            throw new AdminRequestError(`unknown package: ${pkg} is neither the app nor one of its direct dependencies`);
+        }
+    }
+}
 /** Thrown by a handler for a request the channel refuses with 400. */
 export class AdminRequestError extends Error {
 }
@@ -39,6 +66,10 @@ export function parseSyncShapesBody(body) {
     if (!Array.isArray(packages) || packages.some((p) => typeof p !== 'string' || !p)) {
         throw new AdminRequestError('packages must be a list of package names');
     }
+    for (const p of packages) {
+        if (!isValidPackageName(p))
+            throw new AdminRequestError(`not a package name: ${JSON.stringify(p)}`);
+    }
     return { packages: [...new Set(packages)] };
 }
 /** Mount the control channel's routes on `app`. */

package/lib/esm/utils/adminChannel.js.map

@@ -1 +1 @@
-{"version":3,"file":"adminChannel.js","sourceRoot":"","sources":["../../../src/utils/adminChannel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAazC,sEAAsE;AACtE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAS/C,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,QAA4B;IAE5B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAoB,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,MAA0B,EAC1B,QAA8B;IAE9B,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,GAAqB,EAAW,EAAE;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The host→app control channel: `/admin/*` routes a host (Create Now) uses on an\n * app process it started. Present only when the process was started with a\n * shared secret in `CN_APP_ADMIN_SECRET`; without it every route answers 404, so\n * a standalone app has no control channel. Every request carries the secret in\n * the `x-cn-admin-secret` header.\n *\n * - `GET /admin/health` → 200 `{status: 'ok'}` once the server listens (the boot\n *   shape sync has finished by then).\n * - `POST /admin/restart` → 202, then the process exits; the host starts it again.\n * - `POST /admin/sync-shapes` → re-syncs the app's shapes into its app data, as\n *   the boot does, and answers 200 with {@link ShapeSyncResult}. Body (optional):\n *   `{packages: string[]}`, packages whose source changed on disk: in dev they are\n *   reloaded first, so the sync sees shapes added or changed since the boot. A\n *   failed sync answers 500 `{error}`; an unknown package 400 `{error}`.\n */\nimport { timingSafeEqual } from 'crypto';\nimport type express from 'express';\n\n/** What one shape sync did. */\nexport interface ShapeSyncResult {\n  /** Shapes written: those whose stored hash differed from the registered shape. */\n  written: number;\n  /** The orphan policy the sync ran with (see utils/syncShapes). */\n  orphanScope?: 'all' | 'none';\n  /** Set when no sync ran: shape sync is turned off, or there is no default dataset. */\n  skipped?: 'disabled' | 'no-default-dataset';\n}\n\n/** Thrown by a handler for a request the channel refuses with 400. */\nexport class AdminRequestError extends Error {}\n\nexport interface AdminChannelHandlers {\n  /** Exit the process (the host restarts it). Called after the 202 is sent. */\n  exit: () => void;\n  /** Reload `packages` (when given) and sync the registered shapes into app data. */\n  syncShapes: (request: { packages: string[] }) => Promise<ShapeSyncResult>;\n}\n\n/** Compare the provided secret with the configured one in constant time. */\nexport function adminSecretMatches(\n  secret: string | undefined,\n  provided: string | undefined\n): boolean {\n  if (!secret || !provided) return false;\n  const a = Buffer.from(provided);\n  const b = Buffer.from(secret);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\n/** The `packages` of a sync-shapes body: a list of package names, or none. */\nexport function parseSyncShapesBody(body: unknown): { packages: string[] } {\n  if (body === undefined || body === null || body === '') return { packages: [] };\n  if (typeof body !== 'object') {\n    throw new AdminRequestError('the body must be a JSON object');\n  }\n  const packages = (body as { packages?: unknown }).packages;\n  if (packages === undefined) return { packages: [] };\n  if (!Array.isArray(packages) || packages.some((p) => typeof p !== 'string' || !p)) {\n    throw new AdminRequestError('packages must be a list of package names');\n  }\n  return { packages: [...new Set(packages as string[])] };\n}\n\n/** Mount the control channel's routes on `app`. */\nexport function registerAdminRoutes(\n  app: express.Express,\n  secret: string | undefined,\n  handlers: AdminChannelHandlers\n): void {\n  const requireAdmin = (req: express.Request, res: express.Response): boolean => {\n    if (!secret) {\n      res.sendStatus(404); // no control channel in this mode\n      return false;\n    }\n    if (!adminSecretMatches(secret, req.get('x-cn-admin-secret'))) {\n      res.sendStatus(401);\n      return false;\n    }\n    return true;\n  };\n\n  app.get('/admin/health', (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    res.status(200).json({ status: 'ok' });\n  });\n\n  app.post('/admin/restart', (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    res.sendStatus(202);\n    setTimeout(handlers.exit, 50);\n  });\n\n  app.post('/admin/sync-shapes', async (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    let request: { packages: string[] };\n    try {\n      request = parseSyncShapesBody(req.body);\n    } catch (err) {\n      res.status(400).json({ error: (err as Error).message });\n      return;\n    }\n    try {\n      res.status(200).json(await handlers.syncShapes(request));\n    } catch (err) {\n      const status = err instanceof AdminRequestError ? 400 : 500;\n      res.status(status).json({ error: err instanceof Error ? err.message : String(err) });\n    }\n  });\n}\n"]}
+{"version":3,"file":"adminChannel.js","sourceRoot":"","sources":["../../../src/utils/adminChannel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AA2BzC,iJAAiJ;AACjJ,MAAM,QAAQ,GAAG,2DAA2D,CAAC;AAE7E,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACrH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAkB,EAAE,OAA4B;IACvF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,GAAG,wDAAwD,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAS/C,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,QAA4B;IAE5B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAoB,EAAE,CAAC;QACrC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAoB,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,MAA0B,EAC1B,QAA8B;IAE9B,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,GAAqB,EAAW,EAAE;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;YACvD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACpC,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The host→app control channel: `/admin/*` routes a host (Create Now) uses on an\n * app process it started. Present only when the process was started with a\n * shared secret in `CN_APP_ADMIN_SECRET`; without it every route answers 404, so\n * a standalone app has no control channel. Every request carries the secret in\n * the `x-cn-admin-secret` header.\n *\n * - `GET /admin/health` → 200 `{status: 'ok'}` once the server listens (the boot\n *   shape sync has finished by then).\n * - `POST /admin/restart` → 202, then the process exits; the host starts it again.\n * - `POST /admin/sync-shapes` → re-syncs the app's ontologies (the class hierarchy\n *   of every registered package, skipped when unchanged), runs the shape check and\n *   re-syncs its shapes into its app data, as the boot does, and answers 200 with\n *   {@link ShapeSyncResult}. Body (optional):\n *   `{packages: string[]}`, packages whose source changed on disk: in dev they are\n *   reloaded first, so the sync sees shapes added or changed since the boot. Each\n *   name must be a valid npm package name and the app itself or one of its direct\n *   dependencies, never an `@_linked/*` framework package; anything else answers\n *   400 `{error}`. The list never filters the syncs. A failed or timed-out sync\n *   answers 500 `{error}` (a failed ontology sync too, after the shape sync ran).\n */\nimport { timingSafeEqual } from 'crypto';\nimport type express from 'express';\n\n/** What one shape sync did. */\nexport interface ShapeSyncResult {\n  /** Shapes written: those whose stored hash differed from the registered shape. */\n  written: number;\n  /** The orphan policy the sync ran with (see utils/syncShapes). */\n  orphanScope?: 'all' | 'none';\n  /** Set when no sync ran: shape sync is turned off, or there is no default dataset. */\n  skipped?: 'disabled' | 'no-default-dataset';\n  /**\n   * The requested packages whose source was reloaded before the sync (dev only: a built\n   * app reloads nothing). Set by `POST /admin/sync-shapes`.\n   */\n  reloaded?: string[];\n  /** The node shape IRIs registered in the process after the reload. Set by `POST /admin/sync-shapes`. */\n  shapes?: string[];\n  /**\n   * The ontology sync: packages whose class hierarchy was written, and packages left as\n   * they were (unchanged, or their data could not be read). Set by `POST /admin/sync-shapes`.\n   */\n  ontologies?: { written: string[]; skipped: string[] };\n  /** The shape check's findings, counted by severity (each is logged). Set by `POST /admin/sync-shapes`. */\n  shapeCheck?: { errors: number; warnings: number };\n}\n\n/** npm's package-name rule: optional `@scope/`, lower case, URL-safe, no leading `.` or `_` (a scope may start with `_`, as `@_linked` does). */\nconst NPM_NAME = /^(?:@[a-z0-9-~_][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/;\n\n/** Whether `name` is a valid npm package name (and so can never be a path like `..`). */\nexport function isValidPackageName(name: string): boolean {\n  return name.length <= 214 && NPM_NAME.test(name) && !name.split('/').some((part) => part === '.' || part === '..');\n}\n\n/**\n * Refuse a package a host may not ask to reload: not a valid npm name, a framework\n * (`@_linked/*`) package, or not in `allowed` (the app's own name and its direct\n * dependencies). Throws {@link AdminRequestError}.\n */\nexport function assertReloadablePackages(packages: string[], allowed: ReadonlySet<string>): void {\n  for (const pkg of packages) {\n    if (!isValidPackageName(pkg)) throw new AdminRequestError(`not a package name: ${JSON.stringify(pkg)}`);\n    if (pkg.startsWith('@_linked/')) throw new AdminRequestError(`framework packages are not reloaded: ${pkg}`);\n    if (!allowed.has(pkg)) {\n      throw new AdminRequestError(`unknown package: ${pkg} is neither the app nor one of its direct dependencies`);\n    }\n  }\n}\n\n/** Thrown by a handler for a request the channel refuses with 400. */\nexport class AdminRequestError extends Error {}\n\nexport interface AdminChannelHandlers {\n  /** Exit the process (the host restarts it). Called after the 202 is sent. */\n  exit: () => void;\n  /** Reload `packages` (when given) and sync the registered shapes into app data. */\n  syncShapes: (request: { packages: string[] }) => Promise<ShapeSyncResult>;\n}\n\n/** Compare the provided secret with the configured one in constant time. */\nexport function adminSecretMatches(\n  secret: string | undefined,\n  provided: string | undefined\n): boolean {\n  if (!secret || !provided) return false;\n  const a = Buffer.from(provided);\n  const b = Buffer.from(secret);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\n/** The `packages` of a sync-shapes body: a list of package names, or none. */\nexport function parseSyncShapesBody(body: unknown): { packages: string[] } {\n  if (body === undefined || body === null || body === '') return { packages: [] };\n  if (typeof body !== 'object') {\n    throw new AdminRequestError('the body must be a JSON object');\n  }\n  const packages = (body as { packages?: unknown }).packages;\n  if (packages === undefined) return { packages: [] };\n  if (!Array.isArray(packages) || packages.some((p) => typeof p !== 'string' || !p)) {\n    throw new AdminRequestError('packages must be a list of package names');\n  }\n  for (const p of packages as string[]) {\n    if (!isValidPackageName(p)) throw new AdminRequestError(`not a package name: ${JSON.stringify(p)}`);\n  }\n  return { packages: [...new Set(packages as string[])] };\n}\n\n/** Mount the control channel's routes on `app`. */\nexport function registerAdminRoutes(\n  app: express.Express,\n  secret: string | undefined,\n  handlers: AdminChannelHandlers\n): void {\n  const requireAdmin = (req: express.Request, res: express.Response): boolean => {\n    if (!secret) {\n      res.sendStatus(404); // no control channel in this mode\n      return false;\n    }\n    if (!adminSecretMatches(secret, req.get('x-cn-admin-secret'))) {\n      res.sendStatus(401);\n      return false;\n    }\n    return true;\n  };\n\n  app.get('/admin/health', (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    res.status(200).json({ status: 'ok' });\n  });\n\n  app.post('/admin/restart', (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    res.sendStatus(202);\n    setTimeout(handlers.exit, 50);\n  });\n\n  app.post('/admin/sync-shapes', async (req, res) => {\n    if (!requireAdmin(req, res)) return;\n    let request: { packages: string[] };\n    try {\n      request = parseSyncShapesBody(req.body);\n    } catch (err) {\n      res.status(400).json({ error: (err as Error).message });\n      return;\n    }\n    try {\n      res.status(200).json(await handlers.syncShapes(request));\n    } catch (err) {\n      const status = err instanceof AdminRequestError ? 400 : 500;\n      res.status(status).json({ error: err instanceof Error ? err.message : String(err) });\n    }\n  });\n}\n"]}

package/lib/esm/utils/linkedDependencies.d.ts

@@ -70,6 +70,13 @@ export declare function readInstalledPackage(name: string, fromDir: string): {
  * (it is only installed nested) it is the first copy found.
  */
 export declare function discoverLinkedDependencies(appDir: string, appPackageJson: any): LinkedDependency[];
+/**
+ * Package name → the names of its direct `dependencies` and `peerDependencies`, for the app
+ * (`appPackageJson`) and every package in `packageDirs` (name → package root, as discovery
+ * found it). The shape check scopes its direction-I errors with it. A package whose
+ * `package.json` cannot be read is left out.
+ */
+export declare function readDependencyLists(packageDirs: Iterable<[string, string]>, appPackageJson?: any): Record<string, string[]>;
 /**
  * The conditions a backend entry is resolved with on the Node path. These are
  * the ones Node's ESM loader applies to `import()` — so the file found is the

package/lib/esm/utils/linkedDependencies.js

@@ -131,6 +131,35 @@ export function discoverLinkedDependencies(appDir, appPackageJson) {
     }
     return out;
 }
+/**
+ * Package name → the names of its direct `dependencies` and `peerDependencies`, for the app
+ * (`appPackageJson`) and every package in `packageDirs` (name → package root, as discovery
+ * found it). The shape check scopes its direction-I errors with it. A package whose
+ * `package.json` cannot be read is left out.
+ */
+export function readDependencyLists(packageDirs, appPackageJson) {
+    const lists = {};
+    const add = (name, json) => {
+        var _a, _b;
+        if (typeof name !== 'string' || !name)
+            return;
+        lists[name] = [
+            ...new Set([
+                ...Object.keys((_a = json === null || json === void 0 ? void 0 : json.dependencies) !== null && _a !== void 0 ? _a : {}),
+                ...Object.keys((_b = json === null || json === void 0 ? void 0 : json.peerDependencies) !== null && _b !== void 0 ? _b : {}),
+            ]),
+        ].sort();
+    };
+    if (appPackageJson)
+        add(appPackageJson.name, appPackageJson);
+    for (const [name, dir] of packageDirs) {
+        try {
+            add(name, JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8')));
+        }
+        catch (_a) { }
+    }
+    return lists;
+}
 function realpathOr(p) {
     try {
         return fs.realpathSync(p);

package/lib/esm/utils/linkedDependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"linkedDependencies.js","sourceRoot":"","sources":["../../../src/utils/linkedDependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAsB7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAS;IAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAS;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,OAAO,GAAG,IAAI,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,OAAe;IAEf,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,cAAmB;;IAEnB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE;;QAC9C,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO;QAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACvC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvB,CAAC;QACD,qEAAqE;QACrE,0CAA0C;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAAY,EACZ,aAAgC,sBAAsB;IAEtD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACtC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAA,KAAK,QAAQ,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,OAAe,EAAE,GAAW;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,YAAiB,EACjB,UAA6B,EAC7B,KAAqC;IAErC,0EAA0E;IAC1E,0CAA0C;IAC1C,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3B,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,IAAI,MAAW,CAAC;IAChB,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACnC,IACE,OAAO,KAAK,MAAM;gBAClB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;gBAC5B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxB,CAAC,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EACzD,CAAC;gBACD,OAAO,GAAG,GAAG,CAAC;gBACd,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,CAAM,EAAiB,EAAE;QAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,GAAG,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClD,mEAAmE;oBACnE,sDAAsD;oBACtD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,OAAY;IAEZ,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACtC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,OAAO,oBAAoB,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;;QAC5D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,MAAA,WAAW,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,CAAC,mCAAI,WAAW,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,UAAmB;IACjE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5B,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK,KAAK,OAAO;QACnB,CAAC,CAAC,KAAK,YAAY,MAAM;YACvB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAS;;IACvC,OAAO,CACL,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,GAAG,0CAAE,UAAU,mCAC7B,MAAA,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,YAAY,0CAAE,GAAG,0CAAE,OAAO,0CAAE,UAAU,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,OAAY;;IAEZ,OAAO,CACL,MAAA,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,mCAC3C,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;QACpC,aAAa;QACb,GAAG,sBAAsB;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\n/**\n * A linked package found in the app's dependency tree, wherever it is\n * installed: a workspace member, a localized checkout, or a registry install.\n */\nexport interface LinkedDependency {\n  packageName: string;\n  /**\n   * Realpath of the package root whose backend the server loads: the copy the\n   * app itself resolves when that copy is a linked package, otherwise the\n   * first copy the walk found.\n   */\n  path: string;\n  /**\n   * Every distinct installed copy of this package in the tree (realpaths),\n   * in the order the walk found them. More than one means the install is not\n   * deduplicated; only `path`'s backend is ever loaded.\n   */\n  copies: { path: string; version?: string }[];\n}\n\n/**\n * A package whose backend providers the server loads at boot: one whose\n * package.json declares `\"linkedPackage\": true`. That flag is the only test —\n * not the package's scope. `@_linked/localize` is in the `@_linked` scope and\n * is a CLI tool, not a linked package; a custom-scope package with the flag is\n * a linked package. The CLI's workspace discovery uses the same flag.\n *\n * The legacy `\"lincd\": true` flag is deliberately NOT enough. Those packages\n * import the old `lincd` core, and loading them at boot is what produced\n * \"Multiple versions of LINCD are loaded\" before boot loading was narrowed to\n * workspace members.\n */\nexport function isLinkedPackageJson(json: any): boolean {\n  if (!json || typeof json.name !== 'string') return false;\n  return json.linkedPackage === true;\n}\n\n/**\n * Find an installed package the way Node does: `<dir>/node_modules/<name>`,\n * then each parent directory's `node_modules`. Returns null when it is not\n * installed (an optional dependency, say) rather than throwing.\n */\n/**\n * Whether a package has a JavaScript entry the server can import: `main`,\n * `module`, or an `exports` map with a root (`.`) entry or a single string.\n * A linked package can be pure CSS (`@_linked/css`); importing that whole\n * fails with \"Failed to resolve entry\", so the server skips it.\n */\nexport function hasModuleEntry(json: any): boolean {\n  if (!json) return false;\n  if (typeof json.main === 'string' || typeof json.module === 'string') {\n    return true;\n  }\n  const exp = json.exports;\n  if (typeof exp === 'string') return true;\n  if (exp && typeof exp === 'object') {\n    const keys = Object.keys(exp);\n    // Conditions only ({import, require, ...}) describe the root entry.\n    if (keys.length > 0 && keys.every((k) => !k.startsWith('.'))) return true;\n    return '.' in exp;\n  }\n  return false;\n}\n\nexport function readInstalledPackage(\n  name: string,\n  fromDir: string\n): { root: string; json: any } | null {\n  let dir = path.resolve(fromDir);\n  while (true) {\n    const root = path.join(dir, 'node_modules', name);\n    const pkgJsonPath = path.join(root, 'package.json');\n    if (fs.existsSync(pkgJsonPath)) {\n      try {\n        return { root, json: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')) };\n      } catch {\n        return null;\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/**\n * Every linked package reachable from the app's `dependencies`, each one AFTER\n * the linked packages it depends on. Providers register middleware in the\n * order they are indexed, so a package's middleware must not run before that\n * of a package it builds on (e.g. anything reading `request.linkedAuth` after\n * @_linked/auth's JWT middleware).\n *\n * Only linked packages are recursed into — the same rule the workspace-only\n * filter used — so the walk reads a few dozen package.json files, not the\n * whole of node_modules. Each package's dependencies are resolved from its\n * REAL location, so a symlinked workspace or localized checkout resolves its\n * own dependencies the way Node will when it loads it — which is how a\n * package installed only nested (`owl/node_modules/@_linked/rdfs`) is found.\n *\n * The walk is keyed by real path, not name, so every installed copy of a\n * package is recorded (`copies`). The copy whose backend is loaded (`path`)\n * is the one the app itself resolves, so it is the same module instance the\n * app's own imports reach; when the app cannot resolve the package at all\n * (it is only installed nested) it is the first copy found.\n */\nexport function discoverLinkedDependencies(\n  appDir: string,\n  appPackageJson: any\n): LinkedDependency[] {\n  const out: LinkedDependency[] = [];\n  const byName = new Map<string, LinkedDependency>();\n  const visitedRoots = new Set<string>();\n  const appName = appPackageJson?.name;\n\n  const visit = (name: string, fromDir: string) => {\n    if (name === appName) return;\n    const installed = readInstalledPackage(name, fromDir);\n    if (!installed || !isLinkedPackageJson(installed.json)) return;\n    const realRoot = realpathOr(installed.root);\n    if (visitedRoots.has(realRoot)) return;\n    visitedRoots.add(realRoot);\n    let entry = byName.get(name);\n    if (!entry) {\n      entry = { packageName: name, path: realRoot, copies: [] };\n      byName.set(name, entry);\n    }\n    entry.copies.push({ path: realRoot, version: installed.json.version });\n    for (const dep of Object.keys(installed.json.dependencies ?? {})) {\n      visit(dep, realRoot);\n    }\n    // Pushed after its dependencies, once per name: the first copy found\n    // fixes the package's place in the order.\n    if (!out.includes(entry)) out.push(entry);\n  };\n\n  for (const name of Object.keys(appPackageJson?.dependencies ?? {})) {\n    visit(name, appDir);\n  }\n\n  for (const entry of out) {\n    if (entry.copies.length < 2) continue;\n    const fromApp = readInstalledPackage(entry.packageName, appDir);\n    if (fromApp && isLinkedPackageJson(fromApp.json)) {\n      const appCopy = realpathOr(fromApp.root);\n      if (entry.copies.some((c) => c.path === appCopy)) entry.path = appCopy;\n    }\n  }\n  return out;\n}\n\nfunction realpathOr(p: string): string {\n  try {\n    return fs.realpathSync(p);\n  } catch {\n    return p;\n  }\n}\n\n/**\n * The conditions a backend entry is resolved with on the Node path. These are\n * the ones Node's ESM loader applies to `import()` — so the file found is the\n * file a bare `import('<pkg>/backend')` from the app would load, and Node's\n * module cache (keyed by real file URL) hands both the same instance.\n * `development` is deliberately absent: it is a Vite/bundler condition, and a\n * production Node runtime never applies it.\n */\nexport const NODE_IMPORT_CONDITIONS = ['import', 'node', 'default'] as const;\n\n/**\n * The absolute path of a package's backend entry file, or null when the\n * package has no backend entry or the file it names does not exist.\n *\n * With `exports`, this follows Node's PACKAGE_EXPORTS_RESOLVE for the\n * `./backend` subpath: an exact `./backend` key wins; otherwise the `./*`-style\n * pattern with the longest matching prefix; condition objects (nested or not)\n * pick the first key that is one of `conditions` or `default`; arrays take the\n * first target that resolves. A package that has `exports` but nothing\n * matching `./backend` has no backend — exactly as Node would refuse to\n * import it.\n *\n * Without `exports`, the legacy layout: `<root>/backend.js`,\n * `<root>/backend/index.js`, and the layout linked packages build to — a\n * `backend.js` next to `main` (`lib/esm/backend.js`).\n *\n * Hand-written rather than via `resolve.exports`: that package also stops at\n * a path and leaves the existence check to the caller, the subset needed is\n * ~50 lines, and the server keeps one less dependency in every app's install.\n */\nexport function resolveBackendEntry(\n  pkgRoot: string,\n  pkgJson: any,\n  conditions: readonly string[] = NODE_IMPORT_CONDITIONS\n): string | null {\n  const exists = (rel: string) => packageFile(pkgRoot, rel);\n  const exportsField = pkgJson?.exports;\n  if (exportsField === undefined || exportsField === null) {\n    const candidates = ['backend.js', 'backend/index.js'];\n    if (typeof pkgJson?.main === 'string') {\n      candidates.push(path.join(path.dirname(pkgJson.main), 'backend.js'));\n    }\n    candidates.push('lib/esm/backend.js');\n    for (const rel of candidates) {\n      const file = exists(rel);\n      if (file) return file;\n    }\n    return null;\n  }\n  return resolveBackendExport(exportsField, conditions, exists);\n}\n\n/** `<pkgRoot>/<rel>` when it is a file inside the package, else null. */\nfunction packageFile(pkgRoot: string, rel: string): string | null {\n  const file = path.resolve(pkgRoot, rel);\n  // Never let an export target escape the package.\n  if (!file.startsWith(path.resolve(pkgRoot) + path.sep)) return null;\n  try {\n    return fs.statSync(file).isFile() ? file : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The `./backend` subpath of an `exports` map, resolved per Node's\n * PACKAGE_EXPORTS_RESOLVE (see resolveBackendEntry). `probe` turns a matched\n * `./`-relative target into a file, or null when it does not resolve.\n */\nfunction resolveBackendExport(\n  exportsField: any,\n  conditions: readonly string[],\n  probe: (rel: string) => string | null\n): string | null {\n  // `\"exports\": \"./x.js\"`, an array, or a condition object at the top level\n  // are all sugar for the \".\" subpath only.\n  if (\n    typeof exportsField !== 'object' ||\n    Array.isArray(exportsField) ||\n    !Object.keys(exportsField).some((k) => k.startsWith('.'))\n  ) {\n    return null;\n  }\n\n  const subpath = './backend';\n  let target: any;\n  let patternMatch: string | null = null;\n  if (Object.prototype.hasOwnProperty.call(exportsField, subpath)) {\n    target = exportsField[subpath];\n  } else {\n    let bestKey: string | null = null;\n    for (const key of Object.keys(exportsField)) {\n      const star = key.indexOf('*');\n      if (star === -1 || key.indexOf('*', star + 1) !== -1) continue;\n      const prefix = key.slice(0, star);\n      const suffix = key.slice(star + 1);\n      if (\n        subpath !== prefix &&\n        subpath.length >= key.length &&\n        subpath.startsWith(prefix) &&\n        subpath.endsWith(suffix) &&\n        (bestKey === null || patternKeyCompare(bestKey, key) > 0)\n      ) {\n        bestKey = key;\n        patternMatch = subpath.slice(prefix.length, subpath.length - suffix.length);\n      }\n    }\n    if (bestKey === null) return null;\n    target = exportsField[bestKey];\n  }\n\n  const resolveTarget = (t: any): string | null => {\n    if (typeof t === 'string') {\n      if (!t.startsWith('./')) return null;\n      const rel = patternMatch === null ? t : t.split('*').join(patternMatch);\n      return probe(rel);\n    }\n    if (Array.isArray(t)) {\n      for (const item of t) {\n        const file = resolveTarget(item);\n        if (file) return file;\n      }\n      return null;\n    }\n    if (t && typeof t === 'object') {\n      for (const key of Object.keys(t)) {\n        if (key === 'default' || conditions.includes(key)) {\n          // Node takes the first matching condition even if its target fails\n          // to resolve; it does not fall through to later keys.\n          return resolveTarget(t[key]);\n        }\n      }\n    }\n    return null;\n  };\n  return resolveTarget(target);\n}\n\n/**\n * The SOURCE file a dev Vite runner loads for `<pkg>/backend` when the\n * package is a source package — its real root has a `src/` directory, which is\n * what makes `linked`'s Vite config register it as a workspace (cli\n * `discoverWorkspaces` / `readSourcePackage`). Null when the package has no\n * `src/` or no source backend; the caller then falls back to\n * resolveBackendEntry (a built `lib/` copy, or nothing).\n *\n * Mirrors the cli's `resolveWorkspaceSpecifier` for the `./backend` subpath,\n * which runs BEFORE `exports`: `src/backend.tsx`, `src/backend.ts`, then the\n * package's own `exports` under `import`/`default` with a `./lib/esm/X.js`\n * target mapped to `src/X.tsx` / `src/X.ts` (any other `./lib/esm/` target to\n * the same path under src). So an unbuilt workspace, whose `exports` name only\n * `lib/esm`, still has its backend found, and a built one reports the src file\n * Vite actually evaluates rather than its stale `lib/`.\n *\n * Only meaningful when the dev Vite runner owns the package; Node (production,\n * external packages) loads `lib/` and never sees src.\n */\nexport function resolveSourceBackendEntry(\n  pkgRoot: string,\n  pkgJson: any\n): string | null {\n  try {\n    if (!fs.statSync(path.join(pkgRoot, 'src')).isDirectory()) return null;\n  } catch {\n    return null;\n  }\n  for (const rel of ['src/backend.tsx', 'src/backend.ts']) {\n    const file = packageFile(pkgRoot, rel);\n    if (file) return file;\n  }\n  const exportsField = pkgJson?.exports;\n  if (exportsField === undefined || exportsField === null) return null;\n  const libPrefix = './lib/esm/';\n  return resolveBackendExport(exportsField, ['import'], (rel) => {\n    if (!rel.startsWith(libPrefix)) return null;\n    const sub = rel.slice(libPrefix.length);\n    if (/\\.jsx?$/.test(sub)) {\n      const base = 'src/' + sub.replace(/\\.jsx?$/, '');\n      return packageFile(pkgRoot, base + '.tsx') ?? packageFile(pkgRoot, base + '.ts');\n    }\n    return packageFile(pkgRoot, 'src/' + sub);\n  });\n}\n\n/** Node's PATTERN_KEY_COMPARE: < 0 means `a` is the more specific pattern. */\nfunction patternKeyCompare(a: string, b: string): number {\n  const aBase = a.indexOf('*');\n  const bBase = b.indexOf('*');\n  const baseA = aBase === -1 ? a.length : aBase + 1;\n  const baseB = bBase === -1 ? b.length : bBase + 1;\n  if (baseA > baseB) return -1;\n  if (baseB > baseA) return 1;\n  if (aBase === -1) return 1;\n  if (bBase === -1) return -1;\n  if (a.length > b.length) return -1;\n  if (b.length > a.length) return 1;\n  return 0;\n}\n\n/**\n * Whether the dev SSR runner BUNDLES `pkgName` (it is in Vite's\n * `ssr.noExternal`) rather than handing it to Node.\n *\n * This decides which loader a package's backend must be loaded with. A module\n * has to be evaluated by the same loader that evaluates the package everywhere\n * else in the SSR graph, or it runs twice:\n *\n *  - `vite.ssrLoadModule('<external pkg>/backend')` transforms that entry and\n *    its relative imports even though the package is external, while the app's\n *    bare imports of the same package are evaluated by Node — two copies of the\n *    package's module state.\n *  - a plain `import()` of a BUNDLED package goes to Node, while the app's\n *    imports of it are evaluated by Vite — the same split the other way round.\n *\n * Vite matches `noExternal` entries against the bare package name, so a\n * subpath (`pkg/backend`) is covered by an entry for `pkg`.\n */\nexport function isBundledBySsr(pkgName: string, noExternal: unknown): boolean {\n  if (noExternal === true) return true;\n  const entries = Array.isArray(noExternal)\n    ? noExternal\n    : noExternal\n      ? [noExternal]\n      : [];\n  return entries.some((entry) =>\n    typeof entry === 'string'\n      ? entry === pkgName\n      : entry instanceof RegExp\n        ? entry.test(pkgName)\n        : false\n  );\n}\n\n/** The dev SSR runner's resolved `noExternal`, wherever this Vite keeps it. */\nexport function ssrNoExternalOf(vite: any): unknown {\n  return (\n    vite?.config?.ssr?.noExternal ??\n    vite?.config?.environments?.ssr?.resolve?.noExternal\n  );\n}\n\n/**\n * The backend entry of a package the dev Vite runner owns (see isBundledBySsr):\n * its source backend when it is a source package (resolveSourceBackendEntry),\n * otherwise what `exports` names under the `development` condition and Node's\n * import conditions. A registry install has no src/, so it resolves exactly\n * as before.\n */\nexport function resolveDevBackendEntry(\n  pkgRoot: string,\n  pkgJson: any\n): string | null {\n  return (\n    resolveSourceBackendEntry(pkgRoot, pkgJson) ??\n    resolveBackendEntry(pkgRoot, pkgJson, [\n      'development',\n      ...NODE_IMPORT_CONDITIONS,\n    ])\n  );\n}\n"]}
+{"version":3,"file":"linkedDependencies.js","sourceRoot":"","sources":["../../../src/utils/linkedDependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAsB7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAS;IAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAS;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,OAAO,GAAG,IAAI,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,OAAe;IAEf,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,cAAmB;;IAEnB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE;;QAC9C,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO;QAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACvC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,SAAS,CAAC,IAAI,CAAC,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvB,CAAC;QACD,qEAAqE;QACrE,0CAA0C;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,YAAY,mCAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;gBAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAuC,EACvC,cAAoB;IAEpB,MAAM,KAAK,GAA6B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAa,EAAE,IAAS,EAAE,EAAE;;QACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO;QAC9C,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,mCAAI,EAAE,CAAC;gBACxC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,gBAAgB,mCAAI,EAAE,CAAC;aAC7C,CAAC;SACH,CAAC,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;IACF,IAAI,cAAc;QAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,WAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAAY,EACZ,aAAgC,sBAAsB;IAEtD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACtC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAA,KAAK,QAAQ,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,OAAe,EAAE,GAAW;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,YAAiB,EACjB,UAA6B,EAC7B,KAAqC;IAErC,0EAA0E;IAC1E,0CAA0C;IAC1C,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3B,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACzD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,IAAI,MAAW,CAAC;IAChB,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACnC,IACE,OAAO,KAAK,MAAM;gBAClB,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;gBAC5B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxB,CAAC,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EACzD,CAAC;gBACD,OAAO,GAAG,GAAG,CAAC;gBACd,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,CAAM,EAAiB,EAAE;QAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,GAAG,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClD,mEAAmE;oBACnE,sDAAsD;oBACtD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,OAAY;IAEZ,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACtC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,OAAO,oBAAoB,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;;QAC5D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,MAAA,WAAW,CAAC,OAAO,EAAE,IAAI,GAAG,MAAM,CAAC,mCAAI,WAAW,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,UAAmB;IACjE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5B,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK,KAAK,OAAO;QACnB,CAAC,CAAC,KAAK,YAAY,MAAM;YACvB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAS;;IACvC,OAAO,CACL,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,GAAG,0CAAE,UAAU,mCAC7B,MAAA,MAAA,MAAA,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,YAAY,0CAAE,GAAG,0CAAE,OAAO,0CAAE,UAAU,CACrD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,OAAY;;IAEZ,OAAO,CACL,MAAA,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,mCAC3C,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE;QACpC,aAAa;QACb,GAAG,sBAAsB;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\n/**\n * A linked package found in the app's dependency tree, wherever it is\n * installed: a workspace member, a localized checkout, or a registry install.\n */\nexport interface LinkedDependency {\n  packageName: string;\n  /**\n   * Realpath of the package root whose backend the server loads: the copy the\n   * app itself resolves when that copy is a linked package, otherwise the\n   * first copy the walk found.\n   */\n  path: string;\n  /**\n   * Every distinct installed copy of this package in the tree (realpaths),\n   * in the order the walk found them. More than one means the install is not\n   * deduplicated; only `path`'s backend is ever loaded.\n   */\n  copies: { path: string; version?: string }[];\n}\n\n/**\n * A package whose backend providers the server loads at boot: one whose\n * package.json declares `\"linkedPackage\": true`. That flag is the only test —\n * not the package's scope. `@_linked/localize` is in the `@_linked` scope and\n * is a CLI tool, not a linked package; a custom-scope package with the flag is\n * a linked package. The CLI's workspace discovery uses the same flag.\n *\n * The legacy `\"lincd\": true` flag is deliberately NOT enough. Those packages\n * import the old `lincd` core, and loading them at boot is what produced\n * \"Multiple versions of LINCD are loaded\" before boot loading was narrowed to\n * workspace members.\n */\nexport function isLinkedPackageJson(json: any): boolean {\n  if (!json || typeof json.name !== 'string') return false;\n  return json.linkedPackage === true;\n}\n\n/**\n * Find an installed package the way Node does: `<dir>/node_modules/<name>`,\n * then each parent directory's `node_modules`. Returns null when it is not\n * installed (an optional dependency, say) rather than throwing.\n */\n/**\n * Whether a package has a JavaScript entry the server can import: `main`,\n * `module`, or an `exports` map with a root (`.`) entry or a single string.\n * A linked package can be pure CSS (`@_linked/css`); importing that whole\n * fails with \"Failed to resolve entry\", so the server skips it.\n */\nexport function hasModuleEntry(json: any): boolean {\n  if (!json) return false;\n  if (typeof json.main === 'string' || typeof json.module === 'string') {\n    return true;\n  }\n  const exp = json.exports;\n  if (typeof exp === 'string') return true;\n  if (exp && typeof exp === 'object') {\n    const keys = Object.keys(exp);\n    // Conditions only ({import, require, ...}) describe the root entry.\n    if (keys.length > 0 && keys.every((k) => !k.startsWith('.'))) return true;\n    return '.' in exp;\n  }\n  return false;\n}\n\nexport function readInstalledPackage(\n  name: string,\n  fromDir: string\n): { root: string; json: any } | null {\n  let dir = path.resolve(fromDir);\n  while (true) {\n    const root = path.join(dir, 'node_modules', name);\n    const pkgJsonPath = path.join(root, 'package.json');\n    if (fs.existsSync(pkgJsonPath)) {\n      try {\n        return { root, json: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')) };\n      } catch {\n        return null;\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\n/**\n * Every linked package reachable from the app's `dependencies`, each one AFTER\n * the linked packages it depends on. Providers register middleware in the\n * order they are indexed, so a package's middleware must not run before that\n * of a package it builds on (e.g. anything reading `request.linkedAuth` after\n * @_linked/auth's JWT middleware).\n *\n * Only linked packages are recursed into — the same rule the workspace-only\n * filter used — so the walk reads a few dozen package.json files, not the\n * whole of node_modules. Each package's dependencies are resolved from its\n * REAL location, so a symlinked workspace or localized checkout resolves its\n * own dependencies the way Node will when it loads it — which is how a\n * package installed only nested (`owl/node_modules/@_linked/rdfs`) is found.\n *\n * The walk is keyed by real path, not name, so every installed copy of a\n * package is recorded (`copies`). The copy whose backend is loaded (`path`)\n * is the one the app itself resolves, so it is the same module instance the\n * app's own imports reach; when the app cannot resolve the package at all\n * (it is only installed nested) it is the first copy found.\n */\nexport function discoverLinkedDependencies(\n  appDir: string,\n  appPackageJson: any\n): LinkedDependency[] {\n  const out: LinkedDependency[] = [];\n  const byName = new Map<string, LinkedDependency>();\n  const visitedRoots = new Set<string>();\n  const appName = appPackageJson?.name;\n\n  const visit = (name: string, fromDir: string) => {\n    if (name === appName) return;\n    const installed = readInstalledPackage(name, fromDir);\n    if (!installed || !isLinkedPackageJson(installed.json)) return;\n    const realRoot = realpathOr(installed.root);\n    if (visitedRoots.has(realRoot)) return;\n    visitedRoots.add(realRoot);\n    let entry = byName.get(name);\n    if (!entry) {\n      entry = { packageName: name, path: realRoot, copies: [] };\n      byName.set(name, entry);\n    }\n    entry.copies.push({ path: realRoot, version: installed.json.version });\n    for (const dep of Object.keys(installed.json.dependencies ?? {})) {\n      visit(dep, realRoot);\n    }\n    // Pushed after its dependencies, once per name: the first copy found\n    // fixes the package's place in the order.\n    if (!out.includes(entry)) out.push(entry);\n  };\n\n  for (const name of Object.keys(appPackageJson?.dependencies ?? {})) {\n    visit(name, appDir);\n  }\n\n  for (const entry of out) {\n    if (entry.copies.length < 2) continue;\n    const fromApp = readInstalledPackage(entry.packageName, appDir);\n    if (fromApp && isLinkedPackageJson(fromApp.json)) {\n      const appCopy = realpathOr(fromApp.root);\n      if (entry.copies.some((c) => c.path === appCopy)) entry.path = appCopy;\n    }\n  }\n  return out;\n}\n\n/**\n * Package name → the names of its direct `dependencies` and `peerDependencies`, for the app\n * (`appPackageJson`) and every package in `packageDirs` (name → package root, as discovery\n * found it). The shape check scopes its direction-I errors with it. A package whose\n * `package.json` cannot be read is left out.\n */\nexport function readDependencyLists(\n  packageDirs: Iterable<[string, string]>,\n  appPackageJson?: any\n): Record<string, string[]> {\n  const lists: Record<string, string[]> = {};\n  const add = (name: unknown, json: any) => {\n    if (typeof name !== 'string' || !name) return;\n    lists[name] = [\n      ...new Set([\n        ...Object.keys(json?.dependencies ?? {}),\n        ...Object.keys(json?.peerDependencies ?? {}),\n      ]),\n    ].sort();\n  };\n  if (appPackageJson) add(appPackageJson.name, appPackageJson);\n  for (const [name, dir] of packageDirs) {\n    try {\n      add(name, JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8')));\n    } catch {}\n  }\n  return lists;\n}\n\nfunction realpathOr(p: string): string {\n  try {\n    return fs.realpathSync(p);\n  } catch {\n    return p;\n  }\n}\n\n/**\n * The conditions a backend entry is resolved with on the Node path. These are\n * the ones Node's ESM loader applies to `import()` — so the file found is the\n * file a bare `import('<pkg>/backend')` from the app would load, and Node's\n * module cache (keyed by real file URL) hands both the same instance.\n * `development` is deliberately absent: it is a Vite/bundler condition, and a\n * production Node runtime never applies it.\n */\nexport const NODE_IMPORT_CONDITIONS = ['import', 'node', 'default'] as const;\n\n/**\n * The absolute path of a package's backend entry file, or null when the\n * package has no backend entry or the file it names does not exist.\n *\n * With `exports`, this follows Node's PACKAGE_EXPORTS_RESOLVE for the\n * `./backend` subpath: an exact `./backend` key wins; otherwise the `./*`-style\n * pattern with the longest matching prefix; condition objects (nested or not)\n * pick the first key that is one of `conditions` or `default`; arrays take the\n * first target that resolves. A package that has `exports` but nothing\n * matching `./backend` has no backend — exactly as Node would refuse to\n * import it.\n *\n * Without `exports`, the legacy layout: `<root>/backend.js`,\n * `<root>/backend/index.js`, and the layout linked packages build to — a\n * `backend.js` next to `main` (`lib/esm/backend.js`).\n *\n * Hand-written rather than via `resolve.exports`: that package also stops at\n * a path and leaves the existence check to the caller, the subset needed is\n * ~50 lines, and the server keeps one less dependency in every app's install.\n */\nexport function resolveBackendEntry(\n  pkgRoot: string,\n  pkgJson: any,\n  conditions: readonly string[] = NODE_IMPORT_CONDITIONS\n): string | null {\n  const exists = (rel: string) => packageFile(pkgRoot, rel);\n  const exportsField = pkgJson?.exports;\n  if (exportsField === undefined || exportsField === null) {\n    const candidates = ['backend.js', 'backend/index.js'];\n    if (typeof pkgJson?.main === 'string') {\n      candidates.push(path.join(path.dirname(pkgJson.main), 'backend.js'));\n    }\n    candidates.push('lib/esm/backend.js');\n    for (const rel of candidates) {\n      const file = exists(rel);\n      if (file) return file;\n    }\n    return null;\n  }\n  return resolveBackendExport(exportsField, conditions, exists);\n}\n\n/** `<pkgRoot>/<rel>` when it is a file inside the package, else null. */\nfunction packageFile(pkgRoot: string, rel: string): string | null {\n  const file = path.resolve(pkgRoot, rel);\n  // Never let an export target escape the package.\n  if (!file.startsWith(path.resolve(pkgRoot) + path.sep)) return null;\n  try {\n    return fs.statSync(file).isFile() ? file : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The `./backend` subpath of an `exports` map, resolved per Node's\n * PACKAGE_EXPORTS_RESOLVE (see resolveBackendEntry). `probe` turns a matched\n * `./`-relative target into a file, or null when it does not resolve.\n */\nfunction resolveBackendExport(\n  exportsField: any,\n  conditions: readonly string[],\n  probe: (rel: string) => string | null\n): string | null {\n  // `\"exports\": \"./x.js\"`, an array, or a condition object at the top level\n  // are all sugar for the \".\" subpath only.\n  if (\n    typeof exportsField !== 'object' ||\n    Array.isArray(exportsField) ||\n    !Object.keys(exportsField).some((k) => k.startsWith('.'))\n  ) {\n    return null;\n  }\n\n  const subpath = './backend';\n  let target: any;\n  let patternMatch: string | null = null;\n  if (Object.prototype.hasOwnProperty.call(exportsField, subpath)) {\n    target = exportsField[subpath];\n  } else {\n    let bestKey: string | null = null;\n    for (const key of Object.keys(exportsField)) {\n      const star = key.indexOf('*');\n      if (star === -1 || key.indexOf('*', star + 1) !== -1) continue;\n      const prefix = key.slice(0, star);\n      const suffix = key.slice(star + 1);\n      if (\n        subpath !== prefix &&\n        subpath.length >= key.length &&\n        subpath.startsWith(prefix) &&\n        subpath.endsWith(suffix) &&\n        (bestKey === null || patternKeyCompare(bestKey, key) > 0)\n      ) {\n        bestKey = key;\n        patternMatch = subpath.slice(prefix.length, subpath.length - suffix.length);\n      }\n    }\n    if (bestKey === null) return null;\n    target = exportsField[bestKey];\n  }\n\n  const resolveTarget = (t: any): string | null => {\n    if (typeof t === 'string') {\n      if (!t.startsWith('./')) return null;\n      const rel = patternMatch === null ? t : t.split('*').join(patternMatch);\n      return probe(rel);\n    }\n    if (Array.isArray(t)) {\n      for (const item of t) {\n        const file = resolveTarget(item);\n        if (file) return file;\n      }\n      return null;\n    }\n    if (t && typeof t === 'object') {\n      for (const key of Object.keys(t)) {\n        if (key === 'default' || conditions.includes(key)) {\n          // Node takes the first matching condition even if its target fails\n          // to resolve; it does not fall through to later keys.\n          return resolveTarget(t[key]);\n        }\n      }\n    }\n    return null;\n  };\n  return resolveTarget(target);\n}\n\n/**\n * The SOURCE file a dev Vite runner loads for `<pkg>/backend` when the\n * package is a source package — its real root has a `src/` directory, which is\n * what makes `linked`'s Vite config register it as a workspace (cli\n * `discoverWorkspaces` / `readSourcePackage`). Null when the package has no\n * `src/` or no source backend; the caller then falls back to\n * resolveBackendEntry (a built `lib/` copy, or nothing).\n *\n * Mirrors the cli's `resolveWorkspaceSpecifier` for the `./backend` subpath,\n * which runs BEFORE `exports`: `src/backend.tsx`, `src/backend.ts`, then the\n * package's own `exports` under `import`/`default` with a `./lib/esm/X.js`\n * target mapped to `src/X.tsx` / `src/X.ts` (any other `./lib/esm/` target to\n * the same path under src). So an unbuilt workspace, whose `exports` name only\n * `lib/esm`, still has its backend found, and a built one reports the src file\n * Vite actually evaluates rather than its stale `lib/`.\n *\n * Only meaningful when the dev Vite runner owns the package; Node (production,\n * external packages) loads `lib/` and never sees src.\n */\nexport function resolveSourceBackendEntry(\n  pkgRoot: string,\n  pkgJson: any\n): string | null {\n  try {\n    if (!fs.statSync(path.join(pkgRoot, 'src')).isDirectory()) return null;\n  } catch {\n    return null;\n  }\n  for (const rel of ['src/backend.tsx', 'src/backend.ts']) {\n    const file = packageFile(pkgRoot, rel);\n    if (file) return file;\n  }\n  const exportsField = pkgJson?.exports;\n  if (exportsField === undefined || exportsField === null) return null;\n  const libPrefix = './lib/esm/';\n  return resolveBackendExport(exportsField, ['import'], (rel) => {\n    if (!rel.startsWith(libPrefix)) return null;\n    const sub = rel.slice(libPrefix.length);\n    if (/\\.jsx?$/.test(sub)) {\n      const base = 'src/' + sub.replace(/\\.jsx?$/, '');\n      return packageFile(pkgRoot, base + '.tsx') ?? packageFile(pkgRoot, base + '.ts');\n    }\n    return packageFile(pkgRoot, 'src/' + sub);\n  });\n}\n\n/** Node's PATTERN_KEY_COMPARE: < 0 means `a` is the more specific pattern. */\nfunction patternKeyCompare(a: string, b: string): number {\n  const aBase = a.indexOf('*');\n  const bBase = b.indexOf('*');\n  const baseA = aBase === -1 ? a.length : aBase + 1;\n  const baseB = bBase === -1 ? b.length : bBase + 1;\n  if (baseA > baseB) return -1;\n  if (baseB > baseA) return 1;\n  if (aBase === -1) return 1;\n  if (bBase === -1) return -1;\n  if (a.length > b.length) return -1;\n  if (b.length > a.length) return 1;\n  return 0;\n}\n\n/**\n * Whether the dev SSR runner BUNDLES `pkgName` (it is in Vite's\n * `ssr.noExternal`) rather than handing it to Node.\n *\n * This decides which loader a package's backend must be loaded with. A module\n * has to be evaluated by the same loader that evaluates the package everywhere\n * else in the SSR graph, or it runs twice:\n *\n *  - `vite.ssrLoadModule('<external pkg>/backend')` transforms that entry and\n *    its relative imports even though the package is external, while the app's\n *    bare imports of the same package are evaluated by Node — two copies of the\n *    package's module state.\n *  - a plain `import()` of a BUNDLED package goes to Node, while the app's\n *    imports of it are evaluated by Vite — the same split the other way round.\n *\n * Vite matches `noExternal` entries against the bare package name, so a\n * subpath (`pkg/backend`) is covered by an entry for `pkg`.\n */\nexport function isBundledBySsr(pkgName: string, noExternal: unknown): boolean {\n  if (noExternal === true) return true;\n  const entries = Array.isArray(noExternal)\n    ? noExternal\n    : noExternal\n      ? [noExternal]\n      : [];\n  return entries.some((entry) =>\n    typeof entry === 'string'\n      ? entry === pkgName\n      : entry instanceof RegExp\n        ? entry.test(pkgName)\n        : false\n  );\n}\n\n/** The dev SSR runner's resolved `noExternal`, wherever this Vite keeps it. */\nexport function ssrNoExternalOf(vite: any): unknown {\n  return (\n    vite?.config?.ssr?.noExternal ??\n    vite?.config?.environments?.ssr?.resolve?.noExternal\n  );\n}\n\n/**\n * The backend entry of a package the dev Vite runner owns (see isBundledBySsr):\n * its source backend when it is a source package (resolveSourceBackendEntry),\n * otherwise what `exports` names under the `development` condition and Node's\n * import conditions. A registry install has no src/, so it resolves exactly\n * as before.\n */\nexport function resolveDevBackendEntry(\n  pkgRoot: string,\n  pkgJson: any\n): string | null {\n  return (\n    resolveSourceBackendEntry(pkgRoot, pkgJson) ??\n    resolveBackendEntry(pkgRoot, pkgJson, [\n      'development',\n      ...NODE_IMPORT_CONDITIONS,\n    ])\n  );\n}\n"]}

package/lib/esm/utils/ontologySync.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Ontology sync and the shape check, as the server runs them before its shape sync: at boot and
+ * when the host asks for a re-sync (`POST /admin/sync-shapes`).
+ *
+ * - The ontology sync (core `syncOntologies`) writes each registered package's
+ *   `rdfs:subClassOf` triples into the app's default dataset, skipping a package whose stored
+ *   hash matches, so the store's RDFS view infers the class hierarchy.
+ * - The shape check (core `checkShapeHierarchy`) compares the registered shapes with that
+ *   hierarchy. A running app is never stopped by it: its findings are logged and counted.
+ * - The in-memory class hierarchy (core `loadOntologyHierarchy`) is loaded also when the sync
+ *   is off; the sync loads it itself when it runs.
+ * - Before either, every linked package directory the server discovered registers its ontologies
+ *   (core `registerInstalledOntologies`): a package the app only deep-imports shape files from
+ *   never evaluates its register modules, so its data would be missing from both. A source
+ *   package without built register modules (a workspace package in dev) registers through
+ *   `importModule` (Vite's `ssrLoadModule`), when the caller passes one.
+ *
+ * The four core modules (`ontology/syncOntologies`, `shapes/checkShapeHierarchy`,
+ * `ontology/hierarchy`, `ontology/registerInstalled`) are server only and not in core's index, so
+ * {@link loadOntologyCore} imports them by their fixed subpaths when the phase runs; the core
+ * this server depends on has all of them. Kept apart from `LinkedServer` so the order and the failure handling can be tested without
+ * booting a server.
+ */
+import type { BootOrphanScope } from './syncShapes.js';
+/** The subset of core's ontology and shape-check API this module calls. */
+export interface OntologyCore {
+    syncOntologies(ds: unknown, options: {
+        orphanScope: BootOrphanScope;
+    }): Promise<{
+        written: string[];
+        skipped: string[];
+        pruned: string[];
+    }>;
+    checkShapeHierarchy(options: {
+        dependencies?: Record<string, string[]>;
+    }): Promise<Array<{
+        kind: string;
+        severity: 'error' | 'warning';
+        shape?: string;
+        iri?: string;
+        message: string;
+    }>>;
+    /** Loads the in-memory class hierarchy. Optional so a test double can leave it out. */
+    loadOntologyHierarchy?: () => Promise<unknown>;
+    /**
+     * Registers the ontologies of the installed packages in the given directories. Optional so a
+     * test double can leave it out.
+     */
+    registerInstalledOntologies?: (packageDirs: string[], options?: {
+        importModule?: (file: string) => Promise<unknown>;
+    }) => Promise<string[]>;
+}
+/** What the ontology sync and the shape check did, as `POST /admin/sync-shapes` reports it. */
+export interface OntologyPhaseResult {
+    /** Packages whose hierarchy was written, and packages left as they were (unchanged or unreadable). */
+    ontologies: {
+        written: string[];
+        skipped: string[];
+    };
+    /** The shape check's findings, counted by severity. */
+    shapeCheck: {
+        errors: number;
+        warnings: number;
+    };
+    /** The first error the sync or the check threw; the phase went on without it. */
+    failure?: Error;
+}
+/**
+ * Whether the server syncs shapes (and so ontologies) into its app data: off when `linked.config`
+ * sets `syncShapesOnBoot: false` or the environment sets `LINKED_SYNC_SHAPES_ON_BOOT=false`. One
+ * switch for both syncs, at boot and on the host's request.
+ */
+export declare function shapeSyncOn(env: Record<string, string | undefined>, configFlag: unknown): boolean;
+/**
+ * Whether the boot syncs ontologies: when shape sync is on ({@link shapeSyncOn}) and the
+ * environment does not opt out with `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`.
+ */
+export declare function bootSyncsOntologies(env: Record<string, string | undefined>, configFlag?: unknown): boolean;
+/**
+ * Import core's ontology sync, shape check, hierarchy loader and installed packages'
+ * registration.
+ */
+export declare function loadOntologyCore(): Promise<OntologyCore>;
+/**
+ * The package directories whose ontologies register before the sync: every linked package
+ * discovered in the app's dependency tree, then the app's own workspace packages (a CN clone's
+ * `packages/<slug>-ont` is one no package imports, so the dependency walk never reaches it).
+ * Order kept, duplicates dropped.
+ */
+export declare function ontologyPackageDirs(linkedPackageDirs: Iterable<string>, workspacePackageDirs: Iterable<string>): string[];
+/**
+ * In dev, the loader for source register modules: Vite's `ssrLoadModule`, so a workspace package
+ * that was never built registers on the core the SSR graph uses. Undefined without Vite (a built
+ * app), where source packages are skipped.
+ */
+export declare function sourceModuleImporter(vite: {
+    ssrLoadModule?: (url: string) => Promise<unknown>;
+} | undefined | null): ((file: string) => Promise<unknown>) | undefined;
+/**
+ * Register the ontologies of the installed linked packages in `packageDirs` (package roots), sync
+ * the registered ontologies into `ds` (when `sync` is set and there is a dataset), then run the
+ * shape check. Never throws: a failed registration is logged and the phase goes on; a failed sync is logged and returned as `failure`, and the
+ * check still runs; a failed check likewise. Logs one line for the sync, one summary line for
+ * the check and one line per finding.
+ */
+export declare function runOntologyPhase(ds: unknown, { core, sync, orphanScope, dependencies, packageDirs, importModule, log, warn, }: {
+    core: OntologyCore;
+    sync: boolean;
+    orphanScope: BootOrphanScope;
+    dependencies?: Record<string, string[]>;
+    /** Every linked package directory the server discovered (transitively). */
+    packageDirs?: string[];
+    /**
+     * Imports a source register module (`src/ontologies/*.register.ts`) of a package directory
+     * without built ones; in dev, Vite's `ssrLoadModule`.
+     */
+    importModule?: (file: string) => Promise<unknown>;
+    log?: (message: string) => void;
+    warn?: (message: string, err?: unknown) => void;
+}): Promise<OntologyPhaseResult>;
+/**
+ * The host's re-sync: the ontology phase, then the shape sync, which runs also when the ontology
+ * phase failed. The ontology phase's failure is then thrown, so the route answers with it, as
+ * it does for a failed shape sync.
+ */
+export declare function syncOntologiesThenShapes<T extends object>(ontologyPhase: () => Promise<OntologyPhaseResult>, shapeSync: () => Promise<T>): Promise<T & Pick<OntologyPhaseResult, 'ontologies' | 'shapeCheck'>>;

package/lib/esm/utils/ontologySync.js

@@ -0,0 +1,124 @@
+/**
+ * Whether the server syncs shapes (and so ontologies) into its app data: off when `linked.config`
+ * sets `syncShapesOnBoot: false` or the environment sets `LINKED_SYNC_SHAPES_ON_BOOT=false`. One
+ * switch for both syncs, at boot and on the host's request.
+ */
+export function shapeSyncOn(env, configFlag) {
+    return configFlag !== false && env.LINKED_SYNC_SHAPES_ON_BOOT !== 'false';
+}
+/**
+ * Whether the boot syncs ontologies: when shape sync is on ({@link shapeSyncOn}) and the
+ * environment does not opt out with `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`.
+ */
+export function bootSyncsOntologies(env, configFlag) {
+    return shapeSyncOn(env, configFlag) && env.LINKED_SYNC_ONTOLOGIES_ON_BOOT !== 'false';
+}
+/**
+ * Import core's ontology sync, shape check, hierarchy loader and installed packages'
+ * registration.
+ */
+export async function loadOntologyCore() {
+    const sync = await import('@_linked/core/ontology/syncOntologies');
+    const check = await import('@_linked/core/shapes/checkShapeHierarchy');
+    const hierarchy = await import('@_linked/core/ontology/hierarchy');
+    const registerInstalled = await import('@_linked/core/ontology/registerInstalled');
+    return {
+        syncOntologies: (ds, options) => sync.syncOntologies(ds, options),
+        checkShapeHierarchy: (options) => check.checkShapeHierarchy(options),
+        loadOntologyHierarchy: () => hierarchy.loadOntologyHierarchy(),
+        registerInstalledOntologies: (packageDirs, options) => registerInstalled.registerInstalledOntologies(packageDirs, options),
+    };
+}
+/**
+ * The package directories whose ontologies register before the sync: every linked package
+ * discovered in the app's dependency tree, then the app's own workspace packages (a CN clone's
+ * `packages/<slug>-ont` is one no package imports, so the dependency walk never reaches it).
+ * Order kept, duplicates dropped.
+ */
+export function ontologyPackageDirs(linkedPackageDirs, workspacePackageDirs) {
+    return [...new Set([...linkedPackageDirs, ...workspacePackageDirs])];
+}
+/**
+ * In dev, the loader for source register modules: Vite's `ssrLoadModule`, so a workspace package
+ * that was never built registers on the core the SSR graph uses. Undefined without Vite (a built
+ * app), where source packages are skipped.
+ */
+export function sourceModuleImporter(vite) {
+    const ssrLoadModule = vite === null || vite === void 0 ? void 0 : vite.ssrLoadModule;
+    return typeof ssrLoadModule === 'function' ? (file) => ssrLoadModule.call(vite, file) : undefined;
+}
+const asError = (err) => (err instanceof Error ? err : new Error(String(err)));
+const list = (names) => (names.length ? names.join(', ') : 'none');
+/**
+ * Register the ontologies of the installed linked packages in `packageDirs` (package roots), sync
+ * the registered ontologies into `ds` (when `sync` is set and there is a dataset), then run the
+ * shape check. Never throws: a failed registration is logged and the phase goes on; a failed sync is logged and returned as `failure`, and the
+ * check still runs; a failed check likewise. Logs one line for the sync, one summary line for
+ * the check and one line per finding.
+ */
+export async function runOntologyPhase(ds, { core, sync, orphanScope, dependencies, packageDirs = [], importModule, log = console.log, warn = console.warn, }) {
+    var _a;
+    const result = {
+        ontologies: { written: [], skipped: [] },
+        shapeCheck: { errors: 0, warnings: 0 },
+    };
+    if (core.registerInstalledOntologies && packageDirs.length) {
+        try {
+            if (importModule)
+                await core.registerInstalledOntologies(packageDirs, { importModule });
+            else
+                await core.registerInstalledOntologies(packageDirs);
+        }
+        catch (err) {
+            warn("[LinkedServer] registering the installed packages' ontologies failed:", err);
+        }
+    }
+    let hierarchyLoaded = false;
+    if (sync && ds) {
+        try {
+            const { written, skipped, pruned } = await core.syncOntologies(ds, { orphanScope });
+            result.ontologies = { written, skipped };
+            hierarchyLoaded = true;
+            log(`[LinkedServer] ontology sync: written ${list(written)}; skipped ${list(skipped)}` +
+                (orphanScope === 'all' ? `; pruned ${list(pruned)}` : ''));
+        }
+        catch (err) {
+            result.failure = asError(err);
+            warn('[LinkedServer] ontology sync failed:', err);
+        }
+    }
+    if (!hierarchyLoaded && core.loadOntologyHierarchy) {
+        try {
+            await core.loadOntologyHierarchy();
+        }
+        catch (err) {
+            warn('[LinkedServer] loading the class hierarchy failed:', err);
+        }
+    }
+    try {
+        const findings = await core.checkShapeHierarchy({ dependencies });
+        const errors = findings.filter((f) => f.severity === 'error').length;
+        result.shapeCheck = { errors, warnings: findings.length - errors };
+        log(`[LinkedServer] shape check: ${errors} error(s), ${findings.length - errors} warning(s)`);
+        for (const f of findings)
+            warn(`[LinkedServer] shape check ${f.severity} (${f.kind}): ${f.message}`);
+    }
+    catch (err) {
+        (_a = result.failure) !== null && _a !== void 0 ? _a : (result.failure = asError(err));
+        warn('[LinkedServer] shape check failed:', err);
+    }
+    return result;
+}
+/**
+ * The host's re-sync: the ontology phase, then the shape sync, which runs also when the ontology
+ * phase failed. The ontology phase's failure is then thrown, so the route answers with it, as
+ * it does for a failed shape sync.
+ */
+export async function syncOntologiesThenShapes(ontologyPhase, shapeSync) {
+    const { ontologies, shapeCheck, failure } = await ontologyPhase();
+    const shapes = await shapeSync();
+    if (failure)
+        throw failure;
+    return { ...shapes, ontologies, shapeCheck };
+}
+//# sourceMappingURL=ontologySync.js.map

package/lib/esm/utils/ontologySync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ontologySync.js","sourceRoot":"","sources":["../../../src/utils/ontologySync.ts"],"names":[],"mappings":"AAwDA;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,GAAuC,EACvC,UAAmB;IAEnB,OAAO,UAAU,KAAK,KAAK,IAAI,GAAG,CAAC,0BAA0B,KAAK,OAAO,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAuC,EACvC,UAAoB;IAEpB,OAAO,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,8BAA8B,KAAK,OAAO,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IACnF,OAAO;QACL,cAAc,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,CAAC,cAAc,CAAC,EAA+C,EAAE,OAAO,CAAC;QAC/E,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpE,qBAAqB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,qBAAqB,EAAE;QAC9D,2BAA2B,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CACpD,iBAAiB,CAAC,2BAA2B,CAAC,WAAW,EAAE,OAAO,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,iBAAmC,EACnC,oBAAsC;IAEtC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA4E;IAE5E,MAAM,aAAa,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,aAAa,CAAC;IAC1C,OAAO,OAAO,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAAY,EAAS,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/F,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAW,EACX,EACE,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,YAAY,EACZ,WAAW,GAAG,EAAE,EAChB,YAAY,EACZ,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,IAAI,GAAG,OAAO,CAAC,IAAI,GAepB;;IAED,MAAM,MAAM,GAAwB;QAClC,UAAU,EAAE,EAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAC;QACtC,UAAU,EAAE,EAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAC;KACrC,CAAC;IAEF,IAAI,IAAI,CAAC,2BAA2B,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,IAAI,YAAY;gBAAE,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,EAAE,EAAC,YAAY,EAAC,CAAC,CAAC;;gBACjF,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,uEAAuE,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAC,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAC,WAAW,EAAC,CAAC,CAAC;YAChF,MAAM,CAAC,UAAU,GAAG,EAAC,OAAO,EAAE,OAAO,EAAC,CAAC;YACvC,eAAe,GAAG,IAAI,CAAC;YACvB,GAAG,CACD,yCAAyC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,EAAE;gBAChF,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAC,YAAY,EAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;QACrE,MAAM,CAAC,UAAU,GAAG,EAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAC,CAAC;QACjE,GAAG,CAAC,+BAA+B,MAAM,cAAc,QAAQ,CAAC,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAA,MAAM,CAAC,OAAO,oCAAd,MAAM,CAAC,OAAO,GAAK,OAAO,CAAC,GAAG,CAAC,EAAC;QAChC,IAAI,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAiD,EACjD,SAA2B;IAE3B,MAAM,EAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;IAC3B,OAAO,EAAC,GAAG,MAAM,EAAE,UAAU,EAAE,UAAU,EAAC,CAAC;AAC7C,CAAC","sourcesContent":["/**\n * Ontology sync and the shape check, as the server runs them before its shape sync: at boot and\n * when the host asks for a re-sync (`POST /admin/sync-shapes`).\n *\n * - The ontology sync (core `syncOntologies`) writes each registered package's\n *   `rdfs:subClassOf` triples into the app's default dataset, skipping a package whose stored\n *   hash matches, so the store's RDFS view infers the class hierarchy.\n * - The shape check (core `checkShapeHierarchy`) compares the registered shapes with that\n *   hierarchy. A running app is never stopped by it: its findings are logged and counted.\n * - The in-memory class hierarchy (core `loadOntologyHierarchy`) is loaded also when the sync\n *   is off; the sync loads it itself when it runs.\n * - Before either, every linked package directory the server discovered registers its ontologies\n *   (core `registerInstalledOntologies`): a package the app only deep-imports shape files from\n *   never evaluates its register modules, so its data would be missing from both. A source\n *   package without built register modules (a workspace package in dev) registers through\n *   `importModule` (Vite's `ssrLoadModule`), when the caller passes one.\n *\n * The four core modules (`ontology/syncOntologies`, `shapes/checkShapeHierarchy`,\n * `ontology/hierarchy`, `ontology/registerInstalled`) are server only and not in core's index, so\n * {@link loadOntologyCore} imports them by their fixed subpaths when the phase runs; the core\n * this server depends on has all of them. Kept apart from `LinkedServer` so the order and the failure handling can be tested without\n * booting a server.\n */\nimport type {BootOrphanScope} from './syncShapes.js';\n\n/** The subset of core's ontology and shape-check API this module calls. */\nexport interface OntologyCore {\n  syncOntologies(\n    ds: unknown,\n    options: {orphanScope: BootOrphanScope},\n  ): Promise<{written: string[]; skipped: string[]; pruned: string[]}>;\n  checkShapeHierarchy(options: {dependencies?: Record<string, string[]>}): Promise<\n    Array<{kind: string; severity: 'error' | 'warning'; shape?: string; iri?: string; message: string}>\n  >;\n  /** Loads the in-memory class hierarchy. Optional so a test double can leave it out. */\n  loadOntologyHierarchy?: () => Promise<unknown>;\n  /**\n   * Registers the ontologies of the installed packages in the given directories. Optional so a\n   * test double can leave it out.\n   */\n  registerInstalledOntologies?: (\n    packageDirs: string[],\n    options?: {importModule?: (file: string) => Promise<unknown>},\n  ) => Promise<string[]>;\n}\n\n/** What the ontology sync and the shape check did, as `POST /admin/sync-shapes` reports it. */\nexport interface OntologyPhaseResult {\n  /** Packages whose hierarchy was written, and packages left as they were (unchanged or unreadable). */\n  ontologies: {written: string[]; skipped: string[]};\n  /** The shape check's findings, counted by severity. */\n  shapeCheck: {errors: number; warnings: number};\n  /** The first error the sync or the check threw; the phase went on without it. */\n  failure?: Error;\n}\n\n/**\n * Whether the server syncs shapes (and so ontologies) into its app data: off when `linked.config`\n * sets `syncShapesOnBoot: false` or the environment sets `LINKED_SYNC_SHAPES_ON_BOOT=false`. One\n * switch for both syncs, at boot and on the host's request.\n */\nexport function shapeSyncOn(\n  env: Record<string, string | undefined>,\n  configFlag: unknown,\n): boolean {\n  return configFlag !== false && env.LINKED_SYNC_SHAPES_ON_BOOT !== 'false';\n}\n\n/**\n * Whether the boot syncs ontologies: when shape sync is on ({@link shapeSyncOn}) and the\n * environment does not opt out with `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`.\n */\nexport function bootSyncsOntologies(\n  env: Record<string, string | undefined>,\n  configFlag?: unknown,\n): boolean {\n  return shapeSyncOn(env, configFlag) && env.LINKED_SYNC_ONTOLOGIES_ON_BOOT !== 'false';\n}\n\n/**\n * Import core's ontology sync, shape check, hierarchy loader and installed packages'\n * registration.\n */\nexport async function loadOntologyCore(): Promise<OntologyCore> {\n  const sync = await import('@_linked/core/ontology/syncOntologies');\n  const check = await import('@_linked/core/shapes/checkShapeHierarchy');\n  const hierarchy = await import('@_linked/core/ontology/hierarchy');\n  const registerInstalled = await import('@_linked/core/ontology/registerInstalled');\n  return {\n    syncOntologies: (ds, options) =>\n      sync.syncOntologies(ds as Parameters<typeof sync.syncOntologies>[0], options),\n    checkShapeHierarchy: (options) => check.checkShapeHierarchy(options),\n    loadOntologyHierarchy: () => hierarchy.loadOntologyHierarchy(),\n    registerInstalledOntologies: (packageDirs, options) =>\n      registerInstalled.registerInstalledOntologies(packageDirs, options),\n  };\n}\n\n/**\n * The package directories whose ontologies register before the sync: every linked package\n * discovered in the app's dependency tree, then the app's own workspace packages (a CN clone's\n * `packages/<slug>-ont` is one no package imports, so the dependency walk never reaches it).\n * Order kept, duplicates dropped.\n */\nexport function ontologyPackageDirs(\n  linkedPackageDirs: Iterable<string>,\n  workspacePackageDirs: Iterable<string>,\n): string[] {\n  return [...new Set([...linkedPackageDirs, ...workspacePackageDirs])];\n}\n\n/**\n * In dev, the loader for source register modules: Vite's `ssrLoadModule`, so a workspace package\n * that was never built registers on the core the SSR graph uses. Undefined without Vite (a built\n * app), where source packages are skipped.\n */\nexport function sourceModuleImporter(\n  vite: {ssrLoadModule?: (url: string) => Promise<unknown>} | undefined | null,\n): ((file: string) => Promise<unknown>) | undefined {\n  const ssrLoadModule = vite?.ssrLoadModule;\n  return typeof ssrLoadModule === 'function' ? (file) => ssrLoadModule.call(vite, file) : undefined;\n}\n\nconst asError = (err: unknown): Error => (err instanceof Error ? err : new Error(String(err)));\nconst list = (names: string[]) => (names.length ? names.join(', ') : 'none');\n\n/**\n * Register the ontologies of the installed linked packages in `packageDirs` (package roots), sync\n * the registered ontologies into `ds` (when `sync` is set and there is a dataset), then run the\n * shape check. Never throws: a failed registration is logged and the phase goes on; a failed sync is logged and returned as `failure`, and the\n * check still runs; a failed check likewise. Logs one line for the sync, one summary line for\n * the check and one line per finding.\n */\nexport async function runOntologyPhase(\n  ds: unknown,\n  {\n    core,\n    sync,\n    orphanScope,\n    dependencies,\n    packageDirs = [],\n    importModule,\n    log = console.log,\n    warn = console.warn,\n  }: {\n    core: OntologyCore;\n    sync: boolean;\n    orphanScope: BootOrphanScope;\n    dependencies?: Record<string, string[]>;\n    /** Every linked package directory the server discovered (transitively). */\n    packageDirs?: string[];\n    /**\n     * Imports a source register module (`src/ontologies/*.register.ts`) of a package directory\n     * without built ones; in dev, Vite's `ssrLoadModule`.\n     */\n    importModule?: (file: string) => Promise<unknown>;\n    log?: (message: string) => void;\n    warn?: (message: string, err?: unknown) => void;\n  },\n): Promise<OntologyPhaseResult> {\n  const result: OntologyPhaseResult = {\n    ontologies: {written: [], skipped: []},\n    shapeCheck: {errors: 0, warnings: 0},\n  };\n\n  if (core.registerInstalledOntologies && packageDirs.length) {\n    try {\n      if (importModule) await core.registerInstalledOntologies(packageDirs, {importModule});\n      else await core.registerInstalledOntologies(packageDirs);\n    } catch (err) {\n      warn(\"[LinkedServer] registering the installed packages' ontologies failed:\", err);\n    }\n  }\n\n  let hierarchyLoaded = false;\n  if (sync && ds) {\n    try {\n      const {written, skipped, pruned} = await core.syncOntologies(ds, {orphanScope});\n      result.ontologies = {written, skipped};\n      hierarchyLoaded = true;\n      log(\n        `[LinkedServer] ontology sync: written ${list(written)}; skipped ${list(skipped)}` +\n          (orphanScope === 'all' ? `; pruned ${list(pruned)}` : ''),\n      );\n    } catch (err) {\n      result.failure = asError(err);\n      warn('[LinkedServer] ontology sync failed:', err);\n    }\n  }\n  if (!hierarchyLoaded && core.loadOntologyHierarchy) {\n    try {\n      await core.loadOntologyHierarchy();\n    } catch (err) {\n      warn('[LinkedServer] loading the class hierarchy failed:', err);\n    }\n  }\n\n  try {\n    const findings = await core.checkShapeHierarchy({dependencies});\n    const errors = findings.filter((f) => f.severity === 'error').length;\n    result.shapeCheck = {errors, warnings: findings.length - errors};\n    log(`[LinkedServer] shape check: ${errors} error(s), ${findings.length - errors} warning(s)`);\n    for (const f of findings) warn(`[LinkedServer] shape check ${f.severity} (${f.kind}): ${f.message}`);\n  } catch (err) {\n    result.failure ??= asError(err);\n    warn('[LinkedServer] shape check failed:', err);\n  }\n  return result;\n}\n\n/**\n * The host's re-sync: the ontology phase, then the shape sync, which runs also when the ontology\n * phase failed. The ontology phase's failure is then thrown, so the route answers with it, as\n * it does for a failed shape sync.\n */\nexport async function syncOntologiesThenShapes<T extends object>(\n  ontologyPhase: () => Promise<OntologyPhaseResult>,\n  shapeSync: () => Promise<T>,\n): Promise<T & Pick<OntologyPhaseResult, 'ontologies' | 'shapeCheck'>> {\n  const {ontologies, shapeCheck, failure} = await ontologyPhase();\n  const shapes = await shapeSync();\n  if (failure) throw failure;\n  return {...shapes, ontologies, shapeCheck};\n}\n"]}

package/lib/esm/utils/withTimeout.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Settle with `promise`, or reject with `message` after `ms`. The operation is not
+ * cancelled; the timeout only stops a caller (or a queue) from waiting on it forever.
+ */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number, message: string): Promise<T>;
+/** A positive integer from the environment, else `fallback`. */
+export declare function envMs(name: string, fallback: number, env?: Record<string, string | undefined>): number;