@_linked/server 3.6.1 → 3.8.0

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # @\_linked/server
 
+## 3.8.0
+
+### Minor Changes
+
+- [#204](https://github.com/linked-fw/server/pull/204) [`f1dc1a6`](https://github.com/linked-fw/server/commit/f1dc1a6fec0abae90c711daec51e929a9587b582) Thanks [@flyon](https://github.com/flyon)! - Graph queries through the server (named graphs and the graph registry, `@_linked/core`'s
+  `graphQuery`):
+
+  - `RemoteDataset.graphQuery`: graph queries (`graph_create`, `graph_replace`, `graph_patch`,
+    `graph_drop`) go out on the query wire like every other query, with the same token and
+    end-user header. A refusal comes back as core's `GraphQueryError` with its code; a server or
+    gateway without the method (404, 501) reads as `unsupported-query-kind`, so the ontology sync
+    falls back to the default graph there.
+  - In the url form, `RemoteDataset` expands `graphs.allOntologies` and `graphs.allShapes` in a
+    read's `.from()` set from its own graph-registry cache (per dataset, keyed by the url and the
+    dataset the server names in its `ping`, updated by its own graph queries, re-read after 30
+    seconds); `invalidateGraphRegistry(dataset?)` drops it. When the registry cannot be read, the
+    names are sent unexpanded.
+  - The generic plane answers `/call/@_linked/server/graphQuery`: the body is checked with core's
+    `parseGraphQuery`, the `graph` rule of the store its record class routes to decides
+    (`withAccess({graph})`; no rule refuses with 403), and `LinkedStorage.graphQuery` runs it. A
+    store's refusal answers with a status and its code: `{error, code}` (409 `graph-exists`, 409
+    `graph-not-registered`, 400 `graph-name-read-only`, 501 `unsupported-query-kind`). Any
+    `ServerCallError` carrying a string `code` now sends it in the error body.
+  - Control channel: `POST /admin/graph-registry-changed {dataset}` (with `CN_APP_ADMIN_SECRET`)
+    drops the process's cached graph registry, so the next expanding read re-reads it.
+  - The ontology phase (boot and `POST /admin/sync-shapes`) reports and logs the graphs the sync
+    wrote and dropped (`ontologies.graphs`, `ontologies.droppedGraphs`), and says when a store
+    without graph queries got the default-graph sync.
+
+  Breaking changes:
+
+  - Requires the `@_linked/core` with graph queries (`IDataset.graphQuery`, `NamedGraph`, the graph
+    registry cache), which in turn requires `ghcr.io/linked-fw/fuseki:6.2.0-2` or a store that
+    builds its hierarchy from the registry; and the `@_linked/server-utils` whose `QueryAccess` has
+    the `graph` operation (with an older one every graph query is refused). Both ranges are raised
+    at release.
+  - Graph queries on the generic plane are refused unless the store declares a `graph` rule with
+    `withAccess`.
+  - `.from(graphs.allOntologies)` and `.from(graphs.allShapes)` reads through a url-form
+    `RemoteDataset` now also select the `OntologyGraph` and `ShapesGraph` records on the data
+    server; its read rule decides whether they are answered (when refused, the names go
+    unexpanded).
+  - A `ServerCallError` that carries a string `code` now sends it in the error body
+    (`{error, code}`).
+
+## 3.7.0
+
+### Minor Changes
+
+- [#202](https://github.com/linked-fw/server/pull/202) [`9e9cf47`](https://github.com/linked-fw/server/commit/9e9cf479c42c82a287a640c6f02c300186653176) Thanks [@flyon](https://github.com/flyon)! - Ontology data: labels, descriptions and types for every term.
+
+  - `src/data/server.ttl` gains the ontology node (`dcterms:title`, `dcterms:description`,
+    `owl:versionInfo`) and the seven terms it lacked (`LincdWebApp`, `LincdAPI`, `hasAPI`,
+    `N3FileStore`, `BackendAPIStore`, `ownPackage`, `maintainsPackage`), and is written in the
+    deterministic Turtle form. All 11 terms are typed (`owl:Class`, was `rdfs:Class`, or
+    `owl:ObjectProperty`) with an English label and comment; the labels say "Linked", not "LINCD".
+  - Two axioms: `server:BackendFileStore` and `server:BackendAPIStore` are `rdfs:subClassOf`
+    `server:BackendStore`. No shape targets these classes.
+
+- [#202](https://github.com/linked-fw/server/pull/202) [`4e992f4`](https://github.com/linked-fw/server/commit/4e992f458ab3366bbd673a74d12105217c289190) Thanks [@flyon](https://github.com/flyon)! - The server syncs the class hierarchy of every registered ontology into its app data and runs core's shape check before its shape sync, at boot and on `POST /admin/sync-shapes`, whose answer gains `ontologies: {written, skipped}` and `shapeCheck: {errors, warnings}`. The boot's ontology sync follows the shape sync's switches; `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false` turns off only it. The server's own ontology data is Turtle (`data/server.ttl`), and the server no longer calls `autoLoadOntologyData`.
+
+- [#202](https://github.com/linked-fw/server/pull/202) [`4fcafde`](https://github.com/linked-fw/server/commit/4fcafde29dca73f34d45ce5054f24dba79f0d89b) Thanks [@flyon](https://github.com/flyon)! - At boot and on `POST /admin/sync-shapes`, every linked package the server discovered in the app's
+  dependency tree registers its ontologies (core `registerInstalledOntologies`) before the ontology
+  sync and the shape check, so a package the app only deep-imports shape files from
+  (`@_linked/schema/shapes/Person`) is synced and checked too.
+
+- [#202](https://github.com/linked-fw/server/pull/202) [`49a02be`](https://github.com/linked-fw/server/commit/49a02bea25b9526bf732a01db20cd1a33b9560e0) Thanks [@flyon](https://github.com/flyon)! - The ontology registration before the sync and the shape check also covers the app's own workspace
+  packages (`linkedPackage: true` under its `workspaces`), which the dependency walk misses when no
+  package imports them (a Create Now clone's `packages/<slug>-ont`). In dev, a package without a
+  built `lib/` registers from `src/ontologies/*.register.ts` through Vite's `ssrLoadModule` (core
+  `registerInstalledOntologies`' `importModule`); a built app skips it.
+
 ## 3.6.1
 
 ### Patch Changes

package/lib/esm/backend.d.ts

@@ -14,4 +14,13 @@ export default class LincdServerBackendProvider extends BackendProvider {
     updateQuery(json: any): Promise<unknown>;
     createQuery(json: any): Promise<unknown>;
     deleteQuery(json: any): Promise<import("@_linked/core/queries/DeleteQuery.js").DeleteResponse>;
+    /**
+     * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as
+     * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks
+     * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and
+     * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,
+     * so the check resolves the same store. A store's refusal answers with its code (see
+     * `graphQueryCallError`).
+     */
+    graphQuery(json: any): Promise<import("@_linked/core").GraphResult>;
 }

package/lib/esm/backend.js

@@ -12,7 +12,8 @@ import { callable } from '@_linked/server-utils/utils/callable';
 import { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';
 import { LinkedStorage } from '@_linked/core/utils/LinkedStorage';
 import { LocalFileStore } from './shapes/filestores/LocalFileStore.js';
-import { authorizeGenericQuery, resolveQueryCatalog, toQueryBuilder, } from './utils/queryPlane.js';
+import { authorizeGenericQuery, authorizeGraphQuery, graphQueryCallError, resolveQueryCatalog, toGraphQuery, toQueryBuilder, } from './utils/queryPlane.js';
+import { ServerCallError } from '@_linked/server-utils/utils/ServerCallError';
 import path from 'path';
 import fs from 'fs/promises';
 export default class LincdServerBackendProvider extends BackendProvider {
@@ -82,6 +83,26 @@ export default class LincdServerBackendProvider extends BackendProvider {
         await authorizeGenericQuery('delete', json, query, 'deleteQuery');
         return LinkedStorage.deleteQuery(query);
     }
+    /**
+     * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as
+     * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks
+     * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and
+     * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,
+     * so the check resolves the same store. A store's refusal answers with its code (see
+     * `graphQueryCallError`).
+     */
+    async graphQuery(json) {
+        const query = toGraphQuery(json);
+        await authorizeGraphQuery(json, query, 'graphQuery');
+        if (!query)
+            throw new ServerCallError(400, 'Invalid graph query');
+        try {
+            return await LinkedStorage.graphQuery(query);
+        }
+        catch (err) {
+            throw graphQueryCallError(err);
+        }
+    }
 }
 __decorate([
     callable('public'),
@@ -119,4 +140,10 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], LincdServerBackendProvider.prototype, "deleteQuery", null);
+__decorate([
+    callable('public'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], LincdServerBackendProvider.prototype, "graphQuery", null);
 //# sourceMappingURL=backend.js.map

package/lib/esm/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/backend.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,eAAe;IACrE,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACzC,iBAAiB,CAAC,eAAe,CAC/B,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;gBAC5D,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,wDAAwD;IACxD,0FAA0F;IAC1F,wFAAwF;IACxF,qFAAqF;IACrF,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,wFAAwF;IACxF,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,eAAe;IAGT,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAS;QACtB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;CACF;AA1DO;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;sDAGlB;AAuBK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;0DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB","sourcesContent":["import { BackendProvider } from '@_linked/server-utils/utils/BackendProvider';\nimport { callable } from '@_linked/server-utils/utils/callable';\nimport { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { LocalFileStore } from './shapes/filestores/LocalFileStore.js';\nimport {\n  authorizeGenericQuery,\n  resolveQueryCatalog,\n  toQueryBuilder,\n} from './utils/queryPlane.js';\nimport path from 'path';\nimport fs from 'fs/promises';\n\nexport default class LincdServerBackendProvider extends BackendProvider {\n  async setupBeforeControllers() {\n    if (!LinkedFileStorage.getDefaultStore()) {\n      LinkedFileStorage.setDefaultStore(\n        new LocalFileStore(process.env.NODE_ENV + '-filestore')\n      );\n    }\n    let fileSystemUploadPath = path.join('data', 'filestores');\n    try {\n      await fs.access(fileSystemUploadPath);\n    } catch (err) {\n      await fs.mkdir(path.join(fileSystemUploadPath, 'filestores'), {\n        recursive: true,\n      });\n    }\n  }\n\n  /**\n   * Reachability check for a `RemoteDataset` pointed at this server: reads nothing, changes\n   * nothing. A plain linked server has no token concept, so it always answers `{ok: true}`;\n   * a host that serves the wire with tokens answers 401 for a refused one.\n   */\n  @callable('public')\n  async ping(): Promise<{ ok: true }> {\n    return { ok: true };\n  }\n\n  // ── Generic query execution ──────────────────────────────────────────────\n  //\n  // These answer `RemoteDataset`: a browser's store calls\n  // `Server.call(packageName, {method}, json)` (the PACKAGE form), and a remote app's store\n  // posts the same `{args}` body to `{url}/call/@_linked/server/<method>`. Either way the\n  // request arrives here on the generic provider rather than through Shape resolution.\n  //\n  // A query cannot cross the wire live, so the client ships `toJSON()` and `fromJSON()`\n  // rehydrates it here into a live, closed query. `LinkedStorage` then routes it by the\n  // QUERY's shape, which is what decides the target dataset; the store instance never\n  // participates. The host's catalog resolver (`setQueryCatalogResolver`) picks the shape\n  // catalog the JSON is decoded in; the builder keeps it for both lowerings.\n  //\n  // Every query is checked first against the access rules of the stores it\n  // maps to, declared in the app's storage config (`withAccess`; a store with\n  // no rule requires a session): see utils/queryPlane. INTERIM model, to be\n  // rethought. The store runs the builder that was checked. They are declared\n  // 'public' because that check, not the RPC layer, decides whether a session\n  // is required.\n\n  @callable('public')\n  async selectQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('select', json, query, 'selectQuery');\n    return LinkedStorage.selectQuery(query);\n  }\n\n  @callable('public')\n  async askQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('ask', json, query, 'askQuery');\n    return LinkedStorage.askQuery(query);\n  }\n\n  @callable('public')\n  async updateQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('update', json, query, 'updateQuery');\n    return LinkedStorage.updateQuery(query);\n  }\n\n  @callable('public')\n  async createQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('create', json, query, 'createQuery');\n    return LinkedStorage.createQuery(query);\n  }\n\n  @callable('public')\n  async deleteQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('delete', json, query, 'deleteQuery');\n    return LinkedStorage.deleteQuery(query);\n  }\n}\n"]}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/backend.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,eAAe;IACrE,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACzC,iBAAiB,CAAC,eAAe,CAC/B,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;gBAC5D,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,wDAAwD;IACxD,0FAA0F;IAC1F,wFAAwF;IACxF,qFAAqF;IACrF,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,wFAAwF;IACxF,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,eAAe;IAGT,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAS;QACtB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,UAAU,CAAC,IAAS;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AA9EO;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;sDAGlB;AAuBK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;0DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAWK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;4DAUlB","sourcesContent":["import { BackendProvider } from '@_linked/server-utils/utils/BackendProvider';\nimport { callable } from '@_linked/server-utils/utils/callable';\nimport { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { LocalFileStore } from './shapes/filestores/LocalFileStore.js';\nimport {\n  authorizeGenericQuery,\n  authorizeGraphQuery,\n  graphQueryCallError,\n  resolveQueryCatalog,\n  toGraphQuery,\n  toQueryBuilder,\n} from './utils/queryPlane.js';\nimport { ServerCallError } from '@_linked/server-utils/utils/ServerCallError';\nimport path from 'path';\nimport fs from 'fs/promises';\n\nexport default class LincdServerBackendProvider extends BackendProvider {\n  async setupBeforeControllers() {\n    if (!LinkedFileStorage.getDefaultStore()) {\n      LinkedFileStorage.setDefaultStore(\n        new LocalFileStore(process.env.NODE_ENV + '-filestore')\n      );\n    }\n    let fileSystemUploadPath = path.join('data', 'filestores');\n    try {\n      await fs.access(fileSystemUploadPath);\n    } catch (err) {\n      await fs.mkdir(path.join(fileSystemUploadPath, 'filestores'), {\n        recursive: true,\n      });\n    }\n  }\n\n  /**\n   * Reachability check for a `RemoteDataset` pointed at this server: reads nothing, changes\n   * nothing. A plain linked server has no token concept, so it always answers `{ok: true}`;\n   * a host that serves the wire with tokens answers 401 for a refused one.\n   */\n  @callable('public')\n  async ping(): Promise<{ ok: true }> {\n    return { ok: true };\n  }\n\n  // ── Generic query execution ──────────────────────────────────────────────\n  //\n  // These answer `RemoteDataset`: a browser's store calls\n  // `Server.call(packageName, {method}, json)` (the PACKAGE form), and a remote app's store\n  // posts the same `{args}` body to `{url}/call/@_linked/server/<method>`. Either way the\n  // request arrives here on the generic provider rather than through Shape resolution.\n  //\n  // A query cannot cross the wire live, so the client ships `toJSON()` and `fromJSON()`\n  // rehydrates it here into a live, closed query. `LinkedStorage` then routes it by the\n  // QUERY's shape, which is what decides the target dataset; the store instance never\n  // participates. The host's catalog resolver (`setQueryCatalogResolver`) picks the shape\n  // catalog the JSON is decoded in; the builder keeps it for both lowerings.\n  //\n  // Every query is checked first against the access rules of the stores it\n  // maps to, declared in the app's storage config (`withAccess`; a store with\n  // no rule requires a session): see utils/queryPlane. INTERIM model, to be\n  // rethought. The store runs the builder that was checked. They are declared\n  // 'public' because that check, not the RPC layer, decides whether a session\n  // is required.\n\n  @callable('public')\n  async selectQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('select', json, query, 'selectQuery');\n    return LinkedStorage.selectQuery(query);\n  }\n\n  @callable('public')\n  async askQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('ask', json, query, 'askQuery');\n    return LinkedStorage.askQuery(query);\n  }\n\n  @callable('public')\n  async updateQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('update', json, query, 'updateQuery');\n    return LinkedStorage.updateQuery(query);\n  }\n\n  @callable('public')\n  async createQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('create', json, query, 'createQuery');\n    return LinkedStorage.createQuery(query);\n  }\n\n  @callable('public')\n  async deleteQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('delete', json, query, 'deleteQuery');\n    return LinkedStorage.deleteQuery(query);\n  }\n\n  /**\n   * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as\n   * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks\n   * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and\n   * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,\n   * so the check resolves the same store. A store's refusal answers with its code (see\n   * `graphQueryCallError`).\n   */\n  @callable('public')\n  async graphQuery(json: any) {\n    const query = toGraphQuery(json);\n    await authorizeGraphQuery(json, query, 'graphQuery');\n    if (!query) throw new ServerCallError(400, 'Invalid graph query');\n    try {\n      return await LinkedStorage.graphQuery(query);\n    } catch (err) {\n      throw graphQueryCallError(err);\n    }\n  }\n}\n"]}

package/lib/esm/data/server.ttl

@@ -0,0 +1,75 @@
+@prefix server: <https://linked.cm/ont/server/> .
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl: <http://www.w3.org/2002/07/owl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+@prefix dcterms: <http://purl.org/dc/terms/> .
+@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
+@prefix schema: <http://schema.org/> .
+
+server:
+    a owl:Ontology ;
+    dcterms:description "Terms of the Linked Node.js server: the server, the web app it serves and its data API."@en ;
+    dcterms:title "Linked server"@en ;
+    owl:versionInfo "3.7.0" .
+
+server:BackendAPIStore
+    a owl:Class ;
+    rdfs:comment "A frontend store that sends every query to the Linked server's data API instead of holding quads locally."@en ;
+    rdfs:label "backend API store"@en ;
+    rdfs:subClassOf server:BackendStore .
+
+server:BackendFileStore
+    a owl:Class ;
+    rdfs:comment "A frontend quad store that loads and updates its quads through API calls to the Linked server's backend."@en ;
+    rdfs:isDefinedBy server: ;
+    rdfs:label "backend file store"@en ;
+    rdfs:subClassOf server:BackendStore .
+
+server:BackendStore
+    a owl:Class ;
+    rdfs:comment "The base class of frontend quad stores that are loaded and updated through the Linked server's backend API."@en ;
+    rdfs:isDefinedBy server: ;
+    rdfs:label "backend store"@en .
+
+server:LincdAPI
+    a owl:Class ;
+    rdfs:comment "The server's data API endpoint, which answers select, update, create, delete and raw SPARQL calls from the client (LincdAPI.process)."@en ;
+    rdfs:label "Linked data API"@en .
+
+server:LincdServer
+    a owl:Class ;
+    rdfs:comment "The Node.js HTTP server that serves a Linked app, its assets and its /call and data API routes (LinkedServer)."@en ;
+    rdfs:isDefinedBy server: ;
+    rdfs:label "Linked server"@en .
+
+server:LincdWebApp
+    a owl:Class ;
+    rdfs:comment "A Linked web app as the server knows it: the site at SITE_ROOT, with the data API it exposes."@en ;
+    rdfs:label "Linked web app"@en .
+
+server:N3FileStore
+    a owl:Class ;
+    rdfs:comment "A quad store that keeps its quads in an N3/Turtle file on a Node.js server."@en ;
+    rdfs:label "N3 file store"@en .
+
+server:NodeFileStore
+    a owl:Class ;
+    rdfs:comment "A quad store that keeps its quads in a JSON-LD file on a Node.js server."@en ;
+    rdfs:isDefinedBy server: ;
+    rdfs:label "Node file store"@en .
+
+server:hasAPI
+    a owl:ObjectProperty ;
+    rdfs:comment "Links a web app to the client of its data API."@en ;
+    rdfs:label "has API"@en .
+
+server:maintainsPackage
+    a owl:ObjectProperty ;
+    rdfs:comment "Links a web app to a package it maintains."@en ;
+    rdfs:label "maintains package"@en .
+
+server:ownPackage
+    a owl:ObjectProperty ;
+    rdfs:comment "Links a web app to the npm package that is its own code."@en ;
+    rdfs:label "own package"@en .

package/lib/esm/ontologies/server.d.ts

@@ -1,25 +1,7 @@
-/**
- * Load the data of this ontology.
- * In @_linked/core, loadData returns the raw JSON import — no JSONLD.parse() needed.
- */
-export declare var loadData: () => Promise<{
-    "@context": {
-        dc: string;
-        owl: string;
-        rdf: string;
-        rdfs: string;
-        server: string;
-    };
-    "@graph": {
-        "@id": string;
-        "@type": string;
-        "rdfs:comment": string;
-        "rdfs:isDefinedBy": {
-            "@id": string;
-        };
-        "rdfs:label": string;
-    }[];
-}>;
+/** This ontology's data files, relative to this module (`linked build` copies them to `lib/esm/data/`). */
+export declare const dataFiles: string[];
+/** Read this ontology's Turtle data (server only). */
+export declare const loadData: () => Promise<string[]>;
 /**
  * The namespace of this ontology.
  *

package/lib/esm/ontologies/server.js

@@ -1,15 +1,9 @@
 import { createNameSpace } from '@_linked/core/utils/NameSpace';
-/**
- * Load the data of this ontology.
- * In @_linked/core, loadData returns the raw JSON import — no JSONLD.parse() needed.
- */
-export var loadData = async () => {
-    //@ts-ignore
-    const data = await import('../data/server.json', {
-        with: { type: 'json' },
-    });
-    return data.default || data;
-};
+import { loadOntologyFiles } from '@_linked/core/ontology/loadOntologyFiles';
+/** This ontology's data files, relative to this module (`linked build` copies them to `lib/esm/data/`). */
+export const dataFiles = ['../data/server.ttl'];
+/** Read this ontology's Turtle data (server only). */
+export const loadData = () => loadOntologyFiles(import.meta.url, dataFiles);
 /**
  * The namespace of this ontology.
  *

package/lib/esm/ontologies/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/ontologies/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,IAAI,QAAQ,GAAG,KAAK,IAAI,EAAE;IAC/B,YAAY;IACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,qBAAqB,EAAE;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;AAC9B,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEjE,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE1B,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,eAAe;IACf,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,QAAQ;IACR,MAAM;CACP,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC","sourcesContent":["import { createNameSpace } from '@_linked/core/utils/NameSpace';\n\n/**\n * Load the data of this ontology.\n * In @_linked/core, loadData returns the raw JSON import — no JSONLD.parse() needed.\n */\nexport var loadData = async () => {\n  //@ts-ignore\n  const data = await import('../data/server.json', {\n    with: { type: 'json' },\n  });\n  return data.default || data;\n};\n\n/**\n * The namespace of this ontology.\n *\n * First-party ontologies live on linked.cm: `https://linked.cm/ont/{ontologySlug}/`, and a\n * package's own ontology takes the package's publicSlug (`@_linked/server` → `server`), the same\n * slug its shapes use under `https://linked.cm/shape/server/`.\n *\n * Its prefix label is the same slug, `server` (`server:LincdAPI`). It used to be `lincd-server`,\n * which is still registered as a deprecated alias so `lincd-server:` names keep expanding.\n *\n * Until an earlier release the namespace was `http://lincd.org/ont/lincd-server/`. No stored\n * data is typed with these terms; the only store triples that carried them were the synced shape descriptions of\n * `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`), which boot sync\n * rewrites (delete, then recreate) the next time the server starts.\n */\nexport var ns = createNameSpace('https://linked.cm/ont/server/');\n\nexport var _self = ns('');\n\n// Terms are properties of the namespace object below, not module-scope\n// exports. Most of these names are also SHAPE CLASS names in this package\n// (BackendAPIStore, LincdWebApp, LincdAPI, ...). Two bindings of the same name\n// in one bundle scope make the bundler rename one of them, and when the loser\n// is the class, `constructor.name` becomes `BackendAPIStore2` -- which is the\n// shape's IRI and the name `Server.call` routes on. The client then asks a\n// backend that has no such shape, and every store round-trip answers 501.\nconst LincdServer = ns('LincdServer');\nconst BackendFileStore = ns('BackendFileStore');\nconst NodeFileStore = ns('NodeFileStore');\nconst BackendStore = ns('BackendStore');\nconst BackendAPIStore = ns('BackendAPIStore');\nconst LincdWebApp = ns('LincdWebApp');\nconst ownPackage = ns('ownPackage');\nconst maintainsPackage = ns('maintainsPackage');\nconst N3FileStore = ns('N3FileStore');\nconst LincdAPI = ns('LincdAPI');\nconst hasAPI = ns('hasAPI');\n\nexport const server = {\n  LincdServer,\n  BackendFileStore,\n  NodeFileStore,\n  BackendStore,\n  N3FileStore,\n  BackendAPIStore,\n  LincdWebApp,\n  ownPackage,\n  maintainsPackage,\n  LincdAPI,\n  hasAPI,\n};\n\n/** @deprecated use `server` — same object, kept under its old name. */\nexport const lincdServer = server;\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/ontologies/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAE7E,2GAA2G;AAC3G,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEhD,sDAAsD;AACtD,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAE5E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,+BAA+B,CAAC,CAAC;AAEjE,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE1B,uEAAuE;AACvE,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;AACpC,MAAM,gBAAgB,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;AAChC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;AAE5B,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,eAAe;IACf,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,QAAQ;IACR,MAAM;CACP,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC","sourcesContent":["import { createNameSpace } from '@_linked/core/utils/NameSpace';\nimport { loadOntologyFiles } from '@_linked/core/ontology/loadOntologyFiles';\n\n/** This ontology's data files, relative to this module (`linked build` copies them to `lib/esm/data/`). */\nexport const dataFiles = ['../data/server.ttl'];\n\n/** Read this ontology's Turtle data (server only). */\nexport const loadData = () => loadOntologyFiles(import.meta.url, dataFiles);\n\n/**\n * The namespace of this ontology.\n *\n * First-party ontologies live on linked.cm: `https://linked.cm/ont/{ontologySlug}/`, and a\n * package's own ontology takes the package's publicSlug (`@_linked/server` → `server`), the same\n * slug its shapes use under `https://linked.cm/shape/server/`.\n *\n * Its prefix label is the same slug, `server` (`server:LincdAPI`). It used to be `lincd-server`,\n * which is still registered as a deprecated alias so `lincd-server:` names keep expanding.\n *\n * Until an earlier release the namespace was `http://lincd.org/ont/lincd-server/`. No stored\n * data is typed with these terms; the only store triples that carried them were the synced shape descriptions of\n * `LinkedServer`, `LincdAPI` and `LincdWebApp` (`sh:targetClass`, `sh:path`), which boot sync\n * rewrites (delete, then recreate) the next time the server starts.\n */\nexport var ns = createNameSpace('https://linked.cm/ont/server/');\n\nexport var _self = ns('');\n\n// Terms are properties of the namespace object below, not module-scope\n// exports. Most of these names are also SHAPE CLASS names in this package\n// (BackendAPIStore, LincdWebApp, LincdAPI, ...). Two bindings of the same name\n// in one bundle scope make the bundler rename one of them, and when the loser\n// is the class, `constructor.name` becomes `BackendAPIStore2` -- which is the\n// shape's IRI and the name `Server.call` routes on. The client then asks a\n// backend that has no such shape, and every store round-trip answers 501.\nconst LincdServer = ns('LincdServer');\nconst BackendFileStore = ns('BackendFileStore');\nconst NodeFileStore = ns('NodeFileStore');\nconst BackendStore = ns('BackendStore');\nconst BackendAPIStore = ns('BackendAPIStore');\nconst LincdWebApp = ns('LincdWebApp');\nconst ownPackage = ns('ownPackage');\nconst maintainsPackage = ns('maintainsPackage');\nconst N3FileStore = ns('N3FileStore');\nconst LincdAPI = ns('LincdAPI');\nconst hasAPI = ns('hasAPI');\n\nexport const server = {\n  LincdServer,\n  BackendFileStore,\n  NodeFileStore,\n  BackendStore,\n  N3FileStore,\n  BackendAPIStore,\n  LincdWebApp,\n  ownPackage,\n  maintainsPackage,\n  LincdAPI,\n  hasAPI,\n};\n\n/** @deprecated use `server` — same object, kept under its old name. */\nexport const lincdServer = server;\n"]}

package/lib/esm/ontologies/server.register.js

@@ -11,7 +11,7 @@
  * From a sibling module the same import is ordinary and survives.
  */
 import * as terms from './server.js';
-import { loadData, ns } from './server.js';
+import { dataFiles, loadData, ns } from './server.js';
 import { linkedOntology } from '../package.js';
 import { Prefix } from '@_linked/core/utils/Prefix';
 // Deprecated prefix label, kept so `lincd-server:X` names still expand. It is added
@@ -19,6 +19,6 @@ import { Prefix } from '@_linked/core/utils/Prefix';
 // last add wins: registering `server` second makes compaction emit `server:X`.
 Prefix.add('lincd-server', ns('').id);
 // The prefix is also the key this ontology is registered under in the package tree,
-// and the name of its data file: `server` → `../data/server.json`.
-linkedOntology(terms, ns, 'server', loadData, '../data/server.json');
+// and the name of its data file: `server` → `../data/server.ttl`.
+linkedOntology(terms, ns, 'server', loadData, dataFiles);
 //# sourceMappingURL=server.register.js.map

package/lib/esm/ontologies/server.register.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.register.js","sourceRoot":"","sources":["../../../src/ontologies/server.register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,MAAM,aAAa,CAAC;AACrC,OAAO,EAAC,QAAQ,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACzC,OAAO,EAAC,cAAc,EAAC,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAC,MAAM,4BAA4B,CAAC;AAElD,oFAAoF;AACpF,sFAAsF;AACtF,+EAA+E;AAC/E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtC,oFAAoF;AACpF,mEAAmE;AACnE,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC","sourcesContent":["/**\n * Registers this ontology.\n *\n * Kept out of `server.ts` because registration needs that module's whole export\n * namespace, and a module cannot import itself once a bundler is involved: Rollup\n * treats a static self-reference as a circular import and elides it, so the binding is\n * undefined at runtime and the consuming app dies at boot with `_this is not\n * defined`. `tsc` preserves it, which is why the pattern survived for as long as\n * packages were built with `tsc` alone.\n *\n * From a sibling module the same import is ordinary and survives.\n */\nimport * as terms from './server.js';\nimport {loadData, ns} from './server.js';\nimport {linkedOntology} from '../package.js';\nimport {Prefix} from '@_linked/core/utils/Prefix';\n\n// Deprecated prefix label, kept so `lincd-server:X` names still expand. It is added\n// BEFORE the registration below because Prefix keeps one prefix per namespace and the\n// last add wins: registering `server` second makes compaction emit `server:X`.\nPrefix.add('lincd-server', ns('').id);\n\n// The prefix is also the key this ontology is registered under in the package tree,\n// and the name of its data file: `server` → `../data/server.json`.\nlinkedOntology(terms, ns, 'server', loadData, '../data/server.json');\n"]}
+{"version":3,"file":"server.register.js","sourceRoot":"","sources":["../../../src/ontologies/server.register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,MAAM,aAAa,CAAC;AACrC,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,cAAc,EAAC,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAC,MAAM,EAAC,MAAM,4BAA4B,CAAC;AAElD,oFAAoF;AACpF,sFAAsF;AACtF,+EAA+E;AAC/E,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtC,oFAAoF;AACpF,kEAAkE;AAClE,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC","sourcesContent":["/**\n * Registers this ontology.\n *\n * Kept out of `server.ts` because registration needs that module's whole export\n * namespace, and a module cannot import itself once a bundler is involved: Rollup\n * treats a static self-reference as a circular import and elides it, so the binding is\n * undefined at runtime and the consuming app dies at boot with `_this is not\n * defined`. `tsc` preserves it, which is why the pattern survived for as long as\n * packages were built with `tsc` alone.\n *\n * From a sibling module the same import is ordinary and survives.\n */\nimport * as terms from './server.js';\nimport {dataFiles, loadData, ns} from './server.js';\nimport {linkedOntology} from '../package.js';\nimport {Prefix} from '@_linked/core/utils/Prefix';\n\n// Deprecated prefix label, kept so `lincd-server:X` names still expand. It is added\n// BEFORE the registration below because Prefix keeps one prefix per namespace and the\n// last add wins: registering `server` second makes compaction emit `server:X`.\nPrefix.add('lincd-server', ns('').id);\n\n// The prefix is also the key this ontology is registered under in the package tree,\n// and the name of its data file: `server` → `../data/server.ttl`.\nlinkedOntology(terms, ns, 'server', loadData, dataFiles);\n"]}

package/lib/esm/package.d.ts

@@ -1,4 +1,4 @@
 export declare const linkedShape: {
     <T extends typeof import("@_linked/core").Shape>(constructor: T): void;
     <T extends typeof import("@_linked/core").Shape>(config?: import("@_linked/core/utils/Package").ShapeConfig): (constructor: T) => void;
-}, linkedUtil: (constructor: any) => any, linkedOntology: (allFileExports: any, nameSpace: (term: string) => import("@_linked/core/utils/NodeReference.js").NodeReferenceValue, suggestedPrefixAndFileName: string, loadDataFunction?: () => Promise<any>, dataSource?: string | string[]) => void, packageExports: any, packageName: string;
+}, linkedUtil: (constructor: any) => any, linkedOntology: (allFileExports: any, nameSpace: (term: string) => import("@_linked/core/utils/NodeReference.js").NodeReferenceValue, suggestedPrefixAndFileName: string, loadDataFunction?: () => Promise<unknown>, dataSource?: string | string[]) => void, packageExports: any, packageName: string;

package/lib/esm/shapes/LinkedServer.d.ts

@@ -82,6 +82,8 @@ export declare class LinkedServer extends Shape {
      * could not be loaded at all.
      */
     private linkedPackageDirs;
+    /** The app's own workspace packages (`linkedPackage: true`), by real path. */
+    private workspacePackageDirs;
     private warnedDuplicateInstalls;
     private resizePathsMap;
     private api;
@@ -127,11 +129,29 @@ export declare class LinkedServer extends Shape {
     private materializeShapesIntoStore;
     /** One shape sync into the default dataset; throws when it fails. */
     private syncRegisteredShapes;
+    /**
+     * Boot: sync the registered ontologies into their graphs in app data and run the shape
+     * check, before the shape sync (see utils/ontologySync). The sync follows the shape sync's
+     * switch (`syncShapesOnBoot`, `LINKED_SYNC_SHAPES_ON_BOOT`), plus the opt-out
+     * `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`; the in-memory class hierarchy is loaded either way.
+     * Never stops the boot: failures and findings are logged.
+     */
+    private syncOntologiesOnBoot;
+    /**
+     * Every discovered linked package and every workspace package of the app registers its
+     * ontologies (in dev, an unbuilt one through Vite), then the ontology sync (when
+     * `sync` is set) into the default dataset, then the shape check.
+     * Orphaned ontology graphs (and earlier sync nodes) are pruned under the shape sync's orphan policy
+     * (`LINKED_SYNC_SHAPES_PRUNE_ORPHANS`).
+     */
+    private runOntologyPhase;
     /** Tail of the {@link resyncShapes} queue: one re-sync at a time. */
     private shapeSyncQueue;
     /**
-     * Re-sync the registered shapes into app data, as the boot does, and report
-     * what was written. The host calls it (`POST /admin/sync-shapes`) after it
+     * Re-sync the registered ontologies and shapes into app data, as the boot does,
+     * and report what was written: the ontology sync (every registered package,
+     * hash-skipped), the shape check's counts, then the shape sync. A failed ontology
+     * sync does not stop the shape sync; the run then fails with the ontology error. The host calls it (`POST /admin/sync-shapes`) after it
      * changed the app's shape code, so the app — the only process that loads that
      * code — writes its own shapes and their hashes.
      *
@@ -298,7 +318,7 @@ export declare class LinkedServer extends Shape {
     private assertSessionForLevel;
     handleErrors(fn: any): (req: any, res: any, next: any) => Promise<any>;
     handleErrorsJson(fn: any): (req: any, res: any, next: any) => Promise<any>;
-    sendError(res: any, statusCode: number, message: any, logMessage?: string): void;
+    sendError(res: any, statusCode: number, message: any, logMessage?: string, code?: string): void;
     /**
      * The stylesheets a dev (Vite) page render needs, inlined into
      * `<style id="ssr-css">` so the first paint is styled before Vite's client

package/lib/esm/shapes/LinkedServer.js

@@ -36,12 +36,11 @@ import { paint } from '../utils/paint.js';
 import { nativeImport } from '../utils/nativeImport.js';
 import { createJsonBodyParser } from '../utils/jsonBodyParser.js';
 import { LinkedStorage } from '@_linked/core/utils/LinkedStorage';
-import { autoLoadOntologyData } from '@_linked/core/utils/Package';
 import { getAllShapeClasses, getShapeClass, getSuperShapesClasses, } from '@_linked/core/utils/ShapeClass';
 import path from 'path';
 import { pathToFileURL } from 'node:url';
 import { isFatalError } from '../utils/fatalError.js';
-import { discoverLinkedDependencies, hasModuleEntry, isBundledBySsr, NODE_IMPORT_CONDITIONS, readInstalledPackage, resolveBackendEntry, resolveDevBackendEntry, ssrNoExternalOf, } from '../utils/linkedDependencies.js';
+import { discoverLinkedDependencies, hasModuleEntry, isBundledBySsr, NODE_IMPORT_CONDITIONS, readDependencyLists, readInstalledPackage, resolveBackendEntry, resolveDevBackendEntry, ssrNoExternalOf, } from '../utils/linkedDependencies.js';
 /**
  * `instanceof ShapeProvider`, tolerating a second copy of server-utils.
  *
@@ -138,7 +137,8 @@ import { resolveStaticAccessURL, staticAssetURL, } from '../utils/releaseManifes
 import { resolveBootstrapEntry, resolveViteMainEntry, resolveViteServingMode, } from '../utils/bootstrapEntry.js';
 import { resolveRouteAssets } from '../utils/routeAssets.js';
 import { resolveRouteComponent, ssrCssInlineUrls, ssrCssScope, } from '../utils/ssrCss.js';
-import { materializeShapes } from '../utils/syncShapes.js';
+import { bootOrphanScope, materializeShapes } from '../utils/syncShapes.js';
+import { bootSyncsOntologies, loadOntologyCore, runOntologyPhase, ontologyPackageDirs, sourceModuleImporter, shapeSyncOn, syncOntologiesThenShapes, } from '../utils/ontologySync.js';
 import { AdminRequestError, assertReloadablePackages, registerAdminRoutes, } from '../utils/adminChannel.js';
 import { envMs, withTimeout } from '../utils/withTimeout.js';
 import { invalidateSourceUnder } from '../utils/reloadSource.js';
@@ -192,7 +192,6 @@ function installProcessSetup() {
 //
 // global['document'] = document;
 global['reactStaticRenderer'] = renderToStaticMarkup;
-autoLoadOntologyData(true);
 /**
  * How RPC arguments treat a `{__sc}` (live Shape class) marker. No call takes a
  * Shape class from the client: logged in 'warn', refused (400) in 'enforce'.
@@ -285,6 +284,8 @@ let LinkedServer = class LinkedServer extends Shape {
          * could not be loaded at all.
          */
         this.linkedPackageDirs = new Map();
+        /** The app's own workspace packages (`linkedPackage: true`), by real path. */
+        this.workspacePackageDirs = [];
         this.warnedDuplicateInstalls = new Set();
         //from resizedFileName to full resized path (CDN or similar)
         this.resizePathsMap = new Map();
@@ -360,6 +361,7 @@ let LinkedServer = class LinkedServer extends Shape {
         this.initPackage();
         this.server = express();
         await this.initBackendProviders();
+        await this.syncOntologiesOnBoot();
         await this.materializeShapesIntoStore();
         return this;
     }
@@ -396,9 +398,7 @@ let LinkedServer = class LinkedServer extends Shape {
     /** One shape sync into the default dataset; throws when it fails. */
     async syncRegisteredShapes() {
         var _a;
-        const configFlag = (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot;
-        const envFlag = process.env.LINKED_SYNC_SHAPES_ON_BOOT;
-        if (configFlag === false || envFlag === 'false') {
+        if (!shapeSyncOn(process.env, (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot)) {
             return { written: 0, skipped: 'disabled' };
         }
         const appData = LinkedStorage.getDefaultDataset();
@@ -411,8 +411,43 @@ let LinkedServer = class LinkedServer extends Shape {
         return { written: count, orphanScope };
     }
     /**
-     * Re-sync the registered shapes into app data, as the boot does, and report
-     * what was written. The host calls it (`POST /admin/sync-shapes`) after it
+     * Boot: sync the registered ontologies into their graphs in app data and run the shape
+     * check, before the shape sync (see utils/ontologySync). The sync follows the shape sync's
+     * switch (`syncShapesOnBoot`, `LINKED_SYNC_SHAPES_ON_BOOT`), plus the opt-out
+     * `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`; the in-memory class hierarchy is loaded either way.
+     * Never stops the boot: failures and findings are logged.
+     */
+    async syncOntologiesOnBoot() {
+        try {
+            await runAsSystem(() => { var _a; return this.runOntologyPhase(bootSyncsOntologies(process.env, (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot)); }, 'ontology sync at boot');
+        }
+        catch (err) {
+            console.warn('[LinkedServer] ontology sync failed (non-fatal):', err);
+        }
+    }
+    /**
+     * Every discovered linked package and every workspace package of the app registers its
+     * ontologies (in dev, an unbuilt one through Vite), then the ontology sync (when
+     * `sync` is set) into the default dataset, then the shape check.
+     * Orphaned ontology graphs (and earlier sync nodes) are pruned under the shape sync's orphan policy
+     * (`LINKED_SYNC_SHAPES_PRUNE_ORPHANS`).
+     */
+    async runOntologyPhase(sync) {
+        var _a, _b, _c, _d;
+        return runOntologyPhase(LinkedStorage.getDefaultDataset(), {
+            core: await loadOntologyCore(),
+            sync,
+            orphanScope: bootOrphanScope(),
+            dependencies: readDependencyLists((_a = this.linkedPackageDirs) !== null && _a !== void 0 ? _a : new Map(), this.package),
+            packageDirs: ontologyPackageDirs(((_b = this.linkedPackageDirs) !== null && _b !== void 0 ? _b : new Map()).values(), (_c = this.workspacePackageDirs) !== null && _c !== void 0 ? _c : []),
+            importModule: sourceModuleImporter((_d = this.config.server) === null || _d === void 0 ? void 0 : _d.vite),
+        });
+    }
+    /**
+     * Re-sync the registered ontologies and shapes into app data, as the boot does,
+     * and report what was written: the ontology sync (every registered package,
+     * hash-skipped), the shape check's counts, then the shape sync. A failed ontology
+     * sync does not stop the shape sync; the run then fails with the ontology error. The host calls it (`POST /admin/sync-shapes`) after it
      * changed the app's shape code, so the app — the only process that loads that
      * code — writes its own shapes and their hashes.
      *
@@ -435,7 +470,7 @@ let LinkedServer = class LinkedServer extends Shape {
                 if (await this.reloadPackageFromDisk(pkg))
                     reloaded.push(pkg);
             }
-            const result = await this.syncRegisteredShapes();
+            const result = await syncOntologiesThenShapes(() => { var _a; return this.runOntologyPhase(shapeSyncOn(process.env, (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot)); }, () => this.syncRegisteredShapes());
             return { ...result, reloaded, shapes: [...getAllShapeClasses().keys()].sort() };
         }, 'shape sync requested by the host'), timeoutMs, `the shape sync did not finish within ${timeoutMs} ms`));
         this.shapeSyncQueue = run.catch(() => undefined);
@@ -622,6 +657,7 @@ let LinkedServer = class LinkedServer extends Shape {
         // });
         // before controllers
         await this.initBackendProviders();
+        await this.syncOntologiesOnBoot();
         await this.materializeShapesIntoStore();
         //START OF EXPRESS ROUTES AND MIDDLEWARE
         //use cors
@@ -793,6 +829,14 @@ let LinkedServer = class LinkedServer extends Shape {
         // Local workspace packages in this app's dependency tree. These are also
         // imported whole at boot (indexLincdPackage), not only their /backend.
         const allLocalPackages = getLincdPackages();
+        this.workspacePackageDirs = allLocalPackages.map((pkg) => {
+            try {
+                return fsNative.realpathSync(pkg.path);
+            }
+            catch (_a) {
+                return pkg.path;
+            }
+        });
         const localPackageMap = new Map(allLocalPackages.map((pkg) => [pkg.packageName, pkg]));
         const relevantPackages = this.filterPackagesByDependencyTree(localPackageMap, this.package);
         // Every linked package in the dependency tree, installed or local, each
@@ -1775,17 +1819,20 @@ let LinkedServer = class LinkedServer extends Shape {
             catch (err) {
                 // A ServerCallError (e.g. 501 for a call no provider handles) carries
                 // its own status and a message that is safe to send to the client.
+                // A `code` on it (a graph query refusal, see utils/queryPlane) is sent along, so
+                // a remote caller can tell the refusals apart.
                 if (ServerCallError.is(err)) {
-                    return this.sendError(res, err.status, err.message);
+                    const code = err.code;
+                    return this.sendError(res, err.status, err.message, undefined, typeof code === 'string' ? code : undefined);
                 }
                 this.sendError(res, 500, 'internal server error' + (isDevelopment ? ': ' + (err === null || err === void 0 ? void 0 : err.stack) : ''), 'internal server error: ' + (err === null || err === void 0 ? void 0 : err.stack));
             }
         };
     }
-    sendError(res, statusCode = 500, message, logMessage) {
+    sendError(res, statusCode = 500, message, logMessage, code) {
         res === null || res === void 0 ? void 0 : res.status(statusCode);
         if (message) {
-            res === null || res === void 0 ? void 0 : res.send({ error: message });
+            res === null || res === void 0 ? void 0 : res.send(code ? { error: message, code } : { error: message });
             console.warn(paint('red', logMessage || message));
         }
     }