@_linked/server 3.7.0 → 3.9.0

package/CHANGELOG.md

@@ -1,5 +1,104 @@
 # @\_linked/server
 
+## 3.9.0
+
+### Minor Changes
+
+- [#206](https://github.com/linked-fw/server/pull/206) [`dc25a49`](https://github.com/linked-fw/server/commit/dc25a490a9a115e366d99f8db644d236043d609e) Thanks [@flyon](https://github.com/flyon)! - The host control channel reads its secret from `APP_ADMIN_SECRET` and its requests carry it in the
+  `x-app-admin-secret` header. New route `GET /admin/routes` answers the graph routes the process
+  runs with: `{datasets: [{store, id?, default, routes, defaultGraphShapes}]}`, one entry per dataset
+  the router knows, `routes` as `{<shape IRI>: <graph IRI>}` as core's routing holds them once the
+  app's storage file has run, and the shapes each dataset writes to its default graph. Like every
+  `/admin/*` route it answers 404 when the process has no admin secret.
+
+  Renamed, with a fallback (each old name logs one deprecation warning per process):
+
+  - `CN_APP_ADMIN_SECRET` → `APP_ADMIN_SECRET`; the old variable is read when the new one is unset.
+  - The `x-cn-admin-secret` header → `x-app-admin-secret`; the old header is read when the new one
+    is absent.
+
+  The secret is compared through sha256 digests of both sides, so the comparison does not reveal
+  its length.
+
+  No breaking changes: an app or host that sets only the old names keeps working. Requires
+  `@_linked/core` `^2.39.1` (`getShapeGraphs` and `graphRoutingFor` in `utils/graphRouting`).
+
+- [#206](https://github.com/linked-fw/server/pull/206) [`fe012b1`](https://github.com/linked-fw/server/commit/fe012b1291d45763d779e8a8b0e9c18900efbca4) Thanks [@flyon](https://github.com/flyon)! - Shape graphs in the app. The boot and `POST /admin/sync-shapes` sync the registered shapes with
+  core's `syncShapeGraphs`: each package's shapes in its own named graph
+  (`{package IRI}/graph/shapes`, a `ShapesGraph` record in the graph registry), skipped when the
+  stored content hash matches. An installed package's graph comes from its built
+  `lib/esm/data/shapes.ttl`; the app's own packages (the app and its workspace packages) are
+  generated in process, in dev through Vite's loader; the app's single-owner shapes go in
+  `{DATA_ROOT}/graph/shapes`. The boot logs the graphs it writes, and the route reports them as
+  `shapeGraphs`. A graph refusal `graph-not-routed`, and any graph refusal code the server does not
+  know, is answered 400.
+
+  Breaking changes:
+
+  - The default-graph shape sync is replaced: shapes are written into shape graphs, and the shapes an
+    earlier server wrote into the default graph are removed there once their package's graph holds
+    them. A store without graph queries still gets the default-graph sync.
+  - An installed package without `lib/esm/data/shapes.ttl` gets no shape graph, and its shapes are
+    not generated: packages need a release built with a cli that writes `shapes.ttl`.
+  - `ShapeSyncResult.written` (the route's `written`) counts the shape graphs written, not shapes;
+    `shapeGraphs` holds the detail.
+  - `LINKED_SYNC_SHAPES_PRUNE_ORPHANS=true` drops the shape graphs of packages no longer registered
+    (never the app's own graph), instead of default-graph node shapes; it is skipped, with a warning,
+    while a registered package has no `shapes.ttl`.
+  - Requires `@_linked/core` `^2.39.1` (`shapes/syncShapeGraphs`, `shapes/shapesToTurtle`).
+
+  Deprecated: `materializeShapes` and `SyncShapesFn` in `utils/syncShapes` stay as they were, for
+  code built against an earlier server; `syncShapeGraphsInto` replaces them.
+
+  An own package whose shapes could not be generated (the dev loader failed and the server's core
+  holds none of them) is listed in `withoutTurtle`, with a warning, instead of being left out of the
+  report.
+
+## 3.8.0
+
+### Minor Changes
+
+- [#204](https://github.com/linked-fw/server/pull/204) [`f1dc1a6`](https://github.com/linked-fw/server/commit/f1dc1a6fec0abae90c711daec51e929a9587b582) Thanks [@flyon](https://github.com/flyon)! - Graph queries through the server (named graphs and the graph registry, `@_linked/core`'s
+  `graphQuery`):
+
+  - `RemoteDataset.graphQuery`: graph queries (`graph_create`, `graph_replace`, `graph_patch`,
+    `graph_drop`) go out on the query wire like every other query, with the same token and
+    end-user header. A refusal comes back as core's `GraphQueryError` with its code; a server or
+    gateway without the method (404, 501) reads as `unsupported-query-kind`, so the ontology sync
+    falls back to the default graph there.
+  - In the url form, `RemoteDataset` expands `graphs.allOntologies` and `graphs.allShapes` in a
+    read's `.from()` set from its own graph-registry cache (per dataset, keyed by the url and the
+    dataset the server names in its `ping`, updated by its own graph queries, re-read after 30
+    seconds); `invalidateGraphRegistry(dataset?)` drops it. When the registry cannot be read, the
+    names are sent unexpanded.
+  - The generic plane answers `/call/@_linked/server/graphQuery`: the body is checked with core's
+    `parseGraphQuery`, the `graph` rule of the store its record class routes to decides
+    (`withAccess({graph})`; no rule refuses with 403), and `LinkedStorage.graphQuery` runs it. A
+    store's refusal answers with a status and its code: `{error, code}` (409 `graph-exists`, 409
+    `graph-not-registered`, 400 `graph-name-read-only`, 501 `unsupported-query-kind`). Any
+    `ServerCallError` carrying a string `code` now sends it in the error body.
+  - Control channel: `POST /admin/graph-registry-changed {dataset}` (with `CN_APP_ADMIN_SECRET`)
+    drops the process's cached graph registry, so the next expanding read re-reads it.
+  - The ontology phase (boot and `POST /admin/sync-shapes`) reports and logs the graphs the sync
+    wrote and dropped (`ontologies.graphs`, `ontologies.droppedGraphs`), and says when a store
+    without graph queries got the default-graph sync.
+
+  Breaking changes:
+
+  - Requires the `@_linked/core` with graph queries (`IDataset.graphQuery`, `NamedGraph`, the graph
+    registry cache), which in turn requires `ghcr.io/linked-fw/fuseki:6.2.0-2` or a store that
+    builds its hierarchy from the registry; and the `@_linked/server-utils` whose `QueryAccess` has
+    the `graph` operation (with an older one every graph query is refused). Both ranges are raised
+    at release.
+  - Graph queries on the generic plane are refused unless the store declares a `graph` rule with
+    `withAccess`.
+  - `.from(graphs.allOntologies)` and `.from(graphs.allShapes)` reads through a url-form
+    `RemoteDataset` now also select the `OntologyGraph` and `ShapesGraph` records on the data
+    server; its read rule decides whether they are answered (when refused, the names go
+    unexpanded).
+  - A `ServerCallError` that carries a string `code` now sends it in the error body
+    (`{error, code}`).
+
 ## 3.7.0
 
 ### Minor Changes

package/lib/esm/backend.d.ts

@@ -14,4 +14,13 @@ export default class LincdServerBackendProvider extends BackendProvider {
     updateQuery(json: any): Promise<unknown>;
     createQuery(json: any): Promise<unknown>;
     deleteQuery(json: any): Promise<import("@_linked/core/queries/DeleteQuery.js").DeleteResponse>;
+    /**
+     * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as
+     * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks
+     * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and
+     * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,
+     * so the check resolves the same store. A store's refusal answers with its code (see
+     * `graphQueryCallError`).
+     */
+    graphQuery(json: any): Promise<import("@_linked/core").GraphResult>;
 }

package/lib/esm/backend.js

@@ -12,7 +12,8 @@ import { callable } from '@_linked/server-utils/utils/callable';
 import { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';
 import { LinkedStorage } from '@_linked/core/utils/LinkedStorage';
 import { LocalFileStore } from './shapes/filestores/LocalFileStore.js';
-import { authorizeGenericQuery, resolveQueryCatalog, toQueryBuilder, } from './utils/queryPlane.js';
+import { authorizeGenericQuery, authorizeGraphQuery, graphQueryCallError, resolveQueryCatalog, toGraphQuery, toQueryBuilder, } from './utils/queryPlane.js';
+import { ServerCallError } from '@_linked/server-utils/utils/ServerCallError';
 import path from 'path';
 import fs from 'fs/promises';
 export default class LincdServerBackendProvider extends BackendProvider {
@@ -82,6 +83,26 @@ export default class LincdServerBackendProvider extends BackendProvider {
         await authorizeGenericQuery('delete', json, query, 'deleteQuery');
         return LinkedStorage.deleteQuery(query);
     }
+    /**
+     * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as
+     * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks
+     * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and
+     * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,
+     * so the check resolves the same store. A store's refusal answers with its code (see
+     * `graphQueryCallError`).
+     */
+    async graphQuery(json) {
+        const query = toGraphQuery(json);
+        await authorizeGraphQuery(json, query, 'graphQuery');
+        if (!query)
+            throw new ServerCallError(400, 'Invalid graph query');
+        try {
+            return await LinkedStorage.graphQuery(query);
+        }
+        catch (err) {
+            throw graphQueryCallError(err);
+        }
+    }
 }
 __decorate([
     callable('public'),
@@ -119,4 +140,10 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], LincdServerBackendProvider.prototype, "deleteQuery", null);
+__decorate([
+    callable('public'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], LincdServerBackendProvider.prototype, "graphQuery", null);
 //# sourceMappingURL=backend.js.map

package/lib/esm/backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/backend.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,eAAe;IACrE,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACzC,iBAAiB,CAAC,eAAe,CAC/B,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;gBAC5D,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,wDAAwD;IACxD,0FAA0F;IAC1F,wFAAwF;IACxF,qFAAqF;IACrF,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,wFAAwF;IACxF,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,eAAe;IAGT,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAS;QACtB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;CACF;AA1DO;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;sDAGlB;AAuBK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;0DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB","sourcesContent":["import { BackendProvider } from '@_linked/server-utils/utils/BackendProvider';\nimport { callable } from '@_linked/server-utils/utils/callable';\nimport { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { LocalFileStore } from './shapes/filestores/LocalFileStore.js';\nimport {\n  authorizeGenericQuery,\n  resolveQueryCatalog,\n  toQueryBuilder,\n} from './utils/queryPlane.js';\nimport path from 'path';\nimport fs from 'fs/promises';\n\nexport default class LincdServerBackendProvider extends BackendProvider {\n  async setupBeforeControllers() {\n    if (!LinkedFileStorage.getDefaultStore()) {\n      LinkedFileStorage.setDefaultStore(\n        new LocalFileStore(process.env.NODE_ENV + '-filestore')\n      );\n    }\n    let fileSystemUploadPath = path.join('data', 'filestores');\n    try {\n      await fs.access(fileSystemUploadPath);\n    } catch (err) {\n      await fs.mkdir(path.join(fileSystemUploadPath, 'filestores'), {\n        recursive: true,\n      });\n    }\n  }\n\n  /**\n   * Reachability check for a `RemoteDataset` pointed at this server: reads nothing, changes\n   * nothing. A plain linked server has no token concept, so it always answers `{ok: true}`;\n   * a host that serves the wire with tokens answers 401 for a refused one.\n   */\n  @callable('public')\n  async ping(): Promise<{ ok: true }> {\n    return { ok: true };\n  }\n\n  // ── Generic query execution ──────────────────────────────────────────────\n  //\n  // These answer `RemoteDataset`: a browser's store calls\n  // `Server.call(packageName, {method}, json)` (the PACKAGE form), and a remote app's store\n  // posts the same `{args}` body to `{url}/call/@_linked/server/<method>`. Either way the\n  // request arrives here on the generic provider rather than through Shape resolution.\n  //\n  // A query cannot cross the wire live, so the client ships `toJSON()` and `fromJSON()`\n  // rehydrates it here into a live, closed query. `LinkedStorage` then routes it by the\n  // QUERY's shape, which is what decides the target dataset; the store instance never\n  // participates. The host's catalog resolver (`setQueryCatalogResolver`) picks the shape\n  // catalog the JSON is decoded in; the builder keeps it for both lowerings.\n  //\n  // Every query is checked first against the access rules of the stores it\n  // maps to, declared in the app's storage config (`withAccess`; a store with\n  // no rule requires a session): see utils/queryPlane. INTERIM model, to be\n  // rethought. The store runs the builder that was checked. They are declared\n  // 'public' because that check, not the RPC layer, decides whether a session\n  // is required.\n\n  @callable('public')\n  async selectQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('select', json, query, 'selectQuery');\n    return LinkedStorage.selectQuery(query);\n  }\n\n  @callable('public')\n  async askQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('ask', json, query, 'askQuery');\n    return LinkedStorage.askQuery(query);\n  }\n\n  @callable('public')\n  async updateQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('update', json, query, 'updateQuery');\n    return LinkedStorage.updateQuery(query);\n  }\n\n  @callable('public')\n  async createQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('create', json, query, 'createQuery');\n    return LinkedStorage.createQuery(query);\n  }\n\n  @callable('public')\n  async deleteQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('delete', json, query, 'deleteQuery');\n    return LinkedStorage.deleteQuery(query);\n  }\n}\n"]}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/backend.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAC9E,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,MAAM,CAAC,OAAO,OAAO,0BAA2B,SAAQ,eAAe;IACrE,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,EAAE,CAAC;YACzC,iBAAiB,CAAC,eAAe,CAC/B,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,IAAI,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;gBAC5D,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,wDAAwD;IACxD,0FAA0F;IAC1F,wFAAwF;IACxF,qFAAqF;IACrF,EAAE;IACF,sFAAsF;IACtF,sFAAsF;IACtF,oFAAoF;IACpF,wFAAwF;IACxF,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,eAAe;IAGT,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAC,IAAS;QACtB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,IAAS;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAClE,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,UAAU,CAAC,IAAS;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AA9EO;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;sDAGlB;AAuBK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;0DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAGK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;6DAKlB;AAWK;IADL,QAAQ,CAAC,QAAQ,CAAC;;;;4DAUlB","sourcesContent":["import { BackendProvider } from '@_linked/server-utils/utils/BackendProvider';\nimport { callable } from '@_linked/server-utils/utils/callable';\nimport { LinkedFileStorage } from '@_linked/core/utils/LinkedFileStorage';\nimport { LinkedStorage } from '@_linked/core/utils/LinkedStorage';\nimport { LocalFileStore } from './shapes/filestores/LocalFileStore.js';\nimport {\n  authorizeGenericQuery,\n  authorizeGraphQuery,\n  graphQueryCallError,\n  resolveQueryCatalog,\n  toGraphQuery,\n  toQueryBuilder,\n} from './utils/queryPlane.js';\nimport { ServerCallError } from '@_linked/server-utils/utils/ServerCallError';\nimport path from 'path';\nimport fs from 'fs/promises';\n\nexport default class LincdServerBackendProvider extends BackendProvider {\n  async setupBeforeControllers() {\n    if (!LinkedFileStorage.getDefaultStore()) {\n      LinkedFileStorage.setDefaultStore(\n        new LocalFileStore(process.env.NODE_ENV + '-filestore')\n      );\n    }\n    let fileSystemUploadPath = path.join('data', 'filestores');\n    try {\n      await fs.access(fileSystemUploadPath);\n    } catch (err) {\n      await fs.mkdir(path.join(fileSystemUploadPath, 'filestores'), {\n        recursive: true,\n      });\n    }\n  }\n\n  /**\n   * Reachability check for a `RemoteDataset` pointed at this server: reads nothing, changes\n   * nothing. A plain linked server has no token concept, so it always answers `{ok: true}`;\n   * a host that serves the wire with tokens answers 401 for a refused one.\n   */\n  @callable('public')\n  async ping(): Promise<{ ok: true }> {\n    return { ok: true };\n  }\n\n  // ── Generic query execution ──────────────────────────────────────────────\n  //\n  // These answer `RemoteDataset`: a browser's store calls\n  // `Server.call(packageName, {method}, json)` (the PACKAGE form), and a remote app's store\n  // posts the same `{args}` body to `{url}/call/@_linked/server/<method>`. Either way the\n  // request arrives here on the generic provider rather than through Shape resolution.\n  //\n  // A query cannot cross the wire live, so the client ships `toJSON()` and `fromJSON()`\n  // rehydrates it here into a live, closed query. `LinkedStorage` then routes it by the\n  // QUERY's shape, which is what decides the target dataset; the store instance never\n  // participates. The host's catalog resolver (`setQueryCatalogResolver`) picks the shape\n  // catalog the JSON is decoded in; the builder keeps it for both lowerings.\n  //\n  // Every query is checked first against the access rules of the stores it\n  // maps to, declared in the app's storage config (`withAccess`; a store with\n  // no rule requires a session): see utils/queryPlane. INTERIM model, to be\n  // rethought. The store runs the builder that was checked. They are declared\n  // 'public' because that check, not the RPC layer, decides whether a session\n  // is required.\n\n  @callable('public')\n  async selectQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('select', json, query, 'selectQuery');\n    return LinkedStorage.selectQuery(query);\n  }\n\n  @callable('public')\n  async askQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('ask', json, query, 'askQuery');\n    return LinkedStorage.askQuery(query);\n  }\n\n  @callable('public')\n  async updateQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('update', json, query, 'updateQuery');\n    return LinkedStorage.updateQuery(query);\n  }\n\n  @callable('public')\n  async createQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('create', json, query, 'createQuery');\n    return LinkedStorage.createQuery(query);\n  }\n\n  @callable('public')\n  async deleteQuery(json: any) {\n    const query = toQueryBuilder(json, await resolveQueryCatalog(json));\n    await authorizeGenericQuery('delete', json, query, 'deleteQuery');\n    return LinkedStorage.deleteQuery(query);\n  }\n\n  /**\n   * A whole-graph operation (`graph_create`, `graph_replace`, `graph_patch`, `graph_drop`), as\n   * `RemoteDataset.graphQuery` sends it. The query is plain data: core's `parseGraphQuery` checks\n   * it, the `graph` rule of the store its record class routes to decides (no rule refuses), and\n   * `LinkedStorage.graphQuery` runs it outside any shape catalog; no catalog is resolved for it,\n   * so the check resolves the same store. A store's refusal answers with its code (see\n   * `graphQueryCallError`).\n   */\n  @callable('public')\n  async graphQuery(json: any) {\n    const query = toGraphQuery(json);\n    await authorizeGraphQuery(json, query, 'graphQuery');\n    if (!query) throw new ServerCallError(400, 'Invalid graph query');\n    try {\n      return await LinkedStorage.graphQuery(query);\n    } catch (err) {\n      throw graphQueryCallError(err);\n    }\n  }\n}\n"]}

package/lib/esm/data/shapes.ttl

@@ -0,0 +1,26 @@
+@prefix core: <https://linked.cm/ont/core/> .
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+
+<https://linked.cm/shape/server/LincdAPI>
+  a sh:NodeShape ;
+  sh:targetClass <https://linked.cm/ont/server/LincdAPI> .
+
+<https://linked.cm/shape/server/LincdWebApp>
+  a sh:NodeShape ;
+  sh:property <https://linked.cm/shape/server/LincdWebApp/api> ;
+  sh:targetClass <https://linked.cm/ont/server/LincdWebApp> .
+
+<https://linked.cm/shape/server/LincdWebApp/api>
+  a sh:PropertyShape ;
+  rdfs:label "api" ;
+  sh:maxCount "1"^^xsd:integer ;
+  sh:node <https://linked.cm/shape/server-utils/Lincd_API_Client> ;
+  sh:nodeKind sh:IRI ;
+  sh:path <https://linked.cm/ont/server/hasAPI> .
+
+<https://linked.cm/shape/server/LinkedServer>
+  a sh:NodeShape ;
+  sh:targetClass <https://linked.cm/ont/server/LincdServer> .

package/lib/esm/shapes/LinkedServer.d.ts

@@ -84,6 +84,8 @@ export declare class LinkedServer extends Shape {
     private linkedPackageDirs;
     /** The app's own workspace packages (`linkedPackage: true`), by real path. */
     private workspacePackageDirs;
+    /** The names of the app's own workspace packages. */
+    private workspacePackageNames;
     private warnedDuplicateInstalls;
     private resizePathsMap;
     private api;
@@ -105,32 +107,34 @@ export declare class LinkedServer extends Shape {
     initOnly(): Promise<this>;
     private initOnlyBoot;
     /**
-     * Materialize this server's registered shapes into the RDF store as SHACL
-     * (core `syncShapes` → pure `sh:NodeShape` + property shapes), so a running
-     * app's app-data holds the shapes its instances validate/query against.
-     * Whatever shapes the app package registers (published re-exports +
-     * generated) are written on boot, and again when the host asks for it over
-     * the control channel ({@link resyncShapes}). A source reload (HMR) does not
-     * sync shapes by itself.
+     * Sync this server's registered shapes into app data, one named graph per package (see
+     * utils/syncShapes): each package's shapes in `{package IRI}/graph/shapes`, from its built
+     * `shapes.ttl` (an installed package without one gets no shape graph), the app's own packages
+     * generated in process in dev (through Vite's loader), and the app's generated single-owner
+     * shapes in `{DATA_ROOT}/graph/shapes`. Runs at boot, after the ontology sync, and again when
+     * the host asks for it over the control channel ({@link resyncShapes}). A source reload (HMR)
+     * does not sync shapes by itself.
      *
-     * Core writes only the shapes whose stored hash differs, so a sync of
-     * unchanged shapes writes nothing.
+     * A graph whose stored content hash matches is not written, so a sync of unchanged shapes
+     * writes nothing. Shapes an earlier sync wrote into the default graph are removed there once
+     * their package's graph holds them; a store without graph queries gets that default-graph sync
+     * instead.
      *
-     * Additive only: store shapes this process did not register are left alone
-     * unless the operator sets `LINKED_SYNC_SHAPES_PRUNE_ORPHANS=true` — see
-     * `bootOrphanScope` in utils/syncShapes for why.
+     * Shape graphs of packages no longer registered stay unless the operator sets
+     * `LINKED_SYNC_SHAPES_PRUNE_ORPHANS=true` — see `bootOrphanScope` in utils/syncShapes.
      *
      * Opt-out via `linked.config` `syncShapesOnBoot` (default true); env
-     * LINKED_SYNC_SHAPES_ON_BOOT overrides for deployment. CN sets
-     * `syncShapesOnBoot: false` in its own linked.config — its default dataset is
-     * a context-router that can't materialize context-free, and it syncs its own
-     * pinned shapes separately (linked.backend.storage.js).
+     * LINKED_SYNC_SHAPES_ON_BOOT overrides for deployment. A host whose default
+     * dataset is a context router (one that can't write context-free) sets
+     * `syncShapesOnBoot: false` and syncs its shapes itself.
      */
     private materializeShapesIntoStore;
     /** One shape sync into the default dataset; throws when it fails. */
     private syncRegisteredShapes;
+    /** The root directory of a package with shapes: the app, a discovered linked package, or one the app resolves. */
+    private shapePackageDir;
     /**
-     * Boot: sync the registered ontologies' class hierarchy into app data and run the shape
+     * Boot: sync the registered ontologies into their graphs in app data and run the shape
      * check, before the shape sync (see utils/ontologySync). The sync follows the shape sync's
      * switch (`syncShapesOnBoot`, `LINKED_SYNC_SHAPES_ON_BOOT`), plus the opt-out
      * `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`; the in-memory class hierarchy is loaded either way.
@@ -141,7 +145,7 @@ export declare class LinkedServer extends Shape {
      * Every discovered linked package and every workspace package of the app registers its
      * ontologies (in dev, an unbuilt one through Vite), then the ontology sync (when
      * `sync` is set) into the default dataset, then the shape check.
-     * Orphaned sync nodes are pruned under the shape sync's orphan policy
+     * Orphaned ontology graphs (and earlier sync nodes) are pruned under the shape sync's orphan policy
      * (`LINKED_SYNC_SHAPES_PRUNE_ORPHANS`).
      */
     private runOntologyPhase;
@@ -318,7 +322,7 @@ export declare class LinkedServer extends Shape {
     private assertSessionForLevel;
     handleErrors(fn: any): (req: any, res: any, next: any) => Promise<any>;
     handleErrorsJson(fn: any): (req: any, res: any, next: any) => Promise<any>;
-    sendError(res: any, statusCode: number, message: any, logMessage?: string): void;
+    sendError(res: any, statusCode: number, message: any, logMessage?: string, code?: string): void;
     /**
      * The stylesheets a dev (Vite) page render needs, inlined into
      * `<style id="ssr-css">` so the first paint is styled before Vite's client

package/lib/esm/shapes/LinkedServer.js

@@ -137,9 +137,9 @@ import { resolveStaticAccessURL, staticAssetURL, } from '../utils/releaseManifes
 import { resolveBootstrapEntry, resolveViteMainEntry, resolveViteServingMode, } from '../utils/bootstrapEntry.js';
 import { resolveRouteAssets } from '../utils/routeAssets.js';
 import { resolveRouteComponent, ssrCssInlineUrls, ssrCssScope, } from '../utils/ssrCss.js';
-import { bootOrphanScope, materializeShapes } from '../utils/syncShapes.js';
+import { appShapesGraph, bootOrphanScope, loadShapeGraphCore, syncShapeGraphsInto, viteShapesTurtleGenerator, } from '../utils/syncShapes.js';
 import { bootSyncsOntologies, loadOntologyCore, runOntologyPhase, ontologyPackageDirs, sourceModuleImporter, shapeSyncOn, syncOntologiesThenShapes, } from '../utils/ontologySync.js';
-import { AdminRequestError, assertReloadablePackages, registerAdminRoutes, } from '../utils/adminChannel.js';
+import { AdminRequestError, assertReloadablePackages, registerAdminRoutes, resolveAdminSecret, } from '../utils/adminChannel.js';
 import { envMs, withTimeout } from '../utils/withTimeout.js';
 import { invalidateSourceUnder } from '../utils/reloadSource.js';
 import { installSpaFallback, repinSpaFallback, } from '../utils/spaFallback.js';
@@ -286,6 +286,8 @@ let LinkedServer = class LinkedServer extends Shape {
         this.linkedPackageDirs = new Map();
         /** The app's own workspace packages (`linkedPackage: true`), by real path. */
         this.workspacePackageDirs = [];
+        /** The names of the app's own workspace packages. */
+        this.workspacePackageNames = new Set();
         this.warnedDuplicateInstalls = new Set();
         //from resizedFileName to full resized path (CDN or similar)
         this.resizePathsMap = new Map();
@@ -366,52 +368,76 @@ let LinkedServer = class LinkedServer extends Shape {
         return this;
     }
     /**
-     * Materialize this server's registered shapes into the RDF store as SHACL
-     * (core `syncShapes` → pure `sh:NodeShape` + property shapes), so a running
-     * app's app-data holds the shapes its instances validate/query against.
-     * Whatever shapes the app package registers (published re-exports +
-     * generated) are written on boot, and again when the host asks for it over
-     * the control channel ({@link resyncShapes}). A source reload (HMR) does not
-     * sync shapes by itself.
+     * Sync this server's registered shapes into app data, one named graph per package (see
+     * utils/syncShapes): each package's shapes in `{package IRI}/graph/shapes`, from its built
+     * `shapes.ttl` (an installed package without one gets no shape graph), the app's own packages
+     * generated in process in dev (through Vite's loader), and the app's generated single-owner
+     * shapes in `{DATA_ROOT}/graph/shapes`. Runs at boot, after the ontology sync, and again when
+     * the host asks for it over the control channel ({@link resyncShapes}). A source reload (HMR)
+     * does not sync shapes by itself.
      *
-     * Core writes only the shapes whose stored hash differs, so a sync of
-     * unchanged shapes writes nothing.
+     * A graph whose stored content hash matches is not written, so a sync of unchanged shapes
+     * writes nothing. Shapes an earlier sync wrote into the default graph are removed there once
+     * their package's graph holds them; a store without graph queries gets that default-graph sync
+     * instead.
      *
-     * Additive only: store shapes this process did not register are left alone
-     * unless the operator sets `LINKED_SYNC_SHAPES_PRUNE_ORPHANS=true` — see
-     * `bootOrphanScope` in utils/syncShapes for why.
+     * Shape graphs of packages no longer registered stay unless the operator sets
+     * `LINKED_SYNC_SHAPES_PRUNE_ORPHANS=true` — see `bootOrphanScope` in utils/syncShapes.
      *
      * Opt-out via `linked.config` `syncShapesOnBoot` (default true); env
-     * LINKED_SYNC_SHAPES_ON_BOOT overrides for deployment. CN sets
-     * `syncShapesOnBoot: false` in its own linked.config — its default dataset is
-     * a context-router that can't materialize context-free, and it syncs its own
-     * pinned shapes separately (linked.backend.storage.js).
+     * LINKED_SYNC_SHAPES_ON_BOOT overrides for deployment. A host whose default
+     * dataset is a context router (one that can't write context-free) sets
+     * `syncShapesOnBoot: false` and syncs its shapes itself.
      */
     async materializeShapesIntoStore() {
         try {
-            await this.syncRegisteredShapes();
+            await runAsSystem(() => this.syncRegisteredShapes(), 'shape sync at boot');
         }
         catch (err) {
-            console.warn('[LinkedServer] shape materialization failed (non-fatal):', err);
+            console.warn('[LinkedServer] shape sync failed (non-fatal):', err);
         }
     }
     /** One shape sync into the default dataset; throws when it fails. */
     async syncRegisteredShapes() {
-        var _a;
+        var _a, _b, _c, _d, _e;
         if (!shapeSyncOn(process.env, (_a = this.config) === null || _a === void 0 ? void 0 : _a.syncShapesOnBoot)) {
             return { written: 0, skipped: 'disabled' };
         }
         const appData = LinkedStorage.getDefaultDataset();
         if (!appData)
             return { written: 0, skipped: 'no-default-dataset' };
-        const { syncShapes } = await import('@_linked/core');
-        // Explicit target: materialize EVERY registered shape into the app's own
-        // data store regardless of per-shape routing/pins.
-        const { count, orphanScope } = await materializeShapes(appData, syncShapes);
-        return { written: count, orphanScope };
+        const orphanScope = bootOrphanScope();
+        const appName = (_b = this.package) === null || _b === void 0 ? void 0 : _b.name;
+        const vite = (_c = this.config.server) === null || _c === void 0 ? void 0 : _c.vite;
+        const generate = viteShapesTurtleGenerator(vite);
+        // Explicit target: every registered shape goes into the app's own data store, regardless of
+        // per-shape routing or pins.
+        const shapeGraphs = await syncShapeGraphsInto(appData, {
+            core: await loadShapeGraphCore(),
+            orphanScope,
+            isOwn: (name) => name === appName || this.workspacePackageNames.has(name),
+            dev: !!generate,
+            generate,
+            packageDirOf: (name) => this.shapePackageDir(name),
+            appGraph: appShapesGraph(),
+            appPackage: appName,
+        });
+        const written = (_d = shapeGraphs.defaultGraph) !== null && _d !== void 0 ? _d : shapeGraphs.written.length + (((_e = shapeGraphs.appGraph) === null || _e === void 0 ? void 0 : _e.status) === 'written' ? 1 : 0);
+        return { written, orphanScope, shapeGraphs };
+    }
+    /** The root directory of a package with shapes: the app, a discovered linked package, or one the app resolves. */
+    shapePackageDir(name) {
+        var _a, _b;
+        if (name === ((_a = this.package) === null || _a === void 0 ? void 0 : _a.name))
+            return process.cwd();
+        const known = (_b = this.linkedPackageDirs) === null || _b === void 0 ? void 0 : _b.get(name);
+        if (known)
+            return known;
+        const installed = readInstalledPackage(name, process.cwd());
+        return installed === null || installed === void 0 ? void 0 : installed.root;
     }
     /**
-     * Boot: sync the registered ontologies' class hierarchy into app data and run the shape
+     * Boot: sync the registered ontologies into their graphs in app data and run the shape
      * check, before the shape sync (see utils/ontologySync). The sync follows the shape sync's
      * switch (`syncShapesOnBoot`, `LINKED_SYNC_SHAPES_ON_BOOT`), plus the opt-out
      * `LINKED_SYNC_ONTOLOGIES_ON_BOOT=false`; the in-memory class hierarchy is loaded either way.
@@ -429,7 +455,7 @@ let LinkedServer = class LinkedServer extends Shape {
      * Every discovered linked package and every workspace package of the app registers its
      * ontologies (in dev, an unbuilt one through Vite), then the ontology sync (when
      * `sync` is set) into the default dataset, then the shape check.
-     * Orphaned sync nodes are pruned under the shape sync's orphan policy
+     * Orphaned ontology graphs (and earlier sync nodes) are pruned under the shape sync's orphan policy
      * (`LINKED_SYNC_SHAPES_PRUNE_ORPHANS`).
      */
     async runOntologyPhase(sync) {
@@ -726,8 +752,8 @@ let LinkedServer = class LinkedServer extends Shape {
             res.sendStatus(200);
         });
         // The host's control channel (/admin/*), open only when the host started
-        // this process with CN_APP_ADMIN_SECRET; see utils/adminChannel.
-        registerAdminRoutes(this.server, process.env.CN_APP_ADMIN_SECRET, {
+        // this process with APP_ADMIN_SECRET; see utils/adminChannel.
+        registerAdminRoutes(this.server, resolveAdminSecret(), {
             // The host's provisioner starts the app again after it exits.
             exit: () => process.exit(0),
             syncShapes: (request) => this.resyncShapes(request),
@@ -829,6 +855,7 @@ let LinkedServer = class LinkedServer extends Shape {
         // Local workspace packages in this app's dependency tree. These are also
         // imported whole at boot (indexLincdPackage), not only their /backend.
         const allLocalPackages = getLincdPackages();
+        this.workspacePackageNames = new Set(allLocalPackages.map((pkg) => pkg.packageName));
         this.workspacePackageDirs = allLocalPackages.map((pkg) => {
             try {
                 return fsNative.realpathSync(pkg.path);
@@ -1819,17 +1846,20 @@ let LinkedServer = class LinkedServer extends Shape {
             catch (err) {
                 // A ServerCallError (e.g. 501 for a call no provider handles) carries
                 // its own status and a message that is safe to send to the client.
+                // A `code` on it (a graph query refusal, see utils/queryPlane) is sent along, so
+                // a remote caller can tell the refusals apart.
                 if (ServerCallError.is(err)) {
-                    return this.sendError(res, err.status, err.message);
+                    const code = err.code;
+                    return this.sendError(res, err.status, err.message, undefined, typeof code === 'string' ? code : undefined);
                 }
                 this.sendError(res, 500, 'internal server error' + (isDevelopment ? ': ' + (err === null || err === void 0 ? void 0 : err.stack) : ''), 'internal server error: ' + (err === null || err === void 0 ? void 0 : err.stack));
             }
         };
     }
-    sendError(res, statusCode = 500, message, logMessage) {
+    sendError(res, statusCode = 500, message, logMessage, code) {
         res === null || res === void 0 ? void 0 : res.status(statusCode);
         if (message) {
-            res === null || res === void 0 ? void 0 : res.send({ error: message });
+            res === null || res === void 0 ? void 0 : res.send(code ? { error: message, code } : { error: message });
             console.warn(paint('red', logMessage || message));
         }
     }