Run the import-ontology transform client-side; delete the /transform endpoint

[namedgraph]

Summary

Moves the "Import ontology" CONSTRUCT transform off the server on both the browser and CLI paths, so the /transform endpoint is deleted. This removes the last bespoke server-side fetch/SSRF surface (pen-test LNK-002) after /add and /generate were moved client-side, and completes the "until a client-side SPARQL engine lands" caveat from the graph-writes work.

Changes

Browser — client-orchestrated transform

The import-ontology submit handler (modal.xsl) now mirrors the add/clone flow, with an in-browser CONSTRUCT inserted:

add/clone:        GET source (?uri= proxy) ─────────────────────────→ POST target → navigate
import-ontology:  fetch query sp:text → Comunica CONSTRUCT(proxied source) → POST target → navigate

• Fetches the construct-constructors query, extracts sp:text, runs it in-browser over the ?uri=-proxied dct:source, and GSP-appends the Turtle result to the local sd:name target.
• New callbacks ldh:transform-query-response / ldh:transform-construct-response parallel ldh:add-data-source-response.
• The cross-origin-target locality guard from the add/clone variant is carried over.

Client-side SPARQL engine (bundled, lazy)

• Vendors comunica-browser.js (Comunica, prebuilt browser bundle) alongside three.min.js etc.
• Thin wrapper SPARQLTransform.js exposes LinkedDataHub.construct(engineSrc, sourceURL, queryString) → Promise<Turtle> and lazily loads the 2.2 MB engine bundle on first use — nothing heavy loads on ordinary pages. Loaded in the $load-sparql-builder block.

CLI — symmetric local transform

• bin/admin/ontologies/import-ontology.sh no longer POSTs to /transform. It fetches the query, runs the CONSTRUCT locally via Jena arq, and POSTs the result to the target graph. (Requires arq + perl on $PATH.)

Removals

• Transform.java, its Dispatcher locator, and the 4 /transform HTTP tests.
• The now-unreachable generic form-clone-data RDF/POST submit template (its only caller was the transform variant's xsl:next-match).

⚠️ Verification status

Implemented but not yet exercised in a browser/stack (no runtime in the authoring environment). Confirmed here: both stylesheets XML-well-formed, CLI passes bash -n, no lingering Transform refs, Java change is a trivial locator+import removal. Needs in-browser confirmation of:

• The ixsl:call(...) => ixsl:then(...) bridge — awaiting a plain JS-library promise from Saxon-JS. Documented contract, but no precedent in this codebase.
• Comunica browser API shape (engine.query() → resultToString(result, 'text/turtle') → stream read); the wrapper has an async-iterable fallback but verify.
• mvn -Pstandalone clean package (SEF compile) and a live Import ontology run (e.g. SKOS).

🤖 Generated with Claude Code