Run the import-ontology transform client-side; delete the /transform endpoint

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
+### Added
+- Bundled client-side SPARQL engine (Comunica) for in-browser CONSTRUCT execution, lazily loaded on first use
+
 ### Changed
+- **BREAKING**: "Import ontology" transform orchestrated client-side — the browser runs the CONSTRUCT in-browser (bundled SPARQL engine), the CLI (`import-ontology.sh`) runs it via Jena `sparql`; replaces the `/transform` endpoint
 - Application ontologies resolved as a native ontapi `owl:imports` union graph (cached per ontology URI), no RDFS inference — replaces the manually flattened, RDFS-materialized model
 - `Namespace` no-query GET serves the raw ontology graph from the shared repository instead of rebuilding one per request
 - **BREAKING**: "Add data" and "Generate containers" orchestrated client-side over the Graph Store Protocol (POST-append via `?uri=` proxy; per-class container PUT fan-out embedding the view as `ldh:Object` → `rdf:value` → `ldh:View`), replacing the `/add` and `/generate` endpoints
@@ -9,7 +13,7 @@
 
 ### Removed
 - Linked Data proxy no longer serves ontology terms (now dumb transport: bundled-vocab file cache + SSRF-checked external fetch); ontology terms served by `/ns`
-- **BREAKING**: `/add` and `/generate` server-side endpoints (`Add`/`Generate` JAX-RS resources), superseded by the client-orchestrated writes; removes their server-side fetch/SSRF surface (LNK-002); `/transform` retained until a client-side SPARQL engine lands
+- **BREAKING**: `/add`, `/generate` and `/transform` server-side endpoints (`Add`/`Generate`/`Transform` JAX-RS resources), superseded by the client-orchestrated writes; removes their server-side fetch/SSRF surface (LNK-002)
 
 ## [5.7.1] - 2026-08-06
 ### Changed

bin/admin/ontologies/import-ontology.sh

@@ -2,20 +2,26 @@
 
 print_usage()
 {
-    printf "Imports external ontology into the model.\n"
+    printf "Imports an external ontology into a document.\n"
+    printf "\n"
+    printf "Fetches the source ontology, runs the construct-constructors CONSTRUCT query over it locally\n"
+    printf "(Jena sparql), and appends the result to the target graph over the Graph Store Protocol.\n"
     printf "\n"
     printf "Usage:  %s options\n" "$0"
     printf "\n"
     printf "Options:\n"
     printf "  -f, --cert-pem-file CERT_FILE        .pem file with the WebID certificate of the agent\n"
     printf "  -p, --cert-password CERT_PASSWORD    Password of the WebID certificate\n"
-    printf "  --proxy PROXY_URL                    The host this request will be proxied through (optional)\n"
+    printf "  -b, --base BASE_URI                  Base URI of the application\n"
+    printf "  --proxy PROXY_URL                    The host requests to the application are proxied through (optional)\n"
     printf "\n"
     printf "  --source SOURCE_URI                  URI of the imported ontology\n"
+    printf "  --graph GRAPH_URI                    URI of the target document the result is appended to\n"
 }
 
-hash turtle 2>/dev/null || { echo >&2 "turtle not on \$PATH.  Aborting."; exit 1; }
+hash sparql 2>/dev/null || { echo >&2 "sparql (Jena) not on \$PATH. Aborting."; exit 1; }
 hash curl 2>/dev/null || { echo >&2 "curl not on \$PATH. Aborting."; exit 1; }
+hash xmllint 2>/dev/null || { echo >&2 "xmllint not on \$PATH. Aborting."; exit 1; }
 
 args=()
 while [[ $# -gt 0 ]]
@@ -82,20 +88,54 @@ if [ -z "$graph" ] ; then
     exit 1
 fi
 
-target="${base}transform"
+# rewrite an application URL's host to the proxy host, when a proxy is given
+rewrite_proxy()
+{
+    local url="$1"
+
+    if [ -n "$proxy" ]; then
+        local url_host proxy_host
+        url_host=$(echo "$url" | cut -d '/' -f 1,2,3)
+        proxy_host=$(echo "$proxy" | cut -d '/' -f 1,2,3)
+        echo "${url/$url_host/$proxy_host}"
+    else
+        echo "$url"
+    fi
+}
+
+query_doc="${base}queries/construct-constructors/"
+query_url=$(rewrite_proxy "$query_doc")
+graph_url=$(rewrite_proxy "$graph")
+
+tmp_dir=$(mktemp -d)
+trap 'rm -rf "$tmp_dir"' EXIT
 
-if [ -n "$proxy" ]; then
-    # rewrite target hostname to proxy hostname
-    target_host=$(echo "$target" | cut -d '/' -f 1,2,3)
-    proxy_host=$(echo "$proxy" | cut -d '/' -f 1,2,3)
-    target="${target/$target_host/$proxy_host}"
+# 1. fetch the construct-constructors query document, then extract its exact sp:text via a SPARQL SELECT
+
+curl -s -k -E "$cert_pem_file":"$cert_password" -H "Accept: text/turtle" "$query_url" > "$tmp_dir/query.ttl"
+
+cat > "$tmp_dir/extract-text.rq" <<RQ
+PREFIX sp: <http://spinrdf.org/spin#>
+SELECT ?text WHERE { <${base}queries/construct-constructors/#this> sp:text ?text }
+RQ
+
+sparql --data "$tmp_dir/query.ttl" --query "$tmp_dir/extract-text.rq" --results=XML \
+  | xmllint --xpath 'string(//*[local-name()="literal"])' - \
+  > "$tmp_dir/construct.rq"
+
+if [ ! -s "$tmp_dir/construct.rq" ]; then
+    echo >&2 "Could not extract the CONSTRUCT query (sp:text) from ${query_doc}. Aborting."
+    exit 1
 fi
 
-content_type="text/turtle"
+# 2. run the CONSTRUCT over the source ontology locally, producing Turtle
+
+sparql --data "$source" --query "$tmp_dir/construct.rq" --results=Turtle > "$tmp_dir/result.ttl"
 
-turtle+="_:arg <http://purl.org/dc/terms/source> <${source}> .\n"
-turtle+="_:arg <http://www.w3.org/ns/sparql-service-description#name> <${graph}> .\n"
-turtle+="_:arg <http://spinrdf.org/spin#query> <${base}queries/construct-constructors/#this> .\n"
+# 3. append the transformed triples to the target graph (Graph Store Protocol POST)
 
-# submit Turtle doc to the server
-echo -e "$turtle" | turtle --base="$target" | curl -s -k -E "$cert_pem_file":"$cert_password" -d @- -H "Content-Type: $content_type" -H "Accept: text/turtle" "$target" -s -D -
+curl -s -k -E "$cert_pem_file":"$cert_password" \
+  --data-binary @"$tmp_dir/result.ttl" \
+  -H "Content-Type: text/turtle" \
+  -H "Accept: text/turtle" \
+  "$graph_url" -D -