…rors, sanitize

Review fixes #2,JavaScriptSolidServer#3,JavaScriptSolidServer#5,JavaScriptSolidServer#6,JavaScriptSolidServer#8,JavaScriptSolidServer#12:
- JavaScriptSolidServer#3 readAcl: detect container-ness from storage and resolve <dir>/.acl (not
  <dir>.acl) for a slashless container path, and run the Control check against
  the normalized target — was showing an empty ACL for a governed container.
- JavaScriptSolidServer#5/JavaScriptSolidServer#6/JavaScriptSolidServer#12 new src/mcp/read.js#readBounded: one byte-range bounded read shared
  by lws://resource and describe_resource. Bounds memory (no full read of a
  huge object), and surfaces an explicit truncation marker so a clipped body
  isn't taken as whole. Body content-type label now uses getContentType.
- JavaScriptSolidServer#8 readSkillResource: only a genuinely-missing skill is not-found; a read/
  parse failure surfaces as INTERNAL_ERROR instead of being masked.
- #2 sanitizeTypes: client-controlled declared types + describedby shape IRIs
  are stripped of hidden/bidi chars before entering linkset/describe responses;
  captureDeclaredTypes now validates the MCP `types` path to absolute URIs (the
  HTTP Link path already did) so no free-text value is persisted.
- JavaScriptSolidServer#12 wac.parentPath delegates to utils/url.getParentContainer.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Correctness/security: transactional put_typed_resource .meta (#1),
type/describedby + federated-content sanitize (#2/JavaScriptSolidServer#7), container ACL-path
resolution (JavaScriptSolidServer#3), malformed-percent invalid-params (JavaScriptSolidServer#4), bounded read +
truncation signal (JavaScriptSolidServer#5/JavaScriptSolidServer#6), skill read-error not masked (JavaScriptSolidServer#8), resource-error
teaching content (JavaScriptSolidServer#9). Maintainability: single surface registry (JavaScriptSolidServer#11),
helper reuse (JavaScriptSolidServer#12), restored live-gate coverage (JavaScriptSolidServer#10, lws-pod repo).

All fork changes TDD'd in test/mcp-v2-review-fixes.test.js; mcp/lws/wac/acl/
storage/container/handler suites green per-file.

…he write choke point (review #2, JavaScriptSolidServer#10)

- writeTypeConsistency runs inside applyLwsWrite: HTTP PUT/POST and all
  three MCP write tools share ONE gate; the MCP bypass is closed
- application/json gates as JSON-LD (pipeline parity)
- non-RDF body at an RDF-extension name is refused (the SHACL-skip lie)
- callers handle the new problem return; HTTP local gate calls deleted

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…message (task-6 review #2)

- the --lws-off 415 base string returns to the pre-round wording
  ("...text/n3 (N3 Patch) or application/sparql-update (SPARQL Update)");
  the merge-patch clause is appended only under request.lwsEnabled
- new test pins the exact --lws-off 415 body with deepEqual against a
  { conneg: true } (no lws) server

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…ag/304 conformance, PATCH MUSTs, MCP sanitize + SSRF consolidation (review 2026-07-12 B1-B12 + P1-P3)

Closes the 12 (B) findings + 3 (C) pre-existing conformance violations from the
2026-07-12 post-drain code review, TDD per finding, each task spec+quality reviewed:

- #2/JavaScriptSolidServer#10 write-consistency gate moves into applyLwsWrite (the shared choke point);
  application/json gates as JSON-LD; non-RDF body at an RDF name refused
- JavaScriptSolidServer#9 slug-less POST of RDF derives a server-side extension
- JavaScriptSolidServer#6 verbatim NT/NQ parse through n3; JSON-LD is graph-capable
- JavaScriptSolidServer#5 JSON-LD conversion arm gets a variant ETag (RFC 9110 §8.8.3)
- JavaScriptSolidServer#4 pending RDF conversion defers the early 304; 406 carries no ETag (§13.2.2)
- JavaScriptSolidServer#7/P1/P2 PATCH applies at the dataset level (no JSON-LD document detour);
  JSON Merge Patch (RFC 7386); bodied write without Content-Type → 400
- JavaScriptSolidServer#3/JavaScriptSolidServer#12/JavaScriptSolidServer#13 MCP sanitizes altr reps + type-search items; read_resource mimeType
- JavaScriptSolidServer#8/JavaScriptSolidServer#14 per-hop redirect revalidation restores the 303 VoID rail; one SSRF table
- P3 application/json is a first-class container + storage-description label

Fork suite 1545/0/1 (the 1 skip + the isolated mcp-lws-read open-handle file
both pre-existing). la3d/lws-review = 4824fe2..7165855, 18 commits.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…ntResolution capability

- buildStorageDescription gains uriSpacePrefixes; the capability carries
  uriSpace: [<absolute prefix>...] (the void:uriSpace values) so a cold agent
  recognizes minted IRIs on its first storage-description read (probe #2)
- prefixes only (container/suffix mapping stays internal; 303 is the resolver);
  threaded identically to HTTP + MCP; flag-off document byte-identical

Co-Authored-By: Claude Opus 4.8 <[email protected]>