@factoidal/core 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,6 +1,119 @@
 # Changelog
 
-## 0.10.0 (unreleased)
+## 0.11.0 — 2026-10-21
+
+No RDF, SPARQL, datatype or IRI decision is made in JavaScript any more
+(https://github.com/danbri/factoidal/issues/894; owner, 2026-10-21: "The ja
+leak fix is p0"). The engine parses, writes, escapes, compares and chooses
+datatypes; the JavaScript copies term components and calls ops.
+`tools/host-purity-lint.sh` group 3 scans the npm and hub JavaScript for RDF
+syntax and runs in `npm test`.
+
+### Breaking changes
+
+These shapes could not be kept:
+
+- `shexValidate` and `Dataset.validateShex`: a focus or shape given as a
+  string is read as one RDF 1.2 N-Triples term (`'<http://…>'` or `'_:b'`);
+  a bare IRI string is refused. Every API that takes a term as a string
+  now reads it through one engine reader (`TermJson.readTermString`), so
+  `_:x` is always a blank node and `<…>` always an IRI.
+- `graphs()` returns `[NamedNode|BlankNode, Dataset]` pairs, not
+  `[string, Dataset]`, so an IRI graph and a blank-node graph with the same
+  text are never confused.
+- A literal with a language and a direction has datatype
+  `rdf:dirLangString` (RDF 1.2 Concepts; RDF/JS Data Model); before, the
+  RDF/JS default gave `rdf:langString`.
+
+- `factoidal lws-serve` and `@factoidal/core/lws` enforce storage-server
+  authorization from the LWS editor's draft (401 with
+  `WWW-Authenticate: Bearer resource_metadata`, the RFC 9728 metadata
+  document, Bearer JWT access tokens checked for signature, `iss`, `aud`,
+  `exp`, `nbf` and `iat`, then Web Access Control). `lws-serve` needs
+  `--issuer IRI`, `--auth-config FILE` or, for development only,
+  `--insecure-no-auth`; `listen()` with neither `auth` nor
+  `insecureNoAuth` serves only what the ACLs give to the public. New op
+  `lwsFetched`. https://github.com/danbri/factoidal/issues/886
+
+- The N-Quads text functions of `@factoidal/core/rdfjs` (`nquadsToQuads`,
+  `nquadsLineToQuad`, `quadsToNQuads`, `quadToNQuads`, `termToNQuads`,
+  `DatasetCore.fromNQuads`, `DatasetCore.prototype.toNQuads`) call the engine.
+  They throw until the engine is loaded: `await ready()` (new) or any other
+  `@factoidal/core` call first. `nquadsToQuads` now rejects a line the
+  N-Quads grammar rejects (before, `<http://e/a b>` was read as an IRI), and
+  the writers escape as the engine's canonical N-Triples form does (before,
+  `\b`, `\f` and other control characters were written raw).
+- A JavaScript number answered by a registered extension function becomes
+  `xsd:integer` only for an integer within ±(2^53 − 1); every other number is
+  an `xsd:double` in the XSD 1.1 canonical form (`1e21` is `"1.0E21"`, before
+  `"1e+21"^^xsd:integer`; `0.1` is `"1.0E-1"`, before `"0.1"`). `NaN`,
+  `Infinity` and `-Infinity` answer `"NaN"`, `"INF"`, `"-INF"`; before they
+  were the §17.6 error. A `bigint` answers `xsd:integer`
+  (`L4Factoidal.XSD.JsValue.jsLiteral`).
+- `queryHdt` answers a Dataset for CONSTRUCT and DESCRIBE; before it threw a
+  TypeError chosen by a regular expression over the query text.
+- `Literal` has a `direction` member (`''`, `'ltr'`, `'rtl'`), and a
+  directional language-tagged string from the engine keeps its direction and
+  its `rdf:dirLangString` datatype; `equals` compares it.
+
+### New
+
+- `isomorphic(a, b)`: dataset isomorphism by the engine
+  (`Dataset.isomorphicOutcome`, blank nodes in triple terms included).
+  `@factoidal/core/fn`'s `equals` uses it.
+- `fromQuads(quads)`: a Dataset from RDF/JS quads, sent as term components.
+- `ready()`: load the engine. `engineTables()`: the engine's format,
+  regime, query-output and pack-syntax name tables.
+- Ops (formal/lean4/Wasm/Ops/Handles.lean): `datasetQuadsJson`,
+  `datasetAddQuadsJson`, `datasetDeleteQuadsJson`, `datasetFromQuadsJson`,
+  `datasetGraphNames`, `datasetGraphAsDefault`, `datasetIsomorphic`,
+  `parseQuadsJson`, `quadsToNQuads`, `termsToNTriples`, `resolveIri`,
+  `queryForm`, `engineTables`; `datasetMatch`/`datasetMatchCount` take term
+  objects. Theorems: `TermJson.decodeTerm_encodeTerm`,
+  `TermJson.decodeQuad_encodeQuad`, `TermJson.mem_quadList_default`,
+  `TermJson.mem_quadList_named`, `TermJson.toCanonicalNQuads_eq_quadList`,
+  `TermJson.quadPage_append`, `XSD.JsValue.doubleLexical_inLexicalSpace`,
+  `XSD.JsValue.integerLexical_inLexicalSpace`,
+  `XSD.JsValue.jsLiteral_number_double`, `XSD.JsValue.jsLiteral_number_integer`.
+
+### Added
+
+- An extension function may answer an exact term: an RDF/JS term
+  (Literal, NamedNode, BlankNode, or a Quad as an RDF 1.2 triple term), or
+  `{value, datatype}`, or `{value, language, direction?}`. The lexical form
+  and the datatype IRI are kept as given, ill-typed literals included (RDF
+  1.1 Concepts §3.3). The engine checks only what RDF requires: absolute
+  IRIs, a well-formed BCP 47 language tag, direction `ltr` or `rtl`; a term
+  that fails is the §17.6 error for that call. A plain JS number still gets
+  its datatype from `jsLiteral`. Theorem `TermJson.extAnswerJson_encodeTerm`:
+  an app-supplied term is the answer, unchanged.
+
+### Performance
+
+- Dataset iteration reads the quads from the engine as one byte region (op
+  `datasetQuadsBin`: a term table in the delta-log v2 term codec and four
+  u32 indices per quad), decoded in JavaScript with `DataView` and
+  `TextDecoder`. 60,000 quads: 178–205 ms under load, against 214–280 ms in
+  0.10.0 and about the time of the N-Quads writer op in the same run.
+  Theorems `decodeBin_quadsBin` and `quadsBin_binSpec`
+  (`formal/lean4/L4Factoidal/RDF/QuadsBinTheorems.lean`) prove the region
+  reads back as exactly the dataset's quads, so no run-time check is made.
+  https://github.com/danbri/factoidal/issues/900
+
+### Fixed
+
+- `graphs()` (both APIs) no longer merges an IRI graph and a blank-node graph
+  whose strings are equal.
+- `Dataset` iteration builds its quads from the engine's term objects; it no
+  longer parses N-Quads text in JavaScript.
+- The Solid client resolves a relative target against `baseIri` by RFC 3986
+  §5.2 (op `resolveIri`); before it concatenated strings.
+- `factoidal query` table cells and `factoidal inspect` graph names are the
+  engine's canonical N-Triples forms (escaped); `factoidal pack` reads its
+  suffix table from the engine and detects the syntax of a file with an
+  unknown suffix from its content.
+
+## 0.10.0 — 2026-10-21
 
 ### Breaking changes
 

package/README.md

@@ -43,6 +43,12 @@ RDF 1.2 input uses `turtle12`, `ntriples12`, `nquads12` or `trig12`.
 - Servers: SPARQL 1.1 Protocol and Graph Store (Fuseki-compatible paths,
   Jena TDB2 read only), Linked Web Storage 1.0, Solid
 - A persisted store with a delta log for updates (early stage)
+- Terms: a JavaScript extension function can answer with an exact term
+  (`{value: "007", datatype: XSD + "integer"}`, an RDF/JS term, a triple
+  term); the engine keeps the lexical form and the datatype IRI as given.
+  A term given as a string is one N-Triples term everywhere (`<http://…>`
+  is an IRI, `_:b` a blank node). See API.md, "Custom extension functions" and
+  "Terms given as strings".
 - RDF/JS DataFactory and DatasetCore (`/rdfjs`), a functional API (`/fn`)
 
 Formats (generated from `formats()`):
@@ -75,7 +81,7 @@ $ npx factoidal serve --tdb2 DIR /ds               # serve a Jena TDB2 database
 $ npx factoidal pack data.ttl store/gen-1 && npx factoidal activate store gen-1
 $ npx factoidal query store 'SELECT * WHERE { ?s ?p ?o } LIMIT 5'
 $ npx factoidal query "$(npx factoidal sample-store)" 'SELECT (COUNT(*) AS ?n) WHERE { ?s ?p ?o }'
-$ npx factoidal lws-serve DIR                      # Linked Web Storage
+$ npx factoidal lws-serve DIR --issuer IRI         # Linked Web Storage
 $ npx factoidal solid-serve DIR                    # Solid Protocol
 ```
 

package/bin/ext.mjs

@@ -33,11 +33,12 @@
 // times the physical plan evaluates the expression, and across
 // re-evaluation rounds.
 
-const XSD = 'http://www.w3.org/2001/XMLSchema#'
 
 /** How many evaluation rounds an async resolution may take. */
 export const EXT_MAX_ROUNDS = 25
 
+import { appTermToJson } from '../rdfjs.mjs'
+
 const extFunctions = new Map()
 const extRegistered = new Set()
 let extCache = new Map()
@@ -45,29 +46,24 @@ let extPending = []
 let bridgeInstalled = false
 
 /**
- * Encode one JavaScript answer as an SRJ binding-value object, as a JSON
- * string. `''` means "no value" — the §17.6 error.
+ * Encode one JavaScript answer for Wasm/Ops/ExtFns.lean, as a JSON string:
+ * the value tagged with its JavaScript type ({js, v}; a number as its
+ * Number::toString text), or a term object. The engine chooses the datatype
+ * and the lexical form (L4Factoidal.XSD.JsValue.jsLiteral,
+ * https://github.com/danbri/factoidal/issues/894 item 3). `''` means
+ * "no value", the section 17.6 error.
  */
 function encodeAnswer (out) {
   if (out === null || out === undefined) return ''
-  if (typeof out === 'boolean') {
-    return JSON.stringify({ type: 'literal', value: out ? 'true' : 'false', datatype: XSD + 'boolean' })
-  }
-  if (typeof out === 'number') {
-    if (!Number.isFinite(out)) return ''
-    return Number.isInteger(out)
-      ? JSON.stringify({ type: 'literal', value: String(out), datatype: XSD + 'integer' })
-      : JSON.stringify({ type: 'literal', value: String(out), datatype: XSD + 'double' })
-  }
-  if (typeof out === 'string') {
-    return JSON.stringify({ type: 'literal', value: out })
-  }
-  if (typeof out === 'object' && typeof out.type === 'string') {
-    // Already an SRJ binding-value object (or an RDF/JS-shaped term the
-    // caller built): pass it through and let the Lean decoder judge it.
-    return JSON.stringify(out)
+  switch (typeof out) {
+    case 'boolean': return JSON.stringify({ js: 'boolean', v: out })
+    case 'number': return JSON.stringify({ js: 'number', v: Object.is(out, -0) ? '-0' : String(out) })
+    case 'bigint': return JSON.stringify({ js: 'bigint', v: out.toString() })
+    case 'string': return JSON.stringify({ js: 'string', v: out })
+    case 'object':
+      try { return JSON.stringify(appTermToJson(out)) } catch (_error) { return '' }
+    default: return ''
   }
-  return ''
 }
 
 /** The synchronous bridge the wasm module calls. */

package/bin/factoidal.mjs

@@ -20,7 +20,7 @@
 // `--format turtle` all print documents the engine produced.
 
 import {
-  StoreHostError, atomicReplace, listGeneration, makeDirectory, readWhole,
+  StoreHostError, atomicReplace, listGeneration, makeDirectory, readChunk, readWhole,
   runtime
 } from '../store-host/index.mjs'
 import { fileUrlToPath, joinPath } from '../store-host/paths.mjs'
@@ -46,23 +46,9 @@ const EXIT_NOT_WIRED = 3
 const FEED_PROGRESS = 65536
 
 const PACK_LAYOUTS = ['ibk3', 'ibk4', 'ibk5']
-const PACK_SYNTAXES = ['turtle', 'trig', 'nquads', 'ntriples']
-const PACK_SUFFIXES = [
-  ['.ttl', 'turtle'], ['.turtle', 'turtle'],
-  ['.trig', 'trig'],
-  ['.nq', 'nquads'], ['.nquads', 'nquads'],
-  ['.nt', 'ntriples'], ['.ntriples', 'ntriples']
-]
-
-// Suffixes the engine parses elsewhere but the packer's streaming fold does
-// not read. Naming them is better than "cannot tell the syntax from its
-// name", which sends the reader looking for a --syntax value that does not
-// exist.
-const PACK_UNSUPPORTED_SUFFIXES = [
-  ['.rdf', 'RDF/XML'], ['.owl', 'RDF/XML'], ['.xml', 'RDF/XML'],
-  ['.jsonld', 'JSON-LD'], ['.json', 'JSON-LD'], ['.n3', 'Notation3'],
-  ['.csv', 'CSV'], ['.tsv', 'TSV'], ['.hdt', 'HDT']
-]
+// The syntaxes the packer reads and the file-name suffixes of each are the
+// engine's tables (op engineTables: packSyntaxes, packSuffixes,
+// packUnsupportedSuffixes), https://github.com/danbri/factoidal/issues/894.
 
 /** The parent of a path, and its last component. The `activate` hint
  *  printed after a pack needs both; neither is a format decision. */
@@ -344,43 +330,92 @@ https://www.w3.org/TR/sparql11-service-description/`,
 
   'lws-serve': `factoidal lws-serve - serve Linked Web Storage 1.0 over HTTP
 
-usage: factoidal lws-serve DIR [--port N] [--host ADDRESS]
+usage: factoidal lws-serve DIR (--issuer IRI | --auth-config FILE | --insecure-no-auth)
+                         [--owner WEBID] [--root-acl FILE] [--audience IRI]
+                         [--port N] [--host ADDRESS] [--base IRI]
 
 Starts a Node HTTP server that answers every request through the engine's
 lwsStep operation.
 
-DIR names the storage directory. The first slice keeps the resource tree
-in the engine handle, so DIR is not read or written yet; it is the place
-a later snapshot goes (design record, section 2).
+DIR names the storage directory. The storage is kept in the engine
+handle and written to DIR/lws-state.json after every request that
+changed it (temporary file, fsync, rename), and read back on the next
+start. The engine decides the snapshot format and refuses a snapshot
+path with a dot segment or other traversal form
+(formal/lean4/L4Factoidal/LWS/Snapshot.lean).
 
   --port N        the port to bind; 0 takes an ephemeral one (default 3000)
   --host ADDRESS  the address to bind (default 127.0.0.1)
   --base IRI      the absolute IRI the storage root maps to
                   (default: the bound origin)
 
+Authorization (LWS editor's draft, section Authorization; one of the three
+is required):
+  --issuer IRI          trust this authorization server; several may be
+                        given separated by commas. Its metadata is read from
+                        IRI/.well-known/lws-configuration and its keys from
+                        the jwks_uri there, when a token first needs them.
+  --auth-config FILE    the engine's "auth" configuration as JSON:
+                        {"issuers":[{"issuer":IRI,"jwks":{...}?}],
+                         "audience":IRI?, "leeway":SECONDS?,
+                         "refreshInterval":SECONDS?}
+  --insecure-no-auth    development only: no authorization at all; every
+                        request is served. Never the default.
+  --owner WEBID         the storage owner: a new storage gets a root ACL
+                        that gives this agent Read, Write and Control
+  --root-acl FILE       a Turtle root ACL for a new storage instead
+  --audience IRI        the aud value tokens must carry (default: the
+                        storage root IRI)
+
+Requests carry an access token as "Authorization: Bearer TOKEN" (RFC 6750).
+The engine verifies its JWS signature (ES256, RS256 or EdDSA, with the
+vendored HACL* code), its iss, aud, exp, nbf and iat, and then decides
+access with Web Access Control over the storage's ACL resources. A
+request without a valid token answers 401 with
+WWW-Authenticate: Bearer resource_metadata="..." (RFC 9728), and the
+metadata document is served at /.well-known/oauth-protected-resource.
+
 The server makes no protocol decision: status codes, Link relations,
-Last-Modified and the PATCH blank-node refusal are all answered by
-formal/lean4/L4Factoidal/LWS/. A WebAssembly module built before those
+Last-Modified, the PATCH blank-node refusal and every authorization
+decision are answered by formal/lean4/L4Factoidal/LWS/. A WebAssembly module built before those
 operations landed makes this command exit 3 and say so.
 
 Specification: https://w3c.github.io/lws-protocol/lws10-core/`,
 
   'solid-serve': `factoidal solid-serve - serve the Solid Protocol over HTTP
 
-usage: factoidal solid-serve DIR [--port N] [--host ADDRESS]
+usage: factoidal solid-serve DIR (--issuer IRI | --auth-config FILE | --insecure-no-auth)
+                           [--owner WEBID] [--port N] [--host ADDRESS] [--base IRI]
 
 Starts a Node HTTP server that answers every request through the engine's
 solidStep operation.
 
-DIR names the storage directory. The first slice keeps the resource tree
-in the engine handle, so DIR is not read or written yet; it is the place
-a later snapshot goes (design record, section 2).
+DIR names the storage directory. The storage is kept in the engine
+handle and written to DIR/lws-state.json after every request that
+changed it (temporary file, fsync, rename), and read back on the next
+start. The engine decides the snapshot format and refuses a snapshot
+path with a dot segment or other traversal form
+(formal/lean4/L4Factoidal/LWS/Snapshot.lean).
 
   --port N        the port to bind; 0 takes an ephemeral one (default 3000)
   --host ADDRESS  the address to bind (default 127.0.0.1)
   --base IRI      the absolute IRI the storage root maps to
                   (default: the bound origin)
-  --owner WEBID   the WebID the storage advertises as its owner
+  --owner WEBID   the WebID the storage advertises as its owner; under
+                  authentication it gets acl:Read, acl:Write and
+                  acl:Control on the root (Web Access Control §3.2)
+  --issuer IRI    trust this Solid-OIDC issuer (comma separated for more).
+                  The engine verifies each DPoP-bound access token
+                  (Solid-OIDC §8, §9.3; RFC 9449): signature under the
+                  issuer's keys found by OpenID Connect Discovery, aud
+                  "solid", webid, exp, cnf.jkt bound to the DPoP key,
+                  htm, htu, iat and a jti replay cache, and that the
+                  WebID profile lists the issuer (solid:oidcIssuer).
+  --auth-config FILE  the same as JSON: {"issuers":[{"issuer":IRI,
+                  "jwks":{...}?}], "leeway"?, "iatWindow"?,
+                  "refreshInterval"?, "checkProfileIssuer"?}
+  --insecure-no-auth  development only: no authentication; Web Access
+                  Control is not enforced
 
 The server makes no protocol decision. Storage discovery, containment
 triples, slash semantics, the Allow and Accept-* headers, the PUT/POST/
@@ -469,8 +504,9 @@ const VALUE_OPTIONS = {
   update: new Set(['update', 'file']),
   compact: new Set([]),
   serve: new Set(['port', 'host', 'query-path', 'gsp-path', 'file', 'layout', 'tdb2']),
-  'lws-serve': new Set(['port', 'host', 'base']),
-  'solid-serve': new Set(['port', 'host', 'base', 'owner']),
+  'lws-serve': new Set(['port', 'host', 'base', 'issuer', 'auth-config', 'owner', 'root-acl',
+    'audience']),
+  'solid-serve': new Set(['port', 'host', 'base', 'owner', 'issuer', 'auth-config']),
   'solid-client': new Set(['body', 'file', 'content-type', 'interpret'])
 }
 
@@ -599,31 +635,28 @@ async function commandVersion (options) {
 /**
  * One graph name as the manifest reports it. `{"kind":"default"}` is the
  * default graph; the operation marks it that way so a host never has to
- * recognise a reserved IRI.
+ * recognise a reserved IRI. The engine writes the N-Triples form of a name
+ * (op termsToNTriples).
  */
-function graphLabel (graph) {
-  if (graph.kind === 'default') return 'default'
-  if (graph.kind === 'iri') return `<${graph.value}>`
-  if (graph.kind === 'bnode') return `_:${graph.value}`
-  return JSON.stringify(graph)
+function graphLabels (engine, graphs) {
+  const terms = graphs.filter((g) => g.kind !== 'default')
+    .map((g) => ({ type: g.kind === 'iri' ? 'uri' : 'bnode', value: g.value }))
+  const tokens = terms.length === 0 ? [] : engine.call('termsToNTriples', [JSON.stringify(terms)]).tokens
+  let k = 0
+  return graphs.map((g) => (g.kind === 'default' ? 'default' : tokens[k++]))
 }
 
 /**
- * One SPARQL Query Results JSON term as a table cell. This is a display,
- * not a serialization: `--format json` prints the engine's own document
- * and `--format nquads` prints the engine's own N-Triples.
+ * The SPARQL Query Results JSON terms of a table, as display cells: the
+ * engine writes each term's canonical N-Triples form (op termsToNTriples).
+ * `--format json` prints the engine's own document.
  */
-function cellOfTerm (term) {
-  if (term === undefined || term === null) return ''
-  if (term.type === 'uri') return `<${term.value}>`
-  if (term.type === 'bnode') return `_:${term.value}`
-  if (term.type === 'literal') {
-    const lang = term['xml:lang']
-    if (typeof lang === 'string' && lang.length > 0) return `"${term.value}"@${lang}`
-    if (typeof term.datatype === 'string') return `"${term.value}"^^<${term.datatype}>`
-    return `"${term.value}"`
-  }
-  return JSON.stringify(term)
+function cellsOfRows (engine, rows) {
+  const terms = []
+  for (const row of rows) for (const t of row) if (t !== undefined && t !== null) terms.push(t)
+  const tokens = terms.length === 0 ? [] : engine.call('termsToNTriples', [JSON.stringify(terms)]).tokens
+  let k = 0
+  return rows.map((row) => row.map((t) => (t === undefined || t === null ? '' : tokens[k++])))
 }
 
 function plural (count, noun) {
@@ -699,7 +732,7 @@ async function commandInspect (positional, options) {
       String(entry.rows),
       String(entry.bytes),
       entry.blockKind,
-      entry.graphs.length === 0 ? '-' : entry.graphs.map(graphLabel).join(' '),
+      entry.graphs.length === 0 ? '-' : graphLabels(engine, entry.graphs).join(' '),
       entry.predicate
     ].concat(zoned
       ? [String((entry.blobRefs ?? []).length), zoneCell(entry.subjectZone)]
@@ -875,7 +908,7 @@ function renderQueryResult (engine, result, format, limit, quiet) {
       return EXIT_FAILURE
     }
     const shown = limit === null ? bindings : bindings.slice(0, limit)
-    printTable(vars, shown.map((row) => vars.map((name) => cellOfTerm(row[name]))))
+    printTable(vars, cellsOfRows(engine, shown.map((row) => vars.map((name) => row[name]))))
     if (shown.length < bindings.length) {
       err(`showing ${shown.length} of ${bindings.length} rows (--limit ${limit})`)
     } else if (!quiet) {
@@ -914,32 +947,51 @@ function renderQueryResult (engine, result, format, limit, quiet) {
   return EXIT_FAILURE
 }
 
-/** The syntax tag for an input, from --syntax or from the file name. The
- *  engine is what actually decides how to read the bytes; this only picks
- *  which of its parsers to name. */
-function packSyntax (input, options) {
+/** The first `length` bytes of a file, as text, for content detection. */
+function readHead (path, length) {
+  return new TextDecoder('utf-8', { fatal: false }).decode(readChunk(path, 0, length))
+}
+
+/** The syntax tag for an input: --syntax when given, else the engine's
+ *  suffix table (op engineTables), else the engine's content detection
+ *  (op detectFormat) on the first 64 KiB of the file. */
+function packSyntax (engine, input, options) {
+  const tables = engine.call('engineTables', []).tables
+  const syntaxes = tables.packSyntaxes
   if (typeof options.syntax === 'string') {
     const syntax = options.syntax.toLowerCase()
-    if (PACK_SYNTAXES.indexOf(syntax) >= 0) return syntax
-    throw new UsageError(`--syntax ${options.syntax} is not one of ${PACK_SYNTAXES.join(', ')}`)
+    if (syntaxes.indexOf(syntax) >= 0) return syntax
+    throw new UsageError(`--syntax ${options.syntax} is not one of ${syntaxes.join(', ')}`)
   }
   const lower = input.toLowerCase()
-  for (const [suffix, syntax] of PACK_SUFFIXES) {
+  for (const [suffix, syntax] of Object.entries(tables.packSuffixes)) {
     if (lower.endsWith(suffix)) return syntax
   }
-  for (const [suffix, name] of PACK_UNSUPPORTED_SUFFIXES) {
+  for (const [suffix, name] of Object.entries(tables.packUnsupportedSuffixes)) {
     if (lower.endsWith(suffix)) {
       throw new UsageError(
         `pack does not read ${name}. The packer's streaming fold reads ` +
-        `${PACK_SYNTAXES.join(', ')} only. Convert the file first, for ` +
+        `${syntaxes.join(', ')} only. Convert the file first, for ` +
         "example with: factoidal parse FILE --out nquads")
     }
   }
+  let head = ''
+  try {
+    head = readHead(input, 65536)
+  } catch (_error) {
+    head = ''
+  }
+  if (head !== '') {
+    const tag = engine.call('detectFormat', [head]).format
+    const syntax = tag.replace(/12$/, '')
+    if (syntaxes.indexOf(syntax) >= 0) return syntax
+  }
   throw new UsageError(
-    `cannot tell the syntax of ${input} from its name; give --syntax ` +
-    `(${PACK_SYNTAXES.join(', ')})`)
+    `cannot tell the syntax of ${input} from its name or its content; give --syntax ` +
+    `(${syntaxes.join(', ')})`)
 }
 
+
 /**
  * The base IRI relative IRIs in the source resolve against.
  *
@@ -970,7 +1022,7 @@ function packLayout (options) {
 async function commandPack (positional, options) {
   if (positional.length !== 2) throw new UsageError('pack needs INPUT and OUTPUT')
   const [input, output] = positional
-  const syntax = packSyntax(input, options)
+  const syntax = packSyntax(await loadEngine(), input, options)
   const layout = packLayout(options)
   // The pack fold needs a bigger call stack than either runtime gives by
   // default (https://github.com/danbri/factoidal/issues/649). Under Node
@@ -1248,6 +1300,25 @@ async function commandServe (positional, options) {
 async function commandLwsServe (positional, options) {
   if (positional.length !== 1) throw new UsageError('lws-serve needs one DIR')
   const quiet = options.quiet === true
+  const insecure = options['insecure-no-auth'] === true
+  const issuerOption = typeof options.issuer === 'string' ? options.issuer : null
+  const authFile = typeof options['auth-config'] === 'string' ? options['auth-config'] : null
+  if (!insecure && issuerOption === null && authFile === null) {
+    throw new UsageError('lws-serve needs --issuer IRI or --auth-config FILE, ' +
+      'or --insecure-no-auth for development')
+  }
+  if (insecure && (issuerOption !== null || authFile !== null)) {
+    throw new UsageError('--insecure-no-auth cannot be combined with --issuer or --auth-config')
+  }
+  let auth
+  if (authFile !== null) {
+    auth = readJsonFile(authFile)
+  } else if (issuerOption !== null) {
+    auth = { issuers: issuerOption.split(',').filter((v) => v !== '').map((issuer) => ({ issuer })) }
+  }
+  if (auth !== undefined && typeof options.audience === 'string') {
+    auth = { ...auth, audience: options.audience }
+  }
   const { listen, LwsHostError } = await import('../lws/server.mjs')
   let running
   try {
@@ -1255,7 +1326,13 @@ async function commandLwsServe (positional, options) {
       port: servePort(options, 3000),
       host: serveHost(options),
       ...(typeof options.base === 'string' ? { baseIri: options.base } : {}),
-      realClock: true
+      ...(insecure ? { insecureNoAuth: true } : { auth }),
+      ...(typeof options.owner === 'string' ? { owner: options.owner } : {}),
+      ...(typeof options['root-acl'] === 'string'
+        ? { rootAcl: new TextDecoder('utf-8', { fatal: true }).decode(readWhole(options['root-acl'])) }
+        : {}),
+      realClock: true,
+      dir: positional[0]
     })
   } catch (error) {
     if (error instanceof LwsHostError && error.unknownOp) {
@@ -1263,7 +1340,10 @@ async function commandLwsServe (positional, options) {
     }
     throw error
   }
-  if (!quiet) err(`lws-serve: listening on ${running.origin} for ${positional[0]}`)
+  if (!quiet) {
+    err(`lws-serve: listening on ${running.origin} for ${positional[0]}`)
+    if (insecure) err('lws-serve: WARNING: --insecure-no-auth: every request is served without authorization')
+  }
   out(running.origin)
   return untilInterrupted(running, quiet)
 }
@@ -1271,6 +1351,24 @@ async function commandLwsServe (positional, options) {
 async function commandSolidServe (positional, options) {
   if (positional.length !== 1) throw new UsageError('solid-serve needs one DIR')
   const quiet = options.quiet === true
+  // The same rule as lws-serve: no start without a trusted issuer unless
+  // the development mode is asked for by name.
+  const insecure = options['insecure-no-auth'] === true
+  const issuerOption = typeof options.issuer === 'string' ? options.issuer : null
+  const authFile = typeof options['auth-config'] === 'string' ? options['auth-config'] : null
+  if (!insecure && issuerOption === null && authFile === null) {
+    throw new UsageError('solid-serve needs --issuer IRI or --auth-config FILE, ' +
+      'or --insecure-no-auth for development')
+  }
+  if (insecure && (issuerOption !== null || authFile !== null)) {
+    throw new UsageError('--insecure-no-auth cannot be combined with --issuer or --auth-config')
+  }
+  let auth
+  if (authFile !== null) {
+    auth = readJsonFile(authFile)
+  } else if (issuerOption !== null) {
+    auth = { issuers: issuerOption.split(',').filter((v) => v !== '').map((issuer) => ({ issuer })) }
+  }
   const { listen, SolidServerHostError } = await import('../solid/server/index.mjs')
   let running
   try {
@@ -1278,8 +1376,10 @@ async function commandSolidServe (positional, options) {
       port: servePort(options, 3000),
       host: serveHost(options),
       ...(typeof options.base === 'string' ? { baseIri: options.base } : {}),
+      ...(insecure ? { insecureNoAuth: true } : { auth }),
       ...(typeof options.owner === 'string' ? { owner: options.owner } : {}),
-      realClock: true
+      realClock: true,
+      dir: positional[0]
     })
   } catch (error) {
     if (error instanceof SolidServerHostError && error.unknownOp) {
@@ -1287,7 +1387,10 @@ async function commandSolidServe (positional, options) {
     }
     throw error
   }
-  if (!quiet) err(`solid-serve: listening on ${running.origin} for ${positional[0]}`)
+  if (!quiet) {
+    err(`solid-serve: listening on ${running.origin} for ${positional[0]}`)
+    if (insecure) err('solid-serve: WARNING: --insecure-no-auth: every request is served without authentication')
+  }
   out(running.origin)
   return untilInterrupted(running, quiet)
 }

package/browser.d.ts

@@ -19,6 +19,10 @@ export {
   canonicalize,
   graphs,
   canonicalHash,
+  isomorphic,
+  fromQuads,
+  ready,
+  engineTables,
   openDataset,
   closure,
   formats,

package/browser.js

@@ -67,6 +67,10 @@ export const serialize = api.serialize;
 export const canonicalize = api.canonicalize;
 export const graphs = api.graphs;
 export const canonicalHash = api.canonicalHash;
+export const isomorphic = api.isomorphic;
+export const fromQuads = api.fromQuads;
+export const ready = api.ready;
+export const engineTables = api.engineTables;
 export const openDataset = api.openDataset;
 export const closure = api.closure;
 export const formats = api.formats;

package/fn.d.ts

@@ -306,7 +306,7 @@ export function hash(ds: FnDataset): Promise<string>;
 export function equals(a: FnDataset, b: FnDataset): Promise<boolean>;
 
 /** Enumerate named graphs (default graph excluded), first-seen order. */
-export function graphs(ds: FnDataset): Array<[iri: string, graph: FnDataset]>;
+export function graphs(ds: FnDataset): Array<[name: NamedNode | BlankNode, graph: FnDataset]>;
 
 /** A minimal mutable box holding one dataflow input value. */
 export interface Cell<T> {