@factoidal/core 0.11.0 → 0.13.0

package/README.md

@@ -35,7 +35,8 @@ RDF 1.2 input uses `turtle12`, `ntriples12`, `nquads12` or `trig12`.
 - Syntaxes: N-Triples, N-Quads, Turtle, TriG, RDF/XML, JSON-LD; RDF 1.1 and 1.2
 - SPARQL 1.1 and 1.2 query and update; GeoSPARQL functions, text search,
   JavaScript extension functions, SERVICE
-- Reasoning: RDFS, OWL 2 RL closure, OWL 2 DL consistency and entailment, RIF Core
+- Reasoning: RDFS, OWL 2 RL closure, restricted checked OWL consistency,
+  experimental OWL entailment, RIF Core
 - Validation: SHACL, ShEx, JSON Schema, Schematron
 - Mapping: CSVW, RML, JSON-LD
 - Canonicalization: RDFC-1.0; Verifiable Credentials Data Integrity (eddsa-rdfc-2022), did:key
@@ -70,6 +71,62 @@ Formats (generated from `formats()`):
 <!-- formats-table:end -->
 
 Missing writers (HDT, N3, RDFa): https://github.com/danbri/factoidal/issues/883.
+
+## Errors
+
+Every function rejects with one class, `FactoidalError`, except that an
+argument of the wrong JavaScript type is a `TypeError`. The engine decides
+three fields: `code` (below), `position` (`{line, column, offset,
+byteOffset}` where the input defines one: `offset` is a UTF-16 index into
+your string, `byteOffset` counts UTF-8 bytes) and `spec` (the specification
+section of the condition). `cause` holds the underlying error of `host.io`.
+
+```js
+import { parse, FactoidalError } from '@factoidal/core';
+try { await parse('<http://e/a> <http://e/p> .', 'turtle'); }
+catch (e) { if (e instanceof FactoidalError) console.log(e.code, e.position.line, e.spec); }
+```
+
+Codes (generated from `engineTables().errorCodes`):
+
+<!-- errors-table:start (generated by test/errors.test.mjs) -->
+| code | specification | meaning |
+|---|---|---|
+| `parse.syntax` | <https://www.w3.org/TR/rdf12-turtle/#sec-grammar> | The input text does not match the grammar of its RDF syntax. |
+| `parse.rdf12-required` | <https://www.w3.org/TR/rdf12-concepts/#section-triple-terms> | The text uses an RDF 1.2 form (triple term, reified triple, base direction) and was read as RDF 1.1. |
+| `term.invalid-iri` | <https://www.w3.org/TR/rdf12-concepts/#section-IRIs> | A term that must be an IRI is not one. |
+| `term.invalid-langtag` | <https://www.w3.org/TR/rdf12-concepts/#section-Graph-Literal> | A language tag is not well-formed (BCP 47). |
+| `term.invalid` | <https://www.w3.org/TR/sparql11-results-json/#select-encode-terms> | A term or quad given as JSON is not an RDF term or quad. |
+| `query.syntax` | <https://www.w3.org/TR/sparql11-query/#grammar> | The SPARQL query does not match the SPARQL grammar. |
+| `query.failed` | <https://www.w3.org/TR/sparql11-query/#sparqlDefinition> | The SPARQL query parsed but its evaluation was refused. |
+| `update.syntax` | <https://www.w3.org/TR/sparql11-update/#grammar> | The SPARQL update does not match the SPARQL Update grammar. |
+| `update.failed` | <https://www.w3.org/TR/sparql11-update/#updateLanguage> | The SPARQL update parsed but was refused. |
+| `format.unknown` | - | The format name is not one the engine reads or writes. |
+| `serialize.unsupported-rdf12` | <https://www.w3.org/TR/rdf12-concepts/#section-triple-terms> | The data holds an RDF 1.2 term and the requested RDF 1.1 output has no form for it. |
+| `serialize.failed` | - | The writer refused the data. |
+| `canon.unsupported-rdf12` | <https://www.w3.org/TR/rdf-canon/#canon-algorithm> | RDFC-1.0 defines no canonical labelling for RDF 1.2 triple terms or directional strings. |
+| `canon.failed` | <https://www.w3.org/TR/rdf-canon/#canon-algorithm> | Canonicalization was refused. |
+| `owl.unsupported-rdf12` | <https://www.w3.org/TR/owl2-mapping-to-rdf/#Mapping_from_RDF_Graphs_to_the_Structural_Specification> | OWL 2 Direct Semantics has no rule for RDF 1.2 triple terms or directional strings. |
+| `reason.failed` | - | A closure or entailment check was refused. |
+| `regime.refused` | <https://www.w3.org/TR/sparql11-entailment/> | The entailment regime is not implemented. |
+| `validate.failed` | - | A validation (SHACL, ShEx, JSON Schema, Schematron) could not run on its inputs. |
+| `xml.failed` | <https://www.w3.org/TR/xml/#sec-well-formed> | An XML, XPath, XSLT, MathML or XForms input was refused. |
+| `crypto.failed` | - | A cryptographic or Verifiable Credentials operation refused its inputs. |
+| `store.failed` | - | A persisted-store, pack or HDT operation was refused. |
+| `registry.failed` | <https://www.w3.org/TR/sparql11-query/#extensionFunctions> | An extension-function or SERVICE registration was refused. |
+| `handle.unknown` | - | The handle was never issued by this engine. |
+| `handle.disposed` | - | The handle was issued and then closed. |
+| `option.unknown` | - | The options object has a key the function does not take. |
+| `option.invalid-value` | - | An option or mode argument has a value outside its table. |
+| `option.conflict` | - | Two options were given that cannot be combined. |
+| `capacity.exceeded` | - | The input is above a fixed size limit of the engine. |
+| `call.arity` | - | The op was called with the wrong number of arguments. |
+| `call.arguments` | - | The arguments document is not a JSON array of strings. |
+| `op.unknown` | - | The loaded engine has no op of this name. |
+| `op.failed` | - | Any other refusal of an op. |
+| `host.io` | - | The host could not read or write a file, a store or a log (no engine decision). |
+<!-- errors-table:end -->
+
 Full API: [API.md](https://github.com/danbri/factoidal-core/blob/main/npm/factoidal/API.md).
 Changes: [CHANGELOG.md](CHANGELOG.md).
 
@@ -92,15 +149,27 @@ $ npx factoidal solid-serve DIR                    # Solid Protocol
 
 Official test suites, pass / fail / total, 2026-10-09 [B] unless marked.
 
+The OWL DL rows below are historical measurements of the legacy harness;
+they do not measure the current `owlIsConsistent` API. That API now checks
+only an admitted atomic fragment of the default graph. It returns `false`
+for a checked contradiction and `null` for unsupported input or an incomplete
+check; it never returns `true`. Restrictions, negative property assertions,
+imports and equivalentClass are unsupported, and `fuel` does not change its
+fixed 64-round checker bound. `owlEntails` still uses a separate legacy path
+whose positive verdicts do not have this source-to-verdict proof. See the
+[OWL API contract](https://github.com/danbri/factoidal-core/blob/main/npm/factoidal/API.md)
+and the [assurance record](https://github.com/danbri/factoidal-core/blob/main/docs/20261022-owl-pr-reconciliation.md).
+
 | Suite | Result |
 |---|---|
 | SPARQL 1.1 Query, Update, Protocol | 631 / 0 / 631 |
 | SPARQL 1.2 | 254 / 0 / 254 |
 | SPARQL Protocol, Graph Store, Service Description against `serve` | 50 / 0 / 50 [P] |
+| Linked Web Storage 1.0, Touchstone (another implementer's harness), `lws-serve` | 215 / 0 / 221 (6 not applicable) [L] |
 | RDF 1.1 N-Triples, N-Quads, Turtle, TriG, RDF/XML | 992 / 0 / 992 |
 | RDF 1.2 syntax suites | all pass |
 | RDF 1.1 Semantics | 39 / 0 / 39 |
-| RDF 1.2 Semantics | 40 / 7 / 47 |
+| RDF 1.2 Semantics | 29 / 0 / 29 [S] |
 | JSON-LD 1.1 toRdf, expand, flatten | 910 / 0 / 910 |
 | JSON-LD 1.1 compact, fromRdf | 298 / 0 / 300 (2 not run) |
 | JSON-LD 1.1 Framing | 29 / 63 / 92 |
@@ -111,7 +180,7 @@ Official test suites, pass / fail / total, 2026-10-09 [B] unless marked.
 | SHACL 1.0 Core, SHACL-SPARQL | 120 / 0 / 120 |
 | SHACL 1.2 Core | 103 / 30 / 133 |
 | ShEx 2 validation, ShExC | 1624 / 0 / 1624 |
-| CSVW | 821 / 1 / 822 |
+| CSVW | 821 / 0 / 821 (1 defective W3C test excluded) [C] |
 | RIF Core | 43 / 0 / 46 (3 undecided) |
 | RML Core | 60 / 0 / 76 (16 not attempted) |
 | XML 1.0 (xmlconf) | 1861 / 0 (516 not run) |
@@ -124,10 +193,13 @@ Official test suites, pass / fail / total, 2026-10-09 [B] unless marked.
 [B] https://github.com/danbri/factoidal-core/blob/03e2e6deee8146ce7e6fdc3f8f34b8245af5ab54/docs/designissues/2026-10-09-lean-conformance-baseline.md
 [P] https://github.com/danbri/factoidal-core/blob/9a4045f1572a032b53ccb867f8395fe0c8d97bb9/docs/designissues/2026-10-10-store-serve.md
 [X] https://github.com/danbri/factoidal-core/blob/cb871c2de8354362ae6226eb57fb6c549624ea1a/docs/designissues/2026-10-10-xml-profile-widened.md
+[L] 2026-10-22, https://github.com/danbri/factoidal-core/blob/2b9d2e39af53be31ed92463b58d3e132e65c4fe4/docs/designissues/2026-10-21-lws-touchstone-run.md (with server options, 220 of 221 pass in at least one configuration)
+[S] 2026-10-21, the current W3C manifest (29 active tests), https://github.com/danbri/factoidal-core/blob/2b9d2e39af53be31ed92463b58d3e132e65c4fe4/docs/claude-rules/current-state.md
+[C] 2026-10-21, validation test308, https://github.com/danbri/factoidal/issues/700
 
 ## Limits
 
-- Size: 2.5 MB packed, 12.4 MB unpacked; one 11.7 MB wasm module.
+- Size: 2.9 MB packed, 14.0 MB unpacked; one 13.2 MB wasm module.
 - `factoidal update` and `compact` exit 3; updates work through `serve`
   (https://github.com/danbri/factoidal/issues/641).
 - Fuseki: read-only administration API, one dataset per process, no

package/api.d.ts

@@ -42,11 +42,10 @@ export function buildApi(driver: {
 export function entryFromEngine(engine: object): Record<string, unknown>;
 
 export const Dataset: typeof import('./index').Dataset;
-export const DatasetHandle: typeof import('./index').DatasetHandle;
 export const Store: typeof import('./index').Store;
 export const dataFactory: import('./index').DataFactory;
-/** Position-carrying parse failure; see index.d.ts's ParseError. */
-export const ParseError: typeof import('./index').ParseError;
+/** The one error class; see index.d.ts's FactoidalError. */
+export const FactoidalError: typeof import('./index').FactoidalError;
 /** Package version string, e.g. '0.9.0'. */
 export const version: string;
 

package/api.mjs

@@ -18,7 +18,7 @@
 //
 // openStore() here takes a reader function only: there is no file system.
 
-import { buildApi, ParseError, DatasetHandle, Store } from './lib/api.mjs';
+import { buildApi, FactoidalError, Store } from './lib/api.mjs';
 import { entryFromEngine } from './lib/lean-entry.mjs';
 import { dataFactory } from './rdfjs.mjs';
 import { Dataset } from './lib/dataset.mjs';
@@ -52,5 +52,5 @@ export function createApi(engine, options) {
   });
 }
 
-export { buildApi, entryFromEngine, ParseError, DatasetHandle, Store, Dataset, dataFactory, version };
+export { buildApi, entryFromEngine, FactoidalError, Store, Dataset, dataFactory, version };
 export default createApi;

package/authz/server.mjs

@@ -0,0 +1,331 @@
+// A Node HTTP host for the authorization server component.
+// https://github.com/danbri/factoidal/issues/916
+// Design record: docs/designissues/2026-10-22-authorization-server.md
+//
+// WHAT THIS FILE IS ALLOWED TO DO
+// Accept a socket, turn one HTTP request into the JSON request record,
+// call the engine's `authzStep` on a handle, and write the JSON response
+// record back. Read the clock, draw random bytes, resolve host names, fetch
+// the documents the engine names, and read and write the key file. That is
+// the whole contract (iron rule 7 of CLAUDE.md, anti-pattern 36).
+//
+// It makes NO protocol or token decision: no status code, no OAuth error
+// code, no claim, no key choice, no address check. Every one of those lives
+// in `formal/lean4/L4Factoidal/Authz/`. The one status code written here is
+// 500, for a failure of this host itself.
+//
+// THE WASM CONTRACT (Wasm/Ops/Authz.lean)
+//   authzOpen    [configJson]              -> { ok, handle, issuer, kid, changed }
+//   authzStep    [handle, requestJson]     -> { ok, response, changed }
+//                                            | { ok, resolve: { host }, changed }
+//                                            | { ok, fetch: { url, accept, address }, changed }
+//   authzFetched [handle, { url, status, body, now } | { host, addresses, now }] -> { ok }
+//   authzKeys    [handle, { nonce?, private? }] -> { ok, keys } | { ok, jwks }
+//   authzRotate  [handle, { now, random }]  -> { ok, changed, kid }
+//   authzClose   [handle]                   -> { ok }
+//
+// FETCHES. `resolve` names a host: this host resolves it (`dns.lookup`, every
+// address) and passes the addresses back; the engine decides whether they may
+// be reached (loopback, link-local and private addresses are refused unless
+// the configuration says `allowPrivateFetch`). `fetch` names a URL and the
+// address to connect to: this host connects to exactly that address (the name
+// is not resolved again), sends no cookie or credential, follows no redirect,
+// reads at most MAX_DOCUMENT_BYTES, and passes the status and the text back.
+
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { loadEngine } from '../bin/engine.mjs'
+import { storageKeyText } from '../lws/persist.mjs'
+
+/** The ops this host needs from the engine. */
+export const AUTHZ_OPS = ['authzOpen', 'authzStep', 'authzFetched', 'authzKeys', 'authzRotate', 'authzClose']
+
+/** The key file in DIR. */
+export const KEY_FILE = 'authz-keys.json'
+
+/** Bounds on what one request may make this host do. */
+const MAX_NEEDS = 16
+const FETCH_TIMEOUT_MS = 10000
+const MAX_DOCUMENT_BYTES = 1048576
+
+/** Random bytes for the engine, base64. Pure I/O. */
+function randomBase64 (size) {
+  const bytes = new Uint8Array(size)
+  globalThis.crypto.getRandomValues(bytes)
+  return Buffer.from(bytes).toString('base64')
+}
+
+function nowSeconds () {
+  return Math.floor(Date.now() / 1000)
+}
+
+/** An error raised by this host, as opposed to one the engine reported. */
+export class AuthzHostError extends Error {
+  constructor (message) {
+    super(message)
+    this.name = 'AuthzHostError'
+  }
+}
+
+/** Read the key file of DIR, or null. */
+export function readKeyFile (dir) {
+  const file = join(resolve(dir), KEY_FILE)
+  if (!existsSync(file)) return null
+  const text = readFileSync(file, 'utf8')
+  try {
+    return JSON.parse(text)
+  } catch (error) {
+    throw new AuthzHostError(`${file} is not JSON: ${error.message}`)
+  }
+}
+
+/** Write the key file of DIR: temporary file, fsync, rename, mode 0600. */
+export function writeKeyFile (dir, doc) {
+  const root = resolve(dir)
+  mkdirSync(root, { recursive: true })
+  const file = join(root, KEY_FILE)
+  const temporary = join(root, `.${KEY_FILE}.${process.pid}.tmp`)
+  const fd = openSync(temporary, 'w', 0o600)
+  try {
+    writeSync(fd, JSON.stringify(doc))
+    fsyncSync(fd)
+  } finally {
+    closeSync(fd)
+  }
+  renameSync(temporary, file)
+  try {
+    const dirFd = openSync(root, 'r')
+    try { fsyncSync(dirFd) } finally { closeSync(dirFd) }
+  } catch (_error) {
+    // Some platforms cannot fsync a directory; the rename stands.
+  }
+}
+
+/** Every address of a host name. Pure I/O. */
+async function resolveHost (host) {
+  try {
+    const dns = await import('node:dns')
+    const found = await dns.promises.lookup(host, { all: true, verbatim: true })
+    return found.map((a) => a.address)
+  } catch (_error) {
+    return []
+  }
+}
+
+/** GET one URL from the address the engine named. Pure I/O: status 0 and a
+ *  message when there is no answer. */
+async function fetchFrom (url, accept, address) {
+  let target
+  try {
+    target = new URL(url)
+  } catch (error) {
+    return { status: 0, body: `not a URL: ${url}` }
+  }
+  const module = target.protocol === 'https:' ? await import('node:https') : await import('node:http')
+  const family = address.indexOf(':') >= 0 ? 6 : 4
+  return new Promise((done) => {
+    const request = module.request(target, {
+      method: 'GET',
+      headers: { accept },
+      lookup: (_host, options, callback) => {
+        if (options && options.all) callback(null, [{ address, family }])
+        else callback(null, address, family)
+      },
+      timeout: FETCH_TIMEOUT_MS
+    }, (response) => {
+      const chunks = []
+      let size = 0
+      response.on('data', (chunk) => {
+        size += chunk.length
+        if (size > MAX_DOCUMENT_BYTES) {
+          response.destroy()
+          done({ status: 0, body: `the document at ${url} is larger than ${MAX_DOCUMENT_BYTES} bytes` })
+          return
+        }
+        chunks.push(chunk)
+      })
+      response.on('end', () => done({ status: response.statusCode, body: Buffer.concat(chunks).toString('utf8') }))
+      response.on('error', (error) => done({ status: 0, body: String(error.message) }))
+    })
+    request.on('timeout', () => request.destroy(new Error('timeout')))
+    request.on('error', (error) => done({ status: 0, body: String(error.message) }))
+    request.end()
+  })
+}
+
+/**
+ * Open one authorization server on the engine.
+ *
+ * @param {object} options
+ * @param {string} options.issuer the issuer identifier (http or https, no query)
+ * @param {string[]} options.resources the resource IRIs tokens may be issued for
+ * @param {string} [options.dir] the directory of the key file
+ * @param {string} [options.alg] "ES256" (default) or "EdDSA"
+ * @param {number} [options.tokenLifetime] seconds, 1 to 300 (default 300)
+ * @param {number} [options.rotateAfter] seconds; 0 (default) never
+ * @param {boolean} [options.allowHttp] accept http subjects (default false)
+ * @param {boolean} [options.allowPrivateFetch] fetch from loopback, link-local and private addresses (default false)
+ * @param {string|null} [options.storageKey] the key text; default FACTOIDAL_LWS_KEY; null reads none
+ * @param {boolean|string[]} [options.cors] false for no CORS fields, or the origins to answer;
+ *   default: echo any valid request Origin (issue 923)
+ * @param {object} [options.engine] an engine to reuse
+ */
+export async function openAuthorizationServer (options = {}) {
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const dir = typeof options.dir === 'string' ? options.dir : null
+  const config = {
+    issuer: options.issuer,
+    resources: Array.isArray(options.resources) ? options.resources : [],
+    now: nowSeconds(),
+    entropy: randomBase64(64)
+  }
+  for (const name of ['alg', 'tokenLifetime', 'leeway', 'rotateAfter', 'docTtl']) {
+    if (options[name] !== undefined) config[name] = options[name]
+  }
+  if (options.allowHttp === true) config.allowHttp = true
+  if (options.allowPrivateFetch === true) config.allowPrivateFetch = true
+  // CORS (issue 923): false or a list of origins, passed unread; absent, the
+  // engine echoes the request Origin (L4Factoidal/Authz/Server.lean stepCors).
+  if (options.cors !== undefined) config.cors = options.cors
+  const key = storageKeyText(options.storageKey)
+  if (key !== undefined) config.storageKey = key
+  if (dir !== null) {
+    const keys = readKeyFile(dir)
+    if (keys !== null) config.keys = keys
+  }
+  const opened = engine.call('authzOpen', [JSON.stringify(config)])
+  const handle = opened.handle
+  if (typeof handle !== 'string') throw new AuthzHostError('authzOpen answered with no handle')
+
+  const persist = (envelope) => {
+    if (dir === null || envelope === null || typeof envelope !== 'object' || envelope.changed !== true) return
+    const told = engine.call('authzKeys', [handle, JSON.stringify({ nonce: randomBase64(12) })])
+    writeKeyFile(dir, told.keys)
+  }
+  persist(opened)
+
+  return {
+    engine,
+    handle,
+    issuer: opened.issuer,
+    /**
+     * One request.
+     * @param {{method: string, target: string, headers: Array<[string, string]>, body: string}} request
+     * @returns {Promise<{status: number, headers: Array<[string, string]>, body: string}>}
+     */
+    async step (request) {
+      let needs = 0
+      for (;;) {
+        const now = nowSeconds()
+        const record = { ...request, now, random: randomBase64(112) }
+        const envelope = engine.call('authzStep', [handle, JSON.stringify(record)])
+        persist(envelope)
+        if (envelope.response !== undefined && envelope.response !== null) {
+          const r = envelope.response
+          return { status: r.status, headers: Array.isArray(r.headers) ? r.headers : [], body: typeof r.body === 'string' ? r.body : '' }
+        }
+        needs += 1
+        if (needs > MAX_NEEDS) throw new AuthzHostError('the engine asked for more than one request may fetch')
+        if (envelope.resolve !== undefined && envelope.resolve !== null) {
+          const host = String(envelope.resolve.host)
+          const addresses = await resolveHost(host)
+          engine.call('authzFetched', [handle, JSON.stringify({ host, addresses, now: nowSeconds() })])
+        } else if (envelope.fetch !== undefined && envelope.fetch !== null) {
+          const f = envelope.fetch
+          const got = await fetchFrom(String(f.url), String(f.accept), String(f.address))
+          engine.call('authzFetched', [handle, JSON.stringify({ url: f.url, status: got.status, body: got.body, now: nowSeconds() })])
+        } else {
+          throw new AuthzHostError('authzStep answered with no response, resolve or fetch')
+        }
+      }
+    },
+    /** Make a new signing key now (the old one stays published). Returns
+     *  the engine's envelope unread. */
+    rotate () {
+      const told = engine.call('authzRotate', [handle, JSON.stringify({ now: nowSeconds(), random: randomBase64(64) })])
+      persist(told)
+      return told
+    },
+    /** The private JWKs of the published keys: for a test harness only. */
+    privateJwks () {
+      return engine.call('authzKeys', [handle, JSON.stringify({ private: true })]).jwks
+    },
+    close () {
+      try { engine.call('authzClose', [handle]) } catch (_error) { /* already gone */ }
+    }
+  }
+}
+
+function headerPairs (raw) {
+  const pairs = []
+  for (let index = 0; index + 1 < raw.length; index += 2) pairs.push([raw[index], raw[index + 1]])
+  return pairs
+}
+
+function readBody (request) {
+  return new Promise((resolveBody, reject) => {
+    const chunks = []
+    request.on('data', (chunk) => chunks.push(chunk))
+    request.on('error', reject)
+    request.on('end', () => resolveBody(Buffer.concat(chunks).toString('utf8')))
+  })
+}
+
+/**
+ * Start an authorization server: listen, then open the engine handle. With
+ * no `issuer` the issuer is the bound origin.
+ *
+ * @param {object} options as `openAuthorizationServer`, plus `port`, `host`
+ * @returns {Promise<{server: object, port: number, origin: string, issuer: string,
+ *                    authz: object, close: Function}>}
+ */
+export async function listen (options = {}) {
+  const http = await import('node:http')
+  const port = typeof options.port === 'number' ? options.port : 0
+  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
+  let authz = null
+  const server = http.createServer(async (request, response) => {
+    let answer
+    try {
+      const record = {
+        method: request.method,
+        target: request.url,
+        headers: headerPairs(request.rawHeaders),
+        body: await readBody(request)
+      }
+      answer = await authz.step(record)
+    } catch (error) {
+      console.error(`authz-serve: ${error && error.message ? error.message : error}`)
+      response.writeHead(500, { 'content-type': 'text/plain' })
+      response.end('authz-serve: host failure\n')
+      return
+    }
+    for (const [name, value] of answer.headers) response.setHeader(name, String(value))
+    response.statusCode = answer.status
+    response.end(request.method === 'HEAD' ? undefined : answer.body)
+  })
+  await new Promise((resolveListen, reject) => {
+    server.once('error', reject)
+    server.listen(port, host, resolveListen)
+  })
+  const bound = server.address()
+  const origin = `http://${host.indexOf(':') >= 0 ? `[${host}]` : host}:${bound.port}`
+  try {
+    authz = await openAuthorizationServer({ ...options, issuer: typeof options.issuer === 'string' ? options.issuer : origin })
+  } catch (error) {
+    await new Promise((resolveClose) => server.close(resolveClose))
+    throw error
+  }
+  return {
+    server,
+    port: bound.port,
+    origin,
+    issuer: authz.issuer,
+    authz,
+    close () {
+      return new Promise((resolveClose) => {
+        server.close(() => { authz.close(); resolveClose() })
+      })
+    }
+  }
+}