@factoidal/core 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.18.0 (2026-10-27)
+
+- XSD constructor functions for datatypes outside the SPARQL 1.1 §17.5 table (`xsd:byte`, `xsd:int`, `xsd:unsignedInt`, `xsd:date`, `xsd:time`, `xsd:gYear` and the other `xsd:g*` types, the duration types, `xsd:token`, …) now cast as XPath F&O 3.1 §19 says. Before, they changed only the datatype and gave ill-typed literals such as `"HaHa"^^xsd:byte`. An invalid value or a cast that F&O does not allow is now an error (the variable is unbound) (https://github.com/danbri/factoidal/issues/1041, https://github.com/danbri/factoidal-core/pull/142).
+- SPARQL: STRSTARTS, STRENDS, CONTAINS, STRBEFORE and STRAFTER compare the base direction of `rdf:dirLangString` arguments (SPARQL 1.2 §17.4.3: same language tag and same base direction). `CONTAINS("abc"@en--ltr, "a"@en)` is now an error. STRBEFORE and STRAFTER keep the base direction of the first argument: `STRBEFORE("abc"@en--ltr, "b")` is `"a"@en--ltr` (https://github.com/danbri/factoidal/issues/1042, https://github.com/danbri/factoidal-core/pull/136).
+- Store open sends the manifest to the engine as bytes, not as hexadecimal inside the JSON arguments, and decodes it once for the plan and the open (new ops `storeManifestInspectBytes`, `storeQueryPlanBytes`, `storeOpenBytes`; the hexadecimal ops stay). On the londat store (1,046 blocks, 753 kB manifest) a scoped `openStoreHandle` takes 198 ms, not 305 ms with 0.17.0 (median of 9) (https://github.com/danbri/factoidal/issues/1039, https://github.com/danbri/factoidal-core/pull/141).
+- Tests: the W3C manifest runner `l4w3c` reads `.n3` expected results when they are Turtle-compatible (else the test is unsupported, with the reason) and runs Jena's `mfx:TestQuery` as a query evaluation test; Jena ARQ manifests: 31 pass (was 13) of 308 (https://github.com/danbri/factoidal-core/pull/138). The Jena ARQ expression suite drops the 62 expected failures these fixes remove. `tools/split-read-differential.sh` runs on macOS and fails when it checks no file (https://github.com/danbri/factoidal-core/pull/133).
+- LWS client (https://github.com/danbri/factoidal/issues/1065): `read` takes `rangeStart`, `rangeEnd`, `ifNoneMatch` and `prefer` and reports `notModified` (304) and `contentRange`; `verifyNotification` takes `trustedStorages` and never asks an untrusted storage for its description (theorem `step_start_verify_trusted`); `search` and `typeIndex` take `onePage` (one page with its `next`, theorem `onPage_onePage_no_fetch`) and `endpoint` (the service endpoint, no discovery); `describe`, `readPage`, `findLinkset`, `putLinkset`, `getSubscription` and `queryFormats` (OPTIONS, `Accept-Query`) are new kinds; `subscribe` takes `expires`; `updateLinkset` takes `linksetUrl`; a session key may be Ed25519 (EdDSA) as well as P-256; the session takes `bearer` (`{token, realm?}`, a token with no realm goes to every request) and `idToken`. New wasm op `lwsClientNewKey` and `createDidKey({ algorithm })` make a P-256 or Ed25519 `did:key` agent from host random bytes (theorems `multikeyJwk?_p256`, `multikeyJwk?_ed25519`). Each `done` document has a `report` (Metadata, Item, Page, Storage, Subscription shapes read in Lean, `Client/Report.lean`) and each `fail` document a `report` with the driver error kind (`LwsClientError.report`). The lws-driver/1 adapter `deploy/lws-client-adapter/adapter.mjs` only translates JSON now; checker result in its README. Needs a wasm with the op `lwsClientNewKey`.
+- WebDAV: `factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]` serves LWS storages to file browsers (macOS Finder, Windows Explorer, GNOME Files, KDE Dolphin) over WebDAV, RFC 4918 classes 1 and 2 (https://github.com/danbri/factoidal/issues/1066). The root collection holds one folder per mount; a mount is one Markdown file `CONFIGDIR/NAME.md` (`- kind: local` with `- path:` an `lws-serve` storage directory, or `- kind: lws` with `- url:` a remote storage and `- auth: none | did-key | bearer`). A local mount is opened by the ops `lws-serve` uses, as the storage's owner; a remote mount is reached through the LWS client, with a self-issued `did:key` credential from a P-256 key file (made when absent). Every decision is in Lean (`L4Factoidal/WebDAV/`); the host `webdav/server.mjs` carries sockets, files and fetches. New wasm ops `webdavOpen`, `webdavLoad`, `webdavStep`, `webdavResume`, `webdavClose`. JS: `listen({ configDir })` and `openWebdav({ configDir })` from `@factoidal/core/webdav`. litmus 0.13: 208 pass, 0 fail (out of 208: basic, copymove, props, locks, http on a local and a remote mount). Not yet: dead properties and locks kept across a restart (https://github.com/danbri/factoidal/issues/1078); checks with the real file browsers (https://github.com/danbri/factoidal/issues/1079). Design record: `docs/designissues/2026-10-27-webdav.md`.
+- JSON-LD-star (RDF 1.2 triple terms, reifiers, annotations; JSON-LD-star draft, json-ld/json-ld-star `1.2-tests`): option `rdfstar` on `jsonldToRdf`, `jsonldFromRdf`, `parse` and `serialize` with `format: 'jsonld'` reads and writes `@triple`, `@reifies` and `@annotation`; without it a triple term is refused when writing JSON-LD. 170 of 171 json-ld-star tests pass (the one fail is a defective fixture, fromRdf tst07); W3C json-ld-api unchanged (791 pass, 2 local-override, of 793) (https://github.com/danbri/factoidal-core/pull/134, https://github.com/danbri/factoidal-core/pull/140).
+
 ## 0.17.0 (2026-10-27)
 
 - **Breaking:** `canonicalHash(graph)` now returns the SHA-256 (64 lowercase hex digits) of the RDFC-1.0 canonical N-Quads, as the RDF Dataset Canonicalization specification uses it. Before, it returned the canonical text. Use `canonicalize()` for the text. The engine computes the digest in Lean (new op `datasetCanonicalHash`) (https://github.com/danbri/factoidal/issues/1040, https://github.com/danbri/factoidal-core/pull/127).

package/bin/factoidal.mjs

@@ -113,6 +113,8 @@ commands:
                               (RFC 8414 metadata, JWK Set, RFC 8693 token exchange)
   authz-keys DIR              print the public JWK Set of an authorization server
   xmpp-serve DIR              serve XMPP (RFC 6120/6121) over TCP or direct TLS
+  webdav-serve CONFIGDIR      serve local and remote LWS storages to file
+                              browsers over WebDAV (RFC 4918)
 
 global options:
   -h, --help                  print this text, or a command's own help
@@ -644,6 +646,47 @@ MUC/MIX/GC3 rooms.
 Specifications: https://www.rfc-editor.org/rfc/rfc6120 and
 https://www.rfc-editor.org/rfc/rfc6121`,
 
+  'webdav-serve': `factoidal webdav-serve - serve LWS storages to file browsers over WebDAV
+
+usage: factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]
+
+Starts a WebDAV server (RFC 4918, classes 1 and 2) that macOS Finder,
+Windows Explorer, GNOME Files and KDE Dolphin can connect to. Its root
+collection holds one folder per mount; a mount is one Markdown file
+CONFIGDIR/NAME.md (README.md is not a mount):
+
+    # Display name
+    - kind: local | lws
+    - path: ./alice-storage        (local: an lws-serve storage directory)
+    - url: https://storage.example/alice/   (lws: the storage root)
+    - auth: none | did-key | bearer
+    - key-file: ./alice.jwk        (did-key: a P-256 private JWK; made when absent)
+    - token-file: ./alice.token    (bearer: an access token)
+    - writable: true | false       (default true for local, false for lws)
+    - storage: snapshot | files    (local: default what the directory holds)
+    - base: IRI                    (local: the storage root's IRI, default http://localhost/)
+
+Only the first "# " heading and the first "- key: value" list are read; the
+words in brackets above are notes, not part of a value. A malformed file
+stops the start with its name and line number.
+
+A local mount opens the directory with the operations lws-serve uses, as
+the storage's owner (do not serve the same directory with lws-serve at the
+same time). An lws mount reaches the storage through the LWS client.
+
+  --port N         the port to bind (default 8090; 0 takes an ephemeral one)
+  --host ADDRESS   the address to bind (default 127.0.0.1)
+
+Connect: macOS Finder, Go > Connect to Server, http://127.0.0.1:8090/ ;
+Windows, Map network drive, http://127.0.0.1:8090/ ; GNOME Files,
+dav://127.0.0.1:8090/ .
+
+The server makes no protocol decision: every method, status, property, lock
+and mapping is decided by formal/lean4/L4Factoidal/WebDAV/. A WebAssembly
+module built before the WebDAV operations landed makes this command exit 3
+and say so. Design: docs/designissues/2026-10-27-webdav.md
+(https://github.com/danbri/factoidal/issues/1066).`,
+
   'solid-client': `factoidal solid-client - run one Solid client operation
 
 usage: factoidal solid-client <get|put|post|delete|discover> URL [options]
@@ -788,7 +831,8 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key'])
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key']),
+  'webdav-serve': new Set(['port', 'host'])
 }
 
 // ------------------------------------------------------------- commands
@@ -2027,6 +2071,34 @@ async function commandSolidServe (positional, options) {
   return untilInterrupted(running, quiet)
 }
 
+// webdav-serve CONFIGDIR (https://github.com/danbri/factoidal/issues/1066):
+// the host carries sockets, files and fetches; the engine reads the mount
+// files and decides every answer (L4Factoidal/WebDAV/).
+async function commandWebdavServe (positional, options) {
+  if (positional.length !== 1) throw new UsageError('webdav-serve needs one CONFIGDIR')
+  const quiet = options.quiet === true
+  const { listen, WebdavHostError } = await import('../webdav/server.mjs')
+  let running
+  try {
+    running = await listen({ configDir: positional[0], port: servePort(options, 8090), host: serveHost(options) })
+  } catch (error) {
+    if (error instanceof WebdavHostError && error.unknownOp) return notWired('webdav-serve', error.message)
+    if (error instanceof WebdavHostError || (error !== null && typeof error === 'object' && error.code === 'ENOENT')) {
+      err(`factoidal webdav-serve: ${error.message}`)
+      return EXIT_FAILURE
+    }
+    throw error
+  }
+  if (!quiet) {
+    err(`webdav-serve: listening on ${running.origin} for ${positional[0]}`)
+    for (const m of running.mounts) {
+      err(`webdav-serve: ${running.origin}/${encodeURIComponent(m.name)}/ - ${m.title} (${m.kind}${m.writable ? '' : ', read-only'}${m.agent ? ', as ' + m.agent : ''})`)
+    }
+  }
+  out(running.origin)
+  return untilInterrupted(running, quiet)
+}
+
 async function commandXmppServe (positional, options) {
   if (positional.length !== 1) throw new UsageError('xmpp-serve needs one DIR')
   const quiet = options.quiet === true
@@ -2207,7 +2279,8 @@ const COMMANDS = {
   'lws-client': commandLwsClient,
   'authz-serve': commandAuthzServe,
   'authz-keys': commandAuthzKeys,
-  'xmpp-serve': commandXmppServe
+  'xmpp-serve': commandXmppServe,
+  'webdav-serve': commandWebdavServe
 }
 
 // ----------------------------------------------------------------- main

package/bin/store.mjs

@@ -123,7 +123,7 @@ export const STACK_REMEDY = {
 export function openStore (root, generationName = null) {
   if (typeof generationName !== 'string') {
     const opened = openCollection(root)
-    return { ...opened, manifestHex: hexOfBytes(opened.manifest), activated: true }
+    return withManifestHex({ ...opened, activated: true })
   }
   const generationDir = joinPath(root, generationName)
   for (const manifestName of MANIFEST_NAMES) {
@@ -133,23 +133,67 @@ export function openStore (root, generationName = null) {
     } catch (_error) {
       continue
     }
-    return {
+    return withManifestHex({
       root,
       generation: generationName,
       generationDir,
       manifestName,
       manifest,
-      manifestHex: hexOfBytes(manifest),
       activated: false
-    }
+    })
   }
   throw new StoreOperationError(
     `${generationDir} has none of ${MANIFEST_NAMES.join(', ')}`)
 }
 
+/**
+ * `store.manifestHex`, the hexadecimal the older manifest ops take, computed
+ * on first read. The byte ops (`hasManifestBytesOps`) do not read it, so a
+ * store opened for them never builds the 1.5 million digits of a large
+ * manifest (https://github.com/danbri/factoidal/issues/1039).
+ */
+function withManifestHex (store) {
+  let hex = null
+  return Object.defineProperty(store, 'manifestHex', {
+    enumerable: true,
+    get () {
+      if (hex === null) hex = hexOfBytes(store.manifest)
+      return hex
+    }
+  })
+}
+
+/** The byte forms of the manifest ops (formal/lean4/Wasm/Ops/StoreHandles.lean). */
+const MANIFEST_BYTES_OPS = ['storeManifestInspectBytes', 'storeQueryPlanBytes', 'storeOpenBytes']
+const manifestBytesSupport = new WeakMap()
+
+/**
+ * Whether the engine serves the byte forms of the manifest ops. They take
+ * the manifest as the byte region, not as hexadecimal inside the JSON
+ * arguments, and the engine decodes it once for a plan and the open that
+ * follows. An engine built before them has only the hexadecimal ops, and
+ * this host then uses those, as before.
+ */
+function hasManifestBytesOps (engine) {
+  let known = manifestBytesSupport.get(engine)
+  if (known === undefined) {
+    known = false
+    if (typeof engine.callBlobIO === 'function') {
+      const reflection = engine.call('ops', [])
+      const blobIoOps = Array.isArray(reflection && reflection.blobIoOps) ? reflection.blobIoOps : []
+      known = MANIFEST_BYTES_OPS.every((op) => blobIoOps.includes(op))
+    }
+    manifestBytesSupport.set(engine, known)
+  }
+  return known
+}
+
 /** `storeManifestInspect` — decode one manifest. */
 export function inspectManifest (engine, store) {
   try {
+    if (hasManifestBytesOps(engine)) {
+      return engine.callBlobIO('storeManifestInspectBytes', [], store.manifest).envelope
+    }
     return engine.call('storeManifestInspect', [store.manifestHex])
   } catch (error) {
     throw asStoreError(error)
@@ -159,6 +203,9 @@ export function inspectManifest (engine, store) {
 /** `storeQueryPlan` — the artifact keys this query needs, and the mode. */
 export function planQuery (engine, store, sparql) {
   try {
+    if (hasManifestBytesOps(engine)) {
+      return engine.callBlobIO('storeQueryPlanBytes', [sparql], store.manifest).envelope
+    }
     return engine.call('storeQueryPlan', [store.manifestHex, sparql])
   } catch (error) {
     throw asStoreError(error)
@@ -194,16 +241,20 @@ function capDecision (engine, store, sparql) {
   }
 }
 
-/** Read the named artifacts and concatenate them into one region. */
-function regionOf (store, keys) {
+/** Read the named artifacts and concatenate them into one region. With a
+ *  `prefix` (the manifest, for `storeOpenBytes`) the region starts with it,
+ *  and the windows still count from the first artifact byte. */
+function regionOf (store, keys, prefix = null) {
   const chunks = keys.map((key) => readWhole(joinPath(store.generationDir, key)))
+  const start = prefix ? prefix.length : 0
   let total = 0
   for (const chunk of chunks) total += chunk.length
-  const blob = new Uint8Array(total)
+  const blob = new Uint8Array(start + total)
+  if (prefix) blob.set(prefix, 0)
   const artifacts = []
   let offset = 0
   for (let index = 0; index < chunks.length; index += 1) {
-    blob.set(chunks[index], offset)
+    blob.set(chunks[index], start + offset)
     artifacts.push({ key: keys[index], offset, len: chunks[index].length })
     offset += chunks[index].length
   }
@@ -374,11 +425,16 @@ export function openStoreHandle (engine, store, options = {}) {
   } else {
     keys = manifestKeys(engine, store)
   }
-  const { blob, artifacts } = regionOf(store, keys)
+  const bytesOps = hasManifestBytesOps(engine)
+  // The byte op takes the manifest as the first bytes of the region.
+  const { blob, artifacts } = regionOf(store, keys, bytesOps ? store.manifest : null)
   let envelope
   try {
-    envelope = engine.callBlobIO('storeOpen',
-      [store.manifestHex, JSON.stringify(artifacts)], blob).envelope
+    envelope = bytesOps
+      ? engine.callBlobIO('storeOpenBytes',
+        [String(store.manifest.length), JSON.stringify(artifacts)], blob).envelope
+      : engine.callBlobIO('storeOpen',
+        [store.manifestHex, JSON.stringify(artifacts)], blob).envelope
   } catch (error) {
     throw asStoreError(error)
   }

package/index.d.ts

@@ -212,6 +212,9 @@ export interface WriteOptions {
   useRdfType?: boolean;
   /** 'jsonld' only. */
   rdfDirection?: string;
+  /** 'jsonld' only: write RDF 1.2 triple terms as JSON-LD-star (`@triple`,
+   *  `@reifies`, `@annotation`). Without it a triple term is refused. */
+  rdfstar?: boolean;
 }
 
 export type WriteFormat =
@@ -1011,6 +1014,9 @@ export interface JsonLdOptions {
   rdfDirection?: string;
   expandContext?: string;
   processingMode?: string;
+  /** JSON-LD-star: read `@triple`, `@reifies`, `@annotation` as RDF 1.2
+   *  triple terms and reifiers. */
+  rdfstar?: boolean;
 }
 
 /**
@@ -1027,6 +1033,9 @@ export function jsonldToRdf(
 export interface JsonLdFromRdfOptions {
   useNativeTypes?: boolean;
   useRdfType?: boolean;
+  /** JSON-LD-star: write RDF 1.2 triple terms (`@triple`, `@reifies`,
+   *  `@annotation`). Without it a triple term is refused. */
+  rdfstar?: boolean;
   format?: DataFormat;
 }
 

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "ebac38a482d0";
+const WASM_VERSION = "925f357453db";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-fa72ba5bc828-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40439252690",
-  "gitSha": "fa72ba5bc828c1eb75572c3436e9d739f76fdd57",
-  "builtAt": "2026-10-27T03:13:16Z",
+  "release": "danbri/factoidal-builds build-788ee43aec79-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40457275423",
+  "gitSha": "788ee43aec79c4d29592c5e82cc7ab350f0d05dd",
+  "builtAt": "2026-10-27T06:36:59Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "ebac38a482d03d4a6ce1cf4a59164288628fed6957483dd55180743e7a3daf40",
-  "wasmBytes": 17071472,
+  "wasmSha256": "925f357453dbb71d087bef70fd428b054999756d7c967a806403d3d8ee875a57",
+  "wasmBytes": 17565361,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -182,11 +182,10 @@ function utf16Diagnostics(text, diagnostics) {
 // is never one of a partial generation.
 // ---------------------------------------------------------------------
 class Store {
-  constructor(e, env, gen, manifestHex, fromNQuads, withExtensionRounds) {
+  constructor(e, env, gen, fromNQuads, withExtensionRounds) {
     this._e = e;
     this._env = env;
     this._gen = gen;
-    this._manifestHex = manifestHex;
     this._closed = false;
     this._fromNQuads = fromNQuads;
     this._withExtensionRounds = withExtensionRounds;
@@ -236,7 +235,9 @@ class Store {
 
   /** The manifest, decoded by the engine (op storeManifestInspect). */
   async inspect() {
-    const r = entryResult(this._e.storeManifestInspect(this._manifestHex), 'Store.inspect');
+    const r = entryResult(typeof this._e.storeManifestInspectBytes === 'function'
+      ? this._e.storeManifestInspectBytes(this._gen.manifest)
+      : this._e.storeManifestInspect(hexOfBytes(this._gen.manifest)), 'Store.inspect');
     const { ok: _ok, ...rest } = r;
     return rest;
   }
@@ -841,7 +842,7 @@ function buildApi(driver) {
    * @param {Dataset|string|Array} data
    * @param {{format?: string, version?: '1.1'|'1.2', prefixes?: object,
    *   literalShorthand?: boolean, useNativeTypes?: boolean,
-   *   useRdfType?: boolean, rdfDirection?: string,
+   *   useRdfType?: boolean, rdfDirection?: string, rdfstar?: boolean,
    *   inputFormat?: string, baseIRI?: string}} [options]
    *   format: nquads (default), ntriples, turtle, trig, rdfxml, jsonld,
    *   rdfc. inputFormat and baseIRI read text `data`.
@@ -1210,7 +1211,9 @@ function buildApi(driver) {
    * A remote `@context` is not fetched.
    * @param {string} jsonldText
    * @param {{base?: string, rdfDirection?: string, expandContext?: string,
-   *   processingMode?: string}} [options]
+   *   processingMode?: string, rdfstar?: boolean}} [options]
+   *   rdfstar: JSON-LD-star (`@triple`, `@reifies`, `@annotation` as RDF 1.2
+   *   triple terms and reifiers).
    * @returns {Promise<Dataset>}
    */
   async function jsonldToRdf(jsonldText, options) {
@@ -1223,6 +1226,7 @@ function buildApi(driver) {
       ...(opts.rdfDirection ? { rdfDirection: opts.rdfDirection } : {}),
       ...(opts.expandContext ? { expandContext: opts.expandContext } : {}),
       ...(opts.processingMode ? { processingMode: opts.processingMode } : {}),
+      ...(opts.rdfstar ? { rdfstar: true } : {}),
     });
     return c.wrap(entryResult(c.e.datasetFromJsonLd(jsonldText, optionsJson), 'jsonldToRdf'), {},
       { format: 'jsonld', formatInferred: false });
@@ -1250,7 +1254,8 @@ function buildApi(driver) {
    * The text form is `serialize(data, {format: 'jsonld'})`.
    * @param {Dataset|string|Array} data
    * @param {{useNativeTypes?: boolean, useRdfType?: boolean,
-   *   rdfDirection?: string, format?: string, baseIRI?: string}} [options]
+   *   rdfDirection?: string, rdfstar?: boolean, format?: string,
+   *   baseIRI?: string}} [options]
    * @returns {Promise<any>}
    */
   async function jsonldFromRdf(data, options) {
@@ -1907,20 +1912,30 @@ function buildApi(driver) {
     const e = await entry();
     requireEntryFn(e, 'storeOpen', 'openStore (storeOpen)');
     const gen = await openGeneration(reader, opts.generation);
-    const manifestHex = hexOfBytes(gen.manifest);
+    // The byte ops when the engine has them (issue 1039): the manifest
+    // crosses as bytes and is decoded once for the plan and the open. An
+    // older engine gets the hexadecimal ops, as before.
+    const bytesOps = typeof e.storeOpenBytes === 'function';
+    const manifestHex = bytesOps ? null : hexOfBytes(gen.manifest);
     let keys;
     if (Array.isArray(opts.keys)) {
       keys = opts.keys.map(String);
     } else if (typeof opts.sparql === 'string') {
-      const plan = entryResult(e.storeQueryPlan(manifestHex, opts.sparql), 'openStore(plan)');
+      const plan = entryResult(bytesOps
+        ? e.storeQueryPlanBytes(gen.manifest, opts.sparql)
+        : e.storeQueryPlan(manifestHex, opts.sparql), 'openStore(plan)');
       keys = plan.keys.concat(plan.sidecarKeys || [], plan.blobKeys || []);
     } else {
-      keys = manifestKeys(entryResult(e.storeManifestInspect(manifestHex), 'openStore(inspect)'));
+      keys = manifestKeys(entryResult(bytesOps
+        ? e.storeManifestInspectBytes(gen.manifest)
+        : e.storeManifestInspect(manifestHex), 'openStore(inspect)'));
     }
     const { blob, artifacts } = await readRegion(reader, gen.generation, keys);
-    const env = entryResult(e.storeOpen(manifestHex, JSON.stringify(artifacts), blob), 'openStore');
+    const env = entryResult(bytesOps
+      ? e.storeOpenBytes(gen.manifest, JSON.stringify(artifacts), blob)
+      : e.storeOpen(manifestHex, JSON.stringify(artifacts), blob), 'openStore');
     const c = await ctx();
-    return new Store(e, env, gen, manifestHex, (nq) => c.fromNQuads(nq, {}), withExtensionRounds);
+    return new Store(e, env, gen, (nq) => c.fromNQuads(nq, {}), withExtensionRounds);
   }
 
   /**

package/lib/dataset.mjs

@@ -279,7 +279,7 @@ class Dataset {
    * The dataset as a document.
    * @param {{format?: string, version?: '1.1'|'1.2', prefixes?: object,
    *   literalShorthand?: boolean, useNativeTypes?: boolean,
-   *   useRdfType?: boolean, rdfDirection?: string}} [options]
+   *   useRdfType?: boolean, rdfDirection?: string, rdfstar?: boolean}} [options]
    *   format: nquads (default), ntriples, turtle, trig, rdfxml, jsonld,
    *   rdfc (RDFC-1.0 canonical N-Quads).
    * @returns {Promise<string>}
@@ -315,6 +315,7 @@ class Dataset {
         ...(opts.useNativeTypes ? { useNativeTypes: true } : {}),
         ...(opts.useRdfType ? { useRdfType: true } : {}),
         ...(opts.rdfDirection ? { rdfDirection: String(opts.rdfDirection) } : {}),
+        ...(opts.rdfstar ? { rdfstar: true } : {}),
         ...(suffix ? { version: String(opts.version) } : {}),
       })), 'serialize');
       return r.jsonld;

package/lib/lean-entry.mjs

@@ -125,6 +125,9 @@ function installExtensionBridge(eng, entry) {
   };
 }
 
+/** The byte forms of the manifest ops (Wasm/Ops/StoreHandles.lean). */
+const MANIFEST_BYTES_OPS = ['storeManifestInspectBytes', 'storeQueryPlanBytes', 'storeOpenBytes'];
+
 /**
  * Build the entry object lib/api.mjs drives, from a loaded engine handle.
  *
@@ -199,9 +202,45 @@ export function entryFromEngine(eng) {
       }
     };
   }
+  const blobIoOps = Array.isArray(reflection.blobIoOps) ? reflection.blobIoOps : [];
+  // The byte forms of the manifest ops (https://github.com/danbri/factoidal/issues/1039):
+  // the manifest crosses as the byte region, not as hexadecimal inside the
+  // JSON arguments, and the engine decodes it once for a plan and the open
+  // that follows. An engine without them has only the hexadecimal ops; the
+  // methods are then absent and lib/api.mjs uses the hexadecimal ops.
+  if (typeof eng.callBlobIO === 'function' &&
+      MANIFEST_BYTES_OPS.every((op) => blobIoOps.includes(op))) {
+    entry.storeManifestInspectBytes = (manifestBytes) => {
+      try {
+        return JSON.stringify(eng.callBlobIO('storeManifestInspectBytes', [], manifestBytes).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+    entry.storeQueryPlanBytes = (manifestBytes, sparql) => {
+      try {
+        return JSON.stringify(
+          eng.callBlobIO('storeQueryPlanBytes', [String(sparql)], manifestBytes).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+    entry.storeOpenBytes = (manifestBytes, artifactsJson, bytes) => {
+      try {
+        const region = new Uint8Array(manifestBytes.length + bytes.length);
+        region.set(manifestBytes, 0);
+        region.set(bytes, manifestBytes.length);
+        return JSON.stringify(eng.callBlobIO('storeOpenBytes',
+          [String(manifestBytes.length), String(artifactsJson)], region).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+  } else {
+    for (const op of MANIFEST_BYTES_OPS) delete entry[op];
+  }
   // datasetQuadsBin answers a byte region (formal/lean4/L4Factoidal/RDF/QuadsBin.lean):
   // this method answers {envelope, bytes} and throws on a refusal.
-  const blobIoOps = Array.isArray(reflection.blobIoOps) ? reflection.blobIoOps : [];
   if (typeof eng.callBlobIO === 'function' && blobIoOps.includes('datasetQuadsBin')) {
     entry.datasetQuadsBin = (handle, optsJson) => {
       try {

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.17.0';
+export const version = '0.18.0';

package/lws/client.mjs

@@ -38,14 +38,15 @@ import { loadEngine } from '../bin/engine.mjs'
 import { FactoidalError } from '../lib/errors.mjs'
 
 /** The ops this host needs from the engine. */
-export const LWS_CLIENT_OPS = ['lwsClientStart', 'lwsClientStep']
+export const LWS_CLIENT_OPS = ['lwsClientStart', 'lwsClientStep', 'lwsClientNewKey']
 
 /** The operation kinds of the ABI. Listed so a caller can be checked
  *  against the contract; this host attaches no meaning to any of them. */
 export const LWS_CLIENT_KINDS = [
-  'discover', 'read', 'head', 'create', 'update', 'patch', 'delete', 'readLinkset',
-  'updateLinkset', 'move', 'list', 'typeIndex', 'search', 'subscribe', 'unsubscribe',
-  'requestAccess', 'grantAccess', 'getAccess', 'revokeAccess', 'verifyNotification'
+  'discover', 'describe', 'read', 'readPage', 'head', 'create', 'update', 'patch', 'delete',
+  'findLinkset', 'readLinkset', 'updateLinkset', 'putLinkset', 'move', 'list', 'typeIndex',
+  'search', 'queryFormats', 'subscribe', 'getSubscription', 'unsubscribe', 'requestAccess',
+  'grantAccess', 'getAccess', 'revokeAccess', 'verifyNotification'
 ]
 
 /** The error an operation ends with. `reason` is the engine's code
@@ -58,6 +59,9 @@ export class LwsClientError extends FactoidalError {
     this.name = 'LwsClientError'
     this.reason = reason
     this.detail = fail
+    // The engine's name for the failure in the lws-driver/1 adapter
+    // protocol ({ kind, message, ... }), as the engine wrote it.
+    this.report = fail && typeof fail.report === 'object' ? fail.report : undefined
     this.unknownOp = extra.unknownOp === true
   }
 }
@@ -138,8 +142,12 @@ export async function lwsClientOpsAvailable (engine) {
  * @param {string} [options.subjectToken] the authentication credential to
  *   exchange for access tokens (RFC 8693 subject_token)
  * @param {string} [options.subjectTokenType] its token type URI
- * @param {object} [options.selfIssued] `{ subject, keyId, jwk }`: a P-256 key
- *   to sign self-issued credentials with, instead of a subject token
+ * @param {object} [options.selfIssued] `{ subject, keyId, jwk }`: a P-256 or
+ *   Ed25519 key to sign self-issued credentials with, instead of a subject
+ *   token (`createDidKey` makes one)
+ * @param {string} [options.idToken] an OpenID Connect ID Token to exchange
+ * @param {object} [options.bearer] `{ token, realm? }`: an access token the
+ *   caller already has; with a realm it is sent only under it
  * @param {object} [options.session] a session from an earlier client
  * @param {number} [options.maxSteps] the loop cap of one operation
  * @returns {Promise<object>} the client
@@ -157,6 +165,9 @@ export async function createLwsClient (options = {}) {
   // `{ subject, keyId, jwk }`: a P-256 key the engine signs self-issued
   // credentials with (lws10-authn-ssi-cid), passed through unread.
   if (options.selfIssued !== undefined) session.selfIssued = options.selfIssued
+  // Read by the engine's session reader (`Machine.sessionOfJson`), unread here.
+  if (options.idToken !== undefined) session.idToken = options.idToken
+  if (options.bearer !== undefined) session.bearer = options.bearer
 
   function call (op, args) {
     try {
@@ -230,7 +241,10 @@ export async function createLwsClient (options = {}) {
     /** The session (access tokens and subject token), for a later client. */
     session: () => ({ ...session }),
     discover: with_('discover'),
+    describe: with_('describe'),
+    /** `read(url, { accept, rangeStart, rangeEnd, ifNoneMatch, prefer })` */
     read: with_('read'),
+    readPage: with_('readPage'),
     head: with_('head'),
     /** `create(containerUrl, { body, mediaType, slug, container, types, links })` */
     create: with_('create'),
@@ -239,26 +253,54 @@ export async function createLwsClient (options = {}) {
     patch: with_('patch'),
     /** `delete(url, { recursive, precondition, tag })` */
     delete: with_('delete'),
+    findLinkset: with_('findLinkset'),
     readLinkset: with_('readLinkset'),
+    /** `updateLinkset(resourceUrl, { body })`, or with `{ linksetUrl, body }`
+     *  when the caller has the linkset resource. */
     updateLinkset: with_('updateLinkset'),
+    putLinkset: with_('putLinkset'),
     /** `move(url, { destination })` */
     move: with_('move'),
     list: with_('list'),
     typeIndex: with_('typeIndex'),
-    /** `search(anyUrlInTheStorage, { query })` */
+    /** `search(anyUrlInTheStorage, { query })`, or `{ endpoint, query }` with
+     *  the service endpoint, `{ onePage: true }` for one page */
     search: with_('search'),
+    queryFormats: with_('queryFormats'),
+    /** `subscribe(url, { topics, inbox, expires })` */
     subscribe: with_('subscribe'),
+    getSubscription: with_('getSubscription'),
     unsubscribe: with_('unsubscribe'),
     requestAccess: with_('requestAccess'),
     grantAccess: with_('grantAccess'),
     getAccess: with_('getAccess'),
     revokeAccess: with_('revokeAccess'),
-    /** `verifyNotification(baseUrl, { requestTarget, method, headers, body })`:
+    /** `verifyNotification(baseUrl, { requestTarget, method, headers, body, trustedStorages })`:
      *  the engine's verdict `{ accept, status, reason? }`. */
     verifyNotification: with_('verifyNotification')
   }
 }
 
+/**
+ * A new `did:key` agent: the engine makes the key pair and the identifier from
+ * 64 random bytes of this host's random source. The host reads none of it.
+ *
+ * @param {object} [options]
+ * @param {object} [options.engine] an engine handle to reuse
+ * @param {string} [options.algorithm] the engine's name of the algorithm
+ *   (default `ES256`, a P-256 key; `EdDSA` makes an Ed25519 key)
+ * @returns {Promise<{agent: string, kid: string, selfIssued: object}>}
+ *   `selfIssued` is the `createLwsClient` option of that name
+ */
+export async function createDidKey (options = {}) {
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const algorithm = typeof options.algorithm === 'string' ? options.algorithm : 'ES256'
+  const random = new Uint8Array(64)
+  globalThis.crypto.getRandomValues(random)
+  const answer = engine.call('lwsClientNewKey', [algorithm, base64OfBytes(random)])
+  return answer.key
+}
+
 /**
  * An HTTP receiver for webhook notifications. For each request it asks the
  * engine (`verifyNotification`) and answers with the status of the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",
@@ -88,6 +88,9 @@
     "./lws": {
       "default": "./lws/server.mjs"
     },
+    "./webdav": {
+      "default": "./webdav/server.mjs"
+    },
     "./lws/client": {
       "default": "./lws/client.mjs"
     },
@@ -123,6 +126,7 @@
     "lib/",
     "bin/",
     "lws/",
+    "webdav/",
     "authz/",
     "solid/",
     "store-host/",

package/webdav/server.mjs

@@ -0,0 +1,293 @@
+// A Node HTTP host for the Factoidal WebDAV server.
+// https://github.com/danbri/factoidal/issues/1066
+// Design record: docs/designissues/2026-10-27-webdav.md
+//
+// WHAT THIS FILE IS ALLOWED TO DO
+// Carry sockets, files and fetches for the engine, and nothing else:
+//
+// * at start, list CONFIGDIR and give the names to `webdavOpen`; read the
+//   files and test the paths the engine names (`need`) and give them to
+//   `webdavLoad` until it answers `ready`; write the files it names
+//   (`write`, a key file it made); open each local storage directory it
+//   names with the ops `lws-serve` uses (`openLwsStorage`, the config passed
+//   unread);
+// * per request, give the method, target, header fields and content to
+//   `webdavStep`, then carry what the engine answers: an `lws` request to
+//   the local storage it names (no socket: the storage handle's own step),
+//   a `fetch` to the URL it names, until it answers a `response`, which
+//   this file writes back.
+//
+// It makes NO protocol decision. Which files are mounts, what a mount file
+// says, every status code, header field, XML body, lock, property and path
+// mapping is decided in formal/lean4/L4Factoidal/WebDAV/ (iron rule 7 of
+// CLAUDE.md). The one status code written here is 500, for a failure of
+// this host itself. Requests are served one at a time (a queue), because
+// the engine keeps one request in flight per handle.
+//
+// THE WASM CONTRACT (formal/lean4/Wasm/Ops/WebDAV.lean)
+//   webdavOpen   [configJson]                 -> { ok, handle, need }
+//   webdavLoad   [handle, filesJson]          -> { ok, need } | { ok, ready }
+//   webdavStep   [handle, requestJson] + body -> { ok, response | lws | fetch } + body
+//   webdavResume [handle, answerJson]  + body -> { ok, response | lws | fetch } + body
+//   webdavClose  [handle]                     -> { ok }
+
+import { readFileSync, readdirSync, writeFileSync, existsSync } from 'node:fs'
+import { resolve as resolvePath } from 'node:path'
+import { loadEngine } from '../bin/engine.mjs'
+import { openLwsStorage } from '../lws/server.mjs'
+
+/** The ops this host needs from the engine. */
+export const WEBDAV_OPS = ['webdavOpen', 'webdavLoad', 'webdavStep', 'webdavResume', 'webdavClose']
+
+/** The most engine answers one request may take before this host gives up:
+ *  a bound against a defective module, not a protocol rule. */
+const MAX_HOPS = 100000
+
+/** The most rounds of `need` at start: the engine names two. */
+const MAX_LOADS = 8
+
+/** An error of this host, as opposed to one the engine reported. */
+export class WebdavHostError extends Error {
+  constructor (message, detail = {}) {
+    super(message)
+    this.name = 'WebdavHostError'
+    this.unknownOp = detail.unknownOp === true
+    this.envelope = detail.envelope
+  }
+}
+
+function isUnknownOp (error) {
+  const text = error && error.message ? String(error.message) : String(error)
+  return text.indexOf('unknown op') >= 0
+}
+
+/** Random bytes as base64. Pure I/O. */
+function randomBase64 (size) {
+  const bytes = new Uint8Array(size)
+  globalThis.crypto.getRandomValues(bytes)
+  return Buffer.from(bytes).toString('base64')
+}
+
+function nowSeconds () {
+  return Math.floor(Date.now() / 1000)
+}
+
+/** One engine call; an `ok: false` envelope is thrown with the engine's words. */
+function callEngine (engine, op, args) {
+  let envelope
+  try {
+    envelope = engine.call(op, args)
+  } catch (error) {
+    if (isUnknownOp(error)) {
+      throw new WebdavHostError(`the loaded l4factoidal WebAssembly module does not carry ${op}`, { unknownOp: true })
+    }
+    throw error
+  }
+  return envelope
+}
+
+function blobCall (engine, op, args, bytes) {
+  const got = engine.callBlobIO(op, args, bytes)
+  const envelope = got.envelope
+  if (envelope === null || typeof envelope !== 'object') throw new WebdavHostError(`${op} answered with no envelope`)
+  if (envelope.ok === false) throw new WebdavHostError(`${op}: ${envelope.error}`, { envelope })
+  return { envelope, bytes: got.bytes instanceof Uint8Array ? got.bytes : new Uint8Array(0) }
+}
+
+/** The files and paths the engine named, read and tested. Pure I/O. */
+function gather (configDir, need) {
+  const files = (need.read || []).map((name) => {
+    try {
+      return { name, text: readFileSync(resolvePath(configDir, name), 'utf8') }
+    } catch (_error) {
+      return { name, missing: true }
+    }
+  })
+  const exists = (need.exists || []).map((path) => ({ path, present: existsSync(resolvePath(configDir, path)) }))
+  return { files, exists }
+}
+
+/**
+ * Open a WebDAV server handle over the mount files of `configDir`.
+ *
+ * @param {object} options
+ * @param {string} options.configDir the directory of mount files
+ * @param {object} [options.engine] an engine handle to reuse
+ * @returns {Promise<{handle: string, mounts: object[], step: Function, close: Function}>}
+ */
+export async function openWebdav (options = {}) {
+  if (typeof options.configDir !== 'string') throw new WebdavHostError('openWebdav needs configDir')
+  const configDir = options.configDir
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const listing = readdirSync(configDir)
+  let envelope = callEngine(engine, 'webdavOpen', [JSON.stringify({ listing, entropy: randomBase64(32) })])
+  if (envelope.ok === false) throw new WebdavHostError(envelope.error, { envelope })
+  const handle = envelope.handle
+  let loads = 0
+  while (envelope.need !== undefined) {
+    loads += 1
+    if (loads > MAX_LOADS) throw new WebdavHostError('webdavLoad asked for files more often than a start may')
+    envelope = callEngine(engine, 'webdavLoad', [handle, JSON.stringify(gather(configDir, envelope.need))])
+    if (envelope.ok === false) throw new WebdavHostError(envelope.error, { envelope })
+  }
+  const ready = envelope.ready
+  // A file the engine made (a new key): written once, never over a file.
+  for (const w of ready.write || []) {
+    writeFileSync(resolvePath(configDir, w.path), w.text, { mode: parseInt(w.mode, 8), flag: 'wx' })
+  }
+  // Each local storage, opened as lws-serve opens it; the config is the
+  // engine's, passed unread.
+  const storages = new Map()
+  for (const l of ready.local || []) {
+    const storage = await openLwsStorage({ engine, dir: resolvePath(configDir, l.dir), ...l.config, realClock: true })
+    storages.set(l.name, storage)
+  }
+
+  /** Carry one `fetch` the engine named. Pure I/O. */
+  async function exchange (request, bytes) {
+    const init = { method: request.method, headers: request.headers || [], redirect: 'manual' }
+    if (bytes.length > 0) init.body = bytes
+    let reply
+    try {
+      reply = await fetch(request.url, init)
+    } catch (error) {
+      return { answer: { error: error && error.message ? String(error.message) : String(error) }, bytes: new Uint8Array(0) }
+    }
+    const headers = []
+    reply.headers.forEach((value, name) => { headers.push([name, value]) })
+    const body = new Uint8Array(await reply.arrayBuffer())
+    return { answer: { status: reply.status, headers, now: nowSeconds(), randomBase64: randomBase64(48) }, bytes: body }
+  }
+
+  let queue = Promise.resolve()
+
+  /** One request, start to end. */
+  async function serve (request) {
+    const record = {
+      method: request.method,
+      target: request.target,
+      headers: request.headers,
+      now: nowSeconds(),
+      randomBase64: randomBase64(16)
+    }
+    let got = blobCall(engine, 'webdavStep', [handle, JSON.stringify(record)], request.body || new Uint8Array(0))
+    for (let hop = 0; hop < MAX_HOPS; hop += 1) {
+      const env = got.envelope
+      if (env.response !== undefined) {
+        return { status: env.response.status, headers: env.response.headers || [], body: got.bytes }
+      }
+      let answer
+      let bytes
+      if (env.lws !== undefined) {
+        const storage = storages.get(env.lws.mount)
+        if (storage === undefined) throw new WebdavHostError(`the engine named a storage that is not open: ${env.lws.mount}`)
+        const req = env.lws.request
+        const a = await storage.step({ method: req.method, target: req.target, headers: req.headers || [], body: got.bytes })
+        answer = { status: a.status, headers: a.headers }
+        bytes = a.body
+      } else if (env.fetch !== undefined) {
+        const x = await exchange(env.fetch, got.bytes)
+        answer = x.answer
+        bytes = x.bytes
+      } else {
+        throw new WebdavHostError('the engine answered neither response, lws nor fetch')
+      }
+      got = blobCall(engine, 'webdavResume', [handle, JSON.stringify(answer)], bytes)
+    }
+    throw new WebdavHostError('a request took more engine answers than this host allows')
+  }
+
+  return {
+    handle,
+    engine,
+    mounts: ready.mounts || [],
+    /**
+     * One request, served after the requests before it.
+     * @param {{method: string, target: string, headers: Array<[string, string]>, body: Uint8Array}} request
+     */
+    step (request) {
+      const run = queue.then(() => serve(request))
+      queue = run.catch(() => {})
+      return run
+    },
+    close () {
+      for (const s of storages.values()) s.close()
+      try { engine.call('webdavClose', [handle]) } catch (_error) { /* already gone */ }
+    }
+  }
+}
+
+function readBody (request) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    request.on('data', (chunk) => chunks.push(chunk))
+    request.on('error', reject)
+    request.on('end', () => resolve(new Uint8Array(Buffer.concat(chunks))))
+  })
+}
+
+function headerPairs (raw) {
+  const pairs = []
+  for (let index = 0; index + 1 < raw.length; index += 2) pairs.push([raw[index], raw[index + 1]])
+  return pairs
+}
+
+function writeHeaders (response, pairs) {
+  for (const pair of pairs) {
+    if (!Array.isArray(pair) || pair.length < 2) continue
+    const existing = response.getHeader(pair[0])
+    if (existing === undefined) response.setHeader(pair[0], String(pair[1]))
+    else if (Array.isArray(existing)) response.setHeader(pair[0], existing.concat([String(pair[1])]))
+    else response.setHeader(pair[0], [String(existing), String(pair[1])])
+  }
+}
+
+/**
+ * Start the server: open the handle, then listen.
+ *
+ * @param {object} options `configDir`, `port` (default 8090), `host`
+ *   (default 127.0.0.1), `engine`, `onError`
+ * @returns {Promise<{server: object, port: number, origin: string, mounts: object[], close: Function}>}
+ */
+export async function listen (options = {}) {
+  const http = await import('node:http')
+  const dav = await openWebdav(options)
+  const onError = typeof options.onError === 'function'
+    ? options.onError
+    : (error) => { console.error(`webdav-serve: ${error.message}`) }
+  const server = http.createServer(async (request, response) => {
+    let answer
+    try {
+      const body = await readBody(request)
+      answer = await dav.step({ method: request.method, target: request.url, headers: headerPairs(request.rawHeaders), body })
+    } catch (error) {
+      onError(error)
+      response.writeHead(500, { 'content-type': 'text/plain' })
+      response.end(`webdav-serve: ${error.message}\n`)
+      return
+    }
+    writeHeaders(response, answer.headers)
+    response.statusCode = answer.status
+    response.end(answer.body)
+  })
+  const port = typeof options.port === 'number' ? options.port : 8090
+  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(port, host, resolve)
+  })
+  const bound = server.address()
+  const origin = `http://${host.includes(':') ? `[${host}]` : host}:${bound.port}`
+  return {
+    server,
+    port: bound.port,
+    origin,
+    mounts: dav.mounts,
+    close () {
+      return new Promise((resolve) => {
+        server.close(() => { dav.close(); resolve() })
+        if (typeof server.closeAllConnections === 'function') server.closeAllConnections()
+      })
+    }
+  }
+}