@factoidal/core 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## Unreleased
 
+## 0.19.0 (2026-10-27)
+
+- Notice (owner decision, 2026-10-27): "EXPERIMENTAL UNREVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW." It is at the top of both READMEs and the hub, in the package description, in every `factoidal` help text, and on standard error when `serve`, `lws-serve`, `solid-serve`, `solid-client`, `lws-client`, `authz-serve`, `authz-keys`, `xmpp-serve` or `webdav-serve` starts.
+- Authorization server (https://github.com/danbri/factoidal-core/pull/150): SAML 2.0 subject tokens (lws10-authn-saml, token type `urn:ietf:params:oauth:token-type:saml2`) from the identity providers the configuration trusts: `authz-serve --saml-idp FILE` (repeatable; also `lws-serve --authz`), config member `samlIdps` (`[{ entityId, jwk }]`, an RSA public JWK of 2048 bits or more). The assertion needs one enveloped XML Signature in the SAML Core §5 profile (Exclusive XML Canonicalization 1.0, rsa-sha256, SHA-256 digest, the reference `#` + the assertion's `ID`), verified under the configured key, never a key from `ds:KeyInfo`; a document type declaration, comments, processing instructions, a second signature or a wrapped assertion are refused. `saml:NameID` is the subject, the bearer `Recipient` the client; `Conditions` times and every `AudienceRestriction` must name this server. Encrypted assertions are refused (https://github.com/danbri/factoidal/issues/1073). The token type is advertised only when a provider is configured (https://github.com/danbri/factoidal/issues/926). Lean: `XML/ExcC14n.lean`, `XML/DSig.lean`, `SAML/Assertion.lean`; record `docs/designissues/2026-10-27-saml-xml-signature.md`.
+
+Fixes for defects found by the echo test ports (https://github.com/danbri/echochamber: Jena-, RDFLib-, N3.js- and RDF4J-style test suites run against this package).
+
+- SPARQL (https://github.com/danbri/factoidal-core/pull/146): blank nodes written by SPARQL Update get valid N-Triples labels, so CONSTRUCT, DESCRIBE and `shaclValidate` on that Dataset no longer fail (https://github.com/danbri/factoidal/issues/1074); IN and NOT IN raise an error when a comparison errs and no other element decides, so `2 IN (3, 1/0)` is an error, not false (§17.4.1.9, https://github.com/danbri/factoidal/issues/1049); ORDER BY an aggregate (`ORDER BY DESC(COUNT(?s))`) orders the groups of a grouped query (https://github.com/danbri/factoidal/issues/1050); SUBSTR takes start and length of types derived from xsd:integer, such as xsd:int (https://github.com/danbri/factoidal/issues/1060); no XSD constructor function casts a language-tagged literal: `xsd:string("foo"@en)` and `xsd:byte("1"@en)` are errors, use `STR` (§17.5, https://github.com/danbri/factoidal/issues/1062); `true.` and `false.` read as the keyword and the triple terminator (https://github.com/danbri/factoidal/issues/1075); a variable used only inside MINUS is not in scope, so `(1 AS ?z)` is allowed (§18.2.1, https://github.com/danbri/factoidal/issues/1069).
+- Readers and writers (https://github.com/danbri/factoidal-core/pull/147): N-Triples 1.2 and N-Quads 1.2 read the VERSION directive (https://github.com/danbri/factoidal/issues/1055); TriG refuses a top-level triple with no final '.' (https://github.com/danbri/factoidal/issues/1056); Turtle and TriG read white space or a comment after `^^`, and a prefix named `true` or `false` (https://github.com/danbri/factoidal/issues/1063); one RFC 3987 IRI check: the readers, `fromQuads`/`Dataset.add`, the SPARQL parser and the writers refuse a string that is not an IRI, such as `<a_b:c>`, `<http://www:example.org/>` or `<http://a/%zz>`, with `term.invalid-iri`, so no writer writes text that no reader reads (https://github.com/danbri/factoidal/issues/1057); RDF/XML writer: CR in a literal is written `&#xD;` (https://github.com/danbri/factoidal/issues/1047), a predicate such as `urn:example:p` is written with namespace `urn:example:` (https://github.com/danbri/factoidal/issues/1048); RDF/JS: `dataFactory.literal` gives the language tag in lowercase, and the `Literal` type has `direction` (https://github.com/danbri/factoidal/issues/1054); JSON-LD: a `"@foo"` key in a value object is ignored with or without a base (https://github.com/danbri/factoidal/issues/1064); `parse()` with no format: JSON-LD only for JSON text, N-Quads when a statement names a graph; the rules are in API.md (https://github.com/danbri/factoidal/issues/1058).
+- Cost: the IRI check makes parsing slower: 100,000 triples, median of 3, 0.18 → 0.19: N-Triples 581 → 646 ms (+11%), Turtle 606 → 718 ms (+19%), N-Quads 1.2 616 → 681 ms (+10%). Work to recover it is in progress.
+
+## 0.18.0 (2026-10-27)
+
+- XSD constructor functions for datatypes outside the SPARQL 1.1 §17.5 table (`xsd:byte`, `xsd:int`, `xsd:unsignedInt`, `xsd:date`, `xsd:time`, `xsd:gYear` and the other `xsd:g*` types, the duration types, `xsd:token`, …) now cast as XPath F&O 3.1 §19 says. Before, they changed only the datatype and gave ill-typed literals such as `"HaHa"^^xsd:byte`. An invalid value or a cast that F&O does not allow is now an error (the variable is unbound) (https://github.com/danbri/factoidal/issues/1041, https://github.com/danbri/factoidal-core/pull/142).
+- SPARQL: STRSTARTS, STRENDS, CONTAINS, STRBEFORE and STRAFTER compare the base direction of `rdf:dirLangString` arguments (SPARQL 1.2 §17.4.3: same language tag and same base direction). `CONTAINS("abc"@en--ltr, "a"@en)` is now an error. STRBEFORE and STRAFTER keep the base direction of the first argument: `STRBEFORE("abc"@en--ltr, "b")` is `"a"@en--ltr` (https://github.com/danbri/factoidal/issues/1042, https://github.com/danbri/factoidal-core/pull/136).
+- Store open sends the manifest to the engine as bytes, not as hexadecimal inside the JSON arguments, and decodes it once for the plan and the open (new ops `storeManifestInspectBytes`, `storeQueryPlanBytes`, `storeOpenBytes`; the hexadecimal ops stay). On the londat store (1,046 blocks, 753 kB manifest) a scoped `openStoreHandle` takes 198 ms, not 305 ms with 0.17.0 (median of 9) (https://github.com/danbri/factoidal/issues/1039, https://github.com/danbri/factoidal-core/pull/141).
+- Tests: the W3C manifest runner `l4w3c` reads `.n3` expected results when they are Turtle-compatible (else the test is unsupported, with the reason) and runs Jena's `mfx:TestQuery` as a query evaluation test; Jena ARQ manifests: 31 pass (was 13) of 308 (https://github.com/danbri/factoidal-core/pull/138). The Jena ARQ expression suite drops the 62 expected failures these fixes remove. `tools/split-read-differential.sh` runs on macOS and fails when it checks no file (https://github.com/danbri/factoidal-core/pull/133).
+- LWS client (https://github.com/danbri/factoidal/issues/1065): `read` takes `rangeStart`, `rangeEnd`, `ifNoneMatch` and `prefer` and reports `notModified` (304) and `contentRange`; `verifyNotification` takes `trustedStorages` and never asks an untrusted storage for its description (theorem `step_start_verify_trusted`); `search` and `typeIndex` take `onePage` (one page with its `next`, theorem `onPage_onePage_no_fetch`) and `endpoint` (the service endpoint, no discovery); `describe`, `readPage`, `findLinkset`, `putLinkset`, `getSubscription` and `queryFormats` (OPTIONS, `Accept-Query`) are new kinds; `subscribe` takes `expires`; `updateLinkset` takes `linksetUrl`; a session key may be Ed25519 (EdDSA) as well as P-256; the session takes `bearer` (`{token, realm?}`, a token with no realm goes to every request) and `idToken`. New wasm op `lwsClientNewKey` and `createDidKey({ algorithm })` make a P-256 or Ed25519 `did:key` agent from host random bytes (theorems `multikeyJwk?_p256`, `multikeyJwk?_ed25519`). Each `done` document has a `report` (Metadata, Item, Page, Storage, Subscription shapes read in Lean, `Client/Report.lean`) and each `fail` document a `report` with the driver error kind (`LwsClientError.report`). The lws-driver/1 adapter `deploy/lws-client-adapter/adapter.mjs` only translates JSON now; checker result in its README. Needs a wasm with the op `lwsClientNewKey`.
+- WebDAV: `factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]` serves LWS storages to file browsers (macOS Finder, Windows Explorer, GNOME Files, KDE Dolphin) over WebDAV, RFC 4918 classes 1 and 2 (https://github.com/danbri/factoidal/issues/1066). The root collection holds one folder per mount; a mount is one Markdown file `CONFIGDIR/NAME.md` (`- kind: local` with `- path:` an `lws-serve` storage directory, or `- kind: lws` with `- url:` a remote storage and `- auth: none | did-key | bearer`). A local mount is opened by the ops `lws-serve` uses, as the storage's owner; a remote mount is reached through the LWS client, with a self-issued `did:key` credential from a P-256 key file (made when absent). Every decision is in Lean (`L4Factoidal/WebDAV/`); the host `webdav/server.mjs` carries sockets, files and fetches. New wasm ops `webdavOpen`, `webdavLoad`, `webdavStep`, `webdavResume`, `webdavClose`. JS: `listen({ configDir })` and `openWebdav({ configDir })` from `@factoidal/core/webdav`. litmus 0.13: 208 pass, 0 fail (out of 208: basic, copymove, props, locks, http on a local and a remote mount). Not yet: dead properties and locks kept across a restart (https://github.com/danbri/factoidal/issues/1078); checks with the real file browsers (https://github.com/danbri/factoidal/issues/1079). Design record: `docs/designissues/2026-10-27-webdav.md`.
+- JSON-LD-star (RDF 1.2 triple terms, reifiers, annotations; JSON-LD-star draft, json-ld/json-ld-star `1.2-tests`): option `rdfstar` on `jsonldToRdf`, `jsonldFromRdf`, `parse` and `serialize` with `format: 'jsonld'` reads and writes `@triple`, `@reifies` and `@annotation`; without it a triple term is refused when writing JSON-LD. 170 of 171 json-ld-star tests pass (the one fail is a defective fixture, fromRdf tst07); W3C json-ld-api unchanged (791 pass, 2 local-override, of 793) (https://github.com/danbri/factoidal-core/pull/134, https://github.com/danbri/factoidal-core/pull/140).
+
 ## 0.17.0 (2026-10-27)
 
 - **Breaking:** `canonicalHash(graph)` now returns the SHA-256 (64 lowercase hex digits) of the RDFC-1.0 canonical N-Quads, as the RDF Dataset Canonicalization specification uses it. Before, it returned the canonical text. Use `canonicalize()` for the text. The engine computes the digest in Lean (new op `datasetCanonicalHash`) (https://github.com/danbri/factoidal/issues/1040, https://github.com/danbri/factoidal-core/pull/127).

package/README.md

@@ -1,5 +1,13 @@
 # @factoidal/core
 
+> ⚠️ **EXPERIMENTAL UNREVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.**
+>
+> This covers the whole core library and every command line tool, and in
+> particular all protocol, authentication and security code (the LWS, Solid,
+> SPARQL Protocol, WebDAV and XMPP servers and clients, the authorization
+> server, JOSE, XML Signature and SAML, the crypto bindings). Owner decision,
+> 2026-10-27.
+
 RDF, SPARQL, reasoning, validation and Linked Data servers in one package.
 Runs in Node 22.12+, Deno 2 and browsers. No dependencies.
 
@@ -43,7 +51,13 @@ RDF 1.2 input uses `turtle12`, `ntriples12`, `nquads12` or `trig12`.
 - Canonicalization: RDFC-1.0; Verifiable Credentials Data Integrity (eddsa-rdfc-2022), did:key
 - XML: XML 1.0, XPath 1.0, XSLT 1.0, XForms
 - Servers: SPARQL 1.1 Protocol and Graph Store (Fuseki-compatible paths,
-  Jena TDB2 read only), Linked Web Storage 1.0, Solid
+  Jena TDB2 read only), Linked Web Storage 1.0, Solid, an OAuth 2.0
+  authorization server (token exchange for OpenID Connect ID tokens,
+  self-issued CID credentials and SAML 2.0 assertions)
+- Security: JWS/JWT (ES256, RS256, EdDSA), XML Signature verification in the
+  SAML Core profile (Exclusive XML Canonicalization 1.0, rsa-sha256), with
+  HACL\* primitives. XML Encryption and JWE are not implemented yet:
+  https://github.com/danbri/factoidal/issues/1081
 - A persisted store with a delta log for updates (early stage)
 - Terms: a JavaScript extension function can answer with an exact term
   (`{value: "007", datatype: XSD + "integer"}`, an RDF/JS term, a triple
@@ -189,6 +203,7 @@ $ npx factoidal query store 'SELECT * WHERE { ?s ?p ?o } LIMIT 5'
 $ npx factoidal query "$(npx factoidal sample-store)" 'SELECT (COUNT(*) AS ?n) WHERE { ?s ?p ?o }'
 $ npx factoidal lws-serve DIR --issuer IRI         # Linked Web Storage
 $ npx factoidal solid-serve DIR                    # Solid Protocol
+$ npx factoidal authz-serve DIR --resource IRI --saml-idp idp.json   # OAuth 2.0 authorization server
 ```
 
 `npx factoidal --help` lists every command. Replacing Apache Jena Fuseki:

package/authz/server.mjs

@@ -169,6 +169,8 @@ async function fetchFrom (url, accept, address) {
  * @param {string|null} [options.storageKey] the key text; default FACTOIDAL_LWS_KEY; null reads none
  * @param {boolean|string[]} [options.cors] false for no CORS fields, or the origins to answer;
  *   default: echo any valid request Origin (issue 923)
+ * @param {{entityId: string, jwk: object}[]} [options.samlIdps] the SAML 2.0 identity providers
+ *   whose signed assertions are accepted, each with its RSA public JWK (issue 926)
  * @param {object} [options.engine] an engine to reuse
  */
 export async function openAuthorizationServer (options = {}) {
@@ -192,6 +194,9 @@ export async function openAuthorizationServer (options = {}) {
   // CORS (issue 923): false or a list of origins, passed unread; absent, the
   // engine echoes the request Origin (L4Factoidal/Authz/Server.lean stepCors).
   if (options.cors !== undefined) config.cors = options.cors
+  // SAML 2.0 identity providers (issue 926): [{ entityId, jwk }], passed
+  // unread; the engine checks each (Wasm/Ops/Authz.lean samlIdpsOf?).
+  if (options.samlIdps !== undefined) config.samlIdps = options.samlIdps
   const key = storageKeyText(options.storageKey)
   if (key !== undefined) config.storageKey = key
   if (dir !== null) {

package/bin/factoidal.mjs

@@ -90,6 +90,15 @@ function err (line) { console.error(line) }
 
 // ---------------------------------------------------------------- usage
 
+// Owner, 2026-10-27: every protocol, authentication and security component,
+// the CLIs and the core library carry this notice. It is printed with every
+// help text and on standard error when a server, client or key command starts.
+const REVIEW_WARNING = 'EXPERIMENTAL UNREVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.'
+
+/** The commands that serve, speak a protocol, or handle keys and tokens. */
+const WARNED_COMMANDS = new Set(['serve', 'lws-serve', 'solid-serve', 'solid-client', 'lws-client',
+  'authz-serve', 'authz-keys', 'xmpp-serve', 'webdav-serve'])
+
 const USAGE = `factoidal - the Factoidal persisted store, from Node or Deno
 
 usage: factoidal <command> [options]
@@ -113,6 +122,8 @@ commands:
                               (RFC 8414 metadata, JWK Set, RFC 8693 token exchange)
   authz-keys DIR              print the public JWK Set of an authorization server
   xmpp-serve DIR              serve XMPP (RFC 6120/6121) over TCP or direct TLS
+  webdav-serve CONFIGDIR      serve local and remote LWS storages to file
+                              browsers over WebDAV (RFC 4918)
 
 global options:
   -h, --help                  print this text, or a command's own help
@@ -353,6 +364,7 @@ usage: factoidal authz-serve DIR --resource IRI[,IRI...] [--issuer IRI]
                            [--token-lifetime SECONDS] [--rotate-after SECONDS]
                            [--allow-http] [--allow-private-fetch]
                            [--cors-origin ORIGIN]... [--no-cors]
+                           [--saml-idp FILE]...
 
 An authorization server as a component (https://github.com/danbri/factoidal/issues/916),
 for lws-serve and any resource server that reads RFC 8414 metadata:
@@ -361,8 +373,17 @@ for lws-serve and any resource server that reads RFC 8414 metadata:
   POST /token                         RFC 8693 token exchange for an RFC 9068
                                       access token whose aud is the resource
 Subject tokens: OpenID Connect ID tokens (lws10-authn-openid) and
-self-issued JWTs for https and did:key subjects (lws10-authn-ssi-cid). SAML
-2.0 is not accepted (https://github.com/danbri/factoidal/issues/926).
+self-issued JWTs for https and did:key subjects (lws10-authn-ssi-cid), and
+SAML 2.0 assertions (lws10-authn-saml) from the identity providers --saml-idp
+names (https://github.com/danbri/factoidal/issues/926).
+
+--saml-idp FILE (repeatable) trusts one SAML 2.0 identity provider. FILE is
+JSON: {"entityId": "<the saml:Issuer value>", "jwk": <its RSA public JWK>}.
+An assertion must carry one enveloped XML Signature (exclusive
+canonicalization, rsa-sha256) that verifies under that key, an audience that
+names the issuer of this server, and bearer subject confirmation; its NameID
+is the subject and its Recipient the client. Encrypted assertions are
+refused. Without --saml-idp the token type is refused and not advertised.
 
 --resource names the resource IRIs (for lws-serve: BASE.well-known/lws-storage)
 tokens may be issued for; any other is refused with invalid_target.
@@ -518,7 +539,8 @@ is required):
                         BASE.well-known/lws-token, the JWK Set at
                         BASE.well-known/lws-jwks, signing keys in DIR (as
                         authz-serve; --alg, --token-lifetime, --rotate-after,
-                        --allow-http and --allow-private-fetch as there). The
+                        --allow-http, --allow-private-fetch and --saml-idp as
+                        there). The
                         storage trusts it, and any --issuer too. Each request
                         is the authorization server's when the engine says so
                         (L4Factoidal/Authz/Mount.lean); every other is the
@@ -644,6 +666,47 @@ MUC/MIX/GC3 rooms.
 Specifications: https://www.rfc-editor.org/rfc/rfc6120 and
 https://www.rfc-editor.org/rfc/rfc6121`,
 
+  'webdav-serve': `factoidal webdav-serve - serve LWS storages to file browsers over WebDAV
+
+usage: factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]
+
+Starts a WebDAV server (RFC 4918, classes 1 and 2) that macOS Finder,
+Windows Explorer, GNOME Files and KDE Dolphin can connect to. Its root
+collection holds one folder per mount; a mount is one Markdown file
+CONFIGDIR/NAME.md (README.md is not a mount):
+
+    # Display name
+    - kind: local | lws
+    - path: ./alice-storage        (local: an lws-serve storage directory)
+    - url: https://storage.example/alice/   (lws: the storage root)
+    - auth: none | did-key | bearer
+    - key-file: ./alice.jwk        (did-key: a P-256 private JWK; made when absent)
+    - token-file: ./alice.token    (bearer: an access token)
+    - writable: true | false       (default true for local, false for lws)
+    - storage: snapshot | files    (local: default what the directory holds)
+    - base: IRI                    (local: the storage root's IRI, default http://localhost/)
+
+Only the first "# " heading and the first "- key: value" list are read; the
+words in brackets above are notes, not part of a value. A malformed file
+stops the start with its name and line number.
+
+A local mount opens the directory with the operations lws-serve uses, as
+the storage's owner (do not serve the same directory with lws-serve at the
+same time). An lws mount reaches the storage through the LWS client.
+
+  --port N         the port to bind (default 8090; 0 takes an ephemeral one)
+  --host ADDRESS   the address to bind (default 127.0.0.1)
+
+Connect: macOS Finder, Go > Connect to Server, http://127.0.0.1:8090/ ;
+Windows, Map network drive, http://127.0.0.1:8090/ ; GNOME Files,
+dav://127.0.0.1:8090/ .
+
+The server makes no protocol decision: every method, status, property, lock
+and mapping is decided by formal/lean4/L4Factoidal/WebDAV/. A WebAssembly
+module built before the WebDAV operations landed makes this command exit 3
+and say so. Design: docs/designissues/2026-10-27-webdav.md
+(https://github.com/danbri/factoidal/issues/1066).`,
+
   'solid-client': `factoidal solid-client - run one Solid client operation
 
 usage: factoidal solid-client <get|put|post|delete|discover> URL [options]
@@ -764,7 +827,7 @@ function parseArguments (args, valueOptions) {
 class UsageError extends Error {}
 
 /** Options that may be given more than once; their value is the list. */
-const REPEATABLE_OPTIONS = new Set(['cors-origin'])
+const REPEATABLE_OPTIONS = new Set(['cors-origin', 'saml-idp'])
 
 const VALUE_OPTIONS = {
   version: new Set([]),
@@ -778,7 +841,8 @@ const VALUE_OPTIONS = {
   serve: new Set(['port', 'host', 'query-path', 'gsp-path', 'file', 'layout', 'tdb2']),
   'lws-serve': new Set(['port', 'host', 'base', 'issuer', 'auth-config', 'owner', 'root-acl',
     'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window',
-    'redirects-max', 'storage', 'cors-origin', 'authz', 'alg', 'token-lifetime', 'rotate-after']),
+    'redirects-max', 'storage', 'cors-origin', 'authz', 'alg', 'token-lifetime', 'rotate-after',
+    'saml-idp']),
   'solid-serve': new Set(['port', 'host', 'base', 'owner', 'issuer', 'auth-config']),
   'solid-client': new Set(['body', 'file', 'content-type', 'interpret']),
   'lws-client': new Set(['body', 'file', 'content-type', 'slug', 'type', 'link', 'if-match',
@@ -786,9 +850,10 @@ const VALUE_OPTIONS = {
     'target', 'subject-token-file', 'subject-token-type', 'access-token', 'storage', 'root',
     'inbox']),
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
-    'cors-origin']),
+    'cors-origin', 'saml-idp']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key'])
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key']),
+  'webdav-serve': new Set(['port', 'host'])
 }
 
 // ------------------------------------------------------------- commands
@@ -1700,6 +1765,16 @@ function corsConfig (options) {
   return {}
 }
 
+// --saml-idp FILE (repeatable): a SAML 2.0 identity provider whose signed
+// assertions the authorization server accepts, as the config member
+// `samlIdps`. FILE is JSON {"entityId": ID, "jwk": RSA public JWK}; passed
+// unread, the engine checks it (Wasm/Ops/Authz.lean, issue 926).
+function samlConfig (options) {
+  const files = options['saml-idp']
+  if (!Array.isArray(files)) return {}
+  return { samlIdps: files.map((f) => readJsonFile(f)) }
+}
+
 function serveHost (options) {
   if (options.host === undefined) return '127.0.0.1'
   if (typeof options.host !== 'string' || options.host.length === 0) {
@@ -1833,7 +1908,8 @@ async function commandLwsServe (positional, options) {
     ...(options['rotate-after'] !== undefined ? { rotateAfter: natOption('rotate-after', options['rotate-after']) } : {}),
     ...(options['allow-http'] === true ? { allowHttp: true } : {}),
     ...(options['allow-private-fetch'] === true ? { allowPrivateFetch: true } : {}),
-    ...corsConfig(options)
+    ...corsConfig(options),
+    ...samlConfig(options)
   }
   let auth
   if (authFile !== null) {
@@ -1920,7 +1996,8 @@ async function commandAuthzServe (positional, options) {
       ...(options['rotate-after'] !== undefined ? { rotateAfter: natOption('rotate-after', options['rotate-after']) } : {}),
       ...(options['allow-http'] === true ? { allowHttp: true } : {}),
       ...(options['allow-private-fetch'] === true ? { allowPrivateFetch: true } : {}),
-      ...corsConfig(options)
+      ...corsConfig(options),
+      ...samlConfig(options)
     })
   } catch (error) {
     if (error !== null && typeof error === 'object' && error.envelope !== undefined) {
@@ -2027,6 +2104,34 @@ async function commandSolidServe (positional, options) {
   return untilInterrupted(running, quiet)
 }
 
+// webdav-serve CONFIGDIR (https://github.com/danbri/factoidal/issues/1066):
+// the host carries sockets, files and fetches; the engine reads the mount
+// files and decides every answer (L4Factoidal/WebDAV/).
+async function commandWebdavServe (positional, options) {
+  if (positional.length !== 1) throw new UsageError('webdav-serve needs one CONFIGDIR')
+  const quiet = options.quiet === true
+  const { listen, WebdavHostError } = await import('../webdav/server.mjs')
+  let running
+  try {
+    running = await listen({ configDir: positional[0], port: servePort(options, 8090), host: serveHost(options) })
+  } catch (error) {
+    if (error instanceof WebdavHostError && error.unknownOp) return notWired('webdav-serve', error.message)
+    if (error instanceof WebdavHostError || (error !== null && typeof error === 'object' && error.code === 'ENOENT')) {
+      err(`factoidal webdav-serve: ${error.message}`)
+      return EXIT_FAILURE
+    }
+    throw error
+  }
+  if (!quiet) {
+    err(`webdav-serve: listening on ${running.origin} for ${positional[0]}`)
+    for (const m of running.mounts) {
+      err(`webdav-serve: ${running.origin}/${encodeURIComponent(m.name)}/ - ${m.title} (${m.kind}${m.writable ? '' : ', read-only'}${m.agent ? ', as ' + m.agent : ''})`)
+    }
+  }
+  out(running.origin)
+  return untilInterrupted(running, quiet)
+}
+
 async function commandXmppServe (positional, options) {
   if (positional.length !== 1) throw new UsageError('xmpp-serve needs one DIR')
   const quiet = options.quiet === true
@@ -2207,19 +2312,22 @@ const COMMANDS = {
   'lws-client': commandLwsClient,
   'authz-serve': commandAuthzServe,
   'authz-keys': commandAuthzKeys,
-  'xmpp-serve': commandXmppServe
+  'xmpp-serve': commandXmppServe,
+  'webdav-serve': commandWebdavServe
 }
 
 // ----------------------------------------------------------------- main
 
 async function main () {
   if (argv.length === 0) {
+    out(REVIEW_WARNING + '\n')
     out(USAGE)
     return EXIT_USAGE
   }
   const command = argv[0]
   if (command === '--help' || command === '-h' || command === 'help') {
     const topic = argv[1]
+    out(REVIEW_WARNING + '\n')
     if (typeof topic === 'string' && Object.prototype.hasOwnProperty.call(COMMAND_USAGE, topic)) {
       out(COMMAND_USAGE[topic])
     } else {
@@ -2244,9 +2352,13 @@ async function main () {
     throw error
   }
   if (parsed.options.help) {
+    out(REVIEW_WARNING + '\n')
     out(COMMAND_USAGE[command])
     return EXIT_OK
   }
+  if (WARNED_COMMANDS.has(command)) {
+    err(`factoidal ${command}: WARNING: ${REVIEW_WARNING}`)
+  }
   try {
     return await COMMANDS[command](parsed.positional, parsed.options)
   } catch (error) {

package/bin/store.mjs

@@ -123,7 +123,7 @@ export const STACK_REMEDY = {
 export function openStore (root, generationName = null) {
   if (typeof generationName !== 'string') {
     const opened = openCollection(root)
-    return { ...opened, manifestHex: hexOfBytes(opened.manifest), activated: true }
+    return withManifestHex({ ...opened, activated: true })
   }
   const generationDir = joinPath(root, generationName)
   for (const manifestName of MANIFEST_NAMES) {
@@ -133,23 +133,67 @@ export function openStore (root, generationName = null) {
     } catch (_error) {
       continue
     }
-    return {
+    return withManifestHex({
       root,
       generation: generationName,
       generationDir,
       manifestName,
       manifest,
-      manifestHex: hexOfBytes(manifest),
       activated: false
-    }
+    })
   }
   throw new StoreOperationError(
     `${generationDir} has none of ${MANIFEST_NAMES.join(', ')}`)
 }
 
+/**
+ * `store.manifestHex`, the hexadecimal the older manifest ops take, computed
+ * on first read. The byte ops (`hasManifestBytesOps`) do not read it, so a
+ * store opened for them never builds the 1.5 million digits of a large
+ * manifest (https://github.com/danbri/factoidal/issues/1039).
+ */
+function withManifestHex (store) {
+  let hex = null
+  return Object.defineProperty(store, 'manifestHex', {
+    enumerable: true,
+    get () {
+      if (hex === null) hex = hexOfBytes(store.manifest)
+      return hex
+    }
+  })
+}
+
+/** The byte forms of the manifest ops (formal/lean4/Wasm/Ops/StoreHandles.lean). */
+const MANIFEST_BYTES_OPS = ['storeManifestInspectBytes', 'storeQueryPlanBytes', 'storeOpenBytes']
+const manifestBytesSupport = new WeakMap()
+
+/**
+ * Whether the engine serves the byte forms of the manifest ops. They take
+ * the manifest as the byte region, not as hexadecimal inside the JSON
+ * arguments, and the engine decodes it once for a plan and the open that
+ * follows. An engine built before them has only the hexadecimal ops, and
+ * this host then uses those, as before.
+ */
+function hasManifestBytesOps (engine) {
+  let known = manifestBytesSupport.get(engine)
+  if (known === undefined) {
+    known = false
+    if (typeof engine.callBlobIO === 'function') {
+      const reflection = engine.call('ops', [])
+      const blobIoOps = Array.isArray(reflection && reflection.blobIoOps) ? reflection.blobIoOps : []
+      known = MANIFEST_BYTES_OPS.every((op) => blobIoOps.includes(op))
+    }
+    manifestBytesSupport.set(engine, known)
+  }
+  return known
+}
+
 /** `storeManifestInspect` — decode one manifest. */
 export function inspectManifest (engine, store) {
   try {
+    if (hasManifestBytesOps(engine)) {
+      return engine.callBlobIO('storeManifestInspectBytes', [], store.manifest).envelope
+    }
     return engine.call('storeManifestInspect', [store.manifestHex])
   } catch (error) {
     throw asStoreError(error)
@@ -159,6 +203,9 @@ export function inspectManifest (engine, store) {
 /** `storeQueryPlan` — the artifact keys this query needs, and the mode. */
 export function planQuery (engine, store, sparql) {
   try {
+    if (hasManifestBytesOps(engine)) {
+      return engine.callBlobIO('storeQueryPlanBytes', [sparql], store.manifest).envelope
+    }
     return engine.call('storeQueryPlan', [store.manifestHex, sparql])
   } catch (error) {
     throw asStoreError(error)
@@ -194,16 +241,20 @@ function capDecision (engine, store, sparql) {
   }
 }
 
-/** Read the named artifacts and concatenate them into one region. */
-function regionOf (store, keys) {
+/** Read the named artifacts and concatenate them into one region. With a
+ *  `prefix` (the manifest, for `storeOpenBytes`) the region starts with it,
+ *  and the windows still count from the first artifact byte. */
+function regionOf (store, keys, prefix = null) {
   const chunks = keys.map((key) => readWhole(joinPath(store.generationDir, key)))
+  const start = prefix ? prefix.length : 0
   let total = 0
   for (const chunk of chunks) total += chunk.length
-  const blob = new Uint8Array(total)
+  const blob = new Uint8Array(start + total)
+  if (prefix) blob.set(prefix, 0)
   const artifacts = []
   let offset = 0
   for (let index = 0; index < chunks.length; index += 1) {
-    blob.set(chunks[index], offset)
+    blob.set(chunks[index], start + offset)
     artifacts.push({ key: keys[index], offset, len: chunks[index].length })
     offset += chunks[index].length
   }
@@ -374,11 +425,16 @@ export function openStoreHandle (engine, store, options = {}) {
   } else {
     keys = manifestKeys(engine, store)
   }
-  const { blob, artifacts } = regionOf(store, keys)
+  const bytesOps = hasManifestBytesOps(engine)
+  // The byte op takes the manifest as the first bytes of the region.
+  const { blob, artifacts } = regionOf(store, keys, bytesOps ? store.manifest : null)
   let envelope
   try {
-    envelope = engine.callBlobIO('storeOpen',
-      [store.manifestHex, JSON.stringify(artifacts)], blob).envelope
+    envelope = bytesOps
+      ? engine.callBlobIO('storeOpenBytes',
+        [String(store.manifest.length), JSON.stringify(artifacts)], blob).envelope
+      : engine.callBlobIO('storeOpen',
+        [store.manifestHex, JSON.stringify(artifacts)], blob).envelope
   } catch (error) {
     throw asStoreError(error)
   }

package/index.d.ts

@@ -27,8 +27,11 @@ export interface BlankNode {
 export interface Literal {
   termType: 'Literal';
   value: string;
-  /** Language tag ('' when none). */
+  /** Language tag, lowercase ('' when none). */
   language: string;
+  /** Base direction of a directional language-tagged string (RDF 1.2):
+   *  'ltr' or 'rtl'; '' when none. RDF/JS Data Model, Literal.direction. */
+  direction: '' | 'ltr' | 'rtl';
   /** Datatype IRI term (xsd:string for plain literals). */
   datatype: NamedNode;
   equals(other: Term | null | undefined): boolean;
@@ -212,6 +215,9 @@ export interface WriteOptions {
   useRdfType?: boolean;
   /** 'jsonld' only. */
   rdfDirection?: string;
+  /** 'jsonld' only: write RDF 1.2 triple terms as JSON-LD-star (`@triple`,
+   *  `@reifies`, `@annotation`). Without it a triple term is refused. */
+  rdfstar?: boolean;
 }
 
 export type WriteFormat =
@@ -1011,6 +1017,9 @@ export interface JsonLdOptions {
   rdfDirection?: string;
   expandContext?: string;
   processingMode?: string;
+  /** JSON-LD-star: read `@triple`, `@reifies`, `@annotation` as RDF 1.2
+   *  triple terms and reifiers. */
+  rdfstar?: boolean;
 }
 
 /**
@@ -1027,6 +1036,9 @@ export function jsonldToRdf(
 export interface JsonLdFromRdfOptions {
   useNativeTypes?: boolean;
   useRdfType?: boolean;
+  /** JSON-LD-star: write RDF 1.2 triple terms (`@triple`, `@reifies`,
+   *  `@annotation`). Without it a triple term is refused. */
+  rdfstar?: boolean;
   format?: DataFormat;
 }
 

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "ebac38a482d0";
+const WASM_VERSION = "6dbf38660cb9";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-fa72ba5bc828-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40439252690",
-  "gitSha": "fa72ba5bc828c1eb75572c3436e9d739f76fdd57",
-  "builtAt": "2026-10-27T03:13:16Z",
+  "release": "danbri/factoidal-builds build-b8c6b64b8dc1-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40525043015",
+  "gitSha": "b8c6b64b8dc18a6daa2151a61e28dbb9a4707ade",
+  "builtAt": "2026-10-27T15:28:08Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "ebac38a482d03d4a6ce1cf4a59164288628fed6957483dd55180743e7a3daf40",
-  "wasmBytes": 17071472,
+  "wasmSha256": "6dbf38660cb9966ae7c65ecdb68a38e83d09c1283415c1486b618f203f3f2f39",
+  "wasmBytes": 17694204,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -182,11 +182,10 @@ function utf16Diagnostics(text, diagnostics) {
 // is never one of a partial generation.
 // ---------------------------------------------------------------------
 class Store {
-  constructor(e, env, gen, manifestHex, fromNQuads, withExtensionRounds) {
+  constructor(e, env, gen, fromNQuads, withExtensionRounds) {
     this._e = e;
     this._env = env;
     this._gen = gen;
-    this._manifestHex = manifestHex;
     this._closed = false;
     this._fromNQuads = fromNQuads;
     this._withExtensionRounds = withExtensionRounds;
@@ -236,7 +235,9 @@ class Store {
 
   /** The manifest, decoded by the engine (op storeManifestInspect). */
   async inspect() {
-    const r = entryResult(this._e.storeManifestInspect(this._manifestHex), 'Store.inspect');
+    const r = entryResult(typeof this._e.storeManifestInspectBytes === 'function'
+      ? this._e.storeManifestInspectBytes(this._gen.manifest)
+      : this._e.storeManifestInspect(hexOfBytes(this._gen.manifest)), 'Store.inspect');
     const { ok: _ok, ...rest } = r;
     return rest;
   }
@@ -841,7 +842,7 @@ function buildApi(driver) {
    * @param {Dataset|string|Array} data
    * @param {{format?: string, version?: '1.1'|'1.2', prefixes?: object,
    *   literalShorthand?: boolean, useNativeTypes?: boolean,
-   *   useRdfType?: boolean, rdfDirection?: string,
+   *   useRdfType?: boolean, rdfDirection?: string, rdfstar?: boolean,
    *   inputFormat?: string, baseIRI?: string}} [options]
    *   format: nquads (default), ntriples, turtle, trig, rdfxml, jsonld,
    *   rdfc. inputFormat and baseIRI read text `data`.
@@ -1210,7 +1211,9 @@ function buildApi(driver) {
    * A remote `@context` is not fetched.
    * @param {string} jsonldText
    * @param {{base?: string, rdfDirection?: string, expandContext?: string,
-   *   processingMode?: string}} [options]
+   *   processingMode?: string, rdfstar?: boolean}} [options]
+   *   rdfstar: JSON-LD-star (`@triple`, `@reifies`, `@annotation` as RDF 1.2
+   *   triple terms and reifiers).
    * @returns {Promise<Dataset>}
    */
   async function jsonldToRdf(jsonldText, options) {
@@ -1223,6 +1226,7 @@ function buildApi(driver) {
       ...(opts.rdfDirection ? { rdfDirection: opts.rdfDirection } : {}),
       ...(opts.expandContext ? { expandContext: opts.expandContext } : {}),
       ...(opts.processingMode ? { processingMode: opts.processingMode } : {}),
+      ...(opts.rdfstar ? { rdfstar: true } : {}),
     });
     return c.wrap(entryResult(c.e.datasetFromJsonLd(jsonldText, optionsJson), 'jsonldToRdf'), {},
       { format: 'jsonld', formatInferred: false });
@@ -1250,7 +1254,8 @@ function buildApi(driver) {
    * The text form is `serialize(data, {format: 'jsonld'})`.
    * @param {Dataset|string|Array} data
    * @param {{useNativeTypes?: boolean, useRdfType?: boolean,
-   *   rdfDirection?: string, format?: string, baseIRI?: string}} [options]
+   *   rdfDirection?: string, rdfstar?: boolean, format?: string,
+   *   baseIRI?: string}} [options]
    * @returns {Promise<any>}
    */
   async function jsonldFromRdf(data, options) {
@@ -1907,20 +1912,30 @@ function buildApi(driver) {
     const e = await entry();
     requireEntryFn(e, 'storeOpen', 'openStore (storeOpen)');
     const gen = await openGeneration(reader, opts.generation);
-    const manifestHex = hexOfBytes(gen.manifest);
+    // The byte ops when the engine has them (issue 1039): the manifest
+    // crosses as bytes and is decoded once for the plan and the open. An
+    // older engine gets the hexadecimal ops, as before.
+    const bytesOps = typeof e.storeOpenBytes === 'function';
+    const manifestHex = bytesOps ? null : hexOfBytes(gen.manifest);
     let keys;
     if (Array.isArray(opts.keys)) {
       keys = opts.keys.map(String);
     } else if (typeof opts.sparql === 'string') {
-      const plan = entryResult(e.storeQueryPlan(manifestHex, opts.sparql), 'openStore(plan)');
+      const plan = entryResult(bytesOps
+        ? e.storeQueryPlanBytes(gen.manifest, opts.sparql)
+        : e.storeQueryPlan(manifestHex, opts.sparql), 'openStore(plan)');
       keys = plan.keys.concat(plan.sidecarKeys || [], plan.blobKeys || []);
     } else {
-      keys = manifestKeys(entryResult(e.storeManifestInspect(manifestHex), 'openStore(inspect)'));
+      keys = manifestKeys(entryResult(bytesOps
+        ? e.storeManifestInspectBytes(gen.manifest)
+        : e.storeManifestInspect(manifestHex), 'openStore(inspect)'));
     }
     const { blob, artifacts } = await readRegion(reader, gen.generation, keys);
-    const env = entryResult(e.storeOpen(manifestHex, JSON.stringify(artifacts), blob), 'openStore');
+    const env = entryResult(bytesOps
+      ? e.storeOpenBytes(gen.manifest, JSON.stringify(artifacts), blob)
+      : e.storeOpen(manifestHex, JSON.stringify(artifacts), blob), 'openStore');
     const c = await ctx();
-    return new Store(e, env, gen, manifestHex, (nq) => c.fromNQuads(nq, {}), withExtensionRounds);
+    return new Store(e, env, gen, (nq) => c.fromNQuads(nq, {}), withExtensionRounds);
   }
 
   /**

package/lib/dataset.mjs

@@ -279,7 +279,7 @@ class Dataset {
    * The dataset as a document.
    * @param {{format?: string, version?: '1.1'|'1.2', prefixes?: object,
    *   literalShorthand?: boolean, useNativeTypes?: boolean,
-   *   useRdfType?: boolean, rdfDirection?: string}} [options]
+   *   useRdfType?: boolean, rdfDirection?: string, rdfstar?: boolean}} [options]
    *   format: nquads (default), ntriples, turtle, trig, rdfxml, jsonld,
    *   rdfc (RDFC-1.0 canonical N-Quads).
    * @returns {Promise<string>}
@@ -315,6 +315,7 @@ class Dataset {
         ...(opts.useNativeTypes ? { useNativeTypes: true } : {}),
         ...(opts.useRdfType ? { useRdfType: true } : {}),
         ...(opts.rdfDirection ? { rdfDirection: String(opts.rdfDirection) } : {}),
+        ...(opts.rdfstar ? { rdfstar: true } : {}),
         ...(suffix ? { version: String(opts.version) } : {}),
       })), 'serialize');
       return r.jsonld;

package/lib/lean-entry.mjs

@@ -125,6 +125,9 @@ function installExtensionBridge(eng, entry) {
   };
 }
 
+/** The byte forms of the manifest ops (Wasm/Ops/StoreHandles.lean). */
+const MANIFEST_BYTES_OPS = ['storeManifestInspectBytes', 'storeQueryPlanBytes', 'storeOpenBytes'];
+
 /**
  * Build the entry object lib/api.mjs drives, from a loaded engine handle.
  *
@@ -199,9 +202,45 @@ export function entryFromEngine(eng) {
       }
     };
   }
+  const blobIoOps = Array.isArray(reflection.blobIoOps) ? reflection.blobIoOps : [];
+  // The byte forms of the manifest ops (https://github.com/danbri/factoidal/issues/1039):
+  // the manifest crosses as the byte region, not as hexadecimal inside the
+  // JSON arguments, and the engine decodes it once for a plan and the open
+  // that follows. An engine without them has only the hexadecimal ops; the
+  // methods are then absent and lib/api.mjs uses the hexadecimal ops.
+  if (typeof eng.callBlobIO === 'function' &&
+      MANIFEST_BYTES_OPS.every((op) => blobIoOps.includes(op))) {
+    entry.storeManifestInspectBytes = (manifestBytes) => {
+      try {
+        return JSON.stringify(eng.callBlobIO('storeManifestInspectBytes', [], manifestBytes).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+    entry.storeQueryPlanBytes = (manifestBytes, sparql) => {
+      try {
+        return JSON.stringify(
+          eng.callBlobIO('storeQueryPlanBytes', [String(sparql)], manifestBytes).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+    entry.storeOpenBytes = (manifestBytes, artifactsJson, bytes) => {
+      try {
+        const region = new Uint8Array(manifestBytes.length + bytes.length);
+        region.set(manifestBytes, 0);
+        region.set(bytes, manifestBytes.length);
+        return JSON.stringify(eng.callBlobIO('storeOpenBytes',
+          [String(manifestBytes.length), String(artifactsJson)], region).envelope);
+      } catch (err) {
+        return failEnvelope(err);
+      }
+    };
+  } else {
+    for (const op of MANIFEST_BYTES_OPS) delete entry[op];
+  }
   // datasetQuadsBin answers a byte region (formal/lean4/L4Factoidal/RDF/QuadsBin.lean):
   // this method answers {envelope, bytes} and throws on a refusal.
-  const blobIoOps = Array.isArray(reflection.blobIoOps) ? reflection.blobIoOps : [];
   if (typeof eng.callBlobIO === 'function' && blobIoOps.includes('datasetQuadsBin')) {
     entry.datasetQuadsBin = (handle, optsJson) => {
       try {

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.17.0';
+export const version = '0.19.0';

package/lws/client.mjs

@@ -38,14 +38,15 @@ import { loadEngine } from '../bin/engine.mjs'
 import { FactoidalError } from '../lib/errors.mjs'
 
 /** The ops this host needs from the engine. */
-export const LWS_CLIENT_OPS = ['lwsClientStart', 'lwsClientStep']
+export const LWS_CLIENT_OPS = ['lwsClientStart', 'lwsClientStep', 'lwsClientNewKey']
 
 /** The operation kinds of the ABI. Listed so a caller can be checked
  *  against the contract; this host attaches no meaning to any of them. */
 export const LWS_CLIENT_KINDS = [
-  'discover', 'read', 'head', 'create', 'update', 'patch', 'delete', 'readLinkset',
-  'updateLinkset', 'move', 'list', 'typeIndex', 'search', 'subscribe', 'unsubscribe',
-  'requestAccess', 'grantAccess', 'getAccess', 'revokeAccess', 'verifyNotification'
+  'discover', 'describe', 'read', 'readPage', 'head', 'create', 'update', 'patch', 'delete',
+  'findLinkset', 'readLinkset', 'updateLinkset', 'putLinkset', 'move', 'list', 'typeIndex',
+  'search', 'queryFormats', 'subscribe', 'getSubscription', 'unsubscribe', 'requestAccess',
+  'grantAccess', 'getAccess', 'revokeAccess', 'verifyNotification'
 ]
 
 /** The error an operation ends with. `reason` is the engine's code
@@ -58,6 +59,9 @@ export class LwsClientError extends FactoidalError {
     this.name = 'LwsClientError'
     this.reason = reason
     this.detail = fail
+    // The engine's name for the failure in the lws-driver/1 adapter
+    // protocol ({ kind, message, ... }), as the engine wrote it.
+    this.report = fail && typeof fail.report === 'object' ? fail.report : undefined
     this.unknownOp = extra.unknownOp === true
   }
 }
@@ -138,8 +142,12 @@ export async function lwsClientOpsAvailable (engine) {
  * @param {string} [options.subjectToken] the authentication credential to
  *   exchange for access tokens (RFC 8693 subject_token)
  * @param {string} [options.subjectTokenType] its token type URI
- * @param {object} [options.selfIssued] `{ subject, keyId, jwk }`: a P-256 key
- *   to sign self-issued credentials with, instead of a subject token
+ * @param {object} [options.selfIssued] `{ subject, keyId, jwk }`: a P-256 or
+ *   Ed25519 key to sign self-issued credentials with, instead of a subject
+ *   token (`createDidKey` makes one)
+ * @param {string} [options.idToken] an OpenID Connect ID Token to exchange
+ * @param {object} [options.bearer] `{ token, realm? }`: an access token the
+ *   caller already has; with a realm it is sent only under it
  * @param {object} [options.session] a session from an earlier client
  * @param {number} [options.maxSteps] the loop cap of one operation
  * @returns {Promise<object>} the client
@@ -157,6 +165,9 @@ export async function createLwsClient (options = {}) {
   // `{ subject, keyId, jwk }`: a P-256 key the engine signs self-issued
   // credentials with (lws10-authn-ssi-cid), passed through unread.
   if (options.selfIssued !== undefined) session.selfIssued = options.selfIssued
+  // Read by the engine's session reader (`Machine.sessionOfJson`), unread here.
+  if (options.idToken !== undefined) session.idToken = options.idToken
+  if (options.bearer !== undefined) session.bearer = options.bearer
 
   function call (op, args) {
     try {
@@ -230,7 +241,10 @@ export async function createLwsClient (options = {}) {
     /** The session (access tokens and subject token), for a later client. */
     session: () => ({ ...session }),
     discover: with_('discover'),
+    describe: with_('describe'),
+    /** `read(url, { accept, rangeStart, rangeEnd, ifNoneMatch, prefer })` */
     read: with_('read'),
+    readPage: with_('readPage'),
     head: with_('head'),
     /** `create(containerUrl, { body, mediaType, slug, container, types, links })` */
     create: with_('create'),
@@ -239,26 +253,54 @@ export async function createLwsClient (options = {}) {
     patch: with_('patch'),
     /** `delete(url, { recursive, precondition, tag })` */
     delete: with_('delete'),
+    findLinkset: with_('findLinkset'),
     readLinkset: with_('readLinkset'),
+    /** `updateLinkset(resourceUrl, { body })`, or with `{ linksetUrl, body }`
+     *  when the caller has the linkset resource. */
     updateLinkset: with_('updateLinkset'),
+    putLinkset: with_('putLinkset'),
     /** `move(url, { destination })` */
     move: with_('move'),
     list: with_('list'),
     typeIndex: with_('typeIndex'),
-    /** `search(anyUrlInTheStorage, { query })` */
+    /** `search(anyUrlInTheStorage, { query })`, or `{ endpoint, query }` with
+     *  the service endpoint, `{ onePage: true }` for one page */
     search: with_('search'),
+    queryFormats: with_('queryFormats'),
+    /** `subscribe(url, { topics, inbox, expires })` */
     subscribe: with_('subscribe'),
+    getSubscription: with_('getSubscription'),
     unsubscribe: with_('unsubscribe'),
     requestAccess: with_('requestAccess'),
     grantAccess: with_('grantAccess'),
     getAccess: with_('getAccess'),
     revokeAccess: with_('revokeAccess'),
-    /** `verifyNotification(baseUrl, { requestTarget, method, headers, body })`:
+    /** `verifyNotification(baseUrl, { requestTarget, method, headers, body, trustedStorages })`:
      *  the engine's verdict `{ accept, status, reason? }`. */
     verifyNotification: with_('verifyNotification')
   }
 }
 
+/**
+ * A new `did:key` agent: the engine makes the key pair and the identifier from
+ * 64 random bytes of this host's random source. The host reads none of it.
+ *
+ * @param {object} [options]
+ * @param {object} [options.engine] an engine handle to reuse
+ * @param {string} [options.algorithm] the engine's name of the algorithm
+ *   (default `ES256`, a P-256 key; `EdDSA` makes an Ed25519 key)
+ * @returns {Promise<{agent: string, kid: string, selfIssued: object}>}
+ *   `selfIssued` is the `createLwsClient` option of that name
+ */
+export async function createDidKey (options = {}) {
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const algorithm = typeof options.algorithm === 'string' ? options.algorithm : 'ES256'
+  const random = new Uint8Array(64)
+  globalThis.crypto.getRandomValues(random)
+  const answer = engine.call('lwsClientNewKey', [algorithm, base64OfBytes(random)])
+  return answer.key
+}
+
 /**
  * An HTTP receiver for webhook notifications. For each request it asks the
  * engine (`verifyNotification`) and answers with the status of the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@factoidal/core",
-  "version": "0.17.0",
-  "description": "RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
+  "version": "0.19.0",
+  "description": "EXPERIMENTAL UNREVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",
     "rdf",
@@ -88,6 +88,9 @@
     "./lws": {
       "default": "./lws/server.mjs"
     },
+    "./webdav": {
+      "default": "./webdav/server.mjs"
+    },
     "./lws/client": {
       "default": "./lws/client.mjs"
     },
@@ -123,6 +126,7 @@
     "lib/",
     "bin/",
     "lws/",
+    "webdav/",
     "authz/",
     "solid/",
     "store-host/",

package/rdfjs.mjs

@@ -52,11 +52,20 @@ class BlankNode {
   }
 }
 
+// RDF/JS Data Model, interface Literal: "language the language as lowercase
+// [BCP47] string (examples: "en", "en-gb")". A BCP 47 tag is ASCII (RFC 5646
+// section 2.1), and the engine's readers lowercase its ASCII letters (Lean
+// String.toLower), so a factory term equals the same term read from text
+// (https://github.com/danbri/factoidal/issues/1054).
+function lowerAscii(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
 class Literal {
   constructor(value, language, datatype, direction) {
     this.termType = 'Literal';
     this.value = value;
-    this.language = language || '';
+    this.language = language ? lowerAscii(String(language)) : '';
     // RDF/JS Data Model DataFactory.literal: no datatype argument means
     // xsd:string, a language means rdf:langString, a language and a
     // direction mean rdf:dirLangString.

package/webdav/server.mjs

@@ -0,0 +1,293 @@
+// A Node HTTP host for the Factoidal WebDAV server.
+// https://github.com/danbri/factoidal/issues/1066
+// Design record: docs/designissues/2026-10-27-webdav.md
+//
+// WHAT THIS FILE IS ALLOWED TO DO
+// Carry sockets, files and fetches for the engine, and nothing else:
+//
+// * at start, list CONFIGDIR and give the names to `webdavOpen`; read the
+//   files and test the paths the engine names (`need`) and give them to
+//   `webdavLoad` until it answers `ready`; write the files it names
+//   (`write`, a key file it made); open each local storage directory it
+//   names with the ops `lws-serve` uses (`openLwsStorage`, the config passed
+//   unread);
+// * per request, give the method, target, header fields and content to
+//   `webdavStep`, then carry what the engine answers: an `lws` request to
+//   the local storage it names (no socket: the storage handle's own step),
+//   a `fetch` to the URL it names, until it answers a `response`, which
+//   this file writes back.
+//
+// It makes NO protocol decision. Which files are mounts, what a mount file
+// says, every status code, header field, XML body, lock, property and path
+// mapping is decided in formal/lean4/L4Factoidal/WebDAV/ (iron rule 7 of
+// CLAUDE.md). The one status code written here is 500, for a failure of
+// this host itself. Requests are served one at a time (a queue), because
+// the engine keeps one request in flight per handle.
+//
+// THE WASM CONTRACT (formal/lean4/Wasm/Ops/WebDAV.lean)
+//   webdavOpen   [configJson]                 -> { ok, handle, need }
+//   webdavLoad   [handle, filesJson]          -> { ok, need } | { ok, ready }
+//   webdavStep   [handle, requestJson] + body -> { ok, response | lws | fetch } + body
+//   webdavResume [handle, answerJson]  + body -> { ok, response | lws | fetch } + body
+//   webdavClose  [handle]                     -> { ok }
+
+import { readFileSync, readdirSync, writeFileSync, existsSync } from 'node:fs'
+import { resolve as resolvePath } from 'node:path'
+import { loadEngine } from '../bin/engine.mjs'
+import { openLwsStorage } from '../lws/server.mjs'
+
+/** The ops this host needs from the engine. */
+export const WEBDAV_OPS = ['webdavOpen', 'webdavLoad', 'webdavStep', 'webdavResume', 'webdavClose']
+
+/** The most engine answers one request may take before this host gives up:
+ *  a bound against a defective module, not a protocol rule. */
+const MAX_HOPS = 100000
+
+/** The most rounds of `need` at start: the engine names two. */
+const MAX_LOADS = 8
+
+/** An error of this host, as opposed to one the engine reported. */
+export class WebdavHostError extends Error {
+  constructor (message, detail = {}) {
+    super(message)
+    this.name = 'WebdavHostError'
+    this.unknownOp = detail.unknownOp === true
+    this.envelope = detail.envelope
+  }
+}
+
+function isUnknownOp (error) {
+  const text = error && error.message ? String(error.message) : String(error)
+  return text.indexOf('unknown op') >= 0
+}
+
+/** Random bytes as base64. Pure I/O. */
+function randomBase64 (size) {
+  const bytes = new Uint8Array(size)
+  globalThis.crypto.getRandomValues(bytes)
+  return Buffer.from(bytes).toString('base64')
+}
+
+function nowSeconds () {
+  return Math.floor(Date.now() / 1000)
+}
+
+/** One engine call; an `ok: false` envelope is thrown with the engine's words. */
+function callEngine (engine, op, args) {
+  let envelope
+  try {
+    envelope = engine.call(op, args)
+  } catch (error) {
+    if (isUnknownOp(error)) {
+      throw new WebdavHostError(`the loaded l4factoidal WebAssembly module does not carry ${op}`, { unknownOp: true })
+    }
+    throw error
+  }
+  return envelope
+}
+
+function blobCall (engine, op, args, bytes) {
+  const got = engine.callBlobIO(op, args, bytes)
+  const envelope = got.envelope
+  if (envelope === null || typeof envelope !== 'object') throw new WebdavHostError(`${op} answered with no envelope`)
+  if (envelope.ok === false) throw new WebdavHostError(`${op}: ${envelope.error}`, { envelope })
+  return { envelope, bytes: got.bytes instanceof Uint8Array ? got.bytes : new Uint8Array(0) }
+}
+
+/** The files and paths the engine named, read and tested. Pure I/O. */
+function gather (configDir, need) {
+  const files = (need.read || []).map((name) => {
+    try {
+      return { name, text: readFileSync(resolvePath(configDir, name), 'utf8') }
+    } catch (_error) {
+      return { name, missing: true }
+    }
+  })
+  const exists = (need.exists || []).map((path) => ({ path, present: existsSync(resolvePath(configDir, path)) }))
+  return { files, exists }
+}
+
+/**
+ * Open a WebDAV server handle over the mount files of `configDir`.
+ *
+ * @param {object} options
+ * @param {string} options.configDir the directory of mount files
+ * @param {object} [options.engine] an engine handle to reuse
+ * @returns {Promise<{handle: string, mounts: object[], step: Function, close: Function}>}
+ */
+export async function openWebdav (options = {}) {
+  if (typeof options.configDir !== 'string') throw new WebdavHostError('openWebdav needs configDir')
+  const configDir = options.configDir
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const listing = readdirSync(configDir)
+  let envelope = callEngine(engine, 'webdavOpen', [JSON.stringify({ listing, entropy: randomBase64(32) })])
+  if (envelope.ok === false) throw new WebdavHostError(envelope.error, { envelope })
+  const handle = envelope.handle
+  let loads = 0
+  while (envelope.need !== undefined) {
+    loads += 1
+    if (loads > MAX_LOADS) throw new WebdavHostError('webdavLoad asked for files more often than a start may')
+    envelope = callEngine(engine, 'webdavLoad', [handle, JSON.stringify(gather(configDir, envelope.need))])
+    if (envelope.ok === false) throw new WebdavHostError(envelope.error, { envelope })
+  }
+  const ready = envelope.ready
+  // A file the engine made (a new key): written once, never over a file.
+  for (const w of ready.write || []) {
+    writeFileSync(resolvePath(configDir, w.path), w.text, { mode: parseInt(w.mode, 8), flag: 'wx' })
+  }
+  // Each local storage, opened as lws-serve opens it; the config is the
+  // engine's, passed unread.
+  const storages = new Map()
+  for (const l of ready.local || []) {
+    const storage = await openLwsStorage({ engine, dir: resolvePath(configDir, l.dir), ...l.config, realClock: true })
+    storages.set(l.name, storage)
+  }
+
+  /** Carry one `fetch` the engine named. Pure I/O. */
+  async function exchange (request, bytes) {
+    const init = { method: request.method, headers: request.headers || [], redirect: 'manual' }
+    if (bytes.length > 0) init.body = bytes
+    let reply
+    try {
+      reply = await fetch(request.url, init)
+    } catch (error) {
+      return { answer: { error: error && error.message ? String(error.message) : String(error) }, bytes: new Uint8Array(0) }
+    }
+    const headers = []
+    reply.headers.forEach((value, name) => { headers.push([name, value]) })
+    const body = new Uint8Array(await reply.arrayBuffer())
+    return { answer: { status: reply.status, headers, now: nowSeconds(), randomBase64: randomBase64(48) }, bytes: body }
+  }
+
+  let queue = Promise.resolve()
+
+  /** One request, start to end. */
+  async function serve (request) {
+    const record = {
+      method: request.method,
+      target: request.target,
+      headers: request.headers,
+      now: nowSeconds(),
+      randomBase64: randomBase64(16)
+    }
+    let got = blobCall(engine, 'webdavStep', [handle, JSON.stringify(record)], request.body || new Uint8Array(0))
+    for (let hop = 0; hop < MAX_HOPS; hop += 1) {
+      const env = got.envelope
+      if (env.response !== undefined) {
+        return { status: env.response.status, headers: env.response.headers || [], body: got.bytes }
+      }
+      let answer
+      let bytes
+      if (env.lws !== undefined) {
+        const storage = storages.get(env.lws.mount)
+        if (storage === undefined) throw new WebdavHostError(`the engine named a storage that is not open: ${env.lws.mount}`)
+        const req = env.lws.request
+        const a = await storage.step({ method: req.method, target: req.target, headers: req.headers || [], body: got.bytes })
+        answer = { status: a.status, headers: a.headers }
+        bytes = a.body
+      } else if (env.fetch !== undefined) {
+        const x = await exchange(env.fetch, got.bytes)
+        answer = x.answer
+        bytes = x.bytes
+      } else {
+        throw new WebdavHostError('the engine answered neither response, lws nor fetch')
+      }
+      got = blobCall(engine, 'webdavResume', [handle, JSON.stringify(answer)], bytes)
+    }
+    throw new WebdavHostError('a request took more engine answers than this host allows')
+  }
+
+  return {
+    handle,
+    engine,
+    mounts: ready.mounts || [],
+    /**
+     * One request, served after the requests before it.
+     * @param {{method: string, target: string, headers: Array<[string, string]>, body: Uint8Array}} request
+     */
+    step (request) {
+      const run = queue.then(() => serve(request))
+      queue = run.catch(() => {})
+      return run
+    },
+    close () {
+      for (const s of storages.values()) s.close()
+      try { engine.call('webdavClose', [handle]) } catch (_error) { /* already gone */ }
+    }
+  }
+}
+
+function readBody (request) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    request.on('data', (chunk) => chunks.push(chunk))
+    request.on('error', reject)
+    request.on('end', () => resolve(new Uint8Array(Buffer.concat(chunks))))
+  })
+}
+
+function headerPairs (raw) {
+  const pairs = []
+  for (let index = 0; index + 1 < raw.length; index += 2) pairs.push([raw[index], raw[index + 1]])
+  return pairs
+}
+
+function writeHeaders (response, pairs) {
+  for (const pair of pairs) {
+    if (!Array.isArray(pair) || pair.length < 2) continue
+    const existing = response.getHeader(pair[0])
+    if (existing === undefined) response.setHeader(pair[0], String(pair[1]))
+    else if (Array.isArray(existing)) response.setHeader(pair[0], existing.concat([String(pair[1])]))
+    else response.setHeader(pair[0], [String(existing), String(pair[1])])
+  }
+}
+
+/**
+ * Start the server: open the handle, then listen.
+ *
+ * @param {object} options `configDir`, `port` (default 8090), `host`
+ *   (default 127.0.0.1), `engine`, `onError`
+ * @returns {Promise<{server: object, port: number, origin: string, mounts: object[], close: Function}>}
+ */
+export async function listen (options = {}) {
+  const http = await import('node:http')
+  const dav = await openWebdav(options)
+  const onError = typeof options.onError === 'function'
+    ? options.onError
+    : (error) => { console.error(`webdav-serve: ${error.message}`) }
+  const server = http.createServer(async (request, response) => {
+    let answer
+    try {
+      const body = await readBody(request)
+      answer = await dav.step({ method: request.method, target: request.url, headers: headerPairs(request.rawHeaders), body })
+    } catch (error) {
+      onError(error)
+      response.writeHead(500, { 'content-type': 'text/plain' })
+      response.end(`webdav-serve: ${error.message}\n`)
+      return
+    }
+    writeHeaders(response, answer.headers)
+    response.statusCode = answer.status
+    response.end(answer.body)
+  })
+  const port = typeof options.port === 'number' ? options.port : 8090
+  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(port, host, resolve)
+  })
+  const bound = server.address()
+  const origin = `http://${host.includes(':') ? `[${host}]` : host}:${bound.port}`
+  return {
+    server,
+    port: bound.port,
+    origin,
+    mounts: dav.mounts,
+    close () {
+      return new Promise((resolve) => {
+        server.close(() => { dav.close(); resolve() })
+        if (typeof server.closeAllConnections === 'function') server.closeAllConnections()
+      })
+    }
+  }
+}