@factoidal/core 0.20.0 → 0.21.0

package/bin/pack-host.mjs

@@ -363,6 +363,11 @@ export async function denoReexec (options) {
     return null
   }
   if (granted.indexOf('run') < 0 || granted.indexOf('read') < 0) return null
+  // A `deno compile` executable is not the deno command: given `run ...` it
+  // reads `run` as a factoidal command (found 2026-10-28, building the
+  // single-file executables of docs/designissues/2026-10-28-single-file-app.md).
+  // It packs in process instead.
+  if (!/^deno(\.exe)?$/i.test(Deno.execPath().split(/[\\/]/).pop())) return null
   const main = Deno.mainModule.startsWith('file://')
     ? fileUrlToPath(Deno.mainModule)
     : Deno.mainModule

package/bin/serve.mjs

@@ -147,6 +147,8 @@ export async function openServedStore (root, options = {}) {
   const config = {}
   if (typeof options.queryPath === 'string') config.queryPath = options.queryPath
   if (typeof options.gspPath === 'string') config.gspPath = options.gspPath
+  // The Host and Origin guard (issue 1124): passed unread; the engine decides.
+  if (options.localGuard !== undefined && options.localGuard !== null) config.localGuard = options.localGuard
   const info = engine.callBlobIO('storeServeOpen',
     [manifestHex, JSON.stringify(artifacts), JSON.stringify(state), JSON.stringify(config)],
     concatenate(chunks)).envelope
@@ -233,6 +235,8 @@ export async function openServedTdb2 (root, options = {}) {
   const config = {}
   if (typeof options.queryPath === 'string') config.queryPath = options.queryPath
   if (typeof options.gspPath === 'string') config.gspPath = options.gspPath
+  // The Host and Origin guard (issue 1124): passed unread; the engine decides.
+  if (options.localGuard !== undefined && options.localGuard !== null) config.localGuard = options.localGuard
   const info = engine.callBlobIO('tdb2ServeOpen',
     [JSON.stringify(files), JSON.stringify(config)], concatenate(chunks)).envelope
   const handle = info.handle
@@ -343,9 +347,22 @@ function serveConnection (served, socket, onError) {
  */
 export async function listen (root, options = {}) {
   const net = await import('node:net')
+  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
+  // `factoidal serve` has no authentication: the engine answers only the
+  // listener's own names and refuses writes from another origin
+  // (https://github.com/danbri/factoidal/issues/1124). Data for its check.
+  const os = await import('node:os')
+  let addresses = []
+  try { addresses = Object.values(os.networkInterfaces()).flat().filter(Boolean).map((i) => i.address) } catch (_error) { addresses = [] }
+  const localGuard = {
+    host,
+    addresses,
+    ...(Array.isArray(options.allowHosts) ? { allowHosts: options.allowHosts } : {}),
+    ...(Array.isArray(options.allowOrigins) ? { allowOrigins: options.allowOrigins } : {})
+  }
   const served = options.tdb2 === true
-    ? await openServedTdb2(root, options)
-    : await openServedStore(root, options)
+    ? await openServedTdb2(root, { ...options, localGuard })
+    : await openServedStore(root, { ...options, localGuard })
   const onError = typeof options.onError === 'function'
     ? options.onError
     : (error) => { console.error(`factoidal serve: ${error && error.message ? error.message : error}`) }
@@ -356,7 +373,6 @@ export async function listen (root, options = {}) {
     serveConnection(served, socket, onError)
   })
   const port = typeof options.port === 'number' ? options.port : 0
-  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
   await new Promise((resolve, reject) => {
     server.once('error', reject)
     server.listen(port, host, resolve)

package/browser.d.ts

@@ -14,6 +14,7 @@ export type {
   Sbm11Reader, Sbm11Answer, Sbm11Store, Sbm11ReadEvidence, Sbm11Transport,
   LiteralValueData, LiteralValueResult,
   ExplainResult, StageInfo, EvidenceRecord, Wire, FactoidalNode, Pipeline, RunResult, RunOptions,
+  NodePort, GraphSource, GraphSpec, GraphIssue, GraphCheck, FactoidalGraph, GraphRunResult,
 } from './index';
 
 export {
@@ -26,6 +27,7 @@ export {
   canonicalHash,
   asDefaultGraph,
   isomorphic,
+  datasetMerge,
   fromQuads,
   literalValue,
   isValidLiteral,
@@ -42,6 +44,7 @@ export {
   memberOrdinal,
   openDataset,
   closure,
+  sparqlRlInfer,
   formats,
   queryRaw,
   queryHdt,
@@ -74,6 +77,7 @@ export {
   stages,
   node,
   pipe,
+  graph,
   run,
   rdfsPlusClosure,
   rhoDfClosure,
@@ -107,12 +111,18 @@ export {
   vcEd25519SecretToPublic,
   vcEd25519Sign,
   vcEd25519Verify,
+  xmlDecrypt,
+  xmlEncrypt,
+  jweDecrypt,
+  jweEncrypt,
   vcEddsaCreateFromCanonical,
   vcEddsaVerifyFromCanonical,
   vcCheckCredential,
   vcCheckCredentialSubject,
   vcCheckNoDataLoss,
   vcCheckRelatedResourceDigests,
+  cidValidate,
+  cidRetrieveVerificationMethod,
   didKeyResolve,
   capabilities,
   Dataset,

package/browser.js

@@ -85,6 +85,7 @@ export const graphs = api.graphs;
 export const canonicalHash = api.canonicalHash;
 export const asDefaultGraph = api.asDefaultGraph;
 export const isomorphic = api.isomorphic;
+export const datasetMerge = api.datasetMerge;
 export const fromQuads = api.fromQuads;
 // Literal values (https://github.com/danbri/factoidal/issues/1051): synchronous
 // after the engine is loaded.
@@ -103,6 +104,7 @@ export const memberIri = api.memberIri;
 export const memberOrdinal = api.memberOrdinal;
 export const openDataset = api.openDataset;
 export const closure = api.closure;
+export const sparqlRlInfer = api.sparqlRlInfer;
 export const formats = api.formats;
 export const queryRaw = api.queryRaw;
 export const queryHdt = api.queryHdt;
@@ -136,6 +138,7 @@ export const explain = api.explain;
 export const stages = api.stages;
 export const node = api.node;
 export const pipe = api.pipe;
+export const graph = api.graph;
 export const run = api.run;
 export const rdfsPlusClosure = api.rdfsPlusClosure;
 export const rhoDfClosure = api.rhoDfClosure;
@@ -177,12 +180,21 @@ export const vcSha256Hex = api.vcSha256Hex;
 export const vcEd25519SecretToPublic = api.vcEd25519SecretToPublic;
 export const vcEd25519Sign = api.vcEd25519Sign;
 export const vcEd25519Verify = api.vcEd25519Verify;
+
+// XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
+export const xmlDecrypt = api.xmlDecrypt;
+export const xmlEncrypt = api.xmlEncrypt;
+export const jweDecrypt = api.jweDecrypt;
+export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;
 export const vcEddsaVerifyFromCanonical = api.vcEddsaVerifyFromCanonical;
 export const vcCheckCredential = api.vcCheckCredential;
 export const vcCheckCredentialSubject = api.vcCheckCredentialSubject;
 export const vcCheckNoDataLoss = api.vcCheckNoDataLoss;
 export const vcCheckRelatedResourceDigests = api.vcCheckRelatedResourceDigests;
+// Controlled Identifiers v1.0 (https://github.com/danbri/factoidal/issues/1100).
+export const cidValidate = api.cidValidate;
+export const cidRetrieveVerificationMethod = api.cidRetrieveVerificationMethod;
 export const didKeyResolve = api.didKeyResolve;
 
 // Types, probes and metadata

package/index.d.ts

@@ -530,6 +530,18 @@ export function closure(
   options?: { format?: DataFormat; baseIRI?: string }
 ): Promise<Dataset>;
 
+/**
+ * SPARQL 1.2 RL infer (https://w3c.github.io/data-shapes/sparql12-rl/): the
+ * inference graph of the rule set `rules` (SPARQL-RL text) over the default
+ * graph of `data`, as a new Dataset. Rejects when the rule set has a syntax
+ * error, is not well-formed or not stratifiable, or has IMPORTS.
+ */
+export function sparqlRlInfer(
+  data: DataInput,
+  rules: string,
+  options?: { format?: DataFormat; baseIRI?: string }
+): Promise<Dataset>;
+
 /** The syntaxes the engine reads and writes, from the engine (op datasetFormats). */
 export function formats(): Promise<FormatCapability[]>;
 
@@ -574,9 +586,16 @@ export function graphs(dataset: Dataset): Array<[name: NamedNode | BlankNode, gr
  * differ only in their graph names got the same hash. To hash a graph
  * whatever its name (for example one entry of graphs()), use
  * canonicalHash(asDefaultGraph(g)). Rejects when the input holds an RDF 1.2
- * triple term or the section 4.4 call budget is exceeded.
- */
-export function canonicalHash(dataset: Dataset): Promise<string>;
+ * triple term or the section 4.4 call budget is exceeded. The input is what
+ * canonicalize() takes: a Dataset, or text with `format` and `baseIRI`.
+ * Text is a JavaScript string (characters, not bytes): decode bytes first;
+ * the RDF text syntaxes are UTF-8 (`new TextDecoder('utf-8', { fatal: true })`).
+ * A Uint8Array is refused.
+ */
+export function canonicalHash(
+  data: Dataset | string | { text: string; format?: DataFormat; baseIRI?: string },
+  options?: { format?: DataFormat; baseIRI?: string },
+): Promise<string>;
 
 /**
  * A new Dataset with the triples of every graph of `dataset`, all in the
@@ -593,6 +612,15 @@ export function asDefaultGraph(dataset: Dataset): Dataset;
  */
 export function isomorphic(a: DataInput, b: DataInput, options?: { format?: string; baseIRI?: string }): Promise<boolean>;
 
+/**
+ * The RDF merge of two datasets (RDF 1.1 Semantics 5.2): the quads of both,
+ * with the blank nodes of each input kept apart (`_:b` in `a` and `_:b` in
+ * `b` are two blank nodes). The engine computes it (op datasetMerge, Lean
+ * theorem mergeDatasets_isMerge). Prefixes: those of `a`, then those of `b`
+ * whose label `a` does not declare. Since 0.21.0.
+ */
+export function datasetMerge(a: DataInput, b: DataInput, options?: { format?: string; baseIRI?: string }): Promise<Dataset>;
+
 /** A Dataset holding RDF/JS quads; each term is sent to the engine as its components. */
 export function fromQuads(quads: Iterable<Quad>): Promise<Dataset>;
 
@@ -937,17 +965,30 @@ export interface Wire<G = unknown> {
   evidence: EvidenceRecord[];
 }
 
+/** An input port of a node: its name and its wire. */
+export interface NodePort {
+  readonly name: string;
+  readonly wire: string;
+}
+
 /** A node: a registered stage with its parameters. */
 export interface FactoidalNode {
   readonly stage: string;
   readonly kind: string | null;
   /** The engine's status of this node with its settings (see NodeStatus). */
   readonly status: NodeStatus;
-  /** The registry status of the stage. */
-  readonly registryStatus: StageInfo['status'];
+  /** The registry status of the stage; null for a stage with more than one port (not a registry entry). */
+  readonly registryStatus: StageInfo['status'] | null;
   readonly contract: string | null;
   readonly assumptions: readonly string[];
-  readonly wireIn: string;
+  /**
+   * The input ports: one port 'in' for a registry stage; for a stage with
+   * more than one port (datasetMerge: 'left', 'right'), the engine's list
+   * (op graphCheckNodes). Such a node runs only in graph().
+   */
+  readonly ports: readonly NodePort[];
+  /** The input wire of a one-port stage; null for a stage with more than one port. */
+  readonly wireIn: string | null;
   /**
    * The output wire with these settings: for shippedEvaluator, 'Table' for
    * SELECT, 'Answer' for ASK, 'Dataset' for CONSTRUCT and DESCRIBE (Lean
@@ -1047,9 +1088,74 @@ export function stages(): Promise<StageInfo[]>;
  */
 export function node(name: string, params?: Record<string, unknown>): Promise<FactoidalNode>;
 
-/** Compose nodes and pipelines left to right. */
+/** Compose nodes and pipelines left to right. A node with more than one input port throws a TypeError (use graph()). */
 export function pipe(...nodes: Array<FactoidalNode | Pipeline>): Pipeline;
 
+/** Where a port's value comes from: graph input `input`, or the output of node `node` (an earlier node). */
+export type GraphSource = { readonly input: number } | { readonly node: number };
+
+/** The request of graph(). */
+export interface GraphSpec {
+  /** The wire of each graph input: a wire label of stages() (e.g. 'String', 'Dataset'). */
+  inputs?: string[];
+  /** The nodes in order; `from` has one source per input port of the node. */
+  nodes: Array<{ node: FactoidalNode; from: GraphSource[] }>;
+}
+
+/** An issue of the engine's static check of a graph (op graphCheckNodes, Lean graphIssues). */
+export type GraphIssue =
+  | { readonly kind: 'unknownInput'; readonly node: number; readonly port: number; readonly portName: string; readonly input: number }
+  | { readonly kind: 'forwardRef'; readonly node: number; readonly port: number; readonly portName: string; readonly ref: number }
+  | { readonly kind: 'portCount'; readonly node: number; readonly ports: number; readonly sources: number }
+  | { readonly kind: 'wireMismatch'; readonly node: number; readonly port: number; readonly portName: string; readonly source: string; readonly portWire: string };
+
+/** The engine's check of a graph with no issue (op graphCheckNodes). */
+export interface GraphCheck {
+  readonly issues: readonly GraphIssue[];
+  /** The output wire of the last node. */
+  readonly wireOut: string | null;
+  /** The union of the nodes' named assumptions: the premises of Graph.guarantee_sound. */
+  readonly assumptions: readonly string[];
+  readonly contract: { readonly theorem: string; readonly staticCheck: string };
+  readonly nodes: readonly {
+    readonly name: string; readonly kind: string | null; readonly status: NodeStatus;
+    /** null for a stage with more than one port (not a registry entry). */
+    readonly registryStatus: StageInfo['status'] | null;
+    readonly checked: boolean; readonly contract: string | null;
+    readonly theorems: readonly string[]; readonly assumptions: readonly string[];
+    readonly ports: readonly NodePort[]; readonly wireOut: string;
+    readonly settings: Record<string, unknown>; readonly settingsDigest: string;
+    readonly roles: Readonly<Record<string, string>>;
+    readonly outside: readonly OutsideSetting[];
+    readonly derived: Readonly<Record<string, string>>;
+  }[];
+}
+
+/** A graph from graph(): checked by the engine, with no issue. */
+export interface FactoidalGraph {
+  readonly inputs: readonly string[];
+  readonly nodes: readonly { readonly node: FactoidalNode; readonly from: readonly GraphSource[] }[];
+  readonly wireOut: string | null;
+  readonly assumptions: readonly string[];
+  readonly check: GraphCheck;
+}
+
+/** The result of run() on a graph. */
+export interface GraphRunResult<G = unknown> extends RunResult<G> {
+  /** The output of each node, in order; `graph` is the last one. */
+  values: unknown[];
+  issues: GraphIssue[];
+}
+
+/**
+ * A pipeline that is an acyclic graph of nodes with named input ports
+ * (https://github.com/danbri/factoidal/issues/1130). The engine's op
+ * graphCheckNodes checks it: a graph with an issue throws a FactoidalError
+ * (code 'op.failed') whose `issues` is the engine's list; an engine without
+ * the op throws code 'op.unknown'. Since 0.21.0.
+ */
+export function graph(spec: GraphSpec): FactoidalGraph;
+
 /**
  * Run a node or pipeline on `input` (a Wire, or the graph: text for a
  * reader, else a Dataset or data input). Rejects before any node runs when
@@ -1061,6 +1167,12 @@ export function pipe(...nodes: Array<FactoidalNode | Pipeline>): Pipeline;
  * `wireOut` (see Wire).
  */
 export function run(pipeline: FactoidalNode | Pipeline, input: unknown, options?: RunOptions): Promise<RunResult>;
+/**
+ * Run a graph on `inputs`, one value per graph input. Each node runs on the
+ * values of its sources (a node with more than one port gets them in port
+ * order); one evidence record per node, with `node` (its index) and `from`.
+ */
+export function run(graph: FactoidalGraph, inputs: unknown[], options?: RunOptions): Promise<GraphRunResult>;
 
 /** Literature-name alias for coreRdfsClosure (ρdf). */
 export function rhoDfClosure(
@@ -1374,6 +1486,10 @@ export interface Sbm11Store {
   terms: number;
   /** how the engine checks reads; undefined from a wasm module built before the Merkle check */
   verify: 'merkle' | 'none' | undefined;
+  /** the SHA-256 of the bytes of manifest.sbm11, 64 lowercase hex digits, as
+   * the engine computed it at open (pin it, then give it as
+   * `manifestSha256`); undefined from a wasm module built before issue 1105 */
+  manifestSha256: string | undefined;
   query(sparql: string, options?: { base?: string; sparql12?: boolean; reference?: boolean }): Sbm11Answer;
   /** the resources the reader read, when its reader records them (lwsSbm11Reader) */
   readonly evidence: Sbm11ReadEvidence[] | undefined;
@@ -1384,8 +1500,13 @@ export interface Sbm11Store {
  * Node: `source` is a directory unless a reader is given or registered.
  * `verify` (default 'merkle'): the engine checks every byte it decodes against
  * the manifest's Merkle roots and refuses a changed file with its name;
- * 'none' checks lengths only. */
-export function openSbm11(source: string, options?: { reader?: Sbm11Reader; verify?: 'merkle' | 'none' }): Promise<Sbm11Store>;
+ * 'none' checks lengths only.
+ * `manifestSha256`: the trust anchor, the SHA-256 of the bytes of
+ * manifest.sbm11 as 64 hex digits (https://github.com/danbri/factoidal/issues/1105);
+ * the engine refuses the open when the manifest has another digest. */
+export function openSbm11(source: string, options?: {
+  reader?: Sbm11Reader; verify?: 'merkle' | 'none'; manifestSha256?: string
+}): Promise<Sbm11Store>;
 
 /** Serve `source` with `reader`; `null` removes it. */
 export function registerSbm11Source(source: string, reader: Sbm11Reader | null): void;
@@ -1749,6 +1870,45 @@ export function vcEd25519Verify(
   signatureHex: string
 ): Promise<boolean>;
 
+/**
+ * Decrypt every xenc:EncryptedData of an XML document (XML Encryption 1.1).
+ * RSA-OAEP, ECDH-ES and X25519 run in the wasm (HACL*); AES runs in the
+ * host's WebCrypto. Every failure after the structure check is the one
+ * error "XML decryption failed".
+ */
+export function xmlDecrypt(
+  document: string,
+  options: { keys: object[]; allowCbc?: boolean }
+): Promise<{ document: string; canonical: string }>;
+
+/** Encrypt an XML document element, or its content, for one recipient. */
+export function xmlEncrypt(
+  document: string,
+  options: {
+    recipient: object;
+    algorithm?: 'aes128-gcm' | 'aes256-gcm';
+    keyTransport?: 'rsa-oaep-mgf1p' | 'rsa-oaep-sha256';
+    keyWrap?: 'kw-aes128' | 'kw-aes256';
+    content?: boolean;
+    saml?: boolean;
+  }
+): Promise<{ document: string; canonical: string }>;
+
+/**
+ * Decrypt a compact JWE (RFC 7516). Every failure after the allowlist is
+ * the one error "decryption failed".
+ */
+export function jweDecrypt(
+  token: string,
+  options: { jwk: object }
+): Promise<{ header: Record<string, unknown>; plaintext: Uint8Array }>;
+
+/** Encrypt to a compact JWE (RFC 7516). */
+export function jweEncrypt(
+  plaintext: Uint8Array | string,
+  options: { alg: string; enc: string; jwk: object; header?: Record<string, unknown> }
+): Promise<string>;
+
 /**
  * Create an eddsa-rdfc-2022 Data Integrity proofValue (multibase-z,
  * base58btc) over already-canonicalized inputs — RDFC-1.0 canonical
@@ -1817,6 +1977,70 @@ export function vcCheckRelatedResourceDigests(
   credentialJson: string
 ): Promise<{ valid: boolean; reason?: string }>;
 
+/** One failed MUST of CID 1.0 §2 (cidValidate). */
+export interface CidValidationError {
+  /** The engine's name of the failed MUST, e.g. 'idNotUrl', 'jwkPrivateMember'. */
+  code: string;
+  message: string;
+  /** RFC 6901 JSON Pointer to the member, e.g. '/verificationMethod/1/publicKeyJwk/d'; '' is the whole document. */
+  path: string;
+}
+
+/**
+ * Controlled Identifiers v1.0 §2 (https://www.w3.org/TR/cid-1.0/): check a
+ * controlled identifier document. `valid` is the engine's answer
+ * (L4Factoidal.CID.parseDocument); `errors` lists every failed MUST it found,
+ * empty when valid. Issue 1100 item 9.
+ */
+export function cidValidate(doc: string | object): Promise<{ valid: boolean; errors: CidValidationError[] }>;
+
+/** An RFC 9457 problem details object. */
+export interface CidProblem {
+  /** https://w3id.org/security#<NAME> for a §3.5 error; a tag: URI for the others. */
+  type: string;
+  title: string;
+  detail: string;
+}
+
+export interface CidRetrieveOptions {
+  /**
+   * GET the URL the engine names. Called as fetch(url, init) with
+   * init.headers.accept, init.redirect 'manual' and, when the engine chose
+   * one, init.address (the address to connect to). Answers a Response, or
+   * { status, headers: { get(name) }, text() }. Default: Node and Deno
+   * connect to init.address; a browser uses the page's fetch.
+   */
+  fetch?: (url: string, init: { method: 'GET'; headers: { accept: string }; redirect: 'manual'; address?: string }) =>
+    Promise<{ status: number; headers: { get(name: string): string | null }; text(): Promise<string> }>;
+  /** Every address of a host name. Default: the system resolver (Node, Deno); none in a browser. null: none. */
+  resolve?: ((host: string) => Promise<string[]>) | null;
+  /** Refuse a method that has expired or been revoked at this time (a Date, or seconds since the epoch). */
+  now?: Date | number;
+  /** Allow an http document URL (default: https only). */
+  allowHttp?: boolean;
+  /** Allow loopback, link-local, private and localhost addresses (default: refused). */
+  allowPrivateFetch?: boolean;
+}
+
+/**
+ * Controlled Identifiers v1.0 §3.3 Retrieve Verification Method. The engine
+ * names each fetch and decides each answer (the private-address guard of the
+ * authorization server, the status, the Content-Type: application/cid,
+ * application/cid+json, application/ld+json or application/json, then §3.3);
+ * this function does the fetch. Never rejects for a failed retrieval: it
+ * answers `ok: false` with the §3.5 name (or FETCH_REFUSED, FETCH_FAILED,
+ * UNSUPPORTED_MEDIA_TYPE, VERIFICATION_METHOD_NOT_IN_FORCE) and an RFC 9457
+ * object. Issue 1100 items 7 and 9.
+ */
+export function cidRetrieveVerificationMethod(
+  url: string,
+  relationship: 'authentication' | 'assertionMethod' | 'keyAgreement' | 'capabilityInvocation' | 'capabilityDelegation',
+  options?: CidRetrieveOptions
+): Promise<
+  | { ok: true; verificationMethod: Record<string, unknown>; controllerDocument: string }
+  | { ok: false; code: string; problem: CidProblem }
+>;
+
 /**
  * Feature probe: which ops the loaded wasm module serves. A module older
  * than this package can lack some; an operation whose op is missing
@@ -1831,6 +2055,8 @@ export function capabilities(): Promise<{
   canonicalHash: boolean;
   shacl: boolean;
   shex: boolean;
+  /** the engine has the SPARQL 1.2 RL op (datasetSparqlRlInfer) */
+  sparqlRl: boolean;
   owlClosure: boolean;
   explain: boolean;
   stages: boolean;
@@ -1838,6 +2064,10 @@ export function capabilities(): Promise<{
   pipelineCheck: boolean;
   /** The op pipelineCheckNodes: node settings in evidence, and the evaluator's output wire from the query form. */
   pipelineCheckNodes: boolean;
+  /** The op graphCheckNodes: graph() and run() of a graph, and node('datasetMerge'). */
+  graphCheck: boolean;
+  /** The op datasetMerge: datasetMerge(). */
+  datasetMerge: boolean;
   tableau: boolean;
   rml: boolean;
   csvw: boolean;
@@ -1867,6 +2097,8 @@ export function capabilities(): Promise<{
   deltaLog: boolean;
   /** ops literalValue and literalFromValue (issue 1051). */
   literalValues: boolean;
+  /** ops cidValidate and cidRetrieve (issue 1100). */
+  cid: boolean;
   /** 'full': the whole library is in the wasm module. */
   profile: 'full' | string;
   /** The dispatch ABI version string of the loaded wasm module. */
@@ -1945,6 +2177,7 @@ declare const _default: {
   update: typeof update;
   openDataset: typeof openDataset;
   closure: typeof closure;
+  sparqlRlInfer: typeof sparqlRlInfer;
   formats: typeof formats;
   serialize: typeof serialize;
   canonicalize: typeof canonicalize;
@@ -2005,12 +2238,18 @@ declare const _default: {
   vcEd25519SecretToPublic: typeof vcEd25519SecretToPublic;
   vcEd25519Sign: typeof vcEd25519Sign;
   vcEd25519Verify: typeof vcEd25519Verify;
+  xmlDecrypt: typeof xmlDecrypt;
+  xmlEncrypt: typeof xmlEncrypt;
+  jweDecrypt: typeof jweDecrypt;
+  jweEncrypt: typeof jweEncrypt;
   vcEddsaCreateFromCanonical: typeof vcEddsaCreateFromCanonical;
   vcEddsaVerifyFromCanonical: typeof vcEddsaVerifyFromCanonical;
   vcCheckCredential: typeof vcCheckCredential;
   vcCheckCredentialSubject: typeof vcCheckCredentialSubject;
   vcCheckNoDataLoss: typeof vcCheckNoDataLoss;
   vcCheckRelatedResourceDigests: typeof vcCheckRelatedResourceDigests;
+  cidValidate: typeof cidValidate;
+  cidRetrieveVerificationMethod: typeof cidRetrieveVerificationMethod;
   capabilities: typeof capabilities;
   Dataset: typeof Dataset;
   Store: typeof Store;

package/index.mjs

@@ -25,6 +25,7 @@ import { sbm11Api, registerSbm11Source, setDefaultSbm11Reader, mapReader } from
 import { nodeDefaultReaderFactory } from './lib/sbm11-node.mjs';
 import { lwsSbm11Reader as lwsSbm11ReaderWith } from './lib/sbm11-lws.mjs';
 import { nodeSyncTransport } from './lib/sync-http-node.mjs';
+import { nodeCidHost } from './lib/cid-node.mjs';
 
 /**
  * The loaded Lean engine handle: `call(op, args)`, `callBlob`,
@@ -45,6 +46,8 @@ const api = buildApi({
   engineName: 'lean4-wasm',
   loadEntry: async () => entryFromEngine(await loadEngine()),
   storeReaderFor: (root) => (path) => readFileSync(join(root, path)),
+  // Name resolution and a GET pinned to one address (issue 1100 item 9).
+  cidHost: nodeCidHost,
 });
 
 // RDF and SPARQL
@@ -57,6 +60,7 @@ export const graphs = api.graphs;
 export const canonicalHash = api.canonicalHash;
 export const asDefaultGraph = api.asDefaultGraph;
 export const isomorphic = api.isomorphic;
+export const datasetMerge = api.datasetMerge;
 export const fromQuads = api.fromQuads;
 // Literal values (https://github.com/danbri/factoidal/issues/1051): synchronous
 // after the engine is loaded.
@@ -75,6 +79,7 @@ export const memberIri = api.memberIri;
 export const memberOrdinal = api.memberOrdinal;
 export const openDataset = api.openDataset;
 export const closure = api.closure;
+export const sparqlRlInfer = api.sparqlRlInfer;
 export const formats = api.formats;
 export const queryRaw = api.queryRaw;
 export const queryHdt = api.queryHdt;
@@ -129,6 +134,7 @@ export const explain = api.explain;
 export const stages = api.stages;
 export const node = api.node;
 export const pipe = api.pipe;
+export const graph = api.graph;
 export const run = api.run;
 export const rdfsPlusClosure = api.rdfsPlusClosure;
 export const rhoDfClosure = api.rhoDfClosure;
@@ -170,12 +176,21 @@ export const vcSha256Hex = api.vcSha256Hex;
 export const vcEd25519SecretToPublic = api.vcEd25519SecretToPublic;
 export const vcEd25519Sign = api.vcEd25519Sign;
 export const vcEd25519Verify = api.vcEd25519Verify;
+
+// XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
+export const xmlDecrypt = api.xmlDecrypt;
+export const xmlEncrypt = api.xmlEncrypt;
+export const jweDecrypt = api.jweDecrypt;
+export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;
 export const vcEddsaVerifyFromCanonical = api.vcEddsaVerifyFromCanonical;
 export const vcCheckCredential = api.vcCheckCredential;
 export const vcCheckCredentialSubject = api.vcCheckCredentialSubject;
 export const vcCheckNoDataLoss = api.vcCheckNoDataLoss;
 export const vcCheckRelatedResourceDigests = api.vcCheckRelatedResourceDigests;
+// Controlled Identifiers v1.0 (https://github.com/danbri/factoidal/issues/1100).
+export const cidValidate = api.cidValidate;
+export const cidRetrieveVerificationMethod = api.cidRetrieveVerificationMethod;
 export const didKeyResolve = api.didKeyResolve;
 
 // Types, probes and metadata

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "43c334ec5335";
+const WASM_VERSION = "18074526651e";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-0c9a222bdb25-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40662145237",
-  "gitSha": "0c9a222bdb25ff70456611d3fbc87a41902d8324",
-  "builtAt": "2026-10-28T09:52:07Z",
+  "release": "danbri/factoidal-builds build-7ab6936b6710-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40733510537",
+  "gitSha": "7ab6936b6710f2a68517a1fd3a1bf047e96c3c7c",
+  "builtAt": "2026-10-28T17:53:09Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "43c334ec53357cd40339f693d303bda3e422ac92e94ad335cb6b0e83ec4eafbd",
-  "wasmBytes": 17958911,
+  "wasmSha256": "18074526651eb00293b15be5c6d6e117e9d07271f1d104340b9d9ecff3b826c2",
+  "wasmBytes": 19211990,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"