@factoidal/core 0.20.0 → 0.22.0

package/bin/pack-host.mjs

@@ -363,6 +363,11 @@ export async function denoReexec (options) {
     return null
   }
   if (granted.indexOf('run') < 0 || granted.indexOf('read') < 0) return null
+  // A `deno compile` executable is not the deno command: given `run ...` it
+  // reads `run` as a factoidal command (found 2026-10-28, building the
+  // single-file executables of docs/designissues/2026-10-28-single-file-app.md).
+  // It packs in process instead.
+  if (!/^deno(\.exe)?$/i.test(Deno.execPath().split(/[\\/]/).pop())) return null
   const main = Deno.mainModule.startsWith('file://')
     ? fileUrlToPath(Deno.mainModule)
     : Deno.mainModule

package/bin/serve.mjs

@@ -147,6 +147,8 @@ export async function openServedStore (root, options = {}) {
   const config = {}
   if (typeof options.queryPath === 'string') config.queryPath = options.queryPath
   if (typeof options.gspPath === 'string') config.gspPath = options.gspPath
+  // The Host and Origin guard (issue 1124): passed unread; the engine decides.
+  if (options.localGuard !== undefined && options.localGuard !== null) config.localGuard = options.localGuard
   const info = engine.callBlobIO('storeServeOpen',
     [manifestHex, JSON.stringify(artifacts), JSON.stringify(state), JSON.stringify(config)],
     concatenate(chunks)).envelope
@@ -233,6 +235,8 @@ export async function openServedTdb2 (root, options = {}) {
   const config = {}
   if (typeof options.queryPath === 'string') config.queryPath = options.queryPath
   if (typeof options.gspPath === 'string') config.gspPath = options.gspPath
+  // The Host and Origin guard (issue 1124): passed unread; the engine decides.
+  if (options.localGuard !== undefined && options.localGuard !== null) config.localGuard = options.localGuard
   const info = engine.callBlobIO('tdb2ServeOpen',
     [JSON.stringify(files), JSON.stringify(config)], concatenate(chunks)).envelope
   const handle = info.handle
@@ -343,9 +347,22 @@ function serveConnection (served, socket, onError) {
  */
 export async function listen (root, options = {}) {
   const net = await import('node:net')
+  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
+  // `factoidal serve` has no authentication: the engine answers only the
+  // listener's own names and refuses writes from another origin
+  // (https://github.com/danbri/factoidal/issues/1124). Data for its check.
+  const os = await import('node:os')
+  let addresses = []
+  try { addresses = Object.values(os.networkInterfaces()).flat().filter(Boolean).map((i) => i.address) } catch (_error) { addresses = [] }
+  const localGuard = {
+    host,
+    addresses,
+    ...(Array.isArray(options.allowHosts) ? { allowHosts: options.allowHosts } : {}),
+    ...(Array.isArray(options.allowOrigins) ? { allowOrigins: options.allowOrigins } : {})
+  }
   const served = options.tdb2 === true
-    ? await openServedTdb2(root, options)
-    : await openServedStore(root, options)
+    ? await openServedTdb2(root, { ...options, localGuard })
+    : await openServedStore(root, { ...options, localGuard })
   const onError = typeof options.onError === 'function'
     ? options.onError
     : (error) => { console.error(`factoidal serve: ${error && error.message ? error.message : error}`) }
@@ -356,7 +373,6 @@ export async function listen (root, options = {}) {
     serveConnection(served, socket, onError)
   })
   const port = typeof options.port === 'number' ? options.port : 0
-  const host = typeof options.host === 'string' ? options.host : '127.0.0.1'
   await new Promise((resolve, reject) => {
     server.once('error', reject)
     server.listen(port, host, resolve)

package/browser.d.ts

@@ -14,6 +14,8 @@ export type {
   Sbm11Reader, Sbm11Answer, Sbm11Store, Sbm11ReadEvidence, Sbm11Transport,
   LiteralValueData, LiteralValueResult,
   ExplainResult, StageInfo, EvidenceRecord, Wire, FactoidalNode, Pipeline, RunResult, RunOptions,
+  NodePort, GraphSource, GraphSpec, GraphIssue, GraphCheck, FactoidalGraph, GraphRunResult,
+  QtError, Qt4Item, Qt4Result, Xslt4Result,
 } from './index';
 
 export {
@@ -26,6 +28,7 @@ export {
   canonicalHash,
   asDefaultGraph,
   isomorphic,
+  datasetMerge,
   fromQuads,
   literalValue,
   isValidLiteral,
@@ -42,6 +45,7 @@ export {
   memberOrdinal,
   openDataset,
   closure,
+  sparqlRlInfer,
   formats,
   queryRaw,
   queryHdt,
@@ -74,6 +78,7 @@ export {
   stages,
   node,
   pipe,
+  graph,
   run,
   rdfsPlusClosure,
   rhoDfClosure,
@@ -90,6 +95,9 @@ export {
   xmlWellformed,
   xpathEval,
   xsltTransform,
+  xpath4Eval,
+  xqueryEval,
+  xslt4Transform,
   schematronValidate,
   jsonSchemaValidate,
   mathmlEval,
@@ -107,12 +115,18 @@ export {
   vcEd25519SecretToPublic,
   vcEd25519Sign,
   vcEd25519Verify,
+  xmlDecrypt,
+  xmlEncrypt,
+  jweDecrypt,
+  jweEncrypt,
   vcEddsaCreateFromCanonical,
   vcEddsaVerifyFromCanonical,
   vcCheckCredential,
   vcCheckCredentialSubject,
   vcCheckNoDataLoss,
   vcCheckRelatedResourceDigests,
+  cidValidate,
+  cidRetrieveVerificationMethod,
   didKeyResolve,
   capabilities,
   Dataset,

package/browser.js

@@ -85,6 +85,7 @@ export const graphs = api.graphs;
 export const canonicalHash = api.canonicalHash;
 export const asDefaultGraph = api.asDefaultGraph;
 export const isomorphic = api.isomorphic;
+export const datasetMerge = api.datasetMerge;
 export const fromQuads = api.fromQuads;
 // Literal values (https://github.com/danbri/factoidal/issues/1051): synchronous
 // after the engine is loaded.
@@ -103,6 +104,7 @@ export const memberIri = api.memberIri;
 export const memberOrdinal = api.memberOrdinal;
 export const openDataset = api.openDataset;
 export const closure = api.closure;
+export const sparqlRlInfer = api.sparqlRlInfer;
 export const formats = api.formats;
 export const queryRaw = api.queryRaw;
 export const queryHdt = api.queryHdt;
@@ -136,6 +138,7 @@ export const explain = api.explain;
 export const stages = api.stages;
 export const node = api.node;
 export const pipe = api.pipe;
+export const graph = api.graph;
 export const run = api.run;
 export const rdfsPlusClosure = api.rdfsPlusClosure;
 export const rhoDfClosure = api.rhoDfClosure;
@@ -154,6 +157,10 @@ export const jsonldFromRdf = api.jsonldFromRdf;
 export const xmlWellformed = api.xmlWellformed;
 export const xpathEval = api.xpathEval;
 export const xsltTransform = api.xsltTransform;
+// XPath 4.0, XQuery 4.0 and XSLT 4.0 (formal/lean4/Wasm/Ops/Qt4.lean).
+export const xpath4Eval = api.xpath4Eval;
+export const xqueryEval = api.xqueryEval;
+export const xslt4Transform = api.xslt4Transform;
 export const schematronValidate = api.schematronValidate;
 export const jsonSchemaValidate = api.jsonSchemaValidate;
 export const mathmlEval = api.mathmlEval;
@@ -177,12 +184,21 @@ export const vcSha256Hex = api.vcSha256Hex;
 export const vcEd25519SecretToPublic = api.vcEd25519SecretToPublic;
 export const vcEd25519Sign = api.vcEd25519Sign;
 export const vcEd25519Verify = api.vcEd25519Verify;
+
+// XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
+export const xmlDecrypt = api.xmlDecrypt;
+export const xmlEncrypt = api.xmlEncrypt;
+export const jweDecrypt = api.jweDecrypt;
+export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;
 export const vcEddsaVerifyFromCanonical = api.vcEddsaVerifyFromCanonical;
 export const vcCheckCredential = api.vcCheckCredential;
 export const vcCheckCredentialSubject = api.vcCheckCredentialSubject;
 export const vcCheckNoDataLoss = api.vcCheckNoDataLoss;
 export const vcCheckRelatedResourceDigests = api.vcCheckRelatedResourceDigests;
+// Controlled Identifiers v1.0 (https://github.com/danbri/factoidal/issues/1100).
+export const cidValidate = api.cidValidate;
+export const cidRetrieveVerificationMethod = api.cidRetrieveVerificationMethod;
 export const didKeyResolve = api.didKeyResolve;
 
 // Types, probes and metadata

package/index.d.ts

@@ -167,6 +167,20 @@ export class FactoidalError extends Error {
   readonly format?: string;
   /** For a parse failure of text: true when the syntax was inferred. */
   readonly formatInferred?: boolean;
+  /**
+   * For xpath4Eval, xqueryEval and xslt4Transform: the error that the
+   * XPath, XQuery or XSLT 4.0 specification names (code `XPST0003`,
+   * namespace `http://www.w3.org/2005/xqt-errors`, ...).
+   */
+  readonly qtError?: QtError;
+}
+
+/** An error of XPath 4.0, XQuery 4.0 or XSLT 4.0: the local part and the
+ *  namespace of the error QName, and the engine's message. */
+export interface QtError {
+  code: string;
+  namespace: string;
+  message: string;
 }
 
 /** One recoverable-parse diagnostic from a `{lenient:true}` parse() call. */
@@ -530,6 +544,18 @@ export function closure(
   options?: { format?: DataFormat; baseIRI?: string }
 ): Promise<Dataset>;
 
+/**
+ * SPARQL 1.2 RL infer (https://w3c.github.io/data-shapes/sparql12-rl/): the
+ * inference graph of the rule set `rules` (SPARQL-RL text) over the default
+ * graph of `data`, as a new Dataset. Rejects when the rule set has a syntax
+ * error, is not well-formed or not stratifiable, or has IMPORTS.
+ */
+export function sparqlRlInfer(
+  data: DataInput,
+  rules: string,
+  options?: { format?: DataFormat; baseIRI?: string }
+): Promise<Dataset>;
+
 /** The syntaxes the engine reads and writes, from the engine (op datasetFormats). */
 export function formats(): Promise<FormatCapability[]>;
 
@@ -574,9 +600,16 @@ export function graphs(dataset: Dataset): Array<[name: NamedNode | BlankNode, gr
  * differ only in their graph names got the same hash. To hash a graph
  * whatever its name (for example one entry of graphs()), use
  * canonicalHash(asDefaultGraph(g)). Rejects when the input holds an RDF 1.2
- * triple term or the section 4.4 call budget is exceeded.
- */
-export function canonicalHash(dataset: Dataset): Promise<string>;
+ * triple term or the section 4.4 call budget is exceeded. The input is what
+ * canonicalize() takes: a Dataset, or text with `format` and `baseIRI`.
+ * Text is a JavaScript string (characters, not bytes): decode bytes first;
+ * the RDF text syntaxes are UTF-8 (`new TextDecoder('utf-8', { fatal: true })`).
+ * A Uint8Array is refused.
+ */
+export function canonicalHash(
+  data: Dataset | string | { text: string; format?: DataFormat; baseIRI?: string },
+  options?: { format?: DataFormat; baseIRI?: string },
+): Promise<string>;
 
 /**
  * A new Dataset with the triples of every graph of `dataset`, all in the
@@ -593,6 +626,15 @@ export function asDefaultGraph(dataset: Dataset): Dataset;
  */
 export function isomorphic(a: DataInput, b: DataInput, options?: { format?: string; baseIRI?: string }): Promise<boolean>;
 
+/**
+ * The RDF merge of two datasets (RDF 1.1 Semantics 5.2): the quads of both,
+ * with the blank nodes of each input kept apart (`_:b` in `a` and `_:b` in
+ * `b` are two blank nodes). The engine computes it (op datasetMerge, Lean
+ * theorem mergeDatasets_isMerge). Prefixes: those of `a`, then those of `b`
+ * whose label `a` does not declare. Since 0.21.0.
+ */
+export function datasetMerge(a: DataInput, b: DataInput, options?: { format?: string; baseIRI?: string }): Promise<Dataset>;
+
 /** A Dataset holding RDF/JS quads; each term is sent to the engine as its components. */
 export function fromQuads(quads: Iterable<Quad>): Promise<Dataset>;
 
@@ -937,17 +979,30 @@ export interface Wire<G = unknown> {
   evidence: EvidenceRecord[];
 }
 
+/** An input port of a node: its name and its wire. */
+export interface NodePort {
+  readonly name: string;
+  readonly wire: string;
+}
+
 /** A node: a registered stage with its parameters. */
 export interface FactoidalNode {
   readonly stage: string;
   readonly kind: string | null;
   /** The engine's status of this node with its settings (see NodeStatus). */
   readonly status: NodeStatus;
-  /** The registry status of the stage. */
-  readonly registryStatus: StageInfo['status'];
+  /** The registry status of the stage; null for a stage with more than one port (not a registry entry). */
+  readonly registryStatus: StageInfo['status'] | null;
   readonly contract: string | null;
   readonly assumptions: readonly string[];
-  readonly wireIn: string;
+  /**
+   * The input ports: one port 'in' for a registry stage; for a stage with
+   * more than one port (datasetMerge: 'left', 'right'), the engine's list
+   * (op graphCheckNodes). Such a node runs only in graph().
+   */
+  readonly ports: readonly NodePort[];
+  /** The input wire of a one-port stage; null for a stage with more than one port. */
+  readonly wireIn: string | null;
   /**
    * The output wire with these settings: for shippedEvaluator, 'Table' for
    * SELECT, 'Answer' for ASK, 'Dataset' for CONSTRUCT and DESCRIBE (Lean
@@ -1047,9 +1102,74 @@ export function stages(): Promise<StageInfo[]>;
  */
 export function node(name: string, params?: Record<string, unknown>): Promise<FactoidalNode>;
 
-/** Compose nodes and pipelines left to right. */
+/** Compose nodes and pipelines left to right. A node with more than one input port throws a TypeError (use graph()). */
 export function pipe(...nodes: Array<FactoidalNode | Pipeline>): Pipeline;
 
+/** Where a port's value comes from: graph input `input`, or the output of node `node` (an earlier node). */
+export type GraphSource = { readonly input: number } | { readonly node: number };
+
+/** The request of graph(). */
+export interface GraphSpec {
+  /** The wire of each graph input: a wire label of stages() (e.g. 'String', 'Dataset'). */
+  inputs?: string[];
+  /** The nodes in order; `from` has one source per input port of the node. */
+  nodes: Array<{ node: FactoidalNode; from: GraphSource[] }>;
+}
+
+/** An issue of the engine's static check of a graph (op graphCheckNodes, Lean graphIssues). */
+export type GraphIssue =
+  | { readonly kind: 'unknownInput'; readonly node: number; readonly port: number; readonly portName: string; readonly input: number }
+  | { readonly kind: 'forwardRef'; readonly node: number; readonly port: number; readonly portName: string; readonly ref: number }
+  | { readonly kind: 'portCount'; readonly node: number; readonly ports: number; readonly sources: number }
+  | { readonly kind: 'wireMismatch'; readonly node: number; readonly port: number; readonly portName: string; readonly source: string; readonly portWire: string };
+
+/** The engine's check of a graph with no issue (op graphCheckNodes). */
+export interface GraphCheck {
+  readonly issues: readonly GraphIssue[];
+  /** The output wire of the last node. */
+  readonly wireOut: string | null;
+  /** The union of the nodes' named assumptions: the premises of Graph.guarantee_sound. */
+  readonly assumptions: readonly string[];
+  readonly contract: { readonly theorem: string; readonly staticCheck: string };
+  readonly nodes: readonly {
+    readonly name: string; readonly kind: string | null; readonly status: NodeStatus;
+    /** null for a stage with more than one port (not a registry entry). */
+    readonly registryStatus: StageInfo['status'] | null;
+    readonly checked: boolean; readonly contract: string | null;
+    readonly theorems: readonly string[]; readonly assumptions: readonly string[];
+    readonly ports: readonly NodePort[]; readonly wireOut: string;
+    readonly settings: Record<string, unknown>; readonly settingsDigest: string;
+    readonly roles: Readonly<Record<string, string>>;
+    readonly outside: readonly OutsideSetting[];
+    readonly derived: Readonly<Record<string, string>>;
+  }[];
+}
+
+/** A graph from graph(): checked by the engine, with no issue. */
+export interface FactoidalGraph {
+  readonly inputs: readonly string[];
+  readonly nodes: readonly { readonly node: FactoidalNode; readonly from: readonly GraphSource[] }[];
+  readonly wireOut: string | null;
+  readonly assumptions: readonly string[];
+  readonly check: GraphCheck;
+}
+
+/** The result of run() on a graph. */
+export interface GraphRunResult<G = unknown> extends RunResult<G> {
+  /** The output of each node, in order; `graph` is the last one. */
+  values: unknown[];
+  issues: GraphIssue[];
+}
+
+/**
+ * A pipeline that is an acyclic graph of nodes with named input ports
+ * (https://github.com/danbri/factoidal/issues/1130). The engine's op
+ * graphCheckNodes checks it: a graph with an issue throws a FactoidalError
+ * (code 'op.failed') whose `issues` is the engine's list; an engine without
+ * the op throws code 'op.unknown'. Since 0.21.0.
+ */
+export function graph(spec: GraphSpec): FactoidalGraph;
+
 /**
  * Run a node or pipeline on `input` (a Wire, or the graph: text for a
  * reader, else a Dataset or data input). Rejects before any node runs when
@@ -1061,6 +1181,12 @@ export function pipe(...nodes: Array<FactoidalNode | Pipeline>): Pipeline;
  * `wireOut` (see Wire).
  */
 export function run(pipeline: FactoidalNode | Pipeline, input: unknown, options?: RunOptions): Promise<RunResult>;
+/**
+ * Run a graph on `inputs`, one value per graph input. Each node runs on the
+ * values of its sources (a node with more than one port gets them in port
+ * order); one evidence record per node, with `node` (its index) and `from`.
+ */
+export function run(graph: FactoidalGraph, inputs: unknown[], options?: RunOptions): Promise<GraphRunResult>;
 
 /** Literature-name alias for coreRdfsClosure (ρdf). */
 export function rhoDfClosure(
@@ -1374,6 +1500,10 @@ export interface Sbm11Store {
   terms: number;
   /** how the engine checks reads; undefined from a wasm module built before the Merkle check */
   verify: 'merkle' | 'none' | undefined;
+  /** the SHA-256 of the bytes of manifest.sbm11, 64 lowercase hex digits, as
+   * the engine computed it at open (pin it, then give it as
+   * `manifestSha256`); undefined from a wasm module built before issue 1105 */
+  manifestSha256: string | undefined;
   query(sparql: string, options?: { base?: string; sparql12?: boolean; reference?: boolean }): Sbm11Answer;
   /** the resources the reader read, when its reader records them (lwsSbm11Reader) */
   readonly evidence: Sbm11ReadEvidence[] | undefined;
@@ -1384,8 +1514,13 @@ export interface Sbm11Store {
  * Node: `source` is a directory unless a reader is given or registered.
  * `verify` (default 'merkle'): the engine checks every byte it decodes against
  * the manifest's Merkle roots and refuses a changed file with its name;
- * 'none' checks lengths only. */
-export function openSbm11(source: string, options?: { reader?: Sbm11Reader; verify?: 'merkle' | 'none' }): Promise<Sbm11Store>;
+ * 'none' checks lengths only.
+ * `manifestSha256`: the trust anchor, the SHA-256 of the bytes of
+ * manifest.sbm11 as 64 hex digits (https://github.com/danbri/factoidal/issues/1105);
+ * the engine refuses the open when the manifest has another digest. */
+export function openSbm11(source: string, options?: {
+  reader?: Sbm11Reader; verify?: 'merkle' | 'none'; manifestSha256?: string
+}): Promise<Sbm11Store>;
 
 /** Serve `source` with `reader`; `null` removes it. */
 export function registerSbm11Source(source: string, reader: Sbm11Reader | null): void;
@@ -1588,6 +1723,63 @@ export function xsltTransform(
   sourceXml: string
 ): Promise<string>;
 
+/** One item of an XPath 4.0 or XQuery 4.0 result. */
+export interface Qt4Item {
+  /** The item's type: `xs:integer`, `element()`, `map(*)`, `array(*)`,
+   *  `function(*)`, ... */
+  type: string;
+  /** The item serialized with the Serialization 4.0 adaptive method. */
+  value: string;
+}
+
+/** The value shape returned by {@link xpath4Eval} and {@link xqueryEval}. */
+export interface Qt4Result {
+  count: number;
+  items: Qt4Item[];
+  /** The whole sequence, Serialization 4.0 adaptive method. */
+  adaptive: string;
+  /** The whole sequence, xml method (no XML declaration); null when the
+   *  xml method cannot serialize it (a map, an array, a function). */
+  xml: string | null;
+}
+
+/**
+ * Evaluate an XPath 4.0 expression with `xmlText` as the context item
+ * ('' for no context item). The engine does no I/O: fn:doc and
+ * fn:unparsed-text of a URI fail (FODC0002, FOUT1170). A QT4 error rejects
+ * with a FactoidalError whose `qtError` names the error code.
+ */
+export function xpath4Eval(xmlText: string, expr: string): Promise<Qt4Result>;
+
+/**
+ * Evaluate an XQuery 4.0 main module, with `contextXml` as the context item
+ * when it is given and not ''. `import module` of a module that is not
+ * given fails with XQST0059; no resource is fetched.
+ */
+export function xqueryEval(query: string, contextXml?: string): Promise<Qt4Result>;
+
+/** The value shape returned by {@link xslt4Transform}. */
+export interface Xslt4Result {
+  /** The principal result, serialized with the stylesheet's unnamed output definition. */
+  output: string;
+  /** The output method used for `output` (xml, html, xhtml, text, json, adaptive, csv). */
+  method: string;
+  /** The results of xsl:result-document, each serialized with its output definition. */
+  secondary: Array<{ href: string; output: string }>;
+  /** The texts of xsl:message. */
+  messages: string[];
+}
+
+/**
+ * XSLT 4.0 transform of `sourceXml` ('' for no global context item) by a
+ * stylesheet of one module. xsl:import and xsl:include of another module
+ * fail with XTSE0165: no module is fetched.
+ */
+export function xslt4Transform(
+  stylesheetXml: string,
+  sourceXml: string
+): Promise<Xslt4Result>;
+
 /** The exact value a Content MathML expression evaluates to. */
 export type MathValue =
   | { kind: 'rat'; num: number; den: number }
@@ -1749,6 +1941,45 @@ export function vcEd25519Verify(
   signatureHex: string
 ): Promise<boolean>;
 
+/**
+ * Decrypt every xenc:EncryptedData of an XML document (XML Encryption 1.1).
+ * RSA-OAEP, ECDH-ES and X25519 run in the wasm (HACL*); AES runs in the
+ * host's WebCrypto. Every failure after the structure check is the one
+ * error "XML decryption failed".
+ */
+export function xmlDecrypt(
+  document: string,
+  options: { keys: object[]; allowCbc?: boolean }
+): Promise<{ document: string; canonical: string }>;
+
+/** Encrypt an XML document element, or its content, for one recipient. */
+export function xmlEncrypt(
+  document: string,
+  options: {
+    recipient: object;
+    algorithm?: 'aes128-gcm' | 'aes256-gcm';
+    keyTransport?: 'rsa-oaep-mgf1p' | 'rsa-oaep-sha256';
+    keyWrap?: 'kw-aes128' | 'kw-aes256';
+    content?: boolean;
+    saml?: boolean;
+  }
+): Promise<{ document: string; canonical: string }>;
+
+/**
+ * Decrypt a compact JWE (RFC 7516). Every failure after the allowlist is
+ * the one error "decryption failed".
+ */
+export function jweDecrypt(
+  token: string,
+  options: { jwk: object }
+): Promise<{ header: Record<string, unknown>; plaintext: Uint8Array }>;
+
+/** Encrypt to a compact JWE (RFC 7516). */
+export function jweEncrypt(
+  plaintext: Uint8Array | string,
+  options: { alg: string; enc: string; jwk: object; header?: Record<string, unknown> }
+): Promise<string>;
+
 /**
  * Create an eddsa-rdfc-2022 Data Integrity proofValue (multibase-z,
  * base58btc) over already-canonicalized inputs — RDFC-1.0 canonical
@@ -1817,6 +2048,70 @@ export function vcCheckRelatedResourceDigests(
   credentialJson: string
 ): Promise<{ valid: boolean; reason?: string }>;
 
+/** One failed MUST of CID 1.0 §2 (cidValidate). */
+export interface CidValidationError {
+  /** The engine's name of the failed MUST, e.g. 'idNotUrl', 'jwkPrivateMember'. */
+  code: string;
+  message: string;
+  /** RFC 6901 JSON Pointer to the member, e.g. '/verificationMethod/1/publicKeyJwk/d'; '' is the whole document. */
+  path: string;
+}
+
+/**
+ * Controlled Identifiers v1.0 §2 (https://www.w3.org/TR/cid-1.0/): check a
+ * controlled identifier document. `valid` is the engine's answer
+ * (L4Factoidal.CID.parseDocument); `errors` lists every failed MUST it found,
+ * empty when valid. Issue 1100 item 9.
+ */
+export function cidValidate(doc: string | object): Promise<{ valid: boolean; errors: CidValidationError[] }>;
+
+/** An RFC 9457 problem details object. */
+export interface CidProblem {
+  /** https://w3id.org/security#<NAME> for a §3.5 error; a tag: URI for the others. */
+  type: string;
+  title: string;
+  detail: string;
+}
+
+export interface CidRetrieveOptions {
+  /**
+   * GET the URL the engine names. Called as fetch(url, init) with
+   * init.headers.accept, init.redirect 'manual' and, when the engine chose
+   * one, init.address (the address to connect to). Answers a Response, or
+   * { status, headers: { get(name) }, text() }. Default: Node and Deno
+   * connect to init.address; a browser uses the page's fetch.
+   */
+  fetch?: (url: string, init: { method: 'GET'; headers: { accept: string }; redirect: 'manual'; address?: string }) =>
+    Promise<{ status: number; headers: { get(name: string): string | null }; text(): Promise<string> }>;
+  /** Every address of a host name. Default: the system resolver (Node, Deno); none in a browser. null: none. */
+  resolve?: ((host: string) => Promise<string[]>) | null;
+  /** Refuse a method that has expired or been revoked at this time (a Date, or seconds since the epoch). */
+  now?: Date | number;
+  /** Allow an http document URL (default: https only). */
+  allowHttp?: boolean;
+  /** Allow loopback, link-local, private and localhost addresses (default: refused). */
+  allowPrivateFetch?: boolean;
+}
+
+/**
+ * Controlled Identifiers v1.0 §3.3 Retrieve Verification Method. The engine
+ * names each fetch and decides each answer (the private-address guard of the
+ * authorization server, the status, the Content-Type: application/cid,
+ * application/cid+json, application/ld+json or application/json, then §3.3);
+ * this function does the fetch. Never rejects for a failed retrieval: it
+ * answers `ok: false` with the §3.5 name (or FETCH_REFUSED, FETCH_FAILED,
+ * UNSUPPORTED_MEDIA_TYPE, VERIFICATION_METHOD_NOT_IN_FORCE) and an RFC 9457
+ * object. Issue 1100 items 7 and 9.
+ */
+export function cidRetrieveVerificationMethod(
+  url: string,
+  relationship: 'authentication' | 'assertionMethod' | 'keyAgreement' | 'capabilityInvocation' | 'capabilityDelegation',
+  options?: CidRetrieveOptions
+): Promise<
+  | { ok: true; verificationMethod: Record<string, unknown>; controllerDocument: string }
+  | { ok: false; code: string; problem: CidProblem }
+>;
+
 /**
  * Feature probe: which ops the loaded wasm module serves. A module older
  * than this package can lack some; an operation whose op is missing
@@ -1831,6 +2126,8 @@ export function capabilities(): Promise<{
   canonicalHash: boolean;
   shacl: boolean;
   shex: boolean;
+  /** the engine has the SPARQL 1.2 RL op (datasetSparqlRlInfer) */
+  sparqlRl: boolean;
   owlClosure: boolean;
   explain: boolean;
   stages: boolean;
@@ -1838,6 +2135,10 @@ export function capabilities(): Promise<{
   pipelineCheck: boolean;
   /** The op pipelineCheckNodes: node settings in evidence, and the evaluator's output wire from the query form. */
   pipelineCheckNodes: boolean;
+  /** The op graphCheckNodes: graph() and run() of a graph, and node('datasetMerge'). */
+  graphCheck: boolean;
+  /** The op datasetMerge: datasetMerge(). */
+  datasetMerge: boolean;
   tableau: boolean;
   rml: boolean;
   csvw: boolean;
@@ -1848,6 +2149,9 @@ export function capabilities(): Promise<{
   xpath: boolean;
   rif: boolean;
   xslt: boolean;
+  xpath4: boolean;
+  xquery: boolean;
+  xslt4: boolean;
   mathml: boolean;
   xforms: boolean;
   jsonSchema: boolean;
@@ -1867,6 +2171,8 @@ export function capabilities(): Promise<{
   deltaLog: boolean;
   /** ops literalValue and literalFromValue (issue 1051). */
   literalValues: boolean;
+  /** ops cidValidate and cidRetrieve (issue 1100). */
+  cid: boolean;
   /** 'full': the whole library is in the wasm module. */
   profile: 'full' | string;
   /** The dispatch ABI version string of the loaded wasm module. */
@@ -1945,6 +2251,7 @@ declare const _default: {
   update: typeof update;
   openDataset: typeof openDataset;
   closure: typeof closure;
+  sparqlRlInfer: typeof sparqlRlInfer;
   formats: typeof formats;
   serialize: typeof serialize;
   canonicalize: typeof canonicalize;
@@ -1992,6 +2299,9 @@ declare const _default: {
   deltaLogDestroy: typeof deltaLogDestroy;
   _deltaLogCorruptLastForTest: typeof _deltaLogCorruptLastForTest;
   xsltTransform: typeof xsltTransform;
+  xpath4Eval: typeof xpath4Eval;
+  xqueryEval: typeof xqueryEval;
+  xslt4Transform: typeof xslt4Transform;
   mathmlEval: typeof mathmlEval;
   xformsRecalc: typeof xformsRecalc;
   jsonSchemaValidate: typeof jsonSchemaValidate;
@@ -2005,12 +2315,18 @@ declare const _default: {
   vcEd25519SecretToPublic: typeof vcEd25519SecretToPublic;
   vcEd25519Sign: typeof vcEd25519Sign;
   vcEd25519Verify: typeof vcEd25519Verify;
+  xmlDecrypt: typeof xmlDecrypt;
+  xmlEncrypt: typeof xmlEncrypt;
+  jweDecrypt: typeof jweDecrypt;
+  jweEncrypt: typeof jweEncrypt;
   vcEddsaCreateFromCanonical: typeof vcEddsaCreateFromCanonical;
   vcEddsaVerifyFromCanonical: typeof vcEddsaVerifyFromCanonical;
   vcCheckCredential: typeof vcCheckCredential;
   vcCheckCredentialSubject: typeof vcCheckCredentialSubject;
   vcCheckNoDataLoss: typeof vcCheckNoDataLoss;
   vcCheckRelatedResourceDigests: typeof vcCheckRelatedResourceDigests;
+  cidValidate: typeof cidValidate;
+  cidRetrieveVerificationMethod: typeof cidRetrieveVerificationMethod;
   capabilities: typeof capabilities;
   Dataset: typeof Dataset;
   Store: typeof Store;