@factoidal/core 0.20.0 → 0.22.0

package/index.mjs

@@ -25,6 +25,7 @@ import { sbm11Api, registerSbm11Source, setDefaultSbm11Reader, mapReader } from
 import { nodeDefaultReaderFactory } from './lib/sbm11-node.mjs';
 import { lwsSbm11Reader as lwsSbm11ReaderWith } from './lib/sbm11-lws.mjs';
 import { nodeSyncTransport } from './lib/sync-http-node.mjs';
+import { nodeCidHost } from './lib/cid-node.mjs';
 
 /**
  * The loaded Lean engine handle: `call(op, args)`, `callBlob`,
@@ -45,6 +46,8 @@ const api = buildApi({
   engineName: 'lean4-wasm',
   loadEntry: async () => entryFromEngine(await loadEngine()),
   storeReaderFor: (root) => (path) => readFileSync(join(root, path)),
+  // Name resolution and a GET pinned to one address (issue 1100 item 9).
+  cidHost: nodeCidHost,
 });
 
 // RDF and SPARQL
@@ -57,6 +60,7 @@ export const graphs = api.graphs;
 export const canonicalHash = api.canonicalHash;
 export const asDefaultGraph = api.asDefaultGraph;
 export const isomorphic = api.isomorphic;
+export const datasetMerge = api.datasetMerge;
 export const fromQuads = api.fromQuads;
 // Literal values (https://github.com/danbri/factoidal/issues/1051): synchronous
 // after the engine is loaded.
@@ -75,6 +79,7 @@ export const memberIri = api.memberIri;
 export const memberOrdinal = api.memberOrdinal;
 export const openDataset = api.openDataset;
 export const closure = api.closure;
+export const sparqlRlInfer = api.sparqlRlInfer;
 export const formats = api.formats;
 export const queryRaw = api.queryRaw;
 export const queryHdt = api.queryHdt;
@@ -129,6 +134,7 @@ export const explain = api.explain;
 export const stages = api.stages;
 export const node = api.node;
 export const pipe = api.pipe;
+export const graph = api.graph;
 export const run = api.run;
 export const rdfsPlusClosure = api.rdfsPlusClosure;
 export const rhoDfClosure = api.rhoDfClosure;
@@ -147,6 +153,10 @@ export const jsonldFromRdf = api.jsonldFromRdf;
 export const xmlWellformed = api.xmlWellformed;
 export const xpathEval = api.xpathEval;
 export const xsltTransform = api.xsltTransform;
+// XPath 4.0, XQuery 4.0 and XSLT 4.0 (formal/lean4/Wasm/Ops/Qt4.lean).
+export const xpath4Eval = api.xpath4Eval;
+export const xqueryEval = api.xqueryEval;
+export const xslt4Transform = api.xslt4Transform;
 export const schematronValidate = api.schematronValidate;
 export const jsonSchemaValidate = api.jsonSchemaValidate;
 export const mathmlEval = api.mathmlEval;
@@ -170,12 +180,21 @@ export const vcSha256Hex = api.vcSha256Hex;
 export const vcEd25519SecretToPublic = api.vcEd25519SecretToPublic;
 export const vcEd25519Sign = api.vcEd25519Sign;
 export const vcEd25519Verify = api.vcEd25519Verify;
+
+// XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
+export const xmlDecrypt = api.xmlDecrypt;
+export const xmlEncrypt = api.xmlEncrypt;
+export const jweDecrypt = api.jweDecrypt;
+export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;
 export const vcEddsaVerifyFromCanonical = api.vcEddsaVerifyFromCanonical;
 export const vcCheckCredential = api.vcCheckCredential;
 export const vcCheckCredentialSubject = api.vcCheckCredentialSubject;
 export const vcCheckNoDataLoss = api.vcCheckNoDataLoss;
 export const vcCheckRelatedResourceDigests = api.vcCheckRelatedResourceDigests;
+// Controlled Identifiers v1.0 (https://github.com/danbri/factoidal/issues/1100).
+export const cidValidate = api.cidValidate;
+export const cidRetrieveVerificationMethod = api.cidRetrieveVerificationMethod;
 export const didKeyResolve = api.didKeyResolve;
 
 // Types, probes and metadata

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "43c334ec5335";
+const WASM_VERSION = "b4f1a5b8cc1d";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-0c9a222bdb25-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40662145237",
-  "gitSha": "0c9a222bdb25ff70456611d3fbc87a41902d8324",
-  "builtAt": "2026-10-28T09:52:07Z",
+  "release": "danbri/factoidal-builds build-24e7d6edaa7d-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40826788173",
+  "gitSha": "24e7d6edaa7da12a9445922c949f762ddacdf17c",
+  "builtAt": "2026-10-29T07:16:14Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "43c334ec53357cd40339f693d303bda3e422ac92e94ad335cb6b0e83ec4eafbd",
-  "wasmBytes": 17958911,
+  "wasmSha256": "b4f1a5b8cc1d6d5307a836120ba8d09bc7dd7680530bb276366d47a8f95f0d12",
+  "wasmBytes": 29931615,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -30,6 +30,8 @@ import { fullEngineMessage, encodeJsValue } from './lean-entry.mjs';
 import { memoryDeltaLogStore } from './delta-log-hosts.mjs';
 import { FactoidalError, errorFromEnvelope, envelopeResult } from './errors.mjs';
 import { buildNodes } from './nodes.mjs';
+import { runWithCipher } from './cipher-host.mjs';
+import { cidFunctions } from './cid.mjs';
 
 // The format names, regimes and query outputs are the engine's tables (op
 // engineTables, formal/lean4/Wasm/Ops/Handles.lean), read once per engine:
@@ -265,6 +267,10 @@ class Store {
  *        Where the deltaLog* functions keep their records
  *        (lib/delta-log-hosts.mjs): IndexedDB in the browser entries. The
  *        default keeps them in the memory of this process.
+ * @param {object} [driver.cidHost]
+ *        Name resolution and the GET of cidRetrieveVerificationMethod
+ *        (lib/cid-node.mjs under Node and Deno). The default is the browser
+ *        host of lib/cid.mjs: the page's fetch, no name resolution.
  */
 function buildApi(driver) {
   let entryPromise; // memoized; a failed load is retried on the next call
@@ -655,6 +661,17 @@ function buildApi(driver) {
     const entail = opts.entail || 'none';
     const sparql12 = opts.sparql12 === true || String(opts.version || '') === '1.2';
     const e = c.e;
+    if (sparql12 && entail !== 'none' && opts.output === undefined) {
+      // SPARQL 1.2 under an entailment regime: the engine closes the stored
+      // dataset and runs the SPARQL 1.2 evaluator (op datasetQuery12Entail,
+      // https://github.com/danbri/factoidal/issues/1109).
+      requireEntryFn(e, 'datasetQuery12Entail', 'query {sparql12, entail}');
+      const r = await withExtensionRounds(() => entryResult(
+        e.datasetQuery12Entail(ds.handle, sparql, entail), 'query', sparql));
+      if (r.kind === 'ask') return r.boolean;
+      if (r.kind === 'construct' || r.kind === 'describe') return c.fromNQuads(r.nquads, ds.prefixes);
+      return bindingsFromSrj(r.srj);
+    }
     if (entail !== 'none' || opts.output !== undefined) {
       // queryRaw over the stored dataset: an entailment regime, or a
       // results format (SPARQL 1.1 Query Results JSON, XML, CSV, TSV).
@@ -664,15 +681,18 @@ function buildApi(driver) {
       requireEntryFn(e, 'datasetQueryRaw', `query {entail/output}`);
       if (opts.output === undefined) {
         // An entailment regime with the default answer shape.
-        const r = entryResult(e.datasetQueryRaw(ds.handle, sparql, JSON.stringify({
-          entail, output: graphForm ? 'ntriples' : 'json' })), 'query', sparql);
+        // withExtensionRounds: a registered async extension function
+        // (SPARQL 1.1 §17.6) is resolved here as in datasetQuery
+        // (https://github.com/danbri/factoidal/issues/1090).
+        const r = await withExtensionRounds(() => entryResult(e.datasetQueryRaw(ds.handle, sparql,
+          JSON.stringify({ entail, output: graphForm ? 'ntriples' : 'json' })), 'query', sparql));
         if (graphForm) return c.fromNQuads(r.text, ds.prefixes);
         const srj = JSON.parse(r.text);
         if (typeof srj.boolean === 'boolean') return srj.boolean;
         return bindingsFromSrj(srj);
       }
-      const r = entryResult(e.datasetQueryRaw(ds.handle, sparql,
-        JSON.stringify({ entail, output })), 'query', sparql);
+      const r = await withExtensionRounds(() => entryResult(e.datasetQueryRaw(ds.handle, sparql,
+        JSON.stringify({ entail, output })), 'query', sparql));
       return output === 'json' && !graphForm ? JSON.parse(r.text) : r.text;
     }
     const fn = sparql12 ? e.datasetQuery12 : e.datasetQuery;
@@ -910,17 +930,28 @@ function buildApi(driver) {
    * name first, so datasets that differ only in their graph names got the
    * same hash. To hash a graph whatever its name, use
    * canonicalHash(asDefaultGraph(g)).
-   * @param {Dataset} dataset
+   *
+   * The input is what canonicalize() takes: a Dataset, or text (a string,
+   * or {text, format, baseIRI}), with the options {format, baseIRI}. Text is
+   * a JavaScript string: characters, not bytes. Decode bytes first (the RDF
+   * text syntaxes are UTF-8: `new TextDecoder('utf-8', { fatal: true })`);
+   * a Uint8Array is refused.
+   * @param {Dataset|string|{text: string, format?: string, baseIRI?: string}} data
+   * @param {{format?: string, baseIRI?: string}} [options]
    * @returns {Promise<string>}
    */
-  async function canonicalHash(dataset) {
-    if (!(dataset instanceof Dataset)) {
-      throw new TypeError('canonicalHash: expected a Dataset');
+  async function canonicalHash(data, options) {
+    const hashOf = (e, ds) => {
+      requireEntryFn(e, 'datasetCanonicalHash', 'canonicalHash');
+      return entryResult(e.datasetCanonicalHash(ds.handle), 'canonicalHash').hash;
+    };
+    if (data instanceof Dataset && options === undefined) {
+      data.size; // throws the disposed error
+      return hashOf(data._ctx.e, data);
     }
-    dataset.size; // throws the disposed error
-    const c = dataset._ctx;
-    requireEntryFn(c.e, 'datasetCanonicalHash', 'canonicalHash');
-    return entryResult(c.e.datasetCanonicalHash(dataset.handle), 'canonicalHash').hash;
+    // The options are canonicalize()'s, checked by the engine's table for it.
+    const opts = await checkedOptions('canonicalize', optionsOf('canonicalize', options));
+    return withDataset(data, opts, 'canonicalHash', (c, ds) => hashOf(c.e, ds));
   }
 
   /**
@@ -960,6 +991,30 @@ function buildApi(driver) {
       }));
   }
 
+  /**
+   * The RDF merge of two datasets (RDF 1.1 Semantics section 5.2): a new
+   * Dataset that holds the quads of both, with the blank nodes of each input
+   * kept apart, so `_:b` in `a` and `_:b` in `b` are two blank nodes. The
+   * engine computes it (op datasetMerge, formal/lean4/Wasm/Ops/GraphNodes.lean,
+   * theorem mergeDatasets_isMerge); the prefixes are those of `a`, then those
+   * of `b` whose label `a` does not declare. A text argument is read as by
+   * parse() (`options.format`, `options.baseIRI`), in its own blank-node
+   * scope. Since 0.21.0 (https://github.com/danbri/factoidal/issues/1130).
+   * @param {Dataset|string|Array} a
+   * @param {Dataset|string|Array} b
+   * @param {{format?: string, baseIRI?: string}} [options] read text arguments
+   * @returns {Promise<Dataset>}
+   */
+  async function datasetMerge(a, b, options) {
+    // An engine built before the op refuses with op.unknown before the
+    // options are read (its option table has no row for this function).
+    requireEntryFn((await ctx()).e, 'datasetMerge', 'datasetMerge');
+    const opts = await checkedOptions('datasetMerge', optionsOf('datasetMerge', options));
+    return withDataset(a, opts, 'datasetMerge', (c, da) =>
+      withDataset(b, opts, 'datasetMerge', (_c, db) =>
+        c.wrap(entryResult(c.e.datasetMerge(da.handle, db.handle), 'datasetMerge'))));
+  }
+
   /**
    * A Dataset holding RDF/JS quads (op datasetFromQuadsJson). Each term is
    * sent as its components; the engine reads no text.
@@ -1120,6 +1175,28 @@ function buildApi(driver) {
     return withDataset(data, opts, 'closure', (c, ds) => closureOnHandle(c, ds, regime));
   }
 
+  /**
+   * SPARQL 1.2 RL (SPARQL-RL) infer: apply a rule set to the default graph
+   * of `data` and answer the inference graph (the triples the rules derive,
+   * the rule set's DATA blocks included, that are not in `data`) as a new
+   * Dataset. The rule set is SPARQL-RL text (https://w3c.github.io/data-shapes/sparql12-rl/).
+   * A rule set that is not well-formed, not stratifiable, or has IMPORTS is
+   * refused. Engine op: datasetSparqlRlInfer.
+   * @param {Dataset|string|Array} data
+   * @param {string} rules
+   * @param {{format?: string, baseIRI?: string}} [options]
+   * @returns {Promise<Dataset>}
+   */
+  async function sparqlRlInfer(data, rules, options) {
+    const opts = await checkedOptions('sparqlRlInfer', optionsOf('sparqlRlInfer', options));
+    if (typeof rules !== 'string') throw new TypeError('sparqlRlInfer: rules must be a string');
+    return withDataset(data, opts, 'sparqlRlInfer(data)', (c, ds) => {
+      requireEntryFn(c.e, 'datasetSparqlRlInfer', 'sparqlRlInfer');
+      const r = entryResult(c.e.datasetSparqlRlInfer(ds.handle, rules), 'sparqlRlInfer');
+      return c.wrap(r, ds.prefixes);
+    });
+  }
+
   /**
    * RDFS or OWL 2 RL closure of the default graph, as a new Dataset.
    * @param {Dataset|string|Array} data
@@ -1652,6 +1729,136 @@ function buildApi(driver) {
       e.vcEd25519Verify(publicKeyHex, messageHex, signatureHex), 'vcEd25519Verify').valid;
   }
 
+  // -----------------------------------------------------------------
+  // XML Encryption 1.1 and JWE (https://github.com/danbri/factoidal/issues/1084,
+  // https://github.com/danbri/factoidal/issues/1085). Every decision is in
+  // Lean (formal/lean4/Wasm/Ops/XmlEnc.lean, Wasm/Ops/Jwe.lean); RSA, P-256
+  // and X25519 run in the wasm (HACL*). AES runs in this host's WebCrypto:
+  // runWithCipher (lib/cipher-host.mjs) answers each request the engine
+  // makes and calls the op again. This code converts bytes to base64 and
+  // draws random bytes; it reads no document and chooses nothing.
+  // -----------------------------------------------------------------
+
+  // The most random octets any of these ops reads (Jwe.randomBytesNeeded is
+  // at most 112; xmlEncrypt reads at most 76).
+  const CIPHER_RANDOM_BYTES = 112;
+
+  function bytesToBase64(bytes) {
+    let bin = '';
+    for (let i = 0; i < bytes.length; i += 0x8000) {
+      bin += String.fromCharCode.apply(null, bytes.subarray(i, i + 0x8000));
+    }
+    return btoa(bin);
+  }
+
+  function base64ToBytes(text) {
+    const bin = atob(text);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  }
+
+  function randomBase64(n) {
+    const b = new Uint8Array(n);
+    globalThis.crypto.getRandomValues(b);
+    return bytesToBase64(b);
+  }
+
+  // One op that may ask for AES: the engine's envelope after every request
+  // is answered; a refusal throws a FactoidalError.
+  async function cipherOp(fnName, what, args) {
+    const e = await entry();
+    requireEntryFn(e, fnName, what);
+    const res = await runWithCipher((a) => JSON.parse(e[fnName](JSON.stringify(a))), args);
+    return entryResult(JSON.stringify(res), fnName);
+  }
+
+  function checkKeys(fnName, keys) {
+    if (!Array.isArray(keys) || !keys.every((k) => k !== null && typeof k === 'object')) {
+      throw new TypeError(`${fnName}: keys must be an array of JWK objects`);
+    }
+  }
+
+  /**
+   * Decrypt every xenc:EncryptedData of an XML document (XML Encryption 1.1).
+   * Allowlist and key forms: API.md "XML Encryption and JWE".
+   * @param {string} document the XML document
+   * @param {{keys: object[], allowCbc?: boolean}} options private JWKs
+   *   (`kid` is the ds:KeyName); `allowCbc` admits aes128-cbc and aes256-cbc
+   * @returns {Promise<{document: string, canonical: string}>}
+   */
+  async function xmlDecrypt(document, options) {
+    if (typeof document !== 'string') throw new TypeError('xmlDecrypt: document must be a string');
+    const o = options || {};
+    checkKeys('xmlDecrypt', o.keys);
+    const r = await cipherOp('xmlDecrypt', 'XML decryption',
+      { document, keys: o.keys, allowCbc: o.allowCbc === true });
+    return { document: r.document, canonical: r.canonical };
+  }
+
+  /**
+   * Encrypt the document element (or, with `content`, its content) of an XML
+   * document for one recipient (XML Encryption 1.1, AES-GCM content).
+   * @param {string} document the XML document
+   * @param {{recipient: object, algorithm?: 'aes128-gcm'|'aes256-gcm',
+   *   keyTransport?: 'rsa-oaep-mgf1p'|'rsa-oaep-sha256', keyWrap?: 'kw-aes128'|'kw-aes256',
+   *   content?: boolean, saml?: boolean}} options `recipient` is a public JWK
+   *   (RSA, EC P-256, OKP X25519) or an `oct` key; `saml` wraps the result in
+   *   saml:EncryptedAssertion
+   * @returns {Promise<{document: string, canonical: string}>}
+   */
+  async function xmlEncrypt(document, options) {
+    if (typeof document !== 'string') throw new TypeError('xmlEncrypt: document must be a string');
+    const o = options || {};
+    if (o.recipient === null || typeof o.recipient !== 'object') {
+      throw new TypeError('xmlEncrypt: options.recipient must be a JWK object');
+    }
+    const args = { document, recipient: o.recipient, random: randomBase64(CIPHER_RANDOM_BYTES) };
+    for (const k of ['algorithm', 'keyTransport', 'keyWrap']) if (o[k] !== undefined) args[k] = o[k];
+    if (o.content === true) args.content = true;
+    if (o.saml === true) args.saml = true;
+    const r = await cipherOp('xmlEncrypt', 'XML encryption', args);
+    return { document: r.document, canonical: r.canonical };
+  }
+
+  /**
+   * Decrypt a JWE in the Compact Serialization (RFC 7516).
+   * @param {string} token the compact JWE
+   * @param {{jwk: object}} options the recipient's private JWK
+   * @returns {Promise<{header: object, plaintext: Uint8Array}>}
+   */
+  async function jweDecrypt(token, options) {
+    if (typeof token !== 'string') throw new TypeError('jweDecrypt: token must be a string');
+    const o = options || {};
+    if (o.jwk === null || typeof o.jwk !== 'object') throw new TypeError('jweDecrypt: options.jwk must be a JWK object');
+    const r = await cipherOp('jweDecrypt', 'JWE decryption', { token, jwk: o.jwk });
+    return { header: r.header, plaintext: base64ToBytes(r.plaintext) };
+  }
+
+  /**
+   * Encrypt to a JWE in the Compact Serialization (RFC 7516).
+   * @param {Uint8Array|string} plaintext bytes, or text written as UTF-8
+   * @param {{alg: string, enc: string, jwk: object, header?: object}} options
+   *   the recipient's public JWK (or the `oct` key for A128KW, A256KW, dir);
+   *   `header`: more protected header members
+   * @returns {Promise<string>} the compact JWE
+   */
+  async function jweEncrypt(plaintext, options) {
+    let bytes;
+    if (typeof plaintext === 'string') bytes = new TextEncoder().encode(plaintext);
+    else if (plaintext instanceof Uint8Array) bytes = plaintext;
+    else throw new TypeError('jweEncrypt: plaintext must be a Uint8Array or a string');
+    const o = options || {};
+    if (typeof o.alg !== 'string' || typeof o.enc !== 'string') {
+      throw new TypeError('jweEncrypt: options.alg and options.enc must be strings');
+    }
+    if (o.jwk === null || typeof o.jwk !== 'object') throw new TypeError('jweEncrypt: options.jwk must be a JWK object');
+    const args = { alg: o.alg, enc: o.enc, jwk: o.jwk, plaintext: bytesToBase64(bytes),
+      random: randomBase64(CIPHER_RANDOM_BYTES) };
+    if (o.header !== undefined) args.header = o.header;
+    return (await cipherOp('jweEncrypt', 'JWE encryption', args)).token;
+  }
+
   /**
    * Create an eddsa-rdfc-2022 Data Integrity proofValue over an
    * already-canonicalized document + proof config (entry_jsoo.ml's
@@ -1826,6 +2033,67 @@ function buildApi(driver) {
     return r.output;
   }
 
+  // XPath 4.0, XQuery 4.0 and XSLT 4.0 (formal/lean4/Wasm/Ops/Qt4.lean). The
+  // engine evaluates and serializes; these functions check argument types and
+  // unwrap the envelope. A QT4 error rejects with a FactoidalError (code
+  // `xml.failed`) whose `qtError` is {code, namespace, message}: the error
+  // code the specification names (XPST0003, FODC0002, XTSE0165, ...).
+  // The engine does no I/O: fn:doc, fn:unparsed-text, import module,
+  // xsl:import and xsl:include of anything but the arguments fail with the
+  // specification's error code.
+  function qt4Result(r) {
+    const { ok: _ok, ...rest } = r;
+    return rest;
+  }
+
+  /**
+   * Evaluate an XPath 4.0 expression with an XML document as context item.
+   * @param {string} xmlText the context document, or '' for no context item
+   * @param {string} expr an XPath 4.0 expression
+   * @returns {Promise<{count:number, items:Array<{type:string,value:string}>, adaptive:string, xml:string|null}>}
+   */
+  async function xpath4Eval(xmlText, expr) {
+    if (typeof xmlText !== 'string' || typeof expr !== 'string') {
+      throw new TypeError('xpath4Eval: xmlText and expr must be strings');
+    }
+    const e = await entry();
+    requireEntryFn(e, 'xpath4Eval', 'XPath 4.0 evaluation');
+    return qt4Result(entryResult(e.xpath4Eval(xmlText, expr), 'xpath4Eval'));
+  }
+
+  /**
+   * Evaluate an XQuery 4.0 main module, optionally with an XML document as
+   * context item.
+   * @param {string} query an XQuery 4.0 main module
+   * @param {string} [contextXml] the context document ('' or absent: none)
+   * @returns {Promise<{count:number, items:Array<{type:string,value:string}>, adaptive:string, xml:string|null}>}
+   */
+  async function xqueryEval(query, contextXml) {
+    if (typeof query !== 'string' || (contextXml !== undefined && typeof contextXml !== 'string')) {
+      throw new TypeError('xqueryEval: query must be a string, contextXml a string when given');
+    }
+    const e = await entry();
+    requireEntryFn(e, 'xqueryEval', 'XQuery 4.0 evaluation');
+    return qt4Result(entryResult(e.xqueryEval(query, contextXml ?? ''), 'xqueryEval'));
+  }
+
+  /**
+   * XSLT 4.0 transform. The principal result is serialized with the
+   * stylesheet's unnamed output definition; `secondary` holds the results of
+   * xsl:result-document, `messages` the xsl:message texts.
+   * @param {string} stylesheetXml an XSLT stylesheet (one module)
+   * @param {string} sourceXml the source document, or '' for no global context item
+   * @returns {Promise<{output:string, method:string, secondary:Array<{href:string,output:string}>, messages:string[]}>}
+   */
+  async function xslt4Transform(stylesheetXml, sourceXml) {
+    if (typeof stylesheetXml !== 'string' || typeof sourceXml !== 'string') {
+      throw new TypeError('xslt4Transform: stylesheetXml and sourceXml must be strings');
+    }
+    const e = await entry();
+    requireEntryFn(e, 'xslt4Transform', 'XSLT 4.0 transform');
+    return qt4Result(entryResult(e.xslt4Transform(stylesheetXml, sourceXml), 'xslt4Transform'));
+  }
+
   /**
    * Evaluate a Content MathML document (entry_jsoo.ml's mathmlEval
    * export -> MathML.Content.eval_doc_env). `bindings` maps
@@ -2282,11 +2550,14 @@ function buildApi(driver) {
       // ops it actually has.
       shacl: has('shaclValidate'),
       shex: has('shexValidate'),
+      sparqlRl: has('datasetSparqlRlInfer'),
       owlClosure: has('owlClosure'),
       explain: has('explainGraph'),
       stages: has('stageList'),
       pipelineCheck: has('pipelineCheck'),
       pipelineCheckNodes: has('pipelineCheckNodes'),
+      graphCheck: has('graphCheckNodes'),
+      datasetMerge: has('datasetMerge'),
       entailment: has('queryRaw'),
       tableau: has('tableauMaterialise') && has('tableauDlInconsistent'),
       rml: has('rmlMap'),
@@ -2298,6 +2569,9 @@ function buildApi(driver) {
       xpath: has('xpathEval'),
       rif: has('rifEval'),
       xslt: has('xsltTransform'),
+      xpath4: has('xpath4Eval'),
+      xquery: has('xqueryEval'),
+      xslt4: has('xslt4Transform'),
       mathml: has('mathmlEval'),
       xforms: has('xformsRecalc'),
       jsonSchema: has('jsonSchemaValidate'),
@@ -2318,6 +2592,7 @@ function buildApi(driver) {
       store: has('storeOpen') && has('storeHandleQuery'),
       deltaLog: has('deltaLogEncode') && has('deltaLogDecode') && has('deltaLogMerge'),
       literalValues: has('literalValue') && has('literalFromValue'),
+      cid: has('cidValidate') && has('cidRetrieve'),
     };
   }
 
@@ -2421,8 +2696,12 @@ function buildApi(driver) {
   const nodeApi = buildNodes({
     entry, entryResult, requireEntryFn, Dataset,
     parse, closure, shaclValidate, query, serialize, canonicalize, canonicalHash, explain, csvwToRdf,
+    datasetMerge,
   });
 
+  // Controlled Identifiers v1.0 (lib/cid.mjs, issue 1100 items 7 and 9).
+  const cid = cidFunctions({ entry, entryResult, requireEntryFn, host: driver.cidHost });
+
   return {
     parse,
     query,
@@ -2443,6 +2722,7 @@ function buildApi(driver) {
     asDefaultGraph,
     shaclValidate,
     shexValidate,
+    sparqlRlInfer,
     owlClosure,
     coreRdfsClosure,
     coreRdfsCheck,
@@ -2450,6 +2730,7 @@ function buildApi(driver) {
     stages: nodeApi.stages,
     node: nodeApi.node,
     pipe: nodeApi.pipe,
+    graph: nodeApi.graph,
     run: nodeApi.run,
     rdfsPlusClosure,
     rhoDfClosure,
@@ -2471,6 +2752,9 @@ function buildApi(driver) {
     clNormalize,
     rifEval,
     xsltTransform,
+    xpath4Eval,
+    xqueryEval,
+    xslt4Transform,
     mathmlEval,
     xformsRecalc,
     jsonSchemaValidate,
@@ -2484,12 +2768,18 @@ function buildApi(driver) {
     vcEd25519SecretToPublic,
     vcEd25519Sign,
     vcEd25519Verify,
+    xmlDecrypt,
+    xmlEncrypt,
+    jweDecrypt,
+    jweEncrypt,
     vcEddsaCreateFromCanonical,
     vcEddsaVerifyFromCanonical,
     vcCheckCredential,
     vcCheckCredentialSubject,
     vcCheckNoDataLoss,
     vcCheckRelatedResourceDigests,
+    cidValidate: cid.cidValidate,
+    cidRetrieveVerificationMethod: cid.cidRetrieveVerificationMethod,
     capabilities,
     openStore,
     queryStore,
@@ -2503,6 +2793,7 @@ function buildApi(driver) {
     _deltaLogCorruptLastForTest,
     queryRaw,
     isomorphic,
+    datasetMerge,
     fromQuads,
     literalValue,
     isValidLiteral,

package/lib/browser-engine.mjs

@@ -13,6 +13,18 @@
 //
 // No Node built-ins: the browser imports this file as it is.
 
+import { checkEngineStamp } from './engine-integrity.mjs';
+
+// version.json next to the engine, or null (absent, unreadable, not JSON).
+async function stampOf(url) {
+  try {
+    const r = await fetch(url);
+    return r.ok ? await r.json() : null;
+  } catch {
+    return null;
+  }
+}
+
 async function instantiate(url, imports) {
   try {
     return await WebAssembly.instantiateStreaming(fetch(url), imports);
@@ -59,7 +71,22 @@ export function browserEngine(name, defaultAssetsUrl) {
       // newer loader (the loader's own locateFile does the same).
       const version = loader.wasmVersion ? `?v=${loader.wasmVersion}` : '';
       const wasmUrl = new URL(`${name}.wasm`, assetsUrl).href + version;
-      return loader.loadL4({ instantiateWasm: (imports) => instantiate(wasmUrl, imports) });
+      // The release stamp check (engine-integrity.mjs, issue 1106): with a
+      // stamped version.json next to the full engine, its bytes are hashed
+      // before they are compiled (no streaming compile then). Without one,
+      // the streaming path as before.
+      const stamp = name === 'l4factoidal'
+        ? await stampOf(new URL('version.json', assetsUrl).href + version) : null;
+      if (!stamp || stamp.stamped !== true) {
+        return loader.loadL4({ instantiateWasm: (imports) => instantiate(wasmUrl, imports) });
+      }
+      const response = await fetch(wasmUrl);
+      if (!response.ok) {
+        throw new Error(`factoidal: fetching ${wasmUrl} failed: ${response.status} ${response.statusText}`);
+      }
+      const bytes = new Uint8Array(await response.arrayBuffer());
+      await checkEngineStamp(bytes, stamp, { where: wasmUrl });
+      return loader.loadL4({ instantiateWasm: (imports) => WebAssembly.instantiate(bytes, imports) });
     })();
     enginePromise.catch(() => { enginePromise = null; });
     return enginePromise;