@factoidal/core 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.28.0 (2026-10-31)
+
+- The public LWS SBM11 reader rejects resource paths that escape its configured container before calling transport. Default Node HTTP reads refuse redirects. Browser default XHR now rejects caller-supplied headers, including authorization; authenticated browser use requires an explicit trusted, redirect-safe transport. Custom transports remain responsible for redirect and credential policy. WebDAV read-only behavior is unchanged.
+- The Lean HTML parser improvements merged in PR269 now reach the package, including processing instructions, namespace/template handling and public parse-html regressions. This is parser support, not a browser layout engine or a claim of complete HTML conformance.
+- Valid zero-second IETF dates no longer emit panic diagnostics. The targeted native fn-parse-ietf-date set passes 105 cases.
+- Bounded slice and positional consumers of fn:generate evaluate finite prefixes without increasing the generation cap. Native fn-generate improves from 13 pass / 3 fail to 15 pass / 1 fail; the constructed-node identity failure remains visible. All 104 fn-slice cases pass. These targeted native results are not whole-catalog WASM conformance claims.
+
+Native server executables and the SVG graphics experiment have separate release gates; this package version does not claim new executable or SVG compatibility coverage.
+
+## 0.27.0 (2026-10-30)
+
+- New CLI commands `factoidal xpath4`, `factoidal xquery` and `factoidal xslt4` expose the existing Lean XML operations. They accept explicit local input files, display JSON or the engine's serialized result, and preserve QT4 error codes such as `XPST0003`. See the README for arguments and examples.
+- The public dataflow API now has `xpath4Eval`, `xqueryEval` and `xslt4Transform` nodes. Their output wires carry serialized XDM or XSLT results. These nodes are marked tested, with `checked: false` evidence; no evaluator correctness theorem is claimed. Existing registry IDs are preserved.
+- Public `xpath4Eval` and `xqueryEval` now install the pure inline `fn:transform` adapter already used by the QT4 harness. It supports supplied source nodes and stylesheet text without fetching external resources. Assertions default to disabled for `fn:transform` and can be enabled explicitly; direct `xslt4Transform` retains its enabled default. A nested `fn:transform` inside a `post-process` callback remains unsupported (`FOXT0004`).
+- QT4 fixes include assertion handling, QName environments and nested-transform resource bases (https://github.com/danbri/factoidal-core/pull/268). The native `fn-transform` set improves from 127 pass / 9 fail / 1 unsupported to 132 / 4 / 1. XPath grapheme behavior remains Unicode 15.1, with 1,189 / 0 / 0 on the pinned QT4 set. These are native measurements, not full WASM conformance claims.
+- Schema-aware `fn:element-to-map` now uses schema components and typed values, including inherited declarations and conversions (https://github.com/danbri/factoidal-core/pull/270). Native QT4 results improve from 186 pass / 35 fail / 0 unsupported to 219 / 2 / 0; the two remaining fixture/specification disagreements remain visible. Schema-driven behavior requires a validating host and is not newly exposed through the pure public API.
+
+The XProc atomic-step bridge to the Lean dataflow graph remains available in the Lean tree; this release adds no npm XProc operation. Native server executable publication is separate and remains blocked by the WebDAV regression failures tracked in https://github.com/danbri/factoidal/issues/1202.
+
 ## 0.26.0 (2026-10-29)
 
 - QT4 processor feature switches (https://github.com/danbri/factoidal-core/pull/252): the native qt4tests runner can run as a processor without a feature, so the tests written for such processors run instead of being unsupported; qt4tests in XQuery mode, measured on that PR: `fn` 17188 → 17217 pass, `prod` 13819 → 13823 pass, no new failures.

package/README.md

@@ -123,6 +123,50 @@ console.log(r.assumptions, r.proved);       // what the answer depends on
 and marks those steps in the evidence. Details: API.md, "Stages as nodes" and
 "Explaining an entailment" (`explain()` is the same check as one call).
 
+### XPath, XQuery and XSLT 4.0
+
+`xpath4Eval(xml, expression)`, `xqueryEval(query, xml?)`, and
+`xslt4Transform(stylesheet, xml)` use the same Lean engines as the native
+XML test runners. They also have nodes named `xpath4Eval`, `xqueryEval`, and
+`xslt4Transform`. Each node reads XML context **text** (`''` means no context)
+and requires its one string setting: `expression`, `query`, or `stylesheet`.
+
+```js
+import { node, run } from '@factoidal/core';
+
+const evaluate = await node('xpath4Eval', { expression: 'count(//person)' });
+const result = await run(evaluate, '<people><person/></people>', { unchecked: true });
+console.log(result.graph.xml); // '1', serialized by Lean
+console.log(result.proved);    // false: this adapter is tested, with no stage contract
+```
+
+XPath/XQuery nodes output `Qt4Result` (`count`, typed serialized `items`,
+`adaptive`, nullable `xml`), not live XDM values. XSLT nodes output `Xslt4Result`
+(`output`, `method`, `secondary`, `messages`); text or JSON results are not
+mislabelled as XML. There is no implicit result-to-input conversion. Unknown
+or wrongly typed settings fail in Lean. Under the existing node policy these
+tested nodes can run, but return `proved: false` and `checked: false` evidence.
+`unchecked: true` additionally records the explicit opt-in and its reason;
+neither mode claims a proved evaluator contract.
+
+The CLI has `factoidal xpath4 EXPRESSION`, `factoidal xquery QUERY` (or
+`--file PATH`), and `factoidal xslt4 STYLESHEET_FILE`. Each accepts
+`--input XML_FILE`; omission supplies no context item. Default output is the
+engine's JSON envelope. XPath/XQuery accept `--format adaptive|xml`; XSLT
+accepts `--format output` for the principal serialization. `--help` describes
+the complete syntax. QT4 failures exit 1 and retain the error QName in JSON
+on stderr; usage failures exit 2. Secondary results stay in the JSON envelope
+and are not written to files.
+
+Inline `fn:transform` uses the existing pure XSLT adapter, including its
+`enable-assertions` option (default false). Direct `xslt4Transform` retains
+enabled assertions. Calling `fn:transform` from its own `post-process`
+callback currently fails with `FOXT0004`; callback reentrancy is not provided.
+No stylesheet/module/resource fetch or schema provider
+is added. Schema-dependent PSVI tests and XProc execution remain native/
+host-dependent: the Lean XProc 3.1 reader and atomic dataflow bridge exist,
+but there is no public npm XProc WASM entry point.
+
 Formats (generated from `formats()`):
 
 <!-- formats-table:start (generated by test/formats-table.test.mjs) -->

package/bin/factoidal.mjs

@@ -37,6 +37,7 @@ import {
 } from './store.mjs'
 import { sbm11Api, setDefaultSbm11Reader } from '../lib/sbm11.mjs'
 import { nodeDefaultReaderFactory } from '../lib/sbm11-node.mjs'
+import { runQt4, Qt4UsageError } from './qt4.mjs'
 
 const EXIT_OK = 0
 const EXIT_FAILURE = 1
@@ -108,6 +109,9 @@ commands:
   sample-store [DIR]          pack a small built-in store and print its path
   inspect  STORE              report what the activated manifest commits
   query    STORE [QUERY]      evaluate a SPARQL query against a store
+  xpath4   EXPRESSION         XPath 4.0 over --input XML_FILE (optional)
+  xquery   QUERY              XQuery 4.0 over --input XML_FILE (optional)
+  xslt4    STYLESHEET_FILE    XSLT 4.0 over --input XML_FILE (optional)
   pack     INPUT OUTPUT       build one immutable generation from an RDF file
   activate STORE GENERATION   make one generation the activated generation
   update   STORE [UPDATE]     apply a SPARQL Update through the delta log
@@ -146,6 +150,23 @@ an RDF file with pack and activate, or try a small built-in one:
   factoidal query "$(factoidal sample-store)" 'SELECT * WHERE { ?s ?p ?o } LIMIT 5'`
 
 const COMMAND_USAGE = {
+  xpath4: `factoidal xpath4 - evaluate XPath 4.0
+usage: factoidal xpath4 [EXPRESSION] [--expression TEXT | --file PATH] [--input XML_FILE] [--format json|adaptive|xml]
+Supply exactly one expression source. No --input means no context item.
+Default output is the engine's JSON result, including typed serialized items.
+--format xml fails if XML serialization is unavailable (for example maps).
+Only explicitly named files are read. External resources and schema providers are not supplied.`,
+  xquery: `factoidal xquery - evaluate XQuery 4.0
+usage: factoidal xquery [QUERY] [--query TEXT | --file PATH] [--input XML_FILE] [--format json|adaptive|xml]
+Supply exactly one query source. No --input means no context item.
+Default output is the engine's JSON result; display serializations come from Lean.
+External modules/resources and schema providers are not supplied.`,
+  xslt4: `factoidal xslt4 - transform with XSLT 4.0
+usage: factoidal xslt4 [STYLESHEET_FILE] [--stylesheet PATH] [--input XML_FILE] [--format json|output]
+Supply exactly one stylesheet file. No --input means no global context item.
+Default JSON includes principal output, method, secondary results and messages.
+--format output prints only the principal output. Secondary results are never written to files.
+External stylesheet modules/resources and schema providers are not supplied.`,
   'sample-store': `factoidal sample-store - pack a small built-in store, print its path
 
 usage: factoidal sample-store [DIR] [--json]
@@ -1132,6 +1153,9 @@ class UsageError extends Error {}
 const REPEATABLE_OPTIONS = new Set(['cors-origin', 'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin'])
 
 const VALUE_OPTIONS = {
+  xpath4: new Set(['expression', 'file', 'input', 'format']),
+  xquery: new Set(['query', 'file', 'input', 'format']),
+  xslt4: new Set(['stylesheet', 'input', 'format']),
   version: new Set([]),
   'sample-store': new Set([]),
   inspect: new Set(['generation']),
@@ -2965,7 +2989,16 @@ async function commandLwsClient (positional, options) {
   return EXIT_OK
 }
 
+const qt4Host = {
+  loadEngine,
+  readText: (path) => new TextDecoder('utf-8', { fatal: true }).decode(readWhole(path)),
+  out, err,
+}
+
 const COMMANDS = {
+  xpath4: (positional, options) => runQt4('xpath4', positional, options, qt4Host),
+  xquery: (positional, options) => runQt4('xquery', positional, options, qt4Host),
+  xslt4: (positional, options) => runQt4('xslt4', positional, options, qt4Host),
   version: (positional, options) => commandVersion(options),
   'sample-store': (positional, options) => commandSampleStore(positional, options),
   inspect: commandInspect,
@@ -3017,7 +3050,7 @@ async function main () {
   try {
     parsed = parseArguments(argv.slice(1), VALUE_OPTIONS[command])
   } catch (error) {
-    if (error instanceof UsageError) {
+    if (error instanceof UsageError || error instanceof Qt4UsageError) {
       err(`factoidal ${command}: ${error.message}`)
       return EXIT_USAGE
     }
@@ -3034,7 +3067,7 @@ async function main () {
   try {
     return await COMMANDS[command](parsed.positional, parsed.options)
   } catch (error) {
-    if (error instanceof UsageError) {
+    if (error instanceof UsageError || error instanceof Qt4UsageError) {
       err(`factoidal ${command}: ${error.message}`)
       err('')
       err(COMMAND_USAGE[command])

package/bin/qt4.mjs

@@ -0,0 +1,49 @@
+// CLI transport only: read explicit files, call the existing Lean operation,
+// display its JSON/serialization, and preserve the engine's QT4 error QName.
+import { errorFromEnvelope } from '../lib/errors.mjs';
+
+export class Qt4UsageError extends Error {}
+
+export async function runQt4(command, positional, options, host) {
+  const transform = command === 'xslt4';
+  const key = transform ? 'stylesheet' : command === 'xpath4' ? 'expression' : 'query';
+  const allowed = new Set([key, 'input', 'format', 'help', ...(transform ? [] : ['file'])]);
+  for (const option of Object.keys(options)) {
+    if (!allowed.has(option)) throw new Qt4UsageError(`unknown option --${option}`);
+  }
+  if (positional.length > 1) throw new Qt4UsageError('expected at most one positional argument');
+  const sources = [positional[0], options[key], options.file].filter((value) => value !== undefined);
+  if (sources.length !== 1 || typeof sources[0] !== 'string') {
+    throw new Qt4UsageError(`supply exactly one ${key}${transform ? ' file' : ' text or --file PATH'}`);
+  }
+  if (options.input !== undefined && typeof options.input !== 'string') throw new Qt4UsageError('--input needs a file path');
+  const format = options.format ?? 'json';
+  const formats = transform ? ['json', 'output'] : ['json', 'adaptive', 'xml'];
+  if (!formats.includes(format)) throw new Qt4UsageError(`--format must be ${formats.join(', ')}`);
+  try {
+    const expression = transform || options.file !== undefined ? host.readText(sources[0]) : sources[0];
+    const input = options.input === undefined ? '' : host.readText(options.input);
+    const op = transform ? 'xslt4Transform' : command === 'xpath4' ? 'xpath4Eval' : 'xqueryEval';
+    const args = command === 'xpath4' ? [input, expression] : [expression, input];
+    const result = (await host.loadEngine()).call(op, args);
+    if (format === 'json') host.out(JSON.stringify(result, null, 2));
+    else {
+      const text = result[format];
+      if (text === null || typeof text !== 'string') {
+        host.err(`factoidal ${command}: result has no ${format} serialization; use --format json`);
+        return 1;
+      }
+      host.out(text);
+    }
+    return 0;
+  } catch (error) {
+    // loadL4.call throws a plain Error with the original envelope. API wrappers
+    // normalize it separately; the direct CLI call must preserve it here too.
+    const envelope = error?.envelope;
+    const problem = envelope && typeof envelope === 'object' && envelope.ok === false
+      ? errorFromEnvelope(envelope) : error;
+    host.err(JSON.stringify({ error: String(problem?.message ?? problem),
+      ...(problem?.code ? { code: problem.code } : {}), ...(problem?.qtError ? { qtError: problem.qtError } : {}) }));
+    return 1;
+  }
+}

package/index.d.ts

@@ -971,6 +971,7 @@ export interface EvidenceRecord {
  * `wireOut`: a Dataset for the graph wires, text for String (a writer), the
  * rows for Table (SELECT), a boolean for Answer (ASK), `[canonical, sha256]`
  * for String × String (rdfcStage), the report object for ValidationReport,
+ * a Qt4Result for Serialized XDM result, or an Xslt4Result for XSLT result,
  * the explain result for ExplainGraphResult. Since 0.20.0; before, a node
  * whose output was not a Dataset left its input on the wire.
  */
@@ -985,7 +986,12 @@ export interface NodePort {
   readonly wire: string;
 }
 
-/** A node: a registered stage with its parameters. */
+/** A node: a registered stage with its parameters. Public XML adapters use
+ * `xpath4Eval` with {expression}, `xqueryEval` with {query}, or
+ * `xslt4Transform` with {stylesheet}; each reads XML context text and has
+ * status tested, checked:false evidence and no proved evaluator contract.
+ * Their serialized output types are Qt4Result and Xslt4Result (see Wire).
+ */
 export interface FactoidalNode {
   readonly stage: string;
   readonly kind: string | null;
@@ -1550,14 +1556,21 @@ export interface Sbm11ReadEvidence {
   bytes: number;
 }
 
-/** A synchronous HTTP GET: `(url, headers) -> answer`. */
+/** A trusted synchronous HTTP GET: `(url, headers) -> answer`.
+ * It must refuse redirects before forwarding scoped headers. */
 export type Sbm11Transport = (url: string, headers: Record<string, string>) =>
   { status: number; header(name: string): string | null; bytes: Uint8Array };
 
 /** A reader of the SBM11 files held as LWS resources under the container
  * `url` (one resource per file, CURRENT a resource too), by HTTP Range GETs
  * when the server answers 206, else by whole GETs kept in memory. Node: the
- * default transport is a fetch in a worker thread; close() stops it. */
+ * default transport is a fetch in a worker thread that refuses redirects;
+ * close() stops it. `url` must be absolute HTTP(S), without userinfo, query
+ * or fragment. File arguments are raw relative paths; invalid paths return
+ * null before transport and appear in errors().
+ * Browser worker default XHR accepts no caller auth/headers; provide an explicit
+ * trusted transport for those. Its final-URL check cannot prevent an already
+ * sent anonymous request or ambient same-origin browser cookies. */
 export function lwsSbm11Reader(url: string, opts?: {
   auth?: string; headers?: Record<string, string>; transport?: Sbm11Transport; timeoutMs?: number
 }): Sbm11Reader & { evidence(): Sbm11ReadEvidence[]; errors(): string[]; close(): void };

package/index.mjs

@@ -107,7 +107,12 @@ export { registerSbm11Source, mapReader };
 export function lwsSbm11Reader(url, opts = {}) {
   if (typeof opts.transport === 'function') return lwsSbm11ReaderWith(url, opts);
   const transport = nodeSyncTransport({ timeoutMs: opts.timeoutMs });
-  return lwsSbm11ReaderWith(url, { ...opts, transport, onClose: () => transport.close() });
+  try {
+    return lwsSbm11ReaderWith(url, { ...opts, transport, onClose: () => transport.close() });
+  } catch (error) {
+    transport.close();
+    throw error;
+  }
 }
 
 // The persisted store

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "7873155103b0";
+const WASM_VERSION = "5ca09ab0343e";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-7a58d9502ab5-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/40865738991",
-  "gitSha": "7a58d9502ab5487b7694459d775b6f7d2997d3b4",
-  "builtAt": "2026-10-29T12:11:59Z",
+  "release": "danbri/factoidal-builds build-e5057984e388-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/41154673265",
+  "gitSha": "e5057984e388be6534fef19cdbb869b5b5652a17",
+  "builtAt": "2026-10-31T02:40:08Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "7873155103b0243c0ad9723392015fe262d3ffa4ce4b8d59208a5027b550ea65",
-  "wasmBytes": 30091835,
+  "wasmSha256": "5ca09ab0343eac5cfea0295461af8c4ea963a8bf083afc6f3aeadf1f92ef4804",
+  "wasmBytes": 30629431,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -2696,7 +2696,7 @@ function buildApi(driver) {
   const nodeApi = buildNodes({
     entry, entryResult, requireEntryFn, Dataset,
     parse, closure, shaclValidate, query, serialize, canonicalize, canonicalHash, explain, csvwToRdf,
-    datasetMerge,
+    datasetMerge, xpath4Eval, xqueryEval, xslt4Transform,
   });
 
   // Controlled Identifiers v1.0 (lib/cid.mjs, issue 1100 items 7 and 9).

package/lib/nodes.mjs

@@ -66,7 +66,7 @@ import { refusalFor, makeRecord, summarize, unionAssumptions, unionLists } from
 export function buildNodes(deps) {
   const { entry, entryResult, requireEntryFn, Dataset,
     parse, closure, shaclValidate, query, serialize, canonicalize, canonicalHash, explain, csvwToRdf,
-    datasetMerge } = deps;
+    datasetMerge, xpath4Eval, xqueryEval, xslt4Transform } = deps;
 
   const reader = (format) => async (wire, params) => {
     if (typeof wire.graph !== 'string') {
@@ -92,6 +92,15 @@ export function buildNodes(deps) {
   // node's output wire (FactoidalNode.wireOut, the engine's), which run()
   // checks (wireHolds); `artefact` goes in the evidence record.
   const RUNNERS = {
+    xpath4Eval: async (wire, params) => ({
+      graph: await xpath4Eval(wire.graph, params.expression), artefact: { operation: 'xpath4Eval' },
+    }),
+    xqueryEval: async (wire, params) => ({
+      graph: await xqueryEval(params.query, wire.graph), artefact: { operation: 'xqueryEval' },
+    }),
+    xslt4Transform: async (wire, params) => ({
+      graph: await xslt4Transform(params.stylesheet, wire.graph), artefact: { operation: 'xslt4Transform' },
+    }),
     ntriplesDocumentReader: reader('ntriples'),
     nquadsDocumentReader: reader('nquads'),
     turtleDocumentReader: reader('turtle'),
@@ -181,6 +190,17 @@ export function buildNodes(deps) {
       case 'Table': return Array.isArray(value);
       case 'String × String':
         return Array.isArray(value) && value.length === 2 && value.every((v) => typeof v === 'string');
+      // Transport shapes of the existing Lean serializers, not live XDM nodes
+      // or a promise that arbitrary result text is a well-formed XML document.
+      case 'Serialized XDM result':
+        return value !== null && typeof value === 'object' && Number.isSafeInteger(value.count) && value.count >= 0 &&
+          Array.isArray(value.items) && value.items.length === value.count &&
+          value.items.every((item) => item && typeof item.type === 'string' && typeof item.value === 'string') &&
+          typeof value.adaptive === 'string' && (value.xml === null || typeof value.xml === 'string');
+      case 'XSLT result':
+        return value !== null && typeof value === 'object' && typeof value.output === 'string' && typeof value.method === 'string' &&
+          Array.isArray(value.secondary) && value.secondary.every((item) => item && typeof item.href === 'string' && typeof item.output === 'string') &&
+          Array.isArray(value.messages) && value.messages.every((item) => typeof item === 'string');
       default: return value !== undefined && value !== null;
     }
   }

package/lib/sbm11-lws.mjs

@@ -20,7 +20,11 @@
 // mixed). The engine checks every byte it decodes against the manifest's
 // Merkle roots (openSbm11's default `verify: 'merkle'`), so it asks for whole
 // 65,536-byte chunks and the `.merkle` sidecars; this file does no check.
-// Limits: no eviction of the in-memory copies, no retry.
+// Limits: no eviction of the in-memory copies, no retry. Resource paths are
+// confined to the configured container. A custom transport must independently
+// refuse redirects before forwarding headers. Default Node fetch refuses them;
+// default worker XHR accepts no caller headers and checks the final response URL
+// only after sending. XHR may still use ambient same-origin browser cookies.
 //
 // EVIDENCE
 // `evidence()` lists each resource read: { resource, etag, lastModified,
@@ -35,13 +39,41 @@
 // browser worker it is a synchronous XMLHttpRequest. A browser window
 // thread has neither: pass `transport` or run the engine in a worker.
 
+// This reader grants its transport authority only within one HTTP container.
+// A file is a raw relative filename/path, never a URL reference. Reject both
+// literal traversal and encoded structural characters before attaching headers.
 function containerUrl (url) {
-  const s = String(url)
-  return s.endsWith('/') ? s : s + '/'
+  let base
+  try { base = new URL(String(url)) } catch { throw new TypeError('lwsSbm11Reader: expected an absolute HTTP(S) container URL') }
+  if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password || /[?#]/.test(base.href)) {
+    throw new TypeError('lwsSbm11Reader: container must be HTTP(S), without userinfo, query or fragment; use opts.auth/headers')
+  }
+  if (!base.pathname.endsWith('/')) base.pathname += '/'
+  return base
 }
 
 function resourceUrl (base, file) {
-  return new URL(String(file).split('/').map(encodeURIComponent).join('/'), base).href
+  if (typeof file !== 'string' || file.length === 0 || file.length > 4096) {
+    throw new TypeError('invalid relative resource path')
+  }
+  let probe = file
+  for (;;) {
+    if (/^[a-z][a-z0-9+.-]*:/i.test(probe) || /[\\?#\x00-\x1f\x7f]/.test(probe) ||
+        probe.split('/').some(part => part === '' || part === '.' || part === '..') ||
+        /%(?:2f|5c|3f|23)/i.test(probe)) {
+      throw new TypeError('resource path must remain inside the configured container')
+    }
+    // Decode only for rejection, never for the requested filename. Each changed
+    // pass shortens the string, so nested percent encodings are also bounded.
+    const next = probe.replace(/%([a-f0-9]{2})/gi, (_match, hex) => String.fromCharCode(parseInt(hex, 16)))
+    if (next === probe) break
+    probe = next
+  }
+  const resource = new URL(file.split('/').map(encodeURIComponent).join('/'), base)
+  if (resource.origin !== base.origin || !resource.pathname.startsWith(base.pathname)) {
+    throw new TypeError('resource URL escaped the configured container')
+  }
+  return resource.href
 }
 
 /** A synchronous GET with XMLHttpRequest (a browser worker). */
@@ -51,6 +83,9 @@ export function xhrSyncTransport (url, headers) {
   x.responseType = 'arraybuffer'
   for (const [k, v] of Object.entries(headers)) x.setRequestHeader(k, v)
   x.send()
+  // XHR follows redirects internally. This rejects returned bytes, not the
+  // already-sent request. Caller headers require an explicit trusted transport.
+  if (x.responseURL !== new URL(url).href) throw new Error('LWS reader: redirected XHR resource refused')
   return {
     status: x.status,
     header: (name) => x.getResponseHeader(name),
@@ -73,26 +108,27 @@ function unsatisfiedTotal (value) {
  * A reader ({ readAt, size, evidence, close }) of the SBM11 files held as
  * LWS resources under the container `url`.
  *
- * @param {string} url the container that holds CURRENT and the generation
+ * @param {string} url absolute HTTP(S), no userinfo/query/fragment; container that holds CURRENT and the generation
  *   (or the generation container itself)
  * @param {object} [opts]
- * @param {Function} [opts.transport] the synchronous GET (see above)
+ * @param {Function} [opts.transport] trusted synchronous GET; must constrain redirect/header forwarding
  * @param {string} [opts.auth] a value for the Authorization header, such as
  *   `Bearer <access token>` (an LWS access token)
- * @param {object} [opts.headers] further request headers
+ * @param {object} [opts.headers] further request headers; browser use requires explicit trusted transport
  */
 export function lwsSbm11Reader (url, opts = {}) {
   const base = containerUrl(url)
+  const extra = { ...(opts.headers || {}) }
+  if (opts.auth) extra.authorization = String(opts.auth)
   let transport = opts.transport
   if (typeof transport !== 'function') {
     if (typeof XMLHttpRequest === 'function' && typeof document === 'undefined') {
+      if (Object.keys(extra).length > 0) throw new TypeError('lwsSbm11Reader: caller headers require an explicit redirect-safe transport; default XHR cannot constrain forwarding')
       transport = xhrSyncTransport
     } else {
       throw new TypeError('lwsSbm11Reader: no synchronous transport here; pass opts.transport (Node: @factoidal/core gives one)')
     }
   }
-  const extra = { ...(opts.headers || {}) }
-  if (opts.auth) extra.authorization = String(opts.auth)
   // file -> { url, etag, lastModified, total, whole, requests, partial, bytes }
   const files = new Map()
   const errors = []
@@ -100,7 +136,12 @@ export function lwsSbm11Reader (url, opts = {}) {
   function entry (file) {
     let e = files.get(file)
     if (!e) {
-      e = { url: resourceUrl(base, file), etag: null, lastModified: null, total: undefined, whole: null, requests: 0, partial: 0, bytes: 0 }
+      let url
+      try { url = resourceUrl(base, file) } catch (error) {
+        fail(file, error.message)
+        return null
+      }
+      e = { url, etag: null, lastModified: null, total: undefined, whole: null, requests: 0, partial: 0, bytes: 0 }
       files.set(file, e)
     }
     return e
@@ -136,6 +177,7 @@ export function lwsSbm11Reader (url, opts = {}) {
 
   function sizeOf (file) {
     const e = entry(file)
+    if (e === null) return null
     if (e.total !== undefined) return e.total
     const r = get(e, file, 0, 0)
     if (r === null) return null
@@ -161,6 +203,7 @@ export function lwsSbm11Reader (url, opts = {}) {
   return {
     readAt (file, offset, length) {
       const e = entry(file)
+      if (e === null) return null
       if (length === 0) return new Uint8Array(0)
       if (e.whole !== null) {
         return offset + length <= e.whole.length ? e.whole.subarray(offset, offset + length) : null

package/lib/sync-http-node.mjs

@@ -3,7 +3,8 @@
 // The engine is inside WebAssembly and asks for bytes synchronously; Node's
 // fetch is asynchronous. A worker thread makes the fetch; this thread waits
 // on a shared Int32Array (Atomics.wait) and takes the answer with
-// receiveMessageOnPort. Pure I/O: no header is read here, no status judged.
+// receiveMessageOnPort. Redirects are refused before forwarding scoped headers.
+// No RDF or response-header decision is made here.
 //
 // The thread that calls the transport is blocked until the answer comes, so
 // the server must not run on that thread (start it in another process or
@@ -18,7 +19,7 @@ const flag = new Int32Array(signal)
 port.on('message', async (req) => {
   let out
   try {
-    const r = await fetch(req.url, { headers: req.headers, redirect: 'follow' })
+    const r = await fetch(req.url, { headers: req.headers, redirect: 'error' })
     const headers = {}
     r.headers.forEach((v, k) => { headers[k] = v })
     out = { status: r.status, headers, bytes: new Uint8Array(await r.arrayBuffer()) }

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.26.0';
+export const version = '0.28.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "EXPERIMENTAL UNREVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",