@factoidal/core 0.28.0 → 0.30.0

package/CHANGELOG.md

@@ -1,6 +1,32 @@
 # Changelog
 
-## Unreleased
+## 0.30.0 (2026-11-04)
+
+- The Lean XMPP server now has an in-page host (`@factoidal/core/xmpp/inpage`): `openInPageXmppServer` exposes ordered message connections and `inPageWebSocket` adapts them for RFC 7395 clients. Protocol decisions remain in Lean, with shared routing for direct messages, MUC rooms, MIX channels and experimental GC3 groups. This provides an app-to-app transport; it does not include a chat UI or WebMCP bridge.
+- The Node XMPP host adds STARTTLS and WebSocket transport, IQ routing and sealed LWS-backed state for restart persistence. LWS writes enforce the configured content limit with a 413 response; component requests carry their principal through authorization.
+
+- `openInPageLwsStorage({ engine, baseIri, principal, rootAcl?, storageKey?, snapshot?, onSnapshot? })` (`@factoidal/core/lws/inpage`): one Lean LWS storage with no network, in a page, a worker or Node, reached through a `fetch`-shaped function that answers real `Response`s. Every request is the component principal's (issue 1238) and Web Access Control decides it; notifications are off. The storage is kept as one snapshot, sealed when a `storageKey` is given: after each change it is handed to `onSnapshot`, and the caller passes it back as `snapshot` to reopen (the engine refuses one sealed under another key). No Node API. Test: `test/lws-inpage.test.mjs`.
+- `openLwsDataset(storageRootUrl, { fetch, auth })` (`@factoidal/core/lws/dataset`): an LWS storage as an RDF dataset (https://github.com/danbri/factoidal/issues/1011, version 2 of the view). The default graph is empty. The first named graph is the table of contents, named by the storage description IRI (the target of the root's `https://www.w3.org/ns/lws#storage` link; the result member `toc`): the containment as `lws:items`, each listing member's `rdf:type` (`lws:Container` or `lws:DataResource`) with its `dcterms:format`, `schema:size` and `dcterms:modified`, and `<resource> <http://www.iana.org/assignments/relation/linkset> <linkset>` for each linkset read. Then one named graph per RDF resource (named by its IRI) and one per linkset (named by the linkset IRI, one triple per link; relation types become IRIs from the LWS vocabulary, else `http://www.iana.org/assignments/relation/<name>`). `query()` answers `{result, evidence}`; the evidence is each document read with its ETag and each linkset read with its linkset IRI and ETag. A full crawl on every open (one HEAD and one GET per resource for its linkset), no search index, no caching. The definition is Lean (`LWS/DatasetView.lean`, theorems `view_names_nodup`, `view_toc_first`, `view_replace`); the source theorem `lwsSource_query_sound` rests on the named assumption `lwsReadsAtSnapshot`. Needs a wasm build with version 2 of the ops `lwsViewPlan` (with `metadata`) and `lwsDatasetView`.
+- The experimental code notice now says "EXPERIMENTAL UNDER-REVIEWED CODE" (was "UNREVIEWED"), in the README, the package description, every help text, the warning on standard error when a server, client or key command starts, and the hub pages. Owner decision of 2026-10-28, confirmed 2026-11-03.
+
+## 0.29.0 (2026-11-02)
+
+- The Data Compositor can open and save versioned pipeline JSON files. Import validates the recipe and never runs it automatically.
+- The Data Compositor can discover storage declared by an explicitly selected FOAF profile, browse and load pipelines, and create or update files with LWS preconditions. Remembered data contains pod metadata only; credentials stay in the dialog session. The server still controls write access.
+- The browser LWS client no longer eagerly imports its Node-only transport loader. Browser applications can import the public client and supply a browser transport without loading Node built-ins.
+- Package functions `xmlVerify` and `xmlSign` (XML Signature 1.1, all hosts) over the wasm ops of the same names. `xmlVerify(document, {key?, hmacKey?, keyFromKeyInfo?, certificates?, documents?})` gives `{valid: true, signedInfo, references: [{uri, octets}], key, certificate}` or `{valid: false, reason}`; wrong arguments throw a `FactoidalError`. `xmlSign(document, {key, signatureMethod?, canonicalizationMethod?, inclusivePrefixes?, references?, enveloping?, keyValue?})` gives `{document}`. Keys are JWKs, octets are `Uint8Array`; the ECDSA nonce comes from `crypto.getRandomValues`. Test: `test/xmldsig.test.mjs` (RSA, ECDSA and HMAC round trips; node:crypto checks each signature value over the reported `ds:SignedInfo` and each `DigestValue`).
+- XML Signature 1.1 on the wasm dispatch surface (`formal/lean4/Wasm/Ops/XmlDsig.lean`): new wasm ops `xmlVerify` (`{document, key?, hmacKey?, keyFromKeyInfo?, certificates?, documents?}` -> `{valid, signedInfo, references, key, certificate}` or `{valid: false, reason}`) and `xmlSign` (`{document, key, signatureMethod?, canonicalizationMethod?, inclusivePrefixes?, references?, enveloping?, keyValue?, random?}` -> `{document}`). Keys are JWKs; RSA and P-256 by HACL\*, HMAC in Lean; a private key goes only to the custodians of `XML/DSig11Native.lean`, and every signed document passes core validation before it is returned.
+- XML Signature 1.1 `ds:RetrievalMethod` (§4.5.3) in the Lean engine: the `URI` is dereferenced as a reference's (same-document, or the caller's resolver; the engine fetches nothing), its `ds:Transforms` are applied, and the result is read as its `Type` says: `rawX509Certificate` octets, or one element (`ds:X509Data`, `ds:KeyValue`, `ds:RSAKeyValue`, `dsig11:ECKeyValue`, `dsig11:DEREncodedKeyValue`) whose name is the `Type`. One level only. Theorems `dsig11_2013_retrieved_x509Data_eq_direct`, `dsig11_2013_raw_eq_x509Certificate`, `dsig11_2013_retrieved_type`. `lake exe l4xmldsig`: retrieval fixtures 17 pass, 0 fail (out of 17); certificate selection in the 2001 vectors 7 pass, 0 fail (out of 7). Closes https://github.com/danbri/factoidal/issues/1228. No npm or wasm op yet.
+- XML Signature 1.1 `ds:X509Data` keys (§4.5.4) in the Lean engine: `X509Certificate`, `X509IssuerSerial`, `X509SubjectName` (RFC 4514 names), `X509SKI` and `dsig11:X509Digest` select one certificate among those of the element and those the caller gives (`Config.certificates`); with no identifier, the one end-entity certificate of the element. The key is the certificate's SubjectPublicKeyInfo, read as `dsig11:DEREncodedKeyValue` is (theorem `dsig11_2013_x509_key_eq_derEncoded`); the selected certificate matches every identifier (theorem `x509SelectCore_2013_identified`). Certificate path validation stays the caller's (`signingCertificate?`). New DER reader `L4Factoidal/XML/X509.lean`. `lake exe l4xmldsig`: X509Data fixtures made by signxml 16 pass, 0 fail (out of 16); certificate selection in the 6 X.509 vectors of `merlin-xmldsig-twenty-three` 6 pass, 0 fail (out of 6; their DSA keys stay refused, https://github.com/danbri/factoidal/issues/1224). Closes https://github.com/danbri/factoidal/issues/1226. `ds:RetrievalMethod` is not followed (https://github.com/danbri/factoidal/issues/1228); the certificate of the 2012 `X509Digest` vector is not published (https://github.com/danbri/factoidal/issues/1229). No npm or wasm op yet.
+- The XSLT transform of XML Signature 1.1 (§6.6.5) in the Lean engine (`L4Factoidal/XML/DSigXslt.lean`): the stylesheet in `ds:Transform` runs on the XSLT 4.0 processor over the input octets, and the result is written with the stylesheet's `xsl:output`. Theorem `dsig11_xslt_1999_output`. `lake exe l4xmldsig` on Merlin Hughes's 2001 interop vectors `merlin-xmldsig-twenty-three` (now vendored): 38 pass, 0 fail, 14 expected failures (out of 52; every reference digest matches, the XSLT reference included; the 14 are DSA, https://github.com/danbri/factoidal/issues/1224, and one 1024-bit RSA key, https://github.com/danbri/factoidal/issues/1227). Closes the XSLT part of https://github.com/danbri/factoidal/issues/1225. No npm or wasm op yet.
+- XML Signature XPath Filter 2.0 (W3C Recommendation, 2002) in the Lean engine (`L4Factoidal/XML/DSigFilter2.lean`), as a transform of XML Signature 1.1 core validation and generation: intersect, subtract and union over subtree-expanded node-sets, evaluated by the XPath 4.0 engine; `here()` for this transform and for the XPath filtering transform. Theorem `filter2_2002_single_pass`: the filter set equals the single-pass flag of §3.4. `lake exe l4xmldsig` on Merlin Hughes's `merlin-xpath-filter2-three` vectors: 4 pass, 0 fail, 2 expected failures (out of 6; DSA signatures, https://github.com/danbri/factoidal/issues/1224). The XSLT transform is still refused (https://github.com/danbri/factoidal/issues/1225). No npm or wasm op yet.
+- XML Signature 1.1 ECDSA P-256 with each digest of §6.2 (SHA-1, SHA-224, SHA-256, SHA-384, SHA-512) in the Lean engine, for core validation and signature generation: the digest is computed in Lean and HACL\* checks or makes the signature over its FIPS 186-4 §6.4 representative (`Crypto.P256.p256MsgRep`, `Hacl_P256_ecdsa_verif_without_hash`, `Hacl_P256_ecdsa_sign_p256_without_hash`). P-384 and P-521 are still refused (https://github.com/danbri/factoidal/issues/1223). No npm or wasm op yet.
+- XML Signature 1.1 signature generation (§3.1) in the Lean engine (`L4Factoidal/XML/DSig11Sign.lean`): references are digested and `ds:SignedInfo` is canonicalized by the same functions as core validation, in the document that is returned; enveloped and enveloping placement; `ds:KeyValue` with `ds:RSAKeyValue` or `dsig11:ECKeyValue`. Keys stay in one signer component (`Signer`: `hmacSigner`; `rsaSigner` with RSASSA-PKCS1-v1_5 and the HACL\* private operation, the value checked before it is given out; `p256Signer` with a nonce per call). Every signed document is checked by core validation before it is returned (theorem `dsig11_sign_validates`). `lake exe l4xmldsig`: signature generation 15 pass, 0 fail (out of 15); signxml 5.2 verifies the same 15 documents (`tests/xmldsig/verify_lean_signed.py`). No npm or wasm op yet.
+- XML Signature 1.1 core validation in the Lean engine (`L4Factoidal/XML/DSig11.lean`): reference processing (§4.4.3) over the node-sets of `XML.C14n`, with same-document references, the enveloped-signature, XPath filtering, base64 and the six canonicalization transforms; SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 digests; HMAC with `HMACOutputLength` (§6.3.1), RSASSA-PKCS1-v1_5 and ECDSA P-256 SHA-256 signatures; keys from `ds:KeyValue`, `dsig11:DEREncodedKeyValue` and `dsig11:KeyInfoReference`. The SAML profile verifier is unchanged and is a case of it. `lake exe l4xmldsig`: W3C 1.1 interop vectors 9 pass, 0 fail, 36 expected failures (out of 45; https://github.com/danbri/factoidal/issues/1223 (ECDSA other than P-256 SHA-256), https://github.com/danbri/factoidal/issues/1227 (1024-bit RSA keys), https://github.com/danbri/factoidal/issues/1226 (X509Data)); signxml fixtures 22 pass, 0 fail (out of 22). New: SHA-224 (`Crypto.sha224`), HMAC over any hash (`Crypto.hmacWith`), EMSA-PKCS1-v1_5 for every DigestInfo of RFC 8017 (`JOSE.Pkcs1.rsaPkcs1Verify`). No npm or wasm op.
+- The Direct Mapping of relational data to RDF (W3C Recommendation, 2012) in the Lean engine, `L4Factoidal/RDB2RDF/`, over a SQL subset in Lean (`L4Factoidal/SQL/`: CREATE TABLE with keys, ALTER TABLE, INSERT, and the SELECT forms of the W3C RDB2RDF test scripts), with the natural RDF literals of R2RML §10.2. R2RML (W3C Recommendation, 2012) in the Lean engine, `L4Factoidal/RDB2RDF/R2RML.lean`: an R2RML mapping graph is read into the RML model by a term table and runs through the existing RML validator and evaluator; logical tables are queries of the Lean SQL subset, cells are the natural RDF literals of §10.2, and the R2RML-only rules (`rr:sqlVersion`, one logical table per triples map, duplicate result columns, SQL identifier case, valid `rr:language`) are checked in Lean. `bash tests/rdb2rdf/run.sh`: W3C Direct Mapping cases 24 pass, 0 fail (out of 24); W3C R2RML cases 63 pass, 0 fail (out of 63). No npm or wasm op yet.
+- XInclude with XPointer in the Lean engine (`XInclude.expandX`, `L4Factoidal/XPath4/XInclude.lean`): the `xpointer` attribute by the XPointer Framework, element(), xmlns() and xpointer(), on the acquired infoset; intra-document references; namespace, base URI and language fixup; the XInclude 1.1 loop rule and fatal errors; `parse="text"` decoding by `encoding` or detection. `lake exe l4xinclude` on the W3C XInclude test suite: 166 pass, 0 fail, 8 expected failures (out of 174; https://github.com/danbri/factoidal/issues/1218 (unexpanded and unparsed entities), https://github.com/danbri/factoidal/issues/1219 (EBCDIC text, HTTP resources)). The `xinclude` option of `fn:doc` does not evaluate `xpointer` yet: https://github.com/danbri/factoidal/issues/1220. No npm or wasm op.
+- RELAX NG in the Lean engine (`L4Factoidal/RelaxNG/`): the XML syntax of RELAX NG (OASIS 2001, ISO/IEC 19757-2), with simplification, the §7 restrictions, validation by derivatives, and the XSD datatype library through `XSD.SimpleType`. Also the RELAX NG compact syntax (OASIS 2002), translated to the XML syntax as its Appendix A specifies. `lake exe l4relaxng`: James Clark's spectest 965 pass, 0 fail (out of 965); compacttest 87 pass, 0 fail (out of 87). No npm or wasm op yet (https://github.com/danbri/factoidal/issues/1200).
+- Web Annotation Data Model and Vocabulary (W3C Recommendations, 2017) in the Lean engine, `L4Factoidal/WebAnnotation/`: the procedure of the W3C annotation-model tests (`JsonTest.lean`) over the JSON Schema validator, which gains a draft-04 dialect (`draft04Ajv4`: unknown keywords ignored, boolean `exclusiveMinimum`/`exclusiveMaximum`, `format` checked as ajv 4.0.4 "fast" mode checks `uri` and `date-time`); the vocabulary checks over the existing JSON-LD 1.1, N-Triples, Turtle and RDF/XML code (`Vocab.lean`). `bash tests/webannotation/run.sh`: model tests on the 44 Recommendation examples and 41 protocol samples 246 pass, 0 fail (out of 246 runs), 6 excluded (defective test data, https://github.com/danbri/factoidal/issues/1193); 19 negative documents 19 pass, 0 fail (out of 19); vocabulary 342 pass, 0 fail (out of 342). The Web Annotation Protocol (2017) as a Lean request handler over the LWS store (`Protocol.lean`): the `server-manual.html` assertions run against it (`ProtocolSuite.lean`), MUST 35 pass, 0 fail (out of 35), SHOULD 10 pass, 0 fail (out of 10). No npm or wasm op and no HTTP host yet, and no Turtle representation (https://github.com/danbri/factoidal/issues/1197).
 
 ## 0.28.0 (2026-10-31)
 

package/README.md

@@ -1,6 +1,6 @@
 # @factoidal/core
 
-> ⚠️ **EXPERIMENTAL UNREVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.**
+> ⚠️ **EXPERIMENTAL UNDER-REVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.**
 >
 > This covers the whole core library and every command line tool, and in
 > particular all protocol, authentication and security code (the LWS, Solid,
@@ -58,9 +58,10 @@ and `dataset.serialize({ format: 'jsonld', rdfstar: true })`.
   Jena TDB2 read only), Linked Web Storage 1.0, Solid, an OAuth 2.0
   authorization server (token exchange for OpenID Connect ID tokens,
   self-issued CID credentials and SAML 2.0 assertions)
-- Security: JWS/JWT (ES256, RS256, EdDSA), XML Signature verification in the
-  SAML Core profile (Exclusive XML Canonicalization 1.0, rsa-sha256), with
-  HACL\* primitives. XML Encryption 1.1 and JWE (RFC 7516), decryption and
+- Security: JWS/JWT (ES256, RS256, EdDSA), XML Signature 1.1 verification
+  and signing (`xmlVerify`, `xmlSign`; RSA, ECDSA P-256, HMAC; not DSA,
+  https://github.com/danbri/factoidal/issues/1224, nor ECDSA P-384 and P-521,
+  https://github.com/danbri/factoidal/issues/1223), with HACL\* primitives. XML Encryption 1.1 and JWE (RFC 7516), decryption and
   encryption (`xmlDecrypt`, `xmlEncrypt`, `jweDecrypt`, `jweEncrypt`):
   RSA-OAEP, P-256 and X25519 run in the wasm (HACL\*), AES runs in the host's
   WebCrypto. The authorization server decrypts encrypted SAML assertions

package/bin/factoidal.mjs

@@ -94,7 +94,7 @@ function err (line) { console.error(line) }
 // Owner, 2026-10-27: every protocol, authentication and security component,
 // the CLIs and the core library carry this notice. It is printed with every
 // help text and on standard error when a server, client or key command starts.
-const REVIEW_WARNING = 'EXPERIMENTAL UNREVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.'
+const REVIEW_WARNING = 'EXPERIMENTAL UNDER-REVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.'
 
 /** The commands that serve, speak a protocol, or handle keys and tokens. */
 const WARNED_COMMANDS = new Set(['serve', 'lws-serve', 'solid-serve', 'solid-client', 'lws-client',
@@ -128,7 +128,7 @@ commands:
   authz-serve DIR             serve an OAuth 2.0 authorization server for LWS
                               (RFC 8414 metadata, JWK Set, RFC 8693 token exchange)
   authz-keys DIR              print the public JWK Set of an authorization server
-  xmpp-serve DIR              serve XMPP (RFC 6120/6121) over TCP or direct TLS
+  xmpp-serve DIR              serve XMPP (RFC 6120/6121): TCP, STARTTLS or direct TLS
   webdav-serve CONFIGDIR      serve local and remote LWS storages to file
                               browsers over WebDAV (RFC 4918)
   webdav-user FILE NAME       add or replace a user in a webdav-serve users
@@ -481,14 +481,8 @@ usage: factoidal lws-serve DIR (--authz DIR | --issuer IRI | --auth-config FILE
 Starts a Node HTTP server that answers every request through the engine's
 lwsStep operation.
 
-DIR names the storage directory. The storage is kept in the engine
-handle and written to DIR/lws-state.json after every request that
-changed it (temporary file, fsync, rename), and read back on the next
-start. The engine decides the snapshot format and refuses a snapshot
-path with a dot segment or other traversal form
-(formal/lean4/L4Factoidal/LWS/Snapshot.lean).
-
-With --storage files (off by default) a write costs the same whatever the
+DIR names the storage directory. By default (--storage files, since
+2026-11-03) a write costs the same whatever the
 size of the storage: DIR holds one file per resource body (DIR/bodies/),
 a journal of metadata changes (DIR/lws-journal) and a metadata file
 (DIR/lws-files.json) that the journal is folded into from time to time.
@@ -500,6 +494,12 @@ byte (formal/lean4/L4Factoidal/LWS/FileLayout.lean); the storage is still
 held in memory while the server runs
 (docs/designissues/2026-10-22-lws-storage-on-disk.md).
 
+With --storage snapshot the storage is written whole to DIR/lws-state.json
+after every request that changed it (temporary file, fsync, rename), and
+read back on the next start. The engine decides the snapshot format and
+refuses a snapshot path with a dot segment or other traversal form
+(formal/lean4/L4Factoidal/LWS/Snapshot.lean).
+
 Encryption at rest (off by default): when the environment variable
 FACTOIDAL_LWS_KEY holds a 32-byte key (64 hex digits, or 43 characters of
 base64url), the snapshot is sealed with ChaCha20-Poly1305 (HACL*) under a
@@ -577,9 +577,9 @@ The engine decides the file, its contents and every refusal
   --storage snapshot|files
                   how DIR keeps the storage (config member storage;
                   default the environment variable FACTOIDAL_LWS_STORAGE,
-                  else snapshot): one snapshot file written whole after
-                  each change, or one file per body with a journal, so a
-                  write costs the same whatever the storage size
+                  else files): one file per body with a journal, so a
+                  write costs the same whatever the storage size, or one
+                  snapshot file written whole after each change
                   https://github.com/danbri/factoidal/issues/918
   --cors-origin ORIGIN
                   answer CORS (Fetch Standard) only for this origin, written
@@ -744,10 +744,13 @@ those operations landed makes this command exit 3 and say so.
 
 Specification: https://solidproject.org/TR/protocol`,
 
-  'xmpp-serve': `factoidal xmpp-serve - serve XMPP (RFC 6120 and RFC 6121) over TCP or direct TLS
+  'xmpp-serve': `factoidal xmpp-serve - serve XMPP (RFC 6120 and RFC 6121) over TCP, STARTTLS or direct TLS
 
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
-                            [--accounts FILE] [--cert FILE --key FILE]
+                            [--accounts FILE] [--cert FILE --key FILE [--starttls]]
+                            [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
+                            [--muc DOMAIN] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--state-key FILE]
 
 Starts a Node TCP server that runs one engine session per connection and
 answers every byte through the engine's xmppSessionFeed operation.
@@ -761,11 +764,41 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
   --domain NAME    the domain the server is authoritative for (default localhost);
                    a stream for any other domain is answered host-unknown
   --port N         the port to bind; 0 takes an ephemeral one
-                   (default 5222, or 5223 with --cert and --key)
-  --host ADDRESS   the address to bind (default 127.0.0.1)
+                   (default 5222; 5223 with --cert and --key and no --starttls)
+  --host ADDRESS   the address to bind (default 127.0.0.1); without
+                   --cert and --key only a loopback address is accepted
   --accounts FILE  the accounts file (default DIR/accounts)
-  --cert FILE      PEM certificate chain: XEP-0368 direct TLS, no STARTTLS
+  --cert FILE      PEM certificate chain: XEP-0368 direct TLS, or STARTTLS with --starttls
   --key FILE       PEM private key for --cert
+  --starttls       listen in clear and REQUIRE STARTTLS (RFC 6120 section 5)
+                   before anything else; no SASL mechanism is offered and no
+                   credential is accepted until the TLS handshake finishes
+  --ws-port N      also serve XMPP over WebSocket (RFC 7395, the "xmpp"
+                   subprotocol of RFC 6455) for browser clients such as
+                   Strophe.js; wss: with --cert and --key, else loopback only
+  --ws-path PATH   the WebSocket endpoint path (default /xmpp-websocket)
+  --ws-origin ORIGIN  a browser Origin allowed to connect, e.g.
+                   http://localhost:5173 (repeatable); a request from any
+                   other Origin is refused 403, and one with no Origin
+                   (not a browser) is accepted only when no --ws-origin is given
+  --muc DOMAIN     also serve XEP-0045 multi-user chat rooms at DOMAIN, e.g.
+                   conference.example.com: temporary rooms, made by the first
+                   join and gone with the last occupant; no history, no
+                   configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+  --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
+                   joined through this server (XEP-0405 MIX-PAM); channels are
+                   made by an IQ <create/>, kept in memory only, JID-hidden; no
+                   PubSub nodes, no archive (L4Factoidal/XMPP/Mix.lean)
+  --state-key FILE keep the server's state across restarts: rosters, messages held
+                   for offline accounts, MIX channels and GC3 groups, in an LWS
+                   storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
+                   in FILE (64 hex digits; keep FILE outside DIR). A wrong key
+                   stops the start. Plaintext roster files are migrated, then
+                   deleted. Without it, that state is lost at a restart.
+  --gc3 DOMAIN     also serve PROTOTYPE "Groupchat 3.0" groups at DOMAIN: persistent
+                   membership, stable participant ids, optional events. There is
+                   no published GC3 spec; every wire format is invented and listed
+                   in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -774,7 +807,7 @@ disco#info are answered by formal/lean4/L4Factoidal/XMPP/. A WebAssembly
 module built before the session operations landed makes this command
 exit 3 and say so.
 
-Not implemented: STARTTLS (use --cert/--key), server-to-server federation,
+Not implemented: SCRAM channel binding, server-to-server federation,
 MUC/MIX/GC3 rooms.
 
 Specifications: https://www.rfc-editor.org/rfc/rfc6120 and
@@ -1150,7 +1183,7 @@ function parseArguments (args, valueOptions) {
 class UsageError extends Error {}
 
 /** Options that may be given more than once; their value is the list. */
-const REPEATABLE_OPTIONS = new Set(['cors-origin', 'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin'])
+const REPEATABLE_OPTIONS = new Set(['cors-origin', 'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin', 'ws-origin'])
 
 const VALUE_OPTIONS = {
   xpath4: new Set(['expression', 'file', 'input', 'format']),
@@ -1178,7 +1211,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'mix', 'gc3', 'state-key']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2825,9 +2858,11 @@ async function commandXmppServe (positional, options) {
   if (useTls && (typeof options.cert !== 'string' || typeof options.key !== 'string')) {
     throw new UsageError('--cert and --key go together')
   }
+  const startTls = options.starttls === true
+  if (startTls && !useTls) throw new UsageError('--starttls needs --cert and --key')
   const settings = {
     dir: positional[0],
-    port: servePort(options, useTls ? 5223 : 5222),
+    port: servePort(options, useTls && !startTls ? 5223 : 5222),
     host: serveHost(options),
     onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) }
   }
@@ -2837,6 +2872,51 @@ async function commandXmppServe (positional, options) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
   }
+  if (startTls) settings.startTls = true
+  if (options['state-key'] !== undefined) {
+    if (typeof options['state-key'] !== 'string') throw new UsageError('--state-key needs a FILE')
+    // 64 hex digits or base64url of 32 bytes; the engine checks it.
+    settings.stateKey = (await fs.readFile(options['state-key'], 'utf8')).trim()
+  }
+  if (options.muc !== undefined) {
+    if (typeof options.muc !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.muc)) {
+      throw new UsageError('--muc needs a domain name, e.g. conference.example.com')
+    }
+    settings.mucDomain = options.muc
+  }
+  if (options.mix !== undefined) {
+    if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
+      throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
+    }
+    if (options.mix === options.muc) throw new UsageError('--mix and --muc need different domains')
+    settings.mixDomain = options.mix
+  }
+  if (options.gc3 !== undefined) {
+    if (typeof options.gc3 !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.gc3)) {
+      throw new UsageError('--gc3 needs a domain name, e.g. gc3.example.com')
+    }
+    if (options.gc3 === options.muc || options.gc3 === options.mix) throw new UsageError('--gc3 needs a domain of its own')
+    settings.gc3Domain = options.gc3
+  }
+  if (options['ws-port'] !== undefined) {
+    const wsPort = Number(options['ws-port'])
+    if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
+    const origins = options['ws-origin'] === undefined ? []
+      : Array.isArray(options['ws-origin']) ? options['ws-origin'] : [options['ws-origin']]
+    settings.websocket = {
+      port: wsPort,
+      path: typeof options['ws-path'] === 'string' ? options['ws-path'] : '/xmpp-websocket',
+      allowedOrigins: origins,
+      allowNoOrigin: origins.length === 0
+    }
+    if (useTls) { settings.websocket.cert = settings.cert; settings.websocket.key = settings.key }
+  }
+  // Invariant I4 (docs/designissues/2026-10-28-feature-combination-safety.md,
+  // C4): with no TLS this listener offers PLAIN, which sends the password in
+  // clear, so it binds to loopback only.
+  if (!useTls && !/^(127\.\d+\.\d+\.\d+|::1|localhost)$/.test(settings.host)) {
+    throw new UsageError(`xmpp-serve: no TLS on ${settings.host}: give --cert and --key (with --starttls for port 5222), or bind to loopback`)
+  }
   let running
   try {
     running = await listen(settings)
@@ -2849,9 +2929,19 @@ async function commandXmppServe (positional, options) {
   if (!quiet) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +
-        (useTls ? ', direct TLS)' : ', PLAINTEXT: no TLS on this listener)'))
+        (startTls ? ', STARTTLS required)' : useTls ? ', direct TLS)' : ', PLAINTEXT: no TLS on this listener)'))
+    if (settings.mucDomain) err(`xmpp-serve: multi-user chat (XEP-0045) at ${settings.mucDomain}`)
+    if (settings.mixDomain) err(`xmpp-serve: MIX channels (XEP-0369, joined by XEP-0405) at ${settings.mixDomain}`)
+    if (settings.gc3Domain) err(`xmpp-serve: GC3 PROTOTYPE groups at ${settings.gc3Domain} (no published spec; invented wire format)`)
+    if (settings.stateKey) err(`xmpp-serve: state kept across restarts in ${positional[0]}/state, sealed under the state key`)
+    else err('xmpp-serve: WARNING: no --state-key: held messages, MIX channels and GC3 groups are lost at a restart, and rosters are written in clear')
+  }
+  if (running.wsOrigin && !quiet) {
+    err(`xmpp-serve: XMPP over WebSocket on ${running.wsOrigin}` +
+        (settings.websocket.allowedOrigins.length ? ` for Origin ${settings.websocket.allowedOrigins.join(', ')}` : ' (no browser Origin allowed)'))
   }
   out(running.origin)
+  if (running.wsOrigin) out(running.wsOrigin)
   return untilInterrupted(running, quiet)
 }
 

package/browser.d.ts

@@ -117,6 +117,8 @@ export {
   vcEd25519Verify,
   xmlDecrypt,
   xmlEncrypt,
+  xmlVerify,
+  xmlSign,
   jweDecrypt,
   jweEncrypt,
   vcEddsaCreateFromCanonical,

package/browser.js

@@ -188,6 +188,8 @@ export const vcEd25519Verify = api.vcEd25519Verify;
 // XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
 export const xmlDecrypt = api.xmlDecrypt;
 export const xmlEncrypt = api.xmlEncrypt;
+export const xmlVerify = api.xmlVerify;
+export const xmlSign = api.xmlSign;
 export const jweDecrypt = api.jweDecrypt;
 export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;

package/index.d.ts

@@ -1978,6 +1978,50 @@ export function xmlEncrypt(
   }
 ): Promise<{ document: string; canonical: string }>;
 
+/**
+ * XML Signature 1.1 core validation (§3.2). A signature that does not
+ * validate resolves to `{valid: false, reason}`; wrong arguments reject with
+ * a FactoidalError. A key read from ds:KeyInfo is returned, not trusted:
+ * the caller decides whether to trust `key` and `certificate`.
+ */
+export function xmlVerify(
+  document: string,
+  options?: {
+    key?: object;
+    hmacKey?: Uint8Array;
+    keyFromKeyInfo?: boolean;
+    certificates?: Uint8Array[];
+    documents?: Record<string, Uint8Array | string>;
+  }
+): Promise<
+  | {
+      valid: true;
+      signedInfo: string;
+      references: { uri: string; octets: Uint8Array }[];
+      key: object | null;
+      certificate: Uint8Array | null;
+    }
+  | { valid: false; reason: string }
+>;
+
+/**
+ * XML Signature 1.1 signature generation (§3.1). `key` is a private JWK
+ * (RSA 2048/3072/4096, EC P-256, or oct for HMAC). The returned document
+ * has passed core validation in the engine.
+ */
+export function xmlSign(
+  document: string,
+  options: {
+    key: object;
+    signatureMethod?: string;
+    canonicalizationMethod?: string;
+    inclusivePrefixes?: string[];
+    references?: { uri: string; transforms?: string[]; digestMethod?: string }[];
+    enveloping?: { id: string; content: string };
+    keyValue?: boolean;
+  }
+): Promise<{ document: string }>;
+
 /**
  * Decrypt a compact JWE (RFC 7516). Every failure after the allowlist is
  * the one error "decryption failed".
@@ -2330,6 +2374,8 @@ declare const _default: {
   vcEd25519Verify: typeof vcEd25519Verify;
   xmlDecrypt: typeof xmlDecrypt;
   xmlEncrypt: typeof xmlEncrypt;
+  xmlVerify: typeof xmlVerify;
+  xmlSign: typeof xmlSign;
   jweDecrypt: typeof jweDecrypt;
   jweEncrypt: typeof jweEncrypt;
   vcEddsaCreateFromCanonical: typeof vcEddsaCreateFromCanonical;

package/index.mjs

@@ -189,6 +189,8 @@ export const vcEd25519Verify = api.vcEd25519Verify;
 // XML Encryption 1.1 and JWE; AES through WebCrypto (lib/cipher-host.mjs)
 export const xmlDecrypt = api.xmlDecrypt;
 export const xmlEncrypt = api.xmlEncrypt;
+export const xmlVerify = api.xmlVerify;
+export const xmlSign = api.xmlSign;
 export const jweDecrypt = api.jweDecrypt;
 export const jweEncrypt = api.jweEncrypt;
 export const vcEddsaCreateFromCanonical = api.vcEddsaCreateFromCanonical;

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "5ca09ab0343e";
+const WASM_VERSION = "0b80e57ea8e5";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-e5057984e388-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/41154673265",
-  "gitSha": "e5057984e388be6534fef19cdbb869b5b5652a17",
-  "builtAt": "2026-10-31T02:40:08Z",
+  "release": "danbri/factoidal-builds build-084162b863c1-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/41860977405",
+  "gitSha": "084162b863c1f3a28d6dddab32511caa2d6e7c30",
+  "builtAt": "2026-11-04T16:27:40Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "5ca09ab0343eac5cfea0295461af8c4ea963a8bf083afc6f3aeadf1f92ef4804",
-  "wasmBytes": 30629431,
+  "wasmSha256": "0b80e57ea8e53299640cc8b1d75bfd5974ea91963988ab91d3aa4f5d2c0d7778",
+  "wasmBytes": 31363760,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -1821,6 +1821,138 @@ function buildApi(driver) {
     return { document: r.document, canonical: r.canonical };
   }
 
+  // -----------------------------------------------------------------
+  // XML Signature 1.1 (https://github.com/danbri/factoidal/issues/1165,
+  // track B, item 4). Every decision is in Lean (formal/lean4/Wasm/Ops/
+  // XmlDsig.lean over XML/DSig11.lean and XML/DSig11Sign.lean); RSA and
+  // P-256 run in the wasm (HACL*), HMAC in Lean. This code converts octets
+  // to base64 and draws the ECDSA nonce; it reads no document and chooses
+  // no algorithm or key.
+  // -----------------------------------------------------------------
+
+  // Octets given as a Uint8Array (or an ArrayBuffer view), as base64.
+  function octetsToBase64(fnName, name, value) {
+    if (value instanceof Uint8Array) return bytesToBase64(value);
+    if (ArrayBuffer.isView(value)) {
+      return bytesToBase64(new Uint8Array(value.buffer, value.byteOffset, value.byteLength));
+    }
+    if (value instanceof ArrayBuffer) return bytesToBase64(new Uint8Array(value));
+    throw new TypeError(`${fnName}: ${name} must be a Uint8Array`);
+  }
+
+  // A document for `documents`: a string is written as UTF-8.
+  function documentOctetsToBase64(fnName, uri, value) {
+    if (typeof value === 'string') return bytesToBase64(new TextEncoder().encode(value));
+    return octetsToBase64(fnName, `documents[${JSON.stringify(uri)}]`, value);
+  }
+
+  // One XML Signature op: the engine's envelope, or a FactoidalError when
+  // the arguments are wrong (`{ok: false}`).
+  async function dsigOp(fnName, what, args) {
+    const e = await entry();
+    requireEntryFn(e, fnName, what);
+    return entryResult(e[fnName](JSON.stringify(args)), fnName);
+  }
+
+  /**
+   * XML Signature 1.1 core validation (§3.2) of the one ds:Signature of an
+   * XML document. A signature that does not validate is a result
+   * (`valid: false` with the engine's reason), not an exception; wrong
+   * arguments throw a FactoidalError.
+   *
+   * With no `key` and no `hmacKey`, the key of ds:KeyInfo is used (unless
+   * `keyFromKeyInfo` is false). Such a key only says that the signature
+   * verifies under it: the result gives the key (`key`, a JWK) and the
+   * certificate that ds:X509Data names (`certificate`, DER), and the caller
+   * decides whether to trust them. The engine fetches nothing: `documents`
+   * gives the octets of each URI that is not a same-document reference.
+   *
+   * @param {string} document the XML document
+   * @param {{key?: object, hmacKey?: Uint8Array, keyFromKeyInfo?: boolean,
+   *   certificates?: Uint8Array[], documents?: Object<string, Uint8Array|string>}} [options]
+   *   `key` is a public JWK (RSA, or EC on P-256, P-384, P-521); `hmacKey`
+   *   the HMAC key octets; `certificates` DER certificates to select from
+   * @returns {Promise<{valid: true, signedInfo: string,
+   *   references: {uri: string, octets: Uint8Array}[], key: object|null,
+   *   certificate: Uint8Array|null} | {valid: false, reason: string}>}
+   */
+  async function xmlVerify(document, options) {
+    if (typeof document !== 'string') throw new TypeError('xmlVerify: document must be a string');
+    const o = options || {};
+    const args = { document };
+    if (o.key !== undefined) {
+      if (o.key === null || typeof o.key !== 'object') {
+        throw new TypeError('xmlVerify: options.key must be a JWK object');
+      }
+      args.key = o.key;
+    }
+    if (o.hmacKey !== undefined) args.hmacKey = octetsToBase64('xmlVerify', 'options.hmacKey', o.hmacKey);
+    if (o.keyFromKeyInfo !== undefined) args.keyFromKeyInfo = o.keyFromKeyInfo === true;
+    if (o.certificates !== undefined) {
+      if (!Array.isArray(o.certificates)) {
+        throw new TypeError('xmlVerify: options.certificates must be an array of Uint8Array');
+      }
+      args.certificates = o.certificates.map((c, i) =>
+        octetsToBase64('xmlVerify', `options.certificates[${i}]`, c));
+    }
+    if (o.documents !== undefined) {
+      if (o.documents === null || typeof o.documents !== 'object' || Array.isArray(o.documents)) {
+        throw new TypeError('xmlVerify: options.documents must be an object from URI to octets');
+      }
+      args.documents = {};
+      for (const [uri, v] of Object.entries(o.documents)) {
+        args.documents[uri] = documentOctetsToBase64('xmlVerify', uri, v);
+      }
+    }
+    const r = await dsigOp('xmlVerify', 'XML Signature verification', args);
+    if (r.valid !== true) return { valid: false, reason: String(r.reason) };
+    return {
+      valid: true,
+      signedInfo: r.signedInfo,
+      references: (r.references || []).map((x) => ({ uri: x.uri, octets: base64ToBytes(x.octets) })),
+      key: r.key ?? null,
+      certificate: typeof r.certificate === 'string' ? base64ToBytes(r.certificate) : null
+    };
+  }
+
+  /**
+   * XML Signature 1.1 signature generation (§3.1). The returned document
+   * has passed core validation in the engine before it is returned.
+   *
+   * `key` is a private JWK: RSA (`n`, `e`, `d`; 2048, 3072 or 4096 bits),
+   * EC on P-256 (`d`), or `oct` (`k`) for HMAC. The engine chooses the
+   * default method by the key kind (rsa-sha256, ecdsa-sha256, hmac-sha256)
+   * and refuses a method of another key kind. The default reference is the
+   * whole document with the enveloped-signature transform; with
+   * `enveloping`, the signature is the document and holds `content` in a
+   * ds:Object. The ECDSA nonce is 32 octets of `crypto.getRandomValues`.
+   *
+   * @param {string} document the XML document
+   * @param {{key: object, signatureMethod?: string, canonicalizationMethod?: string,
+   *   inclusivePrefixes?: string[],
+   *   references?: {uri: string, transforms?: string[], digestMethod?: string}[],
+   *   enveloping?: {id: string, content: string}, keyValue?: boolean}} options
+   *   algorithm identifiers are the URIs of XML Signature 1.1 §6
+   * @returns {Promise<{document: string}>}
+   */
+  async function xmlSign(document, options) {
+    if (typeof document !== 'string') throw new TypeError('xmlSign: document must be a string');
+    const o = options || {};
+    if (o.key === null || typeof o.key !== 'object') {
+      throw new TypeError('xmlSign: options.key must be a private JWK object');
+    }
+    const args = { document, key: o.key };
+    for (const k of ['signatureMethod', 'canonicalizationMethod', 'inclusivePrefixes',
+      'references', 'enveloping']) {
+      if (o[k] !== undefined) args[k] = o[k];
+    }
+    if (o.keyValue !== undefined) args.keyValue = o.keyValue === true;
+    // The nonce is given for every key; the engine reads it only for ECDSA.
+    args.random = randomBase64(32);
+    const r = await dsigOp('xmlSign', 'XML Signature generation', args);
+    return { document: r.document };
+  }
+
   /**
    * Decrypt a JWE in the Compact Serialization (RFC 7516).
    * @param {string} token the compact JWE
@@ -2770,6 +2902,8 @@ function buildApi(driver) {
     vcEd25519Verify,
     xmlDecrypt,
     xmlEncrypt,
+    xmlVerify,
+    xmlSign,
     jweDecrypt,
     jweEncrypt,
     vcEddsaCreateFromCanonical,

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.28.0';
+export const version = '0.30.0';

package/lws/client.mjs

@@ -34,7 +34,6 @@
 // browser's, or one that carries each request as a message over another
 // transport (XMPP, a worker port). The client needs no global fetch.
 
-import { loadEngine } from '../bin/engine.mjs'
 import { FactoidalError } from '../lib/errors.mjs'
 
 /** The ops this host needs from the engine. */
@@ -159,7 +158,9 @@ export async function lwsClientOpsAvailable (engine) {
  * @returns {Promise<object>} the client
  */
 export async function createLwsClient (options = {}) {
-  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  // Browsers inject their already loaded engine. Only the Node/Deno default
+  // loader imports the file-backed store host; keep it out of that import graph.
+  const engine = options.engine !== undefined ? options.engine : await (await import('../bin/engine.mjs')).loadEngine()
   const wire = typeof options.fetch === 'function' ? options.fetch : globalThis.fetch
   if (typeof wire !== 'function') throw new TypeError('no fetch is available in this runtime')
   const maxSteps = typeof options.maxSteps === 'number' ? options.maxSteps : 1024
@@ -310,7 +311,7 @@ export async function createLwsClient (options = {}) {
  *   `selfIssued` is the `createLwsClient` option of that name
  */
 export async function createDidKey (options = {}) {
-  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const engine = options.engine !== undefined ? options.engine : await (await import('../bin/engine.mjs')).loadEngine()
   const algorithm = typeof options.algorithm === 'string' ? options.algorithm : 'ES256'
   const random = new Uint8Array(64)
   globalThis.crypto.getRandomValues(random)