@factoidal/core 0.28.0 → 0.30.0

package/lws/dataset.mjs

@@ -0,0 +1,160 @@
+// An LWS storage as an RDF dataset (https://github.com/danbri/factoidal/issues/1011,
+// version 2): a table-of-contents graph named by the storage description IRI
+// (the containment as lws:items, the listing members, the link from each
+// resource to its linkset), one named graph per RDF document, one named graph
+// per linkset, and the entity tag of every document and linkset read.
+// Design record: docs/designissues/2026-10-25-lws-dataset-view.md
+//
+// WHAT THIS FILE IS ALLOWED TO DO
+// Loop. Start at the storage root; ask the LWS client (lws/client.mjs) to
+// list a container; give the engine the listing and the container IRI (op
+// lwsViewPlan), which answers which members to list, which to read and whose
+// linksets to read; read those with the client (read, readLinkset); give the
+// engine every listing, read and linkset read (op lwsDatasetView), which
+// answers the dataset as N-Quads with the evidence and the name of the
+// table-of-contents graph; open that text as a Dataset. Every decision is
+// Lean: which members are containers, which media types have an RDF reader
+// and which resources have a linkset to read
+// (L4Factoidal/LWS/DatasetViewRead.lean), the entity tag and the graph of
+// each read, the links of each linkset, the storage description IRI, and the
+// view itself (L4Factoidal/LWS/DatasetView.lean). This file reads no header,
+// no link and chooses no media type.
+//
+// Limits (stated in API.md): a full crawl on every open; one HEAD and one GET
+// per resource for its linkset; no search index; no caching; the snapshot is
+// a sequence of GETs, not one read of the storage.
+
+import { loadEngine } from '../bin/engine.mjs'
+import { parse } from '../index.mjs'
+import { createLwsClient, LwsClientError } from './client.mjs'
+import { FactoidalError } from '../lib/errors.mjs'
+
+/** The engine ops this host needs, beyond the client's. */
+export const LWS_DATASET_OPS = ['lwsViewPlan', 'lwsDatasetView']
+
+function isUnknownOp (error) {
+  const text = error && error.message ? String(error.message) : String(error)
+  return text.indexOf('unknown op') >= 0
+}
+
+/**
+ * Whether the loaded engine carries the dataset-view ops.
+ *
+ * @param {object} engine the handle from `loadEngine()`
+ * @returns {Promise<{available: boolean, reason: string}>}
+ */
+export async function lwsDatasetOpsAvailable (engine) {
+  try {
+    const plan = engine.call('lwsViewPlan', ['{}'])
+    if (!plan || !Array.isArray(plan.metadata)) {
+      return {
+        available: false,
+        reason: 'the loaded l4factoidal WebAssembly module carries version 1 of lwsViewPlan ' +
+          '(no metadata member; rebuild formal/lean4/Wasm)'
+      }
+    }
+    return { available: true, reason: 'lwsViewPlan answered' }
+  } catch (error) {
+    if (isUnknownOp(error)) {
+      return {
+        available: false,
+        reason: 'the loaded l4factoidal WebAssembly module does not carry lwsViewPlan ' +
+          '(rebuild formal/lean4/Wasm)'
+      }
+    }
+    return { available: true, reason: 'lwsViewPlan answered with an engine error' }
+  }
+}
+
+/**
+ * Crawl an LWS storage and open it as a Dataset.
+ *
+ * @param {string} storageRootUrl the URL of the storage root container
+ * @param {object} [options]
+ * @param {Function} [options.fetch] the fetch to use (default `globalThis.fetch`)
+ * @param {object} [options.auth] passed to `createLwsClient`:
+ *   `{ subjectToken, subjectTokenType }`, `{ selfIssued }` or `{ session }`
+ * @param {object} [options.engine] an engine handle to reuse
+ * @param {number} [options.maxContainers] stop with an error after listing
+ *   this many containers (default 10000)
+ * @returns {Promise<object>} `{ dataset, toc, evidence, skipped, graphs,
+ *   query(sparql, options), dispose() }`
+ */
+export async function openLwsDataset (storageRootUrl, options = {}) {
+  if (typeof storageRootUrl !== 'string') {
+    throw new TypeError('openLwsDataset: storageRootUrl must be a string')
+  }
+  const engine = options.engine !== undefined ? options.engine : await loadEngine()
+  const probe = await lwsDatasetOpsAvailable(engine)
+  if (!probe.available) {
+    throw new FactoidalError(`openLwsDataset: ${probe.reason}`, { code: 'op.unknown' })
+  }
+  const auth = options.auth !== undefined && options.auth !== null ? options.auth : {}
+  const client = await createLwsClient({ ...auth, engine, fetch: options.fetch })
+  const maxContainers = typeof options.maxContainers === 'number' ? options.maxContainers : 10000
+
+  const queue = [storageRootUrl]
+  const listed = new Set()
+  const listings = []
+  const reads = []
+  const linksets = []
+  const skipped = []
+  while (queue.length > 0) {
+    const container = queue.shift()
+    if (listed.has(container)) continue
+    if (listed.size >= maxContainers) {
+      throw new FactoidalError(`openLwsDataset: more than ${maxContainers} containers`,
+        { code: 'lws.dataset.limit' })
+    }
+    listed.add(container)
+    const done = await client.list(container)
+    listings.push({ container, done })
+    const plan = engine.call('lwsViewPlan', [JSON.stringify(done), container])
+    for (const c of plan.containers) queue.push(c)
+    for (const s of plan.skipped) skipped.push(s)
+    for (const resource of plan.resources) {
+      try {
+        reads.push({ resource, done: await client.read(resource) })
+      } catch (error) {
+        if (!(error instanceof LwsClientError)) throw error
+        skipped.push({ resource, reason: `read: ${error.reason}` })
+      }
+    }
+    for (const resource of plan.metadata) {
+      try {
+        linksets.push({ resource, done: await client.readLinkset(resource) })
+      } catch (error) {
+        if (!(error instanceof LwsClientError)) throw error
+        skipped.push({ resource, reason: `linkset: ${error.reason}` })
+      }
+    }
+  }
+
+  const view = engine.call('lwsDatasetView', [JSON.stringify({ listings, reads, linksets })])
+  for (const s of view.skipped) skipped.push(s)
+  const dataset = await parse(view.nquads, { format: 'nquads' })
+  const evidence = view.evidence.map((e) => ({ ...e }))
+
+  return {
+    dataset,
+    /** The name of the table-of-contents graph: the storage description IRI. */
+    toc: view.toc,
+    /** Each RDF document read, `{ resource, etag, lastModified }`, then each
+     *  linkset read, `{ resource, linkset, etag }`. */
+    evidence,
+    /** Each member or read left out of the dataset: `{ resource, reason }`. */
+    skipped,
+    /** The number of named graphs (the table of contents, the documents and
+     *  the linksets). */
+    graphs: view.graphs,
+    /**
+     * Run a SPARQL query over the dataset.
+     * @returns {Promise<{result: *, evidence: Array<object>}>} `result` as
+     *   `Dataset.query` answers; `evidence` the documents and linksets read
+     */
+    async query (sparql, queryOptions) {
+      return { result: await dataset.query(sparql, queryOptions), evidence: evidence.slice() }
+    },
+    dispose () { dataset.dispose() }
+  }
+}

package/lws/inpage.mjs

@@ -0,0 +1,135 @@
+// factoidal/lws/inpage.mjs — one Lean LWS storage with no network: it runs
+// in the page (or a worker, or Node) beside the code that uses it, and is
+// reached through a `fetch`-shaped function.
+//
+//   import { loadEngine } from '@factoidal/core/browser'
+//   import { openInPageLwsStorage } from '@factoidal/core/lws/inpage'
+//   const pod = await openInPageLwsStorage({ engine: await loadEngine(),
+//     baseIri: 'https://pod.foafos.local/', principal: 'urn:foafos:shell',
+//     rootAcl, storageKey, snapshot: saved,
+//     onSnapshot: (s) => save(s) })
+//   const r = await pod.fetch('https://pod.foafos.local/notes/a.txt', { method: 'PUT', body: 'hi' })
+//
+// The storage has a component principal (issue 1238): every request is that
+// agent's, no token is read, and Web Access Control still decides it
+// (L4Factoidal/LWS/Authorization.lean). Whoever holds the object can use it,
+// so the host page decides which code gets it, as with xmpp/inpage.mjs.
+//
+// It is kept as one snapshot (`lwsSnapshot`), which the engine seals when a
+// `storageKey` is given. After each step that changed the storage this file
+// asks the engine for the snapshot and gives it to `onSnapshot`; the caller
+// keeps it (IndexedDB, a file) and passes it back as `snapshot` to reopen.
+// The engine checks that snapshot and refuses one sealed under another key.
+//
+// The engine makes every protocol decision (status, headers, bodies). This
+// file turns a fetch call into the request record of the wasm ABI
+// (docs/lws-solid-conformance.md, "wasm ABI") and the response record into a
+// Response. Notifications are off: there is no network to deliver them on.
+// No Node API; `crypto.getRandomValues`, `Request` and `Response` only.
+
+/** Random bytes for the engine, base64 (see lws/server.mjs, entropyBase64). */
+function entropyBase64 (size = 32) {
+  const bytes = new Uint8Array(size)
+  globalThis.crypto.getRandomValues(bytes)
+  let text = ''
+  for (const b of bytes) text += String.fromCharCode(b)
+  return btoa(text)
+}
+
+function handleOf (envelope) {
+  if (envelope === null || typeof envelope !== 'object') return null
+  for (const name of ['handle', 'id']) {
+    const value = envelope[name]
+    if (typeof value === 'string' && value.length > 0) return value
+    if (typeof value === 'number') return String(value)
+  }
+  return null
+}
+
+/**
+ * @param {object} options
+ * @param {object} options.engine a loaded engine handle (`loadEngine()`), with callBlobIO
+ * @param {string} options.baseIri the absolute IRI the storage root maps to; fetch
+ *   reaches only IRIs under it
+ * @param {string} options.principal the component principal (an IRI); every request is its
+ * @param {string} [options.rootAcl] the root ACL (Turtle) of a new storage
+ * @param {string} [options.owner] the WebID the storage advertises
+ * @param {string} [options.storageKey] key text (64 hex digits or base64url); seals the snapshot
+ * @param {object} [options.snapshot] a snapshot to continue from (from onSnapshot)
+ * @param {function} [options.onSnapshot] (snapshot) => void, after each change
+ * @param {number} [options.maxBody] the largest content of one write (the engine's default otherwise)
+ * @returns {Promise<{fetch: Function, snapshot: Function, close: Function, baseIri: string}>}
+ */
+export async function openInPageLwsStorage (options = {}) {
+  const { engine } = options
+  if (!engine || typeof engine.callBlobIO !== 'function') throw new TypeError('openInPageLwsStorage: an engine with callBlobIO is required')
+  if (typeof options.baseIri !== 'string') throw new TypeError('openInPageLwsStorage: baseIri is required')
+  if (typeof options.principal !== 'string') throw new TypeError('openInPageLwsStorage: principal is required')
+  const base = new URL(options.baseIri)
+  const config = { baseIri: base.href, principal: options.principal, notifications: false, entropy: entropyBase64() }
+  for (const name of ['rootAcl', 'owner', 'storageKey']) {
+    if (typeof options[name] === 'string') config[name] = options[name]
+  }
+  if (typeof options.maxBody === 'number') config.maxBody = options.maxBody
+  if (options.snapshot !== undefined && options.snapshot !== null) config.snapshot = options.snapshot
+  const opened = engine.call('lwsOpen', [JSON.stringify(config)])
+  const handle = handleOf(opened)
+  if (handle === null) throw new Error('lwsOpen answered with no handle')
+  const onSnapshot = typeof options.onSnapshot === 'function' ? options.onSnapshot : null
+  let closed = false
+
+  const snapshot = () => {
+    const answer = engine.call('lwsSnapshot', [handle, JSON.stringify({ nonce: entropyBase64(12) })])
+    if (answer === null || typeof answer !== 'object' || answer.snapshot === undefined) {
+      throw new Error('lwsSnapshot answered with no snapshot')
+    }
+    return answer.snapshot
+  }
+
+  /** A fetch to this storage: the same arguments as `fetch`, a real Response back. */
+  async function podFetch (input, init) {
+    if (closed) throw new TypeError('this storage is closed')
+    const request = new Request(input, init)
+    const url = new URL(request.url)
+    if (url.origin !== base.origin || !url.pathname.startsWith(base.pathname)) {
+      throw new TypeError('the IRI is not in this storage')
+    }
+    const target = '/' + url.pathname.slice(base.pathname.length) + url.search
+    const content = request.method === 'GET' || request.method === 'HEAD'
+      ? new Uint8Array(0)
+      : new Uint8Array(await request.arrayBuffer())
+    const record = {
+      method: request.method,
+      target,
+      headers: [...request.headers],
+      now: Math.floor(Date.now() / 1000),
+      random: entropyBase64(16)
+    }
+    const got = engine.callBlobIO('lwsStep', [handle, JSON.stringify(record)], content)
+    const envelope = got.envelope
+    if (envelope === null || typeof envelope !== 'object') throw new Error('lwsStep answered with no envelope')
+    // A storage with a component principal and no files has nothing to
+    // fetch, resolve or read; an engine that asks is not one this host runs.
+    for (const ask of ['fetch', 'resolve', 'read']) {
+      if (envelope[ask] !== undefined && envelope[ask] !== null) throw new Error(`lwsStep asked this host to ${ask}, which an in-page storage cannot`)
+    }
+    const answer = (envelope.response !== null && typeof envelope.response === 'object') ? envelope.response : envelope
+    if (typeof answer.status !== 'number') throw new Error('lwsStep answered with no status in its response record')
+    if (envelope.changed === true && onSnapshot !== null) onSnapshot(snapshot())
+    const headers = new Headers()
+    for (const [name, value] of Array.isArray(answer.headers) ? answer.headers : []) headers.append(name, value)
+    // No content is a null body: a Response refuses an empty one with 204 or 304.
+    const body = got.bytes instanceof Uint8Array && got.bytes.length > 0 ? got.bytes : null
+    return new Response(body, { status: answer.status, headers })
+  }
+
+  return {
+    baseIri: base.href,
+    fetch: podFetch,
+    snapshot,
+    close () {
+      closed = true
+      try { engine.call('lwsClose', [handle]) } catch (_error) { /* already gone */ }
+    }
+  }
+}

package/lws/persist.mjs

@@ -64,7 +64,7 @@ export const STORAGE_MODE_VARIABLE = 'FACTOIDAL_LWS_STORAGE'
 /**
  * The text of the storage mode: `explicit` when the caller gave a string,
  * and otherwise the environment variable, passed unread; the engine checks
- * it. An empty value is none (the engine's default, the snapshot).
+ * it. An empty value is none (the host's default with a DIR, "files").
  */
 export function storageModeText (explicit) {
   if (typeof explicit === 'string') return explicit

package/lws/server.mjs

@@ -250,8 +250,9 @@ function contentBytes (request) {
  * @param {boolean} [options.realClock] stamp each request with this host's clock
  * @param {string|null} [options.storageKey] the storage key text (64 hex digits or base64url);
  *   default the environment variable FACTOIDAL_LWS_KEY; `null` reads no key
- * @param {string} [options.storage] where DIR keeps the storage: "snapshot" (default, one
- *   file) or "files" (one file per body and a journal, issue 918); passed unread
+ * @param {string} [options.storage] where DIR keeps the storage: "files" (default, one
+ *   file per body and a journal, issue 918) or "snapshot" (one file written whole after
+ *   each change); passed unread
  * @param {boolean|string[]} [options.cors] CORS (issue 923): false for none, a list of
  *   origins to answer; default: echo any valid request Origin. Passed unread
  * @param {string} [options.lockCommand] the command named in the lock file of DIR
@@ -270,12 +271,20 @@ export async function openLwsStorage (options = {}) {
   // The pagination threshold and page size of container listings; the
   // engine decides what it means (L4Factoidal/LWS/Pagination.lean).
   if (typeof options.pageSize === 'number') config.pageSize = options.pageSize
+  // The largest content of one write; the engine answers 413 above it
+  // (L4Factoidal/LWS/Operations.lean, step_tooLarge; issue 1240).
+  if (typeof options.maxBody === 'number') config.maxBody = options.maxBody
   // Authorization (L4Factoidal/LWS/Authorization.lean). `auth` is passed
   // through unread; `insecureNoAuth` is the explicit development mode.
   // With neither, the engine enforces authorization with no trusted
   // issuer.
   if (options.auth !== undefined && options.auth !== null) config.auth = options.auth
   if (options.insecureNoAuth === true) config.insecureNoAuth = true
+  // A component principal (issue 1238): a storage a component opens
+  // in-process. No token is read; every request is this agent's, and WAC
+  // decides it (Authorization.decide_principal_agents). Never served over
+  // HTTP: createLwsServer refuses it.
+  if (typeof options.principal === 'string') config.principal = options.principal
   if (typeof options.rootAcl === 'string') config.rootAcl = options.rootAcl
   // Notifications are on unless the caller turns them off; the engine
   // decides everything else about them.
@@ -339,10 +348,13 @@ export async function openLwsStorage (options = {}) {
   // With "files" the engine names the files to read (`load`) and gives the
   // plan of every write (`lwsPersist`), and this host reads no snapshot.
   // With a DIR and no `storage` option, the environment variable
-  // FACTOIDAL_LWS_STORAGE is the value; without a DIR there is nothing to
+  // FACTOIDAL_LWS_STORAGE is the value, and without it "files" (2026-11-03):
+  // a write then costs what it changes, not the size of the storage. A DIR
+  // that holds a snapshot is migrated at the first start (lws-state.json is
+  // renamed lws-state.json.migrated). Without a DIR there is nothing to
   // keep, and only an explicit option is passed.
   const dir = typeof options.dir === 'string' ? options.dir : null
-  const storage = dir !== null ? storageModeText(options.storage) : options.storage
+  const storage = dir !== null ? (storageModeText(options.storage) ?? 'files') : options.storage
   if (typeof storage === 'string') config.storage = storage
   // One writing process per storage directory
   // (https://github.com/danbri/factoidal/issues/1135): the lock is taken
@@ -589,13 +601,37 @@ export async function openLwsStorage (options = {}) {
   }
 }
 
-/** Read a Node request body as its bytes. */
-function readBody (request) {
+/** The engine's default `maxBody` (L4Factoidal/LWS/Operations.lean). */
+export const DEFAULT_MAX_BODY = 16 * 1024 * 1024
+
+/**
+ * Read a Node request body as its bytes, at most `limit + 1` of them. Past
+ * the limit it keeps the first `limit + 1` bytes, stops reading and says so
+ * (`over`), so an oversized upload never reaches memory whole (issue 1240).
+ * The engine decides the answer: content over its `maxBody` is refused with
+ * 413 and changes nothing (`step_tooLarge`, L4Factoidal/LWS/Operations.lean).
+ */
+function readBody (request, limit = DEFAULT_MAX_BODY) {
   return new Promise((resolve, reject) => {
     const chunks = []
-    request.on('data', (chunk) => chunks.push(chunk))
+    let size = 0
+    let over = false
+    const done = () => resolve({ bytes: new Uint8Array(Buffer.concat(chunks)), over })
+    request.on('data', (chunk) => {
+      if (over) return
+      if (size + chunk.length > limit) {
+        chunks.push(chunk.subarray(0, limit + 1 - size))
+        size = limit + 1
+        over = true
+        done()
+        request.resume()
+        return
+      }
+      size += chunk.length
+      chunks.push(chunk)
+    })
     request.on('error', reject)
-    request.on('end', () => resolve(new Uint8Array(Buffer.concat(chunks))))
+    request.on('end', () => { if (!over) done() })
   })
 }
 
@@ -623,6 +659,11 @@ function headerPairs (raw) {
  *                    setBaseIri: Function}>}
  */
 export async function createLwsServer (options = {}) {
+  if (options.principal !== undefined) {
+    // Served over HTTP, a principal storage would let every client act as
+    // the component. It is for in-process use only (issue 1238).
+    throw new LwsHostError('a storage with a component principal is in-process only; it is not served over HTTP')
+  }
   const http = await import('node:http')
   const onError = typeof options.onError === 'function'
     ? options.onError
@@ -675,8 +716,13 @@ export async function createLwsServer (options = {}) {
         method: request.method,
         target: request.url,
         headers: headerPairs(request.rawHeaders),
-        body: await readBody(request)
+        body: new Uint8Array(0)
       }
+      const read = await readBody(request, typeof settings.maxBody === 'number' ? settings.maxBody : DEFAULT_MAX_BODY)
+      record.body = read.bytes
+      // The rest of an oversized body is not read: the connection closes
+      // after the answer. The answer is the engine's.
+      if (read.over) response.shouldKeepAlive = false
     } catch (error) {
       onError(error)
       response.writeHead(500, { 'content-type': 'text/plain' })

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@factoidal/core",
-  "version": "0.28.0",
-  "description": "EXPERIMENTAL UNREVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
+  "version": "0.30.0",
+  "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",
     "rdf",
@@ -70,6 +70,7 @@
     "./store-host/paths": "./store-host/paths.mjs",
     "./xmpp": "./xmpp/index.mjs",
     "./xmpp/server": "./xmpp/server.mjs",
+    "./xmpp/inpage": "./xmpp/inpage.mjs",
     "./cipher-host": "./lib/cipher-host.mjs",
     "./store": {
       "default": "./bin/store.mjs"
@@ -92,9 +93,15 @@
     "./webdav": {
       "default": "./webdav/server.mjs"
     },
+    "./lws/inpage": {
+      "default": "./lws/inpage.mjs"
+    },
     "./lws/client": {
       "default": "./lws/client.mjs"
     },
+    "./lws/dataset": {
+      "default": "./lws/dataset.mjs"
+    },
     "./authz": {
       "default": "./authz/server.mjs"
     },

package/xmpp/README.md

@@ -65,8 +65,12 @@ against an older committed bundle instead of getting a confusing
 mkdir -p state && printf 'juliet:r0m30\nromeo:juli3t\n' > state/accounts
 npx factoidal xmpp-serve state --domain localhost            # plaintext on 5222
 npx factoidal xmpp-serve state --cert fullchain.pem --key privkey.pem   # XEP-0368 direct TLS on 5223
+npx factoidal xmpp-serve state --cert fullchain.pem --key privkey.pem --starttls   # STARTTLS required on 5222
 ```
 
+Without `--cert` and `--key` the listener has no TLS and offers PLAIN, so
+the command binds it to a loopback address only.
+
 ```js
 import { listen } from '@factoidal/core/xmpp/server'
 const running = await listen({ dir: 'state', domain: 'localhost', port: 0 })
@@ -90,6 +94,7 @@ process per connection behind socat) serves; the wasm session ops are
 | `xmppSessionFeed` | `[session, text]` | `{ ok, send: [...], route: [{to, text}], presence: [...], rostersSaved: [...], close, stage, bare, full, bufferedBytes }` |
 | `xmppSessionDeliver` | `[session, text]` | `{ ok, delivered, send }` — `delivered:false` for an unbound session; nothing is lost |
 | `xmppSessionClose` | `[session]` | `{ ok, send }` |
+| `xmppSessionTlsUp` | `[session]` | `{ ok, stage }` — after a feed answered `startTls: true` and the host finished the TLS handshake; refused otherwise |
 | `xmppRosterGet` / `xmppRosterSet` | `[server, bare]` / `[server, bare, encoded]` | the roster in the engine's own on-disk encoding |
 | `xmppClose` | `[server]` | `{ ok, sessions }` |
 
@@ -120,7 +125,10 @@ What it speaks: RFC 6120 stream negotiation, stream errors, SASL PLAIN
 and SCRAM-SHA-256, resource binding; RFC 6121 roster, presence
 subscription and broadcast, message delivery with the server-stamped
 `from`; XEP-0030 `disco#info`; XEP-0368 direct TLS with `--cert`/`--key`.
-Not: STARTTLS, server-to-server federation, MUC/MIX/GC3 rooms, PRECIS.
+RFC 6120 section 5 STARTTLS with `startTls: true` (op `xmppSessionTlsUp`;
+the engine decides, the host does the handshake; see the theorems in
+`formal/lean4/L4Factoidal/XMPP/Server.lean`).
+Not: server-to-server federation, MUC/MIX/GC3 rooms, PRECIS.
 Known limitation shared with the native harness: one SCRAM salt per
 server (`saltB64` in the config), not one per account.