@factoidal/core 0.31.0 → 0.32.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## Unreleased
+
+- XMPP: `xmpp-serve --starttls --tls-port N` serves STARTTLS and XEP-0368 direct TLS from one server.
+- XMPP: members-only rooms (XEP-0045 section 7.2.6). `xmpp-serve --muc-members FILE` lists who may join each room; anyone else gets `registration-required` and cannot see the room.
+- XMPP: disco#info and disco#items results carry `from`. Without it, Profanity 0.19.0 stopped with a segmentation fault after login.
+
+## 0.32.0 (2026-11-05)
+
+- XMPP: stanzas are held to RFC 6120 section 11.1. A DTD, a comment or a processing instruction is refused (https://github.com/danbri/factoidal-core/pull/355). Upgrade if you run `xmpp-serve`.
+- XMPP: `xmpp-serve` limits connections (`--max-connections`, default 1024), the time to log in (`--login-timeout`, default 30 seconds) and the bytes queued for a client that is not reading (https://github.com/danbri/factoidal-core/pull/358).
+- `foafnaut` command to start the Lean browser on macOS (https://github.com/danbri/factoidal-core/pull/349). The document renderer itself ships through the foafnaut build sets, not through this package.
+
+## 0.31.1 (2026-11-05)
+
+- Engine start uses less stack. Two more test fixtures ran with one stack frame for each byte when the engine started: `swapLabelGo` (`Storage/ShardManifest.lean`) and `bytesOfHexLiteral` (`Storage/LiteralGramIndexWire.lean`). Both are now loops. In 0.31.0, WebKit needed between 640 KB and 768 KB of stack to start the engine.
+
 ## 0.31.0 (2026-11-05)
 
 - Stack use on phones. The engine failed on iPhone Safari with "Maximum call stack size exceeded". Two faults are fixed:

package/bin/factoidal.mjs

@@ -747,10 +747,11 @@ Specification: https://solidproject.org/TR/protocol`,
   'xmpp-serve': `factoidal xmpp-serve - serve XMPP (RFC 6120 and RFC 6121) over TCP, STARTTLS or direct TLS
 
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
-                            [--accounts FILE] [--cert FILE --key FILE [--starttls]]
+                            [--accounts FILE] [--cert FILE --key FILE [--starttls [--tls-port N]]]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
-                            [--muc DOMAIN] [--mix DOMAIN] [--gc3 DOMAIN]
-                            [--state-key FILE]
+                            [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--state-key FILE] [--max-connections N]
+                            [--login-timeout SECONDS]
 
 Starts a Node TCP server that runs one engine session per connection and
 answers every byte through the engine's xmppSessionFeed operation.
@@ -773,6 +774,8 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
   --starttls       listen in clear and REQUIRE STARTTLS (RFC 6120 section 5)
                    before anything else; no SASL mechanism is offered and no
                    credential is accepted until the TLS handshake finishes
+  --tls-port N     with --starttls, also serve XEP-0368 direct TLS on port N,
+                   in the same server (the same rooms and sessions)
   --ws-port N      also serve XMPP over WebSocket (RFC 7395, the "xmpp"
                    subprotocol of RFC 6455) for browser clients such as
                    Strophe.js; wss: with --cert and --key, else loopback only
@@ -785,10 +788,19 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    conference.example.com: temporary rooms, made by the first
                    join and gone with the last occupant; no history, no
                    configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+  --muc-members FILE  members-only rooms: one room per line, as
+                   "room: alice@example.com bob@example.com". Only those accounts
+                   may join or see that room; a room not in the file is open to
+                   every account (L4Factoidal/XMPP/Muc.lean)
   --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
                    joined through this server (XEP-0405 MIX-PAM); channels are
                    made by an IQ <create/>, kept in memory only, JID-hidden; no
                    PubSub nodes, no archive (L4Factoidal/XMPP/Mix.lean)
+  --max-connections N  open connections of all kinds before a new one is closed
+                   at once (default 1024). There is no limit per address:
+                   behind a proxy, every client has the same one
+  --login-timeout SECONDS  how long a connection may stay without a bound
+                   resource before it is closed (default 30; 0 disables)
   --state-key FILE keep the server's state across restarts: rosters, messages held
                    for offline accounts, MIX channels and GC3 groups, in an LWS
                    storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
@@ -1211,7 +1223,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'mix', 'gc3', 'state-key']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2873,6 +2885,12 @@ async function commandXmppServe (positional, options) {
     settings.key = await fs.readFile(options.key)
   }
   if (startTls) settings.startTls = true
+  if (options['tls-port'] !== undefined) {
+    if (!startTls) throw new UsageError('--tls-port needs --starttls')
+    const tlsPort = Number(options['tls-port'])
+    if (!Number.isInteger(tlsPort) || tlsPort < 0 || tlsPort > 65535) throw new UsageError('--tls-port needs a port number')
+    settings.directTlsPort = tlsPort
+  }
   if (options['state-key'] !== undefined) {
     if (typeof options['state-key'] !== 'string') throw new UsageError('--state-key needs a FILE')
     // 64 hex digits or base64url of 32 bytes; the engine checks it.
@@ -2884,6 +2902,20 @@ async function commandXmppServe (positional, options) {
     }
     settings.mucDomain = options.muc
   }
+  if (options['muc-members'] !== undefined) {
+    if (typeof options['muc-members'] !== 'string') throw new UsageError('--muc-members needs a FILE')
+    if (settings.mucDomain === undefined) throw new UsageError('--muc-members needs --muc')
+    settings.mucMembers = []
+    for (const line of (await fs.readFile(options['muc-members'], 'utf8')).split('\n')) {
+      if (line.trim() === '') continue
+      const [, room, list] = /^([^:\s@/]+):(.*)$/.exec(line.trim()) ?? []
+      const members = (list ?? '').split(/\s+/).filter(Boolean)
+      if (room === undefined || members.some((m) => !/^[^\s@/]+@[^\s@/]+$/.test(m))) {
+        throw new UsageError(`--muc-members: not "room: bare@jid ...": ${line}`)
+      }
+      settings.mucMembers.push({ room, members })
+    }
+  }
   if (options.mix !== undefined) {
     if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
       throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
@@ -2898,6 +2930,16 @@ async function commandXmppServe (positional, options) {
     if (options.gc3 === options.muc || options.gc3 === options.mix) throw new UsageError('--gc3 needs a domain of its own')
     settings.gc3Domain = options.gc3
   }
+  if (options['max-connections'] !== undefined) {
+    const n = Number(options['max-connections'])
+    if (!Number.isSafeInteger(n) || n < 1) throw new UsageError('--max-connections needs a positive integer')
+    settings.maxConnections = n
+  }
+  if (options['login-timeout'] !== undefined) {
+    const n = Number(options['login-timeout'])
+    if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--login-timeout needs a number of seconds')
+    settings.loginTimeoutMs = n * 1000
+  }
   if (options['ws-port'] !== undefined) {
     const wsPort = Number(options['ws-port'])
     if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
@@ -2936,11 +2978,13 @@ async function commandXmppServe (positional, options) {
     if (settings.stateKey) err(`xmpp-serve: state kept across restarts in ${positional[0]}/state, sealed under the state key`)
     else err('xmpp-serve: WARNING: no --state-key: held messages, MIX channels and GC3 groups are lost at a restart, and rosters are written in clear')
   }
+  if (running.directOrigin && !quiet) err(`xmpp-serve: direct TLS (XEP-0368) on ${running.directOrigin}`)
   if (running.wsOrigin && !quiet) {
     err(`xmpp-serve: XMPP over WebSocket on ${running.wsOrigin}` +
         (settings.websocket.allowedOrigins.length ? ` for Origin ${settings.websocket.allowedOrigins.join(', ')}` : ' (no browser Origin allowed)'))
   }
   out(running.origin)
+  if (running.directOrigin) out(running.directOrigin)
   if (running.wsOrigin) out(running.wsOrigin)
   return untilInterrupted(running, quiet)
 }

package/bin/foafnaut-bleedingedge.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// foafnaut with the bleeding-edge channel; see foafnaut.mjs.
+import { main } from './foafnaut.mjs';
+await main(process.argv.slice(2), 'bleeding-edge');

package/bin/foafnaut-latest.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// foafnaut with the latest channel; see foafnaut.mjs.
+import { main } from './foafnaut.mjs';
+await main(process.argv.slice(2), 'latest');

package/bin/foafnaut.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// foafnaut: start foafnaut2525, the Lean web rendering engine, in its own window.
+// This launcher only chooses and starts an installed macOS app. All page work is
+// in that app. Layout: $FOAFNAUT_HOME (default ~/.foafnaut), versions/<commit>/,
+// current -> versions/<commit>, config.json {"bleedingEdge":"/path/to/App.app"}.
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
+
+  PAGE              an http(s) URL or an HTML file; none opens the default page
+  --latest          install the newest published macOS build, then use it
+  --bleeding-edge   use the local build (config.json "bleedingEdge", or
+                    ~/Applications/foafnaut.app)
+  --verbose         print the choice of app, follow the trace, and log input
+  --detach          do not wait for the window to close
+  --install-latest  install the newest published build and stop
+  --list            list installed versions
+  --which           print the app that would run
+  --help            this text
+
+Also: foafnaut-latest, foafnaut-bleedingedge. Environment: FOAFNAUT_HOME, and
+FOAFNAUT_APP, which chooses the app outright. Page data goes to the app. Its trace
+is in ~/Library/Logs/foafnaut/trace.jsonl. The command stays open until the window
+closes; --detach returns at once.
+
+EXPERIMENTAL UNDER-REVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.
+`;
+const RELEASES = 'https://api.github.com/repos/danbri/factoidal-builds/releases?per_page=60';
+const APP = 'foafnaut.app';
+const home = () => process.env.FOAFNAUT_HOME || join(homedir(), '.foafnaut');
+const fail = (message) => { console.error(`foafnaut: ${message}`); process.exit(1); };
+
+function config() {
+  const path = join(home(), 'config.json');
+  if (!existsSync(path)) return {};
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch (error) { fail(`${path}: ${error.message}`); }
+}
+const bleedingEdgeApp = () => config().bleedingEdge || join(homedir(), 'Applications', APP);
+function versionApp(dir) {
+  const app = join(dir, 'foafnaut', APP);
+  return existsSync(app) ? app : undefined;
+}
+function currentApp() {
+  const current = join(home(), 'current');
+  return existsSync(current) ? versionApp(current) : undefined;
+}
+
+async function installLatest() {
+  const response = await fetch(RELEASES, { headers: { accept: 'application/vnd.github+json', 'user-agent': 'foafnaut' } });
+  if (!response.ok) fail(`release list: HTTP ${response.status}`);
+  // The release list is not in publication order.
+  const release = (await response.json())
+    .filter((r) => /^build-[0-9a-f]{12}-foafnaut-darwin-arm64$/.test(r.tag_name) && r.published_at)
+    .sort((a, b) => b.published_at.localeCompare(a.published_at))[0];
+  if (!release) fail('no published macOS build');
+  const commit = release.tag_name.split('-')[1];
+  const dir = join(home(), 'versions', commit);
+  if (!versionApp(dir)) {
+    const asset = (name) => release.assets.find((a) => a.name === name)?.browser_download_url ?? fail(`${release.tag_name}: no ${name}`);
+    const download = async (url) => {
+      const reply = await fetch(url, { headers: { 'user-agent': 'foafnaut' } });
+      if (!reply.ok) fail(`${url}: HTTP ${reply.status}`);
+      return Buffer.from(await reply.arrayBuffer());
+    };
+    console.error(`foafnaut: downloading ${release.tag_name}`);
+    const info = JSON.parse((await download(asset('build-info.json'))).toString('utf8'));
+    const archive = await download(asset('foafnaut-darwin-arm64.tar.gz'));
+    const expected = info.artifacts?.['foafnaut-darwin-arm64.tar.gz']?.sha256;
+    const actual = createHash('sha256').update(archive).digest('hex');
+    if (!expected) fail(`${release.tag_name}: build-info.json has no archive digest`);
+    if (expected !== actual) fail(`${release.tag_name}: archive digest ${actual} is not ${expected}`);
+    const staging = `${dir}.tmp`;
+    rmSync(staging, { recursive: true, force: true });
+    mkdirSync(staging, { recursive: true });
+    writeFileSync(join(staging, 'archive.tar.gz'), archive);
+    const unpack = spawnSync('tar', ['-xzf', 'archive.tar.gz'], { cwd: staging, stdio: 'inherit' });
+    if (unpack.status !== 0) fail('tar failed');
+    rmSync(join(staging, 'archive.tar.gz'));
+    writeFileSync(join(staging, 'build-info.json'), JSON.stringify(info, null, 2));
+    if (!versionApp(staging)) {
+      rmSync(staging, { recursive: true, force: true });
+      fail(`${release.tag_name} has no ${APP}; it predates the native window. Use --bleeding-edge.`);
+    }
+    rmSync(dir, { recursive: true, force: true });
+    renameSync(staging, dir);
+  }
+  const link = join(home(), 'current');
+  rmSync(link, { force: true });
+  symlinkSync(join('versions', commit), link);
+  console.error(`foafnaut: current is ${commit}`);
+  return versionApp(dir);
+}
+
+function pageArgs(page) {
+  if (page === undefined) return [];
+  if (/^https?:\/\//i.test(page)) return ['--url', page];
+  const path = resolve(page);
+  if (!existsSync(path)) fail(`no such file: ${page}`);
+  return ['--html', path];
+}
+
+export async function main(argv, channel = 'current') {
+  const split = argv.indexOf('--');
+  const options = split < 0 ? argv : argv.slice(0, split);
+  const extra = split < 0 ? [] : argv.slice(split + 1);
+  let page, which = false, verbose = false, detach = false;
+  // Each of these picks the app or the action. Two of them have no one meaning.
+  const exclusive = options.filter((arg) => ['--latest', '--bleeding-edge', '--install-latest', '--list'].includes(arg));
+  if (new Set(exclusive).size > 1) fail(`${exclusive.join(' and ')} can not be used together; see --help`);
+  for (const arg of options) {
+    if (arg === '--help' || arg === '-h') { process.stdout.write(HELP); return; }
+    else if (arg === '--latest') channel = 'latest';
+    else if (arg === '--bleeding-edge') channel = 'bleeding-edge';
+    else if (arg === '--which') which = true;
+    else if (arg === '--verbose' || arg === '-v') verbose = true;
+    else if (arg === '--detach') detach = true;
+    else if (arg === '--install-latest') { await installLatest(); return; }
+    else if (arg === '--list') {
+      const versions = join(home(), 'versions');
+      const current = existsSync(join(home(), 'current')) ? basename(realpathSync(join(home(), 'current'))) : '';
+      for (const name of existsSync(versions) ? readdirSync(versions).filter((n) => !n.endsWith('.tmp')) : [])
+        console.log(`${name === current ? '*' : ' '} ${name}`);
+      console.log(`  bleeding edge: ${bleedingEdgeApp()}${existsSync(bleedingEdgeApp()) ? '' : ' (not found)'}`);
+      return;
+    } else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
+    else if (page !== undefined) fail('give one page');
+    else page = arg;
+  }
+  if (process.platform !== 'darwin') fail('the native window is macOS only; use the Hub page in a WebGPU browser');
+  let app = process.env.FOAFNAUT_APP;
+  if (!app && channel === 'latest') app = await installLatest();
+  if (!app && channel === 'bleeding-edge') app = bleedingEdgeApp();
+  if (!app) app = currentApp() ?? bleedingEdgeApp();
+  if (!existsSync(app)) fail(`no app at ${app}. Run foafnaut --install-latest.`);
+  if (which) { console.log(app); return; }
+  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...extra];
+  const log = join(homedir(), 'Library', 'Logs', 'foafnaut', 'trace.jsonl');
+  if (verbose) console.error(`foafnaut: app ${app}\nfoafnaut: open ${args.join(' ')}\nfoafnaut: trace ${log}`);
+  // Follow only what this run appends.
+  const follow = verbose ? spawn('tail', ['-n', '0', '-F', log], { stdio: ['ignore', 'inherit', 'ignore'] }) : undefined;
+  const run = spawnSync('open', args, { stdio: 'inherit' });
+  follow?.kill();
+  process.exit(run.status ?? 1);
+}
+
+if (import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) await main(process.argv.slice(2));

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "14599aeba24a";
+const WASM_VERSION = "7e47fa191143";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-ace53d982f83-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42050112010",
-  "gitSha": "ace53d982f83e6bf0a1a749a5e800481cc092b9f",
-  "builtAt": "2026-11-05T16:35:31Z",
+  "release": "danbri/factoidal-builds build-54551baca31a-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42216947974",
+  "gitSha": "54551baca31ae999900422c62ac59622ebf4d20a",
+  "builtAt": "2026-11-06T13:04:35Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "14599aeba24a46bf05e1c7ce8aa885df536fe1398a797034eff107e04fa4ebc3",
-  "wasmBytes": 31371405,
+  "wasmSha256": "7e47fa1911434e286cd6523c2b622e183ea6837531d444b9691a2434486f5c4e",
+  "wasmBytes": 31415350,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.31.0';
+export const version = '0.32.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",
@@ -35,7 +35,10 @@
   "browser": "./browser.js",
   "types": "./index.d.ts",
   "bin": {
-    "factoidal": "./bin/factoidal.mjs"
+    "factoidal": "./bin/factoidal.mjs",
+    "foafnaut": "./bin/foafnaut.mjs",
+    "foafnaut-latest": "./bin/foafnaut-latest.mjs",
+    "foafnaut-bleedingedge": "./bin/foafnaut-bleedingedge.mjs"
   },
   "exports": {
     ".": {

package/xmpp/README.md

@@ -66,6 +66,7 @@ mkdir -p state && printf 'juliet:r0m30\nromeo:juli3t\n' > state/accounts
 npx factoidal xmpp-serve state --domain localhost            # plaintext on 5222
 npx factoidal xmpp-serve state --cert fullchain.pem --key privkey.pem   # XEP-0368 direct TLS on 5223
 npx factoidal xmpp-serve state --cert fullchain.pem --key privkey.pem --starttls   # STARTTLS required on 5222
+npx factoidal xmpp-serve state --cert fullchain.pem --key privkey.pem --starttls --tls-port 5223   # both, one server
 ```
 
 Without `--cert` and `--key` the listener has no TLS and offers PLAIN, so
@@ -191,3 +192,16 @@ node --test test/xmpp.test.mjs
 Skips wholesale when the Lean wasm assets aren't resolvable, and skips
 per-op when the resolved bundle predates a given op (see
 `xmppOpsAvailable`) — the same pattern `test/l4-core.test.js` uses.
+
+## Transport limits
+
+The host closes a socket when a limit is reached. These are limits on bytes and time; every protocol decision stays in Lean.
+
+| Option | CLI | Default | Limit |
+|---|---|---|---|
+| `maxConnections` | `--max-connections N` | 1024 | Open connections of all kinds |
+| `loginTimeoutMs` | `--login-timeout SECONDS` | 30 s | Time to bind a resource |
+| `maxQueuedBytes` | | 8 MiB | Bytes waiting for a client that is not reading |
+| `maxBuffered` | | 1 MiB | Bytes of an unfinished unit |
+
+There is no limit per address: behind a proxy, every client has the same one.

package/xmpp/server.mjs

@@ -37,6 +37,9 @@
 // server-to-server federation, and any limit on how many bytes
 // a client may send without completing a unit beyond `maxBuffered`,
 // which is a transport limit this host applies by closing the socket.
+// The other transport limits are `maxConnections`, `loginTimeoutMs` and
+// `maxQueuedBytes`. There is no limit per address: behind a proxy, every
+// client has the same one.
 
 import { randomBytes } from 'node:crypto'
 import { StringDecoder } from 'node:string_decoder'
@@ -135,6 +138,8 @@ export async function openXmppServer (options = {}) {
   if (typeof options.tlsCarrier === 'boolean') config.tlsCarrier = options.tlsCarrier
   // XEP-0045 room service (L4Factoidal/XMPP/Muc.lean); off unless named.
   if (typeof options.mucDomain === 'string') config.mucDomain = options.mucDomain
+  // Members-only rooms: [{room, members: [bare JID]}]; no list, an open room.
+  if (Array.isArray(options.mucMembers)) config.mucMembers = options.mucMembers
   // XEP-0369 channels (L4Factoidal/XMPP/Mix.lean), joined through MIX-PAM; off unless named.
   if (typeof options.mixDomain === 'string') config.mixDomain = options.mixDomain
   // GC3 prototype groups (L4Factoidal/XMPP/Gc3.lean; no published spec); off unless named.
@@ -157,6 +162,11 @@ export async function openXmppServer (options = {}) {
     throw new XmppHostError('xmppOpen answered with no handle')
   }
   const handle = opened.handle
+  // An older engine ignores the list, and the rooms would be open: do not start.
+  if (Array.isArray(options.mucMembers) && opened.mucMembers !== options.mucMembers.length) {
+    engine.call('xmppClose', [handle])
+    throw new XmppHostError('this engine does not carry members-only rooms; rebuild the engine')
+  }
   return {
     engine,
     handle,
@@ -243,10 +253,18 @@ async function readAccountsFile (path) {
  * @param {boolean} [options.startTls] listen in clear and use `cert` and
  *   `key` for STARTTLS (RFC 6120 section 5), which the engine then requires
  *   before anything else; without it, `cert` and `key` mean direct TLS
+ * @param {number} [options.directTlsPort] with `startTls`, `listen` also serves
+ *   XEP-0368 direct TLS on this port, in the same server: one set of rooms
  * @param {number} [options.pollMs] spool poll interval (default 250; 0 disables)
  * @param {number} [options.maxBuffered] residual UTF-8 bytes held by the engine
  *   after a feed before the socket is closed (default 1 MiB); the decoder
  *   may separately hold up to three bytes of an incomplete UTF-8 sequence
+ * @param {number} [options.maxConnections] open connections, of all kinds, before
+ *   a new one is closed at once (default 1024)
+ * @param {number} [options.loginTimeoutMs] how long a connection may stay
+ *   without a bound resource before it is closed (default 30000; 0 disables)
+ * @param {number} [options.maxQueuedBytes] bytes waiting to be written to a
+ *   client that is not reading, before the socket is closed (default 8 MiB)
  * @param {Function} [options.onError]
  * @param {Function} [options.onLog]
  * @returns {Promise<{server: object, xmpp: object, close: Function, sessions: Function}>}
@@ -259,6 +277,14 @@ export async function createXmppServer (options = {}) {
   const dir = typeof options.dir === 'string' ? options.dir : null
   const pollMs = typeof options.pollMs === 'number' ? options.pollMs : 250
   const maxBuffered = typeof options.maxBuffered === 'number' ? options.maxBuffered : 1024 * 1024
+  const limit = (name, fallback) => {
+    const value = typeof options[name] === 'number' ? options[name] : fallback
+    if (!Number.isSafeInteger(value) || value < 0) throw new XmppHostError(`${name} must be a nonnegative safe integer`)
+    return value
+  }
+  const maxConnections = limit('maxConnections', 1024)
+  const loginTimeoutMs = limit('loginTimeoutMs', 30000)
+  const maxQueuedBytes = limit('maxQueuedBytes', 8 * 1024 * 1024)
   if (!Number.isSafeInteger(maxBuffered) || maxBuffered < 0) {
     throw new XmppHostError('maxBuffered must be a nonnegative safe integer')
   }
@@ -385,8 +411,39 @@ export async function createXmppServer (options = {}) {
   // connection callback and therefore have no engine session yet.
   const transports = new Set()
 
+  // Transport limits, like `maxBuffered`: bytes and time, not protocol.
+  function closeIfBacklogged (c) {
+    if (c.socket.destroyed || !(c.socket.writableLength > maxQueuedBytes)) return
+    onError(new XmppHostError(`connection exceeded ${maxQueuedBytes} queued bytes`))
+    c.socket.destroy()
+  }
+
   function writeAll (c, lines) {
     for (const line of lines) if (!c.socket.destroyed) c.socket.write(line)
+    closeIfBacklogged(c)
+  }
+
+  /** A connection gets `loginTimeoutMs` to bind a resource. */
+  function startLoginTimer (c) {
+    if (loginTimeoutMs === 0) return
+    c.loginTimer = setTimeout(() => {
+      if (c.full === null && connections.has(c)) {
+        onLog('closing a connection that did not log in in time')
+        c.socket.destroy()
+      }
+    }, loginTimeoutMs)
+    c.loginTimer.unref()
+  }
+
+  /** Count a new socket, or close it at once if the server is full. */
+  function admit (socket) {
+    if (transports.size >= maxConnections) {
+      onError(new XmppHostError(`refused a connection: ${maxConnections} are open`))
+      socket.destroy()
+      return
+    }
+    transports.add(socket)
+    socket.once('close', () => transports.delete(socket))
   }
 
   let rosterWrites = Promise.resolve()
@@ -471,6 +528,7 @@ export async function createXmppServer (options = {}) {
   function endSession (c) {
     if (!connections.has(c)) return
     connections.delete(c)
+    clearTimeout(c.loginTimer)
     let answer
     try { answer = c.session.close() } catch (error) { onError(error); answer = { send: [] } }
     // The session left its MUC rooms (Muc.leaveAll): tell the other occupants.
@@ -482,10 +540,10 @@ export async function createXmppServer (options = {}) {
     }
   }
 
-  function onConnection (socket) {
+  function onConnection (socket, direct = false) {
     let session
     try {
-      session = xmpp.openSession({ tlsCarrier: useTls, startTls })
+      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct })
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -505,6 +563,7 @@ export async function createXmppServer (options = {}) {
       }
     }
     connections.add(c)
+    startLoginTimer(c)
     onLog(`connection from ${socket.remoteAddress}:${socket.remotePort}`)
     c.onData = (chunk) => {
       if (!connections.has(c) || c.closing || c.upgrading) return
@@ -579,11 +638,12 @@ export async function createXmppServer (options = {}) {
       },
       deliver (text) {
         const got = wsCall('xmppWsDeliver', [handle, text], new Uint8Array(0))
-        if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); return true }
+        if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); closeIfBacklogged(c); return true }
         return false
       }
     }
     connections.add(c)
+    startLoginTimer(c)
     socket.on('data', (chunk) => {
       if (!connections.has(c) || c.closing) return
       let got
@@ -623,29 +683,32 @@ export async function createXmppServer (options = {}) {
       const net = await import('node:net')
       wsServer = net.createServer(onWsConnection)
     }
-    wsServer.on('connection', socket => {
-      transports.add(socket)
-      socket.once('close', () => transports.delete(socket))
-    })
+    wsServer.on('connection', admit)
   }
 
   let server
   try {
     if (useTls) {
       const tls = await import('node:tls')
-      server = tls.createServer({ cert: options.cert, key: options.key }, onConnection)
+      server = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket))
     } else {
       const net = await import('node:net')
-      server = net.createServer(onConnection)
+      server = net.createServer((socket) => onConnection(socket))
     }
   } catch (error) {
     xmpp.close()
     throw error
   }
-  server.on('connection', socket => {
-    transports.add(socket)
-    socket.once('close', () => transports.delete(socket))
-  })
+  server.on('connection', admit)
+
+  // XEP-0368 direct TLS beside a STARTTLS listener: the engine takes its
+  // answer per session, so this differs only in what `onConnection` passes.
+  let directServer = null
+  if (startTls && options.directTlsPort !== undefined) {
+    const tls = await import('node:tls')
+    directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    directServer.on('connection', admit)
+  }
 
   // The harness's mailbox: `<dir>/spool/<bare jid>/<name>` holds one
   // stanza's bytes for that account. Polled for every bound session,
@@ -693,6 +756,7 @@ export async function createXmppServer (options = {}) {
   return {
     server,
     wsServer,
+    directServer,
     xmpp,
     /** The live connections' `{bare, full}` pairs, for a host's own view. */
     sessions () {
@@ -714,6 +778,7 @@ export async function createXmppServer (options = {}) {
         try {
           await new Promise(resolve => server.close(resolve))
           if (wsServer !== null) await new Promise(resolve => wsServer.close(resolve))
+          if (directServer !== null) await new Promise(resolve => directServer.close(resolve))
           await pollTask
           await rosterWrites
           await stateWrites
@@ -765,7 +830,20 @@ export async function listen (options = {}) {
     const path = typeof options.websocket.path === 'string' ? options.websocket.path : '/xmpp-websocket'
     wsOrigin = `${wsScheme}://${host}:${created.wsServer.address().port}${path}`
   }
+  let directOrigin = null
+  if (created.directServer !== null) {
+    try {
+      await new Promise((resolve, reject) => {
+        created.directServer.once('error', reject)
+        created.directServer.listen(options.directTlsPort, host, resolve)
+      })
+    } catch (error) {
+      await created.close()
+      throw error
+    }
+    directOrigin = `xmpps://${host}:${created.directServer.address().port}`
+  }
   const bound = created.server.address()
   const scheme = options.cert !== undefined && options.key !== undefined ? 'xmpps' : 'xmpp'
-  return { ...created, port: bound.port, host, origin: `${scheme}://${host}:${bound.port}`, wsOrigin }
+  return { ...created, port: bound.port, host, origin: `${scheme}://${host}:${bound.port}`, wsOrigin, directOrigin }
 }