@factoidal/core 0.31.1 → 0.33.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## Unreleased
+
+## 0.33.0 (2026-11-06)
+
+- XMPP: held stanzas have caps per recipient and per server and a rate per sending account. A stanza for a name with no account is not held. Rosters have a cap on items and a rate on writes.
+- XMPP: SASL closes a stream after three failed attempts, adds a slower limit per client address, and uses one SCRAM exchange for every name. `--no-address-limit` is for a listener behind a proxy.
+- XMPP: accounts have a salt per name and more SCRAM iterations by default. An accounts line can hold keys in place of a password (`xmpp-serve --verifier NAME`). A malformed accounts file stops the start.
+- XMPP: a stanza has at most 64 levels and 8192 elements. Rooms have reserved nicks and nick checks, and a session leaves its rooms at a clean stream end.
+- XMPP: XEP-0421 occupant ids in rooms. A room seat stays until the last session of a full JID goes.
+- XMPP: `xmpp-serve --starttls --tls-port N` serves STARTTLS and XEP-0368 direct TLS from one server.
+- XMPP: members-only rooms (XEP-0045 section 7.2.6). `xmpp-serve --muc-members FILE` lists who may join each room; anyone else gets `registration-required` and cannot see the room.
+- XMPP: disco#info and disco#items results carry `from`. Without it, Profanity 0.19.0 stopped with a segmentation fault after login.
+- The URL decisions of the LWS SBM11 reader and of the compositor's pod storage are now in Lean (`L4Factoidal/LWS/ContainerPath.lean`, new pure wasm op `containerPath`), not in JavaScript: the container URL, each resource URL from a raw relative path, one new file name, a URL inside a pod root, and the folder above (https://github.com/danbri/factoidal/issues/1127). Theorems `resourceIn_under`, `segmentIn_under`, `within_under`, `parentIn_under` (an accepted URL has the container's origin and the container URL, which ends with `/`, is its prefix) and `within_sibling_refused` (`https://s.example/alice-other/` is not within `https://s.example/alice/`). `lwsSbm11Reader` is now asynchronous (`await lwsSbm11Reader(url, opts)`): it loads the engine first; `opts.engine` gives one. An empty `?` or `#` in a container URL is now refused too. The LWS client's token scope (`TokenEntry.covers`) has the same path-segment boundary: a token for the root `https://s.example/alice` is no longer sent to `https://s.example/alice-other/x` (theorem `covers_sibling_refused`). The hub compositor's pod storage needs an engine with `containerPath`; with an older engine it refuses every pod operation.
+- Requests to private addresses (https://github.com/danbri/factoidal/issues/1126). One Lean decision for every outbound request whose URL a remote party chooses, `L4Factoidal/Net/Egress.lean`: it refuses every address of the IANA IPv4 and IPv6 special-purpose registries (now also 100.64.0.0/10, 198.18.0.0/15, 192.0.0.0/24, the documentation ranges, 224.0.0.0/4, 240.0.0.0/4, 255.255.255.255, fec0::/10, ff00::/8, every IPv6 address outside 2000::/3, and NAT64 64:ff9b::/96 or 6to4 2002::/16 with such an IPv4 address inside) and localhost names, unless the operator opts in with `--allow-private-fetch`. The authorization server and CID retrieval use it (theorem `egress_refuses_special`). `lws-serve`: a webhook inbox at such an address answers 400 at subscription; every webhook, access-request, access-grant and controller-inbox delivery is checked again just before it is made, against the addresses the host resolves then, and the host connects to the address the engine chose (new wasm op `lwsEgress`; theorems `deliveries_pinned`, `egressOf_refuses_special`), so a name that resolves to a private address only at delivery time is refused. A refused delivery is not retried. Deliveries to one destination are limited for all subscriptions together: `--delivery-dest-limit N` (default 10 per window, theorem `admit_per_destination`). `lws-serve --allow-private-fetch` now also lets inboxes be private addresses, and its warning is printed also with `--quiet`. Hosts and tests that deliver to 127.0.0.1 must opt in.
+- `webdav-serve --xmpp` accepts `--users`, `--login-limit`, `--login-window` and `--dangerously-disable-ratelimits` (https://github.com/danbri/factoidal/issues/1125). Each request over XMPP passes the JID allow list and then the same Lean login as on TCP (`Login.admit`); HTTP Basic credentials in the XEP-0332 headers log in. `--users` over XMPP needs `--xmpp-tls` or a loopback `--xmpp-host`. `--cert` and `--key` are refused with `--xmpp` (no port opens).
+- The failed-login limit counts per requester (https://github.com/danbri/factoidal/issues/1128): the client address on TCP, the sender's bare JID over XMPP (`L4Factoidal/Net/LoginLimit.lean`, `requesterKey`), never an empty key; one JID's failures do not block another JID. Over XMPP, requests that wait for `chunkedBase64` chunks are limited to 4 per sender and 16 in total, and wait at most 60 seconds (`resource-constraint`).
+- `xmpp-serve` limits failed SASL logins by default: 5 in 60 seconds per account name and per client address, then `temporary-auth-failure` with no password check until the window ends. `--dangerously-disable-ratelimits` turns it off and prints a warning at start. Wasm: `xmppOpen` takes `disableRateLimits` and answers `warnings`; `xmppSessionOpen` takes `remoteAddress` and `now`; `xmppClientTick` also serves the serving mode; `xmppClientFeed` request records carry `requester`; `webdavOpen` takes `login.transport: "xmpp"` and `login.jid`; `ready.login`.
+
+## 0.32.0 (2026-11-05)
+
+- XMPP: stanzas are held to RFC 6120 section 11.1. A DTD, a comment or a processing instruction is refused (https://github.com/danbri/factoidal-core/pull/355). Upgrade if you run `xmpp-serve`.
+- XMPP: `xmpp-serve` limits connections (`--max-connections`, default 1024), the time to log in (`--login-timeout`, default 30 seconds) and the bytes queued for a client that is not reading (https://github.com/danbri/factoidal-core/pull/358).
+- `foafnaut` command to start the Lean browser on macOS (https://github.com/danbri/factoidal-core/pull/349). The document renderer itself ships through the foafnaut build sets, not through this package.
+
 ## 0.31.1 (2026-11-05)
 
 - Engine start uses less stack. Two more test fixtures ran with one stack frame for each byte when the engine started: `swapLabelGo` (`Storage/ShardManifest.lean`) and `bytesOfHexLiteral` (`Storage/LiteralGramIndexWire.lean`). Both are now loops. In 0.31.0, WebKit needed between 640 KB and 768 KB of stack to start the engine.

package/bin/factoidal.mjs

@@ -445,8 +445,11 @@ DIR holds the signing keys (DIR/authz-keys.json, mode 0600), sealed with
 FACTOIDAL_LWS_KEY when it is set. --rotate-after makes a new key when the
 current one is that old; the old key stays published until its tokens expire.
 --allow-http accepts http subject identifiers; --allow-private-fetch lets the
-server fetch documents from loopback, link-local and private addresses. Both
-are off by default and are for tests.
+server fetch documents from special-purpose addresses: loopback, private,
+link-local, shared (100.64.0.0/10), multicast, reserved and the other ranges
+of the IANA special-purpose registries, and localhost names
+(https://github.com/danbri/factoidal/issues/1126). Both are off by default
+and are for tests.
 CORS (https://github.com/danbri/factoidal/issues/923): by default every answer
 echoes a valid request Origin in Access-Control-Allow-Origin, so a page on
 another origin can read the metadata and keys and exchange a token; a
@@ -474,7 +477,8 @@ usage: factoidal lws-serve DIR (--authz DIR | --issuer IRI | --auth-config FILE
                          [--paginate-always] [--moves all|data|off]
                          [--no-linkset-put] [--unstable-search-results] [--merkle]
                          [--controller-inbox URL] [--delivery-limit N]
-                         [--delivery-window SECONDS] [--redirects-max N]
+                         [--delivery-window SECONDS] [--delivery-dest-limit N]
+                         [--redirects-max N]
                          [--storage snapshot|files]
                          [--cors-origin ORIGIN]... [--no-cors]
 
@@ -569,6 +573,25 @@ The engine decides the file, its contents and every refusal
   --delivery-window SECONDS
                   the length of that window (config member deliveryWindow;
                   default 60)
+  --delivery-dest-limit N
+                  the most deliveries one destination (host and port of the
+                  inbox URL) gets in one window, for all subscriptions and
+                  access records together (config member deliveryDestLimit;
+                  default 10, 0 turns the limit off)
+                  https://github.com/danbri/factoidal/issues/1126
+  --allow-private-fetch
+                  let webhook, access-request, access-grant and controller
+                  inboxes be special-purpose addresses (loopback, private,
+                  link-local, shared 100.64.0.0/10, multicast, reserved and
+                  the other IANA special-purpose ranges) or localhost names,
+                  and let the --authz server fetch from them (config member
+                  allowPrivateFetch; default off). Without it such an inbox
+                  is refused with 400 when its address is known at
+                  subscription, and every delivery is checked again just
+                  before it is made, against the addresses resolved then;
+                  the server connects to the address it checked. For tests
+                  and closed networks only.
+                  https://github.com/danbri/factoidal/issues/1126
   --redirects-max N
                   the most previous identifiers of moved resources kept to
                   answer 301 Moved Permanently (config member redirectsMax;
@@ -747,10 +770,12 @@ Specification: https://solidproject.org/TR/protocol`,
   'xmpp-serve': `factoidal xmpp-serve - serve XMPP (RFC 6120 and RFC 6121) over TCP, STARTTLS or direct TLS
 
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
-                            [--accounts FILE] [--cert FILE --key FILE [--starttls]]
+                            [--accounts FILE] [--cert FILE --key FILE [--starttls [--tls-port N]]]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
-                            [--muc DOMAIN] [--mix DOMAIN] [--gc3 DOMAIN]
-                            [--state-key FILE]
+                            [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--state-key FILE] [--max-connections N]
+                            [--login-timeout SECONDS] [--no-address-limit]
+                            [--dangerously-disable-ratelimits]
 
 Starts a Node TCP server that runs one engine session per connection and
 answers every byte through the engine's xmppSessionFeed operation.
@@ -767,12 +792,20 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    (default 5222; 5223 with --cert and --key and no --starttls)
   --host ADDRESS   the address to bind (default 127.0.0.1); without
                    --cert and --key only a loopback address is accepted
-  --accounts FILE  the accounts file (default DIR/accounts)
+  --accounts FILE  the accounts file (default DIR/accounts). One account per
+                   line: name:password, or a line from --verifier, which holds
+                   no password (SCRAM only). Any other line stops the start. A
+                   file others can read gives a warning
+  --verifier NAME  read a password from standard input, print the accounts line
+                   for NAME that holds no password, and exit; --iterations N
+                   sets the SCRAM count (default 10000)
   --cert FILE      PEM certificate chain: XEP-0368 direct TLS, or STARTTLS with --starttls
   --key FILE       PEM private key for --cert
   --starttls       listen in clear and REQUIRE STARTTLS (RFC 6120 section 5)
                    before anything else; no SASL mechanism is offered and no
                    credential is accepted until the TLS handshake finishes
+  --tls-port N     with --starttls, also serve XEP-0368 direct TLS on port N,
+                   in the same server (the same rooms and sessions)
   --ws-port N      also serve XMPP over WebSocket (RFC 7395, the "xmpp"
                    subprotocol of RFC 6455) for browser clients such as
                    Strophe.js; wss: with --cert and --key, else loopback only
@@ -785,10 +818,19 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    conference.example.com: temporary rooms, made by the first
                    join and gone with the last occupant; no history, no
                    configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+  --muc-members FILE  members-only rooms: one room per line, as
+                   "room: alice@example.com bob@example.com". Only those accounts
+                   may join or see that room; a room not in the file is open to
+                   every account (L4Factoidal/XMPP/Muc.lean)
   --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
                    joined through this server (XEP-0405 MIX-PAM); channels are
                    made by an IQ <create/>, kept in memory only, JID-hidden; no
                    PubSub nodes, no archive (L4Factoidal/XMPP/Mix.lean)
+  --max-connections N  open connections of all kinds before a new one is closed
+                   at once (default 1024). There is no limit per address:
+                   behind a proxy, every client has the same one
+  --login-timeout SECONDS  how long a connection may stay without a bound
+                   resource before it is closed (default 30; 0 disables)
   --state-key FILE keep the server's state across restarts: rosters, messages held
                    for offline accounts, MIX channels and GC3 groups, in an LWS
                    storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
@@ -799,6 +841,23 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    membership, stable participant ids, optional events. There is
                    no published GC3 spec; every wire format is invented and listed
                    in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
+  --no-address-limit
+                   count failed logins per account name only. For a listener
+                   behind a proxy, where every client has the proxy's address
+                   and a limit on it would stop them all
+  --dangerously-disable-ratelimits
+                   no failed SASL login limit and no sender rate on held
+                   messages (a warning is printed at start); any client can
+                   then try passwords without end
+
+Failed SASL logins are limited by default
+(https://github.com/danbri/factoidal/issues/1128): after 5 failed logins in
+60 seconds for one account name (known or not) or from one client address
+(an IPv6 client by its /64), on one stream or on new ones, an attempt gets
+the SASL failure temporary-auth-failure, and no password is checked, also
+the right one, until that window ends. A client address also has a slower
+limit of 20 failed logins in an hour. A malformed SASL payload checks no
+password and does not count. A stream closes after 3 failed attempts.
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -873,7 +932,9 @@ usage: factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]
                               [--login-limit N] [--login-window SECONDS]
                               [--dangerously-disable-ratelimits]
        factoidal webdav-serve CONFIGDIR --xmpp JID --xmpp-password-file FILE
-                 --xmpp-allow JID[,JID...] [--guest NAME] [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
+                 --xmpp-allow JID[,JID...] [--guest NAME] [--users FILE]
+                 [--login-limit N] [--login-window SECONDS] [--dangerously-disable-ratelimits]
+                 [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
 
 EMERGENCY MODE (https://github.com/danbri/factoidal/issues/1147): the server
 is READ ONLY. Every write method (PUT, DELETE, MKCOL, COPY, MOVE, PROPPATCH,
@@ -982,13 +1043,24 @@ NAT is reached this way with no inbound port.
                              --xmpp-host (127.0.0.0/8, ::1) is accepted.
   --xmpp-ca FILE             PEM certificates to trust for --xmpp-tls
   --dangerously-allow-writable-without-login
-                             start although a local mount is writable:
-                             there is no login on the XMPP path yet
-                             (https://github.com/danbri/factoidal/issues/1125),
-                             so every allowed JID writes as the owner.
-                             Without it such a start is refused.
+                             with no --users: start although a local mount
+                             is writable, so every allowed JID writes as the
+                             owner. Without it such a start is refused.
+                             With --users it is not needed.
   --xmpp-resource R          the resource to bind (default dav)
 
+Both checks apply to every request over XMPP
+(https://github.com/danbri/factoidal/issues/1125): the sender's bare JID must
+be in --xmpp-allow, and then the request acts as a user exactly as on TCP:
+the --guest user with no credentials, a user of --users with HTTP Basic
+credentials in the request's headers (xmpp-http-proxy passes Authorization
+unchanged). --users over XMPP needs --xmpp-tls or a loopback --xmpp-host.
+The failed-login limit over XMPP counts per user name and per bare JID of
+the sender (https://github.com/danbri/factoidal/issues/1128): one JID's
+failures do not block another JID. A request whose chunked body is not
+complete waits at most 60 seconds, and at most 4 such requests per sender
+(16 in total) wait at once; others get resource-constraint.
+
 It prints the bound JID (xmpp:user@domain/resource) on standard output.
 XEP-0332 is Deferred, and no WebDAV client speaks it: a reader runs
 "factoidal xmpp-http-proxy --target JID/RESOURCE" (as an allowed JID) and
@@ -1199,7 +1271,7 @@ const VALUE_OPTIONS = {
   compact: new Set([]),
   serve: new Set(['port', 'host', 'query-path', 'gsp-path', 'file', 'layout', 'tdb2', 'allow-host', 'allow-origin']),
   'lws-serve': new Set(['port', 'host', 'base', 'issuer', 'auth-config', 'owner', 'root-acl',
-    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window',
+    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window', 'delivery-dest-limit',
     'redirects-max', 'storage', 'cors-origin', 'authz', 'alg', 'token-lifetime', 'rotate-after',
     'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin']),
   'solid-serve': new Set(['port', 'host', 'base', 'owner', 'issuer', 'auth-config', 'allow-host', 'allow-origin']),
@@ -1211,7 +1283,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'mix', 'gc3', 'state-key']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'verifier', 'iterations']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2327,6 +2399,10 @@ async function commandLwsServe (positional, options) {
       ...(typeof options['controller-inbox'] === 'string' ? { controllerInbox: options['controller-inbox'] } : {}),
       ...(options['delivery-limit'] !== undefined ? { deliveryLimit: natOption('delivery-limit', options['delivery-limit']) } : {}),
       ...(options['delivery-window'] !== undefined ? { deliveryWindow: natOption('delivery-window', options['delivery-window']) } : {}),
+      ...(options['delivery-dest-limit'] !== undefined ? { deliveryDestLimit: natOption('delivery-dest-limit', options['delivery-dest-limit']) } : {}),
+      // Inboxes at special-purpose addresses (issue 1126): passed unread;
+      // L4Factoidal/Net/Egress.lean decides.
+      ...(options['allow-private-fetch'] === true ? { allowPrivateFetch: true } : {}),
       ...(options['redirects-max'] !== undefined ? { redirectsMax: natOption('redirects-max', options['redirects-max']) } : {}),
       ...(typeof options.storage === 'string' ? { storage: options.storage } : {}),
       ...corsConfig(options),
@@ -2356,11 +2432,16 @@ async function commandLwsServe (positional, options) {
   // The engine's start notices (a stale lock taken over; encryption at rest
   // on or off), printed also with --quiet.
   for (const n of (await running.storage()).notices || []) err(`lws-serve: ${n}`)
+  // Printed also with --quiet: this option opens the local network to
+  // requests that remote parties choose (issue 1126).
+  if (options['allow-private-fetch'] === true) {
+    err('lws-serve: WARNING: --allow-private-fetch: webhook and inbox deliveries and authorization ' +
+      'server fetches may go to loopback, private, link-local and other special-purpose addresses')
+  }
   if (!quiet) {
     err(`lws-serve: listening on ${running.origin} for ${positional[0]}`)
     if (running.authz() !== null) err(`lws-serve: authorization server ${running.authz().issuer} (keys in ${authzDir})`)
     if (options['allow-http'] === true) err('lws-serve: WARNING: --allow-http: http subject identifiers are accepted')
-    if (options['allow-private-fetch'] === true) err('lws-serve: WARNING: --allow-private-fetch: private addresses may be fetched')
     if (insecure) {
       err('lws-serve: WARNING: --insecure-no-auth: every request is served without authorization')
       err('lws-serve: --insecure-no-auth: only the Host names of this listener are answered, and a ' +
@@ -2629,20 +2710,32 @@ async function webdavOverXmpp (configDir, options, quiet) {
   if (typeof options.xmpp !== 'string') throw new UsageError('--xmpp needs a JID')
   if (typeof options['xmpp-password-file'] !== 'string') throw new UsageError('--xmpp needs --xmpp-password-file FILE')
   if (typeof options['xmpp-allow'] !== 'string') throw new UsageError('--xmpp needs --xmpp-allow JID[,JID...]')
-  // No login on the XMPP path yet: refuse --users rather than ignore it
-  // (https://github.com/danbri/factoidal/issues/1125).
-  if (['users', 'cert', 'key', 'login-limit', 'login-window', 'dangerously-disable-ratelimits'].some((k) => options[k] !== undefined)) {
-    throw new UsageError('--users, --cert, --key and the login-limit options do not apply with --xmpp yet (https://github.com/danbri/factoidal/issues/1125)')
+  // No port is open with --xmpp, so the HTTPS options do not apply. --users
+  // and the login-limit options do (https://github.com/danbri/factoidal/issues/1125).
+  if (['cert', 'key'].some((k) => options[k] !== undefined)) {
+    throw new UsageError('--cert and --key do not apply with --xmpp: no port is open; give --xmpp-tls for the XMPP stream')
   }
   const fs = await import('node:fs/promises')
+  const { resolve: resolvePath } = await import('node:path')
   const password = (await fs.readFile(options['xmpp-password-file'], 'utf8')).split(/\r?\n/)[0]
   const allow = options['xmpp-allow'].split(',').map((x) => x.trim()).filter((x) => x.length > 0)
   const { openWebdav, WebdavHostError } = await import('../webdav/server.mjs')
   const { connectHttpTarget, XmppClientError } = await import('../xmpp/client.mjs')
   if (options.guest !== undefined && typeof options.guest !== 'string') throw new UsageError('--guest needs a user name')
+  // The login (issue 1125): the same users file and limit options as on
+  // TCP, and the XMPP stream as the transport; the engine checks them all.
+  const davOptions = { configDir, transport: 'xmpp', jid: options.xmpp, tls: options['xmpp-tls'] === true }
+  if (typeof options['xmpp-host'] === 'string') davOptions.host = options['xmpp-host']
+  if (typeof options.guest === 'string') davOptions.guest = options.guest
+  if (typeof options.users === 'string') davOptions.users = resolvePath(options.users)
+  if (options['login-limit'] !== undefined) davOptions.loginLimit = String(options['login-limit'])
+  if (options['login-window'] !== undefined) davOptions.loginWindow = String(options['login-window'])
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    davOptions.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
   let dav
   try {
-    dav = await openWebdav({ configDir, ...(typeof options.guest === 'string' ? { guest: options.guest } : {}) })
+    dav = await openWebdav(davOptions)
   } catch (error) {
     if (error instanceof WebdavHostError && error.unknownOp) return notWired('webdav-serve', error.message)
     if (error instanceof WebdavHostError || (error !== null && typeof error === 'object' && error.code === 'ENOENT')) {
@@ -2662,6 +2755,7 @@ async function webdavOverXmpp (configDir, options, quiet) {
     tls: options['xmpp-tls'] === true,
     mounts: dav.mounts,
     dangerouslyAllowWritableWithoutLogin: options['dangerously-allow-writable-without-login'] === true,
+    login: dav.login,
     step: (request) => dav.step(request),
     onError: (error) => { if (!quiet) err(`webdav-serve: xmpp: ${error.message}`) }
   }
@@ -2685,7 +2779,8 @@ async function webdavOverXmpp (configDir, options, quiet) {
     throw error
   }
   if (!quiet) {
-    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}`)
+    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}` +
+        (dav.login ? `, login from ${options.users} (failed logins limited per user name and per bare JID)` : ', no --users: credentials get 401'))
     if (conn.writableWithoutLogin.length > 0) {
       err(`webdav-serve: WARNING: --dangerously-allow-writable-without-login: every allowed JID can write ${conn.writableWithoutLogin.join(', ')} as the storage owner, with no login`)
     }
@@ -2850,6 +2945,17 @@ async function commandWebdavUser (positional, options) {
 }
 
 async function commandXmppServe (positional, options) {
+  // One accounts line with no password in it: the password comes from stdin.
+  if (typeof options.verifier === 'string') {
+    const { randomBytes } = await import('node:crypto')
+    const { readFileSync } = await import('node:fs')
+    const { loadEngine } = await import('./engine.mjs')
+    const password = readFileSync(0, 'utf8').replace(/\r?\n$/, '')
+    const engine = await loadEngine()
+    const made = engine.call('xmppVerifier', [options.verifier, password, randomBytes(16).toString('base64'), String(options.iterations ?? 10000)])
+    out(made.line)
+    return 0
+  }
   if (positional.length !== 1) throw new UsageError('xmpp-serve needs one DIR')
   const quiet = options.quiet === true
   const { listen, XmppHostError } = await import('../xmpp/server.mjs')
@@ -2867,12 +2973,27 @@ async function commandXmppServe (positional, options) {
     onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) }
   }
   if (typeof options.domain === 'string') settings.domain = options.domain
-  if (typeof options.accounts === 'string') settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+  if (typeof options.accounts === 'string') {
+    settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+    settings.accountsFile = options.accounts
+  }
+  // The failed SASL login limit (https://github.com/danbri/factoidal/issues/1128):
+  // on by default; the engine decides and words the warning.
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    settings.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
+  if (options['no-address-limit'] === true) settings.addressLimit = false
   if (useTls) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
   }
   if (startTls) settings.startTls = true
+  if (options['tls-port'] !== undefined) {
+    if (!startTls) throw new UsageError('--tls-port needs --starttls')
+    const tlsPort = Number(options['tls-port'])
+    if (!Number.isInteger(tlsPort) || tlsPort < 0 || tlsPort > 65535) throw new UsageError('--tls-port needs a port number')
+    settings.directTlsPort = tlsPort
+  }
   if (options['state-key'] !== undefined) {
     if (typeof options['state-key'] !== 'string') throw new UsageError('--state-key needs a FILE')
     // 64 hex digits or base64url of 32 bytes; the engine checks it.
@@ -2884,6 +3005,20 @@ async function commandXmppServe (positional, options) {
     }
     settings.mucDomain = options.muc
   }
+  if (options['muc-members'] !== undefined) {
+    if (typeof options['muc-members'] !== 'string') throw new UsageError('--muc-members needs a FILE')
+    if (settings.mucDomain === undefined) throw new UsageError('--muc-members needs --muc')
+    settings.mucMembers = []
+    for (const line of (await fs.readFile(options['muc-members'], 'utf8')).split('\n')) {
+      if (line.trim() === '') continue
+      const [, room, list] = /^([^:\s@/]+):(.*)$/.exec(line.trim()) ?? []
+      const members = (list ?? '').split(/\s+/).filter(Boolean)
+      if (room === undefined || members.some((m) => !/^[^\s@/]+@[^\s@/]+$/.test(m))) {
+        throw new UsageError(`--muc-members: not "room: bare@jid ...": ${line}`)
+      }
+      settings.mucMembers.push({ room, members })
+    }
+  }
   if (options.mix !== undefined) {
     if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
       throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
@@ -2898,6 +3033,16 @@ async function commandXmppServe (positional, options) {
     if (options.gc3 === options.muc || options.gc3 === options.mix) throw new UsageError('--gc3 needs a domain of its own')
     settings.gc3Domain = options.gc3
   }
+  if (options['max-connections'] !== undefined) {
+    const n = Number(options['max-connections'])
+    if (!Number.isSafeInteger(n) || n < 1) throw new UsageError('--max-connections needs a positive integer')
+    settings.maxConnections = n
+  }
+  if (options['login-timeout'] !== undefined) {
+    const n = Number(options['login-timeout'])
+    if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--login-timeout needs a number of seconds')
+    settings.loginTimeoutMs = n * 1000
+  }
   if (options['ws-port'] !== undefined) {
     const wsPort = Number(options['ws-port'])
     if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
@@ -2926,6 +3071,9 @@ async function commandXmppServe (positional, options) {
     }
     throw error
   }
+  // The engine's start warnings (--dangerously-disable-ratelimits), printed
+  // also with --quiet.
+  for (const w of running.xmpp.warnings || []) err(`factoidal xmpp-serve: WARNING: ${w}`)
   if (!quiet) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +
@@ -2936,11 +3084,13 @@ async function commandXmppServe (positional, options) {
     if (settings.stateKey) err(`xmpp-serve: state kept across restarts in ${positional[0]}/state, sealed under the state key`)
     else err('xmpp-serve: WARNING: no --state-key: held messages, MIX channels and GC3 groups are lost at a restart, and rosters are written in clear')
   }
+  if (running.directOrigin && !quiet) err(`xmpp-serve: direct TLS (XEP-0368) on ${running.directOrigin}`)
   if (running.wsOrigin && !quiet) {
     err(`xmpp-serve: XMPP over WebSocket on ${running.wsOrigin}` +
         (settings.websocket.allowedOrigins.length ? ` for Origin ${settings.websocket.allowedOrigins.join(', ')}` : ' (no browser Origin allowed)'))
   }
   out(running.origin)
+  if (running.directOrigin) out(running.directOrigin)
   if (running.wsOrigin) out(running.wsOrigin)
   return untilInterrupted(running, quiet)
 }

package/bin/foafnaut-bleedingedge.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// foafnaut with the bleeding-edge channel; see foafnaut.mjs.
+import { main } from './foafnaut.mjs';
+await main(process.argv.slice(2), 'bleeding-edge');

package/bin/foafnaut-latest.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// foafnaut with the latest channel; see foafnaut.mjs.
+import { main } from './foafnaut.mjs';
+await main(process.argv.slice(2), 'latest');

package/bin/foafnaut.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+// foafnaut: start foafnaut2525, the Lean web rendering engine, in its own window.
+// This launcher only chooses and starts an installed macOS app. All page work is
+// in that app. Layout: $FOAFNAUT_HOME (default ~/.foafnaut), versions/<commit>/,
+// current -> versions/<commit>, config.json {"bleedingEdge":"/path/to/App.app"}.
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
+
+  PAGE              an http(s) URL or an HTML file; none opens the default page
+  --latest          install the newest published macOS build, then use it
+  --bleeding-edge   use the local build (config.json "bleedingEdge", or
+                    ~/Applications/foafnaut.app)
+  --verbose         print the choice of app, follow the trace, and log input
+  --detach          do not wait for the window to close
+  --install-latest  install the newest published build and stop
+  --list            list installed versions
+  --which           print the app that would run
+  --help            this text
+
+Also: foafnaut-latest, foafnaut-bleedingedge. Environment: FOAFNAUT_HOME, and
+FOAFNAUT_APP, which chooses the app outright. Page data goes to the app. Its trace
+is in ~/Library/Logs/foafnaut/trace.jsonl. The command stays open until the window
+closes; --detach returns at once.
+
+EXPERIMENTAL UNDER-REVIEWED CODE - USE WITH CARE - DO NOT CREATE PUBLIC SERVICES USING THIS WITHOUT CAREFUL INDEPENDENT EXPERT REVIEW.
+`;
+const RELEASES = 'https://api.github.com/repos/danbri/factoidal-builds/releases?per_page=60';
+const APP = 'foafnaut.app';
+const home = () => process.env.FOAFNAUT_HOME || join(homedir(), '.foafnaut');
+const fail = (message) => { console.error(`foafnaut: ${message}`); process.exit(1); };
+
+function config() {
+  const path = join(home(), 'config.json');
+  if (!existsSync(path)) return {};
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch (error) { fail(`${path}: ${error.message}`); }
+}
+const bleedingEdgeApp = () => config().bleedingEdge || join(homedir(), 'Applications', APP);
+function versionApp(dir) {
+  const app = join(dir, 'foafnaut', APP);
+  return existsSync(app) ? app : undefined;
+}
+function currentApp() {
+  const current = join(home(), 'current');
+  return existsSync(current) ? versionApp(current) : undefined;
+}
+
+async function installLatest() {
+  const response = await fetch(RELEASES, { headers: { accept: 'application/vnd.github+json', 'user-agent': 'foafnaut' } });
+  if (!response.ok) fail(`release list: HTTP ${response.status}`);
+  // The release list is not in publication order.
+  const release = (await response.json())
+    .filter((r) => /^build-[0-9a-f]{12}-foafnaut-darwin-arm64$/.test(r.tag_name) && r.published_at)
+    .sort((a, b) => b.published_at.localeCompare(a.published_at))[0];
+  if (!release) fail('no published macOS build');
+  const commit = release.tag_name.split('-')[1];
+  const dir = join(home(), 'versions', commit);
+  if (!versionApp(dir)) {
+    const asset = (name) => release.assets.find((a) => a.name === name)?.browser_download_url ?? fail(`${release.tag_name}: no ${name}`);
+    const download = async (url) => {
+      const reply = await fetch(url, { headers: { 'user-agent': 'foafnaut' } });
+      if (!reply.ok) fail(`${url}: HTTP ${reply.status}`);
+      return Buffer.from(await reply.arrayBuffer());
+    };
+    console.error(`foafnaut: downloading ${release.tag_name}`);
+    const info = JSON.parse((await download(asset('build-info.json'))).toString('utf8'));
+    const archive = await download(asset('foafnaut-darwin-arm64.tar.gz'));
+    const expected = info.artifacts?.['foafnaut-darwin-arm64.tar.gz']?.sha256;
+    const actual = createHash('sha256').update(archive).digest('hex');
+    if (!expected) fail(`${release.tag_name}: build-info.json has no archive digest`);
+    if (expected !== actual) fail(`${release.tag_name}: archive digest ${actual} is not ${expected}`);
+    const staging = `${dir}.tmp`;
+    rmSync(staging, { recursive: true, force: true });
+    mkdirSync(staging, { recursive: true });
+    writeFileSync(join(staging, 'archive.tar.gz'), archive);
+    const unpack = spawnSync('tar', ['-xzf', 'archive.tar.gz'], { cwd: staging, stdio: 'inherit' });
+    if (unpack.status !== 0) fail('tar failed');
+    rmSync(join(staging, 'archive.tar.gz'));
+    writeFileSync(join(staging, 'build-info.json'), JSON.stringify(info, null, 2));
+    if (!versionApp(staging)) {
+      rmSync(staging, { recursive: true, force: true });
+      fail(`${release.tag_name} has no ${APP}; it predates the native window. Use --bleeding-edge.`);
+    }
+    rmSync(dir, { recursive: true, force: true });
+    renameSync(staging, dir);
+  }
+  const link = join(home(), 'current');
+  rmSync(link, { force: true });
+  symlinkSync(join('versions', commit), link);
+  console.error(`foafnaut: current is ${commit}`);
+  return versionApp(dir);
+}
+
+function pageArgs(page) {
+  if (page === undefined) return [];
+  if (/^https?:\/\//i.test(page)) return ['--url', page];
+  const path = resolve(page);
+  if (!existsSync(path)) fail(`no such file: ${page}`);
+  return ['--html', path];
+}
+
+export async function main(argv, channel = 'current') {
+  const split = argv.indexOf('--');
+  const options = split < 0 ? argv : argv.slice(0, split);
+  const extra = split < 0 ? [] : argv.slice(split + 1);
+  let page, which = false, verbose = false, detach = false;
+  // Each of these picks the app or the action. Two of them have no one meaning.
+  const exclusive = options.filter((arg) => ['--latest', '--bleeding-edge', '--install-latest', '--list'].includes(arg));
+  if (new Set(exclusive).size > 1) fail(`${exclusive.join(' and ')} can not be used together; see --help`);
+  for (const arg of options) {
+    if (arg === '--help' || arg === '-h') { process.stdout.write(HELP); return; }
+    else if (arg === '--latest') channel = 'latest';
+    else if (arg === '--bleeding-edge') channel = 'bleeding-edge';
+    else if (arg === '--which') which = true;
+    else if (arg === '--verbose' || arg === '-v') verbose = true;
+    else if (arg === '--detach') detach = true;
+    else if (arg === '--install-latest') { await installLatest(); return; }
+    else if (arg === '--list') {
+      const versions = join(home(), 'versions');
+      const current = existsSync(join(home(), 'current')) ? basename(realpathSync(join(home(), 'current'))) : '';
+      for (const name of existsSync(versions) ? readdirSync(versions).filter((n) => !n.endsWith('.tmp')) : [])
+        console.log(`${name === current ? '*' : ' '} ${name}`);
+      console.log(`  bleeding edge: ${bleedingEdgeApp()}${existsSync(bleedingEdgeApp()) ? '' : ' (not found)'}`);
+      return;
+    } else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
+    else if (page !== undefined) fail('give one page');
+    else page = arg;
+  }
+  if (process.platform !== 'darwin') fail('the native window is macOS only; use the Hub page in a WebGPU browser');
+  let app = process.env.FOAFNAUT_APP;
+  if (!app && channel === 'latest') app = await installLatest();
+  if (!app && channel === 'bleeding-edge') app = bleedingEdgeApp();
+  if (!app) app = currentApp() ?? bleedingEdgeApp();
+  if (!existsSync(app)) fail(`no app at ${app}. Run foafnaut --install-latest.`);
+  if (which) { console.log(app); return; }
+  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...extra];
+  const log = join(homedir(), 'Library', 'Logs', 'foafnaut', 'trace.jsonl');
+  if (verbose) console.error(`foafnaut: app ${app}\nfoafnaut: open ${args.join(' ')}\nfoafnaut: trace ${log}`);
+  // Follow only what this run appends.
+  const follow = verbose ? spawn('tail', ['-n', '0', '-F', log], { stdio: ['ignore', 'inherit', 'ignore'] }) : undefined;
+  const run = spawnSync('open', args, { stdio: 'inherit' });
+  follow?.kill();
+  process.exit(run.status ?? 1);
+}
+
+if (import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) await main(process.argv.slice(2));

package/browser.js

@@ -27,7 +27,7 @@ import { entryFromEngine } from './lib/lean-entry.mjs';
 import { browserEngine } from './lib/browser-engine.mjs';
 import { indexedDbDeltaLogStore } from './lib/delta-log-hosts.mjs';
 import { sbm11Api, registerSbm11Source, mapReader } from './lib/sbm11.mjs';
-import { lwsSbm11Reader } from './lib/sbm11-lws.mjs';
+import { lwsSbm11Reader as lwsSbm11ReaderWith } from './lib/sbm11-lws.mjs';
 
 const l4Engine = browserEngine('l4factoidal', new URL('./l4-assets/', import.meta.url).href);
 
@@ -73,7 +73,10 @@ export const packSbm11 = sbm11.packSbm11;
 export { registerSbm11Source, mapReader };
 // A reader of an SBM11 generation held as LWS resources (issue 1010 KR3). In
 // a browser worker its default transport is a synchronous XMLHttpRequest.
-export { lwsSbm11Reader };
+// Asynchronous: it loads the engine, whose op containerPath decides every URL.
+export async function lwsSbm11Reader(url, opts = {}) {
+  return lwsSbm11ReaderWith(url, { ...opts, engine: opts.engine ?? await loadEngine() });
+}
 
 // RDF and SPARQL
 export const parse = api.parse;