@factoidal/core 0.32.0 → 0.33.0

package/CHANGELOG.md

@@ -2,9 +2,21 @@
 
 ## Unreleased
 
+## 0.33.0 (2026-11-06)
+
+- XMPP: held stanzas have caps per recipient and per server and a rate per sending account. A stanza for a name with no account is not held. Rosters have a cap on items and a rate on writes.
+- XMPP: SASL closes a stream after three failed attempts, adds a slower limit per client address, and uses one SCRAM exchange for every name. `--no-address-limit` is for a listener behind a proxy.
+- XMPP: accounts have a salt per name and more SCRAM iterations by default. An accounts line can hold keys in place of a password (`xmpp-serve --verifier NAME`). A malformed accounts file stops the start.
+- XMPP: a stanza has at most 64 levels and 8192 elements. Rooms have reserved nicks and nick checks, and a session leaves its rooms at a clean stream end.
+- XMPP: XEP-0421 occupant ids in rooms. A room seat stays until the last session of a full JID goes.
 - XMPP: `xmpp-serve --starttls --tls-port N` serves STARTTLS and XEP-0368 direct TLS from one server.
 - XMPP: members-only rooms (XEP-0045 section 7.2.6). `xmpp-serve --muc-members FILE` lists who may join each room; anyone else gets `registration-required` and cannot see the room.
 - XMPP: disco#info and disco#items results carry `from`. Without it, Profanity 0.19.0 stopped with a segmentation fault after login.
+- The URL decisions of the LWS SBM11 reader and of the compositor's pod storage are now in Lean (`L4Factoidal/LWS/ContainerPath.lean`, new pure wasm op `containerPath`), not in JavaScript: the container URL, each resource URL from a raw relative path, one new file name, a URL inside a pod root, and the folder above (https://github.com/danbri/factoidal/issues/1127). Theorems `resourceIn_under`, `segmentIn_under`, `within_under`, `parentIn_under` (an accepted URL has the container's origin and the container URL, which ends with `/`, is its prefix) and `within_sibling_refused` (`https://s.example/alice-other/` is not within `https://s.example/alice/`). `lwsSbm11Reader` is now asynchronous (`await lwsSbm11Reader(url, opts)`): it loads the engine first; `opts.engine` gives one. An empty `?` or `#` in a container URL is now refused too. The LWS client's token scope (`TokenEntry.covers`) has the same path-segment boundary: a token for the root `https://s.example/alice` is no longer sent to `https://s.example/alice-other/x` (theorem `covers_sibling_refused`). The hub compositor's pod storage needs an engine with `containerPath`; with an older engine it refuses every pod operation.
+- Requests to private addresses (https://github.com/danbri/factoidal/issues/1126). One Lean decision for every outbound request whose URL a remote party chooses, `L4Factoidal/Net/Egress.lean`: it refuses every address of the IANA IPv4 and IPv6 special-purpose registries (now also 100.64.0.0/10, 198.18.0.0/15, 192.0.0.0/24, the documentation ranges, 224.0.0.0/4, 240.0.0.0/4, 255.255.255.255, fec0::/10, ff00::/8, every IPv6 address outside 2000::/3, and NAT64 64:ff9b::/96 or 6to4 2002::/16 with such an IPv4 address inside) and localhost names, unless the operator opts in with `--allow-private-fetch`. The authorization server and CID retrieval use it (theorem `egress_refuses_special`). `lws-serve`: a webhook inbox at such an address answers 400 at subscription; every webhook, access-request, access-grant and controller-inbox delivery is checked again just before it is made, against the addresses the host resolves then, and the host connects to the address the engine chose (new wasm op `lwsEgress`; theorems `deliveries_pinned`, `egressOf_refuses_special`), so a name that resolves to a private address only at delivery time is refused. A refused delivery is not retried. Deliveries to one destination are limited for all subscriptions together: `--delivery-dest-limit N` (default 10 per window, theorem `admit_per_destination`). `lws-serve --allow-private-fetch` now also lets inboxes be private addresses, and its warning is printed also with `--quiet`. Hosts and tests that deliver to 127.0.0.1 must opt in.
+- `webdav-serve --xmpp` accepts `--users`, `--login-limit`, `--login-window` and `--dangerously-disable-ratelimits` (https://github.com/danbri/factoidal/issues/1125). Each request over XMPP passes the JID allow list and then the same Lean login as on TCP (`Login.admit`); HTTP Basic credentials in the XEP-0332 headers log in. `--users` over XMPP needs `--xmpp-tls` or a loopback `--xmpp-host`. `--cert` and `--key` are refused with `--xmpp` (no port opens).
+- The failed-login limit counts per requester (https://github.com/danbri/factoidal/issues/1128): the client address on TCP, the sender's bare JID over XMPP (`L4Factoidal/Net/LoginLimit.lean`, `requesterKey`), never an empty key; one JID's failures do not block another JID. Over XMPP, requests that wait for `chunkedBase64` chunks are limited to 4 per sender and 16 in total, and wait at most 60 seconds (`resource-constraint`).
+- `xmpp-serve` limits failed SASL logins by default: 5 in 60 seconds per account name and per client address, then `temporary-auth-failure` with no password check until the window ends. `--dangerously-disable-ratelimits` turns it off and prints a warning at start. Wasm: `xmppOpen` takes `disableRateLimits` and answers `warnings`; `xmppSessionOpen` takes `remoteAddress` and `now`; `xmppClientTick` also serves the serving mode; `xmppClientFeed` request records carry `requester`; `webdavOpen` takes `login.transport: "xmpp"` and `login.jid`; `ready.login`.
 
 ## 0.32.0 (2026-11-05)
 

package/bin/factoidal.mjs

@@ -445,8 +445,11 @@ DIR holds the signing keys (DIR/authz-keys.json, mode 0600), sealed with
 FACTOIDAL_LWS_KEY when it is set. --rotate-after makes a new key when the
 current one is that old; the old key stays published until its tokens expire.
 --allow-http accepts http subject identifiers; --allow-private-fetch lets the
-server fetch documents from loopback, link-local and private addresses. Both
-are off by default and are for tests.
+server fetch documents from special-purpose addresses: loopback, private,
+link-local, shared (100.64.0.0/10), multicast, reserved and the other ranges
+of the IANA special-purpose registries, and localhost names
+(https://github.com/danbri/factoidal/issues/1126). Both are off by default
+and are for tests.
 CORS (https://github.com/danbri/factoidal/issues/923): by default every answer
 echoes a valid request Origin in Access-Control-Allow-Origin, so a page on
 another origin can read the metadata and keys and exchange a token; a
@@ -474,7 +477,8 @@ usage: factoidal lws-serve DIR (--authz DIR | --issuer IRI | --auth-config FILE
                          [--paginate-always] [--moves all|data|off]
                          [--no-linkset-put] [--unstable-search-results] [--merkle]
                          [--controller-inbox URL] [--delivery-limit N]
-                         [--delivery-window SECONDS] [--redirects-max N]
+                         [--delivery-window SECONDS] [--delivery-dest-limit N]
+                         [--redirects-max N]
                          [--storage snapshot|files]
                          [--cors-origin ORIGIN]... [--no-cors]
 
@@ -569,6 +573,25 @@ The engine decides the file, its contents and every refusal
   --delivery-window SECONDS
                   the length of that window (config member deliveryWindow;
                   default 60)
+  --delivery-dest-limit N
+                  the most deliveries one destination (host and port of the
+                  inbox URL) gets in one window, for all subscriptions and
+                  access records together (config member deliveryDestLimit;
+                  default 10, 0 turns the limit off)
+                  https://github.com/danbri/factoidal/issues/1126
+  --allow-private-fetch
+                  let webhook, access-request, access-grant and controller
+                  inboxes be special-purpose addresses (loopback, private,
+                  link-local, shared 100.64.0.0/10, multicast, reserved and
+                  the other IANA special-purpose ranges) or localhost names,
+                  and let the --authz server fetch from them (config member
+                  allowPrivateFetch; default off). Without it such an inbox
+                  is refused with 400 when its address is known at
+                  subscription, and every delivery is checked again just
+                  before it is made, against the addresses resolved then;
+                  the server connects to the address it checked. For tests
+                  and closed networks only.
+                  https://github.com/danbri/factoidal/issues/1126
   --redirects-max N
                   the most previous identifiers of moved resources kept to
                   answer 301 Moved Permanently (config member redirectsMax;
@@ -751,7 +774,8 @@ usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
                             [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
                             [--state-key FILE] [--max-connections N]
-                            [--login-timeout SECONDS]
+                            [--login-timeout SECONDS] [--no-address-limit]
+                            [--dangerously-disable-ratelimits]
 
 Starts a Node TCP server that runs one engine session per connection and
 answers every byte through the engine's xmppSessionFeed operation.
@@ -768,7 +792,13 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    (default 5222; 5223 with --cert and --key and no --starttls)
   --host ADDRESS   the address to bind (default 127.0.0.1); without
                    --cert and --key only a loopback address is accepted
-  --accounts FILE  the accounts file (default DIR/accounts)
+  --accounts FILE  the accounts file (default DIR/accounts). One account per
+                   line: name:password, or a line from --verifier, which holds
+                   no password (SCRAM only). Any other line stops the start. A
+                   file others can read gives a warning
+  --verifier NAME  read a password from standard input, print the accounts line
+                   for NAME that holds no password, and exit; --iterations N
+                   sets the SCRAM count (default 10000)
   --cert FILE      PEM certificate chain: XEP-0368 direct TLS, or STARTTLS with --starttls
   --key FILE       PEM private key for --cert
   --starttls       listen in clear and REQUIRE STARTTLS (RFC 6120 section 5)
@@ -811,6 +841,23 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    membership, stable participant ids, optional events. There is
                    no published GC3 spec; every wire format is invented and listed
                    in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
+  --no-address-limit
+                   count failed logins per account name only. For a listener
+                   behind a proxy, where every client has the proxy's address
+                   and a limit on it would stop them all
+  --dangerously-disable-ratelimits
+                   no failed SASL login limit and no sender rate on held
+                   messages (a warning is printed at start); any client can
+                   then try passwords without end
+
+Failed SASL logins are limited by default
+(https://github.com/danbri/factoidal/issues/1128): after 5 failed logins in
+60 seconds for one account name (known or not) or from one client address
+(an IPv6 client by its /64), on one stream or on new ones, an attempt gets
+the SASL failure temporary-auth-failure, and no password is checked, also
+the right one, until that window ends. A client address also has a slower
+limit of 20 failed logins in an hour. A malformed SASL payload checks no
+password and does not count. A stream closes after 3 failed attempts.
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -885,7 +932,9 @@ usage: factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]
                               [--login-limit N] [--login-window SECONDS]
                               [--dangerously-disable-ratelimits]
        factoidal webdav-serve CONFIGDIR --xmpp JID --xmpp-password-file FILE
-                 --xmpp-allow JID[,JID...] [--guest NAME] [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
+                 --xmpp-allow JID[,JID...] [--guest NAME] [--users FILE]
+                 [--login-limit N] [--login-window SECONDS] [--dangerously-disable-ratelimits]
+                 [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
 
 EMERGENCY MODE (https://github.com/danbri/factoidal/issues/1147): the server
 is READ ONLY. Every write method (PUT, DELETE, MKCOL, COPY, MOVE, PROPPATCH,
@@ -994,13 +1043,24 @@ NAT is reached this way with no inbound port.
                              --xmpp-host (127.0.0.0/8, ::1) is accepted.
   --xmpp-ca FILE             PEM certificates to trust for --xmpp-tls
   --dangerously-allow-writable-without-login
-                             start although a local mount is writable:
-                             there is no login on the XMPP path yet
-                             (https://github.com/danbri/factoidal/issues/1125),
-                             so every allowed JID writes as the owner.
-                             Without it such a start is refused.
+                             with no --users: start although a local mount
+                             is writable, so every allowed JID writes as the
+                             owner. Without it such a start is refused.
+                             With --users it is not needed.
   --xmpp-resource R          the resource to bind (default dav)
 
+Both checks apply to every request over XMPP
+(https://github.com/danbri/factoidal/issues/1125): the sender's bare JID must
+be in --xmpp-allow, and then the request acts as a user exactly as on TCP:
+the --guest user with no credentials, a user of --users with HTTP Basic
+credentials in the request's headers (xmpp-http-proxy passes Authorization
+unchanged). --users over XMPP needs --xmpp-tls or a loopback --xmpp-host.
+The failed-login limit over XMPP counts per user name and per bare JID of
+the sender (https://github.com/danbri/factoidal/issues/1128): one JID's
+failures do not block another JID. A request whose chunked body is not
+complete waits at most 60 seconds, and at most 4 such requests per sender
+(16 in total) wait at once; others get resource-constraint.
+
 It prints the bound JID (xmpp:user@domain/resource) on standard output.
 XEP-0332 is Deferred, and no WebDAV client speaks it: a reader runs
 "factoidal xmpp-http-proxy --target JID/RESOURCE" (as an allowed JID) and
@@ -1211,7 +1271,7 @@ const VALUE_OPTIONS = {
   compact: new Set([]),
   serve: new Set(['port', 'host', 'query-path', 'gsp-path', 'file', 'layout', 'tdb2', 'allow-host', 'allow-origin']),
   'lws-serve': new Set(['port', 'host', 'base', 'issuer', 'auth-config', 'owner', 'root-acl',
-    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window',
+    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window', 'delivery-dest-limit',
     'redirects-max', 'storage', 'cors-origin', 'authz', 'alg', 'token-lifetime', 'rotate-after',
     'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin']),
   'solid-serve': new Set(['port', 'host', 'base', 'owner', 'issuer', 'auth-config', 'allow-host', 'allow-origin']),
@@ -1223,7 +1283,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'verifier', 'iterations']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2339,6 +2399,10 @@ async function commandLwsServe (positional, options) {
       ...(typeof options['controller-inbox'] === 'string' ? { controllerInbox: options['controller-inbox'] } : {}),
       ...(options['delivery-limit'] !== undefined ? { deliveryLimit: natOption('delivery-limit', options['delivery-limit']) } : {}),
       ...(options['delivery-window'] !== undefined ? { deliveryWindow: natOption('delivery-window', options['delivery-window']) } : {}),
+      ...(options['delivery-dest-limit'] !== undefined ? { deliveryDestLimit: natOption('delivery-dest-limit', options['delivery-dest-limit']) } : {}),
+      // Inboxes at special-purpose addresses (issue 1126): passed unread;
+      // L4Factoidal/Net/Egress.lean decides.
+      ...(options['allow-private-fetch'] === true ? { allowPrivateFetch: true } : {}),
       ...(options['redirects-max'] !== undefined ? { redirectsMax: natOption('redirects-max', options['redirects-max']) } : {}),
       ...(typeof options.storage === 'string' ? { storage: options.storage } : {}),
       ...corsConfig(options),
@@ -2368,11 +2432,16 @@ async function commandLwsServe (positional, options) {
   // The engine's start notices (a stale lock taken over; encryption at rest
   // on or off), printed also with --quiet.
   for (const n of (await running.storage()).notices || []) err(`lws-serve: ${n}`)
+  // Printed also with --quiet: this option opens the local network to
+  // requests that remote parties choose (issue 1126).
+  if (options['allow-private-fetch'] === true) {
+    err('lws-serve: WARNING: --allow-private-fetch: webhook and inbox deliveries and authorization ' +
+      'server fetches may go to loopback, private, link-local and other special-purpose addresses')
+  }
   if (!quiet) {
     err(`lws-serve: listening on ${running.origin} for ${positional[0]}`)
     if (running.authz() !== null) err(`lws-serve: authorization server ${running.authz().issuer} (keys in ${authzDir})`)
     if (options['allow-http'] === true) err('lws-serve: WARNING: --allow-http: http subject identifiers are accepted')
-    if (options['allow-private-fetch'] === true) err('lws-serve: WARNING: --allow-private-fetch: private addresses may be fetched')
     if (insecure) {
       err('lws-serve: WARNING: --insecure-no-auth: every request is served without authorization')
       err('lws-serve: --insecure-no-auth: only the Host names of this listener are answered, and a ' +
@@ -2641,20 +2710,32 @@ async function webdavOverXmpp (configDir, options, quiet) {
   if (typeof options.xmpp !== 'string') throw new UsageError('--xmpp needs a JID')
   if (typeof options['xmpp-password-file'] !== 'string') throw new UsageError('--xmpp needs --xmpp-password-file FILE')
   if (typeof options['xmpp-allow'] !== 'string') throw new UsageError('--xmpp needs --xmpp-allow JID[,JID...]')
-  // No login on the XMPP path yet: refuse --users rather than ignore it
-  // (https://github.com/danbri/factoidal/issues/1125).
-  if (['users', 'cert', 'key', 'login-limit', 'login-window', 'dangerously-disable-ratelimits'].some((k) => options[k] !== undefined)) {
-    throw new UsageError('--users, --cert, --key and the login-limit options do not apply with --xmpp yet (https://github.com/danbri/factoidal/issues/1125)')
+  // No port is open with --xmpp, so the HTTPS options do not apply. --users
+  // and the login-limit options do (https://github.com/danbri/factoidal/issues/1125).
+  if (['cert', 'key'].some((k) => options[k] !== undefined)) {
+    throw new UsageError('--cert and --key do not apply with --xmpp: no port is open; give --xmpp-tls for the XMPP stream')
   }
   const fs = await import('node:fs/promises')
+  const { resolve: resolvePath } = await import('node:path')
   const password = (await fs.readFile(options['xmpp-password-file'], 'utf8')).split(/\r?\n/)[0]
   const allow = options['xmpp-allow'].split(',').map((x) => x.trim()).filter((x) => x.length > 0)
   const { openWebdav, WebdavHostError } = await import('../webdav/server.mjs')
   const { connectHttpTarget, XmppClientError } = await import('../xmpp/client.mjs')
   if (options.guest !== undefined && typeof options.guest !== 'string') throw new UsageError('--guest needs a user name')
+  // The login (issue 1125): the same users file and limit options as on
+  // TCP, and the XMPP stream as the transport; the engine checks them all.
+  const davOptions = { configDir, transport: 'xmpp', jid: options.xmpp, tls: options['xmpp-tls'] === true }
+  if (typeof options['xmpp-host'] === 'string') davOptions.host = options['xmpp-host']
+  if (typeof options.guest === 'string') davOptions.guest = options.guest
+  if (typeof options.users === 'string') davOptions.users = resolvePath(options.users)
+  if (options['login-limit'] !== undefined) davOptions.loginLimit = String(options['login-limit'])
+  if (options['login-window'] !== undefined) davOptions.loginWindow = String(options['login-window'])
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    davOptions.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
   let dav
   try {
-    dav = await openWebdav({ configDir, ...(typeof options.guest === 'string' ? { guest: options.guest } : {}) })
+    dav = await openWebdav(davOptions)
   } catch (error) {
     if (error instanceof WebdavHostError && error.unknownOp) return notWired('webdav-serve', error.message)
     if (error instanceof WebdavHostError || (error !== null && typeof error === 'object' && error.code === 'ENOENT')) {
@@ -2674,6 +2755,7 @@ async function webdavOverXmpp (configDir, options, quiet) {
     tls: options['xmpp-tls'] === true,
     mounts: dav.mounts,
     dangerouslyAllowWritableWithoutLogin: options['dangerously-allow-writable-without-login'] === true,
+    login: dav.login,
     step: (request) => dav.step(request),
     onError: (error) => { if (!quiet) err(`webdav-serve: xmpp: ${error.message}`) }
   }
@@ -2697,7 +2779,8 @@ async function webdavOverXmpp (configDir, options, quiet) {
     throw error
   }
   if (!quiet) {
-    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}`)
+    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}` +
+        (dav.login ? `, login from ${options.users} (failed logins limited per user name and per bare JID)` : ', no --users: credentials get 401'))
     if (conn.writableWithoutLogin.length > 0) {
       err(`webdav-serve: WARNING: --dangerously-allow-writable-without-login: every allowed JID can write ${conn.writableWithoutLogin.join(', ')} as the storage owner, with no login`)
     }
@@ -2862,6 +2945,17 @@ async function commandWebdavUser (positional, options) {
 }
 
 async function commandXmppServe (positional, options) {
+  // One accounts line with no password in it: the password comes from stdin.
+  if (typeof options.verifier === 'string') {
+    const { randomBytes } = await import('node:crypto')
+    const { readFileSync } = await import('node:fs')
+    const { loadEngine } = await import('./engine.mjs')
+    const password = readFileSync(0, 'utf8').replace(/\r?\n$/, '')
+    const engine = await loadEngine()
+    const made = engine.call('xmppVerifier', [options.verifier, password, randomBytes(16).toString('base64'), String(options.iterations ?? 10000)])
+    out(made.line)
+    return 0
+  }
   if (positional.length !== 1) throw new UsageError('xmpp-serve needs one DIR')
   const quiet = options.quiet === true
   const { listen, XmppHostError } = await import('../xmpp/server.mjs')
@@ -2879,7 +2973,16 @@ async function commandXmppServe (positional, options) {
     onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) }
   }
   if (typeof options.domain === 'string') settings.domain = options.domain
-  if (typeof options.accounts === 'string') settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+  if (typeof options.accounts === 'string') {
+    settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+    settings.accountsFile = options.accounts
+  }
+  // The failed SASL login limit (https://github.com/danbri/factoidal/issues/1128):
+  // on by default; the engine decides and words the warning.
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    settings.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
+  if (options['no-address-limit'] === true) settings.addressLimit = false
   if (useTls) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
@@ -2968,6 +3071,9 @@ async function commandXmppServe (positional, options) {
     }
     throw error
   }
+  // The engine's start warnings (--dangerously-disable-ratelimits), printed
+  // also with --quiet.
+  for (const w of running.xmpp.warnings || []) err(`factoidal xmpp-serve: WARNING: ${w}`)
   if (!quiet) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +

package/browser.js

@@ -27,7 +27,7 @@ import { entryFromEngine } from './lib/lean-entry.mjs';
 import { browserEngine } from './lib/browser-engine.mjs';
 import { indexedDbDeltaLogStore } from './lib/delta-log-hosts.mjs';
 import { sbm11Api, registerSbm11Source, mapReader } from './lib/sbm11.mjs';
-import { lwsSbm11Reader } from './lib/sbm11-lws.mjs';
+import { lwsSbm11Reader as lwsSbm11ReaderWith } from './lib/sbm11-lws.mjs';
 
 const l4Engine = browserEngine('l4factoidal', new URL('./l4-assets/', import.meta.url).href);
 
@@ -73,7 +73,10 @@ export const packSbm11 = sbm11.packSbm11;
 export { registerSbm11Source, mapReader };
 // A reader of an SBM11 generation held as LWS resources (issue 1010 KR3). In
 // a browser worker its default transport is a synchronous XMLHttpRequest.
-export { lwsSbm11Reader };
+// Asynchronous: it loads the engine, whose op containerPath decides every URL.
+export async function lwsSbm11Reader(url, opts = {}) {
+  return lwsSbm11ReaderWith(url, { ...opts, engine: opts.engine ?? await loadEngine() });
+}
 
 // RDF and SPARQL
 export const parse = api.parse;

package/index.d.ts

@@ -240,7 +240,7 @@ export type WriteFormat =
   | 'rdfxml' | 'rdf-xml' | 'rdf' | 'jsonld' | 'json-ld' | 'rdfc' | 'canonical';
 
 /** Results formats of query() with `output`. */
-export type ResultsFormat = 'json' | 'xml' | 'csv' | 'tsv' | 'table' | 'ntriples';
+export type ResultsFormat = 'json' | 'xml' | 'xml-report' | 'csv' | 'tsv' | 'table' | 'ntriples';
 
 /** One row of formats(). */
 export interface FormatCapability {
@@ -1570,10 +1570,14 @@ export type Sbm11Transport = (url: string, headers: Record<string, string>) =>
  * null before transport and appear in errors().
  * Browser worker default XHR accepts no caller auth/headers; provide an explicit
  * trusted transport for those. Its final-URL check cannot prevent an already
- * sent anonymous request or ambient same-origin browser cookies. */
+ * sent anonymous request or ambient same-origin browser cookies.
+ * Asynchronous: the engine's op containerPath (Lean, L4Factoidal.LWS.ContainerPath)
+ * decides the container URL and every resource URL. */
 export function lwsSbm11Reader(url: string, opts?: {
-  auth?: string; headers?: Record<string, string>; transport?: Sbm11Transport; timeoutMs?: number
-}): Sbm11Reader & { evidence(): Sbm11ReadEvidence[]; errors(): string[]; close(): void };
+  auth?: string; headers?: Record<string, string>; transport?: Sbm11Transport; timeoutMs?: number;
+  /** a loaded engine handle (default: loadEngine()); its op containerPath decides every URL */
+  engine?: object
+}): Promise<Sbm11Reader & { evidence(): Sbm11ReadEvidence[]; errors(): string[]; close(): void }>;
 
 /** One query against a store: open with the query's plan, query, close. */
 export function queryStore(
@@ -2260,13 +2264,22 @@ export interface SparqlResultsJson {
   boolean?: boolean;
 }
 
+/** The exact serialized result is checked by the Lean XML parser. This is
+ * parser admission, not a proof of SPARQL serialization fidelity or XSLT success.
+ * Invalid RDF/XML characters are refused, never removed or replaced.
+ */
+export type SparqlXmlReport =
+  | { kind: 'xml'; xml: string }
+  | { kind: 'diagnostic'; code: 'XML_ADMISSION_REFUSED'; message: string };
+
 export type OutputFormat =
-  | 'json' | 'csv' | 'tsv' | 'xml' | 'table' | 'ntriples';
+  | 'json' | 'csv' | 'tsv' | 'xml' | 'xml-report' | 'table' | 'ntriples';
 
 /**
  * One call, serialised answer: parse `dataString`, close the default
  * graph under `entail`, run the query. Resolves to parsed SPARQL Results
- * JSON when output is 'json' (default), the text otherwise. 'csv', 'tsv'
+ * JSON when output is 'json' (default), an XML/diagnostic object for
+ * 'xml-report', and text otherwise. 'csv', 'tsv'
  * and 'xml' are the W3C SPARQL results formats (CSV and TSV have no ASK
  * encoding, so an ASK with those rejects); 'table' and 'ntriples' are
  * display formats. A CONSTRUCT or DESCRIBE answer is a graph and takes
@@ -2280,7 +2293,7 @@ export function queryRaw(
     entail?: EntailRegime;
     output?: OutputFormat;
   }
-): Promise<SparqlResultsJson | string>;
+): Promise<SparqlResultsJson | SparqlXmlReport | string>;
 
 /** Package version string, e.g. '0.9.0'. */
 export const version: string;

package/index.mjs

@@ -103,12 +103,15 @@ export { registerSbm11Source, mapReader };
 // A reader of an SBM11 generation held as LWS resources (lib/sbm11-lws.mjs;
 // https://github.com/danbri/factoidal/issues/1010 KR3). In Node the default
 // synchronous transport is a fetch in a worker thread (lib/sync-http-node.mjs),
-// stopped by the reader's close().
-export function lwsSbm11Reader(url, opts = {}) {
-  if (typeof opts.transport === 'function') return lwsSbm11ReaderWith(url, opts);
+// stopped by the reader's close(). Asynchronous: it loads the engine, whose
+// op containerPath decides the container URL and every resource URL
+// (formal/lean4/L4Factoidal/LWS/ContainerPath.lean).
+export async function lwsSbm11Reader(url, opts = {}) {
+  const engine = opts.engine ?? await loadEngine();
+  if (typeof opts.transport === 'function') return lwsSbm11ReaderWith(url, { ...opts, engine });
   const transport = nodeSyncTransport({ timeoutMs: opts.timeoutMs });
   try {
-    return lwsSbm11ReaderWith(url, { ...opts, transport, onClose: () => transport.close() });
+    return lwsSbm11ReaderWith(url, { ...opts, engine, transport, onClose: () => transport.close() });
   } catch (error) {
     transport.close();
     throw error;

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "7e47fa191143";
+const WASM_VERSION = "7f617da4ecbe";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-54551baca31a-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42216947974",
-  "gitSha": "54551baca31ae999900422c62ac59622ebf4d20a",
-  "builtAt": "2026-11-06T13:04:35Z",
+  "release": "danbri/factoidal-builds build-31be9833264a-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42304532396",
+  "gitSha": "31be9833264a2289526a8c9fcc1d6b67610cf746",
+  "builtAt": "2026-11-06T23:08:01Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "7e47fa1911434e286cd6523c2b622e183ea6837531d444b9691a2434486f5c4e",
-  "wasmBytes": 31415350,
+  "wasmSha256": "7f617da4ecbe7352b94f361802e12bb785f401aafbf78f92b6031c8e920011f2",
+  "wasmBytes": 32611669,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -693,7 +693,7 @@ function buildApi(driver) {
       }
       const r = await withExtensionRounds(() => entryResult(e.datasetQueryRaw(ds.handle, sparql,
         JSON.stringify({ entail, output })), 'query', sparql));
-      return output === 'json' && !graphForm ? JSON.parse(r.text) : r.text;
+      return (output === 'json' || output === 'xml-report') && !graphForm ? JSON.parse(r.text) : r.text;
     }
     const fn = sparql12 ? e.datasetQuery12 : e.datasetQuery;
     if (typeof fn !== 'function') {
@@ -2487,7 +2487,9 @@ function buildApi(driver) {
    * One call, serialised answer (op queryRaw): parse `dataString`, close
    * the default graph under `entail`, run the query, and write the answer
    * in `output`: 'json' (default; parsed SPARQL results JSON), or 'csv',
-   * 'tsv', 'xml', 'table', 'ntriples' (text). A CONSTRUCT or DESCRIBE
+   * 'tsv', 'xml', 'table', 'ntriples' (text), or 'xml-report' (a checked
+   * XML/diagnostic object from Lean). Ordinary 'xml' rejects an XML
+   * admission failure; 'xml-report' returns it as data. A CONSTRUCT or DESCRIBE
    * answer is a graph: 'ntriples' or 'table' only.
    * @param {string} dataString
    * @param {string} queryString
@@ -2511,7 +2513,7 @@ function buildApi(driver) {
     const r = entryResult(e.queryRaw(dataString, queryString,
       JSON.stringify({ dataFormat: tables.rawDataFormats[dataFormat], entail, output })),
     'queryRaw', queryString);
-    return output === 'json' ? JSON.parse(r.text) : r.text;
+    return output === 'json' || output === 'xml-report' ? JSON.parse(r.text) : r.text;
   }
 
   // ---------------------------------------------------------------

package/lib/sbm11-lws.mjs

@@ -40,40 +40,23 @@
 // thread has neither: pass `transport` or run the engine in a worker.
 
 // This reader grants its transport authority only within one HTTP container.
-// A file is a raw relative filename/path, never a URL reference. Reject both
-// literal traversal and encoded structural characters before attaching headers.
-function containerUrl (url) {
-  let base
-  try { base = new URL(String(url)) } catch { throw new TypeError('lwsSbm11Reader: expected an absolute HTTP(S) container URL') }
-  if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password || /[?#]/.test(base.href)) {
-    throw new TypeError('lwsSbm11Reader: container must be HTTP(S), without userinfo, query or fragment; use opts.auth/headers')
+// A file is a raw relative filename/path, never a URL reference. The engine
+// decides the container URL and every resource URL (op containerPath,
+// formal/lean4/L4Factoidal/LWS/ContainerPath.lean: containerOf, resourceIn,
+// theorem resourceIn_under) before any header is attached; this file only
+// turns a refusal into a TypeError.
+function containerUrl (engine, url) {
+  const r = engine.call('containerPath', [JSON.stringify({ kind: 'container', url: String(url) })])
+  if (!r.allowed) {
+    throw new TypeError(`lwsSbm11Reader: ${r.reason}; the container must be an absolute HTTP(S) URL without userinfo, query or fragment (use opts.auth/headers)`)
   }
-  if (!base.pathname.endsWith('/')) base.pathname += '/'
-  return base
+  return r.url
 }
 
-function resourceUrl (base, file) {
-  if (typeof file !== 'string' || file.length === 0 || file.length > 4096) {
-    throw new TypeError('invalid relative resource path')
-  }
-  let probe = file
-  for (;;) {
-    if (/^[a-z][a-z0-9+.-]*:/i.test(probe) || /[\\?#\x00-\x1f\x7f]/.test(probe) ||
-        probe.split('/').some(part => part === '' || part === '.' || part === '..') ||
-        /%(?:2f|5c|3f|23)/i.test(probe)) {
-      throw new TypeError('resource path must remain inside the configured container')
-    }
-    // Decode only for rejection, never for the requested filename. Each changed
-    // pass shortens the string, so nested percent encodings are also bounded.
-    const next = probe.replace(/%([a-f0-9]{2})/gi, (_match, hex) => String.fromCharCode(parseInt(hex, 16)))
-    if (next === probe) break
-    probe = next
-  }
-  const resource = new URL(file.split('/').map(encodeURIComponent).join('/'), base)
-  if (resource.origin !== base.origin || !resource.pathname.startsWith(base.pathname)) {
-    throw new TypeError('resource URL escaped the configured container')
-  }
-  return resource.href
+function resourceUrl (engine, base, file) {
+  const r = engine.call('containerPath', [JSON.stringify({ kind: 'resource', container: base, path: file })])
+  if (!r.allowed) throw new TypeError(`resource path must remain inside the configured container: ${r.reason}`)
+  return r.url
 }
 
 /** A synchronous GET with XMLHttpRequest (a browser worker). */
@@ -85,7 +68,8 @@ export function xhrSyncTransport (url, headers) {
   x.send()
   // XHR follows redirects internally. This rejects returned bytes, not the
   // already-sent request. Caller headers require an explicit trusted transport.
-  if (x.responseURL !== new URL(url).href) throw new Error('LWS reader: redirected XHR resource refused')
+  // `url` is the engine's serialization, so any other response URL is a redirect.
+  if (x.responseURL !== url) throw new Error('LWS reader: redirected XHR resource refused')
   return {
     status: x.status,
     header: (name) => x.getResponseHeader(name),
@@ -110,14 +94,20 @@ function unsatisfiedTotal (value) {
  *
  * @param {string} url absolute HTTP(S), no userinfo/query/fragment; container that holds CURRENT and the generation
  *   (or the generation container itself)
- * @param {object} [opts]
+ * @param {object} opts
+ * @param {object} opts.engine a loaded engine handle (`call(op, args)`); its op
+ *   containerPath decides the container URL and every resource URL
  * @param {Function} [opts.transport] trusted synchronous GET; must constrain redirect/header forwarding
  * @param {string} [opts.auth] a value for the Authorization header, such as
  *   `Bearer <access token>` (an LWS access token)
  * @param {object} [opts.headers] further request headers; browser use requires explicit trusted transport
  */
 export function lwsSbm11Reader (url, opts = {}) {
-  const base = containerUrl(url)
+  const engine = opts.engine
+  if (!engine || typeof engine.call !== 'function') {
+    throw new TypeError('lwsSbm11Reader: opts.engine (a loaded engine handle) decides the resource URLs')
+  }
+  const base = containerUrl(engine, url)
   const extra = { ...(opts.headers || {}) }
   if (opts.auth) extra.authorization = String(opts.auth)
   let transport = opts.transport
@@ -137,7 +127,7 @@ export function lwsSbm11Reader (url, opts = {}) {
     let e = files.get(file)
     if (!e) {
       let url
-      try { url = resourceUrl(base, file) } catch (error) {
+      try { url = resourceUrl(engine, base, file) } catch (error) {
         fail(file, error.message)
         return null
       }

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.32.0';
+export const version = '0.33.0';

package/lws/server.mjs

@@ -24,6 +24,16 @@
 //   lwsFetched [handle, documentJson] -> { ok, fetch? | installed? | refused? }
 //   lwsDelivered [handle, reportJson] -> { ok, changed, retry? }
 //   lwsFlush [handle, { now? }]       -> { ok, changed, deliveries?, wake? }
+//   lwsEgress [handle, { url, addresses }] -> { ok, host, address } | { ok, refused }
+//
+// REQUESTS TO PRIVATE ADDRESSES (https://github.com/danbri/factoidal/issues/1126)
+// Just before each delivery this host resolves the name the delivery names
+// (`resolve`, every address), passes the addresses to `lwsEgress`, and
+// connects to the address the answer names, with no second resolution
+// (`postTo`). A refused delivery is not made; it is reported to
+// `lwsDelivered` with `refused: true`. Which addresses are refused (the
+// IANA special-purpose ranges) and the opt-in `allowPrivateFetch` are
+// decided by `L4Factoidal/Net/Egress.lean` and `Notifications.egressOf`.
 //
 // RATE LIMIT AND INBOX CHECK (https://github.com/danbri/factoidal/issues/915)
 // An answer may carry `wake: SECONDS`: deliveries wait for a rate-limit
@@ -87,7 +97,7 @@ import { loadEngine } from '../bin/engine.mjs'
 import { readSnapshot, persistIfChanged, storageKeyText, storageModeText, loadFiles, persistFilesIfChanged, readStepBodies, acquireDirLock, atRestNotice } from './persist.mjs'
 
 /** The ops this host needs from the engine. */
-export const LWS_OPS = ['lwsOpen', 'lwsStep', 'lwsClose', 'lwsSnapshot', 'lwsFetched', 'lwsDelivered',
+export const LWS_OPS = ['lwsOpen', 'lwsStep', 'lwsClose', 'lwsSnapshot', 'lwsFetched', 'lwsDelivered', 'lwsEgress',
   'lwsLoad', 'lwsPersist', 'lwsRead', 'lwsDirLock', 'lwsAtRestNotice']
 
 /** How long this host waits for the answer to one delivery request before
@@ -128,6 +138,59 @@ async function resolveHost (host) {
   }
 }
 
+/** The most response bytes this host reads from an inbox; the rest is
+ *  dropped (the engine reads only the status). */
+const MAX_DELIVERY_ANSWER_BYTES = 65536
+
+/**
+ * POST one delivery to the address the engine chose (`lwsEgress`). Pure
+ * I/O: the connection goes to `address` only (the lookup answers it, so the
+ * name is not resolved again), TLS still checks the certificate against the
+ * URL's host name, redirects are not followed. The status, or 0 when no
+ * answer came in time.
+ */
+async function postTo (url, address, headers, body) {
+  let target
+  try {
+    target = new URL(url)
+  } catch (_error) {
+    return 0
+  }
+  const module = target.protocol === 'https:' ? await import('node:https') : await import('node:http')
+  const family = address.indexOf(':') >= 0 ? 6 : 4
+  const fields = {}
+  for (const pair of Array.isArray(headers) ? headers : []) {
+    if (Array.isArray(pair) && pair.length === 2) fields[String(pair[0])] = String(pair[1])
+  }
+  const bytes = Buffer.from(typeof body === 'string' ? body : '', 'utf8')
+  fields['content-length'] = String(bytes.length)
+  return new Promise((done) => {
+    let finished = false
+    const finish = (status) => { if (!finished) { finished = true; done(status) } }
+    const request = module.request(target, {
+      method: 'POST',
+      headers: fields,
+      lookup: (_host, options, callback) => {
+        if (options && options.all) callback(null, [{ address, family }])
+        else callback(null, address, family)
+      },
+      timeout: DELIVERY_TIMEOUT_MS
+    }, (response) => {
+      let size = 0
+      response.on('data', (chunk) => {
+        size += chunk.length
+        if (size > MAX_DELIVERY_ANSWER_BYTES) response.destroy()
+      })
+      response.on('end', () => finish(response.statusCode))
+      response.on('close', () => finish(response.statusCode))
+      response.on('error', () => finish(response.statusCode))
+    })
+    request.on('timeout', () => request.destroy(new Error('timeout')))
+    request.on('error', () => finish(0))
+    request.end(bytes)
+  })
+}
+
 /** The addresses of this machine's network interfaces. Pure I/O. */
 async function interfaceAddresses () {
   try {
@@ -323,6 +386,11 @@ export async function openLwsStorage (options = {}) {
   // engine checks and decides.
   if (typeof options.deliveryLimit === 'number') config.deliveryLimit = options.deliveryLimit
   if (typeof options.deliveryWindow === 'number') config.deliveryWindow = options.deliveryWindow
+  // The limit per destination and the opt-in for private and other
+  // special-purpose delivery targets (issue 1126): passed unread; the
+  // engine decides (L4Factoidal/Net/Egress.lean, Notifications.admitDest).
+  if (typeof options.deliveryDestLimit === 'number') config.deliveryDestLimit = options.deliveryDestLimit
+  if (options.allowPrivateFetch === true) config.allowPrivateFetch = true
   if (typeof options.redirectsMax === 'number') config.redirectsMax = options.redirectsMax
   if (typeof options.controllerInbox === 'string') config.controllerInbox = options.controllerInbox
   // CORS (https://github.com/danbri/factoidal/issues/923): `cors` is false or
@@ -440,22 +508,22 @@ export async function openLwsStorage (options = {}) {
   function deliver (delivery) {
     const job = (async () => {
       let status = 0
-      try {
-        const answer = await fetch(delivery.url, {
-          method: 'POST',
-          headers: Array.isArray(delivery.headers) ? delivery.headers : [],
-          body: delivery.body,
-          redirect: 'manual',
-          signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS)
-        })
-        status = answer.status
-        await answer.arrayBuffer()
-      } catch (_error) {
-        status = 0
+      // Resolve now, let the engine choose the address (issue 1126), and
+      // connect to that address only.
+      const addresses = typeof delivery.resolve === 'string' ? await resolveHost(delivery.resolve) : []
+      if (closed) return
+      const decided = engine.call('lwsEgress', [handle, JSON.stringify({ url: delivery.url, addresses })])
+      const refused = decided !== null && typeof decided === 'object' && typeof decided.refused === 'string'
+        ? decided.refused
+        : null
+      if (refused !== null) {
+        console.error(`lws-serve: delivery to ${delivery.url} not made: ${refused}`)
+      } else {
+        status = await postTo(delivery.url, String(decided.address), delivery.headers, delivery.body)
       }
       if (closed) return
       const told = engine.call('lwsDelivered', [handle, JSON.stringify({
-        id: delivery.id, status, ...clockNow()
+        id: delivery.id, status, ...(refused !== null ? { refused: true } : {}), ...clockNow()
       })])
       persist(told)
       const retry = told !== null && typeof told === 'object' ? told.retry : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",

package/webdav/server.mjs

@@ -186,6 +186,13 @@ export async function openWebdav (options = {}) {
   }
   // The guest user (issue 1147), passed unread; the engine checks it.
   if (typeof options.guest === 'string') login.guest = options.guest
+  // HTTP over XMPP (issue 1125): the transport, the account and, when the
+  // operator gave one, the XMPP server's address; the engine decides.
+  if (options.transport === 'xmpp') {
+    login.transport = 'xmpp'
+    if (typeof options.jid === 'string') login.jid = options.jid
+    if (typeof options.host !== 'string') delete login.host
+  }
   const config = { listing, entropy: randomBase64(32), now: nowSeconds(), login }
   // The Host and Origin guard of the HTTP listener (issue 1124): the bound
   // address and the operator's names and origins, passed unread
@@ -257,6 +264,9 @@ export async function openWebdav (options = {}) {
       randomBase64: randomBase64(16),
       remoteAddress: typeof request.remoteAddress === 'string' ? request.remoteAddress : ''
     }
+    // Over XMPP: the requester the XMPP client handle named (the sender's
+    // bare JID), passed unread (https://github.com/danbri/factoidal/issues/1128).
+    if (request.requester !== undefined && request.requester !== null) record.requester = request.requester
     let got = blobCall(engine, 'webdavStep', [handle, JSON.stringify(record)], request.body || new Uint8Array(0))
     for (let hop = 0; hop < MAX_HOPS; hop += 1) {
       const env = got.envelope
@@ -294,6 +304,8 @@ export async function openWebdav (options = {}) {
     engine,
     mounts: ready.mounts || [],
     warnings: ready.warnings || [],
+    /** The engine's `ready.login`: a users file is loaded. */
+    login: ready.login === true,
     /** The start notices of the local mounts (a stale lock taken over,
      *  encryption at rest on or off), for standard error. */
     storageNotices,

package/xmpp/README.md

@@ -100,7 +100,8 @@ process per connection behind socat) serves; the wasm session ops are
 | `xmppClose` | `[server]` | `{ ok, sessions }` |
 
 The state directory is laid out as the native carrier's, so the two
-hosts can share one: `DIR/accounts` (one `user:password` per line),
+hosts can share one: `DIR/accounts` (one `user:password` per line, or a line with no
+password from `factoidal xmpp-serve --verifier NAME`, for SCRAM only),
 `DIR/roster/<bare jid>.tsv` (persisted on every `rostersSaved`, loaded
 on start), and `DIR/spool/<bare jid>/<file>` — a stanza written there
 by any process is delivered to that account's bound session and
@@ -130,8 +131,9 @@ RFC 6120 section 5 STARTTLS with `startTls: true` (op `xmppSessionTlsUp`;
 the engine decides, the host does the handshake; see the theorems in
 `formal/lean4/L4Factoidal/XMPP/Server.lean`).
 Not: server-to-server federation, MUC/MIX/GC3 rooms, PRECIS.
-Known limitation shared with the native harness: one SCRAM salt per
-server (`saltB64` in the config), not one per account.
+Each name has its own SCRAM salt, from a seed the host gives the engine
+(`saltSeed`; derived from the state key when there is one). The native
+harness and a fixed `saltB64` keep one salt for all.
 
 The shared engine currently reduces routed destinations to bare JIDs and
 the Node host delivers to every bound resource. It does not implement full
@@ -204,4 +206,15 @@ The host closes a socket when a limit is reached. These are limits on bytes and
 | `maxQueuedBytes` | | 8 MiB | Bytes waiting for a client that is not reading |
 | `maxBuffered` | | 1 MiB | Bytes of an unfinished unit |
 
-There is no limit per address: behind a proxy, every client has the same one.
+There is no connection limit per address: behind a proxy, every client has the same one.
+
+## Limits the engine applies
+
+| Option | CLI | Default | Limit |
+|---|---|---|---|
+| `heldLimits.perAccount`, `.perAccountBytes` | | 256 stanzas, 4 MiB | Held for one offline account |
+| `heldLimits.total`, `.totalBytes` | | 10,000 stanzas, 64 MiB | Held on the server |
+| `heldLimits.senderPerWindow`, `.senderWindow` | | 60 in 60 s | Stanzas one account may have held; roster writes of one account |
+| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off behind a proxy, where every client has one address |
+
+Fixed in the engine: 5 failed logins in 60 s per account name, 3 failed attempts on a stream, 1,000 items in a roster, 64 levels and 8,192 elements in a stanza, and room nicks of at most 64 bytes.

package/xmpp/client.mjs

@@ -196,7 +196,9 @@ async function openStream (engine, config, options, onFeed, onClosed) {
  * @param {string} [options.resource]
  * @param {object[]} [options.mounts] the WebDAV handle's mounts, passed unread (the engine refuses writable local mounts without the opt-in)
  * @param {boolean} [options.dangerouslyAllowWritableWithoutLogin]
- * @param {Function} options.step `async ({method, target, headers, body}) => ({status, headers, body})`
+ * @param {boolean} [options.login] the WebDAV handle has a users file (its `ready.login`, passed unread)
+ * @param {number} [options.tickMs] how often the clock is given to the engine (default 1000)
+ * @param {Function} options.step `async ({method, target, headers, body, requester}) => ({status, headers, body})`
  * @param {object} [options.engine]
  * @param {Function} [options.onError]
  * @param {number} [options.maxBuffered] residual bytes the engine may hold before the socket is closed (default 16 MiB)
@@ -211,6 +213,7 @@ export async function connectHttpTarget (options = {}) {
   config.allow = Array.isArray(options.allow) ? options.allow : []
   if (Array.isArray(options.mounts)) config.mounts = options.mounts
   if (options.dangerouslyAllowWritableWithoutLogin === true) config.dangerouslyAllowWritableWithoutLogin = true
+  if (options.login === true) config.login = true
 
   let stream = null
   /** One request the engine named: carried to `step`, answered. */
@@ -221,7 +224,10 @@ export async function connectHttpTarget (options = {}) {
         method: request.method,
         target: request.target,
         headers: request.headers || [],
-        body: new Uint8Array(Buffer.from(request.bodyBase64 || '', 'base64'))
+        body: new Uint8Array(Buffer.from(request.bodyBase64 || '', 'base64')),
+        // The sender's bare JID as the engine named it (issue 1128),
+        // passed unread to the WebDAV handle's login.
+        requester: request.requester
       })
       answer = {
         status: response.status,
@@ -243,11 +249,20 @@ export async function connectHttpTarget (options = {}) {
     for (const r of answer.requests || []) carry(r)
   })
   const jid = await stream.bound
+  // The clock for the time limit of requests that wait for chunks
+  // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
+  const timer = setInterval(() => {
+    if (!stream.isOpen()) return
+    try {
+      stream.write(call(engine, 'xmppClientTick', [stream.handle, String(Date.now())]).send)
+    } catch (_error) { /* handle gone */ }
+  }, typeof options.tickMs === 'number' ? options.tickMs : 1000)
+  stream.closed.then(() => clearInterval(timer))
   return {
     jid,
     writableWithoutLogin: stream.opened.writableWithoutLogin || [],
     closed: stream.closed,
-    close: () => stream.close()
+    close: () => { clearInterval(timer); return stream.close() }
   }
 }
 

package/xmpp/inpage.mjs

@@ -53,6 +53,8 @@ export async function openInPageXmppServer (options = {}) {
   for (const k of ['domain', 'mucDomain', 'mixDomain', 'gc3Domain', 'saltB64']) {
     if (typeof options[k] === 'string') config[k] = options[k]
   }
+  if (typeof config.saltB64 !== 'string') config.saltSeed = randomToken()
+  config.occupantSeed = randomToken()
   if (Array.isArray(options.accounts)) config.accounts = options.accounts
   if (typeof options.iterationCount === 'number') config.iterationCount = options.iterationCount
   const opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -106,7 +108,11 @@ export async function openInPageXmppServer (options = {}) {
       send (message) {
         if (!open) throw new Error('the in-page XMPP connection is closed')
         let answer
-        try { answer = engine.call('xmppMsgFeed', [session, String(message)]) } catch (error) { onError(error); end(); return }
+        try {
+          // The rate limits read the host's clock.
+          engine.call('xmppClock', [handle, String(Math.floor(Date.now() / 1000))])
+          answer = engine.call('xmppMsgFeed', [session, String(message)])
+        } catch (error) { onError(error); end(); return }
         emit(answer.send || [])
         router.apply(c, answer)
         if (answer.close === true) end()

package/xmpp/server.mjs

@@ -38,12 +38,12 @@
 // a client may send without completing a unit beyond `maxBuffered`,
 // which is a transport limit this host applies by closing the socket.
 // The other transport limits are `maxConnections`, `loginTimeoutMs` and
-// `maxQueuedBytes`. There is no limit per address: behind a proxy, every
-// client has the same one.
+// `maxQueuedBytes`. There is no connection limit per address: behind a
+// proxy, every client has the same one.
 
-import { randomBytes } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
 import { StringDecoder } from 'node:string_decoder'
-import { mkdir, readFile, writeFile, readdir, unlink, rename } from 'node:fs/promises'
+import { mkdir, readFile, writeFile, readdir, unlink, rename, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { loadEngine } from '../bin/engine.mjs'
 import { createXmppRouter } from './router.mjs'
@@ -52,7 +52,7 @@ import { createXmppRouter } from './router.mjs'
 export const XMPP_SERVER_OPS = [
   'xmppOpen', 'xmppClose',
   'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionClose',
-  'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad'
+  'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad', 'xmppClock'
 ]
 
 /** An error raised by this host, as opposed to one the engine reported.
@@ -119,10 +119,19 @@ function randomToken (bytes = 18) {
  * @param {object} options
  * @param {string} [options.domain] the domain the server is authoritative for (default `localhost`)
  * @param {Array<{username: string, password: string}>} [options.accounts]
- * @param {string} [options.accountsText] `user:password` lines, the harness's accounts-file format
- * @param {string} [options.saltB64] the SCRAM salt, base64
+ * @param {string} [options.accountsText] the accounts file's text, one account per line:
+ *   `name:password`, or the keys `factoidal xmpp-serve --verifier NAME` writes. A line that is
+ *   neither stops the start (`Server.accountsOfText`)
+ * @param {string} [options.saltB64] one SCRAM salt for every name, base64; absent, each name has its own
+ * @param {string} [options.saltSeed] the seed of the salts; absent, a random one for this process
+ * @param {string} [options.occupantSeed] the key of the rooms' occupant ids; absent, a random one
  * @param {number} [options.iterationCount] the SCRAM iteration count
  * @param {boolean} [options.tlsCarrier] whether the carrier terminates TLS
+ * @param {boolean} [options.disableRateLimits] no failed SASL login limit and no sender rate on
+ *   held stanzas (`--dangerously-disable-ratelimits`)
+ * @param {object} [options.heldLimits] caps of the stanzas held for offline accounts, each a
+ *   number: `perAccount`, `perAccountBytes`, `total`, `totalBytes`, `senderPerWindow`,
+ *   `senderWindow` (seconds); what is absent keeps the engine's default
  * @param {object} [options.engine] an engine handle to reuse
  * @returns {Promise<{engine: object, handle: string, domain: string,
  *   openSession: Function, roster: Function, setRoster: Function, close: Function}>}
@@ -133,13 +142,20 @@ export async function openXmppServer (options = {}) {
   if (typeof options.domain === 'string') config.domain = options.domain
   if (Array.isArray(options.accounts)) config.accounts = options.accounts
   if (typeof options.accountsText === 'string') config.accountsText = options.accountsText
+  // One salt per name, from a seed the engine cannot make; a fixed `saltB64`
+  // (a transcript that must replay) is one salt for all.
   if (typeof options.saltB64 === 'string') config.saltB64 = options.saltB64
+  else config.saltSeed = typeof options.saltSeed === 'string' ? options.saltSeed : randomToken(32)
+  // The key of the XEP-0421 occupant ids of the rooms.
+  config.occupantSeed = typeof options.occupantSeed === 'string' ? options.occupantSeed : randomToken(32)
   if (typeof options.iterationCount === 'number') config.iterationCount = options.iterationCount
   if (typeof options.tlsCarrier === 'boolean') config.tlsCarrier = options.tlsCarrier
   // XEP-0045 room service (L4Factoidal/XMPP/Muc.lean); off unless named.
   if (typeof options.mucDomain === 'string') config.mucDomain = options.mucDomain
   // Members-only rooms: [{room, members: [bare JID]}]; no list, an open room.
   if (Array.isArray(options.mucMembers)) config.mucMembers = options.mucMembers
+  // Nicks reserved for a JID: [{nick, jid}]. Each account's name is reserved for it anyway.
+  if (Array.isArray(options.mucReservedNicks)) config.mucReservedNicks = options.mucReservedNicks
   // XEP-0369 channels (L4Factoidal/XMPP/Mix.lean), joined through MIX-PAM; off unless named.
   if (typeof options.mixDomain === 'string') config.mixDomain = options.mixDomain
   // GC3 prototype groups (L4Factoidal/XMPP/Gc3.lean; no published spec); off unless named.
@@ -147,6 +163,10 @@ export async function openXmppServer (options = {}) {
   // The host keeps the state across restarts (a state key and a DIR): only
   // then does the engine produce `store`/`unstore`.
   if (options.persist === true) config.persist = true
+  // The failed SASL login limit is on unless the operator turns it off
+  // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
+  if (options.disableRateLimits === true) config.disableRateLimits = true
+  if (options.heldLimits && typeof options.heldLimits === 'object') config.heldLimits = options.heldLimits
   let opened
   try {
     opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -162,6 +182,19 @@ export async function openXmppServer (options = {}) {
     throw new XmppHostError('xmppOpen answered with no handle')
   }
   const handle = opened.handle
+  // The rate limits read the host's clock: tell the engine when the second changes.
+  let lastSecond = 0
+  const tick = () => {
+    const now = Math.floor(Date.now() / 1000)
+    if (now === lastSecond) return
+    lastSecond = now
+    try {
+      engine.call('xmppClock', [handle, String(now)])
+    } catch (error) {
+      // An older engine has no such op, and no limit that reads it.
+      if (!isUnknownOp(error)) throw error
+    }
+  }
   // An older engine ignores the list, and the rooms would be open: do not start.
   if (Array.isArray(options.mucMembers) && opened.mucMembers !== options.mucMembers.length) {
     engine.call('xmppClose', [handle])
@@ -172,15 +205,22 @@ export async function openXmppServer (options = {}) {
     handle,
     domain: typeof opened.domain === 'string' ? opened.domain : (config.domain || 'localhost'),
     accounts: typeof opened.accounts === 'number' ? opened.accounts : undefined,
+    /** The engine's start warnings (--dangerously-disable-ratelimits). */
+    warnings: Array.isArray(opened.warnings) ? opened.warnings : [],
+    tick,
     /**
      * One client connection.
-     * @param {{streamId?: string, nonce?: string, tlsCarrier?: boolean, startTls?: boolean, maxUnits?: number}} [sessionOptions]
+     * `remoteAddress` (the socket's) and the clock go to the engine for the
+     * failed SASL login limit (https://github.com/danbri/factoidal/issues/1128).
+     * @param {{streamId?: string, nonce?: string, tlsCarrier?: boolean, startTls?: boolean, maxUnits?: number, remoteAddress?: string}} [sessionOptions]
      */
     openSession (sessionOptions = {}) {
       const record = {
         streamId: typeof sessionOptions.streamId === 'string' ? sessionOptions.streamId : randomToken(),
-        nonce: typeof sessionOptions.nonce === 'string' ? sessionOptions.nonce : randomToken()
+        nonce: typeof sessionOptions.nonce === 'string' ? sessionOptions.nonce : randomToken(),
+        now: Math.floor(Date.now() / 1000)
       }
+      if (typeof sessionOptions.remoteAddress === 'string') record.remoteAddress = sessionOptions.remoteAddress
       if (typeof sessionOptions.tlsCarrier === 'boolean') record.tlsCarrier = sessionOptions.tlsCarrier
       if (typeof sessionOptions.startTls === 'boolean') record.startTls = sessionOptions.startTls
       if (typeof sessionOptions.maxUnits === 'number') record.maxUnits = sessionOptions.maxUnits
@@ -192,6 +232,7 @@ export async function openXmppServer (options = {}) {
         handle: session,
         /** Feed received text; returns the engine's answer document. */
         feed (text) {
+          tick()
           return engine.call('xmppSessionFeed', [session, text])
         },
         /** The TLS handshake a feed asked for (`startTls: true`) finished. */
@@ -238,6 +279,14 @@ async function readAccountsFile (path) {
   }
 }
 
+/** A warning when the accounts file can be read by anyone but its owner. */
+async function accountsFileWarnings (path) {
+  if (process.platform === 'win32') return []
+  const { mode } = await stat(path)
+  if ((mode & 0o077) === 0) return []
+  return [`${path} can be read by other users of this machine: chmod 600 it`]
+}
+
 /**
  * A `net.Server` (or `tls.Server`, when `cert` and `key` are given —
  * XEP-0368 direct TLS) that runs one engine session per connection.
@@ -245,6 +294,7 @@ async function readAccountsFile (path) {
  * The server is returned unlistened: the caller chooses the port.
  *
  * @param {object} options as `openXmppServer`, plus:
+ * @param {string} [options.accountsFile] the path `accountsText` came from, to check its mode
  * @param {string} [options.dir] state directory: `accounts` is read from it when
  *   no accounts are given; rosters are persisted under `roster/`; `spool/` is
  *   polled for stanzas written by other processes
@@ -265,6 +315,8 @@ async function readAccountsFile (path) {
  *   without a bound resource before it is closed (default 30000; 0 disables)
  * @param {number} [options.maxQueuedBytes] bytes waiting to be written to a
  *   client that is not reading, before the socket is closed (default 8 MiB)
+ * @param {boolean} [options.addressLimit] false: count failed logins per account name only, for a
+ *   listener behind a proxy, where every client has one address (default true)
  * @param {Function} [options.onError]
  * @param {Function} [options.onLog]
  * @returns {Promise<{server: object, xmpp: object, close: Function, sessions: Function}>}
@@ -293,9 +345,19 @@ export async function createXmppServer (options = {}) {
   }
 
   const serverOptions = { ...options }
+  let accountsFile = typeof options.accountsFile === 'string' ? options.accountsFile : null
   if (dir !== null && !Array.isArray(options.accounts) && typeof options.accountsText !== 'string') {
     const text = await readAccountsFile(join(dir, 'accounts'))
-    if (text !== null) serverOptions.accountsText = text
+    if (text !== null) { serverOptions.accountsText = text; accountsFile = join(dir, 'accounts') }
+  }
+  // Salts that survive a restart when the state does: a client that keeps a
+  // salted password goes on working, and a name's salt does not change.
+  if (typeof options.saltSeed !== 'string' && typeof options.stateKey === 'string') {
+    serverOptions.saltSeed = createHash('sha256').update('xmpp salt seed\0' + options.stateKey).digest('base64url')
+  }
+  // Occupant ids that survive a restart, for the same reason.
+  if (typeof options.occupantSeed !== 'string' && typeof options.stateKey === 'string') {
+    serverOptions.occupantSeed = createHash('sha256').update('xmpp occupant seed\0' + options.stateKey).digest('base64url')
   }
   const haveKey = options.cert !== undefined && options.key !== undefined
   if (options.startTls === true && !haveKey) {
@@ -306,6 +368,7 @@ export async function createXmppServer (options = {}) {
   if (typeof serverOptions.tlsCarrier !== 'boolean') serverOptions.tlsCarrier = useTls
   if (dir !== null && options.stateKey !== undefined) serverOptions.persist = true
   const xmpp = await openXmppServer(serverOptions)
+  if (accountsFile !== null) xmpp.warnings.push(...await accountsFileWarnings(accountsFile))
 
   // Rosters the previous run persisted.
   try {
@@ -363,6 +426,10 @@ export async function createXmppServer (options = {}) {
           if (got.status !== 200) throw new XmppHostError(`state: ${path} answered ${got.status}`)
           const loaded = xmpp.engine.call('xmppStateLoad', [xmpp.handle, path, new TextDecoder().decode(got.body)])
           if (loaded === null || typeof loaded !== 'object') throw new XmppHostError(`state: ${path} was refused`)
+          if (loaded.stale === true) {
+            const gone = await state.step({ method: 'DELETE', target: path, headers: [], body: new Uint8Array(0) })
+            if (gone.status >= 300 && gone.status !== 404) throw new XmppHostError(`state: DELETE ${path} answered ${gone.status}`)
+          }
         }
       }
     } catch (error) {
@@ -411,6 +478,11 @@ export async function createXmppServer (options = {}) {
   // connection callback and therefore have no engine session yet.
   const transports = new Set()
 
+  // The client's address for the login limit. Behind a proxy every client has
+  // the proxy's address, and a limit on it would stop them all: `addressLimit: false`.
+  const addressOf = (socket) =>
+    options.addressLimit !== false && typeof socket.remoteAddress === 'string' ? socket.remoteAddress : ''
+
   // Transport limits, like `maxBuffered`: bytes and time, not protocol.
   function closeIfBacklogged (c) {
     if (c.socket.destroyed || !(c.socket.writableLength > maxQueuedBytes)) return
@@ -543,7 +615,7 @@ export async function createXmppServer (options = {}) {
   function onConnection (socket, direct = false) {
     let session
     try {
-      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct })
+      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(socket) })
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -611,7 +683,7 @@ export async function createXmppServer (options = {}) {
     let handle
     try {
       const opened = xmpp.engine.call('xmppWsOpen', [xmpp.handle, JSON.stringify({
-        streamId: randomToken(), nonce: randomToken(),
+        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(socket),
         path: typeof ws.path === 'string' ? ws.path : '/xmpp-websocket',
         allowedOrigins: Array.isArray(ws.allowedOrigins) ? ws.allowedOrigins : [],
         allowNoOrigin: ws.allowNoOrigin === true,
@@ -648,6 +720,7 @@ export async function createXmppServer (options = {}) {
       if (!connections.has(c) || c.closing) return
       let got
       try {
+        xmpp.tick()
         got = wsCall('xmppWsFeed', [handle], new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength))
       } catch (error) {
         onError(error)