@factoidal/core 0.32.0 → 0.34.0

package/CHANGELOG.md

@@ -1,10 +1,29 @@
 # Changelog
 
-## Unreleased
-
+## 0.34.0 (2026-11-08)
+
+- `foafnaut` command: `--url` and `--html` open a page or a file (`file:` URLs too), and other options are passed to the app.
+- XMPP: `xmpp-serve --proxy-protocol` (`proxyProtocol` in `createXmppServer`): every connection, on every listener, must start with a PROXY protocol v2 header, read before TLS, and the failed-login limit counts the client address it names. So the limit per client address can stay on behind Fly's proxy, where `--no-address-limit` was needed. The header is decided in Lean (`L4Factoidal/Net/ProxyProtocol.lean`, new wasm op `proxyHeaderParse`, theorems `parse_signature`, `parse_more_bounded`, `parse_proxy_le`); a connection without a valid header in 10 seconds (`proxyHeaderTimeoutMs`) is closed. Without the flag no header is read.
+- XMPP: the server keeps no client address. The limit counts an HMAC-SHA-256 tag of the address (IPv6 by its /64) under a random key that is in memory only and new at each start (`LoginLimit.addressTag`; `xmppOpen` takes `addressKey`; `xmppSessionOpen` and `xmppWsOpen` answer `addressTag`, its first 12 digits). The "connection from" log line shows the tag, not the address and port.
+- XMPP: the server pings a bound session that has been silent, and closes it if it stays silent, so a dead connection frees its resource. A ping is XEP-0199 on TCP and a ping frame on a WebSocket; any byte from the client counts as an answer. `xmpp-serve --ping-interval SECONDS` (default 30, 0 disables) and `--ping-timeout SECONDS` (default 20); `pingIntervalMs` and `pingTimeoutMs` in `createXmppServer`. New ops `xmppSessionPing` and `xmppWsPing`.
+- XMPP: a client that binds a resource a live session holds gets a server-generated one (RFC 6120 section 7.7.2.2), in the bind result. The live session stays. A client must use the JID in the bind result. A resource with no live session is free, and a room seat goes when its stream ends.
+- XMPP: room moderation (XEP-0045 sections 8 to 10): kick (status 307), ban (status 301), grant and revoke voice, moderator, member, admin and owner, the admin and owner lists, and status 321. `xmpp-serve --muc-owners FILE` names the owners, as `room: a@x` or `*: a@x` for every room. With that flag, also with an empty file, the first occupant of a room gets no rights, XMPP cannot change a configured owner, and with `--state-key` bans, grants and revoked voices survive a restart. Without the flag the first occupant is the owner as before, and a room's bans go with the room.
+
+## 0.33.0 (2026-11-06)
+
+- XMPP: held stanzas have caps per recipient and per server and a rate per sending account. A stanza for a name with no account is not held. Rosters have a cap on items and a rate on writes.
+- XMPP: SASL closes a stream after three failed attempts, adds a slower limit per client address, and uses one SCRAM exchange for every name. `--no-address-limit` is for a listener behind a proxy.
+- XMPP: accounts have a salt per name and more SCRAM iterations by default. An accounts line can hold keys in place of a password (`xmpp-serve --verifier NAME`). A malformed accounts file stops the start.
+- XMPP: a stanza has at most 64 levels and 8192 elements. Rooms have reserved nicks and nick checks, and a session leaves its rooms at a clean stream end.
+- XMPP: XEP-0421 occupant ids in rooms. A room seat stays until the last session of a full JID goes.
 - XMPP: `xmpp-serve --starttls --tls-port N` serves STARTTLS and XEP-0368 direct TLS from one server.
 - XMPP: members-only rooms (XEP-0045 section 7.2.6). `xmpp-serve --muc-members FILE` lists who may join each room; anyone else gets `registration-required` and cannot see the room.
 - XMPP: disco#info and disco#items results carry `from`. Without it, Profanity 0.19.0 stopped with a segmentation fault after login.
+- The URL decisions of the LWS SBM11 reader and of the compositor's pod storage are now in Lean (`L4Factoidal/LWS/ContainerPath.lean`, new pure wasm op `containerPath`), not in JavaScript: the container URL, each resource URL from a raw relative path, one new file name, a URL inside a pod root, and the folder above (https://github.com/danbri/factoidal/issues/1127). Theorems `resourceIn_under`, `segmentIn_under`, `within_under`, `parentIn_under` (an accepted URL has the container's origin and the container URL, which ends with `/`, is its prefix) and `within_sibling_refused` (`https://s.example/alice-other/` is not within `https://s.example/alice/`). `lwsSbm11Reader` is now asynchronous (`await lwsSbm11Reader(url, opts)`): it loads the engine first; `opts.engine` gives one. An empty `?` or `#` in a container URL is now refused too. The LWS client's token scope (`TokenEntry.covers`) has the same path-segment boundary: a token for the root `https://s.example/alice` is no longer sent to `https://s.example/alice-other/x` (theorem `covers_sibling_refused`). The hub compositor's pod storage needs an engine with `containerPath`; with an older engine it refuses every pod operation.
+- Requests to private addresses (https://github.com/danbri/factoidal/issues/1126). One Lean decision for every outbound request whose URL a remote party chooses, `L4Factoidal/Net/Egress.lean`: it refuses every address of the IANA IPv4 and IPv6 special-purpose registries (now also 100.64.0.0/10, 198.18.0.0/15, 192.0.0.0/24, the documentation ranges, 224.0.0.0/4, 240.0.0.0/4, 255.255.255.255, fec0::/10, ff00::/8, every IPv6 address outside 2000::/3, and NAT64 64:ff9b::/96 or 6to4 2002::/16 with such an IPv4 address inside) and localhost names, unless the operator opts in with `--allow-private-fetch`. The authorization server and CID retrieval use it (theorem `egress_refuses_special`). `lws-serve`: a webhook inbox at such an address answers 400 at subscription; every webhook, access-request, access-grant and controller-inbox delivery is checked again just before it is made, against the addresses the host resolves then, and the host connects to the address the engine chose (new wasm op `lwsEgress`; theorems `deliveries_pinned`, `egressOf_refuses_special`), so a name that resolves to a private address only at delivery time is refused. A refused delivery is not retried. Deliveries to one destination are limited for all subscriptions together: `--delivery-dest-limit N` (default 10 per window, theorem `admit_per_destination`). `lws-serve --allow-private-fetch` now also lets inboxes be private addresses, and its warning is printed also with `--quiet`. Hosts and tests that deliver to 127.0.0.1 must opt in.
+- `webdav-serve --xmpp` accepts `--users`, `--login-limit`, `--login-window` and `--dangerously-disable-ratelimits` (https://github.com/danbri/factoidal/issues/1125). Each request over XMPP passes the JID allow list and then the same Lean login as on TCP (`Login.admit`); HTTP Basic credentials in the XEP-0332 headers log in. `--users` over XMPP needs `--xmpp-tls` or a loopback `--xmpp-host`. `--cert` and `--key` are refused with `--xmpp` (no port opens).
+- The failed-login limit counts per requester (https://github.com/danbri/factoidal/issues/1128): the client address on TCP, the sender's bare JID over XMPP (`L4Factoidal/Net/LoginLimit.lean`, `requesterKey`), never an empty key; one JID's failures do not block another JID. Over XMPP, requests that wait for `chunkedBase64` chunks are limited to 4 per sender and 16 in total, and wait at most 60 seconds (`resource-constraint`).
+- `xmpp-serve` limits failed SASL logins by default: 5 in 60 seconds per account name and per client address, then `temporary-auth-failure` with no password check until the window ends. `--dangerously-disable-ratelimits` turns it off and prints a warning at start. Wasm: `xmppOpen` takes `disableRateLimits` and answers `warnings`; `xmppSessionOpen` takes `remoteAddress` and `now`; `xmppClientTick` also serves the serving mode; `xmppClientFeed` request records carry `requester`; `webdavOpen` takes `login.transport: "xmpp"` and `login.jid`; `ready.login`.
 
 ## 0.32.0 (2026-11-05)
 

package/bin/factoidal.mjs

@@ -445,8 +445,11 @@ DIR holds the signing keys (DIR/authz-keys.json, mode 0600), sealed with
 FACTOIDAL_LWS_KEY when it is set. --rotate-after makes a new key when the
 current one is that old; the old key stays published until its tokens expire.
 --allow-http accepts http subject identifiers; --allow-private-fetch lets the
-server fetch documents from loopback, link-local and private addresses. Both
-are off by default and are for tests.
+server fetch documents from special-purpose addresses: loopback, private,
+link-local, shared (100.64.0.0/10), multicast, reserved and the other ranges
+of the IANA special-purpose registries, and localhost names
+(https://github.com/danbri/factoidal/issues/1126). Both are off by default
+and are for tests.
 CORS (https://github.com/danbri/factoidal/issues/923): by default every answer
 echoes a valid request Origin in Access-Control-Allow-Origin, so a page on
 another origin can read the metadata and keys and exchange a token; a
@@ -474,7 +477,8 @@ usage: factoidal lws-serve DIR (--authz DIR | --issuer IRI | --auth-config FILE
                          [--paginate-always] [--moves all|data|off]
                          [--no-linkset-put] [--unstable-search-results] [--merkle]
                          [--controller-inbox URL] [--delivery-limit N]
-                         [--delivery-window SECONDS] [--redirects-max N]
+                         [--delivery-window SECONDS] [--delivery-dest-limit N]
+                         [--redirects-max N]
                          [--storage snapshot|files]
                          [--cors-origin ORIGIN]... [--no-cors]
 
@@ -569,6 +573,25 @@ The engine decides the file, its contents and every refusal
   --delivery-window SECONDS
                   the length of that window (config member deliveryWindow;
                   default 60)
+  --delivery-dest-limit N
+                  the most deliveries one destination (host and port of the
+                  inbox URL) gets in one window, for all subscriptions and
+                  access records together (config member deliveryDestLimit;
+                  default 10, 0 turns the limit off)
+                  https://github.com/danbri/factoidal/issues/1126
+  --allow-private-fetch
+                  let webhook, access-request, access-grant and controller
+                  inboxes be special-purpose addresses (loopback, private,
+                  link-local, shared 100.64.0.0/10, multicast, reserved and
+                  the other IANA special-purpose ranges) or localhost names,
+                  and let the --authz server fetch from them (config member
+                  allowPrivateFetch; default off). Without it such an inbox
+                  is refused with 400 when its address is known at
+                  subscription, and every delivery is checked again just
+                  before it is made, against the addresses resolved then;
+                  the server connects to the address it checked. For tests
+                  and closed networks only.
+                  https://github.com/danbri/factoidal/issues/1126
   --redirects-max N
                   the most previous identifiers of moved resources kept to
                   answer 301 Moved Permanently (config member redirectsMax;
@@ -749,9 +772,11 @@ Specification: https://solidproject.org/TR/protocol`,
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
                             [--accounts FILE] [--cert FILE --key FILE [--starttls [--tls-port N]]]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
-                            [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--muc DOMAIN [--muc-members FILE] [--muc-owners FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
                             [--state-key FILE] [--max-connections N]
-                            [--login-timeout SECONDS]
+                            [--login-timeout SECONDS] [--ping-interval SECONDS]
+                            [--ping-timeout SECONDS] [--proxy-protocol] [--no-address-limit]
+                            [--dangerously-disable-ratelimits]
 
 Starts a Node TCP server that runs one engine session per connection and
 answers every byte through the engine's xmppSessionFeed operation.
@@ -768,7 +793,13 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    (default 5222; 5223 with --cert and --key and no --starttls)
   --host ADDRESS   the address to bind (default 127.0.0.1); without
                    --cert and --key only a loopback address is accepted
-  --accounts FILE  the accounts file (default DIR/accounts)
+  --accounts FILE  the accounts file (default DIR/accounts). One account per
+                   line: name:password, or a line from --verifier, which holds
+                   no password (SCRAM only). Any other line stops the start. A
+                   file others can read gives a warning
+  --verifier NAME  read a password from standard input, print the accounts line
+                   for NAME that holds no password, and exit; --iterations N
+                   sets the SCRAM count (default 10000)
   --cert FILE      PEM certificate chain: XEP-0368 direct TLS, or STARTTLS with --starttls
   --key FILE       PEM private key for --cert
   --starttls       listen in clear and REQUIRE STARTTLS (RFC 6120 section 5)
@@ -787,11 +818,19 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
   --muc DOMAIN     also serve XEP-0045 multi-user chat rooms at DOMAIN, e.g.
                    conference.example.com: temporary rooms, made by the first
                    join and gone with the last occupant; no history, no
-                   configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+                   configuration form (L4Factoidal/XMPP/Muc.lean). Kick, ban, voice
+                   and the admin and owner lists follow XEP-0045 sections 8 to 10
   --muc-members FILE  members-only rooms: one room per line, as
                    "room: alice@example.com bob@example.com". Only those accounts
                    may join or see that room; a room not in the file is open to
                    every account (L4Factoidal/XMPP/Muc.lean)
+  --muc-owners FILE  room owners: one room per line, as "room: alice@example.com",
+                   and "*: alice@example.com" for every room. XMPP cannot change
+                   these names. With this flag, also with an empty file, nobody
+                   becomes an owner by being first in a room, and with --state-key
+                   bans and affiliations survive a restart. Without this flag, the
+                   first occupant of a room with no owner is its owner, and a room's
+                   bans and affiliations go with the room
   --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
                    joined through this server (XEP-0405 MIX-PAM); channels are
                    made by an IQ <create/>, kept in memory only, JID-hidden; no
@@ -801,6 +840,11 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    behind a proxy, every client has the same one
   --login-timeout SECONDS  how long a connection may stay without a bound
                    resource before it is closed (default 30; 0 disables)
+  --ping-interval SECONDS  how long a bound session may be silent before the
+                   server pings it: XEP-0199 on TCP, a ping frame on a WebSocket
+                   (default 30; 0 disables pings)
+  --ping-timeout SECONDS  how long after a ping a session that sends no byte is
+                   closed, which frees its resource (default 20)
   --state-key FILE keep the server's state across restarts: rosters, messages held
                    for offline accounts, MIX channels and GC3 groups, in an LWS
                    storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
@@ -811,6 +855,37 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    membership, stable participant ids, optional events. There is
                    no published GC3 spec; every wire format is invented and listed
                    in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
+  --proxy-protocol every connection, on every listener (--port, --tls-port,
+                   --ws-port), must start with a PROXY protocol version 2 header
+                   (HAProxy's spec), read before TLS. The client address in it is
+                   the one the failed-login limit counts. A connection with no
+                   valid header in 10 seconds is closed; a version 1 (text)
+                   header is refused. A LOCAL header (a health check of the
+                   proxy) is accepted with the socket's address. Use it only
+                   behind a proxy that always sends the header, such as Fly with
+                   handlers = ["proxy_proto"] and proxy_proto_options =
+                   { version = "v2" }; without it no header is ever read, so a
+                   client cannot claim an address
+  --no-address-limit
+                   count failed logins per account name only. For a listener
+                   behind a proxy that sends no PROXY header, where every client
+                   has the proxy's address and a limit on it would stop them all
+  --dangerously-disable-ratelimits
+                   no failed SASL login limit and no sender rate on held
+                   messages (a warning is printed at start); any client can
+                   then try passwords without end
+
+Failed SASL logins are limited by default
+(https://github.com/danbri/factoidal/issues/1128): after 5 failed logins in
+60 seconds for one account name (known or not) or from one client address
+(an IPv6 client by its /64), on one stream or on new ones, an attempt gets
+the SASL failure temporary-auth-failure, and no password is checked, also
+the right one, until that window ends. A client address also has a slower
+limit of 20 failed logins in an hour. A malformed SASL payload checks no
+password and does not count. A stream closes after 3 failed attempts.
+The server keeps no client address: the counters hold an HMAC-SHA-256
+tag of it (of its /64 for IPv6) under a random key that is in memory
+only and new at each start, and logs show the first 12 digits of the tag.
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -885,7 +960,9 @@ usage: factoidal webdav-serve CONFIGDIR [--port N] [--host ADDRESS]
                               [--login-limit N] [--login-window SECONDS]
                               [--dangerously-disable-ratelimits]
        factoidal webdav-serve CONFIGDIR --xmpp JID --xmpp-password-file FILE
-                 --xmpp-allow JID[,JID...] [--guest NAME] [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
+                 --xmpp-allow JID[,JID...] [--guest NAME] [--users FILE]
+                 [--login-limit N] [--login-window SECONDS] [--dangerously-disable-ratelimits]
+                 [--xmpp-host H] [--xmpp-port P] [--xmpp-tls]
 
 EMERGENCY MODE (https://github.com/danbri/factoidal/issues/1147): the server
 is READ ONLY. Every write method (PUT, DELETE, MKCOL, COPY, MOVE, PROPPATCH,
@@ -994,13 +1071,24 @@ NAT is reached this way with no inbound port.
                              --xmpp-host (127.0.0.0/8, ::1) is accepted.
   --xmpp-ca FILE             PEM certificates to trust for --xmpp-tls
   --dangerously-allow-writable-without-login
-                             start although a local mount is writable:
-                             there is no login on the XMPP path yet
-                             (https://github.com/danbri/factoidal/issues/1125),
-                             so every allowed JID writes as the owner.
-                             Without it such a start is refused.
+                             with no --users: start although a local mount
+                             is writable, so every allowed JID writes as the
+                             owner. Without it such a start is refused.
+                             With --users it is not needed.
   --xmpp-resource R          the resource to bind (default dav)
 
+Both checks apply to every request over XMPP
+(https://github.com/danbri/factoidal/issues/1125): the sender's bare JID must
+be in --xmpp-allow, and then the request acts as a user exactly as on TCP:
+the --guest user with no credentials, a user of --users with HTTP Basic
+credentials in the request's headers (xmpp-http-proxy passes Authorization
+unchanged). --users over XMPP needs --xmpp-tls or a loopback --xmpp-host.
+The failed-login limit over XMPP counts per user name and per bare JID of
+the sender (https://github.com/danbri/factoidal/issues/1128): one JID's
+failures do not block another JID. A request whose chunked body is not
+complete waits at most 60 seconds, and at most 4 such requests per sender
+(16 in total) wait at once; others get resource-constraint.
+
 It prints the bound JID (xmpp:user@domain/resource) on standard output.
 XEP-0332 is Deferred, and no WebDAV client speaks it: a reader runs
 "factoidal xmpp-http-proxy --target JID/RESOURCE" (as an allowed JID) and
@@ -1211,7 +1299,7 @@ const VALUE_OPTIONS = {
   compact: new Set([]),
   serve: new Set(['port', 'host', 'query-path', 'gsp-path', 'file', 'layout', 'tdb2', 'allow-host', 'allow-origin']),
   'lws-serve': new Set(['port', 'host', 'base', 'issuer', 'auth-config', 'owner', 'root-acl',
-    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window',
+    'audience', 'page-size', 'moves', 'controller-inbox', 'delivery-limit', 'delivery-window', 'delivery-dest-limit',
     'redirects-max', 'storage', 'cors-origin', 'authz', 'alg', 'token-lifetime', 'rotate-after',
     'saml-idp', 'saml-decrypt-key', 'allow-host', 'allow-origin']),
   'solid-serve': new Set(['port', 'host', 'base', 'owner', 'issuer', 'auth-config', 'allow-host', 'allow-origin']),
@@ -1223,7 +1311,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'muc-owners', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'ping-interval', 'ping-timeout', 'verifier', 'iterations']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2339,6 +2427,10 @@ async function commandLwsServe (positional, options) {
       ...(typeof options['controller-inbox'] === 'string' ? { controllerInbox: options['controller-inbox'] } : {}),
       ...(options['delivery-limit'] !== undefined ? { deliveryLimit: natOption('delivery-limit', options['delivery-limit']) } : {}),
       ...(options['delivery-window'] !== undefined ? { deliveryWindow: natOption('delivery-window', options['delivery-window']) } : {}),
+      ...(options['delivery-dest-limit'] !== undefined ? { deliveryDestLimit: natOption('delivery-dest-limit', options['delivery-dest-limit']) } : {}),
+      // Inboxes at special-purpose addresses (issue 1126): passed unread;
+      // L4Factoidal/Net/Egress.lean decides.
+      ...(options['allow-private-fetch'] === true ? { allowPrivateFetch: true } : {}),
       ...(options['redirects-max'] !== undefined ? { redirectsMax: natOption('redirects-max', options['redirects-max']) } : {}),
       ...(typeof options.storage === 'string' ? { storage: options.storage } : {}),
       ...corsConfig(options),
@@ -2368,11 +2460,16 @@ async function commandLwsServe (positional, options) {
   // The engine's start notices (a stale lock taken over; encryption at rest
   // on or off), printed also with --quiet.
   for (const n of (await running.storage()).notices || []) err(`lws-serve: ${n}`)
+  // Printed also with --quiet: this option opens the local network to
+  // requests that remote parties choose (issue 1126).
+  if (options['allow-private-fetch'] === true) {
+    err('lws-serve: WARNING: --allow-private-fetch: webhook and inbox deliveries and authorization ' +
+      'server fetches may go to loopback, private, link-local and other special-purpose addresses')
+  }
   if (!quiet) {
     err(`lws-serve: listening on ${running.origin} for ${positional[0]}`)
     if (running.authz() !== null) err(`lws-serve: authorization server ${running.authz().issuer} (keys in ${authzDir})`)
     if (options['allow-http'] === true) err('lws-serve: WARNING: --allow-http: http subject identifiers are accepted')
-    if (options['allow-private-fetch'] === true) err('lws-serve: WARNING: --allow-private-fetch: private addresses may be fetched')
     if (insecure) {
       err('lws-serve: WARNING: --insecure-no-auth: every request is served without authorization')
       err('lws-serve: --insecure-no-auth: only the Host names of this listener are answered, and a ' +
@@ -2641,20 +2738,32 @@ async function webdavOverXmpp (configDir, options, quiet) {
   if (typeof options.xmpp !== 'string') throw new UsageError('--xmpp needs a JID')
   if (typeof options['xmpp-password-file'] !== 'string') throw new UsageError('--xmpp needs --xmpp-password-file FILE')
   if (typeof options['xmpp-allow'] !== 'string') throw new UsageError('--xmpp needs --xmpp-allow JID[,JID...]')
-  // No login on the XMPP path yet: refuse --users rather than ignore it
-  // (https://github.com/danbri/factoidal/issues/1125).
-  if (['users', 'cert', 'key', 'login-limit', 'login-window', 'dangerously-disable-ratelimits'].some((k) => options[k] !== undefined)) {
-    throw new UsageError('--users, --cert, --key and the login-limit options do not apply with --xmpp yet (https://github.com/danbri/factoidal/issues/1125)')
+  // No port is open with --xmpp, so the HTTPS options do not apply. --users
+  // and the login-limit options do (https://github.com/danbri/factoidal/issues/1125).
+  if (['cert', 'key'].some((k) => options[k] !== undefined)) {
+    throw new UsageError('--cert and --key do not apply with --xmpp: no port is open; give --xmpp-tls for the XMPP stream')
   }
   const fs = await import('node:fs/promises')
+  const { resolve: resolvePath } = await import('node:path')
   const password = (await fs.readFile(options['xmpp-password-file'], 'utf8')).split(/\r?\n/)[0]
   const allow = options['xmpp-allow'].split(',').map((x) => x.trim()).filter((x) => x.length > 0)
   const { openWebdav, WebdavHostError } = await import('../webdav/server.mjs')
   const { connectHttpTarget, XmppClientError } = await import('../xmpp/client.mjs')
   if (options.guest !== undefined && typeof options.guest !== 'string') throw new UsageError('--guest needs a user name')
+  // The login (issue 1125): the same users file and limit options as on
+  // TCP, and the XMPP stream as the transport; the engine checks them all.
+  const davOptions = { configDir, transport: 'xmpp', jid: options.xmpp, tls: options['xmpp-tls'] === true }
+  if (typeof options['xmpp-host'] === 'string') davOptions.host = options['xmpp-host']
+  if (typeof options.guest === 'string') davOptions.guest = options.guest
+  if (typeof options.users === 'string') davOptions.users = resolvePath(options.users)
+  if (options['login-limit'] !== undefined) davOptions.loginLimit = String(options['login-limit'])
+  if (options['login-window'] !== undefined) davOptions.loginWindow = String(options['login-window'])
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    davOptions.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
   let dav
   try {
-    dav = await openWebdav({ configDir, ...(typeof options.guest === 'string' ? { guest: options.guest } : {}) })
+    dav = await openWebdav(davOptions)
   } catch (error) {
     if (error instanceof WebdavHostError && error.unknownOp) return notWired('webdav-serve', error.message)
     if (error instanceof WebdavHostError || (error !== null && typeof error === 'object' && error.code === 'ENOENT')) {
@@ -2674,6 +2783,7 @@ async function webdavOverXmpp (configDir, options, quiet) {
     tls: options['xmpp-tls'] === true,
     mounts: dav.mounts,
     dangerouslyAllowWritableWithoutLogin: options['dangerously-allow-writable-without-login'] === true,
+    login: dav.login,
     step: (request) => dav.step(request),
     onError: (error) => { if (!quiet) err(`webdav-serve: xmpp: ${error.message}`) }
   }
@@ -2697,7 +2807,8 @@ async function webdavOverXmpp (configDir, options, quiet) {
     throw error
   }
   if (!quiet) {
-    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}`)
+    err(`webdav-serve: connected to XMPP as ${conn.jid}; no port is open; requests from ${allow.join(', ')}` +
+        (dav.login ? `, login from ${options.users} (failed logins limited per user name and per bare JID)` : ', no --users: credentials get 401'))
     if (conn.writableWithoutLogin.length > 0) {
       err(`webdav-serve: WARNING: --dangerously-allow-writable-without-login: every allowed JID can write ${conn.writableWithoutLogin.join(', ')} as the storage owner, with no login`)
     }
@@ -2862,6 +2973,17 @@ async function commandWebdavUser (positional, options) {
 }
 
 async function commandXmppServe (positional, options) {
+  // One accounts line with no password in it: the password comes from stdin.
+  if (typeof options.verifier === 'string') {
+    const { randomBytes } = await import('node:crypto')
+    const { readFileSync } = await import('node:fs')
+    const { loadEngine } = await import('./engine.mjs')
+    const password = readFileSync(0, 'utf8').replace(/\r?\n$/, '')
+    const engine = await loadEngine()
+    const made = engine.call('xmppVerifier', [options.verifier, password, randomBytes(16).toString('base64'), String(options.iterations ?? 10000)])
+    out(made.line)
+    return 0
+  }
   if (positional.length !== 1) throw new UsageError('xmpp-serve needs one DIR')
   const quiet = options.quiet === true
   const { listen, XmppHostError } = await import('../xmpp/server.mjs')
@@ -2879,7 +3001,17 @@ async function commandXmppServe (positional, options) {
     onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) }
   }
   if (typeof options.domain === 'string') settings.domain = options.domain
-  if (typeof options.accounts === 'string') settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+  if (typeof options.accounts === 'string') {
+    settings.accountsText = await fs.readFile(options.accounts, 'utf8')
+    settings.accountsFile = options.accounts
+  }
+  // The failed SASL login limit (https://github.com/danbri/factoidal/issues/1128):
+  // on by default; the engine decides and words the warning.
+  if (options['dangerously-disable-ratelimits'] !== undefined) {
+    settings.disableRateLimits = options['dangerously-disable-ratelimits'] === true
+  }
+  if (options['no-address-limit'] === true) settings.addressLimit = false
+  if (options['proxy-protocol'] === true) settings.proxyProtocol = true
   if (useTls) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
@@ -2916,6 +3048,20 @@ async function commandXmppServe (positional, options) {
       settings.mucMembers.push({ room, members })
     }
   }
+  if (options['muc-owners'] !== undefined) {
+    if (typeof options['muc-owners'] !== 'string') throw new UsageError('--muc-owners needs a FILE')
+    if (settings.mucDomain === undefined) throw new UsageError('--muc-owners needs --muc')
+    settings.mucOwners = []
+    for (const line of (await fs.readFile(options['muc-owners'], 'utf8')).split('\n')) {
+      if (line.trim() === '') continue
+      const [, room, list] = /^([^:\s@/]+):(.*)$/.exec(line.trim()) ?? []
+      const owners = (list ?? '').split(/\s+/).filter(Boolean)
+      if (room === undefined || owners.length === 0 || owners.some((m) => !/^[^\s@/]+@[^\s@/]+$/.test(m))) {
+        throw new UsageError(`--muc-owners: not "room: bare@jid ...": ${line}`)
+      }
+      settings.mucOwners.push({ room, owners })
+    }
+  }
   if (options.mix !== undefined) {
     if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
       throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
@@ -2940,6 +3086,16 @@ async function commandXmppServe (positional, options) {
     if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--login-timeout needs a number of seconds')
     settings.loginTimeoutMs = n * 1000
   }
+  if (options['ping-interval'] !== undefined) {
+    const n = Number(options['ping-interval'])
+    if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--ping-interval needs a number of seconds')
+    settings.pingIntervalMs = n * 1000
+  }
+  if (options['ping-timeout'] !== undefined) {
+    const n = Number(options['ping-timeout'])
+    if (!Number.isSafeInteger(n) || n < 1) throw new UsageError('--ping-timeout needs a positive number of seconds')
+    settings.pingTimeoutMs = n * 1000
+  }
   if (options['ws-port'] !== undefined) {
     const wsPort = Number(options['ws-port'])
     if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
@@ -2968,10 +3124,15 @@ async function commandXmppServe (positional, options) {
     }
     throw error
   }
+  // The engine's start warnings (--dangerously-disable-ratelimits), printed
+  // also with --quiet.
+  for (const w of running.xmpp.warnings || []) err(`factoidal xmpp-serve: WARNING: ${w}`)
   if (!quiet) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +
         (startTls ? ', STARTTLS required)' : useTls ? ', direct TLS)' : ', PLAINTEXT: no TLS on this listener)'))
+    if (settings.proxyProtocol) err('xmpp-serve: every connection must start with a PROXY protocol v2 header')
+    else if (settings.addressLimit === false) err('xmpp-serve: failed logins count per account name only (--no-address-limit)')
     if (settings.mucDomain) err(`xmpp-serve: multi-user chat (XEP-0045) at ${settings.mucDomain}`)
     if (settings.mixDomain) err(`xmpp-serve: MIX channels (XEP-0369, joined by XEP-0405) at ${settings.mixDomain}`)
     if (settings.gc3Domain) err(`xmpp-serve: GC3 PROTOTYPE groups at ${settings.gc3Domain} (no published spec; invented wire format)`)

package/bin/foafnaut.mjs

@@ -10,9 +10,11 @@ import { homedir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
-const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
+const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE | --url URL | --html FILE] [APP_OPTIONS] [-- APP_ARGS]
 
-  PAGE              an http(s) URL or an HTML file; none opens the default page
+  PAGE              an http(s) or file: URL, or an HTML file; none opens the default page
+  --url URL         the page as a URL (http, https or file)
+  --html FILE       the page as a local HTML file
   --latest          install the newest published macOS build, then use it
   --bleeding-edge   use the local build (config.json "bleedingEdge", or
                     ~/Applications/foafnaut.app)
@@ -23,6 +25,15 @@ const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
   --which           print the app that would run
   --help            this text
 
+App options, passed to the app as they are:
+  --perf-summary    print frame and input latency figures when the window closes
+  --check-pixels    read back and check every frame (slow)
+  --wasm-engine     use the Wasm engine, not the native library
+  --native-engine PATH  use this native engine library
+  --font FILE       load this font file
+  --bitmap-font     use the baked-in ASCII font only
+  --follow-links    open links that a page asks for at load
+
 Also: foafnaut-latest, foafnaut-bleedingedge. Environment: FOAFNAUT_HOME, and
 FOAFNAUT_APP, which chooses the app outright. Page data goes to the app. Its trace
 is in ~/Library/Logs/foafnaut/trace.jsonl. The command stays open until the window
@@ -96,9 +107,14 @@ async function installLatest() {
   return versionApp(dir);
 }
 
+// App options that take no value, and those that take one.
+const APP_FLAGS = ['--perf-summary', '--check-pixels', '--wasm-engine', '--bitmap-font', '--follow-links', '--idle-checks-only', '--trace-input'];
+const APP_VALUES = ['--native-engine', '--font'];
+
 function pageArgs(page) {
   if (page === undefined) return [];
   if (/^https?:\/\//i.test(page)) return ['--url', page];
+  if (/^file:/i.test(page)) page = new URL(page).pathname;
   const path = resolve(page);
   if (!existsSync(path)) fail(`no such file: ${page}`);
   return ['--html', path];
@@ -109,10 +125,13 @@ export async function main(argv, channel = 'current') {
   const options = split < 0 ? argv : argv.slice(0, split);
   const extra = split < 0 ? [] : argv.slice(split + 1);
   let page, which = false, verbose = false, detach = false;
+  const app_ = [];
+  const setPage = (value) => { if (page !== undefined) fail('give one page'); if (value === undefined) fail('a page option needs a value'); page = value; };
   // Each of these picks the app or the action. Two of them have no one meaning.
   const exclusive = options.filter((arg) => ['--latest', '--bleeding-edge', '--install-latest', '--list'].includes(arg));
   if (new Set(exclusive).size > 1) fail(`${exclusive.join(' and ')} can not be used together; see --help`);
-  for (const arg of options) {
+  for (let i = 0; i < options.length; i++) {
+    const arg = options[i];
     if (arg === '--help' || arg === '-h') { process.stdout.write(HELP); return; }
     else if (arg === '--latest') channel = 'latest';
     else if (arg === '--bleeding-edge') channel = 'bleeding-edge';
@@ -127,9 +146,12 @@ export async function main(argv, channel = 'current') {
         console.log(`${name === current ? '*' : ' '} ${name}`);
       console.log(`  bleeding edge: ${bleedingEdgeApp()}${existsSync(bleedingEdgeApp()) ? '' : ' (not found)'}`);
       return;
-    } else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
-    else if (page !== undefined) fail('give one page');
-    else page = arg;
+    } else if (arg === '--url' || arg === '--html') setPage(options[++i]);
+    else if (arg.startsWith('--url=') || arg.startsWith('--html=')) setPage(arg.slice(arg.indexOf('=') + 1));
+    else if (APP_FLAGS.includes(arg)) app_.push(arg);
+    else if (APP_VALUES.includes(arg)) { if (options[i + 1] === undefined) fail(`${arg} needs a value`); app_.push(arg, options[++i]); }
+    else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
+    else setPage(arg);
   }
   if (process.platform !== 'darwin') fail('the native window is macOS only; use the Hub page in a WebGPU browser');
   let app = process.env.FOAFNAUT_APP;
@@ -138,7 +160,7 @@ export async function main(argv, channel = 'current') {
   if (!app) app = currentApp() ?? bleedingEdgeApp();
   if (!existsSync(app)) fail(`no app at ${app}. Run foafnaut --install-latest.`);
   if (which) { console.log(app); return; }
-  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...extra];
+  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...app_, ...extra];
   const log = join(homedir(), 'Library', 'Logs', 'foafnaut', 'trace.jsonl');
   if (verbose) console.error(`foafnaut: app ${app}\nfoafnaut: open ${args.join(' ')}\nfoafnaut: trace ${log}`);
   // Follow only what this run appends.

package/browser.js

@@ -27,7 +27,7 @@ import { entryFromEngine } from './lib/lean-entry.mjs';
 import { browserEngine } from './lib/browser-engine.mjs';
 import { indexedDbDeltaLogStore } from './lib/delta-log-hosts.mjs';
 import { sbm11Api, registerSbm11Source, mapReader } from './lib/sbm11.mjs';
-import { lwsSbm11Reader } from './lib/sbm11-lws.mjs';
+import { lwsSbm11Reader as lwsSbm11ReaderWith } from './lib/sbm11-lws.mjs';
 
 const l4Engine = browserEngine('l4factoidal', new URL('./l4-assets/', import.meta.url).href);
 
@@ -73,7 +73,10 @@ export const packSbm11 = sbm11.packSbm11;
 export { registerSbm11Source, mapReader };
 // A reader of an SBM11 generation held as LWS resources (issue 1010 KR3). In
 // a browser worker its default transport is a synchronous XMLHttpRequest.
-export { lwsSbm11Reader };
+// Asynchronous: it loads the engine, whose op containerPath decides every URL.
+export async function lwsSbm11Reader(url, opts = {}) {
+  return lwsSbm11ReaderWith(url, { ...opts, engine: opts.engine ?? await loadEngine() });
+}
 
 // RDF and SPARQL
 export const parse = api.parse;

package/index.d.ts

@@ -240,7 +240,7 @@ export type WriteFormat =
   | 'rdfxml' | 'rdf-xml' | 'rdf' | 'jsonld' | 'json-ld' | 'rdfc' | 'canonical';
 
 /** Results formats of query() with `output`. */
-export type ResultsFormat = 'json' | 'xml' | 'csv' | 'tsv' | 'table' | 'ntriples';
+export type ResultsFormat = 'json' | 'xml' | 'xml-report' | 'csv' | 'tsv' | 'table' | 'ntriples';
 
 /** One row of formats(). */
 export interface FormatCapability {
@@ -1570,10 +1570,14 @@ export type Sbm11Transport = (url: string, headers: Record<string, string>) =>
  * null before transport and appear in errors().
  * Browser worker default XHR accepts no caller auth/headers; provide an explicit
  * trusted transport for those. Its final-URL check cannot prevent an already
- * sent anonymous request or ambient same-origin browser cookies. */
+ * sent anonymous request or ambient same-origin browser cookies.
+ * Asynchronous: the engine's op containerPath (Lean, L4Factoidal.LWS.ContainerPath)
+ * decides the container URL and every resource URL. */
 export function lwsSbm11Reader(url: string, opts?: {
-  auth?: string; headers?: Record<string, string>; transport?: Sbm11Transport; timeoutMs?: number
-}): Sbm11Reader & { evidence(): Sbm11ReadEvidence[]; errors(): string[]; close(): void };
+  auth?: string; headers?: Record<string, string>; transport?: Sbm11Transport; timeoutMs?: number;
+  /** a loaded engine handle (default: loadEngine()); its op containerPath decides every URL */
+  engine?: object
+}): Promise<Sbm11Reader & { evidence(): Sbm11ReadEvidence[]; errors(): string[]; close(): void }>;
 
 /** One query against a store: open with the query's plan, query, close. */
 export function queryStore(
@@ -2260,13 +2264,22 @@ export interface SparqlResultsJson {
   boolean?: boolean;
 }
 
+/** The exact serialized result is checked by the Lean XML parser. This is
+ * parser admission, not a proof of SPARQL serialization fidelity or XSLT success.
+ * Invalid RDF/XML characters are refused, never removed or replaced.
+ */
+export type SparqlXmlReport =
+  | { kind: 'xml'; xml: string }
+  | { kind: 'diagnostic'; code: 'XML_ADMISSION_REFUSED'; message: string };
+
 export type OutputFormat =
-  | 'json' | 'csv' | 'tsv' | 'xml' | 'table' | 'ntriples';
+  | 'json' | 'csv' | 'tsv' | 'xml' | 'xml-report' | 'table' | 'ntriples';
 
 /**
  * One call, serialised answer: parse `dataString`, close the default
  * graph under `entail`, run the query. Resolves to parsed SPARQL Results
- * JSON when output is 'json' (default), the text otherwise. 'csv', 'tsv'
+ * JSON when output is 'json' (default), an XML/diagnostic object for
+ * 'xml-report', and text otherwise. 'csv', 'tsv'
  * and 'xml' are the W3C SPARQL results formats (CSV and TSV have no ASK
  * encoding, so an ASK with those rejects); 'table' and 'ntriples' are
  * display formats. A CONSTRUCT or DESCRIBE answer is a graph and takes
@@ -2280,7 +2293,7 @@ export function queryRaw(
     entail?: EntailRegime;
     output?: OutputFormat;
   }
-): Promise<SparqlResultsJson | string>;
+): Promise<SparqlResultsJson | SparqlXmlReport | string>;
 
 /** Package version string, e.g. '0.9.0'. */
 export const version: string;

package/index.mjs

@@ -103,12 +103,15 @@ export { registerSbm11Source, mapReader };
 // A reader of an SBM11 generation held as LWS resources (lib/sbm11-lws.mjs;
 // https://github.com/danbri/factoidal/issues/1010 KR3). In Node the default
 // synchronous transport is a fetch in a worker thread (lib/sync-http-node.mjs),
-// stopped by the reader's close().
-export function lwsSbm11Reader(url, opts = {}) {
-  if (typeof opts.transport === 'function') return lwsSbm11ReaderWith(url, opts);
+// stopped by the reader's close(). Asynchronous: it loads the engine, whose
+// op containerPath decides the container URL and every resource URL
+// (formal/lean4/L4Factoidal/LWS/ContainerPath.lean).
+export async function lwsSbm11Reader(url, opts = {}) {
+  const engine = opts.engine ?? await loadEngine();
+  if (typeof opts.transport === 'function') return lwsSbm11ReaderWith(url, { ...opts, engine });
   const transport = nodeSyncTransport({ timeoutMs: opts.timeoutMs });
   try {
-    return lwsSbm11ReaderWith(url, { ...opts, transport, onClose: () => transport.close() });
+    return lwsSbm11ReaderWith(url, { ...opts, engine, transport, onClose: () => transport.close() });
   } catch (error) {
     transport.close();
     throw error;

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "7e47fa191143";
+const WASM_VERSION = "a92a94475fa0";
 
 import createModule from './l4factoidal.mjs';