@factoidal/core 0.32.0 → 0.34.0

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-54551baca31a-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42216947974",
-  "gitSha": "54551baca31ae999900422c62ac59622ebf4d20a",
-  "builtAt": "2026-11-06T13:04:35Z",
+  "release": "danbri/factoidal-builds build-20ff52ea9005-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42520417546",
+  "gitSha": "20ff52ea90050c8db7bb7135aa0c20ee118183e5",
+  "builtAt": "2026-11-08T21:35:07Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "7e47fa1911434e286cd6523c2b622e183ea6837531d444b9691a2434486f5c4e",
-  "wasmBytes": 31415350,
+  "wasmSha256": "a92a94475fa0cfc6fe9aeb28b197e81c3c3162806ecbba562f200fbaea51416b",
+  "wasmBytes": 32702060,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/api.mjs

@@ -693,7 +693,7 @@ function buildApi(driver) {
       }
       const r = await withExtensionRounds(() => entryResult(e.datasetQueryRaw(ds.handle, sparql,
         JSON.stringify({ entail, output })), 'query', sparql));
-      return output === 'json' && !graphForm ? JSON.parse(r.text) : r.text;
+      return (output === 'json' || output === 'xml-report') && !graphForm ? JSON.parse(r.text) : r.text;
     }
     const fn = sparql12 ? e.datasetQuery12 : e.datasetQuery;
     if (typeof fn !== 'function') {
@@ -2487,7 +2487,9 @@ function buildApi(driver) {
    * One call, serialised answer (op queryRaw): parse `dataString`, close
    * the default graph under `entail`, run the query, and write the answer
    * in `output`: 'json' (default; parsed SPARQL results JSON), or 'csv',
-   * 'tsv', 'xml', 'table', 'ntriples' (text). A CONSTRUCT or DESCRIBE
+   * 'tsv', 'xml', 'table', 'ntriples' (text), or 'xml-report' (a checked
+   * XML/diagnostic object from Lean). Ordinary 'xml' rejects an XML
+   * admission failure; 'xml-report' returns it as data. A CONSTRUCT or DESCRIBE
    * answer is a graph: 'ntriples' or 'table' only.
    * @param {string} dataString
    * @param {string} queryString
@@ -2511,7 +2513,7 @@ function buildApi(driver) {
     const r = entryResult(e.queryRaw(dataString, queryString,
       JSON.stringify({ dataFormat: tables.rawDataFormats[dataFormat], entail, output })),
     'queryRaw', queryString);
-    return output === 'json' ? JSON.parse(r.text) : r.text;
+    return output === 'json' || output === 'xml-report' ? JSON.parse(r.text) : r.text;
   }
 
   // ---------------------------------------------------------------

package/lib/sbm11-lws.mjs

@@ -40,40 +40,23 @@
 // thread has neither: pass `transport` or run the engine in a worker.
 
 // This reader grants its transport authority only within one HTTP container.
-// A file is a raw relative filename/path, never a URL reference. Reject both
-// literal traversal and encoded structural characters before attaching headers.
-function containerUrl (url) {
-  let base
-  try { base = new URL(String(url)) } catch { throw new TypeError('lwsSbm11Reader: expected an absolute HTTP(S) container URL') }
-  if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password || /[?#]/.test(base.href)) {
-    throw new TypeError('lwsSbm11Reader: container must be HTTP(S), without userinfo, query or fragment; use opts.auth/headers')
+// A file is a raw relative filename/path, never a URL reference. The engine
+// decides the container URL and every resource URL (op containerPath,
+// formal/lean4/L4Factoidal/LWS/ContainerPath.lean: containerOf, resourceIn,
+// theorem resourceIn_under) before any header is attached; this file only
+// turns a refusal into a TypeError.
+function containerUrl (engine, url) {
+  const r = engine.call('containerPath', [JSON.stringify({ kind: 'container', url: String(url) })])
+  if (!r.allowed) {
+    throw new TypeError(`lwsSbm11Reader: ${r.reason}; the container must be an absolute HTTP(S) URL without userinfo, query or fragment (use opts.auth/headers)`)
   }
-  if (!base.pathname.endsWith('/')) base.pathname += '/'
-  return base
+  return r.url
 }
 
-function resourceUrl (base, file) {
-  if (typeof file !== 'string' || file.length === 0 || file.length > 4096) {
-    throw new TypeError('invalid relative resource path')
-  }
-  let probe = file
-  for (;;) {
-    if (/^[a-z][a-z0-9+.-]*:/i.test(probe) || /[\\?#\x00-\x1f\x7f]/.test(probe) ||
-        probe.split('/').some(part => part === '' || part === '.' || part === '..') ||
-        /%(?:2f|5c|3f|23)/i.test(probe)) {
-      throw new TypeError('resource path must remain inside the configured container')
-    }
-    // Decode only for rejection, never for the requested filename. Each changed
-    // pass shortens the string, so nested percent encodings are also bounded.
-    const next = probe.replace(/%([a-f0-9]{2})/gi, (_match, hex) => String.fromCharCode(parseInt(hex, 16)))
-    if (next === probe) break
-    probe = next
-  }
-  const resource = new URL(file.split('/').map(encodeURIComponent).join('/'), base)
-  if (resource.origin !== base.origin || !resource.pathname.startsWith(base.pathname)) {
-    throw new TypeError('resource URL escaped the configured container')
-  }
-  return resource.href
+function resourceUrl (engine, base, file) {
+  const r = engine.call('containerPath', [JSON.stringify({ kind: 'resource', container: base, path: file })])
+  if (!r.allowed) throw new TypeError(`resource path must remain inside the configured container: ${r.reason}`)
+  return r.url
 }
 
 /** A synchronous GET with XMLHttpRequest (a browser worker). */
@@ -85,7 +68,8 @@ export function xhrSyncTransport (url, headers) {
   x.send()
   // XHR follows redirects internally. This rejects returned bytes, not the
   // already-sent request. Caller headers require an explicit trusted transport.
-  if (x.responseURL !== new URL(url).href) throw new Error('LWS reader: redirected XHR resource refused')
+  // `url` is the engine's serialization, so any other response URL is a redirect.
+  if (x.responseURL !== url) throw new Error('LWS reader: redirected XHR resource refused')
   return {
     status: x.status,
     header: (name) => x.getResponseHeader(name),
@@ -110,14 +94,20 @@ function unsatisfiedTotal (value) {
  *
  * @param {string} url absolute HTTP(S), no userinfo/query/fragment; container that holds CURRENT and the generation
  *   (or the generation container itself)
- * @param {object} [opts]
+ * @param {object} opts
+ * @param {object} opts.engine a loaded engine handle (`call(op, args)`); its op
+ *   containerPath decides the container URL and every resource URL
  * @param {Function} [opts.transport] trusted synchronous GET; must constrain redirect/header forwarding
  * @param {string} [opts.auth] a value for the Authorization header, such as
  *   `Bearer <access token>` (an LWS access token)
  * @param {object} [opts.headers] further request headers; browser use requires explicit trusted transport
  */
 export function lwsSbm11Reader (url, opts = {}) {
-  const base = containerUrl(url)
+  const engine = opts.engine
+  if (!engine || typeof engine.call !== 'function') {
+    throw new TypeError('lwsSbm11Reader: opts.engine (a loaded engine handle) decides the resource URLs')
+  }
+  const base = containerUrl(engine, url)
   const extra = { ...(opts.headers || {}) }
   if (opts.auth) extra.authorization = String(opts.auth)
   let transport = opts.transport
@@ -137,7 +127,7 @@ export function lwsSbm11Reader (url, opts = {}) {
     let e = files.get(file)
     if (!e) {
       let url
-      try { url = resourceUrl(base, file) } catch (error) {
+      try { url = resourceUrl(engine, base, file) } catch (error) {
         fail(file, error.message)
         return null
       }

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.32.0';
+export const version = '0.34.0';

package/lws/server.mjs

@@ -24,6 +24,16 @@
 //   lwsFetched [handle, documentJson] -> { ok, fetch? | installed? | refused? }
 //   lwsDelivered [handle, reportJson] -> { ok, changed, retry? }
 //   lwsFlush [handle, { now? }]       -> { ok, changed, deliveries?, wake? }
+//   lwsEgress [handle, { url, addresses }] -> { ok, host, address } | { ok, refused }
+//
+// REQUESTS TO PRIVATE ADDRESSES (https://github.com/danbri/factoidal/issues/1126)
+// Just before each delivery this host resolves the name the delivery names
+// (`resolve`, every address), passes the addresses to `lwsEgress`, and
+// connects to the address the answer names, with no second resolution
+// (`postTo`). A refused delivery is not made; it is reported to
+// `lwsDelivered` with `refused: true`. Which addresses are refused (the
+// IANA special-purpose ranges) and the opt-in `allowPrivateFetch` are
+// decided by `L4Factoidal/Net/Egress.lean` and `Notifications.egressOf`.
 //
 // RATE LIMIT AND INBOX CHECK (https://github.com/danbri/factoidal/issues/915)
 // An answer may carry `wake: SECONDS`: deliveries wait for a rate-limit
@@ -87,7 +97,7 @@ import { loadEngine } from '../bin/engine.mjs'
 import { readSnapshot, persistIfChanged, storageKeyText, storageModeText, loadFiles, persistFilesIfChanged, readStepBodies, acquireDirLock, atRestNotice } from './persist.mjs'
 
 /** The ops this host needs from the engine. */
-export const LWS_OPS = ['lwsOpen', 'lwsStep', 'lwsClose', 'lwsSnapshot', 'lwsFetched', 'lwsDelivered',
+export const LWS_OPS = ['lwsOpen', 'lwsStep', 'lwsClose', 'lwsSnapshot', 'lwsFetched', 'lwsDelivered', 'lwsEgress',
   'lwsLoad', 'lwsPersist', 'lwsRead', 'lwsDirLock', 'lwsAtRestNotice']
 
 /** How long this host waits for the answer to one delivery request before
@@ -128,6 +138,59 @@ async function resolveHost (host) {
   }
 }
 
+/** The most response bytes this host reads from an inbox; the rest is
+ *  dropped (the engine reads only the status). */
+const MAX_DELIVERY_ANSWER_BYTES = 65536
+
+/**
+ * POST one delivery to the address the engine chose (`lwsEgress`). Pure
+ * I/O: the connection goes to `address` only (the lookup answers it, so the
+ * name is not resolved again), TLS still checks the certificate against the
+ * URL's host name, redirects are not followed. The status, or 0 when no
+ * answer came in time.
+ */
+async function postTo (url, address, headers, body) {
+  let target
+  try {
+    target = new URL(url)
+  } catch (_error) {
+    return 0
+  }
+  const module = target.protocol === 'https:' ? await import('node:https') : await import('node:http')
+  const family = address.indexOf(':') >= 0 ? 6 : 4
+  const fields = {}
+  for (const pair of Array.isArray(headers) ? headers : []) {
+    if (Array.isArray(pair) && pair.length === 2) fields[String(pair[0])] = String(pair[1])
+  }
+  const bytes = Buffer.from(typeof body === 'string' ? body : '', 'utf8')
+  fields['content-length'] = String(bytes.length)
+  return new Promise((done) => {
+    let finished = false
+    const finish = (status) => { if (!finished) { finished = true; done(status) } }
+    const request = module.request(target, {
+      method: 'POST',
+      headers: fields,
+      lookup: (_host, options, callback) => {
+        if (options && options.all) callback(null, [{ address, family }])
+        else callback(null, address, family)
+      },
+      timeout: DELIVERY_TIMEOUT_MS
+    }, (response) => {
+      let size = 0
+      response.on('data', (chunk) => {
+        size += chunk.length
+        if (size > MAX_DELIVERY_ANSWER_BYTES) response.destroy()
+      })
+      response.on('end', () => finish(response.statusCode))
+      response.on('close', () => finish(response.statusCode))
+      response.on('error', () => finish(response.statusCode))
+    })
+    request.on('timeout', () => request.destroy(new Error('timeout')))
+    request.on('error', () => finish(0))
+    request.end(bytes)
+  })
+}
+
 /** The addresses of this machine's network interfaces. Pure I/O. */
 async function interfaceAddresses () {
   try {
@@ -323,6 +386,11 @@ export async function openLwsStorage (options = {}) {
   // engine checks and decides.
   if (typeof options.deliveryLimit === 'number') config.deliveryLimit = options.deliveryLimit
   if (typeof options.deliveryWindow === 'number') config.deliveryWindow = options.deliveryWindow
+  // The limit per destination and the opt-in for private and other
+  // special-purpose delivery targets (issue 1126): passed unread; the
+  // engine decides (L4Factoidal/Net/Egress.lean, Notifications.admitDest).
+  if (typeof options.deliveryDestLimit === 'number') config.deliveryDestLimit = options.deliveryDestLimit
+  if (options.allowPrivateFetch === true) config.allowPrivateFetch = true
   if (typeof options.redirectsMax === 'number') config.redirectsMax = options.redirectsMax
   if (typeof options.controllerInbox === 'string') config.controllerInbox = options.controllerInbox
   // CORS (https://github.com/danbri/factoidal/issues/923): `cors` is false or
@@ -440,22 +508,22 @@ export async function openLwsStorage (options = {}) {
   function deliver (delivery) {
     const job = (async () => {
       let status = 0
-      try {
-        const answer = await fetch(delivery.url, {
-          method: 'POST',
-          headers: Array.isArray(delivery.headers) ? delivery.headers : [],
-          body: delivery.body,
-          redirect: 'manual',
-          signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS)
-        })
-        status = answer.status
-        await answer.arrayBuffer()
-      } catch (_error) {
-        status = 0
+      // Resolve now, let the engine choose the address (issue 1126), and
+      // connect to that address only.
+      const addresses = typeof delivery.resolve === 'string' ? await resolveHost(delivery.resolve) : []
+      if (closed) return
+      const decided = engine.call('lwsEgress', [handle, JSON.stringify({ url: delivery.url, addresses })])
+      const refused = decided !== null && typeof decided === 'object' && typeof decided.refused === 'string'
+        ? decided.refused
+        : null
+      if (refused !== null) {
+        console.error(`lws-serve: delivery to ${delivery.url} not made: ${refused}`)
+      } else {
+        status = await postTo(delivery.url, String(decided.address), delivery.headers, delivery.body)
       }
       if (closed) return
       const told = engine.call('lwsDelivered', [handle, JSON.stringify({
-        id: delivery.id, status, ...clockNow()
+        id: delivery.id, status, ...(refused !== null ? { refused: true } : {}), ...clockNow()
       })])
       persist(told)
       const retry = told !== null && typeof told === 'object' ? told.retry : null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",

package/webdav/server.mjs

@@ -186,6 +186,13 @@ export async function openWebdav (options = {}) {
   }
   // The guest user (issue 1147), passed unread; the engine checks it.
   if (typeof options.guest === 'string') login.guest = options.guest
+  // HTTP over XMPP (issue 1125): the transport, the account and, when the
+  // operator gave one, the XMPP server's address; the engine decides.
+  if (options.transport === 'xmpp') {
+    login.transport = 'xmpp'
+    if (typeof options.jid === 'string') login.jid = options.jid
+    if (typeof options.host !== 'string') delete login.host
+  }
   const config = { listing, entropy: randomBase64(32), now: nowSeconds(), login }
   // The Host and Origin guard of the HTTP listener (issue 1124): the bound
   // address and the operator's names and origins, passed unread
@@ -257,6 +264,9 @@ export async function openWebdav (options = {}) {
       randomBase64: randomBase64(16),
       remoteAddress: typeof request.remoteAddress === 'string' ? request.remoteAddress : ''
     }
+    // Over XMPP: the requester the XMPP client handle named (the sender's
+    // bare JID), passed unread (https://github.com/danbri/factoidal/issues/1128).
+    if (request.requester !== undefined && request.requester !== null) record.requester = request.requester
     let got = blobCall(engine, 'webdavStep', [handle, JSON.stringify(record)], request.body || new Uint8Array(0))
     for (let hop = 0; hop < MAX_HOPS; hop += 1) {
       const env = got.envelope
@@ -294,6 +304,8 @@ export async function openWebdav (options = {}) {
     engine,
     mounts: ready.mounts || [],
     warnings: ready.warnings || [],
+    /** The engine's `ready.login`: a users file is loaded. */
+    login: ready.login === true,
     /** The start notices of the local mounts (a stale lock taken over,
      *  encryption at rest on or off), for standard error. */
     storageNotices,

package/xmpp/README.md

@@ -95,12 +95,14 @@ process per connection behind socat) serves; the wasm session ops are
 | `xmppSessionFeed` | `[session, text]` | `{ ok, send: [...], route: [{to, text}], presence: [...], rostersSaved: [...], close, stage, bare, full, bufferedBytes }` |
 | `xmppSessionDeliver` | `[session, text]` | `{ ok, delivered, send }` — `delivered:false` for an unbound session; nothing is lost |
 | `xmppSessionClose` | `[session]` | `{ ok, send }` |
+| `xmppSessionPing` | `[session, id]` | `{ ok, sent, send }` — an XEP-0199 ping for a bound session; `sent:false` otherwise. On a WebSocket, `xmppWsPing` writes a ping frame instead |
 | `xmppSessionTlsUp` | `[session]` | `{ ok, stage }` — after a feed answered `startTls: true` and the host finished the TLS handshake; refused otherwise |
 | `xmppRosterGet` / `xmppRosterSet` | `[server, bare]` / `[server, bare, encoded]` | the roster in the engine's own on-disk encoding |
 | `xmppClose` | `[server]` | `{ ok, sessions }` |
 
 The state directory is laid out as the native carrier's, so the two
-hosts can share one: `DIR/accounts` (one `user:password` per line),
+hosts can share one: `DIR/accounts` (one `user:password` per line, or a line with no
+password from `factoidal xmpp-serve --verifier NAME`, for SCRAM only),
 `DIR/roster/<bare jid>.tsv` (persisted on every `rostersSaved`, loaded
 on start), and `DIR/spool/<bare jid>/<file>` — a stanza written there
 by any process is delivered to that account's bound session and
@@ -130,8 +132,15 @@ RFC 6120 section 5 STARTTLS with `startTls: true` (op `xmppSessionTlsUp`;
 the engine decides, the host does the handshake; see the theorems in
 `formal/lean4/L4Factoidal/XMPP/Server.lean`).
 Not: server-to-server federation, MUC/MIX/GC3 rooms, PRECIS.
-Known limitation shared with the native harness: one SCRAM salt per
-server (`saltB64` in the config), not one per account.
+Each name has its own SCRAM salt, from a seed the host gives the engine
+(`saltSeed`; derived from the state key when there is one). The native
+harness and a fixed `saltB64` keep one salt for all.
+
+A live session keeps its full JID. A client that binds a resource a live session holds gets a
+server-generated one (RFC 6120 section 7.7.2.2), so a client must use the JID in the bind result.
+A resource is free as soon as the stream that held it ends. A connection lost with no notice to the
+host stays live until the host sees that. The native harness has no shared session table and does
+not make this check.
 
 The shared engine currently reduces routed destinations to bare JIDs and
 the Node host delivers to every bound resource. It does not implement full
@@ -203,5 +212,50 @@ The host closes a socket when a limit is reached. These are limits on bytes and
 | `loginTimeoutMs` | `--login-timeout SECONDS` | 30 s | Time to bind a resource |
 | `maxQueuedBytes` | | 8 MiB | Bytes waiting for a client that is not reading |
 | `maxBuffered` | | 1 MiB | Bytes of an unfinished unit |
+| `proxyHeaderTimeoutMs` | | 10 s | With `proxyProtocol`: time to send the PROXY header and, on a TLS listener, to finish the TLS handshake |
+
+There is no connection limit per address: behind a proxy, every client has the same one.
+
+## Limits the engine applies
 
-There is no limit per address: behind a proxy, every client has the same one.
+| Option | CLI | Default | Limit |
+|---|---|---|---|
+| `heldLimits.perAccount`, `.perAccountBytes` | | 256 stanzas, 4 MiB | Held for one offline account |
+| `heldLimits.total`, `.totalBytes` | | 10,000 stanzas, 64 MiB | Held on the server |
+| `heldLimits.senderPerWindow`, `.senderWindow` | | 60 in 60 s | Stanzas one account may have held; roster writes of one account |
+| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off only behind a proxy that sends no PROXY header, where every client has one address |
+
+Fixed in the engine: 5 failed logins in 60 s per account name, 3 failed attempts on a stream, 1,000 items in a roster, 64 levels and 8,192 elements in a stanza, and room nicks of at most 64 bytes.
+
+## Client addresses and the PROXY protocol
+
+The server keeps no client address. At start the host makes a random 32-byte key (`addressKey` of `xmppOpen`) that is in
+memory only and new at each start. The engine keeps, for each session, the tag HMAC-SHA-256(key, prefix), where the
+prefix is the IPv4 address or the /64 of an IPv6 address (`LoginLimit.clientPrefix`, the one place that groups addresses;
+`LoginLimit.addressTag`, theorem `addressTag_prefix`). The failed-login counters hold `address:` and the tag. A log line
+shows the first 12 hexadecimal digits of the tag (`addressTag` of `xmppSessionOpen` and `xmppWsOpen`). After a restart
+the tags change, and so do the counters, which are in memory too.
+
+`proxyProtocol: true` (`xmpp-serve --proxy-protocol`) is for a listener behind a TCP proxy that ends no TLS, such as Fly
+with `handlers = ["proxy_proto"]` and `proxy_proto_options = { version = "v2" }`. Every connection on every listener
+(the main port, `--tls-port`, `--ws-port`) must start with a PROXY protocol version 2 header (HAProxy,
+https://www.haproxy.org/download/2.9/doc/proxy-protocol.txt section 2.2), and the client address in it is the one the
+limit counts. The host buffers the first bytes and calls `proxyHeaderParse` (IN region: the bytes so far) until the
+engine decides (`L4Factoidal/Net/ProxyProtocol.lean`, `parse`):
+
+| Decision | Host |
+|---|---|
+| `more` | Waits. Theorem `parse_more_bounded`: only while fewer than 1,040 bytes are held. `proxyHeaderTimeoutMs` closes a connection that never completes a header |
+| `refuse`, with `reason` `signature`, `version`, `command`, `family` or `length` | Closes the connection. No XMPP and no TLS byte is read. A connection that starts with anything else (an XMPP stream header, a TLS ClientHello) is refused at its first byte |
+| `local` | A connection the proxy made itself (a health check). Spec: the receiver uses the real endpoints, so the address is the socket's |
+| `proxy`, with `address` and `port` | The address goes to the session as `remoteAddress` |
+
+The bytes after the header, in the same read, go to TLS or to the XMPP session (theorems `parse_proxy_le`,
+`parse_local_le`). PROXY is accepted for TCP over IPv4 (`0x11`) and IPv6 (`0x21`) only; UNSPEC, UNIX and UDP name no
+client address for the limit and are refused. TLVs are skipped. A length field above 1,024 is refused. An IPv4-mapped IPv6
+source is counted as its IPv4 address. Version 1 (the text form) is not read: Fly sends version 2 when asked, and a second
+parser would only be one more input path.
+
+Without `proxyProtocol` no header is read, so no client can claim an address; the socket's address is tagged the same way.
+`proxyProtocol` on a listener that is reachable without the proxy lets a client choose its address for the limit: use it
+only where every connection comes through the proxy.

package/xmpp/client.mjs

@@ -196,7 +196,9 @@ async function openStream (engine, config, options, onFeed, onClosed) {
  * @param {string} [options.resource]
  * @param {object[]} [options.mounts] the WebDAV handle's mounts, passed unread (the engine refuses writable local mounts without the opt-in)
  * @param {boolean} [options.dangerouslyAllowWritableWithoutLogin]
- * @param {Function} options.step `async ({method, target, headers, body}) => ({status, headers, body})`
+ * @param {boolean} [options.login] the WebDAV handle has a users file (its `ready.login`, passed unread)
+ * @param {number} [options.tickMs] how often the clock is given to the engine (default 1000)
+ * @param {Function} options.step `async ({method, target, headers, body, requester}) => ({status, headers, body})`
  * @param {object} [options.engine]
  * @param {Function} [options.onError]
  * @param {number} [options.maxBuffered] residual bytes the engine may hold before the socket is closed (default 16 MiB)
@@ -211,6 +213,7 @@ export async function connectHttpTarget (options = {}) {
   config.allow = Array.isArray(options.allow) ? options.allow : []
   if (Array.isArray(options.mounts)) config.mounts = options.mounts
   if (options.dangerouslyAllowWritableWithoutLogin === true) config.dangerouslyAllowWritableWithoutLogin = true
+  if (options.login === true) config.login = true
 
   let stream = null
   /** One request the engine named: carried to `step`, answered. */
@@ -221,7 +224,10 @@ export async function connectHttpTarget (options = {}) {
         method: request.method,
         target: request.target,
         headers: request.headers || [],
-        body: new Uint8Array(Buffer.from(request.bodyBase64 || '', 'base64'))
+        body: new Uint8Array(Buffer.from(request.bodyBase64 || '', 'base64')),
+        // The sender's bare JID as the engine named it (issue 1128),
+        // passed unread to the WebDAV handle's login.
+        requester: request.requester
       })
       answer = {
         status: response.status,
@@ -243,11 +249,20 @@ export async function connectHttpTarget (options = {}) {
     for (const r of answer.requests || []) carry(r)
   })
   const jid = await stream.bound
+  // The clock for the time limit of requests that wait for chunks
+  // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
+  const timer = setInterval(() => {
+    if (!stream.isOpen()) return
+    try {
+      stream.write(call(engine, 'xmppClientTick', [stream.handle, String(Date.now())]).send)
+    } catch (_error) { /* handle gone */ }
+  }, typeof options.tickMs === 'number' ? options.tickMs : 1000)
+  stream.closed.then(() => clearInterval(timer))
   return {
     jid,
     writableWithoutLogin: stream.opened.writableWithoutLogin || [],
     closed: stream.closed,
-    close: () => stream.close()
+    close: () => { clearInterval(timer); return stream.close() }
   }
 }
 

package/xmpp/inpage.mjs

@@ -53,6 +53,8 @@ export async function openInPageXmppServer (options = {}) {
   for (const k of ['domain', 'mucDomain', 'mixDomain', 'gc3Domain', 'saltB64']) {
     if (typeof options[k] === 'string') config[k] = options[k]
   }
+  if (typeof config.saltB64 !== 'string') config.saltSeed = randomToken()
+  config.occupantSeed = randomToken()
   if (Array.isArray(options.accounts)) config.accounts = options.accounts
   if (typeof options.iterationCount === 'number') config.iterationCount = options.iterationCount
   const opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -106,7 +108,11 @@ export async function openInPageXmppServer (options = {}) {
       send (message) {
         if (!open) throw new Error('the in-page XMPP connection is closed')
         let answer
-        try { answer = engine.call('xmppMsgFeed', [session, String(message)]) } catch (error) { onError(error); end(); return }
+        try {
+          // The rate limits read the host's clock.
+          engine.call('xmppClock', [handle, String(Math.floor(Date.now() / 1000))])
+          answer = engine.call('xmppMsgFeed', [session, String(message)])
+        } catch (error) { onError(error); end(); return }
         emit(answer.send || [])
         router.apply(c, answer)
         if (answer.close === true) end()