@factoidal/core 0.33.0 → 0.35.1

package/CHANGELOG.md

@@ -1,6 +1,36 @@
 # Changelog
 
-## Unreleased
+## 0.35.1 (2026-11-11)
+
+- Foafnaut (macOS): a heavy page no longer freezes the app. The host keeps one frame of GPU work in flight for heavy frames (three for light ones); after three frames over 250 ms it slows the page's animation and shows "SLOWED: HEAVY PAGE". Quitting or closing the window stops GPU work, so the app quits within seconds (before, up to 209 s on the Spinal Tap page at 2x). `--gpu-frames-in-flight N` sets the limit.
+- Foafnaut: Arabic letters join again on a page that loaded Noto Sans Math first; a font whose GSUB covers the script is preferred. Chinese, Japanese and Korean text breaks between characters, so long runs wrap instead of pushing right-to-left lines out of their cells.
+- BubblePopJS: conversions between byte arrays and the engine's values are faster (Pako about 14% faster on the native engine), with proofs that the fast forms give the same results.
+- XMPP: xmpp-serve logs each connection by its address tag, never the address (--quiet stops it).
+
+## 0.35.0 (2026-11-10)
+
+- Foafnaut: partial frames. A frame compiles again only the primitives that changed, keeps a damage rectangle, and redraws only that part of a layer. On the Spinal Tap page, one animated frame went from 351 ms to 3.9 ms of GPU and JS time at 1x (1225 ms to 4.0 ms at 2x); engine time per frame 28.5 ms to 10.9 ms. `retained:false` still gives the full path, and tests check that both give the same bytes.
+- Foafnaut: BubblePopJS, the built-in JavaScript engine, runs page scripts by default everywhere, also on the Hub. QuickJS-NG stays in the builds for comparison. Fixes: `r.exec(s)` in a loop no longer pays for the length of `s` on each call; a block with `let` or `const` may hold an `await`.
+- Foafnaut: a shader gallery page (WebGPU, WGSL), the same results on both JavaScript engines.
+- Foafnaut: the Hub starts faster, and layout is faster on large pages.
+- Foafnaut: on a Retina Mac the page is drawn at full resolution.
+- Foafnaut: iframes; form submission in the page's encoding; colour emoji (COLR/CPAL) in text, SVG text and canvas text; more fonts and SMIL animation.
+- Foafnaut: a click is no longer lost when the engine is busy; pointer input runs before queued engine work, and script hit tests use the frame on screen.
+- Foafnaut (macOS): the app links Lean's runtime without GNU MP. The releases that still contain GNU MP carry its notice.
+- `foafnaut` command: with no channel, it starts the newer of the installed release and the local bleeding-edge build, and says which. `--bleeding-edge` says the commit and age of the local build and warns when it is more than 6 hours old.
+- LWS client: `verifyNotification` accepts a notification whose `Signature-Input` covers the derived component `@query` (RFC 9421 section 2.2.7; https://github.com/danbri/factoidal-core/issues/379). The value comes from the inbox URL: `?` and the query, or `?` alone when the URL has no query. Before, the client read `@query` as a header field and refused the notification with "a covered component is missing", so `createNotificationReceiver` answered 401 to every notification from a storage that signs `@query` (sparq-lws-core; seen with 0.26.0 and 0.34.0). The client derives `@method`, `@scheme`, `@authority`, `@path` and `@query` only. Another name that starts with `@` (`@target-uri`, `@request-target`, `@query-param`) is refused and is not read as a header field. The decision is in Lean (`inboxBase` and `urlQuery`, `L4Factoidal/LWS/Client/Machine.lean`), through the wasm op `lwsClientStep`.
+- `foafnaut` command: `--version` prints the commit and the build time of the app that would run. The app gives the answer, from the record that its build wrote. An app that is too old to answer gives the line "this build is too old to answer --version".
+- `foafnaut` command: a page given as `file:name.html`, with no `//`, is a path relative to the current directory. A `file://` URL is read as a URL, so percent-encoded characters in its path are decoded.
+- XMPP: every IQ result the server sends has a `from` (RFC 6120 section 8.1.2.1): the address asked, or the account's bare JID when the request had no `to`. Theorems `handleIq_send_has_from` and `handleIq_domain_from`.
+
+## 0.34.0 (2026-11-08)
+
+- `foafnaut` command: `--url` and `--html` open a page or a file (`file:` URLs too), and other options are passed to the app.
+- XMPP: `xmpp-serve --proxy-protocol` (`proxyProtocol` in `createXmppServer`): every connection, on every listener, must start with a PROXY protocol v2 header, read before TLS, and the failed-login limit counts the client address it names. So the limit per client address can stay on behind Fly's proxy, where `--no-address-limit` was needed. The header is decided in Lean (`L4Factoidal/Net/ProxyProtocol.lean`, new wasm op `proxyHeaderParse`, theorems `parse_signature`, `parse_more_bounded`, `parse_proxy_le`); a connection without a valid header in 10 seconds (`proxyHeaderTimeoutMs`) is closed. Without the flag no header is read.
+- XMPP: the server keeps no client address. The limit counts an HMAC-SHA-256 tag of the address (IPv6 by its /64) under a random key that is in memory only and new at each start (`LoginLimit.addressTag`; `xmppOpen` takes `addressKey`; `xmppSessionOpen` and `xmppWsOpen` answer `addressTag`, its first 12 digits). The "connection from" log line shows the tag, not the address and port.
+- XMPP: the server pings a bound session that has been silent, and closes it if it stays silent, so a dead connection frees its resource. A ping is XEP-0199 on TCP and a ping frame on a WebSocket; any byte from the client counts as an answer. `xmpp-serve --ping-interval SECONDS` (default 30, 0 disables) and `--ping-timeout SECONDS` (default 20); `pingIntervalMs` and `pingTimeoutMs` in `createXmppServer`. New ops `xmppSessionPing` and `xmppWsPing`.
+- XMPP: a client that binds a resource a live session holds gets a server-generated one (RFC 6120 section 7.7.2.2), in the bind result. The live session stays. A client must use the JID in the bind result. A resource with no live session is free, and a room seat goes when its stream ends.
+- XMPP: room moderation (XEP-0045 sections 8 to 10): kick (status 307), ban (status 301), grant and revoke voice, moderator, member, admin and owner, the admin and owner lists, and status 321. `xmpp-serve --muc-owners FILE` names the owners, as `room: a@x` or `*: a@x` for every room. With that flag, also with an empty file, the first occupant of a room gets no rights, XMPP cannot change a configured owner, and with `--state-key` bans, grants and revoked voices survive a restart. Without the flag the first occupant is the owner as before, and a room's bans go with the room.
 
 ## 0.33.0 (2026-11-06)
 

package/bin/factoidal.mjs

@@ -772,9 +772,10 @@ Specification: https://solidproject.org/TR/protocol`,
 usage: factoidal xmpp-serve DIR [--domain NAME] [--port N] [--host ADDRESS]
                             [--accounts FILE] [--cert FILE --key FILE [--starttls [--tls-port N]]]
                             [--ws-port N [--ws-path PATH] [--ws-origin ORIGIN]...]
-                            [--muc DOMAIN [--muc-members FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
+                            [--muc DOMAIN [--muc-members FILE] [--muc-owners FILE]] [--mix DOMAIN] [--gc3 DOMAIN]
                             [--state-key FILE] [--max-connections N]
-                            [--login-timeout SECONDS] [--no-address-limit]
+                            [--login-timeout SECONDS] [--ping-interval SECONDS]
+                            [--ping-timeout SECONDS] [--proxy-protocol] [--no-address-limit]
                             [--dangerously-disable-ratelimits]
 
 Starts a Node TCP server that runs one engine session per connection and
@@ -817,11 +818,19 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
   --muc DOMAIN     also serve XEP-0045 multi-user chat rooms at DOMAIN, e.g.
                    conference.example.com: temporary rooms, made by the first
                    join and gone with the last occupant; no history, no
-                   configuration, no persistence (L4Factoidal/XMPP/Muc.lean)
+                   configuration form (L4Factoidal/XMPP/Muc.lean). Kick, ban, voice
+                   and the admin and owner lists follow XEP-0045 sections 8 to 10
   --muc-members FILE  members-only rooms: one room per line, as
                    "room: alice@example.com bob@example.com". Only those accounts
                    may join or see that room; a room not in the file is open to
                    every account (L4Factoidal/XMPP/Muc.lean)
+  --muc-owners FILE  room owners: one room per line, as "room: alice@example.com",
+                   and "*: alice@example.com" for every room. XMPP cannot change
+                   these names. With this flag, also with an empty file, nobody
+                   becomes an owner by being first in a room, and with --state-key
+                   bans and affiliations survive a restart. Without this flag, the
+                   first occupant of a room with no owner is its owner, and a room's
+                   bans and affiliations go with the room
   --mix DOMAIN     also serve XEP-0369 MIX channels at DOMAIN, e.g. mix.example.com,
                    joined through this server (XEP-0405 MIX-PAM); channels are
                    made by an IQ <create/>, kept in memory only, JID-hidden; no
@@ -831,6 +840,11 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    behind a proxy, every client has the same one
   --login-timeout SECONDS  how long a connection may stay without a bound
                    resource before it is closed (default 30; 0 disables)
+  --ping-interval SECONDS  how long a bound session may be silent before the
+                   server pings it: XEP-0199 on TCP, a ping frame on a WebSocket
+                   (default 30; 0 disables pings)
+  --ping-timeout SECONDS  how long after a ping a session that sends no byte is
+                   closed, which frees its resource (default 20)
   --state-key FILE keep the server's state across restarts: rosters, messages held
                    for offline accounts, MIX channels and GC3 groups, in an LWS
                    storage in DIR/state, sealed (ChaCha20-Poly1305) under the key
@@ -841,10 +855,21 @@ DIR/spool/<bare jid>/ is delivered to that account's bound session.
                    membership, stable participant ids, optional events. There is
                    no published GC3 spec; every wire format is invented and listed
                    in L4Factoidal/XMPP/Gc3.lean and danbri/factoidal issue 1236
+  --proxy-protocol every connection, on every listener (--port, --tls-port,
+                   --ws-port), must start with a PROXY protocol version 2 header
+                   (HAProxy's spec), read before TLS. The client address in it is
+                   the one the failed-login limit counts. A connection with no
+                   valid header in 10 seconds is closed; a version 1 (text)
+                   header is refused. A LOCAL header (a health check of the
+                   proxy) is accepted with the socket's address. Use it only
+                   behind a proxy that always sends the header, such as Fly with
+                   handlers = ["proxy_proto"] and proxy_proto_options =
+                   { version = "v2" }; without it no header is ever read, so a
+                   client cannot claim an address
   --no-address-limit
                    count failed logins per account name only. For a listener
-                   behind a proxy, where every client has the proxy's address
-                   and a limit on it would stop them all
+                   behind a proxy that sends no PROXY header, where every client
+                   has the proxy's address and a limit on it would stop them all
   --dangerously-disable-ratelimits
                    no failed SASL login limit and no sender rate on held
                    messages (a warning is printed at start); any client can
@@ -858,6 +883,9 @@ the SASL failure temporary-auth-failure, and no password is checked, also
 the right one, until that window ends. A client address also has a slower
 limit of 20 failed logins in an hour. A malformed SASL payload checks no
 password and does not count. A stream closes after 3 failed attempts.
+The server keeps no client address: the counters hold an HMAC-SHA-256
+tag of it (of its /64 for IPv6) under a random key that is in memory
+only and new at each start, and logs show the first 12 digits of the tag.
 
 The server makes no protocol decision. Stream negotiation, SASL PLAIN and
 SCRAM-SHA-256, resource binding, the roster, presence subscription and
@@ -1283,7 +1311,7 @@ const VALUE_OPTIONS = {
   'authz-serve': new Set(['port', 'host', 'issuer', 'resource', 'alg', 'token-lifetime', 'rotate-after',
     'cors-origin', 'saml-idp', 'saml-decrypt-key']),
   'authz-keys': new Set([]),
-  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'verifier', 'iterations']),
+  'xmpp-serve': new Set(['port', 'host', 'domain', 'accounts', 'cert', 'key', 'tls-port', 'ws-port', 'ws-path', 'ws-origin', 'muc', 'muc-members', 'muc-owners', 'mix', 'gc3', 'state-key', 'max-connections', 'login-timeout', 'ping-interval', 'ping-timeout', 'verifier', 'iterations']),
   'webdav-serve': new Set(['port', 'host', 'users', 'guest', 'cert', 'key', 'login-limit', 'login-window', 'xmpp', 'xmpp-password-file',
     'xmpp-host', 'xmpp-port', 'xmpp-allow', 'xmpp-resource', 'xmpp-ca', 'allow-host', 'allow-origin']),
   'webdav-user': new Set(['iterations']),
@@ -2970,7 +2998,9 @@ async function commandXmppServe (positional, options) {
     dir: positional[0],
     port: servePort(options, useTls && !startTls ? 5223 : 5222),
     host: serveHost(options),
-    onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) }
+    onError: (error) => { if (!quiet) err(`xmpp-serve: ${error.message}`) },
+    // Connection events: an address tag (never an address), closes at a timeout.
+    onLog: (line) => { if (!quiet) err(`xmpp-serve: ${line}`) }
   }
   if (typeof options.domain === 'string') settings.domain = options.domain
   if (typeof options.accounts === 'string') {
@@ -2983,6 +3013,7 @@ async function commandXmppServe (positional, options) {
     settings.disableRateLimits = options['dangerously-disable-ratelimits'] === true
   }
   if (options['no-address-limit'] === true) settings.addressLimit = false
+  if (options['proxy-protocol'] === true) settings.proxyProtocol = true
   if (useTls) {
     settings.cert = await fs.readFile(options.cert)
     settings.key = await fs.readFile(options.key)
@@ -3019,6 +3050,20 @@ async function commandXmppServe (positional, options) {
       settings.mucMembers.push({ room, members })
     }
   }
+  if (options['muc-owners'] !== undefined) {
+    if (typeof options['muc-owners'] !== 'string') throw new UsageError('--muc-owners needs a FILE')
+    if (settings.mucDomain === undefined) throw new UsageError('--muc-owners needs --muc')
+    settings.mucOwners = []
+    for (const line of (await fs.readFile(options['muc-owners'], 'utf8')).split('\n')) {
+      if (line.trim() === '') continue
+      const [, room, list] = /^([^:\s@/]+):(.*)$/.exec(line.trim()) ?? []
+      const owners = (list ?? '').split(/\s+/).filter(Boolean)
+      if (room === undefined || owners.length === 0 || owners.some((m) => !/^[^\s@/]+@[^\s@/]+$/.test(m))) {
+        throw new UsageError(`--muc-owners: not "room: bare@jid ...": ${line}`)
+      }
+      settings.mucOwners.push({ room, owners })
+    }
+  }
   if (options.mix !== undefined) {
     if (typeof options.mix !== 'string' || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(options.mix)) {
       throw new UsageError('--mix needs a domain name, e.g. mix.example.com')
@@ -3043,6 +3088,16 @@ async function commandXmppServe (positional, options) {
     if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--login-timeout needs a number of seconds')
     settings.loginTimeoutMs = n * 1000
   }
+  if (options['ping-interval'] !== undefined) {
+    const n = Number(options['ping-interval'])
+    if (!Number.isSafeInteger(n) || n < 0) throw new UsageError('--ping-interval needs a number of seconds')
+    settings.pingIntervalMs = n * 1000
+  }
+  if (options['ping-timeout'] !== undefined) {
+    const n = Number(options['ping-timeout'])
+    if (!Number.isSafeInteger(n) || n < 1) throw new UsageError('--ping-timeout needs a positive number of seconds')
+    settings.pingTimeoutMs = n * 1000
+  }
   if (options['ws-port'] !== undefined) {
     const wsPort = Number(options['ws-port'])
     if (!Number.isInteger(wsPort) || wsPort < 0 || wsPort > 65535) throw new UsageError('--ws-port needs a port number')
@@ -3078,6 +3133,8 @@ async function commandXmppServe (positional, options) {
     err(`xmpp-serve: listening on ${running.origin} for domain ${running.xmpp.domain}` +
         ` (${running.xmpp.accounts} accounts, state ${positional[0]}` +
         (startTls ? ', STARTTLS required)' : useTls ? ', direct TLS)' : ', PLAINTEXT: no TLS on this listener)'))
+    if (settings.proxyProtocol) err('xmpp-serve: every connection must start with a PROXY protocol v2 header')
+    else if (settings.addressLimit === false) err('xmpp-serve: failed logins count per account name only (--no-address-limit)')
     if (settings.mucDomain) err(`xmpp-serve: multi-user chat (XEP-0045) at ${settings.mucDomain}`)
     if (settings.mixDomain) err(`xmpp-serve: MIX channels (XEP-0369, joined by XEP-0405) at ${settings.mixDomain}`)
     if (settings.gc3Domain) err(`xmpp-serve: GC3 PROTOTYPE groups at ${settings.gc3Domain} (no published spec; invented wire format)`)

package/bin/foafnaut.mjs

@@ -5,14 +5,16 @@
 // current -> versions/<commit>, config.json {"bleedingEdge":"/path/to/App.app"}.
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, join, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
-const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
+const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE | --url URL | --html FILE] [APP_OPTIONS] [-- APP_ARGS]
 
-  PAGE              an http(s) URL or an HTML file; none opens the default page
+  PAGE              an http(s) or file: URL, or an HTML file; none opens the default page
+  --url URL         the page as a URL (http, https or file)
+  --html FILE       the page as a local HTML file
   --latest          install the newest published macOS build, then use it
   --bleeding-edge   use the local build (config.json "bleedingEdge", or
                     ~/Applications/foafnaut.app)
@@ -21,8 +23,21 @@ const HELP = `foafnaut [--latest|--bleeding-edge] [PAGE] [-- APP_ARGS]
   --install-latest  install the newest published build and stop
   --list            list installed versions
   --which           print the app that would run
+  --version         print the commit and build time of that app (the app answers)
   --help            this text
 
+App options, passed to the app as they are:
+  --perf-summary    print frame and input latency figures when the window closes
+  --check-pixels    read back and check every frame (slow)
+  --wasm-engine     use the Wasm engine, not the native library
+  --native-engine PATH  use this native engine library
+  --font FILE       load this font file
+  --bitmap-font     use the baked-in ASCII font only
+  --follow-links    open links that a page asks for at load
+  --be-liberal-in-what-we-accept  draw a page without the features this browser may skip
+                    (module scripts, unreadable media conditions, stylesheets that did not
+                    load) and list them in the console (Option-Command-J); the default refuses
+
 Also: foafnaut-latest, foafnaut-bleedingedge. Environment: FOAFNAUT_HOME, and
 FOAFNAUT_APP, which chooses the app outright. Page data goes to the app. Its trace
 is in ~/Library/Logs/foafnaut/trace.jsonl. The command stays open until the window
@@ -96,9 +111,16 @@ async function installLatest() {
   return versionApp(dir);
 }
 
+// App options that take no value, and those that take one.
+const APP_FLAGS = ['--perf-summary', '--check-pixels', '--wasm-engine', '--bitmap-font', '--follow-links', '--idle-checks-only', '--trace-input', '--be-liberal-in-what-we-accept'];
+const APP_VALUES = ['--native-engine', '--font'];
+
 function pageArgs(page) {
   if (page === undefined) return [];
   if (/^https?:\/\//i.test(page)) return ['--url', page];
+  // file:///abs/path is a URL; file:name.html has no // and is relative to here.
+  if (/^file:\/\//i.test(page)) page = fileURLToPath(page);
+  else if (/^file:/i.test(page)) page = decodeURIComponent(page.slice(5));
   const path = resolve(page);
   if (!existsSync(path)) fail(`no such file: ${page}`);
   return ['--html', path];
@@ -108,15 +130,19 @@ export async function main(argv, channel = 'current') {
   const split = argv.indexOf('--');
   const options = split < 0 ? argv : argv.slice(0, split);
   const extra = split < 0 ? [] : argv.slice(split + 1);
-  let page, which = false, verbose = false, detach = false;
+  let page, which = false, verbose = false, detach = false, version = false;
+  const app_ = [];
+  const setPage = (value) => { if (page !== undefined) fail('give one page'); if (value === undefined) fail('a page option needs a value'); page = value; };
   // Each of these picks the app or the action. Two of them have no one meaning.
   const exclusive = options.filter((arg) => ['--latest', '--bleeding-edge', '--install-latest', '--list'].includes(arg));
   if (new Set(exclusive).size > 1) fail(`${exclusive.join(' and ')} can not be used together; see --help`);
-  for (const arg of options) {
+  for (let i = 0; i < options.length; i++) {
+    const arg = options[i];
     if (arg === '--help' || arg === '-h') { process.stdout.write(HELP); return; }
     else if (arg === '--latest') channel = 'latest';
     else if (arg === '--bleeding-edge') channel = 'bleeding-edge';
     else if (arg === '--which') which = true;
+    else if (arg === '--version') version = true;
     else if (arg === '--verbose' || arg === '-v') verbose = true;
     else if (arg === '--detach') detach = true;
     else if (arg === '--install-latest') { await installLatest(); return; }
@@ -127,18 +153,48 @@ export async function main(argv, channel = 'current') {
         console.log(`${name === current ? '*' : ' '} ${name}`);
       console.log(`  bleeding edge: ${bleedingEdgeApp()}${existsSync(bleedingEdgeApp()) ? '' : ' (not found)'}`);
       return;
-    } else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
-    else if (page !== undefined) fail('give one page');
-    else page = arg;
+    } else if (arg === '--url' || arg === '--html') setPage(options[++i]);
+    else if (arg.startsWith('--url=') || arg.startsWith('--html=')) setPage(arg.slice(arg.indexOf('=') + 1));
+    else if (APP_FLAGS.includes(arg)) app_.push(arg);
+    else if (APP_VALUES.includes(arg)) { if (options[i + 1] === undefined) fail(`${arg} needs a value`); app_.push(arg, options[++i]); }
+    else if (arg.startsWith('-')) fail(`unknown option ${arg}; see --help`);
+    else setPage(arg);
   }
   if (process.platform !== 'darwin') fail('the native window is macOS only; use the Hub page in a WebGPU browser');
   let app = process.env.FOAFNAUT_APP;
   if (!app && channel === 'latest') app = await installLatest();
   if (!app && channel === 'bleeding-edge') app = bleedingEdgeApp();
-  if (!app) app = currentApp() ?? bleedingEdgeApp();
+  // With no channel named: the newer of the installed release and the bleeding-edge build
+  // (owner, 2026-11-09: plain foafnaut started a release of 6 November, older than the
+  // local build, with nothing to say so). Each is dated by its files on disk.
+  if (!app) {
+    const release = currentApp(), local = existsSync(bleedingEdgeApp()) ? bleedingEdgeApp() : undefined;
+    const age = (path) => statSync(path).mtimeMs;
+    app = release && local ? (age(local) >= age(release) ? local : release) : (release ?? local ?? bleedingEdgeApp());
+    if (release && app === release)
+      console.error(`foafnaut: the installed release ${basename(realpathSync(join(home(), 'current')))} (newer than the bleeding-edge build)`);
+    else if (release) console.error('foafnaut: the bleeding-edge build (newer than the installed release; --latest for the release)');
+  }
   if (!existsSync(app)) fail(`no app at ${app}. Run foafnaut --install-latest.`);
+  // The bleeding-edge build says what it was built from (BUILD-INFO.json beside the app,
+  // written when the build is swapped in); an old build is named, so it is not taken for main.
+  if (app === bleedingEdgeApp()) {
+    try {
+      const info = JSON.parse(readFileSync(join(dirname(app), 'BUILD-INFO.json'), 'utf8'));
+      const hours = (Date.now() - Date.parse(info.builtAt)) / 3.6e6;
+      console.error(`foafnaut: bleeding edge built from ${info.commit}${info.dirty ? " with uncommitted changes" : ""} at ${info.builtAt} (${hours.toFixed(1)} h ago)` +
+        (hours > 6 ? '; it may lack newer work on main' : ''));
+    } catch { console.error('foafnaut: bleeding edge has no BUILD-INFO.json; its commit is not known'); }
+  }
   if (which) { console.log(app); return; }
-  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...extra];
+  // The app answers for itself. `open` shows no output, so run its program directly.
+  if (version) {
+    const run = spawnSync(join(dirname(app), 'native-webgpu-html-darwin-arm64'), ['--version'], { encoding: 'utf8' });
+    if (run.status === 0) process.stdout.write(run.stdout);
+    else console.log(`foafnaut: this build is too old to answer --version (${app})`);
+    process.exit(0);
+  }
+  const args = ['-n', ...(detach ? [] : ['-W']), app, '--args', ...pageArgs(page), ...(verbose ? ['--trace-input'] : []), ...app_, ...extra];
   const log = join(homedir(), 'Library', 'Logs', 'foafnaut', 'trace.jsonl');
   if (verbose) console.error(`foafnaut: app ${app}\nfoafnaut: open ${args.join(' ')}\nfoafnaut: trace ${log}`);
   // Follow only what this run appends.

package/l4-assets/l4factoidal.js

@@ -37,7 +37,7 @@
 // bytes change.
 
 // Stamped by formal/lean4/Wasm/build-wasm.sh step 9 -- do not hand-edit.
-const WASM_VERSION = "7f617da4ecbe";
+const WASM_VERSION = "2e241365bd79";
 
 import createModule from './l4factoidal.mjs';
 

package/l4-assets/version.json

@@ -2,17 +2,17 @@
   "engine": "lean4",
   "note": "The Lean 4 (L4Factoidal) engine build provenance and claims: the only engine of @factoidal/core since 0.9.0 (issue 713). This committed file is a placeholder. tools/fetch-builds.sh --set web (through tools/stamp-l4-version.mjs) writes the provenance members from the danbri/factoidal-builds release that built the wasm; formal/lean4/Wasm/build-wasm.sh step 9 writes them for a local build. Do not commit a stamped copy.",
   "stamped": true,
-  "release": "danbri/factoidal-builds build-31be9833264a-web",
-  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42304532396",
-  "gitSha": "31be9833264a2289526a8c9fcc1d6b67610cf746",
-  "builtAt": "2026-11-06T23:08:01Z",
+  "release": "danbri/factoidal-builds build-6f57afba14e0-web",
+  "releaseRun": "https://github.com/danbri/factoidal-builds/actions/runs/42968513371",
+  "gitSha": "6f57afba14e04ed648358e4693790edff69a6cd3",
+  "builtAt": "2026-11-11T07:07:29Z",
   "leanToolchain": "leanprover/lean4:v4.33.1",
   "emscripten": "6.0.8",
   "abiVersion": "1",
   "engineVersion": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
   "version": "l4factoidal-wasm 0.2.0 (dispatch: RDF parse/serialize, SPARQL query+update, RDFS/OWL-RL closures, RDFC-1.0, CL/IKL)",
-  "wasmSha256": "7f617da4ecbe7352b94f361802e12bb785f401aafbf78f92b6031c8e920011f2",
-  "wasmBytes": 32611669,
+  "wasmSha256": "2e241365bd7906474320610a65af99641474534fa0fe0e744ed3d9edeef4ee41",
+  "wasmBytes": 32703824,
   "claims": {
     "source": "formal/lean4 (L4Factoidal): no sorry, no user axioms, no native_decide; W3C behaviour pinned by build-time #guard",
     "suitesAtBuildSha": "see docs/test-results and formal/lean4/PORT_NOTES.md at gitSha"

package/lib/version.mjs

@@ -2,4 +2,4 @@
 // needs import attributes, which not every runtime this package targets
 // reads). test/dts-drift.test.js checks that it equals package.json's
 // `version`.
-export const version = '0.33.0';
+export const version = '0.35.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factoidal/core",
-  "version": "0.33.0",
+  "version": "0.35.1",
   "description": "EXPERIMENTAL UNDER-REVIEWED CODE: do not run public services on it without careful independent expert review. RDF parsing and writing (Turtle, TriG, N-Triples, N-Quads, RDF/XML, JSON-LD), SPARQL 1.1 and 1.2, RDFS and OWL reasoning, SHACL and ShEx validation, CSVW and RML mapping, RDFC-1.0, and SPARQL, LWS and Solid servers, for Node, Deno and browsers.",
   "keywords": [
     "sparql",
@@ -28,7 +28,8 @@
   "author": "Dan Brickley <danbri@danbri.org>",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/danbri/factoidal-builds.git"
+    "url": "git+https://github.com/danbri/factoidal.git",
+    "directory": "npm/factoidal"
   },
   "main": "./index.js",
   "module": "./index.mjs",

package/xmpp/README.md

@@ -95,6 +95,7 @@ process per connection behind socat) serves; the wasm session ops are
 | `xmppSessionFeed` | `[session, text]` | `{ ok, send: [...], route: [{to, text}], presence: [...], rostersSaved: [...], close, stage, bare, full, bufferedBytes }` |
 | `xmppSessionDeliver` | `[session, text]` | `{ ok, delivered, send }` — `delivered:false` for an unbound session; nothing is lost |
 | `xmppSessionClose` | `[session]` | `{ ok, send }` |
+| `xmppSessionPing` | `[session, id]` | `{ ok, sent, send }` — an XEP-0199 ping for a bound session; `sent:false` otherwise. On a WebSocket, `xmppWsPing` writes a ping frame instead |
 | `xmppSessionTlsUp` | `[session]` | `{ ok, stage }` — after a feed answered `startTls: true` and the host finished the TLS handshake; refused otherwise |
 | `xmppRosterGet` / `xmppRosterSet` | `[server, bare]` / `[server, bare, encoded]` | the roster in the engine's own on-disk encoding |
 | `xmppClose` | `[server]` | `{ ok, sessions }` |
@@ -135,6 +136,12 @@ Each name has its own SCRAM salt, from a seed the host gives the engine
 (`saltSeed`; derived from the state key when there is one). The native
 harness and a fixed `saltB64` keep one salt for all.
 
+A live session keeps its full JID. A client that binds a resource a live session holds gets a
+server-generated one (RFC 6120 section 7.7.2.2), so a client must use the JID in the bind result.
+A resource is free as soon as the stream that held it ends. A connection lost with no notice to the
+host stays live until the host sees that. The native harness has no shared session table and does
+not make this check.
+
 The shared engine currently reduces routed destinations to bare JIDs and
 the Node host delivers to every bound resource. It does not implement full
 resource-selection/priority semantics. Binding alone permits delivery; this
@@ -205,6 +212,7 @@ The host closes a socket when a limit is reached. These are limits on bytes and
 | `loginTimeoutMs` | `--login-timeout SECONDS` | 30 s | Time to bind a resource |
 | `maxQueuedBytes` | | 8 MiB | Bytes waiting for a client that is not reading |
 | `maxBuffered` | | 1 MiB | Bytes of an unfinished unit |
+| `proxyHeaderTimeoutMs` | | 10 s | With `proxyProtocol`: time to send the PROXY header and, on a TLS listener, to finish the TLS handshake |
 
 There is no connection limit per address: behind a proxy, every client has the same one.
 
@@ -215,6 +223,39 @@ There is no connection limit per address: behind a proxy, every client has the s
 | `heldLimits.perAccount`, `.perAccountBytes` | | 256 stanzas, 4 MiB | Held for one offline account |
 | `heldLimits.total`, `.totalBytes` | | 10,000 stanzas, 64 MiB | Held on the server |
 | `heldLimits.senderPerWindow`, `.senderWindow` | | 60 in 60 s | Stanzas one account may have held; roster writes of one account |
-| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off behind a proxy, where every client has one address |
+| `addressLimit: false` | `--no-address-limit` | on | Failed logins per client address (5 in 60 s, 20 in an hour). Turn it off only behind a proxy that sends no PROXY header, where every client has one address |
 
 Fixed in the engine: 5 failed logins in 60 s per account name, 3 failed attempts on a stream, 1,000 items in a roster, 64 levels and 8,192 elements in a stanza, and room nicks of at most 64 bytes.
+
+## Client addresses and the PROXY protocol
+
+The server keeps no client address. At start the host makes a random 32-byte key (`addressKey` of `xmppOpen`) that is in
+memory only and new at each start. The engine keeps, for each session, the tag HMAC-SHA-256(key, prefix), where the
+prefix is the IPv4 address or the /64 of an IPv6 address (`LoginLimit.clientPrefix`, the one place that groups addresses;
+`LoginLimit.addressTag`, theorem `addressTag_prefix`). The failed-login counters hold `address:` and the tag. A log line
+shows the first 12 hexadecimal digits of the tag (`addressTag` of `xmppSessionOpen` and `xmppWsOpen`). After a restart
+the tags change, and so do the counters, which are in memory too.
+
+`proxyProtocol: true` (`xmpp-serve --proxy-protocol`) is for a listener behind a TCP proxy that ends no TLS, such as Fly
+with `handlers = ["proxy_proto"]` and `proxy_proto_options = { version = "v2" }`. Every connection on every listener
+(the main port, `--tls-port`, `--ws-port`) must start with a PROXY protocol version 2 header (HAProxy,
+https://www.haproxy.org/download/2.9/doc/proxy-protocol.txt section 2.2), and the client address in it is the one the
+limit counts. The host buffers the first bytes and calls `proxyHeaderParse` (IN region: the bytes so far) until the
+engine decides (`L4Factoidal/Net/ProxyProtocol.lean`, `parse`):
+
+| Decision | Host |
+|---|---|
+| `more` | Waits. Theorem `parse_more_bounded`: only while fewer than 1,040 bytes are held. `proxyHeaderTimeoutMs` closes a connection that never completes a header |
+| `refuse`, with `reason` `signature`, `version`, `command`, `family` or `length` | Closes the connection. No XMPP and no TLS byte is read. A connection that starts with anything else (an XMPP stream header, a TLS ClientHello) is refused at its first byte |
+| `local` | A connection the proxy made itself (a health check). Spec: the receiver uses the real endpoints, so the address is the socket's |
+| `proxy`, with `address` and `port` | The address goes to the session as `remoteAddress` |
+
+The bytes after the header, in the same read, go to TLS or to the XMPP session (theorems `parse_proxy_le`,
+`parse_local_le`). PROXY is accepted for TCP over IPv4 (`0x11`) and IPv6 (`0x21`) only; UNSPEC, UNIX and UDP name no
+client address for the limit and are refused. TLVs are skipped. A length field above 1,024 is refused. An IPv4-mapped IPv6
+source is counted as its IPv4 address. Version 1 (the text form) is not read: Fly sends version 2 when asked, and a second
+parser would only be one more input path.
+
+Without `proxyProtocol` no header is read, so no client can claim an address; the socket's address is tagged the same way.
+`proxyProtocol` on a listener that is reachable without the proxy lets a client choose its address for the limit: use it
+only where every connection comes through the proxy.

package/xmpp/server.mjs

@@ -37,12 +37,25 @@
 // server-to-server federation, and any limit on how many bytes
 // a client may send without completing a unit beyond `maxBuffered`,
 // which is a transport limit this host applies by closing the socket.
-// The other transport limits are `maxConnections`, `loginTimeoutMs` and
-// `maxQueuedBytes`. There is no connection limit per address: behind a
+// The other transport limits are `maxConnections`, `loginTimeoutMs`,
+// `maxQueuedBytes`, and `pingIntervalMs` with `pingTimeoutMs`: a bound session
+// silent for the interval gets a ping from the engine (`xmppSessionPing`, or
+// `xmppWsPing` on a WebSocket), and one that sends no byte in the timeout after
+// that is closed. There is no connection limit per address: behind a
 // proxy, every client has the same one.
+//
+// Client addresses (the failed-login limit): the engine keeps a tag of each,
+// HMAC-SHA-256 under `addressKey`, a random key made here at start and kept in
+// memory only (`L4Factoidal/Net/LoginLimit.lean`, `addressTag`). Logs show the
+// first 12 digits of the tag, never the address. With `proxyProtocol` each
+// connection must start with a PROXY protocol v2 header, which names the client
+// behind a proxy; the engine decides on it (`proxyHeaderParse`,
+// `L4Factoidal/Net/ProxyProtocol.lean`) and this file only buffers the bytes,
+// then hands what follows the header to TLS or to the XMPP session.
 
 import { createHash, randomBytes } from 'node:crypto'
 import { StringDecoder } from 'node:string_decoder'
+import { Duplex } from 'node:stream'
 import { mkdir, readFile, writeFile, readdir, unlink, rename, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { loadEngine } from '../bin/engine.mjs'
@@ -51,7 +64,7 @@ import { createXmppRouter } from './router.mjs'
 /** The ops this host needs from the engine. */
 export const XMPP_SERVER_OPS = [
   'xmppOpen', 'xmppClose',
-  'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionClose',
+  'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionPing', 'xmppSessionClose',
   'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad', 'xmppClock'
 ]
 
@@ -154,6 +167,9 @@ export async function openXmppServer (options = {}) {
   if (typeof options.mucDomain === 'string') config.mucDomain = options.mucDomain
   // Members-only rooms: [{room, members: [bare JID]}]; no list, an open room.
   if (Array.isArray(options.mucMembers)) config.mucMembers = options.mucMembers
+  // Owners: [{room, owners: [bare JID]}], room '*' for every room. Present, also empty: nobody
+  // becomes an owner by being first in a room. Absent: the first occupant is the owner.
+  if (Array.isArray(options.mucOwners)) config.mucOwners = options.mucOwners
   // Nicks reserved for a JID: [{nick, jid}]. Each account's name is reserved for it anyway.
   if (Array.isArray(options.mucReservedNicks)) config.mucReservedNicks = options.mucReservedNicks
   // XEP-0369 channels (L4Factoidal/XMPP/Mix.lean), joined through MIX-PAM; off unless named.
@@ -167,6 +183,9 @@ export async function openXmppServer (options = {}) {
   // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
   if (options.disableRateLimits === true) config.disableRateLimits = true
   if (options.heldLimits && typeof options.heldLimits === 'object') config.heldLimits = options.heldLimits
+  // The key of the client address tags: random, in memory only, new at each start.
+  // A tag is no use to anyone who does not hold it, so it never goes to a log or a file.
+  config.addressKey = typeof options.addressKey === 'string' ? options.addressKey : randomToken(32)
   let opened
   try {
     opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -200,6 +219,11 @@ export async function openXmppServer (options = {}) {
     engine.call('xmppClose', [handle])
     throw new XmppHostError('this engine does not carry members-only rooms; rebuild the engine')
   }
+  // The same for owners: an older engine would make the first occupant the owner.
+  if (Array.isArray(options.mucOwners) && opened.mucOwners !== options.mucOwners.length) {
+    engine.call('xmppClose', [handle])
+    throw new XmppHostError('this engine does not carry configured room owners; rebuild the engine')
+  }
   return {
     engine,
     handle,
@@ -230,6 +254,8 @@ export async function openXmppServer (options = {}) {
       let open = true
       return {
         handle: session,
+        /** The first digits of the client's address tag, for a log line ('' for no address). */
+        addressTag: typeof answer.addressTag === 'string' ? answer.addressTag : '',
         /** Feed received text; returns the engine's answer document. */
         feed (text) {
           tick()
@@ -243,6 +269,10 @@ export async function openXmppServer (options = {}) {
         deliver (text) {
           return engine.call('xmppSessionDeliver', [session, text])
         },
+        /** This session has been silent: `{sent, send}`, an XEP-0199 ping when it is bound. */
+        ping (id) {
+          return engine.call('xmppSessionPing', [session, id])
+        },
         /** End of input: returns `{send: string[]}` and releases the handle. */
         close () {
           if (!open) return { send: [], routeFull: [] }
@@ -315,8 +345,18 @@ async function accountsFileWarnings (path) {
  *   without a bound resource before it is closed (default 30000; 0 disables)
  * @param {number} [options.maxQueuedBytes] bytes waiting to be written to a
  *   client that is not reading, before the socket is closed (default 8 MiB)
- * @param {boolean} [options.addressLimit] false: count failed logins per account name only, for a
- *   listener behind a proxy, where every client has one address (default true)
+ * @param {number} [options.pingIntervalMs] how long a bound session may be silent before it
+ *   gets a ping (default 30000; 0 disables pings and the timeout)
+ * @param {number} [options.pingTimeoutMs] how long after a ping a session that sends
+ *   no byte is closed, so that its resource is free again (default 20000)
+ * @param {boolean} [options.addressLimit] false: count failed logins per account name only
+ *   (default true). Behind a proxy that sends no PROXY header every client has the proxy's address
+ * @param {boolean} [options.proxyProtocol] every connection, on every listener, starts with a
+ *   PROXY protocol v2 header, read before TLS; the client address it names is the one the
+ *   failed-login limit counts. A connection without a valid header is closed. Without this option no
+ *   header is ever read, so a client cannot claim an address (default false)
+ * @param {number} [options.proxyHeaderTimeoutMs] with `proxyProtocol`, how long a connection has to
+ *   send its header and, on a TLS listener, finish the TLS handshake (default 10000)
  * @param {Function} [options.onError]
  * @param {Function} [options.onLog]
  * @returns {Promise<{server: object, xmpp: object, close: Function, sessions: Function}>}
@@ -337,6 +377,11 @@ export async function createXmppServer (options = {}) {
   const maxConnections = limit('maxConnections', 1024)
   const loginTimeoutMs = limit('loginTimeoutMs', 30000)
   const maxQueuedBytes = limit('maxQueuedBytes', 8 * 1024 * 1024)
+  const pingIntervalMs = limit('pingIntervalMs', 30000)
+  const pingTimeoutMs = limit('pingTimeoutMs', 20000)
+  const proxyProtocol = options.proxyProtocol === true
+  const proxyHeaderTimeoutMs = limit('proxyHeaderTimeoutMs', 10000)
+  if (pingIntervalMs > 0 && pingTimeoutMs === 0) throw new XmppHostError('pingTimeoutMs must be positive when pings are on')
   if (!Number.isSafeInteger(maxBuffered) || maxBuffered < 0) {
     throw new XmppHostError('maxBuffered must be a nonnegative safe integer')
   }
@@ -369,6 +414,17 @@ export async function createXmppServer (options = {}) {
   if (dir !== null && options.stateKey !== undefined) serverOptions.persist = true
   const xmpp = await openXmppServer(serverOptions)
   if (accountsFile !== null) xmpp.warnings.push(...await accountsFileWarnings(accountsFile))
+  if (proxyProtocol) {
+    try {
+      xmpp.engine.callBlobIO('proxyHeaderParse', [], new Uint8Array(0))
+    } catch (error) {
+      xmpp.close()
+      if (isUnknownOp(error)) {
+        throw new XmppHostError('the loaded l4factoidal WebAssembly module does not carry proxyHeaderParse', { unknownOp: true })
+      }
+      throw error
+    }
+  }
 
   // Rosters the previous run persisted.
   try {
@@ -415,7 +471,7 @@ export async function createXmppServer (options = {}) {
           '  acl:mode acl:Read, acl:Write, acl:Control .\n'
       })
       const get = (target, accept) => state.step({ method: 'GET', target, headers: accept ? [['Accept', accept]] : [], body: new Uint8Array(0) })
-      for (const kind of ['roster', 'held', 'mix', 'gc3']) {
+      for (const kind of ['roster', 'held', 'mix', 'gc3', 'muc']) {
         const listing = await get(`/xmpp/${kind}/`, 'application/lws+json')
         if (listing.status === 404) continue
         if (listing.status !== 200) throw new XmppHostError(`state: listing /xmpp/${kind}/ answered ${listing.status}`)
@@ -478,10 +534,95 @@ export async function createXmppServer (options = {}) {
   // connection callback and therefore have no engine session yet.
   const transports = new Set()
 
-  // The client's address for the login limit. Behind a proxy every client has
-  // the proxy's address, and a limit on it would stop them all: `addressLimit: false`.
-  const addressOf = (socket) =>
-    options.addressLimit !== false && typeof socket.remoteAddress === 'string' ? socket.remoteAddress : ''
+  // The client's address for the login limit: the socket's, or the one a PROXY
+  // header named. The engine keeps only its tag. `addressLimit: false` gives none.
+  const addressOf = (address) =>
+    options.addressLimit !== false && typeof address === 'string' ? address : ''
+
+  /** With `proxyProtocol`: buffer a new connection's bytes until the engine
+   *  decides on its PROXY v2 header, then `then(address, rest)` with the client
+   *  address and the bytes after the header. A refused header, or none in
+   *  `proxyHeaderTimeoutMs`, closes the connection. */
+  function readProxyHeader (socket, then) {
+    let buffered = Buffer.alloc(0)
+    const timer = setTimeout(() => {
+      onLog('closing a connection that sent no PROXY header in time')
+      finish()
+      socket.destroy()
+    }, proxyHeaderTimeoutMs)
+    timer.unref()
+    const finish = () => {
+      clearTimeout(timer)
+      socket.removeListener('data', onData)
+      socket.removeListener('error', onSocketError)
+    }
+    const onSocketError = () => { finish(); socket.destroy() }
+    const onData = (chunk) => {
+      buffered = buffered.length === 0 ? chunk : Buffer.concat([buffered, chunk])
+      let decision
+      try {
+        decision = xmpp.engine.callBlobIO('proxyHeaderParse', [],
+          new Uint8Array(buffered.buffer, buffered.byteOffset, buffered.byteLength)).envelope
+      } catch (error) {
+        onError(error)
+        finish()
+        socket.destroy()
+        return
+      }
+      if (decision.decision === 'more') return
+      finish()
+      if ((decision.decision !== 'proxy' && decision.decision !== 'local') ||
+          !Number.isSafeInteger(decision.consumed) || decision.consumed > buffered.length) {
+        onLog(`closing a connection: PROXY header refused (${decision.reason || decision.error || 'no decision'})`)
+        socket.destroy()
+        return
+      }
+      // LOCAL: the proxy's own connection (a health check); its address is the socket's.
+      const address = decision.decision === 'proxy' ? decision.address : socket.remoteAddress
+      then(address, buffered.subarray(decision.consumed))
+    }
+    socket.on('data', onData)
+    socket.on('error', onSocketError)
+  }
+
+  /** A stream that yields `head` and then what `socket` reads, and writes to
+   *  `socket`: TLS over a connection whose first bytes were a PROXY header. */
+  function prefixed (socket, head) {
+    const stream = new Duplex({
+      read () { socket.resume() },
+      write (chunk, _encoding, callback) { socket.write(chunk, callback) },
+      final (callback) { socket.end(); callback() },
+      destroy (error, callback) { socket.destroy(); callback(error) }
+    })
+    if (head.length > 0) stream.push(head)
+    socket.on('data', (chunk) => { if (!stream.push(chunk)) socket.pause() })
+    socket.on('end', () => stream.push(null))
+    socket.on('error', (error) => stream.destroy(error))
+    socket.on('close', () => stream.destroy())
+    return stream
+  }
+
+  /** With `proxyProtocol`, a TLS listener is a TCP listener: read the header,
+   *  then be the TLS server over the rest, within `proxyHeaderTimeoutMs`. */
+  function acceptTls (tls, socket, tlsOptions, then) {
+    readProxyHeader(socket, (address, rest) => {
+      const secure = new tls.TLSSocket(prefixed(socket, rest), { isServer: true, ...tlsOptions })
+      const timer = setTimeout(() => { secure.destroy(); socket.destroy() }, proxyHeaderTimeoutMs)
+      timer.unref()
+      const onHandshakeError = (error) => {
+        clearTimeout(timer)
+        if (error && error.code !== 'ECONNRESET') onError(new XmppHostError(`TLS handshake: ${error.message}`))
+        secure.destroy()
+        socket.destroy()
+      }
+      secure.once('error', onHandshakeError)
+      secure.once('secure', () => {
+        clearTimeout(timer)
+        secure.removeListener('error', onHandshakeError)
+        then(secure, address)
+      })
+    })
+  }
 
   // Transport limits, like `maxBuffered`: bytes and time, not protocol.
   function closeIfBacklogged (c) {
@@ -507,6 +648,35 @@ export async function createXmppServer (options = {}) {
     c.loginTimer.unref()
   }
 
+  /** Any byte from a peer shows it is alive, whatever the byte says. */
+  function heard (c) {
+    c.lastHeard = Date.now()
+    c.pingedAt = 0
+  }
+
+  /** Ping the bound sessions that have been silent, and close the ones that stayed silent.
+   *  A dead TCP connection sends no FIN, so without this it holds its resource for as long as
+   *  the operating system keeps retrying. */
+  function checkSilence () {
+    const now = Date.now()
+    for (const c of connections) {
+      if (c.full === null || c.closing || c.upgrading) continue
+      if (c.pingedAt !== 0) {
+        if (now - c.pingedAt >= pingTimeoutMs) {
+          onLog(`closing ${c.full}: no answer to a ping`)
+          c.socket.destroy()
+        }
+      } else if (now - c.lastHeard >= pingIntervalMs) {
+        c.pingedAt = now
+        try { c.ping() } catch (error) { onError(error) }
+      }
+    }
+  }
+  const pinger = pingIntervalMs > 0
+    ? setInterval(checkSilence, Math.ceil(Math.min(pingIntervalMs, pingTimeoutMs, 10000) / 2))
+    : null
+  if (pinger !== null) pinger.unref()
+
   /** Count a new socket, or close it at once if the server is full. */
   function admit (socket) {
     if (transports.size >= maxConnections) {
@@ -612,10 +782,10 @@ export async function createXmppServer (options = {}) {
     }
   }
 
-  function onConnection (socket, direct = false) {
+  function onConnection (socket, direct = false, address = socket.remoteAddress, rest = null) {
     let session
     try {
-      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(socket) })
+      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(address) })
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -628,16 +798,25 @@ export async function createXmppServer (options = {}) {
       full: null,
       closing: false,
       decoder: new StringDecoder('utf8'),
+      lastHeard: Date.now(),
+      pingedAt: 0,
+      pings: 0,
       deliver (text) {
         const answer = c.session.deliver(text)
         if (answer.delivered === true) { writeAll(c, answer.send); return true }
         return false
+      },
+      ping () {
+        const answer = c.session.ping(`ping-${++c.pings}`)
+        if (answer.sent === true) writeAll(c, answer.send)
       }
     }
     connections.add(c)
     startLoginTimer(c)
-    onLog(`connection from ${socket.remoteAddress}:${socket.remotePort}`)
+    // The tag's first digits, never the address (the tag's key is in memory only).
+    onLog(`connection from ${session.addressTag === '' ? 'no address' : 'address ' + session.addressTag}`)
     c.onData = (chunk) => {
+      heard(c)
       if (!connections.has(c) || c.closing || c.upgrading) return
       const text = c.decoder.write(chunk)
       if (text.length === 0) return
@@ -669,6 +848,8 @@ export async function createXmppServer (options = {}) {
       if (error && error.code !== 'ECONNRESET') onError(error)
       endSession(c)
     })
+    // The bytes that came in one read with a PROXY header.
+    if (rest !== null && rest.length > 0) c.onData(rest)
   }
 
   // XMPP over WebSocket (RFC 7395): every byte goes to xmppWsFeed, which
@@ -679,17 +860,19 @@ export async function createXmppServer (options = {}) {
     const got = xmpp.engine.callBlobIO(op, args, bytes)
     return { envelope: got.envelope, bytes: got.bytes instanceof Uint8Array ? got.bytes : new Uint8Array(0) }
   }
-  function onWsConnection (socket) {
+  function onWsConnection (socket, address = socket.remoteAddress, rest = null) {
     let handle
+    let tag = ''
     try {
       const opened = xmpp.engine.call('xmppWsOpen', [xmpp.handle, JSON.stringify({
-        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(socket),
+        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(address),
         path: typeof ws.path === 'string' ? ws.path : '/xmpp-websocket',
         allowedOrigins: Array.isArray(ws.allowedOrigins) ? ws.allowedOrigins : [],
         allowNoOrigin: ws.allowNoOrigin === true,
         tlsCarrier: ws.cert !== undefined && ws.key !== undefined
       })])
       handle = opened.handle
+      if (typeof opened.addressTag === 'string') tag = opened.addressTag
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -700,6 +883,8 @@ export async function createXmppServer (options = {}) {
       bare: null,
       full: null,
       closing: false,
+      lastHeard: Date.now(),
+      pingedAt: 0,
       session: {
         close () {
           try {
@@ -712,11 +897,17 @@ export async function createXmppServer (options = {}) {
         const got = wsCall('xmppWsDeliver', [handle, text], new Uint8Array(0))
         if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); closeIfBacklogged(c); return true }
         return false
+      },
+      ping () {
+        const got = wsCall('xmppWsPing', [handle], new Uint8Array(0))
+        if (got.envelope.sent === true && !socket.destroyed) { socket.write(got.bytes); closeIfBacklogged(c) }
       }
     }
     connections.add(c)
     startLoginTimer(c)
-    socket.on('data', (chunk) => {
+    onLog(`WebSocket connection from ${tag === '' ? 'no address' : 'address ' + tag}`)
+    const onData = (chunk) => {
+      heard(c)
       if (!connections.has(c) || c.closing) return
       let got
       try {
@@ -735,13 +926,16 @@ export async function createXmppServer (options = {}) {
         socket.destroy()
         endSession(c)
       }
-    })
+    }
+    socket.on('data', onData)
     socket.on('end', () => endSession(c))
     socket.on('close', () => endSession(c))
     socket.on('error', (error) => {
       if (error && error.code !== 'ECONNRESET') onError(error)
       endSession(c)
     })
+    // The bytes that came in one read with a PROXY header.
+    if (rest !== null && rest.length > 0) onData(rest)
   }
   let wsServer = null
   if (ws !== null) {
@@ -749,19 +943,34 @@ export async function createXmppServer (options = {}) {
       xmpp.close()
       throw new XmppHostError('the WebSocket listener needs both cert and key for TLS')
     }
-    if (ws.cert !== undefined) {
+    if (proxyProtocol) {
+      const net = await import('node:net')
+      const tls = ws.cert !== undefined ? await import('node:tls') : null
+      wsServer = net.createServer((socket) => {
+        if (tls === null) readProxyHeader(socket, (address, rest) => onWsConnection(socket, address, rest))
+        else acceptTls(tls, socket, { cert: ws.cert, key: ws.key }, (secure, address) => onWsConnection(secure, address))
+      })
+    } else if (ws.cert !== undefined) {
       const tls = await import('node:tls')
-      wsServer = tls.createServer({ cert: ws.cert, key: ws.key }, onWsConnection)
+      wsServer = tls.createServer({ cert: ws.cert, key: ws.key }, (socket) => onWsConnection(socket))
     } else {
       const net = await import('node:net')
-      wsServer = net.createServer(onWsConnection)
+      wsServer = net.createServer((socket) => onWsConnection(socket))
     }
     wsServer.on('connection', admit)
   }
 
   let server
   try {
-    if (useTls) {
+    if (proxyProtocol) {
+      // Every listener is TCP: the header comes before TLS.
+      const net = await import('node:net')
+      const tls = useTls ? await import('node:tls') : null
+      server = net.createServer((socket) => {
+        if (tls === null) readProxyHeader(socket, (address, rest) => onConnection(socket, false, address, rest))
+        else acceptTls(tls, socket, { cert: options.cert, key: options.key }, (secure, address) => onConnection(secure, false, address))
+      })
+    } else if (useTls) {
       const tls = await import('node:tls')
       server = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket))
     } else {
@@ -779,7 +988,13 @@ export async function createXmppServer (options = {}) {
   let directServer = null
   if (startTls && options.directTlsPort !== undefined) {
     const tls = await import('node:tls')
-    directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    if (proxyProtocol) {
+      const net = await import('node:net')
+      directServer = net.createServer((socket) =>
+        acceptTls(tls, socket, { cert: options.cert, key: options.key }, (secure, address) => onConnection(secure, true, address)))
+    } else {
+      directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    }
     directServer.on('connection', admit)
   }
 
@@ -843,6 +1058,7 @@ export async function createXmppServer (options = {}) {
       if (closePromise !== null) return closePromise
       closePromise = (async () => {
         if (poller !== null) clearInterval(poller)
+        if (pinger !== null) clearInterval(pinger)
         for (const c of Array.from(connections)) {
           endSession(c)
           c.socket.destroy()