cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/challenge/state.rs

@@ -2,14 +2,14 @@
 //! tally ([`super::tally`]), the sender's additions and POST log, and the resource timing
 //! format ([`super::reduced_timing`]).
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, HashMap};
 
 use anyhow::{Context, Result, bail, ensure};
 use indexmap::IndexMap;
 use serde::{Deserialize, Deserializer, Serialize};
 use swc_core::ecma::ast::{
-    ArrowExpr, AssignExpr, AssignTarget, BinaryOp, CallExpr, Expr, Function, IfStmt, ObjectLit,
-    SimpleAssignTarget, Stmt, VarDeclarator,
+    ArrowExpr, AssignExpr, AssignTarget, BinaryOp, CallExpr, Expr, FnDecl, Function, Id, IfStmt,
+    MemberExpr, ObjectLit, SimpleAssignTarget, Stmt, VarDeclarator,
 };
 use swc_core::ecma::visit::{Visit, VisitWith};
 
@@ -36,11 +36,21 @@ pub struct ScriptState {
     /// Options copied into the payload under their original names at send time.
     pub forwarded: Vec<String>,
     pub timing: Option<ResourceTiming>,
-    /// Functions on the script's namespace, mapped to the option each returns.
-    pub getters: BTreeMap<String, String>,
+    /// Functions on the script's namespace, by name.
+    pub getters: BTreeMap<String, Getter>,
     pub post_log: Option<PostLog>,
 }
 
+/// A function on the script's namespace that returns an option.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Getter {
+    pub option: String,
+    /// The option holding the page origin, when the getter passes each render sample's stack
+    /// through a helper that replaces URLs on that origin with indices (see
+    /// [`crate::challenge::payload::split_page_urls`]).
+    pub page_origin: Option<String>,
+}
+
 /// Log of challenge POSTs. Each payload includes the log so far. The sender then adds an entry for
 /// the current POST and records its response time when the response arrives.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -208,7 +218,7 @@ impl ScriptState {
             elapsed: elapsed.map(|(_, elapsed)| elapsed),
             forwarded: forwarded.into_iter().map(|(_, key)| key).collect(),
             timing,
-            getters: distinct_getters(sender.getters)?,
+            getters: distinct_getters(sender.getters, &sender.helpers)?,
             post_log,
         })
     }
@@ -400,16 +410,56 @@ struct Sender {
     scopes: Vec<usize>,
     elapsed: Vec<(usize, Elapsed)>,
     copies: Vec<(usize, String)>,
-    getters: Vec<Getter>,
+    getters: Vec<FoundGetter>,
+    /// The first option each declared function reads, by binding.
+    helpers: HashMap<Id, String>,
     pushes: Vec<Push>,
     entries: Vec<LogEntry>,
     stamps: Vec<Stamp>,
 }
 
-/// A namespace getter named `function` that returns the option `option`.
-struct Getter {
+/// A namespace getter named `function` that returns the option `option`, rewriting each
+/// sample's stack with the declared function `rewrite`, if any.
+struct FoundGetter {
     function: String,
     option: String,
+    rewrite: Option<Id>,
+}
+
+/// Finds `<sample>.s = <helper>(<sample>.s)`.
+#[derive(Default)]
+struct StackRewrite(Option<Id>);
+
+impl Visit for StackRewrite {
+    fn visit_assign_expr(&mut self, assignment: &AssignExpr) {
+        if let AssignTarget::Simple(SimpleAssignTarget::Member(target)) = &assignment.left
+            && ast::ident_property(target) == Some("s")
+            && let Expr::Call(call) = &*assignment.right
+            && let Some(helper) = call.callee.as_expr().and_then(|callee| callee.as_ident())
+            && let [argument] = &call.args[..]
+            && let Some(read) = argument.expr.as_member()
+            && ast::ident_property(read) == Some("s")
+        {
+            self.0 = Some(helper.to_id());
+        }
+        assignment.visit_children_with(self);
+    }
+}
+
+/// The first option a function reads.
+#[derive(Default)]
+struct OptionRead(Option<String>);
+
+impl Visit for OptionRead {
+    fn visit_member_expr(&mut self, member: &MemberExpr) {
+        if self.0.is_none()
+            && expression::is_options(&member.obj)
+            && let Some(option) = ast::member_str(&member.prop)
+        {
+            self.0 = Some(option.to_owned());
+        }
+        member.visit_children_with(self);
+    }
 }
 
 /// Matches `_cf_chl_opt.<log>.push(<local>)`.
@@ -503,6 +553,15 @@ impl Visit for Sender {
         self.within(function);
     }
 
+    fn visit_fn_decl(&mut self, declaration: &FnDecl) {
+        let mut read = OptionRead::default();
+        declaration.function.visit_with(&mut read);
+        if let Some(option) = read.0 {
+            self.helpers.insert(declaration.ident.to_id(), option);
+        }
+        declaration.visit_children_with(self);
+    }
+
     fn visit_arrow_expr(&mut self, arrow: &ArrowExpr) {
         self.within(arrow);
     }
@@ -563,9 +622,12 @@ impl Visit for Sender {
                         && let Expr::Assign(first) = &*first.expr
                         && let Some(option) = expression::option_key(&first.right) =>
                 {
-                    self.getters.push(Getter {
+                    let mut rewrite = StackRewrite::default();
+                    getter.function.visit_with(&mut rewrite);
+                    self.getters.push(FoundGetter {
                         function: key.to_owned(),
                         option: option.to_owned(),
+                        rewrite: rewrite.0,
                     });
                 }
                 // `payload.<key> = _cf_chl_opt.<key>`
@@ -589,14 +651,34 @@ impl Visit for Sender {
     }
 }
 
-/// Rejects a getter name that returns different options.
-fn distinct_getters(getters: Vec<Getter>) -> Result<BTreeMap<String, String>> {
+/// Resolves each getter's stack rewrite to the option its helper reads. Rejects a getter name
+/// that returns different options.
+fn distinct_getters(
+    getters: Vec<FoundGetter>,
+    helpers: &HashMap<Id, String>,
+) -> Result<BTreeMap<String, Getter>> {
     let mut distinct = BTreeMap::new();
-    for Getter { function, option } in getters {
-        let previous = distinct.entry(function.clone()).or_insert(option.clone());
+    for found in getters {
+        let function = found.function;
+        let page_origin = found
+            .rewrite
+            .map(|helper| {
+                helpers.get(&helper).cloned().with_context(|| {
+                    format!(
+                        "getter {function} rewrites stacks with unknown helper {}",
+                        helper.0
+                    )
+                })
+            })
+            .transpose()?;
+        let getter = Getter {
+            option: found.option,
+            page_origin,
+        };
+        let previous = distinct.entry(function.clone()).or_insert(getter.clone());
         ensure!(
-            *previous == option,
-            "getter {function} reads both {previous} and {option}"
+            *previous == getter,
+            "getter {function} reads both {previous:?} and {getter:?}"
         );
     }
     Ok(distinct)

data/vendor/cfsolve/src/deobfuscate/encoded_strings.rs

@@ -348,8 +348,9 @@ mod tests {
     fn decodes_escaped_code_units() {
         use base64::Engine;
 
-        // 255 escapes the code unit U+D800, a lone surrogate.
-        let encoded = super::STANDARD.encode([255 ^ 0x05, 0x00 ^ 0xe7, 0xd8 ^ 0x05]);
+        // 255 escapes the code unit U+D800, a lone surrogate. The bytes 255, 0x00, 0xd8 are
+        // XORed with the key 59141 (0xe705), low byte first.
+        let encoded = super::STANDARD.encode([255 ^ 0x05, 0xe7, 0xd8 ^ 0x05]);
         let decoded = super::decode(&encoded, 59141).unwrap();
         assert_eq!(
             decoded.as_wtf8().to_ill_formed_utf16().collect::<Vec<_>>(),

data/vendor/cfsolve/src/deobfuscate/helper_objects.rs

@@ -74,10 +74,10 @@ impl ObjectProperties {
             }
             // A regular expression carries state and identity, so it cannot
             // stand in for every read.
-            Expr::Lit(literal) if !matches!(literal, Lit::Regex(_)) => {
-                self.literals.insert(name, value.clone());
-            }
-            Expr::Tpl(template) if template.exprs.is_empty() => {
+            Expr::Lit(Lit::Regex(_)) => {}
+            // Decoded strings may print as templates without substitutions.
+            Expr::Tpl(template) if !template.exprs.is_empty() => {}
+            Expr::Lit(_) | Expr::Tpl(_) => {
                 self.literals.insert(name, value.clone());
             }
             _ => {}
@@ -489,7 +489,10 @@ fn commutes(first: &Expr, second: &Expr, globals: Globals) -> bool {
 fn eager_operands(result: &Expr) -> Option<Vec<&Expr>> {
     match result {
         Expr::Paren(paren) => eager_operands(&paren.expr),
-        Expr::Unary(unary) if unary.op != UnaryOp::Delete => eager_operands(&unary.arg),
+        // A unary operator applies to its evaluated operand, as the call would.
+        Expr::Unary(unary) if unary.op != UnaryOp::Delete => {
+            eager_operands(&unary.arg).or_else(|| Some(vec![&unary.arg]))
+        }
         Expr::Bin(binary) if !binary.op.may_short_circuit() => {
             Some(vec![&binary.left, &binary.right])
         }
@@ -776,33 +779,6 @@ mod tests {
         assert!(!output.contains("(0, plain)"), "{output}");
     }
 
-    #[test]
-    fn inlines_static_template_properties_without_evaluating_interpolation() {
-        let output = transform(
-            r"function f() {
-                var helper;
-                helper = { first: `fixed` };
-                helper.second = `line\n\u{1f600}\ud800`;
-                helper.dynamic = `value:${read()}`;
-                return function() { return [helper.first, helper.second, helper.dynamic]; };
-            }",
-        );
-        testing::assert_contains(
-            &output,
-            &[],
-            &[r"return [`fixed`, `line\n\u{1f600}\ud800`, helper.dynamic]"],
-        );
-        let output = transform(
-            r"function f() {
-                var helper;
-                helper = { name: `before` };
-                helper.name = `after`;
-                return helper.name;
-            }",
-        );
-        assert!(output.contains("return helper.name;"), "{output}");
-    }
-
     #[test]
     fn inlines_member_assigned_properties_and_helper_functions() {
         let output = transform(
@@ -811,6 +787,15 @@ mod tests {
         );
         assert!(output.contains("(1) + (2)"), "{output}");
         testing::assert_lacks(&output, &["p.name", "h.name]"]);
+        // Static templates inline into later callbacks, as in a payload built after a delay.
+        let output = transform(
+            "function f(h, g) { h = { key: `_field` }; g(function () { return w[h.key]; }); }",
+        );
+        assert!(output.contains("w[`_field`]"), "{output}");
+        // A unary helper evaluates its argument first either way, even a member read.
+        let output =
+            transform("function f(n) { n = function (a) { return !a; }; if (n(w.x)) g(); }");
+        assert!(output.contains("!(w.x)"), "{output}");
         // Helper functions inline when they name only what callers see.
         let output = transform(
             "function f(add, call, read, g) { add = function(a, b) { return a + b; }; \

data/vendor/cfsolve/src/deobfuscate/register_arrays.rs

@@ -14,7 +14,9 @@
 //! expression so its side effects still run.
 //!
 //! Undefined slots need no assignment if the literal runs at most once per call, in the
-//! declaring function and outside loops. The replacement locals already start undefined.
+//! declaring function and outside loops. The replacement locals already start undefined. A
+//! `void` element there keeps only its operand, so a constant hidden as `void (k ^ x ^ (k ^ x))`
+//! leaves the slot's later write as its local's only one, which copy propagation can inline.
 
 use swc_core::common::util::take::Take;
 use swc_core::common::{DUMMY_SP, Mark, SyntaxContext};
@@ -394,13 +396,19 @@ impl Split<'_> {
                 let mut assignments: Vec<Box<Expr>> = self
                     .initial(array, literal)
                     .into_iter()
-                    .map(|(local, value)| {
-                        Box::new(Expr::Assign(AssignExpr {
+                    .map(|(local, value)| match *value {
+                        // The local already starts undefined, so only the operand runs.
+                        Expr::Unary(UnaryExpr {
+                            op: UnaryOp::Void,
+                            arg,
+                            ..
+                        }) if !array.assign_undefined => arg,
+                        value => Box::new(Expr::Assign(AssignExpr {
                             span: DUMMY_SP,
                             op: AssignOp::Assign,
                             left: AssignTarget::Simple(SimpleAssignTarget::Ident(local.into())),
-                            right: value,
-                        }))
+                            right: Box::new(value),
+                        })),
                     })
                     .collect();
                 Some(match assignments.len() {
@@ -495,6 +503,11 @@ mod tests {
         );
         testing::assert_contains(&output, &[], &["h(r_0);", "r_0 = i;"]);
         testing::assert_lacks(&output, &["r_0 = void 0", "["]);
+        // A `void` element runs its operand without writing the local.
+        let output =
+            transform("function f() { var r; r = [void (7 ^ k ^ (7 ^ k))]; r[0] = 1; g(r[0]); }");
+        testing::assert_contains(&output, &[], &["7 ^ k ^ (7 ^ k);", "r_0 = 1;", "g(r_0);"]);
+        testing::assert_lacks(&output, &["r_0 = void"]);
         // A creation in a loop resets the slots on every iteration.
         let output =
             transform("function f() { var r; while (g()) { r = [void 0]; h(r[0]); r[0] = 1; } }");

data/vendor/cfsolve/src/embedding_page/extra_params.rs

@@ -434,20 +434,6 @@ pub(crate) fn widget_id() -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::challenge::reduced_timing::Measure;
-
-    fn page() -> RenderedPage {
-        RenderedPage::render(
-            r#"<html><head><title>t</title>
-            <script src="https://challenges.cloudflare.com/turnstile/v0/api.js"></script></head>
-            <body><div class="cf-turnstile" data-sitekey="0x4AAA" data-action="login"
-                data-theme="dark" data-size="compact" data-language="de"></div></body></html>"#,
-            Url::parse("https://example.com/login").unwrap(),
-            "j5gbk",
-            None,
-        )
-        .unwrap()
-    }
 
     #[test]
     fn finds_build_hashes_and_routes_only_where_the_loader_keeps_them() {

data/vendor/cfsolve/src/embedding_page/page.rs

@@ -1,7 +1,7 @@
 //! Reconstructs the page after `api.js` renders a widget. Builds the `wPr` page summary sent in
 //! the `requestExtraParams` reply.
 
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap};
 use std::iter;
 
 use anyhow::{Context, Result};
@@ -40,6 +40,9 @@ pub(crate) struct Layout {
     /// Widget position set by a challenge page's stylesheet for this viewport. Overrides the
     /// other position settings.
     pub challenge_page: Option<Placement>,
+    /// Widget positions set by embedding pages' stylesheets for this viewport, measured in the
+    /// browser, by page URL. Each overrides the other position settings on its page.
+    pub embedding_pages: BTreeMap<String, Placement>,
 }
 
 impl Default for Layout {
@@ -53,6 +56,7 @@ impl Default for Layout {
             widget_right: None,
             widget_left: 8.0,
             challenge_page: None,
+            embedding_pages: BTreeMap::new(),
         }
     }
 }
@@ -69,8 +73,14 @@ impl Layout {
     /// Layout settings for a widget positioned by a challenge page's stylesheet.
     #[must_use]
     pub(crate) fn on_challenge_page(&self) -> Self {
+        self.placed(self.challenge_page.as_ref())
+    }
+
+    /// Layout settings for a widget at `placement`, if any.
+    #[must_use]
+    pub(crate) fn placed(&self, placement: Option<&Placement>) -> Self {
         let mut layout = self.clone();
-        if let Some(placement) = &self.challenge_page {
+        if let Some(placement) = placement {
             layout.widget_top = placement.top;
             layout.widget_left = placement.left;
             layout.widget_right = Some(placement.right);
@@ -950,6 +960,22 @@ mod tests {
         json!(page.signals(&Layout::default(), None))
     }
 
+    #[test]
+    fn placements_override_the_widget_position() {
+        let placement = Placement {
+            top: 166.875,
+            left: 363.0,
+            right: 1003.0,
+        };
+        let placed = Layout::default().placed(Some(&placement));
+        assert_eq!(
+            (placed.widget_top, placed.widget_left, placed.widget_right),
+            (166.875, 363.0, Some(1003.0))
+        );
+        let unplaced = Layout::default().placed(None);
+        assert_eq!((unplaced.widget_top, unplaced.widget_right), (8.0, None));
+    }
+
     #[test]
     fn reproduces_a_captured_sessions_page_signals() {
         let layout = Layout {

data/vendor/cfsolve/src/http/client.rs

@@ -3,6 +3,7 @@
 use std::collections::BTreeMap;
 use std::sync::Arc;
 use std::time::Duration;
+use std::{env, fs};
 
 use anyhow::{Context, Result, ensure};
 #[cfg(feature = "internals")]
@@ -13,6 +14,7 @@ use wreq::cookie::{Cookie, Jar};
 use wreq::header::HeaderMap;
 use wreq::http2::{StreamDependency, StreamId};
 use wreq::redirect::Policy;
+use wreq::tls::trust::CertStore;
 use wreq::ws::{WebSocket, WebSocketRequestBuilder};
 use wreq::{Client, Proxy, RequestBuilder, Response};
 #[cfg(feature = "internals")]
@@ -24,6 +26,10 @@ use super::decode;
 use super::header_order::{HeaderOrder, RequestKind, Slot};
 use crate::engine::Engine;
 
+/// Environment variable naming a PEM certificate to trust instead of the built-in roots, such as
+/// `capture-proxy`'s CA, so a solve can be recorded in the same format as a browser session.
+const PROXY_CA: &str = "CFSOLVE_PROXY_CA";
+
 /// HTTP client configured from the browser fingerprint. Shared by all session requests to
 /// preserve cookies and transport settings.
 pub struct BrowserClient {
@@ -113,6 +119,11 @@ impl BrowserClient {
         if let Some(proxy) = proxy {
             builder = builder.proxy(Proxy::all(proxy)?);
         }
+        if let Some(path) = env::var_os(PROXY_CA) {
+            let pem = fs::read(&path)
+                .with_context(|| format!("reading {PROXY_CA} {}", path.to_string_lossy()))?;
+            builder = builder.tls_cert_store(CertStore::from_pem_certs([&pem[..]])?);
+        }
         Ok(Self {
             http: builder.build()?,
             jar,

data/vendor/cfsolve/src/js/ast.rs

@@ -9,7 +9,8 @@ use anyhow::{Result, ensure};
 use swc_core::atoms::Wtf8Atom;
 use swc_core::common::sync::Lrc;
 use swc_core::common::{
-    BytePos, DUMMY_SP, FileName, SourceFile, SourceMap, Spanned, SyntaxContext,
+    BytePos, DUMMY_SP, FileName, GLOBALS, Globals, Mark, SourceFile, SourceMap, Spanned,
+    SyntaxContext,
 };
 use swc_core::ecma::ast::{
     AssignExpr, AssignOp, BinaryOp, BlockStmt, Expr, ExprOrSpread, ExprStmt, FnDecl, Function, Id,
@@ -17,7 +18,8 @@ use swc_core::ecma::ast::{
     PropOrSpread, Script, Stmt, UnaryOp, VarDeclarator,
 };
 use swc_core::ecma::parser::{Parser, StringInput, Syntax};
-use swc_core::ecma::visit::{Visit, VisitWith};
+use swc_core::ecma::visit::{Visit, VisitMutWith, VisitWith};
+use swc_ecma_transforms::resolver;
 
 use crate::engine::{self, Lines};
 
@@ -53,8 +55,15 @@ impl ParsedScript {
     }
 }
 
+/// Parses the deobfuscated iframe script and resolves its scopes, so a binding's [`Id`]
+/// identifies it even where other scopes reuse its name.
 pub(crate) fn parse_iframe_javascript(source: &str) -> Result<ParsedScript> {
-    parse_javascript("deobfuscated iframe", source)
+    let mut parsed = parse_javascript("deobfuscated iframe", source)?;
+    GLOBALS.set(&Globals::new(), || {
+        let mut resolve = resolver(Mark::new(), Mark::new(), false);
+        parsed.script.visit_mut_with(&mut resolve);
+    });
+    Ok(parsed)
 }
 
 /// Parses `source`, using `what` to identify it in errors.

data/vendor/cfsolve/src/js/objects.rs

@@ -3,17 +3,24 @@
 
 use std::ops::{Deref, DerefMut};
 
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize, Serializer};
 
 use crate::js::{JsObject, JsValue};
 
 macro_rules! object {
     ($(#[$doc:meta])* $name:ident) => {
         $(#[$doc])*
-        #[derive(Clone, Debug, Default, PartialEq, Deserialize, Serialize)]
+        #[derive(Clone, Debug, Default, PartialEq, Deserialize)]
         #[serde(transparent)]
         pub struct $name(JsObject);
 
+        /// Serializes as `JSON.stringify` does, leaving out `undefined` properties.
+        impl Serialize for $name {
+            fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+                serializer.collect_map(self.0.iter().filter(|(_, value)| !value.is_undefined()))
+            }
+        }
+
         impl $name {
             #[must_use]
             pub fn new() -> Self {

data/vendor/cfsolve/src/listing/fold.rs

@@ -163,89 +163,6 @@ impl<X: Clone> Frame<X> {
     }
 }
 
-/// Newer initial programs inline their string decoder: charCodeAt builds a
-/// length and slice removes the descriptor header and padding. Fold only known
-/// values, without executing the script or guessing randomized global names.
-pub(crate) fn constant<X: Clone>(frame: &Frame<X>, value: &Term) -> Option<JsValue> {
-    if let Some(Known::Literal(value) | Known::Decoded(value)) = frame.resolve(value) {
-        return Some(value);
-    }
-    match value {
-        Term::Binary(operator, left, right) => {
-            let left = constant(frame, left)?;
-            let right = constant(frame, right)?;
-            match (operator, left, right) {
-                (BinaryOp::Add, JsValue::String(left), JsValue::String(right)) => {
-                    Some(JsValue::String(left + right.as_str()))
-                }
-                (BinaryOp::Add, JsValue::Number(left), JsValue::Number(right)) => {
-                    Some(JsValue::Number(left + right))
-                }
-                (BinaryOp::Mul, JsValue::Number(left), JsValue::Number(right)) => {
-                    Some(JsValue::Number(left * right))
-                }
-                _ => None,
-            }
-        }
-        Term::Call {
-            callee,
-            this,
-            arguments,
-        } => {
-            let Term::Get(object, method) = &**callee else {
-                return None;
-            };
-            let object = constant(frame, object)?;
-            // The method must belong to a known string, but an explicit receiver can differ.
-            object.as_str()?;
-            let receiver = match this {
-                Some(this) => constant(frame, this)?,
-                None => object,
-            };
-            let units: Vec<u16> = receiver.as_str()?.encode_utf16().collect();
-            let method = constant(frame, method)?;
-            let arguments: Option<Vec<JsValue>> = arguments
-                .iter()
-                .map(|argument| constant(frame, argument))
-                .collect();
-            let arguments = arguments?;
-            match (method.as_str()?, arguments.as_slice()) {
-                ("charCodeAt", [JsValue::Number(position)]) => {
-                    let position = if position.is_nan() {
-                        0.0
-                    } else {
-                        position.trunc()
-                    };
-                    let code = if position >= 0.0 && position < units.len() as f64 {
-                        f64::from(units[position as usize])
-                    } else {
-                        f64::NAN
-                    };
-                    Some(JsValue::Number(code))
-                }
-                ("slice", [JsValue::Number(start), JsValue::Number(end)]) => {
-                    let index = |value: f64| {
-                        let value = if value.is_nan() { 0.0 } else { value.trunc() };
-                        let value = if value < 0.0 {
-                            units.len() as f64 + value
-                        } else {
-                            value
-                        };
-                        value.clamp(0.0, units.len() as f64) as usize
-                    };
-                    let start = index(*start);
-                    let end = index(*end).max(start);
-                    String::from_utf16(&units[start..end])
-                        .ok()
-                        .map(JsValue::String)
-                }
-                _ => None,
-            }
-        }
-        _ => None,
-    }
-}
-
 /// Intersects register facts from incoming paths. Temporaries do not cross instruction boundaries.
 impl<X: Clone + PartialEq> Facts for Frame<X> {
     fn meet(&mut self, other: &Self) -> bool {