@fuzdev/fuz_app 0.144.0 → 0.146.0

package/dist/db/fact_queries.js

@@ -113,6 +113,21 @@ export const query_delete_fact = async (deps, hash) => {
         return null;
     return { size: Number(row.size), external_url: row.external_url };
 };
+/**
+ * The grace-window half of the orphan cutoff: no `fact_holder` row was
+ * recorded (or refreshed) at or after `$1`. A dedup put adds no `fact` row,
+ * so `fact.created_at` stays at the first insert — without this, an old
+ * orphan an actor re-uploads looks stale, and a sweep between the upload and
+ * the cell write that references it deletes the fact (and, by cascade, the
+ * possession the write needs). A fact counts as recent when its own
+ * `created_at` or any holder's is within the window. Served by
+ * `idx_fact_holder_hash`. Twin of the Rust `ORPHAN_FACT_NOT_RECENTLY_HELD`.
+ */
+const ORPHAN_FACT_NOT_RECENTLY_HELD = `NOT EXISTS (
+		   SELECT 1 FROM fact_holder h
+		   WHERE h.hash = f.hash
+		     AND h.created_at >= $1::timestamptz
+		 )`;
 /**
  * Compute the "orphan facts" set: rows in `fact` where no active
  * (non-tombstone) `cell.refs` array contains the hash.
@@ -124,14 +139,15 @@ export const query_delete_fact = async (deps, hash) => {
  * outputs? external fact mirrors?) the predicate moves to a generic
  * `fact_consumers` registry; today the cell layer is the only consumer.
  *
- * The `older_than` filter applies to `fact.created_at`. Pass `null`
- * to skip the filter (used by the list-summary preview); the delete
- * handler always passes a non-null cutoff (default 0, meaning "any
- * orphan").
+ * The `older_than` filter is the grace cutoff: a fact passes it when both
+ * its `created_at` and every `fact_holder` row's are older (a re-put
+ * refreshes the holder row). Pass `null` to skip the filter (used by the
+ * list-summary preview); the delete handler always passes a non-null
+ * cutoff (default 0, meaning "any orphan").
  *
  * @param deps - query deps
- * @param older_than - filter to facts created before this Date (or null
- *   to skip)
+ * @param older_than - filter to facts created, and last put by any holder,
+ *   before this Date (or null to skip)
  * @param sample_limit - row cap for the returned `sample`
  */
 export const query_orphan_facts_list = async (deps, older_than, sample_limit) => {
@@ -142,7 +158,8 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND ($1::timestamptz IS NULL OR f.created_at < $1::timestamptz)`, [older_than]);
+		 AND ($1::timestamptz IS NULL
+		      OR (f.created_at < $1::timestamptz AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}))`, [older_than]);
     const sample_rows = await deps.db.query(`SELECT hash, size, ${iso8601_timestamp_column('f', 'created_at')} AS created_at, external_url
 		 FROM fact f
 		 WHERE NOT EXISTS (
@@ -150,7 +167,8 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND ($1::timestamptz IS NULL OR f.created_at < $1::timestamptz)
+		 AND ($1::timestamptz IS NULL
+		      OR (f.created_at < $1::timestamptz AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}))
 		 ORDER BY f.created_at ASC
 		 LIMIT $2`, [older_than, sample_limit]);
     return {
@@ -169,7 +187,9 @@ export const query_orphan_facts_list = async (deps, older_than, sample_limit) =>
  * (no row-count limit) — callers iterate to unlink disk files. The
  * `older_than` cutoff is required (non-null) here: bulk delete should
  * always be operator-scoped to a time window. A "delete all" sweep
- * passes a far-future cutoff, not `null`.
+ * passes a far-future cutoff, not `null`. It is the same grace cutoff as
+ * `query_orphan_facts_list`: a fact put — or re-put, deduplicated — by an
+ * actor within the window is kept, whatever its own `created_at`.
  */
 export const query_orphan_facts_select_for_delete = async (deps, older_than) => {
     const rows = await deps.db.query(`SELECT hash, size, external_url
@@ -179,6 +199,7 @@ export const query_orphan_facts_select_for_delete = async (deps, older_than) =>
 		   WHERE c.refs @> ARRAY[f.hash]::text[]
 		     AND c.deleted_at IS NULL
 		 )
-		 AND f.created_at < $1::timestamptz`, [older_than]);
+		 AND f.created_at < $1::timestamptz
+		 AND ${ORPHAN_FACT_NOT_RECENTLY_HELD}`, [older_than]);
     return rows.map((r) => ({ hash: r.hash, size: Number(r.size), external_url: r.external_url }));
 };

package/dist/http/CLAUDE.md

@@ -52,7 +52,7 @@ consumers.
 - `input: z.ZodType` — request body schema; `z.null()` for no-body (GET/DELETE)
 - `output: z.ZodType` — success response schema
 - `mints_credential?: boolean` — the route issues a session cookie while declaring no auth (login, signup, bootstrap); assembly refuses it outside `AUTH_MIDDLEWARE_PATH`, as it does any route whose `auth.account` is not `'none'` (`assert_credential_routes_in_auth_scope` in `auth/middleware.ts`)
-- `reads_credential?: boolean` — the handler reads the resolved account while the route declares no auth gate, answering an anonymous caller itself (account status, the cell-scoped fact read, `create_rpc_endpoint`'s pair, whose dispatcher gates per action); held inside `AUTH_MIDDLEWARE_PATH` by the same assertion
+- `reads_credential?: boolean` — the handler reads the resolved account while the route declares no auth gate, answering an anonymous caller itself (account status, the cell-scoped fact read, `create_rpc_endpoint`'s pair, whose dispatcher gates per action); held inside `AUTH_MIDDLEWARE_PATH` by the same assertion. Such a handler reads the account through `get_public_account_id` (`auth/request_context.ts`), which answers a scope-narrowed token as anonymous — the RPC pair excepted, its dispatcher gating each method
 - `rate_limit?: RateLimitKey` — metadata only (`'ip' | 'account' | 'both'`); auto-derives 429
 - `errors?: RouteErrorSchemas` — handler-specific error schemas keyed by HTTP status
 - `transaction?: boolean` — declarative transaction wrapping (see below)
@@ -315,7 +315,7 @@ rate-limiting middleware (see root ../../../CLAUDE.md §Middleware Ordering).
 
 Per-symbol semantics on TSDoc; the cross-cutting properties:
 
-- **Rightmost-first XFF walk**, skipping trusted entries AND entries that fail strict validation. Closes a rate-limit-key-poisoning surface where an attacker who controls XFF and transits through a trusted proxy could rotate garbage strings to evade per-IP limits.
+- **Rightmost-first XFF walk, skipping trusted entries; the first entry that fails strict validation stops the walk and the request keys on the connection IP.** Stopping, not skipping, keeps a client-written entry left of a non-bare-IP hop (`ip:port`, `unknown`) from picking the bucket.
 - **`validate_ip_strict(ip)`** is defensive against Hono's lax `distinctRemoteAddr` (which classifies anything-with-colons as IPv6 and accepts `'[::1]:8080'`, `'::1\n'` as binary-valid). Two-layer check: character-set pre-filter + round-trip through `convertIPv*ToBinary`.
 - **`normalize_ip(ip)`** delegates to `canonicalize_ip` from `http/ip_canonical.ts` — RFC 5952 lowercase + longest-zero-run compression, IPv4-mapped IPv6 stripped to plain IPv4 so buckets collapse. Idempotent, safe on non-IP strings, strict char-set filter preserves malformed forms unchanged.
 - **Three-branch middleware logic**: no XFF → use connection IP; XFF + connection untrusted → ignore XFF, use connection IP (spoof-proof, debug log); XFF + connection trusted → resolve from header, warn if all entries turn out trusted.

package/dist/http/auth_shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;kBAyEnB,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}
+{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;kBA8EnB,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}

package/dist/http/auth_shape.js

@@ -138,9 +138,9 @@ export const RouteAuth = z
      *
      * - `surface:<name>` — a non-RPC surface, refused to every narrowed token
      *   whatever its method list says (token scoping's rule that a narrowed
-     *   token is RPC-only). `surface:audit_stream`, `surface:fact_bare`, and
-     *   `surface:app_surface` are the spine's route-spec ones; a consumer names
-     *   its own without registering it.
+     *   token is RPC-only). `surface:audit_stream`, `surface:fact_bare`,
+     *   `surface:account_verify`, and `surface:app_surface` are the spine's
+     *   route-spec ones; a consumer names its own without registering it.
      * - `rpc:<method>` — one action method, refused unless the token lists it.
      *   What a route bridged from an `ActionSpec` declares: it carries the
      *   method's identity but never reaches the dispatcher's per-method gate.
@@ -151,9 +151,14 @@ export const RouteAuth = z
      * account lacks the role would be told about the role rather than about the
      * scope).
      *
-     * Opt-in rather than blanket: the account REST routes cross no boundary, and
-     * the RPC endpoint runs its own per-method check inside the dispatcher — and
-     * both are route specs too.
+     * Opt-in rather than blanket: no narrowed token reaches login (which reads
+     * no credential) or logout and the password change (session-only), the
+     * RPC endpoint runs its own per-method check inside the dispatcher, the
+     * `reads_credential` routes that answer anonymous callers (account status,
+     * the cell-scoped fact read) can't take the field and answer a narrowed
+     * token as anonymous in their handler (`get_public_account_id`), and the
+     * server-status route admits a narrowed token by design — and all are
+     * route specs too.
      *
      * Typed as a plain string here to keep `http/` from importing `auth/`; the
      * resolver parses it at registration and throws on a malformed one.

package/dist/http/proxy.d.ts

@@ -102,30 +102,30 @@ export declare const is_trusted_ip: (ip: string, proxies: Array<ParsedProxy>) =>
 /**
  * Resolve the real client IP from an `X-Forwarded-For` header value.
  *
- * Walks right-to-left, skipping trusted proxy entries AND any entry
- * that fails strict IP validation (`validate_ip_strict`). The first
- * untrusted, strictly-valid entry is the client IP. If every walked
- * entry is trusted or malformed, returns the leftmost strictly-valid
- * (trusted) entry (likely-misconfigured all-trusted case) or
- * `undefined` (everything was malformed — middleware falls back to
- * the connection IP). All entries are normalized before matching and
- * in the returned value.
- *
- * Skipping malformed entries is the rate-limit-key fix for the
- * "attacker controls XFF and the proxy passes it through" surface —
- * without the skip, an attacker could rotate arbitrary strings (incl.
+ * Walks right-to-left, skipping trusted proxy entries. The first untrusted
+ * entry is the client IP. The walk **stops** at the first entry that fails
+ * strict IP validation (`validate_ip_strict`) and returns `undefined`, so the
+ * middleware falls back to the connection IP: an entry is only as
+ * trustworthy as the hop that wrote it, and everything left of a malformed
+ * one was written before any trusted hop vouched for it. If every entry is
+ * trusted, returns the leftmost one (likely-misconfigured all-trusted case).
+ * Empty entries are dropped before the walk. All entries are normalized
+ * before matching and in the returned value.
+ *
+ * Stopping, not skipping, is the rate-limit-key rule. Returning a malformed
+ * entry would let an attacker rotate arbitrary strings (incl.
  * `'attacker:controlled'`, which Hono's lax `distinctRemoteAddr`
- * misclassifies as IPv6) as XFF values to get fresh per-IP rate-limit
- * buckets. Tradeoff: legitimate non-standard proxies that include
- * ports in XFF entries (e.g. `203.0.113.1:8080`) also fail strict
- * validation, so those entries get skipped and the rate-limit bucket
- * collapses to the proxy's connection IP (one bucket for everyone
- * behind that proxy). Standard proxies (nginx, cloud LBs) don't
- * include ports.
+ * misclassifies as IPv6) into fresh per-IP rate-limit buckets; skipping it
+ * and walking on would hand the key to the entry the client wrote whenever a
+ * trusted hop appends a non-bare-IP token (`ip:port`, `[v6]:port`,
+ * `unknown`, `unix:`). Tradeoff: behind such a proxy every client collapses
+ * to the proxy's connection IP in rate limiting (one bucket for everyone
+ * behind it). Standard proxies (nginx's `$remote_addr`, cloud LBs) append
+ * bare IPs.
  *
  * @param forwarded_for - the `X-Forwarded-For` header value
  * @param proxies - parsed trusted proxy entries
- * @returns the normalized client IP, or `undefined` if the header is empty / all entries malformed
+ * @returns the normalized client IP, or `undefined` if the header is empty or the walk met a malformed entry
  */
 export declare const resolve_client_ip: (forwarded_for: string, proxies: Array<ParsedProxy>) => string | undefined;
 /**
@@ -139,7 +139,8 @@ export declare const resolve_client_ip: (forwarded_for: string, proxies: Array<P
  * 2. `X-Forwarded-For` present but connection is untrusted → ignore header
  *    (spoofed by a direct attacker), use connection IP.
  * 3. `X-Forwarded-For` present and connection is trusted → walk header
- *    right-to-left, strip trusted entries, use first untrusted entry.
+ *    right-to-left, strip trusted entries, use first untrusted entry; a
+ *    malformed entry stops the walk and the connection IP is used.
  *
  * @param options - trusted proxy configuration
  * @mutates `c.var.client_ip` - set to the resolved (or `'unknown'`) client IP per request

package/dist/http/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,IAAI,MAAM,KAAG,MAA6B,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,sFAAsF;IACtF,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,+DAA+D;IAC/D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,WA6CjD,CAAC;AAiBF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,kBAAkB,GAAI,IAAI,MAAM,KAAG,MAAM,GAAG,MAAM,GAAG,SAWjE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,EAAE,SAAS,KAAK,CAAC,WAAW,CAAC,KAAG,OAqBvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,iBAAiB,GAC7B,eAAe,MAAM,EACrB,SAAS,KAAK,CAAC,WAAW,CAAC,KACzB,MAAM,GAAG,SA0BX,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,YAAY,KAAG,iBAyC/D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,YAAY,KAAG,cAInE,CAAC"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,IAAI,MAAM,KAAG,MAA6B,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,sFAAsF;IACtF,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,+DAA+D;IAC/D,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,WA6CjD,CAAC;AAiBF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,kBAAkB,GAAI,IAAI,MAAM,KAAG,MAAM,GAAG,MAAM,GAAG,SAWjE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,EAAE,SAAS,KAAK,CAAC,WAAW,CAAC,KAAG,OAqBvE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,iBAAiB,GAC7B,eAAe,MAAM,EACrB,SAAS,KAAK,CAAC,WAAW,CAAC,KACzB,MAAM,GAAG,SAqBX,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,YAAY,KAAG,iBAyC/D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,YAAY,KAAG,cAInE,CAAC"}

package/dist/http/proxy.js

@@ -172,30 +172,30 @@ export const is_trusted_ip = (ip, proxies) => {
 /**
  * Resolve the real client IP from an `X-Forwarded-For` header value.
  *
- * Walks right-to-left, skipping trusted proxy entries AND any entry
- * that fails strict IP validation (`validate_ip_strict`). The first
- * untrusted, strictly-valid entry is the client IP. If every walked
- * entry is trusted or malformed, returns the leftmost strictly-valid
- * (trusted) entry (likely-misconfigured all-trusted case) or
- * `undefined` (everything was malformed — middleware falls back to
- * the connection IP). All entries are normalized before matching and
- * in the returned value.
+ * Walks right-to-left, skipping trusted proxy entries. The first untrusted
+ * entry is the client IP. The walk **stops** at the first entry that fails
+ * strict IP validation (`validate_ip_strict`) and returns `undefined`, so the
+ * middleware falls back to the connection IP: an entry is only as
+ * trustworthy as the hop that wrote it, and everything left of a malformed
+ * one was written before any trusted hop vouched for it. If every entry is
+ * trusted, returns the leftmost one (likely-misconfigured all-trusted case).
+ * Empty entries are dropped before the walk. All entries are normalized
+ * before matching and in the returned value.
  *
- * Skipping malformed entries is the rate-limit-key fix for the
- * "attacker controls XFF and the proxy passes it through" surface —
- * without the skip, an attacker could rotate arbitrary strings (incl.
+ * Stopping, not skipping, is the rate-limit-key rule. Returning a malformed
+ * entry would let an attacker rotate arbitrary strings (incl.
  * `'attacker:controlled'`, which Hono's lax `distinctRemoteAddr`
- * misclassifies as IPv6) as XFF values to get fresh per-IP rate-limit
- * buckets. Tradeoff: legitimate non-standard proxies that include
- * ports in XFF entries (e.g. `203.0.113.1:8080`) also fail strict
- * validation, so those entries get skipped and the rate-limit bucket
- * collapses to the proxy's connection IP (one bucket for everyone
- * behind that proxy). Standard proxies (nginx, cloud LBs) don't
- * include ports.
+ * misclassifies as IPv6) into fresh per-IP rate-limit buckets; skipping it
+ * and walking on would hand the key to the entry the client wrote whenever a
+ * trusted hop appends a non-bare-IP token (`ip:port`, `[v6]:port`,
+ * `unknown`, `unix:`). Tradeoff: behind such a proxy every client collapses
+ * to the proxy's connection IP in rate limiting (one bucket for everyone
+ * behind it). Standard proxies (nginx's `$remote_addr`, cloud LBs) append
+ * bare IPs.
  *
  * @param forwarded_for - the `X-Forwarded-For` header value
  * @param proxies - parsed trusted proxy entries
- * @returns the normalized client IP, or `undefined` if the header is empty / all entries malformed
+ * @returns the normalized client IP, or `undefined` if the header is empty or the walk met a malformed entry
  */
 export const resolve_client_ip = (forwarded_for, proxies) => {
     const entries = [];
@@ -206,26 +206,20 @@ export const resolve_client_ip = (forwarded_for, proxies) => {
     }
     if (entries.length === 0)
         return undefined;
-    // Walk from right to left, skip trusted proxies and malformed entries.
-    // Returning a malformed entry as the client IP would let an attacker
-    // who controls XFF poison the per-IP rate-limit key.
+    // Walk from right to left, skipping trusted proxies; stop at a malformed
+    // entry. Everything left of it is client-written, so neither it nor any
+    // entry past it may pick the per-IP rate-limit key.
     for (let i = entries.length - 1; i >= 0; i--) {
         const entry = entries[i];
         if (!validate_ip_strict(entry))
-            continue;
+            return undefined;
         if (!is_trusted_ip(entry, proxies)) {
             return entry;
         }
     }
-    // Every entry was trusted or malformed. Prefer the leftmost
-    // strictly-valid (trusted) entry — the misconfiguration warn in
-    // the middleware fires on it. If none, fall through to undefined
-    // and let the middleware fall back to the connection IP.
-    for (const entry of entries) {
-        if (validate_ip_strict(entry))
-            return entry;
-    }
-    return undefined;
+    // Every entry was valid and trusted — the leftmost one; the
+    // misconfiguration warn in the middleware fires on it.
+    return entries[0];
 };
 /**
  * Create a Hono middleware that resolves the client IP from trusted proxies.
@@ -238,7 +232,8 @@ export const resolve_client_ip = (forwarded_for, proxies) => {
  * 2. `X-Forwarded-For` present but connection is untrusted → ignore header
  *    (spoofed by a direct attacker), use connection IP.
  * 3. `X-Forwarded-For` present and connection is trusted → walk header
- *    right-to-left, strip trusted entries, use first untrusted entry.
+ *    right-to-left, strip trusted entries, use first untrusted entry; a
+ *    malformed entry stops the walk and the connection IP is used.
  *
  * @param options - trusted proxy configuration
  * @mutates `c.var.client_ip` - set to the resolved (or `'unknown'`) client IP per request

package/dist/http/route_spec.d.ts

@@ -169,6 +169,14 @@ export interface RouteSpec {
      * and it would see every caller as anonymous, so assembly refuses it
      * there (`assert_credential_routes_in_auth_scope`), as it does a route
      * whose `auth.account` is not `'none'`.
+     *
+     * The handler owns the token-scope rule a gate would otherwise apply: a
+     * scope-narrowed API token reaches no non-RPC surface that reads account
+     * data, and `auth.required_scope` is refused on a route that admits
+     * anonymous callers. Read the credential through `get_public_account_id`
+     * (`auth/request_context.ts`), not `ACCOUNT_ID_KEY`, so a narrowed token is
+     * answered as the anonymous caller. The RPC endpoint is the exception — its
+     * dispatcher gates each method against the scope.
      */
     reads_credential?: boolean;
     /**

package/dist/http/route_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}
+{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}

package/dist/server/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBAmBxD,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAqDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBAmBxD,CAAC"}

package/dist/server/env.js

@@ -69,7 +69,7 @@ export const BaseServerEnv = z.strictObject({
         description: 'Directory for referenced (large) fact bytes, sharded <shard>/<rest>'
     }),
     FUZ_FACTS_X_ACCEL_REDIRECT_PREFIX: z.string().optional().meta({
-        description: 'Internal nginx prefix for X-Accel-Redirect fact delivery (production only)'
+        description: 'Internal nginx prefix for X-Accel-Redirect fact delivery, ending in `/` (production only)'
     })
 });
 /**

package/dist/server/fact_security_headers.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The untrusted-content hardening headers every served fact carries.
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html` from
+ * executing as stored XSS for any reader of a referencing cell, every fact
+ * response carries `FACT_SECURITY_HEADERS`: `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox`.
+ *
+ * The embedded and disk-stream branches of `server/serve_fact_route.ts` set them
+ * on the response directly. On the `X-Accel-Redirect` branch nginx serves the
+ * bytes from its internal facts location, and a location with its own
+ * `add_header` stops the server-level headers from applying — so that location
+ * must carry the set itself, as the lines `fact_security_header_directives`
+ * renders. The X-Accel validator (`server/x_accel.ts`) refuses a facts location
+ * without them.
+ *
+ * The Rust twin is `fuz_fact_serving::fact_security_headers`; both pin the same
+ * literals.
+ *
+ * @module
+ */
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+export declare const FACT_X_CONTENT_TYPE_OPTIONS = "nosniff";
+/**
+ * `Content-Security-Policy` for fact responses. A fact stored as (or sniffable
+ * to) `text/html` would otherwise execute as stored XSS for any reader of a
+ * referencing cell. `default-src 'none'; sandbox` neutralizes script execution
+ * and sub-resource loads even when a fact is rendered inline; harmless for
+ * directly-served images (they load no sub-resources).
+ */
+export declare const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * `Cache-Control` for fact responses — private, five minutes: the window a
+ * cached read outlives a revoked view.
+ */
+export declare const FACT_CACHE_CONTROL = "private, max-age=300";
+/**
+ * The fact hardening headers, in render order. `Content-Disposition:
+ * attachment` is deliberately absent — it would force-download and break
+ * legitimate inline image rendering.
+ */
+export declare const FACT_SECURITY_HEADERS: {
+    readonly 'X-Content-Type-Options': "nosniff";
+    readonly 'Content-Security-Policy': "default-src 'none'; sandbox";
+};
+/**
+ * The exact nginx `add_header … always;` lines the internal facts location must
+ * carry, rendered from `FACT_SECURITY_HEADERS`. `always` makes nginx add the
+ * header on every status, not just 2xx/3xx. The X-Accel validator refuses a
+ * facts location missing any of them.
+ *
+ * @returns one `add_header` directive per header, each ending in `always;`
+ */
+export declare const fact_security_header_directives: () => Array<string>;
+//# sourceMappingURL=fact_security_headers.d.ts.map

package/dist/server/fact_security_headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fact_security_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/fact_security_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,MAAM,CAG7D,CAAC"}

package/dist/server/fact_security_headers.js

@@ -0,0 +1,58 @@
+/**
+ * The untrusted-content hardening headers every served fact carries.
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html` from
+ * executing as stored XSS for any reader of a referencing cell, every fact
+ * response carries `FACT_SECURITY_HEADERS`: `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox`.
+ *
+ * The embedded and disk-stream branches of `server/serve_fact_route.ts` set them
+ * on the response directly. On the `X-Accel-Redirect` branch nginx serves the
+ * bytes from its internal facts location, and a location with its own
+ * `add_header` stops the server-level headers from applying — so that location
+ * must carry the set itself, as the lines `fact_security_header_directives`
+ * renders. The X-Accel validator (`server/x_accel.ts`) refuses a facts location
+ * without them.
+ *
+ * The Rust twin is `fuz_fact_serving::fact_security_headers`; both pin the same
+ * literals.
+ *
+ * @module
+ */
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+export const FACT_X_CONTENT_TYPE_OPTIONS = 'nosniff';
+/**
+ * `Content-Security-Policy` for fact responses. A fact stored as (or sniffable
+ * to) `text/html` would otherwise execute as stored XSS for any reader of a
+ * referencing cell. `default-src 'none'; sandbox` neutralizes script execution
+ * and sub-resource loads even when a fact is rendered inline; harmless for
+ * directly-served images (they load no sub-resources).
+ */
+export const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * `Cache-Control` for fact responses — private, five minutes: the window a
+ * cached read outlives a revoked view.
+ */
+export const FACT_CACHE_CONTROL = 'private, max-age=300';
+/**
+ * The fact hardening headers, in render order. `Content-Disposition:
+ * attachment` is deliberately absent — it would force-download and break
+ * legitimate inline image rendering.
+ */
+export const FACT_SECURITY_HEADERS = {
+    'X-Content-Type-Options': FACT_X_CONTENT_TYPE_OPTIONS,
+    'Content-Security-Policy': FACT_CONTENT_SECURITY_POLICY
+};
+/**
+ * The exact nginx `add_header … always;` lines the internal facts location must
+ * carry, rendered from `FACT_SECURITY_HEADERS`. `always` makes nginx add the
+ * header on every status, not just 2xx/3xx. The X-Accel validator refuses a
+ * facts location missing any of them.
+ *
+ * @returns one `add_header` directive per header, each ending in `always;`
+ */
+export const fact_security_header_directives = () => Object.entries(FACT_SECURITY_HEADERS).map(([name, value]) => `add_header ${name} "${value}" always;`);

package/dist/server/serve_fact_route.d.ts

@@ -20,7 +20,8 @@
  * `XAccelConfig` (built via
  * `create_x_accel_config` in `server/x_accel.ts`) set in prod, unset in dev.
  * The handle can only be obtained by proving the facts nginx location is
- * `internal;`, so X-Accel serving can't be enabled against a public location.
+ * `internal;` and carries the fact hardening headers, so X-Accel serving can't
+ * be enabled against a public or header-less location.
  *
  * REST, not RPC: binary responses don't fit the JSON-RPC envelope.
  *
@@ -69,14 +70,18 @@
  *
  * Auth shape on the cell-scoped route is `{account: 'none', actor: 'none'}`
  * — the dispatcher's authorization phase is skipped for pure-public routes,
- * so the handler builds the `RequestContext` itself from `c.var.account_id`
- * (populated by the `/api/*` session middleware) by resolving the caller's
- * single actor and loading their role_grants. Unauthed callers pass through
- * with `req_ctx: null` and are admitted only by a `cell.visibility ===
- * 'public'` cell whose `moderation` admits an audience (unmoderated or
+ * so the handler builds the `RequestContext` itself from the resolved account
+ * id (`get_public_account_id`, over what the `/api/*` auth middleware set) by
+ * resolving the caller's single actor and loading their role_grants.
+ * Unauthed callers pass through with `req_ctx: null` and are admitted only by
+ * a `cell.visibility === 'public'` cell whose `moderation` admits an audience (unmoderated or
  * `'approved'`). Multi-actor accounts fall through with `req_ctx: null`
  * — there's no `acting?` slot on a pure-public route, so multi-actor
- * callers are treated as anonymous.
+ * callers are treated as anonymous. A scope-narrowed API token is treated as
+ * anonymous too, not refused (`get_public_account_id`): a narrowed token
+ * reaches no non-RPC surface, but on a route that admits anonymous callers
+ * a 403 would enforce nothing — the holder drops the `Authorization` header and
+ * re-reads every public cell anyway.
  *
  * 404 is the universal "not viewable" response: missing fact, missing or
  * unviewable cell, or the cell doesn't reference the hash. We deliberately
@@ -96,8 +101,13 @@
  * from executing as stored XSS for any reader of a referencing cell, **every**
  * served-fact response carries `X-Content-Type-Options: nosniff` +
  * `Content-Security-Policy: default-src 'none'; sandbox` (the
- * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
- * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `FACT_SECURITY_HEADERS` set from `server/fact_security_headers.ts`,
+ * byte-identical with the Rust twin `fuz_fact_serving`). The embedded and
+ * disk-stream branches set them on the response. On the `X-Accel-Redirect`
+ * branch nginx serves the bytes, and the headers the client sees come from the
+ * internal facts location, not this response — that location must carry the
+ * lines `fact_security_header_directives` renders, which `create_x_accel_config`
+ * enforces.
  * `Content-Disposition: attachment` is deliberately **not** added — it would
  * force-download and break legitimate inline image rendering.
  *
@@ -150,7 +160,8 @@ export interface CreateServeFactRouteSpecOptions {
  * `(cell, hash)` edge — never unioned across the fact's other referrers.
  *
  * Pure-public auth — the handler builds the per-request `RequestContext`
- * from `c.var.account_id` and enforces visibility per-reference.
+ * from the resolved account id (`get_public_account_id`) and enforces
+ * visibility per-reference.
  */
 export declare const create_serve_cell_fact_route_spec: (options: CreateServeFactRouteSpecOptions) => RouteSpec;
 /**

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkHG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAkHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAoCjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAyHD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}