@fuzdev/fuz_app 0.145.0 → 0.146.0

package/dist/http/proxy.js

@@ -172,30 +172,30 @@ export const is_trusted_ip = (ip, proxies) => {
 /**
  * Resolve the real client IP from an `X-Forwarded-For` header value.
  *
- * Walks right-to-left, skipping trusted proxy entries AND any entry
- * that fails strict IP validation (`validate_ip_strict`). The first
- * untrusted, strictly-valid entry is the client IP. If every walked
- * entry is trusted or malformed, returns the leftmost strictly-valid
- * (trusted) entry (likely-misconfigured all-trusted case) or
- * `undefined` (everything was malformed — middleware falls back to
- * the connection IP). All entries are normalized before matching and
- * in the returned value.
+ * Walks right-to-left, skipping trusted proxy entries. The first untrusted
+ * entry is the client IP. The walk **stops** at the first entry that fails
+ * strict IP validation (`validate_ip_strict`) and returns `undefined`, so the
+ * middleware falls back to the connection IP: an entry is only as
+ * trustworthy as the hop that wrote it, and everything left of a malformed
+ * one was written before any trusted hop vouched for it. If every entry is
+ * trusted, returns the leftmost one (likely-misconfigured all-trusted case).
+ * Empty entries are dropped before the walk. All entries are normalized
+ * before matching and in the returned value.
  *
- * Skipping malformed entries is the rate-limit-key fix for the
- * "attacker controls XFF and the proxy passes it through" surface —
- * without the skip, an attacker could rotate arbitrary strings (incl.
+ * Stopping, not skipping, is the rate-limit-key rule. Returning a malformed
+ * entry would let an attacker rotate arbitrary strings (incl.
  * `'attacker:controlled'`, which Hono's lax `distinctRemoteAddr`
- * misclassifies as IPv6) as XFF values to get fresh per-IP rate-limit
- * buckets. Tradeoff: legitimate non-standard proxies that include
- * ports in XFF entries (e.g. `203.0.113.1:8080`) also fail strict
- * validation, so those entries get skipped and the rate-limit bucket
- * collapses to the proxy's connection IP (one bucket for everyone
- * behind that proxy). Standard proxies (nginx, cloud LBs) don't
- * include ports.
+ * misclassifies as IPv6) into fresh per-IP rate-limit buckets; skipping it
+ * and walking on would hand the key to the entry the client wrote whenever a
+ * trusted hop appends a non-bare-IP token (`ip:port`, `[v6]:port`,
+ * `unknown`, `unix:`). Tradeoff: behind such a proxy every client collapses
+ * to the proxy's connection IP in rate limiting (one bucket for everyone
+ * behind it). Standard proxies (nginx's `$remote_addr`, cloud LBs) append
+ * bare IPs.
  *
  * @param forwarded_for - the `X-Forwarded-For` header value
  * @param proxies - parsed trusted proxy entries
- * @returns the normalized client IP, or `undefined` if the header is empty / all entries malformed
+ * @returns the normalized client IP, or `undefined` if the header is empty or the walk met a malformed entry
  */
 export const resolve_client_ip = (forwarded_for, proxies) => {
     const entries = [];
@@ -206,26 +206,20 @@ export const resolve_client_ip = (forwarded_for, proxies) => {
     }
     if (entries.length === 0)
         return undefined;
-    // Walk from right to left, skip trusted proxies and malformed entries.
-    // Returning a malformed entry as the client IP would let an attacker
-    // who controls XFF poison the per-IP rate-limit key.
+    // Walk from right to left, skipping trusted proxies; stop at a malformed
+    // entry. Everything left of it is client-written, so neither it nor any
+    // entry past it may pick the per-IP rate-limit key.
     for (let i = entries.length - 1; i >= 0; i--) {
         const entry = entries[i];
         if (!validate_ip_strict(entry))
-            continue;
+            return undefined;
         if (!is_trusted_ip(entry, proxies)) {
             return entry;
         }
     }
-    // Every entry was trusted or malformed. Prefer the leftmost
-    // strictly-valid (trusted) entry — the misconfiguration warn in
-    // the middleware fires on it. If none, fall through to undefined
-    // and let the middleware fall back to the connection IP.
-    for (const entry of entries) {
-        if (validate_ip_strict(entry))
-            return entry;
-    }
-    return undefined;
+    // Every entry was valid and trusted — the leftmost one; the
+    // misconfiguration warn in the middleware fires on it.
+    return entries[0];
 };
 /**
  * Create a Hono middleware that resolves the client IP from trusted proxies.
@@ -238,7 +232,8 @@ export const resolve_client_ip = (forwarded_for, proxies) => {
  * 2. `X-Forwarded-For` present but connection is untrusted → ignore header
  *    (spoofed by a direct attacker), use connection IP.
  * 3. `X-Forwarded-For` present and connection is trusted → walk header
- *    right-to-left, strip trusted entries, use first untrusted entry.
+ *    right-to-left, strip trusted entries, use first untrusted entry; a
+ *    malformed entry stops the walk and the connection IP is used.
  *
  * @param options - trusted proxy configuration
  * @mutates `c.var.client_ip` - set to the resolved (or `'unknown'`) client IP per request

package/dist/http/route_spec.d.ts

@@ -169,6 +169,14 @@ export interface RouteSpec {
      * and it would see every caller as anonymous, so assembly refuses it
      * there (`assert_credential_routes_in_auth_scope`), as it does a route
      * whose `auth.account` is not `'none'`.
+     *
+     * The handler owns the token-scope rule a gate would otherwise apply: a
+     * scope-narrowed API token reaches no non-RPC surface that reads account
+     * data, and `auth.required_scope` is refused on a route that admits
+     * anonymous callers. Read the credential through `get_public_account_id`
+     * (`auth/request_context.ts`), not `ACCOUNT_ID_KEY`, so a narrowed token is
+     * answered as the anonymous caller. The RPC endpoint is the exception — its
+     * dispatcher gates each method against the scope.
      */
     reads_credential?: boolean;
     /**

package/dist/http/route_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}
+{"version":3,"file":"route_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/route_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAW,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAMjB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC5C,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,UAAU,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAE7F,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;;;OAOG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK5D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAK7D;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;AAmL5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,KAAK,IAAI,EAAE,OAAO,KAAK,CAAC,cAAc,CAAC,KAAG,IAIhF,CAAC;AAwFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,iBAAiB,GAC7B,KAAK,IAAI,EACT,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,qBAAqB,iBAAiB,EACtC,KAAK,MAAM,EACX,IAAI,EAAE,EACN,YAAY,oBAAoB,KAC9B,IAsEF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC,SAAS,CAAC,KAAG,KAAK,CAAC,SAAS,CAK3F,CAAC"}

package/dist/server/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAoDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBAmBxD,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;kBAqDxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAAC;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,sBAmBxD,CAAC"}

package/dist/server/env.js

@@ -69,7 +69,7 @@ export const BaseServerEnv = z.strictObject({
         description: 'Directory for referenced (large) fact bytes, sharded <shard>/<rest>'
     }),
     FUZ_FACTS_X_ACCEL_REDIRECT_PREFIX: z.string().optional().meta({
-        description: 'Internal nginx prefix for X-Accel-Redirect fact delivery (production only)'
+        description: 'Internal nginx prefix for X-Accel-Redirect fact delivery, ending in `/` (production only)'
     })
 });
 /**

package/dist/server/fact_security_headers.d.ts

@@ -33,6 +33,11 @@ export declare const FACT_X_CONTENT_TYPE_OPTIONS = "nosniff";
  * directly-served images (they load no sub-resources).
  */
 export declare const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * `Cache-Control` for fact responses — private, five minutes: the window a
+ * cached read outlives a revoked view.
+ */
+export declare const FACT_CACHE_CONTROL = "private, max-age=300";
 /**
  * The fact hardening headers, in render order. `Content-Disposition:
  * attachment` is deliberately absent — it would force-download and break

package/dist/server/fact_security_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_security_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/fact_security_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,MAAM,CAG7D,CAAC"}
+{"version":3,"file":"fact_security_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/fact_security_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,gCAAgC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,MAAM,CAG7D,CAAC"}

package/dist/server/fact_security_headers.js

@@ -33,6 +33,11 @@ export const FACT_X_CONTENT_TYPE_OPTIONS = 'nosniff';
  * directly-served images (they load no sub-resources).
  */
 export const FACT_CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * `Cache-Control` for fact responses — private, five minutes: the window a
+ * cached read outlives a revoked view.
+ */
+export const FACT_CACHE_CONTROL = 'private, max-age=300';
 /**
  * The fact hardening headers, in render order. `Content-Disposition:
  * attachment` is deliberately absent — it would force-download and break

package/dist/server/serve_fact_route.d.ts

@@ -70,14 +70,18 @@
  *
  * Auth shape on the cell-scoped route is `{account: 'none', actor: 'none'}`
  * — the dispatcher's authorization phase is skipped for pure-public routes,
- * so the handler builds the `RequestContext` itself from `c.var.account_id`
- * (populated by the `/api/*` session middleware) by resolving the caller's
- * single actor and loading their role_grants. Unauthed callers pass through
- * with `req_ctx: null` and are admitted only by a `cell.visibility ===
- * 'public'` cell whose `moderation` admits an audience (unmoderated or
+ * so the handler builds the `RequestContext` itself from the resolved account
+ * id (`get_public_account_id`, over what the `/api/*` auth middleware set) by
+ * resolving the caller's single actor and loading their role_grants.
+ * Unauthed callers pass through with `req_ctx: null` and are admitted only by
+ * a `cell.visibility === 'public'` cell whose `moderation` admits an audience (unmoderated or
  * `'approved'`). Multi-actor accounts fall through with `req_ctx: null`
  * — there's no `acting?` slot on a pure-public route, so multi-actor
- * callers are treated as anonymous.
+ * callers are treated as anonymous. A scope-narrowed API token is treated as
+ * anonymous too, not refused (`get_public_account_id`): a narrowed token
+ * reaches no non-RPC surface, but on a route that admits anonymous callers
+ * a 403 would enforce nothing — the holder drops the `Authorization` header and
+ * re-reads every public cell anyway.
  *
  * 404 is the universal "not viewable" response: missing fact, missing or
  * unviewable cell, or the cell doesn't reference the hash. We deliberately
@@ -156,7 +160,8 @@ export interface CreateServeFactRouteSpecOptions {
  * `(cell, hash)` edge — never unioned across the fact's other referrers.
  *
  * Pure-public auth — the handler builds the per-request `RequestContext`
- * from `c.var.account_id` and enforces visibility per-reference.
+ * from the resolved account id (`get_public_account_id`) and enforces
+ * visibility per-reference.
  */
 export declare const create_serve_cell_fact_route_spec: (options: CreateServeFactRouteSpecOptions) => RouteSpec;
 /**

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwHG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAuCjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAoHD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAoCjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAyHD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAuDF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA2CF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -70,14 +70,18 @@
  *
  * Auth shape on the cell-scoped route is `{account: 'none', actor: 'none'}`
  * — the dispatcher's authorization phase is skipped for pure-public routes,
- * so the handler builds the `RequestContext` itself from `c.var.account_id`
- * (populated by the `/api/*` session middleware) by resolving the caller's
- * single actor and loading their role_grants. Unauthed callers pass through
- * with `req_ctx: null` and are admitted only by a `cell.visibility ===
- * 'public'` cell whose `moderation` admits an audience (unmoderated or
+ * so the handler builds the `RequestContext` itself from the resolved account
+ * id (`get_public_account_id`, over what the `/api/*` auth middleware set) by
+ * resolving the caller's single actor and loading their role_grants.
+ * Unauthed callers pass through with `req_ctx: null` and are admitted only by
+ * a `cell.visibility === 'public'` cell whose `moderation` admits an audience (unmoderated or
  * `'approved'`). Multi-actor accounts fall through with `req_ctx: null`
  * — there's no `acting?` slot on a pure-public route, so multi-actor
- * callers are treated as anonymous.
+ * callers are treated as anonymous. A scope-narrowed API token is treated as
+ * anonymous too, not refused (`get_public_account_id`): a narrowed token
+ * reaches no non-RPC surface, but on a route that admits anonymous callers
+ * a 403 would enforce nothing — the holder drops the `Authorization` header and
+ * re-reads every public cell anyway.
  *
  * 404 is the universal "not viewable" response: missing fact, missing or
  * unviewable cell, or the cell doesn't reference the hash. We deliberately
@@ -124,10 +128,9 @@ import { Readable } from 'node:stream';
 import { join } from 'node:path';
 import { FactHashSchema, Uuid } from '../primitive_schemas.js';
 import { z } from 'zod';
-import { build_request_context, get_request_context, has_scoped_role } from '../auth/request_context.js';
+import { build_request_context, get_public_account_id, get_request_context, has_scoped_role } from '../auth/request_context.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
 import { ActingActor } from '../http/auth_shape.js';
-import { ACCOUNT_ID_KEY } from '../hono_context.js';
 import { query_active_actors_by_account } from '../auth/account_queries.js';
 import { get_route_params } from '../http/route_spec.js';
 import { ERROR_INVALID_ROUTE_PARAMS } from '../http/error_schemas.js';
@@ -137,9 +140,7 @@ import { query_cell_grant_list_for_cell } from '../db/cell_grant_queries.js';
 import { can_view_cell } from '../auth/cell_authorize.js';
 import { cell_steward_admits } from '../auth/cell_steward.js';
 import { parse_file_fact_url } from '../db/file_fact_url.js';
-import { FACT_SECURITY_HEADERS } from './fact_security_headers.js';
-/** `Cache-Control` for fact responses — 5 min revocation window. */
-const CACHE_CONTROL = 'private, max-age=300';
+import { FACT_CACHE_CONTROL, FACT_SECURITY_HEADERS } from './fact_security_headers.js';
 /**
  * Path-param schema for the bare-hash route. Matching the canonical
  * fact-hash form here pushes malformed-hash 400s through the framework's
@@ -202,7 +203,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         return c.body(bytes, 200, {
             'Content-Type': content_type,
             'Content-Length': size,
-            'Cache-Control': CACHE_CONTROL,
+            'Cache-Control': FACT_CACHE_CONTROL,
             ...FACT_SECURITY_HEADERS
         });
     }
@@ -221,7 +222,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         return c.body(null, 200, {
             'Content-Type': content_type,
             'Content-Length': size,
-            'Cache-Control': CACHE_CONTROL,
+            'Cache-Control': FACT_CACHE_CONTROL,
             'X-Accel-Redirect': `${x_accel.redirect_prefix}${shard}/${rest}`,
             ...FACT_SECURITY_HEADERS
         });
@@ -234,22 +235,27 @@ const serve_fact_bytes = async (c, route, hash, config) => {
     return c.body(web_stream, 200, {
         'Content-Type': content_type,
         'Content-Length': size,
-        'Cache-Control': CACHE_CONTROL,
+        'Cache-Control': FACT_CACHE_CONTROL,
         ...FACT_SECURITY_HEADERS
     });
 };
 /**
  * Resolve the caller's `RequestContext` on a pure-public route from the
- * session-middleware-set account id. Multi-actor accounts return `null`
- * (no `acting?` slot on a public route to disambiguate); single active-actor
- * accounts resolve their actor and role_grants for owner / grant / admin
- * admission paths. Unauthenticated callers return `null`. Soft-deleted
- * (tombstoned) actors are excluded from the count
- * (`query_active_actors_by_account`), matching the acting-actor resolution
- * path — a tombstoned actor is never resolvable here.
+ * session-middleware-set account id, read through `get_public_account_id`, so
+ * a scope-narrowed API token returns `null` — downgraded to anonymous, not
+ * refused (see the module doc). Twin of the Rust
+ * `AuthGate::public_request_context`.
+ *
+ * Multi-actor accounts return `null` (no `acting?` slot on a public route to
+ * disambiguate); single active-actor accounts resolve their actor and
+ * role_grants for owner / grant / admin admission paths. Unauthenticated
+ * callers return `null`. Soft-deleted (tombstoned) actors are excluded from the
+ * count (`query_active_actors_by_account`), matching the acting-actor
+ * resolution path — a tombstoned actor is never resolvable here.
  */
 const build_public_request_context = async (c, route) => {
-    const account_id = c.get(ACCOUNT_ID_KEY);
+    // a narrowed token is the anonymous caller here, never a refusal
+    const account_id = get_public_account_id(c);
     if (!account_id)
         return null;
     const actors = await query_active_actors_by_account({ db: route.db }, account_id);
@@ -268,7 +274,8 @@ const build_public_request_context = async (c, route) => {
  * `(cell, hash)` edge — never unioned across the fact's other referrers.
  *
  * Pure-public auth — the handler builds the per-request `RequestContext`
- * from `c.var.account_id` and enforces visibility per-reference.
+ * from the resolved account id (`get_public_account_id`) and enforces
+ * visibility per-reference.
  */
 export const create_serve_cell_fact_route_spec = (options) => {
     const { facts_dir, x_accel, log } = options;

package/dist/server/x_accel.d.ts

@@ -33,6 +33,10 @@
  * - carry, as top-level directives of its own body, an exact `internal;` and
  *   each `fact_security_header_directives` line (token-equal: whitespace and
  *   quoting are free, the words are not);
+ * - set those headers with no other `add_header` — one naming a
+ *   `FACT_SECURITY_HEADERS` header (ASCII case-insensitive) that is not
+ *   token-equal to its required line is refused, since nginx sends both values
+ *   and a client may read only the first (`sniff, nosniff`);
  * - hold only simple directives — any nested block (`location`, `if`,
  *   `limit_except`, …) is refused, and so is `include`, since included files
  *   are not followed.
@@ -53,13 +57,34 @@
  * own modifier and path words and the bodies of the locations serving the
  * prefix.
  *
+ * The prefix itself must be an absolute path ending in exactly one `/` — the
+ * server appends `<shard>/<rest>` straight onto it, so `/_facts` would redirect
+ * to `/_factsab/…`, outside the validated location. At least one location
+ * serving the prefix must sit exactly at it (`/_facts` or `/_facts/`): one only
+ * below it (`location ^~ /_facts/00/`) leaves every other redirect path to
+ * whatever location matches next, and nginx compares location paths
+ * byte-for-byte, so `/_facts//` sits below it too.
+ *
+ * Module directives that undo those guarantees are refused too:
+ *
+ * - `ssi` with any value but `off`, anywhere in the config. SSI `include
+ *   virtual` is a subrequest, which `internal;` admits, so an SSI-processed
+ *   response — a fact inheriting `ssi on` from `http` or `server`, or any page
+ *   carrying user content — could include another fact's bytes.
+ * - `more_set_headers` / `more_clear_headers` (headers-more) everywhere except
+ *   inside a `location` that doesn't serve the prefix (or a block within one):
+ *   they run after `add_header` and can strip the hardening headers, so they
+ *   are refused in the facts location and at every level above it, including
+ *   any block there (`if`, another `server`).
+ *
  * Also refused: an `=` location on the prefix or below it (it can't serve the
  * nested paths the redirect emits); a regex location (`~` / `~*`) whose pattern
  * spells out the prefix (after unescaping `\/`, ASCII case-folded for `~*`) —
- * dead under the rules above, refused for the clearer message; and a config
- * with no location serving the prefix. `include` at server level is allowed,
- * but its file is not read — keep facts-related locations out of included
- * files.
+ * dead under the rules above, refused for the clearer message; a config with no
+ * location at the prefix; and blocks nested more than 64 deep (a parse error, so
+ * the walks can't exhaust the stack). `include` at server level is allowed, but
+ * its file is not read — keep facts-related locations and the directives above
+ * out of included files.
  *
  * The threat model is operator mistakes, not an adversarial config author: the
  * prefix check is textual, so a value assembled from pieces (`/_fac$1`) evades
@@ -73,8 +98,10 @@
  *   the server is trusted to point into the prefix; an untrusted one needs
  *   `proxy_ignore_headers X-Accel-Redirect;` (or the `fastcgi_` / `uwsgi_` /
  *   `scgi_` equivalent).
- * - Module code can redirect internally too (ssi `include virtual`, njs
- *   `internalRedirect`, perl, echo), so run trusted modules and content only.
+ * - Other module code can redirect internally too (njs `internalRedirect`, perl,
+ *   echo), or strip the hardening headers as headers-more can (njs
+ *   `js_header_filter`, lua-nginx-module `header_filter_by_lua*`), and the
+ *   check sees none of it, so run trusted modules and content only.
  *
  * The Rust twin is `fuz_fact_serving`'s `nginx.rs`, held to the same rules and
  * the same fixture corpus.
@@ -145,12 +172,13 @@ export declare class XAccelConfigError extends Error {
  * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
  * into a location proven `internal;` and header-carrying at boot.
  *
- * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param redirect_prefix - the X-Accel redirect prefix, ending in `/` (e.g. `/_facts/`)
  * @param nginx_config - the nginx config string to validate against
  * @returns the validated `XAccelConfig` carrying `redirect_prefix`
  * @throws `XAccelConfigError` carrying every violation
- *   `validate_facts_internal_location` finds — a missing, public, header-less,
- *   exact-match, or regex-shadowed facts location.
+ *   `validate_facts_internal_location` finds — a prefix not ending in `/`, a
+ *   missing, public, header-less, re-headered, exact-match, or regex-shadowed
+ *   facts location, or `ssi` / headers-more reaching it.
  */
 export declare const create_x_accel_config: (redirect_prefix: string, nginx_config: string) => XAccelConfig;
 //# sourceMappingURL=x_accel.d.ts.map

package/dist/server/x_accel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x_accel.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/x_accel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,qCAAqC;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,wDAAwD;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAC5C,QAAQ,MAAM,EACd,gBAAgB,MAAM,KACpB,oBAYF,CAAC;AAsHF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;0CAKF,CAAC;AACxB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;CAKjC;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GACjC,iBAAiB,MAAM,EACvB,cAAc,MAAM,KAClB,YAMF,CAAC"}
+{"version":3,"file":"x_accel.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/x_accel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2HG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACpC,qCAAqC;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,wDAAwD;IACxD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,GAC5C,QAAQ,MAAM,EACd,gBAAgB,MAAM,KACpB,oBAYF,CAAC;AA+IF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;0CAKF,CAAC;AACxB,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;CAKjC;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,iBAAiB,MAAM,EACvB,cAAc,MAAM,KAClB,YAMF,CAAC"}