@cortexkit/common-auth 0.3.0 → 0.4.1

package/dist/store/mutate.js

@@ -4,7 +4,8 @@ import { LockContentionError, LockOwnershipError } from '../fs/with-lock.js';
 import { PoolOperationError, } from './errors.js';
 import { callFailureHook } from './hooks.js';
 import { LockStack, } from './refresh-lock.js';
-import { buildRows, classifyConfig, classifyState, isRecord, LEGACY_STORE_VERSION, POOL_KEY, POOL_ROWS_KEY, POOL_SCHEMA_VERSION, } from './schema.js';
+import { classifyConfig, classifyState, ensureEntries, entryIn, isRecord, LEGACY_STORE_VERSION, POOL_KEY, POOL_ROWS_KEY, POOL_SCHEMA_VERSION, rosterRowIn, setEntryIn, } from './schema.js';
+import { completeTornRows, loadRows } from './torn.js';
 async function readJson(path) {
     let text;
     try {
@@ -38,7 +39,7 @@ export async function readPool(ctx) {
         stateExists: state.exists,
         config: config.config,
         state: state.state,
-        rows: buildRows(config.config, state.state, ctx.codec),
+        rows: loadRows(config.config, state.state, ctx.codec),
     };
 }
 /** The refusal for a pool that is not ready, as a failure value. */
@@ -79,8 +80,13 @@ export class Transaction {
         this.config = structuredClone(snapshot.config);
         this.state = structuredClone(snapshot.state);
     }
+    /**
+     * The rows as every reader loads them: a row torn between the writes of a
+     * replace is shown as that replace leaves it once completed (see
+     * `PoolRow.torn`).
+     */
     rows() {
-        return buildRows(this.config, this.state, this.ctx.codec);
+        return loadRows(this.config, this.state, this.ctx.codec);
     }
     row(id) {
         return this.rows().find((row) => row.id === id);
@@ -92,7 +98,8 @@ export class Transaction {
     }
     /** The first roster row with this id (the one the pool loads). */
     rosterRow(id) {
-        return this.roster().find((raw) => isRecord(raw) && raw.id === id);
+        this.roster();
+        return rosterRowIn(this.config, id);
     }
     /**
      * Drops every roster row carrying this id. The row's per-row entry goes with
@@ -106,25 +113,28 @@ export class Transaction {
         return roster.length - kept.length;
     }
     entries() {
-        if (!isRecord(this.config[POOL_KEY]))
-            this.config[POOL_KEY] = {};
-        const pool = this.config[POOL_KEY];
-        if (!isRecord(pool[POOL_ROWS_KEY]))
-            pool[POOL_ROWS_KEY] = {};
-        return pool[POOL_ROWS_KEY];
+        return ensureEntries(this.config);
     }
     entry(id) {
-        const entries = this.entries();
-        const entry = Object.hasOwn(entries, id) ? entries[id] : undefined;
-        return isRecord(entry) ? entry : undefined;
+        this.entries();
+        return entryIn(this.config, id);
     }
     setEntry(id, entry) {
-        Object.defineProperty(this.entries(), id, {
-            value: entry,
-            enumerable: true,
-            writable: true,
-            configurable: true,
-        });
+        setEntryIn(this.config, id, entry);
+    }
+    /**
+     * Writes the config of every row torn between the writes of a replace as
+     * that replace would have left it (see `completeTornRows`), in one config
+     * write ahead of the operation's own. The write is counted apart from the
+     * operation's: it is setup, like a pull giving a row its entry, so a later
+     * refusal still reports `before-first-write`.
+     */
+    async completeTorn() {
+        const { config, torn } = completeTornRows(this.config, this.state, this.ctx.codec);
+        if (torn.length === 0)
+            return;
+        this.config = config;
+        await this.commitConfig({ counted: false });
     }
     stateAccount(id) {
         const accounts = isRecord(this.state.accounts) ? this.state.accounts : {};
@@ -152,7 +162,7 @@ export class Transaction {
      * key untouched. Entries for ids no longer in the roster are dropped here,
      * and remembered so the id is not reused in this process.
      */
-    async commitConfig() {
+    async commitConfig(options = {}) {
         const roster = this.roster();
         const rosterIds = new Set();
         for (const raw of roster)
@@ -184,7 +194,7 @@ export class Transaction {
                 [POOL_ROWS_KEY]: kept,
             },
         };
-        await this.write(this.ctx.configPath, next, 'config');
+        await this.write(this.ctx.configPath, next, 'config', options.counted ?? true);
         this.config = next;
     }
     /** Writes the state: every unrecognised top-level and per-row key kept. */
@@ -199,7 +209,7 @@ export class Transaction {
         if (committed)
             this.progress.committed = committed;
     }
-    async write(path, value, file) {
+    async write(path, value, file, counted = true) {
         await writeJsonAtomic(path, value, {
             beforeRename: async () => {
                 await this.ctx.onStep?.(`before-${file}-write`, this.info);
@@ -207,7 +217,8 @@ export class Transaction {
                 await this.locks.assertAll();
             },
         });
-        this.progress.writes++;
+        if (counted)
+            this.progress.writes++;
         await this.ctx.onStep?.(`after-${file}-write`, this.info);
     }
 }
@@ -258,9 +269,12 @@ export async function initializePool(ctx, dropKeys) {
 }
 /**
  * Runs `fn` under the store-lock list. The pool must be ready: a pending
- * migration or a load error refuses before anything is written.
+ * migration or a load error refuses before anything is written. Unless
+ * `completeTorn` is false, rows torn between the writes of a replace are
+ * completed first, so `fn` never sees one; the writes that only record
+ * readings or reorder the roster opt out and leave such rows as they are.
  */
-export async function withTransaction(ctx, locks, progress, info, fn) {
+export async function withTransaction(ctx, locks, progress, info, fn, options = {}) {
     const mark = locks.held.length;
     try {
         for (const spec of ctx.storeLocks)
@@ -268,7 +282,10 @@ export async function withTransaction(ctx, locks, progress, info, fn) {
         const result = await readPool(ctx);
         if (result.status !== 'ready')
             throw notReadyError(result, info.operation, info.rowId, progress.writes > 0 ? 'after-first-write' : 'before-first-write');
-        return await fn(new Transaction(ctx, result, locks, progress, info));
+        const tx = new Transaction(ctx, result, locks, progress, info);
+        if (options.completeTorn ?? true)
+            await tx.completeTorn();
+        return await fn(tx);
     }
     finally {
         await locks.releaseTo(mark);

package/dist/store/pool.d.ts

@@ -6,7 +6,7 @@ import { type PullHook } from './pull.js';
 import { type ProviderRefresh, type RefreshOptions, type RefreshOutcome } from './refresh.js';
 import { type LockEnvironment, type PoolLockOptions, type PoolLockSpec } from './refresh-lock.js';
 import { type AddInput, type AddResult, type RemoveOptions, type RemoveResult, type ReorderOptions, type ReorderResult, type RowOperationOptions, type RowToggleOptions } from './rows.js';
-import { type PoolCredential, type PoolRow, type QuotaCodec, type StoredCredential } from './schema.js';
+import { type PoolCredential, type PoolRow, type QuotaCodec, type RotateCredential, type StoredCredential } from './schema.js';
 import { type SettingsMutator, type SettingsRead, type UpdateSettingsOptions, type UpdateSettingsResult } from './settings.js';
 export interface OpenPoolStoreOptions {
     /** The provider every row of this pool belongs to; keys the provider-wide lock. */
@@ -75,7 +75,13 @@ export interface PoolStore {
         credential: StoredCredential;
         credentialEpoch: number;
     }>;
-    rotate(id: string, credential: PoolCredential, input?: {
+    /**
+     * Refreshes the secret a row holds without changing its account or
+     * endpoint. Since 0.4.1 an API key may leave out `baseURL` and `authHeader`
+     * to keep the row's, and one that gives another is refused
+     * (`endpoint-mismatch`) before writing: that is a `replace`.
+     */
+    rotate(id: string, credential: RotateCredential, input?: {
         identity?: string;
     }, options?: RowOperationOptions): Promise<{
         id: string;
@@ -120,7 +126,14 @@ export interface PoolStore {
      * (`invalid-input`). Takes `extraLocks`, then the store locks.
      */
     updateSettings(mutator: SettingsMutator, options?: UpdateSettingsOptions): Promise<UpdateSettingsResult>;
-    recordIdentity(id: string, identity: string, options?: RowOperationOptions): Promise<{
+    /**
+     * Records the identity a lookup found for the row's credential. Since
+     * 0.3.1 it takes the credential epoch the lookup was issued for, and
+     * refuses a lookup that completes after the row was replaced
+     * (`attribution`) or a row recorded for another account
+     * (`identity-mismatch`).
+     */
+    recordIdentity(id: string, identity: string, attribution: Pick<Attribution, 'credentialEpoch'>, options?: RowOperationOptions): Promise<{
         id: string;
         disabled: string[];
     }>;

package/dist/store/pool.js

@@ -77,8 +77,13 @@ export function openPoolStore(options) {
         async load() {
             const result = await readPool(ctx);
             if (result.status === 'ready') {
+                // A torn row is no candidate, but its pull is fired too: the pull
+                // completes the row on disk before reading it, so an interrupted
+                // replace of an OAuth row heals at the next load.
                 for (const row of result.rows)
-                    if (row.candidate && row.type === 'oauth' && row.needsFirstReading)
+                    if ((row.candidate || (row.torn && row.enabled)) &&
+                        row.type === 'oauth' &&
+                        row.needsFirstReading)
                         pulls.fire(row.id, 'load');
             }
             return toLoad(result);
@@ -98,7 +103,7 @@ export function openPoolStore(options) {
         reorder: (ids, callOptions) => reorderRows(rt, ids, callOptions),
         readSettings: () => readPoolSettings(rt),
         updateSettings: (mutator, callOptions) => updatePoolSettings(rt, mutator, callOptions),
-        recordIdentity: (id, identity, callOptions) => recordRowIdentity(rt, id, identity, callOptions),
+        recordIdentity: (id, identity, attribution, callOptions) => recordRowIdentity(rt, id, identity, attribution, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
         recordQuota: (id, attribution, observation) => recordQuota(rt, id, attribution, observation),
         requestReading: (id) => pulls.fire(id, 'admission'),

package/dist/store/rows.d.ts

@@ -1,8 +1,9 @@
+import type { Attribution } from './attribution.js';
 import { PoolOperationError } from './errors.js';
 import { type Transaction } from './mutate.js';
 import type { PoolLockSpec } from './refresh-lock.js';
 import { type StoreRuntime } from './runtime.js';
-import { type PoolCredential, type PoolRow, type StoredCredential } from './schema.js';
+import { type CredentialBinding, type PoolCredential, type PoolRow, type RotateCredential, type StoredCredential } from './schema.js';
 export type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 export interface RowOperationOptions {
     /** Called once, awaited, on every non-success path, before locks release. */
@@ -87,12 +88,16 @@ export type AddResult = {
     credential: StoredCredential;
 };
 /**
- * Writes a rotated credential into the state file (one write). A rotation is
- * the same lineage: no epoch bump, no identity or quota change.
+ * Writes a credential into the state file (one write), stamped with the
+ * credential epoch the row's entry holds in `tx` (1 without an entry) and,
+ * for a replace, the binding the config is about to get. A rotation is the
+ * same lineage: no epoch bump, no identity or quota change. An API key must
+ * belong to the endpoint the row holds in `tx` (see `onRowEndpoint`).
  */
-export declare function rotateIn(rt: StoreRuntime, tx: Transaction, id: string, credential: PoolCredential, extra?: {
+export declare function rotateIn(rt: StoreRuntime, tx: Transaction, id: string, given: RotateCredential, extra?: {
     stamp?: number;
     clearErrors?: boolean;
+    binding?: CredentialBinding;
 }): Promise<StoredCredential>;
 export declare function addRow(rt: StoreRuntime, input: AddInput, options?: RowOperationOptions): Promise<AddResult>;
 export declare function replaceRow(rt: StoreRuntime, id: string, credential: PoolCredential, input?: {
@@ -102,7 +107,7 @@ export declare function replaceRow(rt: StoreRuntime, id: string, credential: Poo
     credential: StoredCredential;
     credentialEpoch: number;
 }>;
-export declare function rotateRow(rt: StoreRuntime, id: string, credential: PoolCredential, input?: {
+export declare function rotateRow(rt: StoreRuntime, id: string, credential: RotateCredential, input?: {
     identity?: string;
 }, options?: RowOperationOptions): Promise<{
     id: string;
@@ -146,7 +151,16 @@ export declare function removeRow(rt: StoreRuntime, id: string, options?: Remove
  * An order equal to the current one writes nothing.
  */
 export declare function reorderRows(rt: StoreRuntime, ids: readonly string[], options?: ReorderOptions): Promise<ReorderResult>;
-export declare function recordRowIdentity(rt: StoreRuntime, id: string, identity: string, options?: RowOperationOptions): Promise<{
+/**
+ * Records the wire identity an identity lookup found for a row's credential.
+ * `attribution` is the credential epoch the lookup was issued for (a row
+ * without an entry is at epoch 1): a lookup that completes after the row was
+ * replaced is refused (`attribution`), as a quota reading would be, so the
+ * first credential's account is never recorded on the second credential. A
+ * row already recorded for another account refuses (`identity-mismatch`):
+ * that is a replacement, not something learnt about the same credential.
+ */
+export declare function recordRowIdentity(rt: StoreRuntime, id: string, identity: string, attribution: Pick<Attribution, 'credentialEpoch'>, options?: RowOperationOptions): Promise<{
     id: string;
     disabled: string[];
 }>;

package/dist/store/rows.js

@@ -3,7 +3,8 @@ import { assertNotInsideHook, runInsideHook } from './hooks.js';
 import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, recordIdentityIn, } from './identity.js';
 import { notReadyError, readPool, runOperation, withTransaction, } from './mutate.js';
 import { readRow, refusal, rowLockSpec, unknownRow, } from './runtime.js';
-import { credentialProblem, fingerprintOf, idProblem, isRecord, rosterRowFor, rotationStamp, rowLockKey, stateFieldsFor, storedCredential, } from './schema.js';
+import { CREDENTIAL_STAMP_KEY, credentialProblem, fingerprintOf, idProblem, isCredentialEpoch, isRecord, rosterRowFor, rotationStamp, rowLockKey, stampFor, stateFieldsFor, storedCredential, } from './schema.js';
+import { bindReplacement } from './torn.js';
 /** Fields of a state entry that belong to the credential it replaces. */
 const CREDENTIAL_STATE_FIELDS = [
     'access',
@@ -13,10 +14,51 @@ const CREDENTIAL_STATE_FIELDS = [
     'apiKey',
 ];
 /**
- * Writes a rotated credential into the state file (one write). A rotation is
- * the same lineage: no epoch bump, no identity or quota change.
+ * The endpoint an API-key roster row sends its key to, as `buildRawRows` loads
+ * it: the trimmed `baseURL`, and a bearer header unless the row names
+ * `x-api-key`.
  */
-export async function rotateIn(rt, tx, id, credential, extra = {}) {
+function rowEndpoint(raw) {
+    return {
+        baseURL: String(raw.baseURL).trim(),
+        authHeader: raw.authHeader === 'x-api-key' ? 'x-api-key' : 'authorization-bearer',
+    };
+}
+/**
+ * The credential as it will sit in the row. The state file holds only an API
+ * key; its endpoint lives in the roster row. So an API key written into a row
+ * is sent wherever that row says, and one given for another `baseURL` or
+ * `authHeader` would silently be paired with an endpoint it was not issued
+ * for. A part the caller leaves out is the row's; a part it gives must equal
+ * the row's, else the write is refused (`endpoint-mismatch`) before anything
+ * is written. Moving a row to another endpoint is a `replace`, which writes
+ * the new endpoint first.
+ */
+function onRowEndpoint(tx, id, credential) {
+    if (credential.type !== 'api')
+        return credential;
+    const raw = tx.rosterRow(id);
+    if (!isRecord(raw)) {
+        if (credential.baseURL === undefined)
+            throw refusal(tx.info.operation, id, 'invalid-input', 'api credential needs a valid baseURL');
+        return { ...credential, baseURL: credential.baseURL };
+    }
+    const endpoint = rowEndpoint(raw);
+    const baseURL = credential.baseURL?.trim() ?? endpoint.baseURL;
+    const authHeader = credential.authHeader ?? endpoint.authHeader;
+    if (baseURL !== endpoint.baseURL || authHeader !== endpoint.authHeader)
+        throw refusal(tx.info.operation, id, 'endpoint-mismatch', `row ${id} sends its key to another endpoint or header; a key for another endpoint is a replacement`);
+    return { ...credential, baseURL, authHeader };
+}
+/**
+ * Writes a credential into the state file (one write), stamped with the
+ * credential epoch the row's entry holds in `tx` (1 without an entry) and,
+ * for a replace, the binding the config is about to get. A rotation is the
+ * same lineage: no epoch bump, no identity or quota change. An API key must
+ * belong to the endpoint the row holds in `tx` (see `onRowEndpoint`).
+ */
+export async function rotateIn(rt, tx, id, given, extra = {}) {
+    const credential = onRowEndpoint(tx, id, given);
     const prior = tx.stateAccount(id);
     const priorStamp = typeof prior?.lastRefreshedAt === 'number'
         ? prior.lastRefreshedAt
@@ -32,18 +74,13 @@ export async function rotateIn(rt, tx, id, credential, extra = {}) {
         delete kept.lastQuotaRefreshError;
         delete kept.quota;
     }
-    const raw = tx.rosterRow(id);
-    const stored = credential.type === 'api' && isRecord(raw)
-        ? storedCredential({
-            ...credential,
-            baseURL: String(raw.baseURL ?? credential.baseURL),
-            ...(raw.authHeader === 'x-api-key' ||
-                raw.authHeader === 'authorization-bearer'
-                ? { authHeader: raw.authHeader }
-                : {}),
-        }, stamp)
-        : storedCredential(credential, stamp);
-    tx.setStateAccount(id, { ...kept, ...stateFieldsFor(credential, stamp) });
+    const stored = storedCredential(credential, stamp);
+    const epoch = tx.entry(id)?.credentialEpoch;
+    tx.setStateAccount(id, {
+        ...kept,
+        ...stateFieldsFor(credential, stamp),
+        [CREDENTIAL_STAMP_KEY]: stampFor(stored, typeof epoch === 'number' ? epoch : 1, extra.binding),
+    });
     await tx.commitState(stored);
     return stored;
 }
@@ -51,7 +88,9 @@ function checkInput(operation, id, credential) {
     const idIssue = operation === 'add' ? idProblem(id) : undefined;
     if (idIssue)
         throw refusal(operation, id, 'invalid-input', idIssue);
-    const credentialIssue = credentialProblem(credential);
+    const credentialIssue = credentialProblem(credential, {
+        baseURLOptional: operation === 'rotate',
+    });
     if (credentialIssue)
         throw refusal(operation, id, 'invalid-input', credentialIssue);
 }
@@ -64,6 +103,10 @@ function requireUsableRow(operation, id, row, credential) {
         throw refusal(operation, id, 'type-mismatch', `row ${id} holds a ${row.type} credential`);
     return row;
 }
+/** The row is recorded for another account than the one given. */
+function identityMismatch(operation, id) {
+    return refusal(operation, id, 'identity-mismatch', `row ${id} is recorded for another account; a credential of a different account is a replacement`);
+}
 /** Keying changed between the unlocked read and the locked one: retry. */
 function keyChanged(operation, id) {
     return refusal(operation, id, 'row-key-changed', `row ${id}'s wire identity changed while its lock was being taken`, true);
@@ -86,6 +129,14 @@ export async function addRow(rt, input, options = {}) {
             const fingerprint = fingerprintOf(credential);
             const same = rows.find((row) => row.invalid === undefined && row.fingerprint === fingerprint);
             if (same) {
+                // The same secret is the same credential, so re-adding it rotates
+                // that row. An identity or endpoint given with it must match the
+                // row's; a different one is refused rather than silently replaced
+                // by what the row already holds.
+                if (identity !== undefined &&
+                    same.identity !== undefined &&
+                    identity !== same.identity)
+                    throw identityMismatch('add', same.id);
                 const stored = await rotateIn(rt, tx, same.id, credential);
                 return { id: same.id, outcome: 'rotated', credential: stored };
             }
@@ -97,18 +148,23 @@ export async function addRow(rt, input, options = {}) {
                     throw refusal('add', id, 'id-exists', `row ${id} already holds a credential`);
                 if (existing.type !== credential.type)
                     throw refusal('add', id, 'type-mismatch', `row ${id} is a ${existing.type} row`);
-                // An earlier add wrote this row's config and stopped before the
-                // state write; writing the credential now completes it at epoch 1.
-                if (!existing.hasEntry) {
+                if (identity !== undefined &&
+                    existing.identity !== undefined &&
+                    identity !== existing.identity)
+                    throw identityMismatch('add', id);
+                // A roster row without a credential (left by another writer, or
+                // by an add of an earlier version that stopped between its
+                // writes): writing the credential now completes it at epoch 1.
+                if (!existing.hasEntry)
                     tx.setEntry(id, {
                         credentialEpoch: 1,
                         needsFirstReading: credential.type === 'oauth',
                     });
-                    await tx.commitConfig();
-                }
                 const stored = await rotateIn(rt, tx, id, credential, {
                     clearErrors: true,
                 });
+                if (!existing.hasEntry)
+                    await tx.commitConfig();
                 return { id, outcome: 'completed', credential: stored };
             }
             tx.roster().push(rosterRowFor({
@@ -134,8 +190,14 @@ export async function addRow(rt, input, options = {}) {
                     outcome = 'added-disabled';
                 }
             }
-            await tx.commitConfig();
+            // The credential is written first. A crash before the config write
+            // then leaves a state entry no roster row names, which no reader
+            // loads and `remove` drops; written the other way round, the new
+            // roster row could load beside a credential left under its id by an
+            // interrupted removal. Nothing of such a leftover entry is kept.
+            tx.dropStateAccount(id);
             const stored = await rotateIn(rt, tx, id, credential);
+            await tx.commitConfig();
             return { id, outcome, credential: stored };
         });
     });
@@ -159,33 +221,38 @@ export async function replaceRow(rt, id, credential, input = {}, options = {}) {
             const row = requireUsableRow('replace', id, tx.row(id), credential);
             if (rowLockKey(row) !== rowLockKey(seen))
                 throw keyChanged('replace', id);
-            const entry = tx.entry(id) ?? {};
-            const priorEpoch = typeof entry.credentialEpoch === 'number'
-                ? entry.credentialEpoch
-                : 1;
-            const credentialEpoch = priorEpoch + 1;
-            const nextEntry = {
-                ...entry,
-                credentialEpoch,
-                needsFirstReading: true,
+            const priorEpoch = tx.entry(id)?.credentialEpoch;
+            const credentialEpoch = (typeof priorEpoch === 'number' ? priorEpoch : 1) + 1;
+            // An epoch past the safe integer range could equal the one before
+            // it, so readers could not tell the new credential from the old.
+            // Refused before anything is written; the row keeps its credential.
+            if (!isCredentialEpoch(credentialEpoch))
+                throw refusal('replace', id, 'invalid-row', `row ${id}'s credential epoch cannot advance past ${Number.MAX_SAFE_INTEGER}; remove the row and add the new credential as a new row`);
+            const binding = {
+                ...(input.identity !== undefined
+                    ? { identity: input.identity }
+                    : {}),
+                ...(credential.type === 'api'
+                    ? {
+                        baseURL: credential.baseURL.trim(),
+                        authHeader: credential.authHeader ?? 'authorization-bearer',
+                    }
+                    : {}),
             };
-            delete nextEntry.quota;
-            tx.setEntry(id, nextEntry);
-            const raw = tx.rosterRow(id);
-            if (input.identity !== undefined)
-                raw.accountId = input.identity;
-            else
-                delete raw.accountId;
-            if (credential.type === 'api') {
-                raw.baseURL = credential.baseURL.trim();
-                raw.authHeader = credential.authHeader ?? 'authorization-bearer';
-            }
+            bindReplacement(tx, id, credentialEpoch, binding);
             if (input.identity !== undefined)
                 disableIdentityDuplicates(tx, input.identity);
-            await tx.commitConfig();
+            // The new credential goes first, stamped with the new epoch and the
+            // binding. A crash before the config write leaves the stamp ahead
+            // of the config: every reader shows the row torn (completed, never
+            // a candidate) and the next store write completes the config from
+            // the stamp, so no reader pairs either credential with the other
+            // account's identity or endpoint.
             const stored = await rotateIn(rt, tx, id, credential, {
                 clearErrors: true,
+                binding,
             });
+            await tx.commitConfig();
             return { id, credential: stored, credentialEpoch };
         });
     });
@@ -208,6 +275,13 @@ export async function rotateRow(rt, id, credential, input = {}, options = {}) {
             const row = requireUsableRow('rotate', id, tx.row(id), credential);
             if (rowLockKey(row) !== rowLockKey(seen))
                 throw keyChanged('rotate', id);
+            // A rotation stays with one account: it may record the first
+            // identity the row learns, but a credential of another known
+            // account is a replacement (new epoch, quota and errors dropped).
+            if (input.identity !== undefined &&
+                row.identity !== undefined &&
+                input.identity !== row.identity)
+                throw identityMismatch('rotate', id);
             const stored = await rotateIn(rt, tx, id, credential);
             let configChanged = false;
             if (!row.hasEntry) {
@@ -445,14 +519,31 @@ export async function reorderRows(rt, ids, options = {}) {
             tx.config.accounts = next;
             await tx.commitConfig();
             return { ids: order, outcome: 'reordered' };
-        });
+        }, 
+        // A reorder keeps every roster row and entry byte for byte, so it
+        // leaves a torn row for a write on that row to complete.
+        { completeTorn: false });
     });
 }
-export async function recordRowIdentity(rt, id, identity, options = {}) {
+/**
+ * Records the wire identity an identity lookup found for a row's credential.
+ * `attribution` is the credential epoch the lookup was issued for (a row
+ * without an entry is at epoch 1): a lookup that completes after the row was
+ * replaced is refused (`attribution`), as a quota reading would be, so the
+ * first credential's account is never recorded on the second credential. A
+ * row already recorded for another account refuses (`identity-mismatch`):
+ * that is a replacement, not something learnt about the same credential.
+ */
+export async function recordRowIdentity(rt, id, identity, attribution, options = {}) {
     assertNotInsideHook('recordIdentity');
     return runOperation(rt.ctx, 'recordIdentity', id, options.onFailure, async (locks, progress) => {
         if (typeof identity !== 'string' || identity.length === 0)
             throw refusal('recordIdentity', id, 'invalid-input', 'identity must be non-empty');
+        const captured = isRecord(attribution)
+            ? attribution.credentialEpoch
+            : undefined;
+        if (!isCredentialEpoch(captured))
+            throw refusal('recordIdentity', id, 'invalid-input', 'the credential epoch the identity lookup was issued for is required');
         const { row: seen } = await readRow(rt, 'recordIdentity', id);
         await locks.acquire(rowLockSpec(rt, seen));
         await locks.acquire(options.providerLock ?? rt.providerLock);
@@ -462,6 +553,10 @@ export async function recordRowIdentity(rt, id, identity, options = {}) {
             const row = requireUsableRow('recordIdentity', id, tx.row(id));
             if (rowLockKey(row) !== rowLockKey(seen))
                 throw keyChanged('recordIdentity', id);
+            if ((row.credentialEpoch ?? 1) !== captured)
+                throw refusal('recordIdentity', id, 'attribution', `the identity for ${id} was looked up for a credential the row no longer holds`, true);
+            if (row.identity !== undefined && row.identity !== identity)
+                throw identityMismatch('recordIdentity', id);
             const disabled = recordIdentityIn(tx, id, identity);
             await tx.commitConfig();
             return { id, disabled };