@fuzdev/fuz_app 0.106.1 → 0.108.0

package/dist/actions/perform_action.js

@@ -5,22 +5,32 @@
  * `perform_action` runs the post-parse pipeline that every action-spec
  * handler must traverse:
  *
- * 1. **Pre-validation auth (401)** — short-circuits unauthenticated callers
- *    on `'required'` axes before input validation runs, so callers never
- *    see `invalid_params` for methods with required input.
- * 2. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
- *    `z.void()` / `?? {}` rules. The validated input lands inside the
- *    function so the authorization phase reads `acting` as a typed Zod
- *    field.
- * 3. **Authorization phase** — when `auth.actor !== 'none'` (or
+ * 1. **Pre-authorization auth (401)** — short-circuits unauthenticated callers
+ *    on `'required'` axes.
+ * 2. **Authorization phase** — when `auth.actor !== 'none'` (or
  *    `auth.account !== 'none' && actor === 'none'`), resolves the actor
  *    via `apply_authorization_phase` against the supplied `account_id`
- *    plus `validated_input.acting`. Failures fold into a JSON-RPC error
- *    envelope. The test-harness escape hatch lives in the caller — pass
+ *    plus the request's `acting` selector, read off the raw params by
+ *    `read_acting`. Failures fold into a JSON-RPC error envelope. The
+ *    test-harness escape hatch lives in the caller — pass
  *    `preset.request_context` to skip the live phase and use a pre-baked
  *    context instead.
- * 4. **Post-authorization auth (403)** — gates `auth.credential_types` and
- *    `auth.roles` against the resolved context.
+ * 3. **Post-authorization auth (403)** — gates `auth.credential_types`,
+ *    the credential's `token_scope`, and `auth.roles` against the resolved
+ *    context.
+ * 4. **Validate params (400)** — `spec.input.safeParse(raw_params)` with
+ *    `z.void()` / `?? {}` rules. Runs **after** the authority gates: a
+ *    400 describing the action's input shape to a caller those gates
+ *    refuse would confirm the method exists and describe how to call it,
+ *    to a channel that should have learned nothing. Coarse authority
+ *    facts before fine ones, and no shape disclosure before authority is
+ *    settled — the same argument that puts the credential gate ahead of
+ *    the scope gate. The cost: a malformed request from an *authenticated*
+ *    caller now pays for the authorization phase's actor + role_grant reads
+ *    before being rejected, where validation used to turn it away first.
+ *    Not a new DoS lever — the same caller reaches that work anyway by
+ *    sending well-formed params — but it does remove a cheap-rejection path
+ *    that buggy clients used to hit.
  * 5. **Rate limit (429)** — per-action IP / account throttling, throttle-
  *    requests semantics (every invocation records, regardless of outcome).
  * 6. **Dispatch + DEV-only output validation + error normalization** —
@@ -45,50 +55,39 @@ import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
 import { JSONRPC_VERSION } from '../http/jsonrpc.js';
 import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, http_status_to_jsonrpc_error_code, JSONRPC_ERROR_CODES, dev_only } from '../http/jsonrpc_errors.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../http/error_schemas.js';
-import { is_public_auth } from '../http/auth_shape.js';
-import { token_scope_admits_method } from '../auth/token_scope.js';
+import { is_public_auth, needs_actor, parse_acting } from '../http/auth_shape.js';
+import { token_scope_admits_method, token_scope_method_capability } from '../auth/token_scope.js';
 /**
  * The shared dispatch core. Pure data — no Hono context, no socket. Each
  * transport calls into this with pre-parsed inputs and binds the result
  * to its wire shape.
  *
- * Phase order: 401 → 400 → 403 → handler. On the test-preset path the
- * dispatcher skips the live authorization phase and uses the supplied
- * pre-baked context for post-authorization checks; pre-validation 401
- * still fires when the harness omits `account_id`.
+ * Phase order: 401 → authz → 403 → 400 → handler. On the test-preset path
+ * the dispatcher skips the live authorization phase and uses the supplied
+ * pre-baked context for post-authorization checks; the 401 still fires when
+ * the harness omits `account_id`.
  */
 export const perform_action = async (input, deps) => {
     const { action, raw_params, request_id: id, account_id, credential_type, token_scope, client_ip, signal, notify, connection_id, request_client, preset } = input;
     const { db, pending_effects, post_commit_effects, log, action_ip_rate_limiter, action_account_rate_limiter } = deps;
     const { spec, handler } = action;
     const action_auth = spec.auth;
-    // step 1: pre-validation auth — 401 short-circuit before input validation.
-    const pre = check_action_auth_pre_validation(action_auth, account_id);
+    // step 1: pre-authorization auth — 401 short-circuit.
+    const pre = check_action_auth_pre_authorization(action_auth, account_id);
     if (pre)
         return error_result(pre);
-    // step 2: validate params. JSON-RPC 2.0 §4.2 forbids `params: null`;
-    // registration sites reject `z.null()` inputs. Empty-body convention
-    // (`raw_params ?? {}`) lets all-optional-object methods omit `params`.
-    const params = is_void_schema(spec.input) ? raw_params : (raw_params ?? {});
-    const parse_result = spec.input.safeParse(params);
-    if (!parse_result.success) {
-        return error_result(jsonrpc_error_messages.invalid_params('invalid params', dev_only({ issues: parse_result.error.issues })));
-    }
-    const validated_input = parse_result.data;
-    // step 3: authorization phase. `acting` reads off the typed Zod field
-    // validated in step 2. Per registry-time invariant 2,
-    // `auth.actor !== 'none' ⟺ input declares acting?: ActingActor` — so
-    // the typed read is safe whenever the dispatcher needs it.
+    // step 2: authorization phase. `acting` reads off the raw params rather
+    // than a validated field, because validation now runs after the authority
+    // gates. Per registry-time invariant 2,
+    // `auth.actor !== 'none' ⟺ input declares acting?: ActingActor` — so the
+    // selector is present on exactly the specs that need it, and step 4 is
+    // what rejects a malformed one.
     let request_context = null;
     if (preset !== undefined) {
         request_context = preset.request_context;
     }
     else if (!is_public_auth(action_auth)) {
-        const validated_with_acting = validated_input;
-        const acting_value = validated_with_acting && typeof validated_with_acting.acting === 'string'
-            ? validated_with_acting.acting
-            : undefined;
-        const result = await apply_authorization_phase({ db }, account_id, action_auth, acting_value);
+        const result = await apply_authorization_phase({ db }, account_id, action_auth, read_acting(action_auth, raw_params));
         if (!result.ok) {
             const { error: reason, ...rest } = result.body;
             const code = http_status_to_jsonrpc_error_code(result.status);
@@ -102,10 +101,19 @@ export const perform_action = async (input, deps) => {
         // unauthenticated-optional axis; the handler sees null in either case.
         request_context = result.request_context;
     }
-    // step 4: post-authorization auth — credential gate first, role gate second.
+    // step 3: post-authorization auth — credential gate, then scope, then role.
     const post = check_action_auth_post_authorization(action_auth, request_context, credential_type, action.spec.method, token_scope);
     if (post)
         return error_result(post);
+    // step 4: validate params. JSON-RPC 2.0 §4.2 forbids `params: null`;
+    // registration sites reject `z.null()` inputs. Empty-body convention
+    // (`raw_params ?? {}`) lets all-optional-object methods omit `params`.
+    const params = is_void_schema(spec.input) ? raw_params : (raw_params ?? {});
+    const parse_result = spec.input.safeParse(params);
+    if (!parse_result.success) {
+        return error_result(jsonrpc_error_messages.invalid_params('invalid params', dev_only({ issues: parse_result.error.issues })));
+    }
+    const validated_input = parse_result.data;
     // step 5: rate limit — throttle-requests semantics (record on every
     // invocation, no success-reset). Same limiters shared with the WS
     // dispatcher so an attacker can't switch transports to bypass the budget.
@@ -203,16 +211,33 @@ const rate_limited_result = (retry_after) => {
     };
 };
 /**
- * Pre-validation auth gate — fires before input validation so missing
- * credentials short-circuit with `unauthenticated` instead of leaking
- * a `invalid_params` error for methods with required input.
+ * Read the `acting` actor selector off the raw params for the authorization
+ * phase.
+ *
+ * Consulted only when the spec declares an actor axis; `parse_acting` owns
+ * what counts as a selector and why a malformed one reads as omitted.
+ *
+ * @param auth - the spec's auth shape; no actor axis means no selector
+ * @param raw_params - the request's unvalidated params
+ * @returns the actor id, or `undefined` when absent, malformed, or unwanted
+ */
+const read_acting = (auth, raw_params) => {
+    if (!needs_actor(auth))
+        return undefined;
+    if (typeof raw_params !== 'object' || raw_params === null)
+        return undefined;
+    return parse_acting(raw_params.acting);
+};
+/**
+ * Pre-authorization auth gate — fires before the authorization phase so
+ * missing credentials short-circuit with `unauthenticated`.
  *
  * 401 fires when `auth.account === 'required'` (or `auth.actor === 'required'`,
  * since registry-time invariant 3 forbids accountless actors in v1) and
  * no account is on the request. `'optional'` axes pass through — the
  * authorization phase decides based on whatever the credential supports.
  */
-const check_action_auth_pre_validation = (auth, account_id) => {
+const check_action_auth_pre_authorization = (auth, account_id) => {
     if (auth.account === 'required' || auth.actor === 'required') {
         if (account_id == null) {
             // Carry the reason on `error.data.reason` (symmetric with the 403
@@ -264,7 +289,7 @@ const check_action_auth_post_authorization = (auth, request_context, credential_
     if (token_scope && !token_scope_admits_method(token_scope, method)) {
         return jsonrpc_error_messages.forbidden('forbidden', {
             reason: ERROR_TOKEN_SCOPE_REQUIRED,
-            required_scope: `rpc:${method}`
+            required_scope: token_scope_method_capability(method)
         });
     }
     if (auth.roles?.length) {

package/dist/actions/register_action_ws.d.ts

@@ -174,10 +174,10 @@ export interface RegisterActionWsResult {
  * - Notifications (method + no id) are silently dropped per JSON-RPC spec.
  *   Exception: `cancel` notifications abort the matching pending request's
  *   `ctx.signal` before bubbling out.
- * - Per-message dispatch goes through `perform_action`: pre-validation
- *   auth (401) → input validation (400) → authorization phase →
- *   post-authorization auth (403) → rate limit (429) → handler (with
- *   transaction wrap iff `spec.side_effects: true`) → DEV output validation.
+ * - Per-message dispatch goes through `perform_action`: pre-authorization
+ *   auth (401) → authorization phase → post-authorization auth (403) →
+ *   input validation (400) → rate limit (429) → handler (with transaction
+ *   wrap iff `spec.side_effects: true`) → DEV output validation.
  * - Authorization phase runs **per message** — role_grant changes during a
  *   connection lifetime are picked up on the next message without any
  *   in-place refresh. Authentication invalidation closes the socket via

package/dist/actions/register_action_ws.js

@@ -53,10 +53,10 @@ export const DEFAULT_SERVER_HEARTBEAT_TIMEOUT = 60_000;
  * - Notifications (method + no id) are silently dropped per JSON-RPC spec.
  *   Exception: `cancel` notifications abort the matching pending request's
  *   `ctx.signal` before bubbling out.
- * - Per-message dispatch goes through `perform_action`: pre-validation
- *   auth (401) → input validation (400) → authorization phase →
- *   post-authorization auth (403) → rate limit (429) → handler (with
- *   transaction wrap iff `spec.side_effects: true`) → DEV output validation.
+ * - Per-message dispatch goes through `perform_action`: pre-authorization
+ *   auth (401) → authorization phase → post-authorization auth (403) →
+ *   input validation (400) → rate limit (429) → handler (with transaction
+ *   wrap iff `spec.side_effects: true`) → DEV output validation.
  * - Authorization phase runs **per message** — role_grant changes during a
  *   connection lifetime are picked up on the next message without any
  *   in-place refresh. Authentication invalidation closes the socket via
@@ -98,7 +98,7 @@ export const register_action_ws = (options) => {
     // scoped token that could upgrade would observe far more than it was
     // granted.
     async (c, next) => {
-        const denied = token_scope_surface_denial(c, 'ws_upgrade');
+        const denied = token_scope_surface_denial(c, 'surface:ws_upgrade');
         if (denied)
             return denied;
         return next();

package/dist/actions/register_ws_endpoint.d.ts

@@ -7,12 +7,18 @@
  * 1. `verify_request_source(allowed_origins)` — reject disallowed origins
  *    before the upgrade handshake runs.
  * 2. `require_auth` — reject unauthenticated upgrades.
- * 3. **Authorization phase** — resolve the acting actor against the
+ * 3. `require_token_scope('surface:ws_upgrade')` — rule 3: a narrowed token
+ *    cannot hold a socket. Mounted here, ahead of the role guard, so a
+ *    narrowed token is told about its scope rather than about a role it
+ *    also lacks. `register_action_ws` repeats the check on its own route
+ *    chain, which is what covers consumers mounting it directly; the
+ *    earlier answer wins when both are wired.
+ * 4. **Authorization phase** — resolve the acting actor against the
  *    authenticated account plus an optional `?acting=<uuid>` query string,
  *    and build the `RequestContext` that per-message dispatch reads.
  *    Multi-actor accounts must supply `?acting` to pick a persona;
  *    single-actor accounts work without it.
- * 4. Optional `require_role(required_roles)` — for endpoints gated to a
+ * 5. Optional `require_role(required_roles)` — for endpoints gated to a
  *    non-empty any-of set of roles.
  *
  * Then delegates to `register_action_ws` for per-message JSON-RPC
@@ -43,14 +49,16 @@ export interface RegisterWsEndpointOptions extends RegisterActionWsOptions {
 }
 /**
  * Mount a WebSocket endpoint with the standard upgrade stack (origin check
- * + auth + actor resolution + optional role) and JSON-RPC dispatch.
+ * + auth + token scope + actor resolution + optional role) and JSON-RPC
+ * dispatch.
  *
  * Returns the `BackendWebsocketTransport` (supplied or freshly
  * created), same as `register_action_ws` — retain it to wire
  * `create_ws_auth_guard` on `on_audit_event` or to broadcast.
  *
- * @mutates options.app - applies origin/auth/authorization/role middleware via `app.use`,
- *   then registers the `GET path` route via the inner `register_action_ws`
+ * @mutates options.app - applies origin/auth/scope/authorization/role middleware
+ *   via `app.use`, then registers the `GET path` route via the inner
+ *   `register_action_ws`
  */
 export declare const register_ws_endpoint: (options: RegisterWsEndpointOptions) => RegisterActionWsResult;
 //# sourceMappingURL=register_ws_endpoint.d.ts.map

package/dist/actions/register_ws_endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAmBF,CAAC"}
+{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAaH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgDD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAoBF,CAAC"}

package/dist/actions/register_ws_endpoint.js

@@ -7,12 +7,18 @@
  * 1. `verify_request_source(allowed_origins)` — reject disallowed origins
  *    before the upgrade handshake runs.
  * 2. `require_auth` — reject unauthenticated upgrades.
- * 3. **Authorization phase** — resolve the acting actor against the
+ * 3. `require_token_scope('surface:ws_upgrade')` — rule 3: a narrowed token
+ *    cannot hold a socket. Mounted here, ahead of the role guard, so a
+ *    narrowed token is told about its scope rather than about a role it
+ *    also lacks. `register_action_ws` repeats the check on its own route
+ *    chain, which is what covers consumers mounting it directly; the
+ *    earlier answer wins when both are wired.
+ * 4. **Authorization phase** — resolve the acting actor against the
  *    authenticated account plus an optional `?acting=<uuid>` query string,
  *    and build the `RequestContext` that per-message dispatch reads.
  *    Multi-actor accounts must supply `?acting` to pick a persona;
  *    single-actor accounts work without it.
- * 4. Optional `require_role(required_roles)` — for endpoints gated to a
+ * 5. Optional `require_role(required_roles)` — for endpoints gated to a
  *    non-empty any-of set of roles.
  *
  * Then delegates to `register_action_ws` for per-message JSON-RPC
@@ -21,7 +27,7 @@
  * @module
  */
 import { Logger } from '@fuzdev/fuz_util/log.ts';
-import { apply_authorization_phase, REQUEST_CONTEXT_KEY, require_auth, require_role } from '../auth/request_context.js';
+import { apply_authorization_phase, REQUEST_CONTEXT_KEY, require_auth, require_role, require_token_scope } from '../auth/request_context.js';
 import { verify_request_source } from '../http/origin.js';
 import { ACCOUNT_ID_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { register_action_ws } from './register_action_ws.js';
@@ -67,19 +73,22 @@ const create_ws_authorization_middleware = (db) => {
 };
 /**
  * Mount a WebSocket endpoint with the standard upgrade stack (origin check
- * + auth + actor resolution + optional role) and JSON-RPC dispatch.
+ * + auth + token scope + actor resolution + optional role) and JSON-RPC
+ * dispatch.
  *
  * Returns the `BackendWebsocketTransport` (supplied or freshly
  * created), same as `register_action_ws` — retain it to wire
  * `create_ws_auth_guard` on `on_audit_event` or to broadcast.
  *
- * @mutates options.app - applies origin/auth/authorization/role middleware via `app.use`,
- *   then registers the `GET path` route via the inner `register_action_ws`
+ * @mutates options.app - applies origin/auth/scope/authorization/role middleware
+ *   via `app.use`, then registers the `GET path` route via the inner
+ *   `register_action_ws`
  */
 export const register_ws_endpoint = (options) => {
     const { app, path, allowed_origins, db, required_roles, log = new Logger('[ws]'), ...rest } = options;
     app.use(path, verify_request_source(allowed_origins));
     app.use(path, require_auth);
+    app.use(path, require_token_scope('surface:ws_upgrade'));
     app.use(path, create_ws_authorization_middleware(db));
     if (required_roles?.length) {
         app.use(path, require_role(required_roles));

package/dist/auth/CLAUDE.md

@@ -61,6 +61,7 @@ Convention — `*_schema.ts` is Zod-only; `*_ddl.ts` holds DDL strings.
 - `auth/scope_kind_schema.ts` — `ScopeKindName`, `create_scope_kind_schema` (open registry, no builtins).
 - `auth/credential_type_schema.ts` — `CredentialTypeName`, `CREDENTIAL_TYPE_SESSION` / `_API_TOKEN` / `_DAEMON_TOKEN`, `create_credential_type_schema`.
 - `auth/grant_path_schema.ts` — `GrantPathName`, `GRANT_PATH_ADMIN` / `_SELF_SERVICE` / `_SYSTEM` / `_BOOTSTRAP`, `create_grant_path_schema`.
+- `auth/token_scope.ts` — per-credential authority narrowing stored on `api_token.scope`: `TokenScope` / `TokenScopeInput` + constructors, `parse_stored_token_scope` (fail-closed), `token_scope_admits_method` / `_non_rpc`, and the `<section>:<id>` capability vocabulary `RouteAuth.required_scope` is written in (`parse_token_scope_capability`, `token_scope_admits_capability`, `token_scope_denied_body`, `TOKEN_SURFACES`). Not an open registry — see ../../../docs/security.md §Token scoping for why the identifier half is deliberately unregistered.
 - `auth/auth_ddl.ts` — `CREATE TABLE` / index / seed strings for the core identity tables.
 - `auth/audit_log_schema.ts` — `AUDIT_EVENT_TYPES` (27 builtins), `AuditEventType` / `AuditEventTypeName`, `audit_metadata_schemas`, `AuditLogEvent`, `AuditLogInput`, `AuditLogConfig`, `create_audit_log_config`.
 - `auth/audit_log_ddl.ts` — `audit_log` table DDL with `seq BIGSERIAL` for cursor-based gap fill (BIGSERIAL converges with the Rust spine; `create_db` registers a `pg.types` int8 parser so `seq` still reads as a JS number).
@@ -123,7 +124,7 @@ they track the same config. Sample via `get_*`; `reset_*` are test-only.
 - `auth/bootstrap_routes.ts` — `POST /bootstrap` + `check_bootstrap_status`; `BootstrapStatus` runtime ref.
 - `auth/signup_routes.ts` — `POST /signup` (open or invite-gated).
 - `auth/audit_log_routes.ts` — optional `GET /audit/stream` (SSE); list/history are on the RPC surface.
-- `auth/auth_guard_resolver.ts` — `fuz_auth_guard_resolver` injected into `apply_route_specs` so the framework stays auth-agnostic.
+- `auth/auth_guard_resolver.ts` — `fuz_auth_guard_resolver` injected into `apply_route_specs` so the framework stays auth-agnostic. Maps each `RouteAuth` axis to a guard and is the single site every route spec traverses, so it also carries the two invariants the schema can't (a `required_scope` that isn't a well-formed capability, and one on an unrestricted route).
 
 **Hono-free route shapes.** Each cookie/SSE-coupled route module has a sibling
 `*_route_schema.ts` (`account_route_schema.ts`, `signup_route_schema.ts`,
@@ -158,7 +159,7 @@ Everything else listed under §RPC action surfaces.
 ### Middleware
 
 - `auth/middleware.ts` — `create_auth_middleware_specs(deps, options)` assembles `[origin, session, request_context, bearer_auth]` + optional `daemon_token`.
-- `auth/request_context.ts` — `RequestContext`, `resolve_acting_actor`, `build_request_context`, predicates (`has_role`, `has_scoped_role`, `has_any_scoped_role`), guards (`require_auth`, `require_role`, `require_credential_types`), `refresh_role_grants`.
+- `auth/request_context.ts` — `RequestContext`, `resolve_acting_actor`, `build_request_context`, predicates (`has_role`, `has_scoped_role`, `has_any_scoped_role`), guards (`require_auth`, `require_role`, `require_credential_types`, `require_token_scope`), `token_scope_surface_denial` (the direct-call form, for surfaces that aren't route specs), `refresh_role_grants`.
 - `auth/session_middleware.ts` — `process_session_cookie` integration, `create_session_and_set_cookie` (shared by login / signup / bootstrap).
 - `auth/bearer_auth.ts` — soft-fail bearer middleware; rejects when `Origin` or `Referer` present (browser context).
 - `auth/daemon_token_middleware.ts` — `start_daemon_token_rotation` + `create_daemon_token_middleware(state, deps, log)` (atomic file write, soft-fail validation, keeper account resolution). Soft-fails — discards the credential (pass-through, no own 401/503) on **every** non-success path: browser context (`Origin`/`Referer` present), malformed/invalid token, and valid-token-but-no-keeper all `next()` through to the dispatcher's `credential_type_required` (403) gate, mirroring the bearer guard and the Rust spine's `resolve.rs`. Daemon tokens are loopback-only, so browser context never arises in practice — the discard is defense-in-depth.
@@ -274,12 +275,15 @@ Sets `c.var.account_id` + `CREDENTIAL_TYPE_KEY` on a valid credential.
 Account-only — never loads actor or role_grants, never populates
 `REQUEST_CONTEXT_KEY`.
 
-**Authorization runs after input validation**, matching the dispatcher's
-401 → 400 → 403 phase order (see `http/CLAUDE.md` §Validation pipeline).
-When the route's input declares `acting?: ActingActor` or its auth requires
-role_grants, the authorization phase calls `resolve_acting_actor` over the
-validated `acting` value and builds an actor-bound `RequestContext`.
-Account-grain routes run with `RequestContext.actor: null`.
+**Authorization runs before input validation**, matching the dispatcher's
+401 → authz → 403 → 400 phase order (see `http/CLAUDE.md` §Validation
+pipeline). When the route's input declares `acting?: ActingActor` or its auth
+requires role_grants, the authorization phase calls `resolve_acting_actor` over
+the `acting` selector — the validated query value on GETs, read off the raw
+body on mutations — and builds an actor-bound `RequestContext`. A malformed
+selector reads as omitted (it only ever picks among actors the account already
+owns, and input validation rejects it a step later). Account-grain routes run
+with `RequestContext.actor: null`.
 
 `apply_authorization_phase` is pure data — returns `AuthorizationResult`
 (`{ok: true, request_context: RequestContext | null} | {ok: false, status, body}`)
@@ -399,7 +403,10 @@ Keeper is not a dedicated guard — it's a composable `RouteAuth` shape:
 `{account: 'required', actor: 'required', roles: ['keeper'], credential_types: ['daemon_token']}`.
 The two-part check is `require_credential_types(['daemon_token'])` (403
 `ERROR_CREDENTIAL_TYPE_REQUIRED`) followed by `require_role(['keeper'])`
-(403 `ERROR_INSUFFICIENT_PERMISSIONS`). Same scope-aware semantics mirrored
+(403 `ERROR_INSUFFICIENT_PERMISSIONS`) — the channel gate lands
+pre-authorization and the role gate post-authorization, so a non-daemon
+credential is refused before the route resolves an actor for it. Same
+scope-aware semantics mirrored
 in the HTTP RPC dispatcher (`actions/action_rpc.ts`), the WS dispatcher
 (`actions/register_action_ws.ts`), and the admin bypasses inside
 `auth/role_grant_offer_actions.ts`.

package/dist/auth/account_route_schema.d.ts

@@ -79,7 +79,16 @@ export declare const PasswordChangeOutput: z.ZodObject<{
     tokens_revoked: z.ZodNumber;
 }, z.core.$strict>;
 export type PasswordChangeOutput = z.infer<typeof PasswordChangeOutput>;
-/** Default maximum sessions per account. */
+/**
+ * Default maximum sessions per account.
+ *
+ * The Rust twin pins the same 5 as a `const` (`fuz_auth`'s
+ * `DEFAULT_MAX_SESSIONS`) rather than a route-state field, because its
+ * `AccountRouteState` has no `Default` and a new field would break every
+ * exhaustive literal in every consumer workspace. So this stays the
+ * configurable side of the pair (`null` disables), and the two ship the same
+ * number — retuning means editing both.
+ */
 export declare const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export declare const DEFAULT_MAX_TOKENS = 10;

package/dist/auth/account_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}
+{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}

package/dist/auth/account_route_schema.js

@@ -56,7 +56,16 @@ export const PasswordChangeOutput = z.strictObject({
     sessions_revoked: z.number(),
     tokens_revoked: z.number()
 });
-/** Default maximum sessions per account. */
+/**
+ * Default maximum sessions per account.
+ *
+ * The Rust twin pins the same 5 as a `const` (`fuz_auth`'s
+ * `DEFAULT_MAX_SESSIONS`) rather than a route-state field, because its
+ * `AccountRouteState` has no `Default` and a new field would break every
+ * exhaustive literal in every consumer workspace. So this stays the
+ * configurable side of the pair (`null` disables), and the two ship the same
+ * number — retuning means editing both.
+ */
 export const DEFAULT_MAX_SESSIONS = 5;
 /** Default maximum API tokens per account. */
 export const DEFAULT_MAX_TOKENS = 10;

package/dist/auth/account_routes.d.ts

@@ -69,20 +69,34 @@ export declare const DEFAULT_LOGIN_FAIL_FLOOR_MS = 250;
  */
 export declare const DEFAULT_LOGIN_FAIL_JITTER_MS = 25;
 /**
- * Shared options for route factories that create sessions and rate-limit by IP.
+ * Shared options for route factories that create sessions.
  *
  * Extended by `AccountRouteOptions` and `SignupRouteOptions`.
  * Consumers can destructure these from `AppServerContext` once and spread into multiple factories.
+ *
+ * The per-IP limiter is deliberately *not* here. Each auth surface names its
+ * own (`login_ip_rate_limiter`, `signup_ip_rate_limiter`,
+ * `bootstrap_ip_rate_limiter`) because the buckets are monotone within their
+ * window — see `RateLimiter.reset`. A shared base field made one instance the
+ * path of least resistance, which let a failure on any surface spend the
+ * budget that bounds guessing on every other one.
  */
 export interface AuthSessionRouteOptions {
     session_options: SessionOptions<string>;
-    /** Rate limiter for auth attempts, keyed by client IP. Pass `null` to disable. */
-    ip_rate_limiter: RateLimiter | null;
 }
 /**
  * Per-factory configuration for account route specs.
  */
 export interface AccountRouteOptions extends AuthSessionRouteOptions {
+    /**
+     * Rate limiter for login + password-change attempts, keyed by client IP.
+     * Pass `null` to disable. The distributed-spray backstop: login is the one
+     * surface that guesses *other* accounts' credentials, so this bucket is
+     * never refunded on success (see `RateLimiter.reset`). Password change
+     * shares it — it is password-bearing on the same account grain, and the
+     * Rust spine shares the same instance across both.
+     */
+    login_ip_rate_limiter: RateLimiter | null;
     /** Rate limiter for login attempts, keyed by submitted username. Pass `null` to disable. */
     login_account_rate_limiter: RateLimiter | null;
     /** Max active sessions per account. Evicts oldest on login. Default 5, `null` disables. */
@@ -130,7 +144,7 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
+ * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export declare const create_account_route_specs: (deps: RouteFactoryDeps, options: AccountRouteOptions) => Array<RouteSpec>;

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAwRjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE;;;;;;;OAOG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CA6RjB,CAAC"}

package/dist/auth/account_routes.js

@@ -155,12 +155,12 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * @param deps - stateless capabilities (keyring, password, log)
- * @param options - per-factory configuration (session_options, ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
+ * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
  * @returns route specs (not yet applied to Hono)
  */
 export const create_account_route_specs = (deps, options) => {
     const { keyring, password } = deps;
-    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status } = options;
+    const { session_options, login_ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status } = options;
     const [verify_shape, login_shape, logout_shape, password_shape] = create_account_route_shapes({
         login_account_rate_limited: login_account_rate_limiter !== null
     });
@@ -181,9 +181,9 @@ export const create_account_route_specs = (deps, options) => {
             ...login_shape,
             handler: async (c, route) => {
                 // Per-IP rate limit check (before any DB/password work)
-                const ip = ip_rate_limiter ? get_client_ip(c) : null;
-                if (ip_rate_limiter && ip) {
-                    const check = ip_rate_limiter.check(ip);
+                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
+                if (login_ip_rate_limiter && ip) {
+                    const check = login_ip_rate_limiter.check(ip);
                     if (!check.allowed) {
                         return rate_limit_exceeded_response(c, check.retry_after);
                     }
@@ -214,8 +214,8 @@ export const create_account_route_specs = (deps, options) => {
                     // enumeration prevention: verify_dummy equalizes Argon2id timing;
                     // login_fail_delay equalizes every other path difference.
                     await password.verify_dummy(pw);
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    if (login_ip_rate_limiter && ip)
+                        login_ip_rate_limiter.record(ip);
                     if (login_account_rate_limiter)
                         login_account_rate_limiter.record(account_rate_key);
                     deps.audit.emit(route, {
@@ -229,8 +229,8 @@ export const create_account_route_specs = (deps, options) => {
                 }
                 const valid = await password.verify_password(pw, account.password_hash);
                 if (!valid) {
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    if (login_ip_rate_limiter && ip)
+                        login_ip_rate_limiter.record(ip);
                     if (login_account_rate_limiter)
                         login_account_rate_limiter.record(account_rate_key);
                     deps.audit.emit(route, {
@@ -243,9 +243,11 @@ export const create_account_route_specs = (deps, options) => {
                     await delay;
                     return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
                 }
-                // Successful login — reset rate limits
-                if (ip_rate_limiter && ip)
-                    ip_rate_limiter.reset(ip);
+                // Successful login — clear the account-grain failure history only.
+                // The IP aggregate is deliberately left standing: it is the
+                // distributed-spray backstop, so a success on one account must not
+                // refund the budget shared by every other account reachable from
+                // that address. See `RateLimiter.reset`.
                 if (login_account_rate_limiter)
                     login_account_rate_limiter.reset(account_rate_key);
                 await create_session_and_set_cookie({
@@ -305,9 +307,9 @@ export const create_account_route_specs = (deps, options) => {
             ...password_shape,
             handler: async (c, route) => {
                 // per-IP rate limit check (before argon2 work)
-                const ip = ip_rate_limiter ? get_client_ip(c) : null;
-                if (ip_rate_limiter && ip) {
-                    const check = ip_rate_limiter.check(ip);
+                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
+                if (login_ip_rate_limiter && ip) {
+                    const check = login_ip_rate_limiter.check(ip);
                     if (!check.allowed) {
                         return rate_limit_exceeded_response(c, check.retry_after);
                     }
@@ -325,8 +327,8 @@ export const create_account_route_specs = (deps, options) => {
                 }
                 const valid = await password.verify_password(current_password, ctx.account.password_hash);
                 if (!valid) {
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    if (login_ip_rate_limiter && ip)
+                        login_ip_rate_limiter.record(ip);
                     if (login_account_rate_limiter)
                         login_account_rate_limiter.record(ctx.account.id);
                     deps.audit.emit(route, {
@@ -350,16 +352,17 @@ export const create_account_route_specs = (deps, options) => {
                 // incidental; password is account-level state).
                 const updated = await query_update_account_password(route, ctx.account.id, new_hash, null, ctx.account.password_hash);
                 // Verify-success contract — the caller proved knowledge, so wipe
-                // their failure history. The race-loser branch below re-records
-                // one on top of the wiped slate so net cost stays 1 (mirrors the
-                // verify-fail branch above's `record`-from-prior+1 outcome when
-                // prior was 0; for prior > 0 the race-loser pays exactly 1,
-                // matching the OLD pre-S1 behavior). Deferring from "after
-                // verify" to "after UPDATE settled" is what closes the S1
-                // bypass — a throw between reset and the UPDATE could have
-                // wiped an attacker's budget.
-                if (ip_rate_limiter && ip)
-                    ip_rate_limiter.reset(ip);
+                // their account-grain failure history. The race-loser branch below
+                // re-records one on top of the wiped slate so net cost stays 1 on
+                // that bucket. Deferring from "after verify" to "after UPDATE
+                // settled" is what closes the S1 bypass — a throw between reset
+                // and the UPDATE could have wiped an attacker's budget.
+                //
+                // The IP aggregate is deliberately not cleared: it is the same
+                // instance login uses, so refunding it here reopens the spray path
+                // through a route that only needs the caller's *own* password. Its
+                // record on the race-loser branch below therefore accumulates
+                // rather than netting out, which is the intent.
                 if (login_account_rate_limiter)
                     login_account_rate_limiter.reset(ctx.account.id);
                 if (!updated) {
@@ -370,8 +373,8 @@ export const create_account_route_specs = (deps, options) => {
                     // audit log can distinguish "user typoed" from "two clients
                     // raced." Sessions/tokens were already revoked by the winner;
                     // no cookie clear here either.
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    if (login_ip_rate_limiter && ip)
+                        login_ip_rate_limiter.record(ip);
                     if (login_account_rate_limiter)
                         login_account_rate_limiter.record(ctx.account.id);
                     deps.audit.emit(route, {