@fuzdev/fuz_app 0.107.0 → 0.109.0

package/dist/auth/bootstrap_routes.js

@@ -13,7 +13,7 @@ import { bootstrap_route_shape } from './bootstrap_route_schema.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { rate_limit_exceeded_response } from '../rate_limiter.js';
-import { ERROR_ALREADY_BOOTSTRAPPED } from '../http/error_schemas.js';
+import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSING } from '../http/error_schemas.js';
 /**
  * Check bootstrap availability at startup.
  *
@@ -54,7 +54,7 @@ export const check_bootstrap_status = async (deps, options) => {
  */
 export const create_bootstrap_route_specs = (deps, options) => {
     const { keyring } = deps;
-    const { session_options, bootstrap_status, on_bootstrap, ip_rate_limiter } = options;
+    const { session_options, bootstrap_status, on_bootstrap, bootstrap_ip_rate_limiter } = options;
     const { token_path } = bootstrap_status;
     return [
         {
@@ -68,9 +68,9 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     return c.json({ error: ERROR_ALREADY_BOOTSTRAPPED }, 403);
                 }
                 // Per-IP rate limit check (before any token/DB work)
-                const ip = ip_rate_limiter ? get_client_ip(c) : null;
-                if (ip_rate_limiter && ip) {
-                    const check = ip_rate_limiter.check(ip);
+                const ip = bootstrap_ip_rate_limiter ? get_client_ip(c) : null;
+                if (bootstrap_ip_rate_limiter && ip) {
+                    const check = bootstrap_ip_rate_limiter.check(ip);
                     if (!check.allowed) {
                         return rate_limit_exceeded_response(c, check.retry_after);
                     }
@@ -87,8 +87,18 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     log: deps.log
                 }, input.token, input);
                 if (!result.ok) {
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    // An unreadable token file closes the window. Bootstrap cannot
+                    // succeed without one, and `check_bootstrap_status` already reads
+                    // an unreadable file as unavailable at startup — so leaving the
+                    // flag set means the two disagree, and every later request takes
+                    // this leg and writes another audit row. The limiter would bound
+                    // that channel; closing it ends it, and stops `/status`
+                    // advertising a window that can't be walked through. Twin of the
+                    // Rust spine's `bootstrap_handler`, which does the same.
+                    if (result.error === ERROR_TOKEN_FILE_MISSING)
+                        bootstrap_status.available = false;
+                    if (bootstrap_ip_rate_limiter && ip)
+                        bootstrap_ip_rate_limiter.record(ip);
                     deps.audit.emit(route, {
                         event_type: 'bootstrap',
                         outcome: 'failure',
@@ -97,9 +107,15 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     });
                     return c.json({ error: result.error }, result.status);
                 }
-                // Successful bootstrap — update state immediately
-                if (ip_rate_limiter && ip)
-                    ip_rate_limiter.reset(ip);
+                // Successful bootstrap — update state immediately. Nothing is
+                // reset: bootstrap has no account-grain bucket to forgive (it
+                // predates any account), and the IP bucket is never refunded on
+                // success (see `RateLimiter.reset`). So this is the one auth
+                // surface where a success clears nothing at all. Bootstrap is
+                // one-shot, so at most `max_attempts - 1` residual entries
+                // survive — and they sit on this route's own limiter, not
+                // login's, so a fumbled token can't spend the operator's login
+                // budget on a deployment where their account is the only one.
                 bootstrap_status.available = false;
                 await create_session_and_set_cookie({
                     keyring,

package/dist/auth/middleware.d.ts

@@ -9,7 +9,6 @@
 import type { SessionOptions } from './session_cookie.js';
 import type { AppDeps } from './deps.js';
 import type { DaemonTokenState } from './daemon_token.js';
-import type { RateLimiter } from '../rate_limiter.js';
 import type { MiddlewareSpec } from '../http/middleware_spec.js';
 /**
  * Per-factory configuration for the standard auth middleware stack.
@@ -21,8 +20,6 @@ export interface AuthMiddlewareOptions {
     path?: string;
     /** Daemon token state for keeper auth. Omit to disable daemon token middleware. */
     daemon_token_state?: DaemonTokenState;
-    /** Rate limiter for bearer token auth attempts (per-IP). Pass `null` to disable. */
-    bearer_ip_rate_limiter: RateLimiter | null;
 }
 /**
  * Create the auth middleware stack.

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAgF/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAuE/B,CAAC"}

package/dist/auth/middleware.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { ApiError, RateLimitError } from '../http/error_schemas.js';
+import { ApiError } from '../http/error_schemas.js';
 /**
  * Create the auth middleware stack.
  *
@@ -21,7 +21,7 @@ import { ApiError, RateLimitError } from '../http/error_schemas.js';
  */
 export const create_auth_middleware_specs = async (deps, options) => {
     const { keyring, db } = deps;
-    const { allowed_origins, session_options, path = '/api/*', daemon_token_state, bearer_ip_rate_limiter } = options;
+    const { allowed_origins, session_options, path = '/api/*', daemon_token_state } = options;
     const query_deps = { db };
     // Dynamic imports preserve the bundle-split for type-only consumers of
     // this module (`MiddlewareSpec`, `AuthMiddlewareOptions`, etc.). The
@@ -36,7 +36,7 @@ export const create_auth_middleware_specs = async (deps, options) => {
     ]);
     const session_middleware = create_session_middleware(keyring, session_options);
     const request_context_middleware = create_request_context_middleware(query_deps, deps.log);
-    const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, bearer_ip_rate_limiter, deps.log);
+    const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, deps.log);
     const specs = [
         {
             name: 'origin',
@@ -50,13 +50,14 @@ export const create_auth_middleware_specs = async (deps, options) => {
             name: 'bearer_auth',
             path,
             handler: bearer_auth_middleware,
-            // Bearer middleware soft-fails for invalid/expired tokens (calls next()
-            // without setting context). Only 429 is a hard-fail from this layer.
-            // Auth enforcement (401/403) happens downstream — the RPC dispatcher's
-            // pre-authorization / post-authorization auth gates, or `require_auth` /
-            // `require_role` on REST — producing consistent JSON-RPC or
-            // route-level errors.
-            errors: { 429: RateLimitError }
+            // Soft-fails on every non-success path — browser context, malformed,
+            // invalid, and expired tokens all `next()` through without setting
+            // context. The layer returns no error response of its own (it carries
+            // no rate limiter, so not even a 429). Auth enforcement (401/403)
+            // happens downstream — the RPC dispatcher's pre-authorization /
+            // post-authorization auth gates, or `require_auth` / `require_role` on
+            // REST — producing consistent JSON-RPC or route-level errors.
+            errors: {}
         }
     ];
     if (daemon_token_state) {

package/dist/auth/migrations.d.ts

@@ -37,6 +37,13 @@
  * DBs (no long-lived data) may still drop + re-bootstrap freely on a break —
  * the freeze is the contract for the deployed chain, not local iteration.
  *
+ * **Every entry is twinned on the Rust spine** (`fuz_auth/src/migrations.rs`),
+ * and the two names must match byte for byte: the `_testing_migration_tracker`
+ * parity gate compares the `(namespace, name, sequence)` rows both spines
+ * record, and a divergence there breaks the swap-freely invariant (a consumer
+ * pointing either implementation at one database). Append on both sides in the
+ * same change, so no entry below repeats the rule.
+ *
  * @module
  */
 import type { Migration, MigrationNamespace } from '../db/migrate.js';

package/dist/auth/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CA6H5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAmK5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/auth/migrations.js

@@ -37,6 +37,13 @@
  * DBs (no long-lived data) may still drop + re-bootstrap freely on a break —
  * the freeze is the contract for the deployed chain, not local iteration.
  *
+ * **Every entry is twinned on the Rust spine** (`fuz_auth/src/migrations.rs`),
+ * and the two names must match byte for byte: the `_testing_migration_tracker`
+ * parity gate compares the `(namespace, name, sequence)` rows both spines
+ * record, and a divergence there breaks the swap-freely invariant (a consumer
+ * pointing either implementation at one database). Append on both sides in the
+ * same change, so no entry below repeats the rule.
+ *
  * @module
  */
 import { ACCOUNT_SCHEMA, ACCOUNT_EMAIL_INDEX, ACCOUNT_USERNAME_CI_INDEX, ACTOR_SCHEMA, ACTOR_INDEX, ACTOR_NAME_LOWER_INDEX, ROLE_GRANT_SCHEMA, ROLE_GRANT_INDEXES, AUTH_SESSION_SCHEMA, AUTH_SESSION_INDEXES, API_TOKEN_SCHEMA, API_TOKEN_INDEX, BOOTSTRAP_LOCK_SCHEMA, BOOTSTRAP_LOCK_SEED, INVITE_SCHEMA, INVITE_INDEXES, APP_SETTINGS_SCHEMA, APP_SETTINGS_SEED } from './auth_ddl.js';
@@ -156,10 +163,6 @@ export const auth_migrations = [
     },
     // v2: per-credential token scoping — `api_token.scope JSONB NOT NULL`.
     //
-    // Name must match the Rust twin's migration byte for byte
-    // (`fuz_auth/src/migrations.rs`) or the `_testing_migration_tracker` parity
-    // gate fails and the swap-freely invariant breaks.
-    //
     // Three statements, and the middle one is the whole compatibility story:
     //
     // 1. Add the column nullable, so the ALTER is instant on a populated table.
@@ -186,6 +189,44 @@ export const auth_migrations = [
 				  WHERE scope IS NULL`);
             await db.query('ALTER TABLE api_token ALTER COLUMN scope SET NOT NULL');
         }
+    },
+    // Index the column every bearer request looks up.
+    //
+    // `full_auth_schema` indexes `api_token(account_id)` and nothing else, so
+    // `query_validate_api_token`'s `WHERE token_hash = $1` — the lookup on the
+    // hot path of *every* bearer-authenticated request, valid or not — has been
+    // a sequential scan since the table shipped. The asymmetry is accidental:
+    // `auth_session` gets the same access pattern for free because its session
+    // hash *is* the primary key.
+    //
+    // UNIQUE rather than a plain index, because both spines resolve a token with
+    // an at-most-one read (`query_one` / `query_opt`). Two rows sharing a hash
+    // would mean the two impls could silently disagree about which credential
+    // answered; the constraint makes that unrepresentable instead of merely
+    // improbable.
+    {
+        name: 'api_token_hash_unique_index',
+        up: async (db) => {
+            await db.query('CREATE UNIQUE INDEX IF NOT EXISTS idx_api_token_hash ON api_token(token_hash)');
+        }
+    },
+    // The GIN the per-cell audit timeline assumes.
+    //
+    // `full_auth_schema` ships only btree indexes (seq, account, event_type,
+    // targets), but `db/cell_audit_queries.ts` reconstructs the per-cell
+    // timeline by OR-ing `metadata @> '{...}'::jsonb` containment clauses —
+    // sequential scans without this index, degrading with audit volume.
+    //
+    // `jsonb_path_ops` rather than the default `jsonb_ops`: it serves exactly
+    // the `@>` containment operator these queries use, with a smaller, faster
+    // index. Server PG and PGlite honor the opclass; PG-compatible engines
+    // without operator classes parse and ignore it, serving `@>` from their
+    // generic GIN.
+    {
+        name: 'audit_log_metadata_gin_index',
+        up: async (db) => {
+            await db.query('CREATE INDEX IF NOT EXISTS idx_audit_log_metadata ON audit_log USING gin (metadata jsonb_path_ops)');
+        }
     }
 ];
 /** Pre-composed migration namespace for auth tables. */

package/dist/auth/session_queries.d.ts

@@ -113,8 +113,19 @@ export declare const query_session_list_for_account: (deps: QueryDeps, account_i
  * both commit above `max_sessions`. A transaction is necessary here but not
  * sufficient. Closing this needs one serialization point per
  * `(account_id, credential_kind)` — a locked parent row or a transaction-scoped
- * advisory lock — taken before count/evict/insert, plus a stable tie-breaker
- * alongside `created_at` so the survivors are deterministic.
+ * advisory lock — taken before count/evict/insert.
+ *
+ * Ordering is `created_at DESC, id DESC`. The `id` leg is a **stability**
+ * tie-breaker, not a recency one: `created_at` defaults to `NOW()`, the
+ * *transaction* timestamp, so two sessions born in one transaction — or in two
+ * transactions that started in the same microsecond — tie, and an untied
+ * `OFFSET` may keep a different set on two evaluations of the same rows. `id` is
+ * the blake3 token hash, so the tie-break is arbitrary but deterministic; it
+ * makes the survivors reproducible, it does not make the row just inserted a
+ * guaranteed survivor. Only the serialization point above does that.
+ *
+ * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
+ * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAsB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,SAAS,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CAY3F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjD,KAAK,MAAM,KACT,OAAO,CAAC,IAAI,CAMd,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAsB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,SAAS,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CAY3F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjD,KAAK,MAAM,KACT,OAAO,CAAC,IAAI,CAMd,CAAC"}

package/dist/auth/session_queries.js

@@ -143,8 +143,19 @@ export const query_session_list_for_account = async (deps, account_id, limit = 5
  * both commit above `max_sessions`. A transaction is necessary here but not
  * sufficient. Closing this needs one serialization point per
  * `(account_id, credential_kind)` — a locked parent row or a transaction-scoped
- * advisory lock — taken before count/evict/insert, plus a stable tie-breaker
- * alongside `created_at` so the survivors are deterministic.
+ * advisory lock — taken before count/evict/insert.
+ *
+ * Ordering is `created_at DESC, id DESC`. The `id` leg is a **stability**
+ * tie-breaker, not a recency one: `created_at` defaults to `NOW()`, the
+ * *transaction* timestamp, so two sessions born in one transaction — or in two
+ * transactions that started in the same microsecond — tie, and an untied
+ * `OFFSET` may keep a different set on two evaluations of the same rows. `id` is
+ * the blake3 token hash, so the tie-break is arbitrary but deterministic; it
+ * makes the survivors reproducible, it does not make the row just inserted a
+ * guaranteed survivor. Only the serialization point above does that.
+ *
+ * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
+ * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
@@ -157,7 +168,7 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
 		 WHERE id IN (
 		   SELECT id FROM auth_session
 		   WHERE account_id = $1
-		   ORDER BY created_at DESC
+		   ORDER BY created_at DESC, id DESC
 		   OFFSET $2
 		 ) RETURNING id`, [account_id, max_sessions]);
     return rows.length;

package/dist/auth/signup_routes.d.ts

@@ -36,6 +36,16 @@ export declare const DEFAULT_SIGNUP_FAIL_JITTER_MS = 25;
  * Per-factory configuration for signup route specs.
  */
 export interface SignupRouteOptions extends AuthSessionRouteOptions {
+    /**
+     * Rate limiter for signup attempts, keyed by client IP. Pass `null` to
+     * disable. Its own instance, not login's: signup failures bound username
+     * *enumeration* (the 403/409 split), not credential guessing, and an
+     * open-signup deployment lets any unauthenticated caller spend this budget
+     * — which must not cost anyone their login attempts. Never refunded on
+     * success (see `RateLimiter.reset`). Mirrors the Rust spine's
+     * `signup_ip_rate_limiter`.
+     */
+    signup_ip_rate_limiter: RateLimiter | null;
     /** Rate limiter for signup attempts, keyed by submitted username. Pass `null` to disable. */
     signup_account_rate_limiter: RateLimiter | null;
     /**

package/dist/auth/signup_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IAClE,6FAA6F;IAC7F,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,gBAAgB,EACtB,SAAS,kBAAkB,KACzB,KAAK,CAAC,SAAS,CA4KjB,CAAC"}
+{"version":3,"file":"signup_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAQhD;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,uBAAuB;IAClE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,6FAA6F;IAC7F,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,gBAAgB,EACtB,SAAS,kBAAkB,KACzB,KAAK,CAAC,SAAS,CAgLjB,CAAC"}

package/dist/auth/signup_routes.js

@@ -55,7 +55,7 @@ const signup_fail_delay = (floor_ms, jitter_ms) => {
  */
 export const create_signup_route_specs = (deps, options) => {
     const { keyring, password } = deps;
-    const { session_options, ip_rate_limiter, signup_account_rate_limiter, signup_fail_floor_ms = DEFAULT_SIGNUP_FAIL_FLOOR_MS, signup_fail_jitter_ms = DEFAULT_SIGNUP_FAIL_JITTER_MS } = options;
+    const { session_options, signup_ip_rate_limiter, signup_account_rate_limiter, signup_fail_floor_ms = DEFAULT_SIGNUP_FAIL_FLOOR_MS, signup_fail_jitter_ms = DEFAULT_SIGNUP_FAIL_JITTER_MS } = options;
     return [
         {
             ...create_signup_route_shape({
@@ -63,9 +63,9 @@ export const create_signup_route_specs = (deps, options) => {
             }),
             handler: async (c, route) => {
                 // Per-IP rate limit check (before any work). 429 stays fast.
-                const ip = ip_rate_limiter ? get_client_ip(c) : null;
-                if (ip_rate_limiter && ip) {
-                    const check = ip_rate_limiter.check(ip);
+                const ip = signup_ip_rate_limiter ? get_client_ip(c) : null;
+                if (signup_ip_rate_limiter && ip) {
+                    const check = signup_ip_rate_limiter.check(ip);
                     if (!check.allowed) {
                         return rate_limit_exceeded_response(c, check.retry_after);
                     }
@@ -157,8 +157,8 @@ export const create_signup_route_specs = (deps, options) => {
                 }
                 catch (e) {
                     if (e instanceof NoMatchingInviteError) {
-                        if (ip_rate_limiter && ip)
-                            ip_rate_limiter.record(ip);
+                        if (signup_ip_rate_limiter && ip)
+                            signup_ip_rate_limiter.record(ip);
                         if (signup_account_rate_limiter)
                             signup_account_rate_limiter.record(account_key);
                         emit_failure_audit('no_match');
@@ -167,8 +167,8 @@ export const create_signup_route_specs = (deps, options) => {
                     }
                     // Unique constraint violation: username or email already exists.
                     if (is_pg_unique_violation(e)) {
-                        if (ip_rate_limiter && ip)
-                            ip_rate_limiter.record(ip);
+                        if (signup_ip_rate_limiter && ip)
+                            signup_ip_rate_limiter.record(ip);
                         if (signup_account_rate_limiter)
                             signup_account_rate_limiter.record(account_key);
                         emit_failure_audit('signup_conflict');
@@ -185,9 +185,12 @@ export const create_signup_route_specs = (deps, options) => {
                     emit_failure_audit('internal_error');
                     throw e;
                 }
-                // Reset rate limiters on success
-                if (ip_rate_limiter && ip)
-                    ip_rate_limiter.reset(ip);
+                // Clear the account-grain bucket only — the IP aggregate stands.
+                // This is the cheapest version of the spray path `RateLimiter.reset`
+                // describes: where login at least costs the attacker a credential,
+                // an open-signup deployment let an *unauthenticated* caller zero a
+                // shared IP budget by creating throwaway accounts, and the
+                // per-account limiter never applies to the attacker's own signups.
                 if (signup_account_rate_limiter)
                     signup_account_rate_limiter.reset(account_key);
                 deps.audit.emit(route, {

package/dist/db/CLAUDE.md

@@ -25,7 +25,7 @@ the code.
   `baseline`), `Migration` / `MigrationNamespace` / `MigrationError`.
 - `query_deps.ts` — `QueryDeps = {db}`, the first param to every `query_*`.
 - `assert_row.ts` — `assert_row(row, context)` for INSERT … RETURNING.
-- `pg_error.ts` — `is_pg_unique_violation` (Postgres `23505`).
+- `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite errors), `is_pg_unique_violation` (Postgres `23505`).
 - `sql_identifier.ts` — `assert_valid_sql_identifier`.
 - `status.ts` — CLI DB status utility.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
@@ -95,7 +95,8 @@ child_id`, fractional-index keyed): `query_cell_item_insert` (throws
 - **`cell_audit_queries.ts`** — `query_audit_log_list_by_cell`: matches
   `audit_log` rows whose `metadata` names the cell on any of six cell-domain
   keys (`cell_id` / `source_id` / `new_id` / `parent_id` / `child_id` /
-  `target_id`), bitmap-OR over the metadata GIN.
+  `target_id`), bitmap-OR over `idx_audit_log_metadata` (the `jsonb_path_ops`
+  GIN the `audit_log_metadata_gin_index` auth migration ships).
 
 ## Fact layer
 
@@ -155,6 +156,9 @@ auth_migration_ns (built-in, fuz_auth)
 
 ### Pre-stable migration policy
 
-Pre-stable: when an introducing migration needs to change shape, **rewrite
-the original in place** rather than appending a follow-up — consumers
-re-bootstrap dev DBs on upgrade. See ../../../docs/migrations.md.
+Scoped to the namespaces on this page (`fuz_cell` / `fuz_cell_history` /
+`fuz_facts`): each is a single `full_*_schema` entry, so when it needs to
+change shape, **rewrite the original in place** rather than appending a
+follow-up — consumers re-bootstrap dev DBs on upgrade. The `fuz_auth`
+namespace is the opposite — frozen and append-only, since consumers hold
+deployed databases on it. See ../../../docs/migrations.md §Schema stability.

package/dist/db/cell_audit_queries.d.ts

@@ -5,8 +5,10 @@
  * `new_id` (clone), `source_id` / `target_id` (cell_field events),
  * `parent_id` / `child_id` (cell_item events).
  *
- * Each `metadata @> '{...}'::jsonb` clause hits the existing GIN on
- * `audit_log.metadata`; Postgres bitmap-ORs the index scans together.
+ * Each `metadata @> '{...}'::jsonb` clause hits `idx_audit_log_metadata`
+ * (the `jsonb_path_ops` GIN on `audit_log.metadata`, shipped by the
+ * `audit_log_metadata_gin_index` migration); Postgres bitmap-ORs the index
+ * scans together.
  *
  * @module
  */

package/dist/db/cell_audit_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}
+{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}

package/dist/db/cell_audit_queries.js

@@ -5,8 +5,10 @@
  * `new_id` (clone), `source_id` / `target_id` (cell_field events),
  * `parent_id` / `child_id` (cell_item events).
  *
- * Each `metadata @> '{...}'::jsonb` clause hits the existing GIN on
- * `audit_log.metadata`; Postgres bitmap-ORs the index scans together.
+ * Each `metadata @> '{...}'::jsonb` clause hits `idx_audit_log_metadata`
+ * (the `jsonb_path_ops` GIN on `audit_log.metadata`, shipped by the
+ * `audit_log_metadata_gin_index` migration); Postgres bitmap-ORs the index
+ * scans together.
  *
  * @module
  */

package/dist/db/pg_error.d.ts

@@ -6,6 +6,18 @@
  *
  * @module
  */
+/**
+ * Extract the error-code string from a caught error, for SQLSTATE checks.
+ *
+ * Other error families also carry string `code`s (Node FS errors:
+ * `ENOENT`, `ENOSPC`, …) — compare the result against specific SQLSTATE
+ * values, never against truthiness.
+ *
+ * @param error - the caught error
+ * @returns the `code` string, or `null` when the value isn't an `Error`
+ * or carries no string `code`
+ */
+export declare const pg_error_code: (error: unknown) => string | null;
 /**
  * Check if an error is a PostgreSQL unique constraint violation (error code 23505).
  *

package/dist/db/pg_error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pg_error.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/pg_error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OACmC,CAAC"}
+{"version":3,"file":"pg_error.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/pg_error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,IAGhD,CAAC;AAET;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAA2C,CAAC"}

package/dist/db/pg_error.js

@@ -6,10 +6,24 @@
  *
  * @module
  */
+/**
+ * Extract the error-code string from a caught error, for SQLSTATE checks.
+ *
+ * Other error families also carry string `code`s (Node FS errors:
+ * `ENOENT`, `ENOSPC`, …) — compare the result against specific SQLSTATE
+ * values, never against truthiness.
+ *
+ * @param error - the caught error
+ * @returns the `code` string, or `null` when the value isn't an `Error`
+ * or carries no string `code`
+ */
+export const pg_error_code = (error) => error instanceof Error && 'code' in error && typeof error.code === 'string'
+    ? error.code
+    : null;
 /**
  * Check if an error is a PostgreSQL unique constraint violation (error code 23505).
  *
  * @param error - the caught error
  * @returns `true` if the error is a unique constraint violation
  */
-export const is_pg_unique_violation = (error) => error instanceof Error && 'code' in error && error.code === '23505';
+export const is_pg_unique_violation = (error) => pg_error_code(error) === '23505';