@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/auth/account_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAsB9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAyB3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,yBAAyB,EAC/B,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CA8KjB,CAAC"}
+{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAwB9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAyB3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,yBAAyB,EAC/B,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAsLjB,CAAC"}

package/dist/auth/account_actions.js

@@ -27,12 +27,14 @@
  *
  * @module
  */
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { rpc_action } from '../actions/action_rpc.js';
+import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { queue_connection_close } from '../actions/connection_closer.js';
 import { to_session_account } from './account_schema.js';
 import { query_session_list_for_account, query_session_revoke_for_account, query_session_revoke_all_for_account } from './session_queries.js';
 import { query_api_token_enforce_limit, query_api_token_list_for_account, query_create_api_token, query_revoke_api_token_for_account } from './api_token_queries.js';
-import { parse_stored_token_scope, token_scope_from_input, token_scope_label } from './token_scope.js';
+import { parse_stored_token_scope, serialize_token_scope, token_scope_from_input, token_scope_label } from './token_scope.js';
 import { token_lifetime_to_expires_at } from './token_lifetime.js';
 import { generate_api_token } from './api_token.js';
 import { DEFAULT_MAX_TOKENS } from './account_route_schema.js';
@@ -108,6 +110,15 @@ export const create_account_actions = (deps, options = {}) => {
         // There is deliberately no permissive fallback here: an omitted scope is
         // a validation error upstream, not a full-authority token.
         const scope = token_scope_from_input(input.scope);
+        // Over the stored-document cap is a malformed request, refused before
+        // any write (the insert would otherwise throw it as a 500). Twin of the
+        // Rust spine's `invalid_params` on `TokenScopeError::TooLarge`.
+        try {
+            serialize_token_scope(scope);
+        }
+        catch (err) {
+            throw jsonrpc_errors.invalid_params(`invalid scope: ${to_error_message(err)}`);
+        }
         // `input.lifetime` is required for the same reason — an omitted lifetime
         // is a validation error, never an eternal token.
         const expires_at = token_lifetime_to_expires_at(input.lifetime);

package/dist/auth/account_route_schema.d.ts

@@ -111,6 +111,7 @@ export declare const account_status_route_shape: {
         account: "none";
         actor: "none";
     };
+    reads_credential: true;
     description: string;
     input: z.ZodNull;
     output: z.ZodObject<{

package/dist/auth/account_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAoD1B,CAAC"}
+{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CA6D1B,CAAC"}

package/dist/auth/account_route_schema.js

@@ -85,6 +85,9 @@ export const account_status_route_shape = {
     method: 'GET',
     path: '/status',
     auth: { account: 'none', actor: 'none' },
+    // no gate — the handler answers an anonymous caller with its own 401 — but
+    // it reads the account the auth middleware resolved
+    reads_credential: true,
     description: 'Current account info (unauthenticated: 401 with bootstrap status)',
     input: AccountStatusInput,
     output: AccountStatusOutput,
@@ -115,10 +118,15 @@ export const create_account_route_shapes = (options) => [
         method: 'POST',
         path: '/login',
         auth: { account: 'none', actor: 'none' },
+        mints_credential: true,
         description: 'Exchange credentials for session',
         input: LoginInput,
         output: LoginOutput,
         rate_limit: 'both',
+        // The handler opens its own transaction around just the session writes,
+        // so a reservation waiting for a slot, and the Argon2 verify, hold no
+        // database connection.
+        transaction: false,
         errors: {
             400: z.looseObject({
                 error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])
@@ -147,6 +155,10 @@ export const create_account_route_shapes = (options) => [
         input: PasswordChangeInput,
         output: PasswordChangeOutput,
         rate_limit: options.login_account_rate_limited ? 'both' : 'ip',
+        // The handler opens its own transaction around just the password update
+        // and the revocations, so a reservation waiting for a slot, and the
+        // Argon2 verify and hash, hold no database connection.
+        transaction: false,
         errors: {
             400: z.looseObject({
                 error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])

package/dist/auth/account_routes.d.ts

@@ -134,8 +134,13 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * `/login` closes the connections of the sessions its cap evicts, and
- * `/logout` and `/password` close the account's, each after the route's
- * transaction commits (`queue_connection_close` on `deps.connection_closer`).
+ * `/logout` and `/password` close the account's, each once its revocation has
+ * committed: `/logout` through the route transaction's post-commit queue
+ * (`queue_connection_close`), `/login` and `/password` — which open their own
+ * transaction around just their writes — straight after it commits
+ * (`close_connections_after_commit`, which logs a failing close rather than
+ * failing the committed request), so a later throw can't drop a close a
+ * committed revocation owes. All on `deps.connection_closer`.
  *
  * @param deps - stateless capabilities (keyring, password, log, audit, connection_closer)
  * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAIlD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE;;;;;;;OAOG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CA2RjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIxE,OAAO,EAGN,KAAK,WAAW,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAOlD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SAkFhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE;;;;;;;OAOG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CA+VjB,CAAC"}

package/dist/auth/account_routes.js

@@ -31,8 +31,10 @@ import { build_account_context, build_request_context, get_request_context, requ
 import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
-import { queue_connection_close } from '../actions/connection_closer.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
+import { parse_acting } from '../http/auth_shape.js';
+import { rate_limit_exceeded_response, reserve_optional } from '../rate_limiter.js';
+import { close_connections_after_commit, queue_connection_close } from '../actions/connection_closer.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS } from '../http/error_schemas.js';
 /**
  * Create the account status route spec.
@@ -82,10 +84,15 @@ export const create_account_status_route_spec = (options) => ({
         // Resolve actor + role_grants when the caller is unambiguous (single-actor
         // account, or supplied `?acting=<uuid>`). On multi-actor accounts
         // without `acting`, fall back to account-only so the frontend can
-        // surface a persona picker.
-        const acting = c.req.query('acting') ?? undefined;
-        const acting_result = await resolve_acting_actor(route, account_id, acting);
-        if (acting_result.ok) {
+        // surface a persona picker. The selector goes through the `ActingActor`
+        // schema, lowercased; a malformed value is a missing persona —
+        // account-only, never a default-actor resolve (as on the Rust spine).
+        const acting_raw = c.req.query('acting');
+        const acting = parse_acting(acting_raw);
+        const acting_result = acting_raw !== undefined && acting === undefined
+            ? null
+            : await resolve_acting_actor(route, account_id, acting);
+        if (acting_result?.ok) {
             const ctx = await build_request_context(route, account_id, acting_result.actor_id);
             if (ctx) {
                 const role_grants = ctx.role_grants.map((p) => ({
@@ -156,8 +163,13 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * `/login` closes the connections of the sessions its cap evicts, and
- * `/logout` and `/password` close the account's, each after the route's
- * transaction commits (`queue_connection_close` on `deps.connection_closer`).
+ * `/logout` and `/password` close the account's, each once its revocation has
+ * committed: `/logout` through the route transaction's post-commit queue
+ * (`queue_connection_close`), `/login` and `/password` — which open their own
+ * transaction around just their writes — straight after it commits
+ * (`close_connections_after_commit`, which logs a failing close rather than
+ * failing the committed request), so a later throw can't drop a close a
+ * committed revocation owes. All on `deps.connection_closer`.
  *
  * @param deps - stateless capabilities (keyring, password, log, audit, connection_closer)
  * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
@@ -185,99 +197,122 @@ export const create_account_route_specs = (deps, options) => {
         {
             ...login_shape,
             handler: async (c, route) => {
-                // Per-IP rate limit check (before any DB/password work)
-                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
-                if (login_ip_rate_limiter && ip) {
-                    const check = login_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before any DB/password work). Reserved, not
+                // checked: the attempt counts against the cap from here until it
+                // settles, so a concurrent burst can't all pass before any of it
+                // records. A key at its cap only because of attempts in flight
+                // waits briefly for a slot (`RESERVATION_WAIT_MAX_MS`) rather than
+                // refusing a burst of correct logins outright. Order: IP, then the
+                // lookup, then the account (its key is the looked-up id). A wait on
+                // the account bucket keeps the IP slot: it belongs to the same
+                // address, the wait is bounded, and giving it up would let that
+                // address exceed its cap meanwhile. The `finally` releases whatever
+                // no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = login_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(login_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                // `UsernameProvided` canonicalizes via `.trim().toLowerCase()` at
-                // parse time — the validated value lands canonical in
-                // `c.var.validated_input`, so the per-account rate-limit key,
-                // DB lookup, and audit metadata see one form. See
-                // `primitive_schemas.ts` for the schema-layer canonicalization.
-                const { username, password: pw } = get_route_input(c);
-                // DB lookup first so we can key the per-account rate limit by a canonical value
-                // (account.id) rather than the submitted identifier. Otherwise an attacker could
-                // alternate between username and email to double the per-account bucket.
-                const account = await query_account_by_username_or_email(route, username);
-                const account_rate_key = account ? account.id : username;
-                // Per-account rate limit check (after DB lookup so the key is canonical)
-                if (login_account_rate_limiter) {
-                    const check = login_account_rate_limiter.check(account_rate_key);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    // `UsernameProvided` canonicalizes via `.trim().toLowerCase()` at
+                    // parse time — the validated value lands canonical in
+                    // `c.var.validated_input`, so the per-account rate-limit key,
+                    // DB lookup, and audit metadata see one form. See
+                    // `primitive_schemas.ts` for the schema-layer canonicalization.
+                    const { username, password: pw } = get_route_input(c);
+                    // DB lookup first so we can key the per-account rate limit by a canonical value
+                    // (account.id) rather than the submitted identifier. Otherwise an attacker could
+                    // alternate between username and email to double the per-account bucket.
+                    const account = await query_account_by_username_or_email(route, username);
+                    const account_rate_key = account ? account.id : username;
+                    // Per-account rate limit (after DB lookup so the key is canonical)
+                    const account_reserved = await reserve_optional(login_account_rate_limiter, account_rate_key, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                // Start the minimum-delay timer concurrently with failure work.
-                // Observed response time is max(work, delay) so all 401 paths
-                // (found-wrong-pw, not-found) return in similar time.
-                const delay = login_fail_delay(login_fail_floor_ms, login_fail_jitter_ms);
-                if (!account) {
-                    // enumeration prevention: verify_dummy equalizes Argon2id timing;
-                    // login_fail_delay equalizes every other path difference.
-                    await password.verify_dummy(pw);
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
-                    if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(account_rate_key);
-                    deps.audit.emit(route, {
-                        event_type: 'login',
-                        outcome: 'failure',
-                        ip: get_client_ip(c),
-                        metadata: { username }
-                    });
-                    await delay;
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
-                }
-                const valid = await password.verify_password(pw, account.password_hash);
-                if (!valid) {
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
+                    account_reservation = account_reserved.reservation;
+                    // Start the minimum-delay timer concurrently with failure work.
+                    // Observed response time is max(work, delay) so all 401 paths
+                    // (found-wrong-pw, not-found) return in similar time.
+                    const delay = login_fail_delay(login_fail_floor_ms, login_fail_jitter_ms);
+                    if (!account) {
+                        // enumeration prevention: verify_dummy equalizes Argon2id timing;
+                        // login_fail_delay equalizes every other path difference.
+                        await password.verify_dummy(pw);
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'login',
+                            outcome: 'failure',
+                            ip: get_client_ip(c),
+                            metadata: { username }
+                        });
+                        await delay;
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    const valid = await password.verify_password(pw, account.password_hash);
+                    if (!valid) {
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'login',
+                            outcome: 'failure',
+                            account_id: account.id,
+                            ip: get_client_ip(c),
+                            metadata: { username }
+                        });
+                        await delay;
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    // Successful login — clear the account-grain failure history only.
+                    // The IP aggregate is deliberately left standing: it is the
+                    // distributed-spray backstop, so a success on one account must not
+                    // refund the budget shared by every other account reachable from
+                    // that address. See `RateLimiter.reset`. A success records nothing:
+                    // both reservations are released.
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                     if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(account_rate_key);
+                        login_account_rate_limiter.reset(account_rate_key);
+                    // The session INSERT and the cap eviction are the route's only
+                    // writes, and only atomic together: one transaction around just
+                    // them (the route is `transaction: false`, so the reservation
+                    // waits above and the Argon2 verify held no connection). Twin of
+                    // the Rust login's transaction around `create_capped_session`.
+                    const evicted = await route.db.transaction((tx) => create_session_and_set_cookie({
+                        keyring,
+                        deps: { db: tx },
+                        c,
+                        account_id: account.id,
+                        session_options,
+                        max_sessions
+                    }));
+                    // The sessions the cap evicted are gone from the table, but not
+                    // from the connections they opened — a WebSocket keeps the
+                    // authority it resolved at upgrade, and an SSE stream never
+                    // rechecks. Close them now the eviction has committed — inline, not
+                    // queued: with no route transaction, a throw later in the handler
+                    // would drop a queued close while the eviction stands. No audit
+                    // row: there is no eviction event, and the `login` row records
+                    // the cause.
+                    for (const session_token_hash of evicted) {
+                        close_connections_after_commit(connection_closer, { kind: 'session', session_token_hash }, deps.log);
+                    }
                     deps.audit.emit(route, {
                         event_type: 'login',
-                        outcome: 'failure',
                         account_id: account.id,
-                        ip: get_client_ip(c),
-                        metadata: { username }
+                        ip: get_client_ip(c)
                     });
-                    await delay;
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    return c.json({ ok: true });
                 }
-                // Successful login — clear the account-grain failure history only.
-                // The IP aggregate is deliberately left standing: it is the
-                // distributed-spray backstop, so a success on one account must not
-                // refund the budget shared by every other account reachable from
-                // that address. See `RateLimiter.reset`.
-                if (login_account_rate_limiter)
-                    login_account_rate_limiter.reset(account_rate_key);
-                const evicted = await create_session_and_set_cookie({
-                    keyring,
-                    deps: route,
-                    c,
-                    account_id: account.id,
-                    session_options,
-                    max_sessions
-                });
-                // The sessions the cap evicted are gone from the table, but not
-                // from the connections they opened — a WebSocket keeps the
-                // authority it resolved at upgrade, and an SSE stream never
-                // rechecks. Close them once the eviction has committed. No audit
-                // row: there is no eviction event, and the `login` row records
-                // the cause.
-                for (const session_token_hash of evicted) {
-                    queue_connection_close(route, connection_closer, { kind: 'session', session_token_hash });
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                deps.audit.emit(route, {
-                    event_type: 'login',
-                    account_id: account.id,
-                    ip: get_client_ip(c)
-                });
-                return c.json({ ok: true });
             }
         },
         {
@@ -316,111 +351,129 @@ export const create_account_route_specs = (deps, options) => {
         {
             ...password_shape,
             handler: async (c, route) => {
-                // per-IP rate limit check (before argon2 work)
-                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
-                if (login_ip_rate_limiter && ip) {
-                    const check = login_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before argon2 work). Reserved, not checked:
+                // the attempt counts against the shared login limiters from here
+                // until it settles, so a concurrent burst of guesses at
+                // `current_password` can't all pass before any of it records. The
+                // `finally` releases whatever no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = login_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(login_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                const ctx = require_request_context(c);
-                const { current_password, new_password } = get_route_input(c);
-                // Defense in depth — see `docs/security.md` §Credential-channel gating.
-                const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? undefined;
-                // per-account rate limit check (after context resolution, before argon2 work)
-                if (login_account_rate_limiter) {
-                    const check = login_account_rate_limiter.check(ctx.account.id);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    const ctx = require_request_context(c);
+                    const { current_password, new_password } = get_route_input(c);
+                    // Defense in depth — see `docs/security.md` §Credential-channel gating.
+                    const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? undefined;
+                    // per-account rate limit (after context resolution, before argon2 work)
+                    const account_reserved = await reserve_optional(login_account_rate_limiter, ctx.account.id, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                const valid = await password.verify_password(current_password, ctx.account.password_hash);
-                if (!valid) {
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
-                    if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(ctx.account.id);
-                    deps.audit.emit(route, {
-                        event_type: 'password_change',
-                        outcome: 'failure',
-                        account_id: ctx.account.id,
-                        ip: get_client_ip(c),
-                        metadata: { credential_type }
+                    account_reservation = account_reserved.reservation;
+                    const valid = await password.verify_password(current_password, ctx.account.password_hash);
+                    if (!valid) {
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'password_change',
+                            outcome: 'failure',
+                            account_id: ctx.account.id,
+                            ip: get_client_ip(c),
+                            metadata: { credential_type }
+                        });
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    // Verify succeeded — do the throw-y operations FIRST so a fault
+                    // (Argon2 OOM, native binding error, DB outage on the UPDATE)
+                    // can't wipe the rate-limit history of a caller observing 500s.
+                    // Resets happen below, after both calls have settled.
+                    const new_hash = await password.hash_password(new_password);
+                    // Conditional UPDATE keyed on the verified hash: closes the
+                    // verify-write race with a concurrent password change that
+                    // already committed against the same starting hash. Account-grain
+                    // operation — `updated_by` stays null (the per-request actor is
+                    // incidental; password is account-level state).
+                    //
+                    // The UPDATE and the two revocations are the route's writes, and
+                    // commit together or not at all: one transaction around just them
+                    // (the route is `transaction: false`, so the reservation waits
+                    // above and the Argon2 verify and hash held no connection). Twin of
+                    // the Rust spine's `change_password`. `null` when the UPDATE matched
+                    // nothing — a concurrent change committed first.
+                    const change = await route.db.transaction(async (tx) => {
+                        const tx_deps = { db: tx };
+                        const updated = await query_update_account_password(tx_deps, ctx.account.id, new_hash, null, ctx.account.password_hash);
+                        if (!updated)
+                            return null;
+                        // revoke all sessions and API tokens (force re-auth everywhere)
+                        const sessions_revoked = await query_session_revoke_all_for_account(tx_deps, ctx.account.id);
+                        const tokens_revoked = await query_revoke_all_api_tokens_for_account(tx_deps, ctx.account.id);
+                        return { sessions_revoked, tokens_revoked };
                     });
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
-                }
-                // Verify succeeded — do the throw-y operations FIRST so a fault
-                // (Argon2 OOM, native binding error, DB outage on the UPDATE)
-                // can't wipe the rate-limit history of a caller observing 500s.
-                // Resets happen below, after both calls have settled.
-                const new_hash = await password.hash_password(new_password);
-                // Conditional UPDATE keyed on the verified hash: closes the
-                // verify-write race with a concurrent password change that
-                // already committed against the same starting hash. Account-grain
-                // operation — `updated_by` stays null (the per-request actor is
-                // incidental; password is account-level state).
-                const updated = await query_update_account_password(route, ctx.account.id, new_hash, null, ctx.account.password_hash);
-                // Verify-success contract — the caller proved knowledge, so wipe
-                // their account-grain failure history. The race-loser branch below
-                // re-records one on top of the wiped slate so net cost stays 1 on
-                // that bucket. Deferring from "after verify" to "after UPDATE
-                // settled" is what closes the S1 bypass — a throw between reset
-                // and the UPDATE could have wiped an attacker's budget.
-                //
-                // The IP aggregate is deliberately not cleared: it is the same
-                // instance login uses, so refunding it here reopens the spray path
-                // through a route that only needs the caller's *own* password. Its
-                // record on the race-loser branch below therefore accumulates
-                // rather than netting out, which is the intent.
-                if (login_account_rate_limiter)
-                    login_account_rate_limiter.reset(ctx.account.id);
-                if (!updated) {
-                    // A concurrent password change committed first — our
-                    // `current_password` was correct at read-time but the row's
-                    // `password_hash` no longer matches. Mirrors the wrong-password
-                    // 401 shape; tag the failure metadata so admins reading the
-                    // audit log can distinguish "user typoed" from "two clients
-                    // raced." Sessions/tokens were already revoked by the winner;
-                    // no cookie clear here either.
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
+                    // Verify-success contract — the caller proved knowledge, so wipe
+                    // their account-grain failure history. The race-loser branch below
+                    // re-records one on top of the wiped slate so net cost stays 1 on
+                    // that bucket. Deferring from "after verify" to "after UPDATE
+                    // settled" is what closes the S1 bypass — a throw between reset
+                    // and the UPDATE could have wiped an attacker's budget.
+                    //
+                    // The IP aggregate is deliberately not cleared: it is the same
+                    // instance login uses, so refunding it here reopens the spray path
+                    // through a route that only needs the caller's *own* password. Its
+                    // record on the race-loser branch below therefore accumulates
+                    // rather than netting out, which is the intent.
                     if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(ctx.account.id);
+                        login_account_rate_limiter.reset(ctx.account.id);
+                    if (!change) {
+                        // A concurrent password change committed first — our
+                        // `current_password` was correct at read-time but the row's
+                        // `password_hash` no longer matches. Mirrors the wrong-password
+                        // 401 shape; tag the failure metadata so admins reading the
+                        // audit log can distinguish "user typoed" from "two clients
+                        // raced." Sessions/tokens were already revoked by the winner;
+                        // no cookie clear here either.
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'password_change',
+                            outcome: 'failure',
+                            account_id: ctx.account.id,
+                            ip: get_client_ip(c),
+                            metadata: { reason: 'concurrent_change', credential_type }
+                        });
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    const { sessions_revoked, tokens_revoked } = change;
+                    // Close every live connection of this account now the password
+                    // update and the revoke-all cascade have committed — inline, not
+                    // queued: with no route transaction, a throw later in the handler
+                    // would drop a queued close while the revocation stands. It does
+                    // not depend on the fail-open audit write below; the audit
+                    // listeners repeat it on the announced `password_change` row.
+                    close_connections_after_commit(connection_closer, { kind: 'account', account_id: ctx.account.id }, deps.log);
+                    clear_session_cookie(c, session_options);
+                    // Account-grain operation — no `actor_id`. The password is
+                    // account-level state; which per-request actor was resolved
+                    // has no semantic bearing on "this account changed its
+                    // password". Mirrors `login`/`logout`.
                     deps.audit.emit(route, {
                         event_type: 'password_change',
-                        outcome: 'failure',
                         account_id: ctx.account.id,
                         ip: get_client_ip(c),
-                        metadata: { reason: 'concurrent_change', credential_type }
+                        metadata: { sessions_revoked, tokens_revoked, credential_type }
                     });
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    return c.json({ ok: true, sessions_revoked, tokens_revoked });
+                }
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                // revoke all sessions and API tokens (force re-auth everywhere)
-                const sessions_revoked = await query_session_revoke_all_for_account(route, ctx.account.id);
-                const tokens_revoked = await query_revoke_all_api_tokens_for_account(route, ctx.account.id);
-                // Close every live connection of this account once the password
-                // update and the revoke-all cascade have committed — this route
-                // runs with the default `transaction: true`, and the queued close
-                // never runs before that commit or on rollback. It does not
-                // depend on the fail-open audit write below; the audit listeners
-                // repeat it on the announced `password_change` row.
-                queue_connection_close(route, connection_closer, {
-                    kind: 'account',
-                    account_id: ctx.account.id
-                });
-                clear_session_cookie(c, session_options);
-                // Account-grain operation — no `actor_id`. The password is
-                // account-level state; which per-request actor was resolved
-                // has no semantic bearing on "this account changed its
-                // password". Mirrors `login`/`logout`.
-                deps.audit.emit(route, {
-                    event_type: 'password_change',
-                    account_id: ctx.account.id,
-                    ip: get_client_ip(c),
-                    metadata: { sessions_revoked, tokens_revoked, credential_type }
-                });
-                return c.json({ ok: true, sessions_revoked, tokens_revoked });
             }
         }
     ];