@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/actions/CLAUDE.md

@@ -641,16 +641,21 @@ closed) — so a closed transport or registry hosts nothing more. Its Rust
 counterpart is `ShutdownCloser::close_all_sockets`, a supertrait of
 `SocketRevoker`.
 
-**Every revocation closes after its commit.** A handler never calls a closer
-inline: it calls `queue_connection_close(ctx, deps.connection_closer, target)`,
+**Every revocation closes after its commit.** A handler inside a route or
+action transaction never calls a closer inline: it calls
+`queue_connection_close(ctx, deps.connection_closer, target)`,
 which puts the close on the request's post-commit queue (`emit_after_commit`).
 The close runs once the handler's transaction has committed and is discarded
 when the handler throws — a rolled-back revocation closes nothing. `target` is
 a `ConnectionCloseTarget` (`{kind: 'session', session_token_hash}` /
 `{kind: 'token', api_token_id}` / `{kind: 'account', account_id}` /
 `{kind: 'role', account_id, role}`);
-`close_connections(closer, target)` is the immediate form the queue runs. Twin
-of `queue_socket_close` / `SocketCloseTarget`.
+`close_connections(closer, target)` is the immediate form the queue runs. A
+handler with no wrapping transaction (`/login`, `/password`) opens its own
+around its writes and closes straight after that commit with
+`close_connections_after_commit(closer, target, log)`, which logs a failing
+close as the post-commit flush does. Twin of `queue_socket_close` /
+`SocketCloseTarget`.
 
 The order is load-bearing for admission: a connection registers, then re-reads
 its credential, so a close that missed the registration must belong to a
@@ -812,7 +817,7 @@ Composes the standard upgrade stack:
 1. `verify_request_source(allowed_origins)`
 2. `require_auth`
 3. `require_token_scope('surface:ws_upgrade')` — a narrowed token cannot hold a socket
-4. Upgrade-time authorization phase — resolves the acting actor, seeds `REQUEST_CONTEXT_KEY` for the inner `register_action_ws`
+4. Upgrade-time authorization phase — resolves the acting actor (`?acting=` through `parse_acting`; malformed reads as omitted), seeds `REQUEST_CONTEXT_KEY` for the inner `register_action_ws`
 5. Optional `require_role(required_roles)` — any-of disjunction (coarse upgrade-time gate; per-action `auth` in each spec still applies at dispatch time)
 6. Delegates to `register_action_ws`
 

package/dist/actions/connection_closer.d.ts

@@ -46,6 +46,7 @@
  * @module
  */
 import type { Uuid } from '../primitive_schemas.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type EmitAfterCommitContext } from '../http/pending_effects.js';
 /**
  * Close live connections by identity, or all of them.
@@ -127,6 +128,21 @@ export type ConnectionCloseTarget = {
  * @returns how many connections closed
  */
 export declare const close_connections: (closer: ConnectionCloser, target: ConnectionCloseTarget) => number;
+/**
+ * Close the connections `target` names, now, for a revocation that has
+ * already committed — logging a close that throws instead of throwing it.
+ *
+ * For a handler with no route transaction, closing straight after its own
+ * commit: a throw there would fail a request whose revocation stands, and skip
+ * the work after the close (the response, the audit row). A closer over several
+ * transports closes the rest before it rethrows, so catching loses no close.
+ * The twin of the post-commit flush, which catches and logs the same way.
+ *
+ * @param closer - the closer to run, `deps.connection_closer` in a handler
+ * @param target - the connections to close
+ * @param log - where a failing close is reported
+ */
+export declare const close_connections_after_commit: (closer: ConnectionCloser, target: ConnectionCloseTarget, log: Logger) => void;
 /**
  * Queue a connection close on `ctx`'s post-commit queue, so it runs only after
  * the request's transaction commits and never when the handler throws.
@@ -135,8 +151,9 @@ export declare const close_connections: (closer: ConnectionCloser, target: Conne
  * why an in-transaction revocation must not close inline.
  *
  * In a handler with no wrapping transaction a throw still drops the queued
- * close while an autocommit write stays; close with `close_connections`
- * straight after the write there.
+ * close while an autocommit write stays; such a handler closes inline straight
+ * after its own commit instead, with `close_connections_after_commit`, which
+ * catches and logs a failing close as the post-commit flush does.
  *
  * @param ctx - the route or action context of the request doing the revoking
  * @param closer - the closer to run, `deps.connection_closer` in a handler

package/dist/actions/connection_closer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnE;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAaF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAMnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA8CzC,CAAC"}
+{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnE;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAaF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,GAC1C,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,EAC7B,KAAK,MAAM,KACT,IAMF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAMnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA8CzC,CAAC"}

package/dist/actions/connection_closer.js

@@ -69,6 +69,28 @@ export const close_connections = (closer, target) => {
             throw new UnreachableError(target);
     }
 };
+/**
+ * Close the connections `target` names, now, for a revocation that has
+ * already committed — logging a close that throws instead of throwing it.
+ *
+ * For a handler with no route transaction, closing straight after its own
+ * commit: a throw there would fail a request whose revocation stands, and skip
+ * the work after the close (the response, the audit row). A closer over several
+ * transports closes the rest before it rethrows, so catching loses no close.
+ * The twin of the post-commit flush, which catches and logs the same way.
+ *
+ * @param closer - the closer to run, `deps.connection_closer` in a handler
+ * @param target - the connections to close
+ * @param log - where a failing close is reported
+ */
+export const close_connections_after_commit = (closer, target, log) => {
+    try {
+        close_connections(closer, target);
+    }
+    catch (err) {
+        log.error('connection close after commit failed:', err);
+    }
+};
 /**
  * Queue a connection close on `ctx`'s post-commit queue, so it runs only after
  * the request's transaction commits and never when the handler throws.
@@ -77,8 +99,9 @@ export const close_connections = (closer, target) => {
  * why an in-transaction revocation must not close inline.
  *
  * In a handler with no wrapping transaction a throw still drops the queued
- * close while an autocommit write stays; close with `close_connections`
- * straight after the write there.
+ * close while an autocommit write stays; such a handler closes inline straight
+ * after its own commit instead, with `close_connections_after_commit`, which
+ * catches and logs a failing close as the post-commit flush does.
  *
  * @param ctx - the route or action context of the request doing the revoking
  * @param closer - the closer to run, `deps.connection_closer` in a handler

package/dist/actions/perform_action.d.ts

@@ -163,6 +163,16 @@ export type PerformActionResult = {
  * the harness omits `account_id`.
  */
 export declare const perform_action: (input: PerformActionInput, deps: PerformActionDeps) => Promise<PerformActionResult>;
+/**
+ * The credential-type 403 — one builder, so the dispatcher's gate below and a
+ * handler that gates a credential channel on its input (`account_delete`'s
+ * self path) emit a byte-identical error. Twin of the Rust
+ * `fuz_auth::credential_type_required`.
+ *
+ * @param required_credential_types - the channels that would be admitted
+ * @returns the `forbidden` error object with reason `credential_type_required`
+ */
+export declare const credential_type_required_error: (required_credential_types: ReadonlyArray<string>) => JsonrpcErrorObject;
 /**
  * Build a JSON-RPC response envelope from a `PerformActionResult` for
  * transports that wire over the JSON-RPC 2.0 message shape (HTTP RPC + WS).

package/dist/actions/perform_action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAmL7B,CAAC;AAuHF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}
+{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAsL7B,CAAC;AA6DF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAC1C,2BAA2B,aAAa,CAAC,MAAM,CAAC,KAC9C,kBAIA,CAAC;AAyDJ;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}

package/dist/actions/perform_action.js

@@ -58,6 +58,7 @@ import { DEV } from 'esm-env';
 import { apply_authorization_phase, has_any_scoped_role } from '../auth/request_context.js';
 import {} from '../hono_context.js';
 import { to_input_params } from '../http/schema_helpers.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
 import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
 import { JSONRPC_VERSION } from '../http/jsonrpc.js';
 import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, http_status_to_jsonrpc_error_code, JSONRPC_ERROR_CODES, dev_only } from '../http/jsonrpc_errors.js';
@@ -119,14 +120,17 @@ export const perform_action = async (input, deps) => {
     // budget it should, and so a throttled caller pays no schema work.
     const rate_limit = spec.rate_limit;
     if (rate_limit) {
-        const ip_check = action_ip_rate_limiter && (rate_limit === 'ip' || rate_limit === 'both');
+        const ip_limiter = rate_limit === 'ip' || rate_limit === 'both' ? action_ip_rate_limiter : null;
         const account_keyed_context = action_account_rate_limiter &&
             request_context !== null &&
             (rate_limit === 'account' || rate_limit === 'both')
             ? request_context
             : null;
-        if (ip_check) {
-            const result = action_ip_rate_limiter.check(client_ip);
+        // keyed by the address's rate-limit key (an IPv6 client's /64); the
+        // audit trail keeps `client_ip` whole
+        const ip_key = ip_limiter ? rate_limit_ip_key(client_ip) : '';
+        if (ip_limiter) {
+            const result = ip_limiter.check(ip_key);
             if (!result.allowed)
                 return rate_limited_result(result.retry_after);
         }
@@ -135,8 +139,8 @@ export const perform_action = async (input, deps) => {
             if (!result.allowed)
                 return rate_limited_result(result.retry_after);
         }
-        if (ip_check)
-            action_ip_rate_limiter.record(client_ip);
+        if (ip_limiter)
+            ip_limiter.record(ip_key);
         if (account_keyed_context) {
             action_account_rate_limiter.record(account_keyed_context.account.id);
         }
@@ -262,6 +266,19 @@ const check_action_auth_pre_authorization = (auth, account_id) => {
     }
     return null;
 };
+/**
+ * The credential-type 403 — one builder, so the dispatcher's gate below and a
+ * handler that gates a credential channel on its input (`account_delete`'s
+ * self path) emit a byte-identical error. Twin of the Rust
+ * `fuz_auth::credential_type_required`.
+ *
+ * @param required_credential_types - the channels that would be admitted
+ * @returns the `forbidden` error object with reason `credential_type_required`
+ */
+export const credential_type_required_error = (required_credential_types) => jsonrpc_error_messages.forbidden('forbidden', {
+    reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
+    required_credential_types
+});
 /**
  * Post-authorization auth gate — fires after the authorization phase
  * resolved the actor + role_grants. Enforces `auth.credential_types` and
@@ -289,10 +306,7 @@ const check_action_auth_pre_authorization = (auth, account_id) => {
 const check_action_auth_post_authorization = (auth, request_context, credential_type, method, token_scope) => {
     if (auth.credential_types?.length) {
         if (!credential_type || !auth.credential_types.includes(credential_type)) {
-            return jsonrpc_error_messages.forbidden('forbidden', {
-                reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
-                required_credential_types: auth.credential_types
-            });
+            return credential_type_required_error(auth.credential_types);
         }
     }
     // Token-scope gate — second of three. See the doc comment for why the order

package/dist/actions/register_ws_endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAaH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAgDD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAoBF,CAAC"}
+{"version":3,"file":"register_ws_endpoint.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_ws_endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAcH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAEN,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACzE;;;;OAIG;IACH,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AA6CD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,yBAAyB,KAChC,sBAoBF,CAAC"}

package/dist/actions/register_ws_endpoint.js

@@ -35,6 +35,7 @@
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_authorization_phase, REQUEST_CONTEXT_KEY, require_auth, require_role, require_token_scope } from '../auth/request_context.js';
 import { verify_request_source } from '../http/origin.js';
+import { parse_acting } from '../http/auth_shape.js';
 import { ACCOUNT_ID_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { register_action_ws } from './register_action_ws.js';
 /** Synthesized auth shape for WS upgrade: account + actor both required. */
@@ -62,9 +63,11 @@ const create_ws_authorization_middleware = (db) => {
             await next();
             return;
         }
-        const acting_param = c.req.query('acting');
+        // through the `ActingActor` schema like every other selector: lowercased,
+        // and a malformed value reads as omitted (`parse_acting`)
+        const acting = parse_acting(c.req.query('acting'));
         const account_id = c.get(ACCOUNT_ID_KEY) ?? null;
-        const result = await apply_authorization_phase({ db }, account_id, WS_UPGRADE_AUTH, acting_param ?? undefined);
+        const result = await apply_authorization_phase({ db }, account_id, WS_UPGRADE_AUTH, acting);
         if (!result.ok)
             return c.json(result.body, result.status);
         if (result.request_context !== null) {

package/dist/auth/CLAUDE.md

@@ -269,16 +269,33 @@ delete / list / clone / moderate`), error reasons, and `all_cell_action_specs`
   manage grants or read the audit timeline. NULL
   `created_by` (system origin) is admin-only for edit/manage (explicit
   defense-in-depth). "Admin" on every tier is the **global** grant — a
-  scoped `admin` row bypasses nothing.
-- `auth/cell_relation_visibility.ts` — `filter_visible_target_ids(deps,
-auth, ids)`: batched strict relation-read filter. Every relation read —
-  the `cell_get` bundle, **forward and reverse** `cell_field_list` /
-  `cell_item_list`, and the deep-clone walk (children bulk-loaded via
-  `query_cell_load_many`) — drops edges whose far endpoint the caller can't
-  view, so a viewer of a parent can't enumerate private linked cells by id.
-  Two queries for the whole id-set (avoids the N+1 of a per-row check). The
-  reverse list verbs additionally cap the fetch by the wire `limit` so a
-  heavily inbound-linked target can't force an unbounded scan.
+  scoped `admin` row bypasses nothing. `can_view_cell`'s public and grant
+  arms also require the cell's `moderation` to admit an audience
+  (`db/cell_moderation.ts`: unmoderated or `approved`), so a pending or
+  rejected contribution is its author's and admins' alone; `can_edit_cell`'s
+  editor-grant arm requires the same admission. `can_steward_cell`
+  is the separate moderator read: the governing root's manager on a pending or
+  rejected contribution under a live root.
+- `auth/cell_steward.ts` — `cell_steward_admits(deps, auth, cell)`: the steward
+  arm with its governing-root load, run only after `can_view_cell` denies. Its
+  module doc names where the arm applies (`cell_get`, `cell_moderate`, the
+  cell-scoped fact route, `cell_list`'s SQL) and where it must not (clone,
+  contribution parents, relation reads, `shared_with`, grant recompute).
+- Strict relation-read visibility — every relation read drops edges whose far
+  endpoint the caller can't view, so a viewer of a parent can't enumerate
+  private linked cells by id. **Forward and reverse** `cell_field_list` /
+  `cell_item_list` filter in SQL before their limit
+  (`db/cell_view_sql.ts`'s `can_view_cell_sql`, bound through
+  `cell_viewer_from_auth`), so a page is up to `limit` edges whose other end
+  the caller can view — `CELL_RELATION_LIST_LIMIT_DEFAULT` (50) when omitted,
+  `CELL_RELATION_LIST_LIMIT_MAX` (500) at most
+  (`auth/cell_relation_list_limit.ts`), and hidden ends never crowd out
+  visible ones. The `cell_get` bundle (whose `*_truncated` counts raw edges)
+  and the clone walk read with `CELL_VIEWER_UNRESTRICTED` and filter after,
+  through `auth/cell_relation_visibility.ts`'s `filter_visible_target_ids(deps,
+auth, ids)`: two queries for the whole id-set, the cells read through the
+  narrow `CELL_VIEW_COLUMNS` projection (`query_cell_view_load_many`), never
+  the payload.
 - `auth/cell_actions.ts` — `create_cell_actions(deps)`, the generic
   handlers. `cell_create` stamps `created_by` + writes the top-level `kind`
   column; `path` writes are admin-only. It also resolves the directory tree:
@@ -296,7 +313,9 @@ auth, ids)`: batched strict relation-read filter. Every relation read —
   parent-aware `authorize_create` dep (`CellCreateAuthorize` — wider input
   `{kind, data, parent_id, root_id, root_data, scope_id}` than `validate_data`,
   returning a `CellCreateVerdict` `{allow:false} | {allow:true, moderation_required}`)
-  gates create by capability; it runs after the validator + the parent-resolve.
+  gates create by capability; it runs after the validator + the parent-resolve
+  (which **404**s `cell_not_found` on a missing or soft-deleted root as on a
+  missing parent, authorizer or not).
   A **viewable**-parent / root-creation deny is **403** `cell_create_forbidden`
   (the create-path **404** mask is reserved for a hidden parent); `Allow` folds
   the moderation outcome (born `pending`+private vs `approved`+author-visibility).
@@ -306,7 +325,8 @@ auth, ids)`: batched strict relation-read filter. Every relation read —
   single-connection deadlock of the in-memory drivers). `None`/omitted = open create (the default;
   mirrors `validate_data`). `cell_moderate` is the `pending → approved | rejected`
   transition, gated on `can_manage_cell` of the **governing root** (admin / root
-  owner — the author lands a 403, the anti-self-approval guard); approve flips
+  owner — the author lands a 403, the anti-self-approval guard; a root owner
+  reaches the check through the steward arm); approve flips
   `moderation → approved` + `visibility → public`, reject sets `rejected`.
 - `auth/cell_grant_actions.ts` / `cell_field_actions.ts` /
   `cell_item_actions.ts` / `cell_audit_actions.ts` — the relation + ACL +
@@ -588,7 +608,7 @@ reactivation has no self path because a soft-deleted account can't
 authenticate.
 
 - `admin_account_list_action_spec` — read; input `{limit?, offset?, include_deleted?}`; output `{accounts, grantable_roles}`. `include_deleted` (default false) surfaces soft-deleted rows (with `account.deleted_at` set) for the admin UI's reactivation view.
-- `account_delete_action_spec` — mutation (soft delete); self-or-admin (`{account, actor}`, handler elevates to admin when `account_id` ≠ self); input `{account_id?}`; output `{ok, deleted}`. Tombstones account + actor(s), revokes sessions/tokens, emits `account_delete` + per-actor `actor_delete`. Refuses a keeper-role target (`ERROR_CANNOT_DELETE_KEEPER`) or the sole active admin (`ERROR_CANNOT_DELETE_LAST_ADMIN`) — both fail-loud with a failure-audit row.
+- `account_delete_action_spec` — mutation (soft delete); self-or-admin (`{account, actor}`, handler elevates to admin when `account_id` ≠ self); the self path is session-only, handler-enforced ahead of the target guards (an API or daemon token gets the dispatcher's `ERROR_CREDENTIAL_TYPE_REQUIRED` 403 via `credential_type_required_error`), while an admin deleting another account keeps any credential; input `{account_id?}`; output `{ok, deleted}`. Tombstones account + actor(s), revokes sessions/tokens, emits `account_delete` + per-actor `actor_delete`. Refuses a keeper-role target (`ERROR_CANNOT_DELETE_KEEPER`) or the sole active admin (`ERROR_CANNOT_DELETE_LAST_ADMIN`) — both fail-loud with a failure-audit row.
 - `account_purge_action_spec` — mutation (hard purge); keeper-only (`credential_types: ['daemon_token']` + `roles: ['keeper']`) + `confirm: true` + WARN; input `{account_id, confirm?}`; output `{ok, purged}`. Cascading delete; emits `account_purge` + per-actor `actor_purge` (identity snapshot survives in metadata since `audit_log` ids carry no FK). Refuses a keeper-role target (`ERROR_CANNOT_DELETE_KEEPER`) or the sole active admin (`ERROR_CANNOT_DELETE_LAST_ADMIN`).
 - `account_undelete_action_spec` — mutation (reactivation, inverse of soft delete); admin-only (`roles: ['admin']` — no self path, a tombstoned account can't authenticate); input `{account_id}`; output `{ok, undeleted}`. Clears the `deleted_at` tombstone on the account + its actor(s), emits `account_undelete` + per-actor `actor_undelete`. Does not restore revoked sessions/tokens.
 - `admin_session_list_action_spec` — read; input `{acting?}` (`.default({})`); output `{sessions}`.

package/dist/auth/account_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAsB9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAyB3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,yBAAyB,EAC/B,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CA8KjB,CAAC"}
+{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAwB9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAyB3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,yBAAyB,EAC/B,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAsLjB,CAAC"}

package/dist/auth/account_actions.js

@@ -27,12 +27,14 @@
  *
  * @module
  */
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { rpc_action } from '../actions/action_rpc.js';
+import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { queue_connection_close } from '../actions/connection_closer.js';
 import { to_session_account } from './account_schema.js';
 import { query_session_list_for_account, query_session_revoke_for_account, query_session_revoke_all_for_account } from './session_queries.js';
 import { query_api_token_enforce_limit, query_api_token_list_for_account, query_create_api_token, query_revoke_api_token_for_account } from './api_token_queries.js';
-import { parse_stored_token_scope, token_scope_from_input, token_scope_label } from './token_scope.js';
+import { parse_stored_token_scope, serialize_token_scope, token_scope_from_input, token_scope_label } from './token_scope.js';
 import { token_lifetime_to_expires_at } from './token_lifetime.js';
 import { generate_api_token } from './api_token.js';
 import { DEFAULT_MAX_TOKENS } from './account_route_schema.js';
@@ -108,6 +110,15 @@ export const create_account_actions = (deps, options = {}) => {
         // There is deliberately no permissive fallback here: an omitted scope is
         // a validation error upstream, not a full-authority token.
         const scope = token_scope_from_input(input.scope);
+        // Over the stored-document cap is a malformed request, refused before
+        // any write (the insert would otherwise throw it as a 500). Twin of the
+        // Rust spine's `invalid_params` on `TokenScopeError::TooLarge`.
+        try {
+            serialize_token_scope(scope);
+        }
+        catch (err) {
+            throw jsonrpc_errors.invalid_params(`invalid scope: ${to_error_message(err)}`);
+        }
         // `input.lifetime` is required for the same reason — an omitted lifetime
         // is a validation error, never an eternal token.
         const expires_at = token_lifetime_to_expires_at(input.lifetime);

package/dist/auth/account_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAqD1B,CAAC"}
+{"version":3,"file":"account_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaD,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACxC,8FAA8F;IAC9F,0BAA0B,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,wBAAwB,KAC/B,CACF,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CA6D1B,CAAC"}

package/dist/auth/account_route_schema.js

@@ -123,6 +123,10 @@ export const create_account_route_shapes = (options) => [
         input: LoginInput,
         output: LoginOutput,
         rate_limit: 'both',
+        // The handler opens its own transaction around just the session writes,
+        // so a reservation waiting for a slot, and the Argon2 verify, hold no
+        // database connection.
+        transaction: false,
         errors: {
             400: z.looseObject({
                 error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])
@@ -151,6 +155,10 @@ export const create_account_route_shapes = (options) => [
         input: PasswordChangeInput,
         output: PasswordChangeOutput,
         rate_limit: options.login_account_rate_limited ? 'both' : 'ip',
+        // The handler opens its own transaction around just the password update
+        // and the revocations, so a reservation waiting for a slot, and the
+        // Argon2 verify and hash, hold no database connection.
+        transaction: false,
         errors: {
             400: z.looseObject({
                 error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])

package/dist/auth/account_routes.d.ts

@@ -134,8 +134,13 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * `/login` closes the connections of the sessions its cap evicts, and
- * `/logout` and `/password` close the account's, each after the route's
- * transaction commits (`queue_connection_close` on `deps.connection_closer`).
+ * `/logout` and `/password` close the account's, each once its revocation has
+ * committed: `/logout` through the route transaction's post-commit queue
+ * (`queue_connection_close`), `/login` and `/password` — which open their own
+ * transaction around just their writes — straight after it commits
+ * (`close_connections_after_commit`, which logs a failing close rather than
+ * failing the committed request), so a later throw can't drop a close a
+ * committed revocation owes. All on `deps.connection_closer`.
  *
  * @param deps - stateless capabilities (keyring, password, log, audit, connection_closer)
  * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAIlD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE;;;;;;;OAOG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CA2RjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIxE,OAAO,EAGN,KAAK,WAAW,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAOlD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SAkFhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE;;;;;;;OAOG;IACH,qBAAqB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CA+VjB,CAAC"}