@fuzdev/fuz_app 0.141.0 → 0.142.0

package/dist/auth/account_routes.js

@@ -31,8 +31,10 @@ import { build_account_context, build_request_context, get_request_context, requ
 import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
-import { queue_connection_close } from '../actions/connection_closer.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
+import { parse_acting } from '../http/auth_shape.js';
+import { rate_limit_exceeded_response, reserve_optional } from '../rate_limiter.js';
+import { close_connections_after_commit, queue_connection_close } from '../actions/connection_closer.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS } from '../http/error_schemas.js';
 /**
  * Create the account status route spec.
@@ -82,10 +84,15 @@ export const create_account_status_route_spec = (options) => ({
         // Resolve actor + role_grants when the caller is unambiguous (single-actor
         // account, or supplied `?acting=<uuid>`). On multi-actor accounts
         // without `acting`, fall back to account-only so the frontend can
-        // surface a persona picker.
-        const acting = c.req.query('acting') ?? undefined;
-        const acting_result = await resolve_acting_actor(route, account_id, acting);
-        if (acting_result.ok) {
+        // surface a persona picker. The selector goes through the `ActingActor`
+        // schema, lowercased; a malformed value is a missing persona —
+        // account-only, never a default-actor resolve (as on the Rust spine).
+        const acting_raw = c.req.query('acting');
+        const acting = parse_acting(acting_raw);
+        const acting_result = acting_raw !== undefined && acting === undefined
+            ? null
+            : await resolve_acting_actor(route, account_id, acting);
+        if (acting_result?.ok) {
             const ctx = await build_request_context(route, account_id, acting_result.actor_id);
             if (ctx) {
                 const role_grants = ctx.role_grants.map((p) => ({
@@ -156,8 +163,13 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
  * Self-service session/token management is on `auth/account_actions.ts`.
  *
  * `/login` closes the connections of the sessions its cap evicts, and
- * `/logout` and `/password` close the account's, each after the route's
- * transaction commits (`queue_connection_close` on `deps.connection_closer`).
+ * `/logout` and `/password` close the account's, each once its revocation has
+ * committed: `/logout` through the route transaction's post-commit queue
+ * (`queue_connection_close`), `/login` and `/password` — which open their own
+ * transaction around just their writes — straight after it commits
+ * (`close_connections_after_commit`, which logs a failing close rather than
+ * failing the committed request), so a later throw can't drop a close a
+ * committed revocation owes. All on `deps.connection_closer`.
  *
  * @param deps - stateless capabilities (keyring, password, log, audit, connection_closer)
  * @param options - per-factory configuration (session_options, login_ip_rate_limiter, login_account_rate_limiter, bootstrap_status)
@@ -185,99 +197,122 @@ export const create_account_route_specs = (deps, options) => {
         {
             ...login_shape,
             handler: async (c, route) => {
-                // Per-IP rate limit check (before any DB/password work)
-                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
-                if (login_ip_rate_limiter && ip) {
-                    const check = login_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before any DB/password work). Reserved, not
+                // checked: the attempt counts against the cap from here until it
+                // settles, so a concurrent burst can't all pass before any of it
+                // records. A key at its cap only because of attempts in flight
+                // waits briefly for a slot (`RESERVATION_WAIT_MAX_MS`) rather than
+                // refusing a burst of correct logins outright. Order: IP, then the
+                // lookup, then the account (its key is the looked-up id). A wait on
+                // the account bucket keeps the IP slot: it belongs to the same
+                // address, the wait is bounded, and giving it up would let that
+                // address exceed its cap meanwhile. The `finally` releases whatever
+                // no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = login_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(login_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                // `UsernameProvided` canonicalizes via `.trim().toLowerCase()` at
-                // parse time — the validated value lands canonical in
-                // `c.var.validated_input`, so the per-account rate-limit key,
-                // DB lookup, and audit metadata see one form. See
-                // `primitive_schemas.ts` for the schema-layer canonicalization.
-                const { username, password: pw } = get_route_input(c);
-                // DB lookup first so we can key the per-account rate limit by a canonical value
-                // (account.id) rather than the submitted identifier. Otherwise an attacker could
-                // alternate between username and email to double the per-account bucket.
-                const account = await query_account_by_username_or_email(route, username);
-                const account_rate_key = account ? account.id : username;
-                // Per-account rate limit check (after DB lookup so the key is canonical)
-                if (login_account_rate_limiter) {
-                    const check = login_account_rate_limiter.check(account_rate_key);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    // `UsernameProvided` canonicalizes via `.trim().toLowerCase()` at
+                    // parse time — the validated value lands canonical in
+                    // `c.var.validated_input`, so the per-account rate-limit key,
+                    // DB lookup, and audit metadata see one form. See
+                    // `primitive_schemas.ts` for the schema-layer canonicalization.
+                    const { username, password: pw } = get_route_input(c);
+                    // DB lookup first so we can key the per-account rate limit by a canonical value
+                    // (account.id) rather than the submitted identifier. Otherwise an attacker could
+                    // alternate between username and email to double the per-account bucket.
+                    const account = await query_account_by_username_or_email(route, username);
+                    const account_rate_key = account ? account.id : username;
+                    // Per-account rate limit (after DB lookup so the key is canonical)
+                    const account_reserved = await reserve_optional(login_account_rate_limiter, account_rate_key, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                // Start the minimum-delay timer concurrently with failure work.
-                // Observed response time is max(work, delay) so all 401 paths
-                // (found-wrong-pw, not-found) return in similar time.
-                const delay = login_fail_delay(login_fail_floor_ms, login_fail_jitter_ms);
-                if (!account) {
-                    // enumeration prevention: verify_dummy equalizes Argon2id timing;
-                    // login_fail_delay equalizes every other path difference.
-                    await password.verify_dummy(pw);
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
-                    if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(account_rate_key);
-                    deps.audit.emit(route, {
-                        event_type: 'login',
-                        outcome: 'failure',
-                        ip: get_client_ip(c),
-                        metadata: { username }
-                    });
-                    await delay;
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
-                }
-                const valid = await password.verify_password(pw, account.password_hash);
-                if (!valid) {
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
+                    account_reservation = account_reserved.reservation;
+                    // Start the minimum-delay timer concurrently with failure work.
+                    // Observed response time is max(work, delay) so all 401 paths
+                    // (found-wrong-pw, not-found) return in similar time.
+                    const delay = login_fail_delay(login_fail_floor_ms, login_fail_jitter_ms);
+                    if (!account) {
+                        // enumeration prevention: verify_dummy equalizes Argon2id timing;
+                        // login_fail_delay equalizes every other path difference.
+                        await password.verify_dummy(pw);
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'login',
+                            outcome: 'failure',
+                            ip: get_client_ip(c),
+                            metadata: { username }
+                        });
+                        await delay;
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    const valid = await password.verify_password(pw, account.password_hash);
+                    if (!valid) {
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'login',
+                            outcome: 'failure',
+                            account_id: account.id,
+                            ip: get_client_ip(c),
+                            metadata: { username }
+                        });
+                        await delay;
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    // Successful login — clear the account-grain failure history only.
+                    // The IP aggregate is deliberately left standing: it is the
+                    // distributed-spray backstop, so a success on one account must not
+                    // refund the budget shared by every other account reachable from
+                    // that address. See `RateLimiter.reset`. A success records nothing:
+                    // both reservations are released.
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                     if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(account_rate_key);
+                        login_account_rate_limiter.reset(account_rate_key);
+                    // The session INSERT and the cap eviction are the route's only
+                    // writes, and only atomic together: one transaction around just
+                    // them (the route is `transaction: false`, so the reservation
+                    // waits above and the Argon2 verify held no connection). Twin of
+                    // the Rust login's transaction around `create_capped_session`.
+                    const evicted = await route.db.transaction((tx) => create_session_and_set_cookie({
+                        keyring,
+                        deps: { db: tx },
+                        c,
+                        account_id: account.id,
+                        session_options,
+                        max_sessions
+                    }));
+                    // The sessions the cap evicted are gone from the table, but not
+                    // from the connections they opened — a WebSocket keeps the
+                    // authority it resolved at upgrade, and an SSE stream never
+                    // rechecks. Close them now the eviction has committed — inline, not
+                    // queued: with no route transaction, a throw later in the handler
+                    // would drop a queued close while the eviction stands. No audit
+                    // row: there is no eviction event, and the `login` row records
+                    // the cause.
+                    for (const session_token_hash of evicted) {
+                        close_connections_after_commit(connection_closer, { kind: 'session', session_token_hash }, deps.log);
+                    }
                     deps.audit.emit(route, {
                         event_type: 'login',
-                        outcome: 'failure',
                         account_id: account.id,
-                        ip: get_client_ip(c),
-                        metadata: { username }
+                        ip: get_client_ip(c)
                     });
-                    await delay;
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    return c.json({ ok: true });
                 }
-                // Successful login — clear the account-grain failure history only.
-                // The IP aggregate is deliberately left standing: it is the
-                // distributed-spray backstop, so a success on one account must not
-                // refund the budget shared by every other account reachable from
-                // that address. See `RateLimiter.reset`.
-                if (login_account_rate_limiter)
-                    login_account_rate_limiter.reset(account_rate_key);
-                const evicted = await create_session_and_set_cookie({
-                    keyring,
-                    deps: route,
-                    c,
-                    account_id: account.id,
-                    session_options,
-                    max_sessions
-                });
-                // The sessions the cap evicted are gone from the table, but not
-                // from the connections they opened — a WebSocket keeps the
-                // authority it resolved at upgrade, and an SSE stream never
-                // rechecks. Close them once the eviction has committed. No audit
-                // row: there is no eviction event, and the `login` row records
-                // the cause.
-                for (const session_token_hash of evicted) {
-                    queue_connection_close(route, connection_closer, { kind: 'session', session_token_hash });
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                deps.audit.emit(route, {
-                    event_type: 'login',
-                    account_id: account.id,
-                    ip: get_client_ip(c)
-                });
-                return c.json({ ok: true });
             }
         },
         {
@@ -316,111 +351,129 @@ export const create_account_route_specs = (deps, options) => {
         {
             ...password_shape,
             handler: async (c, route) => {
-                // per-IP rate limit check (before argon2 work)
-                const ip = login_ip_rate_limiter ? get_client_ip(c) : null;
-                if (login_ip_rate_limiter && ip) {
-                    const check = login_ip_rate_limiter.check(ip);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
-                    }
+                // Per-IP rate limit (before argon2 work). Reserved, not checked:
+                // the attempt counts against the shared login limiters from here
+                // until it settles, so a concurrent burst of guesses at
+                // `current_password` can't all pass before any of it records. The
+                // `finally` releases whatever no branch recorded.
+                // keyed by the address's rate-limit key (an IPv6 client's /64)
+                const ip_key = login_ip_rate_limiter ? rate_limit_ip_key(get_client_ip(c)) : null;
+                const ip_reserved = await reserve_optional(login_ip_rate_limiter, ip_key, {
+                    signal: c.req.raw.signal
+                });
+                if (!ip_reserved.ok) {
+                    return rate_limit_exceeded_response(c, ip_reserved.retry_after);
                 }
-                const ctx = require_request_context(c);
-                const { current_password, new_password } = get_route_input(c);
-                // Defense in depth — see `docs/security.md` §Credential-channel gating.
-                const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? undefined;
-                // per-account rate limit check (after context resolution, before argon2 work)
-                if (login_account_rate_limiter) {
-                    const check = login_account_rate_limiter.check(ctx.account.id);
-                    if (!check.allowed) {
-                        return rate_limit_exceeded_response(c, check.retry_after);
+                let account_reservation = null;
+                try {
+                    const ctx = require_request_context(c);
+                    const { current_password, new_password } = get_route_input(c);
+                    // Defense in depth — see `docs/security.md` §Credential-channel gating.
+                    const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? undefined;
+                    // per-account rate limit (after context resolution, before argon2 work)
+                    const account_reserved = await reserve_optional(login_account_rate_limiter, ctx.account.id, { signal: c.req.raw.signal });
+                    if (!account_reserved.ok) {
+                        return rate_limit_exceeded_response(c, account_reserved.retry_after);
                     }
-                }
-                const valid = await password.verify_password(current_password, ctx.account.password_hash);
-                if (!valid) {
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
-                    if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(ctx.account.id);
-                    deps.audit.emit(route, {
-                        event_type: 'password_change',
-                        outcome: 'failure',
-                        account_id: ctx.account.id,
-                        ip: get_client_ip(c),
-                        metadata: { credential_type }
+                    account_reservation = account_reserved.reservation;
+                    const valid = await password.verify_password(current_password, ctx.account.password_hash);
+                    if (!valid) {
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'password_change',
+                            outcome: 'failure',
+                            account_id: ctx.account.id,
+                            ip: get_client_ip(c),
+                            metadata: { credential_type }
+                        });
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    // Verify succeeded — do the throw-y operations FIRST so a fault
+                    // (Argon2 OOM, native binding error, DB outage on the UPDATE)
+                    // can't wipe the rate-limit history of a caller observing 500s.
+                    // Resets happen below, after both calls have settled.
+                    const new_hash = await password.hash_password(new_password);
+                    // Conditional UPDATE keyed on the verified hash: closes the
+                    // verify-write race with a concurrent password change that
+                    // already committed against the same starting hash. Account-grain
+                    // operation — `updated_by` stays null (the per-request actor is
+                    // incidental; password is account-level state).
+                    //
+                    // The UPDATE and the two revocations are the route's writes, and
+                    // commit together or not at all: one transaction around just them
+                    // (the route is `transaction: false`, so the reservation waits
+                    // above and the Argon2 verify and hash held no connection). Twin of
+                    // the Rust spine's `change_password`. `null` when the UPDATE matched
+                    // nothing — a concurrent change committed first.
+                    const change = await route.db.transaction(async (tx) => {
+                        const tx_deps = { db: tx };
+                        const updated = await query_update_account_password(tx_deps, ctx.account.id, new_hash, null, ctx.account.password_hash);
+                        if (!updated)
+                            return null;
+                        // revoke all sessions and API tokens (force re-auth everywhere)
+                        const sessions_revoked = await query_session_revoke_all_for_account(tx_deps, ctx.account.id);
+                        const tokens_revoked = await query_revoke_all_api_tokens_for_account(tx_deps, ctx.account.id);
+                        return { sessions_revoked, tokens_revoked };
                     });
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
-                }
-                // Verify succeeded — do the throw-y operations FIRST so a fault
-                // (Argon2 OOM, native binding error, DB outage on the UPDATE)
-                // can't wipe the rate-limit history of a caller observing 500s.
-                // Resets happen below, after both calls have settled.
-                const new_hash = await password.hash_password(new_password);
-                // Conditional UPDATE keyed on the verified hash: closes the
-                // verify-write race with a concurrent password change that
-                // already committed against the same starting hash. Account-grain
-                // operation — `updated_by` stays null (the per-request actor is
-                // incidental; password is account-level state).
-                const updated = await query_update_account_password(route, ctx.account.id, new_hash, null, ctx.account.password_hash);
-                // Verify-success contract — the caller proved knowledge, so wipe
-                // their account-grain failure history. The race-loser branch below
-                // re-records one on top of the wiped slate so net cost stays 1 on
-                // that bucket. Deferring from "after verify" to "after UPDATE
-                // settled" is what closes the S1 bypass — a throw between reset
-                // and the UPDATE could have wiped an attacker's budget.
-                //
-                // The IP aggregate is deliberately not cleared: it is the same
-                // instance login uses, so refunding it here reopens the spray path
-                // through a route that only needs the caller's *own* password. Its
-                // record on the race-loser branch below therefore accumulates
-                // rather than netting out, which is the intent.
-                if (login_account_rate_limiter)
-                    login_account_rate_limiter.reset(ctx.account.id);
-                if (!updated) {
-                    // A concurrent password change committed first — our
-                    // `current_password` was correct at read-time but the row's
-                    // `password_hash` no longer matches. Mirrors the wrong-password
-                    // 401 shape; tag the failure metadata so admins reading the
-                    // audit log can distinguish "user typoed" from "two clients
-                    // raced." Sessions/tokens were already revoked by the winner;
-                    // no cookie clear here either.
-                    if (login_ip_rate_limiter && ip)
-                        login_ip_rate_limiter.record(ip);
+                    // Verify-success contract — the caller proved knowledge, so wipe
+                    // their account-grain failure history. The race-loser branch below
+                    // re-records one on top of the wiped slate so net cost stays 1 on
+                    // that bucket. Deferring from "after verify" to "after UPDATE
+                    // settled" is what closes the S1 bypass — a throw between reset
+                    // and the UPDATE could have wiped an attacker's budget.
+                    //
+                    // The IP aggregate is deliberately not cleared: it is the same
+                    // instance login uses, so refunding it here reopens the spray path
+                    // through a route that only needs the caller's *own* password. Its
+                    // record on the race-loser branch below therefore accumulates
+                    // rather than netting out, which is the intent.
                     if (login_account_rate_limiter)
-                        login_account_rate_limiter.record(ctx.account.id);
+                        login_account_rate_limiter.reset(ctx.account.id);
+                    if (!change) {
+                        // A concurrent password change committed first — our
+                        // `current_password` was correct at read-time but the row's
+                        // `password_hash` no longer matches. Mirrors the wrong-password
+                        // 401 shape; tag the failure metadata so admins reading the
+                        // audit log can distinguish "user typoed" from "two clients
+                        // raced." Sessions/tokens were already revoked by the winner;
+                        // no cookie clear here either.
+                        ip_reserved.reservation.record();
+                        account_reservation?.record();
+                        deps.audit.emit(route, {
+                            event_type: 'password_change',
+                            outcome: 'failure',
+                            account_id: ctx.account.id,
+                            ip: get_client_ip(c),
+                            metadata: { reason: 'concurrent_change', credential_type }
+                        });
+                        return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    }
+                    const { sessions_revoked, tokens_revoked } = change;
+                    // Close every live connection of this account now the password
+                    // update and the revoke-all cascade have committed — inline, not
+                    // queued: with no route transaction, a throw later in the handler
+                    // would drop a queued close while the revocation stands. It does
+                    // not depend on the fail-open audit write below; the audit
+                    // listeners repeat it on the announced `password_change` row.
+                    close_connections_after_commit(connection_closer, { kind: 'account', account_id: ctx.account.id }, deps.log);
+                    clear_session_cookie(c, session_options);
+                    // Account-grain operation — no `actor_id`. The password is
+                    // account-level state; which per-request actor was resolved
+                    // has no semantic bearing on "this account changed its
+                    // password". Mirrors `login`/`logout`.
                     deps.audit.emit(route, {
                         event_type: 'password_change',
-                        outcome: 'failure',
                         account_id: ctx.account.id,
                         ip: get_client_ip(c),
-                        metadata: { reason: 'concurrent_change', credential_type }
+                        metadata: { sessions_revoked, tokens_revoked, credential_type }
                     });
-                    return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
+                    return c.json({ ok: true, sessions_revoked, tokens_revoked });
+                }
+                finally {
+                    ip_reserved.reservation.release();
+                    account_reservation?.release();
                 }
-                // revoke all sessions and API tokens (force re-auth everywhere)
-                const sessions_revoked = await query_session_revoke_all_for_account(route, ctx.account.id);
-                const tokens_revoked = await query_revoke_all_api_tokens_for_account(route, ctx.account.id);
-                // Close every live connection of this account once the password
-                // update and the revoke-all cascade have committed — this route
-                // runs with the default `transaction: true`, and the queued close
-                // never runs before that commit or on rollback. It does not
-                // depend on the fail-open audit write below; the audit listeners
-                // repeat it on the announced `password_change` row.
-                queue_connection_close(route, connection_closer, {
-                    kind: 'account',
-                    account_id: ctx.account.id
-                });
-                clear_session_cookie(c, session_options);
-                // Account-grain operation — no `actor_id`. The password is
-                // account-level state; which per-request actor was resolved
-                // has no semantic bearing on "this account changed its
-                // password". Mirrors `login`/`logout`.
-                deps.audit.emit(route, {
-                    event_type: 'password_change',
-                    account_id: ctx.account.id,
-                    ip: get_client_ip(c),
-                    metadata: { sessions_revoked, tokens_revoked, credential_type }
-                });
-                return c.json({ ok: true, sessions_revoked, tokens_revoked });
             }
         }
     ];

package/dist/auth/admin_action_specs.d.ts

@@ -668,7 +668,12 @@ export declare const invite_delete_action_spec: {
 /**
  * Soft-delete an account (reversible tombstone). Self-or-admin: the
  * caller may delete their own account; deleting another requires the
- * admin role (handler-enforced elevation). No `admin_` prefix — the
+ * admin role (handler-enforced elevation). The self path is session-only,
+ * also handler-enforced — the spec declares no `credential_types` so an
+ * admin deleting another account keeps any credential, and a self-delete
+ * over an API or daemon token gets the dispatcher's own 403
+ * `credential_type_required` (`required_credential_types: ['session']`),
+ * ahead of the keeper / last-admin guards. No `admin_` prefix — the
  * privilege lives in the auth check, not the name, so self-service
  * deletion stays open (`delete` = soft, `purge` = hard).
  */

package/dist/auth/admin_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAgB3E,+BAA+B;AAC/B,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;;;mBAoBrB,CAAC;AACd,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;mBAIrB,CAAC;AACd,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;kBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;mBA2BjB,CAAC;AACd,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gDAAgD;AAChD,eAAO,MAAM,6BAA6B;;;;mBAgB7B,CAAC;AACd,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,iDAAiD;AACjD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAEzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;;kBAS3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe;;mBAIf,CAAC;AACd,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;mBAInB,CAAC;AACd,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;mBAOlB,CAAC;AACd,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,mCAAmC;AACnC,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB;;;;kBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,qCAAqC;AACrC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWN,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CAWN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhB,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;CAiBD,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAenE,CAAC"}
+{"version":3,"file":"admin_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAgB3E,+BAA+B;AAC/B,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAIhD,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;;;mBAoBrB,CAAC;AACd,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;mBAIrB,CAAC;AACd,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,mGAAmG;AACnG,eAAO,MAAM,sBAAsB;;;;;;;;kBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;kBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;kBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;mBA2BjB,CAAC;AACd,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,mCAAmC;AACnC,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gDAAgD;AAChD,eAAO,MAAM,6BAA6B;;;;mBAgB7B,CAAC;AACd,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,iDAAiD;AACjD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;kBAEzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wFAAwF;AACxF,eAAO,MAAM,iBAAiB;;;;kBAS3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;;;;;;;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,+BAA+B;AAC/B,eAAO,MAAM,eAAe;;mBAIf,CAAC;AACd,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;;;;;;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iCAAiC;AACjC,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,oCAAoC;AACpC,eAAO,MAAM,mBAAmB;;mBAInB,CAAC;AACd,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,qCAAqC;AACrC,eAAO,MAAM,oBAAoB;;;;;;;kBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;mBAOlB,CAAC;AACd,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,mCAAmC;AACnC,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB;;;;kBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;kBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,qCAAqC;AACrC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWN,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;CAWN,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;CAWV,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhB,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;CAWD,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;CAiBD,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAEtC,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;CAUJ,CAAC;AAEtC,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;CAWP,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,KAAK,CAAC,yBAAyB,CAenE,CAAC"}

package/dist/auth/admin_action_specs.js

@@ -412,7 +412,12 @@ export const invite_delete_action_spec = {
 /**
  * Soft-delete an account (reversible tombstone). Self-or-admin: the
  * caller may delete their own account; deleting another requires the
- * admin role (handler-enforced elevation). No `admin_` prefix — the
+ * admin role (handler-enforced elevation). The self path is session-only,
+ * also handler-enforced — the spec declares no `credential_types` so an
+ * admin deleting another account keeps any credential, and a self-delete
+ * over an API or daemon token gets the dispatcher's own 403
+ * `credential_type_required` (`required_credential_types: ['session']`),
+ * ahead of the keeper / last-admin guards. No `admin_` prefix — the
  * privilege lives in the auth check, not the name, so self-service
  * deletion stays open (`delete` = soft, `purge` = hard).
  */

package/dist/auth/admin_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG/F,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAyC1B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AA0D3D,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,yBAAyB,EAC/B,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CAogBjB,CAAC"}
+{"version":3,"file":"admin_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/admin_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAI/F,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAyC1B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AA0D3D,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAClC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,yBAAyB,EAC/B,UAAS,kBAAuB,KAC9B,KAAK,CAAC,SAAS,CA+gBjB,CAAC"}

package/dist/auth/admin_actions.js

@@ -30,7 +30,8 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { queue_connection_close } from '../actions/connection_closer.js';
-import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
+import { credential_type_required_error } from '../actions/perform_action.js';
+import { jsonrpc_errors, ThrownJsonrpcError } from '../http/jsonrpc_errors.js';
 import { builtin_role_specs_by_name, list_roles_with_grant_path, ROLE_ADMIN, ROLE_KEEPER } from './role_schema.js';
 import { has_scoped_role } from './request_context.js';
 import { query_account_has_global_role, query_account_has_active_global_role, query_count_active_accounts_with_global_role } from './role_grant_queries.js';
@@ -279,13 +280,24 @@ export const create_admin_actions = (deps, options = {}) => {
         }
     };
     // Soft-delete an account (reversible tombstone). Self-or-admin:
-    // deleting another account requires the admin role. Tombstones the
+    // deleting another account requires the admin role. A self-delete is
+    // session-only — enforced here, not on the spec, whose gate stays open so
+    // an admin deleting another account keeps any credential. Tombstones the
     // account + its actor(s), revokes sessions/tokens, closes sockets, and
     // emits `account_delete` + one `actor_delete` per soft-deleted actor —
     // each carrying its identity snapshot. `delete` = soft.
     const account_delete_handler = async (input, ctx) => {
         const auth = ctx.auth;
+        // `Uuid` outputs lowercase, the form `auth.account.id` is in, so an
+        // uppercased own id still reads as self
         const target_account_id = input.account_id ?? auth.account.id;
+        // Self path: a session only (API and daemon tokens alike), with the
+        // dispatcher's own credential-type refusal, before the guards below say
+        // anything about the account — a leaked token can't end its own account.
+        if (target_account_id === auth.account.id && ctx.credential_type !== 'session') {
+            const refusal = credential_type_required_error(['session']);
+            throw new ThrownJsonrpcError(refusal.code, refusal.message, refusal.data);
+        }
         // Self-or-admin elevation: deleting someone else needs the **global**
         // admin grant — a scoped `admin` row confers no cross-account authority.
         if (target_account_id !== auth.account.id && !has_scoped_role(auth, ROLE_ADMIN, null)) {

package/dist/auth/bootstrap_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,+EAA+E;IAC/E,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAyBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAmHjB,CAAC"}
+{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGxE,OAAO,EAGN,KAAK,WAAW,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,+EAA+E;IAC/E,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAyBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0HjB,CAAC"}