@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/auth/cell_grant_actions.js

@@ -15,7 +15,9 @@
  *   principals against the role schema; rejects owner-as-principal.
  *   Actor-shaped principals carry a pre-resolved `actor_id` (callers pick
  *   via `actor_search`). Idempotent — re-granting the same principal
- *   updates `level` via UPSERT.
+ *   updates `level` via UPSERT. A mounted `authorize_grant_create` is asked
+ *   after the spine's own gates, before the owner check and the write (403
+ *   `cell_grant_not_authorized` on refusal).
  * - `cell_grant_revoke` — admin / owner, plus self for actor-shaped grants
  *   ("leave shared cell"). Returns `still_admitted` computed by re-running
  *   `can_view_cell` against the remaining grants.
@@ -33,7 +35,7 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, ERROR_CELL_GRANT_NOT_FOUND, ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, ERROR_CELL_GRANT_UNAPPROVED, ERROR_CELL_GRANT_UNKNOWN_ROLE } from './cell_grant_action_specs.js';
+import { cell_grant_create_action_spec, cell_grant_revoke_action_spec, cell_grant_list_action_spec, ERROR_CELL_GRANT_NOT_AUTHORIZED, ERROR_CELL_GRANT_NOT_FOUND, ERROR_CELL_GRANT_PRINCIPAL_IS_OWNER, ERROR_CELL_GRANT_UNAPPROVED, ERROR_CELL_GRANT_UNKNOWN_ROLE } from './cell_grant_action_specs.js';
 import { ERROR_CELL_NOT_FOUND } from './cell_action_specs.js';
 import { can_view_cell, can_manage_cell } from './cell_authorize.js';
 import { query_cell_get } from '../db/cell_queries.js';
@@ -90,7 +92,7 @@ const assert_principal_is_not_owner = (cell, principal) => {
 };
 /** Create the three `cell_grant_*` RPC actions. */
 export const create_cell_grant_actions = (deps) => {
-    const { roles } = deps;
+    const { roles, authorize_grant_create } = deps;
     const create_handler = async (input, ctx) => {
         const auth = ctx.auth;
         const cell = await query_cell_get(ctx, input.cell_id);
@@ -127,6 +129,21 @@ export const create_cell_grant_actions = (deps) => {
                 reason: ERROR_CELL_GRANT_UNKNOWN_ROLE
             });
         }
+        // The consumer's gate, asked only of a manager past the spine's gates;
+        // a refusal writes nothing.
+        if (authorize_grant_create) {
+            const allowed = await authorize_grant_create(auth, {
+                cell_id: cell.id,
+                cell_created_by: cell.created_by,
+                level: input.level,
+                principal
+            });
+            if (!allowed) {
+                throw jsonrpc_errors.forbidden('cell grant is not permitted here', {
+                    reason: ERROR_CELL_GRANT_NOT_AUTHORIZED
+                });
+            }
+        }
         assert_principal_is_not_owner(cell, principal);
         const row = await query_cell_grant_create(ctx, {
             cell_id: cell.id,

package/dist/auth/credential_type_schema.d.ts

@@ -6,8 +6,9 @@
  * Open-string registry on top so consumers can declare additional
  * credential types (e.g. `'sso_assertion'`, `'agent_token'`) without an
  * upstream release. `RoleSpec.required_credential_types` references
- * entries from this registry; v1 keeps the field informative-only
- * (consumed by `auth/middleware.ts` and the dispatcher). Mirrors the
+ * entries from this registry; v1 keeps the field informative-only —
+ * validated at construction, enforced nowhere; routes and actions gate
+ * with `auth.credential_types`. Mirrors the
  * open-registry pattern used for `RoleName`, `ScopeKindName`,
  * `GrantPathName`, and `AuditEventTypeName`.
  *

package/dist/auth/credential_type_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_type_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/credential_type_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAgC,CAAC;AAExE,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,aAK7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,mDAI3B,CAAC;AAEX,kDAAkD;AAClD,eAAO,MAAM,qBAAqB;;;;EAAmC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAa/E,CAAC;AAEH,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC;;;OAGG;IACH,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,6BAA6B,GACzC,iBAAgB,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAM,KACrD,0BA2BF,CAAC"}
+{"version":3,"file":"credential_type_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/credential_type_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAgC,CAAC;AAExE,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,aAK7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,mDAI3B,CAAC;AAEX,kDAAkD;AAClD,eAAO,MAAM,qBAAqB;;;;EAAmC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAa/E,CAAC;AAEH,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC;;;OAGG;IACH,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,6BAA6B,GACzC,iBAAgB,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAM,KACrD,0BA2BF,CAAC"}

package/dist/auth/credential_type_schema.js

@@ -6,8 +6,9 @@
  * Open-string registry on top so consumers can declare additional
  * credential types (e.g. `'sso_assertion'`, `'agent_token'`) without an
  * upstream release. `RoleSpec.required_credential_types` references
- * entries from this registry; v1 keeps the field informative-only
- * (consumed by `auth/middleware.ts` and the dispatcher). Mirrors the
+ * entries from this registry; v1 keeps the field informative-only —
+ * validated at construction, enforced nowhere; routes and actions gate
+ * with `auth.credential_types`. Mirrors the
  * open-registry pattern used for `RoleName`, `ScopeKindName`,
  * `GrantPathName`, and `AuditEventTypeName`.
  *

package/dist/auth/role_grant_offer_action_specs.d.ts

@@ -44,6 +44,22 @@ export declare const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH: "role_grant_
  * `role_grant_assign`, `role_grant_offer_create`, and `role_grant_offer_accept`.
  */
 export declare const ERROR_ROLE_GRANT_BUILTIN_SCOPED: "role_grant_builtin_scoped";
+/**
+ * Error reason — `role_grant_revoke` targeted the **keeper** account's global
+ * `admin` grant. A **403**: no web path grants `admin` to the keeper again
+ * (bootstrap is one-shot and keeper is not web-grantable), so revoking it would
+ * lock the keeper out of the admin surface for good. Twin of the Rust
+ * `ERROR_CANNOT_REVOKE_KEEPER_ADMIN`.
+ */
+export declare const ERROR_CANNOT_REVOKE_KEEPER_ADMIN: "cannot_revoke_keeper_admin";
+/**
+ * Error reason — `role_grant_revoke` targeted a global `admin` grant whose
+ * revoke would leave no active admin account. A **403**, counted as
+ * `account_delete`'s last-admin guard counts (active accounts, active actors),
+ * less the grant being revoked, under the same row locks. Twin of the Rust
+ * `ERROR_CANNOT_REVOKE_LAST_ADMIN`.
+ */
+export declare const ERROR_CANNOT_REVOKE_LAST_ADMIN: "cannot_revoke_last_admin";
 /**
  * Whether a grant input's `scope_kind` + `scope_id` are paired — both absent
  * (a global grant) or both present (a scoped one), the
@@ -510,7 +526,7 @@ export declare const role_grant_revoke_action_spec: {
     }, z.core.$strict>;
     async: true;
     description: string;
-    error_reasons: ("role_not_web_grantable" | "role_grant_not_found")[];
+    error_reasons: ("role_not_web_grantable" | "role_grant_not_found" | "cannot_revoke_keeper_admin" | "cannot_revoke_last_admin")[];
     rate_limit: "account";
 };
 /**
@@ -542,7 +558,7 @@ export declare const role_grant_assign_action_spec: {
     }, z.core.$strict>;
     async: true;
     description: string;
-    error_reasons: ("insufficient_permissions" | "role_not_web_grantable" | "role_grant_offer_actor_account_mismatch" | "role_grant_builtin_scoped")[];
+    error_reasons: ("insufficient_permissions" | "role_not_web_grantable" | "role_grant_offer_not_authorized" | "role_grant_offer_actor_account_mismatch" | "role_grant_builtin_scoped")[];
     rate_limit: "account";
 };
 /**

package/dist/auth/role_grant_offer_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAe3E,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AACpD;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AAEpF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAC5C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,KAAG,OAAkE,CAAC;AAEvE,+GAA+G;AAC/G,eAAO,MAAM,0BAA0B,2GACkE,CAAC;AAW1G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAiBkC,CAAC;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAMrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAa1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAA0C,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AACnG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;kBAiBuC,CAAC;AACzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmBX,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAS9E,CAAC"}
+{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAiB3E,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AACpD;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAC5C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,KAAG,OAAkE,CAAC;AAEvE,+GAA+G;AAC/G,eAAO,MAAM,0BAA0B,2GACkE,CAAC;AAW1G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAiBkC,CAAC;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAMrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,gDAAgD;AAChD,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAe1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAA0C,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AACnG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;kBAiBuC,CAAC;AACzE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmBX,CAAC;AAEtC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAkBL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;CAmBL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAS9E,CAAC"}

package/dist/auth/role_grant_offer_action_specs.js

@@ -22,7 +22,7 @@
  */
 import { z } from 'zod';
 import { Uuid, bounded_string } from '../primitive_schemas.js';
-import { ERROR_INSUFFICIENT_PERMISSIONS, ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
+import { ERROR_INSUFFICIENT_PERMISSIONS, ERROR_LIMIT_INVALID, ERROR_OFFSET_INVALID, ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
 import { RoleName } from './role_schema.js';
 import { SCOPE_KIND_LENGTH_MAX } from './scope_kind_schema.js';
 import { ROLE_GRANT_OFFER_MESSAGE_LENGTH_MAX, RoleGrantOfferJson } from './role_grant_offer_schema.js';
@@ -50,6 +50,22 @@ export const ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH = 'role_grant_offer_a
  * `role_grant_assign`, `role_grant_offer_create`, and `role_grant_offer_accept`.
  */
 export const ERROR_ROLE_GRANT_BUILTIN_SCOPED = 'role_grant_builtin_scoped';
+/**
+ * Error reason — `role_grant_revoke` targeted the **keeper** account's global
+ * `admin` grant. A **403**: no web path grants `admin` to the keeper again
+ * (bootstrap is one-shot and keeper is not web-grantable), so revoking it would
+ * lock the keeper out of the admin surface for good. Twin of the Rust
+ * `ERROR_CANNOT_REVOKE_KEEPER_ADMIN`.
+ */
+export const ERROR_CANNOT_REVOKE_KEEPER_ADMIN = 'cannot_revoke_keeper_admin';
+/**
+ * Error reason — `role_grant_revoke` targeted a global `admin` grant whose
+ * revoke would leave no active admin account. A **403**, counted as
+ * `account_delete`'s last-admin guard counts (active accounts, active actors),
+ * less the grant being revoked, under the same row locks. Twin of the Rust
+ * `ERROR_CANNOT_REVOKE_LAST_ADMIN`.
+ */
+export const ERROR_CANNOT_REVOKE_LAST_ADMIN = 'cannot_revoke_last_admin';
 /**
  * Whether a grant input's `scope_kind` + `scope_id` are paired — both absent
  * (a global grant) or both present (a scoped one), the
@@ -153,10 +169,12 @@ export const RoleGrantOfferHistoryInput = z
         description: 'Admin-only — history for another account. Defaults to the caller.'
     }),
     limit: z.number().int().min(1).max(ROLE_GRANT_OFFER_HISTORY_LIMIT_MAX).nullish().meta({
-        description: 'Max rows to return (default 100).'
+        description: 'Max rows to return (default 100).',
+        invalid_reason: ERROR_LIMIT_INVALID
     }),
     offset: z.number().int().min(0).nullish().meta({
-        description: 'Pagination offset (default 0).'
+        description: 'Pagination offset (default 0).',
+        invalid_reason: ERROR_OFFSET_INVALID
     }),
     acting: ActingActor
 })
@@ -338,8 +356,13 @@ export const role_grant_revoke_action_spec = {
     input: RoleGrantRevokeInput,
     output: RoleGrantRevokeOutput,
     async: true,
-    description: 'Revoke an active role_grant on a target actor. Admin-only. Supersedes any pending offers for the same (account, role, scope). Fires role_grant_revoke + role_grant_offer_supersede notifications.',
-    error_reasons: [ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE],
+    description: "Revoke an active role_grant on a target actor. Admin-only. Refuses the keeper account's global admin grant and the last active admin's. Supersedes any pending offers for the same (account, role, scope), and every pending offer the target actor made. Fires role_grant_revoke + role_grant_offer_supersede notifications.",
+    error_reasons: [
+        ERROR_ROLE_GRANT_NOT_FOUND,
+        ERROR_ROLE_NOT_WEB_GRANTABLE,
+        ERROR_CANNOT_REVOKE_KEEPER_ADMIN,
+        ERROR_CANNOT_REVOKE_LAST_ADMIN
+    ],
     rate_limit: 'account'
 };
 /**
@@ -356,11 +379,12 @@ export const role_grant_assign_action_spec = {
     input: RoleGrantAssignInput,
     output: RoleGrantAssignOutput,
     async: true,
-    description: "Immediately assign a role_grant to a target account — global-admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`; `scope_kind` + `scope_id` are paired, and a builtin role is global-only. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
+    description: "Immediately assign a role_grant to a target account — global-admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`, and the consumer's offer `authorize` callback must admit it; `scope_kind` + `scope_id` are paired, and a builtin role is global-only. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
     error_reasons: [
         ERROR_INSUFFICIENT_PERMISSIONS,
         ERROR_ROLE_NOT_WEB_GRANTABLE,
         ERROR_ROLE_GRANT_BUILTIN_SCOPED,
+        ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED,
         ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH
     ],
     rate_limit: 'account'

package/dist/auth/role_grant_offer_actions.d.ts

@@ -57,17 +57,22 @@ import { type RequestContext } from './request_context.js';
 import type { ActionFactoryDeps } from './deps.js';
 import { type NotificationSender } from './role_grant_offer_notifications.js';
 /**
- * Authorization callback for `role_grant_offer_create`. Returns `true` to allow,
- * `false` to reject (handler converts to `forbidden`).
+ * Authorization callback for `role_grant_offer_create` and `role_grant_assign`.
+ * Returns `true` to allow, `false` to reject (handler converts to `forbidden`
+ * with `role_grant_offer_not_authorized`).
  *
  * Provided with the fully-resolved request context and the parsed input
  * (pre-TTL, pre-normalization). Consumers override the default to implement
  * policies like "teacher may offer classroom_student only in classrooms they
- * teach".
+ * teach". `role_grant_assign` — the global-admin path that confers a grant
+ * with no offer — runs it too, so a policy over which grants may exist (a
+ * role that must be scoped, a scope that must be real) holds on both paths.
+ * Twin of the Rust `OfferCreateAuthorize`.
  */
 export type RoleGrantOfferCreateAuthorize = (auth: RequestContext, input: {
     to_account_id: string;
     role: string;
+    scope_kind: string | null;
     scope_id: string | null;
 }, deps: {
     log: Logger;
@@ -84,7 +89,7 @@ export interface RoleGrantOfferActionOptions {
     /** TTL applied to newly-created offers. Defaults to `ROLE_GRANT_OFFER_DEFAULT_TTL_MS`. */
     default_ttl_ms?: number;
     /**
-     * Custom authorization for `role_grant_offer_create`. The default requires the
+     * Custom authorization for `role_grant_offer_create` and `role_grant_assign`. The default requires the
      * caller to hold a **global** `admin` grant; the role's
      * `RoleSpec.grant_paths` must include `'admin'` either way. Consumers with
      * richer policies (scope-aware, chained roles) override this. A builtin

package/dist/auth/role_grant_offer_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA4B1B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAyC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACvE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrB,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AA6CD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,iBAAiB,GAAG;IACzB,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CA8nBjB,CAAC"}
+{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAMN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAgC1B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AA2C7C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IACN,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,EACD,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACrB,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AA6CD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,iBAAiB,GAAG;IACzB,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAgsBjB,CAAC"}

package/dist/auth/role_grant_offer_actions.js

@@ -53,16 +53,16 @@
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
 import { emit_after_commit } from '../http/pending_effects.js';
-import { builtin_role_specs_by_name, is_builtin_role, ROLE_ADMIN, role_has_grant_path } from './role_schema.js';
+import { builtin_role_specs_by_name, is_builtin_role, ROLE_ADMIN, ROLE_KEEPER, role_has_grant_path } from './role_schema.js';
 import { GRANT_PATH_ADMIN } from './grant_path_schema.js';
 import { ROLE_GRANT_OFFER_DEFAULT_TTL_MS, to_role_grant_offer_json } from './role_grant_offer_schema.js';
-import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferBuiltinRefusedError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError } from './role_grant_offer_queries.js';
-import { query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant } from './role_grant_queries.js';
+import { query_role_grant_offer_create, query_role_grant_offer_decline, query_role_grant_offer_retract, query_role_grant_offer_list, query_role_grant_offer_history_for_account, query_accept_offer, RoleGrantOfferActorAccountMismatchError, RoleGrantOfferActorMismatchError, RoleGrantOfferAlreadyTerminalError, RoleGrantOfferBuiltinRefusedError, RoleGrantOfferExpiredError, RoleGrantOfferNotFoundError, RoleGrantOfferSelfTargetError, query_role_grant_offer_supersede_outgoing } from './role_grant_offer_queries.js';
+import { query_account_has_active_global_role, query_account_has_global_role, query_count_active_accounts_with_global_role_for_update, query_create_role_grant, query_role_grant_find_active_role_for_actor, query_revoke_role_grant } from './role_grant_queries.js';
 import { query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { has_scoped_role } from './request_context.js';
 import { build_role_grant_offer_accepted_notification, build_role_grant_offer_declined_notification, build_role_grant_offer_received_notification, build_role_grant_offer_retracted_notification, build_role_grant_offer_supersede_notification, build_role_grant_revoke_notification } from './role_grant_offer_notifications.js';
 import { ERROR_INSUFFICIENT_PERMISSIONS, ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE } from '../http/error_schemas.js';
-import { ERROR_ROLE_GRANT_BUILTIN_SCOPED, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec } from './role_grant_offer_action_specs.js';
+import { ERROR_CANNOT_REVOKE_KEEPER_ADMIN, ERROR_CANNOT_REVOKE_LAST_ADMIN, ERROR_ROLE_GRANT_BUILTIN_SCOPED, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH, ERROR_ROLE_GRANT_OFFER_ACTOR_MISMATCH, ERROR_ROLE_GRANT_OFFER_EXPIRED, ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED, ERROR_ROLE_GRANT_OFFER_NOT_FOUND, ERROR_ROLE_GRANT_OFFER_ROLE_NOT_GRANTABLE, ERROR_ROLE_GRANT_OFFER_SELF_TARGET, ERROR_ROLE_GRANT_OFFER_TERMINAL, role_grant_offer_create_action_spec, role_grant_offer_accept_action_spec, role_grant_offer_decline_action_spec, role_grant_offer_retract_action_spec, role_grant_offer_list_action_spec, role_grant_offer_history_action_spec, role_grant_revoke_action_spec, role_grant_assign_action_spec } from './role_grant_offer_action_specs.js';
 // -- Helpers ----------------------------------------------------------------
 /**
  * Fan out a batch of pre-written audit rows to the bound emitter's
@@ -203,6 +203,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         const authorized = await authorize(auth, {
             to_account_id: input.to_account_id,
             role: input.role,
+            scope_kind: input.scope_kind ?? null,
             scope_id: input.scope_id ?? null
         }, { log }, ctx);
         if (!authorized) {
@@ -459,7 +460,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         const target_actor_id = input.actor_id;
         // Admin-grant-path gate — keeper / daemon-scoped roles stay CLI-only
         // (their `grant_paths` does not include `'admin'`).
-        if (!role_has_grant_path(role_specs, role_grant_row.role, GRANT_PATH_ADMIN)) {
+        const emit_revoke_failure = () => {
             audit.emit_role_grant_target(ctx, auth, {
                 event_type: 'role_grant_revoke',
                 outcome: 'failure',
@@ -467,16 +468,46 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                 target_actor_id,
                 metadata: { role: role_grant_row.role, role_grant_id: input.role_grant_id }
             });
+        };
+        if (!role_has_grant_path(role_specs, role_grant_row.role, GRANT_PATH_ADMIN)) {
+            emit_revoke_failure();
             throw jsonrpc_errors.forbidden('role not web-grantable', {
                 reason: ERROR_ROLE_NOT_WEB_GRANTABLE
             });
         }
+        // The global `admin` grant is guarded like the account that holds it:
+        // the keeper account's is never revoked (no web path re-grants it, so the
+        // keeper would be locked out of the admin surface for good), and the
+        // grant goes only when an active admin account remains without it — the
+        // count leaves this grant out, so a second admin actor on the same
+        // account still counts. The count locks what it counted, so a concurrent
+        // revoke or account removal can't pass the same guard.
+        if (role_grant_row.role === ROLE_ADMIN && role_grant_row.scope_id === null) {
+            if (await query_account_has_global_role(ctx, target_account_id, ROLE_KEEPER)) {
+                emit_revoke_failure();
+                throw jsonrpc_errors.forbidden("cannot revoke the keeper account's admin grant", {
+                    reason: ERROR_CANNOT_REVOKE_KEEPER_ADMIN
+                });
+            }
+            if ((await query_account_has_active_global_role(ctx, target_account_id, ROLE_ADMIN)) &&
+                (await query_count_active_accounts_with_global_role_for_update(ctx, ROLE_ADMIN, input.role_grant_id)) === 0) {
+                emit_revoke_failure();
+                throw jsonrpc_errors.forbidden("cannot revoke the last admin's admin grant", {
+                    reason: ERROR_CANNOT_REVOKE_LAST_ADMIN
+                });
+            }
+        }
         const result = await query_revoke_role_grant(ctx, input.role_grant_id, input.actor_id, auth.actor.id, input.reason ?? null);
         if (!result) {
             // Raced with another revoker or the role_grant was revoked between
             // the IDOR check and the UPDATE.
             throw jsonrpc_errors.not_found('role_grant', { reason: ERROR_ROLE_GRANT_NOT_FOUND });
         }
+        // The revokee's own pending offers end with the grant: an offer records
+        // no authority, so one made under this grant would still confer on
+        // accept. Every outgoing offer of the actor goes, superseded like the
+        // revokee's incoming siblings (same reason, same cause, same fan-out).
+        result.superseded_offers.push(...(await query_role_grant_offer_supersede_outgoing(ctx, [input.actor_id])));
         audit.emit_role_grant_target(ctx, auth, {
             event_type: 'role_grant_revoke',
             target_account_id,
@@ -535,7 +566,8 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
     // `role_grant_offer_create`. Gated at the dispatcher on a **global** admin
     // (`roles: ['admin']`) and re-checked here, it re-checks admin-grantability
     // (so keeper / CLI-only roles can't be web-assigned), refuses a scoped
-    // builtin role, resolves the target actor, writes the idempotent grant with
+    // builtin role, runs the consumer's `authorize` callback, resolves the
+    // target actor, writes the idempotent grant with
     // the input's `(scope_kind, scope_id)` pair, and emits a `role_grant_create`
     // audit row — the same event the offer-accept and self-service paths emit.
     // No WS notification in v1 (the grantee picks the capability up on its next
@@ -555,7 +587,7 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
         // omitted — no grant was created).
         const admin_grantable = role_has_grant_path(role_specs, input.role, GRANT_PATH_ADMIN);
         const builtin_scoped = is_scoped_builtin(input.role, input.scope_id);
-        if (builtin_scoped || !admin_grantable) {
+        const emit_assign_failure_audit = () => {
             audit.emit_role_grant_target(ctx, auth, {
                 event_type: 'role_grant_create',
                 outcome: 'failure',
@@ -567,12 +599,31 @@ export const create_role_grant_offer_actions = (deps, options = {}) => {
                     scope_id: input.scope_id ?? null
                 }
             });
+        };
+        if (builtin_scoped || !admin_grantable) {
+            emit_assign_failure_audit();
             if (builtin_scoped && admin_grantable)
                 throw builtin_scoped_error();
             throw jsonrpc_errors.forbidden('role not web-grantable', {
                 reason: ERROR_ROLE_NOT_WEB_GRANTABLE
             });
         }
+        // The consumer's offer policy binds the immediate path too: assign is an
+        // offer the grantee doesn't get to decline, so a grant the `authorize`
+        // callback would refuse as an offer (a scope that doesn't exist, a role
+        // that must be scoped) is refused here, with the offer path's reason.
+        const authorized = await authorize(auth, {
+            to_account_id: input.to_account_id,
+            role: input.role,
+            scope_kind: input.scope_kind ?? null,
+            scope_id: input.scope_id ?? null
+        }, { log }, ctx);
+        if (!authorized) {
+            emit_assign_failure_audit();
+            throw jsonrpc_errors.forbidden('not authorized to grant this role', {
+                reason: ERROR_ROLE_GRANT_OFFER_NOT_AUTHORIZED
+            });
+        }
         // Resolve the grant's target actor. A supplied `to_actor_id` must be an
         // active actor of `to_account_id`; otherwise the account's sole active
         // actor is used (a multi-actor account must name one). A missing /

package/dist/auth/role_grant_offer_notifications.d.ts

@@ -151,8 +151,9 @@ export type RoleGrantOfferDeclinedParams = z.infer<typeof RoleGrantOfferDeclined
 /**
  * Params for `role_grant_offer_supersede`. Fires to the grantor's sockets when
  * their pending offer is obsoleted — either by a sibling accept
- * (`reason: 'sibling_accepted'`), by revoke of the resulting role_grant
- * (`reason: 'role_grant_revoked'`), or by deletion of the parent scope row
+ * (`reason: 'sibling_accepted'`), by revoke of the resulting role_grant or of
+ * one of the grantor's own (`reason: 'role_grant_revoked'`), or by deletion of
+ * the parent scope row
  * the offer was bound to (`reason: 'scope_destroyed'`). `cause_id` points
  * at the accepted offer id, the revoked role_grant id, or the destroyed scope
  * row id respectively.

package/dist/auth/role_grant_offer_notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_notifications.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsB,KAAK,IAAI,EAAkB,MAAM,yBAAyB,CAAC;AAIxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAM9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;CAC5E;AAID,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAIzE,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;kBAIxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUjB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWjB,CAAC;AAEzC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;CAUR,CAAC;AAIzC;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,KAAK,CAAC,SAAS,CAOhE,CAAC;AAIF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,oCAAoC,GAChD,QAAQ,qBAAqB,KAC3B,mBACwE,CAAC"}
+{"version":3,"file":"role_grant_offer_notifications.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsB,KAAK,IAAI,EAAkB,MAAM,yBAAyB,CAAC;AAIxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAM9D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,KAAK,MAAM,CAAC;CAC5E;AAID,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,6CAA6C,8BAA8B,CAAC;AACzF,eAAO,MAAM,8CAA8C,+BAA+B,CAAC;AAC3F,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AAIzE,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF,yEAAyE;AACzE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;kBAExC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;kBAEvC,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;kBAIxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUjB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUhB,CAAC;AAEzC,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWjB,CAAC;AAEzC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;CAUR,CAAC;AAIzC;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,KAAK,CAAC,SAAS,CAOhE,CAAC;AAIF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,4CAA4C,GACxD,QAAQ,4BAA4B,KAClC,mBACgF,CAAC;AAEpF,eAAO,MAAM,6CAA6C,GACzD,QAAQ,6BAA6B,KACnC,mBACiF,CAAC;AAErF,eAAO,MAAM,oCAAoC,GAChD,QAAQ,qBAAqB,KAC3B,mBACwE,CAAC"}

package/dist/auth/role_grant_offer_notifications.js

@@ -67,8 +67,9 @@ export const RoleGrantOfferDeclinedParams = z.strictObject({
 /**
  * Params for `role_grant_offer_supersede`. Fires to the grantor's sockets when
  * their pending offer is obsoleted — either by a sibling accept
- * (`reason: 'sibling_accepted'`), by revoke of the resulting role_grant
- * (`reason: 'role_grant_revoked'`), or by deletion of the parent scope row
+ * (`reason: 'sibling_accepted'`), by revoke of the resulting role_grant or of
+ * one of the grantor's own (`reason: 'role_grant_revoked'`), or by deletion of
+ * the parent scope row
  * the offer was bound to (`reason: 'scope_destroyed'`). `cause_id` points
  * at the accepted offer id, the revoked role_grant id, or the destroyed scope
  * row id respectively.

package/dist/auth/role_grant_offer_queries.d.ts

@@ -286,4 +286,24 @@ export interface AcceptOfferResult {
  * @throws Error if the accepting `actor_id` does not belong to `to_account_id`, or invariant assertions fail
  */
 export declare const query_accept_offer: (deps: QueryDeps, input: AcceptOfferInput) => Promise<AcceptOfferResult>;
+/**
+ * Supersede every pending offer **made by** one of `from_actor_ids` — the
+ * grantor-side cascade.
+ *
+ * An offer carries no record of the authority it was made under, so one
+ * outliving that authority would still confer its role on accept. Revoking a
+ * grant (`role_grant_revoke`, the revokee's actor) and removing an account
+ * (`account_delete` / `account_purge`, every actor of the account) end the
+ * grantor's outgoing pending offers in the same transaction. Each row carries
+ * the grantor's `from_account_id`, as every supersede cascade's does; the
+ * caller emits a `role_grant_offer_supersede` audit event per entry, and the
+ * revoke caller also sends the supersede notification. Twin of the Rust
+ * `query_role_grant_offer_supersede_outgoing`.
+ *
+ * @param deps - query dependencies
+ * @param from_actor_ids - the grantors whose pending offers end
+ * @returns the superseded offers, each with its grantor's account
+ * @mutates `role_grant_offer` rows - stamps `superseded_at` on every pending offer from `from_actor_ids`
+ */
+export declare const query_role_grant_offer_supersede_outgoing: (deps: QueryDeps, from_actor_ids: ReadonlyArray<Uuid>) => Promise<Array<SupersededOffer>>;
 //# sourceMappingURL=role_grant_offer_queries.d.ts.map

package/dist/auth/role_grant_offer_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,OAAO,KAAK,EACX,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACxC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,wBAAwB,CAAC;AAEzF;;;;;GAKG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1B,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB;CAM/D;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;;CAKjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,cAAc,CAwDxB,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,aAAc,SAAQ,cAAc;IACpD;;;;;OAKG;IACH,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,QAAQ,MAAM,GAAG,IAAI,KACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAmB9B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAe/B,CAAC;AA8BF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,eAAe,MAAM,KACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAY/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0CAA0C,GACtD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAW,EACX,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAY/B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,KACb,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAkB/B,CAAC;AAsCF,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,mGAAmG;IACnG,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,IAAI,CAAC;IACf,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,6HAA6H;AAC7H,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,kOAAkO;IAClO,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,yMAAyM;IACzM,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,OAAO,gBAAgB,KACrB,OAAO,CAAC,iBAAiB,CAmP3B,CAAC"}
+{"version":3,"file":"role_grant_offer_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,OAAO,KAAK,EACX,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;;;GAKG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;gBAChD,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACxC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACzC,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,wBAAwB,CAAC;AAEzF;;;;;GAKG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1B,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB;CAM/D;AAED;;;;;GAKG;AACH,qBAAa,uCAAwC,SAAQ,KAAK;;CAKjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,OAAO,yBAAyB,KAC9B,OAAO,CAAC,cAAc,CAwDxB,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,aAAc,SAAQ,cAAc;IACpD;;;;;OAKG;IACH,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,EACrB,QAAQ,MAAM,GAAG,IAAI,KACnB,OAAO,CAAC,aAAa,GAAG,IAAI,CAmB9B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,UAAU,MAAM,EAChB,eAAe,MAAM,KACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAe/B,CAAC;AA8BF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,eAAe,MAAM,KACnB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAY/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0CAA0C,GACtD,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAW,EACX,eAAU,KACR,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAC/C,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,cAAc,GAAG,IAAI,CAY/B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,KACb,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAkB/B,CAAC;AAsCF,sCAAsC;AACtC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,mGAAmG;IACnG,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,IAAI,CAAC;IACf,gDAAgD;IAChD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED,6HAA6H;AAC7H,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,SAAS,CAAC;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,kOAAkO;IAClO,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,yMAAyM;IACzM,YAAY,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,OAAO,gBAAgB,KACrB,OAAO,CAAC,iBAAiB,CAmP3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yCAAyC,GACrD,MAAM,SAAS,EACf,gBAAgB,aAAa,CAAC,IAAI,CAAC,KACjC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAiBhC,CAAC"}

package/dist/auth/role_grant_offer_queries.js

@@ -628,3 +628,38 @@ export const query_accept_offer = async (deps, input) => {
         audit_events: [offer_accept_event, role_grant_create_event, ...supersede_events]
     };
 };
+/**
+ * Supersede every pending offer **made by** one of `from_actor_ids` — the
+ * grantor-side cascade.
+ *
+ * An offer carries no record of the authority it was made under, so one
+ * outliving that authority would still confer its role on accept. Revoking a
+ * grant (`role_grant_revoke`, the revokee's actor) and removing an account
+ * (`account_delete` / `account_purge`, every actor of the account) end the
+ * grantor's outgoing pending offers in the same transaction. Each row carries
+ * the grantor's `from_account_id`, as every supersede cascade's does; the
+ * caller emits a `role_grant_offer_supersede` audit event per entry, and the
+ * revoke caller also sends the supersede notification. Twin of the Rust
+ * `query_role_grant_offer_supersede_outgoing`.
+ *
+ * @param deps - query dependencies
+ * @param from_actor_ids - the grantors whose pending offers end
+ * @returns the superseded offers, each with its grantor's account
+ * @mutates `role_grant_offer` rows - stamps `superseded_at` on every pending offer from `from_actor_ids`
+ */
+export const query_role_grant_offer_supersede_outgoing = async (deps, from_actor_ids) => {
+    if (from_actor_ids.length === 0)
+        return [];
+    return deps.db.query(`WITH updated AS (
+			UPDATE role_grant_offer
+			SET superseded_at = NOW()
+			WHERE from_actor_id = ANY($1)
+			  AND accepted_at IS NULL
+			  AND declined_at IS NULL
+			  AND retracted_at IS NULL
+			  AND superseded_at IS NULL
+			-- raw columns; the outer grantor select formats them
+			RETURNING ${columns_sql(ROLE_GRANT_OFFER_COLUMNS)}
+		)
+		${ROLE_GRANT_OFFER_WITH_GRANTOR_SELECT}`, [from_actor_ids]);
+};

package/dist/auth/role_grant_queries.d.ts

@@ -50,11 +50,12 @@ export declare const query_create_role_grant: (deps: QueryDeps, input: CreateRol
  */
 export declare const query_role_grant_by_id: (deps: QueryDeps, id: Uuid) => Promise<RoleGrant | undefined>;
 /**
- * Look up the role of an active role_grant (constrained to a specific
- * actor) plus the actor's `account_id`.
+ * Look up the role and scope of an active role_grant (constrained to a
+ * specific actor) plus the actor's `account_id`.
  *
  * Used by admin routes to inspect the role_grant's role before acting
- * (e.g., enforcing the admin-grant-path gate on revoke). The actor constraint
+ * (e.g., enforcing the admin-grant-path gate and the global-`admin` guards on
+ * revoke). The actor constraint
  * mirrors `query_revoke_role_grant` so IDOR protection is consistent:
  * a caller can only see role_grants belonging to the target actor.
  *
@@ -71,10 +72,11 @@ export declare const query_role_grant_by_id: (deps: QueryDeps, id: Uuid) => Prom
  * @param deps - query dependencies
  * @param role_grant_id - the role_grant id to look up
  * @param actor_id - the actor that must own the role_grant
- * @returns `{role, account_id}` on a match, or `null`
+ * @returns `{role, scope_id, account_id}` on a match, or `null`
  */
 export declare const query_role_grant_find_active_role_for_actor: (deps: QueryDeps, role_grant_id: string, actor_id: string) => Promise<{
     role: string;
+    scope_id: Uuid | null;
     account_id: Uuid;
 } | null>;
 /** Result of `query_revoke_role_grant` — the revoked role_grant plus any pending offers superseded by the revoke. */
@@ -163,7 +165,7 @@ export declare const query_account_has_global_role: (deps: QueryDeps, account_id
  * Like `query_account_has_global_role`, but only counts the grant when the
  * **account and the granting actor are both active** (`deleted_at IS NULL`).
  * Used by the last-admin branch of the removability guard: a soft-deleted admin
- * can't log in and is excluded from `query_count_active_accounts_with_global_role`,
+ * can't log in and is excluded from `query_count_active_accounts_with_global_role_for_update`,
  * so the guard must use the same active predicate when testing whether the
  * *target* is an admin — otherwise removing an already-tombstoned admin is
  * falsely blocked as `cannot_delete_last_admin`. Soft-delete does **not** revoke
@@ -183,18 +185,34 @@ export declare const query_account_has_active_global_role: (deps: QueryDeps, acc
 /**
  * Count **active** accounts (`deleted_at IS NULL`) holding an active global
  * role_grant for `role`, counting only grants on **active actors**
- * (`act.deleted_at IS NULL`). Used by the last-admin guard on `account_delete` /
- * `account_purge`: soft-delete revokes neither a tombstoned account's nor a
+ * (`act.deleted_at IS NULL`) — and lock what it counted. Used by the last-admin
+ * guards on `account_delete` / `account_purge` and on `role_grant_revoke` of an
+ * `admin` grant: soft-delete revokes neither a tombstoned account's nor a
  * tombstoned actor's admin grant, so an unfiltered count would include unusable
  * admins — this joins `account` *and* filters the actor, so an account whose
  * only admin grant sits on a tombstoned actor no longer counts (otherwise the
- * guard could fail-open and let the last usable admin be deleted).
+ * guard could fail-open and let the last usable admin be removed).
+ *
+ * **Locks** every counted `role_grant`, `actor`, and `account` row
+ * (`FOR UPDATE`) until the caller's transaction ends, so two guards racing to
+ * remove the last two admins serialize: the second waits for the first to
+ * commit, re-reads the rows it changed, and counts one. Run it inside the
+ * transaction that does the removal. Twin of the Rust
+ * `query_count_active_accounts_with_global_role_for_update`.
+ *
+ * `exclude_role_grant_id` leaves one grant out of the count, so a revoke asks
+ * whether any active admin account would remain without that grant — an
+ * account holding the grant on two actors keeps counting through the other.
+ * The excluded grant is still locked, so two revokes of each other's grant
+ * serialize rather than deadlock.
  *
  * @param deps - query dependencies
  * @param role - the role to count (e.g. `ROLE_ADMIN`)
+ * @param exclude_role_grant_id - a grant to leave out of the count (the one being revoked)
  * @returns the number of distinct active accounts with an active global `role` grant
+ * @mutates `role_grant` / `actor` / `account` rows - row-locks the counted rows for the transaction
  */
-export declare const query_count_active_accounts_with_global_role: (deps: QueryDeps, role: string) => Promise<number>;
+export declare const query_count_active_accounts_with_global_role_for_update: (deps: QueryDeps, role: string, exclude_role_grant_id?: Uuid | null) => Promise<number>;
 /**
  * List all role_grants for an actor (including revoked/expired).
  */