/**
 * Account RPC action specs — declarative contract for self-service account
 * operations. Import this module for the specs, Input/Output schemas, and
 * the `all_account_action_specs` registry. Handlers live in
 * `auth/account_actions.ts` so consumers doing typed-client codegen or surface
 * reporting don't transitively drag in server-only query code.
 *
 * @module
 */
import { z } from 'zod';
import { Blake3Hash } from '@fuzdev/fuz_util/hash_blake3.js';
import { AuthSessionJson, ClientApiTokenJson, SessionAccountJson } from './account_schema.js';
import { ApiTokenId } from './api_token.js';
// -- Input/output schemas ---------------------------------------------------
/** Input for `account_verify`. No parameters — the caller is the subject. */
export const VerifyInput = z.void();
/** Input for `account_session_list`. No parameters. */
export const SessionListInput = z.void();
/** Output for `account_session_list`. */
export const SessionListOutput = z.strictObject({
    sessions: z.array(AuthSessionJson),
});
/** Input for `account_session_revoke`. `session_id` is the blake3 hash. */
export const SessionRevokeInput = z.strictObject({
    session_id: Blake3Hash.meta({ description: 'Session id (blake3 hash) to revoke.' }),
});
/** Output for `account_session_revoke`. `revoked` is `false` for IDOR misses. */
export const SessionRevokeOutput = z.strictObject({
    ok: z.literal(true),
    revoked: z.boolean(),
});
/** Input for `account_session_revoke_all`. No parameters. */
export const SessionRevokeAllInput = z.void();
/** Output for `account_session_revoke_all`. */
export const SessionRevokeAllOutput = z.strictObject({
    ok: z.literal(true),
    count: z.number(),
});
/** Input for `account_token_create`. */
export const TokenCreateInput = z
    .strictObject({
    name: z
        .string()
        .default('CLI token')
        .meta({ description: 'Human-friendly label; shown in the token list.' }),
})
    .prefault({});
/** Output for `account_token_create`. `token` is returned exactly once. */
export const TokenCreateOutput = z.strictObject({
    ok: z.literal(true),
    token: z.string().meta({ description: 'Raw token — shown once, store securely.' }),
    id: ApiTokenId,
    name: z.string(),
});
/** Input for `account_token_list`. No parameters. */
export const TokenListInput = z.void();
/** Output for `account_token_list`. Hashes are excluded. */
export const TokenListOutput = z.strictObject({
    tokens: z.array(ClientApiTokenJson),
});
/** Input for `account_token_revoke`. */
export const TokenRevokeInput = z.strictObject({
    token_id: ApiTokenId.meta({ description: 'Public API token id (e.g. `tok_<12 chars>`).' }),
});
/** Output for `account_token_revoke`. `revoked` is `false` for IDOR misses. */
export const TokenRevokeOutput = z.strictObject({
    ok: z.literal(true),
    revoked: z.boolean(),
});
// -- Action specs -----------------------------------------------------------
export const account_verify_action_spec = {
    method: 'account_verify',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none' },
    side_effects: false,
    input: VerifyInput,
    output: SessionAccountJson,
    async: true,
    description: 'Verify the current session and echo the caller account.',
};
export const account_session_list_action_spec = {
    method: 'account_session_list',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none' },
    side_effects: false,
    input: SessionListInput,
    output: SessionListOutput,
    async: true,
    description: 'List auth sessions for the current account.',
};
// `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
// A leaked bearer can otherwise compose `account_session_list` + N×revoke to
// reach the same effect as `account_session_revoke_all`.
export const account_session_revoke_action_spec = {
    method: 'account_session_revoke',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none', credential_types: ['session'] },
    side_effects: true,
    input: SessionRevokeInput,
    output: SessionRevokeOutput,
    async: true,
    description: 'Revoke a single auth session for the current account (IDOR-guarded).',
};
// `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
export const account_session_revoke_all_action_spec = {
    method: 'account_session_revoke_all',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none', credential_types: ['session'] },
    side_effects: true,
    input: SessionRevokeAllInput,
    output: SessionRevokeAllOutput,
    async: true,
    description: 'Revoke every auth session for the current account.',
};
/**
 * `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
 *
 * `rate_limit: 'account'` bounds the burn rate of API-token creates. The
 * outstanding-token count is already capped by `max_tokens` (via
 * `query_api_token_enforce_limit`), but the per-account *rate* of churn
 * is not — without this cap, a caller could rotate tokens in a tight
 * loop to amplify `token_create` audit churn or attempt to provoke
 * downstream rate-limit hot spots.
 */
export const account_token_create_action_spec = {
    method: 'account_token_create',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none', credential_types: ['session'] },
    side_effects: true,
    input: TokenCreateInput,
    output: TokenCreateOutput,
    async: true,
    description: 'Create an API token for the current account. Raw token is returned once.',
    rate_limit: 'account',
};
export const account_token_list_action_spec = {
    method: 'account_token_list',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none' },
    side_effects: false,
    input: TokenListInput,
    output: TokenListOutput,
    async: true,
    description: 'List API tokens for the current account. Hashes are never returned.',
};
// `credential_types: ['session']` — see `docs/security.md` §Credential-channel gating.
export const account_token_revoke_action_spec = {
    method: 'account_token_revoke',
    kind: 'request_response',
    initiator: 'frontend',
    auth: { account: 'required', actor: 'none', credential_types: ['session'] },
    side_effects: true,
    input: TokenRevokeInput,
    output: TokenRevokeOutput,
    async: true,
    description: 'Revoke an API token for the current account (IDOR-guarded).',
};
/**
 * All self-service account action specs — a codegen-ready registry.
 * Consumers spread this into their own action-spec array to include
 * account methods in a typed client surface.
 */
export const all_account_action_specs = [
    account_verify_action_spec,
    account_session_list_action_spec,
    account_session_revoke_action_spec,
    account_session_revoke_all_action_spec,
    account_token_create_action_spec,
    account_token_list_action_spec,
    account_token_revoke_action_spec,
];
