auth/account_actions.ts

Account RPC action handlers — self-service operations for the authenticated account.

Seven request_response actions bound to handlers:

- Session reads: account_verify, account_session_list. - Session mutations: account_session_revoke, account_session_revoke_all. - API token management: account_token_create, account_token_list, account_token_revoke.

The action specs themselves live in auth/account_action_specs.ts. Every spec declares auth: 'authenticated' so the dispatcher enforces auth before the handler runs. Revoke operations are account-scoped (via query_session_revoke_for_account / query_revoke_api_token_for_account) so passing another account's session or token id returns revoked: false rather than revealing whether the id exists.

Counterpart to auth/account_routes.ts, which keeps the cookie-lifecycle flows (login, logout, password, signup, bootstrap) on REST.