@sixb/core 0.0.1

package/dist/chunk-dcgrzj1t.js

@@ -0,0 +1,2954 @@
+// @bun
+import {
+  AuthRuntimeError,
+  assertNonEmpty,
+  getCookie,
+  isInvitationDeliveryAuthStrategy,
+  normalizePagination,
+  resolveAuthConfig,
+  resolveAuthCookieOptionsForAudience,
+  resolveAuthSessionAudience,
+  resolveInvitationExpiresAt,
+  sanitizeReturnTo
+} from "./chunk-xwnf87e1.js";
+import {
+  GRANT_KINDS,
+  canAccessApplication,
+  grantKindOf,
+  resolveAuthorizationContext
+} from "./chunk-0fygrz37.js";
+
+// src/auth/access-tokens.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+var PERSONAL_ACCESS_TOKEN_PREFIX = "sixb_pat";
+var SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX = "sixb_sat";
+var ACCESS_TOKEN_ID_PATTERN = /^tok_[A-Za-z0-9_-]+$/;
+var ACCESS_TOKEN_SECRET_PATTERN = /^[A-Za-z0-9_-]{32,}$/;
+function generateAccessTokenSecret() {
+  return randomBytes(32).toString("base64url");
+}
+function hashAccessTokenSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+function formatAccessTokenValue(kind, tokenId, tokenSecret) {
+  const prefix = accessTokenPrefixForKind(kind);
+  if (!ACCESS_TOKEN_ID_PATTERN.test(tokenId)) {
+    throw new Error("[Sixb] Access token ids must start with 'tok_' and be URL-safe.");
+  }
+  if (!ACCESS_TOKEN_SECRET_PATTERN.test(tokenSecret)) {
+    throw new Error("[Sixb] Access token secrets must be at least 32 URL-safe characters.");
+  }
+  return `${prefix}_${tokenId}.${tokenSecret}`;
+}
+function parseAccessTokenValue(value) {
+  if (!value) {
+    return null;
+  }
+  const firstDot = value.indexOf(".");
+  if (firstDot <= 0 || firstDot !== value.lastIndexOf(".") || firstDot === value.length - 1) {
+    return null;
+  }
+  const tokenLabel = value.slice(0, firstDot);
+  const tokenSecret = value.slice(firstDot + 1);
+  const kind = accessTokenKindFromLabel(tokenLabel);
+  if (!kind || !ACCESS_TOKEN_SECRET_PATTERN.test(tokenSecret)) {
+    return null;
+  }
+  const tokenId = tokenLabel.slice(`${accessTokenPrefixForKind(kind)}_`.length);
+  if (!ACCESS_TOKEN_ID_PATTERN.test(tokenId)) {
+    return null;
+  }
+  return { kind, tokenId, tokenSecret };
+}
+function getBearerAccessTokenValue(request) {
+  const header = request.headers.get("authorization");
+  if (!header) {
+    return null;
+  }
+  const [scheme, token, extra] = header.trim().split(/\s+/);
+  if (scheme?.toLowerCase() !== "bearer" || !token || extra) {
+    return null;
+  }
+  return token;
+}
+function createAccessTokenCredential(kind, tokenId = `tok_${randomUUID()}`) {
+  const tokenSecret = generateAccessTokenSecret();
+  return {
+    kind,
+    tokenId,
+    tokenSecret,
+    tokenHash: hashAccessTokenSecret(tokenSecret),
+    tokenValue: formatAccessTokenValue(kind, tokenId, tokenSecret)
+  };
+}
+function accessTokenPrefixForKind(kind) {
+  switch (kind) {
+    case "personal":
+      return PERSONAL_ACCESS_TOKEN_PREFIX;
+    case "serviceAccount":
+      return SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX;
+  }
+}
+function accessTokenKindFromLabel(label) {
+  if (label.startsWith(`${PERSONAL_ACCESS_TOKEN_PREFIX}_`)) {
+    return "personal";
+  }
+  if (label.startsWith(`${SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX}_`)) {
+    return "serviceAccount";
+  }
+  return null;
+}
+// src/auth/csrf.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+var CSRF_HEADER_NAME = "x-sixb-csrf";
+function generateCsrfToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function isCsrfExemptMethod(method) {
+  const normalized = method.toUpperCase();
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
+}
+function verifyDoubleSubmitCsrf(request, options) {
+  if (isCsrfExemptMethod(request.method)) {
+    return true;
+  }
+  const cookieValue = getCookie(request, options.cookieName);
+  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME);
+  if (!cookieValue || !headerValue) {
+    return false;
+  }
+  return safeEqual(cookieValue, headerValue);
+}
+function safeEqual(left, right) {
+  const leftBytes = Buffer.from(left);
+  const rightBytes = Buffer.from(right);
+  if (leftBytes.length !== rightBytes.length) {
+    return false;
+  }
+  return timingSafeEqual(leftBytes, rightBytes);
+}
+// src/auth/runtime.ts
+import { randomUUID as randomUUID3 } from "crypto";
+
+// src/security/applications.ts
+var applications = {
+  atlas: { kind: "application", id: "atlas", label: "Atlas" },
+  app: { kind: "application", id: "app", label: "Custom app" }
+};
+var APPLICATION_IDS = new Set(Object.values(applications).map((application) => application.id));
+// src/security/errors.ts
+class SecurityValidationError extends Error {
+  name = "SecurityValidationError";
+}
+
+// src/security/membership-policies.ts
+var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"];
+function resolveMembershipPolicyScope(input) {
+  const callerGroups = new Set(input.callerGroupIds);
+  const policyIds = [];
+  const operations = createEmptyOperationScopes();
+  for (const policy of input.membershipPolicies) {
+    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {
+      continue;
+    }
+    policyIds.push(policy.id);
+    for (const operation of policy.can) {
+      operations[operation].policyIds.push(policy.id);
+      for (const groupId of policy.scopeGroupIds) {
+        operations[operation].groupIds.add(groupId);
+      }
+    }
+  }
+  return {
+    policyIds,
+    operations: {
+      invite: freezeOperationScope(operations.invite),
+      assignGroups: freezeOperationScope(operations.assignGroups),
+      suspend: freezeOperationScope(operations.suspend)
+    }
+  };
+}
+function canPerformMembershipOperation(scope, operation, groupIds) {
+  const operationScope = scope.operations[operation];
+  if (operationScope.policyIds.length === 0) {
+    return false;
+  }
+  if (groupIds.length === 0) {
+    return true;
+  }
+  return groupIds.every((groupId) => operationScope.groupIds.has(groupId));
+}
+function missingMembershipGroupIds(scope, operation, groupIds) {
+  if (groupIds.length === 0) {
+    return [];
+  }
+  const operationScope = scope.operations[operation];
+  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId));
+}
+function createEmptyOperationScopes() {
+  return {
+    invite: { policyIds: [], groupIds: new Set },
+    assignGroups: { policyIds: [], groupIds: new Set },
+    suspend: { policyIds: [], groupIds: new Set }
+  };
+}
+function freezeOperationScope(input) {
+  return {
+    policyIds: [...input.policyIds],
+    groupIds: new Set(input.groupIds)
+  };
+}
+function isMembershipOperation(value) {
+  return MEMBERSHIP_OPERATIONS.includes(value);
+}
+
+// src/security/validation.ts
+var GRANT_CAPABILITIES = Object.keys({
+  access: true,
+  view: true,
+  edit: true,
+  append: true,
+  apply: true,
+  run: true,
+  observe: true
+});
+function formatAlternatives(values) {
+  const quoted = values.map((value) => `'${value}'`);
+  const last = quoted.at(-1);
+  return quoted.length < 2 ? last ?? "" : `${quoted.slice(0, -1).join(", ")}, or ${last}`;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError(message)) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw createError(`[Sixb] ${field} must not be empty.`);
+  }
+}
+function assertOptionalString(value, field, createError = (message) => new SecurityValidationError(message)) {
+  if (value === undefined) {
+    return;
+  }
+  if (typeof value !== "string") {
+    throw createError(`[Sixb] ${field} must be a string.`);
+  }
+}
+function assertStringArray(value, field, createError) {
+  if (!Array.isArray(value)) {
+    throw createError(`[Sixb] ${field} must be an array of group ids.`);
+  }
+  for (const item of value) {
+    assertNonEmptyString(item, `${field} item`, createError);
+  }
+}
+function assertMembershipOperationArray(value, field, createError) {
+  if (!Array.isArray(value)) {
+    throw createError(`[Sixb] ${field} must be an array of membership operations.`);
+  }
+  for (const item of value) {
+    if (!isMembershipOperation(item)) {
+      throw createError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+    }
+  }
+}
+function assertNoDuplicateIds(ids, field) {
+  const seen = new Set;
+  for (const id of ids) {
+    if (seen.has(id)) {
+      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`);
+    }
+    seen.add(id);
+  }
+}
+function assertNoDuplicateOperations(operations, field) {
+  const seen = new Set;
+  for (const operation of operations) {
+    if (seen.has(operation)) {
+      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
+    }
+    seen.add(operation);
+  }
+}
+function assertGroupDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+  if (!isRecord(value)) {
+    throw createError("[Sixb] Group definition must be an object.");
+  }
+  if (value.kind !== "group") {
+    throw createError("[Sixb] Group definition kind must be 'group'.");
+  }
+  assertNonEmptyString(value.id, "Group id", createError);
+  assertOptionalString(value.label, `Group '${value.id}' label`, createError);
+  assertOptionalString(value.description, `Group '${value.id}' description`, createError);
+}
+function isGroupDefinition(value) {
+  try {
+    assertGroupDefinition(value, (message) => new Error(message));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+  if (!isRecord(value)) {
+    throw createError("[Sixb] Membership policy definition must be an object.");
+  }
+  if (value.kind !== "membershipPolicy") {
+    throw createError("[Sixb] Membership policy definition kind must be 'membershipPolicy'.");
+  }
+  assertNonEmptyString(value.id, "Membership policy id", createError);
+  assertStringArray(value.grantedToGroupIds, `Membership policy '${value.id}' grantedTo`, createError);
+  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError);
+  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError);
+}
+function isMembershipPolicyDefinition(value) {
+  try {
+    assertMembershipPolicyDefinition(value, (message) => new Error(message));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError(message)) {
+  if (!isRecord(value) || value.kind !== "grant") {
+    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`);
+  }
+  if (!GRANT_CAPABILITIES.includes(value.capability)) {
+    throw createError(`[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`);
+  }
+  if (value.capability === "access" && value.target !== "application") {
+    throw createError(`[Sixb] ${field} access grant target must be 'application'.`);
+  }
+  if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
+    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`);
+  }
+  if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
+    throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
+  }
+  if (value.capability === "observe" && value.target !== "logs") {
+    throw createError(`[Sixb] ${field} observe grant target must be 'logs'.`);
+  }
+  assertSelection(value.selection, field, createError);
+}
+function assertSelection(value, field, createError) {
+  if (!isRecord(value) || typeof value.all !== "boolean") {
+    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`);
+  }
+  const ids = value.all ? value.except : value.ids;
+  if (!Array.isArray(ids)) {
+    throw createError(`[Sixb] ${field} grant selection must list ids.`);
+  }
+  for (const id of ids) {
+    assertNonEmptyString(id, `${field} grant selection id`, createError);
+  }
+}
+function assertRoleDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+  if (!isRecord(value)) {
+    throw createError("[Sixb] Role definition must be an object.");
+  }
+  if (value.kind !== "role") {
+    throw createError("[Sixb] Role definition kind must be 'role'.");
+  }
+  assertNonEmptyString(value.id, "Role id", createError);
+  assertOptionalString(value.label, `Role '${value.id}' label`, createError);
+  assertOptionalString(value.description, `Role '${value.id}' description`, createError);
+  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError);
+  if (!Array.isArray(value.grants)) {
+    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`);
+  }
+  for (const grant of value.grants) {
+    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError);
+  }
+}
+function isRoleDefinition(value) {
+  try {
+    assertRoleDefinition(value, (message) => new Error(message));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function validateSecurityDefinitionsAtStartup(input) {
+  const groupsById = new Map;
+  const rolesById = new Map;
+  const membershipPoliciesById = new Map;
+  for (const group of input.groups) {
+    assertGroupDefinition(group);
+    if (groupsById.has(group.id)) {
+      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`);
+    }
+    groupsById.set(group.id, group);
+  }
+  for (const role of input.roles ?? []) {
+    assertRoleDefinition(role);
+    if (rolesById.has(role.id)) {
+      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`);
+    }
+    if (role.grantedToGroupIds.length === 0) {
+      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
+    }
+    if (role.grants.length === 0) {
+      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must declare at least one grant.`);
+    }
+    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`);
+    for (const groupId of role.grantedToGroupIds) {
+      if (!groupsById.has(groupId)) {
+        throw new SecurityValidationError(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      }
+    }
+    for (const grant of role.grants) {
+      assertGrantReferences(role.id, grant, input);
+    }
+    rolesById.set(role.id, role);
+  }
+  for (const policy of input.membershipPolicies) {
+    assertMembershipPolicyDefinition(policy);
+    if (membershipPoliciesById.has(policy.id)) {
+      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`);
+    }
+    if (policy.grantedToGroupIds.length === 0) {
+      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
+    }
+    if (policy.can.length === 0) {
+      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
+    }
+    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`);
+    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`);
+    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`);
+    for (const groupId of policy.grantedToGroupIds) {
+      if (!groupsById.has(groupId)) {
+        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      }
+    }
+    for (const groupId of policy.scopeGroupIds) {
+      if (!groupsById.has(groupId)) {
+        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      }
+    }
+    membershipPoliciesById.set(policy.id, policy);
+  }
+  return {
+    groups: [...groupsById.values()],
+    groupsById,
+    roles: [...rolesById.values()],
+    rolesById,
+    membershipPolicies: [...membershipPoliciesById.values()],
+    membershipPoliciesById
+  };
+}
+function assertGrantReferences(roleId, grant, registered) {
+  const spec = GRANT_KINDS[grantKindOf(grant)];
+  const universe = registered[spec.universeKey];
+  if (!universe) {
+    return;
+  }
+  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids;
+  for (const id of ids) {
+    if (!universe.has(id)) {
+      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
+    }
+  }
+}
+
+// src/security/builders.ts
+var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
+function assertNonEmptyArray(value, field) {
+  if (value.length === 0) {
+    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`);
+  }
+}
+function groupIdsFrom(groups, field) {
+  return groups.map((group) => {
+    if (!isRecord(group) || group.kind !== "group") {
+      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`);
+    }
+    assertNonEmptyString(group.id, `${field} group id`);
+    return group.id;
+  });
+}
+function membershipOperationsFrom(operations, field) {
+  return operations.map((operation) => {
+    if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
+      throw new SecurityValidationError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+    }
+    return operation;
+  });
+}
+function defineGroup(id, options = {}) {
+  assertNonEmptyString(id, "Group id");
+  assertOptionalString(options.label, `Group '${id}' label`);
+  assertOptionalString(options.description, `Group '${id}' description`);
+  return {
+    kind: "group",
+    id,
+    ...options.label !== undefined ? { label: options.label } : {},
+    ...options.description !== undefined ? { description: options.description } : {}
+  };
+}
+function defineRole(id, options) {
+  assertNonEmptyString(id, "Role id");
+  assertOptionalString(options.label, `Role '${id}' label`);
+  assertOptionalString(options.description, `Role '${id}' description`);
+  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`);
+  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`);
+  for (const grant of options.grants) {
+    assertGrantDefinition(grant, `Role '${id}' grants`);
+  }
+  if (options.grants.length === 0) {
+    throw new SecurityValidationError(`[Sixb] Role '${id}' grants must not be empty.`);
+  }
+  return {
+    kind: "role",
+    id,
+    ...options.label !== undefined ? { label: options.label } : {},
+    ...options.description !== undefined ? { description: options.description } : {},
+    grantedToGroupIds,
+    grants: options.grants
+  };
+}
+function defineMembershipPolicy(id, options) {
+  assertNonEmptyString(id, "Membership policy id");
+  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`);
+  assertNonEmptyArray(options.can, `Membership policy '${id}' can`);
+  return {
+    kind: "membershipPolicy",
+    id,
+    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),
+    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),
+    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`)
+  };
+}
+// src/security/every.ts
+var BREADTH_TARGETS = [
+  "object",
+  "dataset",
+  "action",
+  "workflow",
+  "sync",
+  "pipeline",
+  "agent",
+  "application"
+];
+function isBreadthSelector(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const candidate = value;
+  return typeof candidate.target === "string" && BREADTH_TARGETS.includes(candidate.target) && candidate.selection?.all === true;
+}
+function definitionIdOf(item, label) {
+  if (typeof item?.id !== "string" || !item.id.trim()) {
+    throw new SecurityValidationError(`[Sixb] ${label} requires definitions with a non-empty id.`);
+  }
+  return item.id;
+}
+function all(target, except = []) {
+  return {
+    target,
+    selection: { all: true, except },
+    except(items) {
+      return all(target, [
+        ...except,
+        ...items.map((item) => definitionIdOf(item, `every.${target}() except`))
+      ]);
+    }
+  };
+}
+var every = {
+  object: () => all("object"),
+  dataset: () => all("dataset"),
+  action: () => all("action"),
+  workflow: () => all("workflow"),
+  sync: () => all("sync"),
+  pipeline: () => all("pipeline"),
+  agent: () => all("agent"),
+  application: () => all("application")
+};
+// src/security/grants.ts
+var VIEW_TARGETS = ["object", "dataset"];
+var RUN_TARGETS = ["workflow", "sync", "pipeline", "agent"];
+var TARGET_BY_DEFINITION_KIND = {
+  dataset: "dataset",
+  sync: "sync",
+  pipeline: "pipeline",
+  agent: "agent",
+  workflow: "workflow",
+  application: "application"
+};
+var UNDISCRIMINATED_TARGETS = ["object", "action"];
+function targetOfDefinition(item, label, allowedTargets) {
+  const kind = item?.kind;
+  const discriminated = typeof kind === "string" ? TARGET_BY_DEFINITION_KIND[kind] : undefined;
+  if (discriminated) {
+    if (!isAllowedTarget(discriminated, allowedTargets)) {
+      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`);
+    }
+    return discriminated;
+  }
+  const candidates = allowedTargets.filter((target) => UNDISCRIMINATED_TARGETS.includes(target));
+  const only = candidates.length === 1 ? candidates[0] : undefined;
+  if (only)
+    return only;
+  throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one Sixb could not classify.`);
+}
+function isAllowedTarget(target, allowedTargets) {
+  return allowedTargets.includes(target);
+}
+function resolveGrant(input, label, allowedTargets) {
+  if (isBreadthSelector(input)) {
+    if (!isAllowedTarget(input.target, allowedTargets)) {
+      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} selectors, but received every.${input.target}().`);
+    }
+    return { target: input.target, selection: input.selection };
+  }
+  const items = Array.isArray(input) ? input : [input];
+  let target;
+  for (const item of items) {
+    const itemTarget = targetOfDefinition(item, label, allowedTargets);
+    if (target === undefined) {
+      target = itemTarget;
+      continue;
+    }
+    if (itemTarget !== target) {
+      throw new SecurityValidationError(`[Sixb] ${label} requires one target per grant, but received both ${target} and ${itemTarget} definitions. Use one grant each.`);
+    }
+  }
+  if (target === undefined) {
+    throw new SecurityValidationError(`[Sixb] ${label} requires at least one definition.`);
+  }
+  const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
+  return { target, selection: { all: false, ids } };
+}
+function access(input) {
+  const { selection } = resolveGrant(input, "can.access", ["application"]);
+  return { kind: "grant", capability: "access", target: "application", selection };
+}
+function view(input) {
+  const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS);
+  return { kind: "grant", capability: "view", target, selection };
+}
+function edit(input) {
+  return {
+    kind: "grant",
+    capability: "edit",
+    selection: resolveGrant(input, "can.edit", ["object"]).selection
+  };
+}
+function append(input) {
+  return {
+    kind: "grant",
+    capability: "append",
+    selection: resolveGrant(input, "can.append", ["object"]).selection
+  };
+}
+function apply(input) {
+  return {
+    kind: "grant",
+    capability: "apply",
+    selection: resolveGrant(input, "can.apply", ["action"]).selection
+  };
+}
+function run(input) {
+  const { target, selection } = resolveGrant(input, "can.run", RUN_TARGETS);
+  return { kind: "grant", capability: "run", target, selection };
+}
+function observe(target) {
+  return {
+    kind: "grant",
+    capability: "observe",
+    target,
+    selection: { all: false, ids: [target] }
+  };
+}
+var can = {
+  access,
+  view,
+  edit,
+  append,
+  apply,
+  run,
+  observe
+};
+// src/storage/auth/errors.ts
+class AuthStorageError extends Error {
+  code;
+  name = "AuthStorageError";
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+// src/storage/auth/in-memory/shared.ts
+function createAuthStorageState() {
+  return {
+    users: new Map,
+    identities: new Map,
+    serviceAccounts: new Map,
+    serviceAccountGroupMemberships: new Map,
+    sessions: new Map,
+    accessTokens: new Map,
+    invitations: new Map,
+    groupMemberships: new Map,
+    magicLinks: new Map,
+    oidcAuthorizationAttempts: new Map
+  };
+}
+function scopedKey(...parts) {
+  return JSON.stringify(parts);
+}
+function userKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function identityKey(projectId, strategyId, subject) {
+  return scopedKey(projectId, strategyId, subject);
+}
+function serviceAccountKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId) {
+  return scopedKey(projectId, serviceAccountId, groupId);
+}
+function sessionKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function accessTokenKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function invitationKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function groupMembershipKey(projectId, userId, groupId) {
+  return scopedKey(projectId, userId, groupId);
+}
+function magicLinkKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function oidcAttemptKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
+function cloneRecord(record) {
+  return structuredClone(record);
+}
+function cloneOptionalRecord(record) {
+  return record ? cloneRecord(record) : null;
+}
+function cloneDate(value) {
+  return new Date(value);
+}
+function dateOrNow(value) {
+  return value ? cloneDate(value) : new Date;
+}
+function assertNonEmpty2(value, label) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new AuthStorageError("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizeEmail(email) {
+  return assertNonEmpty2(email, "Email").toLowerCase();
+}
+function normalizeGroupIds(groupIds) {
+  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty2(groupId, "Group id")))];
+}
+function normalizeOptionalGroupIds(groupIds) {
+  return groupIds === undefined ? undefined : normalizeGroupIds(groupIds);
+}
+function normalizeClaims(claims) {
+  return claims ? cloneRecord(claims) : undefined;
+}
+function compareByCreatedAt(a, b, order) {
+  const delta = a.createdAt.getTime() - b.createdAt.getTime();
+  if (delta !== 0) {
+    return order === "asc" ? delta : -delta;
+  }
+  return order === "asc" ? a.id.localeCompare(b.id) : b.id.localeCompare(a.id);
+}
+function isActiveSession(session, now) {
+  return !session.revokedAt && session.expiresAt > now && (!session.absoluteExpiresAt || session.absoluteExpiresAt > now);
+}
+function isActiveAccessToken(token, now) {
+  return !token.revokedAt && token.expiresAt > now;
+}
+function isActiveInvitation(invitation, now) {
+  return invitation.status === "pending" && invitation.expiresAt > now;
+}
+function isActiveMagicLink(link, now) {
+  return !link.consumedAt && !link.revokedAt && link.expiresAt > now;
+}
+function getUserByEmail(state, projectId, email) {
+  const normalizedEmail = normalizeEmail(email);
+  for (const user of state.users.values()) {
+    if (user.projectId === projectId && user.email === normalizedEmail) {
+      return user;
+    }
+  }
+  return null;
+}
+function getActiveInvitationByEmail(state, projectId, email, now) {
+  const normalizedEmail = normalizeEmail(email);
+  const invitations = [...state.invitations.values()].filter((invitation) => invitation.projectId === projectId).filter((invitation) => invitation.email === normalizedEmail).filter((invitation) => isActiveInvitation(invitation, now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
+  return invitations[0] ?? null;
+}
+function revokeActiveSessionsForUser(state, projectId, userId, revokedAt, audience) {
+  const revoked = [];
+  for (const [key, session] of state.sessions) {
+    if (session.projectId !== projectId || session.userId !== userId) {
+      continue;
+    }
+    if (audience !== undefined && session.audience !== audience) {
+      continue;
+    }
+    if (!isActiveSession(session, revokedAt)) {
+      continue;
+    }
+    const next = {
+      ...session,
+      revokedAt: cloneDate(revokedAt)
+    };
+    state.sessions.set(key, cloneRecord(next));
+    revoked.push(next);
+  }
+  return revoked;
+}
+function revokeActiveMagicLinksForEmail(state, projectId, email, revokedAt) {
+  const normalizedEmail = normalizeEmail(email);
+  const revoked = [];
+  for (const [key, link] of state.magicLinks) {
+    if (link.projectId !== projectId || link.email !== normalizedEmail) {
+      continue;
+    }
+    if (!isActiveMagicLink(link, revokedAt)) {
+      continue;
+    }
+    const next = {
+      ...link,
+      revokedAt: cloneDate(revokedAt)
+    };
+    state.magicLinks.set(key, cloneRecord(next));
+    revoked.push(next);
+  }
+  return revoked;
+}
+function assertSessionIdAvailable(state, projectId, sessionId) {
+  if (state.sessions.has(sessionKey(projectId, sessionId))) {
+    throw new AuthStorageError("duplicate_session", `[Sixb] Session '${sessionId}' already exists for project '${projectId}'.`);
+  }
+}
+function validateCompleteSessionInput(state, projectId, session) {
+  const sessionId = assertNonEmpty2(session.id, "Session id");
+  assertNonEmpty2(session.audience, "Session audience");
+  assertNonEmpty2(session.tokenHash, "Session token hash");
+  assertSessionIdAvailable(state, projectId, sessionId);
+}
+function createSessionRecord(state, input) {
+  const id = assertNonEmpty2(input.id, "Session id");
+  const projectId = assertNonEmpty2(input.projectId, "Project id");
+  const userId = assertNonEmpty2(input.userId, "User id");
+  const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+  const audience = resolveAuthSessionAudience(input.audience);
+  const tokenHash = assertNonEmpty2(input.tokenHash, "Session token hash");
+  assertSessionIdAvailable(state, projectId, id);
+  const session = {
+    id,
+    projectId,
+    userId,
+    strategyId,
+    audience,
+    tokenHash,
+    createdAt: cloneDate(input.createdAt),
+    expiresAt: cloneDate(input.expiresAt),
+    absoluteExpiresAt: input.absoluteExpiresAt ? cloneDate(input.absoluteExpiresAt) : undefined,
+    userAgent: input.userAgent,
+    ipAddress: input.ipAddress
+  };
+  state.sessions.set(sessionKey(projectId, id), cloneRecord(session));
+  return session;
+}
+function createServiceAccountRecord(state, input) {
+  const id = assertNonEmpty2(input.id, "Service account id");
+  const projectId = assertNonEmpty2(input.projectId, "Project id");
+  const name = assertNonEmpty2(input.name, "Service account name");
+  const key = serviceAccountKey(projectId, id);
+  if (state.serviceAccounts.has(key)) {
+    throw new AuthStorageError("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
+  }
+  const createdAt = dateOrNow(input.createdAt);
+  const serviceAccount = {
+    id,
+    projectId,
+    name,
+    description: input.description,
+    status: input.status ?? "active",
+    createdByPrincipal: input.createdByPrincipal,
+    createdBySessionId: input.createdBySessionId,
+    createdAt,
+    updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : cloneDate(createdAt)
+  };
+  state.serviceAccounts.set(key, cloneRecord(serviceAccount));
+  return serviceAccount;
+}
+function upsertServiceAccountGroupMembershipRecord(state, input) {
+  const projectId = assertNonEmpty2(input.projectId, "Project id");
+  const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
+  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  if (!state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
+    throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+  }
+  const key = serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId);
+  const existing = state.serviceAccountGroupMemberships.get(key);
+  if (existing) {
+    return existing;
+  }
+  const membership = {
+    projectId,
+    serviceAccountId,
+    groupId,
+    source: input.source,
+    createdAt: dateOrNow(input.createdAt)
+  };
+  state.serviceAccountGroupMemberships.set(key, cloneRecord(membership));
+  return membership;
+}
+function createAccessTokenRecord(state, input) {
+  const id = assertNonEmpty2(input.id, "Access token id");
+  const projectId = assertNonEmpty2(input.projectId, "Project id");
+  const name = assertNonEmpty2(input.name, "Access token name");
+  const subjectId = assertNonEmpty2(input.subjectId, "Access token subject id");
+  const tokenHash = assertNonEmpty2(input.tokenHash, "Access token hash");
+  assertAccessTokenSubject(input.kind, input.subjectType);
+  assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
+  const key = accessTokenKey(projectId, id);
+  if (state.accessTokens.has(key)) {
+    throw new AuthStorageError("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
+  }
+  const token = {
+    id,
+    projectId,
+    name,
+    kind: input.kind,
+    subjectType: input.subjectType,
+    subjectId,
+    tokenHash,
+    groupIds: normalizeOptionalGroupIds(input.groupIds),
+    createdByPrincipal: input.createdByPrincipal,
+    createdBySessionId: input.createdBySessionId,
+    createdAt: cloneDate(input.createdAt),
+    expiresAt: cloneDate(input.expiresAt)
+  };
+  state.accessTokens.set(key, cloneRecord(token));
+  return token;
+}
+function upsertGroupMembershipRecord(state, input) {
+  const projectId = assertNonEmpty2(input.projectId, "Project id");
+  const userId = assertNonEmpty2(input.userId, "User id");
+  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  if (!state.users.has(userKey(projectId, userId))) {
+    throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
+  }
+  const key = groupMembershipKey(projectId, userId, groupId);
+  const existing = state.groupMemberships.get(key);
+  if (existing) {
+    return existing;
+  }
+  const membership = {
+    projectId,
+    userId,
+    groupId,
+    source: input.source,
+    createdAt: dateOrNow(input.createdAt)
+  };
+  state.groupMemberships.set(key, cloneRecord(membership));
+  return membership;
+}
+function removeGroupMembershipRecord(state, params) {
+  const projectId = assertNonEmpty2(params.projectId, "Project id");
+  const userId = assertNonEmpty2(params.userId, "User id");
+  const groupId = assertNonEmpty2(params.groupId, "Group id");
+  const key = groupMembershipKey(projectId, userId, groupId);
+  const existing = state.groupMemberships.get(key);
+  if (!existing) {
+    return null;
+  }
+  state.groupMemberships.delete(key);
+  return existing;
+}
+function assertAccessTokenSubject(kind, subjectType) {
+  if (kind === "personal" && subjectType === "user" || kind === "serviceAccount" && subjectType === "serviceAccount") {
+    return;
+  }
+  throw new AuthStorageError("invalid_input", `[Sixb] Access token kind '${kind}' cannot target subject type '${subjectType}'.`);
+}
+function assertAccessTokenSubjectExists(state, projectId, subjectType, subjectId) {
+  if (subjectType === "user") {
+    if (state.users.has(userKey(projectId, subjectId)))
+      return;
+    throw new AuthStorageError("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
+  }
+  if (state.serviceAccounts.has(serviceAccountKey(projectId, subjectId)))
+    return;
+  throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
+}
+function consumeMagicLinkRecord(state, params) {
+  const projectId = assertNonEmpty2(params.projectId, "Project id");
+  const id = assertNonEmpty2(params.id, "Magic link id");
+  const tokenHash = assertNonEmpty2(params.tokenHash, "Magic link token hash");
+  const key = magicLinkKey(projectId, id);
+  const existing = state.magicLinks.get(key);
+  if (!existing) {
+    throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
+  }
+  if (existing.tokenHash !== tokenHash || existing.consumedAt || existing.revokedAt) {
+    throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
+  }
+  if (existing.expiresAt <= params.consumedAt) {
+    throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
+  }
+  const consumed = {
+    ...existing,
+    consumedAt: cloneDate(params.consumedAt)
+  };
+  state.magicLinks.set(key, cloneRecord(consumed));
+  return consumed;
+}
+function consumeOidcAttemptRecord(state, params) {
+  const projectId = assertNonEmpty2(params.projectId, "Project id");
+  const id = assertNonEmpty2(params.id, "OIDC authorization attempt id");
+  const stateHash = assertNonEmpty2(params.stateHash, "OIDC state hash");
+  const key = oidcAttemptKey(projectId, id);
+  const existing = state.oidcAuthorizationAttempts.get(key);
+  if (!existing) {
+    throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
+  }
+  if (existing.stateHash !== stateHash || existing.consumedAt) {
+    throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
+  }
+  if (existing.expiresAt <= params.consumedAt) {
+    throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
+  }
+  const consumed = {
+    ...existing,
+    consumedAt: cloneDate(params.consumedAt)
+  };
+  state.oidcAuthorizationAttempts.set(key, cloneRecord(consumed));
+  return consumed;
+}
+
+// src/storage/auth/in-memory/access-tokens.ts
+class InMemoryAuthAccessTokenStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    return cloneRecord(createAccessTokenRecord(this.state, input));
+  }
+  async getById(params) {
+    const record = this.state.accessTokens.get(accessTokenKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async list(input) {
+    const order = input.order ?? "asc";
+    const offset = input.offset ?? 0;
+    const rows = [...this.state.accessTokens.values()].filter((token) => token.projectId === input.projectId).filter((token) => input.kind === undefined || token.kind === input.kind).filter((token) => input.subjectType === undefined || token.subjectType === input.subjectType).filter((token) => input.subjectId === undefined || token.subjectId === input.subjectId).filter((token) => input.includeRevoked || !token.revokedAt).sort((a, b) => compareByCreatedAt(a, b, order));
+    const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit);
+    return {
+      accessTokens: page.map(cloneRecord),
+      hasMore: input.limit === undefined ? false : offset + input.limit < rows.length,
+      total: rows.length
+    };
+  }
+  async findValidByTokenHash(params) {
+    const token = this.state.accessTokens.get(accessTokenKey(params.projectId, params.id));
+    if (!token || token.kind !== params.kind || token.tokenHash !== params.tokenHash || !isActiveAccessToken(token, params.now)) {
+      return null;
+    }
+    return cloneRecord(token);
+  }
+  async revoke(params) {
+    const key = accessTokenKey(params.projectId, params.id);
+    const existing = this.state.accessTokens.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      revokedAt: cloneDate(params.revokedAt)
+    };
+    this.state.accessTokens.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async touch(params) {
+    const key = accessTokenKey(params.projectId, params.id);
+    const existing = this.state.accessTokens.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      lastUsedAt: cloneDate(params.lastUsedAt),
+      lastUsedUserAgent: params.userAgent ?? existing.lastUsedUserAgent,
+      lastUsedIpAddress: params.ipAddress ?? existing.lastUsedIpAddress
+    };
+    this.state.accessTokens.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+}
+
+// src/storage/auth/in-memory/group-memberships.ts
+class InMemoryAuthGroupMembershipStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async upsert(input) {
+    return cloneRecord(upsertGroupMembershipRecord(this.state, input));
+  }
+  async remove(params) {
+    const removed = removeGroupMembershipRecord(this.state, params);
+    return removed ? cloneRecord(removed) : null;
+  }
+  async listForUser(params) {
+    return [...this.state.groupMemberships.values()].filter((membership) => membership.projectId === params.projectId).filter((membership) => membership.userId === params.userId).sort((a, b) => a.groupId.localeCompare(b.groupId)).map(cloneRecord);
+  }
+  async listForGroup(params) {
+    return [...this.state.groupMemberships.values()].filter((membership) => membership.projectId === params.projectId).filter((membership) => membership.groupId === params.groupId).sort((a, b) => a.userId.localeCompare(b.userId)).map(cloneRecord);
+  }
+}
+
+// src/storage/auth/in-memory/identities.ts
+class InMemoryAuthUserIdentityStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async upsert(input) {
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const subject = assertNonEmpty2(input.subject, "Subject");
+    const userId = assertNonEmpty2(input.userId, "User id");
+    const key = identityKey(projectId, strategyId, subject);
+    const existing = this.state.identities.get(key);
+    const createdAt = existing?.createdAt ?? dateOrNow(input.createdAt);
+    const identity = {
+      projectId,
+      strategyId,
+      subject,
+      userId,
+      claims: normalizeClaims(input.claims),
+      createdAt,
+      updatedAt: input.updatedAt ? new Date(input.updatedAt) : existing ? new Date : createdAt
+    };
+    this.state.identities.set(key, cloneRecord(identity));
+    return cloneRecord(identity);
+  }
+  async getBySubject(params) {
+    const record = this.state.identities.get(identityKey(params.projectId, params.strategyId, params.subject)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async listForUser(params) {
+    return [...this.state.identities.values()].filter((identity) => identity.projectId === params.projectId).filter((identity) => identity.userId === params.userId).sort((a, b) => {
+      const delta = a.createdAt.getTime() - b.createdAt.getTime();
+      if (delta !== 0)
+        return delta;
+      return `${a.strategyId}:${a.subject}`.localeCompare(`${b.strategyId}:${b.subject}`);
+    }).map(cloneRecord);
+  }
+}
+
+// src/storage/pagination.ts
+function paginate(values, input) {
+  const offset = input.offset ?? 0;
+  const limit = input.limit ?? values.length;
+  const total = values.length;
+  const page = values.slice(offset, offset + limit);
+  return {
+    page,
+    total,
+    hasMore: offset + page.length < total
+  };
+}
+
+// src/storage/auth/in-memory/invitations.ts
+class InMemoryAuthInvitationStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async createOrUpdateActive(input) {
+    const id = assertNonEmpty2(input.id, "Invitation id");
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const email = normalizeEmail(input.email);
+    const groupIds = normalizeGroupIds(input.groupIds);
+    const now = dateOrNow(input.updatedAt ?? input.createdAt);
+    const existingActive = getActiveInvitationByEmail(this.state, projectId, email, now);
+    if (existingActive) {
+      const next = {
+        ...existingActive,
+        groupIds,
+        createdByPrincipal: input.createdByPrincipal,
+        createdBySessionId: input.createdBySessionId,
+        expiresAt: cloneDate(input.expiresAt),
+        updatedAt: now
+      };
+      this.state.invitations.set(invitationKey(projectId, existingActive.id), cloneRecord(next));
+      return cloneRecord(next);
+    }
+    const key = invitationKey(projectId, id);
+    if (this.state.invitations.has(key)) {
+      throw new AuthStorageError("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
+    }
+    const invitation = {
+      id,
+      projectId,
+      email,
+      groupIds,
+      status: "pending",
+      createdByPrincipal: input.createdByPrincipal,
+      createdBySessionId: input.createdBySessionId,
+      createdAt: dateOrNow(input.createdAt),
+      updatedAt: now,
+      expiresAt: cloneDate(input.expiresAt)
+    };
+    this.state.invitations.set(key, cloneRecord(invitation));
+    return cloneRecord(invitation);
+  }
+  async getById(params) {
+    const record = this.state.invitations.get(invitationKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async getActiveByEmail(params) {
+    return cloneOptionalRecord(getActiveInvitationByEmail(this.state, params.projectId, params.email, params.now));
+  }
+  async list(input) {
+    if (input.statuses?.length === 0 || input.groupIds?.length === 0) {
+      return { invitations: [], hasMore: false, total: 0 };
+    }
+    const statuses = input.statuses ? new Set(input.statuses) : null;
+    const groupIds = input.groupIds ? new Set(input.groupIds) : null;
+    const email = input.email ? normalizeEmail(input.email) : null;
+    const order = input.order ?? "desc";
+    const invitations = [...this.state.invitations.values()].filter((invitation) => invitation.projectId === input.projectId).filter((invitation) => email ? invitation.email === email : true).filter((invitation) => statuses ? statuses.has(invitation.status) : true).filter((invitation) => groupIds ? invitation.groupIds.some((groupId) => groupIds.has(groupId)) : true).sort((a, b) => compareByCreatedAt(a, b, order));
+    const page = paginate(invitations, input);
+    return {
+      invitations: page.page.map(cloneRecord),
+      hasMore: page.hasMore,
+      total: page.total
+    };
+  }
+  async accept(params) {
+    const key = invitationKey(params.projectId, params.id);
+    const existing = this.state.invitations.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      status: "accepted",
+      acceptedAt: cloneDate(params.acceptedAt),
+      updatedAt: cloneDate(params.acceptedAt)
+    };
+    this.state.invitations.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async revoke(params) {
+    const key = invitationKey(params.projectId, params.id);
+    const existing = this.state.invitations.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      status: "revoked",
+      revokedAt: cloneDate(params.revokedAt),
+      updatedAt: cloneDate(params.revokedAt)
+    };
+    this.state.invitations.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+}
+
+// src/storage/auth/in-memory/magic-links.ts
+class InMemoryAuthMagicLinkStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    const id = assertNonEmpty2(input.id, "Magic link id");
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const audience = resolveAuthSessionAudience(input.audience);
+    const email = normalizeEmail(input.email);
+    const tokenHash = assertNonEmpty2(input.tokenHash, "Magic link token hash");
+    const key = magicLinkKey(projectId, id);
+    if (this.state.magicLinks.has(key)) {
+      throw new AuthStorageError("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
+    }
+    revokeActiveMagicLinksForEmail(this.state, projectId, email, input.createdAt);
+    const link = {
+      id,
+      projectId,
+      strategyId,
+      audience,
+      email,
+      tokenHash,
+      returnTo: input.returnTo,
+      createdAt: cloneDate(input.createdAt),
+      expiresAt: cloneDate(input.expiresAt)
+    };
+    this.state.magicLinks.set(key, cloneRecord(link));
+    return cloneRecord(link);
+  }
+  async getById(params) {
+    const record = this.state.magicLinks.get(magicLinkKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async getActiveByEmail(params) {
+    const email = normalizeEmail(params.email);
+    const links = [...this.state.magicLinks.values()].filter((link) => link.projectId === params.projectId).filter((link) => link.email === email).filter((link) => isActiveMagicLink(link, params.now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
+    return cloneOptionalRecord(links[0] ?? null);
+  }
+  async consume(params) {
+    return cloneRecord(consumeMagicLinkRecord(this.state, params));
+  }
+  async revokeActiveForEmail(params) {
+    return revokeActiveMagicLinksForEmail(this.state, params.projectId, params.email, params.revokedAt).map(cloneRecord);
+  }
+}
+
+// src/storage/auth/in-memory/oidc-attempts.ts
+class InMemoryAuthOidcAuthorizationAttemptStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    const id = assertNonEmpty2(input.id, "OIDC authorization attempt id");
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const audience = resolveAuthSessionAudience(input.audience);
+    const stateHash = assertNonEmpty2(input.stateHash, "OIDC state hash");
+    const nonceHash = assertNonEmpty2(input.nonceHash, "OIDC nonce hash");
+    const codeVerifier = assertNonEmpty2(input.codeVerifier, "OIDC code verifier");
+    const key = oidcAttemptKey(projectId, id);
+    if (this.state.oidcAuthorizationAttempts.has(key)) {
+      throw new AuthStorageError("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
+    }
+    const attempt = {
+      id,
+      projectId,
+      strategyId,
+      audience,
+      stateHash,
+      nonceHash,
+      codeVerifier,
+      returnTo: input.returnTo,
+      createdAt: cloneDate(input.createdAt),
+      expiresAt: cloneDate(input.expiresAt)
+    };
+    this.state.oidcAuthorizationAttempts.set(key, cloneRecord(attempt));
+    return cloneRecord(attempt);
+  }
+  async getById(params) {
+    const record = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async consume(params) {
+    return cloneRecord(consumeOidcAttemptRecord(this.state, params));
+  }
+}
+
+// src/storage/auth/in-memory/service-account-group-memberships.ts
+class InMemoryAuthServiceAccountGroupMembershipStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async upsert(input) {
+    return cloneRecord(upsertServiceAccountGroupMembershipRecord(this.state, input));
+  }
+  async reconcileForServiceAccount(input) {
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
+    if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
+      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    const desired = new Set(groupIds);
+    for (const [key, membership] of this.state.serviceAccountGroupMemberships) {
+      if (membership.projectId === projectId && membership.serviceAccountId === serviceAccountId && membership.source === input.source && !desired.has(membership.groupId)) {
+        this.state.serviceAccountGroupMemberships.delete(key);
+      }
+    }
+    const updatedAt = dateOrNow(input.updatedAt);
+    for (const groupId of groupIds) {
+      const key = serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId);
+      const existing = this.state.serviceAccountGroupMemberships.get(key);
+      if (existing) {
+        this.state.serviceAccountGroupMemberships.set(key, cloneRecord({ ...existing, source: input.source }));
+        continue;
+      }
+      this.state.serviceAccountGroupMemberships.set(key, cloneRecord({
+        projectId,
+        serviceAccountId,
+        groupId,
+        source: input.source,
+        createdAt: updatedAt
+      }));
+    }
+    return this.listForServiceAccount({ projectId, serviceAccountId });
+  }
+  async listForServiceAccount(params) {
+    return [...this.state.serviceAccountGroupMemberships.values()].filter((membership) => membership.projectId === params.projectId).filter((membership) => membership.serviceAccountId === params.serviceAccountId).sort((a, b) => a.groupId.localeCompare(b.groupId)).map(cloneRecord);
+  }
+  async listForGroup(params) {
+    return [...this.state.serviceAccountGroupMemberships.values()].filter((membership) => membership.projectId === params.projectId).filter((membership) => membership.groupId === params.groupId).sort((a, b) => a.serviceAccountId.localeCompare(b.serviceAccountId)).map(cloneRecord);
+  }
+}
+
+// src/storage/auth/in-memory/service-accounts.ts
+class InMemoryAuthServiceAccountStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    return cloneRecord(createServiceAccountRecord(this.state, input));
+  }
+  async getById(params) {
+    const record = this.state.serviceAccounts.get(serviceAccountKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async update(input) {
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty2(input.id, "Service account id");
+    const key = serviceAccountKey(projectId, id);
+    const existing = this.state.serviceAccounts.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      name: input.name === undefined ? existing.name : assertNonEmpty2(input.name, "Service account name"),
+      description: input.description === undefined ? existing.description : input.description,
+      status: input.status ?? existing.status,
+      updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : new Date
+    };
+    this.state.serviceAccounts.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async list(input) {
+    const statuses = input.statuses ? new Set(input.statuses) : null;
+    const order = input.order ?? "asc";
+    const offset = input.offset ?? 0;
+    const rows = [...this.state.serviceAccounts.values()].filter((serviceAccount) => serviceAccount.projectId === input.projectId).filter((serviceAccount) => !statuses || statuses.has(serviceAccount.status)).sort((a, b) => compareByCreatedAt(a, b, order));
+    const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit);
+    return {
+      serviceAccounts: page.map(cloneRecord),
+      hasMore: input.limit === undefined ? false : offset + input.limit < rows.length,
+      total: rows.length
+    };
+  }
+}
+
+// src/storage/auth/in-memory/sessions.ts
+class InMemoryAuthSessionStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    return cloneRecord(createSessionRecord(this.state, input));
+  }
+  async getById(params) {
+    const record = this.state.sessions.get(sessionKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async getActiveByUserId(params) {
+    const sessions = [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => session.audience === params.audience).filter((session) => isActiveSession(session, params.now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
+    return cloneOptionalRecord(sessions[0] ?? null);
+  }
+  async listActiveByUserId(params) {
+    return [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => isActiveSession(session, params.now)).sort((a, b) => {
+      const activity = (b.lastSeenAt ?? b.createdAt).getTime() - (a.lastSeenAt ?? a.createdAt).getTime();
+      if (activity !== 0)
+        return activity;
+      const created = b.createdAt.getTime() - a.createdAt.getTime();
+      return created !== 0 ? created : b.id.localeCompare(a.id);
+    }).map(cloneRecord);
+  }
+  async findValidByTokenHash(params) {
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
+    if (!session || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+      return null;
+    }
+    return cloneRecord(session);
+  }
+  async renewIfValid(params) {
+    const key = sessionKey(params.projectId, params.id);
+    const session = this.state.sessions.get(key);
+    if (!session || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+      return null;
+    }
+    const requestedExpiresAt = session.absoluteExpiresAt ? new Date(Math.min(params.expiresAt.getTime(), session.absoluteExpiresAt.getTime())) : params.expiresAt;
+    const next = {
+      ...session,
+      expiresAt: new Date(Math.max(session.expiresAt.getTime(), requestedExpiresAt.getTime())),
+      lastSeenAt: cloneDate(params.now)
+    };
+    this.state.sessions.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async revoke(params) {
+    const key = sessionKey(params.projectId, params.id);
+    const existing = this.state.sessions.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      revokedAt: cloneDate(params.revokedAt)
+    };
+    this.state.sessions.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async revokeActiveForUser(params) {
+    return revokeActiveSessionsForUser(this.state, params.projectId, params.userId, params.revokedAt, params.audience).map(cloneRecord);
+  }
+  async touch(params) {
+    const key = sessionKey(params.projectId, params.id);
+    const existing = this.state.sessions.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      lastSeenAt: cloneDate(params.lastSeenAt)
+    };
+    this.state.sessions.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+}
+
+// src/storage/auth/in-memory/users.ts
+class InMemoryAuthUserStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    const id = assertNonEmpty2(input.id, "User id");
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const email = normalizeEmail(input.email);
+    const key = userKey(projectId, id);
+    if (this.state.users.has(key)) {
+      throw new AuthStorageError("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
+    }
+    if (getUserByEmail(this.state, projectId, email)) {
+      throw new AuthStorageError("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
+    }
+    const createdAt = dateOrNow(input.createdAt);
+    const user = {
+      id,
+      projectId,
+      email,
+      displayName: input.displayName,
+      avatarUrl: input.avatarUrl,
+      status: input.status ?? "active",
+      createdAt,
+      updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : cloneDate(createdAt)
+    };
+    this.state.users.set(key, cloneRecord(user));
+    return cloneRecord(user);
+  }
+  async getById(params) {
+    const record = this.state.users.get(userKey(params.projectId, params.id)) ?? null;
+    return cloneOptionalRecord(record);
+  }
+  async getByEmail(params) {
+    return cloneOptionalRecord(getUserByEmail(this.state, params.projectId, params.email));
+  }
+  async updateProfile(input) {
+    const key = userKey(input.projectId, input.id);
+    const existing = this.state.users.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      displayName: input.displayName,
+      avatarUrl: input.avatarUrl,
+      updatedAt: dateOrNow(input.updatedAt)
+    };
+    this.state.users.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async updateStatus(input) {
+    const key = userKey(input.projectId, input.id);
+    const existing = this.state.users.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      status: input.status,
+      updatedAt: dateOrNow(input.updatedAt)
+    };
+    this.state.users.set(key, cloneRecord(next));
+    return cloneRecord(next);
+  }
+  async list(input) {
+    if (input.statuses?.length === 0) {
+      return { users: [], hasMore: false, total: 0 };
+    }
+    const statuses = input.statuses ? new Set(input.statuses) : null;
+    const order = input.order ?? "desc";
+    const rows = [...this.state.users.values()].filter((user) => user.projectId === input.projectId).filter((user) => statuses ? statuses.has(user.status) : true).sort((a, b) => compareByCreatedAt(a, b, order));
+    const page = paginate(rows, input);
+    return {
+      users: page.page.map(cloneRecord),
+      hasMore: page.hasMore,
+      total: page.total
+    };
+  }
+}
+
+// src/storage/auth/in-memory/auth-storage.ts
+class InMemoryAuthStorage {
+  state = createAuthStorageState();
+  users = new InMemoryAuthUserStore(this.state);
+  identities = new InMemoryAuthUserIdentityStore(this.state);
+  serviceAccounts = new InMemoryAuthServiceAccountStore(this.state);
+  serviceAccountGroupMemberships = new InMemoryAuthServiceAccountGroupMembershipStore(this.state);
+  sessions = new InMemoryAuthSessionStore(this.state);
+  accessTokens = new InMemoryAuthAccessTokenStore(this.state);
+  invitations = new InMemoryAuthInvitationStore(this.state);
+  groupMemberships = new InMemoryAuthGroupMembershipStore(this.state);
+  magicLinks = new InMemoryAuthMagicLinkStore(this.state);
+  oidcAuthorizationAttempts = new InMemoryAuthOidcAuthorizationAttemptStore(this.state);
+  snapshot() {
+    return {
+      users: structuredClone(this.state.users),
+      identities: structuredClone(this.state.identities),
+      serviceAccounts: structuredClone(this.state.serviceAccounts),
+      serviceAccountGroupMemberships: structuredClone(this.state.serviceAccountGroupMemberships),
+      sessions: structuredClone(this.state.sessions),
+      accessTokens: structuredClone(this.state.accessTokens),
+      invitations: structuredClone(this.state.invitations),
+      groupMemberships: structuredClone(this.state.groupMemberships),
+      magicLinks: structuredClone(this.state.magicLinks),
+      oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts)
+    };
+  }
+  restore(snapshot) {
+    restoreMap(this.state.users, snapshot.users);
+    restoreMap(this.state.identities, snapshot.identities);
+    restoreMap(this.state.serviceAccounts, snapshot.serviceAccounts);
+    restoreMap(this.state.serviceAccountGroupMemberships, snapshot.serviceAccountGroupMemberships);
+    restoreMap(this.state.sessions, snapshot.sessions);
+    restoreMap(this.state.accessTokens, snapshot.accessTokens);
+    restoreMap(this.state.invitations, snapshot.invitations);
+    restoreMap(this.state.groupMemberships, snapshot.groupMemberships);
+    restoreMap(this.state.magicLinks, snapshot.magicLinks);
+    restoreMap(this.state.oidcAuthorizationAttempts, snapshot.oidcAuthorizationAttempts);
+  }
+  async completeMagicLinkSignIn(input) {
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const completedAt = cloneDate(input.completedAt);
+    const magicLink = this.state.magicLinks.get(magicLinkKey(projectId, input.magicLinkId));
+    if (!magicLink) {
+      throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
+    }
+    if (magicLink.tokenHash !== input.tokenHash || magicLink.consumedAt || magicLink.revokedAt) {
+      throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is not valid for project '${projectId}'.`);
+    }
+    if (magicLink.expiresAt <= completedAt) {
+      throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is expired for project '${projectId}'.`);
+    }
+    const existingUser = getUserByEmail(this.state, projectId, magicLink.email);
+    const activeInvitation = getActiveInvitationByEmail(this.state, projectId, magicLink.email, completedAt);
+    const shouldCreateUser = !existingUser;
+    const manualGroupIds = normalizeGroupIds(input.manualGroupIds);
+    if (existingUser?.status === "suspended") {
+      consumeMagicLinkRecord(this.state, {
+        projectId,
+        id: input.magicLinkId,
+        tokenHash: input.tokenHash,
+        consumedAt: completedAt
+      });
+      throw new AuthStorageError("suspended_user", `[Sixb] User '${existingUser.id}' is suspended for project '${projectId}'.`);
+    }
+    if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
+      consumeMagicLinkRecord(this.state, {
+        projectId,
+        id: input.magicLinkId,
+        tokenHash: input.tokenHash,
+        consumedAt: completedAt
+      });
+      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+    }
+    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
+      consumeMagicLinkRecord(this.state, {
+        projectId,
+        id: input.magicLinkId,
+        tokenHash: input.tokenHash,
+        consumedAt: completedAt
+      });
+      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+    }
+    validateCompleteSessionInput(this.state, projectId, input.session);
+    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
+    let newUserId;
+    if (shouldCreateUser) {
+      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      if (this.state.users.has(userKey(projectId, newUserId))) {
+        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+      }
+    }
+    consumeMagicLinkRecord(this.state, {
+      projectId,
+      id: input.magicLinkId,
+      tokenHash: input.tokenHash,
+      consumedAt: completedAt
+    });
+    let user = existingUser;
+    if (!user) {
+      user = {
+        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        projectId,
+        email: magicLink.email,
+        displayName: input.newUserDisplayName,
+        avatarUrl: input.newUserAvatarUrl,
+        status: "active",
+        createdAt: completedAt,
+        updatedAt: completedAt
+      };
+      this.state.users.set(userKey(projectId, user.id), cloneRecord(user));
+    }
+    const invitation = this.acceptInvitationAndApplyGroups({
+      activeInvitation,
+      completedAt,
+      projectId,
+      user
+    });
+    const memberships = this.applyManualGroups({
+      completedAt,
+      groupIds: manualGroupIds,
+      projectId,
+      userId: user.id,
+      existing: invitation.memberships
+    });
+    const session = this.createSignInSession({
+      projectId,
+      strategyId: magicLink.strategyId,
+      session: input.session,
+      userId: user.id
+    });
+    return {
+      user: cloneRecord(user),
+      session: cloneRecord(session),
+      invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
+      groupMemberships: memberships.map(cloneRecord)
+    };
+  }
+  async completeOidcSignIn(input) {
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const completedAt = cloneDate(input.completedAt);
+    const attempt = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(projectId, input.oidcAuthorizationAttemptId));
+    if (!attempt) {
+      throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' not found for project '${projectId}'.`);
+    }
+    if (attempt.stateHash !== input.stateHash || attempt.consumedAt) {
+      throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is not valid for project '${projectId}'.`);
+    }
+    if (attempt.expiresAt <= completedAt) {
+      throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
+    }
+    const subject = assertNonEmpty2(input.subject, "Subject");
+    const email = normalizeEmail(input.email);
+    const claims = normalizeClaims(input.claims);
+    const identity = this.state.identities.get(identityKey(projectId, attempt.strategyId, subject));
+    const activeInvitation = identity ? null : getActiveInvitationByEmail(this.state, projectId, email, completedAt);
+    let user = identity ? this.state.users.get(userKey(projectId, identity.userId)) ?? null : getUserByEmail(this.state, projectId, email);
+    const shouldCreateUser = !identity && !user;
+    const manualGroupIds = normalizeGroupIds(input.manualGroupIds);
+    if (identity && !user) {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
+    }
+    if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
+    }
+    if (user?.status === "suspended") {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
+    }
+    if (shouldCreateUser && !input.emailVerified) {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+    }
+    if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+    }
+    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
+      this.consumeOidcAttempt(input, completedAt, projectId);
+      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+    }
+    validateCompleteSessionInput(this.state, projectId, input.session);
+    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
+    let newUserId;
+    if (shouldCreateUser) {
+      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      if (this.state.users.has(userKey(projectId, newUserId))) {
+        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+      }
+    }
+    this.consumeOidcAttempt(input, completedAt, projectId);
+    if (!user) {
+      user = {
+        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        projectId,
+        email,
+        displayName: input.displayName,
+        avatarUrl: input.avatarUrl,
+        status: "active",
+        createdAt: completedAt,
+        updatedAt: completedAt
+      };
+      this.state.users.set(userKey(projectId, user.id), cloneRecord(user));
+    }
+    const invitation = this.acceptInvitationAndApplyGroups({
+      activeInvitation,
+      completedAt,
+      projectId,
+      user
+    });
+    const memberships = this.applyManualGroups({
+      completedAt,
+      groupIds: manualGroupIds,
+      projectId,
+      userId: user.id,
+      existing: invitation.memberships
+    });
+    const nextIdentity = {
+      projectId,
+      strategyId: attempt.strategyId,
+      subject,
+      userId: user.id,
+      claims,
+      createdAt: identity?.createdAt ?? completedAt,
+      updatedAt: completedAt
+    };
+    this.state.identities.set(identityKey(projectId, attempt.strategyId, subject), cloneRecord(nextIdentity));
+    const session = this.createSignInSession({
+      projectId,
+      strategyId: attempt.strategyId,
+      session: input.session,
+      userId: user.id
+    });
+    return {
+      user: cloneRecord(user),
+      session: cloneRecord(session),
+      identity: cloneRecord(nextIdentity),
+      invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
+      groupMemberships: memberships.map(cloneRecord)
+    };
+  }
+  async suspendUserAndRevokeSessions(input) {
+    const key = userKey(input.projectId, input.userId);
+    const existing = this.state.users.get(key);
+    if (!existing) {
+      throw new AuthStorageError("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
+    }
+    const next = {
+      ...existing,
+      status: "suspended",
+      updatedAt: cloneDate(input.suspendedAt)
+    };
+    this.state.users.set(key, cloneRecord(next));
+    revokeActiveSessionsForUser(this.state, input.projectId, input.userId, input.suspendedAt);
+    return cloneRecord(next);
+  }
+  acceptInvitationAndApplyGroups(input) {
+    if (!input.activeInvitation) {
+      return { memberships: [] };
+    }
+    const invitation = {
+      ...input.activeInvitation,
+      status: "accepted",
+      acceptedAt: input.completedAt,
+      updatedAt: input.completedAt
+    };
+    this.state.invitations.set(invitationKey(input.projectId, invitation.id), cloneRecord(invitation));
+    const memberships = input.activeInvitation.groupIds.map((groupId) => upsertGroupMembershipRecord(this.state, {
+      projectId: input.projectId,
+      userId: input.user.id,
+      groupId,
+      source: "invitation",
+      createdAt: input.completedAt
+    }));
+    return { invitation, memberships };
+  }
+  applyManualGroups(input) {
+    const memberships = [...input.existing];
+    for (const groupId of input.groupIds) {
+      memberships.push(upsertGroupMembershipRecord(this.state, {
+        projectId: input.projectId,
+        userId: input.userId,
+        groupId,
+        source: "manual",
+        createdAt: input.completedAt
+      }));
+    }
+    return memberships;
+  }
+  createSignInSession(input) {
+    return createSessionRecord(this.state, {
+      id: input.session.id,
+      projectId: input.projectId,
+      userId: input.userId,
+      strategyId: input.strategyId,
+      audience: input.session.audience,
+      tokenHash: input.session.tokenHash,
+      createdAt: input.session.createdAt,
+      expiresAt: input.session.expiresAt,
+      absoluteExpiresAt: input.session.absoluteExpiresAt,
+      userAgent: input.session.userAgent,
+      ipAddress: input.session.ipAddress
+    });
+  }
+  consumeOidcAttempt(input, completedAt, projectId) {
+    consumeOidcAttemptRecord(this.state, {
+      projectId,
+      id: input.oidcAuthorizationAttemptId,
+      stateHash: input.stateHash,
+      consumedAt: completedAt
+    });
+  }
+}
+function restoreMap(target, snapshot) {
+  target.clear();
+  for (const [key, value] of structuredClone(snapshot)) {
+    target.set(key, value);
+  }
+}
+function hasActiveUsers(state, projectId) {
+  for (const user of state.users.values()) {
+    if (user.projectId === projectId && user.status === "active") {
+      return true;
+    }
+  }
+  return false;
+}
+function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
+  if (sessionAudience === storedAudience) {
+    return;
+  }
+  throw new AuthStorageError("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+}
+// src/auth/session-cache.ts
+class SessionCache {
+  ttlMs;
+  maxEntries;
+  entries = new Map;
+  constructor(ttlMs, maxEntries = 4096) {
+    this.ttlMs = ttlMs;
+    this.maxEntries = maxEntries;
+  }
+  get(input) {
+    const entry = this.entries.get(input.sessionId);
+    if (!entry) {
+      return;
+    }
+    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.audience !== input.audience) {
+      this.entries.delete(input.sessionId);
+      return;
+    }
+    return entry.session;
+  }
+  set(input) {
+    const expiresAtMs = Math.min(input.nowMs + this.ttlMs, input.sessionExpiresAtMs, input.sessionAbsoluteExpiresAtMs ?? Number.POSITIVE_INFINITY);
+    if (expiresAtMs <= input.nowMs) {
+      return;
+    }
+    this.entries.delete(input.sessionId);
+    this.entries.set(input.sessionId, {
+      tokenHash: input.tokenHash,
+      audience: input.audience,
+      session: input.session,
+      expiresAtMs
+    });
+    if (this.entries.size > this.maxEntries) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest !== undefined) {
+        this.entries.delete(oldest);
+      }
+    }
+  }
+  invalidate(sessionId) {
+    this.entries.delete(sessionId);
+  }
+  invalidateUser(userId) {
+    for (const [sessionId, entry] of this.entries) {
+      if (entry.session.user.id === userId) {
+        this.entries.delete(sessionId);
+      }
+    }
+  }
+  clear() {
+    this.entries.clear();
+  }
+}
+
+// src/auth/sessions.ts
+import { createHash as createHash2, randomBytes as randomBytes3, randomUUID as randomUUID2 } from "crypto";
+function generateSessionSecret() {
+  return randomBytes3(32).toString("base64url");
+}
+function hashSessionSecret(secret) {
+  return createHash2("sha256").update(secret).digest("hex");
+}
+function formatSessionCookieValue(sessionId, sessionSecret) {
+  if (!sessionId || !sessionSecret || sessionId.includes(".") || sessionSecret.includes(".")) {
+    throw new Error("[Sixb] Session cookie values must be non-empty and must not contain '.'.");
+  }
+  return `${sessionId}.${sessionSecret}`;
+}
+function parseSessionCookieValue(value) {
+  if (!value) {
+    return null;
+  }
+  const firstDot = value.indexOf(".");
+  if (firstDot <= 0 || firstDot !== value.lastIndexOf(".") || firstDot === value.length - 1) {
+    return null;
+  }
+  return {
+    sessionId: value.slice(0, firstDot),
+    sessionSecret: value.slice(firstDot + 1)
+  };
+}
+function createSessionCredential(sessionId = `ses_${randomUUID2()}`) {
+  const sessionSecret = generateSessionSecret();
+  return {
+    sessionId,
+    sessionSecret,
+    tokenHash: hashSessionSecret(sessionSecret),
+    cookieValue: formatSessionCookieValue(sessionId, sessionSecret)
+  };
+}
+
+// src/auth/runtime.ts
+var SESSION_TOUCH_INTERVAL_MS = 60000;
+var ACCESS_TOKEN_TOUCH_INTERVAL_MS = 60000;
+
+class AuthRuntime {
+  projectId;
+  storage;
+  security;
+  config;
+  sessionCache;
+  constructor(options) {
+    this.projectId = options.projectId;
+    this.storage = options.storage;
+    this.security = options.security;
+    this.config = resolveAuthConfig(options.config);
+    this.sessionCache = this.config.session.cacheTtlMs > 0 ? new SessionCache(this.config.session.cacheTtlMs) : null;
+    if (this.isEnabled() && !this.storage.auth) {
+      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+    }
+  }
+  isEnabled() {
+    const strategy = this.config.strategy;
+    return strategy !== null && strategy.kind !== "disabled" && strategy.disabled !== true;
+  }
+  getStrategy() {
+    return this.config.strategy;
+  }
+  createSessionDeadlines(now) {
+    const absoluteTimeoutMs = this.config.session.absoluteTimeoutMs;
+    return {
+      expiresAt: new Date(now.getTime() + this.config.session.idleTimeoutMs),
+      ...absoluteTimeoutMs === undefined ? {} : { absoluteExpiresAt: new Date(now.getTime() + absoluteTimeoutMs) }
+    };
+  }
+  getCookieOptions(options = {}) {
+    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience);
+  }
+  assertCanServeHttp(params) {
+    const strategy = this.config.strategy;
+    if (!strategy) {
+      if (params.production) {
+        throw new AuthRuntimeError("production_auth_required", "[SixbServer] Auth is required in production. Configure auth or use an explicit disabled auth strategy.");
+      }
+      return;
+    }
+    if (params.production && strategy.developmentOnly) {
+      throw new AuthRuntimeError("production_auth_required", `[SixbServer] Auth strategy '${strategy.id}' is development-only and cannot be used in production.`);
+    }
+    if (params.production && (strategy.kind === "disabled" || strategy.disabled === true) && strategy.allowDisabledInProduction !== true) {
+      throw new AuthRuntimeError("production_auth_required", "[SixbServer] Disabled auth in production requires allowDisabledInProduction: true.");
+    }
+  }
+  async getSession(request, options = {}) {
+    if (!this.isEnabled()) {
+      return { authenticated: false, reason: "auth_disabled" };
+    }
+    const audience = resolveAuthSessionAudience(options.audience);
+    const credentialSource = options.credentialSource ?? "session";
+    if (credentialSource !== "session") {
+      const authorizationHeader = request.headers.get("authorization");
+      const tokenValue = getBearerAccessTokenValue(request);
+      if (tokenValue) {
+        return this.resolveAccessTokenSession(request, tokenValue);
+      }
+      if (authorizationHeader) {
+        return { authenticated: false, reason: "invalid_access_token" };
+      }
+      if (credentialSource === "accessToken") {
+        return { authenticated: false, reason: "missing_access_token" };
+      }
+    }
+    return this.resolveCookieSession(request, audience, options.sessionActivity);
+  }
+  async resolveCookieSession(request, audience, activity) {
+    const cookieOptions = this.getCookieOptions({ audience });
+    const cookieValue = getCookie(request, cookieOptions.sessionCookieName);
+    if (!cookieValue) {
+      return { authenticated: false, reason: "missing_cookie" };
+    }
+    const parts = parseSessionCookieValue(cookieValue);
+    if (!parts) {
+      return { authenticated: false, reason: "invalid_cookie" };
+    }
+    const tokenHash = hashSessionSecret(parts.sessionSecret);
+    const nowMs = Date.now();
+    const cached = this.sessionCache?.get({
+      sessionId: parts.sessionId,
+      tokenHash,
+      audience,
+      nowMs
+    });
+    if (cached) {
+      if (activity !== "foreground" || !this.canRenewSession(cached.session, nowMs)) {
+        return cached;
+      }
+      this.sessionCache?.invalidate(parts.sessionId);
+    }
+    const storage = this.requireAuthStorage();
+    const now = new Date(nowMs);
+    let session = await storage.sessions.findValidByTokenHash({
+      projectId: this.projectId,
+      id: parts.sessionId,
+      audience,
+      tokenHash,
+      now
+    });
+    if (!session) {
+      return { authenticated: false, reason: "invalid_session" };
+    }
+    let sessionRenewed = false;
+    if (activity === "foreground" && this.canRenewSession(session, nowMs)) {
+      const renewed = await storage.sessions.renewIfValid({
+        projectId: this.projectId,
+        id: parts.sessionId,
+        audience,
+        tokenHash,
+        now,
+        expiresAt: this.getRenewedSessionExpiresAt(session, nowMs)
+      });
+      if (!renewed) {
+        this.sessionCache?.invalidate(parts.sessionId);
+        return { authenticated: false, reason: "invalid_session" };
+      }
+      session = renewed;
+      sessionRenewed = true;
+    }
+    const user = await storage.users.getById({
+      projectId: this.projectId,
+      id: session.userId
+    });
+    if (!user) {
+      return { authenticated: false, reason: "missing_user" };
+    }
+    if (user.status === "suspended") {
+      return { authenticated: false, reason: "suspended_user" };
+    }
+    const memberships = await storage.groupMemberships.listForUser({
+      projectId: this.projectId,
+      userId: user.id
+    });
+    if (!sessionRenewed) {
+      await this.touchSessionLastSeen(storage, session, now);
+    }
+    const result = {
+      authenticated: true,
+      credentialSource: "session",
+      principal: { type: "user", id: user.id },
+      user,
+      session,
+      groupIds: memberships.map((membership) => membership.groupId)
+    };
+    this.sessionCache?.set({
+      sessionId: parts.sessionId,
+      tokenHash,
+      audience,
+      session: result,
+      nowMs,
+      sessionExpiresAtMs: session.expiresAt.getTime(),
+      sessionAbsoluteExpiresAtMs: session.absoluteExpiresAt?.getTime()
+    });
+    return sessionRenewed ? { ...result, sessionRenewed: true } : result;
+  }
+  canRenewSession(session, nowMs) {
+    if (session.expiresAt.getTime() - nowMs > this.config.session.renewalWindowMs) {
+      return false;
+    }
+    return this.getRenewedSessionExpiresAt(session, nowMs).getTime() > session.expiresAt.getTime();
+  }
+  getRenewedSessionExpiresAt(session, nowMs) {
+    const idleExpiresAtMs = nowMs + this.config.session.idleTimeoutMs;
+    return new Date(session.absoluteExpiresAt ? Math.min(idleExpiresAtMs, session.absoluteExpiresAt.getTime()) : idleExpiresAtMs);
+  }
+  async resolveAccessTokenSession(request, tokenValue) {
+    const parts = parseAccessTokenValue(tokenValue);
+    if (!parts) {
+      return { authenticated: false, reason: "invalid_access_token" };
+    }
+    const storage = this.requireAuthStorage();
+    const now = new Date;
+    const accessToken = await storage.accessTokens.findValidByTokenHash({
+      projectId: this.projectId,
+      id: parts.tokenId,
+      kind: parts.kind,
+      tokenHash: hashAccessTokenSecret(parts.tokenSecret),
+      now
+    });
+    if (!accessToken) {
+      return { authenticated: false, reason: "invalid_access_token" };
+    }
+    await this.touchAccessTokenLastUsed(storage, accessToken, request, now);
+    if (accessToken.subjectType === "user") {
+      const user = await storage.users.getById({
+        projectId: this.projectId,
+        id: accessToken.subjectId
+      });
+      if (!user) {
+        return { authenticated: false, reason: "missing_user" };
+      }
+      if (user.status === "suspended") {
+        return { authenticated: false, reason: "suspended_user" };
+      }
+      const memberships2 = await storage.groupMemberships.listForUser({
+        projectId: this.projectId,
+        userId: user.id
+      });
+      return {
+        authenticated: true,
+        credentialSource: "accessToken",
+        principal: { type: "user", id: user.id },
+        user,
+        accessToken,
+        groupIds: constrainTokenGroupIds(memberships2.map((membership) => membership.groupId), accessToken)
+      };
+    }
+    const serviceAccount = await storage.serviceAccounts.getById({
+      projectId: this.projectId,
+      id: accessToken.subjectId
+    });
+    if (!serviceAccount) {
+      return { authenticated: false, reason: "missing_service_account" };
+    }
+    if (serviceAccount.status === "suspended") {
+      return { authenticated: false, reason: "suspended_service_account" };
+    }
+    const memberships = await storage.serviceAccountGroupMemberships.listForServiceAccount({
+      projectId: this.projectId,
+      serviceAccountId: serviceAccount.id
+    });
+    return {
+      authenticated: true,
+      credentialSource: "accessToken",
+      principal: { type: "serviceAccount", id: serviceAccount.id },
+      serviceAccount,
+      accessToken,
+      groupIds: constrainTokenGroupIds(memberships.map((membership) => membership.groupId), accessToken)
+    };
+  }
+  invalidateSession(sessionId) {
+    this.sessionCache?.invalidate(sessionId);
+  }
+  async touchSessionLastSeen(storage, session, now) {
+    const lastSeen = session.lastSeenAt?.getTime() ?? 0;
+    if (now.getTime() - lastSeen < SESSION_TOUCH_INTERVAL_MS) {
+      return;
+    }
+    try {
+      await storage.sessions.touch({ projectId: this.projectId, id: session.id, lastSeenAt: now });
+    } catch {}
+  }
+  async touchAccessTokenLastUsed(storage, accessToken, request, now) {
+    const lastUsed = accessToken.lastUsedAt?.getTime() ?? 0;
+    if (now.getTime() - lastUsed < ACCESS_TOKEN_TOUCH_INTERVAL_MS) {
+      return;
+    }
+    try {
+      await storage.accessTokens.touch({
+        projectId: this.projectId,
+        id: accessToken.id,
+        lastUsedAt: now,
+        userAgent: request.headers.get("user-agent")?.trim() || undefined,
+        ipAddress: resolveRequestIpAddress(request)
+      });
+    } catch {}
+  }
+  async requirePrincipal(request, options = {}) {
+    const session = await this.getSession(request, options);
+    if (!session.authenticated) {
+      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+    }
+    return session.principal;
+  }
+  async requireUser(request, options = {}) {
+    const session = await this.getSession(request, { ...options, credentialSource: "session" });
+    if (!session.authenticated) {
+      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+    }
+    return session;
+  }
+  async requireUserRequest(request, options = {}) {
+    const session = await this.getSession(request, { ...options, credentialSource: "any" });
+    if (!session.authenticated) {
+      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+    }
+    if (!isAuthenticatedUserRequestSession(session)) {
+      throw new AuthRuntimeError("authorization_denied", "[Sixb] User authentication is required.");
+    }
+    return session;
+  }
+  async createSecurityContext(request, options = {}) {
+    const session = await this.requireUser(request, options);
+    return {
+      principal: session.principal,
+      sessionId: session.session.id,
+      projectId: this.projectId,
+      correlationId: resolveCorrelationId(request)
+    };
+  }
+  async createAuthorizationContext(request, options = {}) {
+    const session = await this.getSession(request, options);
+    if (!session.authenticated) {
+      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+    }
+    return this.contextFromSession(session);
+  }
+  contextFromSession(session) {
+    return resolveAuthorizationContext({
+      principal: session.principal,
+      sessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      groupIds: session.groupIds,
+      roles: this.security.listResolvedRoles()
+    });
+  }
+  async listPersonalAccessTokens(request, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const result = await storage.accessTokens.list({
+      projectId: this.projectId,
+      kind: "personal",
+      subjectType: "user",
+      subjectId: session.user.id,
+      includeRevoked: true,
+      order: "desc",
+      limit: 100
+    });
+    return { accessTokens: result.accessTokens };
+  }
+  async createPersonalAccessToken(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
+      subject: "personal access token"
+    });
+    const credential = createAccessTokenCredential("personal");
+    const accessToken = await storage.accessTokens.create({
+      id: credential.tokenId,
+      projectId: this.projectId,
+      name: input.name,
+      kind: "personal",
+      subjectType: "user",
+      subjectId: session.user.id,
+      tokenHash: credential.tokenHash,
+      groupIds,
+      createdByPrincipal: session.principal,
+      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdAt: new Date,
+      expiresAt: input.expiresAt
+    });
+    return { accessToken, tokenValue: credential.tokenValue };
+  }
+  async revokePersonalAccessToken(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const token = await storage.accessTokens.getById({
+      projectId: this.projectId,
+      id: input.tokenId
+    });
+    if (!token || token.kind !== "personal" || token.subjectType !== "user" || token.subjectId !== session.user.id) {
+      throw missingAccessTokenError(input.tokenId, this.projectId);
+    }
+    const accessToken = await storage.accessTokens.revoke({
+      projectId: this.projectId,
+      id: input.tokenId,
+      revokedAt: new Date
+    });
+    return { accessToken };
+  }
+  async listServiceAccounts(request, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const result = await storage.serviceAccounts.list({
+      projectId: this.projectId,
+      order: "desc",
+      limit: 100
+    });
+    const withGroups = await Promise.all(result.serviceAccounts.map(async (serviceAccount) => ({
+      serviceAccount,
+      groupIds: await this.listServiceAccountGroupIds(storage, serviceAccount.id)
+    })));
+    return {
+      serviceAccounts: withGroups.filter(({ groupIds }) => callerCanManageServiceAccount(session.groupIds, groupIds))
+    };
+  }
+  async createServiceAccount(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
+      subject: "service account"
+    }) ?? [];
+    const now = new Date;
+    const serviceAccount = await storage.serviceAccounts.create({
+      id: input.id ?? `svc_${randomUUID3()}`,
+      projectId: this.projectId,
+      name: input.name,
+      description: input.description,
+      createdByPrincipal: session.principal,
+      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdAt: now,
+      updatedAt: now
+    });
+    const groupMemberships = [];
+    for (const groupId of groupIds) {
+      groupMemberships.push(await storage.serviceAccountGroupMemberships.upsert({
+        projectId: this.projectId,
+        serviceAccountId: serviceAccount.id,
+        groupId,
+        source: "manual",
+        createdAt: now
+      }));
+    }
+    return { serviceAccount, groupMemberships };
+  }
+  async disableServiceAccount(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const { serviceAccount, groupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const updated = await storage.serviceAccounts.update({
+      projectId: this.projectId,
+      id: serviceAccount.id,
+      status: "suspended",
+      updatedAt: new Date
+    });
+    return { serviceAccount: updated, groupIds };
+  }
+  async listServiceAccountAccessTokens(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const { serviceAccount } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const result = await storage.accessTokens.list({
+      projectId: this.projectId,
+      kind: "serviceAccount",
+      subjectType: "serviceAccount",
+      subjectId: serviceAccount.id,
+      includeRevoked: true,
+      order: "desc",
+      limit: 100
+    });
+    return { serviceAccount, accessTokens: result.accessTokens };
+  }
+  async createServiceAccountAccessToken(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    if (serviceAccount.status === "suspended") {
+      throw new AuthStorageError("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
+    }
+    const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
+      subject: "service account token"
+    });
+    const credential = createAccessTokenCredential("serviceAccount");
+    const accessToken = await storage.accessTokens.create({
+      id: credential.tokenId,
+      projectId: this.projectId,
+      name: input.name,
+      kind: "serviceAccount",
+      subjectType: "serviceAccount",
+      subjectId: serviceAccount.id,
+      tokenHash: credential.tokenHash,
+      groupIds,
+      createdByPrincipal: session.principal,
+      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdAt: new Date,
+      expiresAt: input.expiresAt
+    });
+    return { accessToken, tokenValue: credential.tokenValue, serviceAccount };
+  }
+  async revokeServiceAccountAccessToken(request, input, options = {}) {
+    const session = await this.requireUserRequest(request, options);
+    const storage = this.requireAuthStorage();
+    const { serviceAccount } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const token = await storage.accessTokens.getById({
+      projectId: this.projectId,
+      id: input.tokenId
+    });
+    if (!token || token.kind !== "serviceAccount" || token.subjectType !== "serviceAccount" || token.subjectId !== serviceAccount.id) {
+      throw missingAccessTokenError(input.tokenId, this.projectId);
+    }
+    const accessToken = await storage.accessTokens.revoke({
+      projectId: this.projectId,
+      id: input.tokenId,
+      revokedAt: new Date
+    });
+    return { serviceAccount, accessToken };
+  }
+  async requireManageableServiceAccount(storage, callerGroupIds, serviceAccountId) {
+    const serviceAccount = await storage.serviceAccounts.getById({
+      projectId: this.projectId,
+      id: serviceAccountId
+    });
+    const groupIds = serviceAccount ? await this.listServiceAccountGroupIds(storage, serviceAccountId) : [];
+    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
+    }
+    return { serviceAccount, groupIds };
+  }
+  async listServiceAccountGroupIds(storage, serviceAccountId) {
+    const memberships = await storage.serviceAccountGroupMemberships.listForServiceAccount({
+      projectId: this.projectId,
+      serviceAccountId
+    });
+    return memberships.map((membership) => membership.groupId);
+  }
+  async getInvitationOptions(request, options = {}) {
+    const session = await this.requireUser(request, options);
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const inviteScope = scope.operations.invite;
+    const groups = this.scopedGroupOptions(inviteScope.groupIds);
+    const hasInviteMembershipPolicy = inviteScope.policyIds.length > 0;
+    return {
+      groups,
+      canInviteWithoutGroups: hasInviteMembershipPolicy,
+      capabilities: {
+        createInvitation: this.resolveCreateInvitationCapability({
+          canInvite: hasInviteMembershipPolicy
+        })
+      }
+    };
+  }
+  getMembershipCapabilities(input) {
+    return membershipCapabilities(this.resolveMembershipPolicyScopeForUser(groupIdsOf(input.callerGroups)));
+  }
+  async getMembershipOptions(request, options = {}) {
+    const session = await this.requireUser(request, options);
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    return {
+      groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      capabilities: membershipCapabilities(scope).holds
+    };
+  }
+  async listMembers(request, input = {}, options = {}) {
+    const session = await this.requireUser(request, options);
+    const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const { limit, offset } = normalizePagination(input);
+    const result = await storage.users.list({ projectId: this.projectId, order: input.order });
+    const members = [];
+    for (const user of result.users) {
+      const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
+      const canAssignGroups = canPerformMembershipOperation(scope, "assignGroups", groupIds);
+      const canSuspendScope = canPerformMembershipOperation(scope, "suspend", groupIds);
+      if (!canAssignGroups && !canSuspendScope) {
+        continue;
+      }
+      const isSelf = user.id === session.user.id;
+      members.push({
+        user,
+        groupIds,
+        capabilities: {
+          assignGroups: canAssignGroups,
+          suspend: canSuspendScope && !isSelf && user.status === "active",
+          reactivate: canSuspendScope && user.status === "suspended"
+        }
+      });
+    }
+    const page = paginate(members, { limit, offset });
+    return { members: page.page, hasMore: page.hasMore, total: page.total };
+  }
+  async updateMemberGroups(request, input, options = {}) {
+    const session = await this.requireUser(request, options);
+    const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const userId = assertNonEmpty(input.userId, "User id");
+    const { user, groupIds: currentGroupIds } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
+    const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds);
+    const missing = missingMembershipGroupIds(scope, "assignGroups", requestedGroupIds);
+    if (missing.length > 0) {
+      throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to assign group(s): ${missing.join(", ")}.`);
+    }
+    const current = new Set(currentGroupIds);
+    const requested = new Set(requestedGroupIds);
+    const additions = requestedGroupIds.filter((groupId) => !current.has(groupId));
+    const removals = currentGroupIds.filter((groupId) => !requested.has(groupId));
+    if (user.id === session.user.id && removals.length > 0) {
+      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
+    }
+    const now = new Date;
+    for (const groupId of additions) {
+      await storage.groupMemberships.upsert({
+        projectId: this.projectId,
+        userId: user.id,
+        groupId,
+        source: "manual",
+        createdAt: now
+      });
+    }
+    for (const groupId of removals) {
+      await storage.groupMemberships.remove({
+        projectId: this.projectId,
+        userId: user.id,
+        groupId
+      });
+    }
+    this.invalidateUserSessions(user.id);
+    const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
+    return { user, groupIds };
+  }
+  async suspendMember(request, input, options = {}) {
+    const session = await this.requireUser(request, options);
+    const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const userId = assertNonEmpty(input.userId, "User id");
+    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    if (user.id === session.user.id) {
+      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
+    }
+    const suspended = await storage.suspendUserAndRevokeSessions({
+      projectId: this.projectId,
+      userId: user.id,
+      suspendedAt: new Date
+    });
+    this.invalidateUserSessions(user.id);
+    return { user: suspended, groupIds };
+  }
+  async reactivateMember(request, input, options = {}) {
+    const session = await this.requireUser(request, options);
+    const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const userId = assertNonEmpty(input.userId, "User id");
+    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    const reactivated = await storage.users.updateStatus({
+      projectId: this.projectId,
+      id: user.id,
+      status: "active",
+      updatedAt: new Date
+    });
+    return { user: reactivated, groupIds };
+  }
+  invalidateUserSessions(userId) {
+    this.sessionCache?.invalidateUser(userId);
+  }
+  scopedGroupOptions(groupIds) {
+    return this.security.listGroups().filter((group) => groupIds.has(group.id)).map((group) => ({
+      id: group.id,
+      ...group.label !== undefined ? { label: group.label } : {},
+      ...group.description !== undefined ? { description: group.description } : {}
+    }));
+  }
+  async requireManageableMember(storage, scope, operation, userId) {
+    const user = await storage.users.getById({ projectId: this.projectId, id: userId });
+    const groupIds = user ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map((membership) => membership.groupId) : [];
+    if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
+      throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
+    }
+    return { user, groupIds };
+  }
+  resolveMemberGroupIds(input) {
+    const groupIds = [...new Set(input.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    for (const groupId of groupIds) {
+      if (!this.security.getGroupById(groupId)) {
+        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      }
+    }
+    return groupIds;
+  }
+  async invite(request, input, options = {}) {
+    const session = await this.requireUser(request, options);
+    const authStorage = this.requireAuthStorage();
+    const now = new Date;
+    const groupIds = this.resolveInviteGroupIds(input);
+    this.assertCanManageInvitationGroups(session.groupIds, groupIds);
+    const strategy = this.getStrategy();
+    if (!isInvitationDeliveryAuthStrategy(strategy)) {
+      throw new AuthRuntimeError("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
+    }
+    await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
+    const deliveryAudience = resolveAuthSessionAudience(options.delivery?.audience ?? options.audience);
+    this.assertInvitationApplicationAccess(groupIds, deliveryAudience);
+    const invitation = await authStorage.invitations.createOrUpdateActive({
+      id: `inv_${randomUUID3()}`,
+      projectId: this.projectId,
+      email: input.email,
+      groupIds,
+      createdByPrincipal: session.principal,
+      createdBySessionId: session.session.id,
+      createdAt: now,
+      updatedAt: now,
+      expiresAt: resolveInvitationExpiresAt(input.expiresAt, now)
+    });
+    let delivery;
+    try {
+      delivery = await strategy.deliverInvitation({
+        projectId: this.projectId,
+        authStorage,
+        invitation,
+        audience: deliveryAudience,
+        returnTo: options.delivery?.returnTo ?? sanitizeReturnTo(input.returnTo),
+        requestOrigin: options.delivery?.requestOrigin ?? new URL(request.url).origin,
+        now
+      });
+    } catch (error) {
+      await this.revokeInvitationAfterDeliveryFailure(authStorage, invitation, now);
+      throw error;
+    }
+    if (delivery.status === "not_supported") {
+      return { invitation, delivery };
+    }
+    if (delivery.status !== "sent") {
+      await this.revokeInvitationAfterDeliveryFailure(authStorage, invitation, now);
+      throw this.createInvitationDeliveryError(delivery.status);
+    }
+    return { invitation, delivery };
+  }
+  async listInvitations(request, input = {}, options = {}) {
+    const session = await this.requireUser(request, options);
+    const authStorage = this.requireAuthStorage();
+    const { limit, offset } = normalizePagination(input);
+    const result = await authStorage.invitations.list({
+      projectId: this.projectId,
+      email: input.email,
+      statuses: input.statuses,
+      order: input.order
+    });
+    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const manageable = result.invitations.filter((invitation) => canPerformMembershipOperation(scope, "invite", invitation.groupIds));
+    const page = paginate(manageable, { limit, offset });
+    return {
+      invitations: page.page,
+      hasMore: page.hasMore,
+      total: page.total
+    };
+  }
+  async revokeInvitation(request, input, options = {}) {
+    const session = await this.requireUser(request, options);
+    const authStorage = this.requireAuthStorage();
+    const invitationId = assertNonEmpty(input.invitationId, "Invitation id");
+    const invitation = await authStorage.invitations.getById({
+      projectId: this.projectId,
+      id: invitationId
+    });
+    if (!invitation) {
+      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
+    }
+    this.assertCanManageInvitationGroups(session.groupIds, invitation.groupIds);
+    if (invitation.status !== "pending") {
+      throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
+    }
+    return {
+      invitation: await authStorage.invitations.revoke({
+        projectId: this.projectId,
+        id: invitation.id,
+        revokedAt: new Date
+      })
+    };
+  }
+  requireAuthStorage() {
+    if (!this.storage.auth) {
+      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+    }
+    return this.storage.auth;
+  }
+  resolveInviteGroupIds(input) {
+    if (input.groups && input.groupIds) {
+      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation input cannot provide both groups and groupIds.");
+    }
+    const rawGroupIds = input.groupIds ?? input.groups?.map((group) => assertNonEmpty(group.id, "Group id")) ?? [];
+    const groupIds = [...new Set(rawGroupIds.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    for (const groupId of groupIds) {
+      if (!this.security.getGroupById(groupId)) {
+        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown invitation group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      }
+    }
+    return groupIds;
+  }
+  resolveMembershipPolicyScopeForUser(callerGroupIds) {
+    return resolveMembershipPolicyScope({
+      membershipPolicies: this.security.listMembershipPolicies(),
+      callerGroupIds
+    });
+  }
+  resolveCreateInvitationCapability(input) {
+    if (!isInvitationDeliveryAuthStrategy(this.getStrategy())) {
+      return { state: "disabled", reason: "invitation_delivery_not_supported" };
+    }
+    if (!input.canInvite) {
+      return { state: "disabled", reason: "missing_membership_policy" };
+    }
+    return { state: "enabled" };
+  }
+  assertInvitationApplicationAccess(groupIds, audience) {
+    const roles = this.security.listResolvedRoles();
+    const authorization = resolveAuthorizationContext({
+      principal: { type: "user", id: "invited-user" },
+      groupIds,
+      roles
+    });
+    if (canAccessApplication(authorization, roles, audience))
+      return;
+    throw new AuthRuntimeError("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
+  }
+  async assertCanInviteRecipient(strategy, authStorage, email, now) {
+    if (!strategy.validateInvitationRecipient) {
+      return;
+    }
+    const result = await strategy.validateInvitationRecipient({
+      projectId: this.projectId,
+      authStorage,
+      email,
+      now
+    });
+    if (result.status === "allowed") {
+      return;
+    }
+    throw createInvitationRecipientError(result.status, result.email ?? email);
+  }
+  async revokeInvitationAfterDeliveryFailure(authStorage, invitation, failedAt) {
+    await authStorage.invitations.revoke({
+      projectId: this.projectId,
+      id: invitation.id,
+      revokedAt: failedAt
+    });
+  }
+  createInvitationDeliveryError(status) {
+    if (status === "rate_limited") {
+      return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+    }
+    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
+  }
+  assertCanManageInvitationGroups(callerGroupIds, groupIds) {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
+    if (canPerformMembershipOperation(scope, "invite", groupIds)) {
+      return;
+    }
+    if (groupIds.length === 0) {
+      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user is not allowed to create or manage invitations without groups.");
+    }
+    const missing = missingMembershipGroupIds(scope, "invite", groupIds);
+    throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
+  }
+}
+function resolveCorrelationId(request) {
+  return request.headers.get("x-correlation-id") ?? request.headers.get("x-request-id") ?? randomUUID3();
+}
+function isAuthenticatedUserRequestSession(session) {
+  return session.principal.type === "user";
+}
+function resolveRequestIpAddress(request) {
+  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip")?.trim() || undefined;
+}
+function constrainTokenGroupIds(principalGroupIds, accessToken) {
+  if (accessToken.groupIds === undefined) {
+    return principalGroupIds;
+  }
+  const allowed = new Set(accessToken.groupIds);
+  return principalGroupIds.filter((groupId) => allowed.has(groupId));
+}
+function callerCanManageServiceAccount(callerGroupIds, serviceAccountGroupIds) {
+  const callerGroups = new Set(callerGroupIds);
+  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId));
+}
+function missingAccessTokenError(tokenId, projectId) {
+  return new AuthStorageError("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
+}
+function constrainRequestedGroupIds(input, allowedGroupIds, options) {
+  const groupIds = normalizeRequestedGroupIds(input);
+  if (!groupIds) {
+    return;
+  }
+  const allowed = new Set(allowedGroupIds);
+  for (const groupId of groupIds) {
+    if (!allowed.has(groupId)) {
+      throw new AuthRuntimeError("authorization_denied", `[Sixb] Group '${groupId}' cannot be assigned to this ${options.subject}.`);
+    }
+  }
+  return groupIds;
+}
+function normalizeRequestedGroupIds(input) {
+  if (input === undefined) {
+    return null;
+  }
+  const groupIds = [];
+  for (const raw of input) {
+    const groupId = raw.trim();
+    if (!groupId) {
+      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Group ids cannot be empty when creating auth credentials.");
+    }
+    if (!groupIds.includes(groupId)) {
+      groupIds.push(groupId);
+    }
+  }
+  return groupIds;
+}
+function createInvitationRecipientError(status, email) {
+  if (status === "rate_limited") {
+    return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+  }
+  if (status === "invalid_email") {
+    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation email is invalid.");
+  }
+  if (status === "disallowed_domain") {
+    return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' is not allowed by the active auth strategy.`);
+  }
+  return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' belongs to a suspended user.`);
+}
+function membershipCapabilities(scope) {
+  return {
+    holds: {
+      invite: scope.operations.invite.policyIds.length > 0,
+      assignGroups: scope.operations.assignGroups.policyIds.length > 0,
+      suspend: scope.operations.suspend.policyIds.length > 0
+    },
+    assignableGroupIds: [...scope.operations.assignGroups.groupIds],
+    covers: (operation, memberGroups) => canPerformMembershipOperation(scope, operation, groupIdsOf(memberGroups))
+  };
+}
+function groupIdsOf(groups) {
+  return groups.map((group) => typeof group === "string" ? group : group.id);
+}
+// src/auth/types.ts
+var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
+function principalsEqual(left, right) {
+  return left.type === right.type && left.id === right.id;
+}
+export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, APPLICATION_IDS, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup, defineRole, defineMembershipPolicy, every, can, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+
+//# debugId=76194AFCF3E3EC0564756E2164756E21