@sixb/core 0.1.12 → 0.1.14

package/dist/{chunk-2cxv584m.js → chunk-6rzb1g6h.js}

@@ -5,23 +5,23 @@ import {
   canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-bbaa1fet.js";
+} from "./chunk-rzcjp5m2.js";
 import {
   AuthRuntimeError2,
+  DEFAULT_AUTH_SESSION_AUDIENCE2,
   resolveAuthSessionAudience2,
   resolveAuthCookieOptionsForAudience,
   getCookie2,
   resolveAuthConfig2,
   resolveInvitationExpiresAt,
-  sanitizeReturnTo,
   assertNonEmpty3,
   normalizePagination,
   isInvitationDeliveryAuthStrategy2
-} from "./chunk-q5gz3g2j.js";
+} from "./chunk-2jntasmh.js";
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-y3ev53cq.js";
+} from "./chunk-2fv8sajb.js";
 import {
   snapshotLinkPathSelection
 } from "./chunk-t6f3tdnr.js";
@@ -109,6 +109,14 @@ function accessTokenKindFromLabel(label) {
   }
   return null;
 }
+// src/auth/client-address.ts
+var clientAddresses = new WeakMap;
+function setRequestClientAddress2(request, address) {
+  clientAddresses.set(request, address);
+}
+function getRequestClientAddress2(request) {
+  return clientAddresses.get(request);
+}
 // src/auth/csrf.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var CSRF_HEADER_NAME2 = "x-sixb-csrf";
@@ -123,12 +131,17 @@ function verifyDoubleSubmitCsrf2(request, options) {
   if (isCsrfExemptMethod2(request.method)) {
     return true;
   }
+  return verifyCsrfToken2(request, {
+    cookieName: options.cookieName,
+    token: request.headers.get(CSRF_HEADER_NAME2)
+  });
+}
+function verifyCsrfToken2(request, options) {
   const cookieValue = getCookie2(request, options.cookieName);
-  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME2);
-  if (!cookieValue || !headerValue) {
+  if (!cookieValue || !options.token) {
     return false;
   }
-  return safeEqual(cookieValue, headerValue);
+  return safeEqual(cookieValue, options.token);
 }
 function safeEqual(left, right) {
   const leftBytes = Buffer.from(left);
@@ -1366,7 +1379,12 @@ function createSessionRecord(state, input) {
     expiresAt: cloneDate(input.expiresAt),
     absoluteExpiresAt: input.absoluteExpiresAt ? cloneDate(input.absoluteExpiresAt) : undefined,
     userAgent: input.userAgent,
-    ipAddress: input.ipAddress
+    ipAddress: input.ipAddress,
+    bearer: input.bearer ? {
+      clientName: assertNonEmpty4(input.bearer.clientName, "Session client name"),
+      accessExpiresAt: cloneDate(input.bearer.accessExpiresAt),
+      refreshTokenHash: assertNonEmpty4(input.bearer.refreshTokenHash, "Refresh token hash")
+    } : undefined
   };
   state.sessions.set(sessionKey(projectId, id), cloneRecord(session));
   return session;
@@ -1420,10 +1438,10 @@ function createAccessTokenRecord(state, input) {
   const id = assertNonEmpty4(input.id, "Access token id");
   const projectId = assertNonEmpty4(input.projectId, "Project id");
   const name = assertNonEmpty4(input.name, "Access token name");
-  const subjectId = assertNonEmpty4(input.subjectId, "Access token subject id");
+  const subjectId = assertNonEmpty4(input.subject.id, "Access token subject id");
   const tokenHash = assertNonEmpty4(input.tokenHash, "Access token hash");
-  assertAccessTokenSubject(input.kind, input.subjectType);
-  assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
+  assertAccessTokenSubject(input.kind, input.subject.type);
+  assertAccessTokenSubjectExists(state, projectId, input.subject.type, subjectId);
   const key = accessTokenKey(projectId, id);
   if (state.accessTokens.has(key)) {
     throw new AuthStorageError2("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
@@ -1433,8 +1451,7 @@ function createAccessTokenRecord(state, input) {
     projectId,
     name,
     kind: input.kind,
-    subjectType: input.subjectType,
-    subjectId,
+    subject: { type: input.subject.type, id: subjectId },
     tokenHash,
     groupIds: normalizeOptionalGroupIds(input.groupIds),
     createdByPrincipal: input.createdByPrincipal,
@@ -1556,7 +1573,7 @@ class InMemoryAuthAccessTokenStore {
   async list(input) {
     const order = input.order ?? "asc";
     const offset = input.offset ?? 0;
-    const rows = [...this.state.accessTokens.values()].filter((token) => token.projectId === input.projectId).filter((token) => input.kind === undefined || token.kind === input.kind).filter((token) => input.subjectType === undefined || token.subjectType === input.subjectType).filter((token) => input.subjectId === undefined || token.subjectId === input.subjectId).filter((token) => input.includeRevoked || !token.revokedAt).sort((a, b) => compareByCreatedAt(a, b, order));
+    const rows = [...this.state.accessTokens.values()].filter((token) => token.projectId === input.projectId).filter((token) => input.kind === undefined || token.kind === input.kind).filter((token) => input.subject === undefined || token.subject.type === input.subject.type && token.subject.id === input.subject.id).filter((token) => input.includeRevoked || !token.revokedAt).sort((a, b) => compareByCreatedAt(a, b, order));
     const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit);
     return {
       accessTokens: page.map(cloneRecord),
@@ -1632,8 +1649,6 @@ class InMemoryAuthDeviceAuthorizationStore {
       deviceCodeHash: assertNonEmpty4(input.deviceCodeHash, "Device code hash"),
       userCode: assertNonEmpty4(input.userCode, "User code"),
       clientName: assertNonEmpty4(input.clientName, "Client name"),
-      tokenName: assertNonEmpty4(input.tokenName, "Token name"),
-      tokenExpiresAt: new Date(input.tokenExpiresAt),
       status: "pending",
       createdAt: new Date(input.createdAt),
       expiresAt: new Date(input.expiresAt)
@@ -2080,15 +2095,54 @@ class InMemoryAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
-    if (!session || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     return cloneRecord(session);
   }
+  async findValidByAccessTokenHash(params) {
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
+    if (!session?.bearer || session.tokenHash !== params.tokenHash || session.bearer.accessExpiresAt <= params.now || !isActiveSession(session, params.now)) {
+      return null;
+    }
+    return cloneRecord(session);
+  }
+  async rotateRefreshToken(params) {
+    const key = sessionKey(params.projectId, params.id);
+    const session = this.state.sessions.get(key);
+    if (!session?.bearer || !isActiveSession(session, params.now)) {
+      return { status: "invalid" };
+    }
+    const { bearer } = session;
+    const replacedRecently = bearer.previousRefreshTokenHash === params.refreshTokenHash && bearer.refreshedAt !== undefined && params.now.getTime() - bearer.refreshedAt.getTime() <= params.reuseGraceMs;
+    if (bearer.refreshTokenHash !== params.refreshTokenHash && !replacedRecently) {
+      if (bearer.previousRefreshTokenHash !== params.refreshTokenHash) {
+        return { status: "invalid" };
+      }
+      this.state.sessions.set(key, cloneRecord({ ...session, revokedAt: cloneDate(params.now) }));
+      return { status: "reused" };
+    }
+    const requestedExpiresAt = session.absoluteExpiresAt ? new Date(Math.min(params.next.expiresAt.getTime(), session.absoluteExpiresAt.getTime())) : params.next.expiresAt;
+    const next = {
+      ...session,
+      tokenHash: params.next.tokenHash,
+      expiresAt: new Date(Math.max(session.expiresAt.getTime(), requestedExpiresAt.getTime())),
+      lastSeenAt: cloneDate(params.now),
+      bearer: {
+        clientName: bearer.clientName,
+        accessExpiresAt: cloneDate(params.next.accessExpiresAt),
+        refreshTokenHash: params.next.refreshTokenHash,
+        previousRefreshTokenHash: bearer.refreshTokenHash,
+        refreshedAt: cloneDate(params.now)
+      }
+    };
+    this.state.sessions.set(key, cloneRecord(next));
+    return { status: "rotated", session: cloneRecord(next) };
+  }
   async renewIfValid(params) {
     const key = sessionKey(params.projectId, params.id);
     const session = this.state.sessions.get(key);
-    if (!session || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     const requestedExpiresAt = session.absoluteExpiresAt ? new Date(Math.min(params.expiresAt.getTime(), session.absoluteExpiresAt.getTime())) : params.expiresAt;
@@ -2274,17 +2328,17 @@ class InMemoryAuthStorage2 {
     if (authorization.status !== "approved" || !authorization.approvedUserId || !authorization.approvedSessionId || authorization.expiresAt <= input.completedAt) {
       throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
     }
-    if (input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
-      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device access token is invalid.");
+    if (input.session.projectId !== input.projectId || input.session.userId !== authorization.approvedUserId) {
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device session is invalid.");
     }
-    const accessToken = createAccessTokenRecord(this.state, input.accessToken);
+    const session = createSessionRecord(this.state, input.session);
     const consumed = {
       ...authorization,
       status: "consumed",
       consumedAt: new Date(input.completedAt)
     };
     this.state.deviceAuthorizations.set(key, cloneRecord(consumed));
-    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) };
+    return { authorization: cloneRecord(consumed), session: cloneRecord(session) };
   }
   async completeMagicLinkSignIn(input) {
     const projectId = assertNonEmpty4(input.projectId, "Project id");
@@ -2321,15 +2375,6 @@ class InMemoryAuthStorage2 {
       });
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
-      consumeMagicLinkRecord(this.state, {
-        projectId,
-        id: input.magicLinkId,
-        tokenHash: input.tokenHash,
-        consumedAt: completedAt
-      });
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
-    }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
@@ -2365,8 +2410,9 @@ class InMemoryAuthStorage2 {
       projectId,
       user
     });
-    const memberships = this.applyManualGroups({
+    const memberships = this.applyGroups({
       completedAt,
+      source: "manual",
       groupIds: manualGroupIds,
       projectId,
       userId: user.id,
@@ -2410,26 +2456,14 @@ class InMemoryAuthStorage2 {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
     }
-    if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
-    }
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !input.emailVerified) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
-    }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
-    }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
@@ -2459,12 +2493,19 @@ class InMemoryAuthStorage2 {
       projectId,
       user
     });
-    const memberships = this.applyManualGroups({
+    const memberships = this.syncDirectoryGroups({
       completedAt,
-      groupIds: manualGroupIds,
+      groupIds: input.directoryGroupIds,
       projectId,
       userId: user.id,
-      existing: invitation.memberships
+      existing: this.applyGroups({
+        completedAt,
+        source: "manual",
+        groupIds: manualGroupIds,
+        projectId,
+        userId: user.id,
+        existing: invitation.memberships
+      })
     });
     const nextIdentity = {
       projectId,
@@ -2525,19 +2566,30 @@ class InMemoryAuthStorage2 {
     }));
     return { invitation, memberships };
   }
-  applyManualGroups(input) {
+  applyGroups(input) {
     const memberships = [...input.existing];
     for (const groupId of input.groupIds) {
       memberships.push(upsertGroupMembershipRecord(this.state, {
         projectId: input.projectId,
         userId: input.userId,
         groupId,
-        source: "manual",
+        source: input.source,
         createdAt: input.completedAt
       }));
     }
     return memberships;
   }
+  syncDirectoryGroups(input) {
+    if (!input.groupIds) {
+      return input.existing;
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    const stale = [...this.state.groupMemberships.values()].filter((membership) => membership.projectId === input.projectId && membership.userId === input.userId && membership.source === "directory" && !groupIds.includes(membership.groupId));
+    for (const membership of stale) {
+      removeGroupMembershipRecord(this.state, membership);
+    }
+    return this.applyGroups({ ...input, groupIds, source: "directory" });
+  }
   createSignInSession(input) {
     return createSessionRecord(this.state, {
       id: input.session.id,
@@ -2568,14 +2620,6 @@ function restoreMap(target, snapshot) {
     target.set(key, value);
   }
 }
-function hasActiveUsers(state, projectId) {
-  for (const user of state.users.values()) {
-    if (user.projectId === projectId && user.status === "active") {
-      return true;
-    }
-  }
-  return false;
-}
 function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
   if (sessionAudience === storedAudience) {
     return;
@@ -2596,20 +2640,22 @@ class SessionCache {
     if (!entry) {
       return;
     }
-    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.audience !== input.audience) {
+    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.transport !== input.transport || input.audience !== undefined && entry.audience !== input.audience) {
       this.entries.delete(input.sessionId);
       return;
     }
     return entry.session;
   }
   set(input) {
-    const expiresAtMs = Math.min(input.nowMs + this.ttlMs, input.sessionExpiresAtMs, input.sessionAbsoluteExpiresAtMs ?? Number.POSITIVE_INFINITY);
+    const bearer = input.session.session.bearer;
+    const expiresAtMs = Math.min(input.nowMs + this.ttlMs, input.sessionExpiresAtMs, input.sessionAbsoluteExpiresAtMs ?? Number.POSITIVE_INFINITY, bearer?.accessExpiresAt.getTime() ?? Number.POSITIVE_INFINITY);
     if (expiresAtMs <= input.nowMs) {
       return;
     }
     this.entries.delete(input.sessionId);
     this.entries.set(input.sessionId, {
       tokenHash: input.tokenHash,
+      transport: bearer ? "bearer" : "cookie",
       audience: input.audience,
       session: input.session,
       expiresAtMs
@@ -2672,10 +2718,27 @@ function createSessionCredential2(sessionId = `ses_${randomUUID2()}`) {
     cookieValue: formatSessionCookieValue2(sessionId, sessionSecret)
   };
 }
+var SESSION_ACCESS_TOKEN_PREFIX = "sixb_at_";
+var SESSION_REFRESH_TOKEN_PREFIX = "sixb_rt_";
+function createBearerSessionTokens(sessionId) {
+  const accessSecret = generateSessionSecret2();
+  const refreshSecret = generateSessionSecret2();
+  return {
+    accessToken: `${SESSION_ACCESS_TOKEN_PREFIX}${formatSessionCookieValue2(sessionId, accessSecret)}`,
+    refreshToken: `${SESSION_REFRESH_TOKEN_PREFIX}${formatSessionCookieValue2(sessionId, refreshSecret)}`,
+    tokenHash: hashSessionSecret2(accessSecret),
+    refreshTokenHash: hashSessionSecret2(refreshSecret)
+  };
+}
+function parseBearerSessionToken(prefix, value) {
+  return value.startsWith(prefix) ? parseSessionCookieValue2(value.slice(prefix.length)) : null;
+}
 
 // src/auth/runtime.ts
 var SESSION_TOUCH_INTERVAL_MS = 60000;
 var ACCESS_TOKEN_TOUCH_INTERVAL_MS = 60000;
+var BEARER_ACCESS_TOKEN_TTL_MS = 15 * 60000;
+var REFRESH_REUSE_GRACE_MS = 60000;
 
 class AuthRuntime2 {
   projectId;
@@ -2730,19 +2793,17 @@ class AuthRuntime2 {
       return { authenticated: false, reason: "auth_disabled" };
     }
     const audience = resolveAuthSessionAudience2(options.audience);
-    const credentialSource = options.credentialSource ?? "session";
-    if (credentialSource !== "session") {
-      const authorizationHeader = request.headers.get("authorization");
+    if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue2(request);
+      if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
+        return this.resolveBearerSession(tokenValue);
+      }
       if (tokenValue) {
         return this.resolveAccessTokenSession(request, tokenValue);
       }
-      if (authorizationHeader) {
+      if (request.headers.get("authorization")) {
         return { authenticated: false, reason: "invalid_access_token" };
       }
-      if (credentialSource === "accessToken") {
-        return { authenticated: false, reason: "missing_access_token" };
-      }
     }
     return this.resolveCookieSession(request, audience, options.sessionActivity);
   }
@@ -2761,6 +2822,7 @@ class AuthRuntime2 {
     const cached = this.sessionCache?.get({
       sessionId: parts.sessionId,
       tokenHash,
+      transport: "cookie",
       audience,
       nowMs
     });
@@ -2799,41 +2861,109 @@ class AuthRuntime2 {
       session = renewed;
       sessionRenewed = true;
     }
-    const user = await storage.users.getById({
-      projectId: this.projectId,
-      id: session.userId
-    });
-    if (!user) {
-      return { authenticated: false, reason: "missing_user" };
+    if (!sessionRenewed) {
+      await this.touchSessionLastSeen(storage, session, now);
     }
-    if (user.status === "suspended") {
-      return { authenticated: false, reason: "suspended_user" };
+    const result = await this.authenticateSession(storage, session, tokenHash, now);
+    return result.authenticated && sessionRenewed ? { ...result, sessionRenewed: true } : result;
+  }
+  async resolveBearerSession(tokenValue) {
+    const parts = parseBearerSessionToken(SESSION_ACCESS_TOKEN_PREFIX, tokenValue);
+    if (!parts) {
+      return { authenticated: false, reason: "invalid_access_token" };
     }
-    const memberships = await storage.groupMemberships.listForUser({
+    const tokenHash = hashSessionSecret2(parts.sessionSecret);
+    const now = new Date;
+    const cached = this.sessionCache?.get({
+      sessionId: parts.sessionId,
+      tokenHash,
+      transport: "bearer",
+      nowMs: now.getTime()
+    });
+    if (cached) {
+      return cached;
+    }
+    const storage = this.requireAuthStorage();
+    const session = await storage.sessions.findValidByAccessTokenHash({
       projectId: this.projectId,
-      userId: user.id
+      id: parts.sessionId,
+      tokenHash,
+      now
     });
-    if (!sessionRenewed) {
-      await this.touchSessionLastSeen(storage, session, now);
+    if (!session) {
+      return { authenticated: false, reason: "invalid_access_token" };
+    }
+    await this.touchSessionLastSeen(storage, session, now);
+    return this.authenticateSession(storage, session, tokenHash, now);
+  }
+  async authenticateSession(storage, session, tokenHash, now) {
+    const member = await this.loadActiveUser(storage, session.userId);
+    if (!member.authenticated) {
+      return member;
     }
     const result = {
       authenticated: true,
       credentialSource: "session",
-      principal: { type: "user", id: user.id },
-      user,
+      principal: { type: "user", id: member.user.id },
+      user: member.user,
       session,
-      groupIds: memberships.map((membership) => membership.groupId)
+      groupIds: member.groupIds
     };
     this.sessionCache?.set({
-      sessionId: parts.sessionId,
+      sessionId: session.id,
       tokenHash,
-      audience,
+      audience: session.audience,
       session: result,
-      nowMs,
+      nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
       sessionAbsoluteExpiresAtMs: session.absoluteExpiresAt?.getTime()
     });
-    return sessionRenewed ? { ...result, sessionRenewed: true } : result;
+    return result;
+  }
+  prepareBearerSession(input) {
+    const sessionId = `ses_${randomUUID3()}`;
+    const tokens = createBearerSessionTokens(sessionId);
+    return {
+      tokens,
+      session: {
+        id: sessionId,
+        projectId: this.projectId,
+        userId: input.userId,
+        strategyId: "device",
+        audience: DEFAULT_AUTH_SESSION_AUDIENCE2,
+        tokenHash: tokens.tokenHash,
+        createdAt: input.now,
+        ...this.createSessionDeadlines(input.now),
+        bearer: {
+          clientName: input.clientName,
+          accessExpiresAt: new Date(input.now.getTime() + BEARER_ACCESS_TOKEN_TTL_MS),
+          refreshTokenHash: tokens.refreshTokenHash
+        }
+      }
+    };
+  }
+  async refreshSession(refreshToken) {
+    const parts = parseBearerSessionToken(SESSION_REFRESH_TOKEN_PREFIX, refreshToken);
+    if (!parts || !this.isEnabled()) {
+      return null;
+    }
+    const now = new Date;
+    const tokens = createBearerSessionTokens(parts.sessionId);
+    const result = await this.requireAuthStorage().sessions.rotateRefreshToken({
+      projectId: this.projectId,
+      id: parts.sessionId,
+      refreshTokenHash: hashSessionSecret2(parts.sessionSecret),
+      now,
+      reuseGraceMs: REFRESH_REUSE_GRACE_MS,
+      next: {
+        tokenHash: tokens.tokenHash,
+        accessExpiresAt: new Date(now.getTime() + BEARER_ACCESS_TOKEN_TTL_MS),
+        refreshTokenHash: tokens.refreshTokenHash,
+        expiresAt: new Date(now.getTime() + this.config.session.idleTimeoutMs)
+      }
+    });
+    this.sessionCache?.invalidate(parts.sessionId);
+    return result.status === "rotated" ? { tokens, session: result.session } : null;
   }
   canRenewSession(session, nowMs) {
     if (session.expiresAt.getTime() - nowMs > this.config.session.renewalWindowMs) {
@@ -2863,33 +2993,23 @@ class AuthRuntime2 {
       return { authenticated: false, reason: "invalid_access_token" };
     }
     await this.touchAccessTokenLastUsed(storage, accessToken, request, now);
-    if (accessToken.subjectType === "user") {
-      const user = await storage.users.getById({
-        projectId: this.projectId,
-        id: accessToken.subjectId
-      });
-      if (!user) {
-        return { authenticated: false, reason: "missing_user" };
-      }
-      if (user.status === "suspended") {
-        return { authenticated: false, reason: "suspended_user" };
+    if (accessToken.subject.type === "user") {
+      const member = await this.loadActiveUser(storage, accessToken.subject.id);
+      if (!member.authenticated) {
+        return member;
       }
-      const memberships = await storage.groupMemberships.listForUser({
-        projectId: this.projectId,
-        userId: user.id
-      });
       return {
         authenticated: true,
         credentialSource: "accessToken",
-        principal: { type: "user", id: user.id },
-        user,
+        principal: { type: "user", id: member.user.id },
+        user: member.user,
         accessToken,
-        groupIds: constrainTokenGroupIds(memberships.map((membership) => membership.groupId), accessToken)
+        groupIds: constrainTokenGroupIds(member.groupIds, accessToken)
       };
     }
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
-      id: accessToken.subjectId
+      id: accessToken.subject.id
     });
     if (!serviceAccount) {
       return { authenticated: false, reason: "missing_service_account" };
@@ -2910,8 +3030,23 @@ class AuthRuntime2 {
       groupIds: constrainTokenGroupIds(memberships.map((membership) => membership.groupId), accessToken)
     };
   }
-  invalidateSession(sessionId) {
-    this.sessionCache?.invalidate(sessionId);
+  async loadActiveUser(storage, userId) {
+    const user = await storage.users.getById({ projectId: this.projectId, id: userId });
+    if (!user) {
+      return { authenticated: false, reason: "missing_user" };
+    }
+    if (user.status === "suspended") {
+      return { authenticated: false, reason: "suspended_user" };
+    }
+    const memberships = await storage.groupMemberships.listForUser({
+      projectId: this.projectId,
+      userId
+    });
+    return {
+      authenticated: true,
+      user,
+      groupIds: memberships.map((membership) => membership.groupId)
+    };
   }
   async touchSessionLastSeen(storage, session, now) {
     const lastSeen = session.lastSeenAt?.getTime() ?? 0;
@@ -2933,76 +3068,33 @@ class AuthRuntime2 {
         id: accessToken.id,
         lastUsedAt: now,
         userAgent: request.headers.get("user-agent")?.trim() || undefined,
-        ipAddress: resolveRequestIpAddress(request)
+        ipAddress: getRequestClientAddress2(request)
       });
     } catch {}
   }
-  async requirePrincipal(request, options = {}) {
-    const session = await this.getSession(request, options);
-    if (!session.authenticated) {
-      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
-    }
-    return session.principal;
-  }
-  async requireUser(request, options = {}) {
-    const session = await this.getSession(request, { ...options, credentialSource: "session" });
-    if (!session.authenticated) {
-      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
-    }
-    return session;
-  }
-  async requireUserRequest(request, options = {}) {
-    const session = await this.getSession(request, { ...options, credentialSource: "any" });
-    if (!session.authenticated) {
-      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
-    }
-    if (!isAuthenticatedUserRequestSession(session)) {
-      throw new AuthRuntimeError2("authorization_denied", "[Sixb] User authentication is required.");
-    }
-    return session;
-  }
-  async createSecurityContext(request, options = {}) {
-    const session = await this.requireUser(request, options);
-    return {
-      principal: session.principal,
-      sessionId: session.session.id,
-      projectId: this.projectId,
-      correlationId: resolveCorrelationId(request)
-    };
-  }
-  async createAuthorizationContext(request, options = {}) {
-    const session = await this.getSession(request, options);
-    if (!session.authenticated) {
-      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
-    }
-    return this.contextFromSession(session);
-  }
   contextFromSession(session) {
     return resolveAuthorizationContext2({
       principal: session.principal,
-      sessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      sessionId: callerSessionId(session),
       groupIds: session.groupIds,
       roles: this.security.listResolvedRoles()
     });
   }
-  async listPersonalAccessTokens(request, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async listPersonalAccessTokens(caller) {
     const storage = this.requireAuthStorage();
     const result = await storage.accessTokens.list({
       projectId: this.projectId,
       kind: "personal",
-      subjectType: "user",
-      subjectId: session.user.id,
+      subject: { type: "user", id: caller.user.id },
       includeRevoked: true,
       order: "desc",
       limit: 100
     });
     return { accessTokens: result.accessTokens };
   }
-  async createPersonalAccessToken(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async createPersonalAccessToken(caller, input) {
     const storage = this.requireAuthStorage();
-    const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
+    const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
       subject: "personal access token"
     });
     const credential = createAccessTokenCredential2("personal");
@@ -3011,25 +3103,23 @@ class AuthRuntime2 {
       projectId: this.projectId,
       name: input.name,
       kind: "personal",
-      subjectType: "user",
-      subjectId: session.user.id,
+      subject: { type: "user", id: caller.user.id },
       tokenHash: credential.tokenHash,
       groupIds,
-      createdByPrincipal: session.principal,
-      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdByPrincipal: caller.principal,
+      createdBySessionId: callerSessionId(caller),
       createdAt: new Date,
       expiresAt: input.expiresAt
     });
     return { accessToken, tokenValue: credential.tokenValue };
   }
-  async revokePersonalAccessToken(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async revokePersonalAccessToken(caller, input) {
     const storage = this.requireAuthStorage();
     const token = await storage.accessTokens.getById({
       projectId: this.projectId,
       id: input.tokenId
     });
-    if (!token || token.kind !== "personal" || token.subjectType !== "user" || token.subjectId !== session.user.id) {
+    if (!token || token.kind !== "personal" || token.subject.type !== "user" || token.subject.id !== caller.user.id) {
       throw missingAccessTokenError(input.tokenId, this.projectId);
     }
     const accessToken = await storage.accessTokens.revoke({
@@ -3039,8 +3129,7 @@ class AuthRuntime2 {
     });
     return { accessToken };
   }
-  async listServiceAccounts(request, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async listServiceAccounts(caller) {
     const storage = this.requireAuthStorage();
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
@@ -3052,13 +3141,12 @@ class AuthRuntime2 {
       groupIds: await this.listServiceAccountGroupIds(storage, serviceAccount.id)
     })));
     return {
-      serviceAccounts: withGroups.filter(({ groupIds }) => callerCanManageServiceAccount(session.groupIds, groupIds))
+      serviceAccounts: withGroups.filter(({ groupIds }) => callerCanManageServiceAccount(caller.groupIds, groupIds))
     };
   }
-  async createServiceAccount(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async createServiceAccount(caller, input) {
     const storage = this.requireAuthStorage();
-    const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
+    const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
       subject: "service account"
     }) ?? [];
     const now = new Date;
@@ -3067,8 +3155,8 @@ class AuthRuntime2 {
       projectId: this.projectId,
       name: input.name,
       description: input.description,
-      createdByPrincipal: session.principal,
-      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdByPrincipal: caller.principal,
+      createdBySessionId: callerSessionId(caller),
       createdAt: now,
       updatedAt: now
     });
@@ -3084,10 +3172,9 @@ class AuthRuntime2 {
     }
     return { serviceAccount, groupMemberships };
   }
-  async disableServiceAccount(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async disableServiceAccount(caller, input) {
     const storage = this.requireAuthStorage();
-    const { serviceAccount, groupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const { serviceAccount, groupIds } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     const updated = await storage.serviceAccounts.update({
       projectId: this.projectId,
       id: serviceAccount.id,
@@ -3096,25 +3183,22 @@ class AuthRuntime2 {
     });
     return { serviceAccount: updated, groupIds };
   }
-  async listServiceAccountAccessTokens(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async listServiceAccountAccessTokens(caller, input) {
     const storage = this.requireAuthStorage();
-    const { serviceAccount } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const { serviceAccount } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     const result = await storage.accessTokens.list({
       projectId: this.projectId,
       kind: "serviceAccount",
-      subjectType: "serviceAccount",
-      subjectId: serviceAccount.id,
+      subject: { type: "serviceAccount", id: serviceAccount.id },
       includeRevoked: true,
       order: "desc",
       limit: 100
     });
     return { serviceAccount, accessTokens: result.accessTokens };
   }
-  async createServiceAccountAccessToken(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async createServiceAccountAccessToken(caller, input) {
     const storage = this.requireAuthStorage();
-    const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     if (serviceAccount.status === "suspended") {
       throw new AuthStorageError2("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
     }
@@ -3127,26 +3211,24 @@ class AuthRuntime2 {
       projectId: this.projectId,
       name: input.name,
       kind: "serviceAccount",
-      subjectType: "serviceAccount",
-      subjectId: serviceAccount.id,
+      subject: { type: "serviceAccount", id: serviceAccount.id },
       tokenHash: credential.tokenHash,
       groupIds,
-      createdByPrincipal: session.principal,
-      createdBySessionId: session.credentialSource === "session" ? session.session.id : undefined,
+      createdByPrincipal: caller.principal,
+      createdBySessionId: callerSessionId(caller),
       createdAt: new Date,
       expiresAt: input.expiresAt
     });
     return { accessToken, tokenValue: credential.tokenValue, serviceAccount };
   }
-  async revokeServiceAccountAccessToken(request, input, options = {}) {
-    const session = await this.requireUserRequest(request, options);
+  async revokeServiceAccountAccessToken(caller, input) {
     const storage = this.requireAuthStorage();
-    const { serviceAccount } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
+    const { serviceAccount } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     const token = await storage.accessTokens.getById({
       projectId: this.projectId,
       id: input.tokenId
     });
-    if (!token || token.kind !== "serviceAccount" || token.subjectType !== "serviceAccount" || token.subjectId !== serviceAccount.id) {
+    if (!token || token.kind !== "serviceAccount" || token.subject.type !== "serviceAccount" || token.subject.id !== serviceAccount.id) {
       throw missingAccessTokenError(input.tokenId, this.projectId);
     }
     const accessToken = await storage.accessTokens.revoke({
@@ -3174,9 +3256,8 @@ class AuthRuntime2 {
     });
     return memberships.map((membership) => membership.groupId);
   }
-  async getInvitationOptions(request, options = {}) {
-    const session = await this.requireUser(request, options);
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+  async getInvitationOptions(caller) {
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const inviteScope = scope.operations.invite;
     const groups = this.scopedGroupOptions(inviteScope.groupIds);
     const hasInviteMembershipPolicy = inviteScope.policyIds.length > 0;
@@ -3193,32 +3274,31 @@ class AuthRuntime2 {
   getMembershipCapabilities(input) {
     return membershipCapabilities(this.resolveMembershipPolicyScopeForUser(groupIdsOf(input.callerGroups)));
   }
-  async getMembershipOptions(request, options = {}) {
-    const session = await this.requireUser(request, options);
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+  async getMembershipOptions(caller) {
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     return {
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
       capabilities: membershipCapabilities(scope).holds
     };
   }
-  async listMembers(request, input = {}, options = {}) {
-    const session = await this.requireUser(request, options);
+  async listMembers(caller, input = {}) {
     const storage = this.requireAuthStorage();
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const { limit, offset } = normalizePagination(input);
     const result = await storage.users.list({ projectId: this.projectId, order: input.order });
     const members = [];
     for (const user of result.users) {
-      const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
+      const { groupIds, managedGroupIds } = memberGroups(await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id }));
       const canAssignGroups = canPerformMembershipOperation(scope, "assignGroups", groupIds);
       const canSuspendScope = canPerformMembershipOperation(scope, "suspend", groupIds);
       if (!canAssignGroups && !canSuspendScope) {
         continue;
       }
-      const isSelf = user.id === session.user.id;
+      const isSelf = user.id === caller.user.id;
       members.push({
         user,
         groupIds,
+        managedGroupIds,
         capabilities: {
           assignGroups: canAssignGroups,
           suspend: canSuspendScope && !isSelf && user.status === "active",
@@ -3229,12 +3309,15 @@ class AuthRuntime2 {
     const page = paginate(members, { limit, offset });
     return { members: page.page, hasMore: page.hasMore, total: page.total };
   }
-  async updateMemberGroups(request, input, options = {}) {
-    const session = await this.requireUser(request, options);
+  async updateMemberGroups(caller, input) {
     const storage = this.requireAuthStorage();
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds: currentGroupIds } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
+    const {
+      user,
+      groupIds: currentGroupIds,
+      managedGroupIds: currentManagedGroupIds
+    } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds);
     const missing = missingMembershipGroupIds(scope, "assignGroups", requestedGroupIds);
     if (missing.length > 0) {
@@ -3244,7 +3327,11 @@ class AuthRuntime2 {
     const requested = new Set(requestedGroupIds);
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId));
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId));
-    if (user.id === session.user.id && removals.length > 0) {
+    const managedRemovals = removals.filter((groupId) => currentManagedGroupIds.includes(groupId));
+    if (managedRemovals.length > 0) {
+      throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Group(s) ${managedRemovals.join(", ")} are managed by the identity provider. Change them there; they sync at the user's next sign-in.`);
+    }
+    if (user.id === caller.user.id && removals.length > 0) {
       throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
     }
     const now = new Date;
@@ -3264,17 +3351,16 @@ class AuthRuntime2 {
         groupId
       });
     }
-    this.invalidateUserSessions(user.id);
-    const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
-    return { user, groupIds };
+    this.sessionCache?.invalidateUser(user.id);
+    const { groupIds, managedGroupIds } = memberGroups(await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id }));
+    return { user, groupIds, managedGroupIds };
   }
-  async suspendMember(request, input, options = {}) {
-    const session = await this.requireUser(request, options);
+  async suspendMember(caller, input) {
     const storage = this.requireAuthStorage();
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
-    if (user.id === session.user.id) {
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    if (user.id === caller.user.id) {
       throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
     }
     const suspended = await storage.suspendUserAndRevokeSessions({
@@ -3282,25 +3368,53 @@ class AuthRuntime2 {
       userId: user.id,
       suspendedAt: new Date
     });
-    this.invalidateUserSessions(user.id);
-    return { user: suspended, groupIds };
+    this.sessionCache?.invalidateUser(user.id);
+    return { user: suspended, groupIds, managedGroupIds };
   }
-  async reactivateMember(request, input, options = {}) {
-    const session = await this.requireUser(request, options);
+  async reactivateMember(caller, input) {
     const storage = this.requireAuthStorage();
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     const reactivated = await storage.users.updateStatus({
       projectId: this.projectId,
       id: user.id,
       status: "active",
       updatedAt: new Date
     });
-    return { user: reactivated, groupIds };
+    return { user: reactivated, groupIds, managedGroupIds };
+  }
+  async listSessions(caller) {
+    return this.requireAuthStorage().sessions.listActiveByUserId({
+      projectId: this.projectId,
+      userId: caller.user.id,
+      now: new Date
+    });
+  }
+  async revokeSession(caller, sessionId) {
+    const storage = this.requireAuthStorage();
+    const session = await storage.sessions.getById({ projectId: this.projectId, id: sessionId });
+    if (!session || session.userId !== caller.user.id) {
+      return false;
+    }
+    await storage.sessions.revoke({
+      projectId: this.projectId,
+      id: sessionId,
+      revokedAt: new Date
+    });
+    this.sessionCache?.invalidate(sessionId);
+    return true;
   }
-  invalidateUserSessions(userId) {
-    this.sessionCache?.invalidateUser(userId);
+  async revokeAllSessions(caller) {
+    const revoked = await this.requireAuthStorage().sessions.revokeActiveForUser({
+      projectId: this.projectId,
+      userId: caller.user.id,
+      revokedAt: new Date
+    });
+    for (const session of revoked) {
+      this.sessionCache?.invalidate(session.id);
+    }
+    return revoked.length;
   }
   scopedGroupOptions(groupIds) {
     return this.security.listGroups().filter((group) => groupIds.has(group.id)).map((group) => ({
@@ -3311,11 +3425,11 @@ class AuthRuntime2 {
   }
   async requireManageableMember(storage, scope, operation, userId) {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId });
-    const groupIds = user ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map((membership) => membership.groupId) : [];
+    const { groupIds, managedGroupIds } = memberGroups(user ? await storage.groupMemberships.listForUser({ projectId: this.projectId, userId }) : []);
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
       throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
     }
-    return { user, groupIds };
+    return { user, groupIds, managedGroupIds };
   }
   resolveMemberGroupIds(input) {
     const groupIds = [...new Set(input.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
@@ -3326,26 +3440,24 @@ class AuthRuntime2 {
     }
     return groupIds;
   }
-  async invite(request, input, options = {}) {
-    const session = await this.requireUser(request, options);
+  async invite(caller, input, destination) {
     const authStorage = this.requireAuthStorage();
     const now = new Date;
     const groupIds = this.resolveInviteGroupIds(input);
-    this.assertCanManageInvitationGroups(session.groupIds, groupIds);
+    this.assertCanManageInvitationGroups(caller.groupIds, groupIds);
     const strategy = this.getStrategy();
     if (!isInvitationDeliveryAuthStrategy2(strategy)) {
       throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
     }
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
-    const deliveryAudience = resolveAuthSessionAudience2(options.delivery?.audience ?? options.audience);
-    this.assertInvitationApplicationAccess(groupIds, deliveryAudience);
+    this.assertInvitationApplicationAccess(groupIds, destination.audience);
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID3()}`,
       projectId: this.projectId,
       email: input.email,
       groupIds,
-      createdByPrincipal: session.principal,
-      createdBySessionId: session.session.id,
+      createdByPrincipal: caller.principal,
+      createdBySessionId: callerSessionId(caller),
       createdAt: now,
       updatedAt: now,
       expiresAt: resolveInvitationExpiresAt(input.expiresAt, now)
@@ -3356,9 +3468,9 @@ class AuthRuntime2 {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: deliveryAudience,
-        returnTo: options.delivery?.returnTo ?? sanitizeReturnTo(input.returnTo),
-        requestOrigin: options.delivery?.requestOrigin ?? new URL(request.url).origin,
+        audience: destination.audience,
+        returnTo: destination.returnTo,
+        requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
         now
       });
@@ -3379,8 +3491,7 @@ class AuthRuntime2 {
     }
     return { invitation, delivery };
   }
-  async listInvitations(request, input = {}, options = {}) {
-    const session = await this.requireUser(request, options);
+  async listInvitations(caller, input = {}) {
     const authStorage = this.requireAuthStorage();
     const { limit, offset } = normalizePagination(input);
     const result = await authStorage.invitations.list({
@@ -3389,7 +3500,7 @@ class AuthRuntime2 {
       statuses: input.statuses,
       order: input.order
     });
-    const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const manageable = result.invitations.filter((invitation) => canPerformMembershipOperation(scope, "invite", invitation.groupIds));
     const page = paginate(manageable, { limit, offset });
     return {
@@ -3398,8 +3509,7 @@ class AuthRuntime2 {
       total: page.total
     };
   }
-  async revokeInvitation(request, input, options = {}) {
-    const session = await this.requireUser(request, options);
+  async revokeInvitation(caller, input) {
     const authStorage = this.requireAuthStorage();
     const invitationId = assertNonEmpty3(input.invitationId, "Invitation id");
     const invitation = await authStorage.invitations.getById({
@@ -3409,7 +3519,7 @@ class AuthRuntime2 {
     if (!invitation) {
       throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
     }
-    this.assertCanManageInvitationGroups(session.groupIds, invitation.groupIds);
+    this.assertCanManageInvitationGroups(caller.groupIds, invitation.groupIds);
     if (invitation.status !== "pending") {
       throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
     }
@@ -3506,14 +3616,14 @@ class AuthRuntime2 {
     throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
   }
 }
-function resolveCorrelationId(request) {
-  return request.headers.get("x-correlation-id") ?? request.headers.get("x-request-id") ?? randomUUID3();
-}
-function isAuthenticatedUserRequestSession(session) {
-  return session.principal.type === "user";
+function memberGroups(memberships) {
+  return {
+    groupIds: memberships.map((membership) => membership.groupId),
+    managedGroupIds: memberships.filter((membership) => membership.source === "directory").map((membership) => membership.groupId)
+  };
 }
-function resolveRequestIpAddress(request) {
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request.headers.get("x-real-ip")?.trim() || undefined;
+function callerSessionId(caller) {
+  return caller.credentialSource === "session" ? caller.session.id : undefined;
 }
 function constrainTokenGroupIds(principalGroupIds, accessToken) {
   if (accessToken.groupIds === undefined) {
@@ -3589,6 +3699,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=103AE23BF90D263E64756E2164756E21
+//# debugId=73464FD9FDE5971364756E2164756E21