@sixb/core 0.1.12 → 0.1.14

package/src/sandboxes/sandbox.ts

@@ -16,7 +16,10 @@ export type SandboxStatus = "running" | "stopped" | "failed"
  * default set at factory.create(...).
  */
 export interface RunCommandOptions {
-  /** Overrides the sandbox-level workingDirectory for this call. */
+  /**
+   * Working directory for this call. Defaults to the sandbox's workingDirectory;
+   * relative paths resolve against it, while absolute paths override it.
+   */
   readonly cwd?: string
   /** Merged on top of sandbox-level env. Per-call wins on collision. */
   readonly env?: Readonly<Record<string, string>>

package/src/shared/params/types.ts

@@ -6,6 +6,7 @@ import type {
   SchemaOrRef,
   ValueType,
 } from "../../ontology"
+import type { RegisteredValueTypes } from "../../ontology/registered"
 import type { QuantitativeTypeId } from "../../ontology/units"
 
 type Simplify<T> = { [K in keyof T]: T[K] } & {}
@@ -57,14 +58,14 @@ type InferStructuredParamValue<
 
 type InferParamSchemaValue<
   TSchema extends SchemaOrRef,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = TSchema extends keyof ParamPrimitiveSchemaValues
   ? ParamPrimitiveSchemaValues[TSchema]
   : InferStructuredParamValue<TSchema, TValueTypes>
 
 type InferParamValue<
   TParam extends ParamConfig,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = TParam["nullable"] extends true
   ? InferParamSchemaValue<TParam["schema"], TValueTypes> | null
   : InferParamSchemaValue<TParam["schema"], TValueTypes>
@@ -72,7 +73,7 @@ type InferParamValue<
 /** Infer the validated runtime input represented by a parameter config. */
 export type InferParams<
   TParams extends ParamsConfig,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = string extends keyof TParams
   ? Record<string, unknown>
   : Simplify<

package/src/shared/params/user-refs.ts

@@ -0,0 +1,48 @@
+import type { SchemaOrRef, ValueType } from "../../ontology"
+import { isObjectRefSchema } from "../../ontology/refs"
+import { collectUserRefIds, userReferenceProblem } from "../../ontology/user-ref"
+import type { AuthStorage } from "../../storage/auth/types"
+
+/**
+ * Reject params that reference a user who does not exist or is not active.
+ *
+ * Callers run it only when a new run is created: replaying an existing run keeps the params it was
+ * accepted with, even if a referenced user was suspended since.
+ */
+export async function assertParamUsersActive(input: {
+  readonly auth: AuthStorage | undefined
+  readonly projectId: string
+  readonly schemas: Readonly<Record<string, SchemaOrRef>>
+  readonly values: Readonly<Record<string, unknown>>
+  readonly valueTypesById: ReadonlyMap<string, ValueType>
+  /** Names one param in error messages, for example `Action param 'task.assign.assignee'`. */
+  readonly describe: (paramId: string) => string
+  readonly invalid: (message: string) => Error
+}): Promise<void> {
+  const references: { readonly paramId: string; readonly id: string }[] = []
+  for (const [paramId, schema] of Object.entries(input.schemas)) {
+    if (isObjectRefSchema(schema)) continue
+    const ids = collectUserRefIds(schema, input.values[paramId], input.valueTypesById, new Set())
+    for (const id of ids) references.push({ paramId, id })
+  }
+  if (references.length === 0) return
+
+  const users = input.auth?.users
+  const statuses = new Map(
+    await Promise.all(
+      [...new Set(references.map((reference) => reference.id))].map(
+        async (id) =>
+          [
+            id,
+            users
+              ? ((await users.getById({ projectId: input.projectId, id }))?.status ?? null)
+              : "unverifiable",
+          ] as const
+      )
+    )
+  )
+  for (const { paramId, id } of references) {
+    const problem = userReferenceProblem(input.describe(paramId), id, statuses.get(id) ?? null)
+    if (problem) throw input.invalid(problem)
+  }
+}

package/src/shares/compiler.ts

@@ -1,7 +1,8 @@
 import type { ActionDefinitionCatalog } from "../actions"
 import type { LinkPathSelection, LinkPathSelectionMode, ObjectRef } from "../ontology"
+import { isPrimitiveSchema, primitiveTraits } from "../ontology/primitives"
 import type { OntologyDefinitionCatalog } from "../ontology/registry"
-import type { ObjectLink, ObjectType } from "../ontology/types"
+import type { ObjectLink, ObjectType, PrimitiveSchema } from "../ontology/types"
 import type {
   ObjectReadLinkDefinitionSelection,
   ObjectReadLinkSelection,
@@ -88,17 +89,6 @@ export function compileShareAccessPlan(input: CompileShareAccessPlanInput): Shar
   return snapshotShareAccessPlan({ grants })
 }
 
-const SHAREABLE_PRIMITIVE_SCHEMAS = new Set([
-  "string",
-  "integer",
-  "double",
-  "decimal",
-  "boolean",
-  "date",
-  "timestamp",
-  "uuid",
-])
-
 /**
  * V1 deliberately excludes references from shared Action params. A delegated caller cannot yet be
  * authorized to resolve arbitrary object or blob references supplied at invocation time.
@@ -112,9 +102,9 @@ function assertShareableActionParams(input: {
   const seenSchemas = new WeakSet<object>()
   const resolvingValueTypes = new Set<string>()
 
-  const reject = (path: string, kind: "objectRef" | "fileRef"): never => {
+  const reject = (path: string, kind: "objectRef" | PrimitiveSchema): never => {
     throw invalid(
-      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' uses ${kind}. Shared Action parameters cannot contain objectRef or fileRef in V1.`
+      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' uses ${kind}. Shared Action parameters cannot contain objectRef, fileRef, or userRef in V1.`
     )
   }
 
@@ -126,8 +116,8 @@ function assertShareableActionParams(input: {
 
   const walk = (schema: unknown, path: string): void => {
     if (typeof schema === "string") {
-      if (schema === "fileRef") reject(path, "fileRef")
-      if (!SHAREABLE_PRIMITIVE_SCHEMAS.has(schema)) malformed(path)
+      if (!isPrimitiveSchema(schema)) malformed(path)
+      else if (primitiveTraits(schema)?.shareableParam !== true) reject(path, schema)
       return
     }
     if (!isRecord(schema)) throw malformed(path)

package/src/storage/action-runs/types.ts

@@ -27,6 +27,7 @@ export const ACTION_RUN_FAILURE_CODES = [
   "runtime.cancelled",
   "queue.enqueue_failed",
   "action.phase_failed",
+  "action.read_conflict",
 ] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]
 
 export type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]

package/src/storage/auth/errors.ts

@@ -10,7 +10,6 @@ export type AuthStorageErrorCode =
   | "duplicate_service_account"
   | "duplicate_session"
   | "duplicate_user"
-  | "email_link_not_allowed"
   | "expired_magic_link"
   | "expired_oidc_attempt"
   | "invalid_input"

package/src/storage/auth/in-memory/access-tokens.ts

@@ -38,8 +38,11 @@ export class InMemoryAuthAccessTokenStore implements AuthAccessTokenStore {
     const rows = [...this.state.accessTokens.values()]
       .filter((token) => token.projectId === input.projectId)
       .filter((token) => input.kind === undefined || token.kind === input.kind)
-      .filter((token) => input.subjectType === undefined || token.subjectType === input.subjectType)
-      .filter((token) => input.subjectId === undefined || token.subjectId === input.subjectId)
+      .filter(
+        (token) =>
+          input.subject === undefined ||
+          (token.subject.type === input.subject.type && token.subject.id === input.subject.id)
+      )
       .filter((token) => input.includeRevoked || !token.revokedAt)
       .sort((a, b) => compareByCreatedAt(a, b, order))
     const page = rows.slice(offset, input.limit === undefined ? undefined : offset + input.limit)

package/src/storage/auth/in-memory/auth-storage.ts

@@ -7,6 +7,7 @@ import type {
   CompleteOidcSignInInput,
   CompleteSignInResult,
   GroupMembershipRecord,
+  GroupMembershipSource,
   InvitationRecord,
   SessionRecord,
   SuspendUserAndRevokeSessionsInput,
@@ -30,7 +31,6 @@ import {
   cloneRecord,
   consumeMagicLinkRecord,
   consumeOidcAttemptRecord,
-  createAccessTokenRecord,
   createAuthStorageState,
   createSessionRecord,
   deviceAuthorizationKey,
@@ -43,6 +43,7 @@ import {
   normalizeEmail,
   normalizeGroupIds,
   oidcAttemptKey,
+  removeGroupMembershipRecord,
   revokeActiveSessionsForUser,
   upsertGroupMembershipRecord,
   userKey,
@@ -138,24 +139,22 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
     if (
-      input.accessToken.projectId !== input.projectId ||
-      input.accessToken.subjectType !== "user" ||
-      input.accessToken.subjectId !== authorization.approvedUserId ||
-      input.accessToken.createdBySessionId !== authorization.approvedSessionId
+      input.session.projectId !== input.projectId ||
+      input.session.userId !== authorization.approvedUserId
     ) {
       throw new AuthStorageError(
         "invalid_device_authorization",
-        "[Sixb] Device access token is invalid."
+        "[Sixb] Device session is invalid."
       )
     }
-    const accessToken = createAccessTokenRecord(this.state, input.accessToken)
+    const session = createSessionRecord(this.state, input.session)
     const consumed = {
       ...authorization,
       status: "consumed" as const,
       consumedAt: new Date(input.completedAt),
     }
     this.state.deviceAuthorizations.set(key, cloneRecord(consumed))
-    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) }
+    return { authorization: cloneRecord(consumed), session: cloneRecord(session) }
   }
 
   async completeMagicLinkSignIn(
@@ -222,25 +221,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (
-      shouldCreateUser &&
-      !activeInvitation &&
-      input.allowUserCreationWithoutInvitation &&
-      input.requireNoActiveUsersForUserCreation &&
-      hasActiveUsers(this.state, projectId)
-    ) {
-      consumeMagicLinkRecord(this.state, {
-        projectId,
-        id: input.magicLinkId,
-        tokenHash: input.tokenHash,
-        consumedAt: completedAt,
-      })
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     validateCompleteSessionInput(this.state, projectId, input.session)
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
@@ -283,8 +263,9 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId,
       user,
     })
-    const memberships = this.applyManualGroups({
+    const memberships = this.applyGroups({
       completedAt,
+      source: "manual",
       groupIds: manualGroupIds,
       projectId,
       userId: user.id,
@@ -355,14 +336,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "email_link_not_allowed",
-        `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`
-      )
-    }
-
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId)
       throw new AuthStorageError(
@@ -371,14 +344,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (shouldCreateUser && !input.emailVerified) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId)
       throw new AuthStorageError(
@@ -387,20 +352,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       )
     }
 
-    if (
-      shouldCreateUser &&
-      !activeInvitation &&
-      input.allowUserCreationWithoutInvitation &&
-      input.requireNoActiveUsersForUserCreation &&
-      hasActiveUsers(this.state, projectId)
-    ) {
-      this.consumeOidcAttempt(input, completedAt, projectId)
-      throw new AuthStorageError(
-        "user_creation_not_allowed",
-        `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`
-      )
-    }
-
     validateCompleteSessionInput(this.state, projectId, input.session)
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
@@ -437,12 +388,19 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId,
       user,
     })
-    const memberships = this.applyManualGroups({
+    const memberships = this.syncDirectoryGroups({
       completedAt,
-      groupIds: manualGroupIds,
+      groupIds: input.directoryGroupIds,
       projectId,
       userId: user.id,
-      existing: invitation.memberships,
+      existing: this.applyGroups({
+        completedAt,
+        source: "manual",
+        groupIds: manualGroupIds,
+        projectId,
+        userId: user.id,
+        existing: invitation.memberships,
+      }),
     })
 
     const nextIdentity: UserIdentityRecord = {
@@ -536,10 +494,11 @@ export class InMemoryAuthStorage implements AuthStorage {
     return { invitation, memberships }
   }
 
-  private applyManualGroups(input: {
+  private applyGroups(input: {
     readonly completedAt: Date
     readonly groupIds: readonly string[]
     readonly projectId: string
+    readonly source: GroupMembershipSource
     readonly userId: string
     readonly existing: readonly GroupMembershipRecord[]
   }): readonly GroupMembershipRecord[] {
@@ -550,13 +509,40 @@ export class InMemoryAuthStorage implements AuthStorage {
           projectId: input.projectId,
           userId: input.userId,
           groupId,
-          source: "manual",
+          source: input.source,
           createdAt: input.completedAt,
         })
       )
     }
     return memberships
   }
+  // Directory memberships become exactly `groupIds`. A group the user already holds from another
+  // source keeps that source, and memberships from other sources are never removed.
+  private syncDirectoryGroups(input: {
+    readonly completedAt: Date
+    readonly groupIds?: readonly string[]
+    readonly projectId: string
+    readonly userId: string
+    readonly existing: readonly GroupMembershipRecord[]
+  }): readonly GroupMembershipRecord[] {
+    if (!input.groupIds) {
+      return input.existing
+    }
+
+    const groupIds = normalizeGroupIds(input.groupIds)
+    const stale = [...this.state.groupMemberships.values()].filter(
+      (membership) =>
+        membership.projectId === input.projectId &&
+        membership.userId === input.userId &&
+        membership.source === "directory" &&
+        !groupIds.includes(membership.groupId)
+    )
+    for (const membership of stale) {
+      removeGroupMembershipRecord(this.state, membership)
+    }
+
+    return this.applyGroups({ ...input, groupIds, source: "directory" })
+  }
 
   private createSignInSession(input: {
     readonly projectId: string
@@ -602,16 +588,6 @@ function restoreMap<TKey, TValue>(target: Map<TKey, TValue>, snapshot: Map<TKey,
   }
 }
 
-function hasActiveUsers(state: AuthStorageState, projectId: string): boolean {
-  for (const user of state.users.values()) {
-    if (user.projectId === projectId && user.status === "active") {
-      return true
-    }
-  }
-
-  return false
-}
-
 function assertSignInSessionAudience(
   projectId: string,
   sessionAudience: string,

package/src/storage/auth/in-memory/device-authorizations.ts

@@ -45,8 +45,6 @@ export class InMemoryAuthDeviceAuthorizationStore implements AuthDeviceAuthoriza
       deviceCodeHash: assertNonEmpty(input.deviceCodeHash, "Device code hash"),
       userCode: assertNonEmpty(input.userCode, "User code"),
       clientName: assertNonEmpty(input.clientName, "Client name"),
-      tokenName: assertNonEmpty(input.tokenName, "Token name"),
-      tokenExpiresAt: new Date(input.tokenExpiresAt),
       status: "pending",
       createdAt: new Date(input.createdAt),
       expiresAt: new Date(input.expiresAt),

package/src/storage/auth/in-memory/sessions.ts

@@ -1,6 +1,11 @@
 import type { AuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
-import type { AuthSessionStore, CreateAuthSessionInput, SessionRecord } from "../types"
+import type {
+  AuthSessionStore,
+  CreateAuthSessionInput,
+  RotateSessionRefreshTokenResult,
+  SessionRecord,
+} from "../types"
 import type { AuthStorageState } from "./shared"
 import {
   cloneDate,
@@ -73,6 +78,7 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id))
     if (
       !session ||
+      session.bearer ||
       session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
@@ -83,6 +89,67 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     return cloneRecord(session)
   }
 
+  async findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.id))
+    if (
+      !session?.bearer ||
+      session.tokenHash !== params.tokenHash ||
+      session.bearer.accessExpiresAt <= params.now ||
+      !isActiveSession(session, params.now)
+    ) {
+      return null
+    }
+
+    return cloneRecord(session)
+  }
+
+  async rotateRefreshToken(
+    params: Parameters<AuthSessionStore["rotateRefreshToken"]>[0]
+  ): Promise<RotateSessionRefreshTokenResult> {
+    const key = sessionKey(params.projectId, params.id)
+    const session = this.state.sessions.get(key)
+    if (!session?.bearer || !isActiveSession(session, params.now)) {
+      return { status: "invalid" }
+    }
+
+    const { bearer } = session
+    const replacedRecently =
+      bearer.previousRefreshTokenHash === params.refreshTokenHash &&
+      bearer.refreshedAt !== undefined &&
+      params.now.getTime() - bearer.refreshedAt.getTime() <= params.reuseGraceMs
+    if (bearer.refreshTokenHash !== params.refreshTokenHash && !replacedRecently) {
+      if (bearer.previousRefreshTokenHash !== params.refreshTokenHash) {
+        return { status: "invalid" }
+      }
+      this.state.sessions.set(key, cloneRecord({ ...session, revokedAt: cloneDate(params.now) }))
+      return { status: "reused" }
+    }
+
+    const requestedExpiresAt = session.absoluteExpiresAt
+      ? new Date(Math.min(params.next.expiresAt.getTime(), session.absoluteExpiresAt.getTime()))
+      : params.next.expiresAt
+    const next: SessionRecord = {
+      ...session,
+      tokenHash: params.next.tokenHash,
+      expiresAt: new Date(Math.max(session.expiresAt.getTime(), requestedExpiresAt.getTime())),
+      lastSeenAt: cloneDate(params.now),
+      bearer: {
+        clientName: bearer.clientName,
+        accessExpiresAt: cloneDate(params.next.accessExpiresAt),
+        refreshTokenHash: params.next.refreshTokenHash,
+        previousRefreshTokenHash: bearer.refreshTokenHash,
+        refreshedAt: cloneDate(params.now),
+      },
+    }
+    this.state.sessions.set(key, cloneRecord(next))
+    return { status: "rotated", session: cloneRecord(next) }
+  }
+
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
@@ -95,6 +162,7 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     const session = this.state.sessions.get(key)
     if (
       !session ||
+      session.bearer ||
       session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)

package/src/storage/auth/in-memory/shared.ts

@@ -320,6 +320,13 @@ export function createSessionRecord(
     absoluteExpiresAt: input.absoluteExpiresAt ? cloneDate(input.absoluteExpiresAt) : undefined,
     userAgent: input.userAgent,
     ipAddress: input.ipAddress,
+    bearer: input.bearer
+      ? {
+          clientName: assertNonEmpty(input.bearer.clientName, "Session client name"),
+          accessExpiresAt: cloneDate(input.bearer.accessExpiresAt),
+          refreshTokenHash: assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash"),
+        }
+      : undefined,
   }
 
   state.sessions.set(sessionKey(projectId, id), cloneRecord(session))
@@ -398,11 +405,11 @@ export function createAccessTokenRecord(
   const id = assertNonEmpty(input.id, "Access token id")
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const name = assertNonEmpty(input.name, "Access token name")
-  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id")
+  const subjectId = assertNonEmpty(input.subject.id, "Access token subject id")
   const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash")
 
-  assertAccessTokenSubject(input.kind, input.subjectType)
-  assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId)
+  assertAccessTokenSubject(input.kind, input.subject.type)
+  assertAccessTokenSubjectExists(state, projectId, input.subject.type, subjectId)
 
   const key = accessTokenKey(projectId, id)
   if (state.accessTokens.has(key)) {
@@ -417,8 +424,7 @@ export function createAccessTokenRecord(
     projectId,
     name,
     kind: input.kind,
-    subjectType: input.subjectType,
-    subjectId,
+    subject: { type: input.subject.type, id: subjectId },
     tokenHash,
     groupIds: normalizeOptionalGroupIds(input.groupIds),
     createdByPrincipal: input.createdByPrincipal,
@@ -484,7 +490,7 @@ export function removeGroupMembershipRecord(
 
 function assertAccessTokenSubject(
   kind: CreateAuthAccessTokenInput["kind"],
-  subjectType: CreateAuthAccessTokenInput["subjectType"]
+  subjectType: CreateAuthAccessTokenInput["subject"]["type"]
 ): void {
   if (
     (kind === "personal" && subjectType === "user") ||
@@ -502,7 +508,7 @@ function assertAccessTokenSubject(
 function assertAccessTokenSubjectExists(
   state: AuthStorageState,
   projectId: string,
-  subjectType: CreateAuthAccessTokenInput["subjectType"],
+  subjectType: CreateAuthAccessTokenInput["subject"]["type"],
   subjectId: string
 ): void {
   if (subjectType === "user") {

package/src/storage/auth/index.ts

@@ -3,7 +3,6 @@ export { AuthStorageError } from "./errors"
 export { InMemoryAuthStorage } from "./in-memory"
 export type {
   AccessTokenRecord,
-  AccessTokenSubjectType,
   AuthAccessTokenStore,
   AuthDeviceAuthorizationStore,
   AuthGroupMembershipStore,
@@ -16,6 +15,7 @@ export type {
   AuthStorage,
   AuthUserIdentityStore,
   AuthUserStore,
+  BearerSessionState,
   CompleteAuthSessionInput,
   CompleteDeviceAuthorizationInput,
   CompleteDeviceAuthorizationResult,
@@ -47,6 +47,7 @@ export type {
   MagicLinkRecord,
   OidcAuthorizationAttemptRecord,
   ReconcileAuthServiceAccountGroupMembershipsInput,
+  RotateSessionRefreshTokenResult,
   ServiceAccountGroupMembershipRecord,
   ServiceAccountRecord,
   ServiceAccountStatus,