@sixb/core 0.1.18 → 0.1.20

package/dist/{chunk-f1zxad2t.js.map → chunk-tg2cw67r.js.map}

@@ -6,6 +6,6 @@
     "import { AuthorizationError, assertProviderAccess } from \"../authorization\"\nimport type { ExecutionContext } from \"../execution\"\nimport { resolveExecutionScopeAuthorization } from \"../execution/authorization\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport { createConnectorCodedError } from \"./errors\"\nimport type { ConnectorService } from \"./service\"\nimport type {\n  AnyConnectorAdapter,\n  ConnectorAdapter,\n  ConnectorClient,\n  ConnectorConnectionMetadata,\n  ConnectorConnectionSelector,\n  ConnectorDefinition,\n  OAuthConnectorAdapter,\n} from \"./types\"\nimport { isOAuthConnectorDefinition } from \"./types\"\n\n/** Resolve a registered connector through one authorized execution. */\nexport interface ConnectorRuntime {\n  <TAdapter extends ConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>\n  ): Promise<ConnectorClient<TAdapter>>\n  <TAdapter extends OAuthConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>,\n    selector: ConnectorConnectionSelector\n  ): Promise<ConnectorClient<TAdapter>>\n}\n\nexport interface ConnectorExecutionSource<\n  TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter,\n> {\n  readonly connection?: ConnectorConnectionMetadata\n  connect(signal: AbortSignal): Promise<ConnectorClient<TAdapter>>\n}\n\nexport interface ConnectorExecutionSourceResolver {\n  list<TAdapter extends AnyConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>\n  ): Promise<readonly ConnectorExecutionSource<TAdapter>[]>\n}\n\nconst sourceResolvers = new WeakMap<ConnectorRuntime, ConnectorExecutionSourceResolver>()\n\nexport function createConnectorRuntime(\n  runtime: SixbRuntimeContext,\n  execution: ExecutionContext,\n  service: ConnectorService\n): ConnectorRuntime {\n  const connector = ((definition: ConnectorDefinition, selector?: ConnectorConnectionSelector) => {\n    if (isOAuthConnectorDefinition(definition)) {\n      assertConnectorConnectionAccess(runtime, execution)\n      if (!selector) {\n        throw createConnectorCodedError(\n          \"connector.configuration_invalid\",\n          `[Sixb] Connector '${definition.id}' uses persistent connections and requires an explicit owner and slot.`\n        )\n      }\n      return service.connectConnection(definition, selector)\n    }\n    if (selector) {\n      throw createConnectorCodedError(\n        \"connector.configuration_invalid\",\n        `[Sixb] Static connector '${definition.id}' does not accept a connection.`\n      )\n    }\n    assertProviderAccess(runtime, execution, \"connector.connect\")\n    return service.connect(definition as ConnectorDefinition<string, ConnectorAdapter>)\n  }) as ConnectorRuntime\n\n  registerConnectorExecutionSourceResolver(connector, {\n    async list<TAdapter extends AnyConnectorAdapter>(\n      definition: ConnectorDefinition<string, TAdapter>\n    ): Promise<readonly ConnectorExecutionSource<TAdapter>[]> {\n      if (!isOAuthConnectorDefinition(definition)) {\n        return [\n          {\n            connect: (_signal) =>\n              connector(definition as ConnectorDefinition<string, ConnectorAdapter>) as Promise<\n                ConnectorClient<TAdapter>\n              >,\n          },\n        ]\n      }\n\n      assertConnectorConnectionAccess(runtime, execution)\n      const connections = await service.listExecutionConnections(definition)\n      return connections.map((connection) => ({\n        connection: {\n          id: connection.id,\n          connectorId: connection.connectorId,\n          owner: connection.owner,\n          slot: connection.slot,\n          account: connection.account,\n        },\n        connect: (signal) =>\n          service.connectExecutionConnection(definition, connection, signal) as Promise<\n            ConnectorClient<TAdapter>\n          >,\n      }))\n    },\n  })\n  return connector\n}\n\nfunction registerConnectorExecutionSourceResolver(\n  connector: ConnectorRuntime,\n  resolver: ConnectorExecutionSourceResolver\n): void {\n  const registered = sourceResolvers.get(connector)\n  if (registered && registered !== resolver) {\n    throw new Error(\"[Sixb] Connector source resolver is already registered for this execution.\")\n  }\n  sourceResolvers.set(connector, resolver)\n}\n\nexport function getConnectorExecutionSourceResolver(\n  connector: ConnectorRuntime\n): ConnectorExecutionSourceResolver {\n  const resolver = sourceResolvers.get(connector)\n  if (resolver) return resolver\n\n  return {\n    async list<TAdapter extends AnyConnectorAdapter>(\n      definition: ConnectorDefinition<string, TAdapter>\n    ): Promise<readonly ConnectorExecutionSource<TAdapter>[]> {\n      if (isOAuthConnectorDefinition(definition)) {\n        throw createConnectorCodedError(\n          \"connector.configuration_invalid\",\n          `[Sixb] OAuth connector '${definition.id}' cannot be resolved without the managed connection runtime.`\n        )\n      }\n      return [\n        {\n          connect: (_signal) =>\n            connector(definition as ConnectorDefinition<string, ConnectorAdapter>) as Promise<\n              ConnectorClient<TAdapter>\n            >,\n        },\n      ]\n    },\n  }\n}\n\nfunction assertConnectorConnectionAccess(\n  runtime: SixbRuntimeContext,\n  execution: ExecutionContext\n): void {\n  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {\n    execution,\n    authorization: runtime.runtimeAuthorization,\n  })\n  if (resolved.type === \"unrestricted\" && resolved.ref.type === \"trustedPrimitive\") return\n  throw new AuthorizationError(\n    \"privileged:connector-connection.connect\",\n    \"[Sixb] Connector connection clients are restricted to trusted primitive executions.\"\n  )\n}\n"
   ],
   "mappings": ";;;;;;;;;;;;;;;;;;AAkBO,MAAM,wBAAuB,MAAM;AAAA,EAC/B,OAAe;AAC1B;AAAA;AAEO,MAAM,gCAA+B,gBAAe;AAAA,EAEpC;AAAA,EADH,OAAO;AAAA,EACzB,WAAW,CAAU,aAAqB;AAAA,IACxC,MAAM,sBAAsB,cAAc;AAAA,IADvB;AAAA;AAGvB;AAAA;AAaO,MAAM,6BAA4B,gBAAe;AAAA,EAI3C;AAAA,EAHO,OAAO;AAAA,EAEzB,WAAW,CACA,MACT,SACA,SACA;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;AAGO,SAAS,yBAAyB,CACvC,MACA,SACA,UAA4B,CAAC,GACb;AAAA,EAChB,OAAO,iBACL,MACA,QAAQ,WAAW,QAAQ,IAAI,UAAU,UAAU,WACnD,OACF;AAAA;AAIK,SAAS,qCAAqC,CACnD,UAA4B,CAAC,GACb;AAAA,EAChB,OAAO,0BACL,6BACA,sDACA,OACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAyC;AAAA,EACtE,OAAO,iBAAiB,uBAAsB,MAAM,OAAO;AAAA;AAGtD,SAAS,mBAAmB,CACjC,OACgE;AAAA,EAChE,OAAO,eAAe,KAAK,MAAM,cAC7B,mCACA;AAAA;AAGC,SAAS,qBAAqB,CACnC,OACA,MACA,SACO;AAAA,EACP,IAAI,aAAY,KAAK,KAAK,MAAM,KAAK,WAAW,YAAY;AAAA,IAAG,OAAO;AAAA,EACtE,OAAO,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA;AAG3D,SAAS,uBAAuB,CACrC,OACA,MAC0C;AAAA,EAC1C,OACE,iBAAiB,qCAAoC,SAAS,aAAa,MAAM,SAAS;AAAA;AAIvF,SAAS,oBAAoB,CAAC,OAAgB,SAAiC;AAAA,EACpF,OAAO,0BAA0B,uBAAuB,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA;AAGnF,eAAsB,uBAA0B,CAC9C,cACA,SACA,UACY;AAAA,EACZ,IAAI;AAAA,IACF,OAAO,MAAM,SAAS;AAAA,IACtB,OAAO,eAAe;AAAA,IACtB,MAAM,0BAA0B,uBAAuB,SAAS;AAAA,MAC9D,OAAO,IAAI,eAAe,CAAC,cAAc,aAAa,GAAG,OAAO;AAAA,IAClE,CAAC;AAAA;AAAA;;;AC/EL,IAAM,kBAAkB,IAAI;AAErB,SAAS,sBAAsB,CACpC,SACA,WACA,SACkB;AAAA,EAClB,MAAM,YAAa,CAAC,YAAiC,aAA2C;AAAA,IAC9F,IAAI,4BAA2B,UAAU,GAAG;AAAA,MAC1C,gCAAgC,SAAS,SAAS;AAAA,MAClD,IAAI,CAAC,UAAU;AAAA,QACb,MAAM,0BACJ,mCACA,qBAAqB,WAAW,0EAClC;AAAA,MACF;AAAA,MACA,OAAO,QAAQ,kBAAkB,YAAY,QAAQ;AAAA,IACvD;AAAA,IACA,IAAI,UAAU;AAAA,MACZ,MAAM,0BACJ,mCACA,4BAA4B,WAAW,mCACzC;AAAA,IACF;AAAA,IACA,sBAAqB,SAAS,WAAW,mBAAmB;AAAA,IAC5D,OAAO,QAAQ,QAAQ,UAA2D;AAAA;AAAA,EAGpF,yCAAyC,WAAW;AAAA,SAC5C,KAA0C,CAC9C,YACwD;AAAA,MACxD,IAAI,CAAC,4BAA2B,UAAU,GAAG;AAAA,QAC3C,OAAO;AAAA,UACL;AAAA,YACE,SAAS,CAAC,YACR,UAAU,UAA2D;AAAA,UAGzE;AAAA,QACF;AAAA,MACF;AAAA,MAEA,gCAAgC,SAAS,SAAS;AAAA,MAClD,MAAM,cAAc,MAAM,QAAQ,yBAAyB,UAAU;AAAA,MACrE,OAAO,YAAY,IAAI,CAAC,gBAAgB;AAAA,QACtC,YAAY;AAAA,UACV,IAAI,WAAW;AAAA,UACf,aAAa,WAAW;AAAA,UACxB,OAAO,WAAW;AAAA,UAClB,MAAM,WAAW;AAAA,UACjB,SAAS,WAAW;AAAA,QACtB;AAAA,QACA,SAAS,CAAC,WACR,QAAQ,2BAA2B,YAAY,YAAY,MAAM;AAAA,MAGrE,EAAE;AAAA;AAAA,EAEN,CAAC;AAAA,EACD,OAAO;AAAA;AAGT,SAAS,wCAAwC,CAC/C,WACA,UACM;AAAA,EACN,MAAM,aAAa,gBAAgB,IAAI,SAAS;AAAA,EAChD,IAAI,cAAc,eAAe,UAAU;AAAA,IACzC,MAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAAA,EACA,gBAAgB,IAAI,WAAW,QAAQ;AAAA;AAGlC,SAAS,mCAAmC,CACjD,WACkC;AAAA,EAClC,MAAM,WAAW,gBAAgB,IAAI,SAAS;AAAA,EAC9C,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,OAAO;AAAA,SACC,KAA0C,CAC9C,YACwD;AAAA,MACxD,IAAI,4BAA2B,UAAU,GAAG;AAAA,QAC1C,MAAM,0BACJ,mCACA,2BAA2B,WAAW,gEACxC;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL;AAAA,UACE,SAAS,CAAC,YACR,UAAU,UAA2D;AAAA,QAGzE;AAAA,MACF;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,+BAA+B,CACtC,SACA,WACM;AAAA,EACN,MAAM,WAAW,mCAAmC,QAAQ,WAAW;AAAA,IACrE;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AAAA,EACD,IAAI,SAAS,SAAS,kBAAkB,SAAS,IAAI,SAAS;AAAA,IAAoB;AAAA,EAClF,MAAM,IAAI,oBACR,2CACA,qFACF;AAAA;",
-  "debugId": "B7B09D22E526C3CB64756E2164756E21",
+  "debugId": "3C1D35D66FA59CBC64756E2164756E21",
   "names": []
 }

package/dist/{chunk-p844e0rn.js → chunk-tpn40322.js}

@@ -10,14 +10,14 @@ import {
 import {
   validateSchemaValue2,
   normalizeSchemaValue2
-} from "./chunk-y05543x6.js";
+} from "./chunk-hvsb78a1.js";
 import {
   AgentDefinitionError2,
   AgentToolResultValidationError2
 } from "./chunk-pfp1txq2.js";
 import {
   assertValidSchema
-} from "./chunk-vgk3hknm.js";
+} from "./chunk-1k89ecfr.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";

package/dist/{chunk-rt9p8m9t.js → chunk-v9xd5wzd.js}

@@ -2,7 +2,7 @@
 import {
   validateSchemaValue2,
   isRecord2
-} from "./chunk-y05543x6.js";
+} from "./chunk-hvsb78a1.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";

package/dist/{chunk-6h5m9xjx.js → chunk-vpq4shxz.js}

@@ -1,35 +1,31 @@
 // @bun
 import {
-  canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-qkbx3tf6.js";
+} from "./chunk-d0bqz29d.js";
 import {
   assertValidFileRefs2
-} from "./chunk-y05543x6.js";
+} from "./chunk-hvsb78a1.js";
 import {
   SecurityValidationError2,
   resolveMembershipPolicyScope,
   canPerformMembershipOperation,
   missingMembershipGroupIds,
   validateSecurityDefinitionsAtStartup
-} from "./chunk-xt1zt7gv.js";
+} from "./chunk-es1gxsbf.js";
 import {
-  AuthRuntimeError2,
-  DEFAULT_AUTH_SESSION_AUDIENCE2,
-  resolveAuthSessionAudience2,
-  resolveAuthCookieOptionsForAudience,
   getCookie2,
+  AuthRuntimeError2,
   resolveAuthConfig2,
   resolveInvitationExpiresAt,
   assertNonEmpty3,
   normalizePagination,
   isInvitationDeliveryAuthStrategy2
-} from "./chunk-2jntasmh.js";
+} from "./chunk-hcbyfxbe.js";
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-vx2yp45y.js";
+} from "./chunk-c85m1hyj.js";
 import {
   snapshotLinkPathSelection
 } from "./chunk-t6f3tdnr.js";
@@ -161,13 +157,6 @@ function safeEqual(left, right) {
 }
 // src/auth/runtime.ts
 import { randomUUID as randomUUID3 } from "crypto";
-
-// src/security/applications.ts
-var applications2 = {
-  atlas: { kind: "application", id: "atlas", label: "Atlas" },
-  app: { kind: "application", id: "app", label: "Custom app" }
-};
-var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
 // src/security/every.ts
 var BREADTH_TARGETS = [
   "object",
@@ -176,7 +165,6 @@ var BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "application",
   "connector",
   "share"
 ];
@@ -211,7 +199,6 @@ var every2 = {
   workflow: () => all("workflow"),
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
-  application: () => all("application"),
   connector: () => all("connector"),
   share: () => all("share")
 };
@@ -219,10 +206,6 @@ var every2 = {
 class ActionDefinitionError2 extends Error {
   name = "ActionDefinitionError";
 }
-
-class ActionEditCommitError2 extends Error {
-  name = "ActionEditCommitError";
-}
 function missingActionMutationMessage(actionId) {
   return `Action "${actionId}" must declare .writeback(...) or .edits(...).`;
 }
@@ -254,7 +237,7 @@ function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
   assertValidFileRefs2(normalized, pathPrefix);
   return normalized;
 }
-function coerceActionParamsToTyped2(paramsConfig, params, valueTypesById) {
+function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
   return coerceParamsToTyped(paramsConfig, params, valueTypesById);
 }
 function validateActionSubject(action, subject) {
@@ -578,7 +561,6 @@ var TARGET_BY_DEFINITION_KIND = {
   sync: "sync",
   pipeline: "pipeline",
   workflow: "workflow",
-  application: "application",
   connector: "connector",
   share: "share"
 };
@@ -626,10 +608,6 @@ function resolveGrant(input, label, allowedTargets) {
   const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
   return { target, selection: { all: false, ids } };
 }
-function access(input) {
-  const { selection } = resolveGrant(input, "can.access", ["application"]);
-  return { kind: "grant", capability: "access", target: "application", selection };
-}
 function view(input) {
   if (isShareTarget(input))
     return createShareViewGrant(input);
@@ -691,22 +669,11 @@ function observe(input) {
   if (input !== "logs" && !isAgentUsageReference(input)) {
     throw new SecurityValidationError2('[Sixb] can.observe accepts "logs" or agent.usage.');
   }
-  const target = input === "logs" ? "logs" : "aiUsage";
-  return {
-    kind: "grant",
-    capability: "observe",
-    target,
-    selection: { all: false, ids: [target] }
-  };
+  return { kind: "grant", capability: "observe", target: input === "logs" ? "logs" : "aiUsage" };
 }
 function manage(input) {
   if (isAgentUsageReference(input)) {
-    return {
-      kind: "grant",
-      capability: "manage",
-      target: "aiUsage",
-      selection: { all: false, ids: ["aiUsage"] }
-    };
+    return { kind: "grant", capability: "manage", target: "aiUsage" };
   }
   return {
     kind: "grant",
@@ -716,7 +683,6 @@ function manage(input) {
   };
 }
 var can2 = {
-  access,
   view,
   edit,
   append,
@@ -739,7 +705,6 @@ class SecurityRegistry {
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds,
       datasetIds: input.datasetIds,
       actionIds: input.actionIds,
@@ -748,12 +713,9 @@ class SecurityRegistry {
       pipelineIds: input.pipelineIds,
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds
     });
     const universe = {
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds ?? new Set,
       datasetIds: input.datasetIds ?? new Set,
       actionIds: input.actionIds ?? new Set,
@@ -761,8 +723,6 @@ class SecurityRegistry {
       syncIds: input.syncIds ?? new Set,
       pipelineIds: input.pipelineIds ?? new Set,
       connectorIds: input.connectorIds ?? new Set,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
@@ -930,15 +890,12 @@ function getActiveInvitationByEmail(state, projectId, email, now) {
   const invitations = [...state.invitations.values()].filter((invitation) => invitation.projectId === projectId).filter((invitation) => invitation.email === normalizedEmail).filter((invitation) => isActiveInvitation(invitation, now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
   return invitations[0] ?? null;
 }
-function revokeActiveSessionsForUser(state, projectId, userId, revokedAt, audience) {
+function revokeActiveSessionsForUser(state, projectId, userId, revokedAt) {
   const revoked = [];
   for (const [key, session] of state.sessions) {
     if (session.projectId !== projectId || session.userId !== userId) {
       continue;
     }
-    if (audience !== undefined && session.audience !== audience) {
-      continue;
-    }
     if (!isActiveSession(session, revokedAt)) {
       continue;
     }
@@ -977,7 +934,6 @@ function assertSessionIdAvailable(state, projectId, sessionId) {
 }
 function validateCompleteSessionInput(state, projectId, session) {
   const sessionId = assertNonEmpty4(session.id, "Session id");
-  assertNonEmpty4(session.audience, "Session audience");
   assertNonEmpty4(session.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, sessionId);
 }
@@ -986,7 +942,6 @@ function createSessionRecord(state, input) {
   const projectId = assertNonEmpty4(input.projectId, "Project id");
   const userId = assertNonEmpty4(input.userId, "User id");
   const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-  const audience = resolveAuthSessionAudience2(input.audience);
   const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
@@ -994,7 +949,6 @@ function createSessionRecord(state, input) {
     projectId,
     userId,
     strategyId,
-    audience,
     tokenHash,
     createdAt: cloneDate(input.createdAt),
     expiresAt: cloneDate(input.expiresAt),
@@ -1514,7 +1468,6 @@ class InMemoryAuthMagicLinkStore {
     const id = assertNonEmpty4(input.id, "Magic link id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const email = normalizeEmail(input.email);
     const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
@@ -1526,7 +1479,6 @@ class InMemoryAuthMagicLinkStore {
       id,
       projectId,
       strategyId,
-      audience,
       email,
       tokenHash,
       returnTo: input.returnTo,
@@ -1563,7 +1515,6 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
     const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
@@ -1575,7 +1526,6 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
       id,
       projectId,
       strategyId,
-      audience,
       stateHash,
       nonceHash,
       codeVerifier,
@@ -1701,10 +1651,6 @@ class InMemoryAuthSessionStore {
     const record = this.state.sessions.get(sessionKey(params.projectId, params.id)) ?? null;
     return cloneOptionalRecord(record);
   }
-  async getActiveByUserId(params) {
-    const sessions = [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => session.audience === params.audience).filter((session) => isActiveSession(session, params.now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
-    return cloneOptionalRecord(sessions[0] ?? null);
-  }
   async listActiveByUserId(params) {
     return [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => isActiveSession(session, params.now)).sort((a, b) => {
       const activity = (b.lastSeenAt ?? b.createdAt).getTime() - (a.lastSeenAt ?? a.createdAt).getTime();
@@ -1716,7 +1662,7 @@ class InMemoryAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
-    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     return cloneRecord(session);
@@ -1763,7 +1709,7 @@ class InMemoryAuthSessionStore {
   async renewIfValid(params) {
     const key = sessionKey(params.projectId, params.id);
     const session = this.state.sessions.get(key);
-    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     const requestedExpiresAt = session.absoluteExpiresAt ? new Date(Math.min(params.expiresAt.getTime(), session.absoluteExpiresAt.getTime())) : params.expiresAt;
@@ -1789,7 +1735,7 @@ class InMemoryAuthSessionStore {
     return cloneRecord(next);
   }
   async revokeActiveForUser(params) {
-    return revokeActiveSessionsForUser(this.state, params.projectId, params.userId, params.revokedAt, params.audience).map(cloneRecord);
+    return revokeActiveSessionsForUser(this.state, params.projectId, params.userId, params.revokedAt).map(cloneRecord);
   }
   async touch(params) {
     const key = sessionKey(params.projectId, params.id);
@@ -1997,7 +1943,6 @@ class InMemoryAuthStorage2 {
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
-    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
@@ -2086,7 +2031,6 @@ class InMemoryAuthStorage2 {
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
-    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
@@ -2217,7 +2161,6 @@ class InMemoryAuthStorage2 {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -2241,12 +2184,6 @@ function restoreMap(target, snapshot) {
     target.set(key, value);
   }
 }
-function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
-  if (sessionAudience === storedAudience) {
-    return;
-  }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
-}
 // src/auth/session-cache.ts
 class SessionCache {
   ttlMs;
@@ -2261,7 +2198,7 @@ class SessionCache {
     if (!entry) {
       return;
     }
-    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.transport !== input.transport || input.audience !== undefined && entry.audience !== input.audience) {
+    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.transport !== input.transport) {
       this.entries.delete(input.sessionId);
       return;
     }
@@ -2277,7 +2214,6 @@ class SessionCache {
     this.entries.set(input.sessionId, {
       tokenHash: input.tokenHash,
       transport: bearer ? "bearer" : "cookie",
-      audience: input.audience,
       session: input.session,
       expiresAtMs
     });
@@ -2391,8 +2327,8 @@ class AuthRuntime2 {
       ...absoluteTimeoutMs === undefined ? {} : { absoluteExpiresAt: new Date(now.getTime() + absoluteTimeoutMs) }
     };
   }
-  getCookieOptions(options = {}) {
-    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience);
+  getCookieOptions() {
+    return this.config.cookies;
   }
   assertCanServeHttp(params) {
     const strategy = this.config.strategy;
@@ -2413,7 +2349,6 @@ class AuthRuntime2 {
     if (!this.isEnabled()) {
       return { authenticated: false, reason: "auth_disabled" };
     }
-    const audience = resolveAuthSessionAudience2(options.audience);
     if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue2(request);
       if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
@@ -2426,10 +2361,10 @@ class AuthRuntime2 {
         return { authenticated: false, reason: "invalid_access_token" };
       }
     }
-    return this.resolveCookieSession(request, audience, options.sessionActivity);
+    return this.resolveCookieSession(request, options.sessionActivity);
   }
-  async resolveCookieSession(request, audience, activity) {
-    const cookieOptions = this.getCookieOptions({ audience });
+  async resolveCookieSession(request, activity) {
+    const cookieOptions = this.getCookieOptions();
     const cookieValue = getCookie2(request, cookieOptions.sessionCookieName);
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" };
@@ -2444,7 +2379,6 @@ class AuthRuntime2 {
       sessionId: parts.sessionId,
       tokenHash,
       transport: "cookie",
-      audience,
       nowMs
     });
     if (cached) {
@@ -2458,7 +2392,6 @@ class AuthRuntime2 {
     let session = await storage.sessions.findValidByTokenHash({
       projectId: this.projectId,
       id: parts.sessionId,
-      audience,
       tokenHash,
       now
     });
@@ -2470,7 +2403,6 @@ class AuthRuntime2 {
       const renewed = await storage.sessions.renewIfValid({
         projectId: this.projectId,
         id: parts.sessionId,
-        audience,
         tokenHash,
         now,
         expiresAt: this.getRenewedSessionExpiresAt(session, nowMs)
@@ -2533,7 +2465,6 @@ class AuthRuntime2 {
     this.sessionCache?.set({
       sessionId: session.id,
       tokenHash,
-      audience: session.audience,
       session: result,
       nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
@@ -2551,7 +2482,6 @@ class AuthRuntime2 {
         projectId: this.projectId,
         userId: input.userId,
         strategyId: "device",
-        audience: DEFAULT_AUTH_SESSION_AUDIENCE2,
         tokenHash: tokens.tokenHash,
         createdAt: input.now,
         ...this.createSessionDeadlines(input.now),
@@ -2753,6 +2683,10 @@ class AuthRuntime2 {
   }
   async listServiceAccounts(caller) {
     const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      return { serviceAccounts: [] };
+    }
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
       order: "desc",
@@ -2763,14 +2697,13 @@ class AuthRuntime2 {
       groupIds: await this.listServiceAccountGroupIds(storage, serviceAccount.id)
     })));
     return {
-      serviceAccounts: withGroups.filter(({ groupIds }) => callerCanManageServiceAccount(caller.groupIds, groupIds))
+      serviceAccounts: withGroups.filter(({ groupIds }) => canPerformMembershipOperation(scope, "serviceAccounts", groupIds))
     };
   }
   async createServiceAccount(caller, input) {
     const storage = this.requireAuthStorage();
-    const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
-      subject: "service account"
-    }) ?? [];
+    const groupIds = normalizeRequestedGroupIds(input.groupIds) ?? [];
+    this.assertCanManageServiceAccountGroups(caller.groupIds, groupIds);
     const now = new Date;
     const serviceAccount = await storage.serviceAccounts.create({
       id: input.id ?? `svc_${randomUUID3()}`,
@@ -2862,12 +2795,16 @@ class AuthRuntime2 {
     return { serviceAccount, accessToken };
   }
   async requireManageableServiceAccount(storage, callerGroupIds, serviceAccountId) {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError();
+    }
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
       id: serviceAccountId
     });
     const groupIds = serviceAccount ? await this.listServiceAccountGroupIds(storage, serviceAccountId) : [];
-    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+    if (!serviceAccount || !canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
       throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
     }
     return { serviceAccount, groupIds };
@@ -2901,6 +2838,7 @@ class AuthRuntime2 {
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     return {
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      serviceAccountGroups: this.scopedGroupOptions(scope.operations.serviceAccounts.groupIds),
       capabilities: membershipCapabilities(scope).holds
     };
   }
@@ -3073,7 +3011,6 @@ class AuthRuntime2 {
       throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
     }
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
-    this.assertInvitationApplicationAccess(groupIds, destination.audience);
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID3()}`,
       projectId: this.projectId,
@@ -3091,7 +3028,6 @@ class AuthRuntime2 {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: destination.audience,
         returnTo: destination.returnTo,
         requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
@@ -3188,17 +3124,6 @@ class AuthRuntime2 {
     }
     return { state: "enabled" };
   }
-  assertInvitationApplicationAccess(groupIds, audience) {
-    const roles = this.security.listResolvedRoles();
-    const authorization = resolveAuthorizationContext2({
-      principal: { type: "user", id: "invited-user" },
-      groupIds,
-      roles
-    });
-    if (canAccessApplication2(authorization, roles, audience))
-      return;
-    throw new AuthRuntimeError2("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
-  }
   async assertCanInviteRecipient(strategy, authStorage, email, now) {
     if (!strategy.validateInvitationRecipient) {
       return;
@@ -3227,6 +3152,17 @@ class AuthRuntime2 {
     }
     return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
   }
+  assertCanManageServiceAccountGroups(callerGroupIds, groupIds) {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
+    if (canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
+      return;
+    }
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError();
+    }
+    const missing = missingMembershipGroupIds(scope, "serviceAccounts", groupIds);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to place service accounts in group(s): ${missing.join(", ")}.`);
+  }
   assertCanManageInvitationGroups(callerGroupIds, groupIds) {
     const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
     if (canPerformMembershipOperation(scope, "invite", groupIds)) {
@@ -3260,9 +3196,8 @@ function constrainTokenGroupIds(principalGroupIds, accessToken) {
   const allowed = new Set(accessToken.groupIds);
   return principalGroupIds.filter((groupId) => allowed.has(groupId));
 }
-function callerCanManageServiceAccount(callerGroupIds, serviceAccountGroupIds) {
-  const callerGroups = new Set(callerGroupIds);
-  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId));
+function missingServiceAccountsPolicyError() {
+  return new AuthRuntimeError2("authorization_denied", "[Sixb] Managing service accounts needs a membership policy with the 'serviceAccounts' operation.");
 }
 function missingAccessTokenError(tokenId, projectId) {
   return new AuthStorageError2("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
@@ -3313,7 +3248,8 @@ function membershipCapabilities(scope) {
     holds: {
       invite: scope.operations.invite.policyIds.length > 0,
       assignGroups: scope.operations.assignGroups.policyIds.length > 0,
-      suspend: scope.operations.suspend.policyIds.length > 0
+      suspend: scope.operations.suspend.policyIds.length > 0,
+      serviceAccounts: scope.operations.serviceAccounts.policyIds.length > 0
     },
     assignableGroupIds: [...scope.operations.assignGroups.groupIds],
     covers: (operation, memberGroups) => canPerformMembershipOperation(scope, operation, groupIdsOf(memberGroups))
@@ -3327,6 +3263,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=E73F1E47F0D1834864756E2164756E21
+//# debugId=DF55B99B002A92F564756E2164756E21