@sixb/core 0.1.19 → 0.1.20

package/dist/webhooks/internal.js

@@ -1,21 +1,21 @@
 // @bun
 import"../chunk-8mx7qw3y.js";
 import"../chunk-z3y5kg1x.js";
-import"../chunk-enpsx8k5.js";
-import"../chunk-y7rqfrgg.js";
+import"../chunk-gsjm1wms.js";
+import"../chunk-d0bqz29d.js";
 import"../chunk-v4jbb3rs.js";
 import"../chunk-jhm3zsa7.js";
 import"../chunk-hvsb78a1.js";
 import {
   createConnectorCodedError,
   getConnectorExecutionSourceResolver
-} from "../chunk-wz0xs816.js";
+} from "../chunk-tg2cw67r.js";
 import"../chunk-a40ad1ft.js";
 import"../chunk-b38szspf.js";
-import"../chunk-3gnrh4ve.js";
-import"../chunk-xt1zt7gv.js";
+import"../chunk-vpq4shxz.js";
+import"../chunk-es1gxsbf.js";
 import"../chunk-v9xd5wzd.js";
-import"../chunk-2jntasmh.js";
+import"../chunk-hcbyfxbe.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-29yx306f.js";
 import"../chunk-gfdh9kqa.js";
@@ -24,15 +24,15 @@ import"../chunk-s54c868q.js";
 import"../chunk-ere85b8y.js";
 import"../chunk-4as3wt1c.js";
 import"../chunk-h89wz928.js";
-import"../chunk-7kg3k1m9.js";
+import"../chunk-9w055r5b.js";
 import {
   ExecutionStorageError2
 } from "../chunk-tw03bsmb.js";
-import"../chunk-bpgy64fw.js";
+import"../chunk-d09tj99x.js";
 import"../chunk-7n440zgt.js";
 import {
   canRetryWebhookRun2
-} from "../chunk-j2bp5ryw.js";
+} from "../chunk-n33z5bjw.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
@@ -42,10 +42,10 @@ import"../chunk-jmfet9r4.js";
 import {
   WebhookRunError2
 } from "../chunk-qf954wje.js";
-import"../chunk-1f7wpmyp.js";
+import"../chunk-rrzt8jdy.js";
 import {
   createPrimitiveExecutionRecord
-} from "../chunk-nre82s12.js";
+} from "../chunk-9dmt152s.js";
 import"../chunk-br3k6qbf.js";
 import {
   isStorageSerializationFailure2

package/dist/workflows/index.js

@@ -8,7 +8,7 @@ import {
   defineWorkflow2,
   createWorkflowNodeFailure2,
   unwrapWorkflowNodeFailure2
-} from "../chunk-85yvv5n0.js";
+} from "../chunk-k6q3n2sc.js";
 import"../chunk-nq6gpjt7.js";
 import"../chunk-fb3feg1e.js";
 import"../chunk-yxd3nnqt.js";
@@ -45,33 +45,33 @@ import {
   snapshotWorkflowActionInput2,
   WorkflowRunDispatcher2,
   requestWorkflowRun2
-} from "../chunk-ey3pyej1.js";
-import"../chunk-t6vq7bff.js";
-import"../chunk-wz0xs816.js";
-import"../chunk-52bk93x8.js";
-import"../chunk-wwdfe68s.js";
-import"../chunk-zrmy8zvw.js";
+} from "../chunk-6c6sn0bh.js";
+import"../chunk-xfs8x8m9.js";
+import"../chunk-tg2cw67r.js";
+import"../chunk-fkgc1wt8.js";
+import"../chunk-4vyr1j8f.js";
+import"../chunk-hjzdd750.js";
 import"../chunk-mfs23znk.js";
-import"../chunk-7mbzgd9m.js";
+import"../chunk-1zq2p6g0.js";
 import"../chunk-99nd4rc1.js";
 import"../chunk-vyf9kfqf.js";
-import"../chunk-4tcx876c.js";
-import"../chunk-d2ync1v3.js";
-import"../chunk-nre82s12.js";
-import"../chunk-j2bp5ryw.js";
+import"../chunk-bx9q3cwv.js";
+import"../chunk-yevzdx4y.js";
+import"../chunk-9dmt152s.js";
+import"../chunk-n33z5bjw.js";
+import"../chunk-9ybhtmg4.js";
 import"../chunk-br3k6qbf.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-1f7wpmyp.js";
+import"../chunk-rrzt8jdy.js";
 import"../chunk-tw03bsmb.js";
-import"../chunk-7kg3k1m9.js";
+import"../chunk-9w055r5b.js";
 import"../chunk-s16apyk9.js";
+import"../chunk-hn2r7z41.js";
 import"../chunk-h89wz928.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-9ybhtmg4.js";
-import"../chunk-hn2r7z41.js";
 import"../chunk-b38szspf.js";
 import"../chunk-a40ad1ft.js";
 import"../chunk-s54c868q.js";
@@ -80,7 +80,7 @@ import"../chunk-rj69qcrd.js";
 import"../chunk-4as3wt1c.js";
 import"../chunk-29yx306f.js";
 import"../chunk-pqajwytd.js";
-import"../chunk-bpgy64fw.js";
+import"../chunk-d09tj99x.js";
 import"../chunk-3qms4nax.js";
 import"../chunk-7n440zgt.js";
 import"../chunk-m427qgq0.js";
@@ -88,22 +88,22 @@ import"../chunk-fa02jy15.js";
 import"../chunk-7t429e3f.js";
 import"../chunk-3zxk45er.js";
 import"../chunk-5a4a52tq.js";
-import"../chunk-6gmfggss.js";
-import"../chunk-bwjcehza.js";
-import"../chunk-rz53yb4v.js";
+import"../chunk-t7x8dmn0.js";
+import"../chunk-way52z4h.js";
+import"../chunk-0yh890a4.js";
 import"../chunk-gc4ntf7d.js";
 import"../chunk-gfdh9kqa.js";
 import"../chunk-pfp1txq2.js";
 import"../chunk-5e43w60z.js";
-import"../chunk-3gnrh4ve.js";
+import"../chunk-vpq4shxz.js";
 import"../chunk-c85m1hyj.js";
 import"../chunk-v9xd5wzd.js";
-import"../chunk-xt1zt7gv.js";
-import"../chunk-2jntasmh.js";
-import"../chunk-y7rqfrgg.js";
+import"../chunk-es1gxsbf.js";
+import"../chunk-hcbyfxbe.js";
+import"../chunk-d0bqz29d.js";
 import"../chunk-v4jbb3rs.js";
 import"../chunk-hvsb78a1.js";
-import"../chunk-enpsx8k5.js";
+import"../chunk-gsjm1wms.js";
 import"../chunk-jhm3zsa7.js";
 import"../chunk-8mx7qw3y.js";
 import"../chunk-z3y5kg1x.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/core",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "The ontology-first runtime for Sixb — objects, links, telemetry, actions, and provider contracts",
   "keywords": [
     "sixb",
@@ -455,6 +455,12 @@
       "import": "./dist/sandboxes/index.js",
       "default": "./dist/sandboxes/index.js"
     },
+    "./security": {
+      "types": "./dist/security/public.d.ts",
+      "bun": "./src/security/public.ts",
+      "import": "./dist/security/public.js",
+      "default": "./dist/security/public.js"
+    },
     "./storage": {
       "types": "./dist/storage/index.d.ts",
       "bun": "./src/storage/index.ts",
@@ -472,7 +478,7 @@
     "build": "bun ../../scripts/build-package.ts",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
-    "test:e2e": "bun ../../scripts/ci-guard.ts --stall 120 --max 600 bun test ./tests/published-artifacts.e2e.ts",
+    "test:e2e": "bun ../../scripts/ci-guard.ts --stall 120 --max 600 bun test ./tests/published-artifacts.e2e.ts ./tests/browser-entries.e2e.ts",
     "prepack": "bun run build"
   },
   "devDependencies": {

package/src/auth/cookies.ts

@@ -1,9 +1,8 @@
-import type { AuthSessionAudience } from "./audience"
-import { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from "./audience"
 import type { AuthCookieOptions } from "./types"
 
-export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session"
-export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf"
+// The names the app's cookies had beside Atlas's, so its sessions survived Atlas leaving.
+export const DEFAULT_SESSION_COOKIE_NAME = "sixb_session_app"
+export const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf_app"
 
 export interface ResolvedAuthCookieOptions {
   readonly sessionCookieName: string
@@ -41,22 +40,6 @@ export function resolveAuthCookieOptions(
   return resolved
 }
 
-export function resolveAuthCookieOptionsForAudience(
-  options: ResolvedAuthCookieOptions,
-  audience: AuthSessionAudience | undefined
-): ResolvedAuthCookieOptions {
-  const resolvedAudience = resolveAuthSessionAudience(audience)
-  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {
-    return options
-  }
-
-  return {
-    ...options,
-    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,
-    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,
-  }
-}
-
 export function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {
   const cookies = new Map<string, string>()
   if (!header) {

package/src/auth/index.ts

@@ -9,12 +9,6 @@ export {
   parseAccessTokenValue,
   SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
 } from "./access-tokens"
-export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
-export {
-  DEFAULT_AUTH_SESSION_AUDIENCE,
-  isValidAuthSessionAudience,
-  resolveAuthSessionAudience,
-} from "./audience"
 export { getRequestClientAddress, setRequestClientAddress } from "./client-address"
 export {
   clearCsrfCookieHeader,

package/src/auth/runtime.ts

@@ -1,9 +1,5 @@
 import { randomUUID } from "node:crypto"
-import {
-  type AuthorizationContext,
-  canAccessApplication,
-  resolveAuthorizationContext,
-} from "../authorization"
+import { type AuthorizationContext, resolveAuthorizationContext } from "../authorization"
 import {
   canPerformMembershipOperation,
   type GroupReference,
@@ -33,13 +29,8 @@ import {
   hashAccessTokenSecret,
   parseAccessTokenValue,
 } from "./access-tokens"
-import { type AuthSessionAudience, DEFAULT_AUTH_SESSION_AUDIENCE } from "./audience"
 import { getRequestClientAddress } from "./client-address"
-import {
-  getCookie,
-  type ResolvedAuthCookieOptions,
-  resolveAuthCookieOptionsForAudience,
-} from "./cookies"
+import { getCookie, type ResolvedAuthCookieOptions } from "./cookies"
 import { AuthRuntimeError } from "./errors"
 import { SessionCache } from "./session-cache"
 import {
@@ -108,7 +99,6 @@ import {
   isInvitationDeliveryAuthStrategy,
   normalizePagination,
   resolveAuthConfig,
-  resolveAuthSessionAudience,
   resolveInvitationExpiresAt,
 } from "./validation"
 
@@ -184,8 +174,8 @@ export class AuthRuntime {
     }
   }
 
-  getCookieOptions(options: AuthSessionResolutionOptions = {}): ResolvedAuthCookieOptions {
-    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience)
+  getCookieOptions(): ResolvedAuthCookieOptions {
+    return this.config.cookies
   }
 
   assertCanServeHttp(params: { readonly production: boolean }): void {
@@ -240,8 +230,6 @@ export class AuthRuntime {
       return { authenticated: false, reason: "auth_disabled" }
     }
 
-    const audience = resolveAuthSessionAudience(options.audience)
-
     if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue(request)
       if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
@@ -257,15 +245,14 @@ export class AuthRuntime {
       }
     }
 
-    return this.resolveCookieSession(request, audience, options.sessionActivity)
+    return this.resolveCookieSession(request, options.sessionActivity)
   }
 
   private async resolveCookieSession(
     request: Request,
-    audience: ReturnType<typeof resolveAuthSessionAudience>,
     activity: AuthSessionResolutionOptions["sessionActivity"]
   ): Promise<AuthSessionResult> {
-    const cookieOptions = this.getCookieOptions({ audience })
+    const cookieOptions = this.getCookieOptions()
     const cookieValue = getCookie(request, cookieOptions.sessionCookieName)
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" }
@@ -283,7 +270,6 @@ export class AuthRuntime {
       sessionId: parts.sessionId,
       tokenHash,
       transport: "cookie",
-      audience,
       nowMs,
     })
     if (cached) {
@@ -298,7 +284,6 @@ export class AuthRuntime {
     let session = await storage.sessions.findValidByTokenHash({
       projectId: this.projectId,
       id: parts.sessionId,
-      audience,
       tokenHash,
       now,
     })
@@ -312,7 +297,6 @@ export class AuthRuntime {
       const renewed = await storage.sessions.renewIfValid({
         projectId: this.projectId,
         id: parts.sessionId,
-        audience,
         tokenHash,
         now,
         expiresAt: this.getRenewedSessionExpiresAt(session, nowMs),
@@ -388,7 +372,6 @@ export class AuthRuntime {
     this.sessionCache?.set({
       sessionId: session.id,
       tokenHash,
-      audience: session.audience,
       session: result,
       nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
@@ -418,8 +401,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         userId: input.userId,
         strategyId: "device",
-        // A native session belongs to no web app. The column needs a value; nothing reads it.
-        audience: DEFAULT_AUTH_SESSION_AUDIENCE,
         tokenHash: tokens.tokenHash,
         createdAt: input.now,
         ...this.createSessionDeadlines(input.now),
@@ -712,6 +693,11 @@ export class AuthRuntime {
     caller: AuthenticatedUserRequestSession
   ): Promise<ListServiceAccountsResult> {
     const storage = this.requireAuthStorage()
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      return { serviceAccounts: [] }
+    }
+
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
       order: "desc",
@@ -724,11 +710,11 @@ export class AuthRuntime {
       }))
     )
 
-    // A caller only sees the service accounts it is allowed to manage, so
-    // listing never leaks the groups of more-privileged accounts.
+    // A caller only sees the service accounts its membership policies cover, so
+    // listing never leaks the groups of accounts outside its scope.
     return {
       serviceAccounts: withGroups.filter(({ groupIds }) =>
-        callerCanManageServiceAccount(caller.groupIds, groupIds)
+        canPerformMembershipOperation(scope, "serviceAccounts", groupIds)
       ),
     }
   }
@@ -738,11 +724,9 @@ export class AuthRuntime {
     input: CreateServiceAccountInput
   ): Promise<CreateServiceAccountResult> {
     const storage = this.requireAuthStorage()
-    // A caller can only place a service account in groups it itself belongs to.
-    const groupIds =
-      constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
-        subject: "service account",
-      }) ?? []
+    // A caller can only place a service account in groups its `serviceAccounts` policies cover.
+    const groupIds = normalizeRequestedGroupIds(input.groupIds) ?? []
+    this.assertCanManageServiceAccountGroups(caller.groupIds, groupIds)
     const now = new Date()
     const serviceAccount = await storage.serviceAccounts.create({
       id: input.id ?? `svc_${randomUUID()}`,
@@ -829,8 +813,8 @@ export class AuthRuntime {
     }
 
     // The token can only carry groups the service account already holds; the
-    // manageability check above guarantees those are a subset of the caller's
-    // own groups, so the caller can never mint privileges it lacks.
+    // manageability check above guarantees those are within the caller's
+    // `serviceAccounts` scope, so the token never reaches past that scope.
     const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
       subject: "service account token",
     })
@@ -888,12 +872,10 @@ export class AuthRuntime {
   /**
    * Resolve a service account the caller is allowed to manage.
    *
-   * A caller may manage a service account only when it belongs to every group
-   * the account is in ("you can manage what you could have created"). This
-   * confines token minting, disabling, and revocation to privileges the caller
-   * already holds and prevents a service-account token from outliving the
-   * caller's own access. Missing and non-manageable accounts raise the same
-   * error so callers cannot probe which privileged accounts exist.
+   * A caller needs a membership policy with the `serviceAccounts` operation whose scope covers every
+   * group the account is in ("you can manage what you could have created"). This confines token
+   * minting, disabling, and revocation to the groups the project's policies hand out. Missing and
+   * out-of-scope accounts raise the same error so callers cannot probe which accounts exist.
    */
   private async requireManageableServiceAccount(
     storage: AuthStorage,
@@ -903,6 +885,11 @@ export class AuthRuntime {
     readonly serviceAccount: ServiceAccountRecord
     readonly groupIds: readonly string[]
   }> {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
       id: serviceAccountId,
@@ -911,7 +898,7 @@ export class AuthRuntime {
       ? await this.listServiceAccountGroupIds(storage, serviceAccountId)
       : []
 
-    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+    if (!serviceAccount || !canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
       throw new AuthStorageError(
         "missing_service_account",
         `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`
@@ -975,6 +962,7 @@ export class AuthRuntime {
     return {
       // The member-admin edit-groups dialog assigns from the `assignGroups` scope.
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      serviceAccountGroups: this.scopedGroupOptions(scope.operations.serviceAccounts.groupIds),
       capabilities: membershipCapabilities(scope).holds,
     }
   }
@@ -1163,7 +1151,7 @@ export class AuthRuntime {
     return { user: reactivated, groupIds, managedGroupIds }
   }
 
-  /** The caller's active sessions across every audience, most recently active first. */
+  /** The caller's active sessions, most recently active first. */
   async listSessions(caller: AuthenticatedUserRequestSession): Promise<readonly SessionRecord[]> {
     return this.requireAuthStorage().sessions.listActiveByUserId({
       projectId: this.projectId,
@@ -1195,7 +1183,7 @@ export class AuthRuntime {
     return true
   }
 
-  /** End every active session of the caller, across audiences. Returns how many ended. */
+  /** End every active session of the caller. Returns how many ended. */
   async revokeAllSessions(caller: AuthenticatedUserRequestSession): Promise<number> {
     const revoked = await this.requireAuthStorage().sessions.revokeActiveForUser({
       projectId: this.projectId,
@@ -1284,7 +1272,6 @@ export class AuthRuntime {
     }
 
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now)
-    this.assertInvitationApplicationAccess(groupIds, destination.audience)
 
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID()}`,
@@ -1304,7 +1291,6 @@ export class AuthRuntime {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: destination.audience,
         returnTo: destination.returnTo,
         requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
@@ -1451,27 +1437,6 @@ export class AuthRuntime {
     return { state: "enabled" }
   }
 
-  private assertInvitationApplicationAccess(
-    groupIds: readonly string[],
-    audience: AuthSessionAudience
-  ): void {
-    // Check only the groups this invitation assigns. Existing memberships may
-    // be outside the caller's policy scope and must not affect this response.
-    const roles = this.security.listResolvedRoles()
-    const authorization = resolveAuthorizationContext({
-      principal: { type: "user", id: "invited-user" },
-      groupIds,
-      roles,
-    })
-
-    if (canAccessApplication(authorization, roles, audience)) return
-
-    throw new AuthRuntimeError(
-      "authorization_denied",
-      `[Sixb] Invitation groups do not grant access to application '${audience}'.`
-    )
-  }
-
   private async assertCanInviteRecipient(
     strategy: InvitationDeliveryAuthStrategy,
     authStorage: AuthStorage,
@@ -1524,6 +1489,27 @@ export class AuthRuntime {
     )
   }
 
+  private assertCanManageServiceAccountGroups(
+    callerGroupIds: readonly string[],
+    groupIds: readonly string[]
+  ): void {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds)
+
+    if (canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
+      return
+    }
+
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError()
+    }
+
+    const missing = missingMembershipGroupIds(scope, "serviceAccounts", groupIds)
+    throw new AuthRuntimeError(
+      "authorization_denied",
+      `[Sixb] The current user is not allowed to place service accounts in group(s): ${missing.join(", ")}.`
+    )
+  }
+
   private assertCanManageInvitationGroups(
     callerGroupIds: readonly string[],
     groupIds: readonly string[]
@@ -1590,15 +1576,11 @@ function constrainTokenGroupIds(
   return principalGroupIds.filter((groupId) => allowed.has(groupId))
 }
 
-// A caller may manage a service account only when it belongs to every group the
-// account is in, so managing it can never grant more than the caller already
-// has. An account with no groups is powerless and therefore freely manageable.
-function callerCanManageServiceAccount(
-  callerGroupIds: readonly string[],
-  serviceAccountGroupIds: readonly string[]
-): boolean {
-  const callerGroups = new Set(callerGroupIds)
-  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId))
+function missingServiceAccountsPolicyError(): AuthRuntimeError {
+  return new AuthRuntimeError(
+    "authorization_denied",
+    "[Sixb] Managing service accounts needs a membership policy with the 'serviceAccounts' operation."
+  )
 }
 
 function missingAccessTokenError(tokenId: string, projectId: string): AuthStorageError {
@@ -1701,6 +1683,7 @@ function membershipCapabilities(scope: MembershipPolicyScope): MembershipCapabil
       invite: scope.operations.invite.policyIds.length > 0,
       assignGroups: scope.operations.assignGroups.policyIds.length > 0,
       suspend: scope.operations.suspend.policyIds.length > 0,
+      serviceAccounts: scope.operations.serviceAccounts.policyIds.length > 0,
     },
     assignableGroupIds: [...scope.operations.assignGroups.groupIds],
     covers: (operation, memberGroups) =>

package/src/auth/session-cache.ts

@@ -1,10 +1,8 @@
-import type { AuthSessionAudience } from "./audience"
 import type { AuthenticatedAuthSession } from "./types"
 
 interface SessionCacheEntry {
   readonly tokenHash: string
   readonly transport: "cookie" | "bearer"
-  readonly audience: AuthSessionAudience
   readonly session: AuthenticatedAuthSession
   readonly expiresAtMs: number
 }
@@ -14,15 +12,12 @@ export interface SessionCacheGetInput {
   readonly tokenHash: string
   /** A cookie is only ever answered from a cookie entry, and a bearer token from a bearer entry. */
   readonly transport: "cookie" | "bearer"
-  /** The browser audience a cookie was read for. Bearer sessions carry their own. */
-  readonly audience?: AuthSessionAudience
   readonly nowMs: number
 }
 
 export interface SessionCacheSetInput {
   readonly sessionId: string
   readonly tokenHash: string
-  readonly audience: AuthSessionAudience
   readonly nowMs: number
   readonly session: AuthenticatedAuthSession
   readonly sessionExpiresAtMs: number
@@ -38,7 +33,7 @@ export interface SessionCacheSetInput {
  * API stalls. Caching the resolved result for a short TTL collapses those reads to one
  * per session per window.
  *
- * Safety: entries are pinned to the exact token hash, transport, and audience that produced them and
+ * Safety: entries are pinned to the exact token hash and transport that produced them and
  * are never served past the session's rolling or absolute deadline. The short TTL bounds how long
  * a revoked session can linger; sign-out additionally invalidates eagerly via
  * {@link SessionCache.invalidate}.
@@ -60,8 +55,7 @@ export class SessionCache {
     if (
       entry.expiresAtMs <= input.nowMs ||
       entry.tokenHash !== input.tokenHash ||
-      entry.transport !== input.transport ||
-      (input.audience !== undefined && entry.audience !== input.audience)
+      entry.transport !== input.transport
     ) {
       this.entries.delete(input.sessionId)
       return undefined
@@ -88,7 +82,6 @@ export class SessionCache {
     this.entries.set(input.sessionId, {
       tokenHash: input.tokenHash,
       transport: bearer ? "bearer" : "cookie",
-      audience: input.audience,
       session: input.session,
       expiresAtMs,
     })