@sixb/core 0.1.19 → 0.1.20

package/src/security/grants.ts

@@ -1,7 +1,7 @@
 /**
  * Grant builders for role definitions.
  *
- * Grants are plain data referencing application and runtime definitions
+ * Grants are plain data referencing runtime definitions
  * by id. They carry no enforcement logic — the authorization engine expands
  * each grant's selection into per-principal id sets at startup, so runtime
  * checks stay simple `set.has(id)` lookups.
@@ -31,10 +31,8 @@ import {
   isBreadthSelector,
 } from "./every"
 import type {
-  AccessGrant,
   AgentRunGrant,
   AppendGrant,
-  ApplicationDefinition,
   ApplyGrant,
   EditGrant,
   ManageGrant,
@@ -54,7 +52,7 @@ const VIEW_TARGETS = ["object", "dataset"] as const
 const RUN_TARGETS = ["workflow", "sync", "pipeline"] as const
 
 /**
- * Seven of the nine targets carry a `kind` discriminant naming themselves. The other two — an
+ * Six of the eight targets carry a `kind` discriminant naming themselves. The other two — an
  * `ObjectType` and an `ActionDefinition` — carry none, and each appears in exactly one builder that
  * allows no other undiscriminated target, so the allowed set names them unambiguously.
  */
@@ -63,7 +61,6 @@ const TARGET_BY_DEFINITION_KIND: Readonly<Partial<Record<string, BreadthTarget>>
   sync: "sync",
   pipeline: "pipeline",
   workflow: "workflow",
-  application: "application",
   connector: "connector",
   share: "share",
 }
@@ -82,7 +79,7 @@ function targetOfDefinition<TTarget extends BreadthTarget>(
   // `spec.universeKey` with a `TypeError` naming neither the role nor the definition.
   if (discriminated) {
     if (!isAllowedTarget(discriminated, allowedTargets)) {
-      // "one targeting x", not "a x definition": four of the eight targets start with a vowel, and
+      // "one targeting x", not "a x definition": object and action start with a vowel, and
       // this string ships in a release. Same reason the selector branch below writes no article.
       throw new SecurityValidationError(
         `[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`
@@ -158,11 +155,6 @@ function resolveGrant<TDefinition extends { readonly id?: unknown }, TTarget ext
   return { target, selection: { all: false, ids } }
 }
 
-function access(input: GrantInput<ApplicationDefinition, "application">): AccessGrant {
-  const { selection } = resolveGrant(input, "can.access", ["application"])
-  return { kind: "grant", capability: "access", target: "application", selection }
-}
-
 function view<const TObjectTypeId extends string>(
   input: ShareTarget<TObjectTypeId>
 ): ShareViewGrantBuilder<TObjectTypeId>
@@ -270,13 +262,7 @@ function observe(input: "logs" | AgentUsageReference): ObserveGrant {
   if (input !== "logs" && !isAgentUsageReference(input)) {
     throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.')
   }
-  const target = input === "logs" ? "logs" : "aiUsage"
-  return {
-    kind: "grant",
-    capability: "observe",
-    target,
-    selection: { all: false, ids: [target] },
-  }
+  return { kind: "grant", capability: "observe", target: input === "logs" ? "logs" : "aiUsage" }
 }
 
 function manage(input: GrantInput<ConnectorDefinition, "connector">): ManageGrant<"connector">
@@ -285,12 +271,7 @@ function manage(
   input: GrantInput<ConnectorDefinition, "connector"> | AgentUsageReference
 ): ManageGrant {
   if (isAgentUsageReference(input)) {
-    return {
-      kind: "grant",
-      capability: "manage",
-      target: "aiUsage",
-      selection: { all: false, ids: ["aiUsage"] },
-    }
+    return { kind: "grant", capability: "manage", target: "aiUsage" }
   }
   return {
     kind: "grant",
@@ -301,7 +282,6 @@ function manage(
 }
 
 export const can = {
-  access,
   view,
   edit,
   append,

package/src/security/index.ts

@@ -1,4 +1,3 @@
-export { applications } from "./applications"
 export type {
   DefineGroupOptions,
   DefineMarkingOptions,
@@ -20,10 +19,8 @@ export {
 export type { SecurityDefinitionCatalog, SecurityRegistryOptions } from "./registry"
 export { SecurityRegistry } from "./registry"
 export type {
-  AccessGrant,
   AgentRunGrant,
   AppendGrant,
-  ApplicationDefinition,
   ApplyGrant,
   EditGrant,
   GrantCapability,

package/src/security/membership-policies.ts

@@ -10,7 +10,7 @@ export interface MembershipPolicyScope {
   readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>
 }
 
-const MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"] as const
+const MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend", "serviceAccounts"] as const
 
 export function resolveMembershipPolicyScope(input: {
   readonly membershipPolicies: readonly MembershipPolicyDefinition[]
@@ -40,6 +40,7 @@ export function resolveMembershipPolicyScope(input: {
       invite: freezeOperationScope(operations.invite),
       assignGroups: freezeOperationScope(operations.assignGroups),
       suspend: freezeOperationScope(operations.suspend),
+      serviceAccounts: freezeOperationScope(operations.serviceAccounts),
     },
   }
 }
@@ -83,6 +84,7 @@ function createEmptyOperationScopes(): Record<
     invite: { policyIds: [], groupIds: new Set<string>() },
     assignGroups: { policyIds: [], groupIds: new Set<string>() },
     suspend: { policyIds: [], groupIds: new Set<string>() },
+    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },
   }
 }
 

package/src/security/public.ts

@@ -0,0 +1,10 @@
+/**
+ * Browser-safe security entrypoint (`@sixb/core/security`).
+ *
+ * Group files import `defineGroup` from here, because an app layout imports groups to decide who
+ * sees which screens, and the browser cannot load the `@sixb/core` root.
+ */
+
+export type { DefineGroupOptions } from "./builders"
+export { defineGroup } from "./builders"
+export type { GroupDefinition } from "./types"

package/src/security/registry.ts

@@ -1,5 +1,4 @@
 import { type ResolvedRole, resolveRoleGrants } from "../authorization"
-import { APPLICATION_IDS } from "./applications"
 import type {
   GroupDefinition,
   MarkingDefinition,
@@ -26,7 +25,6 @@ export interface SecurityRegistryOptions {
   readonly groups?: readonly GroupDefinition[]
   readonly roles?: readonly RoleDefinition[]
   readonly membershipPolicies?: readonly MembershipPolicyDefinition[]
-  readonly applicationIds?: ReadonlySet<string>
   readonly objectTypeIds?: ReadonlySet<string>
   readonly datasetIds?: ReadonlySet<string>
   readonly actionIds?: ReadonlySet<string>
@@ -52,7 +50,6 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds,
       datasetIds: input.datasetIds,
       actionIds: input.actionIds,
@@ -61,13 +58,10 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       pipelineIds: input.pipelineIds,
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds,
     })
 
     const universe = {
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds ?? new Set<string>(),
       datasetIds: input.datasetIds ?? new Set<string>(),
       actionIds: input.actionIds ?? new Set<string>(),
@@ -75,8 +69,6 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       syncIds: input.syncIds ?? new Set<string>(),
       pipelineIds: input.pipelineIds ?? new Set<string>(),
       connectorIds: input.connectorIds ?? new Set<string>(),
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds ?? new Set<string>(),
       getSubTypes: input.getSubTypes ?? (() => []),
     }

package/src/security/types.ts

@@ -1,5 +1,3 @@
-import type { AuthSessionAudience } from "../auth/audience"
-
 export interface GroupDefinition<TId extends string = string> {
   readonly kind: "group"
   readonly id: TId
@@ -48,19 +46,6 @@ export type Selection =
   | { readonly all: true; readonly except: readonly string[] }
   | { readonly all: false; readonly ids: readonly string[] }
 
-export interface ApplicationDefinition<TId extends AuthSessionAudience = AuthSessionAudience> {
-  readonly kind: "application"
-  readonly id: TId
-  readonly label: string
-}
-
-export interface AccessGrant {
-  readonly kind: "grant"
-  readonly capability: "access"
-  readonly target: "application"
-  readonly selection: Selection
-}
-
 export type ViewGrantTarget = "object" | "dataset"
 
 export interface ViewGrant<TTarget extends ViewGrantTarget = ViewGrantTarget> {
@@ -133,25 +118,34 @@ export interface AgentRunGrant {
 
 export type ObserveGrantTarget = "logs" | "aiUsage"
 
+/** Read the project's logs or its AI usage. Each is one surface, so there is nothing to select. */
 export interface ObserveGrant {
   readonly kind: "grant"
   readonly capability: "observe"
   readonly target: ObserveGrantTarget
-  readonly selection: Selection
 }
 
 export type ManageGrantTarget = "connector" | "aiUsage"
 
-/** Manage a selected connector or the project's AI usage-limit policies. */
-export interface ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> {
-  readonly kind: "grant"
-  readonly capability: "manage"
-  readonly target: TTarget
-  readonly selection: Selection
-}
+/**
+ * Manage the selected connectors, or the project's AI usage-limit policies. AI usage is one
+ * surface, so its grant selects nothing.
+ */
+export type ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> =
+  TTarget extends "connector"
+    ? {
+        readonly kind: "grant"
+        readonly capability: "manage"
+        readonly target: TTarget
+        readonly selection: Selection
+      }
+    : {
+        readonly kind: "grant"
+        readonly capability: "manage"
+        readonly target: TTarget
+      }
 
 export type GrantDefinition =
-  | AccessGrant
   | ViewGrant
   | EditGrant
   | AppendGrant
@@ -175,7 +169,7 @@ export interface RoleDefinition<TId extends string = string> {
   readonly clearances?: readonly string[]
 }
 
-export type MembershipOperation = "invite" | "assignGroups" | "suspend"
+export type MembershipOperation = "invite" | "assignGroups" | "suspend" | "serviceAccounts"
 
 export interface MembershipPolicyDefinition<TId extends string = string> {
   readonly kind: "membershipPolicy"

package/src/security/validation.ts

@@ -1,4 +1,9 @@
-import { GRANT_KINDS, type GrantUniverseKey, grantKindOf } from "../authorization/grant-kinds"
+import {
+  GRANT_KINDS,
+  type GrantUniverseKey,
+  grantKindOf,
+  isSingletonGrantKind,
+} from "../authorization/grant-kinds"
 import { SecurityValidationError } from "./errors"
 import { isMembershipOperation } from "./membership-policies"
 import type {
@@ -22,11 +27,10 @@ type RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>
  *
  * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added
  * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The
- * hand-written `capability !== "access" && …` chain this replaces would have accepted the new
+ * hand-written `capability !== "view" && …` chain this replaces would have accepted the new
  * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.
  */
 const GRANT_CAPABILITIES = Object.keys({
-  access: true,
   view: true,
   edit: true,
   append: true,
@@ -102,7 +106,7 @@ function assertMembershipOperationArray(
   for (const item of value) {
     if (!isMembershipOperation(item)) {
       throw createError(
-        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`
+        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`
       )
     }
   }
@@ -231,10 +235,6 @@ export function assertGrantDefinition(
     )
   }
 
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`)
-  }
-
   if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
     throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)
   }
@@ -259,9 +259,13 @@ export function assertGrantDefinition(
     throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)
   }
 
-  if (value.capability === "run" && value.target === "agent") {
+  // The agent, logs and AI usage are one surface each, so their grants select nothing. The checks
+  // above settled the capability and target, so the kind is known.
+  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {
     if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`)
+      throw createError(
+        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`
+      )
     }
     return
   }
@@ -332,8 +336,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly groups: readonly GroupDefinition[]
   readonly membershipPolicies: readonly MembershipPolicyDefinition[]
   readonly roles?: readonly RoleDefinition[]
-  /** Registered browser application ids — when provided, access grants must reference them. */
-  readonly applicationIds?: ReadonlySet<string>
   /** Registered object type ids — when provided, view grants must reference them. */
   readonly objectTypeIds?: ReadonlySet<string>
   /** Registered dataset ids — when provided, dataset view grants must reference them. */
@@ -348,10 +350,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly pipelineIds?: ReadonlySet<string>
   /** Whether the project's single conversational Agent is configured. */
   readonly agentAvailable?: boolean
-  /** Registered observability surfaces. */
-  readonly observableIds?: ReadonlySet<string>
-  /** Registered singleton management surfaces. */
-  readonly manageableIds?: ReadonlySet<string>
   /** Registered connector ids — when provided, manage grants must reference them. */
   readonly connectorIds?: ReadonlySet<string>
   /** Registered Share ids — when provided, share grants must reference them. */
@@ -496,7 +494,11 @@ function assertGrantReferences(
     }
     return
   }
-  const spec = GRANT_KINDS[grantKindOf(grant)]
+  // Logs and AI usage are always there; only targeted grants name ids to check.
+  if (!("selection" in grant)) return
+  const kind = grantKindOf(grant)
+  if (isSingletonGrantKind(kind)) return
+  const spec = GRANT_KINDS[kind]
   const universe = registered[spec.universeKey]
 
   if (!universe) {

package/src/storage/agents/types.ts

@@ -172,7 +172,7 @@ export const AGENT_RUN_DIAGNOSTIC_CODES = [
  *
  * Sixb writes these codes and the generated client is what reads them, so an open union would only
  * be honest if the HTTP schema were open too — and that costs the OpenAPI enum, the client's
- * autocompletion, and Atlas's exhaustive `switch`. Sixb owns both ends, so a new code is a minor
+ * autocompletion, and the app's exhaustive `switch`. Sixb owns both ends, so a new code is a minor
  * version bump: cheap here, and a broken `switch` is better than a 500 from `z.enum`.
  */
 export type AgentRunDiagnosticCode = (typeof AGENT_RUN_DIAGNOSTIC_CODES)[number]

package/src/storage/auth/in-memory/auth-storage.ts

@@ -222,7 +222,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -353,7 +352,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -555,7 +553,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -587,18 +584,3 @@ function restoreMap<TKey, TValue>(target: Map<TKey, TValue>, snapshot: Map<TKey,
     target.set(key, value)
   }
 }
-
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}

package/src/storage/auth/in-memory/magic-links.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type { AuthMagicLinkStore, CreateAuthMagicLinkInput, MagicLinkRecord } from "../types"
 import type { AuthStorageState } from "./shared"
@@ -22,7 +21,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
     const id = assertNonEmpty(input.id, "Magic link id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const email = normalizeEmail(input.email)
     const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
     const key = magicLinkKey(projectId, id)
@@ -40,7 +38,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
       id,
       projectId,
       strategyId,
-      audience,
       email,
       tokenHash,
       returnTo: input.returnTo,

package/src/storage/auth/in-memory/oidc-attempts.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthOidcAuthorizationAttemptStore,
@@ -26,7 +25,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -43,7 +41,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
       id,
       projectId,
       strategyId,
-      audience,
       stateHash,
       nonceHash,
       codeVerifier,

package/src/storage/auth/in-memory/sessions.ts

@@ -1,4 +1,3 @@
-import type { AuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthSessionStore,
@@ -11,7 +10,6 @@ import {
   cloneDate,
   cloneOptionalRecord,
   cloneRecord,
-  compareByCreatedAt,
   createSessionRecord,
   isActiveSession,
   revokeActiveSessionsForUser,
@@ -33,22 +31,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     return cloneOptionalRecord(record)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const sessions = [...this.state.sessions.values()]
-      .filter((session) => session.projectId === params.projectId)
-      .filter((session) => session.userId === params.userId)
-      .filter((session) => session.audience === params.audience)
-      .filter((session) => isActiveSession(session, params.now))
-      .sort((a, b) => compareByCreatedAt(a, b, "desc"))
-
-    return cloneOptionalRecord(sessions[0] ?? null)
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -71,7 +53,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -79,7 +60,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -153,7 +133,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -163,7 +142,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -208,15 +186,13 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return revokeActiveSessionsForUser(
       this.state,
       params.projectId,
       params.userId,
-      params.revokedAt,
-      params.audience
+      params.revokedAt
     ).map(cloneRecord)
   }
 

package/src/storage/auth/in-memory/shared.ts

@@ -1,4 +1,3 @@
-import { type AuthSessionAudience, resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AccessTokenRecord,
@@ -213,8 +212,7 @@ export function revokeActiveSessionsForUser(
   state: AuthStorageState,
   projectId: string,
   userId: string,
-  revokedAt: Date,
-  audience?: AuthSessionAudience
+  revokedAt: Date
 ): readonly SessionRecord[] {
   const revoked: SessionRecord[] = []
 
@@ -223,10 +221,6 @@ export function revokeActiveSessionsForUser(
       continue
     }
 
-    if (audience !== undefined && session.audience !== audience) {
-      continue
-    }
-
     if (!isActiveSession(session, revokedAt)) {
       continue
     }
@@ -290,7 +284,6 @@ export function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): void {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   assertSessionIdAvailable(state, projectId, sessionId)
 }
@@ -303,7 +296,6 @@ export function createSessionRecord(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = resolveAuthSessionAudience(input.audience)
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   assertSessionIdAvailable(state, projectId, id)
@@ -313,7 +305,6 @@ export function createSessionRecord(
     projectId,
     userId,
     strategyId,
-    audience,
     tokenHash,
     createdAt: cloneDate(input.createdAt),
     expiresAt: cloneDate(input.expiresAt),