@sixb/core 0.1.19 → 0.1.20

package/src/storage/auth/types.ts

@@ -1,4 +1,4 @@
-import type { AccessTokenKind, AuthSessionAudience, Principal } from "../../auth"
+import type { AccessTokenKind, Principal } from "../../auth"
 import type { AuthorizablePrincipal } from "../../execution/types"
 
 export type UserStatus = "active" | "suspended"
@@ -57,7 +57,6 @@ export interface SessionRecord {
   readonly userId: string
   readonly strategyId: string
   /** The web app a browser session belongs to. A bearer session belongs to none and ignores it. */
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -142,7 +141,6 @@ export interface MagicLinkRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -156,7 +154,6 @@ export interface OidcAuthorizationAttemptRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -288,7 +285,6 @@ export interface CreateAuthSessionInput {
   readonly projectId: string
   readonly userId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -330,7 +326,6 @@ export interface ListAuthAccessTokensResult {
 
 export interface CompleteAuthSessionInput {
   readonly id: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -379,7 +374,6 @@ export interface CreateAuthMagicLinkInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -391,7 +385,6 @@ export interface CreateOidcAuthorizationAttemptInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -536,13 +529,7 @@ export interface AuthSessionStore {
     readonly projectId: string
     readonly id: string
   }): Promise<SessionRecord | null>
-  getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null>
-  // All active sessions for a user across every audience, most-recently-active
+  // All active sessions for a user, most-recently-active
   // first. Backs the active-sessions view.
   listActiveByUserId(params: {
     readonly projectId: string
@@ -553,7 +540,6 @@ export interface AuthSessionStore {
   findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null>
@@ -585,7 +571,6 @@ export interface AuthSessionStore {
   renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -598,7 +583,6 @@ export interface AuthSessionStore {
   revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]>
   touch(params: {

package/src/testing/auth-storage-contract.ts

@@ -24,12 +24,10 @@ function at(value: string): Date {
 function sessionInput(
   id: string,
   tokenHash = `${id}-hash`,
-  audience: CompleteAuthSessionInput["audience"] = "atlas",
   absoluteExpiresAt?: Date
 ): CompleteAuthSessionInput {
   return {
     id,
-    audience,
     tokenHash,
     createdAt: at("2026-05-14T10:10:00.000Z"),
     expiresAt: at("2026-05-21T10:10:00.000Z"),
@@ -43,7 +41,6 @@ function bearerSessionInput(id: string) {
     projectId,
     userId: "usr_1",
     strategyId: "magic-link",
-    audience: "atlas" as const,
     tokenHash: "access-1",
     createdAt: at("2026-05-14T10:00:00.000Z"),
     expiresAt: at("2026-06-14T10:00:00.000Z"),
@@ -89,7 +86,6 @@ async function completeOidcSignInForAva(
     id: "oidc_directory",
     projectId,
     strategyId: "entra",
-    audience: "atlas",
     stateHash: "directory-state",
     nonceHash: "nonce-hash",
     codeVerifier: "verifier",
@@ -201,7 +197,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -211,13 +206,12 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-2",
           createdAt: at("2026-05-14T10:05:00.000Z"),
           expiresAt: at("2026-05-21T10:05:00.000Z"),
         })
 
-        // Creating a second session in the same audience no longer revokes the
+        // Creating a second session no longer revokes the
         // first: both stay active and authenticate independently.
         expect(first.revokedAt).toBeUndefined()
         expect(second.revokedAt).toBeUndefined()
@@ -228,7 +222,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_1",
-            audience: "atlas",
             tokenHash: "hash-1",
             now: at("2026-05-14T10:06:00.000Z"),
           })
@@ -237,7 +230,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "hash-2",
             now: at("2026-05-14T10:06:00.000Z"),
           })
@@ -246,22 +238,11 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "wrong",
             now: at("2026-05-14T10:06:00.000Z"),
           })
         ).resolves.toBeNull()
 
-        // getActiveByUserId returns the most recently created active session.
-        await expect(
-          storage.sessions.getActiveByUserId({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            now: at("2026-05-14T10:06:00.000Z"),
-          })
-        ).resolves.toMatchObject({ id: "ses_2" })
-
         const touched = await storage.sessions.touch({
           projectId,
           id: second.id,
@@ -270,28 +251,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         expect(touched.lastSeenAt?.toISOString()).toBe("2026-05-15T10:00:00.000Z")
         expect(touched.expiresAt.toISOString()).toBe("2026-05-21T10:05:00.000Z")
 
-        // A session in a different audience coexists and is cookie-scoped.
-        const appSession = await storage.sessions.create({
-          id: "ses_app",
-          projectId,
-          userId: "usr_1",
-          strategyId: "magic-link",
-          audience: "app",
-          tokenHash: "hash-app",
-          createdAt: at("2026-05-14T10:06:00.000Z"),
-          expiresAt: at("2026-05-21T10:06:00.000Z"),
-        })
-        expect(appSession.revokedAt).toBeUndefined()
-        await expect(
-          storage.sessions.findValidByTokenHash({
-            projectId,
-            id: "ses_app",
-            audience: "atlas",
-            tokenHash: "hash-app",
-            now: at("2026-05-14T10:07:00.000Z"),
-          })
-        ).resolves.toBeNull()
-
         // Revoking a single session leaves the user's other sessions active.
         await storage.sessions.revoke({
           projectId,
@@ -302,7 +261,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_1",
-            audience: "atlas",
             tokenHash: "hash-1",
             now: at("2026-05-14T10:09:00.000Z"),
           })
@@ -311,28 +269,26 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_2",
-            audience: "atlas",
             tokenHash: "hash-2",
             now: at("2026-05-14T10:09:00.000Z"),
           })
         ).resolves.toMatchObject({ id: "ses_2" })
 
         // "Sign out everywhere": revokeActiveForUser clears every remaining
-        // active session for the user, across audiences.
+        // active session for the user.
         const revoked = await storage.sessions.revokeActiveForUser({
           projectId,
           userId: "usr_1",
           revokedAt: at("2026-05-14T10:10:00.000Z"),
         })
-        expect(revoked.map((entry) => entry.id).sort()).toEqual(["ses_2", "ses_app"])
+        expect(revoked.map((entry) => entry.id).sort()).toEqual(["ses_2"])
         await expect(
-          storage.sessions.getActiveByUserId({
+          storage.sessions.listActiveByUserId({
             projectId,
             userId: "usr_1",
-            audience: "atlas",
             now: at("2026-05-14T10:11:00.000Z"),
           })
-        ).resolves.toBeNull()
+        ).resolves.toEqual([])
       })
     })
 
@@ -344,7 +300,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-capped",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -355,7 +310,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-uncapped",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -367,7 +321,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: capped.id,
-            audience: "atlas",
             tokenHash: "hash-capped",
             now: at("2026-05-16T09:59:59.999Z"),
           })
@@ -376,7 +329,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: capped.id,
-            audience: "atlas",
             tokenHash: "hash-capped",
             now: at("2026-05-16T10:00:00.000Z"),
           })
@@ -387,22 +339,13 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           now: at("2026-05-16T10:00:00.000Z"),
         })
         expect(active.map((session) => session.id)).toEqual([uncapped.id])
-        await expect(
-          storage.sessions.getActiveByUserId({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            now: at("2026-05-16T10:00:00.000Z"),
-          })
-        ).resolves.toBeNull()
-        await expect(
-          storage.sessions.revokeActiveForUser({
-            projectId,
-            userId: "usr_1",
-            audience: "atlas",
-            revokedAt: at("2026-05-16T10:00:00.000Z"),
-          })
-        ).resolves.toEqual([])
+        // A session past its absolute deadline is no longer active, so there is nothing to revoke.
+        const revoked = await storage.sessions.revokeActiveForUser({
+          projectId,
+          userId: "usr_1",
+          revokedAt: at("2026-05-16T10:00:00.000Z"),
+        })
+        expect(revoked.map((session) => session.id)).toEqual([uncapped.id])
       })
     })
 
@@ -414,7 +357,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-renew",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-15T10:00:00.000Z"),
@@ -424,7 +366,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         const renewed = await storage.sessions.renewIfValid({
           projectId,
           id: "ses_renew",
-          audience: "atlas",
           tokenHash: "hash-renew",
           now: at("2026-05-14T11:00:00.000Z"),
           expiresAt: at("2026-05-25T10:00:00.000Z"),
@@ -435,7 +376,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         const monotonic = await storage.sessions.renewIfValid({
           projectId,
           id: "ses_renew",
-          audience: "atlas",
           tokenHash: "hash-renew",
           now: at("2026-05-14T12:00:00.000Z"),
           expiresAt: at("2026-05-18T10:00:00.000Z"),
@@ -446,7 +386,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_renew",
-            audience: "atlas",
             tokenHash: "wrong-hash",
             now: at("2026-05-14T13:00:00.000Z"),
             expiresAt: at("2026-05-19T10:00:00.000Z"),
@@ -456,7 +395,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_renew",
-            audience: "atlas",
             tokenHash: "hash-renew",
             now: at("2026-05-20T10:00:00.000Z"),
             expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -468,7 +406,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-concurrent",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-15T10:00:00.000Z"),
@@ -477,7 +414,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_concurrent",
-            audience: "atlas",
             tokenHash: "hash-concurrent",
             now: at("2026-05-14T11:00:00.000Z"),
             expiresAt: at("2026-05-18T10:00:00.000Z"),
@@ -485,7 +421,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.renewIfValid({
             projectId,
             id: "ses_concurrent",
-            audience: "atlas",
             tokenHash: "hash-concurrent",
             now: at("2026-05-14T11:00:00.000Z"),
             expiresAt: at("2026-05-19T10:00:00.000Z"),
@@ -505,7 +440,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-device",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -527,7 +461,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-plain",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -537,7 +470,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("lists a user's active sessions across audiences, newest activity first", async () => {
+    test("lists a user's active sessions, newest activity first", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)
 
@@ -546,7 +479,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-a",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -556,7 +488,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-b",
           createdAt: at("2026-05-14T10:05:00.000Z"),
           expiresAt: at("2026-05-21T10:05:00.000Z"),
@@ -568,7 +499,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-revoked",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),
@@ -586,7 +516,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_2",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-other",
           createdAt: at("2026-05-14T10:03:00.000Z"),
           expiresAt: at("2026-05-21T10:03:00.000Z"),
@@ -984,7 +913,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_creator",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-creator",
           createdAt: at("2026-05-14T10:00:30.000Z"),
           expiresAt: at("2026-05-21T10:00:30.000Z"),
@@ -1251,7 +1179,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
@@ -1261,7 +1188,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_2",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: " ava@acme.com ",
           tokenHash: "hash-2",
           returnTo: "/dashboard",
@@ -1290,7 +1216,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             consumedAt: at("2026-05-14T10:02:00.000Z"),
           })
         ).resolves.toMatchObject({
-          audience: "atlas",
           returnTo: "/dashboard",
           consumedAt: at("2026-05-14T10:02:00.000Z"),
         })
@@ -1312,7 +1237,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1338,7 +1262,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             consumedAt: at("2026-05-14T10:01:00.000Z"),
           })
         ).resolves.toMatchObject({
-          audience: "atlas",
           codeVerifier: "verifier",
           consumedAt: at("2026-05-14T10:01:00.000Z"),
         })
@@ -1362,7 +1285,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "session-hash",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1433,7 +1355,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           storage.sessions.findValidByTokenHash({
             projectId,
             id: "ses_cli",
-            audience: "atlas",
             tokenHash: "access-1",
             now,
           })
@@ -1524,7 +1445,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "old-hash",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1533,7 +1453,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1546,7 +1465,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           tokenHash: "link-hash",
           completedAt: at("2026-05-14T10:02:00.000Z"),
           newUserId: "usr_unused",
-          session: sessionInput("ses_new", "session-hash", "atlas", at("2026-06-21T10:10:00.000Z")),
+          session: sessionInput("ses_new", "session-hash", at("2026-06-21T10:10:00.000Z")),
         })
 
         expect(result.user.id).toBe("usr_1")
@@ -1588,7 +1507,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:02:00.000Z"),
@@ -1643,7 +1561,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:02:00.000Z"),
@@ -1683,7 +1600,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1721,7 +1637,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "founder@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1756,7 +1671,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "ml_1",
           projectId,
           strategyId: "magic-link",
-          audience: "atlas",
           email: "ava@acme.com",
           tokenHash: "link-hash",
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -1795,7 +1709,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1834,7 +1747,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1873,7 +1785,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1919,7 +1830,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_1",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -1952,7 +1862,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           id: "oidc_bootstrap",
           projectId,
           strategyId: "okta",
-          audience: "atlas",
           stateHash: "bootstrap-state",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
@@ -2057,7 +1966,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "atlas",
           tokenHash: "hash-1",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -2067,7 +1975,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
-          audience: "app",
           tokenHash: "hash-app",
           createdAt: at("2026-05-14T10:01:00.000Z"),
           expiresAt: at("2026-05-21T10:01:00.000Z"),

package/src/testing/execution-storage-contract.ts

@@ -382,7 +382,6 @@ async function seedAuth(auth: AuthStorage): Promise<void> {
     projectId,
     userId: "user-one",
     strategyId: "contract",
-    audience: "atlas",
     tokenHash: "session-user-hash",
     createdAt,
     expiresAt,
@@ -392,7 +391,6 @@ async function seedAuth(auth: AuthStorage): Promise<void> {
     projectId,
     userId: "user-other",
     strategyId: "contract",
-    audience: "atlas",
     tokenHash: "session-other-hash",
     createdAt,
     expiresAt,

package/dist/auth/audience.d.ts

@@ -1,8 +0,0 @@
-export declare const DEFAULT_AUTH_SESSION_AUDIENCE = "atlas";
-export type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | "app";
-export interface AuthSessionAudienceOptions {
-    readonly audience?: AuthSessionAudience;
-}
-export declare function isValidAuthSessionAudience(value: string): value is AuthSessionAudience;
-export declare function resolveAuthSessionAudience(value: AuthSessionAudience | undefined): AuthSessionAudience;
-//# sourceMappingURL=audience.d.ts.map

package/dist/auth/audience.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../src/auth/audience.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,6BAA6B,UAAU,CAAA;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,6BAA6B,GAAG,KAAK,CAAA;AAE9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,mBAAmB,CAEtF;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,mBAAmB,CAWrB"}

package/dist/authorization/application-access.d.ts

@@ -1,18 +0,0 @@
-import type { AuthSessionAudience } from "../auth/audience";
-import type { AuthorizationContext, ResolvedRole } from "./types";
-/** Whether declaring roles has enabled an allowlist for an application. */
-export declare function isApplicationAccessControlled(roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
-/**
- * Whether this principal may open this application.
- *
- * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.
- * While no role mentions an application, every authenticated principal may open it; the allowlist only
- * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —
- * denies unless granted, so this is the single asymmetry in the model.
- *
- * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,
- * including projects with no security definitions at all. Closing it means shipping a default grant with
- * the scaffold first, and it is a breaking change for any project relying on the open default.
- */
-export declare function canAccessApplication(authorization: AuthorizationContext, roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
-//# sourceMappingURL=application-access.d.ts.map

package/dist/authorization/application-access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"application-access.d.ts","sourceRoot":"","sources":["../../src/authorization/application-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEjE,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,EACnC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAKT"}