@sixb/core 0.1.19 → 0.1.21

package/dist/{chunk-3gnrh4ve.js → chunk-nn5xnx3s.js}

@@ -1,38 +1,36 @@
 // @bun
 import {
-  canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-y7rqfrgg.js";
+} from "./chunk-6vb4st8k.js";
 import {
   assertValidFileRefs2
-} from "./chunk-hvsb78a1.js";
+} from "./chunk-8frc8a4j.js";
 import {
-  SecurityValidationError2,
   resolveMembershipPolicyScope,
   canPerformMembershipOperation,
   missingMembershipGroupIds,
   validateSecurityDefinitionsAtStartup
-} from "./chunk-xt1zt7gv.js";
+} from "./chunk-f4pamkt9.js";
 import {
-  AuthRuntimeError2,
-  DEFAULT_AUTH_SESSION_AUDIENCE2,
-  resolveAuthSessionAudience2,
-  resolveAuthCookieOptionsForAudience,
   getCookie2,
+  AuthRuntimeError2,
   resolveAuthConfig2,
   resolveInvitationExpiresAt,
   assertNonEmpty3,
   normalizePagination,
   isInvitationDeliveryAuthStrategy2
-} from "./chunk-2jntasmh.js";
+} from "./chunk-hcbyfxbe.js";
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-c85m1hyj.js";
+} from "./chunk-447a5c0p.js";
 import {
   snapshotLinkPathSelection
 } from "./chunk-t6f3tdnr.js";
+import {
+  SecurityValidationError2
+} from "./chunk-jcfw4h7m.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";
@@ -161,13 +159,6 @@ function safeEqual(left, right) {
 }
 // src/auth/runtime.ts
 import { randomUUID as randomUUID3 } from "crypto";
-
-// src/security/applications.ts
-var applications2 = {
-  atlas: { kind: "application", id: "atlas", label: "Atlas" },
-  app: { kind: "application", id: "app", label: "Custom app" }
-};
-var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
 // src/security/every.ts
 var BREADTH_TARGETS = [
   "object",
@@ -176,7 +167,6 @@ var BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "application",
   "connector",
   "share"
 ];
@@ -211,7 +201,6 @@ var every2 = {
   workflow: () => all("workflow"),
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
-  application: () => all("application"),
   connector: () => all("connector"),
   share: () => all("share")
 };
@@ -574,7 +563,6 @@ var TARGET_BY_DEFINITION_KIND = {
   sync: "sync",
   pipeline: "pipeline",
   workflow: "workflow",
-  application: "application",
   connector: "connector",
   share: "share"
 };
@@ -622,10 +610,6 @@ function resolveGrant(input, label, allowedTargets) {
   const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
   return { target, selection: { all: false, ids } };
 }
-function access(input) {
-  const { selection } = resolveGrant(input, "can.access", ["application"]);
-  return { kind: "grant", capability: "access", target: "application", selection };
-}
 function view(input) {
   if (isShareTarget(input))
     return createShareViewGrant(input);
@@ -683,26 +667,28 @@ function isAgentReference(input) {
 function isAgentUsageReference(input) {
   return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "aiUsage";
 }
+var OBSERVABLE_REFERENCES = {
+  logs: "project.logs",
+  activity: "project.activity",
+  aiUsage: "agent.usage"
+};
+function isObservableReference(input) {
+  return typeof input === "object" && input !== null && "kind" in input && typeof input.kind === "string" && Object.hasOwn(OBSERVABLE_REFERENCES, input.kind);
+}
 function observe(input) {
-  if (input !== "logs" && !isAgentUsageReference(input)) {
-    throw new SecurityValidationError2('[Sixb] can.observe accepts "logs" or agent.usage.');
+  const value = input;
+  if (value === "logs") {
+    throw new SecurityValidationError2('[Sixb] can.observe("logs") is now can.observe(project.logs), imported from "@sixb/core".');
   }
-  const target = input === "logs" ? "logs" : "aiUsage";
-  return {
-    kind: "grant",
-    capability: "observe",
-    target,
-    selection: { all: false, ids: [target] }
-  };
+  if (!isObservableReference(value)) {
+    const accepted = Object.values(OBSERVABLE_REFERENCES).join(" or ");
+    throw new SecurityValidationError2(`[Sixb] can.observe accepts ${accepted}.`);
+  }
+  return { kind: "grant", capability: "observe", target: value.kind };
 }
 function manage(input) {
   if (isAgentUsageReference(input)) {
-    return {
-      kind: "grant",
-      capability: "manage",
-      target: "aiUsage",
-      selection: { all: false, ids: ["aiUsage"] }
-    };
+    return { kind: "grant", capability: "manage", target: "aiUsage" };
   }
   return {
     kind: "grant",
@@ -712,7 +698,6 @@ function manage(input) {
   };
 }
 var can2 = {
-  access,
   view,
   edit,
   append,
@@ -722,6 +707,12 @@ var can2 = {
   observe,
   manage
 };
+// src/security/project.ts
+var project2 = Object.freeze({
+  kind: "project",
+  logs: Object.freeze({ kind: "logs" }),
+  activity: Object.freeze({ kind: "activity" })
+});
 // src/security/registry.ts
 class SecurityRegistry {
   markingsById;
@@ -735,7 +726,6 @@ class SecurityRegistry {
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds,
       datasetIds: input.datasetIds,
       actionIds: input.actionIds,
@@ -744,12 +734,9 @@ class SecurityRegistry {
       pipelineIds: input.pipelineIds,
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds
     });
     const universe = {
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds ?? new Set,
       datasetIds: input.datasetIds ?? new Set,
       actionIds: input.actionIds ?? new Set,
@@ -757,8 +744,6 @@ class SecurityRegistry {
       syncIds: input.syncIds ?? new Set,
       pipelineIds: input.pipelineIds ?? new Set,
       connectorIds: input.connectorIds ?? new Set,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
@@ -926,15 +911,12 @@ function getActiveInvitationByEmail(state, projectId, email, now) {
   const invitations = [...state.invitations.values()].filter((invitation) => invitation.projectId === projectId).filter((invitation) => invitation.email === normalizedEmail).filter((invitation) => isActiveInvitation(invitation, now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
   return invitations[0] ?? null;
 }
-function revokeActiveSessionsForUser(state, projectId, userId, revokedAt, audience) {
+function revokeActiveSessionsForUser(state, projectId, userId, revokedAt) {
   const revoked = [];
   for (const [key, session] of state.sessions) {
     if (session.projectId !== projectId || session.userId !== userId) {
       continue;
     }
-    if (audience !== undefined && session.audience !== audience) {
-      continue;
-    }
     if (!isActiveSession(session, revokedAt)) {
       continue;
     }
@@ -973,7 +955,6 @@ function assertSessionIdAvailable(state, projectId, sessionId) {
 }
 function validateCompleteSessionInput(state, projectId, session) {
   const sessionId = assertNonEmpty4(session.id, "Session id");
-  assertNonEmpty4(session.audience, "Session audience");
   assertNonEmpty4(session.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, sessionId);
 }
@@ -982,7 +963,6 @@ function createSessionRecord(state, input) {
   const projectId = assertNonEmpty4(input.projectId, "Project id");
   const userId = assertNonEmpty4(input.userId, "User id");
   const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-  const audience = resolveAuthSessionAudience2(input.audience);
   const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
@@ -990,7 +970,6 @@ function createSessionRecord(state, input) {
     projectId,
     userId,
     strategyId,
-    audience,
     tokenHash,
     createdAt: cloneDate(input.createdAt),
     expiresAt: cloneDate(input.expiresAt),
@@ -1510,7 +1489,6 @@ class InMemoryAuthMagicLinkStore {
     const id = assertNonEmpty4(input.id, "Magic link id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const email = normalizeEmail(input.email);
     const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
@@ -1522,7 +1500,6 @@ class InMemoryAuthMagicLinkStore {
       id,
       projectId,
       strategyId,
-      audience,
       email,
       tokenHash,
       returnTo: input.returnTo,
@@ -1559,7 +1536,6 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
     const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
@@ -1571,7 +1547,6 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
       id,
       projectId,
       strategyId,
-      audience,
       stateHash,
       nonceHash,
       codeVerifier,
@@ -1697,10 +1672,6 @@ class InMemoryAuthSessionStore {
     const record = this.state.sessions.get(sessionKey(params.projectId, params.id)) ?? null;
     return cloneOptionalRecord(record);
   }
-  async getActiveByUserId(params) {
-    const sessions = [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => session.audience === params.audience).filter((session) => isActiveSession(session, params.now)).sort((a, b) => compareByCreatedAt(a, b, "desc"));
-    return cloneOptionalRecord(sessions[0] ?? null);
-  }
   async listActiveByUserId(params) {
     return [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => isActiveSession(session, params.now)).sort((a, b) => {
       const activity = (b.lastSeenAt ?? b.createdAt).getTime() - (a.lastSeenAt ?? a.createdAt).getTime();
@@ -1710,9 +1681,23 @@ class InMemoryAuthSessionStore {
       return created !== 0 ? created : b.id.localeCompare(a.id);
     }).map(cloneRecord);
   }
+  async listByUserId(params) {
+    const before = params.before;
+    const offset = before?.skip ?? 0;
+    const sessions = [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => !before || session.createdAt <= before.createdAt).sort((a, b) => {
+      const created = b.createdAt.getTime() - a.createdAt.getTime();
+      if (created !== 0)
+        return created;
+      return a.id < b.id ? 1 : a.id > b.id ? -1 : 0;
+    });
+    return {
+      sessions: sessions.slice(offset, offset + params.limit).map(cloneRecord),
+      hasMore: sessions.length > offset + params.limit
+    };
+  }
   async findValidByTokenHash(params) {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
-    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     return cloneRecord(session);
@@ -1759,7 +1744,7 @@ class InMemoryAuthSessionStore {
   async renewIfValid(params) {
     const key = sessionKey(params.projectId, params.id);
     const session = this.state.sessions.get(key);
-    if (!session || session.bearer || session.audience !== params.audience || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
+    if (!session || session.bearer || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
       return null;
     }
     const requestedExpiresAt = session.absoluteExpiresAt ? new Date(Math.min(params.expiresAt.getTime(), session.absoluteExpiresAt.getTime())) : params.expiresAt;
@@ -1785,7 +1770,7 @@ class InMemoryAuthSessionStore {
     return cloneRecord(next);
   }
   async revokeActiveForUser(params) {
-    return revokeActiveSessionsForUser(this.state, params.projectId, params.userId, params.revokedAt, params.audience).map(cloneRecord);
+    return revokeActiveSessionsForUser(this.state, params.projectId, params.userId, params.revokedAt).map(cloneRecord);
   }
   async touch(params) {
     const key = sessionKey(params.projectId, params.id);
@@ -1993,7 +1978,6 @@ class InMemoryAuthStorage2 {
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
-    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
@@ -2082,7 +2066,6 @@ class InMemoryAuthStorage2 {
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
-    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
@@ -2213,7 +2196,6 @@ class InMemoryAuthStorage2 {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -2237,12 +2219,6 @@ function restoreMap(target, snapshot) {
     target.set(key, value);
   }
 }
-function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
-  if (sessionAudience === storedAudience) {
-    return;
-  }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
-}
 // src/auth/session-cache.ts
 class SessionCache {
   ttlMs;
@@ -2257,7 +2233,7 @@ class SessionCache {
     if (!entry) {
       return;
     }
-    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.transport !== input.transport || input.audience !== undefined && entry.audience !== input.audience) {
+    if (entry.expiresAtMs <= input.nowMs || entry.tokenHash !== input.tokenHash || entry.transport !== input.transport) {
       this.entries.delete(input.sessionId);
       return;
     }
@@ -2273,7 +2249,6 @@ class SessionCache {
     this.entries.set(input.sessionId, {
       tokenHash: input.tokenHash,
       transport: bearer ? "bearer" : "cookie",
-      audience: input.audience,
       session: input.session,
       expiresAtMs
     });
@@ -2387,8 +2362,8 @@ class AuthRuntime2 {
       ...absoluteTimeoutMs === undefined ? {} : { absoluteExpiresAt: new Date(now.getTime() + absoluteTimeoutMs) }
     };
   }
-  getCookieOptions(options = {}) {
-    return resolveAuthCookieOptionsForAudience(this.config.cookies, options.audience);
+  getCookieOptions() {
+    return this.config.cookies;
   }
   assertCanServeHttp(params) {
     const strategy = this.config.strategy;
@@ -2409,7 +2384,6 @@ class AuthRuntime2 {
     if (!this.isEnabled()) {
       return { authenticated: false, reason: "auth_disabled" };
     }
-    const audience = resolveAuthSessionAudience2(options.audience);
     if (options.credentialSource === "any") {
       const tokenValue = getBearerAccessTokenValue2(request);
       if (tokenValue?.startsWith(SESSION_ACCESS_TOKEN_PREFIX)) {
@@ -2422,10 +2396,10 @@ class AuthRuntime2 {
         return { authenticated: false, reason: "invalid_access_token" };
       }
     }
-    return this.resolveCookieSession(request, audience, options.sessionActivity);
+    return this.resolveCookieSession(request, options.sessionActivity);
   }
-  async resolveCookieSession(request, audience, activity) {
-    const cookieOptions = this.getCookieOptions({ audience });
+  async resolveCookieSession(request, activity) {
+    const cookieOptions = this.getCookieOptions();
     const cookieValue = getCookie2(request, cookieOptions.sessionCookieName);
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" };
@@ -2440,7 +2414,6 @@ class AuthRuntime2 {
       sessionId: parts.sessionId,
       tokenHash,
       transport: "cookie",
-      audience,
       nowMs
     });
     if (cached) {
@@ -2454,7 +2427,6 @@ class AuthRuntime2 {
     let session = await storage.sessions.findValidByTokenHash({
       projectId: this.projectId,
       id: parts.sessionId,
-      audience,
       tokenHash,
       now
     });
@@ -2466,7 +2438,6 @@ class AuthRuntime2 {
       const renewed = await storage.sessions.renewIfValid({
         projectId: this.projectId,
         id: parts.sessionId,
-        audience,
         tokenHash,
         now,
         expiresAt: this.getRenewedSessionExpiresAt(session, nowMs)
@@ -2529,7 +2500,6 @@ class AuthRuntime2 {
     this.sessionCache?.set({
       sessionId: session.id,
       tokenHash,
-      audience: session.audience,
       session: result,
       nowMs: now.getTime(),
       sessionExpiresAtMs: session.expiresAt.getTime(),
@@ -2547,7 +2517,6 @@ class AuthRuntime2 {
         projectId: this.projectId,
         userId: input.userId,
         strategyId: "device",
-        audience: DEFAULT_AUTH_SESSION_AUDIENCE2,
         tokenHash: tokens.tokenHash,
         createdAt: input.now,
         ...this.createSessionDeadlines(input.now),
@@ -2749,6 +2718,10 @@ class AuthRuntime2 {
   }
   async listServiceAccounts(caller) {
     const storage = this.requireAuthStorage();
+    const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      return { serviceAccounts: [] };
+    }
     const result = await storage.serviceAccounts.list({
       projectId: this.projectId,
       order: "desc",
@@ -2759,14 +2732,13 @@ class AuthRuntime2 {
       groupIds: await this.listServiceAccountGroupIds(storage, serviceAccount.id)
     })));
     return {
-      serviceAccounts: withGroups.filter(({ groupIds }) => callerCanManageServiceAccount(caller.groupIds, groupIds))
+      serviceAccounts: withGroups.filter(({ groupIds }) => canPerformMembershipOperation(scope, "serviceAccounts", groupIds))
     };
   }
   async createServiceAccount(caller, input) {
     const storage = this.requireAuthStorage();
-    const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
-      subject: "service account"
-    }) ?? [];
+    const groupIds = normalizeRequestedGroupIds(input.groupIds) ?? [];
+    this.assertCanManageServiceAccountGroups(caller.groupIds, groupIds);
     const now = new Date;
     const serviceAccount = await storage.serviceAccounts.create({
       id: input.id ?? `svc_${randomUUID3()}`,
@@ -2858,12 +2830,16 @@ class AuthRuntime2 {
     return { serviceAccount, accessToken };
   }
   async requireManageableServiceAccount(storage, callerGroupIds, serviceAccountId) {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError();
+    }
     const serviceAccount = await storage.serviceAccounts.getById({
       projectId: this.projectId,
       id: serviceAccountId
     });
     const groupIds = serviceAccount ? await this.listServiceAccountGroupIds(storage, serviceAccountId) : [];
-    if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
+    if (!serviceAccount || !canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
       throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
     }
     return { serviceAccount, groupIds };
@@ -2897,6 +2873,7 @@ class AuthRuntime2 {
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     return {
       groups: this.scopedGroupOptions(scope.operations.assignGroups.groupIds),
+      serviceAccountGroups: this.scopedGroupOptions(scope.operations.serviceAccounts.groupIds),
       capabilities: membershipCapabilities(scope).holds
     };
   }
@@ -3069,7 +3046,6 @@ class AuthRuntime2 {
       throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
     }
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
-    this.assertInvitationApplicationAccess(groupIds, destination.audience);
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID3()}`,
       projectId: this.projectId,
@@ -3087,7 +3063,6 @@ class AuthRuntime2 {
         projectId: this.projectId,
         authStorage,
         invitation,
-        audience: destination.audience,
         returnTo: destination.returnTo,
         requestOrigin: destination.requestOrigin,
         revealLink: input.revealLink,
@@ -3184,17 +3159,6 @@ class AuthRuntime2 {
     }
     return { state: "enabled" };
   }
-  assertInvitationApplicationAccess(groupIds, audience) {
-    const roles = this.security.listResolvedRoles();
-    const authorization = resolveAuthorizationContext2({
-      principal: { type: "user", id: "invited-user" },
-      groupIds,
-      roles
-    });
-    if (canAccessApplication2(authorization, roles, audience))
-      return;
-    throw new AuthRuntimeError2("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
-  }
   async assertCanInviteRecipient(strategy, authStorage, email, now) {
     if (!strategy.validateInvitationRecipient) {
       return;
@@ -3223,6 +3187,17 @@ class AuthRuntime2 {
     }
     return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
   }
+  assertCanManageServiceAccountGroups(callerGroupIds, groupIds) {
+    const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
+    if (canPerformMembershipOperation(scope, "serviceAccounts", groupIds)) {
+      return;
+    }
+    if (scope.operations.serviceAccounts.policyIds.length === 0) {
+      throw missingServiceAccountsPolicyError();
+    }
+    const missing = missingMembershipGroupIds(scope, "serviceAccounts", groupIds);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to place service accounts in group(s): ${missing.join(", ")}.`);
+  }
   assertCanManageInvitationGroups(callerGroupIds, groupIds) {
     const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
     if (canPerformMembershipOperation(scope, "invite", groupIds)) {
@@ -3256,9 +3231,8 @@ function constrainTokenGroupIds(principalGroupIds, accessToken) {
   const allowed = new Set(accessToken.groupIds);
   return principalGroupIds.filter((groupId) => allowed.has(groupId));
 }
-function callerCanManageServiceAccount(callerGroupIds, serviceAccountGroupIds) {
-  const callerGroups = new Set(callerGroupIds);
-  return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId));
+function missingServiceAccountsPolicyError() {
+  return new AuthRuntimeError2("authorization_denied", "[Sixb] Managing service accounts needs a membership policy with the 'serviceAccounts' operation.");
 }
 function missingAccessTokenError(tokenId, projectId) {
   return new AuthStorageError2("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
@@ -3309,7 +3283,8 @@ function membershipCapabilities(scope) {
     holds: {
       invite: scope.operations.invite.policyIds.length > 0,
       assignGroups: scope.operations.assignGroups.policyIds.length > 0,
-      suspend: scope.operations.suspend.policyIds.length > 0
+      suspend: scope.operations.suspend.policyIds.length > 0,
+      serviceAccounts: scope.operations.serviceAccounts.policyIds.length > 0
     },
     assignableGroupIds: [...scope.operations.assignGroups.groupIds],
     covers: (operation, memberGroups) => canPerformMembershipOperation(scope, operation, groupIdsOf(memberGroups))
@@ -3323,6 +3298,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, project2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=910D62C713AA4DF964756E2164756E21
+//# debugId=EE5BEC634BE73EEF64756E2164756E21