@sixb/core 0.1.6 → 0.1.8

package/dist/{chunk-1e8m6yn3.js → chunk-4sm0aznx.js}

@@ -1,4 +1,10 @@
 // @bun
+import {
+  validateSchemaOrRefValue
+} from "./chunk-2dw777qw.js";
+import {
+  snapshotLinkPathSelection
+} from "./chunk-19jp6g9d.js";
 import {
   AuthRuntimeError,
   assertNonEmpty,
@@ -17,7 +23,14 @@ import {
   grantKindOf,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "./chunk-f83ka50g.js";
+} from "./chunk-p1x242ad.js";
+import {
+  coerceSchemaValueToTyped,
+  normalizeSchemaValue
+} from "./chunk-h0k55pc7.js";
+import {
+  OntologyValidationError
+} from "./chunk-dktq02ne.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -210,6 +223,7 @@ var GRANT_CAPABILITIES = Object.keys({
   edit: true,
   append: true,
   apply: true,
+  share: true,
   run: true,
   observe: true,
   manage: true
@@ -326,11 +340,17 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
     throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
   }
-  if (value.capability === "observe" && value.target !== "logs") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs'.`);
+  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
+    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
+  }
+  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
+    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
   }
-  if (value.capability === "manage" && value.target !== undefined) {
-    throw createError(`[Sixb] ${field} manage grant must not declare a target.`);
+  if (value.capability === "run" && value.target === "agent") {
+    if (value.selection !== undefined) {
+      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`);
+    }
+    return;
   }
   assertSelection(value.selection, field, createError);
 }
@@ -441,6 +461,13 @@ function validateSecurityDefinitionsAtStartup(input) {
   };
 }
 function assertGrantReferences(roleId, grant, registered) {
+  if (grant.capability === "run" && grant.target === "agent") {
+    const spec2 = GRANT_KINDS[grantKindOf(grant)];
+    if (!registered.agentAvailable) {
+      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec2.fix}`);
+    }
+    return;
+  }
   const spec = GRANT_KINDS[grantKindOf(grant)];
   const universe = registered[spec.universeKey];
   if (!universe) {
@@ -530,9 +557,9 @@ var BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "agent",
   "application",
-  "connector"
+  "connector",
+  "share"
 ];
 function isBreadthSelector(value) {
   if (typeof value !== "object" || value === null)
@@ -565,21 +592,417 @@ var every = {
   workflow: () => all("workflow"),
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
-  agent: () => all("agent"),
   application: () => all("application"),
-  connector: () => all("connector")
+  connector: () => all("connector"),
+  share: () => all("share")
 };
+// src/actions/errors.ts
+class ActionDefinitionError extends Error {
+  name = "ActionDefinitionError";
+}
+
+class ActionEditCommitError extends Error {
+  name = "ActionEditCommitError";
+}
+function missingActionMutationMessage(actionId) {
+  return `Action "${actionId}" must declare .writeback(...) or .edits(...).`;
+}
+function effectsWithoutEditsMessage(actionId) {
+  return `Action "${actionId}" cannot declare .effects(...) without .edits(...).`;
+}
+
+// src/actions/validation.ts
+function assertNonEmpty2(value, field) {
+  if (!value.trim()) {
+    throw new ActionDefinitionError(`Action ${field} must not be empty.`);
+  }
+}
+function isActionDefinition(value) {
+  const binding = value?.binding;
+  return typeof value === "object" && value !== null && value.kind === "action" && (binding?.kind === "global" || binding?.kind === "object");
+}
+function isGlobalActionDefinition(value) {
+  return value.binding.kind === "global";
+}
+function isObjectActionDefinition(value) {
+  return value.binding.kind === "object";
+}
+function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
+  const knownParamIds = new Set(Object.keys(paramsConfig));
+  const normalized = {};
+  for (const paramId of Object.keys(params)) {
+    if (!knownParamIds.has(paramId)) {
+      throw new OntologyValidationError(`Unknown param '${paramId}' for action '${pathPrefix}'`);
+    }
+  }
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined) {
+      if (paramDef.required) {
+        throw new OntologyValidationError(`Missing required param '${paramId}' for action '${pathPrefix}'`);
+      }
+      continue;
+    }
+    if (value === null) {
+      if (!paramDef.nullable) {
+        throw new OntologyValidationError(`[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`);
+      }
+      normalized[paramId] = null;
+      continue;
+    }
+    validateSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+    normalized[paramId] = normalizeSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+  }
+  return normalized;
+}
+function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
+  const coerced = { ...params };
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined)
+      continue;
+    const schema = paramDef.schema;
+    if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+      continue;
+    }
+    coerced[paramId] = coerceSchemaValueToTyped(schema, value, valueTypesById);
+  }
+  return coerced;
+}
+function validateActionSubject(action, subject) {
+  if (isGlobalActionDefinition(action) && subject.kind !== "none") {
+    throw new OntologyValidationError(`Action '${action.id}' does not accept an object subject.`);
+  }
+}
+function resolveObjectActionSubject(params) {
+  const { runtime, action, subject } = params;
+  if (subject.kind !== "object") {
+    throw new OntologyValidationError(`Action '${action.id}' requires an object subject.`);
+  }
+  const objectType = runtime.ontology.resolveObjectType(subject.objectTypeId);
+  if (!actionAppliesToObjectType(runtime, action, objectType)) {
+    throw new OntologyValidationError(`Action '${action.id}' is not valid for object type '${objectType.id}'.`);
+  }
+  return objectType;
+}
+function actionAppliesToObjectType(runtime, action, objectType) {
+  return runtime.actionRegistry.listForType(objectType).some((candidate) => candidate.id === action.id);
+}
+function normalizeSchemaOrRefValue(schema, value, path, valueTypesById) {
+  if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+    const refValue = value;
+    return {
+      objectTypeId: refValue.objectTypeId,
+      primaryId: refValue.primaryId
+    };
+  }
+  return normalizeSchemaValue(schema, value, path, valueTypesById);
+}
+
+// src/shares/errors.ts
+class ShareDefinitionError extends Error {
+  name = "ShareDefinitionError";
+}
+
+// src/shares/builders.ts
+var shareTargets = new WeakSet;
+function defineShare(id, options) {
+  assertNonEmpty3(id, "Share id");
+  if (!isObjectType(options.target)) {
+    throw invalid(`Share '${id}' target must be an object type.`);
+  }
+  if (typeof options.grants !== "function") {
+    throw invalid(`Share '${id}' grants must be a function.`);
+  }
+  if (options.description !== undefined && typeof options.description !== "string") {
+    throw invalid(`Share '${id}' description must be a string.`);
+  }
+  const target = createShareTarget(options.target.id);
+  let authoredGrants;
+  try {
+    authoredGrants = options.grants({ target });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share '${id}' grants are invalid: ${reason}`);
+  }
+  if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+    throw invalid(`Share '${id}' must declare at least one grant.`);
+  }
+  const grants = snapshotShareGrants(id, options.target.id, authoredGrants);
+  return Object.freeze({
+    kind: "share",
+    id,
+    target: Object.freeze({ kind: "object", objectTypeId: options.target.id }),
+    grants,
+    ...options.description === undefined ? {} : { description: options.description }
+  });
+}
+function isShareDefinition(value) {
+  if (!isRecord2(value) || value.kind !== "share" || !isNonEmpty(value.id))
+    return false;
+  if (!isRecord2(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
+    return false;
+  }
+  return Array.isArray(value.grants);
+}
+function snapshotShareDefinition(value) {
+  try {
+    if (!isRecord2(value)) {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const kind = value.kind;
+    const authoredId = value.id;
+    const target = value.target;
+    const authoredGrants = value.grants;
+    const description = value.description;
+    if (kind !== "share") {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const id = nonEmpty(authoredId, "Share id");
+    if (!isRecord2(target)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    const targetKind = target.kind;
+    const authoredObjectTypeId = target.objectTypeId;
+    if (targetKind !== "object" || !isNonEmpty(authoredObjectTypeId)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+      throw invalid(`Share '${id}' must declare grants.`);
+    }
+    if (description !== undefined && typeof description !== "string") {
+      throw invalid(`Share '${id}' description must be a string.`);
+    }
+    const objectTypeId = authoredObjectTypeId;
+    return Object.freeze({
+      kind: "share",
+      id,
+      target: Object.freeze({ kind: "object", objectTypeId }),
+      grants: snapshotShareGrants(id, objectTypeId, authoredGrants),
+      ...description === undefined ? {} : { description }
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share definition is invalid: ${reason}`);
+  }
+}
+function isShareTarget(value) {
+  return typeof value === "object" && value !== null && shareTargets.has(value);
+}
+function createShareViewGrant(target) {
+  assertShareTarget(target);
+  return createShareViewGrantWithLinks(target.objectTypeId, Object.freeze({ kind: "none" }));
+}
+function createShareActionGrant(action, target) {
+  assertShareTarget(target);
+  const objectTypeId = action.binding.objectType.id;
+  if (target.objectTypeId !== objectTypeId) {
+    throw invalid(`Action '${action.id}' is defined on '${objectTypeId}', not Share target '${target.objectTypeId}'. Shared Actions are exact-type only in V1.`);
+  }
+  return Object.freeze({
+    kind: "action.apply",
+    actionId: action.id,
+    subjectObjectTypeId: target.objectTypeId
+  });
+}
+function createShareTarget(objectTypeId) {
+  const target = { objectTypeId };
+  shareTargets.add(target);
+  return Object.freeze(target);
+}
+function createShareViewGrantWithLinks(targetObjectTypeId, links) {
+  const grant = {
+    kind: "object.view",
+    targetObjectTypeId,
+    links
+  };
+  Object.defineProperty(grant, "withLinks", {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: (...args) => {
+      if (args.length === 0) {
+        return freezeViewGrant(targetObjectTypeId, Object.freeze({ kind: "all" }));
+      }
+      const selected = args[0];
+      if (!Array.isArray(selected)) {
+        throw invalid("withLinks(...) expects an array, or no argument for every direct link.");
+      }
+      return freezeViewGrant(targetObjectTypeId, Object.freeze({
+        kind: "selected",
+        links: Object.freeze(selected.map(snapshotLinkPathSelection))
+      }));
+    }
+  });
+  return Object.freeze(grant);
+}
+function freezeViewGrant(targetObjectTypeId, links) {
+  return Object.freeze({ kind: "object.view", targetObjectTypeId, links });
+}
+function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
+  const grants = [];
+  const actionIds = new Set;
+  let viewCount = 0;
+  for (let index = 0;index < authored.length; index += 1) {
+    const grant = authored[index];
+    if (!isRecord2(grant)) {
+      throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+    }
+    const kind = grant.kind;
+    if (kind === "object.view") {
+      const authoredTargetObjectTypeId = grant.targetObjectTypeId;
+      const links = grant.links;
+      if (authoredTargetObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' view grant must use its contextual target.`);
+      }
+      viewCount += 1;
+      if (viewCount > 1) {
+        throw invalid(`Share '${shareId}' must declare exactly one view grant.`);
+      }
+      grants.push(Object.freeze({
+        kind: "object.view",
+        targetObjectTypeId,
+        links: snapshotLinkMode(links)
+      }));
+      continue;
+    }
+    if (kind === "action.apply") {
+      const actionId = grant.actionId;
+      const subjectObjectTypeId = grant.subjectObjectTypeId;
+      if (!isNonEmpty(actionId) || subjectObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' action grant must apply to its contextual target.`);
+      }
+      if (actionIds.has(actionId)) {
+        throw invalid(`Share '${shareId}' contains duplicate action '${actionId}'.`);
+      }
+      actionIds.add(actionId);
+      grants.push(Object.freeze({
+        kind: "action.apply",
+        actionId,
+        subjectObjectTypeId: targetObjectTypeId
+      }));
+      continue;
+    }
+    throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+  }
+  if (viewCount !== 1) {
+    throw invalid(`Share '${shareId}' must declare exactly one can.view(target) grant.`);
+  }
+  return Object.freeze(grants);
+}
+function snapshotLinkMode(value) {
+  if (!isRecord2(value))
+    throw invalid("Share link selection must be an object.");
+  const kind = value.kind;
+  const links = value.links;
+  if (kind === "none" || kind === "all") {
+    return Object.freeze({ kind });
+  }
+  if (kind !== "selected" || !Array.isArray(links)) {
+    throw invalid("Share link selection must be none, all, or selected links.");
+  }
+  if (links.length === 0) {
+    throw invalid("withLinks([]) is empty; omit withLinks() when no links should be shared.");
+  }
+  try {
+    return Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(links)
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share link selection is invalid: ${reason}`);
+  }
+}
+function snapshotLinkPaths(values) {
+  const byKey = new Map;
+  for (const value of values) {
+    const captured = canonicalizeLinkPath(snapshotLinkPathSelection(value));
+    const key = JSON.stringify([captured.sourceObjectTypeId, captured.linkId]);
+    const current = byKey.get(key);
+    if (!current) {
+      byKey.set(key, captured);
+      continue;
+    }
+    if (!sameLinkTargets(current.targetObjectTypeId, captured.targetObjectTypeId)) {
+      throw invalid(`Link '${captured.sourceObjectTypeId}.${captured.linkId}' declares inconsistent targets.`);
+    }
+    byKey.set(key, Object.freeze({
+      ...current,
+      selection: mergeLinkModes(current.selection, captured.selection)
+    }));
+  }
+  return Object.freeze([...byKey.values()]);
+}
+function canonicalizeLinkPath(value) {
+  return Object.freeze({
+    ...value,
+    selection: value.selection.kind === "selected" ? Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(value.selection.links)
+    }) : value.selection
+  });
+}
+function mergeLinkModes(left, right) {
+  if (left.kind === "all" || right.kind === "all")
+    return Object.freeze({ kind: "all" });
+  if (left.kind === "none")
+    return right;
+  if (right.kind === "none")
+    return left;
+  return Object.freeze({
+    kind: "selected",
+    links: snapshotLinkPaths([...left.links, ...right.links])
+  });
+}
+function sameLinkTargets(left, right) {
+  if (typeof left === "string" || typeof right === "string")
+    return left === right;
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertShareTarget(value) {
+  if (!isShareTarget(value)) {
+    throw invalid("Shared grants must use the target provided by defineShare(...).");
+  }
+}
+function isObjectType(value) {
+  return isRecord2(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function assertNonEmpty3(value, field) {
+  if (!isNonEmpty(value))
+    throw invalid(`${field} must not be empty.`);
+}
+function nonEmpty(value, field) {
+  assertNonEmpty3(value, field);
+  return value;
+}
+function invalid(message) {
+  return new ShareDefinitionError(`[Sixb] ${message}`);
+}
+
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
-var RUN_TARGETS = ["workflow", "sync", "pipeline", "agent"];
+var RUN_TARGETS = ["workflow", "sync", "pipeline"];
 var TARGET_BY_DEFINITION_KIND = {
   dataset: "dataset",
   sync: "sync",
   pipeline: "pipeline",
-  agent: "agent",
   workflow: "workflow",
   application: "application",
-  connector: "connector"
+  connector: "connector",
+  share: "share"
 };
 var UNDISCRIMINATED_TARGETS = ["object", "action"];
 function targetOfDefinition(item, label, allowedTargets) {
@@ -630,6 +1053,8 @@ function access(input) {
   return { kind: "grant", capability: "access", target: "application", selection };
 }
 function view(input) {
+  if (isShareTarget(input))
+    return createShareViewGrant(input);
   const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS);
   return { kind: "grant", capability: "view", target, selection };
 }
@@ -648,17 +1073,47 @@ function append(input) {
   };
 }
 function apply(input) {
-  return {
+  const grant = {
     kind: "grant",
     capability: "apply",
     selection: resolveGrant(input, "can.apply", ["action"]).selection
   };
+  const one = Array.isArray(input) || isBreadthSelector(input) ? undefined : input;
+  if (one && isObjectActionDefinition(one)) {
+    Object.defineProperty(grant, "on", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (target) => createShareActionGrant(one, target)
+    });
+  }
+  return grant;
+}
+function share(input) {
+  return {
+    kind: "grant",
+    capability: "share",
+    selection: resolveGrant(input, "can.share", ["share"]).selection
+  };
 }
 function run(input) {
+  if (isAgentReference(input)) {
+    return { kind: "grant", capability: "run", target: "agent" };
+  }
   const { target, selection } = resolveGrant(input, "can.run", RUN_TARGETS);
   return { kind: "grant", capability: "run", target, selection };
 }
-function observe(target) {
+function isAgentReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "agent";
+}
+function isAgentUsageReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "aiUsage";
+}
+function observe(input) {
+  if (input !== "logs" && !isAgentUsageReference(input)) {
+    throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.');
+  }
+  const target = input === "logs" ? "logs" : "aiUsage";
   return {
     kind: "grant",
     capability: "observe",
@@ -667,9 +1122,18 @@ function observe(target) {
   };
 }
 function manage(input) {
+  if (isAgentUsageReference(input)) {
+    return {
+      kind: "grant",
+      capability: "manage",
+      target: "aiUsage",
+      selection: { all: false, ids: ["aiUsage"] }
+    };
+  }
   return {
     kind: "grant",
     capability: "manage",
+    target: "connector",
     selection: resolveGrant(input, "can.manage", ["connector"]).selection
   };
 }
@@ -679,6 +1143,7 @@ var can = {
   edit,
   append,
   apply,
+  share,
   run,
   observe,
   manage
@@ -701,9 +1166,11 @@ class SecurityRegistry {
       workflowIds: input.workflowIds,
       syncIds: input.syncIds,
       pipelineIds: input.pipelineIds,
-      agentIds: input.agentIds,
+      agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs"])
+      observableIds: new Set(["logs", "aiUsage"]),
+      manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds
     });
     const universe = {
       applicationIds: input.applicationIds ?? APPLICATION_IDS,
@@ -713,9 +1180,10 @@ class SecurityRegistry {
       workflowIds: input.workflowIds ?? new Set,
       syncIds: input.syncIds ?? new Set,
       pipelineIds: input.pipelineIds ?? new Set,
-      agentIds: input.agentIds ?? new Set,
       connectorIds: input.connectorIds ?? new Set,
-      observableIds: new Set(["logs"]),
+      observableIds: new Set(["logs", "aiUsage"]),
+      manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
     this.groupsById = definitions.groupsById;
@@ -770,7 +1238,8 @@ function createAuthStorageState() {
     invitations: new Map,
     groupMemberships: new Map,
     magicLinks: new Map,
-    oidcAuthorizationAttempts: new Map
+    oidcAuthorizationAttempts: new Map,
+    deviceAuthorizations: new Map
   };
 }
 function scopedKey(...parts) {
@@ -791,6 +1260,9 @@ function serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId)
 function sessionKey(projectId, id) {
   return scopedKey(projectId, id);
 }
+function deviceAuthorizationKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
 function accessTokenKey(projectId, id) {
   return scopedKey(projectId, id);
 }
@@ -818,7 +1290,7 @@ function cloneDate(value) {
 function dateOrNow(value) {
   return value ? cloneDate(value) : new Date;
 }
-function assertNonEmpty2(value, label) {
+function assertNonEmpty4(value, label) {
   const normalized = value.trim();
   if (!normalized) {
     throw new AuthStorageError("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
@@ -826,10 +1298,10 @@ function assertNonEmpty2(value, label) {
   return normalized;
 }
 function normalizeEmail(email) {
-  return assertNonEmpty2(email, "Email").toLowerCase();
+  return assertNonEmpty4(email, "Email").toLowerCase();
 }
 function normalizeGroupIds(groupIds) {
-  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty2(groupId, "Group id")))];
+  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty4(groupId, "Group id")))];
 }
 function normalizeOptionalGroupIds(groupIds) {
   return groupIds === undefined ? undefined : normalizeGroupIds(groupIds);
@@ -916,18 +1388,18 @@ function assertSessionIdAvailable(state, projectId, sessionId) {
   }
 }
 function validateCompleteSessionInput(state, projectId, session) {
-  const sessionId = assertNonEmpty2(session.id, "Session id");
-  assertNonEmpty2(session.audience, "Session audience");
-  assertNonEmpty2(session.tokenHash, "Session token hash");
+  const sessionId = assertNonEmpty4(session.id, "Session id");
+  assertNonEmpty4(session.audience, "Session audience");
+  assertNonEmpty4(session.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, sessionId);
 }
 function createSessionRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Session id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+  const id = assertNonEmpty4(input.id, "Session id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
   const audience = resolveAuthSessionAudience(input.audience);
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Session token hash");
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
     id,
@@ -946,9 +1418,9 @@ function createSessionRecord(state, input) {
   return session;
 }
 function createServiceAccountRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Service account id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Service account name");
+  const id = assertNonEmpty4(input.id, "Service account id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Service account name");
   const key = serviceAccountKey(projectId, id);
   if (state.serviceAccounts.has(key)) {
     throw new AuthStorageError("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
@@ -969,9 +1441,9 @@ function createServiceAccountRecord(state, input) {
   return serviceAccount;
 }
 function upsertServiceAccountGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
     throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
   }
@@ -991,11 +1463,11 @@ function upsertServiceAccountGroupMembershipRecord(state, input) {
   return membership;
 }
 function createAccessTokenRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Access token id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Access token name");
-  const subjectId = assertNonEmpty2(input.subjectId, "Access token subject id");
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Access token hash");
+  const id = assertNonEmpty4(input.id, "Access token id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Access token name");
+  const subjectId = assertNonEmpty4(input.subjectId, "Access token subject id");
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Access token hash");
   assertAccessTokenSubject(input.kind, input.subjectType);
   assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
   const key = accessTokenKey(projectId, id);
@@ -1020,9 +1492,9 @@ function createAccessTokenRecord(state, input) {
   return token;
 }
 function upsertGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.users.has(userKey(projectId, userId))) {
     throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
   }
@@ -1042,9 +1514,9 @@ function upsertGroupMembershipRecord(state, input) {
   return membership;
 }
 function removeGroupMembershipRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const userId = assertNonEmpty2(params.userId, "User id");
-  const groupId = assertNonEmpty2(params.groupId, "Group id");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const userId = assertNonEmpty4(params.userId, "User id");
+  const groupId = assertNonEmpty4(params.groupId, "Group id");
   const key = groupMembershipKey(projectId, userId, groupId);
   const existing = state.groupMemberships.get(key);
   if (!existing) {
@@ -1070,9 +1542,9 @@ function assertAccessTokenSubjectExists(state, projectId, subjectType, subjectId
   throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function consumeMagicLinkRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "Magic link id");
-  const tokenHash = assertNonEmpty2(params.tokenHash, "Magic link token hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "Magic link id");
+  const tokenHash = assertNonEmpty4(params.tokenHash, "Magic link token hash");
   const key = magicLinkKey(projectId, id);
   const existing = state.magicLinks.get(key);
   if (!existing) {
@@ -1092,9 +1564,9 @@ function consumeMagicLinkRecord(state, params) {
   return consumed;
 }
 function consumeOidcAttemptRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "OIDC authorization attempt id");
-  const stateHash = assertNonEmpty2(params.stateHash, "OIDC state hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "OIDC authorization attempt id");
+  const stateHash = assertNonEmpty4(params.stateHash, "OIDC state hash");
   const key = oidcAttemptKey(projectId, id);
   const existing = state.oidcAuthorizationAttempts.get(key);
   if (!existing) {
@@ -1175,6 +1647,100 @@ class InMemoryAuthAccessTokenStore {
   }
 }
 
+// src/storage/auth/types.ts
+var MAX_PENDING_DEVICE_AUTHORIZATIONS = 100;
+
+// src/storage/auth/in-memory/device-authorizations.ts
+class InMemoryAuthDeviceAuthorizationStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    const id = assertNonEmpty4(input.id, "Device authorization id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    for (const [key2, authorization] of this.state.deviceAuthorizations) {
+      if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
+        this.state.deviceAuthorizations.delete(key2);
+      }
+    }
+    const pending = [...this.state.deviceAuthorizations.values()].filter((authorization) => authorization.projectId === projectId && authorization.status === "pending").length;
+    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+      throw new AuthStorageError("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
+    }
+    const key = deviceAuthorizationKey(projectId, id);
+    if (this.state.deviceAuthorizations.has(key)) {
+      throw duplicateAuthorization(id, projectId);
+    }
+    const record = {
+      id,
+      projectId,
+      deviceCodeHash: assertNonEmpty4(input.deviceCodeHash, "Device code hash"),
+      userCode: assertNonEmpty4(input.userCode, "User code"),
+      clientName: assertNonEmpty4(input.clientName, "Client name"),
+      tokenName: assertNonEmpty4(input.tokenName, "Token name"),
+      tokenExpiresAt: new Date(input.tokenExpiresAt),
+      status: "pending",
+      createdAt: new Date(input.createdAt),
+      expiresAt: new Date(input.expiresAt)
+    };
+    this.state.deviceAuthorizations.set(key, cloneRecord(record));
+    return cloneRecord(record);
+  }
+  async getById(params) {
+    const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(params.projectId, params.id));
+    return record ? cloneRecord(record) : null;
+  }
+  async getByUserCode(params) {
+    for (const record of this.state.deviceAuthorizations.values()) {
+      if (record.projectId === params.projectId && record.userCode === params.userCode) {
+        return cloneRecord(record);
+      }
+    }
+    return null;
+  }
+  async approve(params) {
+    const record = this.requirePending(params.projectId, params.id, params.approvedAt);
+    const user = this.state.users.get(userKey(params.projectId, params.userId));
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.sessionId));
+    if (!user || user.status !== "active" || !session || session.userId !== user.id || !isActiveSession(session, params.approvedAt)) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
+    }
+    const next = {
+      ...record,
+      status: "approved",
+      approvedUserId: assertNonEmpty4(params.userId, "Approved user id"),
+      approvedSessionId: assertNonEmpty4(params.sessionId, "Approved session id"),
+      approvedAt: new Date(params.approvedAt)
+    };
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
+    return cloneRecord(next);
+  }
+  async deny(params) {
+    const record = this.requirePending(params.projectId, params.id, params.deniedAt);
+    const next = {
+      ...record,
+      status: "denied",
+      deniedAt: new Date(params.deniedAt)
+    };
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
+    return cloneRecord(next);
+  }
+  requirePending(projectId, id, now) {
+    const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(projectId, id));
+    if (!record) {
+      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
+    }
+    if (record.status !== "pending" || record.expiresAt <= now) {
+      throw new AuthStorageError("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+    }
+    return record;
+  }
+}
+function duplicateAuthorization(id, projectId) {
+  return new AuthStorageError("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
+}
+
 // src/storage/auth/in-memory/group-memberships.ts
 class InMemoryAuthGroupMembershipStore {
   state;
@@ -1203,10 +1769,10 @@ class InMemoryAuthUserIdentityStore {
     this.state = state;
   }
   async upsert(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-    const subject = assertNonEmpty2(input.subject, "Subject");
-    const userId = assertNonEmpty2(input.userId, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+    const subject = assertNonEmpty4(input.subject, "Subject");
+    const userId = assertNonEmpty4(input.userId, "User id");
     const key = identityKey(projectId, strategyId, subject);
     const existing = this.state.identities.get(key);
     const createdAt = existing?.createdAt ?? dateOrNow(input.createdAt);
@@ -1256,8 +1822,8 @@ class InMemoryAuthInvitationStore {
     this.state = state;
   }
   async createOrUpdateActive(input) {
-    const id = assertNonEmpty2(input.id, "Invitation id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Invitation id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const groupIds = normalizeGroupIds(input.groupIds);
     const now = dateOrNow(input.updatedAt ?? input.createdAt);
@@ -1355,12 +1921,12 @@ class InMemoryAuthMagicLinkStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "Magic link id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const id = assertNonEmpty4(input.id, "Magic link id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
     const audience = resolveAuthSessionAudience(input.audience);
     const email = normalizeEmail(input.email);
-    const tokenHash = assertNonEmpty2(input.tokenHash, "Magic link token hash");
+    const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
     if (this.state.magicLinks.has(key)) {
       throw new AuthStorageError("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
@@ -1404,13 +1970,13 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "OIDC authorization attempt id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
     const audience = resolveAuthSessionAudience(input.audience);
-    const stateHash = assertNonEmpty2(input.stateHash, "OIDC state hash");
-    const nonceHash = assertNonEmpty2(input.nonceHash, "OIDC nonce hash");
-    const codeVerifier = assertNonEmpty2(input.codeVerifier, "OIDC code verifier");
+    const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
+    const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
+    const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
     const key = oidcAttemptKey(projectId, id);
     if (this.state.oidcAuthorizationAttempts.has(key)) {
       throw new AuthStorageError("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
@@ -1449,8 +2015,8 @@ class InMemoryAuthServiceAccountGroupMembershipStore {
     return cloneRecord(upsertServiceAccountGroupMembershipRecord(this.state, input));
   }
   async reconcileForServiceAccount(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
     if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
       throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
@@ -1501,8 +2067,8 @@ class InMemoryAuthServiceAccountStore {
     return cloneOptionalRecord(record);
   }
   async update(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const id = assertNonEmpty2(input.id, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Service account id");
     const key = serviceAccountKey(projectId, id);
     const existing = this.state.serviceAccounts.get(key);
     if (!existing) {
@@ -1510,7 +2076,7 @@ class InMemoryAuthServiceAccountStore {
     }
     const next = {
       ...existing,
-      name: input.name === undefined ? existing.name : assertNonEmpty2(input.name, "Service account name"),
+      name: input.name === undefined ? existing.name : assertNonEmpty4(input.name, "Service account name"),
       description: input.description === undefined ? existing.description : input.description,
       status: input.status ?? existing.status,
       updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : new Date
@@ -1618,8 +2184,8 @@ class InMemoryAuthUserStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "User id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const key = userKey(projectId, id);
     if (this.state.users.has(key)) {
@@ -1707,6 +2273,7 @@ class InMemoryAuthStorage {
   groupMemberships = new InMemoryAuthGroupMembershipStore(this.state);
   magicLinks = new InMemoryAuthMagicLinkStore(this.state);
   oidcAuthorizationAttempts = new InMemoryAuthOidcAuthorizationAttemptStore(this.state);
+  deviceAuthorizations = new InMemoryAuthDeviceAuthorizationStore(this.state);
   snapshot() {
     return {
       users: structuredClone(this.state.users),
@@ -1718,7 +2285,8 @@ class InMemoryAuthStorage {
       invitations: structuredClone(this.state.invitations),
       groupMemberships: structuredClone(this.state.groupMemberships),
       magicLinks: structuredClone(this.state.magicLinks),
-      oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts)
+      oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts),
+      deviceAuthorizations: structuredClone(this.state.deviceAuthorizations)
     };
   }
   restore(snapshot) {
@@ -1732,9 +2300,40 @@ class InMemoryAuthStorage {
     restoreMap(this.state.groupMemberships, snapshot.groupMemberships);
     restoreMap(this.state.magicLinks, snapshot.magicLinks);
     restoreMap(this.state.oidcAuthorizationAttempts, snapshot.oidcAuthorizationAttempts);
+    restoreMap(this.state.deviceAuthorizations, snapshot.deviceAuthorizations);
+  }
+  async completeDeviceAuthorization(input) {
+    const key = deviceAuthorizationKey(input.projectId, input.id);
+    const authorization = this.state.deviceAuthorizations.get(key);
+    if (!authorization) {
+      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+    }
+    if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+    }
+    if (authorization.status === "pending") {
+      throw new AuthStorageError("pending_device_authorization", "[Sixb] Device authorization is pending.");
+    }
+    if (authorization.status === "denied") {
+      throw new AuthStorageError("device_authorization_denied", "[Sixb] Device authorization was denied.");
+    }
+    if (authorization.status !== "approved" || !authorization.approvedUserId || !authorization.approvedSessionId || authorization.expiresAt <= input.completedAt) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+    }
+    if (input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device access token is invalid.");
+    }
+    const accessToken = createAccessTokenRecord(this.state, input.accessToken);
+    const consumed = {
+      ...authorization,
+      status: "consumed",
+      consumedAt: new Date(input.completedAt)
+    };
+    this.state.deviceAuthorizations.set(key, cloneRecord(consumed));
+    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) };
   }
   async completeMagicLinkSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const magicLink = this.state.magicLinks.get(magicLinkKey(projectId, input.magicLinkId));
     if (!magicLink) {
@@ -1781,7 +2380,7 @@ class InMemoryAuthStorage {
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
         throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
@@ -1795,7 +2394,7 @@ class InMemoryAuthStorage {
     let user = existingUser;
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email: magicLink.email,
         displayName: input.newUserDisplayName,
@@ -1833,7 +2432,7 @@ class InMemoryAuthStorage {
     };
   }
   async completeOidcSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const attempt = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(projectId, input.oidcAuthorizationAttemptId));
     if (!attempt) {
@@ -1845,7 +2444,7 @@ class InMemoryAuthStorage {
     if (attempt.expiresAt <= completedAt) {
       throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
     }
-    const subject = assertNonEmpty2(input.subject, "Subject");
+    const subject = assertNonEmpty4(input.subject, "Subject");
     const email = normalizeEmail(input.email);
     const claims = normalizeClaims(input.claims);
     const identity = this.state.identities.get(identityKey(projectId, attempt.strategyId, subject));
@@ -1881,7 +2480,7 @@ class InMemoryAuthStorage {
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
         throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
@@ -1889,7 +2488,7 @@ class InMemoryAuthStorage {
     this.consumeOidcAttempt(input, completedAt, projectId);
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email,
         displayName: input.displayName,
@@ -3036,6 +3635,6 @@ var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
 function principalsEqual(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { ActionDefinitionError, ActionEditCommitError, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2 as assertNonEmpty, isActionDefinition, isGlobalActionDefinition, isObjectActionDefinition, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, ShareDefinitionError, defineShare, isShareDefinition, snapshotShareDefinition, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
 
-//# debugId=C60B118153C5BA0F64756E2164756E21
+//# debugId=883B08C31B88A92764756E2164756E21