@sixb/core 0.1.7 → 0.1.9

package/dist/{chunk-rre42skh.js → chunk-g00bfdq6.js}

@@ -1,37 +1,48 @@
 // @bun
 import {
-  AuthRuntimeError,
-  assertNonEmpty,
-  getCookie,
-  isInvitationDeliveryAuthStrategy,
-  normalizePagination,
-  resolveAuthConfig,
+  GRANT_KINDS,
+  grantKindOf,
+  canAccessApplication2,
+  resolveRoleGrants2,
+  resolveAuthorizationContext2
+} from "./chunk-dz5h08xv.js";
+import {
+  normalizeSchemaValue2,
+  coerceSchemaValueToTyped2
+} from "./chunk-ms2tmn1k.js";
+import {
+  AuthRuntimeError2,
+  resolveAuthSessionAudience2,
   resolveAuthCookieOptionsForAudience,
-  resolveAuthSessionAudience,
+  getCookie2,
+  resolveAuthConfig2,
   resolveInvitationExpiresAt,
-  sanitizeReturnTo
-} from "./chunk-xwnf87e1.js";
+  sanitizeReturnTo,
+  assertNonEmpty3,
+  normalizePagination,
+  isInvitationDeliveryAuthStrategy2
+} from "./chunk-q5gz3g2j.js";
 import {
-  GRANT_KINDS,
-  canAccessApplication,
-  grantKindOf,
-  resolveAuthorizationContext,
-  resolveRoleGrants
-} from "./chunk-37wk412q.js";
+  validateSchemaOrRefValue2,
+  snapshotLinkPathSelection
+} from "./chunk-f0rwz2vh.js";
+import {
+  OntologyValidationError2
+} from "./chunk-cqr3acm1.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
-var PERSONAL_ACCESS_TOKEN_PREFIX = "sixb_pat";
-var SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX = "sixb_sat";
+var PERSONAL_ACCESS_TOKEN_PREFIX2 = "sixb_pat";
+var SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2 = "sixb_sat";
 var ACCESS_TOKEN_ID_PATTERN = /^tok_[A-Za-z0-9_-]+$/;
 var ACCESS_TOKEN_SECRET_PATTERN = /^[A-Za-z0-9_-]{32,}$/;
-function generateAccessTokenSecret() {
+function generateAccessTokenSecret2() {
   return randomBytes(32).toString("base64url");
 }
-function hashAccessTokenSecret(secret) {
+function hashAccessTokenSecret2(secret) {
   return createHash("sha256").update(secret).digest("hex");
 }
-function formatAccessTokenValue(kind, tokenId, tokenSecret) {
+function formatAccessTokenValue2(kind, tokenId, tokenSecret) {
   const prefix = accessTokenPrefixForKind(kind);
   if (!ACCESS_TOKEN_ID_PATTERN.test(tokenId)) {
     throw new Error("[Sixb] Access token ids must start with 'tok_' and be URL-safe.");
@@ -41,7 +52,7 @@ function formatAccessTokenValue(kind, tokenId, tokenSecret) {
   }
   return `${prefix}_${tokenId}.${tokenSecret}`;
 }
-function parseAccessTokenValue(value) {
+function parseAccessTokenValue2(value) {
   if (!value) {
     return null;
   }
@@ -61,7 +72,7 @@ function parseAccessTokenValue(value) {
   }
   return { kind, tokenId, tokenSecret };
 }
-function getBearerAccessTokenValue(request) {
+function getBearerAccessTokenValue2(request) {
   const header = request.headers.get("authorization");
   if (!header) {
     return null;
@@ -72,49 +83,49 @@ function getBearerAccessTokenValue(request) {
   }
   return token;
 }
-function createAccessTokenCredential(kind, tokenId = `tok_${randomUUID()}`) {
-  const tokenSecret = generateAccessTokenSecret();
+function createAccessTokenCredential2(kind, tokenId = `tok_${randomUUID()}`) {
+  const tokenSecret = generateAccessTokenSecret2();
   return {
     kind,
     tokenId,
     tokenSecret,
-    tokenHash: hashAccessTokenSecret(tokenSecret),
-    tokenValue: formatAccessTokenValue(kind, tokenId, tokenSecret)
+    tokenHash: hashAccessTokenSecret2(tokenSecret),
+    tokenValue: formatAccessTokenValue2(kind, tokenId, tokenSecret)
   };
 }
 function accessTokenPrefixForKind(kind) {
   switch (kind) {
     case "personal":
-      return PERSONAL_ACCESS_TOKEN_PREFIX;
+      return PERSONAL_ACCESS_TOKEN_PREFIX2;
     case "serviceAccount":
-      return SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX;
+      return SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2;
   }
 }
 function accessTokenKindFromLabel(label) {
-  if (label.startsWith(`${PERSONAL_ACCESS_TOKEN_PREFIX}_`)) {
+  if (label.startsWith(`${PERSONAL_ACCESS_TOKEN_PREFIX2}_`)) {
     return "personal";
   }
-  if (label.startsWith(`${SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX}_`)) {
+  if (label.startsWith(`${SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2}_`)) {
     return "serviceAccount";
   }
   return null;
 }
 // src/auth/csrf.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-var CSRF_HEADER_NAME = "x-sixb-csrf";
-function generateCsrfToken() {
+var CSRF_HEADER_NAME2 = "x-sixb-csrf";
+function generateCsrfToken2() {
   return randomBytes2(32).toString("base64url");
 }
-function isCsrfExemptMethod(method) {
+function isCsrfExemptMethod2(method) {
   const normalized = method.toUpperCase();
   return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
-function verifyDoubleSubmitCsrf(request, options) {
-  if (isCsrfExemptMethod(request.method)) {
+function verifyDoubleSubmitCsrf2(request, options) {
+  if (isCsrfExemptMethod2(request.method)) {
     return true;
   }
-  const cookieValue = getCookie(request, options.cookieName);
-  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME);
+  const cookieValue = getCookie2(request, options.cookieName);
+  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME2);
   if (!cookieValue || !headerValue) {
     return false;
   }
@@ -132,13 +143,13 @@ function safeEqual(left, right) {
 import { randomUUID as randomUUID3 } from "crypto";
 
 // src/security/applications.ts
-var applications = {
+var applications2 = {
   atlas: { kind: "application", id: "atlas", label: "Atlas" },
   app: { kind: "application", id: "app", label: "Custom app" }
 };
-var APPLICATION_IDS = new Set(Object.values(applications).map((application) => application.id));
+var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
 // src/security/errors.ts
-class SecurityValidationError extends Error {
+class SecurityValidationError2 extends Error {
   name = "SecurityValidationError";
 }
 
@@ -210,6 +221,7 @@ var GRANT_CAPABILITIES = Object.keys({
   edit: true,
   append: true,
   apply: true,
+  share: true,
   run: true,
   observe: true,
   manage: true
@@ -222,12 +234,12 @@ function formatAlternatives(values) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw createError(`[Sixb] ${field} must not be empty.`);
   }
 }
-function assertOptionalString(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertOptionalString(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (value === undefined) {
     return;
   }
@@ -257,7 +269,7 @@ function assertNoDuplicateIds(ids, field) {
   const seen = new Set;
   for (const id of ids) {
     if (seen.has(id)) {
-      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate group id '${id}'.`);
     }
     seen.add(id);
   }
@@ -266,12 +278,12 @@ function assertNoDuplicateOperations(operations, field) {
   const seen = new Set;
   for (const operation of operations) {
     if (seen.has(operation)) {
-      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
     }
     seen.add(operation);
   }
 }
-function assertGroupDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertGroupDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Group definition must be an object.");
   }
@@ -290,7 +302,7 @@ function isGroupDefinition(value) {
     return false;
   }
 }
-function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Membership policy definition must be an object.");
   }
@@ -310,7 +322,7 @@ function isMembershipPolicyDefinition(value) {
     return false;
   }
 }
-function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value) || value.kind !== "grant") {
     throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`);
   }
@@ -352,7 +364,7 @@ function assertSelection(value, field, createError) {
     assertNonEmptyString(id, `${field} grant selection id`, createError);
   }
 }
-function assertRoleDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertRoleDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Role definition must be an object.");
   }
@@ -385,25 +397,25 @@ function validateSecurityDefinitionsAtStartup(input) {
   for (const group of input.groups) {
     assertGroupDefinition(group);
     if (groupsById.has(group.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate group id: ${group.id}`);
     }
     groupsById.set(group.id, group);
   }
   for (const role of input.roles ?? []) {
     assertRoleDefinition(role);
     if (rolesById.has(role.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate role id: ${role.id}`);
     }
     if (role.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
+      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
     }
     if (role.grants.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must declare at least one grant.`);
+      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must declare at least one grant.`);
     }
     assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`);
     for (const groupId of role.grantedToGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     for (const grant of role.grants) {
@@ -414,25 +426,25 @@ function validateSecurityDefinitionsAtStartup(input) {
   for (const policy of input.membershipPolicies) {
     assertMembershipPolicyDefinition(policy);
     if (membershipPoliciesById.has(policy.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate membership policy id: ${policy.id}`);
     }
     if (policy.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
+      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
     }
     if (policy.can.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
+      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
     }
     assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`);
     assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`);
     assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`);
     for (const groupId of policy.grantedToGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     for (const groupId of policy.scopeGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     membershipPoliciesById.set(policy.id, policy);
@@ -448,9 +460,9 @@ function validateSecurityDefinitionsAtStartup(input) {
 }
 function assertGrantReferences(roleId, grant, registered) {
   if (grant.capability === "run" && grant.target === "agent") {
-    const spec2 = GRANT_KINDS[grantKindOf(grant)];
+    const spec = GRANT_KINDS[grantKindOf(grant)];
     if (!registered.agentAvailable) {
-      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec2.fix}`);
+      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`);
     }
     return;
   }
@@ -462,7 +474,7 @@ function assertGrantReferences(roleId, grant, registered) {
   const ids = grant.selection.all ? grant.selection.except : grant.selection.ids;
   for (const id of ids) {
     if (!universe.has(id)) {
-      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
+      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
     }
   }
 }
@@ -471,13 +483,13 @@ function assertGrantReferences(roleId, grant, registered) {
 var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
 function assertNonEmptyArray(value, field) {
   if (value.length === 0) {
-    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`);
+    throw new SecurityValidationError2(`[Sixb] ${field} must not be empty.`);
   }
 }
 function groupIdsFrom(groups, field) {
   return groups.map((group) => {
     if (!isRecord(group) || group.kind !== "group") {
-      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} must contain only group definitions.`);
     }
     assertNonEmptyString(group.id, `${field} group id`);
     return group.id;
@@ -486,12 +498,12 @@ function groupIdsFrom(groups, field) {
 function membershipOperationsFrom(operations, field) {
   return operations.map((operation) => {
     if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
-      throw new SecurityValidationError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
     }
     return operation;
   });
 }
-function defineGroup(id, options = {}) {
+function defineGroup2(id, options = {}) {
   assertNonEmptyString(id, "Group id");
   assertOptionalString(options.label, `Group '${id}' label`);
   assertOptionalString(options.description, `Group '${id}' description`);
@@ -502,7 +514,7 @@ function defineGroup(id, options = {}) {
     ...options.description !== undefined ? { description: options.description } : {}
   };
 }
-function defineRole(id, options) {
+function defineRole2(id, options) {
   assertNonEmptyString(id, "Role id");
   assertOptionalString(options.label, `Role '${id}' label`);
   assertOptionalString(options.description, `Role '${id}' description`);
@@ -512,7 +524,7 @@ function defineRole(id, options) {
     assertGrantDefinition(grant, `Role '${id}' grants`);
   }
   if (options.grants.length === 0) {
-    throw new SecurityValidationError(`[Sixb] Role '${id}' grants must not be empty.`);
+    throw new SecurityValidationError2(`[Sixb] Role '${id}' grants must not be empty.`);
   }
   return {
     kind: "role",
@@ -523,7 +535,7 @@ function defineRole(id, options) {
     grants: options.grants
   };
 }
-function defineMembershipPolicy(id, options) {
+function defineMembershipPolicy2(id, options) {
   assertNonEmptyString(id, "Membership policy id");
   assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`);
   assertNonEmptyArray(options.can, `Membership policy '${id}' can`);
@@ -544,7 +556,8 @@ var BREADTH_TARGETS = [
   "sync",
   "pipeline",
   "application",
-  "connector"
+  "connector",
+  "share"
 ];
 function isBreadthSelector(value) {
   if (typeof value !== "object" || value === null)
@@ -554,7 +567,7 @@ function isBreadthSelector(value) {
 }
 function definitionIdOf(item, label) {
   if (typeof item?.id !== "string" || !item.id.trim()) {
-    throw new SecurityValidationError(`[Sixb] ${label} requires definitions with a non-empty id.`);
+    throw new SecurityValidationError2(`[Sixb] ${label} requires definitions with a non-empty id.`);
   }
   return item.id;
 }
@@ -570,7 +583,7 @@ function all(target, except = []) {
     }
   };
 }
-var every = {
+var every2 = {
   object: () => all("object"),
   dataset: () => all("dataset"),
   action: () => all("action"),
@@ -578,8 +591,405 @@ var every = {
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
   application: () => all("application"),
-  connector: () => all("connector")
+  connector: () => all("connector"),
+  share: () => all("share")
 };
+// src/actions/errors.ts
+class ActionDefinitionError2 extends Error {
+  name = "ActionDefinitionError";
+}
+
+class ActionEditCommitError2 extends Error {
+  name = "ActionEditCommitError";
+}
+function missingActionMutationMessage(actionId) {
+  return `Action "${actionId}" must declare .writeback(...) or .edits(...).`;
+}
+function effectsWithoutEditsMessage(actionId) {
+  return `Action "${actionId}" cannot declare .effects(...) without .edits(...).`;
+}
+
+// src/actions/validation.ts
+function assertNonEmpty2(value, field) {
+  if (!value.trim()) {
+    throw new ActionDefinitionError2(`Action ${field} must not be empty.`);
+  }
+}
+function isActionDefinition2(value) {
+  const binding = value?.binding;
+  return typeof value === "object" && value !== null && value.kind === "action" && (binding?.kind === "global" || binding?.kind === "object");
+}
+function isGlobalActionDefinition2(value) {
+  return value.binding.kind === "global";
+}
+function isObjectActionDefinition2(value) {
+  return value.binding.kind === "object";
+}
+function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
+  const knownParamIds = new Set(Object.keys(paramsConfig));
+  const normalized = {};
+  for (const paramId of Object.keys(params)) {
+    if (!knownParamIds.has(paramId)) {
+      throw new OntologyValidationError2(`Unknown param '${paramId}' for action '${pathPrefix}'`);
+    }
+  }
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined) {
+      if (paramDef.required) {
+        throw new OntologyValidationError2(`Missing required param '${paramId}' for action '${pathPrefix}'`);
+      }
+      continue;
+    }
+    if (value === null) {
+      if (!paramDef.nullable) {
+        throw new OntologyValidationError2(`[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`);
+      }
+      normalized[paramId] = null;
+      continue;
+    }
+    validateSchemaOrRefValue2(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+    normalized[paramId] = normalizeSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+  }
+  return normalized;
+}
+function coerceActionParamsToTyped2(paramsConfig, params, valueTypesById) {
+  const coerced = { ...params };
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined)
+      continue;
+    const schema = paramDef.schema;
+    if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+      continue;
+    }
+    coerced[paramId] = coerceSchemaValueToTyped2(schema, value, valueTypesById);
+  }
+  return coerced;
+}
+function validateActionSubject(action, subject) {
+  if (isGlobalActionDefinition2(action) && subject.kind !== "none") {
+    throw new OntologyValidationError2(`Action '${action.id}' does not accept an object subject.`);
+  }
+}
+function resolveObjectActionSubject(params) {
+  const { runtime, action, subject } = params;
+  if (subject.kind !== "object") {
+    throw new OntologyValidationError2(`Action '${action.id}' requires an object subject.`);
+  }
+  const objectType = runtime.ontology.resolveObjectType(subject.objectTypeId);
+  if (!actionAppliesToObjectType(runtime, action, objectType)) {
+    throw new OntologyValidationError2(`Action '${action.id}' is not valid for object type '${objectType.id}'.`);
+  }
+  return objectType;
+}
+function actionAppliesToObjectType(runtime, action, objectType) {
+  return runtime.actionRegistry.listForType(objectType).some((candidate) => candidate.id === action.id);
+}
+function normalizeSchemaOrRefValue(schema, value, path, valueTypesById) {
+  if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+    const refValue = value;
+    return {
+      objectTypeId: refValue.objectTypeId,
+      primaryId: refValue.primaryId
+    };
+  }
+  return normalizeSchemaValue2(schema, value, path, valueTypesById);
+}
+
+// src/shares/errors.ts
+class ShareDefinitionError2 extends Error {
+  name = "ShareDefinitionError";
+}
+
+// src/shares/builders.ts
+var shareTargets = new WeakSet;
+function defineShare2(id, options) {
+  assertNonEmpty(id, "Share id");
+  if (!isObjectType(options.target)) {
+    throw invalid(`Share '${id}' target must be an object type.`);
+  }
+  if (typeof options.grants !== "function") {
+    throw invalid(`Share '${id}' grants must be a function.`);
+  }
+  if (options.description !== undefined && typeof options.description !== "string") {
+    throw invalid(`Share '${id}' description must be a string.`);
+  }
+  const target = createShareTarget(options.target.id);
+  let authoredGrants;
+  try {
+    authoredGrants = options.grants({ target });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError2)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share '${id}' grants are invalid: ${reason}`);
+  }
+  if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+    throw invalid(`Share '${id}' must declare at least one grant.`);
+  }
+  const grants = snapshotShareGrants(id, options.target.id, authoredGrants);
+  return Object.freeze({
+    kind: "share",
+    id,
+    target: Object.freeze({ kind: "object", objectTypeId: options.target.id }),
+    grants,
+    ...options.description === undefined ? {} : { description: options.description }
+  });
+}
+function isShareDefinition(value) {
+  if (!isRecord2(value) || value.kind !== "share" || !isNonEmpty(value.id))
+    return false;
+  if (!isRecord2(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
+    return false;
+  }
+  return Array.isArray(value.grants);
+}
+function snapshotShareDefinition(value) {
+  try {
+    if (!isRecord2(value)) {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const kind = value.kind;
+    const authoredId = value.id;
+    const target = value.target;
+    const authoredGrants = value.grants;
+    const description = value.description;
+    if (kind !== "share") {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const id = nonEmpty(authoredId, "Share id");
+    if (!isRecord2(target)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    const targetKind = target.kind;
+    const authoredObjectTypeId = target.objectTypeId;
+    if (targetKind !== "object" || !isNonEmpty(authoredObjectTypeId)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+      throw invalid(`Share '${id}' must declare grants.`);
+    }
+    if (description !== undefined && typeof description !== "string") {
+      throw invalid(`Share '${id}' description must be a string.`);
+    }
+    const objectTypeId = authoredObjectTypeId;
+    return Object.freeze({
+      kind: "share",
+      id,
+      target: Object.freeze({ kind: "object", objectTypeId }),
+      grants: snapshotShareGrants(id, objectTypeId, authoredGrants),
+      ...description === undefined ? {} : { description }
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError2)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share definition is invalid: ${reason}`);
+  }
+}
+function isShareTarget(value) {
+  return typeof value === "object" && value !== null && shareTargets.has(value);
+}
+function createShareViewGrant(target) {
+  assertShareTarget(target);
+  return createShareViewGrantWithLinks(target.objectTypeId, Object.freeze({ kind: "none" }));
+}
+function createShareActionGrant(action, target) {
+  assertShareTarget(target);
+  const objectTypeId = action.binding.objectType.id;
+  if (target.objectTypeId !== objectTypeId) {
+    throw invalid(`Action '${action.id}' is defined on '${objectTypeId}', not Share target '${target.objectTypeId}'. Shared Actions are exact-type only in V1.`);
+  }
+  return Object.freeze({
+    kind: "action.apply",
+    actionId: action.id,
+    subjectObjectTypeId: target.objectTypeId
+  });
+}
+function createShareTarget(objectTypeId) {
+  const target = { objectTypeId };
+  shareTargets.add(target);
+  return Object.freeze(target);
+}
+function createShareViewGrantWithLinks(targetObjectTypeId, links) {
+  const grant = {
+    kind: "object.view",
+    targetObjectTypeId,
+    links
+  };
+  Object.defineProperty(grant, "withLinks", {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: (...args) => {
+      if (args.length === 0) {
+        return freezeViewGrant(targetObjectTypeId, Object.freeze({ kind: "all" }));
+      }
+      const selected = args[0];
+      if (!Array.isArray(selected)) {
+        throw invalid("withLinks(...) expects an array, or no argument for every direct link.");
+      }
+      return freezeViewGrant(targetObjectTypeId, Object.freeze({
+        kind: "selected",
+        links: Object.freeze(selected.map(snapshotLinkPathSelection))
+      }));
+    }
+  });
+  return Object.freeze(grant);
+}
+function freezeViewGrant(targetObjectTypeId, links) {
+  return Object.freeze({ kind: "object.view", targetObjectTypeId, links });
+}
+function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
+  const grants = [];
+  const actionIds = new Set;
+  let viewCount = 0;
+  for (let index = 0;index < authored.length; index += 1) {
+    const grant = authored[index];
+    if (!isRecord2(grant)) {
+      throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+    }
+    const kind = grant.kind;
+    if (kind === "object.view") {
+      const authoredTargetObjectTypeId = grant.targetObjectTypeId;
+      const links = grant.links;
+      if (authoredTargetObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' view grant must use its contextual target.`);
+      }
+      viewCount += 1;
+      if (viewCount > 1) {
+        throw invalid(`Share '${shareId}' must declare exactly one view grant.`);
+      }
+      grants.push(Object.freeze({
+        kind: "object.view",
+        targetObjectTypeId,
+        links: snapshotLinkMode(links)
+      }));
+      continue;
+    }
+    if (kind === "action.apply") {
+      const actionId = grant.actionId;
+      const subjectObjectTypeId = grant.subjectObjectTypeId;
+      if (!isNonEmpty(actionId) || subjectObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' action grant must apply to its contextual target.`);
+      }
+      if (actionIds.has(actionId)) {
+        throw invalid(`Share '${shareId}' contains duplicate action '${actionId}'.`);
+      }
+      actionIds.add(actionId);
+      grants.push(Object.freeze({
+        kind: "action.apply",
+        actionId,
+        subjectObjectTypeId: targetObjectTypeId
+      }));
+      continue;
+    }
+    throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+  }
+  if (viewCount !== 1) {
+    throw invalid(`Share '${shareId}' must declare exactly one can.view(target) grant.`);
+  }
+  return Object.freeze(grants);
+}
+function snapshotLinkMode(value) {
+  if (!isRecord2(value))
+    throw invalid("Share link selection must be an object.");
+  const kind = value.kind;
+  const links = value.links;
+  if (kind === "none" || kind === "all") {
+    return Object.freeze({ kind });
+  }
+  if (kind !== "selected" || !Array.isArray(links)) {
+    throw invalid("Share link selection must be none, all, or selected links.");
+  }
+  if (links.length === 0) {
+    throw invalid("withLinks([]) is empty; omit withLinks() when no links should be shared.");
+  }
+  try {
+    return Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(links)
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError2)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share link selection is invalid: ${reason}`);
+  }
+}
+function snapshotLinkPaths(values) {
+  const byKey = new Map;
+  for (const value of values) {
+    const captured = canonicalizeLinkPath(snapshotLinkPathSelection(value));
+    const key = JSON.stringify([captured.sourceObjectTypeId, captured.linkId]);
+    const current = byKey.get(key);
+    if (!current) {
+      byKey.set(key, captured);
+      continue;
+    }
+    if (!sameLinkTargets(current.targetObjectTypeId, captured.targetObjectTypeId)) {
+      throw invalid(`Link '${captured.sourceObjectTypeId}.${captured.linkId}' declares inconsistent targets.`);
+    }
+    byKey.set(key, Object.freeze({
+      ...current,
+      selection: mergeLinkModes(current.selection, captured.selection)
+    }));
+  }
+  return Object.freeze([...byKey.values()]);
+}
+function canonicalizeLinkPath(value) {
+  return Object.freeze({
+    ...value,
+    selection: value.selection.kind === "selected" ? Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(value.selection.links)
+    }) : value.selection
+  });
+}
+function mergeLinkModes(left, right) {
+  if (left.kind === "all" || right.kind === "all")
+    return Object.freeze({ kind: "all" });
+  if (left.kind === "none")
+    return right;
+  if (right.kind === "none")
+    return left;
+  return Object.freeze({
+    kind: "selected",
+    links: snapshotLinkPaths([...left.links, ...right.links])
+  });
+}
+function sameLinkTargets(left, right) {
+  if (typeof left === "string" || typeof right === "string")
+    return left === right;
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertShareTarget(value) {
+  if (!isShareTarget(value)) {
+    throw invalid("Shared grants must use the target provided by defineShare(...).");
+  }
+}
+function isObjectType(value) {
+  return isRecord2(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function assertNonEmpty(value, field) {
+  if (!isNonEmpty(value))
+    throw invalid(`${field} must not be empty.`);
+}
+function nonEmpty(value, field) {
+  assertNonEmpty(value, field);
+  return value;
+}
+function invalid(message) {
+  return new ShareDefinitionError2(`[Sixb] ${message}`);
+}
+
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
 var RUN_TARGETS = ["workflow", "sync", "pipeline"];
@@ -589,7 +999,8 @@ var TARGET_BY_DEFINITION_KIND = {
   pipeline: "pipeline",
   workflow: "workflow",
   application: "application",
-  connector: "connector"
+  connector: "connector",
+  share: "share"
 };
 var UNDISCRIMINATED_TARGETS = ["object", "action"];
 function targetOfDefinition(item, label, allowedTargets) {
@@ -597,7 +1008,7 @@ function targetOfDefinition(item, label, allowedTargets) {
   const discriminated = typeof kind === "string" ? TARGET_BY_DEFINITION_KIND[kind] : undefined;
   if (discriminated) {
     if (!isAllowedTarget(discriminated, allowedTargets)) {
-      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`);
+      throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`);
     }
     return discriminated;
   }
@@ -605,7 +1016,7 @@ function targetOfDefinition(item, label, allowedTargets) {
   const only = candidates.length === 1 ? candidates[0] : undefined;
   if (only)
     return only;
-  throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one Sixb could not classify.`);
+  throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one Sixb could not classify.`);
 }
 function isAllowedTarget(target, allowedTargets) {
   return allowedTargets.includes(target);
@@ -613,7 +1024,7 @@ function isAllowedTarget(target, allowedTargets) {
 function resolveGrant(input, label, allowedTargets) {
   if (isBreadthSelector(input)) {
     if (!isAllowedTarget(input.target, allowedTargets)) {
-      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} selectors, but received every.${input.target}().`);
+      throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} selectors, but received every.${input.target}().`);
     }
     return { target: input.target, selection: input.selection };
   }
@@ -626,11 +1037,11 @@ function resolveGrant(input, label, allowedTargets) {
       continue;
     }
     if (itemTarget !== target) {
-      throw new SecurityValidationError(`[Sixb] ${label} requires one target per grant, but received both ${target} and ${itemTarget} definitions. Use one grant each.`);
+      throw new SecurityValidationError2(`[Sixb] ${label} requires one target per grant, but received both ${target} and ${itemTarget} definitions. Use one grant each.`);
     }
   }
   if (target === undefined) {
-    throw new SecurityValidationError(`[Sixb] ${label} requires at least one definition.`);
+    throw new SecurityValidationError2(`[Sixb] ${label} requires at least one definition.`);
   }
   const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
   return { target, selection: { all: false, ids } };
@@ -640,6 +1051,8 @@ function access(input) {
   return { kind: "grant", capability: "access", target: "application", selection };
 }
 function view(input) {
+  if (isShareTarget(input))
+    return createShareViewGrant(input);
   const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS);
   return { kind: "grant", capability: "view", target, selection };
 }
@@ -658,11 +1071,28 @@ function append(input) {
   };
 }
 function apply(input) {
-  return {
+  const grant = {
     kind: "grant",
     capability: "apply",
     selection: resolveGrant(input, "can.apply", ["action"]).selection
   };
+  const one = Array.isArray(input) || isBreadthSelector(input) ? undefined : input;
+  if (one && isObjectActionDefinition2(one)) {
+    Object.defineProperty(grant, "on", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (target) => createShareActionGrant(one, target)
+    });
+  }
+  return grant;
+}
+function share(input) {
+  return {
+    kind: "grant",
+    capability: "share",
+    selection: resolveGrant(input, "can.share", ["share"]).selection
+  };
 }
 function run(input) {
   if (isAgentReference(input)) {
@@ -679,7 +1109,7 @@ function isAgentUsageReference(input) {
 }
 function observe(input) {
   if (input !== "logs" && !isAgentUsageReference(input)) {
-    throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.');
+    throw new SecurityValidationError2('[Sixb] can.observe accepts "logs" or agent.usage.');
   }
   const target = input === "logs" ? "logs" : "aiUsage";
   return {
@@ -705,12 +1135,13 @@ function manage(input) {
     selection: resolveGrant(input, "can.manage", ["connector"]).selection
   };
 }
-var can = {
+var can2 = {
   access,
   view,
   edit,
   append,
   apply,
+  share,
   run,
   observe,
   manage
@@ -736,7 +1167,8 @@ class SecurityRegistry {
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
       observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"])
+      manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds
     });
     const universe = {
       applicationIds: input.applicationIds ?? APPLICATION_IDS,
@@ -749,6 +1181,7 @@ class SecurityRegistry {
       connectorIds: input.connectorIds ?? new Set,
       observableIds: new Set(["logs", "aiUsage"]),
       manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
     this.groupsById = definitions.groupsById;
@@ -757,7 +1190,7 @@ class SecurityRegistry {
     this.resolvedRoles = definitions.roles.map((role) => ({
       id: role.id,
       grantedToGroupIds: role.grantedToGroupIds,
-      grants: resolveRoleGrants(role, universe)
+      grants: resolveRoleGrants2(role, universe)
     }));
   }
   listGroups() {
@@ -783,7 +1216,7 @@ class SecurityRegistry {
   }
 }
 // src/storage/auth/errors.ts
-class AuthStorageError extends Error {
+class AuthStorageError2 extends Error {
   code;
   name = "AuthStorageError";
   constructor(code, message) {
@@ -855,18 +1288,18 @@ function cloneDate(value) {
 function dateOrNow(value) {
   return value ? cloneDate(value) : new Date;
 }
-function assertNonEmpty2(value, label) {
+function assertNonEmpty4(value, label) {
   const normalized = value.trim();
   if (!normalized) {
-    throw new AuthStorageError("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
+    throw new AuthStorageError2("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
   }
   return normalized;
 }
 function normalizeEmail(email) {
-  return assertNonEmpty2(email, "Email").toLowerCase();
+  return assertNonEmpty4(email, "Email").toLowerCase();
 }
 function normalizeGroupIds(groupIds) {
-  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty2(groupId, "Group id")))];
+  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty4(groupId, "Group id")))];
 }
 function normalizeOptionalGroupIds(groupIds) {
   return groupIds === undefined ? undefined : normalizeGroupIds(groupIds);
@@ -949,22 +1382,22 @@ function revokeActiveMagicLinksForEmail(state, projectId, email, revokedAt) {
 }
 function assertSessionIdAvailable(state, projectId, sessionId) {
   if (state.sessions.has(sessionKey(projectId, sessionId))) {
-    throw new AuthStorageError("duplicate_session", `[Sixb] Session '${sessionId}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_session", `[Sixb] Session '${sessionId}' already exists for project '${projectId}'.`);
   }
 }
 function validateCompleteSessionInput(state, projectId, session) {
-  const sessionId = assertNonEmpty2(session.id, "Session id");
-  assertNonEmpty2(session.audience, "Session audience");
-  assertNonEmpty2(session.tokenHash, "Session token hash");
+  const sessionId = assertNonEmpty4(session.id, "Session id");
+  assertNonEmpty4(session.audience, "Session audience");
+  assertNonEmpty4(session.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, sessionId);
 }
 function createSessionRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Session id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-  const audience = resolveAuthSessionAudience(input.audience);
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Session token hash");
+  const id = assertNonEmpty4(input.id, "Session id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+  const audience = resolveAuthSessionAudience2(input.audience);
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
     id,
@@ -983,12 +1416,12 @@ function createSessionRecord(state, input) {
   return session;
 }
 function createServiceAccountRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Service account id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Service account name");
+  const id = assertNonEmpty4(input.id, "Service account id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Service account name");
   const key = serviceAccountKey(projectId, id);
   if (state.serviceAccounts.has(key)) {
-    throw new AuthStorageError("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
   }
   const createdAt = dateOrNow(input.createdAt);
   const serviceAccount = {
@@ -1006,11 +1439,11 @@ function createServiceAccountRecord(state, input) {
   return serviceAccount;
 }
 function upsertServiceAccountGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
-    throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
   }
   const key = serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId);
   const existing = state.serviceAccountGroupMemberships.get(key);
@@ -1028,16 +1461,16 @@ function upsertServiceAccountGroupMembershipRecord(state, input) {
   return membership;
 }
 function createAccessTokenRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Access token id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Access token name");
-  const subjectId = assertNonEmpty2(input.subjectId, "Access token subject id");
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Access token hash");
+  const id = assertNonEmpty4(input.id, "Access token id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Access token name");
+  const subjectId = assertNonEmpty4(input.subjectId, "Access token subject id");
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Access token hash");
   assertAccessTokenSubject(input.kind, input.subjectType);
   assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
   const key = accessTokenKey(projectId, id);
   if (state.accessTokens.has(key)) {
-    throw new AuthStorageError("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
   }
   const token = {
     id,
@@ -1057,11 +1490,11 @@ function createAccessTokenRecord(state, input) {
   return token;
 }
 function upsertGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.users.has(userKey(projectId, userId))) {
-    throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
   }
   const key = groupMembershipKey(projectId, userId, groupId);
   const existing = state.groupMemberships.get(key);
@@ -1079,9 +1512,9 @@ function upsertGroupMembershipRecord(state, input) {
   return membership;
 }
 function removeGroupMembershipRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const userId = assertNonEmpty2(params.userId, "User id");
-  const groupId = assertNonEmpty2(params.groupId, "Group id");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const userId = assertNonEmpty4(params.userId, "User id");
+  const groupId = assertNonEmpty4(params.groupId, "Group id");
   const key = groupMembershipKey(projectId, userId, groupId);
   const existing = state.groupMemberships.get(key);
   if (!existing) {
@@ -1094,32 +1527,32 @@ function assertAccessTokenSubject(kind, subjectType) {
   if (kind === "personal" && subjectType === "user" || kind === "serviceAccount" && subjectType === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError("invalid_input", `[Sixb] Access token kind '${kind}' cannot target subject type '${subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${kind}' cannot target subject type '${subjectType}'.`);
 }
 function assertAccessTokenSubjectExists(state, projectId, subjectType, subjectId) {
   if (subjectType === "user") {
     if (state.users.has(userKey(projectId, subjectId)))
       return;
-    throw new AuthStorageError("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
   }
   if (state.serviceAccounts.has(serviceAccountKey(projectId, subjectId)))
     return;
-  throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
+  throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function consumeMagicLinkRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "Magic link id");
-  const tokenHash = assertNonEmpty2(params.tokenHash, "Magic link token hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "Magic link id");
+  const tokenHash = assertNonEmpty4(params.tokenHash, "Magic link token hash");
   const key = magicLinkKey(projectId, id);
   const existing = state.magicLinks.get(key);
   if (!existing) {
-    throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
   }
   if (existing.tokenHash !== tokenHash || existing.consumedAt || existing.revokedAt) {
-    throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
+    throw new AuthStorageError2("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
   }
   if (existing.expiresAt <= params.consumedAt) {
-    throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
+    throw new AuthStorageError2("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
   }
   const consumed = {
     ...existing,
@@ -1129,19 +1562,19 @@ function consumeMagicLinkRecord(state, params) {
   return consumed;
 }
 function consumeOidcAttemptRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "OIDC authorization attempt id");
-  const stateHash = assertNonEmpty2(params.stateHash, "OIDC state hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "OIDC authorization attempt id");
+  const stateHash = assertNonEmpty4(params.stateHash, "OIDC state hash");
   const key = oidcAttemptKey(projectId, id);
   const existing = state.oidcAuthorizationAttempts.get(key);
   if (!existing) {
-    throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
   }
   if (existing.stateHash !== stateHash || existing.consumedAt) {
-    throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
+    throw new AuthStorageError2("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
   }
   if (existing.expiresAt <= params.consumedAt) {
-    throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
+    throw new AuthStorageError2("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
   }
   const consumed = {
     ...existing,
@@ -1186,7 +1619,7 @@ class InMemoryAuthAccessTokenStore {
     const key = accessTokenKey(params.projectId, params.id);
     const existing = this.state.accessTokens.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1199,7 +1632,7 @@ class InMemoryAuthAccessTokenStore {
     const key = accessTokenKey(params.projectId, params.id);
     const existing = this.state.accessTokens.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1213,7 +1646,7 @@ class InMemoryAuthAccessTokenStore {
 }
 
 // src/storage/auth/types.ts
-var MAX_PENDING_DEVICE_AUTHORIZATIONS = 100;
+var MAX_PENDING_DEVICE_AUTHORIZATIONS2 = 100;
 
 // src/storage/auth/in-memory/device-authorizations.ts
 class InMemoryAuthDeviceAuthorizationStore {
@@ -1222,16 +1655,16 @@ class InMemoryAuthDeviceAuthorizationStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "Device authorization id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    for (const [key2, authorization] of this.state.deviceAuthorizations) {
+    const id = assertNonEmpty4(input.id, "Device authorization id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    for (const [key, authorization] of this.state.deviceAuthorizations) {
       if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
-        this.state.deviceAuthorizations.delete(key2);
+        this.state.deviceAuthorizations.delete(key);
       }
     }
     const pending = [...this.state.deviceAuthorizations.values()].filter((authorization) => authorization.projectId === projectId && authorization.status === "pending").length;
-    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
-      throw new AuthStorageError("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
+    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS2) {
+      throw new AuthStorageError2("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
     }
     const key = deviceAuthorizationKey(projectId, id);
     if (this.state.deviceAuthorizations.has(key)) {
@@ -1240,10 +1673,10 @@ class InMemoryAuthDeviceAuthorizationStore {
     const record = {
       id,
       projectId,
-      deviceCodeHash: assertNonEmpty2(input.deviceCodeHash, "Device code hash"),
-      userCode: assertNonEmpty2(input.userCode, "User code"),
-      clientName: assertNonEmpty2(input.clientName, "Client name"),
-      tokenName: assertNonEmpty2(input.tokenName, "Token name"),
+      deviceCodeHash: assertNonEmpty4(input.deviceCodeHash, "Device code hash"),
+      userCode: assertNonEmpty4(input.userCode, "User code"),
+      clientName: assertNonEmpty4(input.clientName, "Client name"),
+      tokenName: assertNonEmpty4(input.tokenName, "Token name"),
       tokenExpiresAt: new Date(input.tokenExpiresAt),
       status: "pending",
       createdAt: new Date(input.createdAt),
@@ -1269,13 +1702,13 @@ class InMemoryAuthDeviceAuthorizationStore {
     const user = this.state.users.get(userKey(params.projectId, params.userId));
     const session = this.state.sessions.get(sessionKey(params.projectId, params.sessionId));
     if (!user || user.status !== "active" || !session || session.userId !== user.id || !isActiveSession(session, params.approvedAt)) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
     }
     const next = {
       ...record,
       status: "approved",
-      approvedUserId: assertNonEmpty2(params.userId, "Approved user id"),
-      approvedSessionId: assertNonEmpty2(params.sessionId, "Approved session id"),
+      approvedUserId: assertNonEmpty4(params.userId, "Approved user id"),
+      approvedSessionId: assertNonEmpty4(params.sessionId, "Approved session id"),
       approvedAt: new Date(params.approvedAt)
     };
     this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
@@ -1294,16 +1727,16 @@ class InMemoryAuthDeviceAuthorizationStore {
   requirePending(projectId, id, now) {
     const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(projectId, id));
     if (!record) {
-      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
     }
     if (record.status !== "pending" || record.expiresAt <= now) {
-      throw new AuthStorageError("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
     }
     return record;
   }
 }
 function duplicateAuthorization(id, projectId) {
-  return new AuthStorageError("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
+  return new AuthStorageError2("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
 }
 
 // src/storage/auth/in-memory/group-memberships.ts
@@ -1334,10 +1767,10 @@ class InMemoryAuthUserIdentityStore {
     this.state = state;
   }
   async upsert(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-    const subject = assertNonEmpty2(input.subject, "Subject");
-    const userId = assertNonEmpty2(input.userId, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+    const subject = assertNonEmpty4(input.subject, "Subject");
+    const userId = assertNonEmpty4(input.userId, "User id");
     const key = identityKey(projectId, strategyId, subject);
     const existing = this.state.identities.get(key);
     const createdAt = existing?.createdAt ?? dateOrNow(input.createdAt);
@@ -1387,8 +1820,8 @@ class InMemoryAuthInvitationStore {
     this.state = state;
   }
   async createOrUpdateActive(input) {
-    const id = assertNonEmpty2(input.id, "Invitation id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Invitation id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const groupIds = normalizeGroupIds(input.groupIds);
     const now = dateOrNow(input.updatedAt ?? input.createdAt);
@@ -1407,7 +1840,7 @@ class InMemoryAuthInvitationStore {
     }
     const key = invitationKey(projectId, id);
     if (this.state.invitations.has(key)) {
-      throw new AuthStorageError("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
     }
     const invitation = {
       id,
@@ -1451,7 +1884,7 @@ class InMemoryAuthInvitationStore {
     const key = invitationKey(params.projectId, params.id);
     const existing = this.state.invitations.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1466,7 +1899,7 @@ class InMemoryAuthInvitationStore {
     const key = invitationKey(params.projectId, params.id);
     const existing = this.state.invitations.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1486,15 +1919,15 @@ class InMemoryAuthMagicLinkStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "Magic link id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience(input.audience);
+    const id = assertNonEmpty4(input.id, "Magic link id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+    const audience = resolveAuthSessionAudience2(input.audience);
     const email = normalizeEmail(input.email);
-    const tokenHash = assertNonEmpty2(input.tokenHash, "Magic link token hash");
+    const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
     if (this.state.magicLinks.has(key)) {
-      throw new AuthStorageError("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
     }
     revokeActiveMagicLinksForEmail(this.state, projectId, email, input.createdAt);
     const link = {
@@ -1535,16 +1968,16 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "OIDC authorization attempt id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience(input.audience);
-    const stateHash = assertNonEmpty2(input.stateHash, "OIDC state hash");
-    const nonceHash = assertNonEmpty2(input.nonceHash, "OIDC nonce hash");
-    const codeVerifier = assertNonEmpty2(input.codeVerifier, "OIDC code verifier");
+    const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+    const audience = resolveAuthSessionAudience2(input.audience);
+    const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
+    const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
+    const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
     const key = oidcAttemptKey(projectId, id);
     if (this.state.oidcAuthorizationAttempts.has(key)) {
-      throw new AuthStorageError("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
     }
     const attempt = {
       id,
@@ -1580,10 +2013,10 @@ class InMemoryAuthServiceAccountGroupMembershipStore {
     return cloneRecord(upsertServiceAccountGroupMembershipRecord(this.state, input));
   }
   async reconcileForServiceAccount(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
     if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     const groupIds = normalizeGroupIds(input.groupIds);
     const desired = new Set(groupIds);
@@ -1632,16 +2065,16 @@ class InMemoryAuthServiceAccountStore {
     return cloneOptionalRecord(record);
   }
   async update(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const id = assertNonEmpty2(input.id, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Service account id");
     const key = serviceAccountKey(projectId, id);
     const existing = this.state.serviceAccounts.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
     }
     const next = {
       ...existing,
-      name: input.name === undefined ? existing.name : assertNonEmpty2(input.name, "Service account name"),
+      name: input.name === undefined ? existing.name : assertNonEmpty4(input.name, "Service account name"),
       description: input.description === undefined ? existing.description : input.description,
       status: input.status ?? existing.status,
       updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : new Date
@@ -1715,7 +2148,7 @@ class InMemoryAuthSessionStore {
     const key = sessionKey(params.projectId, params.id);
     const existing = this.state.sessions.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1731,7 +2164,7 @@ class InMemoryAuthSessionStore {
     const key = sessionKey(params.projectId, params.id);
     const existing = this.state.sessions.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1749,15 +2182,15 @@ class InMemoryAuthUserStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "User id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const key = userKey(projectId, id);
     if (this.state.users.has(key)) {
-      throw new AuthStorageError("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
     }
     if (getUserByEmail(this.state, projectId, email)) {
-      throw new AuthStorageError("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
     }
     const createdAt = dateOrNow(input.createdAt);
     const user = {
@@ -1784,7 +2217,7 @@ class InMemoryAuthUserStore {
     const key = userKey(input.projectId, input.id);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1799,7 +2232,7 @@ class InMemoryAuthUserStore {
     const key = userKey(input.projectId, input.id);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1826,7 +2259,7 @@ class InMemoryAuthUserStore {
 }
 
 // src/storage/auth/in-memory/auth-storage.ts
-class InMemoryAuthStorage {
+class InMemoryAuthStorage2 {
   state = createAuthStorageState();
   users = new InMemoryAuthUserStore(this.state);
   identities = new InMemoryAuthUserIdentityStore(this.state);
@@ -1871,22 +2304,22 @@ class InMemoryAuthStorage {
     const key = deviceAuthorizationKey(input.projectId, input.id);
     const authorization = this.state.deviceAuthorizations.get(key);
     if (!authorization) {
-      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
     }
     if (authorization.deviceCodeHash !== input.deviceCodeHash) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Invalid device authorization.");
     }
     if (authorization.status === "pending") {
-      throw new AuthStorageError("pending_device_authorization", "[Sixb] Device authorization is pending.");
+      throw new AuthStorageError2("pending_device_authorization", "[Sixb] Device authorization is pending.");
     }
     if (authorization.status === "denied") {
-      throw new AuthStorageError("device_authorization_denied", "[Sixb] Device authorization was denied.");
+      throw new AuthStorageError2("device_authorization_denied", "[Sixb] Device authorization was denied.");
     }
     if (authorization.status !== "approved" || !authorization.approvedUserId || !authorization.approvedSessionId || authorization.expiresAt <= input.completedAt) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
     }
     if (input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device access token is invalid.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device access token is invalid.");
     }
     const accessToken = createAccessTokenRecord(this.state, input.accessToken);
     const consumed = {
@@ -1898,17 +2331,17 @@ class InMemoryAuthStorage {
     return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) };
   }
   async completeMagicLinkSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const magicLink = this.state.magicLinks.get(magicLinkKey(projectId, input.magicLinkId));
     if (!magicLink) {
-      throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
     }
     if (magicLink.tokenHash !== input.tokenHash || magicLink.consumedAt || magicLink.revokedAt) {
-      throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is not valid for project '${projectId}'.`);
     }
     if (magicLink.expiresAt <= completedAt) {
-      throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError2("expired_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is expired for project '${projectId}'.`);
     }
     const existingUser = getUserByEmail(this.state, projectId, magicLink.email);
     const activeInvitation = getActiveInvitationByEmail(this.state, projectId, magicLink.email, completedAt);
@@ -1921,7 +2354,7 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("suspended_user", `[Sixb] User '${existingUser.id}' is suspended for project '${projectId}'.`);
+      throw new AuthStorageError2("suspended_user", `[Sixb] User '${existingUser.id}' is suspended for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       consumeMagicLinkRecord(this.state, {
@@ -1930,7 +2363,7 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
       consumeMagicLinkRecord(this.state, {
@@ -1939,15 +2372,15 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
-        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError2("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
     }
     consumeMagicLinkRecord(this.state, {
@@ -1959,7 +2392,7 @@ class InMemoryAuthStorage {
     let user = existingUser;
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email: magicLink.email,
         displayName: input.newUserDisplayName,
@@ -1997,19 +2430,19 @@ class InMemoryAuthStorage {
     };
   }
   async completeOidcSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const attempt = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(projectId, input.oidcAuthorizationAttemptId));
     if (!attempt) {
-      throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' not found for project '${projectId}'.`);
     }
     if (attempt.stateHash !== input.stateHash || attempt.consumedAt) {
-      throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is not valid for project '${projectId}'.`);
     }
     if (attempt.expiresAt <= completedAt) {
-      throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError2("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
     }
-    const subject = assertNonEmpty2(input.subject, "Subject");
+    const subject = assertNonEmpty4(input.subject, "Subject");
     const email = normalizeEmail(input.email);
     const claims = normalizeClaims(input.claims);
     const identity = this.state.identities.get(identityKey(projectId, attempt.strategyId, subject));
@@ -2019,41 +2452,41 @@ class InMemoryAuthStorage {
     const manualGroupIds = normalizeGroupIds(input.manualGroupIds);
     if (identity && !user) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
     }
     if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
+      throw new AuthStorageError2("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
     }
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
+      throw new AuthStorageError2("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
     }
     if (shouldCreateUser && !input.emailVerified) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
-        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError2("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
     }
     this.consumeOidcAttempt(input, completedAt, projectId);
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email,
         displayName: input.displayName,
@@ -2105,7 +2538,7 @@ class InMemoryAuthStorage {
     const key = userKey(input.projectId, input.userId);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2191,7 +2624,7 @@ function assertSignInSessionAudience(projectId, sessionAudience, storedAudience)
   if (sessionAudience === storedAudience) {
     return;
   }
-  throw new AuthStorageError("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
 }
 // src/auth/session-cache.ts
 class SessionCache {
@@ -2249,19 +2682,19 @@ class SessionCache {
 
 // src/auth/sessions.ts
 import { createHash as createHash2, randomBytes as randomBytes3, randomUUID as randomUUID2 } from "crypto";
-function generateSessionSecret() {
+function generateSessionSecret2() {
   return randomBytes3(32).toString("base64url");
 }
-function hashSessionSecret(secret) {
+function hashSessionSecret2(secret) {
   return createHash2("sha256").update(secret).digest("hex");
 }
-function formatSessionCookieValue(sessionId, sessionSecret) {
+function formatSessionCookieValue2(sessionId, sessionSecret) {
   if (!sessionId || !sessionSecret || sessionId.includes(".") || sessionSecret.includes(".")) {
     throw new Error("[Sixb] Session cookie values must be non-empty and must not contain '.'.");
   }
   return `${sessionId}.${sessionSecret}`;
 }
-function parseSessionCookieValue(value) {
+function parseSessionCookieValue2(value) {
   if (!value) {
     return null;
   }
@@ -2274,13 +2707,13 @@ function parseSessionCookieValue(value) {
     sessionSecret: value.slice(firstDot + 1)
   };
 }
-function createSessionCredential(sessionId = `ses_${randomUUID2()}`) {
-  const sessionSecret = generateSessionSecret();
+function createSessionCredential2(sessionId = `ses_${randomUUID2()}`) {
+  const sessionSecret = generateSessionSecret2();
   return {
     sessionId,
     sessionSecret,
-    tokenHash: hashSessionSecret(sessionSecret),
-    cookieValue: formatSessionCookieValue(sessionId, sessionSecret)
+    tokenHash: hashSessionSecret2(sessionSecret),
+    cookieValue: formatSessionCookieValue2(sessionId, sessionSecret)
   };
 }
 
@@ -2288,7 +2721,7 @@ function createSessionCredential(sessionId = `ses_${randomUUID2()}`) {
 var SESSION_TOUCH_INTERVAL_MS = 60000;
 var ACCESS_TOKEN_TOUCH_INTERVAL_MS = 60000;
 
-class AuthRuntime {
+class AuthRuntime2 {
   projectId;
   storage;
   security;
@@ -2298,10 +2731,10 @@ class AuthRuntime {
     this.projectId = options.projectId;
     this.storage = options.storage;
     this.security = options.security;
-    this.config = resolveAuthConfig(options.config);
+    this.config = resolveAuthConfig2(options.config);
     this.sessionCache = this.config.session.cacheTtlMs > 0 ? new SessionCache(this.config.session.cacheTtlMs) : null;
     if (this.isEnabled() && !this.storage.auth) {
-      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+      throw new AuthRuntimeError2("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
     }
   }
   isEnabled() {
@@ -2325,26 +2758,26 @@ class AuthRuntime {
     const strategy = this.config.strategy;
     if (!strategy) {
       if (params.production) {
-        throw new AuthRuntimeError("production_auth_required", "[SixbServer] Auth is required in production. Configure auth or use an explicit disabled auth strategy.");
+        throw new AuthRuntimeError2("production_auth_required", "[SixbServer] Auth is required in production. Configure auth or use an explicit disabled auth strategy.");
       }
       return;
     }
     if (params.production && strategy.developmentOnly) {
-      throw new AuthRuntimeError("production_auth_required", `[SixbServer] Auth strategy '${strategy.id}' is development-only and cannot be used in production.`);
+      throw new AuthRuntimeError2("production_auth_required", `[SixbServer] Auth strategy '${strategy.id}' is development-only and cannot be used in production.`);
     }
     if (params.production && (strategy.kind === "disabled" || strategy.disabled === true) && strategy.allowDisabledInProduction !== true) {
-      throw new AuthRuntimeError("production_auth_required", "[SixbServer] Disabled auth in production requires allowDisabledInProduction: true.");
+      throw new AuthRuntimeError2("production_auth_required", "[SixbServer] Disabled auth in production requires allowDisabledInProduction: true.");
     }
   }
   async getSession(request, options = {}) {
     if (!this.isEnabled()) {
       return { authenticated: false, reason: "auth_disabled" };
     }
-    const audience = resolveAuthSessionAudience(options.audience);
+    const audience = resolveAuthSessionAudience2(options.audience);
     const credentialSource = options.credentialSource ?? "session";
     if (credentialSource !== "session") {
       const authorizationHeader = request.headers.get("authorization");
-      const tokenValue = getBearerAccessTokenValue(request);
+      const tokenValue = getBearerAccessTokenValue2(request);
       if (tokenValue) {
         return this.resolveAccessTokenSession(request, tokenValue);
       }
@@ -2359,15 +2792,15 @@ class AuthRuntime {
   }
   async resolveCookieSession(request, audience, activity) {
     const cookieOptions = this.getCookieOptions({ audience });
-    const cookieValue = getCookie(request, cookieOptions.sessionCookieName);
+    const cookieValue = getCookie2(request, cookieOptions.sessionCookieName);
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" };
     }
-    const parts = parseSessionCookieValue(cookieValue);
+    const parts = parseSessionCookieValue2(cookieValue);
     if (!parts) {
       return { authenticated: false, reason: "invalid_cookie" };
     }
-    const tokenHash = hashSessionSecret(parts.sessionSecret);
+    const tokenHash = hashSessionSecret2(parts.sessionSecret);
     const nowMs = Date.now();
     const cached = this.sessionCache?.get({
       sessionId: parts.sessionId,
@@ -2457,7 +2890,7 @@ class AuthRuntime {
     return new Date(session.absoluteExpiresAt ? Math.min(idleExpiresAtMs, session.absoluteExpiresAt.getTime()) : idleExpiresAtMs);
   }
   async resolveAccessTokenSession(request, tokenValue) {
-    const parts = parseAccessTokenValue(tokenValue);
+    const parts = parseAccessTokenValue2(tokenValue);
     if (!parts) {
       return { authenticated: false, reason: "invalid_access_token" };
     }
@@ -2467,7 +2900,7 @@ class AuthRuntime {
       projectId: this.projectId,
       id: parts.tokenId,
       kind: parts.kind,
-      tokenHash: hashAccessTokenSecret(parts.tokenSecret),
+      tokenHash: hashAccessTokenSecret2(parts.tokenSecret),
       now
     });
     if (!accessToken) {
@@ -2485,7 +2918,7 @@ class AuthRuntime {
       if (user.status === "suspended") {
         return { authenticated: false, reason: "suspended_user" };
       }
-      const memberships2 = await storage.groupMemberships.listForUser({
+      const memberships = await storage.groupMemberships.listForUser({
         projectId: this.projectId,
         userId: user.id
       });
@@ -2495,7 +2928,7 @@ class AuthRuntime {
         principal: { type: "user", id: user.id },
         user,
         accessToken,
-        groupIds: constrainTokenGroupIds(memberships2.map((membership) => membership.groupId), accessToken)
+        groupIds: constrainTokenGroupIds(memberships.map((membership) => membership.groupId), accessToken)
       };
     }
     const serviceAccount = await storage.serviceAccounts.getById({
@@ -2551,24 +2984,24 @@ class AuthRuntime {
   async requirePrincipal(request, options = {}) {
     const session = await this.getSession(request, options);
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return session.principal;
   }
   async requireUser(request, options = {}) {
     const session = await this.getSession(request, { ...options, credentialSource: "session" });
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return session;
   }
   async requireUserRequest(request, options = {}) {
     const session = await this.getSession(request, { ...options, credentialSource: "any" });
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     if (!isAuthenticatedUserRequestSession(session)) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] User authentication is required.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] User authentication is required.");
     }
     return session;
   }
@@ -2584,12 +3017,12 @@ class AuthRuntime {
   async createAuthorizationContext(request, options = {}) {
     const session = await this.getSession(request, options);
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return this.contextFromSession(session);
   }
   contextFromSession(session) {
-    return resolveAuthorizationContext({
+    return resolveAuthorizationContext2({
       principal: session.principal,
       sessionId: session.credentialSource === "session" ? session.session.id : undefined,
       groupIds: session.groupIds,
@@ -2616,7 +3049,7 @@ class AuthRuntime {
     const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
       subject: "personal access token"
     });
-    const credential = createAccessTokenCredential("personal");
+    const credential = createAccessTokenCredential2("personal");
     const accessToken = await storage.accessTokens.create({
       id: credential.tokenId,
       projectId: this.projectId,
@@ -2727,12 +3160,12 @@ class AuthRuntime {
     const storage = this.requireAuthStorage();
     const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
     if (serviceAccount.status === "suspended") {
-      throw new AuthStorageError("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
+      throw new AuthStorageError2("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
     }
     const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
       subject: "service account token"
     });
-    const credential = createAccessTokenCredential("serviceAccount");
+    const credential = createAccessTokenCredential2("serviceAccount");
     const accessToken = await storage.accessTokens.create({
       id: credential.tokenId,
       projectId: this.projectId,
@@ -2774,7 +3207,7 @@ class AuthRuntime {
     });
     const groupIds = serviceAccount ? await this.listServiceAccountGroupIds(storage, serviceAccountId) : [];
     if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
     }
     return { serviceAccount, groupIds };
   }
@@ -2844,19 +3277,19 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds: currentGroupIds } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds);
     const missing = missingMembershipGroupIds(scope, "assignGroups", requestedGroupIds);
     if (missing.length > 0) {
-      throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to assign group(s): ${missing.join(", ")}.`);
+      throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to assign group(s): ${missing.join(", ")}.`);
     }
     const current = new Set(currentGroupIds);
     const requested = new Set(requestedGroupIds);
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId));
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId));
     if (user.id === session.user.id && removals.length > 0) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
     }
     const now = new Date;
     for (const groupId of additions) {
@@ -2883,10 +3316,10 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     if (user.id === session.user.id) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
     }
     const suspended = await storage.suspendUserAndRevokeSessions({
       projectId: this.projectId,
@@ -2900,7 +3333,7 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     const reactivated = await storage.users.updateStatus({
       projectId: this.projectId,
@@ -2924,15 +3357,15 @@ class AuthRuntime {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId });
     const groupIds = user ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map((membership) => membership.groupId) : [];
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
     }
     return { user, groupIds };
   }
   resolveMemberGroupIds(input) {
-    const groupIds = [...new Set(input.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    const groupIds = [...new Set(input.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
     for (const groupId of groupIds) {
       if (!this.security.getGroupById(groupId)) {
-        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     return groupIds;
@@ -2944,11 +3377,11 @@ class AuthRuntime {
     const groupIds = this.resolveInviteGroupIds(input);
     this.assertCanManageInvitationGroups(session.groupIds, groupIds);
     const strategy = this.getStrategy();
-    if (!isInvitationDeliveryAuthStrategy(strategy)) {
-      throw new AuthRuntimeError("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
+    if (!isInvitationDeliveryAuthStrategy2(strategy)) {
+      throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
     }
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
-    const deliveryAudience = resolveAuthSessionAudience(options.delivery?.audience ?? options.audience);
+    const deliveryAudience = resolveAuthSessionAudience2(options.delivery?.audience ?? options.audience);
     this.assertInvitationApplicationAccess(groupIds, deliveryAudience);
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID3()}`,
@@ -3012,17 +3445,17 @@ class AuthRuntime {
   async revokeInvitation(request, input, options = {}) {
     const session = await this.requireUser(request, options);
     const authStorage = this.requireAuthStorage();
-    const invitationId = assertNonEmpty(input.invitationId, "Invitation id");
+    const invitationId = assertNonEmpty3(input.invitationId, "Invitation id");
     const invitation = await authStorage.invitations.getById({
       projectId: this.projectId,
       id: invitationId
     });
     if (!invitation) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
     }
     this.assertCanManageInvitationGroups(session.groupIds, invitation.groupIds);
     if (invitation.status !== "pending") {
-      throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
+      throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
     }
     return {
       invitation: await authStorage.invitations.revoke({
@@ -3034,19 +3467,19 @@ class AuthRuntime {
   }
   requireAuthStorage() {
     if (!this.storage.auth) {
-      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+      throw new AuthRuntimeError2("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
     }
     return this.storage.auth;
   }
   resolveInviteGroupIds(input) {
     if (input.groups && input.groupIds) {
-      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation input cannot provide both groups and groupIds.");
+      throw new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation input cannot provide both groups and groupIds.");
     }
-    const rawGroupIds = input.groupIds ?? input.groups?.map((group) => assertNonEmpty(group.id, "Group id")) ?? [];
-    const groupIds = [...new Set(rawGroupIds.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    const rawGroupIds = input.groupIds ?? input.groups?.map((group) => assertNonEmpty3(group.id, "Group id")) ?? [];
+    const groupIds = [...new Set(rawGroupIds.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
     for (const groupId of groupIds) {
       if (!this.security.getGroupById(groupId)) {
-        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown invitation group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Unknown invitation group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     return groupIds;
@@ -3058,7 +3491,7 @@ class AuthRuntime {
     });
   }
   resolveCreateInvitationCapability(input) {
-    if (!isInvitationDeliveryAuthStrategy(this.getStrategy())) {
+    if (!isInvitationDeliveryAuthStrategy2(this.getStrategy())) {
       return { state: "disabled", reason: "invitation_delivery_not_supported" };
     }
     if (!input.canInvite) {
@@ -3068,14 +3501,14 @@ class AuthRuntime {
   }
   assertInvitationApplicationAccess(groupIds, audience) {
     const roles = this.security.listResolvedRoles();
-    const authorization = resolveAuthorizationContext({
+    const authorization = resolveAuthorizationContext2({
       principal: { type: "user", id: "invited-user" },
       groupIds,
       roles
     });
-    if (canAccessApplication(authorization, roles, audience))
+    if (canAccessApplication2(authorization, roles, audience))
       return;
-    throw new AuthRuntimeError("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
   }
   async assertCanInviteRecipient(strategy, authStorage, email, now) {
     if (!strategy.validateInvitationRecipient) {
@@ -3101,9 +3534,9 @@ class AuthRuntime {
   }
   createInvitationDeliveryError(status) {
     if (status === "rate_limited") {
-      return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+      return new AuthRuntimeError2("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
     }
-    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
+    return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
   }
   assertCanManageInvitationGroups(callerGroupIds, groupIds) {
     const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
@@ -3111,10 +3544,10 @@ class AuthRuntime {
       return;
     }
     if (groupIds.length === 0) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user is not allowed to create or manage invitations without groups.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user is not allowed to create or manage invitations without groups.");
     }
     const missing = missingMembershipGroupIds(scope, "invite", groupIds);
-    throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
   }
 }
 function resolveCorrelationId(request) {
@@ -3138,7 +3571,7 @@ function callerCanManageServiceAccount(callerGroupIds, serviceAccountGroupIds) {
   return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId));
 }
 function missingAccessTokenError(tokenId, projectId) {
-  return new AuthStorageError("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
+  return new AuthStorageError2("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
 }
 function constrainRequestedGroupIds(input, allowedGroupIds, options) {
   const groupIds = normalizeRequestedGroupIds(input);
@@ -3148,7 +3581,7 @@ function constrainRequestedGroupIds(input, allowedGroupIds, options) {
   const allowed = new Set(allowedGroupIds);
   for (const groupId of groupIds) {
     if (!allowed.has(groupId)) {
-      throw new AuthRuntimeError("authorization_denied", `[Sixb] Group '${groupId}' cannot be assigned to this ${options.subject}.`);
+      throw new AuthRuntimeError2("authorization_denied", `[Sixb] Group '${groupId}' cannot be assigned to this ${options.subject}.`);
     }
   }
   return groupIds;
@@ -3161,7 +3594,7 @@ function normalizeRequestedGroupIds(input) {
   for (const raw of input) {
     const groupId = raw.trim();
     if (!groupId) {
-      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Group ids cannot be empty when creating auth credentials.");
+      throw new AuthRuntimeError2("invalid_auth_input", "[Sixb] Group ids cannot be empty when creating auth credentials.");
     }
     if (!groupIds.includes(groupId)) {
       groupIds.push(groupId);
@@ -3171,15 +3604,15 @@ function normalizeRequestedGroupIds(input) {
 }
 function createInvitationRecipientError(status, email) {
   if (status === "rate_limited") {
-    return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+    return new AuthRuntimeError2("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
   }
   if (status === "invalid_email") {
-    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation email is invalid.");
+    return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation email is invalid.");
   }
   if (status === "disallowed_domain") {
-    return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' is not allowed by the active auth strategy.`);
+    return new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation email '${email}' is not allowed by the active auth strategy.`);
   }
-  return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' belongs to a suspended user.`);
+  return new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation email '${email}' belongs to a suspended user.`);
 }
 function membershipCapabilities(scope) {
   return {
@@ -3196,10 +3629,10 @@ function groupIdsOf(groups) {
   return groups.map((group) => typeof group === "string" ? group : group.id);
 }
 // src/auth/types.ts
-var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
-function principalsEqual(left, right) {
+var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
+function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=D187F2B23E70181D64756E2164756E21
+//# debugId=4470AA67E3AEAE5264756E2164756E21