@sixb/core 0.1.8 → 0.1.9

package/dist/{chunk-4sm0aznx.js → chunk-g00bfdq6.js}

@@ -1,50 +1,48 @@
 // @bun
 import {
-  validateSchemaOrRefValue
-} from "./chunk-2dw777qw.js";
+  GRANT_KINDS,
+  grantKindOf,
+  canAccessApplication2,
+  resolveRoleGrants2,
+  resolveAuthorizationContext2
+} from "./chunk-dz5h08xv.js";
 import {
-  snapshotLinkPathSelection
-} from "./chunk-19jp6g9d.js";
+  normalizeSchemaValue2,
+  coerceSchemaValueToTyped2
+} from "./chunk-ms2tmn1k.js";
 import {
-  AuthRuntimeError,
-  assertNonEmpty,
-  getCookie,
-  isInvitationDeliveryAuthStrategy,
-  normalizePagination,
-  resolveAuthConfig,
+  AuthRuntimeError2,
+  resolveAuthSessionAudience2,
   resolveAuthCookieOptionsForAudience,
-  resolveAuthSessionAudience,
+  getCookie2,
+  resolveAuthConfig2,
   resolveInvitationExpiresAt,
-  sanitizeReturnTo
-} from "./chunk-xwnf87e1.js";
-import {
-  GRANT_KINDS,
-  canAccessApplication,
-  grantKindOf,
-  resolveAuthorizationContext,
-  resolveRoleGrants
-} from "./chunk-p1x242ad.js";
+  sanitizeReturnTo,
+  assertNonEmpty3,
+  normalizePagination,
+  isInvitationDeliveryAuthStrategy2
+} from "./chunk-q5gz3g2j.js";
 import {
-  coerceSchemaValueToTyped,
-  normalizeSchemaValue
-} from "./chunk-h0k55pc7.js";
+  validateSchemaOrRefValue2,
+  snapshotLinkPathSelection
+} from "./chunk-f0rwz2vh.js";
 import {
-  OntologyValidationError
-} from "./chunk-dktq02ne.js";
+  OntologyValidationError2
+} from "./chunk-cqr3acm1.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
-var PERSONAL_ACCESS_TOKEN_PREFIX = "sixb_pat";
-var SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX = "sixb_sat";
+var PERSONAL_ACCESS_TOKEN_PREFIX2 = "sixb_pat";
+var SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2 = "sixb_sat";
 var ACCESS_TOKEN_ID_PATTERN = /^tok_[A-Za-z0-9_-]+$/;
 var ACCESS_TOKEN_SECRET_PATTERN = /^[A-Za-z0-9_-]{32,}$/;
-function generateAccessTokenSecret() {
+function generateAccessTokenSecret2() {
   return randomBytes(32).toString("base64url");
 }
-function hashAccessTokenSecret(secret) {
+function hashAccessTokenSecret2(secret) {
   return createHash("sha256").update(secret).digest("hex");
 }
-function formatAccessTokenValue(kind, tokenId, tokenSecret) {
+function formatAccessTokenValue2(kind, tokenId, tokenSecret) {
   const prefix = accessTokenPrefixForKind(kind);
   if (!ACCESS_TOKEN_ID_PATTERN.test(tokenId)) {
     throw new Error("[Sixb] Access token ids must start with 'tok_' and be URL-safe.");
@@ -54,7 +52,7 @@ function formatAccessTokenValue(kind, tokenId, tokenSecret) {
   }
   return `${prefix}_${tokenId}.${tokenSecret}`;
 }
-function parseAccessTokenValue(value) {
+function parseAccessTokenValue2(value) {
   if (!value) {
     return null;
   }
@@ -74,7 +72,7 @@ function parseAccessTokenValue(value) {
   }
   return { kind, tokenId, tokenSecret };
 }
-function getBearerAccessTokenValue(request) {
+function getBearerAccessTokenValue2(request) {
   const header = request.headers.get("authorization");
   if (!header) {
     return null;
@@ -85,49 +83,49 @@ function getBearerAccessTokenValue(request) {
   }
   return token;
 }
-function createAccessTokenCredential(kind, tokenId = `tok_${randomUUID()}`) {
-  const tokenSecret = generateAccessTokenSecret();
+function createAccessTokenCredential2(kind, tokenId = `tok_${randomUUID()}`) {
+  const tokenSecret = generateAccessTokenSecret2();
   return {
     kind,
     tokenId,
     tokenSecret,
-    tokenHash: hashAccessTokenSecret(tokenSecret),
-    tokenValue: formatAccessTokenValue(kind, tokenId, tokenSecret)
+    tokenHash: hashAccessTokenSecret2(tokenSecret),
+    tokenValue: formatAccessTokenValue2(kind, tokenId, tokenSecret)
   };
 }
 function accessTokenPrefixForKind(kind) {
   switch (kind) {
     case "personal":
-      return PERSONAL_ACCESS_TOKEN_PREFIX;
+      return PERSONAL_ACCESS_TOKEN_PREFIX2;
     case "serviceAccount":
-      return SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX;
+      return SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2;
   }
 }
 function accessTokenKindFromLabel(label) {
-  if (label.startsWith(`${PERSONAL_ACCESS_TOKEN_PREFIX}_`)) {
+  if (label.startsWith(`${PERSONAL_ACCESS_TOKEN_PREFIX2}_`)) {
     return "personal";
   }
-  if (label.startsWith(`${SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX}_`)) {
+  if (label.startsWith(`${SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2}_`)) {
     return "serviceAccount";
   }
   return null;
 }
 // src/auth/csrf.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-var CSRF_HEADER_NAME = "x-sixb-csrf";
-function generateCsrfToken() {
+var CSRF_HEADER_NAME2 = "x-sixb-csrf";
+function generateCsrfToken2() {
   return randomBytes2(32).toString("base64url");
 }
-function isCsrfExemptMethod(method) {
+function isCsrfExemptMethod2(method) {
   const normalized = method.toUpperCase();
   return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
-function verifyDoubleSubmitCsrf(request, options) {
-  if (isCsrfExemptMethod(request.method)) {
+function verifyDoubleSubmitCsrf2(request, options) {
+  if (isCsrfExemptMethod2(request.method)) {
     return true;
   }
-  const cookieValue = getCookie(request, options.cookieName);
-  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME);
+  const cookieValue = getCookie2(request, options.cookieName);
+  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME2);
   if (!cookieValue || !headerValue) {
     return false;
   }
@@ -145,13 +143,13 @@ function safeEqual(left, right) {
 import { randomUUID as randomUUID3 } from "crypto";
 
 // src/security/applications.ts
-var applications = {
+var applications2 = {
   atlas: { kind: "application", id: "atlas", label: "Atlas" },
   app: { kind: "application", id: "app", label: "Custom app" }
 };
-var APPLICATION_IDS = new Set(Object.values(applications).map((application) => application.id));
+var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
 // src/security/errors.ts
-class SecurityValidationError extends Error {
+class SecurityValidationError2 extends Error {
   name = "SecurityValidationError";
 }
 
@@ -236,12 +234,12 @@ function formatAlternatives(values) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw createError(`[Sixb] ${field} must not be empty.`);
   }
 }
-function assertOptionalString(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertOptionalString(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (value === undefined) {
     return;
   }
@@ -271,7 +269,7 @@ function assertNoDuplicateIds(ids, field) {
   const seen = new Set;
   for (const id of ids) {
     if (seen.has(id)) {
-      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate group id '${id}'.`);
     }
     seen.add(id);
   }
@@ -280,12 +278,12 @@ function assertNoDuplicateOperations(operations, field) {
   const seen = new Set;
   for (const operation of operations) {
     if (seen.has(operation)) {
-      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
     }
     seen.add(operation);
   }
 }
-function assertGroupDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertGroupDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Group definition must be an object.");
   }
@@ -304,7 +302,7 @@ function isGroupDefinition(value) {
     return false;
   }
 }
-function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Membership policy definition must be an object.");
   }
@@ -324,7 +322,7 @@ function isMembershipPolicyDefinition(value) {
     return false;
   }
 }
-function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError(message)) {
+function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value) || value.kind !== "grant") {
     throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`);
   }
@@ -366,7 +364,7 @@ function assertSelection(value, field, createError) {
     assertNonEmptyString(id, `${field} grant selection id`, createError);
   }
 }
-function assertRoleDefinition(value, createError = (message) => new SecurityValidationError(message)) {
+function assertRoleDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
   if (!isRecord(value)) {
     throw createError("[Sixb] Role definition must be an object.");
   }
@@ -399,25 +397,25 @@ function validateSecurityDefinitionsAtStartup(input) {
   for (const group of input.groups) {
     assertGroupDefinition(group);
     if (groupsById.has(group.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate group id: ${group.id}`);
     }
     groupsById.set(group.id, group);
   }
   for (const role of input.roles ?? []) {
     assertRoleDefinition(role);
     if (rolesById.has(role.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate role id: ${role.id}`);
     }
     if (role.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
+      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
     }
     if (role.grants.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Role '${role.id}' must declare at least one grant.`);
+      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must declare at least one grant.`);
     }
     assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`);
     for (const groupId of role.grantedToGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     for (const grant of role.grants) {
@@ -428,25 +426,25 @@ function validateSecurityDefinitionsAtStartup(input) {
   for (const policy of input.membershipPolicies) {
     assertMembershipPolicyDefinition(policy);
     if (membershipPoliciesById.has(policy.id)) {
-      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`);
+      throw new SecurityValidationError2(`[Sixb] Duplicate membership policy id: ${policy.id}`);
     }
     if (policy.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
+      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
     }
     if (policy.can.length === 0) {
-      throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
+      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
     }
     assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`);
     assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`);
     assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`);
     for (const groupId of policy.grantedToGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     for (const groupId of policy.scopeGroupIds) {
       if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     membershipPoliciesById.set(policy.id, policy);
@@ -462,9 +460,9 @@ function validateSecurityDefinitionsAtStartup(input) {
 }
 function assertGrantReferences(roleId, grant, registered) {
   if (grant.capability === "run" && grant.target === "agent") {
-    const spec2 = GRANT_KINDS[grantKindOf(grant)];
+    const spec = GRANT_KINDS[grantKindOf(grant)];
     if (!registered.agentAvailable) {
-      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec2.fix}`);
+      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`);
     }
     return;
   }
@@ -476,7 +474,7 @@ function assertGrantReferences(roleId, grant, registered) {
   const ids = grant.selection.all ? grant.selection.except : grant.selection.ids;
   for (const id of ids) {
     if (!universe.has(id)) {
-      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
+      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
     }
   }
 }
@@ -485,13 +483,13 @@ function assertGrantReferences(roleId, grant, registered) {
 var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
 function assertNonEmptyArray(value, field) {
   if (value.length === 0) {
-    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`);
+    throw new SecurityValidationError2(`[Sixb] ${field} must not be empty.`);
   }
 }
 function groupIdsFrom(groups, field) {
   return groups.map((group) => {
     if (!isRecord(group) || group.kind !== "group") {
-      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} must contain only group definitions.`);
     }
     assertNonEmptyString(group.id, `${field} group id`);
     return group.id;
@@ -500,12 +498,12 @@ function groupIdsFrom(groups, field) {
 function membershipOperationsFrom(operations, field) {
   return operations.map((operation) => {
     if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
-      throw new SecurityValidationError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
     }
     return operation;
   });
 }
-function defineGroup(id, options = {}) {
+function defineGroup2(id, options = {}) {
   assertNonEmptyString(id, "Group id");
   assertOptionalString(options.label, `Group '${id}' label`);
   assertOptionalString(options.description, `Group '${id}' description`);
@@ -516,7 +514,7 @@ function defineGroup(id, options = {}) {
     ...options.description !== undefined ? { description: options.description } : {}
   };
 }
-function defineRole(id, options) {
+function defineRole2(id, options) {
   assertNonEmptyString(id, "Role id");
   assertOptionalString(options.label, `Role '${id}' label`);
   assertOptionalString(options.description, `Role '${id}' description`);
@@ -526,7 +524,7 @@ function defineRole(id, options) {
     assertGrantDefinition(grant, `Role '${id}' grants`);
   }
   if (options.grants.length === 0) {
-    throw new SecurityValidationError(`[Sixb] Role '${id}' grants must not be empty.`);
+    throw new SecurityValidationError2(`[Sixb] Role '${id}' grants must not be empty.`);
   }
   return {
     kind: "role",
@@ -537,7 +535,7 @@ function defineRole(id, options) {
     grants: options.grants
   };
 }
-function defineMembershipPolicy(id, options) {
+function defineMembershipPolicy2(id, options) {
   assertNonEmptyString(id, "Membership policy id");
   assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`);
   assertNonEmptyArray(options.can, `Membership policy '${id}' can`);
@@ -569,7 +567,7 @@ function isBreadthSelector(value) {
 }
 function definitionIdOf(item, label) {
   if (typeof item?.id !== "string" || !item.id.trim()) {
-    throw new SecurityValidationError(`[Sixb] ${label} requires definitions with a non-empty id.`);
+    throw new SecurityValidationError2(`[Sixb] ${label} requires definitions with a non-empty id.`);
   }
   return item.id;
 }
@@ -585,7 +583,7 @@ function all(target, except = []) {
     }
   };
 }
-var every = {
+var every2 = {
   object: () => all("object"),
   dataset: () => all("dataset"),
   action: () => all("action"),
@@ -597,11 +595,11 @@ var every = {
   share: () => all("share")
 };
 // src/actions/errors.ts
-class ActionDefinitionError extends Error {
+class ActionDefinitionError2 extends Error {
   name = "ActionDefinitionError";
 }
 
-class ActionEditCommitError extends Error {
+class ActionEditCommitError2 extends Error {
   name = "ActionEditCommitError";
 }
 function missingActionMutationMessage(actionId) {
@@ -614,17 +612,17 @@ function effectsWithoutEditsMessage(actionId) {
 // src/actions/validation.ts
 function assertNonEmpty2(value, field) {
   if (!value.trim()) {
-    throw new ActionDefinitionError(`Action ${field} must not be empty.`);
+    throw new ActionDefinitionError2(`Action ${field} must not be empty.`);
   }
 }
-function isActionDefinition(value) {
+function isActionDefinition2(value) {
   const binding = value?.binding;
   return typeof value === "object" && value !== null && value.kind === "action" && (binding?.kind === "global" || binding?.kind === "object");
 }
-function isGlobalActionDefinition(value) {
+function isGlobalActionDefinition2(value) {
   return value.binding.kind === "global";
 }
-function isObjectActionDefinition(value) {
+function isObjectActionDefinition2(value) {
   return value.binding.kind === "object";
 }
 function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
@@ -632,30 +630,30 @@ function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
   const normalized = {};
   for (const paramId of Object.keys(params)) {
     if (!knownParamIds.has(paramId)) {
-      throw new OntologyValidationError(`Unknown param '${paramId}' for action '${pathPrefix}'`);
+      throw new OntologyValidationError2(`Unknown param '${paramId}' for action '${pathPrefix}'`);
     }
   }
   for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
     const value = params[paramId];
     if (value === undefined) {
       if (paramDef.required) {
-        throw new OntologyValidationError(`Missing required param '${paramId}' for action '${pathPrefix}'`);
+        throw new OntologyValidationError2(`Missing required param '${paramId}' for action '${pathPrefix}'`);
       }
       continue;
     }
     if (value === null) {
       if (!paramDef.nullable) {
-        throw new OntologyValidationError(`[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`);
+        throw new OntologyValidationError2(`[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`);
       }
       normalized[paramId] = null;
       continue;
     }
-    validateSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+    validateSchemaOrRefValue2(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
     normalized[paramId] = normalizeSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
   }
   return normalized;
 }
-function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
+function coerceActionParamsToTyped2(paramsConfig, params, valueTypesById) {
   const coerced = { ...params };
   for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
     const value = params[paramId];
@@ -665,23 +663,23 @@ function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
     if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
       continue;
     }
-    coerced[paramId] = coerceSchemaValueToTyped(schema, value, valueTypesById);
+    coerced[paramId] = coerceSchemaValueToTyped2(schema, value, valueTypesById);
   }
   return coerced;
 }
 function validateActionSubject(action, subject) {
-  if (isGlobalActionDefinition(action) && subject.kind !== "none") {
-    throw new OntologyValidationError(`Action '${action.id}' does not accept an object subject.`);
+  if (isGlobalActionDefinition2(action) && subject.kind !== "none") {
+    throw new OntologyValidationError2(`Action '${action.id}' does not accept an object subject.`);
   }
 }
 function resolveObjectActionSubject(params) {
   const { runtime, action, subject } = params;
   if (subject.kind !== "object") {
-    throw new OntologyValidationError(`Action '${action.id}' requires an object subject.`);
+    throw new OntologyValidationError2(`Action '${action.id}' requires an object subject.`);
   }
   const objectType = runtime.ontology.resolveObjectType(subject.objectTypeId);
   if (!actionAppliesToObjectType(runtime, action, objectType)) {
-    throw new OntologyValidationError(`Action '${action.id}' is not valid for object type '${objectType.id}'.`);
+    throw new OntologyValidationError2(`Action '${action.id}' is not valid for object type '${objectType.id}'.`);
   }
   return objectType;
 }
@@ -696,18 +694,18 @@ function normalizeSchemaOrRefValue(schema, value, path, valueTypesById) {
       primaryId: refValue.primaryId
     };
   }
-  return normalizeSchemaValue(schema, value, path, valueTypesById);
+  return normalizeSchemaValue2(schema, value, path, valueTypesById);
 }
 
 // src/shares/errors.ts
-class ShareDefinitionError extends Error {
+class ShareDefinitionError2 extends Error {
   name = "ShareDefinitionError";
 }
 
 // src/shares/builders.ts
 var shareTargets = new WeakSet;
-function defineShare(id, options) {
-  assertNonEmpty3(id, "Share id");
+function defineShare2(id, options) {
+  assertNonEmpty(id, "Share id");
   if (!isObjectType(options.target)) {
     throw invalid(`Share '${id}' target must be an object type.`);
   }
@@ -722,7 +720,7 @@ function defineShare(id, options) {
   try {
     authoredGrants = options.grants({ target });
   } catch (error) {
-    if (error instanceof ShareDefinitionError)
+    if (error instanceof ShareDefinitionError2)
       throw error;
     const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
     throw invalid(`Share '${id}' grants are invalid: ${reason}`);
@@ -784,7 +782,7 @@ function snapshotShareDefinition(value) {
       ...description === undefined ? {} : { description }
     });
   } catch (error) {
-    if (error instanceof ShareDefinitionError)
+    if (error instanceof ShareDefinitionError2)
       throw error;
     const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
     throw invalid(`Share definition is invalid: ${reason}`);
@@ -914,7 +912,7 @@ function snapshotLinkMode(value) {
       links: snapshotLinkPaths(links)
     });
   } catch (error) {
-    if (error instanceof ShareDefinitionError)
+    if (error instanceof ShareDefinitionError2)
       throw error;
     const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
     throw invalid(`Share link selection is invalid: ${reason}`);
@@ -980,16 +978,16 @@ function isRecord2(value) {
 function isNonEmpty(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
-function assertNonEmpty3(value, field) {
+function assertNonEmpty(value, field) {
   if (!isNonEmpty(value))
     throw invalid(`${field} must not be empty.`);
 }
 function nonEmpty(value, field) {
-  assertNonEmpty3(value, field);
+  assertNonEmpty(value, field);
   return value;
 }
 function invalid(message) {
-  return new ShareDefinitionError(`[Sixb] ${message}`);
+  return new ShareDefinitionError2(`[Sixb] ${message}`);
 }
 
 // src/security/grants.ts
@@ -1010,7 +1008,7 @@ function targetOfDefinition(item, label, allowedTargets) {
   const discriminated = typeof kind === "string" ? TARGET_BY_DEFINITION_KIND[kind] : undefined;
   if (discriminated) {
     if (!isAllowedTarget(discriminated, allowedTargets)) {
-      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`);
+      throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`);
     }
     return discriminated;
   }
@@ -1018,7 +1016,7 @@ function targetOfDefinition(item, label, allowedTargets) {
   const only = candidates.length === 1 ? candidates[0] : undefined;
   if (only)
     return only;
-  throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one Sixb could not classify.`);
+  throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one Sixb could not classify.`);
 }
 function isAllowedTarget(target, allowedTargets) {
   return allowedTargets.includes(target);
@@ -1026,7 +1024,7 @@ function isAllowedTarget(target, allowedTargets) {
 function resolveGrant(input, label, allowedTargets) {
   if (isBreadthSelector(input)) {
     if (!isAllowedTarget(input.target, allowedTargets)) {
-      throw new SecurityValidationError(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} selectors, but received every.${input.target}().`);
+      throw new SecurityValidationError2(`[Sixb] ${label} accepts ${allowedTargets.join(" or ")} selectors, but received every.${input.target}().`);
     }
     return { target: input.target, selection: input.selection };
   }
@@ -1039,11 +1037,11 @@ function resolveGrant(input, label, allowedTargets) {
       continue;
     }
     if (itemTarget !== target) {
-      throw new SecurityValidationError(`[Sixb] ${label} requires one target per grant, but received both ${target} and ${itemTarget} definitions. Use one grant each.`);
+      throw new SecurityValidationError2(`[Sixb] ${label} requires one target per grant, but received both ${target} and ${itemTarget} definitions. Use one grant each.`);
     }
   }
   if (target === undefined) {
-    throw new SecurityValidationError(`[Sixb] ${label} requires at least one definition.`);
+    throw new SecurityValidationError2(`[Sixb] ${label} requires at least one definition.`);
   }
   const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
   return { target, selection: { all: false, ids } };
@@ -1079,7 +1077,7 @@ function apply(input) {
     selection: resolveGrant(input, "can.apply", ["action"]).selection
   };
   const one = Array.isArray(input) || isBreadthSelector(input) ? undefined : input;
-  if (one && isObjectActionDefinition(one)) {
+  if (one && isObjectActionDefinition2(one)) {
     Object.defineProperty(grant, "on", {
       configurable: false,
       enumerable: false,
@@ -1111,7 +1109,7 @@ function isAgentUsageReference(input) {
 }
 function observe(input) {
   if (input !== "logs" && !isAgentUsageReference(input)) {
-    throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.');
+    throw new SecurityValidationError2('[Sixb] can.observe accepts "logs" or agent.usage.');
   }
   const target = input === "logs" ? "logs" : "aiUsage";
   return {
@@ -1137,7 +1135,7 @@ function manage(input) {
     selection: resolveGrant(input, "can.manage", ["connector"]).selection
   };
 }
-var can = {
+var can2 = {
   access,
   view,
   edit,
@@ -1192,7 +1190,7 @@ class SecurityRegistry {
     this.resolvedRoles = definitions.roles.map((role) => ({
       id: role.id,
       grantedToGroupIds: role.grantedToGroupIds,
-      grants: resolveRoleGrants(role, universe)
+      grants: resolveRoleGrants2(role, universe)
     }));
   }
   listGroups() {
@@ -1218,7 +1216,7 @@ class SecurityRegistry {
   }
 }
 // src/storage/auth/errors.ts
-class AuthStorageError extends Error {
+class AuthStorageError2 extends Error {
   code;
   name = "AuthStorageError";
   constructor(code, message) {
@@ -1293,7 +1291,7 @@ function dateOrNow(value) {
 function assertNonEmpty4(value, label) {
   const normalized = value.trim();
   if (!normalized) {
-    throw new AuthStorageError("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
+    throw new AuthStorageError2("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
   }
   return normalized;
 }
@@ -1384,7 +1382,7 @@ function revokeActiveMagicLinksForEmail(state, projectId, email, revokedAt) {
 }
 function assertSessionIdAvailable(state, projectId, sessionId) {
   if (state.sessions.has(sessionKey(projectId, sessionId))) {
-    throw new AuthStorageError("duplicate_session", `[Sixb] Session '${sessionId}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_session", `[Sixb] Session '${sessionId}' already exists for project '${projectId}'.`);
   }
 }
 function validateCompleteSessionInput(state, projectId, session) {
@@ -1398,7 +1396,7 @@ function createSessionRecord(state, input) {
   const projectId = assertNonEmpty4(input.projectId, "Project id");
   const userId = assertNonEmpty4(input.userId, "User id");
   const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-  const audience = resolveAuthSessionAudience(input.audience);
+  const audience = resolveAuthSessionAudience2(input.audience);
   const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
@@ -1423,7 +1421,7 @@ function createServiceAccountRecord(state, input) {
   const name = assertNonEmpty4(input.name, "Service account name");
   const key = serviceAccountKey(projectId, id);
   if (state.serviceAccounts.has(key)) {
-    throw new AuthStorageError("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
   }
   const createdAt = dateOrNow(input.createdAt);
   const serviceAccount = {
@@ -1445,7 +1443,7 @@ function upsertServiceAccountGroupMembershipRecord(state, input) {
   const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
   const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
-    throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
   }
   const key = serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId);
   const existing = state.serviceAccountGroupMemberships.get(key);
@@ -1472,7 +1470,7 @@ function createAccessTokenRecord(state, input) {
   assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
   const key = accessTokenKey(projectId, id);
   if (state.accessTokens.has(key)) {
-    throw new AuthStorageError("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
+    throw new AuthStorageError2("duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
   }
   const token = {
     id,
@@ -1496,7 +1494,7 @@ function upsertGroupMembershipRecord(state, input) {
   const userId = assertNonEmpty4(input.userId, "User id");
   const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.users.has(userKey(projectId, userId))) {
-    throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
   }
   const key = groupMembershipKey(projectId, userId, groupId);
   const existing = state.groupMemberships.get(key);
@@ -1529,17 +1527,17 @@ function assertAccessTokenSubject(kind, subjectType) {
   if (kind === "personal" && subjectType === "user" || kind === "serviceAccount" && subjectType === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError("invalid_input", `[Sixb] Access token kind '${kind}' cannot target subject type '${subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${kind}' cannot target subject type '${subjectType}'.`);
 }
 function assertAccessTokenSubjectExists(state, projectId, subjectType, subjectId) {
   if (subjectType === "user") {
     if (state.users.has(userKey(projectId, subjectId)))
       return;
-    throw new AuthStorageError("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
   }
   if (state.serviceAccounts.has(serviceAccountKey(projectId, subjectId)))
     return;
-  throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
+  throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function consumeMagicLinkRecord(state, params) {
   const projectId = assertNonEmpty4(params.projectId, "Project id");
@@ -1548,13 +1546,13 @@ function consumeMagicLinkRecord(state, params) {
   const key = magicLinkKey(projectId, id);
   const existing = state.magicLinks.get(key);
   if (!existing) {
-    throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
   }
   if (existing.tokenHash !== tokenHash || existing.consumedAt || existing.revokedAt) {
-    throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
+    throw new AuthStorageError2("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
   }
   if (existing.expiresAt <= params.consumedAt) {
-    throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
+    throw new AuthStorageError2("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
   }
   const consumed = {
     ...existing,
@@ -1570,13 +1568,13 @@ function consumeOidcAttemptRecord(state, params) {
   const key = oidcAttemptKey(projectId, id);
   const existing = state.oidcAuthorizationAttempts.get(key);
   if (!existing) {
-    throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
   }
   if (existing.stateHash !== stateHash || existing.consumedAt) {
-    throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
+    throw new AuthStorageError2("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
   }
   if (existing.expiresAt <= params.consumedAt) {
-    throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
+    throw new AuthStorageError2("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
   }
   const consumed = {
     ...existing,
@@ -1621,7 +1619,7 @@ class InMemoryAuthAccessTokenStore {
     const key = accessTokenKey(params.projectId, params.id);
     const existing = this.state.accessTokens.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1634,7 +1632,7 @@ class InMemoryAuthAccessTokenStore {
     const key = accessTokenKey(params.projectId, params.id);
     const existing = this.state.accessTokens.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1648,7 +1646,7 @@ class InMemoryAuthAccessTokenStore {
 }
 
 // src/storage/auth/types.ts
-var MAX_PENDING_DEVICE_AUTHORIZATIONS = 100;
+var MAX_PENDING_DEVICE_AUTHORIZATIONS2 = 100;
 
 // src/storage/auth/in-memory/device-authorizations.ts
 class InMemoryAuthDeviceAuthorizationStore {
@@ -1659,14 +1657,14 @@ class InMemoryAuthDeviceAuthorizationStore {
   async create(input) {
     const id = assertNonEmpty4(input.id, "Device authorization id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
-    for (const [key2, authorization] of this.state.deviceAuthorizations) {
+    for (const [key, authorization] of this.state.deviceAuthorizations) {
       if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
-        this.state.deviceAuthorizations.delete(key2);
+        this.state.deviceAuthorizations.delete(key);
       }
     }
     const pending = [...this.state.deviceAuthorizations.values()].filter((authorization) => authorization.projectId === projectId && authorization.status === "pending").length;
-    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
-      throw new AuthStorageError("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
+    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS2) {
+      throw new AuthStorageError2("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
     }
     const key = deviceAuthorizationKey(projectId, id);
     if (this.state.deviceAuthorizations.has(key)) {
@@ -1704,7 +1702,7 @@ class InMemoryAuthDeviceAuthorizationStore {
     const user = this.state.users.get(userKey(params.projectId, params.userId));
     const session = this.state.sessions.get(sessionKey(params.projectId, params.sessionId));
     if (!user || user.status !== "active" || !session || session.userId !== user.id || !isActiveSession(session, params.approvedAt)) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
     }
     const next = {
       ...record,
@@ -1729,16 +1727,16 @@ class InMemoryAuthDeviceAuthorizationStore {
   requirePending(projectId, id, now) {
     const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(projectId, id));
     if (!record) {
-      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
     }
     if (record.status !== "pending" || record.expiresAt <= now) {
-      throw new AuthStorageError("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
     }
     return record;
   }
 }
 function duplicateAuthorization(id, projectId) {
-  return new AuthStorageError("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
+  return new AuthStorageError2("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
 }
 
 // src/storage/auth/in-memory/group-memberships.ts
@@ -1842,7 +1840,7 @@ class InMemoryAuthInvitationStore {
     }
     const key = invitationKey(projectId, id);
     if (this.state.invitations.has(key)) {
-      throw new AuthStorageError("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
     }
     const invitation = {
       id,
@@ -1886,7 +1884,7 @@ class InMemoryAuthInvitationStore {
     const key = invitationKey(params.projectId, params.id);
     const existing = this.state.invitations.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1901,7 +1899,7 @@ class InMemoryAuthInvitationStore {
     const key = invitationKey(params.projectId, params.id);
     const existing = this.state.invitations.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -1924,12 +1922,12 @@ class InMemoryAuthMagicLinkStore {
     const id = assertNonEmpty4(input.id, "Magic link id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience(input.audience);
+    const audience = resolveAuthSessionAudience2(input.audience);
     const email = normalizeEmail(input.email);
     const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
     if (this.state.magicLinks.has(key)) {
-      throw new AuthStorageError("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
     }
     revokeActiveMagicLinksForEmail(this.state, projectId, email, input.createdAt);
     const link = {
@@ -1973,13 +1971,13 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience(input.audience);
+    const audience = resolveAuthSessionAudience2(input.audience);
     const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
     const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
     const key = oidcAttemptKey(projectId, id);
     if (this.state.oidcAuthorizationAttempts.has(key)) {
-      throw new AuthStorageError("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
     }
     const attempt = {
       id,
@@ -2018,7 +2016,7 @@ class InMemoryAuthServiceAccountGroupMembershipStore {
     const projectId = assertNonEmpty4(input.projectId, "Project id");
     const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
     if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     const groupIds = normalizeGroupIds(input.groupIds);
     const desired = new Set(groupIds);
@@ -2072,7 +2070,7 @@ class InMemoryAuthServiceAccountStore {
     const key = serviceAccountKey(projectId, id);
     const existing = this.state.serviceAccounts.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2150,7 +2148,7 @@ class InMemoryAuthSessionStore {
     const key = sessionKey(params.projectId, params.id);
     const existing = this.state.sessions.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2166,7 +2164,7 @@ class InMemoryAuthSessionStore {
     const key = sessionKey(params.projectId, params.id);
     const existing = this.state.sessions.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+      throw new AuthStorageError2("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2189,10 +2187,10 @@ class InMemoryAuthUserStore {
     const email = normalizeEmail(input.email);
     const key = userKey(projectId, id);
     if (this.state.users.has(key)) {
-      throw new AuthStorageError("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
     }
     if (getUserByEmail(this.state, projectId, email)) {
-      throw new AuthStorageError("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError2("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
     }
     const createdAt = dateOrNow(input.createdAt);
     const user = {
@@ -2219,7 +2217,7 @@ class InMemoryAuthUserStore {
     const key = userKey(input.projectId, input.id);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2234,7 +2232,7 @@ class InMemoryAuthUserStore {
     const key = userKey(input.projectId, input.id);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2261,7 +2259,7 @@ class InMemoryAuthUserStore {
 }
 
 // src/storage/auth/in-memory/auth-storage.ts
-class InMemoryAuthStorage {
+class InMemoryAuthStorage2 {
   state = createAuthStorageState();
   users = new InMemoryAuthUserStore(this.state);
   identities = new InMemoryAuthUserIdentityStore(this.state);
@@ -2306,22 +2304,22 @@ class InMemoryAuthStorage {
     const key = deviceAuthorizationKey(input.projectId, input.id);
     const authorization = this.state.deviceAuthorizations.get(key);
     if (!authorization) {
-      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
     }
     if (authorization.deviceCodeHash !== input.deviceCodeHash) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Invalid device authorization.");
     }
     if (authorization.status === "pending") {
-      throw new AuthStorageError("pending_device_authorization", "[Sixb] Device authorization is pending.");
+      throw new AuthStorageError2("pending_device_authorization", "[Sixb] Device authorization is pending.");
     }
     if (authorization.status === "denied") {
-      throw new AuthStorageError("device_authorization_denied", "[Sixb] Device authorization was denied.");
+      throw new AuthStorageError2("device_authorization_denied", "[Sixb] Device authorization was denied.");
     }
     if (authorization.status !== "approved" || !authorization.approvedUserId || !authorization.approvedSessionId || authorization.expiresAt <= input.completedAt) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
     }
     if (input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
-      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device access token is invalid.");
+      throw new AuthStorageError2("invalid_device_authorization", "[Sixb] Device access token is invalid.");
     }
     const accessToken = createAccessTokenRecord(this.state, input.accessToken);
     const consumed = {
@@ -2337,13 +2335,13 @@ class InMemoryAuthStorage {
     const completedAt = cloneDate(input.completedAt);
     const magicLink = this.state.magicLinks.get(magicLinkKey(projectId, input.magicLinkId));
     if (!magicLink) {
-      throw new AuthStorageError("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
     }
     if (magicLink.tokenHash !== input.tokenHash || magicLink.consumedAt || magicLink.revokedAt) {
-      throw new AuthStorageError("invalid_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is not valid for project '${projectId}'.`);
     }
     if (magicLink.expiresAt <= completedAt) {
-      throw new AuthStorageError("expired_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError2("expired_magic_link", `[Sixb] Magic link '${input.magicLinkId}' is expired for project '${projectId}'.`);
     }
     const existingUser = getUserByEmail(this.state, projectId, magicLink.email);
     const activeInvitation = getActiveInvitationByEmail(this.state, projectId, magicLink.email, completedAt);
@@ -2356,7 +2354,7 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("suspended_user", `[Sixb] User '${existingUser.id}' is suspended for project '${projectId}'.`);
+      throw new AuthStorageError2("suspended_user", `[Sixb] User '${existingUser.id}' is suspended for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       consumeMagicLinkRecord(this.state, {
@@ -2365,7 +2363,7 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
       consumeMagicLinkRecord(this.state, {
@@ -2374,7 +2372,7 @@ class InMemoryAuthStorage {
         tokenHash: input.tokenHash,
         consumedAt: completedAt
       });
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
@@ -2382,7 +2380,7 @@ class InMemoryAuthStorage {
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
-        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError2("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
     }
     consumeMagicLinkRecord(this.state, {
@@ -2436,13 +2434,13 @@ class InMemoryAuthStorage {
     const completedAt = cloneDate(input.completedAt);
     const attempt = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(projectId, input.oidcAuthorizationAttemptId));
     if (!attempt) {
-      throw new AuthStorageError("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError2("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' not found for project '${projectId}'.`);
     }
     if (attempt.stateHash !== input.stateHash || attempt.consumedAt) {
-      throw new AuthStorageError("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError2("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is not valid for project '${projectId}'.`);
     }
     if (attempt.expiresAt <= completedAt) {
-      throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError2("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
     }
     const subject = assertNonEmpty4(input.subject, "Subject");
     const email = normalizeEmail(input.email);
@@ -2454,27 +2452,27 @@ class InMemoryAuthStorage {
     const manualGroupIds = normalizeGroupIds(input.manualGroupIds);
     if (identity && !user) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
     }
     if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
+      throw new AuthStorageError2("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
     }
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
+      throw new AuthStorageError2("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
     }
     if (shouldCreateUser && !input.emailVerified) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
       this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
+      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
@@ -2482,7 +2480,7 @@ class InMemoryAuthStorage {
     if (shouldCreateUser) {
       newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
-        throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError2("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
     }
     this.consumeOidcAttempt(input, completedAt, projectId);
@@ -2540,7 +2538,7 @@ class InMemoryAuthStorage {
     const key = userKey(input.projectId, input.userId);
     const existing = this.state.users.get(key);
     if (!existing) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
     }
     const next = {
       ...existing,
@@ -2626,7 +2624,7 @@ function assertSignInSessionAudience(projectId, sessionAudience, storedAudience)
   if (sessionAudience === storedAudience) {
     return;
   }
-  throw new AuthStorageError("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
 }
 // src/auth/session-cache.ts
 class SessionCache {
@@ -2684,19 +2682,19 @@ class SessionCache {
 
 // src/auth/sessions.ts
 import { createHash as createHash2, randomBytes as randomBytes3, randomUUID as randomUUID2 } from "crypto";
-function generateSessionSecret() {
+function generateSessionSecret2() {
   return randomBytes3(32).toString("base64url");
 }
-function hashSessionSecret(secret) {
+function hashSessionSecret2(secret) {
   return createHash2("sha256").update(secret).digest("hex");
 }
-function formatSessionCookieValue(sessionId, sessionSecret) {
+function formatSessionCookieValue2(sessionId, sessionSecret) {
   if (!sessionId || !sessionSecret || sessionId.includes(".") || sessionSecret.includes(".")) {
     throw new Error("[Sixb] Session cookie values must be non-empty and must not contain '.'.");
   }
   return `${sessionId}.${sessionSecret}`;
 }
-function parseSessionCookieValue(value) {
+function parseSessionCookieValue2(value) {
   if (!value) {
     return null;
   }
@@ -2709,13 +2707,13 @@ function parseSessionCookieValue(value) {
     sessionSecret: value.slice(firstDot + 1)
   };
 }
-function createSessionCredential(sessionId = `ses_${randomUUID2()}`) {
-  const sessionSecret = generateSessionSecret();
+function createSessionCredential2(sessionId = `ses_${randomUUID2()}`) {
+  const sessionSecret = generateSessionSecret2();
   return {
     sessionId,
     sessionSecret,
-    tokenHash: hashSessionSecret(sessionSecret),
-    cookieValue: formatSessionCookieValue(sessionId, sessionSecret)
+    tokenHash: hashSessionSecret2(sessionSecret),
+    cookieValue: formatSessionCookieValue2(sessionId, sessionSecret)
   };
 }
 
@@ -2723,7 +2721,7 @@ function createSessionCredential(sessionId = `ses_${randomUUID2()}`) {
 var SESSION_TOUCH_INTERVAL_MS = 60000;
 var ACCESS_TOKEN_TOUCH_INTERVAL_MS = 60000;
 
-class AuthRuntime {
+class AuthRuntime2 {
   projectId;
   storage;
   security;
@@ -2733,10 +2731,10 @@ class AuthRuntime {
     this.projectId = options.projectId;
     this.storage = options.storage;
     this.security = options.security;
-    this.config = resolveAuthConfig(options.config);
+    this.config = resolveAuthConfig2(options.config);
     this.sessionCache = this.config.session.cacheTtlMs > 0 ? new SessionCache(this.config.session.cacheTtlMs) : null;
     if (this.isEnabled() && !this.storage.auth) {
-      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+      throw new AuthRuntimeError2("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
     }
   }
   isEnabled() {
@@ -2760,26 +2758,26 @@ class AuthRuntime {
     const strategy = this.config.strategy;
     if (!strategy) {
       if (params.production) {
-        throw new AuthRuntimeError("production_auth_required", "[SixbServer] Auth is required in production. Configure auth or use an explicit disabled auth strategy.");
+        throw new AuthRuntimeError2("production_auth_required", "[SixbServer] Auth is required in production. Configure auth or use an explicit disabled auth strategy.");
       }
       return;
     }
     if (params.production && strategy.developmentOnly) {
-      throw new AuthRuntimeError("production_auth_required", `[SixbServer] Auth strategy '${strategy.id}' is development-only and cannot be used in production.`);
+      throw new AuthRuntimeError2("production_auth_required", `[SixbServer] Auth strategy '${strategy.id}' is development-only and cannot be used in production.`);
     }
     if (params.production && (strategy.kind === "disabled" || strategy.disabled === true) && strategy.allowDisabledInProduction !== true) {
-      throw new AuthRuntimeError("production_auth_required", "[SixbServer] Disabled auth in production requires allowDisabledInProduction: true.");
+      throw new AuthRuntimeError2("production_auth_required", "[SixbServer] Disabled auth in production requires allowDisabledInProduction: true.");
     }
   }
   async getSession(request, options = {}) {
     if (!this.isEnabled()) {
       return { authenticated: false, reason: "auth_disabled" };
     }
-    const audience = resolveAuthSessionAudience(options.audience);
+    const audience = resolveAuthSessionAudience2(options.audience);
     const credentialSource = options.credentialSource ?? "session";
     if (credentialSource !== "session") {
       const authorizationHeader = request.headers.get("authorization");
-      const tokenValue = getBearerAccessTokenValue(request);
+      const tokenValue = getBearerAccessTokenValue2(request);
       if (tokenValue) {
         return this.resolveAccessTokenSession(request, tokenValue);
       }
@@ -2794,15 +2792,15 @@ class AuthRuntime {
   }
   async resolveCookieSession(request, audience, activity) {
     const cookieOptions = this.getCookieOptions({ audience });
-    const cookieValue = getCookie(request, cookieOptions.sessionCookieName);
+    const cookieValue = getCookie2(request, cookieOptions.sessionCookieName);
     if (!cookieValue) {
       return { authenticated: false, reason: "missing_cookie" };
     }
-    const parts = parseSessionCookieValue(cookieValue);
+    const parts = parseSessionCookieValue2(cookieValue);
     if (!parts) {
       return { authenticated: false, reason: "invalid_cookie" };
     }
-    const tokenHash = hashSessionSecret(parts.sessionSecret);
+    const tokenHash = hashSessionSecret2(parts.sessionSecret);
     const nowMs = Date.now();
     const cached = this.sessionCache?.get({
       sessionId: parts.sessionId,
@@ -2892,7 +2890,7 @@ class AuthRuntime {
     return new Date(session.absoluteExpiresAt ? Math.min(idleExpiresAtMs, session.absoluteExpiresAt.getTime()) : idleExpiresAtMs);
   }
   async resolveAccessTokenSession(request, tokenValue) {
-    const parts = parseAccessTokenValue(tokenValue);
+    const parts = parseAccessTokenValue2(tokenValue);
     if (!parts) {
       return { authenticated: false, reason: "invalid_access_token" };
     }
@@ -2902,7 +2900,7 @@ class AuthRuntime {
       projectId: this.projectId,
       id: parts.tokenId,
       kind: parts.kind,
-      tokenHash: hashAccessTokenSecret(parts.tokenSecret),
+      tokenHash: hashAccessTokenSecret2(parts.tokenSecret),
       now
     });
     if (!accessToken) {
@@ -2920,7 +2918,7 @@ class AuthRuntime {
       if (user.status === "suspended") {
         return { authenticated: false, reason: "suspended_user" };
       }
-      const memberships2 = await storage.groupMemberships.listForUser({
+      const memberships = await storage.groupMemberships.listForUser({
         projectId: this.projectId,
         userId: user.id
       });
@@ -2930,7 +2928,7 @@ class AuthRuntime {
         principal: { type: "user", id: user.id },
         user,
         accessToken,
-        groupIds: constrainTokenGroupIds(memberships2.map((membership) => membership.groupId), accessToken)
+        groupIds: constrainTokenGroupIds(memberships.map((membership) => membership.groupId), accessToken)
       };
     }
     const serviceAccount = await storage.serviceAccounts.getById({
@@ -2986,24 +2984,24 @@ class AuthRuntime {
   async requirePrincipal(request, options = {}) {
     const session = await this.getSession(request, options);
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return session.principal;
   }
   async requireUser(request, options = {}) {
     const session = await this.getSession(request, { ...options, credentialSource: "session" });
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return session;
   }
   async requireUserRequest(request, options = {}) {
     const session = await this.getSession(request, { ...options, credentialSource: "any" });
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     if (!isAuthenticatedUserRequestSession(session)) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] User authentication is required.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] User authentication is required.");
     }
     return session;
   }
@@ -3019,12 +3017,12 @@ class AuthRuntime {
   async createAuthorizationContext(request, options = {}) {
     const session = await this.getSession(request, options);
     if (!session.authenticated) {
-      throw new AuthRuntimeError("authentication_required", "[Sixb] Authentication is required.");
+      throw new AuthRuntimeError2("authentication_required", "[Sixb] Authentication is required.");
     }
     return this.contextFromSession(session);
   }
   contextFromSession(session) {
-    return resolveAuthorizationContext({
+    return resolveAuthorizationContext2({
       principal: session.principal,
       sessionId: session.credentialSource === "session" ? session.session.id : undefined,
       groupIds: session.groupIds,
@@ -3051,7 +3049,7 @@ class AuthRuntime {
     const groupIds = constrainRequestedGroupIds(input.groupIds, session.groupIds, {
       subject: "personal access token"
     });
-    const credential = createAccessTokenCredential("personal");
+    const credential = createAccessTokenCredential2("personal");
     const accessToken = await storage.accessTokens.create({
       id: credential.tokenId,
       projectId: this.projectId,
@@ -3162,12 +3160,12 @@ class AuthRuntime {
     const storage = this.requireAuthStorage();
     const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, session.groupIds, input.serviceAccountId);
     if (serviceAccount.status === "suspended") {
-      throw new AuthStorageError("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
+      throw new AuthStorageError2("suspended_service_account", `[Sixb] Service account '${input.serviceAccountId}' is suspended for project '${this.projectId}'.`);
     }
     const groupIds = constrainRequestedGroupIds(input.groupIds, serviceAccountGroupIds, {
       subject: "service account token"
     });
-    const credential = createAccessTokenCredential("serviceAccount");
+    const credential = createAccessTokenCredential2("serviceAccount");
     const accessToken = await storage.accessTokens.create({
       id: credential.tokenId,
       projectId: this.projectId,
@@ -3209,7 +3207,7 @@ class AuthRuntime {
     });
     const groupIds = serviceAccount ? await this.listServiceAccountGroupIds(storage, serviceAccountId) : [];
     if (!serviceAccount || !callerCanManageServiceAccount(callerGroupIds, groupIds)) {
-      throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${this.projectId}'.`);
     }
     return { serviceAccount, groupIds };
   }
@@ -3279,19 +3277,19 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds: currentGroupIds } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds);
     const missing = missingMembershipGroupIds(scope, "assignGroups", requestedGroupIds);
     if (missing.length > 0) {
-      throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to assign group(s): ${missing.join(", ")}.`);
+      throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to assign group(s): ${missing.join(", ")}.`);
     }
     const current = new Set(currentGroupIds);
     const requested = new Set(requestedGroupIds);
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId));
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId));
     if (user.id === session.user.id && removals.length > 0) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
     }
     const now = new Date;
     for (const groupId of additions) {
@@ -3318,10 +3316,10 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     if (user.id === session.user.id) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
     }
     const suspended = await storage.suspendUserAndRevokeSessions({
       projectId: this.projectId,
@@ -3335,7 +3333,7 @@ class AuthRuntime {
     const session = await this.requireUser(request, options);
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(session.groupIds);
-    const userId = assertNonEmpty(input.userId, "User id");
+    const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     const reactivated = await storage.users.updateStatus({
       projectId: this.projectId,
@@ -3359,15 +3357,15 @@ class AuthRuntime {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId });
     const groupIds = user ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map((membership) => membership.groupId) : [];
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
-      throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
     }
     return { user, groupIds };
   }
   resolveMemberGroupIds(input) {
-    const groupIds = [...new Set(input.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    const groupIds = [...new Set(input.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
     for (const groupId of groupIds) {
       if (!this.security.getGroupById(groupId)) {
-        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     return groupIds;
@@ -3379,11 +3377,11 @@ class AuthRuntime {
     const groupIds = this.resolveInviteGroupIds(input);
     this.assertCanManageInvitationGroups(session.groupIds, groupIds);
     const strategy = this.getStrategy();
-    if (!isInvitationDeliveryAuthStrategy(strategy)) {
-      throw new AuthRuntimeError("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
+    if (!isInvitationDeliveryAuthStrategy2(strategy)) {
+      throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support invitations.");
     }
     await this.assertCanInviteRecipient(strategy, authStorage, input.email, now);
-    const deliveryAudience = resolveAuthSessionAudience(options.delivery?.audience ?? options.audience);
+    const deliveryAudience = resolveAuthSessionAudience2(options.delivery?.audience ?? options.audience);
     this.assertInvitationApplicationAccess(groupIds, deliveryAudience);
     const invitation = await authStorage.invitations.createOrUpdateActive({
       id: `inv_${randomUUID3()}`,
@@ -3447,17 +3445,17 @@ class AuthRuntime {
   async revokeInvitation(request, input, options = {}) {
     const session = await this.requireUser(request, options);
     const authStorage = this.requireAuthStorage();
-    const invitationId = assertNonEmpty(input.invitationId, "Invitation id");
+    const invitationId = assertNonEmpty3(input.invitationId, "Invitation id");
     const invitation = await authStorage.invitations.getById({
       projectId: this.projectId,
       id: invitationId
     });
     if (!invitation) {
-      throw new AuthStorageError("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
+      throw new AuthStorageError2("missing_invitation", `[Sixb] Invitation '${invitationId}' not found for project '${this.projectId}'.`);
     }
     this.assertCanManageInvitationGroups(session.groupIds, invitation.groupIds);
     if (invitation.status !== "pending") {
-      throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
+      throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation '${invitationId}' is already ${invitation.status} and cannot be revoked.`);
     }
     return {
       invitation: await authStorage.invitations.revoke({
@@ -3469,19 +3467,19 @@ class AuthRuntime {
   }
   requireAuthStorage() {
     if (!this.storage.auth) {
-      throw new AuthRuntimeError("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
+      throw new AuthRuntimeError2("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
     }
     return this.storage.auth;
   }
   resolveInviteGroupIds(input) {
     if (input.groups && input.groupIds) {
-      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation input cannot provide both groups and groupIds.");
+      throw new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation input cannot provide both groups and groupIds.");
     }
-    const rawGroupIds = input.groupIds ?? input.groups?.map((group) => assertNonEmpty(group.id, "Group id")) ?? [];
-    const groupIds = [...new Set(rawGroupIds.map((groupId) => assertNonEmpty(groupId, "Group id")))];
+    const rawGroupIds = input.groupIds ?? input.groups?.map((group) => assertNonEmpty3(group.id, "Group id")) ?? [];
+    const groupIds = [...new Set(rawGroupIds.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
     for (const groupId of groupIds) {
       if (!this.security.getGroupById(groupId)) {
-        throw new AuthRuntimeError("invalid_auth_input", `[Sixb] Unknown invitation group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Unknown invitation group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
       }
     }
     return groupIds;
@@ -3493,7 +3491,7 @@ class AuthRuntime {
     });
   }
   resolveCreateInvitationCapability(input) {
-    if (!isInvitationDeliveryAuthStrategy(this.getStrategy())) {
+    if (!isInvitationDeliveryAuthStrategy2(this.getStrategy())) {
       return { state: "disabled", reason: "invitation_delivery_not_supported" };
     }
     if (!input.canInvite) {
@@ -3503,14 +3501,14 @@ class AuthRuntime {
   }
   assertInvitationApplicationAccess(groupIds, audience) {
     const roles = this.security.listResolvedRoles();
-    const authorization = resolveAuthorizationContext({
+    const authorization = resolveAuthorizationContext2({
       principal: { type: "user", id: "invited-user" },
       groupIds,
       roles
     });
-    if (canAccessApplication(authorization, roles, audience))
+    if (canAccessApplication2(authorization, roles, audience))
       return;
-    throw new AuthRuntimeError("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] Invitation groups do not grant access to application '${audience}'.`);
   }
   async assertCanInviteRecipient(strategy, authStorage, email, now) {
     if (!strategy.validateInvitationRecipient) {
@@ -3536,9 +3534,9 @@ class AuthRuntime {
   }
   createInvitationDeliveryError(status) {
     if (status === "rate_limited") {
-      return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+      return new AuthRuntimeError2("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
     }
-    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
+    return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation delivery was skipped by the active auth strategy.");
   }
   assertCanManageInvitationGroups(callerGroupIds, groupIds) {
     const scope = this.resolveMembershipPolicyScopeForUser(callerGroupIds);
@@ -3546,10 +3544,10 @@ class AuthRuntime {
       return;
     }
     if (groupIds.length === 0) {
-      throw new AuthRuntimeError("authorization_denied", "[Sixb] The current user is not allowed to create or manage invitations without groups.");
+      throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user is not allowed to create or manage invitations without groups.");
     }
     const missing = missingMembershipGroupIds(scope, "invite", groupIds);
-    throw new AuthRuntimeError("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
+    throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
   }
 }
 function resolveCorrelationId(request) {
@@ -3573,7 +3571,7 @@ function callerCanManageServiceAccount(callerGroupIds, serviceAccountGroupIds) {
   return serviceAccountGroupIds.every((groupId) => callerGroups.has(groupId));
 }
 function missingAccessTokenError(tokenId, projectId) {
-  return new AuthStorageError("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
+  return new AuthStorageError2("missing_access_token", `[Sixb] Access token '${tokenId}' not found for project '${projectId}'.`);
 }
 function constrainRequestedGroupIds(input, allowedGroupIds, options) {
   const groupIds = normalizeRequestedGroupIds(input);
@@ -3583,7 +3581,7 @@ function constrainRequestedGroupIds(input, allowedGroupIds, options) {
   const allowed = new Set(allowedGroupIds);
   for (const groupId of groupIds) {
     if (!allowed.has(groupId)) {
-      throw new AuthRuntimeError("authorization_denied", `[Sixb] Group '${groupId}' cannot be assigned to this ${options.subject}.`);
+      throw new AuthRuntimeError2("authorization_denied", `[Sixb] Group '${groupId}' cannot be assigned to this ${options.subject}.`);
     }
   }
   return groupIds;
@@ -3596,7 +3594,7 @@ function normalizeRequestedGroupIds(input) {
   for (const raw of input) {
     const groupId = raw.trim();
     if (!groupId) {
-      throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Group ids cannot be empty when creating auth credentials.");
+      throw new AuthRuntimeError2("invalid_auth_input", "[Sixb] Group ids cannot be empty when creating auth credentials.");
     }
     if (!groupIds.includes(groupId)) {
       groupIds.push(groupId);
@@ -3606,15 +3604,15 @@ function normalizeRequestedGroupIds(input) {
 }
 function createInvitationRecipientError(status, email) {
   if (status === "rate_limited") {
-    return new AuthRuntimeError("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
+    return new AuthRuntimeError2("rate_limited", "[Sixb] Invitation delivery is rate limited. Try again later.");
   }
   if (status === "invalid_email") {
-    return new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation email is invalid.");
+    return new AuthRuntimeError2("invalid_auth_input", "[Sixb] Invitation email is invalid.");
   }
   if (status === "disallowed_domain") {
-    return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' is not allowed by the active auth strategy.`);
+    return new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation email '${email}' is not allowed by the active auth strategy.`);
   }
-  return new AuthRuntimeError("invalid_auth_input", `[Sixb] Invitation email '${email}' belongs to a suspended user.`);
+  return new AuthRuntimeError2("invalid_auth_input", `[Sixb] Invitation email '${email}' belongs to a suspended user.`);
 }
 function membershipCapabilities(scope) {
   return {
@@ -3631,10 +3629,10 @@ function groupIdsOf(groups) {
   return groups.map((group) => typeof group === "string" ? group : group.id);
 }
 // src/auth/types.ts
-var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
-function principalsEqual(left, right) {
+var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
+function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError, ActionEditCommitError, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2 as assertNonEmpty, isActionDefinition, isGlobalActionDefinition, isObjectActionDefinition, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, ShareDefinitionError, defineShare, isShareDefinition, snapshotShareDefinition, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=883B08C31B88A92764756E2164756E21
+//# debugId=4470AA67E3AEAE5264756E2164756E21