Breaking (issue #2): every public entity ID is now an opaque string across the store interfaces. AuthUser.ID, Group.ID, APIKeyInfo.ID, Passkey.ID, OrgInvite.ID, TokenClaim.UserID, SessionRecord.UserID and every uint id parameter/return on the six store interfaces are now string. The auth package never parses or does arithmetic on an ID, so a store keyed by uuid / ULID / KSUID passes its IDs straight through.

Migration

• Consumers of the reference stores: none. gormstore keeps its uint primary keys and converts to/from decimal strings at its boundary — no database migration, IDs render identically ("1", "2", …). memory likewise keeps uint keys internally.
• Custom store implementers: change your method signatures to the string id types (the compiler points at each one) and treat an unknown/unparseable id as the method's documented miss (ErrNoUser/ErrNoGroup/a no-op delete) rather than a real key. "" is the reserved "no user" sentinel. SCIM member values and the {id} path segment now pass through verbatim.

Full details in CHANGELOG.md.