@sixb/core 0.1.6 → 0.1.8

package/src/storage/executions/validation.ts

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util"
 import type {
   AuthorizablePrincipal,
   AuthorizationRef,
@@ -18,6 +19,10 @@ export interface ExecutionValidationLookup {
     readonly projectId: string
     readonly id: string
   }): Promise<ExecutionRecord | null>
+  getShareSession(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<{ readonly grantId: string } | null>
 }
 
 export function normalizeExecutionRecord(
@@ -55,6 +60,9 @@ export async function validateExecutionRecordReferences(
     )
     await validateCredential(record, lookup)
   }
+  if (record.authorizationRef.type === "delegated") {
+    await validateDelegation(record, lookup)
+  }
 
   await validateParent(record, lookup)
 }
@@ -144,6 +152,17 @@ function assertAuthorizationRef(ref: AuthorizationRef): void {
       assertNonBlank(ref.primitive.id, "Authority primitive id")
       assertNonBlank(ref.primitive.runId, "Authority primitive run id")
       return
+    case "delegated":
+      if (ref.delegation.kind !== "share") {
+        invalid(
+          `Unknown authority delegation kind '${String(
+            (ref.delegation as { kind?: unknown }).kind
+          )}'.`
+        )
+      }
+      assertNonBlank(ref.delegation.grantId, "Authority delegation grant id")
+      assertNonBlank(ref.delegation.sessionId, "Authority delegation session id")
+      return
     case "kernel":
       assertKernelOperation(ref.operation, "Authority kernel operation")
       return
@@ -174,7 +193,13 @@ function assertExecutorAuthority(record: ExecutionRecord): void {
         }
         return
       }
-      invalid("Request executions require principal or explicitly disabled authority.")
+      if (authorizationRef.type === "delegated") {
+        if (requestedBy !== undefined) {
+          invalid("Delegated request executions cannot have a requested-by principal.")
+        }
+        return
+      }
+      invalid("Request executions require principal, delegated, or explicitly disabled authority.")
       break
     }
     case "primitive": {
@@ -190,16 +215,28 @@ function assertExecutorAuthority(record: ExecutionRecord): void {
       return
     }
     case "agent": {
+      if (source.type !== "execution") {
+        invalid("Agent executions require a parent execution source.")
+      }
       if (
-        authorizationRef.type !== "principal" ||
-        authorizationRef.principal.type !== "serviceAccount"
+        authorizationRef.type === "principal" &&
+        authorizationRef.principal.type === "serviceAccount" &&
+        authorizationRef.credential === undefined
       ) {
-        invalid("Agent executions require service-account authority.")
+        return
       }
-      if (authorizationRef.credential !== undefined) {
-        invalid("Agent execution authority cannot carry an external credential.")
+      if (
+        authorizationRef.type === "principal" &&
+        authorizationRef.principal.type === "user" &&
+        authorizationRef.credential !== undefined
+      ) {
+        return
       }
-      return
+      if (authorizationRef.type === "disabled") return
+      invalid(
+        "Agent executions require managed service-account, credentialed user, or explicitly disabled authority."
+      )
+      break
     }
     case "kernel": {
       if (
@@ -281,6 +318,27 @@ async function validateCredential(
   }
 }
 
+async function validateDelegation(
+  record: ExecutionRecord,
+  lookup: ExecutionValidationLookup
+): Promise<void> {
+  if (record.authorizationRef.type !== "delegated") return
+  const { grantId, sessionId } = record.authorizationRef.delegation
+  const session = await lookup.getShareSession({ projectId: record.projectId, id: sessionId })
+  if (!session) {
+    throw new ExecutionStorageError(
+      "missing_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not exist in project '${record.projectId}'.`
+    )
+  }
+  if (session.grantId !== grantId) {
+    throw new ExecutionStorageError(
+      "invalid_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not belong to grant '${grantId}'.`
+    )
+  }
+}
+
 async function validateParent(
   record: ExecutionRecord,
   lookup: ExecutionValidationLookup
@@ -310,6 +368,23 @@ async function validateParent(
       `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`
     )
   }
+  if (
+    record.executor.type === "agent" &&
+    isInheritedAgentAuthority(record.authorizationRef) &&
+    !isDeepStrictEqual(parent.authorizationRef, record.authorizationRef)
+  ) {
+    throw new ExecutionStorageError(
+      "invalid_parent_execution",
+      `[Sixb] Child Agent execution '${record.id}' must inherit its parent's authorization reference.`
+    )
+  }
+}
+
+function isInheritedAgentAuthority(ref: AuthorizationRef): boolean {
+  return (
+    ref.type === "disabled" ||
+    (ref.type === "principal" && ref.principal.type === "user" && ref.credential !== undefined)
+  )
 }
 
 function assertPrincipal(principal: AuthorizablePrincipal, label: string): void {

package/src/storage/in-memory/index.ts

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks"
 import { InMemoryActionRunStorage } from "../action-runs"
 import { type AgentStorage, InMemoryAgentStorage } from "../agents"
 import { type AiAccountingAttribution, type AiCostStorage, InMemoryAiCostStorage } from "../ai-cost"
+import { type AiLimitStorage, InMemoryAiLimitStorage } from "../ai-limits"
 import { type AiUsageStorage, InMemoryAiUsageStorage } from "../ai-usage"
 import { type AuthStorage, InMemoryAuthStorage } from "../auth"
 import {
@@ -20,6 +21,7 @@ import { ProviderMaterializationTransactionLifecycle } from "../ontology/provide
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
@@ -28,6 +30,8 @@ import {
 import { InMemoryPipelineRunStorage, type PipelineRunStorage } from "../pipeline-runs"
 import { InMemoryProjectionRunStorage } from "../projection-runs"
 import { InMemoryRulesStorage, type RulesStorage } from "../rules"
+import { InMemoryShareGrantStorage, type ShareGrantStorage } from "../share-grants"
+import { InMemoryShareSessionStorage, type ShareSessionStorage } from "../share-sessions"
 import { InMemorySyncRunStorage, type SyncRunStorage } from "../sync-runs"
 import type { TimeseriesStorage } from "../timeseries"
 import { InMemoryTimeseriesStorage } from "../timeseries/store"
@@ -65,11 +69,40 @@ export class InMemoryStorage implements Storage {
   private readonly timeseriesStorage = new InMemoryTimeseriesStorage()
   private readonly ontologyStorage: InMemoryOntologyStorage
   private readonly authStorage = new InMemoryAuthStorage()
-  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage)
+  private readonly shareGrantStorage = new InMemoryShareGrantStorage()
+  private readonly shareSessionStorage = new InMemoryShareSessionStorage(this.shareGrantStorage)
+  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage, {
+    shareSessions: this.shareSessionStorage,
+  })
   private readonly agentStorage = new InMemoryAgentStorage(this.executionStorage)
   private readonly aiUsageStorage = new InMemoryAiUsageStorage(this.executionStorage)
   private readonly aiCostStorage = new InMemoryAiCostStorage(this.aiUsageStorage, {
     resolve: (input) => this.resolveAiAccountingAttribution(input),
+    resolveGroup: async (input) => {
+      const attribution = await this.resolveAiAccountingAttribution(input)
+      if (attribution?.kind !== "subagent") return { executionId: input.executionId, attribution }
+      const parent = await this.agentStorage.runs.getById({
+        projectId: input.projectId,
+        id: attribution.parentRunId,
+      })
+      if (!parent) throw new Error("[Sixb] Subagent accounting parent is missing.")
+      return {
+        executionId: parent.executionId,
+        attribution: await this.resolveAiAccountingAttribution({
+          ...input,
+          executionId: parent.executionId,
+        }),
+      }
+    },
+  })
+  private readonly aiLimitStorage = new InMemoryAiLimitStorage({
+    resolveExecution: ({ projectId, executionId }) =>
+      this.executionStorage.getById({ projectId, id: executionId }),
+    resolveUsageRecord: ({ projectId, usageRecordId }) =>
+      this.aiUsageStorage.getRecord(projectId, usageRecordId),
+    resolveCostRecord: ({ projectId, usageRecordId }) =>
+      this.aiCostStorage.getRecord(projectId, usageRecordId),
+    listUsageRecords: ({ projectId }) => this.aiUsageStorage.listRecords(projectId),
   })
   private readonly actionRunStorage = new InMemoryActionRunStorage(this.executionStorage)
   private readonly syncRunStorage = new InMemorySyncRunStorage(this.executionStorage)
@@ -88,6 +121,7 @@ export class InMemoryStorage implements Storage {
   readonly agents: AgentStorage
   readonly aiUsage: AiUsageStorage
   readonly aiCosts: AiCostStorage
+  readonly aiLimits: AiLimitStorage
   readonly actionRuns: InMemoryActionRunStorage
   readonly syncRuns: SyncRunStorage
   readonly pipelineRuns: PipelineRunStorage
@@ -96,6 +130,8 @@ export class InMemoryStorage implements Storage {
   readonly workflowInterventions: WorkflowInterventionStorage
   readonly webhookRuns: WebhookRunStorage
   readonly rules: RulesStorage
+  readonly shareGrants: ShareGrantStorage
+  readonly shareSessions: ShareSessionStorage
   readonly fileUploadSessions: FileUploadSessionStore
   readonly connectorConnections: ConnectorConnectionStorage
 
@@ -107,13 +143,14 @@ export class InMemoryStorage implements Storage {
       (run) => this.withStorageOperation(run),
       () => this.assertRootOperationAvailable()
     )
-    this.objects = createOperationScopedFacade(this.objectStorage, scope)
+    this.objects = createObjectOperationScope(this.objectStorage, scope)
     this.timeseries = createOperationScopedFacade(this.timeseriesStorage, scope)
     this.auth = createAuthOperationScope(this.authStorage, scope)
     this.executions = createOperationScopedFacade(this.executionStorage, scope)
     this.agents = createAgentOperationScope(this.agentStorage, scope)
     this.aiUsage = createOperationScopedFacade(this.aiUsageStorage, scope)
     this.aiCosts = createOperationScopedFacade(this.aiCostStorage, scope)
+    this.aiLimits = createOperationScopedFacade(this.aiLimitStorage, scope)
     this.actionRuns = createOperationScopedFacade(this.actionRunStorage, scope)
     this.syncRuns = createOperationScopedFacade(this.syncRunStorage, scope)
     this.pipelineRuns = createOperationScopedFacade(this.pipelineRunStorage, scope)
@@ -125,6 +162,8 @@ export class InMemoryStorage implements Storage {
     )
     this.webhookRuns = createOperationScopedFacade(this.webhookRunStorage, scope)
     this.rules = createOperationScopedFacade(this.rulesStorage, scope)
+    this.shareGrants = createOperationScopedFacade(this.shareGrantStorage, scope)
+    this.shareSessions = createOperationScopedFacade(this.shareSessionStorage, scope)
     this.fileUploadSessions = createOperationScopedFacade(this.fileUploadSessionStorage, scope)
     this.connectorConnections = createOperationScopedFacade(this.connectorConnectionStorage, scope)
     this.ontologyStorage = new InMemoryOntologyStorage(this.objectStorage, this.timeseriesStorage, {
@@ -154,14 +193,20 @@ export class InMemoryStorage implements Storage {
       projectId: input.projectId,
       id: execution.executor.runId,
     })
-    if (directRun) {
+    if (directRun?.kind === "conversation") {
       return {
         kind: "agent",
-        agentId: directRun.agentId,
         agentRunId: directRun.id,
         threadId: directRun.threadId,
       }
     }
+    if (directRun?.kind === "subagent") {
+      return {
+        kind: "subagent",
+        subagentRunId: directRun.id,
+        parentRunId: directRun.parentRunId,
+      }
+    }
     const agentRun = await this.workflowRunStorage.agentNodes.getByNodeRunId({
       projectId: input.projectId,
       nodeRunId: execution.executor.runId,
@@ -174,7 +219,7 @@ export class InMemoryStorage implements Storage {
     if (!node) return undefined
     return {
       kind: "workflowAgent",
-      agentId: agentRun.agentId,
+      agentStepId: node.nodeId,
       nodeRunId: agentRun.nodeRunId,
       workflowId: node.workflowId,
       workflowRunId: node.workflowRunId,
@@ -224,7 +269,13 @@ export class InMemoryStorage implements Storage {
       this.materializationLifecycles.set(transactionToken, materializationLifecycle)
 
       try {
-        const result = await this.transactionScope.run(transactionToken, async () => run(tx))
+        const result = await this.transactionScope.run(transactionToken, async () => {
+          try {
+            return await run(tx)
+          } finally {
+            await this.aiLimitStorage.settleOperations()
+          }
+        })
         materializationLifecycle.assertCommittable()
         return result
       } catch (error) {
@@ -297,6 +348,7 @@ export class InMemoryStorage implements Storage {
       agents: this.agentStorage,
       aiUsage: this.aiUsageStorage,
       aiCosts: this.aiCostStorage,
+      aiLimits: this.aiLimitStorage,
       actionRuns: this.actionRunStorage,
       syncRuns: this.syncRunStorage,
       pipelineRuns: this.pipelineRunStorage,
@@ -305,6 +357,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage,
       webhookRuns: this.webhookRunStorage,
       rules: this.rulesStorage,
+      shareGrants: this.shareGrantStorage,
+      shareSessions: this.shareSessionStorage,
       fileUploadSessions: this.fileUploadSessionStorage,
       connectorConnections: this.connectorConnectionStorage,
       ping: async () => undefined,
@@ -324,6 +378,7 @@ export class InMemoryStorage implements Storage {
       agents: this.agentStorage.snapshot(),
       aiUsage: this.aiUsageStorage.snapshot(),
       aiCosts: this.aiCostStorage.snapshot(),
+      aiLimits: this.aiLimitStorage.snapshot(),
       actionRuns: this.actionRunStorage.snapshot(),
       syncRuns: this.syncRunStorage.snapshot(),
       pipelineRuns: this.pipelineRunStorage.snapshot(),
@@ -332,6 +387,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage.snapshot(),
       webhookRuns: this.webhookRunStorage.snapshot(),
       rules: this.rulesStorage.snapshot(),
+      shareGrants: this.shareGrantStorage.snapshot(),
+      shareSessions: this.shareSessionStorage.snapshot(),
       fileUploadSessions: this.fileUploadSessionStorage.snapshot(),
       connectorConnections: this.connectorConnectionStorage.snapshot(),
     }
@@ -346,6 +403,7 @@ export class InMemoryStorage implements Storage {
     this.agentStorage.restore(snapshot.agents)
     this.aiUsageStorage.restore(snapshot.aiUsage)
     this.aiCostStorage.restore(snapshot.aiCosts)
+    this.aiLimitStorage.restore(snapshot.aiLimits)
     this.actionRunStorage.restore(snapshot.actionRuns)
     this.syncRunStorage.restore(snapshot.syncRuns)
     this.pipelineRunStorage.restore(snapshot.pipelineRuns)
@@ -354,6 +412,8 @@ export class InMemoryStorage implements Storage {
     this.workflowInterventionStorage.restore(snapshot.workflowInterventions)
     this.webhookRunStorage.restore(snapshot.webhookRuns)
     this.rulesStorage.restore(snapshot.rules)
+    this.shareGrantStorage.restore(snapshot.shareGrants)
+    this.shareSessionStorage.restore(snapshot.shareSessions)
     this.fileUploadSessionStorage.restore(snapshot.fileUploadSessions)
     this.connectorConnectionStorage.restore(snapshot.connectorConnections)
   }
@@ -368,6 +428,7 @@ export interface InMemoryStorageSnapshot {
   readonly agents: ReturnType<InMemoryAgentStorage["snapshot"]>
   readonly aiUsage: ReturnType<InMemoryAiUsageStorage["snapshot"]>
   readonly aiCosts: ReturnType<InMemoryAiCostStorage["snapshot"]>
+  readonly aiLimits: ReturnType<InMemoryAiLimitStorage["snapshot"]>
   readonly actionRuns: ReturnType<InMemoryActionRunStorage["snapshot"]>
   readonly syncRuns: ReturnType<InMemorySyncRunStorage["snapshot"]>
   readonly pipelineRuns: ReturnType<InMemoryPipelineRunStorage["snapshot"]>
@@ -376,6 +437,8 @@ export interface InMemoryStorageSnapshot {
   readonly workflowInterventions: ReturnType<InMemoryWorkflowInterventionStorage["snapshot"]>
   readonly webhookRuns: ReturnType<InMemoryWebhookRunStorage["snapshot"]>
   readonly rules: ReturnType<InMemoryRulesStorage["snapshot"]>
+  readonly shareGrants: ReturnType<InMemoryShareGrantStorage["snapshot"]>
+  readonly shareSessions: ReturnType<InMemoryShareSessionStorage["snapshot"]>
   readonly fileUploadSessions: ReturnType<InMemoryFileUploadSessions["snapshot"]>
   readonly connectorConnections: ReturnType<InMemoryConnectorConnectionStorage["snapshot"]>
 }

package/src/storage/index.ts

@@ -16,6 +16,14 @@ export type {
   ProjectionExecution,
   ProjectionMaterializationIdentity,
 } from "../materialization/model"
+export type { ModelProviderIds } from "../models/events"
+export type { ObjectRef } from "../ontology"
+export type {
+  ShareAccessPlan,
+  ShareScopedActionGrant,
+  ShareScopedGrant,
+  ShareScopedViewGrant,
+} from "../shares/access-plan"
 export type {
   ActionRunEffectsRecord,
   ActionRunFailure,
@@ -65,6 +73,7 @@ export type {
   AgentRunExecution,
   AgentRunFailureCode,
   AgentRunFinishReason,
+  AgentRunKind,
   AgentRunRecord,
   AgentRunStatus,
   AgentRunStore,
@@ -75,9 +84,12 @@ export type {
   AgentThreadStore,
   AppendAgentMessageInput,
   ConfirmAgentRunExecutionOwnershipInput,
+  ConversationAgentRunRecord,
+  ConversationAgentRunSpec,
   CreateAgentContextCheckpointInput,
   CreateAgentRunInput,
   CreateAgentThreadInput,
+  CreateSubagentRunInput,
   DeleteAgentMessagesByRunInput,
   FinishAgentRunInput,
   FinishQueuedAgentRunInput,
@@ -89,6 +101,9 @@ export type {
   ListAgentThreadsResult,
   ReclaimAgentRunInput,
   StartAgentRunInput,
+  SubagentRunRecord,
+  SubagentRunResult,
+  SubagentRunSpec,
 } from "./agents"
 export {
   AGENT_RUN_DIAGNOSTIC_CODES,
@@ -111,11 +126,15 @@ export type {
   AiBillableMeter,
   AiBillingIdentity,
   AiCostComponent,
+  AiCostEstimate,
   AiCostStorage,
   AiCostStorageErrorCode,
   AiCostSummary,
   AiModelCallAccountingItem,
   AiModelCallCostRecord,
+  AiModelCallExecutionSummary,
+  AiModelCallGroup,
+  AiModelCallGroupSummary,
   AiMoney,
   AiPriceSource,
   AiPricingContext,
@@ -126,10 +145,42 @@ export type {
   InMemoryAiCostStorageSnapshot,
   ListAiModelCallAccountingInput,
   ListAiModelCallAccountingResult,
+  ListAiModelCallGroupsInput,
+  ListAiModelCallGroupsResult,
   QueryAiAccountingOverviewInput,
   SummarizeAiCostExecutionsInput,
 } from "./ai-cost"
 export { AiCostStorageError, InMemoryAiCostStorage } from "./ai-cost"
+export type {
+  AiLimitConsumption,
+  AiLimitMeter,
+  AiLimitPeriod,
+  AiLimitPeriodKind,
+  AiLimitPolicy,
+  AiLimitPolicyStatus,
+  AiLimitQuantity,
+  AiLimitReservationBucket,
+  AiLimitStorage,
+  AiLimitStorageErrorCode,
+  AiLimitSubject,
+  AiModelCallReservation,
+  AiModelCallReservationIdentity,
+  AiModelCallReservationState,
+  CreateAiLimitPolicyInput,
+  DeleteAiLimitPolicyInput,
+  GetAiLimitPolicyInput,
+  InMemoryAiLimitStorageOptions,
+  InMemoryAiLimitStorageSnapshot,
+  ListAiLimitPoliciesInput,
+  ListAiLimitPolicyStatusesInput,
+  MarkAiModelCallReservationUnknownInput,
+  ReconcileAiModelCallInput,
+  RecordAiModelCallLimitActualsInput,
+  ReserveAiModelCallInput,
+  ReserveAiModelCallResult,
+  UpdateAiLimitPolicyInput,
+} from "./ai-limits"
+export { AiLimitStorageError, aiLimitCalendarMonth, InMemoryAiLimitStorage } from "./ai-limits"
 export type {
   AiModelCallUsage,
   AiModelCallUsageInput,
@@ -158,6 +209,7 @@ export type {
   AccessTokenRecord,
   AccessTokenSubjectType,
   AuthAccessTokenStore,
+  AuthDeviceAuthorizationStore,
   AuthGroupMembershipStore,
   AuthInvitationStore,
   AuthMagicLinkStore,
@@ -170,6 +222,8 @@ export type {
   AuthUserIdentityStore,
   AuthUserStore,
   CompleteAuthSessionInput,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
@@ -178,8 +232,11 @@ export type {
   CreateAuthServiceAccountInput,
   CreateAuthSessionInput,
   CreateAuthUserInput,
+  CreateDeviceAuthorizationInput,
   CreateOidcAuthorizationAttemptInput,
   CreateOrUpdateAuthInvitationInput,
+  DeviceAuthorizationRecord,
+  DeviceAuthorizationStatus,
   GroupMembershipRecord,
   GroupMembershipSource,
   InvitationRecord,
@@ -210,7 +267,7 @@ export type {
   UserRecord,
   UserStatus,
 } from "./auth"
-export { AuthStorageError, InMemoryAuthStorage } from "./auth"
+export { AuthStorageError, InMemoryAuthStorage, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "./auth"
 export type {
   AttachConnectorConnectionRunAuthorizationInput,
   ClaimConnectorConnectionRunCallbackInput,
@@ -345,6 +402,10 @@ export {
   step,
 } from "./migrations"
 export type {
+  CompiledObjectReadObjectSelection,
+  CompiledObjectReadRoot,
+  CompiledObjectReadStep,
+  CompiledSelectedObjectReadScope,
   CountObjectsInput,
   CountObjectsResult,
   ExistsObjectsInput,
@@ -365,6 +426,15 @@ export type {
   ObjectQueryCapabilityMap,
   ObjectQueryScalarOperation,
   ObjectQueryScalarOperations,
+  ObjectReadExecutionLimits,
+  ObjectReadLimitMetric,
+  ObjectReadLinkDefinitionSelection,
+  ObjectReadLinkSelection,
+  ObjectReadNode,
+  ObjectReadObjectSelection,
+  ObjectReadRoot,
+  ObjectReadScopeFactory,
+  ObjectReadStorage,
   ObjectRow,
   ObjectRowLinks,
   ObjectStorage,
@@ -372,11 +442,19 @@ export type {
   QueryObjectLinksResult,
   QueryObjectsInput,
   QueryObjectsResult,
+  SelectedObjectReadScope,
 } from "./objects"
 export {
+  assertObjectReaderProject,
+  assertObjectReadFacetCount,
+  assertObjectReadOutputWithinLimit,
+  compileSelectedObjectReadScope,
   linkBatchKey,
+  MAX_OBJECT_READ_FACETS,
+  ObjectReadLimitExceededError,
   objectBatchKey,
   objectLinkCursor,
+  snapshotObjectReadExecutionLimits,
 } from "./objects"
 export type {
   AbandonSourceMaterializationCandidateInput,
@@ -560,6 +638,29 @@ export type {
   RulesStorage,
 } from "./rules"
 export { InMemoryRulesStorage } from "./rules"
+export type {
+  CreateShareGrantInput,
+  GetShareGrantByIdInput,
+  ListShareGrantsInput,
+  ListShareGrantsResult,
+  RevokeShareGrantInput,
+  ShareAuthoritySnapshot,
+  ShareAuthoritySnapshotV1,
+  ShareGrantRecord,
+  ShareGrantStorage,
+  ShareGrantStorageErrorCode,
+} from "./share-grants"
+export { InMemoryShareGrantStorage, ShareGrantStorageError } from "./share-grants"
+export type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+  ShareSessionStorage,
+  ShareSessionStorageErrorCode,
+} from "./share-sessions"
+export { InMemoryShareSessionStorage, ShareSessionStorageError } from "./share-sessions"
 export type {
   FinishSyncRunInput,
   ListLatestSyncRunsInput,