@sixb/core 0.1.7 → 0.1.8

package/src/rules/execution.ts

@@ -1,4 +1,5 @@
-import { isAllowed } from "../authorization"
+import { isRuntimeAllowed } from "../authorization"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { DefinitionCatalog } from "../runtime/definitions"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type { ListActiveRuleStatesInput, ListActiveRuleStatesResult } from "../storage/rules"
@@ -20,28 +21,39 @@ export function createRulesRuntime(
   runtime: SixbRuntimeContext,
   source: DefinitionCatalog<RuleDefinition>
 ): RulesRuntime {
-  const visible = (rule: RuleDefinition) =>
-    isAllowed(runtime.authorization, {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const visible = (rule: RuleDefinition) => {
+    if (authority.type === "denied" || authority.type === "delegated") return false
+    return isRuntimeAllowed(runtime, {
       kind: "object.view",
       objectTypeId: rule.subject.objectTypeId,
     })
+  }
 
   return {
-    list: () => source.list().filter(visible),
+    list: () =>
+      authority.type === "denied" || authority.type === "delegated"
+        ? []
+        : source.list().filter(visible),
     getById: (ruleId) => {
+      if (authority.type === "denied" || authority.type === "delegated") return null
       const rule = source.getById(ruleId)
       return rule && visible(rule) ? rule : null
     },
     states: {
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ states: [], hasMore: false, total: 0 })
+        }
         const storage = runtime.storage.rules
         if (!storage) return Promise.resolve({ states: [], hasMore: false, total: 0 })
         return storage.listActive({
-          projectId: runtime.projectId,
           ...input,
-          objectTypeIds: runtime.authorization
-            ? [...runtime.authorization.grants["view:object"]]
-            : undefined,
+          objectTypeIds:
+            authority.type === "principal"
+              ? [...authority.context.grants["view:object"]]
+              : undefined,
+          projectId: runtime.projectId,
         })
       },
     },

package/src/runtime/create.ts

@@ -20,6 +20,7 @@ import type { RuleDefinition } from "../rules"
 import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition } from "../schedules"
 import type { GroupDefinition, MembershipPolicyDefinition, RoleDefinition } from "../security"
+import type { ShareDefinition } from "../shares"
 import type { Storage } from "../storage"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows"
@@ -63,6 +64,8 @@ export interface CreateSixbOptions {
   groups?: readonly GroupDefinition[]
   roles?: readonly RoleDefinition[]
   membershipPolicies?: readonly MembershipPolicyDefinition[]
+  /** Share definitions to register in addition to auto-discovered `shares/` exports. */
+  shares?: readonly ShareDefinition[]
   auth?: SixbAuthConfig
   projectRoot?: string
 }
@@ -72,7 +75,7 @@ export interface CreateSixbOptions {
  *
  * The host auto-discovers exported definitions from `ontology/`, `actions/`, `datasets/`,
  * `connectors/`, `syncs/`, `schedules/`, `pipelines/`, `projections/`,
- * `rules/`, `workflows/`, and `security/{groups,roles,policies}/`
+ * `rules/`, `workflows/`, `shares/`, and `security/{groups,roles,policies}/`
  * relative to `projectRoot`.
  */
 export async function createSixb(
@@ -124,6 +127,7 @@ export async function createSixb(
     membershipPolicies: [...(options.membershipPolicies ?? []), ...definitions.membershipPolicies],
     models: options.models,
     tools: options.tools,
+    shares: [...(options.shares ?? []), ...definitions.shares],
     auth: options.auth,
   })
 }

package/src/runtime/definitions.ts

@@ -9,6 +9,7 @@ import type { ProjectionDefinitionCatalog } from "../projections"
 import type { RuleDefinition } from "../rules"
 import type { ScheduleDefinition } from "../schedules"
 import type { SecurityDefinitionCatalog } from "../security"
+import type { ShareDefinition } from "../shares"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows"
 
@@ -32,6 +33,7 @@ export interface SixbDefinitions {
   readonly rules: DefinitionCatalog<RuleDefinition>
   readonly schedules: DefinitionCatalog<ScheduleDefinition>
   readonly security: SecurityDefinitionCatalog
+  readonly shares: DefinitionCatalog<ShareDefinition>
   readonly syncs: DefinitionCatalog<SyncDefinition>
   readonly workflows: DefinitionCatalog<WorkflowDefinition>
 }

package/src/runtime/host.ts

@@ -36,7 +36,11 @@ import {
   type DomainEventService,
   OntologyOutboxDispatcher,
 } from "../events"
-import { resolveExecutionScopeAuthorization } from "../execution/authorization"
+import {
+  captureExecutionScope,
+  resolveExecutionScopeAuthorization,
+} from "../execution/authorization"
+import { createAuthorizedObjectReader } from "../execution/authorized-object-reader"
 import type { ExecutionScope } from "../execution/types"
 import type { LakeStorage } from "../lake-storage"
 import { type LoggerProvider, LoggingService, type ObservabilityOptions } from "../logging"
@@ -63,6 +67,7 @@ import type {
   RoleDefinition,
   SecurityDefinitionCatalog,
 } from "../security"
+import type { ShareDefinition } from "../shares"
 import type { Storage } from "../storage"
 import type { SyncDefinition } from "../syncs"
 import type { RegisteredWebhook } from "../webhooks"
@@ -114,6 +119,7 @@ export interface SixbHostOptions<TOntologySources extends readonly OntologySourc
   groups?: readonly GroupDefinition[]
   roles?: readonly RoleDefinition[]
   membershipPolicies?: readonly MembershipPolicyDefinition[]
+  shares?: readonly ShareDefinition[]
   auth?: SixbAuthConfig
 }
 
@@ -239,24 +245,36 @@ export class SixbHost<
 
   /** Bind an existing opaque scope. This method never creates or escalates authority. */
   withScope(scope: ExecutionScope): Sixb<TOntologySources> {
-    const authorization = resolveExecutionScopeAuthorization(this.projectId, scope)
-    if (authorization.ref.type === "kernel") {
+    const capturedScope = captureExecutionScope(scope)
+    const authorization = resolveExecutionScopeAuthorization(this.projectId, capturedScope)
+    if (authorization.type === "unrestricted" && authorization.ref.type === "kernel") {
       throw new Error("[Sixb] Kernel authority cannot be bound to the domain SDK.")
     }
 
+    const objectReader = createAuthorizedObjectReader({
+      scope: capturedScope,
+      ontology: this.hostContext.ontology,
+      objectStorage: this.storage.objects,
+    })
+
     const runtime: SixbRuntimeContext = {
       ...this.hostContext,
-      runtimeAuthorization: scope.authorization,
+      runtimeAuthorization: capturedScope.authorization,
+      objectReader,
       ...(authorization.type === "principal" ? { authorization: authorization.context } : {}),
     }
     registerOntologyMutationRuntime(
       runtime,
       createOntologyMutationRuntime({
-        materializer: this.materializer.withScope(scope),
+        materializer: this.materializer.withScope(capturedScope),
         notifyCommittedFacts: () => this.committedFacts.notify(),
       })
     )
-    return createBoundSixb<TOntologySources>(runtime, this.sixbDependencies(), scope.execution)
+    return createBoundSixb<TOntologySources>(
+      runtime,
+      this.sixbDependencies(),
+      capturedScope.execution
+    )
   }
 
   get id(): string {
@@ -318,6 +336,7 @@ export class SixbHost<
         ? {}
         : { connectorConnections: this.connectorService.connectionProcess }),
       blobStorage: this.blobStorage,
+      lakeStorage: this.lakeStorage,
     }
   }
 }

package/src/runtime/internal.ts

@@ -9,6 +9,7 @@ export type {
   StartConnectorAuthorizationResult,
 } from "../connectors/connections/contracts"
 export type { ConnectorConnectionsRuntime } from "../connectors/connections/execution"
+export type { AuthorizedObjectReader } from "../execution/authorized-object-reader"
 export type { OntologyMutationRuntime } from "./ontology-mutations"
 export {
   createOntologyMutationRuntime,

package/src/runtime/resolve-definitions.ts

@@ -19,6 +19,7 @@ import {
   type RoleDefinition,
   SecurityRegistry,
 } from "../security"
+import { type ShareDefinition, validateSharesAtStartup } from "../shares"
 import type { SyncDefinition } from "../syncs"
 import {
   validateKeyedDatasetWriterTopology,
@@ -43,6 +44,7 @@ interface DefinitionOptions {
   readonly workflows?: readonly WorkflowDefinition[]
   readonly tools?: readonly AgentToolDefinition[]
   readonly models?: ModelCatalogInput
+  readonly shares?: readonly ShareDefinition[]
   readonly groups?: readonly GroupDefinition[]
   readonly roles?: readonly RoleDefinition[]
   readonly membershipPolicies?: readonly MembershipPolicyDefinition[]
@@ -61,6 +63,11 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
   const ontology = new OntologyRegistry({ sources: options.ontology })
   const actionRegistry = new ActionRegistry({ actions: options.actions ?? [], ontology })
   const registeredActionIds = new Set(actionRegistry.list().map((action) => action.id))
+  const sharesById = validateSharesAtStartup({
+    shares: options.shares ?? [],
+    ontology,
+    actions: actionRegistry,
+  })
 
   const models = options.models === undefined ? undefined : createModelCatalog(options.models)
   const tools = createAgentToolCatalog(options.tools)
@@ -142,6 +149,7 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
     pipelineIds: new Set(pipelinesById.keys()),
     agentAvailable: models !== undefined,
     connectorIds: new Set(connectorsById.keys()),
+    shareIds: new Set(sharesById.keys()),
     getSubTypes: (objectTypeId) => ontology.listSubTypes(objectTypeId),
   })
   validateWorkflowAgentStepGroupReferences(workflows, security)
@@ -168,6 +176,7 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
     rules: createDefinitionCatalog(rulesById),
     schedules: createDefinitionCatalog(schedulesById),
     security,
+    shares: createDefinitionCatalog(sharesById),
     syncs: createDefinitionCatalog(syncsById),
     workflows: createDefinitionCatalog(workflowsById),
   })

package/src/runtime/sixb.ts

@@ -11,6 +11,9 @@ import type { ConnectorService } from "../connectors/service"
 import { createDatasetsRuntime, type DatasetsRuntime } from "../datasets/execution"
 import { createEventsRuntime, type EventsRuntime } from "../events/execution"
 import type { ExecutionContext } from "../execution"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
+import { assertAuthorizedObjectReaderBinding } from "../execution/authorized-object-reader"
+import type { LakeStorage } from "../lake-storage/types"
 import { createLogsRuntime, type LogsRuntime } from "../logging/execution"
 import type { LoggingService } from "../logging/service"
 import { createObjectsRuntime, type ObjectsRuntime } from "../objects/execution"
@@ -18,6 +21,7 @@ import { createPipelinesRuntime, type PipelinesRuntime } from "../pipelines/exec
 import { createProjectionsRuntime, type ProjectionsRuntime } from "../projections/execution"
 import { createRulesRuntime, type RulesRuntime } from "../rules/execution"
 import { createSchedulesRuntime, type SchedulesRuntime } from "../schedules/execution"
+import { createSharesRuntime, type SharesRuntime } from "../shares/execution"
 import { createSyncsRuntime, type SyncsRuntime } from "../syncs/execution"
 import { createWorkflowsRuntime, type WorkflowsRuntime } from "../workflows/execution"
 import type { SixbDefinitions } from "./definitions"
@@ -42,6 +46,7 @@ export interface Sixb<
   readonly events: EventsRuntime
   readonly logs: LogsRuntime
   readonly schedules: SchedulesRuntime
+  readonly shares: SharesRuntime
   readonly connector: ConnectorRuntime
   readonly blobs: BlobsRuntime
 }
@@ -54,6 +59,7 @@ export interface SixbDependencies {
   readonly connectorService: ConnectorService
   readonly connectorConnections?: ConnectorConnectionProcess
   readonly blobStorage: BlobStorage
+  readonly lakeStorage: LakeStorage
 }
 
 export function createBoundSixb<TOntologySources extends readonly OntologySource[]>(
@@ -61,6 +67,14 @@ export function createBoundSixb<TOntologySources extends readonly OntologySource
   dependencies: SixbDependencies,
   execution: ExecutionContext
 ): Sixb<TOntologySources> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
+  assertAuthorizedObjectReaderBinding({
+    reader: runtime.objectReader,
+    scope: { execution, authorization: runtime.runtimeAuthorization },
+  })
   const sixb: Sixb<TOntologySources> = {
     execution,
     ...createExecutionFacades<TOntologySources>(runtime, execution, dependencies),
@@ -91,7 +105,13 @@ function createExecutionFacades<TOntologySources extends readonly OntologySource
   return {
     objects: createObjectsRuntime<TOntologySources>(runtime, execution),
     actions: createActionsRuntime(runtime, execution),
-    datasets: createDatasetsRuntime(runtime, dependencies.definitions.datasets),
+    datasets: createDatasetsRuntime(
+      runtime,
+      execution,
+      dependencies.definitions.datasets,
+      dependencies.lakeStorage,
+      dependencies.blobStorage
+    ),
     workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
     syncs: createSyncsRuntime(runtime, execution, dependencies.definitions.syncs),
     pipelines: createPipelinesRuntime(runtime, execution, dependencies.definitions.pipelines),
@@ -101,7 +121,8 @@ function createExecutionFacades<TOntologySources extends readonly OntologySource
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
     events: createEventsRuntime(runtime),
     logs: createLogsRuntime(runtime, dependencies.logging),
-    schedules: createSchedulesRuntime(dependencies.definitions.schedules),
+    schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
+    shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
     connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
     blobs: createBlobsRuntime(runtime, execution, dependencies.blobStorage),
   }

package/src/runtime/types.ts

@@ -15,6 +15,7 @@ import type { AuthorizationContext } from "../authorization"
 import type { Broker } from "../broker"
 import type { DomainEventLog } from "../events"
 import type { RuntimeAuthorization } from "../execution"
+import type { AuthorizedObjectReader } from "../execution/authorized-object-reader"
 import type {
   ObjectQuery,
   ObjectQueryExplanation,
@@ -60,6 +61,8 @@ export interface SixbHostContext {
 /** Host dependencies paired with the process-local authority of one bound execution. */
 export interface SixbRuntimeContext extends SixbHostContext {
   readonly runtimeAuthorization: RuntimeAuthorization
+  /** Core-owned read boundary carrying this exact execution authority. */
+  readonly objectReader: AuthorizedObjectReader
   /**
    * Resolved principal grants. Absent for trusted primitive and explicitly disabled executions.
    * The opaque `runtimeAuthorization` remains the source of authority.

package/src/schedules/execution.ts

@@ -1,14 +1,36 @@
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { DefinitionCatalog } from "../runtime/definitions"
+import type { SixbRuntimeContext } from "../runtime/types"
 import type { ScheduleDefinition } from "./types"
 
 /** Schedule definitions visible to an execution; process lifecycle remains on the host. */
 export type SchedulesRuntime = DefinitionCatalog<ScheduleDefinition>
 
 export function createSchedulesRuntime(
+  runtime: SixbRuntimeContext,
   schedules: DefinitionCatalog<ScheduleDefinition>
 ): SchedulesRuntime {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
   return {
-    list: () => schedules.list(),
-    getById: (scheduleId) => schedules.getById(scheduleId),
+    list: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return []
+        case "principal":
+        case "unrestricted":
+          return schedules.list()
+      }
+    },
+    getById: (scheduleId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null
+        case "principal":
+        case "unrestricted":
+          return schedules.getById(scheduleId)
+      }
+    },
   }
 }

package/src/security/every.ts

@@ -16,6 +16,7 @@ import type { ConnectorDefinition } from "../connectors"
 import type { DatasetDefinition } from "../datasets"
 import type { ObjectType } from "../ontology"
 import type { PipelineDefinition } from "../pipelines"
+import type { ShareDefinition } from "../shares"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows/types"
 import { SecurityValidationError } from "./errors"
@@ -31,6 +32,7 @@ export const BREADTH_TARGETS = [
   "pipeline",
   "application",
   "connector",
+  "share",
 ] as const
 
 export type BreadthTarget = (typeof BREADTH_TARGETS)[number]
@@ -44,6 +46,7 @@ interface BreadthTargetInput {
   pipeline: PipelineDefinition
   application: ApplicationDefinition
   connector: ConnectorDefinition
+  share: ShareDefinition
 }
 
 /**
@@ -105,4 +108,5 @@ export const every = {
   pipeline: (): BreadthSelector<"pipeline"> => all("pipeline"),
   application: (): BreadthSelector<"application"> => all("application"),
   connector: (): BreadthSelector<"connector"> => all("connector"),
+  share: (): BreadthSelector<"share"> => all("share"),
 }

package/src/security/grants.ts

@@ -7,12 +7,20 @@
  * checks stay simple `set.has(id)` lookups.
  */
 
-import type { ActionDefinition } from "../actions/types"
+import type { ActionDefinition, ObjectActionDefinition } from "../actions/types"
+import { isObjectActionDefinition } from "../actions/validation"
 import type { AgentReference, AgentUsageReference } from "../agents/types"
 import type { ConnectorDefinition } from "../connectors"
 import type { DatasetDefinition } from "../datasets"
 import type { ObjectType } from "../ontology"
 import type { PipelineDefinition } from "../pipelines"
+import { createShareActionGrant, createShareViewGrant, isShareTarget } from "../shares/builders"
+import type {
+  ShareActionGrantBuilder,
+  ShareDefinition,
+  ShareTarget,
+  ShareViewGrantBuilder,
+} from "../shares/types"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows/types"
 import { SecurityValidationError } from "./errors"
@@ -33,6 +41,7 @@ import type {
   ObserveGrant,
   RunGrant,
   Selection,
+  ShareGrant,
   ViewGrant,
 } from "./types"
 
@@ -56,6 +65,7 @@ const TARGET_BY_DEFINITION_KIND: Readonly<Partial<Record<string, BreadthTarget>>
   workflow: "workflow",
   application: "application",
   connector: "connector",
+  share: "share",
 }
 
 const UNDISCRIMINATED_TARGETS: readonly BreadthTarget[] = ["object", "action"]
@@ -153,9 +163,15 @@ function access(input: GrantInput<ApplicationDefinition, "application">): Access
   return { kind: "grant", capability: "access", target: "application", selection }
 }
 
+function view<const TObjectTypeId extends string>(
+  input: ShareTarget<TObjectTypeId>
+): ShareViewGrantBuilder<TObjectTypeId>
 function view(input: GrantInput<ObjectType, "object">): ViewGrant<"object">
 function view(input: GrantInput<DatasetDefinition, "dataset">): ViewGrant<"dataset">
-function view(input: GrantInput<ObjectType | DatasetDefinition, "object" | "dataset">): ViewGrant {
+function view(
+  input: ShareTarget | GrantInput<ObjectType | DatasetDefinition, "object" | "dataset">
+): ViewGrant | ShareViewGrantBuilder {
+  if (isShareTarget(input)) return createShareViewGrant(input)
   const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS)
   return { kind: "grant", capability: "view", target, selection }
 }
@@ -176,12 +192,37 @@ function append(input: GrantInput<ObjectType, "object">): AppendGrant {
   }
 }
 
+function apply<const TAction extends ObjectActionDefinition>(
+  input: TAction
+): ApplyGrant & ShareActionGrantBuilder<TAction>
+function apply(input: GrantInput<ActionDefinition, "action">): ApplyGrant
 function apply(input: GrantInput<ActionDefinition, "action">): ApplyGrant {
-  return {
+  const grant: ApplyGrant = {
     kind: "grant",
     capability: "apply",
     selection: resolveGrant(input, "can.apply", ["action"]).selection,
   }
+  // `Array.isArray` does not narrow a readonly array. This cast restores the branch already proved
+  // above; every non-selector, non-array GrantInput is one Action definition.
+  const one: ActionDefinition | undefined =
+    Array.isArray(input) || isBreadthSelector(input) ? undefined : (input as ActionDefinition)
+  if (one && isObjectActionDefinition(one)) {
+    Object.defineProperty(grant, "on", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (target: ShareTarget) => createShareActionGrant(one, target),
+    })
+  }
+  return grant
+}
+
+function share(input: GrantInput<ShareDefinition, "share">): ShareGrant {
+  return {
+    kind: "grant",
+    capability: "share",
+    selection: resolveGrant(input, "can.share", ["share"]).selection,
+  }
 }
 
 function run(input: GrantInput<WorkflowDefinition, "workflow">): RunGrant<"workflow">
@@ -265,6 +306,7 @@ export const can = {
   edit,
   append,
   apply,
+  share,
   run,
   observe,
   manage,

package/src/security/index.ts

@@ -40,6 +40,7 @@ export type {
   RunGrant,
   RunGrantTarget,
   Selection,
+  ShareGrant,
   ViewGrant,
   ViewGrantTarget,
 } from "./types"

package/src/security/registry.ts

@@ -27,6 +27,7 @@ export interface SecurityRegistryOptions {
   readonly pipelineIds?: ReadonlySet<string>
   readonly agentAvailable?: boolean
   readonly connectorIds?: ReadonlySet<string>
+  readonly shareIds?: ReadonlySet<string>
   readonly getSubTypes?: (objectTypeId: string) => readonly string[]
 }
 
@@ -52,6 +53,7 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       connectorIds: input.connectorIds,
       observableIds: new Set(["logs", "aiUsage"]),
       manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds,
     })
 
     const universe = {
@@ -65,6 +67,7 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       connectorIds: input.connectorIds ?? new Set<string>(),
       observableIds: new Set(["logs", "aiUsage"]),
       manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds ?? new Set<string>(),
       getSubTypes: input.getSubTypes ?? (() => []),
     }
 

package/src/security/types.ts

@@ -86,6 +86,13 @@ export interface ApplyGrant {
   readonly selection: Selection
 }
 
+/** Issue, list, and revoke grants created from the selected Share definitions. */
+export interface ShareGrant {
+  readonly kind: "grant"
+  readonly capability: "share"
+  readonly selection: Selection
+}
+
 export type RunGrantTarget = "workflow" | "sync" | "pipeline"
 
 export interface RunGrant<TTarget extends RunGrantTarget = RunGrantTarget> {
@@ -127,6 +134,7 @@ export type GrantDefinition =
   | EditGrant
   | AppendGrant
   | ApplyGrant
+  | ShareGrant
   | RunGrant
   | AgentRunGrant
   | ObserveGrant

package/src/security/validation.ts

@@ -30,6 +30,7 @@ const GRANT_CAPABILITIES = Object.keys({
   edit: true,
   append: true,
   apply: true,
+  share: true,
   run: true,
   observe: true,
   manage: true,
@@ -321,6 +322,8 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly manageableIds?: ReadonlySet<string>
   /** Registered connector ids — when provided, manage grants must reference them. */
   readonly connectorIds?: ReadonlySet<string>
+  /** Registered Share ids — when provided, share grants must reference them. */
+  readonly shareIds?: ReadonlySet<string>
 }): RegisteredSecurityDefinitions {
   const groupsById = new Map<string, GroupDefinition>()
   const rolesById = new Map<string, RoleDefinition>()