@sixb/core 0.1.7 → 0.1.8

package/src/shares/session-protocol.ts

@@ -0,0 +1,258 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto"
+import { formatSessionCookieValue, parseSessionCookieValue } from "../auth/sessions"
+import type { SixbHostView } from "../runtime"
+import type { ShareGrantRecord, ShareSessionRecord, Storage } from "../storage"
+import { ShareSessionStorageError } from "../storage"
+import { type ShareAccessPlan, snapshotShareAccessPlan } from "./access-plan"
+import { compileShareAccessPlan } from "./compiler"
+import { intersectShareAccessPlans } from "./intersection"
+
+export const DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS = 15 * 60_000
+
+const MAX_CREATE_ATTEMPTS = 5
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/
+
+export interface SharedSessionContext {
+  readonly grantId: string
+  readonly sessionId: string
+  readonly destinationPath: string
+  readonly access: ShareAccessPlan
+  readonly expiresAt: Date
+  readonly absoluteExpiresAt: Date
+}
+
+export interface SharedSessionCredential {
+  readonly context: SharedSessionContext
+  /** Opaque value for the HttpOnly shared-session cookie. */
+  readonly cookieValue: string
+}
+
+export interface SharedSessionProtocolOptions {
+  readonly host: SixbHostView
+  readonly inactivityTtlMs?: number
+  readonly now?: () => Date
+}
+
+/**
+ * Framework-owned shared-session lifecycle.
+ *
+ * Link and session secrets are verified here. Callers receive only an effective access plan built
+ * from the issued snapshot intersected with the Share definition registered now.
+ */
+export class SharedSessionProtocol {
+  private readonly host: SixbHostView
+  private readonly inactivityTtlMs: number
+  private readonly now: () => Date
+
+  constructor(options: SharedSessionProtocolOptions) {
+    if (!options.host.storage.shareGrants || !options.host.storage.shareSessions) {
+      throw new Error("[Sixb] Shared sessions require share grant and session storage.")
+    }
+    const inactivityTtlMs = options.inactivityTtlMs ?? DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS
+    if (!Number.isSafeInteger(inactivityTtlMs) || inactivityTtlMs <= 0) {
+      throw new Error("[Sixb] Shared session inactivity TTL must be a positive integer.")
+    }
+    this.host = options.host
+    this.inactivityTtlMs = inactivityTtlMs
+    this.now = options.now ?? (() => new Date())
+  }
+
+  async exchange(grantId: string, secret: string): Promise<SharedSessionCredential | null> {
+    if (!validIdentifier(grantId) || !validSecret(secret)) return null
+    const now = this.currentTime()
+
+    for (let attempt = 0; attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const sessionSecret = randomBytes(32).toString("base64url")
+      const sessionId = `shs_${randomUUID()}`
+      try {
+        const result = await this.host.storage.transaction(async (tx) => {
+          const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+          const secretMatches = secretMatchesHash(secret, grant?.tokenHash ?? "")
+          if (!grant || !secretMatches) return null
+          const sessions = requireSessions(tx)
+          const absoluteExpiresAt = new Date(grant.expiresAt)
+          const session = await sessions.create({
+            id: sessionId,
+            projectId: this.host.projectId,
+            grantId: grant.id,
+            tokenHash: sha256(sessionSecret),
+            createdAt: now,
+            expiresAt: inactivityDeadline(now, absoluteExpiresAt, this.inactivityTtlMs),
+            absoluteExpiresAt,
+          })
+          return { grant, session }
+        })
+        if (!result) return null
+        return {
+          context: this.context(result.grant, result.session),
+          cookieValue: formatSessionCookieValue(sessionId, sessionSecret),
+        }
+      } catch (error) {
+        if (
+          error instanceof ShareSessionStorageError &&
+          error.code === "duplicate" &&
+          attempt < MAX_CREATE_ATTEMPTS - 1
+        ) {
+          continue
+        }
+        throw error
+      }
+    }
+
+    return null
+  }
+
+  async resolve(
+    grantId: string,
+    cookieValue: string | undefined,
+    options: { readonly activity?: "background" | "foreground" } = {}
+  ): Promise<SharedSessionContext | null> {
+    if (!validIdentifier(grantId) || !validCookieValue(cookieValue)) return null
+    const credential = parseSessionCookieValue(cookieValue)
+    if (
+      !credential ||
+      !validIdentifier(credential.sessionId) ||
+      !validSecret(credential.sessionSecret)
+    ) {
+      return null
+    }
+    const now = this.currentTime()
+    const tokenHash = sha256(credential.sessionSecret)
+
+    const result = await this.host.storage.transaction(async (tx) => {
+      const sessions = requireSessions(tx)
+      const current = await sessions.getById({
+        projectId: this.host.projectId,
+        id: credential.sessionId,
+      })
+      const secretMatches = secretMatchesHash(credential.sessionSecret, current?.tokenHash ?? "")
+      if (
+        !current ||
+        current.grantId !== grantId ||
+        current.revokedAt !== undefined ||
+        current.expiresAt.getTime() <= now.getTime() ||
+        current.absoluteExpiresAt.getTime() <= now.getTime() ||
+        !secretMatches
+      ) {
+        return null
+      }
+
+      const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+      if (!grant || current.absoluteExpiresAt.getTime() !== grant.expiresAt.getTime()) {
+        return null
+      }
+
+      if (options.activity !== "foreground") return { grant, session: current }
+
+      const renewed = await sessions.renewIfValid({
+        projectId: this.host.projectId,
+        id: current.id,
+        grantId,
+        tokenHash,
+        now,
+        expiresAt: inactivityDeadline(now, current.absoluteExpiresAt, this.inactivityTtlMs),
+      })
+      return renewed ? { grant, session: renewed } : null
+    })
+
+    return result ? this.context(result.grant, result.session) : null
+  }
+
+  async revoke(context: Pick<SharedSessionContext, "grantId" | "sessionId">): Promise<void> {
+    const revokedAt = this.currentTime()
+    await this.host.storage.transaction(async (tx) => {
+      const session = await requireSessions(tx).getById({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+      })
+      if (!session || session.grantId !== context.grantId) return
+      await requireSessions(tx).revoke({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+        revokedAt,
+      })
+    })
+  }
+
+  private context(grant: ShareGrantRecord, session: ShareSessionRecord): SharedSessionContext {
+    return {
+      grantId: grant.id,
+      sessionId: session.id,
+      destinationPath: grant.destinationPath,
+      access: effectiveAccess(this.host, grant),
+      expiresAt: new Date(session.expiresAt),
+      absoluteExpiresAt: new Date(session.absoluteExpiresAt),
+    }
+  }
+
+  private currentTime(): Date {
+    const now = this.now()
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+      throw new Error("[Sixb] Shared session clock returned an invalid date.")
+    }
+    return new Date(now)
+  }
+}
+
+function effectiveAccess(host: SixbHostView, grant: ShareGrantRecord): ShareAccessPlan {
+  const definition = host.definitions.shares.getById(grant.definitionId)
+  if (!definition || definition.target.objectTypeId !== grant.target.objectTypeId) {
+    return snapshotShareAccessPlan({ grants: [] })
+  }
+  const current = compileShareAccessPlan({
+    share: definition,
+    target: grant.target,
+    ontology: host.definitions.ontology,
+    actions: host.definitions.actions,
+  })
+  return intersectShareAccessPlans(grant.authoritySnapshot.access, current)
+}
+
+async function activeGrant(
+  storage: Storage,
+  projectId: string,
+  grantId: string,
+  now: Date
+): Promise<ShareGrantRecord | null> {
+  const grant = await storage.shareGrants?.getById({ projectId, id: grantId })
+  return !grant || grant.revokedAt !== undefined || grant.expiresAt.getTime() <= now.getTime()
+    ? null
+    : grant
+}
+
+function requireSessions(storage: Storage): NonNullable<Storage["shareSessions"]> {
+  if (!storage.shareSessions) {
+    throw new Error("[Sixb] Shared session storage is not configured.")
+  }
+  return storage.shareSessions
+}
+
+function inactivityDeadline(now: Date, absolute: Date, ttlMs: number): Date {
+  return new Date(Math.min(absolute.getTime(), now.getTime() + ttlMs))
+}
+
+function secretMatchesHash(secret: string, expectedHash: string): boolean {
+  const actual = createHash("sha256").update(secret).digest()
+  const expected = /^[0-9a-f]{64}$/.test(expectedHash)
+    ? Buffer.from(expectedHash, "hex")
+    : Buffer.alloc(actual.length)
+  return timingSafeEqual(actual, expected)
+}
+
+function sha256(value: string): string {
+  return createHash("sha256").update(value).digest("hex")
+}
+
+function validIdentifier(value: unknown): value is string {
+  return (
+    typeof value === "string" && value.length > 0 && value.length <= 128 && value.trim() === value
+  )
+}
+
+function validSecret(value: unknown): value is string {
+  return typeof value === "string" && SECRET_PATTERN.test(value)
+}
+
+function validCookieValue(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 256
+}

package/src/shares/types.ts

@@ -0,0 +1,76 @@
+import type { ObjectActionDefinition } from "../actions"
+import type {
+  LinkPathSelectionInput,
+  LinkPathSelectionMode,
+  ObjectTypeWithPropertyTokens,
+} from "../ontology"
+
+declare const shareTargetBrand: unique symbol
+
+/** Contextual placeholder for the one exact object supplied when a Share is issued. */
+export interface ShareTarget<TObjectTypeId extends string = string> {
+  readonly [shareTargetBrand]: true
+  readonly objectTypeId: TObjectTypeId
+}
+
+export interface ShareViewGrant<TObjectTypeId extends string = string> {
+  readonly kind: "object.view"
+  readonly targetObjectTypeId: TObjectTypeId
+  readonly links: LinkPathSelectionMode
+}
+
+export interface ShareViewGrantBuilder<TObjectTypeId extends string = string>
+  extends ShareViewGrant<TObjectTypeId> {
+  /** Include every direct link present when a grant is issued. Nested links remain excluded. */
+  withLinks(): ShareViewGrant<TObjectTypeId>
+  /** Include only these link paths. Use a bare link token when it has no nested links. */
+  withLinks<const TLinks extends readonly LinkPathSelectionInput<TObjectTypeId>[]>(
+    links: TLinks
+  ): ShareViewGrant<TObjectTypeId>
+}
+
+export interface ShareActionGrant<
+  TActionId extends string = string,
+  TObjectTypeId extends string = string,
+> {
+  readonly kind: "action.apply"
+  readonly actionId: TActionId
+  readonly subjectObjectTypeId: TObjectTypeId
+}
+
+export interface ShareActionGrantBuilder<
+  TAction extends ObjectActionDefinition = ObjectActionDefinition,
+> {
+  on(
+    target: ShareTarget<TAction["binding"]["objectType"]["id"]>
+  ): ShareActionGrant<TAction["id"], TAction["binding"]["objectType"]["id"]>
+}
+
+export type ShareScopeGrant = ShareViewGrant | ShareActionGrant
+
+export interface ShareDefinition<
+  TId extends string = string,
+  TTargetObjectTypeId extends string = string,
+> {
+  readonly kind: "share"
+  /**
+   * Durable authority identity. Removing a definition suspends its grants; reusing the id can make
+   * unexpired grants effective again after intersection. Revoke them before permanent removal.
+   */
+  readonly id: TId
+  readonly target: {
+    readonly kind: "object"
+    readonly objectTypeId: TTargetObjectTypeId
+  }
+  readonly grants: readonly ShareScopeGrant[]
+  readonly description?: string
+}
+
+export interface DefineShareOptions<
+  TTarget extends ObjectTypeWithPropertyTokens,
+  TGrants extends readonly ShareScopeGrant[],
+> {
+  readonly target: TTarget
+  readonly grants: (context: { readonly target: ShareTarget<TTarget["id"]> }) => TGrants
+  readonly description?: string
+}

package/src/shares/validation.ts

@@ -0,0 +1,40 @@
+import type { ActionDefinitionCatalog } from "../actions"
+import type { OntologyDefinitionCatalog } from "../ontology"
+import { snapshotShareDefinition } from "./builders"
+import { compileShareAccessPlan } from "./compiler"
+import { ShareDefinitionError } from "./errors"
+import type { ShareDefinition } from "./types"
+
+/** Cross-validate discovered Share definitions after ontology and Actions are registered. */
+export function validateSharesAtStartup(input: {
+  readonly shares: readonly ShareDefinition[]
+  readonly ontology: OntologyDefinitionCatalog
+  readonly actions: ActionDefinitionCatalog
+}): ReadonlyMap<string, ShareDefinition> {
+  const byId = new Map<string, ShareDefinition>()
+  for (const authoredShare of input.shares) {
+    const share = snapshotShareDefinition(authoredShare)
+    if (byId.has(share.id)) {
+      throw invalid(`Duplicate Share id: ${share.id}`)
+    }
+    compileShareAccessPlan({
+      share,
+      target: {
+        objectTypeId: share.target.objectTypeId,
+        primaryId: "__sixb_share_definition_validation__",
+      },
+      ontology: input.ontology,
+      actions: input.actions,
+    })
+    byId.set(share.id, share)
+  }
+  return byId
+}
+
+export function assertShareDefinitionEnvelope(value: unknown): asserts value is ShareDefinition {
+  snapshotShareDefinition(value)
+}
+
+function invalid(message: string): ShareDefinitionError {
+  return new ShareDefinitionError(`[Sixb] ${message}`)
+}

package/src/storage/executions/in-memory.ts

@@ -1,4 +1,5 @@
 import type { AuthStorage } from "../auth"
+import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
 import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
 import {
@@ -18,12 +19,17 @@ function executionKey(projectId: string, id: string): string {
 export class InMemoryExecutionStorage implements ExecutionStorage {
   private readonly rows = new Map<string, ExecutionRecord>()
   private readonly runRootOperation: RunRootOperation
+  private readonly shareSessions?: Pick<ShareSessionStorage, "getById">
 
   constructor(
     private readonly auth: AuthStorage,
-    input: { readonly runRootOperation?: RunRootOperation } = {}
+    input: {
+      readonly runRootOperation?: RunRootOperation
+      readonly shareSessions?: Pick<ShareSessionStorage, "getById">
+    } = {}
   ) {
     this.runRootOperation = input.runRootOperation ?? runDirectly
+    this.shareSessions = input.shareSessions
   }
 
   snapshot(): InMemoryExecutionStorageSnapshot {
@@ -54,6 +60,8 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
           const existing = this.rows.get(executionKey(projectId, id))
           return existing ? cloneExecutionRecord(existing) : null
         },
+        getShareSession: async ({ projectId, id }) =>
+          (await this.shareSessions?.getById({ projectId, id })) ?? null,
       })
 
       this.rows.set(key, cloneExecutionRecord(record))

package/src/storage/executions/provider.ts

@@ -22,7 +22,7 @@ export interface ExecutionStorageRow {
   readonly correlationId: string
   /** SQL-only projection of an execution source, used to enforce the parent foreign key. */
   readonly parentExecutionId: string | null
-  readonly authorityKind: "disabled" | "kernel" | "principal" | "trustedPrimitive"
+  readonly authorityKind: "delegated" | "disabled" | "kernel" | "principal" | "trustedPrimitive"
   readonly authorityUserId: string | null
   readonly authorityServiceAccountId: string | null
   readonly authoritySessionId: string | null
@@ -30,6 +30,9 @@ export interface ExecutionStorageRow {
   readonly authorityPrimitiveKind: TrustedPrimitiveKind | null
   readonly authorityPrimitiveId: string | null
   readonly authorityKernelOperation: "ontology.recover" | null
+  readonly authorityDelegationKind: "share" | null
+  readonly authorityDelegationId: string | null
+  readonly authorityDelegationSessionId: string | null
   readonly createdAt: Date
 }
 
@@ -132,6 +135,9 @@ function flattenAuthority(
   ExecutionStorageRow,
   | "authorityAccessTokenId"
   | "authorityKernelOperation"
+  | "authorityDelegationKind"
+  | "authorityDelegationId"
+  | "authorityDelegationSessionId"
   | "authorityKind"
   | "authorityPrimitiveId"
   | "authorityPrimitiveKind"
@@ -147,6 +153,9 @@ function flattenAuthority(
     authorityPrimitiveKind: null,
     authorityPrimitiveId: null,
     authorityKernelOperation: null,
+    authorityDelegationKind: null,
+    authorityDelegationId: null,
+    authorityDelegationSessionId: null,
   }
 
   switch (record.authorizationRef.type) {
@@ -178,6 +187,14 @@ function flattenAuthority(
         authorityPrimitiveKind: record.authorizationRef.primitive.kind,
         authorityPrimitiveId: record.authorizationRef.primitive.id,
       }
+    case "delegated":
+      return {
+        ...empty,
+        authorityKind: "delegated",
+        authorityDelegationKind: record.authorizationRef.delegation.kind,
+        authorityDelegationId: record.authorizationRef.delegation.grantId,
+        authorityDelegationSessionId: record.authorizationRef.delegation.sessionId,
+      }
     case "kernel":
       return {
         ...empty,
@@ -271,6 +288,18 @@ function inflateAuthority(row: ExecutionStorageRow): CreateExecutionInput["autho
           runId: row.executorId,
         },
       }
+    case "delegated":
+      return {
+        type: "delegated",
+        delegation: {
+          kind: requireValue(row.authorityDelegationKind, "authority delegation kind"),
+          grantId: requireValue(row.authorityDelegationId, "authority delegation id"),
+          sessionId: requireValue(
+            row.authorityDelegationSessionId,
+            "authority delegation session id"
+          ),
+        },
+      }
     case "kernel":
       return {
         type: "kernel",

package/src/storage/executions/run-link.ts

@@ -41,6 +41,35 @@ export async function findPrimitiveRunExecution(input: {
   return execution
 }
 
+/** Resolve the request execution that directly initiated one provider-validated primitive run. */
+export async function findPrimitiveParentRequestExecution(input: {
+  readonly executions: ExecutionStorage
+  readonly projectId: string
+  readonly executionId: string
+  readonly primitive: TrustedPrimitiveRef
+}): Promise<ExecutionRecord | null> {
+  const child = await findPrimitiveRunExecution({
+    ...input,
+    sourceTypes: ["execution"],
+  })
+  if (!child || child.source.type !== "execution") return null
+
+  const parent = await input.executions.getById({
+    projectId: input.projectId,
+    id: child.source.executionId,
+  })
+  if (
+    !parent ||
+    parent.executor.type !== "request" ||
+    parent.source.type !== "http" ||
+    parent.executor.requestId !== parent.source.requestId ||
+    parent.correlationId !== child.correlationId
+  ) {
+    return null
+  }
+  return parent
+}
+
 /** Find the immutable execution and authority owned by one Agent run. */
 export async function findAgentRunExecution(input: {
   readonly executions: ExecutionStorage

package/src/storage/executions/validation.ts

@@ -19,6 +19,10 @@ export interface ExecutionValidationLookup {
     readonly projectId: string
     readonly id: string
   }): Promise<ExecutionRecord | null>
+  getShareSession(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<{ readonly grantId: string } | null>
 }
 
 export function normalizeExecutionRecord(
@@ -56,6 +60,9 @@ export async function validateExecutionRecordReferences(
     )
     await validateCredential(record, lookup)
   }
+  if (record.authorizationRef.type === "delegated") {
+    await validateDelegation(record, lookup)
+  }
 
   await validateParent(record, lookup)
 }
@@ -145,6 +152,17 @@ function assertAuthorizationRef(ref: AuthorizationRef): void {
       assertNonBlank(ref.primitive.id, "Authority primitive id")
       assertNonBlank(ref.primitive.runId, "Authority primitive run id")
       return
+    case "delegated":
+      if (ref.delegation.kind !== "share") {
+        invalid(
+          `Unknown authority delegation kind '${String(
+            (ref.delegation as { kind?: unknown }).kind
+          )}'.`
+        )
+      }
+      assertNonBlank(ref.delegation.grantId, "Authority delegation grant id")
+      assertNonBlank(ref.delegation.sessionId, "Authority delegation session id")
+      return
     case "kernel":
       assertKernelOperation(ref.operation, "Authority kernel operation")
       return
@@ -175,7 +193,13 @@ function assertExecutorAuthority(record: ExecutionRecord): void {
         }
         return
       }
-      invalid("Request executions require principal or explicitly disabled authority.")
+      if (authorizationRef.type === "delegated") {
+        if (requestedBy !== undefined) {
+          invalid("Delegated request executions cannot have a requested-by principal.")
+        }
+        return
+      }
+      invalid("Request executions require principal, delegated, or explicitly disabled authority.")
       break
     }
     case "primitive": {
@@ -294,6 +318,27 @@ async function validateCredential(
   }
 }
 
+async function validateDelegation(
+  record: ExecutionRecord,
+  lookup: ExecutionValidationLookup
+): Promise<void> {
+  if (record.authorizationRef.type !== "delegated") return
+  const { grantId, sessionId } = record.authorizationRef.delegation
+  const session = await lookup.getShareSession({ projectId: record.projectId, id: sessionId })
+  if (!session) {
+    throw new ExecutionStorageError(
+      "missing_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not exist in project '${record.projectId}'.`
+    )
+  }
+  if (session.grantId !== grantId) {
+    throw new ExecutionStorageError(
+      "invalid_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not belong to grant '${grantId}'.`
+    )
+  }
+}
+
 async function validateParent(
   record: ExecutionRecord,
   lookup: ExecutionValidationLookup

package/src/storage/in-memory/index.ts

@@ -21,6 +21,7 @@ import { ProviderMaterializationTransactionLifecycle } from "../ontology/provide
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
@@ -29,6 +30,8 @@ import {
 import { InMemoryPipelineRunStorage, type PipelineRunStorage } from "../pipeline-runs"
 import { InMemoryProjectionRunStorage } from "../projection-runs"
 import { InMemoryRulesStorage, type RulesStorage } from "../rules"
+import { InMemoryShareGrantStorage, type ShareGrantStorage } from "../share-grants"
+import { InMemoryShareSessionStorage, type ShareSessionStorage } from "../share-sessions"
 import { InMemorySyncRunStorage, type SyncRunStorage } from "../sync-runs"
 import type { TimeseriesStorage } from "../timeseries"
 import { InMemoryTimeseriesStorage } from "../timeseries/store"
@@ -66,7 +69,11 @@ export class InMemoryStorage implements Storage {
   private readonly timeseriesStorage = new InMemoryTimeseriesStorage()
   private readonly ontologyStorage: InMemoryOntologyStorage
   private readonly authStorage = new InMemoryAuthStorage()
-  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage)
+  private readonly shareGrantStorage = new InMemoryShareGrantStorage()
+  private readonly shareSessionStorage = new InMemoryShareSessionStorage(this.shareGrantStorage)
+  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage, {
+    shareSessions: this.shareSessionStorage,
+  })
   private readonly agentStorage = new InMemoryAgentStorage(this.executionStorage)
   private readonly aiUsageStorage = new InMemoryAiUsageStorage(this.executionStorage)
   private readonly aiCostStorage = new InMemoryAiCostStorage(this.aiUsageStorage, {
@@ -123,6 +130,8 @@ export class InMemoryStorage implements Storage {
   readonly workflowInterventions: WorkflowInterventionStorage
   readonly webhookRuns: WebhookRunStorage
   readonly rules: RulesStorage
+  readonly shareGrants: ShareGrantStorage
+  readonly shareSessions: ShareSessionStorage
   readonly fileUploadSessions: FileUploadSessionStore
   readonly connectorConnections: ConnectorConnectionStorage
 
@@ -134,7 +143,7 @@ export class InMemoryStorage implements Storage {
       (run) => this.withStorageOperation(run),
       () => this.assertRootOperationAvailable()
     )
-    this.objects = createOperationScopedFacade(this.objectStorage, scope)
+    this.objects = createObjectOperationScope(this.objectStorage, scope)
     this.timeseries = createOperationScopedFacade(this.timeseriesStorage, scope)
     this.auth = createAuthOperationScope(this.authStorage, scope)
     this.executions = createOperationScopedFacade(this.executionStorage, scope)
@@ -153,6 +162,8 @@ export class InMemoryStorage implements Storage {
     )
     this.webhookRuns = createOperationScopedFacade(this.webhookRunStorage, scope)
     this.rules = createOperationScopedFacade(this.rulesStorage, scope)
+    this.shareGrants = createOperationScopedFacade(this.shareGrantStorage, scope)
+    this.shareSessions = createOperationScopedFacade(this.shareSessionStorage, scope)
     this.fileUploadSessions = createOperationScopedFacade(this.fileUploadSessionStorage, scope)
     this.connectorConnections = createOperationScopedFacade(this.connectorConnectionStorage, scope)
     this.ontologyStorage = new InMemoryOntologyStorage(this.objectStorage, this.timeseriesStorage, {
@@ -346,6 +357,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage,
       webhookRuns: this.webhookRunStorage,
       rules: this.rulesStorage,
+      shareGrants: this.shareGrantStorage,
+      shareSessions: this.shareSessionStorage,
       fileUploadSessions: this.fileUploadSessionStorage,
       connectorConnections: this.connectorConnectionStorage,
       ping: async () => undefined,
@@ -374,6 +387,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage.snapshot(),
       webhookRuns: this.webhookRunStorage.snapshot(),
       rules: this.rulesStorage.snapshot(),
+      shareGrants: this.shareGrantStorage.snapshot(),
+      shareSessions: this.shareSessionStorage.snapshot(),
       fileUploadSessions: this.fileUploadSessionStorage.snapshot(),
       connectorConnections: this.connectorConnectionStorage.snapshot(),
     }
@@ -397,6 +412,8 @@ export class InMemoryStorage implements Storage {
     this.workflowInterventionStorage.restore(snapshot.workflowInterventions)
     this.webhookRunStorage.restore(snapshot.webhookRuns)
     this.rulesStorage.restore(snapshot.rules)
+    this.shareGrantStorage.restore(snapshot.shareGrants)
+    this.shareSessionStorage.restore(snapshot.shareSessions)
     this.fileUploadSessionStorage.restore(snapshot.fileUploadSessions)
     this.connectorConnectionStorage.restore(snapshot.connectorConnections)
   }
@@ -420,6 +437,8 @@ export interface InMemoryStorageSnapshot {
   readonly workflowInterventions: ReturnType<InMemoryWorkflowInterventionStorage["snapshot"]>
   readonly webhookRuns: ReturnType<InMemoryWebhookRunStorage["snapshot"]>
   readonly rules: ReturnType<InMemoryRulesStorage["snapshot"]>
+  readonly shareGrants: ReturnType<InMemoryShareGrantStorage["snapshot"]>
+  readonly shareSessions: ReturnType<InMemoryShareSessionStorage["snapshot"]>
   readonly fileUploadSessions: ReturnType<InMemoryFileUploadSessions["snapshot"]>
   readonly connectorConnections: ReturnType<InMemoryConnectorConnectionStorage["snapshot"]>
 }