@sixb/sqlite 0.1.7 → 0.1.9

package/src/execution-storage.ts

@@ -3,24 +3,29 @@ import {
   type ExecutionStorageRow,
   executionRecordFromStorageRow,
   executionRecordToStorageRow,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences,
+  prepareExecutionRecord,
 } from "@sixb/core/internal/execution-storage"
-import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "@sixb/core/storage"
+import type {
+  CreateExecutionInput,
+  ExecutionRecord,
+  ExecutionStorage,
+  ShareSessionStorage,
+} from "@sixb/core/storage"
 import { ExecutionStorageError } from "@sixb/core/storage"
 import type { SqliteAuthStorage } from "./auth-storage"
 
 export class SqliteExecutionStorage implements ExecutionStorage {
   constructor(
     private readonly db: Database,
-    private readonly auth: SqliteAuthStorage
+    private readonly auth: SqliteAuthStorage,
+    private readonly shareSessions: Pick<ShareSessionStorage, "getById">
   ) {}
 
   async create(input: CreateExecutionInput): Promise<ExecutionRecord> {
-    const record = normalizeExecutionRecord(input)
-    await validateExecutionRecordReferences(record, {
+    const record = await prepareExecutionRecord(input, {
       auth: this.auth,
       getExecution: (params) => this.getById(params),
+      getShareSession: (params) => this.shareSessions.getById(params),
     })
     const row = executionRecordToStorageRow(record)
 
@@ -37,6 +42,7 @@ export class SqliteExecutionStorage implements ExecutionStorage {
             source_id,
             requested_by_user_id,
             requested_by_service_account_id,
+            requester_group_ids,
             correlation_id,
             parent_execution_id,
             authority_kind,
@@ -47,8 +53,11 @@ export class SqliteExecutionStorage implements ExecutionStorage {
             authority_primitive_kind,
             authority_primitive_id,
             authority_kernel_operation,
+            authority_delegation_kind,
+            authority_delegation_id,
+            authority_delegation_session_id,
             created_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `
         )
         .run(
@@ -60,6 +69,7 @@ export class SqliteExecutionStorage implements ExecutionStorage {
           row.sourceId,
           row.requestedByUserId,
           row.requestedByServiceAccountId,
+          JSON.stringify(row.requesterGroupIds),
           row.correlationId,
           row.parentExecutionId,
           row.authorityKind,
@@ -70,6 +80,9 @@ export class SqliteExecutionStorage implements ExecutionStorage {
           row.authorityPrimitiveKind,
           row.authorityPrimitiveId,
           row.authorityKernelOperation,
+          row.authorityDelegationKind,
+          row.authorityDelegationId,
+          row.authorityDelegationSessionId,
           row.createdAt.toISOString()
         )
     } catch (error) {
@@ -114,6 +127,7 @@ function toStorageRow(row: SqliteExecutionRow): ExecutionStorageRow {
     sourceId: row.source_id,
     requestedByUserId: row.requested_by_user_id,
     requestedByServiceAccountId: row.requested_by_service_account_id,
+    requesterGroupIds: JSON.parse(row.requester_group_ids),
     correlationId: row.correlation_id,
     parentExecutionId: row.parent_execution_id,
     authorityKind: row.authority_kind,
@@ -124,6 +138,9 @@ function toStorageRow(row: SqliteExecutionRow): ExecutionStorageRow {
     authorityPrimitiveKind: row.authority_primitive_kind,
     authorityPrimitiveId: row.authority_primitive_id,
     authorityKernelOperation: row.authority_kernel_operation,
+    authorityDelegationKind: row.authority_delegation_kind,
+    authorityDelegationId: row.authority_delegation_id,
+    authorityDelegationSessionId: row.authority_delegation_session_id,
     createdAt: new Date(row.created_at),
   }
 }
@@ -144,6 +161,7 @@ interface SqliteExecutionRow {
   readonly source_id: string
   readonly requested_by_user_id: string | null
   readonly requested_by_service_account_id: string | null
+  readonly requester_group_ids: string
   readonly correlation_id: string
   readonly parent_execution_id: string | null
   readonly authority_kind: ExecutionStorageRow["authorityKind"]
@@ -154,5 +172,8 @@ interface SqliteExecutionRow {
   readonly authority_primitive_kind: ExecutionStorageRow["authorityPrimitiveKind"]
   readonly authority_primitive_id: string | null
   readonly authority_kernel_operation: ExecutionStorageRow["authorityKernelOperation"]
+  readonly authority_delegation_kind: ExecutionStorageRow["authorityDelegationKind"]
+  readonly authority_delegation_id: string | null
+  readonly authority_delegation_session_id: string | null
   readonly created_at: string
 }

package/src/index.ts

@@ -10,9 +10,14 @@ import type {
   StorageTransactionOptions,
 } from "@sixb/core"
 import { ProviderMaterializationTransactionLifecycle } from "@sixb/core/internal/ontology-storage-provider"
+import {
+  createTransactionStorageProxy,
+  throwNestedStorageTransaction,
+} from "@sixb/core/internal/storage"
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
@@ -22,9 +27,9 @@ import {
   type AiCostStorage,
   type AiLimitStorage,
   type AiUsageStorage,
-  createTransactionStorageProxy,
+  type ShareGrantStorage,
+  type ShareSessionStorage,
   StorageTransactionError,
-  throwNestedStorageTransaction,
 } from "@sixb/core/storage"
 import { SqliteActionRunStorage } from "./action-run-storage"
 import { SqliteAgentStorage } from "./agents"
@@ -39,11 +44,13 @@ import {
   installFreshSqliteSchema,
   sqliteStoragePath,
 } from "./migrations"
-import { SqliteObjectStorage } from "./object-storage"
+import { SqliteObjectStorage } from "./objects"
 import { SqliteOntologyStorage, type SqliteOntologyTransactionContext } from "./ontology-storage"
 import { SqlitePipelineRunStorage } from "./pipeline-run-storage"
 import { SqliteProjectionRunStorage } from "./projection-run-storage"
 import { SqliteRulesStorage } from "./rules-storage"
+import { SqliteShareGrantStorage } from "./share-grant-storage"
+import { SqliteShareSessionStorage } from "./share-session-storage"
 import { SqliteSyncRunStorage } from "./sync-run-storage"
 import { registerSqliteStorageTestingAdapter } from "./testing"
 import { SqliteTimeseriesStorage } from "./timeseries-storage"
@@ -96,6 +103,8 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly timeseries: Storage["timeseries"]
   readonly webhookRuns: SqliteWebhookRunStorage
   readonly rules: SqliteRulesStorage
+  readonly shareGrants: ShareGrantStorage
+  readonly shareSessions: ShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
   readonly migrators: readonly StorageMigrator[]
 
@@ -143,7 +152,7 @@ export class SqliteStorage implements MigrationCapableStorage {
     const readTimeseries = path
       ? new SqliteTimeseriesStorage({ connection: this.readConnection })
       : stores.timeseries
-    this.objects = createOperationScopedFacade(readObjects, readScope)
+    this.objects = createObjectOperationScope(readObjects, readScope)
     this.ontology = createOntologyOperationScope(stores.ontology, ontologyScope)
     this.auth = createAuthOperationScope(stores.auth, scope)
     this.executions = createOperationScopedFacade(stores.executions, scope)
@@ -160,6 +169,8 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.workflowInterventions = createOperationScopedFacade(stores.workflowInterventions, scope)
     this.webhookRuns = createOperationScopedFacade(stores.webhookRuns, scope)
     this.rules = createOperationScopedFacade(stores.rules, scope)
+    this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope)
+    this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope)
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : []
     registerSqliteStorageTestingAdapter(this, (durationMs) =>
@@ -294,7 +305,9 @@ function createSqliteStores(
   }
 ): SqliteStoreSet {
   const auth = new SqliteAuthStorage({ connection })
-  const executions = new SqliteExecutionStorage(connection.db, auth)
+  const shareGrants = new SqliteShareGrantStorage({ connection })
+  const shareSessions = new SqliteShareSessionStorage({ connection })
+  const executions = new SqliteExecutionStorage(connection.db, auth, shareSessions)
   return {
     objects: new SqliteObjectStorage({ connection }),
     ontology: new SqliteOntologyStorage({
@@ -317,6 +330,8 @@ function createSqliteStores(
     workflowInterventions: new SqliteWorkflowInterventionStorage({ connection }),
     webhookRuns: new SqliteWebhookRunStorage({ connection, executions }),
     rules: new SqliteRulesStorage({ connection }),
+    shareGrants,
+    shareSessions,
     connectorConnections: new SqliteConnectorConnectionStorage(connection),
   }
 }
@@ -339,6 +354,8 @@ interface SqliteStoreSet {
   readonly timeseries: SqliteTimeseriesStorage
   readonly webhookRuns: SqliteWebhookRunStorage
   readonly rules: SqliteRulesStorage
+  readonly shareGrants: SqliteShareGrantStorage
+  readonly shareSessions: SqliteShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
 }
 

package/src/migrations/035-share-grants.sql

@@ -0,0 +1,66 @@
+CREATE TABLE share_grants (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  definition_id TEXT NOT NULL CHECK (length(trim(definition_id)) > 0),
+  target_object_type_id TEXT NOT NULL CHECK (length(trim(target_object_type_id)) > 0),
+  target_primary_id TEXT NOT NULL CHECK (length(trim(target_primary_id)) > 0),
+  issued_by_type TEXT NOT NULL CHECK (issued_by_type IN ('user', 'serviceAccount')),
+  issued_by_id TEXT NOT NULL CHECK (length(trim(issued_by_id)) > 0),
+  authority_version INTEGER NOT NULL CHECK (authority_version > 0),
+  authority_snapshot TEXT NOT NULL CHECK (
+    json_valid(authority_snapshot)
+    AND json_type(authority_snapshot) = 'object'
+    AND json_type(authority_snapshot, '$.version') = 'integer'
+    AND json_extract(authority_snapshot, '$.version') = authority_version
+    AND json_type(authority_snapshot, '$.access') = 'object'
+  ),
+  authority_digest TEXT NOT NULL CHECK (
+    length(authority_digest) = 64
+    AND authority_digest = lower(authority_digest)
+    AND authority_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  destination_path TEXT NOT NULL CHECK (
+    substr(destination_path, 1, 1) = '/'
+    AND instr(destination_path, '?') = 0
+    AND instr(destination_path, '#') = 0
+    AND instr(destination_path, char(92)) = 0
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  revoked_by_type TEXT CHECK (
+    revoked_by_type IS NULL OR revoked_by_type IN ('user', 'serviceAccount', 'system')
+  ),
+  revoked_by_id TEXT CHECK (revoked_by_id IS NULL OR length(trim(revoked_by_id)) > 0),
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, token_hash),
+  CHECK (expires_at > created_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at),
+  CHECK (
+    (revoked_at IS NULL AND revoked_by_type IS NULL AND revoked_by_id IS NULL)
+    OR
+    (revoked_at IS NOT NULL AND revoked_by_type IS NOT NULL AND revoked_by_id IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_share_grants_target
+  ON share_grants (
+    project_id,
+    definition_id,
+    target_object_type_id,
+    target_primary_id,
+    created_at DESC,
+    id DESC
+  );
+
+CREATE INDEX idx_share_grants_project_created
+  ON share_grants (project_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_grants_expiry
+  ON share_grants (project_id, expires_at)
+  WHERE revoked_at IS NULL;

package/src/migrations/036-share-sessions.sql

@@ -0,0 +1,226 @@
+-- Shared sessions and their execution provenance.
+CREATE TABLE share_sessions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  grant_id TEXT NOT NULL CHECK (length(trim(grant_id)) > 0),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  absolute_expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, id, grant_id),
+  UNIQUE (project_id, token_hash),
+  FOREIGN KEY (project_id, grant_id)
+    REFERENCES share_grants (project_id, id),
+  CHECK (expires_at > created_at),
+  CHECK (absolute_expires_at > created_at),
+  CHECK (expires_at <= absolute_expires_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at)
+);
+
+CREATE INDEX idx_share_sessions_grant
+  ON share_sessions (project_id, grant_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_sessions_expiry
+  ON share_sessions (project_id, expires_at)
+  WHERE revoked_at IS NULL;
+
+-- Persist shared-session provenance on request executions without fabricating a principal.
+CREATE TABLE executions_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation = 'ontology.recover'
+  ),
+  authority_delegation_kind TEXT CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  authority_delegation_id TEXT,
+  authority_delegation_session_id TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  FOREIGN KEY (
+    project_id, authority_delegation_session_id, authority_delegation_id
+  ) REFERENCES share_sessions (project_id, id, grant_id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v2 (
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, authority_delegation_kind, authority_delegation_id,
+  authority_delegation_session_id, created_at
+)
+SELECT
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, NULL, NULL, NULL, created_at
+FROM executions;
+
+DROP TABLE executions;
+ALTER TABLE executions_v2 RENAME TO executions;

package/src/migrations/037-execution-requester-groups.sql

@@ -0,0 +1,24 @@
+ALTER TABLE executions ADD COLUMN requester_group_ids TEXT NOT NULL DEFAULT '[]';
+
+-- Preserve each admitted snapshot, including an intentionally empty one. Executions without
+-- their own historical snapshot inherit from their parent; historical roots remain unknown/empty.
+WITH RECURSIVE attribution(project_id, id, groups) AS (
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, '[]')
+  FROM executions e
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+  WHERE e.parent_execution_id IS NULL
+  UNION ALL
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, p.groups)
+  FROM executions e
+  JOIN attribution p ON p.project_id = e.project_id AND p.id = e.parent_execution_id
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+)
+UPDATE executions SET requester_group_ids = (
+  SELECT groups FROM attribution
+  WHERE attribution.project_id = executions.project_id AND attribution.id = executions.id
+);
+
+ALTER TABLE workflow_runs DROP COLUMN requester_group_ids;
+ALTER TABLE agent_runs DROP COLUMN requester_group_ids;

package/src/migrations.ts

@@ -88,6 +88,8 @@ import retireAgentDefinitionsSql from "./migrations/033-retire-agent-definitions
 import deviceAuthorizationsSql from "./migrations/034-device-authorizations.sql" with {
   type: "text",
 }
+import shareGrantsSql from "./migrations/035-share-grants.sql" with { type: "text" }
+import shareSessionsSql from "./migrations/036-share-sessions.sql" with { type: "text" }
 
 const MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -177,6 +179,9 @@ export const sqliteStorageMigrations = defineMigrations({
     sqliteSql("032-conversation-run-spec", conversationRunSpecSql),
     sqliteSql("033-retire-agent-definitions", retireAgentDefinitionsSql),
     sqliteSql("034-device-authorizations", deviceAuthorizationsSql),
+    sqliteSql("035-share-grants", shareGrantsSql),
+    sqliteSql("036-share-sessions", shareSessionsSql),
+    sqliteSql("037-execution-requester-groups", executionRequesterGroupsSql),
   ],
 })
 
@@ -392,3 +397,7 @@ function rollbackQuietly(db: Database): void {
     // Ignore rollback errors so the original migration failure is preserved.
   }
 }
+
+import executionRequesterGroupsSql from "./migrations/037-execution-requester-groups.sql" with {
+  type: "text",
+}

package/src/objects/index.ts

@@ -0,0 +1,2 @@
+export type { SqliteObjectStorageOptions } from "./storage"
+export { SqliteObjectStorage } from "./storage"