@sixb/core 0.0.1

package/dist/chunk-hsv43v58.js

@@ -0,0 +1,1390 @@
+// @bun
+import {
+  SchedulerRuntime
+} from "./chunk-ya6brh8a.js";
+import {
+  createObjectSet,
+  exports_service
+} from "./chunk-t358gywy.js";
+import {
+  createOntologyMutationRuntime,
+  registerOntologyMutationRuntime
+} from "./chunk-v5c085yp.js";
+import {
+  registerProjectionRegistry
+} from "./chunk-590dejbp.js";
+import {
+  LogsRuntime
+} from "./chunk-c3zd880g.js";
+import {
+  ConnectorError,
+  ConnectorNotFoundError,
+  PipelineError,
+  SyncValidationError,
+  discoverActions,
+  discoverAgents,
+  discoverConnectors,
+  discoverDatasets,
+  discoverGroups,
+  discoverMembershipPolicies,
+  discoverOntologySources,
+  discoverPipelines,
+  discoverProjections,
+  discoverRoles,
+  discoverRules,
+  discoverSchedules,
+  discoverSyncs,
+  discoverWorkflows,
+  requestPipelineRun,
+  requestSyncRun,
+  validateRulesAtStartup
+} from "./chunk-pv1yad91.js";
+import {
+  WorkflowsRuntime,
+  validateWorkflowsAtStartup
+} from "./chunk-0psb6kdw.js";
+import {
+  validateSchedulesAtStartup
+} from "./chunk-867jxh7c.js";
+import {
+  RuntimeError
+} from "./chunk-k6j72mtt.js";
+import {
+  assertDatasetDefinition
+} from "./chunk-r65yscvk.js";
+import {
+  EventsRuntime,
+  OntologyOutboxDispatcher
+} from "./chunk-yxss87qa.js";
+import {
+  ActionRegistry,
+  ActionsRuntime
+} from "./chunk-dhmj53mx.js";
+import {
+  requestAction,
+  requestActionAndWait
+} from "./chunk-jdwx7vzs.js";
+import {
+  ProjectionRegistry,
+  createOntologyMaterializer
+} from "./chunk-yvef9xwc.js";
+import {
+  checkStorageSchema,
+  isMigrationCapableStorage
+} from "./chunk-aebzcsxr.js";
+import {
+  OntologyRegistry
+} from "./chunk-mx84y05q.js";
+import {
+  attachSixbErrorReporter,
+  reportEventDeliveryFailure,
+  shareSixbErrorReporter
+} from "./chunk-t72dvahb.js";
+import {
+  assertObjectTypeRegistered
+} from "./chunk-tsk2bxs3.js";
+import {
+  AgentsRuntime,
+  validateAgentGroupReferences
+} from "./chunk-nvamz5dv.js";
+import {
+  APPLICATION_IDS,
+  AuthRuntime,
+  validateSecurityDefinitionsAtStartup
+} from "./chunk-dcgrzj1t.js";
+import {
+  AuthRuntimeError,
+  isMagicLinkAuthStrategy,
+  isOidcAuthStrategy
+} from "./chunk-xwnf87e1.js";
+import {
+  assertAuthorized,
+  canViewEvent,
+  isAllowed,
+  resolveRoleGrants
+} from "./chunk-0fygrz37.js";
+// src/webhooks/errors.ts
+class WebhookValidationError extends Error {
+  name = "WebhookValidationError";
+}
+
+// src/webhooks/builders.ts
+function defineWebhook(id) {
+  assertNonEmpty(id, "Webhook id");
+  return new WebhookMethodBuilder(id);
+}
+
+class WebhookMethodBuilder {
+  id;
+  constructor(id) {
+    this.id = id;
+  }
+  post() {
+    return new WebhookBodyBuilder(this.id, "POST");
+  }
+}
+
+class WebhookBodyBuilder {
+  id;
+  method;
+  constructor(id, method) {
+    this.id = id;
+    this.method = method;
+  }
+  json(schema) {
+    if (schema !== undefined && typeof schema.parse !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook JSON schema must provide parse(value).");
+    }
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "json",
+        parse(value) {
+          return schema ? schema.parse(value) : value;
+        }
+      }
+    });
+  }
+  text() {
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "text",
+        parse(value) {
+          if (typeof value !== "string") {
+            throw new Error("Expected webhook body to be text.");
+          }
+          return value;
+        }
+      }
+    });
+  }
+  raw() {
+    return new WebhookBuilder({
+      id: this.id,
+      method: this.method,
+      body: {
+        format: "raw",
+        parse(value) {
+          if (!(value instanceof Uint8Array)) {
+            throw new Error("Expected webhook body to be raw bytes.");
+          }
+          return value;
+        }
+      }
+    });
+  }
+}
+
+class WebhookBuilder {
+  draft;
+  constructor(draft) {
+    this.draft = draft;
+  }
+  verify(verify) {
+    if (typeof verify !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook verify must be a function.");
+    }
+    return new WebhookBuilder({
+      ...this.draft,
+      verify
+    });
+  }
+  idempotencyKey(resolver) {
+    if (typeof resolver !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook idempotencyKey must be a function.");
+    }
+    return new WebhookBuilder({
+      ...this.draft,
+      idempotencyKey: resolver
+    });
+  }
+  handle(handle) {
+    if (typeof handle !== "function") {
+      throw new WebhookValidationError("[Sixb] Webhook handle must be a function.");
+    }
+    return {
+      kind: "webhook",
+      id: this.draft.id,
+      method: this.draft.method,
+      body: this.draft.body,
+      idempotencyKey: this.draft.idempotencyKey,
+      verify: this.draft.verify,
+      handle
+    };
+  }
+}
+function assertNonEmpty(value, field) {
+  if (!value.trim()) {
+    throw new WebhookValidationError(`[Sixb] ${field} must not be empty.`);
+  }
+}
+// src/webhooks/connector.ts
+function webhookConnector(options) {
+  return {
+    type: "webhook",
+    webhooks: options.webhooks,
+    connect() {
+      return { kind: "webhook" };
+    }
+  };
+}
+// src/webhooks/registry.ts
+function registerWebhooks(connectors) {
+  const registered = [];
+  const routes = new Map;
+  for (const connector of connectors) {
+    const webhooks = connector.adapter.webhooks ?? [];
+    if (!Array.isArray(webhooks)) {
+      throw new WebhookValidationError(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
+    }
+    const ids = new Set;
+    for (const webhook of webhooks) {
+      assertValidWebhook(connector.id, webhook);
+      if (ids.has(webhook.id)) {
+        throw new WebhookValidationError(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
+      }
+      ids.add(webhook.id);
+      const route = webhookRoute(connector.id, webhook.id);
+      const duplicate = routes.get(route);
+      if (duplicate) {
+        throw new WebhookValidationError(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
+      }
+      const registeredWebhook = {
+        connector,
+        webhook,
+        route
+      };
+      routes.set(route, registeredWebhook);
+      registered.push(registeredWebhook);
+    }
+  }
+  return {
+    webhooks: registered
+  };
+}
+function webhookRoute(connectorId, webhookId) {
+  return `/api/webhooks/${connectorId}/${webhookId}`;
+}
+function assertValidWebhook(connectorId, webhook) {
+  if (!isRecord(webhook)) {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
+  }
+  if (webhook.kind !== "webhook") {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
+  }
+  if (typeof webhook.id !== "string" || !webhook.id.trim()) {
+    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
+  }
+  if (webhook.method !== "POST") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
+  }
+  if (!isRecord(webhook.body)) {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
+  }
+  if (webhook.body.format !== "json" && webhook.body.format !== "text" && webhook.body.format !== "raw") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
+  }
+  if (typeof webhook.body.parse !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
+  }
+  if (webhook.verify !== undefined && typeof webhook.verify !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
+  }
+  if (webhook.idempotencyKey !== undefined && typeof webhook.idempotencyKey !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
+  }
+  if (typeof webhook.handle !== "function") {
+    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// src/webhooks/unverified.ts
+class UnverifiedWebhookError extends Error {
+  name = "UnverifiedWebhookError";
+}
+function resolveWebhookVerification(subject, options) {
+  if (options.credential)
+    return { credential: options.credential };
+  if (!options.allowUnverified) {
+    throw new UnverifiedWebhookError(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
+  }
+  return { allowUnverified: true };
+}
+function warnUnverifiedWebhook(subject, verification) {
+  if (verification.credential)
+    return;
+  console.warn(`[${subject.connector}] ${subject.allowOption}, so ${subject.verifies} is not checked ` + `and this route accepts unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption} before exposing it.`);
+}
+// src/runtime/create.ts
+import { resolve as resolve2 } from "path";
+
+// src/runtime/sixb.ts
+import { resolve } from "path";
+
+// src/connectors/runtime.ts
+class ConnectorRuntime {
+  projectId;
+  definitionsById = new Map;
+  connectionStates = new Map;
+  constructor(projectId, definitions) {
+    this.projectId = projectId;
+    for (const definition of definitions) {
+      if (this.definitionsById.has(definition.id)) {
+        throw new ConnectorError(`Duplicate connector id: ${definition.id}`);
+      }
+      this.definitionsById.set(definition.id, definition);
+    }
+  }
+  list() {
+    return [...this.definitionsById.values()];
+  }
+  getById(id) {
+    return this.definitionsById.get(id) ?? null;
+  }
+  async connect(definition) {
+    const registeredDefinition = this.definitionsById.get(definition.id);
+    if (!registeredDefinition) {
+      throw new ConnectorNotFoundError(definition.id);
+    }
+    if (registeredDefinition !== definition) {
+      throw new ConnectorError(`Connector '${definition.id}' is not the registered definition instance.`);
+    }
+    let state = this.connectionStates.get(definition);
+    if (!state) {
+      const controller = new AbortController;
+      const clientPromise = Promise.resolve(definition.adapter.connect({
+        projectId: this.projectId,
+        connectorId: definition.id,
+        signal: controller.signal
+      }));
+      state = { controller, clientPromise };
+      this.connectionStates.set(definition, state);
+    }
+    try {
+      return await state.clientPromise;
+    } catch (error) {
+      if (this.connectionStates.get(definition) === state) {
+        this.connectionStates.delete(definition);
+      }
+      throw error;
+    }
+  }
+  async disconnectAll() {
+    const activeConnections = [...this.connectionStates.entries()];
+    this.connectionStates.clear();
+    for (const [definition, state] of activeConnections) {
+      await this.disconnectState(definition, state);
+    }
+  }
+  async disconnectState(definition, state) {
+    state.controller.abort();
+    let client;
+    try {
+      client = await state.clientPromise;
+    } catch {
+      return;
+    }
+    if (typeof definition.adapter.disconnect === "function") {
+      await definition.adapter.disconnect(client);
+    }
+  }
+}
+
+// src/maintenance/ontology-maintenance.ts
+var DEFAULT_INTERVAL_MS = 60000;
+var DEFAULT_RETENTION_MS = 24 * 60 * 60000;
+var DEFAULT_CLEANUP_LIMIT = 1000;
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 30000;
+var DEGRADED_ATTEMPT_THRESHOLD = 3;
+var DEGRADED_FAILURE_THRESHOLD = 2;
+
+class OntologyMaintenance {
+  projectId;
+  storage;
+  dispatcher;
+  intervalMs;
+  publishedOutboxRetentionMs;
+  terminalSourceRetentionMs;
+  cleanupLimit;
+  shutdownTimeoutMs;
+  now;
+  onError;
+  owners = new Set;
+  timer = null;
+  pass = null;
+  stopping = null;
+  snapshot;
+  constructor(dependencies) {
+    assertNonblank(dependencies.projectId, "projectId");
+    const options = dependencies.options ?? {};
+    this.projectId = dependencies.projectId;
+    this.storage = dependencies.storage;
+    this.dispatcher = dependencies.dispatcher;
+    this.intervalMs = positiveInteger(options.intervalMs ?? DEFAULT_INTERVAL_MS, "intervalMs");
+    this.publishedOutboxRetentionMs = nonnegativeInteger(options.publishedOutboxRetentionMs ?? DEFAULT_RETENTION_MS, "publishedOutboxRetentionMs");
+    this.terminalSourceRetentionMs = nonnegativeInteger(options.terminalSourceRetentionMs ?? DEFAULT_RETENTION_MS, "terminalSourceRetentionMs");
+    this.cleanupLimit = positiveInteger(options.cleanupLimit ?? DEFAULT_CLEANUP_LIMIT, "cleanupLimit");
+    this.shutdownTimeoutMs = nonnegativeInteger(options.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS, "shutdownTimeoutMs");
+    this.now = dependencies.now ?? (() => new Date);
+    this.onError = dependencies.onError ?? ((error) => console.error("[Sixb] Ontology maintenance error:", error));
+    this.snapshot = emptySnapshot(this.intervalMs);
+  }
+  async start() {
+    if (this.stopping)
+      await this.stopping;
+    const owner = Symbol("ontology-maintenance-owner");
+    const startsHosting = this.owners.size === 0;
+    this.owners.add(owner);
+    if (startsHosting)
+      this.startHostedPass();
+    let released = false;
+    return {
+      stop: async () => {
+        if (released)
+          return;
+        released = true;
+        this.owners.delete(owner);
+        if (this.owners.size === 0)
+          await this.stopLoop();
+      }
+    };
+  }
+  runNow() {
+    this.pass ??= this.runPass().finally(() => {
+      this.pass = null;
+    });
+    return this.pass;
+  }
+  async stop() {
+    this.owners.clear();
+    await this.stopLoop();
+  }
+  getSnapshot() {
+    return structuredClone(this.snapshot);
+  }
+  getOperationalStatus() {
+    const snapshot = this.getSnapshot();
+    const lastActivityAt = latestTimestamp(snapshot.lastStartedAt, snapshot.lastCompletedAt);
+    const overdue = lastActivityAt !== null && this.now().getTime() - Date.parse(lastActivityAt) > this.intervalMs * 2;
+    const oldestPendingAt = snapshot.outbox?.oldestPendingAt ?? null;
+    const pendingTooLong = oldestPendingAt !== null && this.now().getTime() - Date.parse(oldestPendingAt) > this.intervalMs * 2;
+    const repeatedlyFailing = (snapshot.outbox?.maxAttempts ?? 0) >= DEGRADED_ATTEMPT_THRESHOLD;
+    const degraded = snapshot.consecutiveFailures >= DEGRADED_FAILURE_THRESHOLD || repeatedlyFailing || pendingTooLong || overdue;
+    return { status: degraded ? "degraded" : "ok", maintenance: snapshot };
+  }
+  startHostedPass() {
+    this.runNow().catch((error) => this.reportError(error)).finally(() => this.scheduleNextPass());
+  }
+  async runPass() {
+    const started = this.now();
+    this.snapshot = { ...this.snapshot, running: true, lastStartedAt: started.toISOString() };
+    const failures = [];
+    await captureFailure(() => this.dispatcher.drain(), failures);
+    const cleanup = await this.cleanupExpiredRows(started, failures);
+    const { outbox, terminalSources } = await this.readOperationalSummaries(failures);
+    this.completePass({ started, failures, cleanup, outbox, terminalSources });
+  }
+  async cleanupExpiredRows(started, failures) {
+    const publishedOutboxRowsDeleted = await captureFailure(() => this.storage.ontology.outbox.purgePublished({
+      projectId: this.projectId,
+      publishedBefore: new Date(started.getTime() - this.publishedOutboxRetentionMs).toISOString(),
+      limit: this.cleanupLimit
+    }), failures, 0);
+    const terminalSources = await captureFailure(() => this.storage.ontology.sources.cleanupTerminal({
+      projectId: this.projectId,
+      terminalBefore: new Date(started.getTime() - this.terminalSourceRetentionMs).toISOString(),
+      limit: this.cleanupLimit
+    }), failures, { rowsDeleted: 0, materializationsDeleted: 0 });
+    return {
+      publishedOutboxRowsDeleted,
+      terminalSourceRowsDeleted: terminalSources.rowsDeleted,
+      terminalSourceMaterializationsDeleted: terminalSources.materializationsDeleted
+    };
+  }
+  async readOperationalSummaries(failures) {
+    const outbox = await captureFailure(() => this.storage.ontology.outbox.summarize({ projectId: this.projectId }), failures, this.snapshot.outbox);
+    const terminalSummary = await captureFailure(() => this.storage.ontology.sources.summarizeTerminal({ projectId: this.projectId }), failures, this.snapshot.terminalSources);
+    return { outbox, terminalSources: terminalSummary };
+  }
+  completePass(input) {
+    const completed = this.now();
+    const failure = input.failures.length > 0 ? new AggregateError(input.failures, "Maintenance pass failed.") : null;
+    this.snapshot = {
+      running: false,
+      intervalMs: this.intervalMs,
+      lastStartedAt: input.started.toISOString(),
+      lastCompletedAt: completed.toISOString(),
+      lastDurationMs: Math.max(0, completed.getTime() - input.started.getTime()),
+      consecutiveFailures: failure ? this.snapshot.consecutiveFailures + 1 : 0,
+      lastError: failure ? errorMessage(failure) : null,
+      outbox: input.outbox,
+      terminalSources: input.terminalSources,
+      cleanup: input.cleanup
+    };
+    if (failure)
+      this.reportError(failure);
+  }
+  scheduleNextPass() {
+    if (this.owners.size === 0 || this.timer !== null)
+      return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      if (this.owners.size === 0)
+        return;
+      this.runNow().catch((error) => this.reportError(error)).finally(() => this.scheduleNextPass());
+    }, this.intervalMs);
+    this.timer.unref?.();
+  }
+  stopLoop() {
+    if (this.stopping)
+      return this.stopping;
+    if (this.timer !== null) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const activePass = this.pass ?? Promise.resolve();
+    const stopping = settlesWithin(activePass, this.shutdownTimeoutMs).then((settled) => {
+      if (!settled) {
+        this.reportError(new Error(`[Sixb] Ontology maintenance did not stop within ${this.shutdownTimeoutMs}ms.`));
+      }
+    });
+    this.stopping = stopping.finally(() => {
+      this.stopping = null;
+    });
+    return this.stopping;
+  }
+  reportError(error) {
+    try {
+      this.onError(error);
+    } catch {}
+  }
+}
+function emptySnapshot(intervalMs) {
+  return {
+    running: false,
+    intervalMs,
+    lastStartedAt: null,
+    lastCompletedAt: null,
+    lastDurationMs: null,
+    consecutiveFailures: 0,
+    lastError: null,
+    outbox: null,
+    terminalSources: null,
+    cleanup: null
+  };
+}
+function positiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must be a positive integer.`);
+  }
+  return value;
+}
+function nonnegativeInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must be a nonnegative integer.`);
+  }
+  return value;
+}
+function assertNonblank(value, name) {
+  if (value.trim().length === 0) {
+    throw new Error(`[Sixb] Ontology maintenance ${name} must not be blank.`);
+  }
+}
+function errorMessage(error) {
+  if (error instanceof AggregateError) {
+    return [...error.errors].map(errorMessage).join(" | ").slice(0, 2000);
+  }
+  const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+  return message.slice(0, 2000);
+}
+function latestTimestamp(left, right) {
+  if (left === null)
+    return right;
+  if (right === null)
+    return left;
+  return Date.parse(left) >= Date.parse(right) ? left : right;
+}
+async function settlesWithin(promise, timeoutMs) {
+  let timer;
+  const timedOut = new Promise((resolve) => {
+    timer = setTimeout(() => resolve(false), timeoutMs);
+  });
+  const result = await Promise.race([
+    promise.then(() => true, () => true),
+    timedOut
+  ]);
+  if (timer !== undefined)
+    clearTimeout(timer);
+  return result;
+}
+async function captureFailure(run, failures, fallback) {
+  try {
+    return await run();
+  } catch (error) {
+    failures.push(error);
+    return fallback;
+  }
+}
+// src/security/runtime.ts
+class RuntimeSecurityRegistry {
+  groupsById;
+  rolesById;
+  membershipPoliciesById;
+  resolvedRoles;
+  constructor(groupsById, rolesById, membershipPoliciesById, resolvedRoles) {
+    this.groupsById = groupsById;
+    this.rolesById = rolesById;
+    this.membershipPoliciesById = membershipPoliciesById;
+    this.resolvedRoles = resolvedRoles;
+  }
+  listGroups() {
+    return [...this.groupsById.values()];
+  }
+  getGroupById(groupId) {
+    return this.groupsById.get(groupId) ?? null;
+  }
+  listRoles() {
+    return [...this.rolesById.values()];
+  }
+  getRoleById(roleId) {
+    return this.rolesById.get(roleId) ?? null;
+  }
+  listResolvedRoles() {
+    return this.resolvedRoles;
+  }
+  listMembershipPolicies() {
+    return [...this.membershipPoliciesById.values()];
+  }
+  getMembershipPolicyById(policyId) {
+    return this.membershipPoliciesById.get(policyId) ?? null;
+  }
+}
+function createRuntimeSecurityRegistry(input) {
+  const securityDefinitions = validateSecurityDefinitionsAtStartup({
+    groups: input.groups ?? [],
+    roles: input.roles ?? [],
+    membershipPolicies: input.membershipPolicies ?? [],
+    applicationIds: input.applicationIds ?? APPLICATION_IDS,
+    objectTypeIds: input.objectTypeIds,
+    datasetIds: input.datasetIds,
+    actionIds: input.actionIds,
+    workflowIds: input.workflowIds,
+    syncIds: input.syncIds,
+    pipelineIds: input.pipelineIds,
+    agentIds: input.agentIds,
+    observableIds: new Set(["logs"])
+  });
+  const universe = {
+    applicationIds: input.applicationIds ?? APPLICATION_IDS,
+    objectTypeIds: input.objectTypeIds ?? new Set,
+    datasetIds: input.datasetIds ?? new Set,
+    actionIds: input.actionIds ?? new Set,
+    workflowIds: input.workflowIds ?? new Set,
+    syncIds: input.syncIds ?? new Set,
+    pipelineIds: input.pipelineIds ?? new Set,
+    agentIds: input.agentIds ?? new Set,
+    observableIds: new Set(["logs"]),
+    getSubTypes: input.getSubTypes ?? (() => [])
+  };
+  const resolvedRoles = securityDefinitions.roles.map((role) => ({
+    id: role.id,
+    grantedToGroupIds: role.grantedToGroupIds,
+    grants: resolveRoleGrants(role, universe)
+  }));
+  return new RuntimeSecurityRegistry(securityDefinitions.groupsById, securityDefinitions.rolesById, securityDefinitions.membershipPoliciesById, resolvedRoles);
+}
+
+// src/runtime/scoped.ts
+function createScopedSixb(runtime, deps) {
+  const canListAction = (action) => isAllowed(runtime.authorization, { kind: "action.apply", actionId: action.id }) && (action.binding.kind === "global" || isAllowed(runtime.authorization, {
+    kind: "object.view",
+    objectTypeId: action.binding.objectType.id
+  }));
+  const scopedCatalog = (source, toRequest) => {
+    const allowed = (id) => isAllowed(runtime.authorization, toRequest(id));
+    return {
+      list: () => source.list().filter((item) => allowed(item.id)),
+      getById: (id) => {
+        const item = source.getById(id);
+        return item && allowed(id) ? item : null;
+      }
+    };
+  };
+  const datasets = scopedCatalog(deps.datasets, (datasetId) => ({
+    kind: "dataset.view",
+    datasetId
+  }));
+  const syncs = scopedCatalog(deps.syncs, (syncId) => ({ kind: "sync.run", syncId }));
+  const pipelines = scopedCatalog(deps.pipelines, (pipelineId) => ({
+    kind: "pipeline.run",
+    pipelineId
+  }));
+  const workflows = scopedCatalog(deps.workflows, (workflowId) => ({
+    kind: "workflow.run",
+    workflowId
+  }));
+  const agents = scopedCatalog(deps.agents, (agentId) => ({ kind: "agent.run", agentId }));
+  const scoped = {
+    authorization: runtime.authorization,
+    objects(objectType) {
+      assertObjectTypeRegistered(runtime.ontology.getObjectTypesById(), objectType);
+      return createObjectSet({ ...runtime, objectType });
+    },
+    list: (params) => exports_service.listObjects(runtime, params),
+    getObject: async (objectTypeId, primaryId) => {
+      assertAuthorized(runtime, { kind: "object.view", objectTypeId });
+      return runtime.storage.objects.getByPrimaryId({
+        projectId: runtime.projectId,
+        objectTypeId,
+        primaryId
+      });
+    },
+    getPrimaryPropertyId: (objectTypeId) => {
+      assertAuthorized(runtime, { kind: "object.view", objectTypeId });
+      return runtime.ontology.getPrimaryPropertyId(objectTypeId);
+    },
+    upsertObject: (objectTypeId, properties) => exports_service.upsertObject(runtime, objectTypeId, properties),
+    upsertObjectBatch: (objectTypeId, items) => exports_service.upsertObjectBatch(runtime, objectTypeId, items),
+    upsertLink: (objectTypeId, sourceId, linkId, target) => exports_service.upsertLink(runtime, objectTypeId, sourceId, linkId, target),
+    upsertLinkBatch: (items) => exports_service.upsertLinkBatch(runtime, items),
+    removeLink: (objectTypeId, sourceId, linkId, target) => exports_service.removeLink(runtime, objectTypeId, sourceId, linkId, target),
+    appendTelemetry: (objectTypeId, items) => exports_service.appendTelemetry(runtime, objectTypeId, items),
+    listDatasets: datasets.list,
+    getDatasetById: datasets.getById,
+    listActions: () => runtime.actionRegistry.list().filter((action) => canListAction(action)),
+    getActionById: (actionId) => {
+      const action = runtime.actionRegistry.getById(actionId);
+      return action && canListAction(action) ? action : null;
+    },
+    requestAction: (input) => requestAction(runtime, input),
+    requestActionAndWait: (input) => requestActionAndWait(runtime, input),
+    listWorkflows: workflows.list,
+    getWorkflowById: workflows.getById,
+    requestWorkflowRun: (input) => deps.workflows.requestByIdAs(runtime, input),
+    listSyncs: syncs.list,
+    getSyncById: syncs.getById,
+    requestSyncRun: async (input) => {
+      const sync = deps.syncs.getById(input.syncId);
+      if (!sync)
+        throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`);
+      return requestSyncRun(runtime, sync, input);
+    },
+    listPipelines: pipelines.list,
+    getPipelineById: pipelines.getById,
+    requestPipelineRun: async (input) => {
+      const pipeline = deps.pipelines.getById(input.pipelineId);
+      if (!pipeline)
+        throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`);
+      return requestPipelineRun(runtime, pipeline, input);
+    },
+    listAgents: agents.list,
+    getAgentById: agents.getById,
+    requestAgentRun: (input) => deps.agents.requestAs(runtime, input),
+    listThreads: (input) => deps.agents.listThreadsAs(runtime, input),
+    getThread: (threadId) => deps.agents.getThreadAs(runtime, threadId),
+    readEvents: async (input) => {
+      const events = await runtime.events.read(input);
+      return events.filter((event) => canViewEvent(runtime.authorization, event));
+    }
+  };
+  return scoped;
+}
+
+// src/runtime/storage-readiness.ts
+var DEFAULT_SCHEMA_RETRY_DELAY_MS = 60000;
+
+class StorageReadiness {
+  storage;
+  schema;
+  schemaRetryDelayMs;
+  now;
+  constructor(storage, options = {}) {
+    this.storage = storage;
+    this.schemaRetryDelayMs = positiveInteger2(options.schemaRetryDelayMs ?? DEFAULT_SCHEMA_RETRY_DELAY_MS, "schemaRetryDelayMs");
+    this.now = options.now ?? (() => new Date);
+    this.schema = isMigrationCapableStorage(storage) ? { status: "unchecked" } : { status: "valid" };
+  }
+  startSchemaValidation() {
+    if (this.schema.status === "checking" || this.schema.status === "valid")
+      return;
+    if (this.schema.status === "invalid" && this.now().getTime() < this.schema.retryAt)
+      return;
+    this.schema = { status: "checking" };
+    this.validateSchema();
+  }
+  async check() {
+    try {
+      await this.storage.ping();
+    } catch {
+      return {
+        status: "unready",
+        storage: { reachable: false, schemaValid: false },
+        reason: "Storage is unreachable."
+      };
+    }
+    this.startSchemaValidation();
+    if (this.schema.status === "valid") {
+      return { status: "ready", storage: { reachable: true, schemaValid: true } };
+    }
+    return {
+      status: "unready",
+      storage: { reachable: true, schemaValid: false },
+      reason: this.schema.status === "invalid" ? this.schema.reason : "Storage schema validation is in progress."
+    };
+  }
+  async validateSchema() {
+    const result = await checkStorageSchema(this.storage);
+    this.schema = result.ok ? { status: "valid" } : this.invalidSchema(result.reason ?? "Storage schema is not usable.");
+  }
+  invalidSchema(reason) {
+    return {
+      status: "invalid",
+      reason,
+      retryAt: this.now().getTime() + this.schemaRetryDelayMs
+    };
+  }
+}
+function positiveInteger2(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`[Sixb] Storage readiness ${name} must be a positive integer.`);
+  }
+  return value;
+}
+
+// src/runtime/sixb.ts
+class Sixb {
+  projectId;
+  ontologySources;
+  datasetsById = new Map;
+  schedulesById = new Map;
+  syncsById = new Map;
+  pipelinesById = new Map;
+  rulesById = new Map;
+  connectorRuntime;
+  webhooksByRoute = new Map;
+  webhooks;
+  runtimeContext;
+  committedFacts;
+  eventsRuntime;
+  ontologyMaintenance;
+  storageReadiness;
+  projectionRegistry;
+  ontology;
+  actionRegistry;
+  actions;
+  workflows;
+  agents;
+  broker;
+  events;
+  logs;
+  storage;
+  lakeStorage;
+  blobStorage;
+  queues;
+  sandboxes;
+  projectRoot;
+  rules;
+  security;
+  auth;
+  schedulerRuntime = null;
+  constructor(options) {
+    attachSixbErrorReporter(this, options.onError);
+    this.projectId = options.id ?? "default";
+    this.ontologySources = options.ontology;
+    this.broker = options.broker;
+    this.eventsRuntime = new EventsRuntime({
+      projectId: this.projectId,
+      broker: this.broker,
+      host: this
+    });
+    this.events = this.eventsRuntime;
+    this.logs = new LogsRuntime({
+      projectId: this.projectId,
+      broker: this.broker,
+      logger: options.logger,
+      observability: options.observability?.logs
+    });
+    this.storage = options.storage;
+    this.storageReadiness = new StorageReadiness(this.storage);
+    this.lakeStorage = options.lakeStorage;
+    this.blobStorage = options.blobStorage;
+    this.queues = options.queues;
+    this.sandboxes = options.sandboxes;
+    this.projectRoot = resolve(options.projectRoot ?? process.cwd());
+    this.rules = options.rules ?? [];
+    this.ontology = new OntologyRegistry({ sources: this.ontologySources });
+    this.actionRegistry = new ActionRegistry(options.actions ?? [], this.ontology);
+    const registeredActionIds = new Set(this.actionRegistry.list().map((action) => action.id));
+    const agents = options.agents ?? [];
+    this.security = createRuntimeSecurityRegistry({
+      groups: options.groups ?? [],
+      roles: options.roles ?? [],
+      membershipPolicies: options.membershipPolicies ?? [],
+      objectTypeIds: new Set(this.ontology.getObjectTypesById().keys()),
+      datasetIds: new Set((options.datasets ?? []).map((dataset) => dataset.id)),
+      actionIds: registeredActionIds,
+      workflowIds: new Set((options.workflows ?? []).map((workflow) => workflow.id)),
+      syncIds: new Set((options.syncs ?? []).map((sync) => sync.id)),
+      pipelineIds: new Set((options.pipelines ?? []).map((pipeline) => pipeline.id)),
+      agentIds: new Set(agents.map((agent) => agent.id)),
+      getSubTypes: (objectTypeId) => this.ontology.listSubTypes(objectTypeId)
+    });
+    this.auth = new AuthRuntime({
+      projectId: this.projectId,
+      storage: this.storage,
+      security: this.security,
+      config: options.auth
+    });
+    validateAuthStrategySecurityReferences(this.auth.getStrategy(), this.security);
+    this.connectorRuntime = new ConnectorRuntime(this.projectId, options.connectors ?? []);
+    const connectors = this.connectorRuntime.list();
+    assertWebhookDeliveryStorage(connectors, this.storage);
+    this.webhooks = registerWebhooks(connectors).webhooks;
+    for (const registered of this.webhooks) {
+      this.webhooksByRoute.set(registered.route, registered);
+    }
+    for (const dataset of options.datasets ?? []) {
+      assertDatasetDefinition(dataset, (message) => new RuntimeError(message));
+      if (this.datasetsById.has(dataset.id)) {
+        throw new RuntimeError(`Duplicate dataset id: ${dataset.id}`);
+      }
+      this.datasetsById.set(dataset.id, dataset);
+    }
+    for (const schedule of options.schedules ?? []) {
+      if (this.schedulesById.has(schedule.id)) {
+        throw new RuntimeError(`Duplicate schedule id: ${schedule.id}`);
+      }
+      this.schedulesById.set(schedule.id, schedule);
+    }
+    for (const sync of options.syncs ?? []) {
+      if (this.syncsById.has(sync.id)) {
+        throw new RuntimeError(`Duplicate sync id: ${sync.id}`);
+      }
+      const dataset = this.datasetsById.get(sync.target.dataset.id);
+      if (!dataset) {
+        throw new RuntimeError(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      }
+      this.syncsById.set(sync.id, sync);
+    }
+    for (const pipeline of options.pipelines ?? []) {
+      if (this.pipelinesById.has(pipeline.id)) {
+        throw new RuntimeError(`Duplicate pipeline id: ${pipeline.id}`);
+      }
+      if (pipeline.graph.nodes.length === 0) {
+        throw new RuntimeError(`Pipeline '${pipeline.id}' must contain at least one step.`);
+      }
+      const stepIds = new Set;
+      for (const node of pipeline.graph.nodes) {
+        const { step } = node;
+        if (stepIds.has(step.id)) {
+          throw new RuntimeError(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
+        }
+        stepIds.add(step.id);
+        for (const [inputName, dataset] of Object.entries(step.inputs)) {
+          if (!this.datasetsById.has(dataset.id)) {
+            throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+          }
+        }
+        if (!this.datasetsById.has(step.output.id)) {
+          throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+        }
+      }
+      this.pipelinesById.set(pipeline.id, pipeline);
+    }
+    validateRulesAtStartup(this.rules, this.ontology);
+    for (const rule of this.rules) {
+      this.rulesById.set(rule.id, rule);
+    }
+    validateSchedulesAtStartup([...this.schedulesById.values()], this.ontology, {
+      registeredRuleIds: new Set(this.rulesById.keys()),
+      registeredActionIds,
+      registeredDatasetIds: new Set(this.datasetsById.keys()),
+      registeredSyncIds: new Set(this.syncsById.keys()),
+      registeredPipelineIds: new Set(this.pipelinesById.keys())
+    });
+    for (const sync of this.syncsById.values()) {
+      validateScheduleReferences("Sync", sync.id, sync.triggers, this.schedulesById);
+    }
+    for (const pipeline of this.pipelinesById.values()) {
+      validateScheduleReferences("Pipeline", pipeline.id, pipeline.triggers, this.schedulesById);
+    }
+    const workflows = validateWorkflowsAtStartup({
+      workflows: options.workflows ?? [],
+      registeredSchedules: this.schedulesById,
+      registeredActionIds,
+      registeredAgentIds: new Set(agents.map((agent) => agent.id))
+    });
+    const workflowIds = new Set;
+    for (const workflow of workflows) {
+      if (workflowIds.has(workflow.id)) {
+        throw new RuntimeError(`Duplicate workflow id: ${workflow.id}`);
+      }
+      workflowIds.add(workflow.id);
+    }
+    this.projectionRegistry = new ProjectionRegistry({
+      projections: options.projections ?? [],
+      ontology: this.ontology,
+      datasetsById: this.datasetsById
+    });
+    registerProjectionRegistry(this, this.projectionRegistry);
+    const materializer = createOntologyMaterializer({
+      projectId: this.projectId,
+      ontology: this.ontology,
+      projections: this.projectionRegistry,
+      storage: this.storage
+    });
+    this.committedFacts = new OntologyOutboxDispatcher({
+      projectId: this.projectId,
+      storage: this.storage,
+      events: this.eventsRuntime,
+      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure(this, error, {
+        projectId: this.projectId,
+        ...failure
+      })
+    });
+    this.ontologyMaintenance = new OntologyMaintenance({
+      projectId: this.projectId,
+      storage: this.storage,
+      dispatcher: this.committedFacts,
+      options: options.ontologyMaintenance
+    });
+    this.runtimeContext = {
+      projectId: this.projectId,
+      ontology: this.ontology,
+      actionRegistry: this.actionRegistry,
+      events: this.events,
+      storage: this.storage,
+      lakeStorage: this.lakeStorage,
+      blobStorage: this.blobStorage,
+      queues: this.queues,
+      sandboxes: this.sandboxes,
+      rules: this.rules
+    };
+    registerProjectionRegistry(this.runtimeContext, this.projectionRegistry);
+    const ontologyMutations = createOntologyMutationRuntime({
+      materializer,
+      notifyCommittedFacts: () => this.committedFacts.notify()
+    });
+    registerOntologyMutationRuntime(this, ontologyMutations);
+    registerOntologyMutationRuntime(this.runtimeContext, ontologyMutations);
+    shareSixbErrorReporter(this, this.runtimeContext);
+    this.actions = new ActionsRuntime(this.runtimeContext);
+    this.workflows = new WorkflowsRuntime(this.runtimeContext, workflows);
+    const agentIds = new Set;
+    for (const agent of agents) {
+      if (agentIds.has(agent.id)) {
+        throw new RuntimeError(`Duplicate agent id: ${agent.id}`);
+      }
+      agentIds.add(agent.id);
+    }
+    validateAgentGroupReferences(agents, this.security);
+    this.agents = new AgentsRuntime(this.runtimeContext, agents);
+  }
+  get id() {
+    return this.projectId;
+  }
+  listObjectTypes() {
+    return this.ontology.listObjectTypes();
+  }
+  getObjectTypeById(objectTypeId) {
+    return this.ontology.getObjectTypeById(objectTypeId);
+  }
+  resolveObjectType(objectTypeId) {
+    return this.ontology.resolveObjectType(objectTypeId);
+  }
+  getValueTypesById() {
+    return this.ontology.getValueTypesById();
+  }
+  listActions() {
+    return this.actionRegistry.list();
+  }
+  getActionById(actionId) {
+    return this.actionRegistry.getById(actionId);
+  }
+  listGlobalActions() {
+    return this.actionRegistry.getGlobalActions();
+  }
+  listActionsForType(objectType) {
+    return this.actionRegistry.getActionsForType(objectType);
+  }
+  listDatasets() {
+    return [...this.datasetsById.values()];
+  }
+  getDatasetById(datasetId) {
+    return this.datasetsById.get(datasetId) ?? null;
+  }
+  listSyncs() {
+    return [...this.syncsById.values()];
+  }
+  getSyncById(syncId) {
+    return this.syncsById.get(syncId) ?? null;
+  }
+  listPipelines() {
+    return [...this.pipelinesById.values()];
+  }
+  getPipelineById(pipelineId) {
+    return this.pipelinesById.get(pipelineId) ?? null;
+  }
+  requestAction(input) {
+    return requestAction(this.runtimeContext, input);
+  }
+  requestActionAndWait(input) {
+    return requestActionAndWait(this.runtimeContext, input);
+  }
+  requestWorkflowRun(input) {
+    return this.workflows.requestById(input);
+  }
+  async requestSyncRun(input) {
+    const sync = this.getSyncById(input.syncId);
+    if (!sync) {
+      throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`);
+    }
+    return requestSyncRun(this.runtimeContext, sync, input);
+  }
+  async requestPipelineRun(input) {
+    const pipeline = this.getPipelineById(input.pipelineId);
+    if (!pipeline) {
+      throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`);
+    }
+    return requestPipelineRun(this.runtimeContext, pipeline, input);
+  }
+  requestAgentRun(input) {
+    return this.agents.request(input);
+  }
+  listSchedules() {
+    return [...this.schedulesById.values()];
+  }
+  getScheduleById(scheduleId) {
+    return this.schedulesById.get(scheduleId) ?? null;
+  }
+  listRules() {
+    return [...this.rulesById.values()];
+  }
+  getRuleById(ruleId) {
+    return this.rulesById.get(ruleId) ?? null;
+  }
+  listConnectors() {
+    return this.connectorRuntime.list();
+  }
+  getConnectorById(connectorId) {
+    return this.connectorRuntime.getById(connectorId);
+  }
+  listWebhooks() {
+    return this.webhooks;
+  }
+  getWebhookById(connectorId, webhookId) {
+    return this.webhooksByRoute.get(webhookRoute(connectorId, webhookId)) ?? null;
+  }
+  connector(definition) {
+    return this.connectorRuntime.connect(definition);
+  }
+  async startScheduler() {
+    if (this.schedulerRuntime || this.schedulesById.size === 0)
+      return;
+    const runtime = new SchedulerRuntime({
+      schedules: this.listSchedules(),
+      events: this.eventsRuntime
+    });
+    await runtime.start();
+    this.schedulerRuntime = runtime;
+  }
+  async stopScheduler() {
+    if (!this.schedulerRuntime)
+      return;
+    const runtime = this.schedulerRuntime;
+    this.schedulerRuntime = null;
+    await runtime.stop();
+  }
+  startOntologyMaintenance() {
+    this.storageReadiness.startSchemaValidation();
+    return this.ontologyMaintenance.start();
+  }
+  getOntologyOperationalStatus() {
+    return this.ontologyMaintenance.getOperationalStatus();
+  }
+  async checkReadiness() {
+    return this.storageReadiness.check();
+  }
+  async disconnectConnectors() {
+    await this.connectorRuntime.disconnectAll();
+  }
+  async closeLogger() {
+    await this.logs.close();
+  }
+  async closeBroker() {
+    await this.committedFacts.stop();
+    await this.ontologyMaintenance.stop();
+    await this.broker.close?.();
+  }
+  as(context) {
+    return createScopedSixb({ ...this.runtimeContext, authorization: context }, {
+      datasets: {
+        list: () => this.listDatasets(),
+        getById: (datasetId) => this.getDatasetById(datasetId)
+      },
+      syncs: {
+        list: () => this.listSyncs(),
+        getById: (syncId) => this.getSyncById(syncId)
+      },
+      pipelines: {
+        list: () => this.listPipelines(),
+        getById: (pipelineId) => this.getPipelineById(pipelineId)
+      },
+      workflows: this.workflows,
+      agents: this.agents
+    });
+  }
+  objects(objectType) {
+    assertObjectTypeRegistered(this.ontology.getObjectTypesById(), objectType);
+    return createObjectSet({ ...this.runtimeContext, objectType });
+  }
+  async upsertObject(objectTypeId, properties) {
+    return exports_service.upsertObject(this.runtimeContext, objectTypeId, properties);
+  }
+  async upsertObjectBatch(objectTypeId, items) {
+    return exports_service.upsertObjectBatch(this.runtimeContext, objectTypeId, items);
+  }
+  async upsertLinkBatch(items) {
+    return exports_service.upsertLinkBatch(this.runtimeContext, items);
+  }
+  async appendTelemetry(objectTypeId, items) {
+    await exports_service.appendTelemetry(this.runtimeContext, objectTypeId, items);
+  }
+  async upsertLink(objectTypeId, sourceId, linkId, target) {
+    await exports_service.upsertLink(this.runtimeContext, objectTypeId, sourceId, linkId, target);
+  }
+  async removeLink(objectTypeId, sourceId, linkId, target) {
+    await exports_service.removeLink(this.runtimeContext, objectTypeId, sourceId, linkId, target);
+  }
+  getPrimaryPropertyId(objectTypeId) {
+    return this.ontology.getPrimaryPropertyId(objectTypeId);
+  }
+  listObjectProjections() {
+    return this.projectionRegistry.listObjectProjections();
+  }
+  listLinkProjections() {
+    return this.projectionRegistry.listLinkProjections();
+  }
+  listTelemetryProjections() {
+    return this.projectionRegistry.listTelemetryProjections();
+  }
+  getProjectionById(projectionId) {
+    return this.projectionRegistry.getProjectionById(projectionId);
+  }
+  async list(params) {
+    return exports_service.listObjects(this.runtimeContext, params);
+  }
+  listSubTypes(objectTypeId) {
+    return this.ontology.listSubTypes(objectTypeId);
+  }
+  isValidLinkTarget(expected, actual) {
+    return this.ontology.isValidLinkTarget(expected, actual);
+  }
+}
+function validateScheduleReferences(consumerKind, consumerId, references, schedulesById) {
+  for (const reference of references) {
+    if (!schedulesById.has(reference.scheduleId)) {
+      throw new RuntimeError(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
+    }
+  }
+}
+function validateAuthStrategySecurityReferences(strategy, security) {
+  if (!isMagicLinkAuthStrategy(strategy) && !isOidcAuthStrategy(strategy)) {
+    return;
+  }
+  for (const groupId of strategy.bootstrapGroupIds ?? []) {
+    if (!security.getGroupById(groupId)) {
+      throw new AuthRuntimeError("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+    }
+  }
+}
+function assertWebhookDeliveryStorage(connectors, storage) {
+  if (storage.webhookDeliveries !== undefined) {
+    return;
+  }
+  for (const connector of connectors) {
+    const webhooks = connector.adapter.webhooks;
+    if (!Array.isArray(webhooks)) {
+      continue;
+    }
+    if (webhooks.some((webhook) => webhook.idempotencyKey !== undefined)) {
+      throw new WebhookValidationError("[Sixb] Webhook idempotency requires storage.webhookDeliveries to be configured.");
+    }
+  }
+}
+
+// src/runtime/create.ts
+async function createSixb(options) {
+  const projectRoot = resolve2(options.projectRoot ?? process.cwd());
+  const discovered = await discoverOntologySources(projectRoot);
+  const allSources = [...options.ontologies ?? [], ...discovered];
+  if (allSources.length === 0) {
+    throw new RuntimeError("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
+  }
+  const [
+    actions,
+    projections,
+    schedules,
+    syncs,
+    connectors,
+    pipelines,
+    datasets,
+    rules,
+    workflows,
+    groups,
+    roles,
+    membershipPolicies,
+    agents
+  ] = await Promise.all([
+    discoverActions(projectRoot),
+    discoverProjections(projectRoot),
+    discoverSchedules(projectRoot),
+    discoverSyncs(projectRoot),
+    discoverConnectors(projectRoot),
+    discoverPipelines(projectRoot),
+    discoverDatasets(projectRoot),
+    discoverRules(projectRoot),
+    discoverWorkflows(projectRoot),
+    discoverGroups(projectRoot),
+    discoverRoles(projectRoot),
+    discoverMembershipPolicies(projectRoot),
+    discoverAgents(projectRoot)
+  ]);
+  return new Sixb({
+    id: options.id,
+    ontology: allSources,
+    broker: options.broker,
+    storage: options.storage,
+    lakeStorage: options.lakeStorage,
+    blobStorage: options.blobStorage,
+    queues: options.queues,
+    sandboxes: options.sandboxes,
+    logger: options.logger,
+    observability: options.observability,
+    onError: options.onError,
+    ontologyMaintenance: options.ontologyMaintenance,
+    projectRoot,
+    actions: [...options.actions ?? [], ...actions],
+    datasets: [...options.datasets ?? [], ...datasets],
+    connectors: [...options.connectors ?? [], ...connectors],
+    schedules: [...options.schedules ?? [], ...schedules],
+    syncs: [...options.syncs ?? [], ...syncs],
+    pipelines: [...options.pipelines ?? [], ...pipelines],
+    projections: [...options.projections ?? [], ...projections],
+    rules: [...options.rules ?? [], ...rules],
+    workflows: [...options.workflows ?? [], ...workflows],
+    groups: [...options.groups ?? [], ...groups],
+    roles: [...options.roles ?? [], ...roles],
+    membershipPolicies: [...options.membershipPolicies ?? [], ...membershipPolicies],
+    agents: [...options.agents ?? [], ...agents],
+    auth: options.auth
+  });
+}
+export { WebhookValidationError, defineWebhook, webhookConnector, UnverifiedWebhookError, resolveWebhookVerification, warnUnverifiedWebhook, Sixb, createSixb };
+
+//# debugId=1140B1FB403AF17D64756E2164756E21