@sixb/core 0.1.0 → 0.1.2

package/src/runtime/types.ts

@@ -1,35 +1,20 @@
 /**
  * Core type definitions for the runtime layer.
  *
- * Hierarchy: Broker + Storage + Queues → Sixb → ObjectSet → ObjectByIdHandle
+ * Hierarchy: SixbHostContext → SixbRuntimeContext → ObjectSet → ObjectByIdHandle
  * Each level narrows generic parameters so downstream code stays type-safe.
  */
 
 import type {
-  ActionDefinition,
+  ActionDefinitionCatalog,
   ActionParamsConfig,
-  ActionRegistry,
-  ActionsRuntime,
   InferActionParams,
-  RequestActionAndWaitInput,
-  RequestActionInput,
   RequestActionResult,
 } from "../actions"
-import type { AgentsRuntime, RequestAgentRunInput, RequestAgentRunResult } from "../agents"
-import type { AuthRuntime } from "../auth"
 import type { AuthorizationContext } from "../authorization"
-import type { BlobStorage } from "../blob-storage"
 import type { Broker } from "../broker"
-import type { ConnectorAdapter, ConnectorClient, ConnectorDefinition } from "../connectors"
-import type { DatasetDefinition } from "../datasets"
 import type { DomainEventLog } from "../events"
-import type { LakeStorage } from "../lake-storage"
-import type { LogsRuntime } from "../logging"
-import type {
-  OntologyMaintenanceHandle,
-  OntologyOperationalStatus,
-  SixbReadiness,
-} from "../maintenance"
+import type { RuntimeAuthorization } from "../execution"
 import type {
   ObjectQuery,
   ObjectQueryExplanation,
@@ -52,55 +37,32 @@ import type {
 } from "../ontology/inference"
 import type { OntologyDocumentInput, OntologyRegistry, OntologySource } from "../ontology/registry"
 import type { LinkToken, ObjectTypeWithPropertyTokens, PropertyToken } from "../ontology/tokens"
-import type { PipelineRunRequestResult, RequestPipelineRunInput } from "../pipelines/request"
-import type { PipelineDefinition } from "../pipelines/types"
-import type {
-  LinkProjectionDefinition,
-  ObjectProjectionDefinition,
-  ProjectionDefinition,
-  TelemetryProjectionDefinition,
-} from "../projections/types"
 import type { Queues } from "../queues"
-import type { RuleDefinition } from "../rules"
-import type { SandboxFactory } from "../sandboxes"
-import type { ScheduleDefinition } from "../schedules"
-import type { SecurityRegistry } from "../security"
-import type { ActionRunRecord, ObjectLinkRow, ObjectRow, Storage } from "../storage"
-import type { RequestSyncRunInput, SyncDefinition, SyncRunRequestResult } from "../syncs"
-import type { RegisteredWebhook } from "../webhooks"
-import type {
-  RequestWorkflowRunInput,
-  WorkflowRunRequestResult,
-  WorkflowsRuntime,
-} from "../workflows"
-import type { ScopedSixb } from "./scoped"
-
+import type { ActionRunRecord, ObjectLinkRow, Storage } from "../storage"
 // ── Shared runtime context ──────────────────────────────────
 
 /**
- * Shared runtime context holding infrastructure + ontology registry.
- *
- * Built once by `Sixb` at construction time and threaded to `objects/`
- * service and leaf functions.
+ * Infrastructure and registries owned by the configured host.
  *
- * `Sixb` satisfies this structurally — callers can pass `sixb` directly
- * wherever a `SixbRuntimeContext` is expected.
+ * This context cannot call protected leaves: those require a {@link SixbRuntimeContext} carrying
+ * registered runtime authority.
  */
-export interface SixbRuntimeContext {
+export interface SixbHostContext {
   readonly projectId: string
+  readonly broker: Broker
   readonly ontology: OntologyRegistry
-  readonly actionRegistry: ActionRegistry
+  readonly actionRegistry: ActionDefinitionCatalog
   readonly events: DomainEventLog
   readonly storage: Storage
-  readonly lakeStorage: LakeStorage
-  readonly blobStorage: BlobStorage
   readonly queues: Queues
-  readonly sandboxes?: SandboxFactory
-  readonly rules?: readonly RuleDefinition[]
+}
+
+/** Host dependencies paired with the process-local authority of one bound execution. */
+export interface SixbRuntimeContext extends SixbHostContext {
+  readonly runtimeAuthorization: RuntimeAuthorization
   /**
-   * Principal scope for this context. Absent on privileged runtimes (raw
-   * `sixb`, syncs, workers, tests); present on contexts created by
-   * `sixb.as(context)`, where data operations enforce default-deny grants.
+   * Resolved principal grants. Absent for trusted primitive and explicitly disabled executions.
+   * The opaque `runtimeAuthorization` remains the source of authority.
    */
   readonly authorization?: AuthorizationContext
 }
@@ -1079,241 +1041,6 @@ export interface ObjectByIdHandle<
   ): TelemetryChannel<TToken, TValueTypes>
 }
 
-/**
- * Public API surface of a Sixb runtime instance.
- *
- * The class `Sixb<T>` implements this interface so the contract is
- * enforced at compile time and easy to scan in one place.
- */
-export interface SixbInstance<_ extends readonly OntologySource[]> {
-  readonly id: string
-  readonly ontology: OntologyRegistry
-  readonly broker: Broker
-  readonly events: DomainEventLog
-  readonly logs: LogsRuntime
-  readonly storage: Storage
-  readonly lakeStorage: LakeStorage
-  readonly blobStorage: BlobStorage
-  readonly queues: Queues
-  readonly sandboxes?: SandboxFactory
-  readonly rules?: readonly RuleDefinition[]
-  readonly security: SecurityRegistry
-  readonly auth: AuthRuntime
-  readonly actions: ActionsRuntime
-  readonly workflows: WorkflowsRuntime
-  readonly agents: AgentsRuntime
-
-  /** Create a principal-scoped runtime surface that enforces authorization grants. */
-  as(context: AuthorizationContext): ScopedSixb<_>
-
-  /** All registered object types. */
-  listObjectTypes(): readonly ObjectTypeWithPropertyTokens[]
-
-  /** Lookup an object type by id. */
-  getObjectTypeById(objectTypeId: string): ObjectTypeWithPropertyTokens | null
-
-  /** Resolve an object type by id, or throw if it is unknown. */
-  resolveObjectType(objectTypeId: string): ObjectTypeWithPropertyTokens
-
-  /** Value types registered in the runtime ontology, keyed by id. */
-  getValueTypesById(): ReadonlyMap<string, ValueType>
-
-  /** All registered action definitions. */
-  listActions(): readonly ActionDefinition[]
-
-  /** Lookup an action definition by id. */
-  getActionById(actionId: string): ActionDefinition | null
-
-  /** All registered global actions. */
-  listGlobalActions(): readonly ActionDefinition[]
-
-  /** All actions valid for an object type, including inherited actions. */
-  listActionsForType(objectType: ObjectType): readonly ActionDefinition[]
-
-  /** All registered dataset definitions. */
-  listDatasets(): readonly DatasetDefinition[]
-
-  /** Lookup a dataset definition by id. */
-  getDatasetById(datasetId: string): DatasetDefinition | null
-
-  /** All registered sync definitions. */
-  listSyncs(): readonly SyncDefinition[]
-
-  /** Lookup a sync definition by id. */
-  getSyncById(syncId: string): SyncDefinition | null
-
-  /** All registered pipeline definitions. */
-  listPipelines(): readonly PipelineDefinition[]
-
-  /** Lookup a pipeline definition by id. */
-  getPipelineById(pipelineId: string): PipelineDefinition | null
-
-  /**
-   * Request an action run by id. Queued, not run inline — see `requestActionAndWait`.
-   *
-   * Every start verb on this runtime is `request*` for that reason: `run*` implied inline execution
-   * that never happened.
-   */
-  requestAction(input: RequestActionInput): Promise<RequestActionResult>
-
-  /** Request an action run and wait for it to reach a terminal state. */
-  requestActionAndWait(input: RequestActionAndWaitInput): Promise<ActionRunRecord>
-
-  /** Queue a workflow run by id. */
-  requestWorkflowRun(input: RequestWorkflowRunInput): Promise<WorkflowRunRequestResult>
-
-  /** Queue a sync run by id. */
-  requestSyncRun(input: RequestSyncRunInput): Promise<SyncRunRequestResult>
-
-  /** Queue a pipeline run by id. */
-  requestPipelineRun(input: RequestPipelineRunInput): Promise<PipelineRunRequestResult>
-
-  /** Queue an agent turn by id. */
-  requestAgentRun(input: RequestAgentRunInput): Promise<RequestAgentRunResult>
-
-  /** All registered schedule definitions. */
-  listSchedules(): readonly ScheduleDefinition[]
-
-  /** Lookup a schedule definition by id. */
-  getScheduleById(scheduleId: string): ScheduleDefinition | null
-
-  /** All registered rule definitions. */
-  listRules(): readonly RuleDefinition[]
-
-  /** Lookup a rule definition by id. */
-  getRuleById(ruleId: string): RuleDefinition | null
-
-  /** All registered connector definitions. */
-  listConnectors(): readonly ConnectorDefinition[]
-
-  /** Lookup a connector definition by id. */
-  getConnectorById(connectorId: string): ConnectorDefinition | null
-
-  /** All webhook endpoints registered through connector adapters. */
-  listWebhooks(): readonly RegisteredWebhook[]
-
-  /** Lookup a registered connector webhook by connector id and webhook id. */
-  getWebhookById(connectorId: string, webhookId: string): RegisteredWebhook | null
-
-  /**
-   * Resolve a connector definition to its connected client.
-   *
-   * The first call connects lazily and caches the result for reuse within the runtime.
-   */
-  connector<TAdapter extends ConnectorAdapter>(
-    definition: ConnectorDefinition<string, TAdapter>
-  ): Promise<ConnectorClient<TAdapter>>
-
-  /** Start the scheduler runtime for all registered schedules. */
-  startScheduler(): Promise<void>
-
-  /** Stop the scheduler runtime. */
-  stopScheduler(): Promise<void>
-
-  /** Start durable outbox recovery and bounded ontology retention. */
-  startOntologyMaintenance(): Promise<OntologyMaintenanceHandle>
-
-  /** Latest cached asynchronous delivery and cleanup status. */
-  getOntologyOperationalStatus(): OntologyOperationalStatus
-
-  /** Verify required storage reachability and migration state. */
-  checkReadiness(): Promise<SixbReadiness>
-
-  /** Disconnect all currently connected connector clients. */
-  disconnectConnectors(): Promise<void>
-
-  /** Close the runtime broker provider if it owns external resources. */
-  closeBroker(): Promise<void>
-
-  /** Close the process logger provider, flushing buffered output. */
-  closeLogger(): Promise<void>
-
-  /**
-   * Type-safe ObjectSet for a registered object type.
-   *
-   * Not part of this interface because `ObjectSet` triggers deep type
-   * instantiation when the generic parameter is the widened base
-   * `ObjectTypeWithPropertyTokens`. Use `sixb.objects(MyConcreteType)`
-   * directly — TypeScript infers the narrow type from the literal.
-   *
-   * Signature: `objects<T>(objectType: T): ObjectSet<T, RegisteredValueTypes>`
-   */
-
-  /** Get the primary property id for a given object type. */
-  getPrimaryPropertyId(objectTypeId: string): string
-
-  /** Upsert an object by type id (for server / dynamic contexts). */
-  upsertObject(objectTypeId: string, properties: Record<string, unknown>): Promise<ObjectRow>
-
-  /** Append telemetry for multiple objects of a given type. */
-  appendTelemetry(
-    objectTypeId: string,
-    items: readonly { id: string; properties: Record<string, unknown>; at?: Date }[]
-  ): Promise<void>
-
-  /** Create or update a link from source to target. */
-  upsertLink(
-    objectTypeId: string,
-    sourceId: string,
-    linkId: string,
-    target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
-  ): Promise<void>
-
-  /** Remove a link from source to target. */
-  removeLink(
-    objectTypeId: string,
-    sourceId: string,
-    linkId: string,
-    target: { targetTypeId: string; targetId: string }
-  ): Promise<void>
-
-  /** Batch upsert objects of a single type. Returns per-item results. */
-  upsertObjectBatch(
-    objectTypeId: string,
-    items: readonly { properties: Record<string, unknown> }[]
-  ): Promise<readonly BatchItemResult<ObjectRow>[]>
-
-  /** Batch upsert links. Returns per-item results. */
-  upsertLinkBatch(
-    items: readonly {
-      objectTypeId: string
-      sourceId: string
-      linkId: string
-      target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
-    }[]
-  ): Promise<readonly BatchItemResult<void>[]>
-
-  /** Cross-type object listing for dashboards and search. */
-  list(params: {
-    objectTypeIds?: readonly string[]
-    idPrefix?: string
-    idSuffix?: string
-    updatedAfter?: Date
-    updatedBefore?: Date
-    createdAfter?: Date
-    createdBefore?: Date
-    limit?: number
-    offset?: number
-    orderBy?: "createdAt" | "updatedAt" | "primaryId"
-    order?: "asc" | "desc"
-  }): Promise<ListResult<ObjectRow>>
-
-  /** Collect all transitive sub-types of the given object type id. */
-  listSubTypes(objectTypeId: string): string[]
-
-  /** All registered object projection definitions. */
-  listObjectProjections(): readonly ObjectProjectionDefinition[]
-
-  /** All registered link projection definitions. */
-  listLinkProjections(): readonly LinkProjectionDefinition[]
-
-  /** All registered telemetry projection definitions. */
-  listTelemetryProjections(): readonly TelemetryProjectionDefinition[]
-
-  /** Lookup a registered projection by id. */
-  getProjectionById(projectionId: string): ProjectionDefinition | null
-}
-
 export interface ObjectSet<
   TObjectType extends ObjectTypeWithPropertyTokens,
   TValueTypes extends readonly ValueType[],

package/src/scheduler/index.ts

@@ -1,3 +1,3 @@
 export { SchedulerError, SchedulerValidationError } from "./errors"
-export type { SchedulerRuntimeOptions } from "./runtime"
+export type { SchedulerController, SchedulerRuntimeOptions } from "./runtime"
 export { SchedulerRuntime } from "./runtime"

package/src/scheduler/runtime.ts

@@ -1,18 +1,33 @@
 import type { DomainEventLog } from "../events"
-import type { CronScheduleDefinition, ScheduleDefinition } from "../schedules"
-import { nextCronOccurrence } from "../schedules"
+import { nextCronOccurrence } from "../schedules/next-occurrence"
+import type { CronScheduleDefinition, ScheduleDefinition } from "../schedules/types"
 import { SchedulerValidationError } from "./errors"
 
 /** Matches the `onError` flush budget: long enough for a healthy broker, short enough to shut down. */
 const DEFAULT_EMIT_DRAIN_TIMEOUT_MS = 5_000
 
+/**
+ * Largest delay `setTimeout` accepts before it overflows its 32-bit counter.
+ *
+ * Node coerces anything larger to `1`, so an unclamped monthly or yearly occurrence would fire
+ * immediately, find nothing due, and re-arm on the next tick -- spinning the event loop and
+ * emitting a `TimeoutOverflowWarning` for every re-arm until the occurrence came into range.
+ */
+const MAX_TIMER_DELAY_MS = 2_147_483_647
+
 export interface SchedulerRuntimeOptions {
   schedules: readonly ScheduleDefinition[]
   events: DomainEventLog
   now?: () => Date
 }
 
-export class SchedulerRuntime {
+/** Process lifecycle surface exposed by SixbHost. */
+export interface SchedulerController {
+  start(): Promise<void>
+  stop(): Promise<void>
+}
+
+export class SchedulerRuntime implements SchedulerController {
   private readonly schedules: readonly CronScheduleDefinition[]
   private readonly events: DomainEventLog
   private readonly now: () => Date
@@ -40,8 +55,19 @@ export class SchedulerRuntime {
 
     const now = this.now()
     for (const schedule of this.schedules) {
-      const next = nextCronOccurrence(schedule.trigger.expression, now, schedule.trigger.timezone)
-      this.nextOccurrences.set(schedule.id, next)
+      // Syntactically valid expressions can still have no reachable occurrence -- `0 0 30 2 *`
+      // parses but never matches. `tick()` already tolerates that per schedule; start-up must
+      // agree, or one unschedulable expression stops every other schedule in the project and
+      // crash-loops the scheduler role.
+      try {
+        const next = nextCronOccurrence(schedule.trigger.expression, now, schedule.trigger.timezone)
+        this.nextOccurrences.set(schedule.id, next)
+      } catch (error) {
+        console.error(
+          `[Sixb] Scheduler failed to compute next occurrence for '${schedule.id}':`,
+          error
+        )
+      }
     }
 
     this.armTimer()
@@ -101,7 +127,12 @@ export class SchedulerRuntime {
 
     if (earliest === null) return
 
-    const delayMs = Math.max(0, earliest.getTime() - this.now().getTime())
+    // Waking early is harmless: `tick()` re-arms from the same occurrence map, so a clamped delay
+    // just becomes several sleeps instead of one.
+    const delayMs = Math.min(
+      Math.max(0, earliest.getTime() - this.now().getTime()),
+      MAX_TIMER_DELAY_MS
+    )
     this.timer = setTimeout(() => this.tick(), delayMs)
   }
 

package/src/schedules/execution.ts

@@ -0,0 +1,14 @@
+import type { DefinitionCatalog } from "../runtime/definitions"
+import type { ScheduleDefinition } from "./types"
+
+/** Schedule definitions visible to an execution; process lifecycle remains on the host. */
+export type SchedulesRuntime = DefinitionCatalog<ScheduleDefinition>
+
+export function createSchedulesRuntime(
+  schedules: DefinitionCatalog<ScheduleDefinition>
+): SchedulesRuntime {
+  return {
+    list: () => schedules.list(),
+    getById: (scheduleId) => schedules.getById(scheduleId),
+  }
+}

package/src/schedules/types.ts

@@ -8,9 +8,7 @@ import type {
 import type { LinkToken, ObjectTypeWithTokens, Property, PropertyToken } from "../ontology"
 import type {
   FieldPredicate,
-  OrderedPredicateValueFor,
   Predicate,
-  PredicateValueFor,
   PropertyPredicate,
   PropertyPredicateBuilder,
 } from "../predicates"
@@ -183,12 +181,6 @@ export type EventScheduleConditionFor<
   readonly predicate: TPredicate
 }
 
-export type EventScheduleSerializableValue<TProperty extends Property> =
-  PredicateValueFor<TProperty>
-
-export type EventScheduleNumericValue<TProperty extends Property> =
-  OrderedPredicateValueFor<TProperty>
-
 type LinkPropertyTokens<TLink extends LinkToken> =
   NonNullable<TLink["link"]["properties"]> extends readonly Property[]
     ? {

package/src/security/every.ts

@@ -13,6 +13,7 @@
 
 import type { ActionDefinition } from "../actions/types"
 import type { AgentDefinition } from "../agents/types"
+import type { ConnectorDefinition } from "../connectors"
 import type { DatasetDefinition } from "../datasets"
 import type { ObjectType } from "../ontology"
 import type { PipelineDefinition } from "../pipelines"
@@ -31,6 +32,7 @@ export const BREADTH_TARGETS = [
   "pipeline",
   "agent",
   "application",
+  "connector",
 ] as const
 
 export type BreadthTarget = (typeof BREADTH_TARGETS)[number]
@@ -44,6 +46,7 @@ interface BreadthTargetInput {
   pipeline: PipelineDefinition
   agent: AgentDefinition
   application: ApplicationDefinition
+  connector: ConnectorDefinition
 }
 
 /**
@@ -105,4 +108,5 @@ export const every = {
   pipeline: (): BreadthSelector<"pipeline"> => all("pipeline"),
   agent: (): BreadthSelector<"agent"> => all("agent"),
   application: (): BreadthSelector<"application"> => all("application"),
+  connector: (): BreadthSelector<"connector"> => all("connector"),
 }

package/src/security/grants.ts

@@ -9,6 +9,7 @@
 
 import type { ActionDefinition } from "../actions/types"
 import type { AgentDefinition } from "../agents/types"
+import type { ConnectorDefinition } from "../connectors"
 import type { DatasetDefinition } from "../datasets"
 import type { ObjectType } from "../ontology"
 import type { PipelineDefinition } from "../pipelines"
@@ -27,6 +28,7 @@ import type {
   ApplicationDefinition,
   ApplyGrant,
   EditGrant,
+  ManageGrant,
   ObserveGrant,
   RunGrant,
   Selection,
@@ -42,7 +44,7 @@ const VIEW_TARGETS = ["object", "dataset"] as const
 const RUN_TARGETS = ["workflow", "sync", "pipeline", "agent"] as const
 
 /**
- * Six of the eight targets carry a `kind` discriminant naming themselves. The other two — an
+ * Seven of the nine targets carry a `kind` discriminant naming themselves. The other two — an
  * `ObjectType` and an `ActionDefinition` — carry none, and each appears in exactly one builder that
  * allows no other undiscriminated target, so the allowed set names them unambiguously.
  */
@@ -53,6 +55,7 @@ const TARGET_BY_DEFINITION_KIND: Readonly<Partial<Record<string, BreadthTarget>>
   agent: "agent",
   workflow: "workflow",
   application: "application",
+  connector: "connector",
 }
 
 const UNDISCRIMINATED_TARGETS: readonly BreadthTarget[] = ["object", "action"]
@@ -204,6 +207,14 @@ function observe(target: "logs"): ObserveGrant {
   }
 }
 
+function manage(input: GrantInput<ConnectorDefinition, "connector">): ManageGrant {
+  return {
+    kind: "grant",
+    capability: "manage",
+    selection: resolveGrant(input, "can.manage", ["connector"]).selection,
+  }
+}
+
 export const can = {
   access,
   view,
@@ -212,4 +223,5 @@ export const can = {
   apply,
   run,
   observe,
+  manage,
 }

package/src/security/index.ts

@@ -16,6 +16,8 @@ export {
   missingMembershipGroupIds,
   resolveMembershipPolicyScope,
 } from "./membership-policies"
+export type { SecurityDefinitionCatalog, SecurityRegistryOptions } from "./registry"
+export { SecurityRegistry } from "./registry"
 export type {
   AccessGrant,
   AppendGrant,
@@ -26,6 +28,7 @@ export type {
   GrantDefinition,
   GroupDefinition,
   GroupReference,
+  ManageGrant,
   MembershipOperation,
   MembershipPolicyDefinition,
   ObserveGrant,
@@ -34,7 +37,6 @@ export type {
   RoleDefinition,
   RunGrant,
   RunGrantTarget,
-  SecurityRegistry,
   Selection,
   ViewGrant,
   ViewGrantTarget,

package/src/security/registry.ts

@@ -0,0 +1,107 @@
+import { type ResolvedRole, resolveRoleGrants } from "../authorization"
+import { APPLICATION_IDS } from "./applications"
+import type { GroupDefinition, MembershipPolicyDefinition, RoleDefinition } from "./types"
+import { validateSecurityDefinitionsAtStartup } from "./validation"
+
+/** Read-only access to validated security definitions and resolved role grants. */
+export interface SecurityDefinitionCatalog {
+  listGroups(): readonly GroupDefinition[]
+  getGroupById(groupId: string): GroupDefinition | null
+  listRoles(): readonly RoleDefinition[]
+  getRoleById(roleId: string): RoleDefinition | null
+  listResolvedRoles(): readonly ResolvedRole[]
+  listMembershipPolicies(): readonly MembershipPolicyDefinition[]
+  getMembershipPolicyById(policyId: string): MembershipPolicyDefinition | null
+}
+
+export interface SecurityRegistryOptions {
+  readonly groups?: readonly GroupDefinition[]
+  readonly roles?: readonly RoleDefinition[]
+  readonly membershipPolicies?: readonly MembershipPolicyDefinition[]
+  readonly applicationIds?: ReadonlySet<string>
+  readonly objectTypeIds?: ReadonlySet<string>
+  readonly datasetIds?: ReadonlySet<string>
+  readonly actionIds?: ReadonlySet<string>
+  readonly workflowIds?: ReadonlySet<string>
+  readonly syncIds?: ReadonlySet<string>
+  readonly pipelineIds?: ReadonlySet<string>
+  readonly agentIds?: ReadonlySet<string>
+  readonly connectorIds?: ReadonlySet<string>
+  readonly getSubTypes?: (objectTypeId: string) => readonly string[]
+}
+
+export class SecurityRegistry implements SecurityDefinitionCatalog {
+  private readonly groupsById: ReadonlyMap<string, GroupDefinition>
+  private readonly rolesById: ReadonlyMap<string, RoleDefinition>
+  private readonly membershipPoliciesById: ReadonlyMap<string, MembershipPolicyDefinition>
+  private readonly resolvedRoles: readonly ResolvedRole[]
+
+  constructor(input: SecurityRegistryOptions) {
+    const definitions = validateSecurityDefinitionsAtStartup({
+      groups: input.groups ?? [],
+      roles: input.roles ?? [],
+      membershipPolicies: input.membershipPolicies ?? [],
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds,
+      datasetIds: input.datasetIds,
+      actionIds: input.actionIds,
+      workflowIds: input.workflowIds,
+      syncIds: input.syncIds,
+      pipelineIds: input.pipelineIds,
+      agentIds: input.agentIds,
+      connectorIds: input.connectorIds,
+      observableIds: new Set(["logs"]),
+    })
+
+    const universe = {
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds ?? new Set<string>(),
+      datasetIds: input.datasetIds ?? new Set<string>(),
+      actionIds: input.actionIds ?? new Set<string>(),
+      workflowIds: input.workflowIds ?? new Set<string>(),
+      syncIds: input.syncIds ?? new Set<string>(),
+      pipelineIds: input.pipelineIds ?? new Set<string>(),
+      agentIds: input.agentIds ?? new Set<string>(),
+      connectorIds: input.connectorIds ?? new Set<string>(),
+      observableIds: new Set(["logs"]),
+      getSubTypes: input.getSubTypes ?? (() => []),
+    }
+
+    this.groupsById = definitions.groupsById
+    this.rolesById = definitions.rolesById
+    this.membershipPoliciesById = definitions.membershipPoliciesById
+    this.resolvedRoles = definitions.roles.map((role) => ({
+      id: role.id,
+      grantedToGroupIds: role.grantedToGroupIds,
+      grants: resolveRoleGrants(role, universe),
+    }))
+  }
+
+  listGroups(): readonly GroupDefinition[] {
+    return [...this.groupsById.values()]
+  }
+
+  getGroupById(groupId: string): GroupDefinition | null {
+    return this.groupsById.get(groupId) ?? null
+  }
+
+  listRoles(): readonly RoleDefinition[] {
+    return [...this.rolesById.values()]
+  }
+
+  getRoleById(roleId: string): RoleDefinition | null {
+    return this.rolesById.get(roleId) ?? null
+  }
+
+  listResolvedRoles(): readonly ResolvedRole[] {
+    return this.resolvedRoles
+  }
+
+  listMembershipPolicies(): readonly MembershipPolicyDefinition[] {
+    return [...this.membershipPoliciesById.values()]
+  }
+
+  getMembershipPolicyById(policyId: string): MembershipPolicyDefinition | null {
+    return this.membershipPoliciesById.get(policyId) ?? null
+  }
+}