@sixb/core 0.1.1 → 0.1.3

package/src/queues/in-memory.ts

@@ -1,18 +1,25 @@
 import { randomUUID } from "node:crypto"
+import type { SixbErrorCode } from "../errors/types"
 import { QueueError } from "./errors"
 import type {
+  ActionQueueJobFailureCode,
   ActionRunRequestedQueueJob,
   AgentQueueJob,
+  AgentQueueJobFailureCode,
   ClaimedQueueJob,
   NewQueueJob,
+  PipelineQueueJobFailureCode,
   PipelineRunRequestedQueueJob,
+  ProjectionQueueJobFailureCode,
   ProjectionRunRequestedQueueJob,
   Queue,
   QueueJob,
-  QueueJobError,
+  QueueJobFailure,
   Queues,
+  SyncQueueJobFailureCode,
   SyncRunRequestedQueueJob,
   WorkflowQueueJob,
+  WorkflowQueueJobFailureCode,
 } from "./types"
 
 type QueueRecordState = "queued" | "completed" | "failed"
@@ -23,6 +30,7 @@ interface QueueRecord<TQueueJob extends QueueJob = QueueJob> {
   job: TQueueJob
   // A leased job stays "queued" until a worker completes or fails it.
   state: QueueRecordState
+  failure: QueueJobFailure | null
   leaseId: string | null
   claimedAt: string | null
   leaseExpiresAt: string | null
@@ -131,6 +139,7 @@ class InMemoryQueueStore {
       queueId,
       job,
       state: "queued",
+      failure: null,
       leaseId: null,
       claimedAt: null,
       leaseExpiresAt: null,
@@ -165,7 +174,9 @@ class InMemoryQueueStore {
   }
 }
 
-class InMemoryQueue<TQueueJob extends QueueJob> implements Queue<TQueueJob> {
+class InMemoryQueue<TQueueJob extends QueueJob, TFailureCode extends SixbErrorCode>
+  implements Queue<TQueueJob, TFailureCode>
+{
   constructor(
     private readonly store: InMemoryQueueStore,
     private readonly queueId: string
@@ -260,7 +271,6 @@ class InMemoryQueue<TQueueJob extends QueueJob> implements Queue<TQueueJob> {
     jobId: string
     leaseId: string
     availableAt?: string
-    error?: QueueJobError
   }): Promise<void> {
     const record = this.requireActiveLease(params)
     const availableAt = params.availableAt ?? new Date().toISOString()
@@ -277,10 +287,11 @@ class InMemoryQueue<TQueueJob extends QueueJob> implements Queue<TQueueJob> {
     projectId: string
     jobId: string
     leaseId: string
-    error: QueueJobError
+    failure: QueueJobFailure<TFailureCode>
   }): Promise<void> {
     const record = this.requireActiveLease(params)
     record.state = "failed"
+    record.failure = structuredClone(params.failure)
     clearLease(record)
   }
 
@@ -347,15 +358,30 @@ export class InMemoryQueues implements Queues {
   readonly scope = "process" as const
   private readonly store = new InMemoryQueueStore()
 
-  readonly syncRuns = new InMemoryQueue<SyncRunRequestedQueueJob>(this.store, "sync.runs")
-  readonly pipelines = new InMemoryQueue<PipelineRunRequestedQueueJob>(this.store, "pipeline.runs")
-  readonly projections = new InMemoryQueue<ProjectionRunRequestedQueueJob>(
+  readonly syncRuns = new InMemoryQueue<SyncRunRequestedQueueJob, SyncQueueJobFailureCode>(
     this.store,
-    "projection.runs"
+    "sync.runs"
+  )
+  readonly pipelines = new InMemoryQueue<PipelineRunRequestedQueueJob, PipelineQueueJobFailureCode>(
+    this.store,
+    "pipeline.runs"
+  )
+  readonly projections = new InMemoryQueue<
+    ProjectionRunRequestedQueueJob,
+    ProjectionQueueJobFailureCode
+  >(this.store, "projection.runs")
+  readonly workflows = new InMemoryQueue<WorkflowQueueJob, WorkflowQueueJobFailureCode>(
+    this.store,
+    "workflow.runs"
+  )
+  readonly actions = new InMemoryQueue<ActionRunRequestedQueueJob, ActionQueueJobFailureCode>(
+    this.store,
+    "action.runs"
+  )
+  readonly agents = new InMemoryQueue<AgentQueueJob, AgentQueueJobFailureCode>(
+    this.store,
+    "agent.runs"
   )
-  readonly workflows = new InMemoryQueue<WorkflowQueueJob>(this.store, "workflow.runs")
-  readonly actions = new InMemoryQueue<ActionRunRequestedQueueJob>(this.store, "action.runs")
-  readonly agents = new InMemoryQueue<AgentQueueJob>(this.store, "agent.runs")
 
   /** Nothing to reach: the store is a field of this object. */
   health(): Promise<void> {

package/src/queues/index.ts

@@ -2,22 +2,30 @@ export type { ProviderScope } from "../provider-scope"
 export { QueueError } from "./errors"
 export { InMemoryQueues } from "./in-memory"
 export type {
+  ActionQueueJobFailureCode,
   ActionRunRequestedQueueJob,
+  AgentAiUsageAccountingPayload,
+  AgentAiUsageRecordPayload,
+  AgentAiUsageRecordRequestedQueueJob,
   AgentQueueJob,
+  AgentQueueJobFailureCode,
   AgentRunRequestedQueueJob,
   AgentWorkflowNodeRequestedQueueJob,
   ClaimedQueueJob,
   NewQueueJob,
+  PipelineQueueJobFailureCode,
   PipelineRunRequestedQueueJob,
+  ProjectionQueueJobFailureCode,
   ProjectionRunRequestedQueueJob,
   Queue,
   QueueJob,
   QueueJobEnvelope,
-  QueueJobError,
+  QueueJobFailure,
   Queues,
+  SyncQueueJobFailureCode,
   SyncRunRequestedQueueJob,
   WorkflowQueueJob,
+  WorkflowQueueJobFailureCode,
   WorkflowRunRequestedQueueJob,
-  WorkflowRunResumeCause,
   WorkflowRunResumeRequestedQueueJob,
 } from "./types"

package/src/queues/types.ts

@@ -1,7 +1,14 @@
+import type { SixbErrorCode, SixbFailure } from "../errors/types"
 import type { JsonValue } from "../json"
-import type { ProjectionMaterializationIdentity } from "../materialization/model"
+import type { ProjectionRunFailureCode } from "../projections/types"
 import type { ProviderScope } from "../provider-scope"
-import type { WorkflowRunSource } from "../workflows/types"
+import type { ActionRunFailureCode } from "../storage/action-runs/types"
+import type { AgentRunFailureCode } from "../storage/agents/types"
+import type { AiPricingContext } from "../storage/ai-cost/types"
+import type { RecordAiModelCallInput } from "../storage/ai-usage"
+import type { PipelineRunFailureCode } from "../storage/pipeline-runs/types"
+import type { SyncRunFailureCode } from "../storage/sync-runs/types"
+import type { WorkflowRunFailureCode } from "../storage/workflow-runs/types"
 
 export interface QueueJobEnvelope {
   readonly id: string
@@ -31,10 +38,16 @@ export type NewQueueJob<TQueueJob extends QueueJob> =
       }
     : never
 
-export interface QueueJobError {
-  readonly name?: string
-  readonly message: string
-}
+/** Portable terminal failure handed to a queue provider when a claimed job is abandoned. */
+export type QueueJobFailure<TCode extends SixbErrorCode = SixbErrorCode> = SixbFailure<TCode>
+
+/** Lane-specific aliases keep each primitive free to evolve its failure vocabulary independently. */
+export type SyncQueueJobFailureCode = SyncRunFailureCode
+export type PipelineQueueJobFailureCode = PipelineRunFailureCode
+export type ProjectionQueueJobFailureCode = ProjectionRunFailureCode
+export type WorkflowQueueJobFailureCode = WorkflowRunFailureCode
+export type ActionQueueJobFailureCode = ActionRunFailureCode
+export type AgentQueueJobFailureCode = AgentRunFailureCode
 
 export interface ClaimedQueueJob<TQueueJob extends QueueJob = QueueJob> {
   /** Opaque acknowledgement token for this specific claim attempt. */
@@ -45,7 +58,10 @@ export interface ClaimedQueueJob<TQueueJob extends QueueJob = QueueJob> {
   readonly job: TQueueJob
 }
 
-export interface Queue<TQueueJob extends QueueJob> {
+export interface Queue<
+  TQueueJob extends QueueJob,
+  TFailureCode extends SixbErrorCode = SixbErrorCode,
+> {
   /**
    * Adds durable work to the lane. Jobs become claimable at `availableAt`, or immediately.
    * Repeating a caller-supplied job id is idempotent while that job remains in the provider.
@@ -85,15 +101,20 @@ export interface Queue<TQueueJob extends QueueJob> {
     jobId: string
     leaseId: string
     availableAt?: string
-    error?: QueueJobError
   }): Promise<void>
 
-  /** Marks the claimed job as terminally failed so it will not be delivered again. */
+  /**
+   * Marks the claimed job as terminally failed so it will not be delivered again.
+   *
+   * The failure explains this terminal settlement; `retryable` may still be true when a worker's
+   * policy exhausted its attempts. Queue providers may project the record into their native failed
+   * job diagnostics. A queryable dead-letter history is deliberately a separate contract.
+   */
   fail(params: {
     projectId: string
     jobId: string
     leaseId: string
-    error: QueueJobError
+    failure: QueueJobFailure<TFailureCode>
   }): Promise<void>
 
   /** Extends an active lease. Returns `null` if the lease was already lost, expired, or completed. */
@@ -109,10 +130,7 @@ export interface SyncRunRequestedQueueJob
   extends QueueJob<
     "sync.run.requested",
     {
-      readonly syncId: string
-      readonly runId?: string
-      readonly expectedLatestVersionId?: string
-      readonly commitMessage?: string
+      readonly runId: string
     }
   > {}
 
@@ -120,42 +138,33 @@ export interface PipelineRunRequestedQueueJob
   extends QueueJob<
     "pipeline.run.requested",
     {
-      readonly pipelineId: string
-      readonly runId?: string
+      readonly runId: string
     }
   > {}
 
 export interface ProjectionRunRequestedQueueJob
-  extends QueueJob<"projection.run.requested", ProjectionMaterializationIdentity> {}
+  extends QueueJob<
+    "projection.run.requested",
+    {
+      readonly runId: string
+    }
+  > {}
 
 export interface WorkflowRunRequestedQueueJob
   extends QueueJob<
     "workflow.run.requested",
     {
-      readonly workflowId: string
-      readonly runId?: string
-      readonly input?: Readonly<Record<string, unknown>>
-      readonly source?: WorkflowRunSource
+      readonly runId: string
     }
   > {}
 
-export type WorkflowRunResumeCause =
-  | {
-      readonly kind: "intervention"
-      readonly interventionId: string
-    }
-  | {
-      readonly kind: "agentNode"
-      readonly nodeRunId: string
-    }
-
+/** Wake a durable wait edge; the worker resolves its type and current state from storage. */
 export interface WorkflowRunResumeRequestedQueueJob
   extends QueueJob<
     "workflow.run.resume.requested",
     {
-      readonly workflowId: string
       readonly runId: string
-      readonly resume: WorkflowRunResumeCause
+      readonly nodeRunId: string
     }
   > {}
 
@@ -165,7 +174,6 @@ export interface ActionRunRequestedQueueJob
   extends QueueJob<
     "action.run.requested",
     {
-      readonly actionId: string
       readonly runId: string
     }
   > {}
@@ -179,10 +187,7 @@ export interface AgentRunRequestedQueueJob
   extends QueueJob<
     "agent.run.requested",
     {
-      readonly agentId: string
-      readonly threadId: string
       readonly runId: string
-      readonly triggerMessageId: string
     }
   > {}
 
@@ -190,20 +195,48 @@ export interface AgentWorkflowNodeRequestedQueueJob
   extends QueueJob<
     "agent.workflow-node.requested",
     {
-      readonly agentId: string
       readonly nodeRunId: string
     }
   > {}
 
-export type AgentQueueJob = AgentRunRequestedQueueJob | AgentWorkflowNodeRequestedQueueJob
+/** JSON-safe representation of one model-call ledger append awaiting durable recovery. */
+export type AgentAiUsageRecordPayload = Omit<
+  RecordAiModelCallInput,
+  "projectId" | "usage" | "occurredAt" | "recordedAt"
+> & {
+  readonly usage: {
+    readonly [Field in keyof RecordAiModelCallInput["usage"]]: RecordAiModelCallInput["usage"][Field]
+  }
+  readonly occurredAt: string
+}
+
+export interface AgentAiUsageAccountingPayload {
+  readonly pricingContext: AiPricingContext
+  readonly ratedAt: string
+}
+
+export interface AgentAiUsageRecordRequestedQueueJob
+  extends QueueJob<
+    "agent.ai-usage.record.requested",
+    {
+      readonly record: AgentAiUsageRecordPayload
+      /** Absent on Phase 1 jobs; recovery then uses an empty pricing context. */
+      readonly accounting?: AgentAiUsageAccountingPayload
+    }
+  > {}
+
+export type AgentQueueJob =
+  | AgentRunRequestedQueueJob
+  | AgentWorkflowNodeRequestedQueueJob
+  | AgentAiUsageRecordRequestedQueueJob
 
 export interface Queues {
-  readonly syncRuns: Queue<SyncRunRequestedQueueJob>
-  readonly pipelines: Queue<PipelineRunRequestedQueueJob>
-  readonly projections: Queue<ProjectionRunRequestedQueueJob>
-  readonly workflows: Queue<WorkflowQueueJob>
-  readonly actions: Queue<ActionRunRequestedQueueJob>
-  readonly agents: Queue<AgentQueueJob>
+  readonly syncRuns: Queue<SyncRunRequestedQueueJob, SyncQueueJobFailureCode>
+  readonly pipelines: Queue<PipelineRunRequestedQueueJob, PipelineQueueJobFailureCode>
+  readonly projections: Queue<ProjectionRunRequestedQueueJob, ProjectionQueueJobFailureCode>
+  readonly workflows: Queue<WorkflowQueueJob, WorkflowQueueJobFailureCode>
+  readonly actions: Queue<ActionRunRequestedQueueJob, ActionQueueJobFailureCode>
+  readonly agents: Queue<AgentQueueJob, AgentQueueJobFailureCode>
 
   /**
    * Whether these queues can be shared across processes.

package/src/rules/execution.ts

@@ -0,0 +1,49 @@
+import { isAllowed } from "../authorization"
+import type { DefinitionCatalog } from "../runtime/definitions"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type { ListActiveRuleStatesInput, ListActiveRuleStatesResult } from "../storage/rules"
+import type { RuleDefinition } from "./types"
+
+export interface RuleStatesRuntime {
+  list(
+    input?: Omit<ListActiveRuleStatesInput, "projectId" | "objectTypeIds">
+  ): Promise<ListActiveRuleStatesResult>
+}
+
+export interface RulesRuntime {
+  list(): readonly RuleDefinition[]
+  getById(ruleId: string): RuleDefinition | null
+  readonly states: RuleStatesRuntime
+}
+
+export function createRulesRuntime(
+  runtime: SixbRuntimeContext,
+  source: DefinitionCatalog<RuleDefinition>
+): RulesRuntime {
+  const visible = (rule: RuleDefinition) =>
+    isAllowed(runtime.authorization, {
+      kind: "object.view",
+      objectTypeId: rule.subject.objectTypeId,
+    })
+
+  return {
+    list: () => source.list().filter(visible),
+    getById: (ruleId) => {
+      const rule = source.getById(ruleId)
+      return rule && visible(rule) ? rule : null
+    },
+    states: {
+      list: (input = {}) => {
+        const storage = runtime.storage.rules
+        if (!storage) return Promise.resolve({ states: [], hasMore: false, total: 0 })
+        return storage.listActive({
+          projectId: runtime.projectId,
+          ...input,
+          objectTypeIds: runtime.authorization
+            ? [...runtime.authorization.grants["view:object"]]
+            : undefined,
+        })
+      },
+    },
+  }
+}

package/src/rules/index.ts

@@ -25,6 +25,5 @@ export {
   assertRuleDefinition,
   assertRulePredicateShape,
   isRuleDefinition,
-  isRuleValue,
   validateRulesAtStartup,
 } from "./validation"

package/src/rules/validation.ts

@@ -1,8 +1,8 @@
 import type { OntologyRegistry } from "../ontology/registry"
 import type { ObjectType } from "../ontology/types"
-import { assertPredicateShape, isPredicateValue } from "../predicates"
+import { assertPredicateShape } from "../predicates"
 import { RuleValidationError } from "./errors"
-import type { RuleDefinition, RulePredicate, RuleValue } from "./types"
+import type { RuleDefinition, RulePredicate } from "./types"
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
@@ -18,10 +18,6 @@ function assertNonEmptyString(
   }
 }
 
-export function isRuleValue(value: unknown): value is RuleValue {
-  return isPredicateValue(value)
-}
-
 /**
  * Validate only the portable AST shape.
  *

package/src/runtime/ai-cost.ts

@@ -0,0 +1,15 @@
+import type { AiCostStorage, AiCostSummary } from "../storage/ai-cost"
+
+/** Resolve preferred cost summaries in input order without inventing unavailable accounting. */
+export async function resolveExecutionCosts(input: {
+  readonly storage: AiCostStorage | undefined
+  readonly projectId: string
+  readonly executionIds: readonly string[]
+}): Promise<readonly (AiCostSummary | undefined)[]> {
+  if (input.executionIds.length === 0) return []
+  if (!input.storage) return input.executionIds.map(() => undefined)
+  return input.storage.summarizeExecutions({
+    projectId: input.projectId,
+    executionIds: input.executionIds,
+  })
+}

package/src/runtime/ai-usage.ts

@@ -0,0 +1,17 @@
+import type { AiModelCallUsage, AiUsageStorage } from "../storage/ai-usage"
+
+/** Resolve execution usage for runtime views without exposing the accounting provider. */
+export async function resolveExecutionUsage(input: {
+  readonly storage: AiUsageStorage | undefined
+  readonly projectId: string
+  readonly executionIds: readonly string[]
+}): Promise<readonly (AiModelCallUsage | undefined)[]> {
+  if (input.executionIds.length === 0) return []
+  if (!input.storage) return input.executionIds.map(() => undefined)
+
+  const summaries = await input.storage.summarizeExecutions({
+    projectId: input.projectId,
+    executionIds: input.executionIds,
+  })
+  return summaries.map((summary) => (summary.modelCallCount === 0 ? undefined : summary.usage))
+}

package/src/runtime/create.ts

@@ -3,24 +3,9 @@ import type { ActionDefinition } from "../actions"
 import type { AgentDefinition } from "../agents"
 import type { SixbAuthConfig } from "../auth"
 import type { BlobStorage } from "../blob-storage"
-import {
-  discoverActions,
-  discoverAgents,
-  discoverConnectors,
-  discoverDatasets,
-  discoverGroups,
-  discoverMembershipPolicies,
-  discoverOntologySources,
-  discoverPipelines,
-  discoverProjections,
-  discoverRoles,
-  discoverRules,
-  discoverSchedules,
-  discoverSyncs,
-  discoverWorkflows,
-} from "../bootstrap"
+import { discoverOntologySources, discoverProjectDefinitions } from "../bootstrap"
 import type { Broker } from "../broker"
-import type { ConnectorDefinition } from "../connectors/types"
+import type { ConnectorConnectionOptions, ConnectorDefinition } from "../connectors/types"
 import type { DatasetDefinition } from "../datasets"
 import type { SixbErrorHandler } from "../error-reporting/types"
 import type { LakeStorage } from "../lake-storage"
@@ -37,7 +22,7 @@ import type { Storage } from "../storage"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows"
 import { RuntimeError } from "./errors"
-import { Sixb } from "./sixb"
+import { SixbHost } from "./host"
 import type { OntologySource } from "./types"
 
 export interface CreateSixbOptions {
@@ -63,6 +48,8 @@ export interface CreateSixbOptions {
   datasets?: readonly DatasetDefinition[]
   /** Connector definitions to register in addition to auto-discovered `connectors/` exports. */
   connectors?: readonly ConnectorDefinition[]
+  /** Required to protect OAuth credentials when connector connection storage is durable. */
+  connectorConnections?: ConnectorConnectionOptions
   schedules?: readonly ScheduleDefinition[]
   syncs?: readonly SyncDefinition[]
   pipelines?: readonly PipelineDefinition[]
@@ -77,20 +64,20 @@ export interface CreateSixbOptions {
 }
 
 /**
- * Create a Sixb runtime using convention-based discovery.
+ * Create a SixbHost using convention-based discovery.
  *
- * Sixb auto-discovers exported definitions from `ontology/`, `actions/`, `datasets/`,
+ * The host auto-discovers exported definitions from `ontology/`, `actions/`, `datasets/`,
  * `connectors/`, `syncs/`, `schedules/`, `pipelines/`, `projections/`,
  * `rules/`, `workflows/`, `agents/`, and `security/{groups,roles,policies}/`
  * relative to `projectRoot`.
  */
 export async function createSixb(
   options: CreateSixbOptions
-): Promise<Sixb<readonly OntologySource[]>> {
+): Promise<SixbHost<readonly OntologySource[]>> {
   const projectRoot = resolve(options.projectRoot ?? process.cwd())
 
-  const discovered = await discoverOntologySources(projectRoot)
-  const allSources = [...(options.ontologies ?? []), ...discovered]
+  const discoveredOntology = await discoverOntologySources(projectRoot)
+  const allSources = [...(options.ontologies ?? []), ...discoveredOntology]
 
   if (allSources.length === 0) {
     throw new RuntimeError(
@@ -98,40 +85,12 @@ export async function createSixb(
     )
   }
 
-  const [
-    actions,
-    projections,
-    schedules,
-    syncs,
-    connectors,
-    pipelines,
-    datasets,
-    rules,
-    workflows,
-    groups,
-    roles,
-    membershipPolicies,
-    agents,
-  ] = await Promise.all([
-    discoverActions(projectRoot),
-    discoverProjections(projectRoot),
-    discoverSchedules(projectRoot),
-    discoverSyncs(projectRoot),
-    discoverConnectors(projectRoot),
-    discoverPipelines(projectRoot),
-    discoverDatasets(projectRoot),
-    discoverRules(projectRoot),
-    discoverWorkflows(projectRoot),
-    discoverGroups(projectRoot),
-    discoverRoles(projectRoot),
-    discoverMembershipPolicies(projectRoot),
-    discoverAgents(projectRoot),
-  ])
+  const definitions = await discoverProjectDefinitions(projectRoot)
 
   // Explicit definitions come first so local setup can override ordering while duplicate ids are
-  // still rejected by the Sixb constructor. Every family merges — `actions` and `projections` used to
-  // *replace* discovery instead, silently and undocumented.
-  return new Sixb<readonly OntologySource[]>({
+  // still rejected by the SixbHost constructor. Every family merges — `actions` and `projections`
+  // used to *replace* discovery instead, silently and undocumented.
+  return new SixbHost<readonly OntologySource[]>({
     id: options.id,
     ontology: allSources,
     broker: options.broker,
@@ -145,19 +104,20 @@ export async function createSixb(
     onError: options.onError,
     ontologyMaintenance: options.ontologyMaintenance,
     projectRoot,
-    actions: [...(options.actions ?? []), ...actions],
-    datasets: [...(options.datasets ?? []), ...datasets],
-    connectors: [...(options.connectors ?? []), ...connectors],
-    schedules: [...(options.schedules ?? []), ...schedules],
-    syncs: [...(options.syncs ?? []), ...syncs],
-    pipelines: [...(options.pipelines ?? []), ...pipelines],
-    projections: [...(options.projections ?? []), ...projections],
-    rules: [...(options.rules ?? []), ...rules],
-    workflows: [...(options.workflows ?? []), ...workflows],
-    groups: [...(options.groups ?? []), ...groups],
-    roles: [...(options.roles ?? []), ...roles],
-    membershipPolicies: [...(options.membershipPolicies ?? []), ...membershipPolicies],
-    agents: [...(options.agents ?? []), ...agents],
+    actions: [...(options.actions ?? []), ...definitions.actions],
+    datasets: [...(options.datasets ?? []), ...definitions.datasets],
+    connectors: [...(options.connectors ?? []), ...definitions.connectors],
+    connectorConnections: options.connectorConnections,
+    schedules: [...(options.schedules ?? []), ...definitions.schedules],
+    syncs: [...(options.syncs ?? []), ...definitions.syncs],
+    pipelines: [...(options.pipelines ?? []), ...definitions.pipelines],
+    projections: [...(options.projections ?? []), ...definitions.projections],
+    rules: [...(options.rules ?? []), ...definitions.rules],
+    workflows: [...(options.workflows ?? []), ...definitions.workflows],
+    groups: [...(options.groups ?? []), ...definitions.groups],
+    roles: [...(options.roles ?? []), ...definitions.roles],
+    membershipPolicies: [...(options.membershipPolicies ?? []), ...definitions.membershipPolicies],
+    agents: [...(options.agents ?? []), ...definitions.agents],
     auth: options.auth,
   })
 }

package/src/runtime/definitions.ts

@@ -0,0 +1,44 @@
+import type { ActionDefinitionCatalog } from "../actions"
+import type { AgentDefinition } from "../agents"
+import type { ConnectorDefinition } from "../connectors"
+import type { DatasetDefinition } from "../datasets"
+import type { OntologyDefinitionCatalog } from "../ontology"
+import type { PipelineDefinition } from "../pipelines"
+import type { ProjectionDefinitionCatalog } from "../projections"
+import type { RuleDefinition } from "../rules"
+import type { ScheduleDefinition } from "../schedules"
+import type { SecurityDefinitionCatalog } from "../security"
+import type { SyncDefinition } from "../syncs"
+import type { WorkflowDefinition } from "../workflows"
+
+/** Immutable, host-owned catalog of validated project definitions. */
+export interface DefinitionCatalog<TDefinition> {
+  list(): readonly TDefinition[]
+  getById(id: string): TDefinition | null
+}
+
+/** Definitions resolved and cross-validated while composing a {@link SixbHost}. */
+export interface SixbDefinitions {
+  readonly ontology: OntologyDefinitionCatalog
+  readonly actions: ActionDefinitionCatalog
+  readonly agents: DefinitionCatalog<AgentDefinition>
+  readonly connectors: DefinitionCatalog<ConnectorDefinition>
+  readonly datasets: DefinitionCatalog<DatasetDefinition>
+  readonly pipelines: DefinitionCatalog<PipelineDefinition>
+  readonly projections: ProjectionDefinitionCatalog
+  readonly rules: DefinitionCatalog<RuleDefinition>
+  readonly schedules: DefinitionCatalog<ScheduleDefinition>
+  readonly security: SecurityDefinitionCatalog
+  readonly syncs: DefinitionCatalog<SyncDefinition>
+  readonly workflows: DefinitionCatalog<WorkflowDefinition>
+}
+
+/** Build a read-only catalog over an already validated definition index. */
+export function createDefinitionCatalog<TDefinition>(
+  definitionsById: ReadonlyMap<string, TDefinition>
+): DefinitionCatalog<TDefinition> {
+  return Object.freeze({
+    list: () => [...definitionsById.values()],
+    getById: (id: string) => definitionsById.get(id) ?? null,
+  })
+}