@sixb/core 0.1.11 → 0.1.13

package/src/ontology/validation/schema.ts

@@ -1,46 +1,62 @@
 import { isFileRef } from "../../blob-storage/validation"
+import { withFailureMessage } from "../../errors/failure-message"
 import type { ObjectFieldSchema, Schema, ValueType, ValueTypeRefSchema } from ".."
 import { isDecimalString } from "../decimal"
 import { OntologyValidationError } from "../errors"
+import { isUserRef } from "../user-ref"
 
 /** Recursive schema validator used by both object and link property validation. */
 export function validateSchemaValue(
   schema: Schema,
   value: unknown,
   path: string,
-  valueTypesById: ReadonlyMap<string, ValueType>
+  valueTypesById: ReadonlyMap<string, ValueType>,
+  diagnosticPath = path
 ): void {
   if (typeof schema === "string") {
     switch (schema) {
       case "string":
       case "uuid": {
         if (typeof value !== "string") {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be a string`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be a string`),
+            `Property ${diagnosticPath} must be a string.`
+          )
         }
         return
       }
       case "boolean": {
         if (typeof value !== "boolean") {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be a boolean`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be a boolean`),
+            `Property ${diagnosticPath} must be a boolean.`
+          )
         }
         return
       }
       case "integer": {
         if (typeof value !== "number" || !Number.isInteger(value)) {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be an integer`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be an integer`),
+            `Property ${diagnosticPath} must be an integer.`
+          )
         }
         return
       }
       case "double": {
         if (typeof value !== "number" || !Number.isFinite(value)) {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be numeric`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be numeric`),
+            `Property ${diagnosticPath} must be numeric.`
+          )
         }
         return
       }
       case "decimal": {
         if (!isDecimalString(value)) {
-          throw new OntologyValidationError(
-            `[Sixb] Property ${path} must be an exact decimal string`
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be an exact decimal string`),
+            `Property ${diagnosticPath} must be an exact decimal string.`
           )
         }
         return
@@ -48,23 +64,47 @@ export function validateSchemaValue(
       case "date":
       case "timestamp": {
         if (!(value instanceof Date) && typeof value !== "string") {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be a Date or ISO string`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be a Date or ISO string`),
+            `Property ${diagnosticPath} must be a Date or ISO string.`
+          )
         }
         return
       }
       case "fileRef": {
         if (!isFileRef(value)) {
-          throw new OntologyValidationError(`[Sixb] Property ${path} must be a fileRef`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Property ${path} must be a fileRef`),
+            `Property ${diagnosticPath} must be a fileRef.`
+          )
+        }
+        return
+      }
+      case "userRef": {
+        if (!isUserRef(value)) {
+          throw withFailureMessage(
+            new OntologyValidationError(
+              `[Sixb] Property ${path} must be a user reference { type: "user", id }`
+            ),
+            `Property ${diagnosticPath} must be a user reference.`
+          )
         }
         return
       }
+      default:
+        // Every primitive validates its values above. Untyped definitions can still carry an
+        // unknown string; it keeps falling through without a check.
+        schema satisfies never
     }
   }
 
   if (schema.type === "enum") {
     if (!schema.values.includes(value as never)) {
-      throw new OntologyValidationError(
-        `[Sixb] Property ${path} must be one of: ${schema.values.join(", ")}`
+      throw withFailureMessage(
+        new OntologyValidationError(
+          `[Sixb] Property ${path} must be one of: ${schema.values.join(", ")}`
+        ),
+        `Property ${diagnosticPath} must match a declared enum value.`
       )
     }
     return
@@ -72,34 +112,58 @@ export function validateSchemaValue(
 
   if (schema.type === "array") {
     if (!Array.isArray(value)) {
-      throw new OntologyValidationError(`[Sixb] Property ${path} must be an array`)
+      throw withFailureMessage(
+        new OntologyValidationError(`[Sixb] Property ${path} must be an array`),
+        `Property ${diagnosticPath} must be an array.`
+      )
     }
     for (let index = 0; index < value.length; index += 1) {
-      validateSchemaValue(schema.items, value[index], `${path}[${index}]`, valueTypesById)
+      validateSchemaValue(
+        schema.items,
+        value[index],
+        `${path}[${index}]`,
+        valueTypesById,
+        `${diagnosticPath}[${index}]`
+      )
     }
     return
   }
 
   if (schema.type === "map") {
     if (!isRecord(value)) {
-      throw new OntologyValidationError(`[Sixb] Property ${path} must be an object map`)
+      throw withFailureMessage(
+        new OntologyValidationError(`[Sixb] Property ${path} must be an object map`),
+        `Property ${diagnosticPath} must be an object map.`
+      )
     }
     for (const [key, entry] of Object.entries(value)) {
-      validateSchemaValue(schema.valueSchema, entry, `${path}.${key}`, valueTypesById)
+      validateSchemaValue(
+        schema.valueSchema,
+        entry,
+        `${path}.${key}`,
+        valueTypesById,
+        `${diagnosticPath}.*`
+      )
     }
     return
   }
 
   if (schema.type === "object") {
     if (!isRecord(value)) {
-      throw new OntologyValidationError(`[Sixb] Property ${path} must be an object`)
+      throw withFailureMessage(
+        new OntologyValidationError(`[Sixb] Property ${path} must be an object`),
+        `Property ${diagnosticPath} must be an object.`
+      )
     }
 
     const fields = schema.properties
     const fieldIds = new Set(Object.keys(fields))
     for (const fieldId of Object.keys(value)) {
       if (!fieldIds.has(fieldId)) {
-        throw new OntologyValidationError(`[Sixb] Unknown field '${path}.${fieldId}'`)
+        throw withFailureMessage(
+          new OntologyValidationError(`[Sixb] Unknown field '${path}.${fieldId}'`),
+          `Object ${diagnosticPath} contains an undeclared field.`
+        )
       }
     }
 
@@ -107,12 +171,21 @@ export function validateSchemaValue(
       const fieldValue = value[fieldId]
       if (fieldValue === undefined) {
         if (field.required) {
-          throw new OntologyValidationError(`[Sixb] Missing required field '${path}.${fieldId}'`)
+          throw withFailureMessage(
+            new OntologyValidationError(`[Sixb] Missing required field '${path}.${fieldId}'`),
+            `Missing required field '${diagnosticPath}.${fieldId}'.`
+          )
         }
         continue
       }
 
-      validateFieldValue(field, fieldValue, `${path}.${fieldId}`, valueTypesById)
+      validateFieldValue(
+        field,
+        fieldValue,
+        `${path}.${fieldId}`,
+        valueTypesById,
+        `${diagnosticPath}.${fieldId}`
+      )
     }
     return
   }
@@ -122,7 +195,8 @@ export function validateSchemaValue(
       resolveValueTypeSchema(schema, valueTypesById, path),
       value,
       path,
-      valueTypesById
+      valueTypesById,
+      diagnosticPath
     )
   }
 }
@@ -131,16 +205,20 @@ function validateFieldValue(
   field: ObjectFieldSchema,
   value: unknown,
   path: string,
-  valueTypesById: ReadonlyMap<string, ValueType>
+  valueTypesById: ReadonlyMap<string, ValueType>,
+  diagnosticPath = path
 ): void {
   if (value === null) {
     if (field.nullable) {
       return
     }
-    throw new OntologyValidationError(`[Sixb] Field ${path} cannot be null`)
+    throw withFailureMessage(
+      new OntologyValidationError(`[Sixb] Field ${path} cannot be null`),
+      `Field ${diagnosticPath} cannot be null.`
+    )
   }
 
-  validateSchemaValue(field.schema, value, path, valueTypesById)
+  validateSchemaValue(field.schema, value, path, valueTypesById, diagnosticPath)
 }
 
 export function resolveValueTypeRef(schema: Schema): string | undefined {

package/src/ontology/vector-profiles.ts

@@ -0,0 +1,35 @@
+import type { ObjectVectorSearchProfile } from "./types"
+
+/** Metadata-only copy. Executable provider objects and credentials never leave the host. */
+export function snapshotVectorProfiles(
+  profiles: Readonly<Record<string, ObjectVectorSearchProfile>>
+): Readonly<Record<string, ObjectVectorSearchProfile>> {
+  const snapshot: Record<string, ObjectVectorSearchProfile> = Object.create(null)
+  for (const [name, profileDefinition] of Object.entries(profiles)) {
+    const { providerId, modelId, definition } = profileDefinition.model
+    snapshot[name] = Object.freeze({
+      source: Object.freeze([...profileDefinition.source]),
+      model: Object.freeze({
+        providerId,
+        modelId,
+        definition: Object.freeze({
+          kind: "embedding" as const,
+          providerId,
+          modelId,
+          dimensions: definition.dimensions,
+          ...(definition.representation
+            ? {
+                representation: Object.freeze({
+                  name: definition.representation.name,
+                  ...(definition.representation.version === undefined
+                    ? {}
+                    : { version: definition.representation.version }),
+                }),
+              }
+            : {}),
+        }),
+      }),
+    })
+  }
+  return Object.freeze(snapshot)
+}

package/src/predicates/types.ts

@@ -1,5 +1,5 @@
 import type { DecimalValue } from "../ontology/decimal"
-import type { Property, Schema } from "../ontology/types"
+import type { PrimitiveSchema, Property, Schema } from "../ontology/types"
 
 export type Predicate =
   | AllPredicate
@@ -65,39 +65,49 @@ export type PredicateValueFor<TProperty extends Property> = string extends TProp
     ? SerializableSchemaPredicateValue<TProperty["schema"]> | null
     : SerializableSchemaPredicateValue<TProperty["schema"]>
 
-type SerializableSchemaPredicateValue<TSchema extends Schema> = TSchema extends
-  | "string"
-  | "uuid"
-  | "date"
-  | "timestamp"
-  ? string
-  : TSchema extends "integer" | "double"
-    ? number
-    : TSchema extends "decimal"
-      ? DecimalValue
-      : TSchema extends "boolean"
-        ? boolean
-        : TSchema extends { readonly type: "enum"; readonly values: readonly (infer TValue)[] }
-          ? Extract<TValue, PredicateValue>
-          : TSchema extends {
-                readonly type: "valueTypeRef"
-                readonly _resolved: infer TResolved extends Schema
-              }
-            ? SerializableSchemaPredicateValue<TResolved>
-            : never
-
-type OrderedSchemaPredicateValue<TSchema extends Schema> = TSchema extends "decimal"
-  ? DecimalValue
-  : TSchema extends "integer" | "double"
+/**
+ * Rule predicate values per primitive: `equality` for `eq`/`notEq`, `ordered` for range operators.
+ * `never` rejects the operator. Indexed by `PrimitiveSchema`, so a new primitive must add a row.
+ */
+interface PrimitivePredicateValues {
+  string: { equality: string; ordered: never }
+  uuid: { equality: string; ordered: never }
+  date: { equality: string; ordered: never }
+  timestamp: { equality: string; ordered: never }
+  integer: { equality: number; ordered: number }
+  double: { equality: number; ordered: number }
+  decimal: { equality: DecimalValue; ordered: DecimalValue }
+  boolean: { equality: boolean; ordered: never }
+  fileRef: { equality: never; ordered: never }
+  // Rule predicates compare scalar values; a user reference supports presence checks only.
+  userRef: { equality: never; ordered: never }
+}
+
+type SerializableSchemaPredicateValue<TSchema extends Schema> = TSchema extends PrimitiveSchema
+  ? PrimitivePredicateValues[TSchema] extends { equality: infer TValue }
+    ? TValue
+    : never
+  : TSchema extends { readonly type: "enum"; readonly values: readonly (infer TValue)[] }
+    ? Extract<TValue, PredicateValue>
+    : TSchema extends {
+          readonly type: "valueTypeRef"
+          readonly _resolved: infer TResolved extends Schema
+        }
+      ? SerializableSchemaPredicateValue<TResolved>
+      : never
+
+type OrderedSchemaPredicateValue<TSchema extends Schema> = TSchema extends PrimitiveSchema
+  ? PrimitivePredicateValues[TSchema] extends { ordered: infer TValue }
+    ? TValue
+    : never
+  : TSchema extends { readonly type: "enum"; readonly valueType: "integer" }
     ? number
-    : TSchema extends { readonly type: "enum"; readonly valueType: "integer" }
-      ? number
-      : TSchema extends {
-            readonly type: "valueTypeRef"
-            readonly _resolved: infer TResolved extends Schema
-          }
-        ? OrderedSchemaPredicateValue<TResolved>
-        : never
+    : TSchema extends {
+          readonly type: "valueTypeRef"
+          readonly _resolved: infer TResolved extends Schema
+        }
+      ? OrderedSchemaPredicateValue<TResolved>
+      : never
 
 /** Ordered comparison value inferred from a concrete numeric ontology property. */
 export type OrderedPredicateValueFor<TProperty extends Property> = string extends TProperty["id"]

package/src/projections/builders.ts

@@ -108,14 +108,35 @@ type ProjectionSchemaByDatasetColumnType = {
   readonly fileRef: "fileRef"
 }
 
+/** Projections cannot map user references yet, even nested ones; registration rejects them too. */
+type SchemaContainsUserRef<TSchema> = TSchema extends "userRef"
+  ? true
+  : TSchema extends { type: "array"; items: infer TItems }
+    ? SchemaContainsUserRef<TItems>
+    : TSchema extends { type: "map"; valueSchema: infer TValue }
+      ? SchemaContainsUserRef<TValue>
+      : TSchema extends { type: "object"; properties: infer TFields }
+        ? true extends {
+            [K in keyof TFields]: TFields[K] extends { schema: infer TField }
+              ? SchemaContainsUserRef<TField>
+              : false
+          }[keyof TFields]
+          ? true
+          : false
+        : TSchema extends { type: "valueTypeRef"; _resolved: infer TResolved }
+          ? SchemaContainsUserRef<TResolved>
+          : false
+
 type DatasetColumnCompatibleWithSchema<
   TColumnType extends DatasetColumnType,
   TSchema extends Schema,
 > = [ResolvedProjectionSchema<TSchema>] extends [never]
   ? false
-  : ResolvedProjectionSchema<TSchema> extends ProjectionSchemaByDatasetColumnType[TColumnType]
-    ? true
-    : false
+  : SchemaContainsUserRef<TSchema> extends true
+    ? false
+    : ResolvedProjectionSchema<TSchema> extends ProjectionSchemaByDatasetColumnType[TColumnType]
+      ? true
+      : false
 
 type DatasetColumnNameCompatibleWithSchema<
   TDataset extends DatasetDefinition,

package/src/projections/validation.ts

@@ -8,7 +8,7 @@
 import type { DatasetDefinition } from "../datasets"
 import type { OntologyDefinitionCatalog } from "../ontology"
 import type { ObjectType, Property, ValueType } from "../ontology/types"
-import { resolveSemanticType } from "../ontology/validation"
+import { findPrimitiveSchema, resolveSemanticType } from "../ontology/validation"
 import { ProjectionValidationError } from "./errors"
 import {
   computeProjectionOwnership,
@@ -394,6 +394,20 @@ export function validateProjectionsAtStartup(
           `[Sixb] ${prefix}: source mappings cannot own telemetry property "${projection.objectTypeId}.${propId}"`
         )
       }
+      // A dataset column cannot prove that a user exists and is active, so user references stay
+      // out of source data until a projection can resolve them.
+      if (
+        property &&
+        findPrimitiveSchema(
+          property.schema,
+          ontology.getValueTypesById(),
+          (schema) => schema === "userRef"
+        )
+      ) {
+        throw new ProjectionValidationError(
+          `[Sixb] ${prefix}: property "${projection.objectTypeId}.${propId}" holds user references (ref.user()), which projections cannot map yet. Set it from an Action or a runtime edit instead.`
+        )
+      }
     }
 
     const primaryId = primaryByTypeId.get(projection.objectTypeId)!

package/src/queues/in-memory.ts

@@ -20,6 +20,7 @@ import type {
   SubagentQueueJob,
   SyncQueueJobFailureCode,
   SyncRunRequestedQueueJob,
+  VectorIndexingQueueJob,
   WorkflowQueueJob,
   WorkflowQueueJobFailureCode,
 } from "./types"
@@ -402,6 +403,10 @@ export class InMemoryQueues implements Queues {
   readonly scope = "process" as const
   private readonly store = new InMemoryQueueStore()
 
+  readonly vectorIndexing = new InMemoryQueue<
+    VectorIndexingQueueJob,
+    "internal.unexpected" | "runtime.cancelled"
+  >(this.store, "vector.indexing")
   readonly syncRuns = new InMemoryQueue<SyncRunRequestedQueueJob, SyncQueueJobFailureCode>(
     this.store,
     "sync.runs"

package/src/queues/index.ts

@@ -37,6 +37,7 @@ export type {
   SubagentRunRequestedQueueJob,
   SyncQueueJobFailureCode,
   SyncRunRequestedQueueJob,
+  VectorIndexingQueueJob,
   WorkflowQueueJob,
   WorkflowQueueJobFailureCode,
   WorkflowRunRequestedQueueJob,

package/src/queues/types.ts

@@ -226,7 +226,17 @@ export type AgentQueueJob =
   | AgentWorkflowNodeRequestedQueueJob
   | AgentAiUsageRecordRequestedQueueJob
 
+/** Internal lane hosted by ProjectionWorker. */
+export type VectorIndexingQueueJob = QueueJob<
+  "vector.index.requested",
+  { readonly indexingId: string }
+>
+
 export interface Queues {
+  readonly vectorIndexing: Queue<
+    VectorIndexingQueueJob,
+    "internal.unexpected" | "runtime.cancelled"
+  >
   readonly syncRuns: Queue<SyncRunRequestedQueueJob, SyncQueueJobFailureCode>
   readonly pipelines: Queue<PipelineRunRequestedQueueJob, PipelineQueueJobFailureCode>
   readonly projections: Queue<ProjectionRunRequestedQueueJob, ProjectionQueueJobFailureCode>

package/src/runtime/create.ts

@@ -21,6 +21,7 @@ import type { RuleDefinition } from "../rules"
 import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition } from "../schedules"
 import type { GroupDefinition, MembershipPolicyDefinition, RoleDefinition } from "../security"
+import type { ParamsConfig } from "../shared/params/types"
 import type { ShareDefinition } from "../shares"
 import type { Storage } from "../storage"
 import type { SyncDefinition } from "../syncs"
@@ -29,14 +30,14 @@ import { RuntimeError } from "./errors"
 import { SixbHost } from "./host"
 import type { OntologySource } from "./types"
 
-export interface CreateSixbOptions {
+export interface CreateSixbOptions<in out TParams extends ParamsConfig = ParamsConfig> {
   id?: string
   broker: Broker
   storage: Storage
   lakeStorage: LakeStorage
   blobStorage: BlobStorage
   queues: Queues
-  sandboxes?: SandboxFactory
+  sandboxes?: SandboxFactory<TParams>
   /** Optional process-level output provider. Omit for broker-only logging. */
   logger?: LoggerProvider
   /** Broker capture controls, independent from the output provider. */
@@ -79,9 +80,9 @@ export interface CreateSixbOptions {
  * `rules/`, `workflows/`, `shares/`, and `security/{groups,roles,policies}/`
  * relative to `projectRoot`.
  */
-export async function createSixb(
-  options: CreateSixbOptions
-): Promise<SixbHost<readonly OntologySource[]>> {
+export async function createSixb<const TParams extends ParamsConfig = ParamsConfig>(
+  options: CreateSixbOptions<TParams>
+): Promise<SixbHost<TParams>> {
   assertNoAgentDefinitions(options)
   const projectRoot = resolve(options.projectRoot ?? process.cwd())
 
@@ -99,7 +100,7 @@ export async function createSixb(
   // Explicit definitions come first so local setup can override ordering while duplicate ids are
   // still rejected by the SixbHost constructor. Every family merges — `actions` and `projections`
   // used to *replace* discovery instead, silently and undocumented.
-  return new SixbHost<readonly OntologySource[]>({
+  return new SixbHost<TParams>({
     id: options.id,
     ontology: allSources,
     broker: options.broker,