@sixb/core 0.1.16 → 0.1.18

package/dist/{chunk-vjqt7q3a.js → chunk-vz3gc1tm.js}

@@ -1,11 +1,17 @@
 // @bun
+import {
+  supportsDirectUpload2
+} from "./chunk-jhm3zsa7.js";
+import {
+  SecurityValidationError2
+} from "./chunk-xt1zt7gv.js";
 import {
   OntologyRegistry2
-} from "./chunk-zvmr2hqk.js";
+} from "./chunk-bs7sqkre.js";
 import {
   ProjectionRegistry2,
   createOntologyMaterializer2
-} from "./chunk-h4138ww2.js";
+} from "./chunk-p0dqwj3n.js";
 import {
   captureSixbFailure2,
   isSixbError2
@@ -13,40 +19,45 @@ import {
 import {
   SecurityRegistry,
   AuthRuntime2
-} from "./chunk-2xvgy3x5.js";
+} from "./chunk-6h5m9xjx.js";
 import {
   captureExecutionScope,
   resolveExecutionScopeAuthorization,
   AuthorizationError2
-} from "./chunk-69kt9q43.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   AuthRuntimeError2,
   isMagicLinkAuthStrategy2,
   isOidcAuthStrategy2
 } from "./chunk-2jntasmh.js";
 import {
-  createModelCatalog2
-} from "./chunk-tnvafr7g.js";
+  indexModelBindings,
+  assertRerankingModel,
+  validateRerankingResults,
+  RerankingModelResponseError2,
+  createModelCatalog2,
+  estimateModelCall
+} from "./chunk-29yx306f.js";
 import {
   FileUploadSessionError2
-} from "./chunk-dp7yk20b.js";
+} from "./chunk-zxawp1n2.js";
 import {
   isMigrationCapableStorage2,
   checkStorageSchema2
-} from "./chunk-6z1q7j19.js";
+} from "./chunk-qq90g05n.js";
 import {
   createAuthorizedObjectReader
-} from "./chunk-8x74221e.js";
+} from "./chunk-fx93hd2n.js";
 import {
   attachSixbErrorReporter2,
   shareSixbErrorReporter2
 } from "./chunk-vjcd8d27.js";
 import {
   ActionRegistry2
-} from "./chunk-dsv8kdgk.js";
+} from "./chunk-tffvfy6s.js";
 import {
   assertDatasetDefinition2
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   OntologyOutboxDispatcher2,
   createDomainEventService2
@@ -56,7 +67,7 @@ import {
 } from "./chunk-e1c18xjx.js";
 import {
   createSandboxDefinition
-} from "./chunk-gmdvns8f.js";
+} from "./chunk-48e3cn2d.js";
 import {
   ConnectorError2,
   ConnectorNotFoundError2,
@@ -68,16 +79,20 @@ import {
   isConnectorStorageError,
   storageBoundaryError,
   recoverConnectorFailure
-} from "./chunk-nvymebc1.js";
+} from "./chunk-f1zxad2t.js";
 import {
   toolsFromProjectConfig
-} from "./chunk-f72rbvsb.js";
+} from "./chunk-p844e0rn.js";
 import {
   assertNoAgentDefinitions,
   validateWorkflowsAtStartup2,
   validateWorkflowAgentStepGroupReferences2,
-  createBoundSixb
-} from "./chunk-3q7z9hd4.js";
+  createBoundSixb,
+  DEFAULT_PROJECT_LOCALE,
+  DEFAULT_PROJECT_TIME_ZONE,
+  canonicalLocale,
+  canonicalTimeZone
+} from "./chunk-fe52eczz.js";
 import {
   registerConnectorConnectionCallbackProcess
 } from "./chunk-5a4a52tq.js";
@@ -87,36 +102,40 @@ import {
 } from "./chunk-85cd7e8c.js";
 import {
   SchedulerRuntime2
-} from "./chunk-z5rnrmz1.js";
+} from "./chunk-yw9pyg66.js";
 import {
+  discoverOntologyFiles,
+  discoverAgentSkills,
+  discoverProjectInstructions,
   validateRulesAtStartup,
   validateSharesAtStartup,
-  discoverOntologySources2,
+  discoverOntologySources,
   discoverProjectDefinitions2
-} from "./chunk-a7ne02hk.js";
+} from "./chunk-s4jhg8a3.js";
 import {
   LoggingService2
 } from "./chunk-3qms4nax.js";
 import {
   bindEmbeddingModels,
   createVectorIndexingRuntime,
-  registerVectorIndexingRuntime
-} from "./chunk-gkxsenvp.js";
+  registerVectorIndexingRuntime,
+  getApiPublicOrigin
+} from "./chunk-de4z2bj6.js";
 import {
   registerProjectionRegistry2
-} from "./chunk-cq44v1a6.js";
+} from "./chunk-7hpdd6r9.js";
 import {
   SyncValidationError2
-} from "./chunk-nkbev3tr.js";
+} from "./chunk-yv9czyfr.js";
 import {
   ModelExecutionSession
-} from "./chunk-chdg6eqq.js";
+} from "./chunk-k6hrnf35.js";
 import {
   isOAuthConnectorDefinition2
 } from "./chunk-9x8dybsb.js";
 import {
   ensureExecutionRecord2
-} from "./chunk-7g2gjvah.js";
+} from "./chunk-ex496vct.js";
 import {
   ConnectorConnectionStorageError2,
   CONNECTOR_CONNECTION_RUN_FAILURE_CODES2
@@ -130,9 +149,6 @@ import {
 import {
   sameEmbeddingModel
 } from "./chunk-kyjcwqz6.js";
-import {
-  supportsDirectUpload2
-} from "./chunk-h3v76ams.js";
 import {
   isJsonObject2
 } from "./chunk-wy0qdqfm.js";
@@ -2701,11 +2717,13 @@ var DEGRADED_FAILURE_THRESHOLD = 2;
 var ABANDONED_UPLOAD_SWEEP_DELAY_MS = 5 * 60000;
 var ABANDONED_UPLOAD_ABORT_GRACE_MS = 15 * 60000;
 var ABANDONED_SOURCE_PURGE_BATCH = 50000;
+var EXPIRED_FILE_DOWNLOAD_RETENTION_MS = 7 * 24 * 60 * 60000;
 
 class OntologyMaintenance {
   projectId;
   storage;
   dispatcher;
+  vectorIndexing;
   blobStorage;
   intervalMs;
   publishedOutboxRetentionMs;
@@ -2725,6 +2743,7 @@ class OntologyMaintenance {
     this.projectId = dependencies.projectId;
     this.storage = dependencies.storage;
     this.dispatcher = dependencies.dispatcher;
+    this.vectorIndexing = dependencies.vectorIndexing;
     this.blobStorage = dependencies.blobStorage;
     this.intervalMs = positiveInteger(options.intervalMs ?? DEFAULT_INTERVAL_MS, "intervalMs");
     this.publishedOutboxRetentionMs = nonnegativeInteger(options.publishedOutboxRetentionMs ?? DEFAULT_RETENTION_MS, "publishedOutboxRetentionMs");
@@ -2788,9 +2807,12 @@ class OntologyMaintenance {
     this.snapshot = { ...this.snapshot, running: true, lastStartedAt: started.toISOString() };
     const failures = [];
     await captureFailure(() => this.dispatcher.drain(), failures);
+    const vectorIndexing = this.vectorIndexing;
+    if (vectorIndexing)
+      await captureFailure(() => vectorIndexing.drain(), failures);
     const cleanup = await this.cleanupExpiredRows(started, failures);
-    const { outbox, terminalSources } = await this.readOperationalSummaries(failures);
-    this.completePass({ started, failures, cleanup, outbox, terminalSources });
+    const outbox = await captureFailure(() => this.storage.ontology.outbox.summarize({ projectId: this.projectId }), failures, this.snapshot.outbox);
+    this.completePass({ started, failures, cleanup, outbox });
   }
   async cleanupExpiredRows(started, failures) {
     const publishedOutboxRowsDeleted = await captureFailure(() => this.storage.ontology.outbox.purgePublished({
@@ -2798,6 +2820,7 @@ class OntologyMaintenance {
       publishedBefore: new Date(started.getTime() - this.publishedOutboxRetentionMs).toISOString(),
       limit: this.cleanupLimit
     }), failures, 0);
+    const spentPlanRows = await captureFailure(() => this.purgeSpentPlans(started), failures, 0);
     const terminalSources = await captureFailure(() => this.storage.ontology.sources.cleanupTerminal({
       projectId: this.projectId,
       terminalBefore: new Date(started.getTime() - this.terminalSourceRetentionMs).toISOString(),
@@ -2809,9 +2832,17 @@ class OntologyMaintenance {
       await captureFailure(() => this.retireAbandonedUploads(uploads, started, failures), failures);
       await captureFailure(() => uploads.cleanupExpired(started), failures, 0);
     }
+    const downloads = this.storage.fileDownloadGrants;
+    if (downloads) {
+      await captureFailure(() => downloads.deleteExpired({
+        projectId: this.projectId,
+        expiredBefore: new Date(started.getTime() - EXPIRED_FILE_DOWNLOAD_RETENTION_MS),
+        limit: this.cleanupLimit
+      }), failures, 0);
+    }
     return {
       publishedOutboxRowsDeleted,
-      terminalSourceRowsDeleted: terminalSources.rowsDeleted + abandonedSources.rowsDeleted,
+      terminalSourceRowsDeleted: terminalSources.rowsDeleted + abandonedSources.rowsDeleted + spentPlanRows,
       terminalSourceMaterializationsDeleted: terminalSources.materializationsDeleted + abandonedSources.materializationsDeleted
     };
   }
@@ -2831,6 +2862,19 @@ class OntologyMaintenance {
       }
     }
   }
+  async purgeSpentPlans(started) {
+    let rowsDeleted = 0;
+    while (true) {
+      const purged = await this.storage.ontology.replacementPlans.purge({
+        projectId: this.projectId,
+        limit: ABANDONED_SOURCE_PURGE_BATCH
+      });
+      rowsDeleted += purged;
+      if (purged < ABANDONED_SOURCE_PURGE_BATCH || this.now().getTime() - started.getTime() >= this.intervalMs) {
+        return rowsDeleted;
+      }
+    }
+  }
   async retireAbandonedUploads(uploads, now, failures) {
     const abandoned = await uploads.listAbandoned({
       projectId: this.projectId,
@@ -2868,11 +2912,6 @@ class OntologyMaintenance {
     if (abortFailure !== undefined)
       throw abortFailure;
   }
-  async readOperationalSummaries(failures) {
-    const outbox = await captureFailure(() => this.storage.ontology.outbox.summarize({ projectId: this.projectId }), failures, this.snapshot.outbox);
-    const terminalSummary = await captureFailure(() => this.storage.ontology.sources.summarizeTerminal({ projectId: this.projectId }), failures, this.snapshot.terminalSources);
-    return { outbox, terminalSources: terminalSummary };
-  }
   completePass(input) {
     const completed = this.now();
     const failure = input.failures.length > 0 ? new AggregateError(input.failures, "Maintenance pass failed.") : null;
@@ -2885,7 +2924,6 @@ class OntologyMaintenance {
       consecutiveFailures: failure ? this.snapshot.consecutiveFailures + 1 : 0,
       lastError: failure ? errorMessage(failure) : null,
       outbox: input.outbox,
-      terminalSources: input.terminalSources,
       cleanup: input.cleanup
     };
     if (failure)
@@ -2937,7 +2975,6 @@ function emptySnapshot(intervalMs) {
     consecutiveFailures: 0,
     lastError: null,
     outbox: null,
-    terminalSources: null,
     cleanup: null
   };
 }
@@ -2993,6 +3030,179 @@ async function captureFailure(run, failures, fallback) {
     return fallback;
   }
 }
+// src/models/execution/reranking.ts
+import { randomUUID as randomUUID6 } from "crypto";
+function bindRerankingModels(catalog, session) {
+  if (!catalog)
+    return;
+  return indexModelBindings(catalog.list().map(({ model }) => Object.freeze({
+    providerId: model.providerId,
+    modelId: model.modelId,
+    definition: model.definition,
+    rerank: (input) => executeReranking(session, model, input)
+  })), "reranking", assertRerankingModel);
+}
+async function executeReranking(session, binding, input) {
+  const query = input.query;
+  if (typeof query !== "string" || !query.trim() || !Array.isArray(input.documents) || input.documents.some((text) => typeof text !== "string" || !text.trim())) {
+    throw new TypeError("[SixbModels] Reranking requires a query and nonempty document strings.");
+  }
+  const documents = [...input.documents];
+  const signal = AbortSignal.any([session.signal(input.signal), AbortSignal.timeout(30000)]);
+  signal.throwIfAborted();
+  if (documents.length === 0)
+    return { results: [] };
+  const accounting = await session.accounting();
+  accounting.assertHealthy();
+  const model = await binding.resolve?.() ?? binding;
+  assertRerankingModel(model);
+  if (model.providerId !== binding.providerId || model.modelId !== binding.modelId) {
+    throw new TypeError("[SixbModels] Resolved reranking model identity does not match its binding.");
+  }
+  signal.throwIfAborted();
+  const encoder = new TextEncoder;
+  const queryBytes = encoder.encode(query).byteLength;
+  const tokens = documents.reduce((sum, text) => sum + Math.ceil((queryBytes + encoder.encode(text).byteLength) / 4), 0);
+  const callId = `call_${randomUUID6()}`;
+  await accounting.admitCall({
+    callId,
+    providerId: model.providerId,
+    modelId: model.modelId,
+    modelKind: "reranking",
+    costEstimator: model.costEstimator,
+    inputTokens: { status: "estimated", tokens, method: "utf8BytesDividedByFour" },
+    outputTokenAllowance: 0,
+    estimatedTotalTokens: tokens
+  });
+  let result;
+  try {
+    signal.throwIfAborted();
+    result = await model.rerank({ query, documents, signal });
+  } catch (error) {
+    const metadata = error instanceof RerankingModelResponseError2 ? error.metadata : {};
+    await recordReranking(accounting, model, callId, metadata);
+    throw error;
+  }
+  await recordReranking(accounting, model, callId, result ?? {});
+  signal.throwIfAborted();
+  try {
+    return { ...result, results: validateRerankingResults(result?.results, documents.length) };
+  } catch (cause) {
+    throw new RerankingModelResponseError2("[SixbModels] Invalid reranking response.", model.providerId, model.modelId, result ?? {}, { cause });
+  }
+}
+async function recordReranking(accounting, model, callId, metadata) {
+  const usage = { ...metadata.usage, outputTokens: metadata.usage?.outputTokens ?? 0 };
+  const estimate = estimateModelCall(model, {
+    usage,
+    route: metadata.route,
+    responseModelId: metadata.responseModelId
+  });
+  await accounting.onModelCallEnd({
+    callId,
+    modelKind: "reranking",
+    providerId: model.providerId,
+    modelId: model.modelId,
+    responseId: metadata.providerIds?.responseId ?? callId,
+    responseModelId: metadata.responseModelId,
+    providerIds: metadata.providerIds,
+    usage,
+    cost: metadata.reportedCost ? { status: "reported", ...metadata.reportedCost } : estimate,
+    ...metadata.reportedCost ? { estimate } : {},
+    route: metadata.route
+  });
+}
+
+// src/objects/vectors/indexing-dispatch.ts
+var PAGE_SIZE = 100;
+var REDISPATCH_DELAY_MS = 30000;
+
+class VectorIndexingDispatcher {
+  projectId;
+  indexing;
+  queue;
+  running = null;
+  next = null;
+  stopped = false;
+  constructor(projectId, indexing, queue) {
+    this.projectId = projectId;
+    this.indexing = indexing;
+    this.queue = queue;
+  }
+  notify() {
+    this.drain().catch((error) => console.error("[Sixb] Could not dispatch vector indexing; maintenance will retry:", error));
+  }
+  drain() {
+    this.next ??= settled(this.running).then(() => {
+      this.next = null;
+      if (this.stopped)
+        return;
+      this.running = this.pass().finally(() => {
+        this.running = null;
+      });
+      return this.running;
+    });
+    return this.next;
+  }
+  async stop() {
+    this.stopped = true;
+    await settled(this.next);
+    await settled(this.running);
+  }
+  async pass() {
+    for (;; ) {
+      const now = new Date;
+      const work = await this.indexing.listDue({
+        projectId: this.projectId,
+        now: now.toISOString(),
+        limit: PAGE_SIZE
+      });
+      if (work.length) {
+        const jobs = [...new Map(work.map((item) => [item.batchId ?? item.id, item])).entries()];
+        await this.queue.enqueue({
+          projectId: this.projectId,
+          jobs: jobs.map(([id, item]) => ({
+            id,
+            type: "vector.index.requested",
+            payload: { indexingId: id },
+            availableAt: item.availableAt
+          }))
+        });
+        await this.indexing.dispatched({
+          projectId: this.projectId,
+          ids: work.map((item) => item.id),
+          nextDispatchAt: new Date(now.getTime() + REDISPATCH_DELAY_MS).toISOString()
+        });
+      }
+      if (work.length < PAGE_SIZE || this.stopped)
+        return;
+    }
+  }
+}
+function settled(promise) {
+  return (promise ?? Promise.resolve()).then(() => {
+    return;
+  }, () => {
+    return;
+  });
+}
+
+// src/agents/skills.ts
+function createAgentSkillCatalog(definitions) {
+  const skills = Object.freeze([...definitions ?? []]);
+  const skillsByName = new Map;
+  for (const skill of skills) {
+    if (skillsByName.has(skill.name)) {
+      throw new RuntimeError2(`[Sixb] Duplicate Agent Skill name: ${skill.name}`);
+    }
+    skillsByName.set(skill.name, skill);
+  }
+  return Object.freeze({
+    list: () => skills,
+    getByName: (name) => skillsByName.get(name) ?? null
+  });
+}
+
 // src/agents/tool-catalog.ts
 function createAgentToolCatalog(definitions) {
   const tools = toolsFromProjectConfig(definitions);
@@ -3003,6 +3213,290 @@ function createAgentToolCatalog(definitions) {
   });
 }
 
+// src/ontology/docs.ts
+function createOntologyDocsCatalog(input) {
+  const modules = input.docs?.modules ?? [];
+  const scripts = Object.freeze([...input.docs?.scripts ?? []]);
+  const claimedPaths = new Map(scripts.map((script) => [script.path.toLowerCase(), `script 'ontology/${script.path}'`]));
+  const claim = (path, owner) => {
+    const claimedBy = claimedPaths.get(path.toLowerCase());
+    if (claimedBy !== undefined) {
+      throw new RuntimeError2(`[Sixb] The ${owner} at 'ontology/${path}' collides with ${claimedBy}, which only differs ` + "by case or not at all. Rename one of them.");
+    }
+    claimedPaths.set(path.toLowerCase(), `the ${owner}`);
+  };
+  const docPathByType = new Map;
+  const typeIdsByNotesPath = new Map;
+  const addNotesPath = (path, objectTypeIds) => {
+    const typeIds = typeIdsByNotesPath.get(path.toLowerCase()) ?? new Set;
+    for (const objectTypeId of objectTypeIds)
+      typeIds.add(objectTypeId);
+    typeIdsByNotesPath.set(path.toLowerCase(), typeIds);
+  };
+  for (const objectType of input.objectTypes) {
+    const path = docPathFor(objectType.id, modules);
+    claim(path, `doc of object type '${objectType.id}'`);
+    docPathByType.set(objectType.id, path);
+    addNotesPath(path, [objectType.id]);
+  }
+  for (const module of modules) {
+    if (module.objectTypeIds.length > 0) {
+      addNotesPath(`${withoutExtension(module.path)}.md`, module.objectTypeIds);
+    }
+  }
+  const notesByType = new Map;
+  const docs = [];
+  const docPaths = new Map;
+  for (const doc of input.docs?.docs ?? []) {
+    const sameName = docPaths.get(doc.path.toLowerCase());
+    if (sameName !== undefined) {
+      throw new RuntimeError2(`[Sixb] The ontology docs 'ontology/${sameName}' and 'ontology/${doc.path}' only differ ` + "by case. Rename one of them.");
+    }
+    docPaths.set(doc.path.toLowerCase(), doc.path);
+    const objectTypeIds = typeIdsByNotesPath.get(doc.path.toLowerCase());
+    if (objectTypeIds === undefined) {
+      docs.push(doc);
+      continue;
+    }
+    for (const objectTypeId of objectTypeIds) {
+      notesByType.set(objectTypeId, [...notesByType.get(objectTypeId) ?? [], doc]);
+    }
+  }
+  for (const notes of notesByType.values())
+    notes.sort(byPath);
+  Object.freeze(docs);
+  const wildcardLinks = new Set(input.objectTypes.flatMap((objectType) => objectType.links.filter((link) => link.targetObjectTypeId === "*").map((link) => linkKey(objectType.id, link.id))));
+  return Object.freeze({
+    docPathFor: (objectTypeId) => {
+      const path = docPathByType.get(objectTypeId);
+      if (path === undefined) {
+        throw new RuntimeError2(`[Sixb] Object type '${objectTypeId}' is not registered.`);
+      }
+      return path;
+    },
+    notesFor: (objectTypeId) => notesByType.get(objectTypeId) ?? [],
+    listDocs: () => docs,
+    listScripts: () => scripts,
+    isWildcardLink: (objectTypeId, linkId) => wildcardLinks.has(linkKey(objectTypeId, linkId))
+  });
+}
+function docPathFor(objectTypeId, modules) {
+  const rank = (module) => {
+    const name = basename(withoutExtension(module.path));
+    return [
+      kebabCase(name) === kebabCase(objectTypeId) ? 0 : 1,
+      name === "index" ? 1 : 0,
+      module.objectTypeIds.length
+    ];
+  };
+  let owner;
+  for (const module of modules) {
+    if (!module.objectTypeIds.includes(objectTypeId))
+      continue;
+    if (owner === undefined || compareRanks(rank(module), rank(owner)) < 0)
+      owner = module;
+  }
+  const fileName = `${objectTypeId.replaceAll(/[^A-Za-z0-9._-]/g, "_")}.md`;
+  if (owner === undefined)
+    return fileName;
+  const base = withoutExtension(owner.path);
+  return owner.objectTypeIds.length === 1 ? `${base}.md` : `${base}/${fileName}`;
+}
+function compareRanks(left, right) {
+  for (const [index, value] of left.entries()) {
+    const difference = value - (right[index] ?? 0);
+    if (difference !== 0)
+      return difference;
+  }
+  return 0;
+}
+function kebabCase(name) {
+  return name.replaceAll(/([a-z0-9])([A-Z])/g, "$1-$2").replaceAll(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replaceAll(/[\s_]+/g, "-").toLowerCase();
+}
+function withoutExtension(path) {
+  return path.replace(/\.[^./]+$/, "");
+}
+function basename(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function linkKey(objectTypeId, linkId) {
+  return JSON.stringify([objectTypeId, linkId]);
+}
+function byPath(left, right) {
+  return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+}
+
+// src/security/markings.ts
+function validateMarkingsAtStartup(input) {
+  validatePropertyMarkings(input.ontology, input.markingIds);
+  validateColumnMarkings(input.datasetsById, input.markingIds);
+  rejectPipelineStepsOverMarkedColumns(input.pipelines, input.datasetsById);
+  validateProjectionMarkings(input.projections, input.ontology, input.datasetsById);
+}
+function validatePropertyMarkings(ontology, markingIds) {
+  for (const objectType of ontology.listObjectTypes()) {
+    for (const property of objectType.properties) {
+      validateProperty(objectType, property, markingIds);
+    }
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? []) {
+        if (property.markings !== undefined) {
+          throw new SecurityValidationError2(`[Sixb] Link property '${objectType.id}.${link.id}.${property.id}' cannot carry markings. Mark object properties instead.`);
+        }
+      }
+    }
+    assertSubtypeKeepsParentMarkings(objectType, ontology);
+  }
+}
+function validateProperty(objectType, property, markingIds) {
+  if (property.markings === undefined)
+    return;
+  const path = `${objectType.id}.${property.id}`;
+  assertMarkingList(property.markings, `Property '${path}'`, markingIds);
+  if (property.primary) {
+    throw new SecurityValidationError2(`[Sixb] Primary property '${path}' cannot carry markings: it identifies the object.`);
+  }
+  if (property.mode === "telemetry") {
+    throw new SecurityValidationError2(`[Sixb] Telemetry property '${path}' cannot carry markings yet.`);
+  }
+}
+function assertSubtypeKeepsParentMarkings(objectType, ontology) {
+  if (!objectType.extends)
+    return;
+  const parent = ontology.getObjectTypeById(objectType.extends);
+  if (!parent)
+    return;
+  for (const parentProperty of parent.properties) {
+    const property = objectType.properties.find((candidate) => candidate.id === parentProperty.id);
+    const missing = missingMarkings(parentProperty.markings, property?.markings);
+    if (missing.length > 0) {
+      throw new SecurityValidationError2(`[Sixb] Property '${objectType.id}.${parentProperty.id}' must keep the markings of '${parent.id}.${parentProperty.id}': add ${missing.map((markingId) => `'${markingId}'`).join(", ")}.`);
+    }
+  }
+}
+function validateColumnMarkings(datasetsById, markingIds) {
+  for (const dataset of datasetsById.values()) {
+    for (const column of dataset.schema.columns) {
+      if (column.markings === undefined)
+        continue;
+      assertMarkingList(column.markings, `Dataset column '${dataset.id}.${column.name}'`, markingIds);
+    }
+  }
+}
+function assertMarkingList(markings, subject, markingIds) {
+  if (!Array.isArray(markings) || markings.length === 0) {
+    throw new SecurityValidationError2(`[Sixb] ${subject} markings must be a non-empty list of marking ids.`);
+  }
+  if (new Set(markings).size !== markings.length) {
+    throw new SecurityValidationError2(`[Sixb] ${subject} lists the same marking twice.`);
+  }
+  for (const markingId of markings) {
+    if (typeof markingId !== "string" || !markingIds.has(markingId)) {
+      throw new SecurityValidationError2(`[Sixb] ${subject} references unknown marking '${String(markingId)}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`);
+    }
+  }
+}
+function rejectPipelineStepsOverMarkedColumns(pipelines, datasetsById) {
+  for (const pipeline of pipelines) {
+    for (const { step } of pipeline.graph.nodes) {
+      for (const input of Object.values(step.inputs)) {
+        const dataset = datasetsById.get(input.id);
+        const column = dataset?.schema.columns.find((candidate) => candidate.markings);
+        if (!dataset || !column)
+          continue;
+        throw new SecurityValidationError2(`[Sixb] Pipeline '${pipeline.id}' step '${step.id}' reads column '${dataset.id}.${column.name}', which carries ${markingList(column.markings)}. Pipeline steps cannot read marked columns yet.`);
+      }
+    }
+  }
+}
+function validateProjectionMarkings(projections, ontology, datasetsById) {
+  for (const projection of projections.listObjects()) {
+    const objectType = ontology.getObjectTypeById(projection.objectTypeId);
+    if (objectType)
+      validateObjectProjection(projection, objectType, datasetsById);
+  }
+  for (const projection of projections.listLinks()) {
+    const role = `keys link '${projection.sourceObjectTypeId}.${projection.linkId}'`;
+    for (const columnName of [projection.sourceField, projection.targetField]) {
+      assertUnmarkedColumn(projection, sourceColumn(projection, columnName, datasetsById), role);
+    }
+  }
+  for (const projection of projections.listTelemetry()) {
+    const columnNames = [
+      projection.objectIdField,
+      projection.atField,
+      ...Object.values(projection.properties).flatMap((mapping) => mapping.unitField === undefined ? [mapping.valueField] : [mapping.valueField, mapping.unitField])
+    ];
+    for (const columnName of columnNames) {
+      const column = sourceColumn(projection, columnName, datasetsById);
+      if (!column.markings)
+        continue;
+      throw new SecurityValidationError2(`[Sixb] Projection '${projection.id}' reads column '${column.path}', which carries ${markingList(column.markings)}. Telemetry projections cannot read marked columns yet.`);
+    }
+  }
+}
+function validateObjectProjection(projection, objectType, datasetsById) {
+  const keyRoles = objectProjectionKeyRoles(projection, objectType);
+  for (const [propertyId, columnName] of Object.entries(projection.properties)) {
+    const column = sourceColumn(projection, columnName, datasetsById);
+    const property = objectType.properties.find((candidate) => candidate.id === propertyId);
+    const path = `${objectType.id}.${propertyId}`;
+    const keyRole = keyRoles.get(propertyId);
+    if (keyRole) {
+      assertUnmarkedColumn(projection, column, keyRole);
+      if (property?.markings) {
+        throw new SecurityValidationError2(`[Sixb] Projection '${projection.id}': property '${path}' ${keyRole} and cannot carry markings.`);
+      }
+      continue;
+    }
+    const missing = missingMarkings(column.markings, property?.markings);
+    if (missing.length > 0) {
+      throw new SecurityValidationError2(`[Sixb] Projection '${projection.id}': property '${path}' is projected from column '${column.path}', which carries ${markingList(column.markings)}. Add markings: ${markingList(missing)} to the property.`);
+    }
+  }
+  for (const [linkId, link] of Object.entries(projection.links)) {
+    if (link.sourceField === undefined)
+      continue;
+    assertUnmarkedColumn(projection, sourceColumn(projection, link.sourceField, datasetsById), `keys link '${objectType.id}.${linkId}'`);
+  }
+  const conflictResolution = projection.conflictResolution;
+  if (conflictResolution?.strategy === "mostRecent") {
+    assertUnmarkedColumn(projection, sourceColumn(projection, conflictResolution.sourceTimestamp, datasetsById), "decides which value wins under 'mostRecent'");
+  }
+}
+function objectProjectionKeyRoles(projection, objectType) {
+  const roles = new Map;
+  for (const property of objectType.properties) {
+    if (property.primary)
+      roles.set(property.id, `becomes the id of '${objectType.id}'`);
+  }
+  for (const [linkId, link] of Object.entries(projection.links)) {
+    if (link.sourcePropertyId === undefined)
+      continue;
+    roles.set(link.sourcePropertyId, `keys link '${objectType.id}.${linkId}'`);
+  }
+  return roles;
+}
+function sourceColumn(projection, columnName, datasetsById) {
+  const column = datasetsById.get(projection.datasetId)?.schema.columns.find((candidate) => candidate.name === columnName);
+  if (!column) {
+    throw new Error(`[Sixb] Projection '${projection.id}' maps unknown column '${columnName}'.`);
+  }
+  return { path: `${projection.datasetId}.${columnName}`, markings: column.markings };
+}
+function assertUnmarkedColumn(projection, column, role) {
+  if (!column.markings)
+    return;
+  throw new SecurityValidationError2(`[Sixb] Projection '${projection.id}': column '${column.path}' ${role} and cannot carry markings.`);
+}
+function missingMarkings(required, declared) {
+  const present = new Set(declared ?? []);
+  return (required ?? []).filter((markingId) => !present.has(markingId));
+}
+function markingList(markings) {
+  return `[${(markings ?? []).join(", ")}]`;
+}
+
 // src/syncs/validation.ts
 function validateKeyedDatasetWriterTopology(input) {
   for (const sync of input.syncs) {
@@ -3079,6 +3573,11 @@ function resolveDefinitions(options) {
     }
   }
   const tools = createAgentToolCatalog(options.tools);
+  const skills = createAgentSkillCatalog(options.agent?.skills);
+  const ontologyDocs = createOntologyDocsCatalog({
+    objectTypes: ontology.listObjectTypes(),
+    ...options.agent?.ontologyDocs === undefined ? {} : { docs: options.agent.ontologyDocs }
+  });
   const connectorsById = indexUniqueDefinitions("connector", options.connectors ?? []);
   const datasetsById = new Map;
   for (const dataset of options.datasets ?? []) {
@@ -3126,10 +3625,12 @@ function resolveDefinitions(options) {
     registeredSchedules: schedulesById,
     registeredActionIds,
     ...models === undefined ? {} : { models },
-    tools
+    tools,
+    skills
   });
   const workflowsById = indexUniqueDefinitions("workflow", workflows);
   const security = new SecurityRegistry({
+    markings: options.markings ?? [],
     groups: options.groups ?? [],
     roles: options.roles ?? [],
     membershipPolicies: options.membershipPolicies ?? [],
@@ -3154,10 +3655,22 @@ function resolveDefinitions(options) {
     syncs,
     telemetryProjections: projectionRegistry.listTelemetry()
   });
+  validateMarkingsAtStartup({
+    markingIds: new Set(security.listMarkings().map((marking) => marking.id)),
+    ontology,
+    datasetsById,
+    pipelines,
+    projections: projectionRegistry
+  });
   return Object.freeze({
     ontology,
     actions: actionRegistry,
     tools,
+    agent: Object.freeze({
+      skills,
+      ...options.agent?.instructions === undefined ? {} : { instructions: options.agent.instructions },
+      ontologyDocs
+    }),
     connectors: createDefinitionCatalog(connectorsById),
     datasets: createDefinitionCatalog(datasetsById),
     ...models === undefined ? {} : { models },
@@ -3277,9 +3790,12 @@ function positiveInteger2(value, name) {
 // src/runtime/host.ts
 class SixbHost2 {
   projectId;
+  locale;
+  timeZone;
   webhookRegistry;
   hostContext;
   committedFacts;
+  vectorIndexing;
   eventService;
   ontologyMaintenance;
   storageReadiness;
@@ -3301,6 +3817,8 @@ class SixbHost2 {
   constructor(options) {
     const errorReporter = attachSixbErrorReporter2(this, options.onError);
     this.projectId = options.id ?? "default";
+    this.locale = resolveProjectLocale(options.locale);
+    this.timeZone = resolveProjectTimeZone(options.timeZone);
     this.broker = options.broker;
     this.eventService = createDomainEventService2({
       projectId: this.projectId,
@@ -3359,15 +3877,21 @@ class SixbHost2 {
         ...failure
       })
     });
+    const vectorIndexing = this.storage.ontology.vectorIndexing;
+    if (vectorIndexing && definitions.ontology.listObjectTypes().some((type) => Object.keys(type.search?.vectors ?? {}).length > 0)) {
+      this.vectorIndexing = new VectorIndexingDispatcher(this.projectId, vectorIndexing, this.queues.vectorIndexing);
+    }
     this.ontologyMaintenance = new OntologyMaintenance({
       projectId: this.projectId,
       storage: this.storage,
       dispatcher: this.committedFacts,
+      vectorIndexing: this.vectorIndexing,
       blobStorage: this.blobStorage,
       options: options.ontologyMaintenance
     });
     this.hostContext = {
       embeddingModels: definitions.models?.embedding,
+      rerankingModels: definitions.models?.reranking,
       projectId: this.projectId,
       broker: this.broker,
       ontology: definitions.ontology,
@@ -3381,7 +3905,8 @@ class SixbHost2 {
     registerVectorIndexingRuntime(this, createVectorIndexingRuntime(this.hostContext, this.materializer));
     this.scheduler = new SchedulerRuntime2({
       schedules: definitions.schedules.list(),
-      events: this.eventService
+      events: this.eventService,
+      timeZone: this.timeZone
     });
   }
   withScope(scope) {
@@ -3392,15 +3917,18 @@ class SixbHost2 {
     }
     const modelExecution = new ModelExecutionSession({ ...this.hostContext, runtimeAuthorization: capturedScope.authorization }, capturedScope.execution);
     const embeddingModels = bindEmbeddingModels(this.hostContext.embeddingModels, modelExecution);
+    const rerankingModels = bindRerankingModels(this.hostContext.rerankingModels, modelExecution);
     const objectReader = createAuthorizedObjectReader({
       scope: capturedScope,
       ontology: this.hostContext.ontology,
       objectStorage: this.storage.objects,
-      embeddingModels
+      embeddingModels,
+      rerankingModels
     });
     const runtime = {
       ...this.hostContext,
       embeddingModels,
+      rerankingModels,
       modelExecution,
       runtimeAuthorization: capturedScope.authorization,
       objectReader,
@@ -3408,7 +3936,10 @@ class SixbHost2 {
     };
     registerOntologyMutationRuntime2(runtime, createOntologyMutationRuntime2({
       materializer: this.materializer.withScope(capturedScope),
-      notifyCommittedFacts: () => this.committedFacts.notify()
+      notifyCommittedFacts: () => {
+        this.committedFacts.notify();
+        this.vectorIndexing?.notify();
+      }
     }));
     return createBoundSixb(runtime, this.sixbDependencies(), capturedScope.execution);
   }
@@ -3442,6 +3973,7 @@ class SixbHost2 {
   }
   async closeBroker() {
     await this.committedFacts.stop();
+    await this.vectorIndexing?.stop();
     await this.ontologyMaintenance.stop();
     await this.broker.close?.();
   }
@@ -3456,10 +3988,29 @@ class SixbHost2 {
       connectorService: this.connectorService,
       ...this.connectorService.connectionProcess === undefined ? {} : { connectorConnections: this.connectorService.connectionProcess },
       blobStorage: this.blobStorage,
+      apiPublicOrigin: () => getApiPublicOrigin(this),
       lakeStorage: this.lakeStorage
     };
   }
 }
+function resolveProjectLocale(locale) {
+  if (locale === undefined)
+    return DEFAULT_PROJECT_LOCALE;
+  const canonical = canonicalLocale(locale);
+  if (canonical === undefined) {
+    throw new RuntimeError2(`[Sixb] 'locale' must be a BCP 47 language tag such as "fr-FR"; received ${JSON.stringify(locale)}.`);
+  }
+  return canonical;
+}
+function resolveProjectTimeZone(timeZone) {
+  if (timeZone === undefined)
+    return DEFAULT_PROJECT_TIME_ZONE;
+  const canonical = canonicalTimeZone(timeZone);
+  if (canonical === undefined) {
+    throw new RuntimeError2(`[Sixb] 'timeZone' must be an IANA time zone such as "Europe/Paris"; received ${JSON.stringify(timeZone)}.`);
+  }
+  return canonical;
+}
 function validateAuthStrategySecurityReferences(strategy, security) {
   if (!isMagicLinkAuthStrategy2(strategy) && !isOidcAuthStrategy2(strategy)) {
     return;
@@ -3486,14 +4037,19 @@ function assertWebhookRunStorage(connectors, storage) {
 async function createSixb2(options) {
   assertNoAgentDefinitions(options);
   const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-  const discoveredOntology = await discoverOntologySources2(projectRoot);
-  const allSources = [...options.ontologies ?? [], ...discoveredOntology];
+  const discoveredOntology = await discoverOntologySources(projectRoot);
+  const allSources = [...options.ontologies ?? [], ...discoveredOntology.sources];
   if (allSources.length === 0) {
     throw new RuntimeError2("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
   }
   const definitions = await discoverProjectDefinitions2(projectRoot);
+  const skills = await discoverAgentSkills(projectRoot);
+  const instructions = await discoverProjectInstructions(projectRoot);
+  const ontologyFiles = await discoverOntologyFiles(projectRoot);
   return new SixbHost2({
     id: options.id,
+    locale: options.locale,
+    timeZone: options.timeZone,
     ontology: allSources,
     broker: options.broker,
     storage: options.storage,
@@ -3516,15 +4072,21 @@ async function createSixb2(options) {
     projections: [...options.projections ?? [], ...definitions.projections],
     rules: [...options.rules ?? [], ...definitions.rules],
     workflows: [...options.workflows ?? [], ...definitions.workflows],
+    markings: [...options.markings ?? [], ...definitions.markings],
     groups: [...options.groups ?? [], ...definitions.groups],
     roles: [...options.roles ?? [], ...definitions.roles],
     membershipPolicies: [...options.membershipPolicies ?? [], ...definitions.membershipPolicies],
     models: options.models,
     tools: options.tools,
+    agent: {
+      skills,
+      ...instructions === undefined ? {} : { instructions },
+      ontologyDocs: { modules: discoveredOntology.modules, ...ontologyFiles }
+    },
     shares: [...options.shares ?? [], ...definitions.shares],
     auth: options.auth
   });
 }
 export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=5D4C3D731AF4BC5E64756E2164756E21
+//# debugId=F00D1642A2671DB564756E2164756E21