@sixb/core 0.1.11 → 0.1.13

package/dist/{chunk-ftv470j8.js → chunk-rqtdtm43.js}

@@ -16,8 +16,13 @@ import {
   telemetryPointSortKey2,
   compareObjectRefs2,
   compareLinkRefs2
-} from "./chunk-c5rkjrgp.js";
+} from "./chunk-7ytf06d3.js";
 import {
+  withFailureMessage
+} from "./chunk-z3y5kg1x.js";
+import {
+  collectUserRefIds,
+  userReferenceProblem,
   normalizeObjectProperties2,
   normalizeSchemaValue2,
   assertKnownProperties2,
@@ -26,7 +31,7 @@ import {
   normalizeLinkProperties2,
   validateLinkProperties2,
   validateTelemetryUnit2
-} from "./chunk-ms2tmn1k.js";
+} from "./chunk-d8yes9yx.js";
 import {
   materializationEventKindOrdinal2,
   sha256Canonical2,
@@ -34,32 +39,38 @@ import {
   createCommitId2,
   createEventId2,
   materializationApplyPhase
-} from "./chunk-gqh45d2n.js";
+} from "./chunk-ht4a7mjg.js";
 import {
   ProjectionValidationError2,
   validateProjectionsAtStartup,
   isProjectionDefinition2,
   resolveExecutionScopeAuthorization
-} from "./chunk-dz5h08xv.js";
+} from "./chunk-rzcjp5m2.js";
 import {
-  isStorageSerializationFailure2
-} from "./chunk-8vj0rjgs.js";
+  objectBatchKey2,
+  vectorConfiguration,
+  vectorSources,
+  normalizeVector2
+} from "./chunk-gc226ten.js";
 import {
   parseDatasetTimestamp2
 } from "./chunk-z667z3sg.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2
-} from "./chunk-17kfctj6.js";
+} from "./chunk-m8zkvep1.js";
+import {
+  isStorageSerializationFailure2
+} from "./chunk-zdkcdshk.js";
 import {
   assertPinnedDatasetWatermark2
-} from "./chunk-wjasrj67.js";
+} from "./chunk-3qpcrcj8.js";
 import {
   MaterializationValidationError2,
   MaterializationObjectNotFoundError2,
   MaterializationCancellationError2,
   MaterializationConflictError2
-} from "./chunk-yv79ncbv.js";
+} from "./chunk-96yw3pwd.js";
 import {
   assertJsonValue2,
   cloneJsonValue2,
@@ -589,6 +600,9 @@ function createMaterializerContext(input) {
   if (computeOntologyRevision2(input.ontology) !== input.projections.ontologyRevision) {
     throw new MaterializationValidationError2("Materializer Ontology does not match the Ontology pinned by its projection registry.");
   }
+  if ((!input.storage.ontology.vectors || !input.storage.ontology.vectorIndexing) && input.ontology.listObjectTypes().some((type) => Object.keys(type.search?.vectors ?? {}).length > 0)) {
+    throw new MaterializationValidationError2("Storage does not support transactional vector profiles and automatic indexing.");
+  }
   const dependencies = input.dependencies ?? {};
   const maxSerializationRetries = dependencies.maxSerializationRetries ?? 2;
   if (!Number.isSafeInteger(maxSerializationRetries) || maxSerializationRetries < 0) {
@@ -645,19 +659,36 @@ async function withSerializationRetry(context, run) {
 
 // src/materializer/execution/scope.ts
 function prepareMaterializerExecution(projectId, scope) {
-  const authorization = resolveExecutionScopeAuthorization(projectId, scope);
-  const base = {
+  resolveExecutionScopeAuthorization(projectId, scope);
+  return {
     scope,
     record: executionRecordInputFromRuntime({
       execution: scope.execution,
       runtimeAuthorization: scope.authorization
     }),
     executionId: scope.execution.id,
-    correlationId: scope.execution.correlationId
+    correlationId: scope.execution.correlationId,
+    attribution: executionAttribution(scope)
   };
-  if (authorization.type !== "principal")
-    return base;
-  return { ...base, actor: authorization.context.principal };
+}
+function executionAttribution(scope) {
+  const { requestedBy, executor } = scope.execution;
+  const attributed = { executor: eventExecutor(executor) };
+  if (requestedBy === undefined)
+    return attributed;
+  return { ...attributed, requestedBy: { type: requestedBy.type, id: requestedBy.id } };
+}
+function eventExecutor(executor) {
+  switch (executor.type) {
+    case "request":
+      return { type: "request", requestId: executor.requestId };
+    case "primitive":
+      return { type: "primitive", kind: executor.kind, id: executor.id, runId: executor.runId };
+    case "agent":
+      return { type: "agent", runId: executor.runId };
+    case "kernel":
+      return { type: "kernel", operation: structuredClone(executor.operation) };
+  }
 }
 function ensureMaterializerExecution(executions, execution) {
   return ensureExecutionRecord2(executions, execution.record);
@@ -787,17 +818,15 @@ function buildTelemetryEventDraft(context, point) {
   };
 }
 function eventDraftBase(context) {
-  const base = {
+  return {
     schemaVersion: 1,
     projectId: context.projectId,
     occurredAt: context.committedAt,
     correlationId: context.correlationId,
     origin: context.origin,
+    ...context.attribution,
     commitId: context.commitId
   };
-  if (context.actor === undefined)
-    return base;
-  return { ...base, actor: context.actor };
 }
 function orderedDraft(sortKey, draft) {
   return {
@@ -814,6 +843,100 @@ function sequenceMaterializationEvent(projectId, commitId, commitOrdinal, draft)
   return { ...draft, ...sequence };
 }
 
+// src/materializer/effective/vector-indexing.ts
+import { randomUUID as randomUUID2 } from "crypto";
+async function scheduleVectorChanges(context, storage, items, session, projection = false) {
+  const indexing = storage.ontology.vectorIndexing;
+  if (!indexing)
+    return;
+  const upserts = items.filter((item) => item.kind === "object-upsert").filter((item) => Object.keys(context.ontology.resolveObjectType(item.value.row.ref.objectTypeId).search?.vectors ?? {}).length > 0);
+  const previous = await storage.objects.getByPrimaryIdBatch({
+    projectId: context.projectId,
+    items: upserts.map((item) => item.value.row.ref)
+  });
+  const requests = [];
+  const deleted = [];
+  const groups = new Map;
+  for (const item of items) {
+    if (item.kind === "object-delete") {
+      deleted.push(item.value.ref);
+      continue;
+    }
+    if (item.kind !== "object-upsert")
+      continue;
+    const row = item.value.row;
+    const profiles = context.ontology.resolveObjectType(row.ref.objectTypeId).search?.vectors ?? {};
+    const before = previous.get(objectBatchKey2(row.ref.objectTypeId, row.ref.primaryId));
+    for (const [profile, definition] of Object.entries(profiles)) {
+      const { sourceFingerprint, text } = vectorSources(definition.source, row.properties);
+      if (before && vectorSources(definition.source, before.properties).sourceFingerprint === sourceFingerprint)
+        continue;
+      const configuration = vectorConfiguration(definition);
+      const bytes = Buffer.byteLength(text);
+      const key = JSON.stringify([row.ref.objectTypeId, profile, configuration, row.lastCommitId]);
+      let group = projection ? groups.get(key) : undefined;
+      if (projection && (!group || group.count === 32 || group.bytes + bytes > 32768)) {
+        group = { id: randomUUID2(), count: 0, bytes: 0 };
+        groups.set(key, group);
+      }
+      if (group) {
+        group.count++;
+        group.bytes += bytes;
+      }
+      requests.push({
+        ...group ? { batchId: group.id } : {},
+        id: randomUUID2(),
+        ref: row.ref,
+        profile,
+        sourceFingerprint,
+        configuration,
+        sourceCommitId: row.lastCommitId
+      });
+    }
+  }
+  if (requests.length || deleted.length)
+    await indexing.schedule({
+      projectId: context.projectId,
+      session,
+      requests,
+      deleted,
+      availableAt: context.clock().toISOString()
+    });
+}
+
+// src/materializer/effective/vectors.ts
+async function invalidateVectorChanges(projectId, vectors, items, session) {
+  if (!vectors)
+    return;
+  const changes = new Map(items.flatMap((item) => {
+    if (item.kind !== "object-upsert" && item.kind !== "object-delete")
+      return [];
+    const ref = item.kind === "object-upsert" ? item.value.row.ref : item.value.ref;
+    return [[objectRefKey2(ref), { ref, item }]];
+  }));
+  if (!changes.size)
+    return;
+  const stored = await vectors.listBatch({
+    projectId,
+    refs: [...changes.values()].map(({ ref }) => ref)
+  });
+  const removals = [];
+  for (const entry of stored) {
+    const change = changes.get(objectRefKey2(entry.ref));
+    if (!change)
+      continue;
+    const { item } = change;
+    if (item.kind === "object-upsert" && entry.source.every((id) => {
+      const value = item.value.row.properties[id];
+      return value === undefined || value === null || typeof value === "string";
+    }) && vectorSources(entry.source, item.value.row.properties).sourceFingerprint === entry.sourceFingerprint)
+      continue;
+    removals.push({ ref: entry.ref, profile: entry.profile, expectedCommitId: entry.lastCommitId });
+  }
+  if (removals.length)
+    await vectors.removeBatch({ session, projectId, entries: removals });
+}
+
 // src/materializer/shared/abort.ts
 function throwIfAborted(signal) {
   if (signal?.aborted) {
@@ -1084,12 +1207,16 @@ async function stageWorkBounded(context, storage, session, records) {
     await storage.stageWork({ session, records: chunk });
   }
 }
-async function drainStagedWork(context, storage, session, signal) {
+async function drainStagedWork(context, transactionStorage, session, signal, projection = false) {
+  const ontologyStorage = transactionStorage.ontology;
+  const storage = ontologyStorage.materializations;
   let phase = null;
   let pending = [];
   const flush = async () => {
     if (pending.length === 0)
       return;
+    await scheduleVectorChanges(context, transactionStorage, pending, session, projection);
+    await invalidateVectorChanges(context.projectId, ontologyStorage.vectors, pending, session);
     await applyItems(context, storage, session, pending, signal);
     pending = [];
   };
@@ -1351,6 +1478,8 @@ function normalizeOntologyEditCommit2(input) {
     return normalized;
   });
   if (input.mode === "continue") {
+    if ("vectorWrites" in input)
+      throw new MaterializationValidationError2("Vector writes require an atomic commit.");
     return Object.freeze({
       mode: "continue",
       source: Object.freeze({
@@ -1369,11 +1498,17 @@ function normalizeOntologyEditCommit2(input) {
     kind: "runtime",
     requestId: normalizeNonblank(input.source.requestId, "Runtime request id")
   });
+  if (input.vectorWrites?.length && (operations.length || input.source.kind !== "runtime")) {
+    throw new MaterializationValidationError2("Vector writes require a dedicated atomic runtime commit.");
+  }
+  if (input.vectorWrites !== undefined)
+    assertJsonValue2(input.vectorWrites, "Vector writes");
   const expectedObjects = input.expectedObjects.map(normalizeExpectedObject);
   const expectedLinks = input.expectedLinks.map(normalizeExpectedLink);
   const expectedLinkScopes = input.expectedLinkScopes.map(normalizeExpectedLinkScope);
   return Object.freeze({
     mode: "atomic",
+    ...input.vectorWrites === undefined ? {} : { vectorWrites: structuredClone(input.vectorWrites) },
     source,
     operations: Object.freeze(operations),
     expectedObjects: deduplicateExpectations(expectedObjects, (value) => objectRefKey2(value.ref), "Expected objects"),
@@ -2165,7 +2300,7 @@ function validateEffectiveObject(ontology, ref, properties) {
     assertKnownProperties2(objectType, properties);
     for (const property of objectType.properties) {
       if (property.mode !== "telemetry" && property.required && properties[property.id] === undefined) {
-        throw new Error(`[Sixb] Missing required property '${property.id}' for object type '${objectType.id}'`);
+        throw withFailureMessage(new Error(`[Sixb] Missing required property '${property.id}' for object type '${objectType.id}'`), `Missing required property '${objectType.id}.${property.id}'.`);
       }
     }
     validateObjectProperties2(objectType, properties, ontology.getValueTypesById());
@@ -2208,7 +2343,7 @@ function materializationValidation(run) {
   } catch (error) {
     if (error instanceof MaterializationValidationError2)
       throw error;
-    throw new MaterializationValidationError2(error instanceof Error ? error.message : String(error));
+    throw new MaterializationValidationError2(error instanceof Error ? error.message : String(error), { cause: error });
   }
 }
 
@@ -2404,16 +2539,71 @@ function sameAuthority(left, right) {
   return stableJsonStringify2(left) === stableJsonStringify2(right);
 }
 
+// src/materializer/edits/user-refs.ts
+var NO_REFERENCED_USERS = { kind: "loaded", statuses: new Map };
+async function loadReferencedUsers(context, operations) {
+  const ids = new Set;
+  for (const operation of operations) {
+    switch (operation.kind) {
+      case "object.create":
+      case "object.upsert":
+        collectObjectUserRefIds(context.ontology, operation.ref.objectTypeId, operation.properties, ids);
+        break;
+      case "object.patch":
+        collectObjectUserRefIds(context.ontology, operation.ref.objectTypeId, operation.set, ids);
+        break;
+      default:
+        break;
+    }
+  }
+  if (ids.size === 0)
+    return NO_REFERENCED_USERS;
+  const users = context.storage.auth?.users;
+  if (!users)
+    return { kind: "unavailable" };
+  const entries = await Promise.all([...ids].map(async (id) => {
+    const user = await users.getById({ projectId: context.projectId, id });
+    return [id, user?.status ?? null];
+  }));
+  return { kind: "loaded", statuses: new Map(entries) };
+}
+function assertIntroducedUsersActive(ontology, objectTypeId, before, after, users) {
+  const objectType = ontology.resolveObjectType(objectTypeId);
+  const valueTypesById = ontology.getValueTypesById();
+  for (const property of objectType.properties) {
+    const introduced = collectUserRefIds(property.schema, after[property.id], valueTypesById, new Set);
+    if (introduced.size === 0)
+      continue;
+    const held = collectUserRefIds(property.schema, before?.[property.id], valueTypesById, new Set);
+    for (const id of introduced) {
+      if (held.has(id))
+        continue;
+      const problem = userReferenceProblem(`Property '${objectTypeId}.${property.id}'`, id, users.kind === "unavailable" ? "unverifiable" : users.statuses.get(id) ?? null);
+      if (problem)
+        throw new MaterializationValidationError2(problem);
+    }
+  }
+}
+function collectObjectUserRefIds(ontology, objectTypeId, properties, into) {
+  const objectType = ontology.getObjectTypeById(objectTypeId);
+  if (!objectType)
+    return;
+  const valueTypesById = ontology.getValueTypesById();
+  for (const property of objectType.properties) {
+    collectUserRefIds(property.schema, properties[property.id], valueTypesById, into);
+  }
+}
+
 // src/materializer/edits/operations.ts
 function undoEditJournal(journal) {
   for (let index = journal.length - 1;index >= 0; index -= 1) {
     journal[index]?.restore();
   }
 }
-function applyEditOperation(context, state, operation, identity, journal) {
+function applyEditOperation(context, state, operation, identity, users, journal) {
   validateOperationRef(context, operation);
   if (isObjectOperation2(operation)) {
-    return applyObjectOperation(context, state, operation, identity, journal);
+    return applyObjectOperation(context, state, operation, identity, users, journal);
   }
   return applyLinkOperation(context, state, operation, linkCardinality(context.ontology, operation.ref), journal);
 }
@@ -2424,7 +2614,7 @@ function validateOperationRef(context, operation) {
   }
   validateLinkRef(context.ontology, operation.ref);
 }
-function applyObjectOperation(context, state, operation, identity, journal) {
+function applyObjectOperation(context, state, operation, identity, users, journal) {
   const working = requireWorkingObject(state, operation);
   const normalized = validateObjectOperation(context, operation);
   const currentEffective = resolveObject(context.ontology, working);
@@ -2437,7 +2627,8 @@ function applyObjectOperation(context, state, operation, identity, journal) {
     effectiveExists: currentEffective !== null,
     ...normalized
   });
-  applyObjectTransition(context, state, working, transition.next, transition.editedAt, journal);
+  const assertUsers = operation.kind === "object.restore" ? undefined : (resolved) => assertIntroducedUsersActive(context.ontology, operation.ref.objectTypeId, currentEffective?.properties, resolved.properties, users);
+  applyObjectTransition(context, state, working, transition.next, transition.editedAt, journal, assertUsers);
   return objectOperationOutcome(operation, working, transition.changed, context, identity);
 }
 function requireWorkingObject(state, operation) {
@@ -2464,15 +2655,17 @@ function validateObjectOperation(context, operation) {
       return {};
   }
 }
-function applyObjectTransition(context, state, working, next, nextEditedAt, journal) {
+function applyObjectTransition(context, state, working, next, nextEditedAt, journal, validateResolved) {
   const previous = working.override;
   const previousEditedAt = working.editedAt;
   working.override = next;
   working.editedAt = { ...nextEditedAt };
   try {
     const resolved = resolveObject(context.ontology, working);
-    if (resolved)
+    if (resolved) {
       validateEffectiveObject(context.ontology, resolved.ref, resolved.properties);
+      validateResolved?.(resolved);
+    }
     validateWorkingCardinality(state.links.slots);
   } catch (error) {
     working.override = previous;
@@ -2723,16 +2916,14 @@ function buildLinkEvent(context, planContext, change) {
   return buildLinkMaterializationEventDraft({ ...eventContext, change });
 }
 function materializationEventContext(context, planContext) {
-  const base = {
+  return {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
     origin: planContext.origin,
-    correlationId: planContext.correlationId
+    correlationId: planContext.correlationId,
+    attribution: planContext.attribution
   };
-  if (planContext.actor === undefined)
-    return base;
-  return { ...base, actor: planContext.actor };
 }
 function sortedObjects(objects) {
   return [...objects.values()].sort((left, right) => compareObjectRefs2(left.ref, right.ref));
@@ -2744,12 +2935,121 @@ function sortedLinkSlots(slots) {
   return [...slots.values()].sort((left, right) => linkScopeKey(left.ref.source, left.ref.linkId).localeCompare(linkScopeKey(right.ref.source, right.ref.linkId)));
 }
 
+// src/materializer/edits/vector-authority.ts
+async function authorizeVectorIndexingCommit(storage, projectId, input, execution) {
+  const executor = execution.scope.execution.executor;
+  if (executor.type !== "kernel" || executor.operation.type !== "ontology.indexVectors")
+    return false;
+  if (input.mode !== "atomic" || input.source.kind !== "runtime" || input.operations.length || !input.vectorWrites?.length || input.expectedLinks.length || input.expectedLinkScopes.length) {
+    throw new MaterializationValidationError2("Vector indexing authority only permits its persisted vector writes.");
+  }
+  const writes = input.vectorWrites;
+  const refs = new Set(writes.map((write) => objectRefKey2(write.input.ref)));
+  if (input.expectedObjects.length !== refs.size || input.expectedObjects.some((expected) => !refs.has(objectRefKey2(expected.ref)))) {
+    throw new MaterializationValidationError2("Vector indexing must fence exactly its written objects.");
+  }
+  const indexing = storage.ontology.vectorIndexing;
+  const indexingId = executor.operation.indexingId;
+  const single = await indexing?.get({ projectId, id: indexingId });
+  if (single && writes.length !== 1) {
+    throw new MaterializationValidationError2("Individual indexing authority only permits one vector write.");
+  }
+  let members;
+  if (single) {
+    members = [single];
+  } else if (writes.length === 1) {
+    const member = await indexing?.getBatchMember({
+      projectId,
+      batchId: indexingId,
+      ref: writes[0].input.ref,
+      profile: writes[0].input.profile
+    });
+    members = member ? [member] : [];
+  } else {
+    members = await indexing?.getBatch({ projectId, batchId: indexingId }) ?? [];
+  }
+  const byProfile = new Map(members.map((work) => [JSON.stringify([objectRefKey2(work.ref), work.profile]), work]));
+  const source = execution.scope.execution.source;
+  for (const write of writes) {
+    const work = byProfile.get(JSON.stringify([objectRefKey2(write.input.ref), write.input.profile]));
+    if (!work || work.status !== "ready") {
+      throw new MaterializationConflictError2("effective-state", "Vector indexing work is no longer ready.");
+    }
+    if (source.type !== "ontologyCommit" || source.commitId !== work.sourceCommitId || !matchesStoredResult(write, work)) {
+      throw new MaterializationValidationError2("Vector indexing authority only permits its current prepared representation.");
+    }
+  }
+  return true;
+}
+function matchesStoredResult(write, work) {
+  const prepared = write.input;
+  return prepared.ref.objectTypeId === work.ref.objectTypeId && prepared.ref.primaryId === work.ref.primaryId && prepared.profile === work.profile && prepared.configuration === work.configuration && prepared.sourceFingerprint === work.sourceFingerprint && work.values !== undefined && work.values.length === write.values.length && work.values.every((value, index) => value === write.values[index]);
+}
+
+// src/materializer/edits/vectors.ts
+async function commitVectorWrites(context, storage, input, commitId, session) {
+  if (input.mode !== "atomic" || !input.vectorWrites?.length)
+    return;
+  const vectors = storage.ontology.vectors;
+  if (!vectors)
+    throw new MaterializationValidationError2("Storage does not support vector profiles.");
+  const rows = await storage.objects.getByPrimaryIdBatch({
+    projectId: context.projectId,
+    items: input.vectorWrites.map((write) => write.input.ref)
+  });
+  const expectations = new Map(input.expectedObjects.map((expected) => [objectRefKey2(expected.ref), expected]));
+  const entries = [];
+  const seen = new Set;
+  for (const write of input.vectorWrites) {
+    const prepared = write.input;
+    const key = JSON.stringify([objectRefKey2(prepared.ref), prepared.profile]);
+    if (seen.has(key))
+      throw new MaterializationValidationError2(`Duplicate vector write: ${key}`);
+    seen.add(key);
+    const profileDefinition = context.ontology.resolveObjectType(prepared.ref.objectTypeId).search?.vectors?.[prepared.profile];
+    if (prepared.projectId !== context.projectId || !profileDefinition || vectorConfiguration(profileDefinition) !== prepared.configuration) {
+      throw new MaterializationConflictError2("effective-state", "Vector profile configuration changed; index it again.");
+    }
+    const expected = expectations.get(objectRefKey2(prepared.ref));
+    if (!expected?.exists || !prepared.expectedObject?.exists || objectRefKey2(prepared.expectedObject.ref) !== objectRefKey2(prepared.ref) || expected.version !== prepared.expectedObject.version || expected.lastCommitId !== prepared.expectedObject.lastCommitId) {
+      throw new MaterializationValidationError2("Vector writes must fence their prepared object revision.");
+    }
+    const row = rows.get(objectBatchKey2(prepared.ref.objectTypeId, prepared.ref.primaryId));
+    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId || vectorSources(profileDefinition.source, row.properties).sourceFingerprint !== prepared.sourceFingerprint) {
+      throw new MaterializationConflictError2("effective-state", "Vector sources changed; index the profile again.");
+    }
+    entries.push({
+      expectedCommitId: prepared.expectedVectorCommitId,
+      value: {
+        ref: prepared.ref,
+        profile: prepared.profile,
+        configuration: prepared.configuration,
+        source: profileDefinition.source,
+        sourceFingerprint: prepared.sourceFingerprint,
+        values: normalizeVector2(write.values, profileDefinition.model.definition.dimensions),
+        lastCommitId: commitId
+      }
+    });
+  }
+  await vectors.writeBatch({ session, projectId: context.projectId, entries });
+  await storage.ontology.vectorIndexing?.complete({
+    session,
+    projectId: context.projectId,
+    entries: input.vectorWrites.map(({ input: prepared }) => ({
+      ref: prepared.ref,
+      profile: prepared.profile,
+      configuration: prepared.configuration,
+      sourceFingerprint: prepared.sourceFingerprint
+    }))
+  });
+}
+
 // src/materializer/edits/commit.ts
 async function commitEdits(context, raw) {
-  const command = prepareEditCommit(context, raw);
+  const command = await prepareEditCommit(context, raw);
   return executeEditCommit(context, command);
 }
-function prepareEditCommit(context, raw) {
+async function prepareEditCommit(context, raw) {
   const input = normalizeOntologyEditCommit2(raw.input);
   const idempotencyKey = editIdempotencyKey(input);
   const identity = createTimedCommitIdentity2({
@@ -2762,7 +3062,8 @@ function prepareEditCommit(context, raw) {
     input,
     identity,
     origin: input.source,
-    execution: prepareMaterializerExecution(context.projectId, raw.scope)
+    execution: prepareMaterializerExecution(context.projectId, raw.scope),
+    users: await loadReferencedUsers(context, input.operations)
   };
 }
 function editIdempotencyKey(input) {
@@ -2785,6 +3086,8 @@ async function lockActionRunForMaterialization(storage, projectId, input, execut
   assertMaterializerRunExecution(execution, run.executionId, `Action run '${run.id}'`);
 }
 async function validateMutationExecution(storage, projectId, input, execution) {
+  if (await authorizeVectorIndexingCommit(storage, projectId, input, execution))
+    return;
   if (input.source.kind !== "action") {
     assertRuntimeMutationExecution(execution);
     return;
@@ -2822,7 +3125,8 @@ async function executeEditTransaction(context, storage, command) {
   const workingState = await loadEditWorkingState(context, storage.ontology.materializations, session, command.input.operations);
   const outcomes = applyEditOperations(context, workingState, command);
   const changes = await stageEditPlan(context, storage.ontology.materializations, session, workingState, editPlanContext(command));
-  await drainStagedWork(context, storage.ontology.materializations, session);
+  await drainStagedWork(context, storage, session);
+  await commitVectorWrites(context, storage, command.input, command.identity.commitId, session);
   const eventCount = await drainStagedEvents(context, storage.ontology.materializations, session, command.identity);
   const result = {
     kind: "edit",
@@ -2847,24 +3151,23 @@ async function beginEditMaterialization(context, storage, command) {
   });
 }
 function buildEditCommit(context, command) {
-  const commit = {
+  return {
     projectId: context.projectId,
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
     executionId: command.execution.executionId,
     origin: command.origin,
+    ...command.execution.attribution,
     ontologyRevision: context.projectionRegistry.ontologyRevision,
     intent: {
       kind: "edit",
       mode: command.input.mode,
-      operationCount: command.input.operations.length
+      operationCount: command.input.operations.length,
+      ...command.input.mode === "atomic" && command.input.vectorWrites?.length ? { vectorWriteCount: command.input.vectorWrites.length } : {}
     },
     committedAt: command.identity.committedAt
   };
-  if (command.execution.actor === undefined)
-    return commit;
-  return { ...commit, actor: command.execution.actor };
 }
 function editExpectations(input) {
   if (input.mode === "atomic") {
@@ -2892,7 +3195,7 @@ function applyEditExecutionUnit(context, state, command, unit) {
 }
 function applyOneEditOperation(context, state, operation, command) {
   try {
-    return applyEditOperation(context, state, operation, command.identity);
+    return applyEditOperation(context, state, operation, command.identity, command.users);
   } catch (error) {
     if (!isRecoverableEditValidation(command.input, error))
       throw error;
@@ -2905,7 +3208,7 @@ function applyEditOperationGroup(context, state, command, group) {
   for (const operation of group) {
     let outcome;
     try {
-      outcome = applyEditOperation(context, state, operation, command.identity, journal);
+      outcome = applyEditOperation(context, state, operation, command.identity, command.users, journal);
     } catch (error) {
       if (!isRecoverableEditValidation(command.input, error))
         throw error;
@@ -2933,14 +3236,12 @@ function isRecoverableEditValidation(input, error) {
   return error instanceof MaterializationValidationError2;
 }
 function editPlanContext(command) {
-  const context = {
+  return {
     identity: command.identity,
     origin: command.origin,
-    correlationId: command.execution.correlationId
+    correlationId: command.execution.correlationId,
+    attribution: command.execution.attribution
   };
-  if (command.execution.actor === undefined)
-    return context;
-  return { ...context, actor: command.execution.actor };
 }
 async function finalizeEditMaterialization(storage, session, result) {
   const applied = await storage.ontology.materializations.finalize({
@@ -3289,6 +3590,7 @@ function appendObjectChangeWork(work, sortKey, context, input, change) {
     committedAt: input.identity.committedAt,
     origin: input.origin,
     correlationId: input.correlationId,
+    attribution: input.attribution,
     change
   })));
 }
@@ -3429,6 +3731,7 @@ function appendLinkChangeWork(work, sortKey, context, input, change) {
     committedAt: input.identity.committedAt,
     origin: input.origin,
     correlationId: input.correlationId,
+    attribution: input.attribution,
     change
   })));
 }
@@ -3707,7 +4010,7 @@ async function executeProjectionTransaction(context, storage, command, ready) {
     }
   });
   const counts = await planReadyProjection(context, storage.ontology.materializations, session, command, ready, origin);
-  await drainStagedWork(context, storage.ontology.materializations, session, command.signal);
+  await drainStagedWork(context, storage, session, command.signal, true);
   const eventCount = await drainStagedEvents(context, storage.ontology.materializations, session, ready.identity, command.signal);
   const result = {
     kind: "projection",
@@ -3747,6 +4050,7 @@ function projectionCommit(projectId, command, identity, origin) {
     requestHash: identity.requestHash,
     executionId: command.scopeExecution.executionId,
     origin,
+    ...command.scopeExecution.attribution,
     ontologyRevision: command.runIdentity.ontologyRevision,
     projectionRevision: command.runIdentity.projectionRevision,
     ownershipHash: command.runIdentity.ownershipHash,
@@ -3761,7 +4065,8 @@ async function planReadyProjection(context, storage, session, command, ready, or
     projectionKind: command.projectionKind,
     identity: ready.identity,
     origin,
-    correlationId: command.scopeExecution.correlationId
+    correlationId: command.scopeExecution.correlationId,
+    attribution: command.scopeExecution.attribution
   };
   if (command.signal === undefined) {
     return planProjectionReplacement(context, storage, session, input);
@@ -3996,16 +4301,14 @@ async function stageTelemetryObjectPlan(context, storage, session, planContext,
   await stageWorkBounded(context, storage, session, work);
 }
 function telemetryEventContext(context, planContext) {
-  const eventContext = {
+  return {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
     origin: planContext.origin,
-    correlationId: planContext.event.correlationId
+    correlationId: planContext.event.correlationId,
+    attribution: planContext.event.attribution
   };
-  if (planContext.event.actor === undefined)
-    return eventContext;
-  return { ...eventContext, actor: planContext.event.actor };
 }
 function emptyTelemetryCounts() {
   return {
@@ -4204,9 +4507,9 @@ async function executeTelemetryTransaction(context, storage, command) {
   const session = await beginTelemetryMaterialization(context, storage, command, origin);
   const counts = await planTelemetryAppend(context, storage.ontology.materializations, session, command.input, command.identity, origin, {
     correlationId: command.execution.correlationId,
-    ...command.execution.actor === undefined ? {} : { actor: command.execution.actor }
+    attribution: command.execution.attribution
   });
-  await drainStagedWork(context, storage.ontology.materializations, session);
+  await drainStagedWork(context, storage, session);
   const eventCount = await drainStagedEvents(context, storage.ontology.materializations, session, command.identity);
   const result = {
     kind: "telemetry",
@@ -4254,24 +4557,19 @@ function telemetryCommit(projectId, command, origin) {
     requestHash: command.identity.requestHash,
     executionId: command.execution.executionId,
     origin,
+    ...command.execution.attribution,
     ontologyRevision: command.ontologyRevision,
     intent: telemetryCommitIntent(command),
     committedAt: command.identity.committedAt
   };
-  const withActor = telemetryCommitActor(base, command);
   if (command.kind === "runtime")
-    return withActor;
+    return base;
   return {
-    ...withActor,
+    ...base,
     projectionRevision: command.resolvedProjection.projectionRevision,
     ownershipHash: command.resolvedProjection.ownershipHash
   };
 }
-function telemetryCommitActor(commit, command) {
-  if (command.execution.actor === undefined)
-    return commit;
-  return { ...commit, actor: command.execution.actor };
-}
 function telemetryCommitIntent(command) {
   if (command.kind === "runtime") {
     return {
@@ -4366,4 +4664,4 @@ function createOntologyMaterializer2(input) {
 }
 export { computeOntologyRevision2, computeProjectionRevision2, computeProjectionOwnershipHash2, ProjectionRegistry2, createActionIdempotencyKey2, createRuntimeIdempotencyKey2, createProjectionIdempotencyKey2, createRuntimeTelemetryIdempotencyKey2, createProjectionTelemetryIdempotencyKey2, createCommitIdentity2, timestampCommitIdentity2, createTimedCommitIdentity2, createProjectionMaterializationId2, createLinkScopeFingerprint2, normalizeJsonProperties2, normalizeOntologyEditCommit2, normalizeProjectionExecution2, normalizeProjectionSourceEntry2, normalizeTelemetryAppend2, OntologyMaterializer2, createOntologyMaterializer2 };
 
-//# debugId=45B690D58E462D3C64756E2164756E21
+//# debugId=61B9FC5452B219F064756E2164756E21