@sixb/core 0.1.11 → 0.1.13

package/src/execution/authorized-object-reader.ts

@@ -1,6 +1,8 @@
+import { assertNever } from "../assert-never"
 import { assertAuthorized, isAllowed } from "../authorization"
 import { AuthorizationError } from "../authorization/errors"
 import type { AuthorizationContext } from "../authorization/types"
+import type { EmbeddingModelCatalog } from "../models/catalog"
 import {
   type AuthorizedOntologySelection,
   type AuthorizedOntologyView,
@@ -84,6 +86,7 @@ class AuthorizedObjectReaderImpl {
   readonly #authority: ResolvedExecutionAuthority
   readonly #runtime: RuntimeReadAuthorization
   readonly #ontology: OntologyRegistry
+  readonly #embeddingModels?: EmbeddingModelCatalog
   #ontologyView?: AuthorizedOntologyView
   readonly #storage: ObjectReadStorage
   readonly #delegatedObjectTypeIds?: ReadonlySet<string>
@@ -95,6 +98,7 @@ class AuthorizedObjectReaderImpl {
     input: {
       readonly scope: ExecutionScope
       readonly ontology: OntologyRegistry
+      readonly embeddingModels?: EmbeddingModelCatalog
       readonly storage: ObjectReadStorage
       readonly authority: ResolvedExecutionAuthority
     }
@@ -106,6 +110,7 @@ class AuthorizedObjectReaderImpl {
     this.#authorization = input.scope.authorization
     this.#authority = input.authority
     this.#ontology = input.ontology
+    this.#embeddingModels = input.embeddingModels
     this.#storage = input.storage
     this.#delegatedObjectTypeIds =
       input.authority.type === "delegated"
@@ -316,6 +321,7 @@ class AuthorizedObjectReaderImpl {
           query: executionQuery,
           ...(includeTotal === undefined ? {} : { includeTotal }),
           projectId: this.#runtime.projectId,
+          signal: input.signal,
         },
         this.#queryExecutorOptions()
       )
@@ -459,10 +465,15 @@ class AuthorizedObjectReaderImpl {
       // The selected storage instance is the private execution capability. Passing the delegated
       // runtime token into the generic executor would either reject this admitted query or tempt a
       // forgeable bypass flag; neither is needed at this nominal boundary.
-      return { ontology: this.#ontology, storage: this.#storage }
+      return {
+        ontology: this.#ontology,
+        storage: this.#storage,
+        embeddingModels: this.#embeddingModels,
+      }
     }
     return {
       ontology: this.#ontology,
+      embeddingModels: this.#embeddingModels,
       storage: this.#storage,
       runtimeAuthorization: this.#runtime.runtimeAuthorization,
       ...(this.#runtime.authorization === undefined
@@ -546,6 +557,7 @@ export type AuthorizedObjectReader = AuthorizedObjectReaderImpl
 export function createAuthorizedObjectReader(input: {
   readonly scope: ExecutionScope
   readonly ontology: OntologyRegistry
+  readonly embeddingModels?: EmbeddingModelCatalog
   readonly objectStorage: ObjectStorage
 }): AuthorizedObjectReader {
   const scope = captureExecutionScope(input.scope)
@@ -555,6 +567,7 @@ export function createAuthorizedObjectReader(input: {
   const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
     scope,
     ontology: input.ontology,
+    embeddingModels: input.embeddingModels,
     storage,
     authority,
   })
@@ -590,16 +603,13 @@ function objectStorageForAuthority(
         limits: authority.objectRead.limits,
       })
     default:
-      return assertNever(authority)
+      return assertNever(
+        authority,
+        `[Sixb] Unsupported object reader authority '${String((authority as { type?: unknown }).type)}'.`
+      )
   }
 }
 
-function assertNever(value: never): never {
-  throw new Error(
-    `[Sixb] Unsupported object reader authority '${String((value as { type?: unknown }).type)}'.`
-  )
-}
-
 function ontologySelectionForAuthority(
   authority: ResolvedExecutionAuthority,
   ontology: OntologyRegistry
@@ -681,7 +691,30 @@ function snapshotFacetRequests(facets: readonly ObjectFacetRequest[]): ObjectFac
 /** Capture one serializable query before either authorization or execution sees it. */
 function snapshotAuthoredQuery(query: ObjectQuery): ObjectQuery {
   try {
-    return structuredClone(query)
+    const snapshot = structuredClone(query)
+    const pending = [snapshot]
+    const seen = new Set<ObjectQuery>()
+    for (const node of pending) {
+      if (seen.has(node)) continue
+      seen.add(node)
+      if (
+        node.kind === "vector" &&
+        (typeof node.vector !== "string" ||
+          typeof node.profile !== "string" ||
+          "propertyId" in node)
+      ) {
+        throw new ObjectQueryValidationError([
+          {
+            path: "$",
+            code: "invalid_vector_search_input",
+            message: "Vector search requires a named profile and search text",
+          },
+        ])
+      }
+      if ("input" in node) pending.push(node.input)
+      if (node.kind === "set") pending.push(...node.inputs)
+    }
+    return snapshot
   } catch (error) {
     if (error instanceof ObjectQueryValidationError) throw error
     throw new ObjectQueryValidationError([

package/src/execution/kernel-operation.ts

@@ -0,0 +1,27 @@
+import type { KernelOperation } from "./types"
+
+export function kernelOperationId(operation: KernelOperation): string {
+  switch (operation.type) {
+    case "ontology.recover":
+      return operation.recoveryId
+    case "ontology.indexVectors":
+      return operation.indexingId
+    default:
+      return unknownOperation(operation)
+  }
+}
+
+export function kernelOperationFromId(type: KernelOperation["type"], id: string): KernelOperation {
+  switch (type) {
+    case "ontology.recover":
+      return { type, recoveryId: id }
+    case "ontology.indexVectors":
+      return { type, indexingId: id }
+    default:
+      return unknownOperation(type)
+  }
+}
+
+function unknownOperation(_operation: never): never {
+  throw new Error("[Sixb] Unknown kernel operation.")
+}

package/src/execution/primitive.ts

@@ -1,5 +1,4 @@
 import { bindModelExecutionAttempt, type ModelExecutionAttempt } from "../models/execution/binding"
-import type { OntologySource } from "../ontology"
 import type { OntologyMutationRuntime } from "../runtime/ontology-mutations"
 import { getOntologyMutationRuntime } from "../runtime/ontology-mutations"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
@@ -14,7 +13,7 @@ export interface PrimitiveExecutionHost {
 }
 
 export interface BoundPrimitiveExecution {
-  readonly sixb: Sixb<readonly OntologySource[]>
+  readonly sixb: Sixb
   /** Internal mutation port guarded by the same runtime authority as `sixb`. */
   readonly ontologyMutations: OntologyMutationRuntime
 }

package/src/execution/request.ts

@@ -1,7 +1,6 @@
 import { randomUUID } from "node:crypto"
 import type { AuthorizationContext } from "../authorization"
 import { bindModelExecutionAttempt } from "../models/execution/binding"
-import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 import {
   objectReadScopeForAccessPlan,
@@ -97,7 +96,7 @@ export interface RequestExecutionHost {
 export function bindRequestExecution(
   host: RequestExecutionHost,
   input: BindRequestExecutionInput
-): Sixb<readonly OntologySource[]> {
+): Sixb {
   const requestId = requestIdentifier(input.request)
   const correlationId = correlationIdentifier(input.request, requestId)
   const scope = createRequestScope(host.id, requestId, correlationId, input.authorization)

package/src/execution/scopes.ts

@@ -197,6 +197,8 @@ function sourceIdentifier(source: ExecutionSource): {
   readonly value: string
 } {
   switch (source.type) {
+    case "ontologyCommit":
+      return { label: "Execution source commit id", value: source.commitId }
     case "http":
       return { label: "Execution source request id", value: source.requestId }
     case "webhook":

package/src/execution/types.ts

@@ -26,10 +26,9 @@ export interface SharedAccessDelegationRef {
   readonly sessionId: string
 }
 
-export type KernelOperation = {
-  readonly type: "ontology.recover"
-  readonly recoveryId: string
-}
+export type KernelOperation =
+  | { readonly type: "ontology.recover"; readonly recoveryId: string }
+  | { readonly type: "ontology.indexVectors"; readonly indexingId: string }
 
 /** Workload currently executing. This is provenance and never grants authority by itself. */
 export type ExecutionExecutor =
@@ -49,6 +48,7 @@ export type ExecutionExecutor =
  * An `execution` source is the single logical parent of a nested execution.
  */
 export type ExecutionSource =
+  | { readonly type: "ontologyCommit"; readonly commitId: string }
   | { readonly type: "http"; readonly requestId: string }
   | { readonly type: "webhook"; readonly deliveryId: string }
   | { readonly type: "schedule"; readonly eventId: string }

package/src/index.ts

@@ -20,6 +20,7 @@ export type {
   ObjectLink,
   ObjectLinkTargetMetadata,
   ObjectLinkTargetType,
+  ObjectPropertiesMetadata,
   ObjectRef,
   ObjectRefSchema,
   ObjectSchema,
@@ -27,6 +28,7 @@ export type {
   ObjectTypeSearchMetadata,
   ObjectTypeWithPropertyTokens,
   ObjectTypeWithTokens,
+  ObjectVectorSearchProfile,
   Ontology,
   OntologyDefinitionCatalog,
   OntologyRegistryOptions,
@@ -39,6 +41,8 @@ export type {
   Schema,
   SchemaOrRef,
   SixbObjectTypeMap,
+  SixbValueTypeMap,
+  UserRef,
   ValueType,
   ValueTypeRefSchema,
 } from "./ontology"
@@ -55,6 +59,7 @@ export {
   prop,
   ref,
   stringEnum,
+  userRef,
   valueTypeRef,
 } from "./ontology"
 
@@ -74,9 +79,6 @@ export type {
   ActionParamConfig,
   ActionParamsConfig,
   ActionReadFacade,
-  ActionReadObjectByIdHandle,
-  ActionReadObjectSet,
-  ActionReadObjectSetSource,
   ActionRunPhaseInfo,
   ActionRuntimeFacade,
   ActionSubject,
@@ -246,8 +248,8 @@ export type {
   DatasetVersionCommittedEvent,
   DomainEvent,
   DomainEventLog,
-  EventActor,
   EventDraft,
+  EventExecutor,
   EventOrigin,
   EventPropertySelector,
   EventScopeKeys,
@@ -411,7 +413,6 @@ export type {
   MembershipCapabilities,
   MembershipOperationCapabilities,
   Principal,
-  SecurityContext,
   SixbAuthConfig,
 } from "./auth"
 export {
@@ -600,6 +601,7 @@ export type {
   SandboxFileRecord,
   SandboxNetworkPolicy,
   SandboxNetworkTarget,
+  SandboxRequestCredential,
   SandboxSessionOptions,
   SandboxStatus,
 } from "./sandboxes"
@@ -897,6 +899,7 @@ export type {
   SixbRunFailedContext,
   SixbRunFailureByKind,
   SixbRunIdentityByKind,
+  SixbVectorIndexingFailedContext,
 } from "./error-reporting/types"
 export type { SixbErrorCode, SixbFailure } from "./errors/types"
 export type { EventsRuntime } from "./events/execution"
@@ -922,6 +925,10 @@ export type {
   ObjectQueryLinksResult,
   ObjectsRuntime,
 } from "./objects/execution"
+export type {
+  ObjectVectorHandle,
+  VectorProfileName,
+} from "./objects/vectors/types"
 export type { PipelineRunsRuntime, PipelinesRuntime } from "./pipelines/execution"
 export type {
   ProjectionRunsRuntime,
@@ -944,6 +951,9 @@ export type {
   ObjectQueryFacetResult,
   ObjectQueryListOptions,
   ObjectQueryRow,
+  ObjectReadByIdHandle,
+  ObjectReader,
+  ObjectReadSet,
   ObjectSet,
   ObjectSetListInput,
   ObjectSetQueryPropertyToken,
@@ -951,8 +961,6 @@ export type {
   ObjectWhereClause,
   OntologyDocumentInput,
   OntologySource,
-  RegisteredObjectType,
-  RegisteredValueTypes,
   SchedulerController,
   Sixb,
   SixbDefinitions,
@@ -990,6 +998,7 @@ export type {
   WebhookRunFailureCode,
   WorkflowRunFailureCode,
 } from "./storage"
+export type { VectorIndexingFailureCode } from "./storage/ontology/vector-indexing"
 export type { SyncRunsRuntime, SyncsRuntime } from "./syncs/execution"
 export type {
   LatestWorkflowRunListResult,
@@ -1066,16 +1075,51 @@ export {
   MAX_AGENT_APP_STATE_TOTAL_BYTES,
   MAX_AGENT_CONTEXT_ENTRIES,
 } from "./agents"
-export type { AgentThreadRecord, ListAgentThreadsResult } from "./storage/agents"
+export type { SandboxSourceAuth, SandboxSourceCredentials } from "./sandboxes/auth"
+export type {
+  SandboxConfig,
+  SandboxDefinition,
+  SandboxEnvironment,
+  SandboxResolveContext,
+  SandboxSource,
+} from "./sandboxes/configuration"
+export type { ParamOptions } from "./shared/params/builders"
+export type { InferParams, ParamConfig, ParamsConfig } from "./shared/params/types"
+export type {
+  AgentThreadRecord,
+  AgentThreadSandboxParams,
+  AgentThreadSandboxState,
+  ListAgentThreadsResult,
+} from "./storage/agents"
 
 // ── Models ──────────────────────────────────────────────────
 
 export type {
+  EmbeddingBatchLimits,
+  EmbeddingModel,
+  EmbeddingModelCatalog,
+  EmbeddingModelDefinition,
+  EmbeddingModelEntry,
+  EmbeddingModelRef,
+  EmbeddingModelRequest,
+  EmbeddingModelResponseMetadata,
+  EmbeddingModelResult,
   LanguageModelCatalog,
   LanguageModelEntry,
   LanguageModelRef,
+  ModelCallCost,
   ModelCatalog,
   ModelCatalogInput,
+  ModelCostComponent,
+  ModelCostEstimate,
+  ModelCostEstimator,
+  ModelCostMeter,
+  ModelMoney,
+  ModelProviderIds,
+  ModelRef,
+  ModelReportedCost,
+  ModelRoute,
+  ModelUsage,
 } from "./models"
 export type {
   InferLanguageModelOutput,
@@ -1098,6 +1142,22 @@ export type {
   ActionParamDescriptor,
   ActionPhaseDescriptor,
 } from "./actions/descriptor"
+export type { DecisionAnswerSchema, DecisionOutputShape } from "./models/decision/output"
+export { decisionOutput } from "./models/decision/output"
+export { question } from "./models/decision/questions"
+export type {
+  ChoiceQuestion,
+  DecisionAnswer,
+  DecisionAnswers,
+  DecisionContent,
+  DecisionEvaluateInput,
+  DecisionEvaluateResult,
+  DecisionModelsRuntime,
+  DecisionQuestion,
+  DecisionQuestions,
+  ProbabilityQuestion,
+  ScoreQuestion,
+} from "./models/decision/types"
 export type {
   ForeignKeyDescriptor,
   LinkProjectionDefinition,

package/src/lake-storage/in-memory.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto"
 import { isDeepStrictEqual } from "node:util"
 import type { DatasetDefinition, DatasetSchema, MergeChange } from "../datasets"
-import { getDatasetRowValidationError } from "../datasets/validation"
+import { getDatasetRowValidationFailure } from "../datasets/validation"
 import { resolveDatasetChangeColumns } from "./changes"
 import { mergeStrictDatasetDefinition } from "./definition-updates"
 import { LakeConcurrencyError, LakeStorageError } from "./errors"
@@ -113,9 +113,11 @@ class InMemoryLakeWriteSession implements LakeWriteSession {
     const stagedRows: DatasetRow[] = []
     const stagedPrimaryKeys = new Set<string>()
     for await (const row of rows) {
-      const validationError = getDatasetRowValidationError(row, this.input.dataset)
+      const validationError = getDatasetRowValidationFailure(row, this.input.dataset)
       if (validationError) {
-        throw new LakeStorageError(`[LakeStorage] ${validationError}`)
+        throw new LakeStorageError(`[LakeStorage] ${validationError.message}`, {
+          cause: validationError,
+        })
       }
 
       if (getDatasetPrimaryKeyColumns(this.input.dataset) !== null) {

package/src/maintenance/ontology-maintenance.ts

@@ -1,5 +1,11 @@
+import { type BlobStorage, supportsDirectUpload } from "../blob-storage"
 import type { OntologyOutboxDispatcher } from "../events"
-import type { Storage } from "../storage"
+import {
+  type FileUploadSession,
+  FileUploadSessionError,
+  type FileUploadSessionStore,
+  type Storage,
+} from "../storage"
 import type {
   OntologyMaintenanceCleanupSnapshot,
   OntologyMaintenanceHandle,
@@ -14,11 +20,17 @@ const DEFAULT_CLEANUP_LIMIT = 1_000
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 30_000
 const DEGRADED_ATTEMPT_THRESHOLD = 3
 const DEGRADED_FAILURE_THRESHOLD = 2
+// A request that passed the expiry gate may still be finishing blob I/O, and the API clock may
+// run ahead of the database's; the sweep leaves sessions alone until this long past expiry.
+const ABANDONED_UPLOAD_SWEEP_DELAY_MS = 5 * 60_000
+const ABANDONED_UPLOAD_ABORT_GRACE_MS = 15 * 60_000
 
 interface OntologyMaintenanceDependencies {
   readonly projectId: string
   readonly storage: Storage
   readonly dispatcher: OntologyOutboxDispatcher
+  /** Aborts the provider side of abandoned staged uploads. */
+  readonly blobStorage?: BlobStorage
   readonly options?: OntologyMaintenanceOptions
   readonly now?: () => Date
   readonly onError?: (error: unknown) => void
@@ -29,6 +41,7 @@ export class OntologyMaintenance {
   private readonly projectId: string
   private readonly storage: Storage
   private readonly dispatcher: OntologyOutboxDispatcher
+  private readonly blobStorage: BlobStorage | undefined
   private readonly intervalMs: number
   private readonly publishedOutboxRetentionMs: number
   private readonly terminalSourceRetentionMs: number
@@ -48,6 +61,7 @@ export class OntologyMaintenance {
     this.projectId = dependencies.projectId
     this.storage = dependencies.storage
     this.dispatcher = dependencies.dispatcher
+    this.blobStorage = dependencies.blobStorage
     this.intervalMs = positiveInteger(options.intervalMs ?? DEFAULT_INTERVAL_MS, "intervalMs")
     this.publishedOutboxRetentionMs = nonnegativeInteger(
       options.publishedOutboxRetentionMs ?? DEFAULT_RETENTION_MS,
@@ -174,6 +188,12 @@ export class OntologyMaintenance {
       failures,
       { rowsDeleted: 0, materializationsDeleted: 0 }
     )
+    const uploads = this.storage.fileUploadSessions
+    if (uploads) {
+      // Retire abandoned uploads first: the store never reaps one that is still pending.
+      await captureFailure(() => this.retireAbandonedUploads(uploads, started, failures), failures)
+      await captureFailure(() => uploads.cleanupExpired(started), failures, 0)
+    }
 
     return {
       publishedOutboxRowsDeleted,
@@ -182,6 +202,62 @@ export class OntologyMaintenance {
     }
   }
 
+  private async retireAbandonedUploads(
+    uploads: FileUploadSessionStore,
+    now: Date,
+    failures: unknown[]
+  ): Promise<void> {
+    const abandoned = await uploads.listAbandoned({
+      projectId: this.projectId,
+      now: new Date(now.getTime() - ABANDONED_UPLOAD_SWEEP_DELAY_MS),
+      limit: this.cleanupLimit,
+    })
+    for (const session of abandoned) {
+      await captureFailure(() => this.retireAbandonedUpload(uploads, session, now), failures)
+    }
+  }
+
+  /**
+   * Releases one abandoned upload's provider-side parts, then makes its row terminal so
+   * `cleanupExpired` can reap it. Throwing records a pass failure and moves on to the next.
+   */
+  private async retireAbandonedUpload(
+    uploads: FileUploadSessionStore,
+    session: FileUploadSession,
+    now: Date
+  ): Promise<void> {
+    const blobStorage = this.blobStorage
+    const providerUpload = session.providerUpload
+    let abortFailure: unknown
+    if (providerUpload && blobStorage && supportsDirectUpload(blobStorage)) {
+      try {
+        await blobStorage.abortUpload({
+          uploadId: session.id,
+          stagingKey: providerUpload.stagingKey,
+          ...(providerUpload.providerUploadId === undefined
+            ? {}
+            : { providerUploadId: providerUpload.providerUploadId }),
+        })
+      } catch (error) {
+        // Retry on later passes for a bounded time. After that the bucket lifecycle rule owns
+        // the parts: a row that can never be aborted would hold a slot in every pass's limit.
+        if (now.getTime() - session.expiresAt.getTime() < ABANDONED_UPLOAD_ABORT_GRACE_MS)
+          throw error
+        abortFailure = error
+      }
+    }
+
+    try {
+      await uploads.abort(session.id)
+    } catch (error) {
+      // Another API instance's pass retired it first.
+      if (!(error instanceof FileUploadSessionError && error.reason === "already_aborted")) {
+        throw error
+      }
+    }
+    if (abortFailure !== undefined) throw abortFailure
+  }
+
   private async readOperationalSummaries(failures: unknown[]): Promise<{
     readonly outbox: OntologyMaintenanceSnapshot["outbox"]
     readonly terminalSources: OntologyMaintenanceSnapshot["terminalSources"]

package/src/materialization/errors.ts

@@ -7,6 +7,8 @@ export type MaterializationConflictKind =
   | "execution-lost"
   | "run-correlation"
   | "effective-state"
+  /** A state the commit was told to expect (an Action's reads) no longer matches. */
+  | "expectation"
   | "timeseries-point"
   | "outbox-lease"
 
@@ -24,8 +26,8 @@ function prefixMessage(message: string): string {
 export class MaterializationValidationError extends OntologyValidationError {
   readonly name: string = "MaterializationValidationError"
 
-  constructor(message: string) {
-    super(prefixMessage(message))
+  constructor(message: string, options?: ErrorOptions) {
+    super(prefixMessage(message), options)
   }
 }
 

package/src/materialization/events.ts

@@ -1,20 +1,45 @@
-import type { EventActor } from "../events/envelope"
 import type { LinkDeletedEventPayload, LinkMutationEventPayload } from "../events/types/links"
 import type { ObjectDeletedEventPayload, ObjectMutationEventPayload } from "../events/types/objects"
 import type { TelemetryAppendedEventPayload } from "../events/types/telemetry"
+import type {
+  AuthorizablePrincipal,
+  KernelOperation,
+  TrustedPrimitiveKind,
+} from "../execution/types"
 import type { JsonValue } from "../json"
 import type {
   OntologyMaterializationOrigin,
   OntologyMaterializationPropertyChangeMap,
 } from "./model"
 
+/**
+ * Workload that made an ontology change, copied from its execution.
+ *
+ * It names what ran; `requestedBy` names on whose behalf. A primitive carries its definition id so
+ * a consumer can tell which workflow, sync, or webhook wrote without reading the run. An Agent
+ * `runId` is its Agent run, or the step run of a Workflow Agent step.
+ */
+export type EventExecutor =
+  | { readonly type: "request"; readonly requestId: string }
+  | {
+      readonly type: "primitive"
+      readonly kind: TrustedPrimitiveKind
+      readonly id: string
+      readonly runId: string
+    }
+  | { readonly type: "agent"; readonly runId: string }
+  | { readonly type: "kernel"; readonly operation: KernelOperation }
+
 interface OntologyMaterializationEventBase {
   readonly id: string
   readonly schemaVersion: 1
   readonly projectId: string
   readonly occurredAt: string
   readonly correlationId: string
-  readonly actor?: EventActor
+  /** Principal on whose behalf the write ran; absent for automatic or anonymous work. */
+  readonly requestedBy?: AuthorizablePrincipal
+  /** Workload that made the write. */
+  readonly executor: EventExecutor
   readonly origin: OntologyMaterializationOrigin
   readonly commitId: string
   readonly commitOrdinal: number

package/src/materialization/index.ts

@@ -77,3 +77,4 @@ export {
   telemetryPointSortKey,
   telemetrySeriesKey,
 } from "./refs"
+export type { ObjectVectorWrite, PreparedObjectVector } from "./vectors"

package/src/materialization/model.ts

@@ -3,6 +3,7 @@ import type { EventOrigin } from "../events/envelope"
 import type { PropertyChange, PropertyChangeMap } from "../events/property-changes"
 import type { JsonValue } from "../json"
 import type { ProjectionProtocolIdentity, ProjectionRunFailureCode } from "../projections/types"
+import type { ObjectVectorWrite } from "./vectors"
 
 export type { ProjectionProtocolIdentity } from "../projections/types"
 
@@ -125,6 +126,7 @@ export type OntologyEditCommit =
       readonly source:
         | { readonly kind: "action"; readonly actionId: string; readonly runId: string }
         | { readonly kind: "runtime"; readonly requestId: string }
+      readonly vectorWrites?: readonly ObjectVectorWrite[]
       readonly expectedObjects: readonly ExpectedObjectRevision[]
       readonly expectedLinks: readonly ExpectedLinkRevision[]
       readonly expectedLinkScopes: readonly ExpectedLinkScopeRevision[]

package/src/materialization/vectors.ts

@@ -0,0 +1,18 @@
+import type { ExpectedObjectRevision, OntologyObjectRef } from "./model"
+
+/** Internal observation captured before embedding and fenced by the atomic vector write. */
+export interface PreparedObjectVector {
+  readonly projectId: string
+  readonly ref: OntologyObjectRef
+  readonly profile: string
+  readonly configuration: string
+  readonly text: string
+  readonly sourceFingerprint: string
+  readonly expectedObject: Extract<ExpectedObjectRevision, { exists: true }>
+  readonly expectedVectorCommitId: string | null
+}
+
+export interface ObjectVectorWrite {
+  readonly input: PreparedObjectVector
+  readonly values: readonly number[]
+}