@sixb/core 0.1.11 → 0.1.13

package/src/storage/ontology/in-memory/vector-indexing.ts

@@ -0,0 +1,179 @@
+import type { MaterializationSession } from "../materializations"
+import type { OntologyVectorIndexingStorage, VectorIndexingWork } from "../vector-indexing"
+
+export class InMemoryVectorIndexingStorage implements OntologyVectorIndexingStorage {
+  constructor(
+    private readonly state: Map<
+      string,
+      VectorIndexingWork & { projectId: string; dispatchAt: string }
+    >,
+    private readonly assertSession: (session: MaterializationSession, projectId: string) => void,
+    private readonly run: <T>(fn: () => T) => Promise<T>
+  ) {}
+
+  async schedule(input: Parameters<OntologyVectorIndexingStorage["schedule"]>[0]) {
+    this.assertSession(input.session, input.projectId)
+    if (input.deleted.length) {
+      const deleted = new Set(
+        input.deleted.map((ref) => JSON.stringify([ref.objectTypeId, ref.primaryId]))
+      )
+      for (const [key, work] of this.state) {
+        if (
+          work.projectId === input.projectId &&
+          deleted.has(JSON.stringify([work.ref.objectTypeId, work.ref.primaryId]))
+        )
+          this.state.delete(key)
+      }
+    }
+    for (const request of input.requests) {
+      const key = JSON.stringify([
+        input.projectId,
+        request.ref.objectTypeId,
+        request.ref.primaryId,
+        request.profile,
+      ])
+      this.state.set(
+        key,
+        structuredClone({
+          ...request,
+          projectId: input.projectId,
+          status: "pending",
+          availableAt: input.availableAt,
+          dispatchAt: input.availableAt,
+        })
+      )
+    }
+  }
+
+  async complete(input: Parameters<OntologyVectorIndexingStorage["complete"]>[0]) {
+    this.assertSession(input.session, input.projectId)
+    for (const entry of input.entries) {
+      const key = JSON.stringify([
+        input.projectId,
+        entry.ref.objectTypeId,
+        entry.ref.primaryId,
+        entry.profile,
+      ])
+      const work = this.state.get(key)
+      if (
+        work?.configuration === entry.configuration &&
+        work.sourceFingerprint === entry.sourceFingerprint
+      ) {
+        this.state.delete(key)
+      }
+    }
+  }
+
+  async dispatched(input: Parameters<OntologyVectorIndexingStorage["dispatched"]>[0]) {
+    await this.run(() => {
+      for (const [key, work] of this.state)
+        if (work.projectId === input.projectId && input.ids.includes(work.id))
+          this.state.set(key, { ...work, dispatchAt: input.nextDispatchAt })
+    })
+  }
+  async get(input: Parameters<OntologyVectorIndexingStorage["get"]>[0]) {
+    return this.run(() =>
+      structuredClone(
+        [...this.state.values()].find(
+          (work) => work.projectId === input.projectId && work.id === input.id
+        ) ?? null
+      )
+    )
+  }
+
+  async getBatch(input: Parameters<OntologyVectorIndexingStorage["getBatch"]>[0]) {
+    return this.run(() =>
+      structuredClone(
+        [...this.state.values()]
+          .filter((work) => work.projectId === input.projectId && work.batchId === input.batchId)
+          .sort((a, b) => a.id.localeCompare(b.id))
+      )
+    )
+  }
+
+  async getBatchMember(input: Parameters<OntologyVectorIndexingStorage["getBatchMember"]>[0]) {
+    return this.run(() => {
+      const work = this.state.get(
+        JSON.stringify([
+          input.projectId,
+          input.ref.objectTypeId,
+          input.ref.primaryId,
+          input.profile,
+        ])
+      )
+      return work?.batchId === input.batchId ? structuredClone(work) : null
+    })
+  }
+
+  async updateBatch(input: Parameters<OntologyVectorIndexingStorage["updateBatch"]>[0]) {
+    return this.run(() => {
+      const updates = new Map(input.updates.map((update) => [update.id, update]))
+      const matches = [...this.state.entries()].filter(
+        ([, work]) =>
+          work.projectId === input.projectId && updates.get(work.id)?.expectedStatus === work.status
+      )
+      if (input.requireAll && matches.length !== input.updates.length) return false
+      for (const [key, work] of matches) {
+        const update = updates.get(work.id)!
+        this.state.set(
+          key,
+          structuredClone({
+            ...work,
+            status: update.status,
+            availableAt: update.availableAt,
+            values: update.values ?? work.values,
+            error: update.error,
+          })
+        )
+      }
+      return true
+    })
+  }
+
+  async listDue(input: Parameters<OntologyVectorIndexingStorage["listDue"]>[0]) {
+    return this.run(() =>
+      [...this.state.values()]
+        .filter(
+          (work) =>
+            work.projectId === input.projectId &&
+            work.status !== "failed" &&
+            work.dispatchAt <= input.now
+        )
+        .sort((a, b) => a.dispatchAt.localeCompare(b.dispatchAt) || a.id.localeCompare(b.id))
+        .slice(0, input.limit)
+        .map(({ values: _values, ...work }) => structuredClone(work))
+    )
+  }
+
+  async update(input: Parameters<OntologyVectorIndexingStorage["update"]>[0]) {
+    return this.run(() => {
+      for (const [key, work] of this.state) {
+        if (
+          work.projectId !== input.projectId ||
+          work.id !== input.id ||
+          work.status !== input.expectedStatus
+        )
+          continue
+        this.state.set(
+          key,
+          structuredClone({
+            ...work,
+            status: input.status,
+            availableAt: input.availableAt,
+            values: input.values ?? work.values,
+            error: input.error,
+          })
+        )
+        return true
+      }
+      return false
+    })
+  }
+
+  async remove(input: Parameters<OntologyVectorIndexingStorage["remove"]>[0]) {
+    await this.run(() => {
+      for (const [key, work] of this.state)
+        if (work.projectId === input.projectId && work.id === input.id) this.state.delete(key)
+    })
+  }
+}

package/src/storage/ontology/in-memory/vectors.ts

@@ -0,0 +1,73 @@
+import { MaterializationConflictError } from "../../../materialization/errors"
+import type { MaterializationSession } from "../materializations"
+import type { OntologyVectorStorage, StoredObjectVector } from "../vectors"
+
+export function vectorObjectKey(projectId: string, ref: StoredObjectVector["ref"]): string {
+  return JSON.stringify([projectId, ref.objectTypeId, ref.primaryId])
+}
+
+export class InMemoryOntologyVectorStorage implements OntologyVectorStorage {
+  constructor(
+    private readonly state: Map<string, Map<string, StoredObjectVector>>,
+    private readonly assertSession: (
+      session: MaterializationSession,
+      projectId: string,
+      commitId?: string
+    ) => void,
+    private readonly runRootOperation: <T>(run: () => T) => Promise<T>
+  ) {}
+
+  async list(input: Parameters<OntologyVectorStorage["list"]>[0]) {
+    return this.listBatch({ projectId: input.projectId, refs: [input.ref] })
+  }
+
+  async listBatch(input: Parameters<OntologyVectorStorage["listBatch"]>[0]) {
+    return this.runRootOperation(() =>
+      [...new Set(input.refs.map((ref) => vectorObjectKey(input.projectId, ref)))].flatMap((key) =>
+        [...(this.state.get(key)?.values() ?? [])].map(({ values: _values, ...metadata }) =>
+          structuredClone(metadata)
+        )
+      )
+    )
+  }
+
+  async removeBatch(input: Parameters<OntologyVectorStorage["removeBatch"]>[0]) {
+    this.assertSession(input.session, input.projectId)
+    for (const entry of input.entries) {
+      await this.remove({ session: input.session, projectId: input.projectId, ...entry })
+    }
+  }
+
+  async write(input: Parameters<OntologyVectorStorage["write"]>[0]) {
+    this.assertSession(input.session, input.projectId, input.value.lastCommitId)
+    const key = vectorObjectKey(input.projectId, input.value.ref)
+    const profiles = this.state.get(key) ?? new Map<string, StoredObjectVector>()
+    this.assertRevision(profiles.get(input.value.profile), input.expectedCommitId)
+    profiles.set(input.value.profile, structuredClone(input.value))
+    this.state.set(key, profiles)
+  }
+
+  async writeBatch(input: Parameters<OntologyVectorStorage["writeBatch"]>[0]): Promise<void> {
+    for (const entry of input.entries) {
+      await this.write({ session: input.session, projectId: input.projectId, ...entry })
+    }
+  }
+
+  async remove(input: Parameters<OntologyVectorStorage["remove"]>[0]) {
+    this.assertSession(input.session, input.projectId)
+    const key = vectorObjectKey(input.projectId, input.ref)
+    const profiles = this.state.get(key)
+    this.assertRevision(profiles?.get(input.profile), input.expectedCommitId)
+    profiles?.delete(input.profile)
+    if (profiles?.size === 0) this.state.delete(key)
+  }
+
+  private assertRevision(current: StoredObjectVector | undefined, expected: string | null) {
+    if ((current?.lastCommitId ?? null) !== expected) {
+      throw new MaterializationConflictError(
+        "effective-state",
+        "Vector changed since it was prepared."
+      )
+    }
+  }
+}

package/src/storage/ontology/index.ts

@@ -2,6 +2,8 @@ import type { OntologyCommitStorage } from "./commits"
 import type { OntologyMaterializationStorage } from "./materializations"
 import type { OntologyOutboxStorage } from "./outbox"
 import type { OntologySourceStorage } from "./sources"
+import type { OntologyVectorIndexingStorage } from "./vector-indexing"
+import type { OntologyVectorStorage } from "./vectors"
 
 export type { ProjectionExecution } from "../../materialization/model"
 export type {
@@ -119,9 +121,21 @@ export type {
   TerminalSourceMaterializationSummary,
 } from "./sources"
 
+export type { ObjectVectorState, OntologyVectorStorage, StoredObjectVector } from "./vectors"
+
 export interface OntologyStorage {
+  readonly vectorIndexing?: OntologyVectorIndexingStorage
+  readonly vectors?: OntologyVectorStorage
   readonly commits: OntologyCommitStorage
   readonly sources: OntologySourceStorage
   readonly materializations: OntologyMaterializationStorage
   readonly outbox: OntologyOutboxStorage
 }
+
+export type {
+  OntologyVectorIndexingStorage,
+  VectorIndexingFailureCode,
+  VectorIndexingRequest,
+  VectorIndexingUpdate,
+  VectorIndexingWork,
+} from "./vector-indexing"

package/src/storage/ontology/provider-header-validation.ts

@@ -38,6 +38,55 @@ function assertCommitEnvelope(commit: OntologyCommitWrite): void {
   assertNonblank(commit.executionId, "Materialization execution id")
   assertNonblank(commit.ontologyRevision, "Materialization ontology revision")
   assertTimestamp(commit.committedAt, "Materialization commit time")
+  assertCommitAttribution(commit)
+}
+
+/** Shape only: the Materializer copies both values from the execution it has already verified. */
+function assertCommitAttribution(commit: OntologyCommitWrite): void {
+  const { requestedBy, executor } = commit
+  if (requestedBy !== undefined) {
+    if (requestedBy.type !== "user" && requestedBy.type !== "serviceAccount") {
+      invalidCorrelation("Materialization requester must be a user or service account.")
+    }
+    assertNonblank(requestedBy.id, "Materialization requester id")
+  }
+
+  switch (executor?.type) {
+    case "request":
+      assertNonblank(executor.requestId, "Materialization executor request id")
+      return
+    case "primitive":
+      assertNonblank(executor.kind, "Materialization executor primitive kind")
+      assertNonblank(executor.id, "Materialization executor primitive id")
+      assertNonblank(executor.runId, "Materialization executor run id")
+      return
+    case "agent":
+      assertNonblank(executor.runId, "Materialization executor Agent run id")
+      return
+    case "kernel":
+      assertNonblank(executor.operation?.type, "Materialization executor kernel operation")
+      return
+    default:
+      invalidCorrelation("Materialization executor is invalid.")
+  }
+}
+
+/** A governed or projected write is attributed to exactly the primitive run that owns it. */
+function assertPrimitiveExecutor(
+  commit: OntologyCommitWrite,
+  kind: "action" | "projection",
+  id: string,
+  runId: string
+): void {
+  const { executor } = commit
+  if (
+    executor.type !== "primitive" ||
+    executor.kind !== kind ||
+    executor.id !== id ||
+    executor.runId !== runId
+  ) {
+    invalidCorrelation(`Commit ${kind} origin does not match its executor.`)
+  }
 }
 
 function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommitIntent): void {
@@ -47,6 +96,7 @@ function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommi
     case "action":
       assertNonblank(commit.origin.actionId, "Action origin action id")
       assertNonblank(commit.origin.runId, "Action origin run id")
+      assertPrimitiveExecutor(commit, "action", commit.origin.actionId, commit.origin.runId)
       return
     case "runtime":
       assertNonblank(commit.origin.requestId, "Runtime origin request id")
@@ -77,6 +127,12 @@ function assertProjectionCommit(
   ) {
     invalidCorrelation("Projection commit origin does not match its dataset version.")
   }
+  assertPrimitiveExecutor(
+    commit,
+    "projection",
+    commit.origin.projectionId,
+    commit.origin.projectionRunId
+  )
 }
 
 function assertTelemetryCommit(
@@ -142,6 +198,7 @@ function assertProjectionTelemetryCommit(
   if (origin.batchOrdinal !== source.batchOrdinal) {
     invalidCorrelation("Projection telemetry origin does not match its batch ordinal.")
   }
+  assertPrimitiveExecutor(commit, "projection", origin.projectionId, origin.projectionRunId)
 }
 
 function assertProjectionTelemetryBatch(

package/src/storage/ontology/provider-work.ts

@@ -9,6 +9,7 @@ import {
   objectRefKey,
   telemetryPointKey,
 } from "../../materialization/refs"
+import type { OntologyCommitWrite } from "./commits"
 import {
   type ExactTimeseriesPointWrite,
   type MaterializationCardinalityOccupantWorkRecord,
@@ -107,8 +108,7 @@ export function assertWorkRecord(
       record.draft.commitId !== header.commit.id ||
       record.draft.occurredAt !== header.commit.committedAt ||
       stableJsonStringify(record.draft.origin) !== stableJsonStringify(header.commit.origin) ||
-      stableJsonStringify(record.draft.actor ?? null) !==
-        stableJsonStringify(header.commit.actor ?? null)
+      !sameAttribution(record.draft, header.commit)
     ) {
       throw new MaterializationValidationError("Materialization event work is invalid.")
     }
@@ -312,7 +312,7 @@ function assertOutboxCorrelation(
     value.availableAt !== commit.committedAt ||
     value.createdAt !== commit.committedAt ||
     stableJsonStringify(envelope.origin) !== stableJsonStringify(commit.origin) ||
-    stableJsonStringify(envelope.actor ?? null) !== stableJsonStringify(commit.actor ?? null) ||
+    !sameAttribution(envelope, commit) ||
     !Number.isSafeInteger(envelope.commitOrdinal) ||
     envelope.commitOrdinal < 0 ||
     envelope.id !== createEventId(commit.projectId, commit.id, envelope.commitOrdinal)
@@ -347,3 +347,15 @@ function assertLinkRefEqual(left: OntologyLinkRef, right: OntologyLinkRef, label
     invalidCorrelation(`${label} row and expected references differ.`)
   }
 }
+
+/** Events carry exactly the attribution of the commit that produced them. */
+function sameAttribution(
+  event: Pick<OntologyCommitWrite, "requestedBy" | "executor">,
+  commit: Pick<OntologyCommitWrite, "requestedBy" | "executor">
+): boolean {
+  return (
+    stableJsonStringify(event.requestedBy ?? null) ===
+      stableJsonStringify(commit.requestedBy ?? null) &&
+    stableJsonStringify(event.executor) === stableJsonStringify(commit.executor)
+  )
+}

package/src/storage/ontology/provider.ts

@@ -6,10 +6,13 @@ import {
 } from "../../materialization/errors"
 import type {
   EffectiveLinkSnapshot,
+  ExpectedLinkRevision,
+  ExpectedLinkScopeRevision,
+  ExpectedObjectRevision,
   OntologyLinkRef,
   OntologyObjectRef,
 } from "../../materialization/model"
-import { projectionEntityKey } from "../../materialization/refs"
+import { linkRefKey, objectRefKey, projectionEntityKey } from "../../materialization/refs"
 import type { OntologyCommitOriginSelector, OntologyCommitWrite } from "./commits"
 import type {
   FinalizeMaterializationInput,
@@ -485,6 +488,61 @@ export function effectiveConflict(message: string): MaterializationConflictError
   return new MaterializationConflictError("effective-state", message)
 }
 
+/**
+ * Rejects a commit whose expected object no longer matches its current effective row.
+ *
+ * Every provider checks commit expectations through these helpers, so a failed expectation is always
+ * the `expectation` conflict kind: an Action run reports exactly that kind as a read conflict.
+ */
+export function assertExpectedObjectRevision(
+  current: { readonly version: number; readonly lastCommitId: string | null } | null,
+  expected: ExpectedObjectRevision
+): void {
+  if (!expected.exists) {
+    if (current) {
+      throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (
+    !current ||
+    current.version !== expected.version ||
+    current.lastCommitId !== expected.lastCommitId
+  ) {
+    throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} changed.`)
+  }
+}
+
+/** `currentLastCommitId` is `undefined` when the link has no effective row. */
+export function assertExpectedLinkRevision(
+  currentLastCommitId: string | null | undefined,
+  expected: ExpectedLinkRevision
+): void {
+  if (!expected.exists) {
+    if (currentLastCommitId !== undefined) {
+      throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (currentLastCommitId === undefined || currentLastCommitId !== expected.lastCommitId) {
+    throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} changed.`)
+  }
+}
+
+export function assertExpectedLinkScopeRevision(
+  currentFingerprint: string | undefined,
+  expected: ExpectedLinkScopeRevision
+): void {
+  if (currentFingerprint === expected.fingerprint) return
+  throw expectationConflict(
+    `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`
+  )
+}
+
+function expectationConflict(message: string): MaterializationConflictError {
+  return new MaterializationConflictError("expectation", message)
+}
+
 export function materializationWorkColumns(record: MaterializationWorkRecord): {
   readonly lane: "none" | "apply" | "cardinality" | "event"
   readonly majorOrder: number

package/src/storage/ontology/vector-indexing.ts

@@ -0,0 +1,98 @@
+import type { SixbFailure } from "../../errors/types"
+import type { OntologyObjectRef } from "../../materialization/model"
+import type { MaterializationSession } from "./materializations"
+
+export const VECTOR_INDEXING_FAILURE_CODES = [
+  "vector.model_unavailable",
+  "vector.response_invalid",
+  "vector.outcome_unknown",
+  "internal.unexpected",
+] as const
+
+export type VectorIndexingFailureCode = (typeof VECTOR_INDEXING_FAILURE_CODES)[number]
+
+/** Latest desired representation; replacing its id fences every older delivery. */
+export interface VectorIndexingRequest {
+  readonly id: string
+  /** Set only by projection materialization; a bounded, immediately durable group. */
+  readonly batchId?: string
+  readonly ref: OntologyObjectRef
+  readonly profile: string
+  readonly configuration: string
+  readonly sourceFingerprint: string
+  readonly sourceCommitId: string
+}
+
+export interface VectorIndexingWork extends VectorIndexingRequest {
+  readonly status: "pending" | "running" | "ready" | "failed"
+  readonly availableAt: string
+  readonly values?: readonly number[]
+  readonly error?: SixbFailure<VectorIndexingFailureCode>
+}
+
+export interface VectorIndexingUpdate {
+  readonly id: string
+  readonly expectedStatus: VectorIndexingWork["status"]
+  readonly status: VectorIndexingWork["status"]
+  readonly availableAt: string
+  readonly values?: readonly number[]
+  readonly error?: SixbFailure<VectorIndexingFailureCode>
+}
+
+/** Durable intent belongs to ontology storage; delivery leases belong to Queues. */
+export interface OntologyVectorIndexingStorage {
+  /** Called inside the transaction that changes the effective object. */
+  schedule(input: {
+    projectId: string
+    session: MaterializationSession
+    requests: readonly VectorIndexingRequest[]
+    deleted: readonly OntologyObjectRef[]
+    availableAt: string
+  }): Promise<void>
+  /** Clear matching intent atomically with a successful automatic or explicit vector write. */
+  complete(input: {
+    projectId: string
+    session: MaterializationSession
+    entries: readonly Pick<
+      VectorIndexingRequest,
+      "ref" | "profile" | "configuration" | "sourceFingerprint"
+    >[]
+  }): Promise<void>
+  dispatched(input: {
+    projectId: string
+    ids: readonly string[]
+    nextDispatchAt: string
+  }): Promise<void>
+  get(input: { projectId: string; id: string }): Promise<VectorIndexingWork | null>
+  getBatch(input: { projectId: string; batchId: string }): Promise<readonly VectorIndexingWork[]>
+  /** Read only the result this kernel batch is allowed to publish. */
+  getBatchMember(input: {
+    projectId: string
+    batchId: string
+    ref: OntologyObjectRef
+    profile: string
+  }): Promise<VectorIndexingWork | null>
+  /** Atomic transitions; requireAll prevents admission if any prepared member was superseded. */
+  updateBatch(input: {
+    projectId: string
+    updates: readonly VectorIndexingUpdate[]
+    requireAll?: boolean
+  }): Promise<boolean>
+  /** Bounded fair redispatch scan. Never scans objects or backfills existing data. */
+  listDue(input: {
+    projectId: string
+    now: string
+    limit: number
+  }): Promise<readonly VectorIndexingWork[]>
+  /** CAS also fences concurrent deliveries and source changes. */
+  update(input: {
+    projectId: string
+    id: string
+    expectedStatus: VectorIndexingWork["status"]
+    status: VectorIndexingWork["status"]
+    availableAt: string
+    values?: readonly number[]
+    error?: SixbFailure<VectorIndexingFailureCode>
+  }): Promise<boolean>
+  remove(input: { projectId: string; id: string }): Promise<void>
+}

package/src/storage/ontology/vectors.ts

@@ -0,0 +1,48 @@
+import type { OntologyObjectRef } from "../../materialization/model"
+import type { MaterializationSession } from "./materializations"
+
+export interface ObjectVectorState {
+  readonly ref: OntologyObjectRef
+  readonly profile: string
+  readonly configuration: string
+  readonly source: readonly string[]
+  readonly sourceFingerprint: string
+  readonly lastCommitId: string
+}
+
+export interface StoredObjectVector extends ObjectVectorState {
+  readonly values: readonly number[]
+}
+
+/** Transactional derived state. Mutations must run inside an ontology materialization transaction. */
+export interface OntologyVectorStorage {
+  list(input: { projectId: string; ref: OntologyObjectRef }): Promise<readonly ObjectVectorState[]>
+  listBatch(input: {
+    projectId: string
+    refs: readonly OntologyObjectRef[]
+  }): Promise<readonly ObjectVectorState[]>
+  removeBatch(input: {
+    session: MaterializationSession
+    projectId: string
+    entries: readonly { ref: OntologyObjectRef; profile: string; expectedCommitId: string }[]
+  }): Promise<void>
+  write(input: {
+    session: MaterializationSession
+    projectId: string
+    value: StoredObjectVector
+    expectedCommitId: string | null
+  }): Promise<void>
+  /** Write a validated set inside the materialization transaction; any conflict aborts it. */
+  writeBatch(input: {
+    session: MaterializationSession
+    projectId: string
+    entries: readonly { value: StoredObjectVector; expectedCommitId: string | null }[]
+  }): Promise<void>
+  remove(input: {
+    session: MaterializationSession
+    projectId: string
+    ref: OntologyObjectRef
+    profile: string
+    expectedCommitId: string
+  }): Promise<void>
+}

package/src/storage/operation-scope.ts

@@ -206,6 +206,7 @@ export function createAuthOperationScope<T extends AuthStorage>(
     groupMemberships: createOperationScopedFacade(target.groupMemberships, scope),
     magicLinks: createOperationScopedFacade(target.magicLinks, scope),
     oidcAuthorizationAttempts: createOperationScopedFacade(target.oidcAuthorizationAttempts, scope),
+    deviceAuthorizations: createOperationScopedFacade(target.deviceAuthorizations, scope),
   }) as T
 }
 
@@ -230,6 +231,7 @@ export function createOntologyOperationScope<T extends OntologyStorage>(
     sources: createOperationScopedFacade(target.sources, scope),
     materializations: createOperationScopedFacade(target.materializations, scope),
     outbox: createOperationScopedFacade(target.outbox, scope),
+    ...(target.vectors ? { vectors: createOperationScopedFacade(target.vectors, scope) } : {}),
   }) as T
 }
 

package/src/storage/types.ts

@@ -50,6 +50,8 @@ export type {
   AgentRunRecord,
   AgentStorage,
   AgentThreadRecord,
+  AgentThreadSandboxParams,
+  AgentThreadSandboxState,
   AppendAgentMessageInput,
   ConfirmAgentRunExecutionOwnershipInput,
   ConversationAgentRunRecord,
@@ -70,6 +72,7 @@ export type {
   SubagentRunRecord,
   SubagentRunResult,
   SubagentRunSpec,
+  TransitionAgentThreadSandboxInput,
 } from "./agents"
 export { AGENT_RUN_FAILURE_CODES, AgentStorageError } from "./agents"
 export type {
@@ -297,7 +300,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/workflow-interventions/index.ts

@@ -7,7 +7,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,