@sixb/core 0.1.17 → 0.1.19

package/src/objects/context/types.ts

@@ -4,6 +4,7 @@
  * Context hierarchy: SixbRuntimeContext → ResolvedObjectContext → ResolvedLinkContext
  */
 
+import type { BlobStorage } from "../../blob-storage"
 import type { ExecutionContext } from "../../execution"
 import type { ObjectLink } from "../../ontology"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
@@ -20,6 +21,12 @@ export interface ExecutionObjectContext extends ResolvedObjectContext {
   readonly execution: ExecutionContext
 }
 
+/** An object set's operations, which also open the files its objects reference. */
+export interface ObjectSetContext extends ExecutionObjectContext {
+  /** Opened only once a FileRef is resolved in a row read with the caller's permissions. */
+  readonly blobStorage: Pick<BlobStorage, "stat" | "open">
+}
+
 /** Resolved context for link operations. */
 export interface ResolvedLinkContext extends ResolvedObjectContext {
   readonly linkDefinition: ObjectLink

package/src/objects/execution.ts

@@ -1,3 +1,5 @@
+import { shareActionRunExecutor } from "../actions/run/executor"
+import type { BlobStorage } from "../blob-storage"
 import { shareSixbErrorReporter } from "../error-reporting/capability"
 import type { ExecutionContext } from "../execution"
 import {
@@ -85,7 +87,6 @@ export interface ExecutionObjectByIdHandle<TObjectType extends ObjectTypeWithPro
   extends ObjectReadByIdHandle<TObjectType> {
   vector: ObjectByIdHandle<TObjectType>["vector"]
   requestAction: ObjectByIdHandle<TObjectType>["requestAction"]
-  requestActionAndWait: ObjectByIdHandle<TObjectType>["requestActionAndWait"]
   link: ObjectByIdHandle<TObjectType>["link"]
   unlink: ObjectByIdHandle<TObjectType>["unlink"]
   delete: ObjectByIdHandle<TObjectType>["delete"]
@@ -96,7 +97,6 @@ export interface ExecutionObjectByIdHandle<TObjectType extends ObjectTypeWithPro
 export interface ExecutionObjectSet<TObjectType extends ObjectTypeWithPropertyTokens>
   extends ObjectReadSet<TObjectType> {
   requestAction: ObjectSet<TObjectType>["requestAction"]
-  requestActionAndWait: ObjectSet<TObjectType>["requestActionAndWait"]
   upsert: ObjectSet<TObjectType>["upsert"]
   upsertLink: ObjectSet<TObjectType>["upsertLink"]
   removeLink: ObjectSet<TObjectType>["removeLink"]
@@ -147,7 +147,8 @@ export interface ObjectsRuntime extends ExecutionObjectOperations {
 
 export function createObjectsRuntime(
   runtime: SixbRuntimeContext,
-  execution: ExecutionContext
+  execution: ExecutionContext,
+  blobStorage: Pick<BlobStorage, "stat" | "open">
 ): ObjectsRuntime {
   const runtimeAuthorization = runtime.runtimeAuthorization
   const objectReader = runtime.objectReader
@@ -171,6 +172,7 @@ export function createObjectsRuntime(
   }
   shareOntologyMutationRuntime(runtime, capturedRuntime)
   shareSixbErrorReporter(runtime, capturedRuntime)
+  shareActionRunExecutor(runtime, capturedRuntime)
   Object.freeze(capturedRuntime)
   const ontologyView = () => getAuthorizedOntologyView(objectReader)
   const objects = Object.assign(
@@ -180,6 +182,7 @@ export function createObjectsRuntime(
         ...capturedRuntime,
         execution,
         objectType,
+        blobStorage,
       }) as ExecutionObjectSet<TObjectType>
     },
     {

package/src/objects/materializer-adapter.ts

@@ -25,6 +25,7 @@ import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
 import {
   assertKnownProperties,
   assertLinkTargetType,
+  assertValidFileRefs,
   normalizeLinkProperties,
   normalizeObjectProperties,
   validateLinkProperties,
@@ -146,6 +147,7 @@ export function normalizeRuntimeObject(input: {
   const { objectType, primaryPropertyId, properties, valueTypesById } = input
   assertKnownProperties(objectType, properties)
   validateObjectProperties(objectType, properties, valueTypesById)
+  assertValidFileRefs(properties, objectType.id)
 
   const primaryValue = properties[primaryPropertyId]
   if (primaryValue === undefined || primaryValue === null) {
@@ -185,6 +187,7 @@ export function normalizeRuntimeLink(input: {
   const { objectType, linkDefinition, linkId, targetTypeId, properties, valueTypesById } = input
   assertLinkTargetType(objectType.id, linkId, linkDefinition, targetTypeId, input.isValidLinkTarget)
   validateLinkProperties(objectType, linkDefinition, properties, undefined, valueTypesById)
+  assertValidFileRefs(properties, `${objectType.id}.${linkId}`)
   const normalized = normalizeLinkProperties(objectType, linkDefinition, properties, valueTypesById)
   if (normalized === undefined) return undefined
   return normalizeJsonProperties(normalized, `${objectType.id}.${linkId} properties`)

package/src/objects/object/upsert-batch.ts

@@ -52,6 +52,9 @@ export async function upsertObjectBatch(
         ],
       }
     },
-    value: ([outcome]) => toObjectRow(ctx.projectId, requireEffectiveObject(outcome)),
+    value: ([outcome]) =>
+      ctx.objectReader.redactWrittenRow(
+        toObjectRow(ctx.projectId, requireEffectiveObject(outcome))
+      ),
   })
 }

package/src/objects/object/upsert.ts

@@ -34,5 +34,7 @@ export async function upsertObject(
   const commit = await commitRuntimeOperations(ctx, [
     objectUpsertOperation({ id: runtimeOperationId(0), ref, properties: normalized.properties }),
   ])
-  return toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0]))
+  return ctx.objectReader.redactWrittenRow(
+    toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0]))
+  )
 }

package/src/objects/property-clearance.ts

@@ -0,0 +1,209 @@
+import { AuthorizationError } from "../authorization/errors"
+import type { StoredDomainEvent } from "../events/types"
+import type { OntologyDefinitionCatalog } from "../ontology/registry"
+import { missingClearanceRedactions } from "../security/redactions"
+import type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from "../storage"
+import type {
+  ObjectQueryAdmissionState,
+  ObjectQueryPropertyUse,
+  ObjectQuerySemanticAdmission,
+} from "./query/validate"
+
+/**
+ * The marked properties one reader cannot read, resolved once from its clearances.
+ *
+ * A property is readable when the reader clears every one of its markings. Unreadable properties
+ * are omitted from rows and cannot be used to select, order, or aggregate objects.
+ */
+export interface PropertyClearance {
+  /** Marked properties of this object type the reader cannot read. */
+  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>
+  /** First marking on the property that the reader is not cleared for. */
+  missingMarking(objectTypeId: string, propertyId: string): string | undefined
+}
+
+const NO_PROPERTIES: ReadonlySet<string> = new Set()
+
+// Readers are built per execution, but few distinct clearance sets exist per ontology.
+const clearancesByOntology = new WeakMap<
+  OntologyDefinitionCatalog,
+  Map<string, PropertyClearance | undefined>
+>()
+
+/**
+ * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read
+ * every property, so callers skip redaction entirely.
+ */
+export function resolvePropertyClearance(
+  ontology: OntologyDefinitionCatalog,
+  clearances: ReadonlySet<string>
+): PropertyClearance | undefined {
+  let resolved = clearancesByOntology.get(ontology)
+  if (!resolved) {
+    resolved = new Map()
+    clearancesByOntology.set(ontology, resolved)
+  }
+  const key = JSON.stringify([...clearances].sort())
+  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))
+  return resolved.get(key)
+}
+
+function createPropertyClearance(
+  ontology: OntologyDefinitionCatalog,
+  clearances: ReadonlySet<string>
+): PropertyClearance | undefined {
+  const missingByType = new Map<string, ReadonlyMap<string, string>>()
+  for (const objectType of ontology.listObjectTypes()) {
+    const missing = new Map<string, string>()
+    for (const property of objectType.properties) {
+      const marking = property.markings?.find((markingId) => !clearances.has(markingId))
+      if (marking !== undefined) missing.set(property.id, marking)
+    }
+    if (missing.size > 0) missingByType.set(objectType.id, missing)
+  }
+  if (missingByType.size === 0) return undefined
+
+  const hiddenByType = new Map(
+    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])
+  )
+  return Object.freeze({
+    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,
+    missingMarking: (objectTypeId: string, propertyId: string) =>
+      missingByType.get(objectTypeId)?.get(propertyId),
+  })
+}
+
+/**
+ * Omit unreadable properties from a row and the objects expanded under it.
+ *
+ * Every hidden property of the type is listed in `redactions`, whether or not the row holds a
+ * value: listing only present values would reveal which hidden properties are empty.
+ */
+export function redactObjectRow<TRow extends ObjectRow>(
+  row: TRow,
+  clearance: PropertyClearance
+): TRow {
+  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)
+  const links = row.links
+  if (hidden.size === 0 && links === undefined) return row
+
+  const redacted: TRow = { ...row }
+  if (hidden.size > 0) {
+    redacted.properties = withoutKeys(row.properties, hidden)
+    redacted.redactions = missingClearanceRedactions(hidden)
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(
+      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])
+    )
+  }
+  return redacted
+}
+
+function redactLinkValue(
+  value: ExpandedLinkValue,
+  clearance: PropertyClearance
+): ExpandedLinkValue {
+  if (value === null) return null
+  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))
+  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.
+  return redactObjectRow(value as ExpandedObjectRow, clearance)
+}
+
+/**
+ * Omit unreadable properties from an object event, under the same contract as rows. Other events
+ * carry no markable value: link properties and telemetry properties cannot be marked.
+ */
+export function redactDomainEvent(
+  event: StoredDomainEvent,
+  clearance: PropertyClearance
+): StoredDomainEvent {
+  if (event.topic !== "objects") return event
+  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)
+  if (hidden.size === 0) return event
+
+  const payload = {
+    ...event.payload,
+    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),
+    redactions: missingClearanceRedactions(hidden),
+  }
+  if (event.type === "object.deleted") return { ...event, payload }
+  return {
+    ...event,
+    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },
+  }
+}
+
+function withoutKeys<TValue>(
+  record: Readonly<Record<string, TValue>>,
+  hidden: ReadonlySet<string>
+): Record<string, TValue> {
+  const kept: Record<string, TValue> = {}
+  for (const [key, value] of Object.entries(record)) {
+    if (!hidden.has(key)) kept[key] = value
+  }
+  return kept
+}
+
+/**
+ * Reject every query use of a property the reader cannot read, except projection.
+ *
+ * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which
+ * objects match and in what order. Projection only shapes the output, which is redacted anyway.
+ */
+export function createClearanceQueryAdmission(
+  clearance: PropertyClearance
+): ObjectQuerySemanticAdmission {
+  // Each state stands for the object types a query has reached so far. A property without an
+  // explicit type is checked against all of them.
+  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()
+  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {
+    const created = Object.freeze({})
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]))
+    return created
+  }
+  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {
+    const objectTypeIds = reachedTypes.get(input)
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.")
+    }
+    return objectTypeIds
+  }
+  const empty = state([])
+
+  const admission: ObjectQuerySemanticAdmission = {
+    empty: () => empty,
+    source: (input) => ({ state: state(input.result.objectTypeIds) }),
+    edge: (input) => ({ state: state(input.result.objectTypeIds) }),
+    // A difference only returns objects of its first input.
+    set: (input) =>
+      input.op === "subtract"
+        ? (input.states[0] ?? empty)
+        : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project") return undefined
+      const objectTypeIds =
+        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId)
+        if (marking === undefined) continue
+        return new AuthorizationError(
+          `clearance:marking:${marking}`,
+          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`
+        )
+      }
+      return undefined
+    },
+  }
+  return Object.freeze(admission)
+}
+
+const PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by",
+}

package/src/objects/query/executor.ts

@@ -39,10 +39,13 @@ import { rerankObjectCandidates } from "./reranking-executor"
 import { findQueryReranking } from "./reranking-query"
 import { compareQueryScalarValues, queryScalarValuesEqual } from "./scalar-values"
 import {
+  type AdmittedObjectQuery,
+  type ObjectQuerySemanticAdmission,
   type ObjectQueryValidationIssue,
   resolveObjectQueryResultShape,
   type ValidatedObjectQuery,
   validateObjectQuery,
+  validateObjectQueryWithAdmission,
 } from "./validate"
 
 export interface QueryExecutorOptions
@@ -73,6 +76,8 @@ export interface QueryExecutorOptions
   authorization?: AuthorizationContext
   /** Registered execution capability for queries reached through a bound Sixb SDK. */
   runtimeAuthorization?: RuntimeAuthorization
+  /** Reader-specific admission applied after grants, such as marking clearances. */
+  admission?: ObjectQuerySemanticAdmission
 }
 
 export interface ExecuteObjectQueryInput {
@@ -138,15 +143,7 @@ export async function executeObjectQuery(
   input: ExecuteObjectQueryInput,
   options: QueryExecutorOptions
 ): Promise<ExecuteObjectQueryResult> {
-  const normalized = normalizeObjectQuery(input.query)
-  const validated = validateObjectQuery(normalized, {
-    ontology: options.ontology,
-    maxLimit: options.maxLimit,
-    maxPageSize: options.maxPageSize,
-    maxRefs: options.maxRefs,
-    normalize: false,
-  })
-  assertQueryViewable(input.projectId, validated, options)
+  const validated = validateExecutableQuery(input, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -242,15 +239,7 @@ export async function countObjects(
   input: ExecuteObjectCountInput,
   options: QueryExecutorOptions
 ): Promise<ExecuteObjectCountResult> {
-  const normalized = normalizeObjectQuery(input.query)
-  const validated = validateObjectQuery(normalized, {
-    ontology: options.ontology,
-    maxLimit: options.maxLimit,
-    maxPageSize: options.maxPageSize,
-    maxRefs: options.maxRefs,
-    normalize: false,
-  })
-  assertQueryViewable(input.projectId, validated, options)
+  const validated = validateExecutableQuery(input, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -303,15 +292,7 @@ export async function existsObjects(
   input: ExecuteObjectExistsInput,
   options: QueryExecutorOptions
 ): Promise<ExecuteObjectExistsResult> {
-  const normalized = normalizeObjectQuery(input.query)
-  const validated = validateObjectQuery(normalized, {
-    ontology: options.ontology,
-    maxLimit: options.maxLimit,
-    maxPageSize: options.maxPageSize,
-    maxRefs: options.maxRefs,
-    normalize: false,
-  })
-  assertQueryViewable(input.projectId, validated, options)
+  const validated = validateExecutableQuery(input, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -364,16 +345,17 @@ export async function facetObjects(
   input: ExecuteObjectFacetsInput,
   options: QueryExecutorOptions
 ): Promise<ExecuteObjectFacetsResult> {
-  const normalized = normalizeObjectQuery(input.query)
-  const validated = validateObjectQuery(normalized, {
-    ontology: options.ontology,
-    maxLimit: options.maxLimit,
-    maxPageSize: options.maxPageSize,
-    maxRefs: options.maxRefs,
-    normalize: false,
-  })
-  assertQueryViewable(input.projectId, validated, options)
+  const validated = validateExecutableQuery(input, options)
   const facets = validateObjectFacetRequests(input.facets, validated.result.objectTypeIds, options)
+  facets.forEach((facet, index) => {
+    const denial = options.admission?.property({
+      state: validated.admissionState,
+      propertyId: facet.propertyId,
+      use: "facet",
+      path: `$.facets[${index}].propertyId`,
+    })
+    if (denial) throw denial
+  })
   const aggregateQuery = stripOuterRowShape(validated.query)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
@@ -430,6 +412,31 @@ export async function facetObjects(
   }
 }
 
+/**
+ * Validate, authorize the touched types, then admit the query for the reader.
+ *
+ * Grants are checked first so a denial never describes properties of a type the caller cannot
+ * view. The admitted query is the one executed: an admission may narrow it, as markings narrow
+ * default text fields.
+ */
+function validateExecutableQuery(
+  input: { readonly projectId: string; readonly query: ObjectQuery },
+  options: QueryExecutorOptions
+): AdmittedObjectQuery {
+  const validationOptions = {
+    ontology: options.ontology,
+    maxLimit: options.maxLimit,
+    maxPageSize: options.maxPageSize,
+    maxRefs: options.maxRefs,
+    normalize: false,
+  }
+  const normalized = normalizeObjectQuery(input.query)
+  const validated = validateObjectQuery(normalized, validationOptions)
+  assertQueryViewable(input.projectId, validated, options)
+  if (!options.admission) return { ...validated, admissionState: {} }
+  return validateObjectQueryWithAdmission(normalized, validationOptions, options.admission)
+}
+
 // Authorization happens at planning time: a scoped query must hold a view
 // grant for every object type it touches, before any storage call runs.
 function assertQueryViewable(

package/src/objects/query/validate.ts

@@ -42,7 +42,10 @@ export interface ObjectQueryValidationIssue {
 export interface ValidatedObjectQuery {
   query: ObjectQuery
   result: ObjectQueryResultShape
-  /** Every object type the query touches, including intermediate traversal types. */
+  /**
+   * Every object type the query touches, including intermediate traversal types and the subtypes
+   * an outgoing link can reach.
+   */
   touchedObjectTypeIds: readonly string[]
 }
 
@@ -159,6 +162,67 @@ const NOOP_QUERY_ADMISSION: ObjectQuerySemanticAdmission = Object.freeze({
     input.states[0] ?? NOOP_ADMISSION_STATE,
 })
 
+/**
+ * Admit a query only when both admissions admit it, each reducing its own state.
+ *
+ * The first denial wins, in order, so composing keeps each admission's messages unchanged.
+ */
+export function composeObjectQueryAdmissions(
+  first: ObjectQuerySemanticAdmission,
+  second: ObjectQuerySemanticAdmission
+): ObjectQuerySemanticAdmission {
+  const parts = new WeakMap<
+    ObjectQueryAdmissionState,
+    readonly [ObjectQueryAdmissionState, ObjectQueryAdmissionState]
+  >()
+  const join = (
+    left: ObjectQueryAdmissionState,
+    right: ObjectQueryAdmissionState
+  ): ObjectQueryAdmissionState => {
+    const state = Object.freeze({})
+    parts.set(state, [left, right])
+    return state
+  }
+  const split = (state: ObjectQueryAdmissionState) => {
+    const pair = parts.get(state)
+    if (!pair) throw new Error("[Sixb] Composed query admission received a foreign state.")
+    return pair
+  }
+  const transition = (
+    left: ObjectQueryAdmissionTransition,
+    right: ObjectQueryAdmissionTransition
+  ): ObjectQueryAdmissionTransition => {
+    const denial = left.denial ?? right.denial
+    return { state: join(left.state, right.state), ...(denial ? { denial } : {}) }
+  }
+
+  const admission: ObjectQuerySemanticAdmission = {
+    empty: () => join(first.empty(), second.empty()),
+    source: (input) => transition(first.source(input), second.source(input)),
+    edge: (input) => {
+      const [left, right] = split(input.state)
+      return transition(
+        first.edge({ ...input, state: left }),
+        second.edge({ ...input, state: right })
+      )
+    },
+    property: (input) => {
+      const [left, right] = split(input.state)
+      return (
+        first.property({ ...input, state: left }) ?? second.property({ ...input, state: right })
+      )
+    },
+    set: (input) => {
+      const pairs = input.states.map(split)
+      return join(
+        first.set({ ...input, states: pairs.map(([left]) => left) }),
+        second.set({ ...input, states: pairs.map(([, right]) => right) })
+      )
+    },
+  }
+  return Object.freeze(admission)
+}
+
 export function validateObjectQuery(
   query: ObjectQuery,
   options: ObjectQueryValidationOptions
@@ -530,9 +594,7 @@ function validateStart(
     return { result: { objectTypeIds: [] }, query: { kind: "start", objectTypeId } }
   }
 
-  const objectTypeIds = includeSubtypes
-    ? uniqueStrings([objectTypeId, ...ctx.ontology.listSubTypes(objectTypeId)])
-    : [objectTypeId]
+  const objectTypeIds = includeSubtypes ? withSubtypes([objectTypeId], ctx) : [objectTypeId]
 
   return { result: { objectTypeIds }, query: { kind: "start", objectTypeId, includeSubtypes } }
 }
@@ -895,16 +957,15 @@ function validateTextQuery(
       continue
     }
 
-    if (fieldsByObjectType) fieldsByObjectType[objectType.id] = uniqueStrings(fieldIds)
+    const admitted = admitTextFields(fieldIds, fields === undefined, {
+      state: admissionState,
+      objectTypeId: objectType.id,
+      path: `${path}.fields`,
+      ctx,
+    })
+    if (fieldsByObjectType) fieldsByObjectType[objectType.id] = uniqueStrings(admitted)
 
     for (const fieldId of fieldIds) {
-      admitProperty(ctx, {
-        state: admissionState,
-        propertyId: fieldId,
-        objectTypeId: objectType.id,
-        use: "text",
-        path: `${path}.fields`,
-      })
       const property = getProperty(objectType, fieldId)
       if (!property) {
         addIssue(
@@ -933,6 +994,43 @@ function validateTextQuery(
   return fieldsByObjectType ? { fieldsByObjectType } : {}
 }
 
+/**
+ * Admit the fields a text query searches. Every explicit field must be admitted. Default fields
+ * come from the type's search profile, so a reader that cannot use one searches the others
+ * instead; only a type left with no usable default field is denied.
+ */
+function admitTextFields(
+  fieldIds: readonly string[],
+  defaults: boolean,
+  input: {
+    readonly state: ObjectQueryAdmissionState
+    readonly objectTypeId: string
+    readonly path: string
+    readonly ctx: QueryValidationContext
+  }
+): readonly string[] {
+  const admitted: string[] = []
+  let firstDenial: Error | undefined
+  for (const fieldId of fieldIds) {
+    const denial = input.ctx.admission.property({
+      state: input.state,
+      propertyId: fieldId,
+      objectTypeId: input.objectTypeId,
+      use: "text",
+      path: input.path,
+    })
+    if (!denial) {
+      admitted.push(fieldId)
+    } else if (!defaults) {
+      recordAdmissionDenial(input.ctx, denial)
+    } else {
+      firstDenial ??= denial
+    }
+  }
+  if (admitted.length === 0 && firstDenial) recordAdmissionDenial(input.ctx, firstDenial)
+  return admitted
+}
+
 function validateVectorProfileQuery(
   query: ObjectQueryVector,
   shape: ObjectQueryResultShape,
@@ -1060,7 +1158,9 @@ function validateOutgoingTraverse(
     }
   }
 
-  return { objectTypeIds: uniqueStrings(targetTypeIds) }
+  const objectTypeIds = uniqueStrings(targetTypeIds)
+  touchLinkTargets(objectTypeIds, ctx)
+  return { objectTypeIds }
 }
 
 function validateIncomingTraverse(
@@ -1261,7 +1361,22 @@ function resolveOutgoingExpansionTargets(
     )
   }
 
-  return { objectTypeIds: uniqueStrings(targetTypeIds) }
+  const objectTypeIds = uniqueStrings(targetTypeIds)
+  touchLinkTargets(objectTypeIds, ctx)
+  return { objectTypeIds }
+}
+
+/**
+ * Following a link outgoing reads every subtype of its declared targets: links accept subtype
+ * targets and storage follows them by link id alone. Authorize those reads like a `start` that
+ * includes subtypes; the result shape keeps the declared targets that later nodes validate against.
+ * Incoming edges already name every source type they can return: storage matches a pinned
+ * `sourceObjectTypeId` exactly, and otherwise subtypes inherit the link.
+ */
+function touchLinkTargets(objectTypeIds: readonly string[], ctx: QueryValidationContext): void {
+  for (const objectTypeId of withSubtypes(objectTypeIds, ctx)) {
+    ctx.touchedObjectTypeIds.add(objectTypeId)
+  }
 }
 
 function resolveIncomingExpansionTargets(
@@ -1657,6 +1772,10 @@ function uniqueStrings(values: readonly string[]): string[] {
   return [...new Set(values)]
 }
 
+function withSubtypes(objectTypeIds: readonly string[], ctx: QueryValidationContext): string[] {
+  return uniqueStrings(objectTypeIds.flatMap((id) => [id, ...ctx.ontology.listSubTypes(id)]))
+}
+
 function admitTransition(
   ctx: QueryValidationContext,
   transition: ObjectQueryAdmissionTransition