@sixb/core 0.1.20 → 0.1.22

package/dist/{chunk-vpq4shxz.js → chunk-h3pbv7n8.js}

@@ -1,37 +1,76 @@
 // @bun
 import {
+  assertAuthorized2,
   resolveRoleGrants2,
+  resolveRoleViewConditions2,
   resolveAuthorizationContext2
-} from "./chunk-d0bqz29d.js";
+} from "./chunk-yc9ners4.js";
 import {
-  assertValidFileRefs2
-} from "./chunk-hvsb78a1.js";
+  isUserRef,
+  isUserRefPropertySchema,
+  isCurrentUser
+} from "./chunk-4y26vs3v.js";
+import {
+  compileConditionalObjectReadScope2
+} from "./chunk-rap5w0x0.js";
+import {
+  validateSchemaValue2,
+  assertValidFileRefs2,
+  normalizeSchemaValue2,
+  validatePropertyValue2,
+  isExactSchema,
+  isSortableSchema,
+  isTextSchema,
+  isContainsSchema,
+  queryScalarKindForSchema
+} from "./chunk-65pyhyas.js";
 import {
-  SecurityValidationError2,
   resolveMembershipPolicyScope,
   canPerformMembershipOperation,
   missingMembershipGroupIds,
   validateSecurityDefinitionsAtStartup
-} from "./chunk-es1gxsbf.js";
+} from "./chunk-73v685wb.js";
+import {
+  sha256Canonical2
+} from "./chunk-zrvhsq7f.js";
 import {
   getCookie2,
   AuthRuntimeError2,
+  normalizeProfileChanges,
+  signInDisplayName2,
   resolveAuthConfig2,
   resolveInvitationExpiresAt,
   assertNonEmpty3,
   normalizePagination,
-  isInvitationDeliveryAuthStrategy2
-} from "./chunk-hcbyfxbe.js";
+  isMagicLinkAuthStrategy2,
+  isInvitationDeliveryAuthStrategy2,
+  isOidcAuthStrategy2
+} from "./chunk-5grk14e5.js";
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-c85m1hyj.js";
+} from "./chunk-6n69k945.js";
 import {
   snapshotLinkPathSelection
-} from "./chunk-t6f3tdnr.js";
+} from "./chunk-16a9dmfy.js";
+import {
+  resolveWhere,
+  ObjectQueryValidationError2,
+  normalizeObjectQuery2
+} from "./chunk-j936th07.js";
 import {
-  OntologyValidationError2
+  MaterializationValidationError2
+} from "./chunk-y7dbmaqh.js";
+import {
+  SecurityValidationError2
+} from "./chunk-jcfw4h7m.js";
+import {
+  OntologyValidationError2,
+  formatUnknownObjectTypeMessage
 } from "./chunk-cqr3acm1.js";
+import {
+  normalizeDecimalValue2
+} from "./chunk-3bh94gbw.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -553,6 +592,15 @@ function invalid(message) {
   return new ShareDefinitionError2(`[Sixb] ${message}`);
 }
 
+// src/security/project.ts
+var project2 = Object.freeze({
+  kind: "project",
+  logs: Object.freeze({ kind: "logs" }),
+  activity: Object.freeze({ kind: "activity" }),
+  users: Object.freeze({ kind: "users" }),
+  models: Object.freeze({ kind: "models" })
+});
+
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
 var RUN_TARGETS = ["workflow", "sync", "pipeline"];
@@ -608,11 +656,59 @@ function resolveGrant(input, label, allowedTargets) {
   const ids = [...new Set(items.map((item) => definitionIdOf(item, label)))];
   return { target, selection: { all: false, ids } };
 }
+var UNVIEWABLE_PROJECT_REFERENCES = new Set([
+  project2,
+  project2.logs,
+  project2.activity
+]);
 function view(input) {
   if (isShareTarget(input))
     return createShareViewGrant(input);
+  if (isUsersReference(input)) {
+    return { kind: "grant", capability: "view", target: "users" };
+  }
+  if (UNVIEWABLE_PROJECT_REFERENCES.has(input)) {
+    throw new SecurityValidationError2("[Sixb] can.view accepts object types, datasets, shares, or project.users.");
+  }
   const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS);
-  return { kind: "grant", capability: "view", target, selection };
+  const grant = { kind: "grant", capability: "view", target, selection };
+  const one = target !== "object" || Array.isArray(input) || isBreadthSelector(input) ? undefined : input;
+  if (one) {
+    Object.defineProperty(grant, "where", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (callback) => conditionalViewGrant(grant, one, callback)
+    });
+  }
+  return grant;
+}
+function conditionalViewGrant(grant, objectType, callback) {
+  const subject = `can.view(${objectType.id}).where(...)`;
+  if (typeof callback !== "function") {
+    throw new SecurityValidationError2(`[Sixb] ${subject} expects a function, such as (object) => object.p.status.eq("open").`);
+  }
+  const condition = resolveWhere(callback);
+  if (condition === undefined) {
+    throw new SecurityValidationError2(`[Sixb] ${subject} returned no condition. Return a predicate, or drop .where() to grant every object.`);
+  }
+  return deepFreeze({
+    kind: "grant",
+    capability: "view",
+    target: "object",
+    selection: structuredClone(grant.selection),
+    condition: structuredClone(condition)
+  });
+}
+function deepFreeze(value) {
+  if (typeof value !== "object" || value === null || Object.isFrozen(value))
+    return value;
+  for (const child of Object.values(value))
+    deepFreeze(child);
+  return Object.freeze(value);
+}
+function isUsersReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "users";
 }
 function edit(input) {
   return {
@@ -656,25 +752,51 @@ function run(input) {
   if (isAgentReference(input)) {
     return { kind: "grant", capability: "run", target: "agent" };
   }
+  if (isModelsReference(input)) {
+    return { kind: "grant", capability: "run", target: "models" };
+  }
   const { target, selection } = resolveGrant(input, "can.run", RUN_TARGETS);
   return { kind: "grant", capability: "run", target, selection };
 }
 function isAgentReference(input) {
   return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "agent";
 }
+function isModelsReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "models";
+}
 function isAgentUsageReference(input) {
   return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "aiUsage";
 }
+var OBSERVABLE_REFERENCES = {
+  logs: "project.logs",
+  activity: "project.activity",
+  aiUsage: "agent.usage",
+  agentThreads: "agent.threads"
+};
+function isObservableReference(input) {
+  return typeof input === "object" && input !== null && "kind" in input && typeof input.kind === "string" && Object.hasOwn(OBSERVABLE_REFERENCES, input.kind);
+}
 function observe(input) {
-  if (input !== "logs" && !isAgentUsageReference(input)) {
-    throw new SecurityValidationError2('[Sixb] can.observe accepts "logs" or agent.usage.');
+  const value = input;
+  if (value === "logs") {
+    throw new SecurityValidationError2('[Sixb] can.observe("logs") is now can.observe(project.logs), imported from "@sixb/core".');
+  }
+  if (!isObservableReference(value)) {
+    const accepted = Object.values(OBSERVABLE_REFERENCES).join(" or ");
+    throw new SecurityValidationError2(`[Sixb] can.observe accepts ${accepted}.`);
   }
-  return { kind: "grant", capability: "observe", target: input === "logs" ? "logs" : "aiUsage" };
+  return { kind: "grant", capability: "observe", target: value.kind };
+}
+function isAgentMemoryReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "agentMemory";
 }
 function manage(input) {
   if (isAgentUsageReference(input)) {
     return { kind: "grant", capability: "manage", target: "aiUsage" };
   }
+  if (isAgentMemoryReference(input)) {
+    return { kind: "grant", capability: "manage", target: "agentMemory" };
+  }
   return {
     kind: "grant",
     capability: "manage",
@@ -692,6 +814,1312 @@ var can2 = {
   observe,
   manage
 };
+// src/objects/query/current-user.ts
+function bindCurrentUser(query, user) {
+  switch (query.kind) {
+    case "start":
+    case "refs":
+      return query;
+    case "filter":
+      return {
+        ...query,
+        input: bindCurrentUser(query.input, user),
+        predicate: bindCurrentUserPredicate(query.predicate, user)
+      };
+    case "set":
+      return { ...query, inputs: query.inputs.map((input) => bindCurrentUser(input, user)) };
+    default:
+      return { ...query, input: bindCurrentUser(query.input, user) };
+  }
+}
+function bindCurrentUserPredicate(predicate, user) {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      return {
+        ...predicate,
+        items: predicate.items.map((item) => bindCurrentUserPredicate(item, user))
+      };
+    case "not":
+      return { ...predicate, item: bindCurrentUserPredicate(predicate.item, user) };
+    case "exists":
+    case "constant":
+      return predicate;
+    case "in": {
+      if (!predicate.values.some(isCurrentUser))
+        return predicate;
+      const values = predicate.values.flatMap((value) => isCurrentUser(value) ? user ? [user] : [] : [value]);
+      return values.length > 0 ? { ...predicate, values } : NO_ROW;
+    }
+    case "contains": {
+      if (!isCurrentUser(predicate.value))
+        return predicate;
+      if (user)
+        return { ...predicate, value: user };
+      return NO_ROW;
+    }
+    default: {
+      if (!isCurrentUser(predicate.value))
+        return predicate;
+      if (user)
+        return { ...predicate, value: user };
+      return predicate.op === "neq" ? EVERY_ROW : NO_ROW;
+    }
+  }
+}
+var NO_ROW = Object.freeze({ op: "constant", value: false });
+var EVERY_ROW = Object.freeze({ op: "constant", value: true });
+
+// src/objects/vectors/profile.ts
+var MAX_VECTOR_K = 1000;
+var VECTOR_INPUT_VERSION = 1;
+var INDEXING_EMBEDDING_TIMEOUT_MS = 5 * 60000;
+function vectorConfiguration(profile) {
+  return sha256Canonical2({
+    format: VECTOR_INPUT_VERSION,
+    sources: [...profile.source],
+    provider: profile.model.providerId,
+    model: profile.model.modelId,
+    representation: profile.model.definition.representation ?? { name: profile.model.modelId },
+    dimensions: profile.model.definition.dimensions,
+    ...profile.model.definition.inputMode === "asymmetric" ? { inputMode: "asymmetric" } : {},
+    metric: "cosine",
+    precision: "float32",
+    normalization: "l2-v1"
+  });
+}
+function vectorSources(source, properties) {
+  const values = Object.create(null);
+  for (const key of source) {
+    const value = properties[key];
+    if (value !== undefined && value !== null && typeof value !== "string") {
+      throw new MaterializationValidationError2(`Vector source must be text: ${key}`);
+    }
+    values[key] = typeof value === "string" ? value : null;
+  }
+  const text = JSON.stringify(source.map((key) => [key, values[key]]));
+  return { text, sourceFingerprint: sha256Canonical2(text) };
+}
+function normalizeVector2(values, dimensions) {
+  if (!Array.isArray(values) || values.length !== dimensions) {
+    throw new MaterializationValidationError2(`Vector dimension mismatch; expected ${dimensions}`);
+  }
+  const normalized = Array.from(values, (value) => {
+    if (typeof value !== "number" || !Number.isFinite(value) || !Number.isFinite(Math.fround(value))) {
+      throw new MaterializationValidationError2("Vector values must be finite float32 numbers.");
+    }
+    return Math.fround(value);
+  });
+  if (!normalized.some((value) => value !== 0)) {
+    throw new MaterializationValidationError2("Cosine search requires a nonzero vector.");
+  }
+  const norm = Math.hypot(...normalized);
+  return Object.freeze(normalized.map((value) => Math.fround(value / norm)));
+}
+function vectorSearchCandidateLimit2(dimensions) {
+  return Math.min(1e4, Math.floor(16000000 / dimensions));
+}
+
+// src/objects/vectors/query.ts
+function hasVectorProfile2(query) {
+  if (query.kind === "vector")
+    return true;
+  if (query.kind === "set")
+    return query.inputs.some(hasVectorProfile2);
+  return "input" in query && hasVectorProfile2(query.input);
+}
+function isVectorProfileQuery2(query) {
+  if (query.kind === "limit" || query.kind === "project")
+    return isVectorProfileQuery2(query.input);
+  if (query.kind === "rerank") {
+    return query.input.kind === "vector" && isVectorProfileQuery2(query.input);
+  }
+  if (query.kind !== "vector" || !query.profile)
+    return false;
+  return isVectorCandidateQuery(query.input);
+}
+function isVectorCandidateQuery(query) {
+  switch (query.kind) {
+    case "start":
+      return !query.includeSubtypes;
+    case "refs":
+      return true;
+    case "filter":
+    case "traverse":
+      return isVectorCandidateQuery(query.input);
+    case "set":
+      return query.inputs.every(isVectorCandidateQuery);
+    default:
+      return false;
+  }
+}
+
+// src/objects/query/reranking-limits.ts
+var MAX_RERANK_CANDIDATES = 100;
+var MAX_RERANK_INPUT_BYTES = 1048576;
+
+// src/objects/query/validate.ts
+var DEFAULT_MAX_LIMIT = 1000;
+var DEFAULT_MAX_PAGE_SIZE = 1000;
+var DEFAULT_MAX_REFS = 1000;
+var NOOP_ADMISSION_STATE = Object.freeze({});
+var NOOP_QUERY_ADMISSION = Object.freeze({
+  empty: () => NOOP_ADMISSION_STATE,
+  source: () => ({ state: NOOP_ADMISSION_STATE }),
+  property: () => {
+    return;
+  },
+  edge: (input) => ({
+    state: input.state
+  }),
+  set: (input) => input.states[0] ?? NOOP_ADMISSION_STATE
+});
+function composeObjectQueryAdmissions(first, second) {
+  const parts = new WeakMap;
+  const join = (left, right) => {
+    const state = Object.freeze({});
+    parts.set(state, [left, right]);
+    return state;
+  };
+  const split = (state) => {
+    const pair = parts.get(state);
+    if (!pair)
+      throw new Error("[Sixb] Composed query admission received a foreign state.");
+    return pair;
+  };
+  const transition = (left, right) => {
+    const denial = left.denial ?? right.denial;
+    return { state: join(left.state, right.state), ...denial ? { denial } : {} };
+  };
+  const admission = {
+    empty: () => join(first.empty(), second.empty()),
+    source: (input) => transition(first.source(input), second.source(input)),
+    edge: (input) => {
+      const [left, right] = split(input.state);
+      return transition(first.edge({ ...input, state: left }), second.edge({ ...input, state: right }));
+    },
+    property: (input) => {
+      const [left, right] = split(input.state);
+      return first.property({ ...input, state: left }) ?? second.property({ ...input, state: right });
+    },
+    set: (input) => {
+      const pairs = input.states.map(split);
+      return join(first.set({ ...input, states: pairs.map(([left]) => left) }), second.set({ ...input, states: pairs.map(([, right]) => right) }));
+    }
+  };
+  return Object.freeze(admission);
+}
+function validateObjectQuery2(query, options) {
+  const admitted = validateObjectQueryWithAdmission(query, options, NOOP_QUERY_ADMISSION);
+  return {
+    query: admitted.query,
+    result: admitted.result,
+    touchedObjectTypeIds: admitted.touchedObjectTypeIds
+  };
+}
+function validateObjectQueryWithAdmission(query, options, admission) {
+  const normalized = options.normalize === false ? query : normalizeObjectQuery2(query);
+  const ctx = createValidationContext(options, admission);
+  validateVectorComposition(query, ctx);
+  const validation = validateQueryNode(normalized, "$", ctx);
+  if (ctx.issues.length > 0) {
+    throw new ObjectQueryValidationError2(ctx.issues);
+  }
+  const denial = ctx.admissionDenials[0];
+  if (denial)
+    throw denial;
+  return {
+    query: validation.query,
+    result: validation.result,
+    touchedObjectTypeIds: [...ctx.touchedObjectTypeIds],
+    admissionState: validation.admissionState
+  };
+}
+function collectObjectQueryValidationIssues2(query, options) {
+  const normalized = options.normalize === false ? query : normalizeObjectQuery2(query);
+  const ctx = createValidationContext(options, NOOP_QUERY_ADMISSION);
+  validateVectorComposition(query, ctx);
+  validateQueryNode(normalized, "$", ctx);
+  return ctx.issues;
+}
+function resolveObjectQueryResultShape2(query, options) {
+  return validateObjectQuery2(query, options).result;
+}
+function validateVectorComposition(query, ctx) {
+  if (hasVectorProfile2(query) && !isVectorProfileQuery2(query))
+    ctx.issues.push({
+      path: "$",
+      code: "vector.composition",
+      message: "Vector profiles support one top-k over one concrete type, with filters, traversals or sets before ranking, optional reranking, then limit/project."
+    });
+}
+function createValidationContext(options, admission) {
+  return {
+    ontology: options.ontology,
+    valueTypesById: options.ontology.getValueTypesById(),
+    maxLimit: options.maxLimit ?? DEFAULT_MAX_LIMIT,
+    maxPageSize: options.maxPageSize ?? DEFAULT_MAX_PAGE_SIZE,
+    maxRefs: options.maxRefs ?? DEFAULT_MAX_REFS,
+    issues: [],
+    touchedObjectTypeIds: new Set,
+    admission,
+    admissionDenials: []
+  };
+}
+function validateQueryNode(query, path, ctx) {
+  const validation = dispatchQueryNode(query, path, ctx);
+  for (const objectTypeId of validation.result.objectTypeIds) {
+    ctx.touchedObjectTypeIds.add(objectTypeId);
+  }
+  return validation;
+}
+function dispatchQueryNode(query, path, ctx) {
+  switch (query.kind) {
+    case "start": {
+      const validation = validateStart(query.objectTypeId, query.includeSubtypes, path, ctx);
+      return {
+        ...validation,
+        admissionState: admitTransition(ctx, ctx.admission.source({
+          kind: "start",
+          result: validation.result,
+          objectTypeId: query.objectTypeId,
+          path
+        }))
+      };
+    }
+    case "refs": {
+      const validation = validateRefs(query.refs, path, ctx);
+      return {
+        ...validation,
+        admissionState: admitTransition(ctx, ctx.admission.source({
+          kind: "refs",
+          result: validation.result,
+          refs: validation.query.kind === "refs" ? validation.query.refs : query.refs,
+          path
+        }))
+      };
+    }
+    case "filter": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      const predicate = validatePredicate(query.predicate, input.result, input.admissionState, `${path}.predicate`, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query, predicate },
+        admissionState: input.admissionState
+      };
+    }
+    case "text": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      const textFields = validateTextQuery(query.query, query.fields, input.result, input.admissionState, path, ctx);
+      return {
+        result: input.result,
+        query: {
+          ...query,
+          input: input.query,
+          fields: query.fields,
+          fieldsByObjectType: query.fields ? undefined : textFields.fieldsByObjectType
+        },
+        admissionState: input.admissionState
+      };
+    }
+    case "vector": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      return {
+        result: input.result,
+        query: validateVectorProfileQuery({ ...query, input: input.query }, input.result, input.admissionState, path, ctx),
+        admissionState: input.admissionState
+      };
+    }
+    case "traverse": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      const result = validateTraverse(query.linkId, query.direction, query.sourceObjectTypeId, input.result, path, ctx);
+      return {
+        result,
+        query: { ...query, input: input.query },
+        admissionState: admitTransition(ctx, ctx.admission.edge({
+          state: input.admissionState,
+          result,
+          linkId: query.linkId,
+          direction: query.direction,
+          sourceObjectTypeId: query.sourceObjectTypeId,
+          use: "traverse",
+          path
+        }))
+      };
+    }
+    case "rerank": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      if (input.query.kind !== "vector" || typeof input.query.vector !== "string" || input.query.k > MAX_RERANK_CANDIDATES) {
+        addIssue(ctx, path, "invalid_rerank_input", `Reranking requires a text vector query with k at most ${MAX_RERANK_CANDIDATES}, before limit or project.`);
+      }
+      if (typeof query.model?.provider !== "string" || !query.model.provider.trim() || query.model.provider.trim() !== query.model.provider || typeof query.model.modelId !== "string" || !query.model.modelId.trim() || query.model.modelId.trim() !== query.model.modelId) {
+        addIssue(ctx, path, "invalid_rerank_model", "Reranking requires an explicit provider and model ID.");
+      }
+      return { ...input, query: { ...query, model: { ...query.model }, input: input.query } };
+    }
+    case "set":
+      return validateSet(query.inputs, query.op, path, ctx);
+    case "sort": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      const fields = validateSortFields(query.fields, input.result, input.admissionState, "sort", path, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query, fields },
+        admissionState: input.admissionState
+      };
+    }
+    case "limit": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      validateLimit(query.limit, path, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query },
+        admissionState: input.admissionState
+      };
+    }
+    case "page": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      validatePage(query.pageSize, query.pageToken, path, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query },
+        admissionState: input.admissionState
+      };
+    }
+    case "project": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      validateProjection(query.properties, input.result, input.admissionState, path, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query },
+        admissionState: input.admissionState
+      };
+    }
+    case "expand": {
+      const input = validateQueryNode(query.input, `${path}.input`, ctx);
+      const usersAllowed = path === "$";
+      const expansions = validateExpansions(query.expansions, input.result, input.admissionState, `${path}.expansions`, ctx, usersAllowed);
+      validateUserExpansions(query.users, input.result, `${path}.users`, ctx, usersAllowed);
+      validateUserExpansionsProjected(query.users, input.query, `${path}.users`, ctx);
+      return {
+        result: input.result,
+        query: { ...query, input: input.query, expansions },
+        admissionState: input.admissionState
+      };
+    }
+  }
+}
+function validateRefs(refs, path, ctx) {
+  if (refs.length === 0) {
+    addIssue(ctx, `${path}.refs`, "empty_refs", "refs must include at least one object reference");
+  }
+  if (refs.length > ctx.maxRefs) {
+    addIssue(ctx, `${path}.refs`, "too_many_refs", `refs must include at most ${ctx.maxRefs} object references`);
+  }
+  const objectTypeIds = new Set;
+  refs.forEach((ref, index) => {
+    const refPath = `${path}.refs[${index}]`;
+    if (!ref.objectTypeId) {
+      addIssue(ctx, `${refPath}.objectTypeId`, "missing_object_type", "objectTypeId is required");
+    } else if (!ctx.ontology.getObjectTypeById(ref.objectTypeId)) {
+      addIssue(ctx, `${refPath}.objectTypeId`, "unknown_object_type", formatUnknownObjectTypeMessage(ref.objectTypeId));
+    } else {
+      objectTypeIds.add(ref.objectTypeId);
+    }
+    if (!ref.primaryId) {
+      addIssue(ctx, `${refPath}.primaryId`, "missing_primary_id", "primaryId is required");
+    }
+  });
+  return {
+    result: { objectTypeIds: [...objectTypeIds] },
+    query: { kind: "refs", refs: refs.map((ref) => ({ ...ref })) }
+  };
+}
+function validateStart(objectTypeId, includeSubtypes, path, ctx) {
+  if (!objectTypeId) {
+    addIssue(ctx, path, "missing_object_type", "start.objectTypeId is required");
+    return { result: { objectTypeIds: [] }, query: { kind: "start", objectTypeId } };
+  }
+  if (!ctx.ontology.getObjectTypeById(objectTypeId)) {
+    addIssue(ctx, path, "unknown_object_type", formatUnknownObjectTypeMessage(objectTypeId));
+    return { result: { objectTypeIds: [] }, query: { kind: "start", objectTypeId } };
+  }
+  const objectTypeIds = includeSubtypes ? withSubtypes([objectTypeId], ctx) : [objectTypeId];
+  return { result: { objectTypeIds }, query: { kind: "start", objectTypeId, includeSubtypes } };
+}
+function validatePredicate(predicate, shape, admissionState, path, ctx) {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      if (predicate.items.length === 0) {
+        addIssue(ctx, path, "empty_predicate_group", `Predicate '${predicate.op}' must not be empty`);
+      }
+      return {
+        ...predicate,
+        items: predicate.items.map((item, index) => validatePredicate(item, shape, admissionState, `${path}.items[${index}]`, ctx))
+      };
+    case "not":
+      return {
+        ...predicate,
+        item: validatePredicate(predicate.item, shape, admissionState, `${path}.item`, ctx)
+      };
+    case "eq":
+    case "neq":
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte": {
+      const { scalarKind: _authoredScalarKind, ...authoredPredicate } = predicate;
+      const scalarKind = resolveAndValidatePredicateProperty(predicate.propertyId, predicate.op, shape, path, ctx);
+      validatePredicateValue(predicate.propertyId, predicate.op, predicate.value, shape, path, ctx);
+      admitProperty(ctx, {
+        state: admissionState,
+        propertyId: predicate.propertyId,
+        use: "filter",
+        path
+      });
+      return {
+        ...authoredPredicate,
+        value: normalizeObjectQueryValue(predicate.value, scalarKind),
+        ...scalarKind ? { scalarKind } : {}
+      };
+    }
+    case "in": {
+      const { scalarKind: _authoredScalarKind, ...authoredPredicate } = predicate;
+      const scalarKind = resolveAndValidatePredicateProperty(predicate.propertyId, predicate.op, shape, path, ctx);
+      if (predicate.values.length === 0) {
+        addIssue(ctx, path, "empty_in_values", "Predicate 'in' must include at least one value");
+      }
+      predicate.values.forEach((value, index) => {
+        validatePredicateValue(predicate.propertyId, predicate.op, value, shape, `${path}.values[${index}]`, ctx);
+      });
+      admitProperty(ctx, {
+        state: admissionState,
+        propertyId: predicate.propertyId,
+        use: "filter",
+        path
+      });
+      return {
+        ...authoredPredicate,
+        values: predicate.values.map((value) => normalizeObjectQueryValue(value, scalarKind)),
+        ...scalarKind ? { scalarKind } : {}
+      };
+    }
+    case "exists":
+      resolveAndValidatePredicateProperty(predicate.propertyId, predicate.op, shape, path, ctx);
+      admitProperty(ctx, {
+        state: admissionState,
+        propertyId: predicate.propertyId,
+        use: "filter",
+        path
+      });
+      if (typeof predicate.value !== "boolean") {
+        addIssue(ctx, path, "invalid_exists_value", "Predicate 'exists' value must be boolean");
+      }
+      return predicate;
+    case "constant":
+      if (typeof predicate.value !== "boolean") {
+        addIssue(ctx, path, "invalid_constant_value", "Predicate 'constant' value must be boolean");
+      }
+      return predicate;
+    case "contains": {
+      const { scalarKind: _authoredScalarKind, ...authoredPredicate } = predicate;
+      const scalarKind = resolveAndValidatePredicateProperty(predicate.propertyId, predicate.op, shape, path, ctx);
+      validateContainsValue(predicate.propertyId, predicate.value, shape, path, ctx);
+      admitProperty(ctx, {
+        state: admissionState,
+        propertyId: predicate.propertyId,
+        use: "filter",
+        path
+      });
+      return {
+        ...authoredPredicate,
+        value: normalizeObjectQueryValue(predicate.value, scalarKind),
+        ...scalarKind ? { scalarKind } : {}
+      };
+    }
+  }
+}
+function resolveAndValidatePredicateProperty(propertyId, op, shape, path, ctx) {
+  const properties = getPropertiesForResult(propertyId, shape, path, ctx);
+  if (properties.length === 0)
+    return;
+  const schemas = [];
+  for (const { objectType, property } of properties) {
+    const schema = resolveSchemaForProperty(property, objectType.id, ctx, path);
+    if (schema)
+      schemas.push(schema);
+    if (isPrimaryExactPredicate(property, op)) {
+      continue;
+    }
+    if (property.query?.searchable !== true || property.query.filterable !== true) {
+      addIssue(ctx, path, "property_not_filterable", `Property '${propertyId}' on '${objectType.id}' must set query.searchable: true and query.filterable: true before it can be used in predicates`);
+      continue;
+    }
+    if (!schema)
+      continue;
+    if ((op === "lt" || op === "lte" || op === "gt" || op === "gte") && !isSortableSchema(schema)) {
+      addIssue(ctx, path, "operator_not_supported_for_schema", `Predicate '${op}' cannot be used with property '${propertyId}' on '${objectType.id}' because its schema is not orderable`);
+    }
+    if ((op === "eq" || op === "neq" || op === "in" || op === "exists") && !isExactSchema(schema)) {
+      addIssue(ctx, path, "operator_not_supported_for_schema", `Predicate '${op}' cannot be used with property '${propertyId}' on '${objectType.id}' because its schema cannot be exact-matched`);
+    }
+    if (op === "contains" && !isContainsSchema(schema)) {
+      addIssue(ctx, path, "operator_not_supported_for_schema", `Predicate 'contains' cannot be used with property '${propertyId}' on '${objectType.id}' because its schema is not string, array, or map`);
+    }
+  }
+  if (op === "exists")
+    return;
+  if (op === "contains")
+    return resolveArrayItemScalarKind(schemas, ctx);
+  return resolveCommonQueryScalarKind(schemas, propertyId, path, ctx);
+}
+function resolveArrayItemScalarKind(schemas, ctx) {
+  const kinds = new Set;
+  for (const schema of schemas) {
+    if (typeof schema === "string" || schema.type !== "array")
+      return;
+    const items = resolveValueTypeRefs(schema.items, ctx.valueTypesById);
+    kinds.add(items ? queryScalarKindForSchema(items) : undefined);
+  }
+  return kinds.size === 1 ? [...kinds][0] : undefined;
+}
+function resolveValueTypeRefs(schema, valueTypesById, seen = new Set) {
+  if (typeof schema === "string" || schema.type !== "valueTypeRef")
+    return schema;
+  if (seen.has(schema.valueTypeId))
+    return;
+  seen.add(schema.valueTypeId);
+  const resolved = schema._resolved ?? valueTypesById.get(schema.valueTypeId)?.schema;
+  return resolved ? resolveValueTypeRefs(resolved, valueTypesById, seen) : undefined;
+}
+function normalizeObjectQueryValue(value, scalarKind) {
+  try {
+    if (scalarKind === "decimal" && typeof value === "string")
+      return normalizeDecimalValue2(value);
+    if ((scalarKind === "date" || scalarKind === "timestamp") && isTemporalValue(value)) {
+      return normalizeSchemaValue2(scalarKind, value, "predicate value", NO_VALUE_TYPES);
+    }
+  } catch {
+    return value;
+  }
+  return value;
+}
+var NO_VALUE_TYPES = new Map;
+function isTemporalValue(value) {
+  return typeof value === "string" || value instanceof Date;
+}
+function resolveCommonQueryScalarKind(schemas, propertyId, path, ctx) {
+  const scalarKinds = schemas.map(queryScalarKindForSchema);
+  if (scalarKinds.length === 0 || scalarKinds.some((kind) => kind === undefined)) {
+    return;
+  }
+  const resolvedKinds = new Set(scalarKinds);
+  if (resolvedKinds.size === 1)
+    return scalarKinds[0];
+  addIssue(ctx, path, "incompatible_property_scalar_kinds", `Property '${propertyId}' resolves to incompatible scalar schemas: ${[...resolvedKinds].join(", ")}`);
+  return;
+}
+function validatePredicateValue(propertyId, op, value, shape, path, ctx) {
+  if (isCurrentUser(value)) {
+    validateCurrentUserPredicate(propertyId, op, shape, path, ctx);
+    return;
+  }
+  for (const { objectType, property } of getPropertiesForResult(propertyId, shape, path, ctx, {
+    reportMissing: false
+  })) {
+    try {
+      validatePropertyValue2(property, value, `${objectType.id}.${property.id}`, ctx.valueTypesById);
+    } catch (error) {
+      addIssue(ctx, path, "invalid_predicate_value", error instanceof Error ? error.message : `Invalid value for property '${property.id}' on '${objectType.id}'`);
+    }
+  }
+}
+function validateContainsValue(propertyId, value, shape, path, ctx) {
+  if (isCurrentUser(value)) {
+    validateCurrentUserPredicate(propertyId, "contains", shape, path, ctx);
+    return;
+  }
+  for (const { objectType, property } of getPropertiesForResult(propertyId, shape, path, ctx, {
+    reportMissing: false
+  })) {
+    const schema = resolveSchemaForProperty(property, objectType.id, ctx, path);
+    if (!schema)
+      continue;
+    if (typeof schema === "string") {
+      if (isContainsSchema(schema)) {
+        if (typeof value !== "string") {
+          addIssue(ctx, path, "invalid_contains_value", `Predicate 'contains' value for '${objectType.id}.${property.id}' must be a string`);
+        }
+      }
+      continue;
+    }
+    if (schema.type === "array") {
+      try {
+        validateSchemaValue2(schema.items, value, `${objectType.id}.${property.id}[]`, ctx.valueTypesById);
+      } catch (error) {
+        addIssue(ctx, path, "invalid_contains_value", error instanceof Error ? error.message : `Invalid contains value for '${objectType.id}.${property.id}'`);
+      }
+      continue;
+    }
+    if (schema.type === "map" && typeof value !== "string") {
+      addIssue(ctx, path, "invalid_contains_value", `Predicate 'contains' value for '${objectType.id}.${property.id}' must be a map key string`);
+    }
+  }
+}
+function validateCurrentUserPredicate(propertyId, op, shape, path, ctx) {
+  if (op !== "eq" && op !== "neq" && op !== "in" && op !== "contains") {
+    addIssue(ctx, path, "current_user_operator_not_supported", `Predicate '${op}' cannot compare currentUser(); use eq, neq, in, or contains.`);
+    return;
+  }
+  for (const { objectType, property } of getPropertiesForResult(propertyId, shape, path, ctx, {
+    reportMissing: false
+  })) {
+    if (holdsUserReferences(property.schema, op === "contains", ctx))
+      continue;
+    addIssue(ctx, path, "current_user_requires_user_reference", op === "contains" ? `currentUser() can only be found in a list of ref.user() values; '${objectType.id}.${property.id}' is not one.` : `currentUser() can only be compared with a ref.user() property; '${objectType.id}.${property.id}' is not one.`);
+  }
+}
+function holdsUserReferences(schema, list, ctx) {
+  const resolved = resolveValueTypeRefs(schema, ctx.valueTypesById);
+  if (!list)
+    return resolved === "userRef";
+  if (typeof resolved !== "object" || resolved.type !== "array")
+    return false;
+  return resolveValueTypeRefs(resolved.items, ctx.valueTypesById) === "userRef";
+}
+function validateTextQuery(query, fields, shape, admissionState, path, ctx) {
+  if (query.trim().length === 0) {
+    addIssue(ctx, path, "empty_text_query", "Text query must not be empty");
+  }
+  const fieldsByObjectType = fields ? undefined : {};
+  for (const objectType of getObjectTypesForResult(shape, ctx)) {
+    const fieldIds = fields ?? objectType.search?.defaultText;
+    if (!fieldIds || fieldIds.length === 0) {
+      addIssue(ctx, path, "missing_text_fields", `Object type '${objectType.id}' must define search.defaultText or the text query must specify fields`);
+      continue;
+    }
+    const admitted = admitTextFields(fieldIds, fields === undefined, {
+      state: admissionState,
+      objectTypeId: objectType.id,
+      path: `${path}.fields`,
+      ctx
+    });
+    if (fieldsByObjectType)
+      fieldsByObjectType[objectType.id] = uniqueStrings(admitted);
+    for (const fieldId of fieldIds) {
+      const property = getProperty(objectType, fieldId);
+      if (!property) {
+        addIssue(ctx, path, "unknown_text_field", `Text query references unknown property '${fieldId}' on '${objectType.id}'`);
+        continue;
+      }
+      assertStaticSearchProperty(objectType.id, property, "text query", path, ctx);
+      assertQueryFlag(objectType.id, property, "text", "text query", path, ctx);
+      const schema = resolveSchemaForProperty(property, objectType.id, ctx, path);
+      if (schema && !isTextSchema(schema)) {
+        addIssue(ctx, path, "text_field_not_string_like", `Text query field '${fieldId}' on '${objectType.id}' must be string-like`);
+      }
+    }
+  }
+  return fieldsByObjectType ? { fieldsByObjectType } : {};
+}
+function admitTextFields(fieldIds, defaults, input) {
+  const admitted = [];
+  let firstDenial;
+  for (const fieldId of fieldIds) {
+    const denial = input.ctx.admission.property({
+      state: input.state,
+      propertyId: fieldId,
+      objectTypeId: input.objectTypeId,
+      use: "text",
+      path: input.path
+    });
+    if (!denial) {
+      admitted.push(fieldId);
+    } else if (!defaults) {
+      recordAdmissionDenial(input.ctx, denial);
+    } else {
+      firstDenial ??= denial;
+    }
+  }
+  if (admitted.length === 0 && firstDenial)
+    recordAdmissionDenial(input.ctx, firstDenial);
+  return admitted;
+}
+function validateVectorProfileQuery(query, shape, state, path, ctx) {
+  const types = getObjectTypesForResult(shape, ctx);
+  if (types.length !== 1 || !Number.isSafeInteger(query.k) || query.k < 1 || query.k > MAX_VECTOR_K) {
+    addIssue(ctx, path, "invalid_vector_profile_query", `Vector search requires one type, one profile and k between 1 and ${MAX_VECTOR_K}`);
+    return query;
+  }
+  const objectType = types[0];
+  const profile = query.profile === undefined ? undefined : objectType.search?.vectors?.[query.profile];
+  if (!profile) {
+    addIssue(ctx, path, "unknown_vector_profile", `Unknown vector profile: ${query.profile}`);
+    return query;
+  }
+  for (const propertyId of profile.source)
+    admitProperty(ctx, { state, propertyId, objectTypeId: objectType.id, use: "vector", path });
+  let values = query.vector;
+  try {
+    if (typeof values === "string") {
+      if (!values.trim() || values.length > 8000) {
+        throw new Error("Vector search text must be nonempty and at most 8000 characters.");
+      }
+    } else {
+      values = normalizeVector2(values, profile.model.definition.dimensions);
+    }
+  } catch (error) {
+    addIssue(ctx, path, "invalid_vector", error instanceof Error ? error.message : "Invalid vector");
+  }
+  return {
+    ...query,
+    vector: values,
+    source: [...profile.source],
+    configuration: vectorConfiguration(profile)
+  };
+}
+function validateTraverse(linkId, direction, sourceObjectTypeId, shape, path, ctx) {
+  if (!linkId) {
+    addIssue(ctx, path, "missing_link_id", "traverse.linkId is required");
+    return { objectTypeIds: [] };
+  }
+  if (direction === "outgoing") {
+    if (sourceObjectTypeId !== undefined) {
+      addIssue(ctx, path, "traverse_source_not_applicable", "traverse.sourceObjectTypeId only applies to incoming traversal");
+    }
+    return validateOutgoingTraverse(linkId, shape, path, ctx);
+  }
+  return validateIncomingTraverse(linkId, sourceObjectTypeId, shape, path, ctx);
+}
+function validateOutgoingTraverse(linkId, shape, path, ctx) {
+  const targetTypeIds = [];
+  for (const objectType of getObjectTypesForResult(shape, ctx)) {
+    const link = objectType.links.find((candidate) => candidate.id === linkId);
+    if (!link) {
+      addIssue(ctx, path, "unknown_link", `Outgoing traversal references unknown link '${linkId}' on '${objectType.id}'`);
+      continue;
+    }
+    if (link.targetObjectTypeId === "*") {
+      addIssue(ctx, path, "wildcard_traverse_target", `Outgoing traversal over wildcard link '${objectType.id}.${linkId}' cannot infer a target object type`);
+      continue;
+    }
+    const declaredTargets = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
+    for (const targetId of declaredTargets) {
+      if (!ctx.ontology.getObjectTypeById(targetId)) {
+        addIssue(ctx, path, "unknown_link_target", `Outgoing traversal over '${objectType.id}.${linkId}' targets unknown object type '${targetId}'`);
+      } else {
+        targetTypeIds.push(targetId);
+      }
+    }
+  }
+  const objectTypeIds = uniqueStrings(targetTypeIds);
+  touchLinkTargets(objectTypeIds, ctx);
+  return { objectTypeIds };
+}
+function validateIncomingTraverse(linkId, sourceObjectTypeId, shape, path, ctx) {
+  let candidateTypes = ctx.ontology.listObjectTypes();
+  if (sourceObjectTypeId !== undefined) {
+    const sourceType = ctx.ontology.getObjectTypeById(sourceObjectTypeId);
+    if (!sourceType) {
+      addIssue(ctx, path, "unknown_traverse_source", `Incoming traversal references unknown source object type '${sourceObjectTypeId}'`);
+      return { objectTypeIds: [] };
+    }
+    candidateTypes = [sourceType];
+  }
+  const sourceTypeIds = [];
+  for (const sourceType of candidateTypes) {
+    const link = sourceType.links.find((candidate) => candidate.id === linkId);
+    if (!link)
+      continue;
+    if (link.targetObjectTypeId === "*") {
+      sourceTypeIds.push(sourceType.id);
+      continue;
+    }
+    const matches = shape.objectTypeIds.some((targetTypeId) => ctx.ontology.isValidLinkTarget(link.targetObjectTypeId, targetTypeId));
+    if (matches)
+      sourceTypeIds.push(sourceType.id);
+  }
+  if (sourceTypeIds.length === 0) {
+    addIssue(ctx, path, "incoming_link_not_found", `Incoming traversal found no source object types with link '${linkId}' targeting ${shape.objectTypeIds.join(" | ")}`);
+  }
+  return { objectTypeIds: uniqueStrings(sourceTypeIds) };
+}
+function validateExpansions(expansions, shape, admissionState, path, ctx, usersAllowed) {
+  return expansions.map((expansion, index) => validateExpansion(expansion, shape, admissionState, `${path}[${index}]`, ctx, usersAllowed));
+}
+function validateExpansion(expansion, shape, admissionState, path, ctx, usersAllowed) {
+  if (!expansion.linkId) {
+    addIssue(ctx, path, "missing_expand_link", "expand.linkId is required");
+    return expansion;
+  }
+  const targetShape = expansion.direction === "incoming" ? resolveIncomingExpansionTargets(expansion.linkId, expansion.sourceObjectTypeId, shape, path, ctx) : resolveOutgoingExpansionTargets(expansion.linkId, expansion.sourceObjectTypeId, shape, path, ctx);
+  const targetAdmissionState = admitTransition(ctx, ctx.admission.edge({
+    state: admissionState,
+    result: targetShape,
+    linkId: expansion.linkId,
+    direction: expansion.direction,
+    sourceObjectTypeId: expansion.sourceObjectTypeId,
+    use: "expand",
+    path
+  }));
+  for (const targetTypeId of targetShape.objectTypeIds) {
+    ctx.touchedObjectTypeIds.add(targetTypeId);
+  }
+  validateExpansionLimit(expansion.limit, path, ctx);
+  const orderBy = expansion.orderBy ? validateSortFields(expansion.orderBy, targetShape, targetAdmissionState, "expand.orderBy", `${path}.orderBy`, ctx) : undefined;
+  const expand = expansion.expand ? validateExpansions(expansion.expand, targetShape, targetAdmissionState, `${path}.expand`, ctx, usersAllowed) : undefined;
+  validateUserExpansions(expansion.users, targetShape, `${path}.users`, ctx, usersAllowed);
+  return { ...expansion, orderBy, expand };
+}
+function validateUserExpansions(users, shape, path, ctx, usersAllowed) {
+  if (users === undefined)
+    return;
+  if (!Array.isArray(users)) {
+    addIssue(ctx, path, "invalid_user_expansion", "expand.users must be an array of property ids");
+    return;
+  }
+  if (!usersAllowed && users.length > 0) {
+    addIssue(ctx, path, "invalid_user_expansion", "Only the outermost expand can expand user properties; a set operand cannot.");
+    return;
+  }
+  users.forEach((propertyId, index) => {
+    const propertyPath = `${path}[${index}]`;
+    if (typeof propertyId !== "string" || propertyId.length === 0) {
+      addIssue(ctx, propertyPath, "invalid_user_expansion", "expand.users ids must not be empty");
+      return;
+    }
+    const declared = getPropertiesForResult(propertyId, shape, propertyPath, ctx, {
+      reportMissing: false
+    });
+    if (declared.length === 0) {
+      addIssue(ctx, propertyPath, "unknown_property", `Expansion references property '${propertyId}' not present on result type ${shape.objectTypeIds.join(" | ")} (an expand abandoned by a later traverse?)`);
+      return;
+    }
+    for (const { objectType, property } of declared) {
+      if (isUserRefPropertySchema(property.schema))
+        continue;
+      addIssue(ctx, propertyPath, "invalid_user_expansion", `Property '${propertyId}' on '${objectType.id}' is not a ref.user() property; expand() takes a link or a user property.`);
+    }
+  });
+}
+function validateUserExpansionsProjected(users, input, path, ctx) {
+  if (!Array.isArray(users))
+    return;
+  const projected = projectedProperties(input);
+  if (projected === undefined)
+    return;
+  users.forEach((propertyId, index) => {
+    if (projected.includes(propertyId))
+      return;
+    addIssue(ctx, `${path}[${index}]`, "invalid_user_expansion", `Expanded user property '${propertyId}' must be projected too.`);
+  });
+}
+function projectedProperties(query) {
+  switch (query.kind) {
+    case "project":
+      return query.properties;
+    case "set":
+      return keptByEveryOperand(query.inputs.map(projectedProperties));
+    case "filter":
+    case "text":
+    case "vector":
+    case "rerank":
+    case "sort":
+    case "limit":
+    case "page":
+      return projectedProperties(query.input);
+    default:
+      return;
+  }
+}
+function keptByEveryOperand(projections) {
+  const projected = projections.filter((properties) => properties !== undefined);
+  if (projected.length === 0)
+    return;
+  return projected.reduce((kept, properties) => kept.filter((propertyId) => properties.includes(propertyId)));
+}
+function resolveOutgoingExpansionTargets(linkId, sourceObjectTypeId, shape, path, ctx) {
+  if (sourceObjectTypeId !== undefined) {
+    addIssue(ctx, path, "expand_source_not_applicable", "expand.sourceObjectTypeId only applies to incoming expansion");
+  }
+  const targetTypeIds = [];
+  let foundOnAnyType = false;
+  for (const objectType of getObjectTypesForResult(shape, ctx)) {
+    const link = objectType.links.find((candidate) => candidate.id === linkId);
+    if (!link)
+      continue;
+    foundOnAnyType = true;
+    if (link.targetObjectTypeId === "*") {
+      addIssue(ctx, path, "wildcard_expand_target", `Expansion over wildcard link '${objectType.id}.${linkId}' cannot infer a target object type`);
+      continue;
+    }
+    const declaredTargets = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
+    for (const targetId of declaredTargets) {
+      if (!ctx.ontology.getObjectTypeById(targetId)) {
+        addIssue(ctx, path, "unknown_expand_target", `Expansion over '${objectType.id}.${linkId}' targets unknown object type '${targetId}'`);
+      } else {
+        targetTypeIds.push(targetId);
+      }
+    }
+  }
+  if (!foundOnAnyType) {
+    addIssue(ctx, path, "unknown_expand_link", `Expansion references link '${linkId}' not present on result type ${shape.objectTypeIds.join(" | ")} (an expand abandoned by a later traverse?)`);
+  }
+  const objectTypeIds = uniqueStrings(targetTypeIds);
+  touchLinkTargets(objectTypeIds, ctx);
+  return { objectTypeIds };
+}
+function touchLinkTargets(objectTypeIds, ctx) {
+  for (const objectTypeId of withSubtypes(objectTypeIds, ctx)) {
+    ctx.touchedObjectTypeIds.add(objectTypeId);
+  }
+}
+function resolveIncomingExpansionTargets(linkId, sourceObjectTypeId, shape, path, ctx) {
+  let candidateTypes = ctx.ontology.listObjectTypes();
+  if (sourceObjectTypeId !== undefined) {
+    const sourceType = ctx.ontology.getObjectTypeById(sourceObjectTypeId);
+    if (!sourceType) {
+      addIssue(ctx, path, "unknown_expand_source", `Incoming expansion references unknown source object type '${sourceObjectTypeId}'`);
+      return { objectTypeIds: [] };
+    }
+    candidateTypes = [sourceType];
+  }
+  const sourceTypeIds = [];
+  for (const sourceType of candidateTypes) {
+    const link = sourceType.links.find((candidate) => candidate.id === linkId);
+    if (!link)
+      continue;
+    if (link.targetObjectTypeId === "*") {
+      sourceTypeIds.push(sourceType.id);
+      continue;
+    }
+    const matches = shape.objectTypeIds.some((targetTypeId) => ctx.ontology.isValidLinkTarget(link.targetObjectTypeId, targetTypeId));
+    if (matches)
+      sourceTypeIds.push(sourceType.id);
+  }
+  if (sourceTypeIds.length === 0) {
+    addIssue(ctx, path, "incoming_expand_link_not_found", `Incoming expansion found no source object types with link '${linkId}' targeting ${shape.objectTypeIds.join(" | ")}`);
+  }
+  return { objectTypeIds: uniqueStrings(sourceTypeIds) };
+}
+function validateExpansionLimit(limit, path, ctx) {
+  if (limit === undefined)
+    return;
+  if (!Number.isInteger(limit) || limit < 0) {
+    addIssue(ctx, `${path}.limit`, "invalid_expand_limit", "expand.limit must be a non-negative integer");
+  }
+}
+function validateSet(inputs, op, path, ctx) {
+  if (inputs.length === 0) {
+    addIssue(ctx, path, "empty_set", `Set operation '${op}' must include at least one input`);
+    return {
+      result: { objectTypeIds: [] },
+      query: { kind: "set", op, inputs },
+      admissionState: ctx.admission.empty()
+    };
+  }
+  const results = inputs.map((input, index) => validateQueryNode(input, `${path}.inputs[${index}]`, ctx));
+  const first = results[0]?.result ?? { objectTypeIds: [] };
+  const expected = keyForTypeIds(first.objectTypeIds);
+  results.forEach((result, index) => {
+    if (keyForTypeIds(result.result.objectTypeIds) !== expected) {
+      addIssue(ctx, `${path}.inputs[${index}]`, "incompatible_set_input", `Set operation '${op}' inputs must produce the same object type set`);
+    }
+  });
+  return {
+    result: first,
+    query: { kind: "set", op, inputs: results.map((result) => result.query) },
+    admissionState: ctx.admission.set({
+      op,
+      states: results.map((result) => result.admissionState),
+      path
+    })
+  };
+}
+function validateSortFields(fields, shape, admissionState, use, path, ctx) {
+  if (fields.length === 0) {
+    addIssue(ctx, path, "empty_sort", "Sort must include at least one field");
+    return [];
+  }
+  const seen = new Set;
+  return fields.map((field, index) => {
+    if (field.direction && field.direction !== "asc" && field.direction !== "desc") {
+      addIssue(ctx, `${path}.fields[${index}]`, "invalid_sort_direction", "Sort direction must be asc or desc");
+    }
+    const key = field.kind === "property" ? `property:${field.propertyId}` : "relevance";
+    if (seen.has(key)) {
+      addIssue(ctx, `${path}.fields[${index}]`, "duplicate_sort_field", `Duplicate sort field '${key}'`);
+    }
+    seen.add(key);
+    if (field.kind === "relevance")
+      return field;
+    admitProperty(ctx, {
+      state: admissionState,
+      propertyId: field.propertyId,
+      use,
+      path: `${path}.fields[${index}]`
+    });
+    const { scalarKind: _authoredScalarKind, ...authoredField } = field;
+    const schemas = [];
+    for (const { objectType, property } of getPropertiesForResult(field.propertyId, shape, `${path}.fields[${index}]`, ctx)) {
+      if (property.query?.searchable !== true || property.query.sortable !== true) {
+        addIssue(ctx, `${path}.fields[${index}]`, "property_not_sortable", `Property '${property.id}' on '${objectType.id}' must set query.searchable: true and query.sortable: true before it can be sorted`);
+        continue;
+      }
+      const schema = resolveSchemaForProperty(property, objectType.id, ctx, `${path}.fields[${index}]`);
+      if (schema)
+        schemas.push(schema);
+      if (schema && !isSortableSchema(schema)) {
+        addIssue(ctx, `${path}.fields[${index}]`, "sort_field_not_orderable", `Sort field '${property.id}' on '${objectType.id}' is not orderable`);
+      }
+    }
+    const scalarKind = resolveCommonQueryScalarKind(schemas, field.propertyId, `${path}.fields[${index}]`, ctx);
+    return { ...authoredField, ...scalarKind ? { scalarKind } : {} };
+  });
+}
+function validateLimit(limit, path, ctx) {
+  if (!Number.isInteger(limit) || limit < 0) {
+    addIssue(ctx, path, "invalid_limit", "limit must be a non-negative integer");
+  } else if (limit > ctx.maxLimit) {
+    addIssue(ctx, path, "limit_too_large", `limit must be <= ${ctx.maxLimit}`);
+  }
+}
+function validatePage(pageSize, pageToken, path, ctx) {
+  if (!Number.isInteger(pageSize) || pageSize <= 0) {
+    addIssue(ctx, path, "invalid_page_size", "pageSize must be a positive integer");
+  } else if (pageSize > ctx.maxPageSize) {
+    addIssue(ctx, path, "page_size_too_large", `pageSize must be <= ${ctx.maxPageSize}`);
+  }
+  if (pageToken !== undefined && pageToken.length === 0) {
+    addIssue(ctx, path, "empty_page_token", "pageToken must not be empty when provided");
+  }
+}
+function validateProjection(properties, shape, admissionState, path, ctx) {
+  if (!properties)
+    return;
+  if (properties.length === 0) {
+    addIssue(ctx, path, "empty_projection", "project.properties must not be empty when provided");
+  }
+  const seen = new Set;
+  properties.forEach((propertyId, index) => {
+    admitProperty(ctx, {
+      state: admissionState,
+      propertyId,
+      use: "project",
+      path: `${path}.properties[${index}]`
+    });
+    if (seen.has(propertyId)) {
+      addIssue(ctx, `${path}.properties[${index}]`, "duplicate_projection_property", `Duplicate projected property '${propertyId}'`);
+    }
+    seen.add(propertyId);
+    getPropertiesForResult(propertyId, shape, `${path}.properties[${index}]`, ctx);
+  });
+}
+function getObjectTypesForResult(shape, ctx) {
+  const objectTypes = [];
+  for (const objectTypeId of shape.objectTypeIds) {
+    const objectType = ctx.ontology.getObjectTypeById(objectTypeId);
+    if (objectType)
+      objectTypes.push(objectType);
+  }
+  return objectTypes;
+}
+function getPropertiesForResult(propertyId, shape, path, ctx, options = {}) {
+  const results = [];
+  for (const objectType of getObjectTypesForResult(shape, ctx)) {
+    const property = getProperty(objectType, propertyId);
+    if (!property) {
+      if (options.reportMissing === false) {
+        continue;
+      }
+      addIssue(ctx, path, "unknown_property", `Property '${propertyId}' does not exist on object type '${objectType.id}'`);
+      continue;
+    }
+    results.push({ objectType, property });
+  }
+  return results;
+}
+function getProperty(objectType, propertyId) {
+  return objectType.properties.find((property) => property.id === propertyId);
+}
+function assertStaticSearchProperty(objectTypeId, property, context, path, ctx) {
+  if (property.mode === "telemetry") {
+    addIssue(ctx, path, "telemetry_search_property", `${context} references telemetry property '${property.id}' on '${objectTypeId}'. Search can only reference static properties because telemetry latest values are not object-query indexed.`);
+  }
+}
+function assertQueryFlag(objectTypeId, property, flag, context, path, ctx) {
+  if (property.query?.searchable === true && property.query[flag] === true)
+    return;
+  addIssue(ctx, path, "query_field_not_enabled", `${context} field '${property.id}' on '${objectTypeId}' must set query.searchable: true and query.${flag}: true`);
+}
+function resolveSchemaForProperty(property, objectTypeId, ctx, path) {
+  try {
+    return resolveSchema(property.schema, ctx.valueTypesById);
+  } catch (error) {
+    addIssue(ctx, path, "unresolved_property_schema", error instanceof Error ? error.message : `Could not resolve schema for '${objectTypeId}.${property.id}'`);
+    return null;
+  }
+}
+function resolveSchema(schema, valueTypesById, seenValueTypeIds = new Set) {
+  if (typeof schema === "string")
+    return schema;
+  if (schema.type !== "valueTypeRef")
+    return schema;
+  if (seenValueTypeIds.has(schema.valueTypeId)) {
+    throw new Error(`Circular valueTypeRef '${schema.valueTypeId}'`);
+  }
+  const resolved = schema._resolved ?? valueTypesById.get(schema.valueTypeId)?.schema;
+  if (!resolved) {
+    throw new Error(`Unknown valueTypeRef '${schema.valueTypeId}'`);
+  }
+  seenValueTypeIds.add(schema.valueTypeId);
+  return resolveSchema(resolved, valueTypesById, seenValueTypeIds);
+}
+function isPrimaryExactPredicate(property, op) {
+  return property.primary === true && (op === "eq" || op === "in");
+}
+function keyForTypeIds(typeIds) {
+  return uniqueStrings(typeIds).sort().join("\x00");
+}
+function uniqueStrings(values) {
+  return [...new Set(values)];
+}
+function withSubtypes(objectTypeIds, ctx) {
+  return uniqueStrings(objectTypeIds.flatMap((id) => [id, ...ctx.ontology.listSubTypes(id)]));
+}
+function admitTransition(ctx, transition) {
+  if (transition.denial)
+    recordAdmissionDenial(ctx, transition.denial);
+  return transition.state;
+}
+function admitProperty(ctx, input) {
+  const denial = ctx.admission.property(input);
+  if (denial)
+    recordAdmissionDenial(ctx, denial);
+}
+function recordAdmissionDenial(ctx, denial) {
+  if (ctx.admissionDenials.length === 0)
+    ctx.admissionDenials.push(denial);
+}
+function addIssue(ctx, path, code, message) {
+  ctx.issues.push({ path, code, message });
+}
+
+// src/security/view-conditions.ts
+function resolveViewCondition(roleId, grant, ontology) {
+  if (!("condition" in grant) || grant.condition === undefined)
+    return;
+  const objectTypeId = grant.capability === "view" && grant.target === "object" ? onlyId(grant.selection) : undefined;
+  if (objectTypeId === undefined) {
+    throw new SecurityValidationError2(`[Sixb] Role '${roleId}' declares a condition on a grant that is not a view grant on one object type. Write can.view(Type).where(...).`);
+  }
+  const subject = viewConditionSubject({ roleId, objectTypeId });
+  if (!ontology) {
+    throw new SecurityValidationError2(`[Sixb] ${subject} needs the ontology to be validated.`);
+  }
+  const objectTypeIds = [objectTypeId, ...ontology.listSubTypes(objectTypeId)];
+  try {
+    const validated = validateObjectQueryWithAdmission({
+      kind: "filter",
+      input: { kind: "start", objectTypeId, includeSubtypes: true },
+      predicate: grant.condition
+    }, { ontology }, unmarkedPropertiesOnly(subject, objectTypeIds, ontology));
+    if (validated.query.kind !== "filter") {
+      throw new Error(`[Sixb] ${subject} did not validate as a filter.`);
+    }
+    const ordered = orderedTextComparison(validated.query.predicate);
+    if (ordered) {
+      throw new SecurityValidationError2(`[Sixb] ${subject} compares '${objectTypeId}.${ordered.propertyId}' with ${ordered.op}(). Storage providers order text differently, so a condition cannot order text: compare with eq, neq, in or contains instead.`);
+    }
+    return {
+      roleId,
+      objectTypeId,
+      predicate: deepFreeze2(structuredClone(validated.query.predicate))
+    };
+  } catch (error) {
+    if (!(error instanceof ObjectQueryValidationError2))
+      throw error;
+    const reasons = error.issues.map((issue) => issue.message).join("; ");
+    throw new SecurityValidationError2(`[Sixb] ${subject}: ${reasons}`);
+  }
+}
+function assertViewConditionsReadable(input) {
+  for (const condition of input.conditions) {
+    const predicate = bindCurrentUserPredicate(condition.predicate, STARTUP_CHECK_USER);
+    const objectTypeIds = [condition.objectTypeId, ...input.getSubTypes(condition.objectTypeId)];
+    try {
+      input.objectStorage.createConditionalReadScope({
+        projectId: input.projectId,
+        scope: compileConditionalObjectReadScope2({
+          kind: "conditional",
+          conditions: objectTypeIds.map((objectTypeId) => ({ objectTypeId, predicate }))
+        })
+      });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new SecurityValidationError2(`[Sixb] ${viewConditionSubject(condition)} cannot be read by the configured object storage: ${reason}`, { cause: error });
+    }
+  }
+}
+var STARTUP_CHECK_USER = Object.freeze({ type: "user", id: "usr_sixb_startup_check" });
+function viewConditionSubject(condition) {
+  return `Role '${condition.roleId}': can.view(${condition.objectTypeId}).where(...)`;
+}
+function orderedTextComparison(predicate) {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      for (const item of predicate.items) {
+        const ordered = orderedTextComparison(item);
+        if (ordered)
+          return ordered;
+      }
+      return null;
+    case "not":
+      return orderedTextComparison(predicate.item);
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte":
+      return predicate.scalarKind === "string" || predicate.scalarKind === "uuid" ? { propertyId: predicate.propertyId, op: predicate.op } : null;
+    default:
+      return null;
+  }
+}
+function onlyId(selection) {
+  if (selection.all || selection.ids.length !== 1)
+    return;
+  return selection.ids[0];
+}
+function unmarkedPropertiesOnly(subject, objectTypeIds, ontology) {
+  const state = Object.freeze({});
+  const admission = {
+    empty: () => state,
+    source: () => ({ state }),
+    edge: () => ({ state }),
+    set: () => state,
+    property: ({ propertyId }) => {
+      for (const objectTypeId of objectTypeIds) {
+        const property = ontology.getObjectTypeById(objectTypeId)?.properties.find((candidate) => candidate.id === propertyId);
+        const markings = property?.markings ?? [];
+        if (markings.length === 0)
+          continue;
+        return new SecurityValidationError2(`[Sixb] ${subject} reads '${objectTypeId}.${propertyId}', which carries [${markings.join(", ")}]. A condition can only read unmarked properties.`);
+      }
+      return;
+    }
+  };
+  return Object.freeze(admission);
+}
+function deepFreeze2(value) {
+  if (typeof value !== "object" || value === null)
+    return value;
+  for (const child of Object.values(value))
+    deepFreeze2(child);
+  return Object.freeze(value);
+}
+
 // src/security/registry.ts
 class SecurityRegistry {
   markingsById;
@@ -699,6 +2127,7 @@ class SecurityRegistry {
   rolesById;
   membershipPoliciesById;
   resolvedRoles;
+  viewConditions;
   constructor(input) {
     const definitions = validateSecurityDefinitionsAtStartup({
       markings: input.markings ?? [],
@@ -715,6 +2144,7 @@ class SecurityRegistry {
       connectorIds: input.connectorIds,
       shareIds: input.shareIds
     });
+    this.viewConditions = definitions.roles.flatMap((role) => role.grants.flatMap((grant) => resolveViewCondition(role.id, grant, input.ontology) ?? []));
     const universe = {
       objectTypeIds: input.objectTypeIds ?? new Set,
       datasetIds: input.datasetIds ?? new Set,
@@ -730,12 +2160,17 @@ class SecurityRegistry {
     this.groupsById = definitions.groupsById;
     this.rolesById = definitions.rolesById;
     this.membershipPoliciesById = definitions.membershipPoliciesById;
-    this.resolvedRoles = definitions.roles.map((role) => ({
-      id: role.id,
-      grantedToGroupIds: role.grantedToGroupIds,
-      grants: resolveRoleGrants2(role, universe),
-      clearances: new Set(role.clearances ?? [])
-    }));
+    this.resolvedRoles = definitions.roles.map((role) => {
+      const grants = resolveRoleGrants2(role, universe);
+      const viewConditions = resolveRoleViewConditions2(this.viewConditions.filter((condition) => condition.roleId === role.id), grants, universe);
+      return {
+        id: role.id,
+        grantedToGroupIds: role.grantedToGroupIds,
+        grants,
+        ...viewConditions.size > 0 ? { viewConditions } : {},
+        clearances: new Set(role.clearances ?? [])
+      };
+    });
   }
   listMarkings() {
     return [...this.markingsById.values()];
@@ -758,6 +2193,9 @@ class SecurityRegistry {
   listResolvedRoles() {
     return this.resolvedRoles;
   }
+  listViewConditions() {
+    return this.viewConditions;
+  }
   listMembershipPolicies() {
     return [...this.membershipPoliciesById.values()];
   }
@@ -1660,6 +3098,20 @@ class InMemoryAuthSessionStore {
       return created !== 0 ? created : b.id.localeCompare(a.id);
     }).map(cloneRecord);
   }
+  async listByUserId(params) {
+    const before = params.before;
+    const offset = before?.skip ?? 0;
+    const sessions = [...this.state.sessions.values()].filter((session) => session.projectId === params.projectId).filter((session) => session.userId === params.userId).filter((session) => !before || session.createdAt <= before.createdAt).sort((a, b) => {
+      const created = b.createdAt.getTime() - a.createdAt.getTime();
+      if (created !== 0)
+        return created;
+      return a.id < b.id ? 1 : a.id > b.id ? -1 : 0;
+    });
+    return {
+      sessions: sessions.slice(offset, offset + params.limit).map(cloneRecord),
+      hasMore: sessions.length > offset + params.limit
+    };
+  }
   async findValidByTokenHash(params) {
     const session = this.state.sessions.get(sessionKey(params.projectId, params.id));
     if (!session || session.bearer || session.tokenHash !== params.tokenHash || !isActiveSession(session, params.now)) {
@@ -1787,6 +3239,12 @@ class InMemoryAuthUserStore {
     const record = this.state.users.get(userKey(params.projectId, params.id)) ?? null;
     return cloneOptionalRecord(record);
   }
+  async getByIds(params) {
+    return [...new Set(params.ids)].flatMap((id) => {
+      const record = this.state.users.get(userKey(params.projectId, id));
+      return record ? [cloneRecord(record)] : [];
+    });
+  }
   async getByEmail(params) {
     return cloneOptionalRecord(getUserByEmail(this.state, params.projectId, params.email));
   }
@@ -1796,14 +3254,19 @@ class InMemoryAuthUserStore {
     if (!existing) {
       throw new AuthStorageError2("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
+    const displayName = profileValue(input.displayName, existing.displayName);
+    const avatarUrl = profileValue(input.avatarUrl, existing.avatarUrl);
+    if (displayName === existing.displayName && avatarUrl === existing.avatarUrl) {
+      return { user: cloneRecord(existing), previousUser: cloneRecord(existing) };
+    }
     const next = {
       ...existing,
-      displayName: input.displayName,
-      avatarUrl: input.avatarUrl,
+      displayName,
+      avatarUrl,
       updatedAt: dateOrNow(input.updatedAt)
     };
     this.state.users.set(key, cloneRecord(next));
-    return cloneRecord(next);
+    return { user: cloneRecord(next), previousUser: cloneRecord(existing) };
   }
   async updateStatus(input) {
     const key = userKey(input.projectId, input.id);
@@ -1817,15 +3280,16 @@ class InMemoryAuthUserStore {
       updatedAt: dateOrNow(input.updatedAt)
     };
     this.state.users.set(key, cloneRecord(next));
-    return cloneRecord(next);
+    return { user: cloneRecord(next), previousUser: cloneRecord(existing) };
   }
   async list(input) {
     if (input.statuses?.length === 0) {
       return { users: [], hasMore: false, total: 0 };
     }
     const statuses = input.statuses ? new Set(input.statuses) : null;
+    const search = input.search?.toLowerCase();
     const order = input.order ?? "desc";
-    const rows = [...this.state.users.values()].filter((user) => user.projectId === input.projectId).filter((user) => statuses ? statuses.has(user.status) : true).sort((a, b) => compareByCreatedAt(a, b, order));
+    const rows = [...this.state.users.values()].filter((user) => user.projectId === input.projectId).filter((user) => statuses ? statuses.has(user.status) : true).filter((user) => search === undefined ? true : userMatches(user, search)).sort((a, b) => compareByCreatedAt(a, b, order));
     const page = paginate(rows, input);
     return {
       users: page.page.map(cloneRecord),
@@ -1834,6 +3298,12 @@ class InMemoryAuthUserStore {
     };
   }
 }
+function profileValue(value, current) {
+  return value === undefined ? current : value ?? undefined;
+}
+function userMatches(user, search) {
+  return (user.displayName?.toLowerCase().includes(search) ?? false) || user.email.toLowerCase().includes(search);
+}
 
 // src/storage/auth/in-memory/auth-storage.ts
 class InMemoryAuthStorage2 {
@@ -1956,6 +3426,7 @@ class InMemoryAuthStorage2 {
       tokenHash: input.tokenHash,
       consumedAt: completedAt
     });
+    const previousUser = existingUser ? cloneRecord(existingUser) : null;
     let user = existingUser;
     if (!user) {
       user = {
@@ -1994,7 +3465,8 @@ class InMemoryAuthStorage2 {
       user: cloneRecord(user),
       session: cloneRecord(session),
       invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
-      groupMemberships: memberships.map(cloneRecord)
+      groupMemberships: memberships.map(cloneRecord),
+      previousUser
     };
   }
   async completeOidcSignIn(input) {
@@ -2039,6 +3511,7 @@ class InMemoryAuthStorage2 {
       }
     }
     this.consumeOidcAttempt(input, completedAt, projectId);
+    const previousUser = user ? cloneRecord(user) : null;
     if (!user) {
       user = {
         id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
@@ -2051,6 +3524,8 @@ class InMemoryAuthStorage2 {
         updatedAt: completedAt
       };
       this.state.users.set(userKey(projectId, user.id), cloneRecord(user));
+    } else {
+      user = this.refreshProviderProfile(user, input, completedAt);
     }
     const invitation = this.acceptInvitationAndApplyGroups({
       activeInvitation,
@@ -2093,7 +3568,8 @@ class InMemoryAuthStorage2 {
       session: cloneRecord(session),
       identity: cloneRecord(nextIdentity),
       invitation: invitation.invitation ? cloneRecord(invitation.invitation) : undefined,
-      groupMemberships: memberships.map(cloneRecord)
+      groupMemberships: memberships.map(cloneRecord),
+      previousUser
     };
   }
   async suspendUserAndRevokeSessions(input) {
@@ -2109,7 +3585,17 @@ class InMemoryAuthStorage2 {
     };
     this.state.users.set(key, cloneRecord(next));
     revokeActiveSessionsForUser(this.state, input.projectId, input.userId, input.suspendedAt);
-    return cloneRecord(next);
+    return { user: cloneRecord(next), previousUser: cloneRecord(existing) };
+  }
+  refreshProviderProfile(user, input, updatedAt) {
+    const displayName = input.displayName ?? user.displayName;
+    const avatarUrl = input.avatarUrl ?? user.avatarUrl;
+    if (displayName === user.displayName && avatarUrl === user.avatarUrl) {
+      return user;
+    }
+    const next = { ...user, displayName, avatarUrl, updatedAt: cloneDate(updatedAt) };
+    this.state.users.set(userKey(user.projectId, user.id), cloneRecord(next));
+    return next;
   }
   acceptInvitationAndApplyGroups(input) {
     if (!input.activeInvitation) {
@@ -2184,6 +3670,166 @@ function restoreMap(target, snapshot) {
     target.set(key, value);
   }
 }
+// src/users/execution.ts
+var DEFAULT_LIMIT = 50;
+var MAX_LIMIT = 200;
+var MAX_SEARCH_LENGTH = 200;
+function createUsersRuntime(runtime) {
+  const assertReadable = () => assertAuthorized2(runtime, { kind: "users.view" });
+  return {
+    get: async (user) => {
+      assertReadable();
+      if (!isUserRef(user)) {
+        throw new Error("[Sixb] users.get expects a user reference, such as userRef(id).");
+      }
+      const users = runtime.storage.auth?.users;
+      if (!users)
+        return null;
+      const record = await users.getById({ projectId: runtime.projectId, id: user.id });
+      return record ? toUserProfile(record) : null;
+    },
+    list: async (input = {}) => {
+      assertReadable();
+      const limit = listLimit(input.limit);
+      const offset = listOffset(input.offset);
+      const search = listSearch(input.search);
+      const users = runtime.storage.auth?.users;
+      if (!users)
+        return { users: [], hasMore: false, total: 0 };
+      const page = await users.list({
+        projectId: runtime.projectId,
+        ...statusFilter(input.status),
+        ...search === undefined ? {} : { search },
+        limit,
+        offset,
+        order: "asc"
+      });
+      return {
+        users: page.users.map(toUserProfile),
+        hasMore: page.hasMore,
+        total: page.total
+      };
+    }
+  };
+}
+function toUserProfile(record) {
+  return {
+    id: record.id,
+    email: record.email,
+    ...record.displayName === undefined ? {} : { displayName: record.displayName },
+    ...record.avatarUrl === undefined ? {} : { avatarUrl: record.avatarUrl },
+    status: record.status
+  };
+}
+function statusFilter(status = "active") {
+  if (status === "all")
+    return {};
+  if (status === "active" || status === "suspended")
+    return { statuses: [status] };
+  throw new Error(`[Sixb] users.list status must be "active", "suspended", or "all".`);
+}
+function listSearch(search) {
+  const trimmed = search?.trim();
+  if (!trimmed)
+    return;
+  if (trimmed.length <= MAX_SEARCH_LENGTH)
+    return trimmed;
+  throw new Error(`[Sixb] users.list search must be at most ${MAX_SEARCH_LENGTH} characters.`);
+}
+function listLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_LIMIT;
+  if (Number.isInteger(limit) && limit >= 1 && limit <= MAX_LIMIT)
+    return limit;
+  throw new Error(`[Sixb] users.list limit must be an integer from 1 to ${MAX_LIMIT}.`);
+}
+function listOffset(offset) {
+  if (offset === undefined)
+    return 0;
+  if (Number.isInteger(offset) && offset >= 0)
+    return offset;
+  throw new Error("[Sixb] users.list offset must be a non-negative integer.");
+}
+
+// src/auth/member-events.ts
+function signInEvents(result) {
+  const user = toUserProfile(result.user);
+  if (result.previousUser === null) {
+    return [
+      {
+        type: "user.joined",
+        payload: {
+          user,
+          ...result.invitation ? { invitationId: result.invitation.id } : {}
+        },
+        idempotencyKey: `user.joined:${user.id}`
+      }
+    ];
+  }
+  const changes = profileChanges(result.previousUser, result.user);
+  if (!hasChanges(changes))
+    return [];
+  return [{ type: "user.profile.updated", payload: { user, changes } }];
+}
+function profileUpdatedEvents(caller, previousUser, user) {
+  const changes = profileChanges(previousUser, user);
+  if (!hasChanges(changes))
+    return [];
+  return [
+    {
+      type: "user.profile.updated",
+      payload: { user: toUserProfile(user), changes, requestedBy: requester(caller) }
+    }
+  ];
+}
+function statusChangedEvents(caller, previousUser, user) {
+  if (previousUser.status === user.status)
+    return [];
+  return [
+    {
+      type: user.status === "suspended" ? "user.suspended" : "user.reactivated",
+      payload: { user: toUserProfile(user), requestedBy: requester(caller) }
+    }
+  ];
+}
+function invitedEvents(caller, invitation) {
+  return [
+    {
+      type: "user.invited",
+      payload: {
+        invitationId: invitation.id,
+        email: invitation.email,
+        expiresAt: invitation.expiresAt.toISOString(),
+        requestedBy: requester(caller)
+      }
+    }
+  ];
+}
+function profileChanges(before, after) {
+  const displayName = fieldChange(before.displayName, after.displayName);
+  const avatarUrl = fieldChange(before.avatarUrl, after.avatarUrl);
+  return {
+    ...displayName ? { displayName } : {},
+    ...avatarUrl ? { avatarUrl } : {}
+  };
+}
+function fieldChange(before, after) {
+  if (after === undefined) {
+    return before === undefined ? undefined : { operation: "cleared", before, after: null };
+  }
+  if (before === undefined)
+    return { operation: "created", after };
+  if (before === after)
+    return;
+  return { operation: "updated", before, after };
+}
+function hasChanges(changes) {
+  return changes.displayName !== undefined || changes.avatarUrl !== undefined;
+}
+function requester(caller) {
+  return { type: caller.principal.type, id: caller.principal.id };
+}
+
 // src/auth/session-cache.ts
 class SessionCache {
   ttlMs;
@@ -2296,6 +3942,7 @@ var SESSION_TOUCH_INTERVAL_MS = 60000;
 var ACCESS_TOKEN_TOUCH_INTERVAL_MS = 60000;
 var BEARER_ACCESS_TOKEN_TTL_MS = 15 * 60000;
 var REFRESH_REUSE_GRACE_MS = 60000;
+var PROFILE_FIELDS = ["displayName", "avatarUrl"];
 
 class AuthRuntime2 {
   projectId;
@@ -2303,10 +3950,12 @@ class AuthRuntime2 {
   security;
   config;
   sessionCache;
+  events;
   constructor(options) {
     this.projectId = options.projectId;
     this.storage = options.storage;
     this.security = options.security;
+    this.events = options.events;
     this.config = resolveAuthConfig2(options.config);
     this.sessionCache = this.config.session.cacheTtlMs > 0 ? new SessionCache(this.config.session.cacheTtlMs) : null;
     if (this.isEnabled() && !this.storage.auth) {
@@ -2623,6 +4272,38 @@ class AuthRuntime2 {
       });
     } catch {}
   }
+  async completeMagicLinkSignIn(input) {
+    const strategy = this.getStrategy();
+    if (!isMagicLinkAuthStrategy2(strategy)) {
+      throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support magic-link sign-in.");
+    }
+    const result = await strategy.completeMagicLinkSignIn({
+      projectId: this.projectId,
+      authStorage: this.requireAuthStorage(),
+      magicLinkId: input.magicLinkId,
+      token: input.token,
+      session: input.session,
+      displayName: signInDisplayName2(input.displayName)
+    });
+    await this.emitMemberEvents(signInEvents(result));
+    return result;
+  }
+  async completeOidcSignIn(input) {
+    const strategy = this.getStrategy();
+    if (!isOidcAuthStrategy2(strategy)) {
+      throw new AuthRuntimeError2("invalid_auth_config", "[Sixb] The active auth strategy does not support OIDC sign-in.");
+    }
+    const result = await strategy.completeOidcSignIn({
+      projectId: this.projectId,
+      authStorage: this.requireAuthStorage(),
+      requestUrl: input.requestUrl,
+      requestOrigin: input.requestOrigin,
+      session: input.session
+    });
+    this.sessionCache?.invalidateUser(result.user.id);
+    await this.emitMemberEvents(signInEvents(result));
+    return result;
+  }
   contextFromSession(session) {
     return resolveAuthorizationContext2({
       principal: session.principal,
@@ -2924,12 +4605,13 @@ class AuthRuntime2 {
     if (user.id === caller.user.id) {
       throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
     }
-    const suspended = await storage.suspendUserAndRevokeSessions({
+    const { user: suspended, previousUser } = await storage.suspendUserAndRevokeSessions({
       projectId: this.projectId,
       userId: user.id,
       suspendedAt: new Date
     });
     this.sessionCache?.invalidateUser(user.id);
+    await this.emitMemberEvents(statusChangedEvents(caller, previousUser, suspended));
     return { user: suspended, groupIds, managedGroupIds };
   }
   async reactivateMember(caller, input) {
@@ -2937,14 +4619,64 @@ class AuthRuntime2 {
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
     const { user, groupIds, managedGroupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
-    const reactivated = await storage.users.updateStatus({
+    const { user: reactivated, previousUser } = await storage.users.updateStatus({
       projectId: this.projectId,
       id: user.id,
       status: "active",
       updatedAt: new Date
     });
+    await this.emitMemberEvents(statusChangedEvents(caller, previousUser, reactivated));
     return { user: reactivated, groupIds, managedGroupIds };
   }
+  async getProfile(caller) {
+    const storage = this.requireAuthStorage();
+    const user = await storage.users.getById({ projectId: this.projectId, id: caller.user.id });
+    if (!user) {
+      throw new AuthStorageError2("missing_user", `[Sixb] User '${caller.user.id}' not found for project '${this.projectId}'.`);
+    }
+    return {
+      profile: toUserProfile(user),
+      managedFields: await this.managedProfileFields(storage, user.id)
+    };
+  }
+  async updateProfile(caller, input) {
+    const changes = normalizeProfileChanges(input);
+    const storage = this.requireAuthStorage();
+    const managedFields = await this.managedProfileFields(storage, caller.user.id);
+    const managedChanges = managedFields.filter((field) => changes[field] !== undefined);
+    if (managedChanges.length > 0) {
+      throw new AuthRuntimeError2("authorization_denied", `[Sixb] Your identity provider manages ${managedChanges.join(" and ")}. ` + `Change ${managedChanges.length > 1 ? "them" : "it"} there.`);
+    }
+    const { user, previousUser } = await storage.users.updateProfile({
+      projectId: this.projectId,
+      id: caller.user.id,
+      ...changes,
+      updatedAt: new Date
+    });
+    const changed = user.displayName !== previousUser.displayName || user.avatarUrl !== previousUser.avatarUrl;
+    if (changed) {
+      this.sessionCache?.invalidateUser(user.id);
+    }
+    await this.emitMemberEvents(profileUpdatedEvents(caller, previousUser, user));
+    return { profile: toUserProfile(user), managedFields };
+  }
+  async managedProfileFields(storage, userId) {
+    const strategy = this.getStrategy();
+    if (!strategy?.providerProfileFields) {
+      return [];
+    }
+    const identities = await storage.identities.listForUser({ projectId: this.projectId, userId });
+    const managed = new Set;
+    for (const identity of identities) {
+      if (identity.strategyId !== strategy.id) {
+        continue;
+      }
+      for (const field of strategy.providerProfileFields(identity)) {
+        managed.add(field);
+      }
+    }
+    return PROFILE_FIELDS.filter((field) => managed.has(field));
+  }
   async listSessions(caller) {
     return this.requireAuthStorage().sessions.listActiveByUserId({
       projectId: this.projectId,
@@ -3041,13 +4773,11 @@ class AuthRuntime2 {
       status: delivery.status,
       ...input.revealLink && delivery.link ? { link: delivery.link } : {}
     };
-    if (delivery.status === "not_supported") {
-      return { invitation, delivery };
-    }
-    if (delivery.status !== "sent") {
+    if (delivery.status !== "sent" && delivery.status !== "not_supported") {
       await this.revokeInvitationAfterDeliveryFailure(authStorage, invitation, now);
       throw this.createInvitationDeliveryError(delivery.status);
     }
+    await this.emitMemberEvents(invitedEvents(caller, invitation));
     return { invitation, delivery };
   }
   async listInvitations(caller, input = {}) {
@@ -3090,6 +4820,11 @@ class AuthRuntime2 {
       })
     };
   }
+  async emitMemberEvents(events) {
+    if (events.length === 0)
+      return;
+    await this.events.emit({ events }, { source: "Sixb" });
+  }
   requireAuthStorage() {
     if (!this.storage.auth) {
       throw new AuthRuntimeError2("auth_storage_missing", "[Sixb] Auth is enabled but storage.auth is not configured.");
@@ -3263,6 +4998,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, project2, can2, bindCurrentUser, bindCurrentUserPredicate, INDEXING_EMBEDDING_TIMEOUT_MS, vectorConfiguration, vectorSources, normalizeVector2, vectorSearchCandidateLimit2, hasVectorProfile2, isVectorProfileQuery2, MAX_RERANK_INPUT_BYTES, composeObjectQueryAdmissions, validateObjectQuery2, validateObjectQueryWithAdmission, collectObjectQueryValidationIssues2, resolveObjectQueryResultShape2, assertViewConditionsReadable, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, createUsersRuntime, toUserProfile, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=DF55B99B002A92F564756E2164756E21
+//# debugId=86A4C82302343CA464756E2164756E21