@sixb/core 0.1.6 → 0.1.7

package/dist/{chunk-md8k0r54.js → chunk-3fqt22c4.js}

@@ -11,15 +11,15 @@ import {
   objectBatchKey,
   objectLinkCursor,
   queryScalarValuesEqual
-} from "./chunk-t624af60.js";
+} from "./chunk-6ed5bwnd.js";
 import {
   assertAuthorized,
   isAllowed
-} from "./chunk-f83ka50g.js";
+} from "./chunk-37wk412q.js";
 import {
   validatePropertyValue,
   validateSchemaValue
-} from "./chunk-rnshztfq.js";
+} from "./chunk-d63tybny.js";
 import {
   normalizeDecimalValue
 } from "./chunk-04b07a9q.js";
@@ -28,7 +28,7 @@ import {
 } from "./chunk-dktq02ne.js";
 import {
   stableJsonStringify
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 // src/objects/query/planner.ts
 var DEFAULT_MAX_FALLBACK_ROWS = 1000;
 var fallbackNodeKinds = new Set([

package/dist/{chunk-t9xghkva.js → chunk-3kv70xwp.js}

@@ -17,7 +17,8 @@ async function findAgentRunExecution(input) {
     id: input.executionId
   });
   const authority = execution?.authorizationRef;
-  if (!execution || execution.source.type !== "execution" || execution.executor.type !== "agent" || execution.executor.runId !== input.runId || authority?.type !== "principal" || authority.principal.type !== "serviceAccount" || authority.principal.id !== input.serviceAccountId || authority.credential !== undefined) {
+  const validAuthority = input.authority.type === "managed" ? authority?.type === "principal" && authority.principal.type === "serviceAccount" && authority.principal.id === input.authority.serviceAccountId && authority.credential === undefined : authority?.type === "disabled" || authority?.type === "principal" && authority.principal.type === "user" && authority.credential !== undefined;
+  if (!execution || execution.source.type !== "execution" || execution.executor.type !== "agent" || execution.executor.runId !== input.runId || !validAuthority) {
     return null;
   }
   return execution;
@@ -25,4 +26,4 @@ async function findAgentRunExecution(input) {
 
 export { findPrimitiveRunExecution, findAgentRunExecution };
 
-//# debugId=5E24C6B3FD9A6F0464756E2164756E21
+//# debugId=4CB7F7085BDD770364756E2164756E21

package/dist/{chunk-t9xghkva.js.map → chunk-3kv70xwp.js.map}

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/storage/executions/run-link.ts"],
   "sourcesContent": [
-    "import type { TrustedPrimitiveRef } from \"../../execution/types\"\nimport type { ExecutionRecord, ExecutionStorage } from \"./types\"\n\n/**\n * Find the immutable execution that is the authority owned by a primitive run.\n *\n * ExecutionStorage owns generic provenance invariants. Primitive providers remain responsible for\n * deciding which sources they accept and translating a mismatch to their domain-specific error.\n */\nexport async function findPrimitiveRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly primitive: TrustedPrimitiveRef\n  readonly sourceTypes: readonly (\n    | \"datasetVersion\"\n    | \"event\"\n    | \"execution\"\n    | \"schedule\"\n    | \"webhook\"\n  )[]\n}): Promise<ExecutionRecord | null> {\n  const execution = await input.executions.getById({\n    projectId: input.projectId,\n    id: input.executionId,\n  })\n  const authority = execution?.authorizationRef\n  if (\n    !execution ||\n    !input.sourceTypes.some((type) => type === execution.source.type) ||\n    execution.executor.type !== \"primitive\" ||\n    execution.executor.kind !== input.primitive.kind ||\n    execution.executor.runId !== input.primitive.runId ||\n    authority?.type !== \"trustedPrimitive\" ||\n    authority.primitive.kind !== input.primitive.kind ||\n    authority.primitive.id !== input.primitive.id ||\n    authority.primitive.runId !== input.primitive.runId\n  ) {\n    return null\n  }\n  return execution\n}\n\n/** Find the immutable execution and service-account authority owned by one Agent run. */\nexport async function findAgentRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly serviceAccountId: string\n}): Promise<ExecutionRecord | null> {\n  const execution = await input.executions.getById({\n    projectId: input.projectId,\n    id: input.executionId,\n  })\n  const authority = execution?.authorizationRef\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.executor.type !== \"agent\" ||\n    execution.executor.runId !== input.runId ||\n    authority?.type !== \"principal\" ||\n    authority.principal.type !== \"serviceAccount\" ||\n    authority.principal.id !== input.serviceAccountId ||\n    authority.credential !== undefined\n  ) {\n    return null\n  }\n  return execution\n}\n"
+    "import type { TrustedPrimitiveRef } from \"../../execution/types\"\nimport type { ExecutionRecord, ExecutionStorage } from \"./types\"\n\n/**\n * Find the immutable execution that is the authority owned by a primitive run.\n *\n * ExecutionStorage owns generic provenance invariants. Primitive providers remain responsible for\n * deciding which sources they accept and translating a mismatch to their domain-specific error.\n */\nexport async function findPrimitiveRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly primitive: TrustedPrimitiveRef\n  readonly sourceTypes: readonly (\n    | \"datasetVersion\"\n    | \"event\"\n    | \"execution\"\n    | \"schedule\"\n    | \"webhook\"\n  )[]\n}): Promise<ExecutionRecord | null> {\n  const execution = await input.executions.getById({\n    projectId: input.projectId,\n    id: input.executionId,\n  })\n  const authority = execution?.authorizationRef\n  if (\n    !execution ||\n    !input.sourceTypes.some((type) => type === execution.source.type) ||\n    execution.executor.type !== \"primitive\" ||\n    execution.executor.kind !== input.primitive.kind ||\n    execution.executor.runId !== input.primitive.runId ||\n    authority?.type !== \"trustedPrimitive\" ||\n    authority.primitive.kind !== input.primitive.kind ||\n    authority.primitive.id !== input.primitive.id ||\n    authority.primitive.runId !== input.primitive.runId\n  ) {\n    return null\n  }\n  return execution\n}\n\n/** Find the immutable execution and authority owned by one Agent run. */\nexport async function findAgentRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly authority:\n    | { readonly type: \"managed\"; readonly serviceAccountId: string }\n    | { readonly type: \"inherited\" }\n}): Promise<ExecutionRecord | null> {\n  const execution = await input.executions.getById({\n    projectId: input.projectId,\n    id: input.executionId,\n  })\n  const authority = execution?.authorizationRef\n  const validAuthority =\n    input.authority.type === \"managed\"\n      ? authority?.type === \"principal\" &&\n        authority.principal.type === \"serviceAccount\" &&\n        authority.principal.id === input.authority.serviceAccountId &&\n        authority.credential === undefined\n      : authority?.type === \"disabled\" ||\n        (authority?.type === \"principal\" &&\n          authority.principal.type === \"user\" &&\n          authority.credential !== undefined)\n\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.executor.type !== \"agent\" ||\n    execution.executor.runId !== input.runId ||\n    !validAuthority\n  ) {\n    return null\n  }\n  return execution\n}\n"
   ],
-  "mappings": ";;AASA,eAAsB,yBAAyB,CAAC,OAYZ;AAAA,EAClC,MAAM,YAAY,MAAM,MAAM,WAAW,QAAQ;AAAA,IAC/C,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,YAAY,WAAW;AAAA,EAC7B,IACE,CAAC,aACD,CAAC,MAAM,YAAY,KAAK,CAAC,SAAS,SAAS,UAAU,OAAO,IAAI,KAChE,UAAU,SAAS,SAAS,eAC5B,UAAU,SAAS,SAAS,MAAM,UAAU,QAC5C,UAAU,SAAS,UAAU,MAAM,UAAU,SAC7C,WAAW,SAAS,sBACpB,UAAU,UAAU,SAAS,MAAM,UAAU,QAC7C,UAAU,UAAU,OAAO,MAAM,UAAU,MAC3C,UAAU,UAAU,UAAU,MAAM,UAAU,OAC9C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,qBAAqB,CAAC,OAMR;AAAA,EAClC,MAAM,YAAY,MAAM,MAAM,WAAW,QAAQ;AAAA,IAC/C,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,YAAY,WAAW;AAAA,EAC7B,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,SAAS,SAAS,WAC5B,UAAU,SAAS,UAAU,MAAM,SACnC,WAAW,SAAS,eACpB,UAAU,UAAU,SAAS,oBAC7B,UAAU,UAAU,OAAO,MAAM,oBACjC,UAAU,eAAe,WACzB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;",
-  "debugId": "5E24C6B3FD9A6F0464756E2164756E21",
+  "mappings": ";;AASA,eAAsB,yBAAyB,CAAC,OAYZ;AAAA,EAClC,MAAM,YAAY,MAAM,MAAM,WAAW,QAAQ;AAAA,IAC/C,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,YAAY,WAAW;AAAA,EAC7B,IACE,CAAC,aACD,CAAC,MAAM,YAAY,KAAK,CAAC,SAAS,SAAS,UAAU,OAAO,IAAI,KAChE,UAAU,SAAS,SAAS,eAC5B,UAAU,SAAS,SAAS,MAAM,UAAU,QAC5C,UAAU,SAAS,UAAU,MAAM,UAAU,SAC7C,WAAW,SAAS,sBACpB,UAAU,UAAU,SAAS,MAAM,UAAU,QAC7C,UAAU,UAAU,OAAO,MAAM,UAAU,MAC3C,UAAU,UAAU,UAAU,MAAM,UAAU,OAC9C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,qBAAqB,CAAC,OAQR;AAAA,EAClC,MAAM,YAAY,MAAM,MAAM,WAAW,QAAQ;AAAA,IAC/C,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,YAAY,WAAW;AAAA,EAC7B,MAAM,iBACJ,MAAM,UAAU,SAAS,YACrB,WAAW,SAAS,eACpB,UAAU,UAAU,SAAS,oBAC7B,UAAU,UAAU,OAAO,MAAM,UAAU,oBAC3C,UAAU,eAAe,YACzB,WAAW,SAAS,cACnB,WAAW,SAAS,eACnB,UAAU,UAAU,SAAS,UAC7B,UAAU,eAAe;AAAA,EAEjC,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,SAAS,SAAS,WAC5B,UAAU,SAAS,UAAU,MAAM,SACnC,CAAC,gBACD;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "4CB7F7085BDD770364756E2164756E21",
   "names": []
 }

package/dist/{chunk-z3zp0bj1.js → chunk-407j3msh.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isJsonValue
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/logging/types.ts
 var LOG_LEVELS = ["debug", "info", "warn", "error"];

package/dist/{chunk-rhrbz7d4.js → chunk-4a849fr1.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   compareStrings
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/auth/attribution.ts
 async function snapshotRequesterGroupIds(input) {

package/dist/{chunk-62c7t4jc.js → chunk-4nxeacx7.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   findPrimitiveRunExecution
-} from "./chunk-t9xghkva.js";
+} from "./chunk-3kv70xwp.js";
 
 // src/storage/sync-runs/errors.ts
 class SyncRunError extends Error {

package/dist/{chunk-cy0n5dms.js → chunk-5jcdmjam.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   findPrimitiveRunExecution
-} from "./chunk-t9xghkva.js";
+} from "./chunk-3kv70xwp.js";
 
 // src/storage/pipeline-runs/errors.ts
 class PipelineRunError extends Error {

package/dist/{chunk-819wnjz8.js → chunk-64sr682n.js}

@@ -1,29 +1,29 @@
 // @bun
 import {
   createPrimitiveExecutionRecord
-} from "./chunk-f6erf2vv.js";
+} from "./chunk-hdz94br2.js";
 import {
   sha256Canonical
-} from "./chunk-72q2y8hn.js";
+} from "./chunk-8tsf6dmc.js";
 import {
   PROJECTION_RUN_FAILURE_CODES,
   ProjectionRunError,
   assertProjectionRunDurableExecution,
   assertProjectionRunIdentityMatches
-} from "./chunk-dysw7nsm.js";
+} from "./chunk-xdpwpkha.js";
 import {
   findPrimitiveRunExecution
-} from "./chunk-t9xghkva.js";
+} from "./chunk-3kv70xwp.js";
 import {
   reportRunFailure
-} from "./chunk-dsrkgtnh.js";
+} from "./chunk-jq43kdvk.js";
 import {
   ProjectionValidationError
-} from "./chunk-f83ka50g.js";
+} from "./chunk-37wk412q.js";
 import {
   createSixbError,
   toSixbFailure
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 // src/projections/capability.ts
 var projectionRegistryKey = Symbol("sixb.projectionRegistry");
 function registerProjectionRegistry(owner, registry) {