@sixb/core 0.1.7 → 0.1.8

package/src/ontology/index.ts

@@ -18,8 +18,14 @@ export {
   isDecimalValue,
   normalizeDecimalValue,
 } from "./decimal"
+export type {
+  LinkPathSelection,
+  LinkPathSelectionBuilder,
+  LinkPathSelectionInput,
+  LinkPathSelectionMode,
+} from "./link-path-selection"
 export type { InferSchemaOrRef, ObjectRef, ObjectRefSchema, SchemaOrRef } from "./refs"
-export { isObjectRefSchema, ref, validateSchemaOrRefValue } from "./refs"
+export { isObjectRefSchema, objectRef, ref, validateSchemaOrRefValue } from "./refs"
 export type {
   LinkToken,
   LinkTokenMap,

package/src/ontology/inference/index.ts

@@ -148,6 +148,7 @@ export type InferPropertySemanticType<
  *
  * Semantic type can come either directly from the property or indirectly from
  * a referenced value type.
+ * Guard `never` explicitly: UnitsOf<never> is keyof never (string | number | symbol).
  */
 export type InferPropertyUnit<
   TProperty extends Pick<Property, "schema" | "semanticType">,
@@ -155,7 +156,9 @@ export type InferPropertyUnit<
 > =
   InferPropertySemanticType<TProperty, TValueTypes> extends infer TSemanticType extends
     QuantitativeTypeId
-    ? UnitsOf<TSemanticType>
+    ? [TSemanticType] extends [never]
+      ? never
+      : UnitsOf<TSemanticType>
     : never
 
 export type InferObjectProperties<

package/src/ontology/internal.ts

@@ -1,3 +1,2 @@
-export type { SchemaJsonSchema } from "./json-schema"
 export { schemaFieldsToJsonSchema, schemaRecordToJsonSchema } from "./json-schema"
 export { createLinkTokenMap, createPropertyTokenMap } from "./tokens"

package/src/ontology/json-schema.ts

@@ -1,20 +1,21 @@
+import type { JsonObject } from "../json"
 import { OntologyValidationError } from "./errors"
-import { isObjectRefSchema, type SchemaOrRef } from "./refs"
+import type { SchemaOrRef } from "./refs"
 import type { Schema, ValueType } from "./types"
 
-export type SchemaJsonSchema = Readonly<Record<string, unknown>>
+type DeepReadonly<T> = T extends object ? { readonly [K in keyof T]: DeepReadonly<T[K]> } : T
 
 export interface SchemaJsonField {
-  readonly schema: SchemaOrRef
+  readonly schema: DeepReadonly<SchemaOrRef>
   readonly required?: boolean
   readonly nullable?: boolean
 }
 
 /** Convert a record of Sixb schemas into the strict JSON object schema used by model outputs. */
 export function schemaRecordToJsonSchema(input: {
-  readonly shape: Readonly<Record<string, SchemaOrRef>>
+  readonly shape: Readonly<Record<string, DeepReadonly<SchemaOrRef>>>
   readonly valueTypesById: ReadonlyMap<string, ValueType>
-}): SchemaJsonSchema {
+}): JsonObject {
   return schemaFieldsToJsonSchema({
     fields: Object.fromEntries(
       Object.entries(input.shape).map(([field, schema]) => [field, { schema, required: true }])
@@ -27,7 +28,7 @@ export function schemaRecordToJsonSchema(input: {
 export function schemaFieldsToJsonSchema(input: {
   readonly fields: Readonly<Record<string, SchemaJsonField>>
   readonly valueTypesById: ReadonlyMap<string, ValueType>
-}): SchemaJsonSchema {
+}): JsonObject {
   const required = Object.entries(input.fields)
     .filter(([, field]) => field.required === true)
     .map(([field]) => field)
@@ -45,11 +46,11 @@ export function schemaFieldsToJsonSchema(input: {
 }
 
 function schemaOrRefJsonSchema(
-  schema: SchemaOrRef,
+  schema: DeepReadonly<SchemaOrRef>,
   valueTypesById: ReadonlyMap<string, ValueType>,
   resolving: ReadonlySet<string>
-): SchemaJsonSchema {
-  if (isObjectRefSchema(schema)) {
+): JsonObject {
+  if (typeof schema !== "string" && schema.type === "objectRef") {
     return {
       type: "object",
       properties: {
@@ -64,10 +65,10 @@ function schemaOrRefJsonSchema(
 }
 
 function schemaJsonSchema(
-  schema: Schema,
+  schema: DeepReadonly<Schema>,
   valueTypesById: ReadonlyMap<string, ValueType>,
   resolving: ReadonlySet<string>
-): SchemaJsonSchema {
+): JsonObject {
   if (typeof schema === "string") {
     switch (schema) {
       case "string":
@@ -103,7 +104,7 @@ function schemaJsonSchema(
     }
   }
 
-  if (schema.type === "enum") return { enum: schema.values }
+  if (schema.type === "enum") return { enum: [...schema.values] }
   if (schema.type === "array") {
     return { type: "array", items: schemaJsonSchema(schema.items, valueTypesById, resolving) }
   }

package/src/ontology/link-path-selection.ts

@@ -0,0 +1,193 @@
+import type { LinkToken } from "./tokens"
+
+declare const linkPathSelectionBrand: unique symbol
+
+type LinkTargetObjectTypeId<TTarget> = TTarget extends readonly string[]
+  ? TTarget[number]
+  : TTarget extends "*"
+    ? string
+    : TTarget extends string
+      ? TTarget
+      : never
+
+export type LinkPathSelectionMode =
+  | { readonly kind: "none" }
+  | { readonly kind: "all" }
+  | {
+      readonly kind: "selected"
+      readonly links: readonly LinkPathSelection[]
+    }
+
+/**
+ * Inert nested selection produced by `ObjectType.l.someLink.withLinks(...)`.
+ *
+ * It stores ids only. Consumers such as Share definitions resolve those ids against their own
+ * current ontology registry instead of trusting the token's embedded metadata.
+ */
+export type LinkPathSelection<
+  TSourceObjectTypeId extends string = string,
+  TLinkId extends string = string,
+  TTargetObjectTypeId extends string | readonly string[] = string | readonly string[],
+> = {
+  readonly [linkPathSelectionBrand]?: never
+  readonly kind: "linkPathSelection"
+  readonly sourceObjectTypeId: TSourceObjectTypeId
+  readonly linkId: TLinkId
+  readonly targetObjectTypeId: TTargetObjectTypeId
+  readonly selection: LinkPathSelectionMode
+}
+
+export type LinkPathSelectionInput<TSourceObjectTypeId extends string = string> =
+  | LinkToken<TSourceObjectTypeId>
+  | LinkPathSelection<TSourceObjectTypeId>
+
+export interface LinkPathSelectionBuilder<
+  TSourceObjectTypeId extends string,
+  TLinkId extends string,
+  TTargetObjectTypeId extends string | readonly string[],
+> {
+  withLinks(): LinkPathSelection<TSourceObjectTypeId, TLinkId, TTargetObjectTypeId>
+  withLinks<
+    const TLinks extends readonly LinkPathSelectionInput<
+      LinkTargetObjectTypeId<TTargetObjectTypeId>
+    >[],
+  >(links: TLinks): LinkPathSelection<TSourceObjectTypeId, TLinkId, TTargetObjectTypeId>
+}
+
+/** @internal Snapshot a token/path into the portable ids-only representation. */
+export function snapshotLinkPathSelection(input: LinkPathSelectionInput): LinkPathSelection {
+  return snapshotLinkPathSelectionValue(input, new Set())
+}
+
+function snapshotLinkPathSelectionValue(input: unknown, visiting: Set<object>): LinkPathSelection {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    throw new Error("[Sixb] Link path selection must be a link token or nested link selection.")
+  }
+  if (visiting.has(input)) {
+    throw new Error("[Sixb] Link path selection must not contain a cycle.")
+  }
+  visiting.add(input)
+  try {
+    if (isLinkPathSelection(input)) {
+      return createLinkPathSelectionFromIds(
+        {
+          sourceObjectTypeId: input.sourceObjectTypeId,
+          linkId: input.linkId,
+          targetObjectTypeId: input.targetObjectTypeId,
+          selection: input.selection,
+        },
+        visiting
+      )
+    }
+
+    return createLinkPathSelectionFromIds(
+      {
+        sourceObjectTypeId: (input as { readonly objectTypeId?: unknown }).objectTypeId,
+        linkId: (input as { readonly id?: unknown }).id,
+        targetObjectTypeId: (input as { readonly targetObjectTypeId?: unknown }).targetObjectTypeId,
+        selection: { kind: "none" },
+      },
+      visiting
+    )
+  } finally {
+    visiting.delete(input)
+  }
+}
+
+/** @internal */
+function isLinkPathSelection(value: unknown): value is LinkPathSelection {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    (value as { readonly kind?: unknown }).kind === "linkPathSelection"
+  )
+}
+
+export function createLinkPathSelection(
+  token: LinkToken,
+  links: readonly LinkPathSelectionInput[] | undefined
+): LinkPathSelection {
+  if (links !== undefined && !Array.isArray(links)) {
+    throw new Error(`[Sixb] Link '${token.objectTypeId}.${token.id}' withLinks expects an array.`)
+  }
+  if (links?.length === 0) {
+    throw new Error(
+      `[Sixb] Link '${token.objectTypeId}.${token.id}' withLinks([]) is empty; omit withLinks() when no nested links should be selected.`
+    )
+  }
+
+  return createLinkPathSelectionFromIds({
+    sourceObjectTypeId: token.objectTypeId,
+    linkId: token.id,
+    targetObjectTypeId: token.targetObjectTypeId,
+    selection:
+      links === undefined
+        ? { kind: "all" }
+        : { kind: "selected", links: links.map(snapshotLinkPathSelection) },
+  })
+}
+
+function createLinkPathSelectionFromIds(
+  input: {
+    readonly sourceObjectTypeId: unknown
+    readonly linkId: unknown
+    readonly targetObjectTypeId: unknown
+    readonly selection: unknown
+  },
+  visiting: Set<object> = new Set()
+): LinkPathSelection {
+  const sourceObjectTypeId = nonEmptyLinkSelectionId(
+    input.sourceObjectTypeId,
+    "source object type id"
+  )
+  const linkId = nonEmptyLinkSelectionId(input.linkId, "link id")
+  const targetObjectTypeId = snapshotLinkTarget(input.targetObjectTypeId)
+  const selection = snapshotLinkSelectionMode(input.selection, visiting)
+  return Object.freeze({
+    kind: "linkPathSelection" as const,
+    sourceObjectTypeId,
+    linkId,
+    targetObjectTypeId,
+    selection,
+  })
+}
+
+function snapshotLinkSelectionMode(value: unknown, visiting: Set<object>): LinkPathSelectionMode {
+  if (typeof value !== "object" || value === null) {
+    throw new Error("[Sixb] Link path selection must declare nested links.")
+  }
+  const kind = (value as { readonly kind?: unknown }).kind
+  if (kind === "none" || kind === "all") return Object.freeze({ kind })
+  if (kind !== "selected") {
+    throw new Error(`[Sixb] Unknown nested link selection '${String(kind)}'.`)
+  }
+  const links = (value as { readonly links?: unknown }).links
+  if (!Array.isArray(links)) {
+    throw new Error("[Sixb] Selected nested links must be an array.")
+  }
+  if (links.length === 0) {
+    throw new Error(
+      "[Sixb] Selected nested links must not be empty; omit withLinks() when no nested links should be selected."
+    )
+  }
+  return Object.freeze({
+    kind: "selected" as const,
+    links: Object.freeze(links.map((link) => snapshotLinkPathSelectionValue(link, visiting))),
+  })
+}
+
+function snapshotLinkTarget(value: unknown): string | readonly string[] {
+  if (Array.isArray(value)) {
+    return Object.freeze(
+      value.map((item) => nonEmptyLinkSelectionId(item, "target object type id"))
+    )
+  }
+  return nonEmptyLinkSelectionId(value, "target object type id")
+}
+
+function nonEmptyLinkSelectionId(value: unknown, field: string): string {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] Link path ${field} must not be empty.`)
+  }
+  return value
+}

package/src/ontology/refs.ts

@@ -34,6 +34,25 @@ export function ref<const TObjectType extends ObjectType>(
   }
 }
 
+/** Build an exact, typed reference to one object instance. */
+export function objectRef<const TObjectType extends ObjectType>(
+  objectType: TObjectType,
+  primaryId: string
+): ObjectRef<TObjectType["id"]> {
+  if (
+    typeof objectType !== "object" ||
+    objectType === null ||
+    typeof objectType.id !== "string" ||
+    !objectType.id.trim()
+  ) {
+    throw new OntologyValidationError("[Sixb] Object reference type must be an object type.")
+  }
+  if (typeof primaryId !== "string" || !primaryId.trim()) {
+    throw new OntologyValidationError("[Sixb] Object reference primary id must not be empty.")
+  }
+  return Object.freeze({ objectTypeId: objectType.id, primaryId })
+}
+
 export function isObjectRefSchema(schema: SchemaOrRef): schema is ObjectRefSchema {
   return (
     typeof schema === "object" &&

package/src/ontology/tokens.ts

@@ -1,3 +1,8 @@
+import {
+  createLinkPathSelection,
+  type LinkPathSelectionBuilder,
+  type LinkPathSelectionInput,
+} from "./link-path-selection"
 import type { ObjectLink, ObjectType, Property } from "./types"
 
 declare const propertyTokenBrand: unique symbol
@@ -38,7 +43,7 @@ export type LinkToken<
   readonly id: TLinkId
   readonly targetObjectTypeId: TTargetObjectTypeId
   readonly link: TLink
-}
+} & LinkPathSelectionBuilder<TObjectTypeId, TLinkId, TTargetObjectTypeId>
 
 export type LinkTokenMap<TObjectType extends ObjectType> = {
   readonly [L in TObjectType["links"][number] as L["id"]]: LinkToken<
@@ -95,17 +100,19 @@ export function createLinkTokenMap<TObjectType extends ObjectType>(
   objectType: TObjectType
 ): LinkTokenMap<TObjectType> {
   const tokenEntries = objectType.links.map((link) => {
-    const token: LinkToken<
-      TObjectType["id"],
-      typeof link.id,
-      typeof link.targetObjectTypeId,
-      typeof link
-    > = {
+    const token = {
       objectTypeId: objectType.id,
       id: link.id,
       targetObjectTypeId: link.targetObjectTypeId,
       link,
-    }
+    } as LinkToken<TObjectType["id"], typeof link.id, typeof link.targetObjectTypeId, typeof link>
+    Object.defineProperty(token, "withLinks", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (...args: [links?: readonly LinkPathSelectionInput[]]) =>
+        createLinkPathSelection(token, args.length === 0 ? undefined : args[0]),
+    })
     return [link.id, token] as const
   })
 

package/src/pipelines/execution.ts

@@ -1,5 +1,6 @@
-import { canViewPipelineRun, isAllowed } from "../authorization"
+import { assertAuthorized, canViewPipelineRun, isRuntimeAllowed } from "../authorization"
 import type { ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   ListLatestPipelineRunsResult,
@@ -41,30 +42,46 @@ export function createPipelinesRuntime(
   execution: ExecutionContext,
   source: Pick<PipelinesRuntime, "list" | "getById">
 ): PipelinesRuntime {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
   const allowed = (pipelineId: string) =>
-    isAllowed(runtime.authorization, { kind: "pipeline.run", pipelineId })
+    isRuntimeAllowed(runtime, { kind: "pipeline.run", pipelineId })
   const visibleIds = () =>
     source
       .list()
       .filter((pipeline) => allowed(pipeline.id))
       .map((pipeline) => pipeline.id)
+  const historyFilterIds = () =>
+    authority.type === "unrestricted"
+      ? undefined
+      : authority.type === "principal"
+        ? visibleIds()
+        : []
 
   const getRun = async (runId: string) => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const run =
       (await runtime.storage.pipelineRuns?.getById({
         projectId: runtime.projectId,
         id: runId,
       })) ?? null
-    return run && canViewPipelineRun(runtime.authorization, run) ? run : null
+    if (!run) return null
+    return authority.type === "unrestricted" || canViewPipelineRun(authority.context, run)
+      ? run
+      : null
   }
 
   return {
-    list: () => source.list().filter((pipeline) => allowed(pipeline.id)),
+    list: () =>
+      authority.type === "denied" || authority.type === "delegated"
+        ? []
+        : source.list().filter((pipeline) => allowed(pipeline.id)),
     getById: (pipelineId) => {
+      if (authority.type === "denied" || authority.type === "delegated") return null
       const pipeline = source.getById(pipelineId)
       return pipeline && allowed(pipelineId) ? pipeline : null
     },
     request: async (input) => {
+      assertAuthorized(runtime, { kind: "pipeline.run", pipelineId: input.pipelineId })
       const pipeline = source.getById(input.pipelineId)
       if (!pipeline) throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`)
       return requestPipelineRun(runtime, execution, pipeline, input)
@@ -72,15 +89,21 @@ export function createPipelinesRuntime(
     runs: {
       getById: getRun,
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        }
         const storage = runtime.storage.pipelineRuns
         if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          pipelineIds: runtime.authorization ? visibleIds() : undefined,
+          pipelineIds: historyFilterIds(),
+          projectId: runtime.projectId,
         })
       },
       listLatest: (pipelineIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] })
+        }
         const storage = runtime.storage.pipelineRuns
         if (!storage || pipelineIds.length === 0) return Promise.resolve({ runs: [] })
         const allowedIds = pipelineIds.filter(allowed)
@@ -95,9 +118,9 @@ export function createPipelinesRuntime(
         const storage = runtime.storage.pipelineRuns
         if (!storage || !(await getRun(runId))) return null
         return storage.listSteps({
-          projectId: runtime.projectId,
           ...input,
           pipelineRunId: runId,
+          projectId: runtime.projectId,
         })
       },
     },

package/src/pipelines/request.ts

@@ -1,4 +1,5 @@
 import { assertAuthorized } from "../authorization"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import {
   createPrimitiveExecutionRecord,
   ensureExecutionRecord,
@@ -42,6 +43,10 @@ export async function requestPipelineRun(
   pipeline: PipelineDefinition,
   options: PipelineRunRequestOptions = {}
 ): Promise<PipelineRunRequestResult> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertAuthorized(runtime, { kind: "pipeline.run", pipelineId: pipeline.id })
   if (!runtime.storage.pipelineRuns) {
     throw new PipelineError("[Sixb] Pipeline run storage is not configured.")

package/src/projections/execution.ts

@@ -1,4 +1,5 @@
 import { canViewProjection, canViewProjectionRun } from "../authorization"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   ListLatestProjectionRunsResult,
@@ -35,8 +36,31 @@ export function createProjectionsRuntime(
   runtime: SixbRuntimeContext,
   source: ProjectionDefinitionCatalog
 ): ProjectionsRuntime {
-  const visible = (projection: ProjectionDefinition) =>
-    canViewProjection(runtime.authorization, projection)
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const listVisible = <TProjection extends ProjectionDefinition>(
+    list: () => readonly TProjection[]
+  ): readonly TProjection[] => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return []
+      case "principal":
+        return list().filter((projection) => canViewProjection(authority.context, projection))
+      case "unrestricted":
+        return [...list()]
+    }
+  }
+  const visible = (projection: ProjectionDefinition) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return false
+      case "principal":
+        return canViewProjection(authority.context, projection)
+      case "unrestricted":
+        return true
+    }
+  }
   const visibleIds = (projectionIds: readonly string[]) =>
     projectionIds.filter((projectionId) => {
       const projection = source.getById(projectionId)
@@ -44,35 +68,72 @@ export function createProjectionsRuntime(
     })
 
   return {
-    list: () => source.list().filter(visible),
-    listObjects: () => source.listObjects().filter(visible),
-    listLinks: () => source.listLinks().filter(visible),
-    listTelemetry: () => source.listTelemetry().filter(visible),
+    list: () => listVisible(() => source.list()),
+    listObjects: () => listVisible(() => source.listObjects()),
+    listLinks: () => listVisible(() => source.listLinks()),
+    listTelemetry: () => listVisible(() => source.listTelemetry()),
     getById: (projectionId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null
+        case "principal":
+        case "unrestricted":
+          break
+      }
       const projection = source.getById(projectionId)
       return projection && visible(projection) ? projection : null
     },
     runs: {
       getById: async (runId) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return null
+          case "principal":
+          case "unrestricted":
+            break
+        }
         const run =
           (await runtime.storage.projectionRuns?.getById({
             projectId: runtime.projectId,
             id: runId,
           })) ?? null
-        return run && canViewProjectionRun(runtime.authorization, run.target) ? run : null
+        if (!run) return null
+        return authority.type === "unrestricted" ||
+          canViewProjectionRun(authority.context, run.target)
+          ? run
+          : null
       },
       list: (input = {}) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+          case "principal":
+          case "unrestricted":
+            break
+        }
         const storage = runtime.storage.projectionRuns
         if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          objectTypeIds: runtime.authorization
-            ? [...runtime.authorization.grants["view:object"]]
-            : undefined,
+          objectTypeIds:
+            authority.type === "principal"
+              ? [...authority.context.grants["view:object"]]
+              : undefined,
+          projectId: runtime.projectId,
         })
       },
       listLatest: (projectionIds) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [] })
+          case "principal":
+          case "unrestricted":
+            break
+        }
         const storage = runtime.storage.projectionRuns
         if (!storage || projectionIds.length === 0) return Promise.resolve({ runs: [] })
         const ids = visibleIds(projectionIds)

package/src/projections/run-dispatch.ts

@@ -4,7 +4,7 @@ import { createSixbError, toSixbFailure } from "../errors/internal"
 import type { SixbFailure } from "../errors/types"
 import type { RunDispatcher } from "../execution/dispatch"
 import { createPrimitiveExecutionRecord } from "../execution/durable"
-import type { LakeStorage } from "../lake-storage"
+import type { DatasetProducer, LakeStorage } from "../lake-storage"
 import type { Queues } from "../queues"
 import type { SixbDefinitions } from "../runtime/definitions"
 import type { ExecutionRecord, ProjectionRunRecord, Storage } from "../storage"
@@ -289,14 +289,11 @@ async function assertExistingRun(
 async function resolveProducerExecution(
   storage: Storage,
   projectId: string,
-  producer:
-    | {
-        readonly kind: "sync" | "pipeline"
-        readonly id?: string
-        readonly runId?: string
-      }
-    | undefined
+  producer: DatasetProducer | undefined
 ): Promise<ExecutionRecord | null> {
+  if (producer?.kind === "ingest") {
+    return producer.id ? storage.executions.getById({ projectId, id: producer.id }) : null
+  }
   if (!producer?.runId) return null
   if (producer.kind === "sync") {
     const run = await storage.syncRuns?.getById({ projectId, id: producer.runId })
@@ -342,10 +339,7 @@ async function requireProducerExecution(input: {
   )
 }
 
-function assertProducerId(
-  producer: { readonly kind: "sync" | "pipeline"; readonly id?: string; readonly runId?: string },
-  runOwnerId: string
-): void {
+function assertProducerId(producer: DatasetProducer, runOwnerId: string): void {
   if (producer.id === undefined || producer.id === runOwnerId) return
   throw new ProjectionValidationError(
     `[Sixb] Dataset producer '${producer.kind}:${producer.id}' does not match run '${producer.runId}'.`