@sixb/core 0.1.0 → 0.1.2

package/src/connectors/types.ts

@@ -20,11 +20,127 @@ export interface ConnectorContext {
  */
 export interface ConnectorAdapter<TType extends string = string, TClient = unknown> {
   readonly type: TType
+  readonly authentication?: never
   readonly webhooks?: readonly WebhookDefinition<unknown, TClient>[]
   connect(context: ConnectorContext): Promise<TClient> | TClient
   disconnect?(client: TClient): Promise<void> | void
 }
 
+/** One OAuth token set normalized by an OAuth connector adapter. */
+export interface ConnectorOAuthCredentials {
+  readonly accessToken: string
+  readonly refreshToken?: string
+  readonly tokenType?: string
+  readonly scopes?: readonly string[]
+  readonly expiresAt?: Date
+}
+
+/** Public, non-secret account information returned for framework-owned selection UI. */
+export interface ConnectorAccountCandidate {
+  readonly id: string
+  readonly label: string
+  readonly description?: string
+  readonly avatarUrl?: string
+}
+
+/** V1 intentionally supports project-owned connector connections only. */
+export interface ProjectConnectorConnectionOwner {
+  readonly type: "project"
+}
+
+export type ConnectorConnectionOwner = ProjectConnectorConnectionOwner
+
+/** Stable application-defined lookup key for one connector connection. */
+export interface ConnectorConnectionSelector {
+  readonly owner: ConnectorConnectionOwner
+  readonly slot: string
+}
+
+/** Stable, non-secret metadata shared by connector connection consumers. */
+export interface ConnectorConnectionMetadata extends ConnectorConnectionSelector {
+  readonly id: string
+  readonly connectorId: string
+  readonly account: ConnectorAccountCandidate
+}
+
+/** Credential protection required when an OAuth connector uses durable connection storage. */
+export interface ConnectorConnectionOptions {
+  /** Canonical base64url encoding of exactly 32 random bytes, shared by storage replicas. */
+  readonly encryptionKey: string
+}
+
+export interface OAuthConnectorAuthorizationContext extends ConnectorContext {
+  readonly redirectUri: string
+}
+
+export interface OAuthConnectorAuthorizationUrlInput {
+  readonly state: string
+  readonly codeChallenge: string
+  readonly codeChallengeMethod: "S256"
+}
+
+export interface OAuthConnectorCodeExchangeInput {
+  readonly code: string
+  readonly codeVerifier: string
+}
+
+export interface ConnectorConnectionClientContext extends ConnectorContext {
+  readonly connectionId: string
+  readonly account: ConnectorAccountCandidate
+  readonly tokenSource: ConnectorTokenSource
+}
+
+/** One delivered token, bound to the credential revision that produced it. */
+export interface ConnectorAccessToken {
+  readonly accessToken: string
+  readonly tokenType?: string
+  /** Report this exact token as rejected so Sixb can refresh only its credential revision. */
+  invalidate(): void
+}
+
+/** Live credential source owned by Sixb. Adapters must resolve a token for each request. */
+export interface ConnectorTokenSource {
+  get(): Promise<ConnectorAccessToken>
+}
+
+/**
+ * OAuth-backed connector adapter. Sixb owns persistence, OAuth state, refresh coordination and UI;
+ * the adapter owns provider protocol details and typed client creation.
+ */
+export interface ConnectorOAuth2Authentication {
+  readonly type: "oauth2"
+  authorizationUrl(
+    context: OAuthConnectorAuthorizationContext,
+    input: OAuthConnectorAuthorizationUrlInput
+  ): Promise<string | URL> | string | URL
+  exchangeCode(
+    context: OAuthConnectorAuthorizationContext,
+    input: OAuthConnectorCodeExchangeInput
+  ): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials
+  refresh(
+    context: ConnectorContext,
+    credentials: ConnectorOAuthCredentials
+  ): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials
+  /**
+   * Revokes the grant idempotently. An already revoked or invalid grant must resolve successfully
+   * so Sixb can converge after losing an earlier provider response.
+   */
+  revoke?(context: ConnectorContext, credentials: ConnectorOAuthCredentials): Promise<void> | void
+}
+
+export interface OAuthConnectorAdapter<TType extends string = string, TClient = unknown> {
+  readonly type: TType
+  readonly authentication: ConnectorOAuth2Authentication
+  readonly webhooks?: undefined
+  discoverAccounts(
+    context: ConnectorContext,
+    credentials: ConnectorOAuthCredentials
+  ): Promise<readonly ConnectorAccountCandidate[]> | readonly ConnectorAccountCandidate[]
+  connect(context: ConnectorConnectionClientContext): Promise<TClient> | TClient
+}
+
+export type AnyConnectorAdapter = ConnectorAdapter | OAuthConnectorAdapter
+
 /**
  * Inert connector definition registered with Sixb.
  *
@@ -33,30 +149,63 @@ export interface ConnectorAdapter<TType extends string = string, TClient = unkno
  */
 export interface ConnectorDefinition<
   TId extends string = string,
-  TAdapter extends ConnectorAdapter = ConnectorAdapter,
+  TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter,
 > {
   readonly kind: "connector"
   readonly id: TId
   readonly adapter: TAdapter
 }
 
+export type StaticConnectorDefinition = ConnectorDefinition<string, ConnectorAdapter>
+
 /** Infer the connected client type returned by a connector adapter. */
-export type ConnectorClient<TAdapter extends ConnectorAdapter> = Awaited<
+export type ConnectorClient<TAdapter extends AnyConnectorAdapter> = Awaited<
   ReturnType<TAdapter["connect"]>
 >
 
+export function isOAuthConnectorAdapter(
+  value: AnyConnectorAdapter
+): value is OAuthConnectorAdapter {
+  return "authentication" in value && value.authentication?.type === "oauth2"
+}
+
+export function isOAuthConnectorDefinition(
+  value: ConnectorDefinition
+): value is ConnectorDefinition<string, OAuthConnectorAdapter> {
+  return isOAuthConnectorAdapter(value.adapter)
+}
+
+export function isStaticConnectorDefinition(
+  value: ConnectorDefinition
+): value is StaticConnectorDefinition {
+  return !isOAuthConnectorDefinition(value)
+}
+
 export function isConnectorDefinition(value: unknown): value is ConnectorDefinition {
   if (!isRecord(value)) {
     return false
   }
 
-  return (
+  const adapter = value.adapter
+  if (
     value.kind === "connector" &&
     typeof value.id === "string" &&
-    isRecord(value.adapter) &&
-    typeof value.adapter.type === "string" &&
-    typeof value.adapter.connect === "function"
-  )
+    isRecord(adapter) &&
+    typeof adapter.type === "string" &&
+    typeof adapter.connect === "function"
+  ) {
+    if (adapter.authentication === undefined) return true
+    const authentication = adapter.authentication
+    if (!isRecord(authentication) || authentication.type !== "oauth2") return false
+    return (
+      typeof authentication.authorizationUrl === "function" &&
+      typeof authentication.exchangeCode === "function" &&
+      typeof authentication.refresh === "function" &&
+      typeof adapter.discoverAccounts === "function"
+    )
+  }
+
+  return false
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {

package/src/datasets/builders.ts

@@ -4,6 +4,7 @@ import type {
   DatasetColumnNameOf,
   DatasetColumnType,
   DatasetDefinition,
+  DatasetPrimaryKey,
 } from "./types"
 import { assertDatasetColumnDefinition, assertDatasetDefinition } from "./validation"
 
@@ -13,6 +14,7 @@ type DatasetColumnOptions = {
 
 type DefineDatasetOptions = {
   readonly schema: readonly DatasetColumnDefinition[]
+  readonly primaryKey?: DatasetPrimaryKey
   readonly partitionBy?: readonly string[]
   readonly description?: string
 }
@@ -20,6 +22,7 @@ type DefineDatasetOptions = {
 type DeriveDatasetOptions<TParent extends DatasetDefinition> = {
   readonly pick?: readonly DatasetColumnNameOf<TParent>[]
   readonly add?: readonly DatasetColumnDefinition[]
+  readonly primaryKey?: DatasetPrimaryKey
   readonly partitionBy?: readonly string[]
   readonly description?: string
 }
@@ -39,6 +42,24 @@ type ColumnDefinitionOf<
   TName extends ColumnNameOf<TColumns>,
 > = Extract<TColumns[number], { readonly name: TName }>
 
+type PrimaryKeyColumnNameOf<TColumns extends readonly DatasetColumnDefinition[]> =
+  string extends ColumnNameOf<TColumns>
+    ? string
+    : {
+        [TName in ColumnNameOf<TColumns>]: ColumnDefinitionOf<
+          TColumns,
+          TName
+        >["type"] extends "string"
+          ? ColumnDefinitionOf<TColumns, TName> extends { readonly nullable: true }
+            ? never
+            : TName
+          : never
+      }[ColumnNameOf<TColumns>]
+
+type CheckedDefineDatasetOptions<TOptions extends DefineDatasetOptions> = TOptions & {
+  readonly primaryKey?: DatasetPrimaryKey<PrimaryKeyColumnNameOf<TOptions["schema"]>>
+}
+
 type PickColumns<
   TColumns extends readonly DatasetColumnDefinition[],
   TNames extends readonly ColumnNameOf<TColumns>[],
@@ -86,8 +107,9 @@ type DatasetColumnResult<
 
 type DatasetDefinitionResult<TId extends string, TOptions extends DefineDatasetOptions> = Omit<
   DatasetDefinition<TId, TOptions["schema"]>,
-  "partitionBy" | "description"
+  "primaryKey" | "partitionBy" | "description"
 > &
+  FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
   FieldFromOptions<TOptions, "description", string>
 
@@ -95,10 +117,21 @@ type DerivedDatasetDefinitionResult<
   TId extends string,
   TParent extends DatasetDefinition,
   TOptions extends DeriveDatasetOptions<TParent> | undefined,
-> = Omit<DatasetDefinition<TId, DerivedColumns<TParent, TOptions>>, "partitionBy" | "description"> &
+> = Omit<
+  DatasetDefinition<TId, DerivedColumns<TParent, TOptions>>,
+  "primaryKey" | "partitionBy" | "description"
+> &
+  FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
   FieldFromOptions<TOptions, "description", string>
 
+type CheckedDeriveDatasetOptions<
+  TParent extends DatasetDefinition,
+  TOptions extends DeriveDatasetOptions<TParent>,
+> = TOptions & {
+  readonly primaryKey?: DatasetPrimaryKey<PrimaryKeyColumnNameOf<DerivedColumns<TParent, TOptions>>>
+}
+
 export function col<const TName extends string, const TType extends DatasetColumnType>(
   name: TName,
   type: TType
@@ -130,12 +163,19 @@ function assertDatasetId(id: string): void {
 }
 
 function createDatasetDefinition(id: string, options: DefineDatasetOptions): DatasetDefinition {
-  const definition: DatasetDefinition = {
+  const definition: unknown = {
     kind: "dataset",
     id,
     schema: {
       columns: [...options.schema],
     },
+    ...(options.primaryKey !== undefined
+      ? {
+          primaryKey: Array.isArray(options.primaryKey)
+            ? [...options.primaryKey]
+            : options.primaryKey,
+        }
+      : {}),
     ...(options.partitionBy !== undefined ? { partitionBy: [...options.partitionBy] } : {}),
     ...(options.description !== undefined ? { description: options.description } : {}),
   }
@@ -189,6 +229,7 @@ function deriveDatasetDefinition(
 
   return createDatasetDefinition(id, {
     schema: [...pickedColumns, ...(options.add ?? [])],
+    ...(options.primaryKey !== undefined ? { primaryKey: options.primaryKey } : {}),
     ...(options.partitionBy !== undefined ? { partitionBy: options.partitionBy } : {}),
     ...(options.description !== undefined ? { description: options.description } : {}),
   })
@@ -203,7 +244,10 @@ function createDatasetDeriveBuilder<TId extends string>(id: TId) {
   function derive<
     const TParent extends DatasetDefinition,
     const TOptions extends DeriveDatasetOptions<TParent>,
-  >(parent: TParent, options: TOptions): DerivedDatasetDefinitionResult<TId, TParent, TOptions>
+  >(
+    parent: TParent,
+    options: CheckedDeriveDatasetOptions<TParent, TOptions>
+  ): DerivedDatasetDefinitionResult<TId, TParent, TOptions>
   function derive(
     parent: DatasetDefinition,
     options?: DeriveDatasetOptions<DatasetDefinition>
@@ -220,7 +264,7 @@ export function defineDataset<const TId extends string>(
 export function defineDataset<
   const TId extends string,
   const TOptions extends DefineDatasetOptions,
->(id: TId, options: TOptions): DatasetDefinitionResult<TId, TOptions>
+>(id: TId, options: CheckedDefineDatasetOptions<TOptions>): DatasetDefinitionResult<TId, TOptions>
 export function defineDataset(
   id: string,
   options?: DefineDatasetOptions

package/src/datasets/changes.ts

@@ -0,0 +1,13 @@
+export type MergeChange<Row, Key> =
+  | { readonly kind: "upsert"; readonly row: Row }
+  | { readonly kind: "delete"; readonly key: Key }
+
+export const change = {
+  upsert<const Row extends object>(row: Row): { readonly kind: "upsert"; readonly row: Row } {
+    return { kind: "upsert", row }
+  },
+
+  delete<const Key extends object>(key: Key): { readonly kind: "delete"; readonly key: Key } {
+    return { kind: "delete", key }
+  },
+}

package/src/datasets/execution.ts

@@ -0,0 +1,24 @@
+import { isAllowed } from "../authorization"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type { DatasetDefinition } from "./types"
+
+export interface DatasetsRuntime {
+  list(): readonly DatasetDefinition[]
+  getById(datasetId: string): DatasetDefinition | null
+}
+
+export function createDatasetsRuntime(
+  runtime: Pick<SixbRuntimeContext, "authorization">,
+  source: Pick<DatasetsRuntime, "list" | "getById">
+): DatasetsRuntime {
+  const allowed = (datasetId: string) =>
+    isAllowed(runtime.authorization, { kind: "dataset.view", datasetId })
+
+  return {
+    list: () => source.list().filter((dataset) => allowed(dataset.id)),
+    getById: (datasetId) => {
+      const dataset = source.getById(datasetId)
+      return dataset && allowed(datasetId) ? dataset : null
+    },
+  }
+}

package/src/datasets/index.ts

@@ -1,4 +1,6 @@
 export { col, defineDataset } from "./builders"
+export type { MergeChange } from "./changes"
+export { change } from "./changes"
 export { DatasetValidationError } from "./errors"
 export type {
   DatasetColumnDefinition,
@@ -8,6 +10,7 @@ export type {
   DatasetColumnTypeOf,
   DatasetColumnUnionOf,
   DatasetDefinition,
+  DatasetPrimaryKey,
   DatasetSchema,
 } from "./types"
 export { getDatasetRowValidationError, isDatasetDefinition } from "./validation"

package/src/datasets/types.ts

@@ -24,6 +24,10 @@ export interface DatasetSchema<
   readonly columns: TColumns
 }
 
+export type DatasetPrimaryKey<TColumnName extends string = string> =
+  | TColumnName
+  | readonly [TColumnName, TColumnName, ...TColumnName[]]
+
 export interface DatasetDefinition<
   TId extends string = string,
   TColumns extends readonly DatasetColumnDefinition[] = readonly DatasetColumnDefinition[],
@@ -31,6 +35,7 @@ export interface DatasetDefinition<
   readonly kind: "dataset"
   readonly id: TId
   readonly schema: DatasetSchema<TColumns>
+  readonly primaryKey?: DatasetPrimaryKey
   readonly partitionBy?: readonly string[]
   readonly description?: string
 }

package/src/datasets/validation.ts

@@ -1,5 +1,5 @@
 import { isFileRef } from "../blob-storage"
-import { isJsonValue } from "../json"
+import { isJsonValue, isPlainRecord } from "../json"
 import { isDecimalString } from "../ontology/decimal"
 import { DatasetValidationError } from "./errors"
 import type {
@@ -25,15 +25,6 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
 }
 
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  if (!isRecord(value)) {
-    return false
-  }
-
-  const prototype = Object.getPrototypeOf(value)
-  return prototype === Object.prototype || prototype === null
-}
-
 function isValidDateValue(value: unknown): boolean {
   return value instanceof Date && !Number.isNaN(value.getTime())
 }
@@ -128,6 +119,53 @@ function assertDatasetSchema(
   }
 }
 
+function assertDatasetPrimaryKey(
+  primaryKey: unknown,
+  schema: DatasetSchema,
+  createError: (message: string) => Error
+): void {
+  let keyColumns: readonly unknown[]
+  if (typeof primaryKey === "string") {
+    keyColumns = [primaryKey]
+  } else if (Array.isArray(primaryKey)) {
+    if (primaryKey.length < 2) {
+      throw createError(
+        "Dataset primaryKey arrays must contain at least two column names. Use a string for a single-column key."
+      )
+    }
+    keyColumns = primaryKey
+  } else {
+    throw createError(
+      "Dataset primaryKey must be a column name or an array of at least two column names."
+    )
+  }
+
+  const columnsByName = new Map(schema.columns.map((column) => [column.name, column] as const))
+  const seenColumnNames = new Set<string>()
+
+  for (const columnName of keyColumns) {
+    if (typeof columnName !== "string" || columnName.trim().length === 0) {
+      throw createError("Dataset primaryKey columns must be non-empty strings.")
+    }
+
+    if (seenColumnNames.has(columnName)) {
+      throw createError(`Dataset primaryKey contains duplicate column '${columnName}'.`)
+    }
+    seenColumnNames.add(columnName)
+
+    const column = columnsByName.get(columnName)
+    if (column === undefined) {
+      throw createError(`Dataset primaryKey column '${columnName}' is not declared in the schema.`)
+    }
+    if (column.type !== "string") {
+      throw createError(`Dataset primaryKey column '${columnName}' must have type 'string'.`)
+    }
+    if (column.nullable === true) {
+      throw createError(`Dataset primaryKey column '${columnName}' must not be nullable.`)
+    }
+  }
+}
+
 export function assertDatasetDefinition(
   definition: unknown,
   createError: (message: string) => Error = (message) => new DatasetValidationError(message)
@@ -143,6 +181,10 @@ export function assertDatasetDefinition(
   assertNonEmptyString(definition.id, "Dataset id", createError)
   assertDatasetSchema(definition.schema, createError)
 
+  if (definition.primaryKey !== undefined) {
+    assertDatasetPrimaryKey(definition.primaryKey, definition.schema, createError)
+  }
+
   if (definition.partitionBy !== undefined) {
     if (!Array.isArray(definition.partitionBy)) {
       throw createError("Dataset partitionBy must be an array of column names.")
@@ -176,7 +218,7 @@ export function getDatasetRowValidationError(
   dataset: DatasetDefinition,
   options?: { readonly columns?: Iterable<string> }
 ): string | null {
-  if (!isPlainObject(row)) {
+  if (!isPlainRecord(row)) {
     return `Dataset '${dataset.id}' rows must be plain objects.`
   }
 

package/src/error-reporting/capability.ts

@@ -1,13 +1,18 @@
-import { randomUUID } from "node:crypto"
 import { SixbErrorReporter } from "./reporter"
-import type { SixbErrorHandler, SixbFailedRun } from "./types"
-
-function resolveOccurredAt(occurredAt?: Date | string): string {
-  if (occurredAt instanceof Date) return occurredAt.toISOString()
-  return occurredAt ?? new Date().toISOString()
-}
+import {
+  type ReportActionPhaseFailureInput,
+  type ReportEventDeliveryFailureInput,
+  type ReportRuleEvaluationFailureInput,
+  type ReportRunFailureInput,
+  reportActionPhaseFailure as reportActionPhaseFailureWith,
+  reportEventDeliveryFailure as reportEventDeliveryFailureWith,
+  reportRuleEvaluationFailure as reportRuleEvaluationFailureWith,
+  reportRunFailure as reportRunFailureWith,
+} from "./reports"
+import type { SixbErrorHandler } from "./types"
 
 const ERROR_REPORTER = Symbol("sixb.error-reporter")
+const FALLBACK_REPORTER = new SixbErrorReporter()
 
 type ErrorReporterHost = {
   [ERROR_REPORTER]?: SixbErrorReporter
@@ -20,6 +25,10 @@ function asHost(value: unknown): ErrorReporterHost | null {
   return value as ErrorReporterHost
 }
 
+function resolveSixbErrorReporter(host: unknown): SixbErrorReporter {
+  return asHost(host)?.[ERROR_REPORTER] ?? FALLBACK_REPORTER
+}
+
 export function attachSixbErrorReporter(
   host: object,
   handler?: SixbErrorHandler
@@ -34,97 +43,35 @@ export function shareSixbErrorReporter(source: object, target: object): void {
   if (reporter) (target as ErrorReporterHost)[ERROR_REPORTER] = reporter
 }
 
-export interface ReportRunFailureInput {
-  readonly projectId: string
-  readonly run: SixbFailedRun
-  readonly occurredAt?: Date | string
-  readonly attempt?: number
+export type {
+  ReportActionPhaseFailureInput,
+  ReportEventDeliveryFailureInput,
+  ReportRuleEvaluationFailureInput,
+  ReportRunFailureInput,
 }
 
-export function reportRunFailure(
+export function reportActionPhaseFailure(
   host: unknown,
   error: unknown,
-  input: ReportRunFailureInput
+  input: ReportActionPhaseFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  reporter.report(error, {
-    type: "run.failed",
-    notificationId: `project:${input.projectId}:run:${input.run.kind}:${input.run.runId}:failed:${occurredAt}`,
-    projectId: input.projectId,
-    occurredAt,
-    ...(input.attempt === undefined ? {} : { attempt: input.attempt }),
-    run: input.run,
-  })
+  reportActionPhaseFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
-export interface ReportEventDeliveryFailureInput {
-  readonly projectId: string
-  /** Event types that never reached subscribers. Payloads must not be passed in. */
-  readonly eventTypes: readonly string[]
-  readonly occurredAt?: Date | string
-  /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */
-  readonly attempts?: number
-  /** Envelope ids, when the events were persisted before delivery failed. */
-  readonly eventIds?: readonly string[]
-  /**
-   * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to
-   * make a report reproducible in a test.
-   */
-  readonly occurrenceId?: string
+export function reportRunFailure(
+  host: unknown,
+  error: unknown,
+  input: ReportRunFailureInput
+): void {
+  reportRunFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
-/**
- * Report that domain events were lost.
- *
- * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,
- * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier
- * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists
- * to surface.
- *
- * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus
- * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected
- * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole
- * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched
- * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not
- * fix that; an identity does.
- */
 export function reportEventDeliveryFailure(
   host: unknown,
   error: unknown,
   input: ReportEventDeliveryFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  const attempts = input.attempts ?? 1
-  const eventIds = input.eventIds === undefined ? undefined : [...input.eventIds].sort()
-  const firstEventId = eventIds?.[0]
-  const occurrence = firstEventId
-    ? `events:${firstEventId}:attempt:${attempts}`
-    : `emit:${input.occurrenceId ?? randomUUID()}`
-  reporter.report(error, {
-    type: "event.delivery.failed",
-    notificationId: `project:${input.projectId}:event-delivery:${occurrence}`,
-    projectId: input.projectId,
-    occurredAt,
-    attempts,
-    eventTypes: input.eventTypes,
-    ...(eventIds === undefined ? {} : { eventIds }),
-  })
-}
-
-export interface ReportRuleEvaluationFailureInput {
-  readonly projectId: string
-  readonly source: "live" | "reconciliation"
-  readonly eventIds?: readonly string[]
-  readonly occurredAt?: Date | string
-  /** Set when the failure could be attributed to one rule/subject candidate. */
-  readonly ruleId?: string
-  readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }
+  reportEventDeliveryFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
 export function reportRuleEvaluationFailure(
@@ -132,29 +79,9 @@ export function reportRuleEvaluationFailure(
   error: unknown,
   input: ReportRuleEvaluationFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  const eventIds = [...(input.eventIds ?? [])].sort()
-  // A candidate-level failure keys on the candidate, so two rules failing over the same batch stay
-  // two notifications rather than collapsing into one.
-  const occurrence =
-    input.ruleId && input.subject
-      ? `${input.ruleId}:${input.subject.objectTypeId}:${input.subject.primaryId}`
-      : (eventIds[0] ?? "current-state")
-  reporter.report(error, {
-    type: "rule.evaluation.failed",
-    notificationId: `project:${input.projectId}:rule-evaluation:${input.source}:${occurrence}:failed:${occurredAt}`,
-    projectId: input.projectId,
-    occurredAt,
-    source: input.source,
-    eventIds,
-    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),
-    ...(input.subject === undefined ? {} : { subject: input.subject }),
-  })
+  reportRuleEvaluationFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
 export async function flushSixbErrors(host: unknown, timeoutMs?: number): Promise<void> {
-  await asHost(host)?.[ERROR_REPORTER]?.flush(timeoutMs)
+  await resolveSixbErrorReporter(host).flush(timeoutMs)
 }