@sixb/core 0.1.1 → 0.1.2

package/src/connectors/types.ts

@@ -20,11 +20,127 @@ export interface ConnectorContext {
  */
 export interface ConnectorAdapter<TType extends string = string, TClient = unknown> {
   readonly type: TType
+  readonly authentication?: never
   readonly webhooks?: readonly WebhookDefinition<unknown, TClient>[]
   connect(context: ConnectorContext): Promise<TClient> | TClient
   disconnect?(client: TClient): Promise<void> | void
 }
 
+/** One OAuth token set normalized by an OAuth connector adapter. */
+export interface ConnectorOAuthCredentials {
+  readonly accessToken: string
+  readonly refreshToken?: string
+  readonly tokenType?: string
+  readonly scopes?: readonly string[]
+  readonly expiresAt?: Date
+}
+
+/** Public, non-secret account information returned for framework-owned selection UI. */
+export interface ConnectorAccountCandidate {
+  readonly id: string
+  readonly label: string
+  readonly description?: string
+  readonly avatarUrl?: string
+}
+
+/** V1 intentionally supports project-owned connector connections only. */
+export interface ProjectConnectorConnectionOwner {
+  readonly type: "project"
+}
+
+export type ConnectorConnectionOwner = ProjectConnectorConnectionOwner
+
+/** Stable application-defined lookup key for one connector connection. */
+export interface ConnectorConnectionSelector {
+  readonly owner: ConnectorConnectionOwner
+  readonly slot: string
+}
+
+/** Stable, non-secret metadata shared by connector connection consumers. */
+export interface ConnectorConnectionMetadata extends ConnectorConnectionSelector {
+  readonly id: string
+  readonly connectorId: string
+  readonly account: ConnectorAccountCandidate
+}
+
+/** Credential protection required when an OAuth connector uses durable connection storage. */
+export interface ConnectorConnectionOptions {
+  /** Canonical base64url encoding of exactly 32 random bytes, shared by storage replicas. */
+  readonly encryptionKey: string
+}
+
+export interface OAuthConnectorAuthorizationContext extends ConnectorContext {
+  readonly redirectUri: string
+}
+
+export interface OAuthConnectorAuthorizationUrlInput {
+  readonly state: string
+  readonly codeChallenge: string
+  readonly codeChallengeMethod: "S256"
+}
+
+export interface OAuthConnectorCodeExchangeInput {
+  readonly code: string
+  readonly codeVerifier: string
+}
+
+export interface ConnectorConnectionClientContext extends ConnectorContext {
+  readonly connectionId: string
+  readonly account: ConnectorAccountCandidate
+  readonly tokenSource: ConnectorTokenSource
+}
+
+/** One delivered token, bound to the credential revision that produced it. */
+export interface ConnectorAccessToken {
+  readonly accessToken: string
+  readonly tokenType?: string
+  /** Report this exact token as rejected so Sixb can refresh only its credential revision. */
+  invalidate(): void
+}
+
+/** Live credential source owned by Sixb. Adapters must resolve a token for each request. */
+export interface ConnectorTokenSource {
+  get(): Promise<ConnectorAccessToken>
+}
+
+/**
+ * OAuth-backed connector adapter. Sixb owns persistence, OAuth state, refresh coordination and UI;
+ * the adapter owns provider protocol details and typed client creation.
+ */
+export interface ConnectorOAuth2Authentication {
+  readonly type: "oauth2"
+  authorizationUrl(
+    context: OAuthConnectorAuthorizationContext,
+    input: OAuthConnectorAuthorizationUrlInput
+  ): Promise<string | URL> | string | URL
+  exchangeCode(
+    context: OAuthConnectorAuthorizationContext,
+    input: OAuthConnectorCodeExchangeInput
+  ): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials
+  refresh(
+    context: ConnectorContext,
+    credentials: ConnectorOAuthCredentials
+  ): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials
+  /**
+   * Revokes the grant idempotently. An already revoked or invalid grant must resolve successfully
+   * so Sixb can converge after losing an earlier provider response.
+   */
+  revoke?(context: ConnectorContext, credentials: ConnectorOAuthCredentials): Promise<void> | void
+}
+
+export interface OAuthConnectorAdapter<TType extends string = string, TClient = unknown> {
+  readonly type: TType
+  readonly authentication: ConnectorOAuth2Authentication
+  readonly webhooks?: undefined
+  discoverAccounts(
+    context: ConnectorContext,
+    credentials: ConnectorOAuthCredentials
+  ): Promise<readonly ConnectorAccountCandidate[]> | readonly ConnectorAccountCandidate[]
+  connect(context: ConnectorConnectionClientContext): Promise<TClient> | TClient
+}
+
+export type AnyConnectorAdapter = ConnectorAdapter | OAuthConnectorAdapter
+
 /**
  * Inert connector definition registered with Sixb.
  *
@@ -33,30 +149,63 @@ export interface ConnectorAdapter<TType extends string = string, TClient = unkno
  */
 export interface ConnectorDefinition<
   TId extends string = string,
-  TAdapter extends ConnectorAdapter = ConnectorAdapter,
+  TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter,
 > {
   readonly kind: "connector"
   readonly id: TId
   readonly adapter: TAdapter
 }
 
+export type StaticConnectorDefinition = ConnectorDefinition<string, ConnectorAdapter>
+
 /** Infer the connected client type returned by a connector adapter. */
-export type ConnectorClient<TAdapter extends ConnectorAdapter> = Awaited<
+export type ConnectorClient<TAdapter extends AnyConnectorAdapter> = Awaited<
   ReturnType<TAdapter["connect"]>
 >
 
+export function isOAuthConnectorAdapter(
+  value: AnyConnectorAdapter
+): value is OAuthConnectorAdapter {
+  return "authentication" in value && value.authentication?.type === "oauth2"
+}
+
+export function isOAuthConnectorDefinition(
+  value: ConnectorDefinition
+): value is ConnectorDefinition<string, OAuthConnectorAdapter> {
+  return isOAuthConnectorAdapter(value.adapter)
+}
+
+export function isStaticConnectorDefinition(
+  value: ConnectorDefinition
+): value is StaticConnectorDefinition {
+  return !isOAuthConnectorDefinition(value)
+}
+
 export function isConnectorDefinition(value: unknown): value is ConnectorDefinition {
   if (!isRecord(value)) {
     return false
   }
 
-  return (
+  const adapter = value.adapter
+  if (
     value.kind === "connector" &&
     typeof value.id === "string" &&
-    isRecord(value.adapter) &&
-    typeof value.adapter.type === "string" &&
-    typeof value.adapter.connect === "function"
-  )
+    isRecord(adapter) &&
+    typeof adapter.type === "string" &&
+    typeof adapter.connect === "function"
+  ) {
+    if (adapter.authentication === undefined) return true
+    const authentication = adapter.authentication
+    if (!isRecord(authentication) || authentication.type !== "oauth2") return false
+    return (
+      typeof authentication.authorizationUrl === "function" &&
+      typeof authentication.exchangeCode === "function" &&
+      typeof authentication.refresh === "function" &&
+      typeof adapter.discoverAccounts === "function"
+    )
+  }
+
+  return false
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {

package/src/datasets/execution.ts

@@ -0,0 +1,24 @@
+import { isAllowed } from "../authorization"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type { DatasetDefinition } from "./types"
+
+export interface DatasetsRuntime {
+  list(): readonly DatasetDefinition[]
+  getById(datasetId: string): DatasetDefinition | null
+}
+
+export function createDatasetsRuntime(
+  runtime: Pick<SixbRuntimeContext, "authorization">,
+  source: Pick<DatasetsRuntime, "list" | "getById">
+): DatasetsRuntime {
+  const allowed = (datasetId: string) =>
+    isAllowed(runtime.authorization, { kind: "dataset.view", datasetId })
+
+  return {
+    list: () => source.list().filter((dataset) => allowed(dataset.id)),
+    getById: (datasetId) => {
+      const dataset = source.getById(datasetId)
+      return dataset && allowed(datasetId) ? dataset : null
+    },
+  }
+}

package/src/error-reporting/capability.ts

@@ -1,13 +1,18 @@
-import { randomUUID } from "node:crypto"
 import { SixbErrorReporter } from "./reporter"
-import type { SixbErrorHandler, SixbFailedRun } from "./types"
-
-function resolveOccurredAt(occurredAt?: Date | string): string {
-  if (occurredAt instanceof Date) return occurredAt.toISOString()
-  return occurredAt ?? new Date().toISOString()
-}
+import {
+  type ReportActionPhaseFailureInput,
+  type ReportEventDeliveryFailureInput,
+  type ReportRuleEvaluationFailureInput,
+  type ReportRunFailureInput,
+  reportActionPhaseFailure as reportActionPhaseFailureWith,
+  reportEventDeliveryFailure as reportEventDeliveryFailureWith,
+  reportRuleEvaluationFailure as reportRuleEvaluationFailureWith,
+  reportRunFailure as reportRunFailureWith,
+} from "./reports"
+import type { SixbErrorHandler } from "./types"
 
 const ERROR_REPORTER = Symbol("sixb.error-reporter")
+const FALLBACK_REPORTER = new SixbErrorReporter()
 
 type ErrorReporterHost = {
   [ERROR_REPORTER]?: SixbErrorReporter
@@ -20,6 +25,10 @@ function asHost(value: unknown): ErrorReporterHost | null {
   return value as ErrorReporterHost
 }
 
+function resolveSixbErrorReporter(host: unknown): SixbErrorReporter {
+  return asHost(host)?.[ERROR_REPORTER] ?? FALLBACK_REPORTER
+}
+
 export function attachSixbErrorReporter(
   host: object,
   handler?: SixbErrorHandler
@@ -34,97 +43,35 @@ export function shareSixbErrorReporter(source: object, target: object): void {
   if (reporter) (target as ErrorReporterHost)[ERROR_REPORTER] = reporter
 }
 
-export interface ReportRunFailureInput {
-  readonly projectId: string
-  readonly run: SixbFailedRun
-  readonly occurredAt?: Date | string
-  readonly attempt?: number
+export type {
+  ReportActionPhaseFailureInput,
+  ReportEventDeliveryFailureInput,
+  ReportRuleEvaluationFailureInput,
+  ReportRunFailureInput,
 }
 
-export function reportRunFailure(
+export function reportActionPhaseFailure(
   host: unknown,
   error: unknown,
-  input: ReportRunFailureInput
+  input: ReportActionPhaseFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  reporter.report(error, {
-    type: "run.failed",
-    notificationId: `project:${input.projectId}:run:${input.run.kind}:${input.run.runId}:failed:${occurredAt}`,
-    projectId: input.projectId,
-    occurredAt,
-    ...(input.attempt === undefined ? {} : { attempt: input.attempt }),
-    run: input.run,
-  })
+  reportActionPhaseFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
-export interface ReportEventDeliveryFailureInput {
-  readonly projectId: string
-  /** Event types that never reached subscribers. Payloads must not be passed in. */
-  readonly eventTypes: readonly string[]
-  readonly occurredAt?: Date | string
-  /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */
-  readonly attempts?: number
-  /** Envelope ids, when the events were persisted before delivery failed. */
-  readonly eventIds?: readonly string[]
-  /**
-   * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to
-   * make a report reproducible in a test.
-   */
-  readonly occurrenceId?: string
+export function reportRunFailure(
+  host: unknown,
+  error: unknown,
+  input: ReportRunFailureInput
+): void {
+  reportRunFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
-/**
- * Report that domain events were lost.
- *
- * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,
- * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier
- * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists
- * to surface.
- *
- * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus
- * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected
- * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole
- * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched
- * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not
- * fix that; an identity does.
- */
 export function reportEventDeliveryFailure(
   host: unknown,
   error: unknown,
   input: ReportEventDeliveryFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  const attempts = input.attempts ?? 1
-  const eventIds = input.eventIds === undefined ? undefined : [...input.eventIds].sort()
-  const firstEventId = eventIds?.[0]
-  const occurrence = firstEventId
-    ? `events:${firstEventId}:attempt:${attempts}`
-    : `emit:${input.occurrenceId ?? randomUUID()}`
-  reporter.report(error, {
-    type: "event.delivery.failed",
-    notificationId: `project:${input.projectId}:event-delivery:${occurrence}`,
-    projectId: input.projectId,
-    occurredAt,
-    attempts,
-    eventTypes: input.eventTypes,
-    ...(eventIds === undefined ? {} : { eventIds }),
-  })
-}
-
-export interface ReportRuleEvaluationFailureInput {
-  readonly projectId: string
-  readonly source: "live" | "reconciliation"
-  readonly eventIds?: readonly string[]
-  readonly occurredAt?: Date | string
-  /** Set when the failure could be attributed to one rule/subject candidate. */
-  readonly ruleId?: string
-  readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }
+  reportEventDeliveryFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
 export function reportRuleEvaluationFailure(
@@ -132,29 +79,9 @@ export function reportRuleEvaluationFailure(
   error: unknown,
   input: ReportRuleEvaluationFailureInput
 ): void {
-  const reporter = asHost(host)?.[ERROR_REPORTER]
-  if (!reporter) return
-
-  const occurredAt = resolveOccurredAt(input.occurredAt)
-  const eventIds = [...(input.eventIds ?? [])].sort()
-  // A candidate-level failure keys on the candidate, so two rules failing over the same batch stay
-  // two notifications rather than collapsing into one.
-  const occurrence =
-    input.ruleId && input.subject
-      ? `${input.ruleId}:${input.subject.objectTypeId}:${input.subject.primaryId}`
-      : (eventIds[0] ?? "current-state")
-  reporter.report(error, {
-    type: "rule.evaluation.failed",
-    notificationId: `project:${input.projectId}:rule-evaluation:${input.source}:${occurrence}:failed:${occurredAt}`,
-    projectId: input.projectId,
-    occurredAt,
-    source: input.source,
-    eventIds,
-    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),
-    ...(input.subject === undefined ? {} : { subject: input.subject }),
-  })
+  reportRuleEvaluationFailureWith(resolveSixbErrorReporter(host), error, input)
 }
 
 export async function flushSixbErrors(host: unknown, timeoutMs?: number): Promise<void> {
-  await asHost(host)?.[ERROR_REPORTER]?.flush(timeoutMs)
+  await resolveSixbErrorReporter(host).flush(timeoutMs)
 }

package/src/error-reporting/internal.ts

@@ -1,13 +1,15 @@
 export {
   attachSixbErrorReporter,
   flushSixbErrors,
+  type ReportActionPhaseFailureInput,
   type ReportEventDeliveryFailureInput,
   type ReportRuleEvaluationFailureInput,
   type ReportRunFailureInput,
+  reportActionPhaseFailure,
   reportEventDeliveryFailure,
   reportRuleEvaluationFailure,
   reportRunFailure,
   shareSixbErrorReporter,
 } from "./capability"
 export { normalizeReportedError } from "./normalize"
-export { SixbErrorReporter } from "./reporter"
+export { type ErrorReporter, SixbErrorReporter } from "./reporter"

package/src/error-reporting/reporter.ts

@@ -3,17 +3,25 @@ import type { SixbErrorContext, SixbErrorHandler } from "./types"
 
 const DEFAULT_FLUSH_TIMEOUT_MS = 5_000
 
+export interface ErrorReporter {
+  report(error: unknown, context: SixbErrorContext): void
+}
+
 /** Failure-isolated, non-blocking adapter around the configured callback. */
-export class SixbErrorReporter {
+export class SixbErrorReporter implements ErrorReporter {
   private readonly pending = new Set<Promise<void>>()
 
   constructor(private readonly handler?: SixbErrorHandler) {}
 
   report(error: unknown, context: SixbErrorContext): void {
-    if (!this.handler) return
+    const normalizedError = normalizeReportedError(error)
+    if (!this.handler) {
+      reportToConsole(normalizedError, context)
+      return
+    }
 
     const invocation = Promise.resolve()
-      .then(() => this.handler?.(normalizeReportedError(error), context))
+      .then(() => this.handler?.(normalizedError, context))
       .then(() => undefined)
       .catch((handlerError) => {
         try {
@@ -47,6 +55,14 @@ export class SixbErrorReporter {
   }
 }
 
+function reportToConsole(error: Error, context: SixbErrorContext): void {
+  try {
+    console.error(`[Sixb] Unhandled ${context.type}:`, error, context)
+  } catch {
+    // Error reporting must never escape back into framework execution.
+  }
+}
+
 async function settleWithin(
   promises: readonly Promise<void>[],
   timeoutMs: number

package/src/error-reporting/reports.ts

@@ -0,0 +1,172 @@
+import { randomUUID } from "node:crypto"
+import { captureSixbFailure } from "../errors/internal"
+import type { SixbFailure } from "../errors/types"
+import type { ActionRunFailure } from "../storage/action-runs"
+import type { ErrorReporter } from "./reporter"
+import type { SixbFailedRun } from "./types"
+
+function resolveOccurredAt(occurredAt?: Date | string): string {
+  if (occurredAt instanceof Date) return occurredAt.toISOString()
+  return occurredAt ?? new Date().toISOString()
+}
+
+export type ReportRunFailureInput = SixbFailedRun & {
+  readonly projectId: string
+  readonly attempt?: number
+}
+
+export function reportRunFailure(
+  reporter: ErrorReporter,
+  error: unknown,
+  input: ReportRunFailureInput
+): void {
+  const occurredAt = input.failure.at
+  reporter.report(error, {
+    ...input,
+    type: "run.failed",
+    notificationId: `project:${input.projectId}:run:${input.runKind}:${input.run.runId}:failed:${occurredAt}`,
+    occurredAt,
+  })
+}
+
+export interface ReportActionPhaseFailureInput {
+  readonly projectId: string
+  readonly actionId: string
+  readonly runId: string
+  readonly phase: "effects"
+  readonly failure: ActionRunFailure<"effects">
+}
+
+export function reportActionPhaseFailure(
+  reporter: ErrorReporter,
+  error: unknown,
+  input: ReportActionPhaseFailureInput
+): void {
+  reporter.report(error, {
+    type: "action.phase.failed",
+    notificationId: `project:${input.projectId}:action:${input.actionId}:run:${input.runId}:phase:${input.phase}:failed:${input.failure.at}`,
+    projectId: input.projectId,
+    occurredAt: input.failure.at,
+    actionId: input.actionId,
+    runId: input.runId,
+    phase: input.phase,
+    failure: input.failure,
+  })
+}
+
+export interface ReportEventDeliveryFailureInput {
+  readonly projectId: string
+  /** Exact durable failure when this delivery was persisted by the ontology outbox. */
+  readonly failure?: SixbFailure<"event.delivery_failed">
+  /** Event types that never reached subscribers. Payloads must not be passed in. */
+  readonly eventTypes: readonly string[]
+  readonly occurredAt?: Date | string
+  /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */
+  readonly attempts?: number
+  /** Envelope ids, when the events were persisted before delivery failed. */
+  readonly eventIds?: readonly string[]
+  /**
+   * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to
+   * make a report reproducible in a test.
+   */
+  readonly occurrenceId?: string
+}
+
+/**
+ * Report that domain events were lost.
+ *
+ * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,
+ * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier
+ * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists
+ * to surface.
+ *
+ * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus
+ * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected
+ * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole
+ * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched
+ * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not
+ * fix that; an identity does.
+ */
+export function reportEventDeliveryFailure(
+  reporter: ErrorReporter,
+  error: unknown,
+  input: ReportEventDeliveryFailureInput
+): void {
+  const occurredAt = input.failure?.at ?? resolveOccurredAt(input.occurredAt)
+  const attempts = input.attempts ?? 1
+  const eventIds = input.eventIds === undefined ? undefined : [...input.eventIds].sort()
+  const eventTypes = [...input.eventTypes]
+  const failure =
+    input.failure ??
+    captureSixbFailure(error, {
+      allowedCodes: ["event.delivery_failed"],
+      defaultCode: "event.delivery_failed",
+      details: {
+        attempts,
+        eventTypes,
+        ...(eventIds === undefined ? {} : { eventIds }),
+      },
+      at: new Date(occurredAt),
+    })
+  const firstEventId = eventIds?.[0]
+  const occurrence = firstEventId
+    ? `events:${firstEventId}:attempt:${attempts}`
+    : `emit:${input.occurrenceId ?? randomUUID()}`
+  reporter.report(error, {
+    type: "event.delivery.failed",
+    notificationId: `project:${input.projectId}:event-delivery:${occurrence}`,
+    projectId: input.projectId,
+    occurredAt,
+    failure,
+    attempts,
+    eventTypes,
+    ...(eventIds === undefined ? {} : { eventIds }),
+  })
+}
+
+export interface ReportRuleEvaluationFailureInput {
+  readonly projectId: string
+  readonly source: "live" | "reconciliation"
+  readonly eventIds?: readonly string[]
+  readonly occurredAt?: Date | string
+  /** Set when the failure could be attributed to one rule/subject candidate. */
+  readonly ruleId?: string
+  readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }
+}
+
+export function reportRuleEvaluationFailure(
+  reporter: ErrorReporter,
+  error: unknown,
+  input: ReportRuleEvaluationFailureInput
+): void {
+  const occurredAt = resolveOccurredAt(input.occurredAt)
+  const eventIds = [...(input.eventIds ?? [])].sort()
+  const failure = captureSixbFailure(error, {
+    allowedCodes: ["internal.unexpected"],
+    defaultCode: "internal.unexpected",
+    details: {
+      source: input.source,
+      eventIds,
+      ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),
+      ...(input.subject === undefined ? {} : { subject: input.subject }),
+    },
+    at: new Date(occurredAt),
+  })
+  // A candidate-level failure keys on the candidate, so two rules failing over the same batch stay
+  // two notifications rather than collapsing into one.
+  const occurrence =
+    input.ruleId && input.subject
+      ? `${input.ruleId}:${input.subject.objectTypeId}:${input.subject.primaryId}`
+      : (eventIds[0] ?? "current-state")
+  reporter.report(error, {
+    type: "rule.evaluation.failed",
+    notificationId: `project:${input.projectId}:rule-evaluation:${input.source}:${occurrence}:failed:${occurredAt}`,
+    projectId: input.projectId,
+    occurredAt,
+    failure,
+    source: input.source,
+    eventIds,
+    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),
+    ...(input.subject === undefined ? {} : { subject: input.subject }),
+  })
+}