@wardby/cli 0.5.2 → 0.6.0

package/dist/core/secret-broker-config.d.ts

@@ -0,0 +1,103 @@
+import { z } from "zod";
+export declare const MIN_BROKERED_VALUE_LENGTH = 6;
+export declare const SecretBrokerConfigSchema: z.ZodObject<{
+    hosts: z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">;
+    pathPrefixes: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    placement: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"header">;
+        name: z.ZodEffects<z.ZodString, string, string>;
+        format: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        kind: "header";
+        format: string;
+    }, {
+        name: string;
+        kind: "header";
+        format: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"query">;
+        name: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        kind: "query";
+    }, {
+        name: string;
+        kind: "query";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"body">;
+        field: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "body";
+        field: string;
+    }, {
+        kind: "body";
+        field: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"aws-sigv4">;
+        region: z.ZodString;
+        service: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "aws-sigv4";
+        service: string;
+        region: string;
+    }, {
+        kind: "aws-sigv4";
+        service: string;
+        region: string;
+    }>]>;
+}, "strict", z.ZodTypeAny, {
+    hosts: string[];
+    placement: {
+        name: string;
+        kind: "header";
+        format: string;
+    } | {
+        name: string;
+        kind: "query";
+    } | {
+        kind: "body";
+        field: string;
+    } | {
+        kind: "aws-sigv4";
+        service: string;
+        region: string;
+    };
+    pathPrefixes?: string[] | undefined;
+}, {
+    hosts: string[];
+    placement: {
+        name: string;
+        kind: "header";
+        format: string;
+    } | {
+        name: string;
+        kind: "query";
+    } | {
+        kind: "body";
+        field: string;
+    } | {
+        kind: "aws-sigv4";
+        service: string;
+        region: string;
+    };
+    pathPrefixes?: string[] | undefined;
+}>;
+export type SecretBrokerConfig = z.infer<typeof SecretBrokerConfigSchema>;
+export type SecretBrokerPlacement = SecretBrokerConfig["placement"];
+export declare function parseSecretBrokerConfig(input: unknown): SecretBrokerConfig;
+/**
+ * A fingerprint of one broker config (sha256 hex of its parsed JSON): an unbroker
+ * link carries the hash of the config it was minted for, so it can't remove a
+ * config that has changed since.
+ */
+export declare function brokerConfigHash(config: SecretBrokerConfig): string;
+export declare const SECRET_BROKER_CHANGED = "secret_broker_changed: brokering changed since this link was created; request a new link";
+export type SigV4Credentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+};
+export declare function parseSigV4Value(value: string): SigV4Credentials;
+/** Throws unless `value` can be brokered under `config` (and later scrubbed from responses). */
+export declare function assertBrokerableValue(config: SecretBrokerConfig, value: string): void;

package/dist/core/secret-broker-config.js

@@ -0,0 +1,112 @@
+/**
+ * A brokered secret's owner-set config: where its value may be sent and how it is
+ * placed. Validated on every write; the privileged host (sandbox/secret-broker.ts)
+ * trusts it at request time.
+ */
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const MIN_BROKERED_VALUE_LENGTH = 6;
+const FORBIDDEN_HEADERS = ["host", "connection", "transfer-encoding", "content-length", "upgrade", "proxy-connection"];
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/;
+const HOSTNAME = /^(?=.{1,253}$)(?!-)[a-z0-9-]{1,63}(?:\.(?!-)[a-z0-9-]{1,63})+$/;
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/** False for a name a resolver could read as an IPv4 address ("127.1", "0x7f.0.0.1") or with a label ending in "-". */
+function isExactHostname(h) {
+    if (!HOSTNAME.test(h) || IPV4.test(h))
+        return false;
+    const labels = h.split(".");
+    const last = labels[labels.length - 1];
+    return !/^\d+$/.test(last) && !last.startsWith("0x") && !labels.some((l) => l.endsWith("-"));
+}
+const host = z
+    .string()
+    .transform((h) => h.toLowerCase())
+    .refine(isExactHostname, "hosts must be exact hostnames (no scheme, port, wildcard, or IP)");
+const pathPrefix = z
+    .string()
+    .max(512)
+    .startsWith("/")
+    .refine(
+// eslint-disable-next-line no-control-regex
+(p) => !/[?#\\\x00-\x1f\x7f]/.test(p) && !/%2f|%5c/i.test(p), "path prefixes must not contain ?, #, a backslash, control characters, or an encoded / or \\");
+const placement = z.discriminatedUnion("kind", [
+    z
+        .object({
+        kind: z.literal("header"),
+        name: z
+            .string()
+            .regex(TOKEN, "header name must be an HTTP token")
+            .refine((n) => !FORBIDDEN_HEADERS.includes(n.toLowerCase()), "that header cannot be set"),
+        format: z
+            .string()
+            .max(256)
+            .refine((f) => f.split("{value}").length === 2, 'format must contain "{value}" exactly once')
+            .refine((f) => !/[\r\n]/.test(f), "format must not contain line breaks"),
+    })
+        .strict(),
+    z.object({ kind: z.literal("query"), name: z.string().min(1).max(128) }).strict(),
+    z.object({ kind: z.literal("body"), field: z.string().min(1).max(128) }).strict(),
+    z
+        .object({
+        kind: z.literal("aws-sigv4"),
+        region: z.string().regex(/^[a-z0-9-]{1,32}$/),
+        service: z.string().regex(/^[a-z0-9-]{1,64}$/),
+    })
+        .strict(),
+]);
+export const SecretBrokerConfigSchema = z
+    .object({
+    hosts: z.array(host).min(1).max(20),
+    pathPrefixes: z.array(pathPrefix).max(20).optional(),
+    placement,
+})
+    .strict();
+export function parseSecretBrokerConfig(input) {
+    const parsed = SecretBrokerConfigSchema.safeParse(input);
+    if (!parsed.success) {
+        throw new Error(`secret_broker_config_invalid: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+    }
+    return parsed.data;
+}
+/**
+ * A fingerprint of one broker config (sha256 hex of its parsed JSON): an unbroker
+ * link carries the hash of the config it was minted for, so it can't remove a
+ * config that has changed since.
+ */
+export function brokerConfigHash(config) {
+    return createHash("sha256")
+        .update(JSON.stringify(parseSecretBrokerConfig(config)))
+        .digest("hex");
+}
+export const SECRET_BROKER_CHANGED = "secret_broker_changed: brokering changed since this link was created; request a new link";
+const SigV4ValueSchema = z
+    .object({
+    accessKeyId: z.string().min(1).max(256),
+    secretAccessKey: z.string().min(MIN_BROKERED_VALUE_LENGTH).max(1024),
+    sessionToken: z.string().min(MIN_BROKERED_VALUE_LENGTH).max(8192).optional(),
+})
+    .strict();
+export function parseSigV4Value(value) {
+    let json;
+    try {
+        json = JSON.parse(value);
+    }
+    catch {
+        throw new Error("secret_broker_value_invalid: an AWS SigV4 secret's value must be JSON {accessKeyId, secretAccessKey, sessionToken?}");
+    }
+    const parsed = SigV4ValueSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new Error("secret_broker_value_invalid: an AWS SigV4 secret's value must be JSON {accessKeyId, secretAccessKey, sessionToken?}");
+    }
+    return parsed.data;
+}
+/** Throws unless `value` can be brokered under `config` (and later scrubbed from responses). */
+export function assertBrokerableValue(config, value) {
+    if (config.placement.kind === "aws-sigv4") {
+        parseSigV4Value(value);
+        return;
+    }
+    if (value.length < MIN_BROKERED_VALUE_LENGTH) {
+        throw new Error(`secret_broker_value_invalid: a brokered value must be at least ${MIN_BROKERED_VALUE_LENGTH} characters`);
+    }
+}

package/dist/core/secrets.d.ts

@@ -6,19 +6,52 @@
  * always resolve a name within one owner's (or, at get-time, one agent's)
  * scope, never globally.
  */
-import type { PrismaClient, Secret } from "#prisma";
+import { type PrismaClient, type Secret } from "#prisma";
 import type { SecretCipher } from "../providers/secrets/types.js";
-export type SecretMetadata = Pick<Secret, "id" | "name" | "keyId" | "ownerId" | "createdAt" | "updatedAt">;
+import { type SecretBrokerConfig } from "./secret-broker-config.js";
+export type BrokerChangeVia = "mcp" | "browser";
+export type SecretMetadata = Pick<Secret, "id" | "name" | "keyId" | "ownerId" | "createdAt" | "updatedAt"> & {
+    broker: SecretBrokerConfig | null;
+};
+export interface SecretEntry {
+    value: string;
+    broker: SecretBrokerConfig | null;
+}
 export interface SecretsAccessor {
+    /** Readable secrets only: a brokered secret throws `secret_brokered`. */
     get(name: string): Promise<string | undefined>;
+    /** Host-internal: value and broker config, brokered or not. Never exposed to tool code. */
+    resolve?(name: string): Promise<SecretEntry | undefined>;
 }
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
  * (same id) rather than failing on the unique constraint. The plaintext is
- * never logged or returned.
+ * never logged or returned. With `options.broker`, the config is validated
+ * against the value, saved, and audited in the same transaction.
+ */
+export declare function createSecret(name: string, value: string, ownerId: string, cipher: SecretCipher, db: PrismaClient, options?: {
+    broker?: SecretBrokerConfig;
+    via?: BrokerChangeVia;
+}): Promise<Secret>;
+/**
+ * Sets, changes, or (broker: null) removes a secret's broker config, with one audit
+ * row per actual change. `expectedBrokerHash` (brokerConfigHash of the config the
+ * caller confirmed) makes the change conditional, checked inside the transaction:
+ * if the secret is no longer brokered with exactly that config, it throws
+ * secret_broker_changed and changes nothing.
  */
-export declare function createSecret(name: string, value: string, ownerId: string, cipher: SecretCipher, db: PrismaClient): Promise<Secret>;
+export declare function setSecretBroker(db: PrismaClient, cipher: SecretCipher, input: {
+    ownerId: string;
+    name: string;
+    broker: SecretBrokerConfig | null;
+    actorId: string;
+    via: BrokerChangeVia;
+    expectedBrokerHash?: string;
+}): Promise<{
+    before: SecretBrokerConfig | null;
+    after: SecretBrokerConfig | null;
+}>;
 /** Names/metadata only — never a value or ciphertext. */
 export declare function listSecrets(ownerId: string, db: PrismaClient): Promise<SecretMetadata[]>;
 /** Attaches one of the owner's own secrets (by canonical name) to an agent,
@@ -43,6 +76,8 @@ export declare function deleteSecret(secretId: string, db: PrismaClient): Promis
  * binding written before that rule, left behind by make_owner, or on an
  * owner-less agent behaves exactly like an unattached name, so one owner's
  * secret never reaches another owner's agent (A2/S2-2, R2-1).
+ *
+ * A brokered secret's `get` throws `secret_brokered`; only the privileged host's `resolve` sees its value.
  */
 export declare function buildSecretsAccessor(agentId: string, cipher: SecretCipher, db: Pick<PrismaClient, "agentSecret"> & Partial<Pick<PrismaClient, "$queryRaw">>): SecretsAccessor;
 /**

package/dist/core/secrets.js

@@ -1,31 +1,120 @@
+/**
+ * Secrets: encrypted-at-rest values, attached to an agent by name, readable
+ * only inside the sandbox at point-of-use (never by any read/list tool).
+ * `Secret.name` is unique per owner (`@@unique([ownerId, name])`), so two
+ * owners can each have their own "API_KEY" without collision — attach/get
+ * always resolve a name within one owner's (or, at get-time, one agent's)
+ * scope, never globally.
+ */
+import { Prisma } from "#prisma";
 import { boundedString } from "../sandbox/bounded-json.js";
+import { assertBrokerableValue, brokerConfigHash, parseSecretBrokerConfig, SECRET_BROKER_CHANGED, } from "./secret-broker-config.js";
+function brokerOf(secret) {
+    return secret.broker === null || secret.broker === undefined ? null : parseSecretBrokerConfig(secret.broker);
+}
+const BROKERED_GET_MESSAGE = 'secret_brokered: this secret is brokered; send it with fetch(url, { secrets: ["NAME"] }) instead of reading it';
 /**
  * Encrypts and stores a secret value. Upserts on (ownerId, name) — calling
  * this again for a name the owner already has rotates its value in place
  * (same id) rather than failing on the unique constraint. The plaintext is
- * never logged or returned.
+ * never logged or returned. With `options.broker`, the config is validated
+ * against the value, saved, and audited in the same transaction.
  */
-export async function createSecret(name, value, ownerId, cipher, db) {
+export async function createSecret(name, value, ownerId, cipher, db, options = {}) {
     boundedString(name, 1024);
     boundedString(value, 65_536);
+    const broker = options.broker ? parseSecretBrokerConfig(options.broker) : undefined;
+    if (broker)
+        assertBrokerableValue(broker, value);
     const ciphertext = await cipher.encrypt(value);
     const keyId = cipher.keyId();
-    return db.secret.upsert({
-        where: { ownerId_name: { ownerId, name } },
-        create: { name, ciphertext, keyId, ownerId },
-        update: { ciphertext, keyId },
+    if (!broker) {
+        // A rotation that omits `broker` keeps the stored config, so the new value must still be brokerable.
+        const existing = await db.secret.findUnique({
+            where: { ownerId_name: { ownerId, name } },
+            select: { broker: true },
+        });
+        if (existing?.broker)
+            assertBrokerableValue(brokerOf(existing), value);
+        return db.secret.upsert({
+            where: { ownerId_name: { ownerId, name } },
+            create: { name, ciphertext, keyId, ownerId },
+            update: { ciphertext, keyId },
+        });
+    }
+    return db.$transaction(async (tx) => {
+        const existing = await tx.secret.findUnique({ where: { ownerId_name: { ownerId, name } } });
+        const before = existing ? brokerOf(existing) : null;
+        const secret = await tx.secret.upsert({
+            where: { ownerId_name: { ownerId, name } },
+            create: { name, ciphertext, keyId, ownerId, broker },
+            update: { ciphertext, keyId, broker },
+        });
+        if (JSON.stringify(before) !== JSON.stringify(broker)) {
+            await tx.secretBrokerChange.create({
+                data: {
+                    secretId: secret.id,
+                    ownerId,
+                    secretName: name,
+                    actorId: ownerId,
+                    before: before ?? Prisma.JsonNull,
+                    after: broker,
+                    via: options.via ?? "mcp",
+                },
+            });
+        }
+        return secret;
+    });
+}
+/**
+ * Sets, changes, or (broker: null) removes a secret's broker config, with one audit
+ * row per actual change. `expectedBrokerHash` (brokerConfigHash of the config the
+ * caller confirmed) makes the change conditional, checked inside the transaction:
+ * if the secret is no longer brokered with exactly that config, it throws
+ * secret_broker_changed and changes nothing.
+ */
+export async function setSecretBroker(db, cipher, input) {
+    const after = input.broker === null ? null : parseSecretBrokerConfig(input.broker);
+    return db.$transaction(async (tx) => {
+        const secret = await tx.secret.findUnique({
+            where: { ownerId_name: { ownerId: input.ownerId, name: input.name } },
+        });
+        if (!secret)
+            throw new Error(`secret_not_found: no secret named "${input.name}"`);
+        const before = brokerOf(secret);
+        if (input.expectedBrokerHash !== undefined && (!before || brokerConfigHash(before) !== input.expectedBrokerHash)) {
+            throw new Error(SECRET_BROKER_CHANGED);
+        }
+        if (JSON.stringify(before) === JSON.stringify(after))
+            return { before, after };
+        if (after)
+            assertBrokerableValue(after, await cipher.decrypt(secret.ciphertext));
+        await tx.secret.update({ where: { id: secret.id }, data: { broker: after ?? Prisma.DbNull } });
+        await tx.secretBrokerChange.create({
+            data: {
+                secretId: secret.id,
+                ownerId: input.ownerId,
+                secretName: secret.name,
+                actorId: input.actorId,
+                before: before ?? Prisma.JsonNull,
+                after: after ?? Prisma.JsonNull,
+                via: input.via,
+            },
+        });
+        return { before, after };
     });
 }
 /** Names/metadata only — never a value or ciphertext. */
 export async function listSecrets(ownerId, db) {
     const secrets = await db.secret.findMany({ where: { ownerId } });
-    return secrets.map(({ id, name, keyId, ownerId: owner, createdAt, updatedAt }) => ({
-        id,
-        name,
-        keyId,
-        ownerId: owner,
-        createdAt,
-        updatedAt,
+    return secrets.map((s) => ({
+        id: s.id,
+        name: s.name,
+        keyId: s.keyId,
+        ownerId: s.ownerId,
+        createdAt: s.createdAt,
+        updatedAt: s.updatedAt,
+        broker: brokerOf(s),
     }));
 }
 async function findOwnedSecretByName(db, ownerId, name) {
@@ -66,37 +155,53 @@ export async function deleteSecret(secretId, db) {
  * binding written before that rule, left behind by make_owner, or on an
  * owner-less agent behaves exactly like an unattached name, so one owner's
  * secret never reaches another owner's agent (A2/S2-2, R2-1).
+ *
+ * A brokered secret's `get` throws `secret_brokered`; only the privileged host's `resolve` sees its value.
  */
 export function buildSecretsAccessor(agentId, cipher, db) {
+    async function resolve(name) {
+        boundedString(name, 1024);
+        if (db.$queryRaw) {
+            // NULL-safe: "=" is never true when either owner is NULL.
+            const rows = await db.$queryRaw `
+        SELECT CASE WHEN octet_length(s."ciphertext") <= 262144 THEN s."ciphertext" ELSE NULL END AS "ciphertext",
+               s."broker" AS "broker"
+        FROM "Secret" s
+        JOIN "AgentSecret" a ON a."secretId" = s."id"
+        JOIN "Agent" g ON g."id" = a."agentId"
+        WHERE a."agentId" = ${agentId} AND a."boundName" = ${name} AND s."ownerId" = g."ownerId" LIMIT 1`;
+            if (!rows.length)
+                return undefined;
+            if (rows[0].ciphertext === null)
+                throw new Error("secret_value_limit");
+            return {
+                value: await cipher.decrypt(rows[0].ciphertext),
+                broker: brokerOf({ broker: rows[0].broker }),
+            };
+        }
+        // Lightweight provider doubles use the same post-read bound; production Prisma filters in SQL.
+        const attachment = await db.agentSecret.findFirst({
+            where: { agentId, boundName: name },
+            include: { secret: true, agent: { select: { ownerId: true } } },
+        });
+        if (!attachment)
+            return undefined;
+        const owner = attachment.agent.ownerId;
+        if (owner === null || attachment.secret.ownerId !== owner)
+            return undefined;
+        boundedString(attachment.secret.ciphertext, 256 * 1024);
+        return {
+            value: await cipher.decrypt(attachment.secret.ciphertext),
+            broker: brokerOf({ broker: attachment.secret.broker ?? null }),
+        };
+    }
     return {
+        resolve,
         async get(name) {
-            boundedString(name, 1024);
-            if (db.$queryRaw) {
-                // NULL-safe: "=" is never true when either owner is NULL.
-                const rows = await db.$queryRaw `
-          SELECT CASE WHEN octet_length(s."ciphertext") <= 262144 THEN s."ciphertext" ELSE NULL END AS "ciphertext"
-          FROM "Secret" s
-          JOIN "AgentSecret" a ON a."secretId" = s."id"
-          JOIN "Agent" g ON g."id" = a."agentId"
-          WHERE a."agentId" = ${agentId} AND a."boundName" = ${name} AND s."ownerId" = g."ownerId" LIMIT 1`;
-                if (!rows.length)
-                    return undefined;
-                if (rows[0].ciphertext === null)
-                    throw new Error("secret_value_limit");
-                return cipher.decrypt(rows[0].ciphertext);
-            }
-            // Lightweight provider doubles use the same post-read bound; production Prisma filters in SQL.
-            const attachment = await db.agentSecret.findFirst({
-                where: { agentId, boundName: name },
-                include: { secret: true, agent: { select: { ownerId: true } } },
-            });
-            if (!attachment)
-                return undefined;
-            const owner = attachment.agent.ownerId;
-            if (owner === null || attachment.secret.ownerId !== owner)
-                return undefined;
-            boundedString(attachment.secret.ciphertext, 256 * 1024);
-            return cipher.decrypt(attachment.secret.ciphertext);
+            const entry = await resolve(name);
+            if (entry?.broker)
+                throw new Error(BROKERED_GET_MESSAGE);
+            return entry?.value;
         },
     };
 }
@@ -115,5 +220,8 @@ export function scopeSecretsAccessor(accessor, allowedNames) {
                 return undefined;
             return accessor.get(name);
         },
+        ...(accessor.resolve && {
+            resolve: async (name) => (allowed.has(name) ? accessor.resolve(name) : undefined),
+        }),
     };
 }

package/dist/core/workflow-event-recorder.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Turns an emitted workflow event into outbox rows: resolves the event's work
+ * item (given, else the run's attribution, else the PR's issue link), finds
+ * the channel links that match (project links by the item's project, agent
+ * links by the event's agent), filters each link's event kinds, de-duplicates
+ * by channel, and writes one WorkflowEvent plus one NotificationDelivery per
+ * channel in a transaction. A dedupeKey that already exists is a no-op, so
+ * redeliveries and repeated finalizers record a fact once. Writes nothing
+ * when no link matches.
+ */
+import { type PrismaClient } from "#prisma";
+import { type WorkflowEventSink } from "./workflow-events.js";
+export type RecorderDb = Pick<PrismaClient, "notificationChannel" | "workflowEvent" | "notificationDelivery" | "runAttribution" | "issuePullRequest" | "$transaction">;
+export declare function createWorkflowEventRecorder(db: RecorderDb, enabledProviders: readonly string[]): WorkflowEventSink;

package/dist/core/workflow-event-recorder.js

@@ -0,0 +1,120 @@
+/**
+ * Turns an emitted workflow event into outbox rows: resolves the event's work
+ * item (given, else the run's attribution, else the PR's issue link), finds
+ * the channel links that match (project links by the item's project, agent
+ * links by the event's agent), filters each link's event kinds, de-duplicates
+ * by channel, and writes one WorkflowEvent plus one NotificationDelivery per
+ * channel in a transaction. A dedupeKey that already exists is a no-op, so
+ * redeliveries and repeated finalizers record a fact once. Writes nothing
+ * when no link matches.
+ */
+import { Prisma } from "#prisma";
+import { projectOf } from "../providers/issue-tracker/types.js";
+import { threadKeys } from "./workflow-events.js";
+async function resolveWorkItem(db, input) {
+    if (input.workItem)
+        return input.workItem;
+    if (input.runId) {
+        const attribution = await db.runAttribution.findUnique({
+            where: { runId: input.runId },
+            select: { workItem: { select: { provider: true, key: true } } },
+        });
+        if (attribution)
+            return attribution.workItem;
+    }
+    if (input.pullRequest) {
+        const pr = await db.issuePullRequest.findFirst({
+            where: {
+                codeProvider: input.pullRequest.codeProvider,
+                repository: input.pullRequest.repository,
+                number: input.pullRequest.number,
+            },
+            orderBy: { createdAt: "asc" },
+            select: { issueProvider: true, issueKey: true },
+        });
+        if (pr)
+            return { provider: pr.issueProvider, key: pr.issueKey };
+    }
+    return null;
+}
+export function createWorkflowEventRecorder(db, enabledProviders) {
+    return async (input) => {
+        if (enabledProviders.length === 0)
+            return;
+        const existing = await db.workflowEvent.findUnique({
+            where: { dedupeKey: input.dedupeKey },
+            select: { id: true },
+        });
+        if (existing)
+            return;
+        const item = await resolveWorkItem(db, input);
+        const or = [];
+        if (item)
+            or.push({ issueProvider: item.provider, projectKey: projectOf(item.key) });
+        if (input.agentId)
+            or.push({ agentId: input.agentId });
+        if (or.length === 0)
+            return;
+        const links = await db.notificationChannel.findMany({
+            where: { provider: { in: [...enabledProviders] }, OR: or },
+            select: { provider: true, channelId: true, events: true, includeCost: true },
+        });
+        const kind = input.payload.kind;
+        const byChannel = new Map();
+        for (const link of links) {
+            if (link.events.length > 0 && !link.events.includes(kind))
+                continue;
+            const key = `${link.provider}\u0000${link.channelId}`;
+            const prev = byChannel.get(key);
+            byChannel.set(key, {
+                provider: link.provider,
+                channelId: link.channelId,
+                includeCost: (prev?.includeCost ?? false) || link.includeCost,
+            });
+        }
+        if (byChannel.size === 0)
+            return;
+        const threadKey = item
+            ? threadKeys.issue(item.provider, item.key)
+            : input.pullRequest
+                ? threadKeys.pr(input.pullRequest.codeProvider, input.pullRequest.repository, input.pullRequest.number)
+                : input.runId
+                    ? threadKeys.run(input.runId)
+                    : null;
+        if (!threadKey)
+            return;
+        try {
+            await db.$transaction(async (tx) => {
+                const event = await tx.workflowEvent.create({
+                    data: {
+                        kind,
+                        dedupeKey: input.dedupeKey,
+                        runId: input.runId ?? null,
+                        agentId: input.agentId ?? null,
+                        workItemProvider: item?.provider ?? null,
+                        workItemKey: item?.key ?? null,
+                        codeProvider: input.pullRequest?.codeProvider ?? null,
+                        repository: input.pullRequest?.repository ?? null,
+                        prNumber: input.pullRequest?.number ?? null,
+                        payload: input.payload,
+                    },
+                });
+                await tx.notificationDelivery.createMany({
+                    data: [...byChannel.values()].map((c) => ({
+                        eventId: event.id,
+                        provider: c.provider,
+                        channelId: c.channelId,
+                        threadKey,
+                        includeCost: c.includeCost,
+                    })),
+                });
+            });
+        }
+        catch (err) {
+            // A concurrent recording of the same fact won the dedupeKey: nothing to do.
+            if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === "P2002")
+                return;
+            throw err;
+        }
+    };
+}