@opengeni/core 0.28.1 → 2.1.0-canary.0

package/src/domain/github-repository-bindings.ts

@@ -0,0 +1,295 @@
+import type { RepositoryResourceRef, ResourceRef } from "@opengeni/contracts";
+import {
+  hasAuditableGitHubInstallationAuthority,
+  listGitHubInstallationAccessForWorkspace,
+  type Database,
+} from "@opengeni/db";
+
+/**
+ * GitHub App repository-binding resolution for bare repository resources.
+ *
+ * A repository resource that names a GitHub repository by URI alone (no
+ * `githubInstallationId`/`githubRepositoryId`) never mints an installation
+ * token, so the sandbox clones it anonymously and cannot push or use `gh`.
+ * The workspace allowlist (`github_installation_repositories`) stores only
+ * numeric repository ids, so resolving a URI needs the installation's owner
+ * login from the durable binding plus one provider read for the repository id.
+ * This module owns the pure parts: URI parsing, candidate selection under the
+ * workspace's auditable bindings, and the exactly-one-match stamping rule. The
+ * provider read is injected so the worker can supply the live GitHub lookup
+ * while tests stay deterministic.
+ */
+
+export type GitHubRepositoryCoordinates = { owner: string; name: string };
+
+const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/u;
+const GITHUB_NAME_PATTERN = /^[A-Za-z0-9._-]+$/u;
+const GITHUB_HOSTS = new Set(["github.com", "www.github.com"]);
+const GITHUB_SCP_LIKE_PATTERN = /^git@(?:www\.)?github\.com:(.+)$/iu;
+
+function coordinatesFromPath(path: string): GitHubRepositoryCoordinates | null {
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length !== 2) return null;
+  const owner = segments[0]!;
+  const name = segments[1]!.replace(/\.git$/u, "");
+  if (!GITHUB_OWNER_PATTERN.test(owner) || !name || !GITHUB_NAME_PATTERN.test(name)) {
+    return null;
+  }
+  return { owner, name };
+}
+
+/**
+ * Parse a GitHub repository reference into owner/name, else null. Accepts
+ * `https://github.com/<owner>/<repo>[.git][/]`, `www.github.com`,
+ * `ssh://git@github.com/<owner>/<repo>[.git]`, and the scp-like
+ * `git@github.com:<owner>/<repo>[.git]`.
+ */
+export function parseGitHubRepositoryCoordinates(uri: string): GitHubRepositoryCoordinates | null {
+  const trimmed = uri.trim();
+  const scpLike = GITHUB_SCP_LIKE_PATTERN.exec(trimmed);
+  if (scpLike) {
+    return coordinatesFromPath(scpLike[1]!);
+  }
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (!GITHUB_HOSTS.has(url.hostname.toLowerCase()) || url.search || url.hash) {
+    return null;
+  }
+  if (url.protocol === "https:" || url.protocol === "http:") {
+    if (url.username || url.password) return null;
+  } else if (url.protocol === "ssh:") {
+    if (url.password || (url.username && url.username !== "git")) return null;
+  } else {
+    return null;
+  }
+  return coordinatesFromPath(url.pathname);
+}
+
+export type UnboundGitHubRepositoryResource = {
+  resource: RepositoryResourceRef;
+  owner: string;
+  name: string;
+};
+
+/**
+ * Repository resources that name a github.com repository without any
+ * platform identity: no GitHub App ids, no credential binding, no personal
+ * connection, and either the explicit `github` provider or no provider at all.
+ * Resources that already carry ids, legacy provider ids, a binding, or a
+ * connection are someone else's authority and are never rewritten here.
+ */
+export function unboundGitHubRepositoryResources(
+  resources: readonly ResourceRef[],
+): UnboundGitHubRepositoryResource[] {
+  const out: UnboundGitHubRepositoryResource[] = [];
+  for (const resource of resources) {
+    if (resource.kind !== "repository") continue;
+    if (resource.provider !== undefined && resource.provider !== "github") continue;
+    if (
+      resource.githubInstallationId !== undefined ||
+      resource.githubRepositoryId !== undefined ||
+      resource.installationId !== undefined ||
+      resource.repositoryId !== undefined ||
+      resource.credentialBindingId !== undefined ||
+      resource.connectionId !== undefined ||
+      resource.connectionType !== undefined
+    ) {
+      continue;
+    }
+    const coordinates = parseGitHubRepositoryCoordinates(resource.uri);
+    if (!coordinates) continue;
+    out.push({ resource, ...coordinates });
+  }
+  return out;
+}
+
+export type GitHubRepositoryBindingCandidate = {
+  installationId: number;
+  accountLogin: string;
+  repositoryIds: number[];
+};
+
+/**
+ * The workspace's auditable GitHub App bindings, under workspace RLS. Only
+ * bindings that could authorize a token mint are candidates; legacy
+ * `unverified` rows never resolve a URI.
+ */
+export async function listGitHubRepositoryBindingCandidates(
+  db: Database,
+  workspaceId: string,
+): Promise<GitHubRepositoryBindingCandidate[]> {
+  const installations = await listGitHubInstallationAccessForWorkspace(db, workspaceId);
+  return installations
+    .filter((installation) => hasAuditableGitHubInstallationAuthority(installation))
+    .map((installation) => ({
+      installationId: installation.installationId,
+      accountLogin: installation.accountLogin ?? "",
+      repositoryIds: [...installation.repositoryIds],
+    }))
+    .filter((candidate) => candidate.accountLogin.length > 0);
+}
+
+export type GitHubRepositoryBindingLookup = (input: {
+  installationId: number;
+  owner: string;
+  name: string;
+}) => Promise<{ id: number } | null>;
+
+export type GitHubRepositoryBinding = { installationId: number; repositoryId: number };
+
+export type GitHubRepositoryBindingOutcome =
+  | { status: "resolved"; binding: GitHubRepositoryBinding }
+  /** No workspace binding owns this repository's account: anonymous, as before. */
+  | { status: "unbound" }
+  /** The account is bound, but no installation's allowlist holds this repository. */
+  | { status: "not_allowlisted"; installationIds: number[] }
+  /** More than one bound installation's allowlist holds this repository. */
+  | { status: "ambiguous"; installationIds: number[] }
+  /** The provider lookup failed (suspended/deleted installation, outage). */
+  | { status: "unavailable"; installationIds: number[]; message: string };
+
+export type GitHubRepositoryBindingResolution = {
+  uri: string;
+  owner: string;
+  name: string;
+  outcome: GitHubRepositoryBindingOutcome;
+};
+
+export type GitHubRepositoryBindingResolutionResult = {
+  resources: ResourceRef[];
+  bindings: Map<string, GitHubRepositoryBinding>;
+  resolutions: GitHubRepositoryBindingResolution[];
+};
+
+/**
+ * Resolve every bare github.com repository resource against the workspace's
+ * auditable bindings. A resource is stamped only when exactly one bound
+ * installation's allowlist contains the repository id GitHub reports for that
+ * URI through that installation. Every other case leaves the resource bare
+ * and reports why, so the caller can surface a warning without ever failing
+ * the turn or the session. Distinct URIs resolve concurrently, as do the
+ * candidate installations of one owner.
+ */
+export async function resolveGitHubRepositoryBindings(input: {
+  resources: readonly ResourceRef[];
+  candidates: readonly GitHubRepositoryBindingCandidate[];
+  lookup: GitHubRepositoryBindingLookup;
+}): Promise<GitHubRepositoryBindingResolutionResult> {
+  const unbound = unboundGitHubRepositoryResources(input.resources);
+  const bindings = new Map<string, GitHubRepositoryBinding>();
+  if (unbound.length === 0) {
+    return { resources: [...input.resources], bindings, resolutions: [] };
+  }
+  const candidatesByLogin = new Map<string, GitHubRepositoryBindingCandidate[]>();
+  for (const candidate of input.candidates) {
+    const key = candidate.accountLogin.toLowerCase();
+    const list = candidatesByLogin.get(key) ?? [];
+    list.push(candidate);
+    candidatesByLogin.set(key, list);
+  }
+  const distinct = new Map<string, UnboundGitHubRepositoryResource>();
+  for (const entry of unbound) {
+    if (!distinct.has(entry.resource.uri)) distinct.set(entry.resource.uri, entry);
+  }
+  const resolutions = await Promise.all(
+    [...distinct.values()].map(async (entry) => ({
+      uri: entry.resource.uri,
+      owner: entry.owner,
+      name: entry.name,
+      outcome: await resolveOne(
+        entry,
+        candidatesByLogin.get(entry.owner.toLowerCase()) ?? [],
+        input.lookup,
+      ),
+    })),
+  );
+  for (const resolution of resolutions) {
+    if (resolution.outcome.status === "resolved") {
+      bindings.set(resolution.uri, resolution.outcome.binding);
+    }
+  }
+  return {
+    resources: applyGitHubRepositoryBindings(input.resources, bindings),
+    bindings,
+    resolutions,
+  };
+}
+
+async function resolveOne(
+  entry: UnboundGitHubRepositoryResource,
+  installations: readonly GitHubRepositoryBindingCandidate[],
+  lookup: GitHubRepositoryBindingLookup,
+): Promise<GitHubRepositoryBindingOutcome> {
+  if (installations.length === 0) {
+    return { status: "unbound" };
+  }
+  const installationIds = installations.map((installation) => installation.installationId);
+  const results = await Promise.allSettled(
+    installations.map(async (installation) => {
+      const found = await lookup({
+        installationId: installation.installationId,
+        owner: entry.owner,
+        name: entry.name,
+      });
+      return found &&
+        Number.isSafeInteger(found.id) &&
+        found.id > 0 &&
+        installation.repositoryIds.includes(found.id)
+        ? { installationId: installation.installationId, repositoryId: found.id }
+        : null;
+    }),
+  );
+  const failure = results.find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  if (failure) {
+    return {
+      status: "unavailable",
+      installationIds,
+      message: failure.reason instanceof Error ? failure.reason.message : String(failure.reason),
+    };
+  }
+  const matches = results.flatMap((result) =>
+    result.status === "fulfilled" && result.value ? [result.value] : [],
+  );
+  if (matches.length === 1) {
+    return { status: "resolved", binding: matches[0]! };
+  }
+  if (matches.length === 0) {
+    return { status: "not_allowlisted", installationIds };
+  }
+  return {
+    status: "ambiguous",
+    installationIds: matches.map((match) => match.installationId),
+  };
+}
+
+/**
+ * Stamp resolved GitHub App ids onto the matching bare resources of any
+ * resource list (turn resources and runtime resources must agree, because the
+ * credential binding id and token filename derive from the installation id).
+ */
+export function applyGitHubRepositoryBindings(
+  resources: readonly ResourceRef[],
+  bindings: ReadonlyMap<string, GitHubRepositoryBinding>,
+): ResourceRef[] {
+  if (bindings.size === 0) return [...resources];
+  const stampable = new Set(
+    unboundGitHubRepositoryResources(resources).map((entry) => entry.resource),
+  );
+  return resources.map((resource) => {
+    if (resource.kind !== "repository" || !stampable.has(resource)) return resource;
+    const binding = bindings.get(resource.uri);
+    if (!binding) return resource;
+    return {
+      ...resource,
+      provider: "github",
+      githubInstallationId: binding.installationId,
+      githubRepositoryId: binding.repositoryId,
+    };
+  });
+}

package/src/domain/governed-learning-activation.ts

@@ -0,0 +1,44 @@
+import {
+  GovernedLearningActivationCaller,
+  ActivateGovernedLearningDecisionRequest,
+  UndoGovernedLearningActivationRequest,
+  type GovernedLearningActivationReceipt,
+  type GovernedLearningActivationUndoReceipt,
+} from "@opengeni/contracts";
+import {
+  activateGovernedLearningDecision,
+  undoGovernedLearningActivation,
+  type Database,
+} from "@opengeni/db";
+
+export function createGovernedLearningActivationController(options: {
+  db: Database;
+  activate?: typeof activateGovernedLearningDecision;
+  undo?: typeof undoGovernedLearningActivation;
+}): {
+  activate(input: {
+    caller: unknown;
+    request: unknown;
+  }): Promise<GovernedLearningActivationReceipt>;
+  undo(input: {
+    caller: unknown;
+    request: unknown;
+  }): Promise<GovernedLearningActivationUndoReceipt>;
+} {
+  const activate = options.activate ?? activateGovernedLearningDecision;
+  const undo = options.undo ?? undoGovernedLearningActivation;
+  return {
+    async activate(input) {
+      return await activate(options.db, {
+        caller: GovernedLearningActivationCaller.parse(input.caller),
+        request: ActivateGovernedLearningDecisionRequest.parse(input.request),
+      });
+    },
+    async undo(input) {
+      return await undo(options.db, {
+        caller: GovernedLearningActivationCaller.parse(input.caller),
+        request: UndoGovernedLearningActivationRequest.parse(input.request),
+      });
+    },
+  };
+}

package/src/domain/governed-learning-evaluator.ts

@@ -0,0 +1,49 @@
+import {
+  GOVERNED_LEARNING_AUTOMATIC_CONFIDENCE_FLOOR_BPS,
+  GovernedLearningDecision,
+  GovernedLearningDecisionFacts,
+  type GovernedLearningDecision as GovernedLearningDecisionType,
+  type GovernedLearningDecisionFacts as GovernedLearningDecisionFactsType,
+  type GovernedLearningDecisionReason,
+} from "@opengeni/contracts";
+
+/**
+ * Pure, closed evaluator mirrored by the 0268 database authority. It never
+ * receives source content and cannot activate a destination authority.
+ */
+export function deriveGovernedLearningDecision(
+  input: GovernedLearningDecisionFactsType,
+): GovernedLearningDecisionType {
+  const facts = GovernedLearningDecisionFacts.parse(input);
+  const reasons: GovernedLearningDecisionReason[] = [];
+
+  if (facts.effectiveMode === "off") reasons.push("policy_off");
+  if (facts.revoked) reasons.push("evidence_revoked");
+  if (facts.stale) reasons.push("proposal_stale");
+  if (facts.conflictCount > 0) reasons.push("evidence_conflict");
+  if (facts.confidenceBps < GOVERNED_LEARNING_AUTOMATIC_CONFIDENCE_FLOOR_BPS) {
+    reasons.push("confidence_below_floor");
+  }
+  if (facts.effectiveMode === "suggest") reasons.push("policy_suggest");
+  if (facts.effectiveMode === "automatic") reasons.push("policy_automatic");
+
+  const outcome =
+    facts.effectiveMode === "off"
+      ? "off"
+      : facts.revoked
+        ? "revoked"
+        : facts.stale
+          ? "stale"
+          : facts.conflictCount > 0
+            ? "conflict"
+            : facts.confidenceBps < GOVERNED_LEARNING_AUTOMATIC_CONFIDENCE_FLOOR_BPS
+              ? "confidence"
+              : facts.effectiveMode;
+
+  return GovernedLearningDecision.parse({
+    outcome,
+    reasons,
+    automaticEligible: outcome === "automatic",
+    confidenceFloorBps: GOVERNED_LEARNING_AUTOMATIC_CONFIDENCE_FLOOR_BPS,
+  });
+}

package/src/domain/governed-learning-slack-publication.ts

@@ -0,0 +1,157 @@
+import type {
+  GovernedLearningActivationReceipt,
+  GovernedLearningActivationUndoReceipt,
+} from "@opengeni/contracts";
+import {
+  enqueueMemorySlackPublication,
+  getCurrentMemorySlackPublicationConfiguration,
+  resolveGovernedLearningEvidenceOrigin,
+  type Database,
+  type EnqueueMemorySlackPublicationResult,
+  type GovernedLearningEvidenceOrigin,
+} from "@opengeni/db";
+
+/**
+ * Narrow post-persistence notification port for governed-learning activation
+ * and undo receipts (migration 0269). The evaluator/controller own policy,
+ * authority, and the immutable receipts; this adapter only projects bounded,
+ * content-free facts into the existing Slack publication outbox. It never
+ * reads proposal content, evidence bytes, or destination bodies.
+ */
+export type GovernedLearningSlackEvent =
+  | {
+      kind: "activated";
+      receipt: GovernedLearningActivationReceipt;
+      sessionId: string | null;
+      attemptId: string | null;
+    }
+  | { kind: "undone"; receipt: GovernedLearningActivationUndoReceipt };
+
+export type GovernedLearningSlackPublicationResult =
+  | {
+      kind: "evidence_origin_unresolved" | "slack_derived_evidence" | "policy_quiet";
+      enqueue: null;
+    }
+  | { kind: "enqueued"; enqueue: EnqueueMemorySlackPublicationResult };
+
+export type GovernedLearningSlackProjection = {
+  summary: string;
+  outcome: "activated" | "undone";
+  destination: "instruction_policy" | "preference";
+  sourceKind: "scoped-knowledge-evidence" | "task-note" | null;
+  destinationRevisionId: string;
+  destinationVersion: number;
+  activationReceiptId: string;
+  undoReceiptId: string | null;
+  occurredAt: string;
+};
+
+const DESTINATION_LABEL: Record<"instruction_policy" | "preference", string> = {
+  instruction_policy: "workspace instruction policy",
+  preference: "workspace preference",
+};
+const SOURCE_LABEL: Record<"scoped-knowledge-evidence" | "task-note", string> = {
+  "scoped-knowledge-evidence": "workspace knowledge evidence",
+  "task-note": "a task note",
+};
+
+export function governedLearningSlackImportance(
+  event: GovernedLearningSlackEvent,
+): "major" | "normal" | "minor" {
+  if (event.kind === "undone") return "major";
+  return event.receipt.destination === "instruction_policy" ? "major" : "normal";
+}
+
+export function governedLearningSlackProjection(
+  event: GovernedLearningSlackEvent,
+): GovernedLearningSlackProjection {
+  if (event.kind === "activated") {
+    const receipt = event.receipt;
+    return {
+      summary: `Automatically activated a ${DESTINATION_LABEL[receipt.destination]} learned from ${SOURCE_LABEL[receipt.sourceKind]} (revision ${receipt.destinationNewVersion}). Undo is available through the workspace learning API.`,
+      outcome: "activated",
+      destination: receipt.destination,
+      sourceKind: receipt.sourceKind,
+      destinationRevisionId: receipt.destinationRevisionId,
+      destinationVersion: receipt.destinationNewVersion,
+      activationReceiptId: receipt.id,
+      undoReceiptId: null,
+      occurredAt: receipt.effectiveAt,
+    };
+  }
+  const receipt = event.receipt;
+  return {
+    summary: `Undid an automatic ${DESTINATION_LABEL[receipt.destination]} activation (revision ${receipt.destinationOldVersion} → ${receipt.destinationNewVersion}).`,
+    outcome: "undone",
+    destination: receipt.destination,
+    sourceKind: null,
+    destinationRevisionId: receipt.destinationActivatedRevisionId,
+    destinationVersion: receipt.destinationNewVersion,
+    activationReceiptId: receipt.activationReceiptId,
+    undoReceiptId: receipt.id,
+    occurredAt: receipt.effectiveAt,
+  };
+}
+
+/** Evidence that itself came from a Slack knowledge connector must never republish to Slack. */
+export function governedLearningEvidenceIsSlackDerived(
+  origin: GovernedLearningEvidenceOrigin,
+): boolean {
+  return origin.kind === "document" && /slack/iu.test(origin.providerKey ?? "");
+}
+
+export async function publishGovernedLearningEventToSlack(
+  db: Database,
+  event: GovernedLearningSlackEvent,
+  options: {
+    resolveEvidenceOrigin?: typeof resolveGovernedLearningEvidenceOrigin;
+    configuration?: typeof getCurrentMemorySlackPublicationConfiguration;
+    enqueue?: typeof enqueueMemorySlackPublication;
+  } = {},
+): Promise<GovernedLearningSlackPublicationResult> {
+  const workspaceId = event.receipt.workspaceId;
+  if (event.kind === "activated") {
+    // Loop prevention: evidence that came from a Slack knowledge connector
+    // must not be republished to Slack. Task-note evidence is always local.
+    const origin = await (options.resolveEvidenceOrigin ?? resolveGovernedLearningEvidenceOrigin)(
+      db,
+      { workspaceId, evidenceId: event.receipt.evidenceId },
+    );
+    if (!origin) return { kind: "evidence_origin_unresolved", enqueue: null };
+    if (governedLearningEvidenceIsSlackDerived(origin)) {
+      return { kind: "slack_derived_evidence", enqueue: null };
+    }
+  }
+  const importance = governedLearningSlackImportance(event);
+  const configuration = await (
+    options.configuration ?? getCurrentMemorySlackPublicationConfiguration
+  )(db, workspaceId);
+  const deliveryMode = configuration?.autoImportances.includes(importance)
+    ? "auto"
+    : configuration?.reviewImportances.includes(importance)
+      ? "review"
+      : null;
+  if (!configuration?.enabled || !deliveryMode) return { kind: "policy_quiet", enqueue: null };
+
+  const projection = governedLearningSlackProjection(event);
+  const receipt = event.receipt;
+  const enqueue = await (options.enqueue ?? enqueueMemorySlackPublication)(db, {
+    accountId: receipt.accountId,
+    workspaceId,
+    sourceType: "durable_learning",
+    sourceId: receipt.id,
+    sourceVersion: String(projection.destinationVersion),
+    sourceIdempotencyKey: `governed-learning:${event.kind}:${receipt.id}`,
+    projection: { ...projection },
+    importance,
+    deliveryMode,
+    actor: {
+      kind: "service",
+      subjectId: receipt.serviceActorSubjectId,
+      initiatingHumanSubjectId: receipt.initiatingHumanSubjectId,
+      sessionId: event.kind === "activated" ? event.sessionId : null,
+      attemptId: event.kind === "activated" ? event.attemptId : null,
+    },
+  });
+  return { kind: "enqueued", enqueue };
+}

package/src/domain/insights.ts

@@ -8,6 +8,7 @@ import {
   aggregateModelCallFacts,
   aggregateModelCallFactsByDay,
   aggregateModelCallFactsByHour,
+  aggregateModelContextContributions,
   aggregateRootSessionDrivers,
   aggregateScheduleFacts,
   aggregateSessionDepth,
@@ -212,6 +213,7 @@ export async function getWorkspaceInsights(
     agentRunsUsed,
     facets,
     recentCalls,
+    promptContributions,
   ] = await Promise.all([
     sumUsageQuantityInRange(db, {
       workspaceId: input.workspaceId,
@@ -315,6 +317,12 @@ export async function getWorkspaceInsights(
       ...filter,
       limit: 50,
     }),
+    aggregateModelContextContributions(db, {
+      workspaceId: input.workspaceId,
+      since: window.since,
+      until: window.until,
+      ...filter,
+    }),
   ]);
 
   const [priorRootDrivers, attached, fireCounts] = await Promise.all([
@@ -539,6 +547,7 @@ export async function getWorkspaceInsights(
           : microsToUsd(row.estimatedProviderCostMicros),
       pricingSource: pricingSourceOf(row.pricingSource),
     })),
+    promptContributions,
     warmSeconds,
     priorWarmSeconds,
     warmGroups: warmGroups.map((group) => ({

package/src/domain/memory-slack-delivery.ts

@@ -1,13 +1,10 @@
 import type { MemorySlackPublicationDistribution } from "@opengeni/contracts";
 import {
-  correctWorkspaceMemory,
   enqueueMemorySlackPublication,
   getCurrentMemorySlackPublicationConfiguration,
   getWorkspaceMemorySlackPublicationSnapshot,
   saveWorkspaceMemory,
   withWorkspaceRls,
-  type CorrectWorkspaceMemoryInput,
-  type CorrectWorkspaceMemoryResult,
   type Database,
   type EnqueueMemorySlackPublicationResult,
   type MemoryEmbedder,
@@ -49,33 +46,6 @@ export async function saveWorkspaceMemoryWithSlackPublication(
   });
 }
 
-export async function correctWorkspaceMemoryWithSlackPublication(
-  db: Database,
-  input: CorrectWorkspaceMemoryInput,
-  publication: MemorySlackPublicationCommitRequest | null,
-  embedder?: MemoryEmbedder,
-): Promise<
-  CorrectWorkspaceMemoryResult & { slackPublication: MemorySlackPublicationCommitResult }
-> {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const result = await correctWorkspaceMemory(scopedDb, input, embedder);
-    if (!publication || result.action !== "superseded" || !result.replacement) {
-      return { ...result, slackPublication: { decision: null, enqueue: null } };
-    }
-    const replacement = await requiredSnapshot(scopedDb, input.workspaceId, result.replacement.id);
-    const slackPublication = await evaluateAndEnqueue(scopedDb, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      snapshot: replacement,
-      changeKind: "corrected",
-      relatedMemoryId: result.memory.id,
-      occurredAt: result.replacement.updatedAt,
-      publication,
-    });
-    return { ...result, slackPublication };
-  });
-}
-
 async function publishSavedMemoryMutation(
   db: Database,
   input: SaveWorkspaceMemoryInput,

package/src/domain/organization-membership-lifecycle.ts

@@ -0,0 +1,9 @@
+export function organizationMembershipHttpStatus(
+  sqlState: string | null,
+): 400 | 403 | 404 | 409 | null {
+  if (sqlState === "22023" || sqlState === "23514") return 400;
+  if (sqlState === "42501") return 403;
+  if (sqlState === "P0002") return 404;
+  if (sqlState === "23505" || sqlState === "40001" || sqlState === "55000") return 409;
+  return null;
+}