@opengeni/db 0.28.9 → 0.36.0

package/src/session-tenancy.ts

@@ -0,0 +1,188 @@
+import { createHash } from "node:crypto";
+import { sql } from "drizzle-orm";
+import {
+  rawRows,
+  type Database,
+  rlsContextForWorkspace,
+  withWorkspaceSubjectRls,
+  withWorkspaceSubjectSessionActivityRls,
+} from "./database";
+
+export type SessionTenancyVisibility = "user_private" | "workspace_shared";
+
+export type TransitionSessionVisibilityInput = {
+  workspaceId: string;
+  sessionId: string;
+  actorSubjectId: string;
+  targetVisibility: SessionTenancyVisibility;
+  expectedAuthorityEpoch: number;
+  operationKey: string;
+};
+
+export type TransitionSessionVisibilityResult = {
+  operationId: string;
+  visibility: SessionTenancyVisibility;
+  authorityEpoch: number;
+  ownerOrganizationMembershipId: string | null;
+  changed: boolean;
+  replay: boolean;
+  interruptedAttemptCount: number;
+  cancelledTurnCount: number;
+  cancelledUpdateCount: number;
+  pausedGoalCount: number;
+  revokedGrantCount: number;
+};
+
+export type ForkSessionContentInput = {
+  sourceWorkspaceId: string;
+  sourceSessionId: string;
+  actorSubjectId: string;
+  destinationWorkspaceId: string;
+  destinationVisibility: SessionTenancyVisibility;
+  operationKey: string;
+};
+
+export type ForkSessionContentResult = {
+  operationId: string;
+  sessionId: string;
+  workspaceId: string;
+  visibility: SessionTenancyVisibility;
+  authorityEpoch: number;
+  copiedHistoryItemCount: number;
+  replay: boolean;
+};
+
+export function canonicalSessionVisibilityTransitionHash(
+  input: Pick<
+    TransitionSessionVisibilityInput,
+    "sessionId" | "targetVisibility" | "expectedAuthorityEpoch"
+  >,
+): string {
+  return createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        sessionId: input.sessionId,
+        targetVisibility: input.targetVisibility,
+        expectedAuthorityEpoch: input.expectedAuthorityEpoch,
+      }),
+    )
+    .digest("hex");
+}
+
+export function canonicalSessionForkHash(
+  input: Pick<
+    ForkSessionContentInput,
+    "sourceSessionId" | "destinationWorkspaceId" | "destinationVisibility"
+  >,
+): string {
+  return createHash("sha256")
+    .update(
+      JSON.stringify({
+        version: 1,
+        sourceSessionId: input.sourceSessionId,
+        destinationWorkspaceId: input.destinationWorkspaceId,
+        destinationVisibility: input.destinationVisibility,
+      }),
+    )
+    .digest("hex");
+}
+
+export async function transitionSessionVisibility(
+  db: Database,
+  input: TransitionSessionVisibilityInput,
+): Promise<TransitionSessionVisibilityResult> {
+  if (!Number.isSafeInteger(input.expectedAuthorityEpoch) || input.expectedAuthorityEpoch < 1) {
+    throw new Error("expectedAuthorityEpoch must be a positive safe integer");
+  }
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  const requestHash = canonicalSessionVisibilityTransitionHash(input);
+  const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
+  return await withWorkspaceSubjectSessionActivityRls(
+    db,
+    input.workspaceId,
+    input.actorSubjectId,
+    async (scopedDb) => {
+      const rows = await rawRows<{
+        operationId: string;
+        visibility: SessionTenancyVisibility;
+        authorityEpoch: number;
+        ownerOrganizationMembershipId: string | null;
+        changed: boolean;
+        replay: boolean;
+        interruptedAttemptCount: number;
+        cancelledTurnCount: number;
+        cancelledUpdateCount: number;
+        pausedGoalCount: number;
+        revokedGrantCount: number;
+      }>(
+        scopedDb,
+        sql`select
+          operation_id as "operationId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          owner_organization_membership_id as "ownerOrganizationMembershipId",
+          changed,
+          replay,
+          interrupted_attempt_count as "interruptedAttemptCount",
+          cancelled_turn_count as "cancelledTurnCount",
+          cancelled_update_count as "cancelledUpdateCount",
+          paused_goal_count as "pausedGoalCount",
+          revoked_grant_count as "revokedGrantCount"
+        from transition_session_visibility(
+          ${accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.sessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.targetVisibility},
+          ${input.expectedAuthorityEpoch},
+          ${input.operationKey},
+          ${requestHash}
+        )`,
+      );
+      const result = rows[0];
+      if (!result) throw new Error("Session visibility transition returned no result");
+      return result;
+    },
+  );
+}
+
+export async function forkSessionContent(
+  db: Database,
+  input: ForkSessionContentInput,
+): Promise<ForkSessionContentResult> {
+  if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
+  const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
+  const requestHash = canonicalSessionForkHash(input);
+  return await withWorkspaceSubjectRls(
+    db,
+    input.sourceWorkspaceId,
+    input.actorSubjectId,
+    async (scopedDb) => {
+      const rows = await rawRows<ForkSessionContentResult>(
+        scopedDb,
+        sql`select
+          operation_id as "operationId",
+          session_id as "sessionId",
+          workspace_id as "workspaceId",
+          visibility,
+          authority_epoch as "authorityEpoch",
+          copied_history_item_count as "copiedHistoryItemCount",
+          replay
+        from fork_session_content(
+          ${accountId}::uuid,
+          ${input.sourceWorkspaceId}::uuid,
+          ${input.sourceSessionId}::uuid,
+          ${input.actorSubjectId},
+          ${input.destinationWorkspaceId}::uuid,
+          ${input.destinationVisibility},
+          ${input.operationKey},
+          ${requestHash}
+        )`,
+      );
+      const result = rows[0];
+      if (!result) throw new Error("Session fork returned no result");
+      return result;
+    },
+  );
+}

package/src/session-tool-call-settlement.ts

@@ -4,6 +4,7 @@ import { and, asc, eq, sql } from "drizzle-orm";
 import type { Database } from "./database";
 import { fromPostgresLosslessJson, LOSSLESS_CONTENT_CODEC_VERSION } from "./lossless-json";
 import * as schema from "./schema";
+import { cancelUnacceptedVideoGenerationsForToolCallsInTransaction } from "./video-generation";
 
 export const TOOL_RESULT_TYPE_BY_CALL_TYPE: Readonly<Record<string, string>> = {
   function_call: "function_call_result",
@@ -134,6 +135,10 @@ export async function closePendingSessionToolCallsInTransaction(
       row.resultItem === null
         ? null
         : fromPostgresLosslessJson(row.resultItem, row.resultItemCodecVersion),
+    eventOutput:
+      row.eventOutput === null
+        ? null
+        : fromPostgresLosslessJson(row.eventOutput, row.eventOutputCodecVersion),
   }));
   if (pending.length === 0) return { sequence: input.sequence, events: [], closed: 0 };
 
@@ -305,9 +310,11 @@ export async function closePendingSessionToolCallsInTransaction(
                 },
               ],
             }
-          : ((resolution.existingResult?.item ?? resolution.call.resultItem)?.output ??
-            resolution.existingResult?.item ??
-            resolution.call.resultItem),
+          : resolution.call.eventOutput !== null
+            ? resolution.call.eventOutput.value
+            : ((resolution.existingResult?.item ?? resolution.call.resultItem)?.output ??
+              resolution.existingResult?.item ??
+              resolution.call.resultItem),
         recovery: {
           interrupted: resolution.interrupted,
           outcome: resolution.interrupted ? "unknown" : "durable_result_found",
@@ -326,6 +333,14 @@ export async function closePendingSessionToolCallsInTransaction(
     eventValues.length > 0
       ? await tx.insert(schema.sessionEvents).values(eventValues).returning()
       : [];
+  await cancelUnacceptedVideoGenerationsForToolCallsInTransaction(tx, {
+    workspaceId: input.workspaceId,
+    sessionId: input.sessionId,
+    turnId: input.turnId,
+    toolCallIds: pending.map((call) => call.callId),
+    reason: input.reason,
+    now: input.now,
+  });
   await tx
     .delete(schema.sessionPendingToolCalls)
     .where(

package/src/slack-task-policy-schema.ts

@@ -0,0 +1,130 @@
+import type { SlackTaskPolicyContent } from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import {
+  bigint,
+  check,
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+export const slackTaskPolicyRevisions = pgTable(
+  "slack_task_policy_revisions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    revision: bigint("revision", { mode: "number" })
+      .notNull()
+      .default(sql`nextval('slack_task_policy_revision_seq')`),
+    policy: jsonb("policy").$type<SlackTaskPolicyContent>().notNull(),
+    policyHash: text("policy_hash").notNull(),
+    supersedesRevisionId: uuid("supersedes_revision_id"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_task_policy_revisions_workspace_operation_uq").on(
+      table.workspaceId,
+      table.operationId,
+    ),
+    workspaceRevision: uniqueIndex("slack_task_policy_revisions_workspace_revision_uq").on(
+      table.workspaceId,
+      table.revision,
+    ),
+    workspaceHistory: index("slack_task_policy_revisions_workspace_history_idx").on(
+      table.workspaceId,
+      table.revision,
+    ),
+    receipt: check(
+      "slack_task_policy_revisions_receipt_chk",
+      sql`${table.requestFingerprint} ~ '^[0-9a-f]{64}$' and ${table.policyHash} ~ '^[0-9a-f]{64}$'`,
+    ),
+  }),
+);
+
+export const slackTaskPolicyHeads = pgTable(
+  "slack_task_policy_heads",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").primaryKey(),
+    revisionId: uuid("revision_id").notNull(),
+    revision: bigint("revision", { mode: "number" }).notNull(),
+    policyHash: text("policy_hash").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    activatedAt: timestamp("activated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    account: index("slack_task_policy_heads_account_idx").on(table.accountId),
+  }),
+);
+
+export const slackTaskPolicyActivationEvents = pgTable(
+  "slack_task_policy_activation_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    oldRevisionId: uuid("old_revision_id"),
+    oldRevision: bigint("old_revision", { mode: "number" }),
+    oldPolicyHash: text("old_policy_hash"),
+    newRevisionId: uuid("new_revision_id").notNull(),
+    newRevision: bigint("new_revision", { mode: "number" }).notNull(),
+    newPolicyHash: text("new_policy_hash").notNull(),
+    actorSubjectId: text("actor_subject_id").notNull(),
+    reason: text("reason").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_task_policy_events_workspace_operation_uq").on(
+      table.workspaceId,
+      table.operationId,
+    ),
+    workspaceVersion: uniqueIndex("slack_task_policy_events_workspace_version_uq").on(
+      table.workspaceId,
+      table.activationVersion,
+    ),
+    workspaceTimeline: index("slack_task_policy_events_workspace_time_idx").on(
+      table.workspaceId,
+      table.createdAt,
+      table.id,
+    ),
+  }),
+);
+
+export const slackSharedTaskOrigins = pgTable(
+  "slack_shared_task_origins",
+  {
+    interactionId: uuid("interaction_id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    connectionId: uuid("connection_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    slackTeamId: text("slack_team_id").notNull(),
+    sourceChannelId: text("source_channel_id").notNull(),
+    sourceThreadTs: text("source_thread_ts").notNull(),
+    initiatingSlackUserId: text("initiating_slack_user_id").notNull(),
+    policyRevisionId: uuid("policy_revision_id").notNull(),
+    policyHash: text("policy_hash").notNull(),
+    policyActivationVersion: bigint("policy_activation_version", { mode: "number" }).notNull(),
+    publicationMode: text("publication_mode")
+      .$type<"never" | "approval_required" | "allow">()
+      .notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceSession: uniqueIndex("slack_shared_task_origins_workspace_session_uq").on(
+      table.workspaceId,
+      table.sessionId,
+    ),
+  }),
+);

package/src/slack-task-policy.ts

@@ -0,0 +1,341 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  SlackTaskPolicyContent,
+  canonicalizeSlackTaskPolicy,
+  type SlackTaskPolicyActivationEvent,
+  type SlackTaskPolicyHead,
+  type SlackTaskPolicyListResponse,
+  type SlackTaskPolicyMutationResponse,
+  type SlackTaskPolicyRevision,
+} from "@opengeni/contracts";
+import { and, desc, eq, sql } from "drizzle-orm";
+import type { Database } from "./database";
+import { rawRows, withRlsContext } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+import * as schema from "./schema";
+
+type RevisionRow = typeof schema.slackTaskPolicyRevisions.$inferSelect;
+type HeadRow = typeof schema.slackTaskPolicyHeads.$inferSelect;
+type EventRow = typeof schema.slackTaskPolicyActivationEvents.$inferSelect;
+type OriginRow = typeof schema.slackSharedTaskOrigins.$inferSelect;
+
+export type SlackSharedTaskOrigin = {
+  interactionId: string;
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  sessionId: string;
+  slackTeamId: string;
+  sourceChannelId: string;
+  sourceThreadTs: string;
+  initiatingSlackUserId: string;
+  policyRevisionId: string;
+  policyHash: string;
+  policyActivationVersion: number;
+  publicationMode: "never" | "approval_required" | "allow";
+  createdAt: Date;
+};
+
+export class SlackTaskPolicyConflictError extends Error {
+  readonly name = "SlackTaskPolicyConflictError";
+  readonly code = "SLACK_TASK_POLICY_CONFLICT";
+  constructor(readonly currentHead: SlackTaskPolicyHead | null) {
+    super("The active Slack task policy changed in another request");
+  }
+}
+
+export class SlackTaskPolicyOperationReuseError extends Error {
+  readonly name = "SlackTaskPolicyOperationReuseError";
+  readonly code = "SLACK_TASK_POLICY_OPERATION_REUSED";
+  constructor() {
+    super("The Slack task-policy operation id was already used for another request");
+  }
+}
+
+export class SlackTaskPolicyInvalidOperationError extends Error {
+  readonly name = "SlackTaskPolicyInvalidOperationError";
+}
+
+export class SlackTaskPolicyAuthorityError extends Error {
+  readonly name = "SlackTaskPolicyAuthorityError";
+
+  constructor(message = "Slack task-policy administration requires exact workspace authority") {
+    super(message);
+  }
+}
+
+function iso(value: Date | string): string {
+  return (value instanceof Date ? value : new Date(value)).toISOString();
+}
+
+function revisionFromRow(row: RevisionRow): SlackTaskPolicyRevision {
+  return {
+    id: row.id,
+    operationId: row.operationId,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    revision: row.revision,
+    policy: canonicalizeSlackTaskPolicy(SlackTaskPolicyContent.parse(row.policy)),
+    policyHash: row.policyHash,
+    supersedesRevisionId: row.supersedesRevisionId,
+    createdBySubjectId: row.createdBySubjectId,
+    createdAt: iso(row.createdAt),
+  };
+}
+
+function headFromRow(row: HeadRow): SlackTaskPolicyHead {
+  return {
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    revisionId: row.revisionId,
+    revision: row.revision,
+    policyHash: row.policyHash,
+    activationVersion: row.activationVersion,
+    activatedAt: iso(row.activatedAt),
+  };
+}
+
+function eventFromRow(row: EventRow): SlackTaskPolicyActivationEvent {
+  return {
+    id: row.id,
+    operationId: row.operationId,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    activationVersion: row.activationVersion,
+    oldRevision:
+      row.oldRevisionId === null
+        ? null
+        : { id: row.oldRevisionId, revision: row.oldRevision!, policyHash: row.oldPolicyHash! },
+    newRevision: {
+      id: row.newRevisionId,
+      revision: row.newRevision,
+      policyHash: row.newPolicyHash,
+    },
+    actorSubjectId: row.actorSubjectId,
+    reason: row.reason,
+    createdAt: iso(row.createdAt),
+  };
+}
+
+async function currentSlackTaskPolicyHead(
+  db: Database,
+  accountId: string,
+  workspaceId: string,
+): Promise<SlackTaskPolicyHead | null> {
+  return (await getActiveSlackTaskPolicy(db, { accountId, workspaceId }))?.head ?? null;
+}
+
+export async function getActiveSlackTaskPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string },
+): Promise<{ head: SlackTaskPolicyHead; revision: SlackTaskPolicyRevision } | null> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({
+        head: schema.slackTaskPolicyHeads,
+        revision: schema.slackTaskPolicyRevisions,
+      })
+      .from(schema.slackTaskPolicyHeads)
+      .innerJoin(
+        schema.slackTaskPolicyRevisions,
+        and(
+          eq(schema.slackTaskPolicyRevisions.id, schema.slackTaskPolicyHeads.revisionId),
+          eq(schema.slackTaskPolicyRevisions.workspaceId, schema.slackTaskPolicyHeads.workspaceId),
+        ),
+      )
+      .where(
+        and(
+          eq(schema.slackTaskPolicyHeads.accountId, input.accountId),
+          eq(schema.slackTaskPolicyHeads.workspaceId, input.workspaceId),
+        ),
+      )
+      .limit(1);
+    return row ? { head: headFromRow(row.head), revision: revisionFromRow(row.revision) } : null;
+  });
+}
+
+export async function listSlackTaskPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string; limit?: number },
+): Promise<SlackTaskPolicyListResponse> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const limit = Math.max(1, Math.min(100, input.limit ?? 50));
+    const [active, revisions, events] = await Promise.all([
+      getActiveSlackTaskPolicy(scopedDb, input),
+      scopedDb
+        .select()
+        .from(schema.slackTaskPolicyRevisions)
+        .where(eq(schema.slackTaskPolicyRevisions.workspaceId, input.workspaceId))
+        .orderBy(desc(schema.slackTaskPolicyRevisions.revision))
+        .limit(limit),
+      scopedDb
+        .select()
+        .from(schema.slackTaskPolicyActivationEvents)
+        .where(eq(schema.slackTaskPolicyActivationEvents.workspaceId, input.workspaceId))
+        .orderBy(desc(schema.slackTaskPolicyActivationEvents.activationVersion))
+        .limit(limit),
+    ]);
+    return {
+      current: active?.head ?? null,
+      activeRevision: active?.revision ?? null,
+      revisions: revisions.map(revisionFromRow),
+      activationEvents: events.map(eventFromRow),
+    };
+  });
+}
+
+export async function updateSlackTaskPolicy(
+  db: Database,
+  input: {
+    operationId?: string;
+    accountId: string;
+    workspaceId: string;
+    policy: SlackTaskPolicyContent;
+    expectedCurrentRevisionId: string | null;
+    expectedActivationVersion: number;
+    actorSubjectId: string;
+    principalKind: "human_session" | undefined;
+    reason: string;
+  },
+): Promise<SlackTaskPolicyMutationResponse> {
+  if (input.principalKind !== "human_session" || input.actorSubjectId.trim().length === 0) {
+    throw new SlackTaskPolicyAuthorityError(
+      "Slack task-policy changes require an exact authenticated human actor",
+    );
+  }
+  const operationId = input.operationId ?? randomUUID();
+  const policy = canonicalizeSlackTaskPolicy(input.policy);
+  const requestFingerprint = createHash("sha256")
+    .update(
+      JSON.stringify([
+        "slack_task_policy_operation",
+        1,
+        input.accountId,
+        input.workspaceId,
+        policy,
+        input.expectedCurrentRevisionId,
+        input.expectedActivationVersion,
+        input.actorSubjectId,
+        input.reason,
+      ]),
+      "utf8",
+    )
+    .digest("hex");
+
+  try {
+    return await withRlsContext(db, input, async (scopedDb) => {
+      await scopedDb.execute(
+        sql`select set_config('opengeni.subject_id', ${input.actorSubjectId}, true)`,
+      );
+      await scopedDb.execute(
+        sql`select set_config('opengeni.principal_kind', 'human_session', true)`,
+      );
+      const [receipt] = await rawRows<{ revisionId: string; eventId: string }>(
+        scopedDb,
+        sql`select revision_id as "revisionId", event_id as "eventId"
+            from slack_task_policy_update(
+              ${operationId}::uuid,
+              ${requestFingerprint},
+              ${input.accountId}::uuid,
+              ${input.workspaceId}::uuid,
+              ${JSON.stringify(policy)}::jsonb,
+              ${input.expectedCurrentRevisionId}::uuid,
+              ${input.expectedActivationVersion}::bigint,
+              ${input.actorSubjectId},
+              ${input.reason}
+            )`,
+      );
+      if (!receipt) throw new Error("Slack task-policy update returned no lifecycle receipt");
+      const [[revision], [head], [event]] = await Promise.all([
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyRevisions)
+          .where(eq(schema.slackTaskPolicyRevisions.id, receipt.revisionId))
+          .limit(1),
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyHeads)
+          .where(eq(schema.slackTaskPolicyHeads.workspaceId, input.workspaceId))
+          .limit(1),
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyActivationEvents)
+          .where(eq(schema.slackTaskPolicyActivationEvents.id, receipt.eventId))
+          .limit(1),
+      ]);
+      if (!revision || !head || !event) {
+        throw new Error("Slack task-policy lifecycle receipt was incomplete");
+      }
+      return {
+        revision: revisionFromRow(revision),
+        head: headFromRow(head),
+        event: eventFromRow(event),
+      };
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "P1471") throw new SlackTaskPolicyOperationReuseError();
+    if (state === "40001") {
+      throw new SlackTaskPolicyConflictError(
+        await currentSlackTaskPolicyHead(db, input.accountId, input.workspaceId),
+      );
+    }
+    if (state === "42501") {
+      throw new SlackTaskPolicyAuthorityError(error instanceof Error ? error.message : undefined);
+    }
+    if (state === "22023") throw new SlackTaskPolicyInvalidOperationError();
+    throw error;
+  }
+}
+
+function originFromRow(row: OriginRow): SlackSharedTaskOrigin {
+  return { ...row };
+}
+
+export async function saveSlackSharedTaskOrigin(
+  db: Database,
+  input: Omit<SlackSharedTaskOrigin, "createdAt">,
+): Promise<SlackSharedTaskOrigin> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [created] = await scopedDb
+      .insert(schema.slackSharedTaskOrigins)
+      .values(input)
+      .onConflictDoNothing({ target: schema.slackSharedTaskOrigins.interactionId })
+      .returning();
+    if (created) return originFromRow(created);
+    const [existing] = await scopedDb
+      .select()
+      .from(schema.slackSharedTaskOrigins)
+      .where(eq(schema.slackSharedTaskOrigins.interactionId, input.interactionId))
+      .limit(1);
+    if (!existing) throw new Error("Slack shared-task origin conflict could not be resolved");
+    for (const [key, value] of Object.entries(input)) {
+      if (existing[key as keyof OriginRow] !== value) {
+        throw new SlackTaskPolicyInvalidOperationError(
+          "Slack shared-task origin identity conflicted with immutable evidence",
+        );
+      }
+    }
+    return originFromRow(existing);
+  });
+}
+
+export async function getSlackSharedTaskOrigin(
+  db: Database,
+  input: { accountId: string; workspaceId: string; interactionId: string },
+): Promise<SlackSharedTaskOrigin | null> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select()
+      .from(schema.slackSharedTaskOrigins)
+      .where(
+        and(
+          eq(schema.slackSharedTaskOrigins.accountId, input.accountId),
+          eq(schema.slackSharedTaskOrigins.workspaceId, input.workspaceId),
+          eq(schema.slackSharedTaskOrigins.interactionId, input.interactionId),
+        ),
+      )
+      .limit(1);
+    return row ? originFromRow(row) : null;
+  });
+}