@orthacms/copilot-server 0.0.0-reserve.0

package/dist/lib/chat/infrastructure/schema/proposals.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copilotProposals = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+const conversations_1 = require("./conversations");
+const external_refs_1 = require("./external-refs");
+/**
+ * **The accept boundary** — one row per change the copilot proposed
+ * ([ADR-0005](../../../../../../docs/adr/0005-copilot-authority-model.md) §5).
+ *
+ * Every mutating tool writes here first and a human decides; a workspace that
+ * opted a tool into auto-apply still gets the row, accepted in the same breath.
+ * That is what makes a direct apply "undoable, never invisible" rather than a
+ * write with no paper trail — the row records what was proposed, by which run,
+ * on whose behalf, and who decided.
+ *
+ * `target` and `patch` are opaque jsonb on purpose: their shape belongs to the
+ * applier that declared the `kind`, and teaching this table about content
+ * entries would make the copilot the thing that changes when content does.
+ */
+exports.copilotProposals = (0, pg_core_1.pgTable)('copilot_proposals', {
+    /** Primary key. */
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    /** The thread the proposal was made in. */
+    conversationId: (0, pg_core_1.uuid)('conversation_id')
+        .notNull()
+        .references(() => conversations_1.copilotConversations.id, { onDelete: 'cascade' }),
+    /** The run that produced it — provenance on the eventual effect. */
+    runId: (0, pg_core_1.uuid)('run_id').notNull(),
+    /**
+     * The provider-assigned tool-call id, so a proposal joins to its row in
+     * `copilot_tool_calls` and the UI can attach the card to the step that
+     * produced it.
+     */
+    toolCallId: (0, pg_core_1.text)('tool_call_id').notNull(),
+    /**
+     * The tool that proposed it. Load-bearing rather than descriptive:
+     * accepting re-resolves the capability profile and requires this tool to
+     * still be offered to the accepting user, so "you may accept what you
+     * could have proposed" needs no second permission model.
+     */
+    toolName: (0, pg_core_1.text)('tool_name').notNull(),
+    /** Which applier carries it out, e.g. `content.entry.update`. */
+    kind: (0, pg_core_1.text)('kind').notNull(),
+    /** The workspace it belongs to. */
+    workspaceId: (0, pg_core_1.uuid)('workspace_id')
+        .notNull()
+        .references(() => external_refs_1.workspaces.id, { onDelete: 'cascade' }),
+    /** The user the run acted as — never a copilot identity. */
+    createdBy: (0, pg_core_1.uuid)('created_by')
+        .notNull()
+        .references(() => external_refs_1.users.id, { onDelete: 'cascade' }),
+    /** Where the change lands; shape owned by the applier. */
+    target: (0, pg_core_1.jsonb)('target').notNull(),
+    /** The change itself; shape owned by the applier's use-case. */
+    patch: (0, pg_core_1.jsonb)('patch').notNull(),
+    /** One line naming the change — the card's title. */
+    summary: (0, pg_core_1.text)('summary').notNull(),
+    /** Per-field before/after for the review diff, when field-shaped. */
+    changes: (0, pg_core_1.jsonb)('changes'),
+    /** `pending` | `accepted` | `rejected`. */
+    status: (0, pg_core_1.text)('status').notNull().default('pending'),
+    /** Who decided. Null while pending. */
+    decidedBy: (0, pg_core_1.uuid)('decided_by').references(() => external_refs_1.users.id, {
+        onDelete: 'set null'
+    }),
+    /** When they decided. Null while pending. */
+    decidedAt: (0, pg_core_1.timestamp)('decided_at', { withTimezone: true }),
+    /** What the applier reported — the entity id and any detail. */
+    result: (0, pg_core_1.jsonb)('result'),
+    /**
+     * Why the last accept failed, when one did. The proposal stays
+     * `pending`, so a transient failure is retryable and a permanent one is
+     * legible — rather than stranding the row in a fourth state nobody
+     * clears.
+     */
+    error: (0, pg_core_1.text)('error'),
+    /** Row creation timestamp. */
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true })
+        .notNull()
+        .defaultNow()
+}, (table) => [
+    // "What is waiting for me in this workspace?" — the review queue.
+    (0, pg_core_1.index)('copilot_proposals_workspace_idx').on(table.workspaceId, table.status, table.createdAt),
+    // "What did this run propose?" — the transcript's card lookup.
+    (0, pg_core_1.index)('copilot_proposals_run_idx').on(table.runId)
+]);

package/dist/lib/chat/infrastructure/schema/tool-calls.d.ts

@@ -0,0 +1,203 @@
+/**
+ * What actually touched data — **the security-review surface**
+ * ([ADR-0005](../../../../../../docs/adr/0005-copilot-authority-model.md), consequences:
+ * "Security review has one surface: `copilot_tool_calls` joined to the activity
+ * log"). One row per attempted call, written whether it succeeded, failed, or
+ * was refused by the authorize step, because a refused call is exactly the
+ * event a reviewer is looking for.
+ */
+export declare const copilotToolCalls: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "copilot_tool_calls";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        conversationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "conversation_id";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        runId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "run_id";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        callId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "call_id";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        input: import("drizzle-orm/pg-core").PgColumn<{
+            name: "input";
+            tableName: "copilot_tool_calls";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        outputSummary: import("drizzle-orm/pg-core").PgColumn<{
+            name: "output_summary";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        ok: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ok";
+            tableName: "copilot_tool_calls";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        error: import("drizzle-orm/pg-core").PgColumn<{
+            name: "error";
+            tableName: "copilot_tool_calls";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        durationMs: import("drizzle-orm/pg-core").PgColumn<{
+            name: "duration_ms";
+            tableName: "copilot_tool_calls";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "copilot_tool_calls";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=tool-calls.d.ts.map

package/dist/lib/chat/infrastructure/schema/tool-calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-calls.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/schema/tool-calls.ts"],"names":[],"mappings":"AAYA;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwC5B,CAAC"}

package/dist/lib/chat/infrastructure/schema/tool-calls.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copilotToolCalls = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+const conversations_1 = require("./conversations");
+/**
+ * What actually touched data — **the security-review surface**
+ * ([ADR-0005](../../../../../../docs/adr/0005-copilot-authority-model.md), consequences:
+ * "Security review has one surface: `copilot_tool_calls` joined to the activity
+ * log"). One row per attempted call, written whether it succeeded, failed, or
+ * was refused by the authorize step, because a refused call is exactly the
+ * event a reviewer is looking for.
+ */
+exports.copilotToolCalls = (0, pg_core_1.pgTable)('copilot_tool_calls', {
+    /** Primary key. */
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    /** The thread the call was made in. */
+    conversationId: (0, pg_core_1.uuid)('conversation_id')
+        .notNull()
+        .references(() => conversations_1.copilotConversations.id, { onDelete: 'cascade' }),
+    /** The run the call belongs to. */
+    runId: (0, pg_core_1.uuid)('run_id').notNull(),
+    /** The provider-assigned call id, as the model issued it. */
+    callId: (0, pg_core_1.text)('call_id').notNull(),
+    /** The tool's name, e.g. `admin_content_search`. */
+    name: (0, pg_core_1.text)('name').notNull(),
+    /** The arguments the model supplied. */
+    input: (0, pg_core_1.jsonb)('input'),
+    /**
+     * The result, **redacted to a summary** rather than stored whole. A
+     * search can return a page of entry bodies, and copying those into an
+     * append-only audit table would duplicate content indefinitely and
+     * spread anything sensitive in it into a second place with a different
+     * deletion story. The transcript already holds what the model saw.
+     */
+    outputSummary: (0, pg_core_1.text)('output_summary'),
+    /** Whether the call succeeded. */
+    ok: (0, pg_core_1.boolean)('ok').notNull(),
+    /** The error message, when it did not. */
+    error: (0, pg_core_1.text)('error'),
+    /** How long it took, in milliseconds. */
+    durationMs: (0, pg_core_1.integer)('duration_ms').notNull(),
+    /** Row creation timestamp. */
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true })
+        .notNull()
+        .defaultNow()
+}, (table) => [
+    // "What did this run do?" — the review query, and the UI's step list.
+    (0, pg_core_1.index)('copilot_tool_calls_run_idx').on(table.runId, table.createdAt)
+]);

package/dist/lib/copilot.module.d.ts

@@ -0,0 +1,30 @@
+import { DynamicModule } from '@nestjs/common';
+import { type ModelResolver, type SkillDefinition } from '@orthacms/copilot-domain';
+import { type ProviderRegistration } from './infrastructure/model-registry';
+import type { CopilotPluginConfig } from './types/copilot-config';
+/** Options `CopilotModule.forRoot` binds into DI. */
+export interface CopilotModuleOptions {
+    /** The model backends this deployment offers, in preference order. */
+    providers: readonly ProviderRegistration[];
+    /** Optional custom handler picking a provider per run. */
+    resolve?: ModelResolver;
+    /** Skills defined in code, available in every workspace. */
+    skills?: readonly SkillDefinition[];
+    /** Host config (kill switch + output ceiling + run limits). */
+    config: CopilotPluginConfig;
+}
+/**
+ * NestJS module for the copilot plugin. Registered globally, like every other
+ * plugin module here, so a tool-binding plugin can inject
+ * {@link CopilotToolRegistry} without an explicit import.
+ *
+ * Phase 1 adds the chat vertical slice on top of phase 0's model seam: the SSE
+ * run route, the bounded run engine, the capability profile, and conversation
+ * persistence. The tools themselves are bound by the plugins that own the logic
+ * they wrap, never by this module.
+ */
+export declare class CopilotModule {
+    /** Creates the global dynamic module around a validated config. */
+    static forRoot(options: CopilotModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=copilot.module.d.ts.map

package/dist/lib/copilot.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot.module.d.ts","sourceRoot":"","sources":["../../src/lib/copilot.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAIH,KAAK,aAAa,EAClB,KAAK,eAAe,EACvB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAEH,KAAK,oBAAoB,EAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAqBlE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACjC,sEAAsE;IACtE,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC3C,0DAA0D;IAC1D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,qBACa,aAAa;IACtB,mEAAmE;IACnE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa;CAwG/D"}

package/dist/lib/copilot.module.js

@@ -0,0 +1,146 @@
+"use strict";
+var CopilotModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CopilotModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const copilot_domain_1 = require("@orthacms/copilot-domain");
+const database_1 = require("@orthacms/database");
+const tools_server_1 = require("@orthacms/tools-server");
+const copilot_tokens_1 = require("./copilot.tokens");
+const model_registry_1 = require("./infrastructure/model-registry");
+const capability_profile_service_1 = require("./chat/application/capability-profile.service");
+const decide_proposal_service_1 = require("./chat/application/decide-proposal.service");
+const tool_permission_broker_1 = require("./chat/application/tool-permission.broker");
+const proposal_applier_registry_1 = require("./chat/application/proposal-applier.registry");
+const content_type_summary_service_1 = require("./chat/application/content-type-summary.service");
+const run_engine_service_1 = require("./chat/application/run-engine.service");
+const conversation_repository_1 = require("./chat/infrastructure/persistence/conversation.repository");
+const proposal_repository_1 = require("./chat/infrastructure/persistence/proposal.repository");
+const create_run_controller_1 = require("./chat/http/controllers/create-run.controller");
+const get_conversation_controller_1 = require("./chat/http/controllers/get-conversation.controller");
+const list_conversations_controller_1 = require("./chat/http/controllers/list-conversations.controller");
+const list_models_controller_1 = require("./chat/http/controllers/list-models.controller");
+const proposals_controller_1 = require("./chat/http/controllers/proposals.controller");
+const tool_permission_controller_1 = require("./chat/http/controllers/tool-permission.controller");
+const update_conversation_controller_1 = require("./chat/http/controllers/update-conversation.controller");
+const skill_catalog_service_1 = require("./skills/application/skill-catalog.service");
+const skill_repository_1 = require("./skills/infrastructure/persistence/skill.repository");
+const list_skills_controller_1 = require("./skills/http/controllers/list-skills.controller");
+const manage_skills_controller_1 = require("./skills/http/controllers/manage-skills.controller");
+/**
+ * NestJS module for the copilot plugin. Registered globally, like every other
+ * plugin module here, so a tool-binding plugin can inject
+ * {@link CopilotToolRegistry} without an explicit import.
+ *
+ * Phase 1 adds the chat vertical slice on top of phase 0's model seam: the SSE
+ * run route, the bounded run engine, the capability profile, and conversation
+ * persistence. The tools themselves are bound by the plugins that own the logic
+ * they wrap, never by this module.
+ */
+let CopilotModule = CopilotModule_1 = class CopilotModule {
+    /** Creates the global dynamic module around a validated config. */
+    static forRoot(options) {
+        // No `resolve` handler means the **first registered provider** serves
+        // every run that names none. There is no separate `defaultProvider`
+        // setting to keep in sync with the list — the list *is* the setting,
+        // and its order is the preference order (`catalogue()` renders in it,
+        // and the admin's picker opens on its first entry).
+        const [first] = options.providers;
+        if (!first) {
+            throw new Error('CopilotModule requires at least one model provider — the first one registered ' +
+                'is what serves a run that names none.');
+        }
+        const resolver = options.resolve ?? (() => first.name);
+        return {
+            module: CopilotModule_1,
+            global: true,
+            // `DatabaseModule` is global, but importing it explicitly keeps
+            // this module standalone-testable.
+            // `ToolsModule` carries the shared tool registry — the same
+            // catalogue the MCP endpoint serves. Imported rather than provided
+            // so a deployment running the copilot *without* MCP still has one,
+            // and one running both has exactly one.
+            imports: [database_1.DatabaseModule, tools_server_1.ToolsModule],
+            controllers: [
+                create_run_controller_1.CreateRunController,
+                // Before `GetConversationController`: `conversations/:id` and
+                // `models` can't collide (different first segments), but keep
+                // the read routes grouped after the run route.
+                list_models_controller_1.ListModelsController,
+                list_conversations_controller_1.ListConversationsController,
+                // `PATCH conversations/:id`. No ordering hazard with the `GET`
+                // wildcard below — Express matches method and path together —
+                // but it reads with the other conversation routes.
+                update_conversation_controller_1.UpdateConversationController,
+                // Before `GetConversationController`, whose `conversations/:id`
+                // is the only wildcard here — Express matches in declaration
+                // order, so the literal-prefixed routes go first.
+                proposals_controller_1.ProposalsController,
+                // Before `GetConversationController` for the same reason as
+                // the others: its `conversations/:id` is the only wildcard, and
+                // Express matches in declaration order.
+                tool_permission_controller_1.ToolPermissionController,
+                // Both skill controllers before the conversation wildcard, for
+                // the same declaration-order reason as the rest. `skills` and
+                // `skills/:id` live in different controllers and cannot
+                // collide (different segment counts); `skills/manage` is
+                // declared above `skills/:id` inside the manage controller.
+                list_skills_controller_1.ListSkillsController,
+                manage_skills_controller_1.ManageSkillsController,
+                get_conversation_controller_1.GetConversationController
+            ],
+            providers: [
+                { provide: copilot_tokens_1.COPILOT_CONFIG, useValue: options.config },
+                {
+                    provide: copilot_domain_1.MODEL_REGISTRY,
+                    useValue: (0, model_registry_1.buildModelRegistry)(options.providers)
+                },
+                {
+                    // Always bound, empty when the host declared none: "this
+                    // deployment ships no skills" must not present as a missing
+                    // dependency.
+                    provide: copilot_tokens_1.COPILOT_SKILL_REGISTRY,
+                    useValue: (0, copilot_domain_1.buildSkillRegistry)(options.skills ?? [])
+                },
+                { provide: copilot_domain_1.MODEL_RESOLVER, useValue: resolver },
+                capability_profile_service_1.CapabilityProfileService,
+                content_type_summary_service_1.ContentTypeSummaryService,
+                conversation_repository_1.ConversationRepository,
+                proposal_repository_1.ProposalRepository,
+                proposal_applier_registry_1.ProposalApplierRegistry,
+                decide_proposal_service_1.DecideProposalService,
+                {
+                    // Constructed through a factory so the operator's
+                    // `permissionDecisionBudgetMs` reaches it — the wait for a
+                    // permission decision is an accessibility limit as much as a
+                    // resource one, and five minutes is not generous for a
+                    // screen-magnifier or switch-access user (`ORT-118`).
+                    provide: tool_permission_broker_1.ToolPermissionBroker,
+                    useFactory: () => {
+                        const broker = new tool_permission_broker_1.ToolPermissionBroker();
+                        broker.configure(options.config.permissionDecisionBudgetMs);
+                        return broker;
+                    }
+                },
+                skill_repository_1.SkillRepository,
+                skill_catalog_service_1.SkillCatalogService,
+                run_engine_service_1.RunEngine
+            ],
+            exports: [
+                copilot_tokens_1.COPILOT_CONFIG,
+                copilot_domain_1.MODEL_REGISTRY,
+                copilot_domain_1.MODEL_RESOLVER,
+                copilot_tokens_1.COPILOT_SKILL_REGISTRY,
+                // Exported so the plugins that own writes can register their
+                // proposal appliers. Tools go to the shared `ToolRegistry` in
+                // `@orthacms/tools-server`, which the MCP module provides.
+                proposal_applier_registry_1.ProposalApplierRegistry
+            ]
+        };
+    }
+};
+exports.CopilotModule = CopilotModule;
+exports.CopilotModule = CopilotModule = CopilotModule_1 = tslib_1.__decorate([
+    (0, common_1.Module)({})
+], CopilotModule);

package/dist/lib/copilot.tokens.d.ts

@@ -0,0 +1,34 @@
+/**
+ * DI tokens and their inject decorators for the copilot plugin. Kept in a
+ * dependency-free module (imports only `@nestjs/common`) so providers and
+ * services can reference them without forming an import cycle with
+ * `copilot.module.ts`.
+ *
+ * The model-provider seam's tokens (`MODEL_REGISTRY`, `MODEL_RESOLVER`) live
+ * in `@orthacms/copilot-domain` alongside the port they bind, so an adapter
+ * package never has to import the server.
+ */
+/** Injection token for the resolved copilot configuration. */
+export declare const COPILOT_CONFIG: unique symbol;
+/** Parameter decorator that injects the copilot configuration. */
+export declare const InjectCopilotConfig: () => ParameterDecorator;
+/**
+ * Optional override for the run engine's ceilings (`RunLimits`). Unbound, the
+ * engine uses `DEFAULT_RUN_LIMITS`.
+ *
+ * A token rather than a defaulted constructor parameter: Nest resolves every
+ * constructor argument positionally and does **not** honour a TypeScript
+ * default, so `limits: RunLimits = DEFAULT_RUN_LIMITS` fails boot with an
+ * unresolvable dependency at that index rather than quietly using the default.
+ */
+export declare const COPILOT_RUN_LIMITS: unique symbol;
+/**
+ * The host's code-defined skills, as a built `SkillRegistry`.
+ *
+ * Always bound (an empty registry when the host declared none) rather than
+ * optional: "this deployment ships no skills" and "the registry was not wired"
+ * would otherwise be the same missing dependency, and only one of them is a
+ * bug.
+ */
+export declare const COPILOT_SKILL_REGISTRY: unique symbol;
+//# sourceMappingURL=copilot.tokens.d.ts.map

package/dist/lib/copilot.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot.tokens.d.ts","sourceRoot":"","sources":["../../src/lib/copilot.tokens.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,8DAA8D;AAC9D,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,QAAO,kBACb,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC"}

package/dist/lib/copilot.tokens.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COPILOT_SKILL_REGISTRY = exports.COPILOT_RUN_LIMITS = exports.InjectCopilotConfig = exports.COPILOT_CONFIG = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * DI tokens and their inject decorators for the copilot plugin. Kept in a
+ * dependency-free module (imports only `@nestjs/common`) so providers and
+ * services can reference them without forming an import cycle with
+ * `copilot.module.ts`.
+ *
+ * The model-provider seam's tokens (`MODEL_REGISTRY`, `MODEL_RESOLVER`) live
+ * in `@orthacms/copilot-domain` alongside the port they bind, so an adapter
+ * package never has to import the server.
+ */
+/** Injection token for the resolved copilot configuration. */
+exports.COPILOT_CONFIG = Symbol('COPILOT_CONFIG');
+/** Parameter decorator that injects the copilot configuration. */
+const InjectCopilotConfig = () => (0, common_1.Inject)(exports.COPILOT_CONFIG);
+exports.InjectCopilotConfig = InjectCopilotConfig;
+/**
+ * Optional override for the run engine's ceilings (`RunLimits`). Unbound, the
+ * engine uses `DEFAULT_RUN_LIMITS`.
+ *
+ * A token rather than a defaulted constructor parameter: Nest resolves every
+ * constructor argument positionally and does **not** honour a TypeScript
+ * default, so `limits: RunLimits = DEFAULT_RUN_LIMITS` fails boot with an
+ * unresolvable dependency at that index rather than quietly using the default.
+ */
+exports.COPILOT_RUN_LIMITS = Symbol('COPILOT_RUN_LIMITS');
+/**
+ * The host's code-defined skills, as a built `SkillRegistry`.
+ *
+ * Always bound (an empty registry when the host declared none) rather than
+ * optional: "this deployment ships no skills" and "the registry was not wired"
+ * would otherwise be the same missing dependency, and only one of them is a
+ * bug.
+ */
+exports.COPILOT_SKILL_REGISTRY = Symbol('COPILOT_SKILL_REGISTRY');

package/dist/lib/infrastructure/model-registry.d.ts

@@ -0,0 +1,22 @@
+import { type ModelProvider, type ModelRegistry } from '@orthacms/copilot-domain';
+/** One provider the host offers, under the name runs refer to it by. */
+export interface ProviderRegistration {
+    /** Unique, operator-chosen name — `claude`, `ollama-big`, `fake`. */
+    name: string;
+    /** The adapter instance, already constructed with its own config. */
+    provider: ModelProvider;
+}
+/**
+ * Builds an immutable {@link ModelRegistry} over the host's provider list.
+ * Bound to `MODEL_REGISTRY` at the composition root; the resolver returns a
+ * name, the core looks the provider up here.
+ *
+ * Registration order is preserved, so {@link ModelRegistry.catalogue} renders
+ * in the order the operator wrote — the first entry reads as the house default.
+ *
+ * @throws When a name is blank or registered twice. A list can express both,
+ *   unlike a map, so the guard has to be explicit — and silently dropping one
+ *   of two same-named providers would route runs to a backend nobody chose.
+ */
+export declare function buildModelRegistry(registrations: readonly ProviderRegistration[]): ModelRegistry;
+//# sourceMappingURL=model-registry.d.ts.map

package/dist/lib/infrastructure/model-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/model-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,aAAa,EAClB,KAAK,aAAa,EACrB,MAAM,0BAA0B,CAAC;AAElC,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,QAAQ,EAAE,aAAa,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAC9B,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC/C,aAAa,CA+Cf"}