@orthacms/copilot-server 0.0.0-reserve.0

package/dist/lib/skills/http/controllers/manage-skills.controller.d.ts

@@ -0,0 +1,64 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import { SkillCatalogService, type SkillSummary } from '../../application/skill-catalog.service';
+import { SkillRepository, type SkillRecord } from '../../infrastructure/persistence/skill.repository';
+import { CreateSkillDto } from '../../application/dto/create-skill.dto';
+import { UpdateSkillDto } from '../../application/dto/update-skill.dto';
+/**
+ * Authoring skills — `GET /:id`, `POST`, `PATCH /:id`, `DELETE /:id` under
+ * `/api/copilot/skills`.
+ *
+ * **Every route here requires `copilot:skills:manage`, and that is the whole
+ * security posture of the feature.** A skill's `instructions` are prompt text
+ * that runs for every member of the workspace, so writing one is authoring part
+ * of the system prompt rather than authoring content
+ * ([ADR-0010](../../../../../../../docs/adr/0010-copilot-skills.md)). The key is
+ * admin-only in `SYSTEM_ROLES`; a contributor can use every skill and write
+ * none.
+ *
+ * `GET /:id` is here rather than beside the list route because it is the only
+ * read that carries the body, and the manage page is the only thing that needs
+ * one. `OriginGuard` on the three writes, as everywhere else that changes
+ * state.
+ *
+ * A skill that is not this workspace's is a **404, not a 403** — the repository
+ * filters on the workspace and reports "not found" either way, so an id cannot
+ * be probed for existence.
+ */
+export declare class ManageSkillsController {
+    private readonly skills;
+    private readonly catalog;
+    constructor(skills: SkillRepository, catalog: SkillCatalogService);
+    /**
+     * Every skill the manage page lists — code skills (read-only) and all of
+     * the workspace's rows, disabled ones included.
+     *
+     * A second listing route rather than a flag on the public one, because the
+     * two answer different questions and have different permissions: "what may
+     * I attach?" is `copilot:use`, "what exists here?" is an admin's view.
+     */
+    manageList(workspaceId: string): Promise<SkillSummary[]>;
+    read(id: string, workspaceId: string): Promise<SkillRecord>;
+    create(body: CreateSkillDto, user: PublicUser, workspaceId: string): Promise<SkillRecord>;
+    update(id: string, body: UpdateSkillDto, workspaceId: string): Promise<SkillRecord>;
+    /**
+     * Deletes a skill.
+     *
+     * A real delete, unlike a conversation's — a skill is configuration rather
+     * than the receipt for a change somebody's content already took, and every
+     * turn that ran with it holds its own name/title snapshot, so the
+     * transcript survives.
+     */
+    remove(id: string, workspaceId: string): Promise<void>;
+    /**
+     * Refuses a name a code skill or another row already holds.
+     *
+     * A code skill's name is refused **here**, at the write, rather than left
+     * to `mergeSkills` at read time: the merge drops the shadowed row silently,
+     * which is the right thing to do when a deploy takes a name over but a
+     * terrible thing to do to someone who has just typed one — they would see a
+     * saved skill that never runs. The unique index behind this covers the
+     * concurrent case; this covers the legible one.
+     */
+    private assertNameFree;
+}
+//# sourceMappingURL=manage-skills.controller.d.ts.map

package/dist/lib/skills/http/controllers/manage-skills.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manage-skills.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/http/controllers/manage-skills.controller.ts"],"names":[],"mappings":"AAiBA,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACH,mBAAmB,EACnB,KAAK,YAAY,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACH,eAAe,EACf,KAAK,WAAW,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAGa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,mBAAmB;IAGjD;;;;;;;OAOG;IAGG,UAAU,CACQ,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,YAAY,EAAE,CAAC;IAOpB,IAAI,CACsB,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAYjB,MAAM,CACA,IAAI,EAAE,cAAc,EACb,IAAI,EAAE,UAAU,EACX,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAmBjB,MAAM,CACoB,EAAE,EAAE,MAAM,EAC9B,IAAI,EAAE,cAAc,EACR,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAoBvB;;;;;;;OAOG;IAKG,MAAM,CACoB,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,IAAI,CAAC;IAOhB;;;;;;;;;OASG;YACW,cAAc;CAiB/B"}

package/dist/lib/skills/http/controllers/manage-skills.controller.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManageSkillsController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const skill_catalog_service_1 = require("../../application/skill-catalog.service");
+const skill_repository_1 = require("../../infrastructure/persistence/skill.repository");
+const create_skill_dto_1 = require("../../application/dto/create-skill.dto");
+const update_skill_dto_1 = require("../../application/dto/update-skill.dto");
+/**
+ * Authoring skills — `GET /:id`, `POST`, `PATCH /:id`, `DELETE /:id` under
+ * `/api/copilot/skills`.
+ *
+ * **Every route here requires `copilot:skills:manage`, and that is the whole
+ * security posture of the feature.** A skill's `instructions` are prompt text
+ * that runs for every member of the workspace, so writing one is authoring part
+ * of the system prompt rather than authoring content
+ * ([ADR-0010](../../../../../../../docs/adr/0010-copilot-skills.md)). The key is
+ * admin-only in `SYSTEM_ROLES`; a contributor can use every skill and write
+ * none.
+ *
+ * `GET /:id` is here rather than beside the list route because it is the only
+ * read that carries the body, and the manage page is the only thing that needs
+ * one. `OriginGuard` on the three writes, as everywhere else that changes
+ * state.
+ *
+ * A skill that is not this workspace's is a **404, not a 403** — the repository
+ * filters on the workspace and reports "not found" either way, so an id cannot
+ * be probed for existence.
+ */
+let ManageSkillsController = class ManageSkillsController {
+    skills;
+    catalog;
+    constructor(skills, catalog) {
+        this.skills = skills;
+        this.catalog = catalog;
+    }
+    /**
+     * Every skill the manage page lists — code skills (read-only) and all of
+     * the workspace's rows, disabled ones included.
+     *
+     * A second listing route rather than a flag on the public one, because the
+     * two answer different questions and have different permissions: "what may
+     * I attach?" is `copilot:use`, "what exists here?" is an admin's view.
+     */
+    async manageList(workspaceId) {
+        return this.catalog.manageList(workspaceId);
+    }
+    async read(id, workspaceId) {
+        const skill = await this.skills.find(id, workspaceId);
+        if (!skill) {
+            throw new common_1.NotFoundException('Skill not found.');
+        }
+        return skill;
+    }
+    async create(body, user, workspaceId) {
+        await this.assertNameFree(body.name, workspaceId);
+        return this.skills.create({
+            workspaceId,
+            name: body.name,
+            title: body.title,
+            description: body.description,
+            instructions: body.instructions,
+            mode: body.mode ?? 'manual',
+            enabled: body.enabled ?? true,
+            createdBy: user.id
+        });
+    }
+    async update(id, body, workspaceId) {
+        // An empty patch cannot mean anything, and answering 200 to it would
+        // report success for a write that never happened. The pipe cannot catch
+        // this: every property is legitimately optional on its own.
+        if (Object.keys(body).length === 0) {
+            throw new common_1.BadRequestException('Provide at least one field to change.');
+        }
+        if (body.name !== undefined) {
+            await this.assertNameFree(body.name, workspaceId, id);
+        }
+        const updated = await this.skills.update(id, workspaceId, body);
+        if (!updated) {
+            throw new common_1.NotFoundException('Skill not found.');
+        }
+        return updated;
+    }
+    /**
+     * Deletes a skill.
+     *
+     * A real delete, unlike a conversation's — a skill is configuration rather
+     * than the receipt for a change somebody's content already took, and every
+     * turn that ran with it holds its own name/title snapshot, so the
+     * transcript survives.
+     */
+    async remove(id, workspaceId) {
+        const removed = await this.skills.remove(id, workspaceId);
+        if (!removed) {
+            throw new common_1.NotFoundException('Skill not found.');
+        }
+    }
+    /**
+     * Refuses a name a code skill or another row already holds.
+     *
+     * A code skill's name is refused **here**, at the write, rather than left
+     * to `mergeSkills` at read time: the merge drops the shadowed row silently,
+     * which is the right thing to do when a deploy takes a name over but a
+     * terrible thing to do to someone who has just typed one — they would see a
+     * saved skill that never runs. The unique index behind this covers the
+     * concurrent case; this covers the legible one.
+     */
+    async assertNameFree(name, workspaceId, exceptId) {
+        const taken = await this.catalog.nameTaken(name, workspaceId, exceptId);
+        if (taken === 'code') {
+            throw new common_1.ConflictException(`"${name}" is the name of a skill defined in this deployment's configuration. Choose another name.`);
+        }
+        if (taken === 'cms') {
+            throw new common_1.ConflictException(`This workspace already has a skill named "${name}".`);
+        }
+    }
+};
+exports.ManageSkillsController = ManageSkillsController;
+tslib_1.__decorate([
+    (0, common_1.Get)('skills/manage'),
+    (0, swagger_1.ApiOperation)({ summary: 'List every skill, for the management page' }),
+    tslib_1.__param(0, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ManageSkillsController.prototype, "manageList", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('skills/:id'),
+    (0, swagger_1.ApiOperation)({ summary: 'Read one skill, including its instructions' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'No such skill here.' }),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ManageSkillsController.prototype, "read", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('skills'),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Create a skill in this workspace' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'The name is already taken.' }),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [create_skill_dto_1.CreateSkillDto, Object, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ManageSkillsController.prototype, "create", null);
+tslib_1.__decorate([
+    (0, common_1.Patch)('skills/:id'),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Edit a skill' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'The new name is already taken.' }),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, update_skill_dto_1.UpdateSkillDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ManageSkillsController.prototype, "update", null);
+tslib_1.__decorate([
+    (0, common_1.Delete)('skills/:id'),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete a skill' }),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ManageSkillsController.prototype, "remove", null);
+exports.ManageSkillsController = ManageSkillsController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.COPILOT_SKILLS_MANAGE),
+    (0, common_1.Controller)('copilot'),
+    tslib_1.__metadata("design:paramtypes", [skill_repository_1.SkillRepository,
+        skill_catalog_service_1.SkillCatalogService])
+], ManageSkillsController);

package/dist/lib/skills/infrastructure/persistence/skill.repository.d.ts

@@ -0,0 +1,78 @@
+import { type Database } from '@orthacms/database';
+import type { Skill, SkillMode } from '@orthacms/copilot-domain';
+/** A CMS skill as the manage page reads it — the row, plus its provenance. */
+export interface SkillRecord extends Skill {
+    /** Row id. What the write routes address. */
+    id: string;
+    /** Whether it is on offer. */
+    enabled: boolean;
+    /** Who wrote it, when the account still exists. */
+    createdBy: string | null;
+    /** Row creation timestamp. */
+    createdAt: Date;
+    /** Last edit. */
+    updatedAt: Date;
+}
+/** The fields a create accepts. */
+export interface CreateSkillInput {
+    workspaceId: string;
+    name: string;
+    title: string;
+    description: string;
+    instructions: string;
+    mode: SkillMode;
+    enabled: boolean;
+    createdBy: string;
+}
+/** The fields an update accepts — all optional, none of them the workspace. */
+export interface UpdateSkillInput {
+    name?: string;
+    title?: string;
+    description?: string;
+    instructions?: string;
+    mode?: SkillMode;
+    enabled?: boolean;
+}
+/**
+ * Reads and writes CMS-authored skills.
+ *
+ * **Every method takes `workspaceId` and filters on it.** `WorkspaceGuard`
+ * proves the caller belongs to the workspace they named in the header; nothing
+ * upstream proves a *skill id* belongs to that workspace, so a valid session in
+ * workspace A could otherwise edit workspace B's instructions by id. Same rule,
+ * and same reason, as `ConversationRepository`.
+ */
+export declare class SkillRepository {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * The workspace's skills, oldest first.
+     *
+     * `enabled` selects one of two **disjoint** sets when passed, rather than
+     * widening the result: the run catalogue wants only the live ones and the
+     * manage page wants everything, and a caller that meant "only live" would
+     * otherwise silently offer a skill someone deliberately switched off.
+     */
+    list(workspaceId: string, enabled?: boolean): Promise<SkillRecord[]>;
+    /**
+     * One skill, or `null` when the id is not this workspace's. Null rather
+     * than a throw for "not yours" as well as "no such id" — the two are
+     * indistinguishable to a caller, so an id cannot be probed for existence.
+     */
+    find(id: string, workspaceId: string): Promise<SkillRecord | null>;
+    /** Whether the workspace already has a skill under this name. */
+    findByName(name: string, workspaceId: string): Promise<SkillRecord | null>;
+    /** Writes a new skill. */
+    create(input: CreateSkillInput): Promise<SkillRecord>;
+    /**
+     * Applies a patch, returning the updated row — or `null` when the id is not
+     * this workspace's.
+     *
+     * The ownership predicate is part of the `UPDATE` rather than a read
+     * beforehand, so there is no check-then-write window.
+     */
+    update(id: string, workspaceId: string, patch: UpdateSkillInput): Promise<SkillRecord | null>;
+    /** Deletes a skill. `false` when the id is not this workspace's. */
+    remove(id: string, workspaceId: string): Promise<boolean>;
+}
+//# sourceMappingURL=skill.repository.d.ts.map

package/dist/lib/skills/infrastructure/persistence/skill.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.repository.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/infrastructure/persistence/skill.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAGjE,8EAA8E;AAC9E,MAAM,WAAW,WAAY,SAAQ,KAAK;IACtC,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8BAA8B;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBACa,eAAe;IACM,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;;;OAOG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAgB1E;;;;OAIG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAcxE,iEAAiE;IAC3D,UAAU,CACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,0BAA0B;IACpB,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3D;;;;;;OAMG;IACG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAc9B,oEAAoE;IAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE"}

package/dist/lib/skills/infrastructure/persistence/skill.repository.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillRepository = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const skills_1 = require("../schema/skills");
+/**
+ * Reads and writes CMS-authored skills.
+ *
+ * **Every method takes `workspaceId` and filters on it.** `WorkspaceGuard`
+ * proves the caller belongs to the workspace they named in the header; nothing
+ * upstream proves a *skill id* belongs to that workspace, so a valid session in
+ * workspace A could otherwise edit workspace B's instructions by id. Same rule,
+ * and same reason, as `ConversationRepository`.
+ */
+let SkillRepository = class SkillRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * The workspace's skills, oldest first.
+     *
+     * `enabled` selects one of two **disjoint** sets when passed, rather than
+     * widening the result: the run catalogue wants only the live ones and the
+     * manage page wants everything, and a caller that meant "only live" would
+     * otherwise silently offer a skill someone deliberately switched off.
+     */
+    async list(workspaceId, enabled) {
+        const rows = await this.db
+            .select()
+            .from(skills_1.copilotSkills)
+            .where(enabled === undefined
+            ? (0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId)
+            : (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId), (0, drizzle_orm_1.eq)(skills_1.copilotSkills.enabled, enabled)))
+            .orderBy((0, drizzle_orm_1.asc)(skills_1.copilotSkills.createdAt));
+        return rows.map(toRecord);
+    }
+    /**
+     * One skill, or `null` when the id is not this workspace's. Null rather
+     * than a throw for "not yours" as well as "no such id" — the two are
+     * indistinguishable to a caller, so an id cannot be probed for existence.
+     */
+    async find(id, workspaceId) {
+        const [row] = await this.db
+            .select()
+            .from(skills_1.copilotSkills)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(skills_1.copilotSkills.id, id), (0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId)))
+            .limit(1);
+        return row ? toRecord(row) : null;
+    }
+    /** Whether the workspace already has a skill under this name. */
+    async findByName(name, workspaceId) {
+        const [row] = await this.db
+            .select()
+            .from(skills_1.copilotSkills)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(skills_1.copilotSkills.name, name), (0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId)))
+            .limit(1);
+        return row ? toRecord(row) : null;
+    }
+    /** Writes a new skill. */
+    async create(input) {
+        const [row] = await this.db
+            .insert(skills_1.copilotSkills)
+            .values(input)
+            .returning();
+        return toRecord(row);
+    }
+    /**
+     * Applies a patch, returning the updated row — or `null` when the id is not
+     * this workspace's.
+     *
+     * The ownership predicate is part of the `UPDATE` rather than a read
+     * beforehand, so there is no check-then-write window.
+     */
+    async update(id, workspaceId, patch) {
+        const [row] = await this.db
+            .update(skills_1.copilotSkills)
+            .set({ ...patch, updatedAt: new Date() })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(skills_1.copilotSkills.id, id), (0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId)))
+            .returning();
+        return row ? toRecord(row) : null;
+    }
+    /** Deletes a skill. `false` when the id is not this workspace's. */
+    async remove(id, workspaceId) {
+        const rows = await this.db
+            .delete(skills_1.copilotSkills)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(skills_1.copilotSkills.id, id), (0, drizzle_orm_1.eq)(skills_1.copilotSkills.workspaceId, workspaceId)))
+            .returning({ id: skills_1.copilotSkills.id });
+        return rows.length > 0;
+    }
+};
+exports.SkillRepository = SkillRepository;
+exports.SkillRepository = SkillRepository = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], SkillRepository);
+/** The row, with `source` stamped — a database row is always a CMS skill. */
+function toRecord(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        title: row.title,
+        description: row.description,
+        instructions: row.instructions,
+        mode: row.mode,
+        enabled: row.enabled,
+        source: 'cms',
+        createdBy: row.createdBy,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}

package/dist/lib/skills/infrastructure/schema/index.d.ts

@@ -0,0 +1,2 @@
+export { copilotSkills, copilotSkillMode } from './skills';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/skills/infrastructure/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/skills/infrastructure/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC"}

package/dist/lib/skills/infrastructure/schema/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copilotSkillMode = exports.copilotSkills = void 0;
+var skills_1 = require("./skills");
+Object.defineProperty(exports, "copilotSkills", { enumerable: true, get: function () { return skills_1.copilotSkills; } });
+Object.defineProperty(exports, "copilotSkillMode", { enumerable: true, get: function () { return skills_1.copilotSkillMode; } });