@orthacms/copilot-server 0.0.0-reserve.0

package/dist/lib/chat/http/sse-stream.d.ts

@@ -0,0 +1,41 @@
+import type { Response } from 'express';
+import type { CopilotRunEvent } from '@orthacms/copilot-domain';
+/**
+ * Writes a run's events to an Express response as Server-Sent Events.
+ *
+ * **Verified through the admin's Vite dev proxy** (`^/api/` → `:3000`), for
+ * both GET and POST: frames arrive one at a time with the same timing as a
+ * direct connection, so nothing here is working around a buffering proxy. The
+ * headers below still matter for whatever fronts production — `no-transform`
+ * stops a compressing proxy from buffering to gzip, and `X-Accel-Buffering: no`
+ * is nginx's opt-out.
+ */
+export declare class SseStream {
+    private readonly res;
+    private heartbeat;
+    private closed;
+    constructor(res: Response);
+    /** Sends the headers and starts the heartbeat. */
+    open(): void;
+    /**
+     * Sends one event. The event's `type` becomes the SSE event name, so a
+     * client can listen per kind, and the whole event is the JSON payload.
+     */
+    send(event: CopilotRunEvent): void;
+    /** Stops the heartbeat and ends the response. Safe to call twice. */
+    close(): void;
+    /**
+     * Aborts `controller` when the client goes away.
+     *
+     * **This hangs off the *response*, not the request** — a distinction that
+     * costs a whole afternoon if you get it wrong. Express has already consumed
+     * the request body by the time a handler runs, and a fully-consumed
+     * `IncomingMessage` emits `'close'` immediately, while the client is still
+     * connected and waiting. Wiring the abort to `req.on('close')` therefore
+     * cancels every run the instant it starts — and because `writeHead` hasn't
+     * flushed yet, it presents as a request that hangs with no response at all
+     * rather than as an error. Verified directly on Node 22.
+     */
+    onClientDisconnect(controller: AbortController): void;
+}
+//# sourceMappingURL=sse-stream.d.ts.map

package/dist/lib/chat/http/sse-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse-stream.d.ts","sourceRoot":"","sources":["../../../../src/lib/chat/http/sse-stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAShE;;;;;;;;;GASG;AACH,qBAAa,SAAS;IAIN,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,MAAM,CAAS;gBAEM,GAAG,EAAE,QAAQ;IAE1C,kDAAkD;IAClD,IAAI,IAAI,IAAI;IAsBZ;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAWlC,qEAAqE;IACrE,KAAK,IAAI,IAAI;IAYb;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,UAAU,EAAE,eAAe,GAAG,IAAI;CAUxD"}

package/dist/lib/chat/http/sse-stream.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SseStream = void 0;
+/**
+ * How often to send a comment frame while nothing else is happening. A model
+ * can think for a while before its first token, and an idle connection is
+ * exactly what an intermediary decides to reap.
+ */
+const HEARTBEAT_MS = 15_000;
+/**
+ * Writes a run's events to an Express response as Server-Sent Events.
+ *
+ * **Verified through the admin's Vite dev proxy** (`^/api/` → `:3000`), for
+ * both GET and POST: frames arrive one at a time with the same timing as a
+ * direct connection, so nothing here is working around a buffering proxy. The
+ * headers below still matter for whatever fronts production — `no-transform`
+ * stops a compressing proxy from buffering to gzip, and `X-Accel-Buffering: no`
+ * is nginx's opt-out.
+ */
+class SseStream {
+    res;
+    heartbeat = null;
+    closed = false;
+    constructor(res) {
+        this.res = res;
+    }
+    /** Sends the headers and starts the heartbeat. */
+    open() {
+        this.res.writeHead(200, {
+            'Content-Type': 'text/event-stream; charset=utf-8',
+            // `no-transform` is the load-bearing half: without it a
+            // compressing intermediary may buffer the whole body to compress it.
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive',
+            'X-Accel-Buffering': 'no'
+        });
+        // `writeHead` alone sends nothing — Node buffers until the first write.
+        // Flush a comment now so the client's `fetch` resolves and the UI can
+        // render a pending state instead of waiting on the first token.
+        this.res.write(': open\n\n');
+        this.res.flushHeaders?.();
+        this.heartbeat = setInterval(() => {
+            if (!this.closed) {
+                this.res.write(': ping\n\n');
+            }
+        }, HEARTBEAT_MS);
+    }
+    /**
+     * Sends one event. The event's `type` becomes the SSE event name, so a
+     * client can listen per kind, and the whole event is the JSON payload.
+     */
+    send(event) {
+        if (this.closed) {
+            return;
+        }
+        // JSON.stringify cannot emit a raw newline inside a string, so a single
+        // `data:` line is always well-formed — no need to split the payload.
+        this.res.write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`);
+    }
+    /** Stops the heartbeat and ends the response. Safe to call twice. */
+    close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
+        this.res.end();
+    }
+    /**
+     * Aborts `controller` when the client goes away.
+     *
+     * **This hangs off the *response*, not the request** — a distinction that
+     * costs a whole afternoon if you get it wrong. Express has already consumed
+     * the request body by the time a handler runs, and a fully-consumed
+     * `IncomingMessage` emits `'close'` immediately, while the client is still
+     * connected and waiting. Wiring the abort to `req.on('close')` therefore
+     * cancels every run the instant it starts — and because `writeHead` hasn't
+     * flushed yet, it presents as a request that hangs with no response at all
+     * rather than as an error. Verified directly on Node 22.
+     */
+    onClientDisconnect(controller) {
+        this.res.on('close', () => {
+            this.closed = true;
+            if (this.heartbeat) {
+                clearInterval(this.heartbeat);
+                this.heartbeat = null;
+            }
+            controller.abort();
+        });
+    }
+}
+exports.SseStream = SseStream;

package/dist/lib/chat/infrastructure/persistence/conversation.repository.d.ts

@@ -0,0 +1,159 @@
+import { type Database } from '@orthacms/database';
+import type { AttachmentRef, ModelContentBlock, SkillRef } from '@orthacms/copilot-domain';
+/** A thread as the list and the transcript render it. */
+export interface ConversationView {
+    id: string;
+    title: string | null;
+    surface: string;
+    archived: boolean;
+    /**
+     * The model last picked for this thread — `null` when nobody has,
+     * `'default'` for the host's resolver, else `'<provider>:<model>'`. See the
+     * column's own note for why the three states are one nullable text field.
+     */
+    modelChoice: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** One persisted turn. */
+export interface MessageView {
+    id: string;
+    runId: string;
+    role: 'user' | 'assistant';
+    content: ModelContentBlock[];
+    /** Files attached to a user turn; null on an assistant turn and when none. */
+    attachments: AttachmentRef[] | null;
+    /** Skills in force for a user turn; null on an assistant turn and when none. */
+    skills: SkillRef[] | null;
+    model: string | null;
+    provider: string | null;
+    stopReason: string | null;
+    position: number;
+    createdAt: Date;
+}
+/** What {@link ConversationRepository.recordToolCall} writes. */
+export interface ToolCallRecord {
+    conversationId: string;
+    runId: string;
+    callId: string;
+    name: string;
+    input: unknown;
+    outputSummary: string | null;
+    ok: boolean;
+    error: string | null;
+    durationMs: number;
+}
+/**
+ * Reads and writes the copilot's transcript.
+ *
+ * **Every method takes the owning `userId` and `workspaceId` and filters on
+ * both.** Not defence in depth for its own sake: `WorkspaceGuard` proves the
+ * caller belongs to the workspace they named, but nothing upstream proves a
+ * *conversation id* belongs to that user or that workspace — that check has to
+ * live here, or a valid session could pull another member's thread by id.
+ */
+export declare class ConversationRepository {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * This user's threads in this workspace, most recently used first.
+     *
+     * `archived` selects **one of two disjoint sets** rather than widening the
+     * result: archiving means "hide this from the list", so an archived thread
+     * appearing beside its active siblings would defeat the flag entirely.
+     */
+    list(userId: string, workspaceId: string, archived?: boolean): Promise<ConversationView[]>;
+    /**
+     * Renames a thread, files it away, and/or records the model picked for it,
+     * returning the updated row — or `null` when the id is not this user's in
+     * this workspace.
+     *
+     * **`updatedAt` is deliberately not touched.** It means "last used", and the
+     * list sorts by it: bumping it here would send a thread you merely renamed
+     * to the top of the rail, above conversations you actually had since. That
+     * goes double for `modelChoice`, which the client writes as a side effect of
+     * touching a picker — a thread must not climb the rail because someone
+     * looked at its model.
+     *
+     * The ownership predicate is part of the `UPDATE` rather than a read
+     * beforehand, so there is no window between checking and writing — and a
+     * miss is reported as `null` for "not yours" and "no such id" alike, so an
+     * id cannot be probed for existence.
+     */
+    update(conversationId: string, userId: string, workspaceId: string, patch: {
+        title?: string;
+        archived?: boolean;
+        modelChoice?: string;
+    }): Promise<ConversationView | null>;
+    /**
+     * A thread the caller owns, or `null`. Returns null rather than throwing
+     * for "not yours" as well as "no such id" — the two are indistinguishable
+     * to a caller, so an id can't be probed for existence.
+     */
+    find(conversationId: string, userId: string, workspaceId: string): Promise<ConversationView | null>;
+    /** Like {@link find}, but 404s — for routes that need the thread present. */
+    findOrFail(conversationId: string, userId: string, workspaceId: string): Promise<ConversationView>;
+    /**
+     * Tool names this thread has been told to stop asking about.
+     *
+     * Read **per run**, never cached, for the same reason the capability
+     * profile is: the list can grow mid-thread (the user answers "allow for
+     * this chat" on turn three), and a run holding a snapshot from turn one
+     * would ask again for something already answered.
+     */
+    allowedTools(conversationId: string): Promise<string[]>;
+    /**
+     * Adds a tool to this thread's allow list.
+     *
+     * The append happens **in the database**, not by reading and writing back:
+     * two calls in one turn can both be answered "allow for this chat" while
+     * the run is parked, and a read-modify-write would lose one of them.
+     */
+    allowTool(conversationId: string, toolName: string): Promise<void>;
+    /** Starts a thread owned by `userId` in `workspaceId`. */
+    create(userId: string, workspaceId: string, surface: string, firstMessage: string): Promise<ConversationView>;
+    /** One thread's turns, in transcript order. */
+    messages(conversationId: string): Promise<MessageView[]>;
+    /**
+     * Appends a turn and bumps the thread's `updatedAt`.
+     *
+     * The position comes from `max(position) + 1` **computed in SQL**, inside
+     * the same statement as the insert, rather than read into JS and written
+     * back. Two runs in one thread can overlap (a second question asked while
+     * the first is still streaming), and a read-then-write would hand both the
+     * same position.
+     */
+    appendMessage(input: {
+        conversationId: string;
+        runId: string;
+        role: 'user' | 'assistant';
+        content: ModelContentBlock[];
+        attachments?: AttachmentRef[] | null;
+        skills?: SkillRef[] | null;
+        model?: string | null;
+        provider?: string | null;
+        stopReason?: string | null;
+        inputTokens?: number | null;
+        outputTokens?: number | null;
+    }): Promise<{
+        id: string;
+        position: number;
+    }>;
+    /** Writes the audit row for one attempted tool call. */
+    recordToolCall(record: ToolCallRecord): Promise<void>;
+    /** One run's tool calls, oldest first — the UI's step list. */
+    toolCalls(runId: string): Promise<{
+        id: string;
+        conversationId: string;
+        runId: string;
+        callId: string;
+        name: string;
+        input: unknown;
+        outputSummary: string | null;
+        ok: boolean;
+        error: string | null;
+        durationMs: number;
+        createdAt: Date;
+    }[]>;
+}
+//# sourceMappingURL=conversation.repository.d.ts.map

package/dist/lib/chat/infrastructure/persistence/conversation.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversation.repository.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/persistence/conversation.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACX,MAAM,0BAA0B,CAAC;AAMlC,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAmBD,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,WAAW,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACpC,gFAAgF;IAChF,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,qBACa,sBAAsB;IACD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;;OAMG;IACG,IAAI,CACN,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,UAAQ,GACjB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAc9B;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACR,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAuBnC;;;;OAIG;IACG,IAAI,CACN,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAenC,6EAA6E;IACvE,UAAU,CACZ,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;;;;OAOG;IACG,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS7D;;;;;;OAMG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcxE,0DAA0D;IACpD,MAAM,CACR,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACrB,OAAO,CAAC,gBAAgB,CAAC;IAgB5B,+CAA+C;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAoB9D;;;;;;;;OAQG;IACG,aAAa,CAAC,KAAK,EAAE;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAC3B,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACrC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IA4C7C,wDAAwD;IAClD,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D,+DAA+D;IACzD,SAAS,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;CAOhC"}

package/dist/lib/chat/infrastructure/persistence/conversation.repository.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConversationRepository = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const conversations_1 = require("../schema/conversations");
+const messages_1 = require("../schema/messages");
+const tool_calls_1 = require("../schema/tool-calls");
+const derive_title_1 = require("./derive-title");
+/**
+ * The columns every conversation read serves.
+ *
+ * One object rather than four copies: the read shape is `ConversationView`, and
+ * a column added to the table but forgotten in one of the selects is a field
+ * that is present on the list and missing on the detail — which typechecks.
+ */
+const CONVERSATION_COLUMNS = {
+    id: conversations_1.copilotConversations.id,
+    title: conversations_1.copilotConversations.title,
+    surface: conversations_1.copilotConversations.surface,
+    archived: conversations_1.copilotConversations.archived,
+    modelChoice: conversations_1.copilotConversations.modelChoice,
+    createdAt: conversations_1.copilotConversations.createdAt,
+    updatedAt: conversations_1.copilotConversations.updatedAt
+};
+/**
+ * Reads and writes the copilot's transcript.
+ *
+ * **Every method takes the owning `userId` and `workspaceId` and filters on
+ * both.** Not defence in depth for its own sake: `WorkspaceGuard` proves the
+ * caller belongs to the workspace they named, but nothing upstream proves a
+ * *conversation id* belongs to that user or that workspace — that check has to
+ * live here, or a valid session could pull another member's thread by id.
+ */
+let ConversationRepository = class ConversationRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * This user's threads in this workspace, most recently used first.
+     *
+     * `archived` selects **one of two disjoint sets** rather than widening the
+     * result: archiving means "hide this from the list", so an archived thread
+     * appearing beside its active siblings would defeat the flag entirely.
+     */
+    async list(userId, workspaceId, archived = false) {
+        return this.db
+            .select(CONVERSATION_COLUMNS)
+            .from(conversations_1.copilotConversations)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.userId, userId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.workspaceId, workspaceId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.archived, archived)))
+            .orderBy((0, drizzle_orm_1.desc)(conversations_1.copilotConversations.updatedAt));
+    }
+    /**
+     * Renames a thread, files it away, and/or records the model picked for it,
+     * returning the updated row — or `null` when the id is not this user's in
+     * this workspace.
+     *
+     * **`updatedAt` is deliberately not touched.** It means "last used", and the
+     * list sorts by it: bumping it here would send a thread you merely renamed
+     * to the top of the rail, above conversations you actually had since. That
+     * goes double for `modelChoice`, which the client writes as a side effect of
+     * touching a picker — a thread must not climb the rail because someone
+     * looked at its model.
+     *
+     * The ownership predicate is part of the `UPDATE` rather than a read
+     * beforehand, so there is no window between checking and writing — and a
+     * miss is reported as `null` for "not yours" and "no such id" alike, so an
+     * id cannot be probed for existence.
+     */
+    async update(conversationId, userId, workspaceId, patch) {
+        const [row] = await this.db
+            .update(conversations_1.copilotConversations)
+            .set({
+            ...(patch.title !== undefined ? { title: patch.title } : {}),
+            ...(patch.archived !== undefined
+                ? { archived: patch.archived }
+                : {}),
+            ...(patch.modelChoice !== undefined
+                ? { modelChoice: patch.modelChoice }
+                : {})
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.id, conversationId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.userId, userId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.workspaceId, workspaceId)))
+            .returning(CONVERSATION_COLUMNS);
+        return row ?? null;
+    }
+    /**
+     * A thread the caller owns, or `null`. Returns null rather than throwing
+     * for "not yours" as well as "no such id" — the two are indistinguishable
+     * to a caller, so an id can't be probed for existence.
+     */
+    async find(conversationId, userId, workspaceId) {
+        const [row] = await this.db
+            .select(CONVERSATION_COLUMNS)
+            .from(conversations_1.copilotConversations)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.id, conversationId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.userId, userId), (0, drizzle_orm_1.eq)(conversations_1.copilotConversations.workspaceId, workspaceId)))
+            .limit(1);
+        return row ?? null;
+    }
+    /** Like {@link find}, but 404s — for routes that need the thread present. */
+    async findOrFail(conversationId, userId, workspaceId) {
+        const found = await this.find(conversationId, userId, workspaceId);
+        if (!found) {
+            throw new common_1.NotFoundException('Conversation not found.');
+        }
+        return found;
+    }
+    /**
+     * Tool names this thread has been told to stop asking about.
+     *
+     * Read **per run**, never cached, for the same reason the capability
+     * profile is: the list can grow mid-thread (the user answers "allow for
+     * this chat" on turn three), and a run holding a snapshot from turn one
+     * would ask again for something already answered.
+     */
+    async allowedTools(conversationId) {
+        const [row] = await this.db
+            .select({ allowedTools: conversations_1.copilotConversations.allowedTools })
+            .from(conversations_1.copilotConversations)
+            .where((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.id, conversationId))
+            .limit(1);
+        return row?.allowedTools ?? [];
+    }
+    /**
+     * Adds a tool to this thread's allow list.
+     *
+     * The append happens **in the database**, not by reading and writing back:
+     * two calls in one turn can both be answered "allow for this chat" while
+     * the run is parked, and a read-modify-write would lose one of them.
+     */
+    async allowTool(conversationId, toolName) {
+        await this.db
+            .update(conversations_1.copilotConversations)
+            .set({
+            allowedTools: (0, drizzle_orm_1.sql) `(
+                    select coalesce(jsonb_agg(distinct value), '[]'::jsonb)
+                    from jsonb_array_elements(
+                        ${conversations_1.copilotConversations.allowedTools} || ${JSON.stringify([toolName])}::jsonb
+                    ) as value
+                )`
+        })
+            .where((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.id, conversationId));
+    }
+    /** Starts a thread owned by `userId` in `workspaceId`. */
+    async create(userId, workspaceId, surface, firstMessage) {
+        const [row] = await this.db
+            .insert(conversations_1.copilotConversations)
+            .values({
+            userId,
+            workspaceId,
+            surface,
+            title: (0, derive_title_1.deriveTitle)(firstMessage)
+        })
+            // The view's columns, not `returning()`: a bare one hands back the
+            // owner ids and the allow-list too, which is more than any caller of
+            // a `ConversationView` should be holding.
+            .returning(CONVERSATION_COLUMNS);
+        return row;
+    }
+    /** One thread's turns, in transcript order. */
+    async messages(conversationId) {
+        return this.db
+            .select({
+            id: messages_1.copilotMessages.id,
+            runId: messages_1.copilotMessages.runId,
+            role: messages_1.copilotMessages.role,
+            content: messages_1.copilotMessages.content,
+            attachments: messages_1.copilotMessages.attachments,
+            skills: messages_1.copilotMessages.skills,
+            model: messages_1.copilotMessages.model,
+            provider: messages_1.copilotMessages.provider,
+            stopReason: messages_1.copilotMessages.stopReason,
+            position: messages_1.copilotMessages.position,
+            createdAt: messages_1.copilotMessages.createdAt
+        })
+            .from(messages_1.copilotMessages)
+            .where((0, drizzle_orm_1.eq)(messages_1.copilotMessages.conversationId, conversationId))
+            .orderBy((0, drizzle_orm_1.asc)(messages_1.copilotMessages.position));
+    }
+    /**
+     * Appends a turn and bumps the thread's `updatedAt`.
+     *
+     * The position comes from `max(position) + 1` **computed in SQL**, inside
+     * the same statement as the insert, rather than read into JS and written
+     * back. Two runs in one thread can overlap (a second question asked while
+     * the first is still streaming), and a read-then-write would hand both the
+     * same position.
+     */
+    async appendMessage(input) {
+        const nextPosition = (0, drizzle_orm_1.sql) `(
+            select coalesce(max(${messages_1.copilotMessages.position}), 0) + 1
+            from ${messages_1.copilotMessages}
+            where ${messages_1.copilotMessages.conversationId} = ${input.conversationId}
+        )`;
+        const [row] = await this.db
+            .insert(messages_1.copilotMessages)
+            .values({
+            conversationId: input.conversationId,
+            runId: input.runId,
+            role: input.role,
+            content: input.content,
+            // Null rather than `[]` for "none": the column is read as
+            // "did this turn carry files", and an empty array answers that
+            // question with a value that has to be length-checked.
+            attachments: input.attachments?.length
+                ? input.attachments
+                : null,
+            // Null for "none", for the same reason as `attachments`: the
+            // column answers "did this turn run with skills", and an empty
+            // array answers it with a value every reader has to length-check.
+            skills: input.skills?.length ? input.skills : null,
+            model: input.model ?? null,
+            provider: input.provider ?? null,
+            stopReason: input.stopReason ?? null,
+            inputTokens: input.inputTokens ?? null,
+            outputTokens: input.outputTokens ?? null,
+            position: nextPosition
+        })
+            .returning({
+            id: messages_1.copilotMessages.id,
+            position: messages_1.copilotMessages.position
+        });
+        await this.db
+            .update(conversations_1.copilotConversations)
+            .set({ updatedAt: new Date() })
+            .where((0, drizzle_orm_1.eq)(conversations_1.copilotConversations.id, input.conversationId));
+        return row;
+    }
+    /** Writes the audit row for one attempted tool call. */
+    async recordToolCall(record) {
+        await this.db.insert(tool_calls_1.copilotToolCalls).values(record);
+    }
+    /** One run's tool calls, oldest first — the UI's step list. */
+    async toolCalls(runId) {
+        return this.db
+            .select()
+            .from(tool_calls_1.copilotToolCalls)
+            .where((0, drizzle_orm_1.eq)(tool_calls_1.copilotToolCalls.runId, runId))
+            .orderBy((0, drizzle_orm_1.asc)(tool_calls_1.copilotToolCalls.createdAt));
+    }
+};
+exports.ConversationRepository = ConversationRepository;
+exports.ConversationRepository = ConversationRepository = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], ConversationRepository);

package/dist/lib/chat/infrastructure/persistence/derive-title.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Names a thread from its opening message.
+ *
+ * Deliberately **not** a model call: titling is the kind of thing that quietly
+ * doubles the cost and latency of starting a chat, and the first line of what
+ * someone typed is a better title than a summary anyway. Phase 4 can revisit it
+ * when there is a settings surface to make it optional.
+ *
+ * Returns `null` for an effectively empty message, leaving the thread untitled
+ * rather than titled with whitespace.
+ */
+export declare function deriveTitle(message: string): string | null;
+//# sourceMappingURL=derive-title.d.ts.map

package/dist/lib/chat/infrastructure/persistence/derive-title.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-title.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/persistence/derive-title.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkB1D"}

package/dist/lib/chat/infrastructure/persistence/derive-title.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveTitle = deriveTitle;
+/** Longest title we store. Long enough to be recognisable in a list, no more. */
+const MAX_TITLE_LENGTH = 60;
+/**
+ * Names a thread from its opening message.
+ *
+ * Deliberately **not** a model call: titling is the kind of thing that quietly
+ * doubles the cost and latency of starting a chat, and the first line of what
+ * someone typed is a better title than a summary anyway. Phase 4 can revisit it
+ * when there is a settings surface to make it optional.
+ *
+ * Returns `null` for an effectively empty message, leaving the thread untitled
+ * rather than titled with whitespace.
+ */
+function deriveTitle(message) {
+    // Collapse all whitespace first: a pasted multi-line message would
+    // otherwise produce a title with a newline in it, which renders as a
+    // broken row rather than a truncated one.
+    const collapsed = message.replace(/\s+/g, ' ').trim();
+    if (collapsed.length === 0) {
+        return null;
+    }
+    if (collapsed.length <= MAX_TITLE_LENGTH) {
+        return collapsed;
+    }
+    // Prefer cutting at a word boundary, but only if that leaves most of the
+    // budget used — otherwise a single very long word would truncate to almost
+    // nothing.
+    const clipped = collapsed.slice(0, MAX_TITLE_LENGTH);
+    const lastSpace = clipped.lastIndexOf(' ');
+    const cut = lastSpace > MAX_TITLE_LENGTH * 0.6 ? lastSpace : clipped.length;
+    return `${clipped.slice(0, cut).trimEnd()}…`;
+}