@orthacms/copilot-server 0.0.0-reserve.0

package/dist/lib/chat/infrastructure/persistence/proposal.repository.d.ts

@@ -0,0 +1,86 @@
+import { type Database } from '@orthacms/database';
+import type { ProposalChange, ProposalStatus, ProposalTarget } from '@orthacms/copilot-domain';
+/** One proposal as the chat panel and the review queue render it. */
+export interface ProposalView {
+    id: string;
+    conversationId: string;
+    runId: string;
+    toolCallId: string;
+    toolName: string;
+    kind: string;
+    workspaceId: string;
+    createdBy: string;
+    target: ProposalTarget;
+    patch: Readonly<Record<string, unknown>>;
+    summary: string;
+    changes: readonly ProposalChange[] | null;
+    status: ProposalStatus;
+    decidedBy: string | null;
+    decidedAt: Date | null;
+    result: Record<string, unknown> | null;
+    error: string | null;
+    createdAt: Date;
+}
+/** What {@link ProposalRepository.create} writes. */
+export interface NewProposal {
+    conversationId: string;
+    runId: string;
+    toolCallId: string;
+    toolName: string;
+    kind: string;
+    workspaceId: string;
+    createdBy: string;
+    target: ProposalTarget;
+    patch: Readonly<Record<string, unknown>>;
+    summary: string;
+    changes?: readonly ProposalChange[];
+}
+/**
+ * Reads and writes `copilot_proposals`.
+ *
+ * **Every method takes the owning `workspaceId` and filters on it**, for the
+ * same reason `ConversationRepository` does: `WorkspaceGuard` proves the caller
+ * belongs to the workspace they named, but nothing upstream proves a *proposal
+ * id* belongs to that workspace.
+ *
+ * It deliberately does **not** filter by `createdBy`. A proposal is a review
+ * item, not private correspondence: a second editor should be able to accept a
+ * change a colleague's copilot drafted, which is the ordinary case for a review
+ * queue. What bounds that is the accepting user's own permissions, re-resolved
+ * at accept time.
+ */
+export declare class ProposalRepository {
+    private readonly db;
+    constructor(db: Database);
+    /** Persists a new `pending` proposal and returns it. */
+    create(input: NewProposal): Promise<ProposalView>;
+    /** One proposal in this workspace, or null. */
+    find(id: string, workspaceId: string): Promise<ProposalView | null>;
+    /** This workspace's proposals, newest first, optionally by status. */
+    list(workspaceId: string, options?: {
+        status?: ProposalStatus;
+        conversationId?: string;
+    }): Promise<ProposalView[]>;
+    /**
+     * Moves a **pending** proposal to `accepted` or `rejected`, returning the
+     * updated row — or `null` when it was already decided.
+     *
+     * The `status = 'pending'` predicate is the concurrency guard, not a
+     * convenience: two reviewers clicking Accept at the same moment would
+     * otherwise both apply the change. The loser gets `null` and reports that
+     * the proposal was already decided.
+     */
+    decide(id: string, workspaceId: string, status: Exclude<ProposalStatus, 'pending'>, decidedBy: string, result?: Record<string, unknown>): Promise<ProposalView | null>;
+    /** Records what the applier reported on an already-accepted proposal. */
+    recordResult(id: string, workspaceId: string, result: Record<string, unknown>): Promise<ProposalView | null>;
+    /**
+     * Returns a proposal whose apply failed to `pending`, recording why.
+     *
+     * A failed apply is deliberately **not** a status of its own: it is a
+     * proposal that still needs deciding, and a `failed` state would need
+     * something to clear it before a retry could work. Clearing `decidedBy` /
+     * `decidedAt` too keeps the row honest — nobody decided it.
+     */
+    reopen(id: string, workspaceId: string, message: string): Promise<void>;
+}
+//# sourceMappingURL=proposal.repository.d.ts.map

package/dist/lib/chat/infrastructure/persistence/proposal.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal.repository.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/persistence/proposal.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EACR,cAAc,EACd,cAAc,EACd,cAAc,EACjB,MAAM,0BAA0B,CAAC;AAGlC,qEAAqE;AACrE,MAAM,WAAW,YAAY;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,qDAAqD;AACrD,MAAM,WAAW,WAAW;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,kBAAkB;IACG,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D,wDAAwD;IAClD,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;IAqBvD,+CAA+C;IACzC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAczE,sEAAsE;IAChE,IAAI,CACN,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,cAAc,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,YAAY,EAAE,CAAC;IAsB1B;;;;;;;;OAQG;IACG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,EAC1C,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAqB/B,yEAAyE;IACnE,YAAY,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAc/B;;;;;;;OAOG;IACG,MAAM,CACR,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CAiBnB"}

package/dist/lib/chat/infrastructure/persistence/proposal.repository.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProposalRepository = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const proposals_1 = require("../schema/proposals");
+/**
+ * Reads and writes `copilot_proposals`.
+ *
+ * **Every method takes the owning `workspaceId` and filters on it**, for the
+ * same reason `ConversationRepository` does: `WorkspaceGuard` proves the caller
+ * belongs to the workspace they named, but nothing upstream proves a *proposal
+ * id* belongs to that workspace.
+ *
+ * It deliberately does **not** filter by `createdBy`. A proposal is a review
+ * item, not private correspondence: a second editor should be able to accept a
+ * change a colleague's copilot drafted, which is the ordinary case for a review
+ * queue. What bounds that is the accepting user's own permissions, re-resolved
+ * at accept time.
+ */
+let ProposalRepository = class ProposalRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Persists a new `pending` proposal and returns it. */
+    async create(input) {
+        const [row] = await this.db
+            .insert(proposals_1.copilotProposals)
+            .values({
+            conversationId: input.conversationId,
+            runId: input.runId,
+            toolCallId: input.toolCallId,
+            toolName: input.toolName,
+            kind: input.kind,
+            workspaceId: input.workspaceId,
+            createdBy: input.createdBy,
+            target: input.target,
+            patch: input.patch,
+            summary: input.summary,
+            changes: input.changes ?? null,
+            status: 'pending'
+        })
+            .returning();
+        return toView(row);
+    }
+    /** One proposal in this workspace, or null. */
+    async find(id, workspaceId) {
+        const [row] = await this.db
+            .select()
+            .from(proposals_1.copilotProposals)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(proposals_1.copilotProposals.id, id), (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.workspaceId, workspaceId)))
+            .limit(1);
+        return row ? toView(row) : null;
+    }
+    /** This workspace's proposals, newest first, optionally by status. */
+    async list(workspaceId, options = {}) {
+        const rows = await this.db
+            .select()
+            .from(proposals_1.copilotProposals)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(proposals_1.copilotProposals.workspaceId, workspaceId), options.status
+            ? (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.status, options.status)
+            : undefined, options.conversationId
+            ? (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.conversationId, options.conversationId)
+            : undefined))
+            .orderBy((0, drizzle_orm_1.desc)(proposals_1.copilotProposals.createdAt));
+        return rows.map(toView);
+    }
+    /**
+     * Moves a **pending** proposal to `accepted` or `rejected`, returning the
+     * updated row — or `null` when it was already decided.
+     *
+     * The `status = 'pending'` predicate is the concurrency guard, not a
+     * convenience: two reviewers clicking Accept at the same moment would
+     * otherwise both apply the change. The loser gets `null` and reports that
+     * the proposal was already decided.
+     */
+    async decide(id, workspaceId, status, decidedBy, result) {
+        const [row] = await this.db
+            .update(proposals_1.copilotProposals)
+            .set({
+            status,
+            decidedBy,
+            decidedAt: new Date(),
+            result: result ?? null,
+            error: null
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(proposals_1.copilotProposals.id, id), (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.workspaceId, workspaceId), (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.status, 'pending')))
+            .returning();
+        return row ? toView(row) : null;
+    }
+    /** Records what the applier reported on an already-accepted proposal. */
+    async recordResult(id, workspaceId, result) {
+        const [row] = await this.db
+            .update(proposals_1.copilotProposals)
+            .set({ result })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(proposals_1.copilotProposals.id, id), (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.workspaceId, workspaceId)))
+            .returning();
+        return row ? toView(row) : null;
+    }
+    /**
+     * Returns a proposal whose apply failed to `pending`, recording why.
+     *
+     * A failed apply is deliberately **not** a status of its own: it is a
+     * proposal that still needs deciding, and a `failed` state would need
+     * something to clear it before a retry could work. Clearing `decidedBy` /
+     * `decidedAt` too keeps the row honest — nobody decided it.
+     */
+    async reopen(id, workspaceId, message) {
+        await this.db
+            .update(proposals_1.copilotProposals)
+            .set({
+            status: 'pending',
+            decidedBy: null,
+            decidedAt: null,
+            result: null,
+            error: message
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(proposals_1.copilotProposals.id, id), (0, drizzle_orm_1.eq)(proposals_1.copilotProposals.workspaceId, workspaceId)));
+    }
+};
+exports.ProposalRepository = ProposalRepository;
+exports.ProposalRepository = ProposalRepository = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], ProposalRepository);
+/** Row → view, narrowing the jsonb columns to their declared shapes. */
+function toView(row) {
+    return {
+        id: row.id,
+        conversationId: row.conversationId,
+        runId: row.runId,
+        toolCallId: row.toolCallId,
+        toolName: row.toolName,
+        kind: row.kind,
+        workspaceId: row.workspaceId,
+        createdBy: row.createdBy,
+        target: row.target,
+        patch: row.patch,
+        summary: row.summary,
+        changes: row.changes ?? null,
+        status: row.status,
+        decidedBy: row.decidedBy,
+        decidedAt: row.decidedAt,
+        result: row.result ?? null,
+        error: row.error,
+        createdAt: row.createdAt
+    };
+}

package/dist/lib/chat/infrastructure/schema/conversations.d.ts

@@ -0,0 +1,189 @@
+/**
+ * One chat thread, scoped to a **user × workspace**. There is no sharing in
+ * v1: a conversation belongs to the person who started it, and every read is
+ * filtered by both columns, so a valid session for workspace A can never reach
+ * a thread in workspace B.
+ *
+ * Both foreign keys cascade — deleting a user or a workspace takes their
+ * transcripts with it, which is the behaviour a deletion request needs.
+ */
+export declare const copilotConversations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "copilot_conversations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        title: import("drizzle-orm/pg-core").PgColumn<{
+            name: "title";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        surface: import("drizzle-orm/pg-core").PgColumn<{
+            name: "surface";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        archived: import("drizzle-orm/pg-core").PgColumn<{
+            name: "archived";
+            tableName: "copilot_conversations";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        modelChoice: import("drizzle-orm/pg-core").PgColumn<{
+            name: "model_choice";
+            tableName: "copilot_conversations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        allowedTools: import("drizzle-orm/pg-core").PgColumn<{
+            name: "allowed_tools";
+            tableName: "copilot_conversations";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "copilot_conversations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "copilot_conversations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=conversations.d.ts.map

package/dist/lib/chat/infrastructure/schema/conversations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversations.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/schema/conversations.ts"],"names":[],"mappings":"AAWA;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6FhC,CAAC"}

package/dist/lib/chat/infrastructure/schema/conversations.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copilotConversations = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+const external_refs_1 = require("./external-refs");
+/**
+ * One chat thread, scoped to a **user × workspace**. There is no sharing in
+ * v1: a conversation belongs to the person who started it, and every read is
+ * filtered by both columns, so a valid session for workspace A can never reach
+ * a thread in workspace B.
+ *
+ * Both foreign keys cascade — deleting a user or a workspace takes their
+ * transcripts with it, which is the behaviour a deletion request needs.
+ */
+exports.copilotConversations = (0, pg_core_1.pgTable)('copilot_conversations', {
+    /** Primary key. */
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    /** The owning user. Threads are private to them. */
+    userId: (0, pg_core_1.uuid)('user_id')
+        .notNull()
+        .references(() => external_refs_1.users.id, { onDelete: 'cascade' }),
+    /** The workspace the thread's runs are scoped to. */
+    workspaceId: (0, pg_core_1.uuid)('workspace_id')
+        .notNull()
+        .references(() => external_refs_1.workspaces.id, { onDelete: 'cascade' }),
+    /**
+     * Display title. Null until the first turn names it — derived from the
+     * opening user message rather than costing a model call.
+     */
+    title: (0, pg_core_1.text)('title'),
+    /**
+     * Where the thread was started from (`chat`, `palette`, `entry`, …).
+     * Recorded now because a thread continued from an inline entry point
+     * should still render as the surface it came from (design §2).
+     */
+    surface: (0, pg_core_1.text)('surface').notNull().default('chat'),
+    /** Hidden from the list without losing the transcript. */
+    archived: (0, pg_core_1.boolean)('archived').notNull().default(false),
+    /**
+     * The model the person last **picked** for this thread, so reopening it
+     * in another tab — or after a reload — offers the backend they chose
+     * rather than silently falling back to the deployment default.
+     *
+     * A memory, **not a pin**: the run route still takes its provider and
+     * model per turn, so a conversation can start cheap and escalate. What
+     * this column fixes is forgetting the choice, which nobody asked for.
+     *
+     * Three states, and telling the last two apart is the whole reason it is
+     * one nullable text column rather than a `provider`/`model` pair:
+     *
+     * - `null` — nobody has picked on this thread. The client keeps whatever
+     *   its own per-tab memory seeded the chat with.
+     * - `'default'` — the person explicitly picked **Default**, i.e. "let
+     *   the host's resolver decide", which can differ per run. Pinning
+     *   today's default provider instead would silently opt them out of
+     *   that routing.
+     * - `'<provider>:<model>'` — a registered backend, in the same
+     *   `modelChoiceKey` form the picker uses. A provider name cannot
+     *   contain a colon and a model id routinely does, so the **first**
+     *   colon separates the two — and `'default'` has none at all, which is
+     *   what keeps the sentinel unambiguous.
+     *
+     * The value is validated against `ModelRegistry.catalogue()` on write,
+     * so it can only ever name a backend the operator configured.
+     */
+    modelChoice: (0, pg_core_1.text)('model_choice'),
+    /**
+     * Tool names the user answered "allow for this chat" to.
+     *
+     * **On the thread, not on the user**, and that is the whole scope: it
+     * dies when the thread does, so there is no standing permission anyone
+     * has to remember granting or go and revoke. A per-user allow-list
+     * would be a policy outliving its context, which is the shape
+     * [ADR-0009](../../../../../../docs/adr/0009-copilot-applies-directly.md)
+     * just finished removing.
+     *
+     * It is a **usability** memory, never an authority one: every call it
+     * skips the prompt for is still authorized against the caller's live
+     * grants by `ToolRegistry.call`.
+     */
+    allowedTools: (0, pg_core_1.jsonb)('allowed_tools')
+        .notNull()
+        .$type()
+        .default([]),
+    /** Row creation timestamp. */
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+    /**
+     * Bumped on every turn, so the thread list can sort by recency without
+     * joining the messages table.
+     */
+    updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true })
+        .notNull()
+        .defaultNow()
+}, (table) => [
+    // The thread list's exact query: this user's threads in this
+    // workspace, most recently used first.
+    (0, pg_core_1.index)('copilot_conversations_owner_idx').on(table.userId, table.workspaceId, table.updatedAt)
+]);

package/dist/lib/chat/infrastructure/schema/external-refs.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Reference-only projections of tables other plugins own, carrying just the
+ * `id` column this plugin's foreign keys target. Same pattern (and same two
+ * reasons) as `workspaces/server`'s `external-refs.ts`:
+ *
+ *  - the generated copilot migration can emit the cross-context FKs
+ *    `copilot_conversations.user_id → users(id)` and
+ *    `… .workspace_id → workspaces(id)` — the host applies identity's and
+ *    workspaces' migrations first, so both physical tables already exist when
+ *    this one runs; and
+ *  - `drizzle-kit generate` sees a **pure-Drizzle** schema graph. Importing
+ *    another plugin's runtime barrel here would pull its NestJS providers into
+ *    drizzle-kit's esbuild pass, which has no `experimentalDecorators` and
+ *    dies on their parameter decorators.
+ *
+ * Deliberately **not** re-exported from `schema/index.ts`, so drizzle-kit
+ * references these only in the FKs and never emits a duplicate `CREATE TABLE`.
+ */
+export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "users";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const workspaces: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "workspaces";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "workspaces";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=external-refs.d.ts.map

package/dist/lib/chat/infrastructure/schema/external-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-refs.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/schema/external-refs.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;EAEhB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;EAErB,CAAC"}

package/dist/lib/chat/infrastructure/schema/external-refs.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workspaces = exports.users = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+/**
+ * Reference-only projections of tables other plugins own, carrying just the
+ * `id` column this plugin's foreign keys target. Same pattern (and same two
+ * reasons) as `workspaces/server`'s `external-refs.ts`:
+ *
+ *  - the generated copilot migration can emit the cross-context FKs
+ *    `copilot_conversations.user_id → users(id)` and
+ *    `… .workspace_id → workspaces(id)` — the host applies identity's and
+ *    workspaces' migrations first, so both physical tables already exist when
+ *    this one runs; and
+ *  - `drizzle-kit generate` sees a **pure-Drizzle** schema graph. Importing
+ *    another plugin's runtime barrel here would pull its NestJS providers into
+ *    drizzle-kit's esbuild pass, which has no `experimentalDecorators` and
+ *    dies on their parameter decorators.
+ *
+ * Deliberately **not** re-exported from `schema/index.ts`, so drizzle-kit
+ * references these only in the FKs and never emits a duplicate `CREATE TABLE`.
+ */
+exports.users = (0, pg_core_1.pgTable)('users', {
+    id: (0, pg_core_1.uuid)('id').primaryKey()
+});
+exports.workspaces = (0, pg_core_1.pgTable)('workspaces', {
+    id: (0, pg_core_1.uuid)('id').primaryKey()
+});

package/dist/lib/chat/infrastructure/schema/index.d.ts

@@ -0,0 +1,5 @@
+export { copilotConversations } from './conversations';
+export { copilotMessages, copilotMessageRole } from './messages';
+export { copilotToolCalls } from './tool-calls';
+export { copilotProposals } from './proposals';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/chat/infrastructure/schema/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/chat/infrastructure/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/chat/infrastructure/schema/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copilotProposals = exports.copilotToolCalls = exports.copilotMessageRole = exports.copilotMessages = exports.copilotConversations = void 0;
+var conversations_1 = require("./conversations");
+Object.defineProperty(exports, "copilotConversations", { enumerable: true, get: function () { return conversations_1.copilotConversations; } });
+var messages_1 = require("./messages");
+Object.defineProperty(exports, "copilotMessages", { enumerable: true, get: function () { return messages_1.copilotMessages; } });
+Object.defineProperty(exports, "copilotMessageRole", { enumerable: true, get: function () { return messages_1.copilotMessageRole; } });
+var tool_calls_1 = require("./tool-calls");
+Object.defineProperty(exports, "copilotToolCalls", { enumerable: true, get: function () { return tool_calls_1.copilotToolCalls; } });
+var proposals_1 = require("./proposals");
+Object.defineProperty(exports, "copilotProposals", { enumerable: true, get: function () { return proposals_1.copilotProposals; } });